@h-ai/cli 0.1.0-alpha.53 → 0.1.0-alpha.54

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@h-ai/cli",
   "type": "module",
-  "version": "0.1.0-alpha.53",
+  "version": "0.1.0-alpha.54",
   "description": "Hai Framework CLI for project scaffolding and code generation.",
   "license": "Apache-2.0",
   "keywords": [
@@ -26,6 +26,9 @@
   "publishConfig": {
     "access": "public"
   },
+  "engines": {
+    "node": ">=22.12.0"
+  },
   "dependencies": {
     "cac": "^7.0.0",
     "chalk": "^5.4.1",
@@ -34,7 +37,7 @@
     "ora": "^9.1.0",
     "prompts": "^2.4.2",
     "yaml": "^2.7.0",
-    "@h-ai/core": "0.1.0-alpha.53"
+    "@h-ai/core": "0.1.0-alpha.54"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",
@@ -43,7 +46,12 @@
     "rimraf": "^6.1.3",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.7",
+    "@h-ai/deploy": "0.1.0-alpha.54",
+    "@h-ai/reach": "0.1.0-alpha.54",
+    "@h-ai/reldb": "0.1.0-alpha.54",
+    "@h-ai/cache": "0.1.0-alpha.54",
+    "@h-ai/storage": "0.1.0-alpha.54"
   },
   "scripts": {
     "build": "tsup",
@@ -56,6 +64,7 @@
     "test:scaffold-gates": "pnpm build && node tests/run-scaffold-gates.mjs",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
-    "clean": "rimraf dist .turbo"
+    "clean": "rimraf dist .turbo",
+    "build:clean": "rimraf dist"
   }
 }

package/templates/apps/api/apps/{{projectName}}-contract/package.json.hbs

@@ -1,4 +1,5 @@
 {
+  "engines": { "node": ">=22.12.0" },
   "name": "{{api.contractPackageName}}",
   "type": "module",
   "version": "0.1.0",

package/templates/apps/api/apps/{{projectName}}-service/package.json.hbs

@@ -1,4 +1,5 @@
 {
+  "engines": { "node": ">=22.12.0" },
   "name": "{{api.servicePackageName}}",
   "type": "module",
   "version": "0.1.0",

package/templates/apps/api/package.json.hbs

@@ -1,4 +1,5 @@
 {
+  "engines": { "node": ">=22.12.0" },
   "name": "{{projectName}}",
   "type": "module",
   "version": "0.1.0",

package/templates/apps/fullstack/apps/{{projectName}}-app/package.json.hbs

@@ -5,6 +5,7 @@
   "type": "module",
   "version": "0.1.0",
   "private": true,
+  "engines": { "node": ">=22.12.0" },
   "scripts": {
     "paraglide:compile": "paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide",
     "paraglide:watch": "paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide --watch",

package/templates/apps/fullstack/apps/{{projectName}}-desktop/package.json.hbs

@@ -1,6 +1,7 @@
 {{! @skipIfEmpty }}
 {{#if fullstack.frontends.desktop}}
 {
+  "engines": { "node": ">=22.12.0" },
   "name": "{{projectName}}-desktop",
   "type": "module",
   "version": "0.1.0",

package/templates/apps/fullstack/apps/{{projectName}}-web/package.json.hbs

@@ -5,6 +5,7 @@
   "type": "module",
   "version": "0.1.0",
   "private": true,
+  "engines": { "node": ">=22.12.0" },
   "scripts": {
     "paraglide:compile": "paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide",
     "paraglide:watch": "paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide --watch",

package/templates/apps/fullstack/package.json.hbs

@@ -1,4 +1,5 @@
 {
+  "engines": { "node": ">=22.12.0" },
   "name": "{{projectName}}",
   "type": "module",
   "version": "0.1.0",

package/templates/apps/fullstack/packages/{{projectName}}-contract/package.json.hbs

@@ -1,4 +1,5 @@
 {
+  "engines": { "node": ">=22.12.0" },
   "name": "{{fullstack.contractPackageName}}",
   "type": "module",
   "version": "0.1.0",

package/templates/apps/fullstack/packages/{{projectName}}-serv/package.json.hbs

@@ -1,4 +1,5 @@
 {
+  "engines": { "node": ">=22.12.0" },
   "name": "{{fullstack.servPackageName}}",
   "type": "module",
   "version": "0.1.0",

package/templates/apps/fullstack/packages/{{projectName}}-shared/package.json.hbs

@@ -1,4 +1,5 @@
 {
+  "engines": { "node": ">=22.12.0" },
   "name": "{{fullstack.sharedPackageName}}",
   "type": "module",
   "version": "0.1.0",

package/templates/base/eslint.config.js.hbs

@@ -24,6 +24,7 @@ export default antfu({
     '**/README.md',
     '**/opencode.json',
     '**/package.json',
+    '**/pnpm-workspace.yaml',
   ],
   svelte: true,
 }, {

package/templates/base/package.json.hbs

@@ -1,7 +1,9 @@
 {
+  "engines": { "node": ">=22.12.0" },
   "name": "{{projectName}}",
-  "version": "0.1.0-alpha.53",
+  "version": "0.1.0-alpha.54",
   "private": true,
+  "packageManager": "pnpm@9.15.0",
   "description": "{{#if_eq appType 'admin'}}Enterprise management system built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'website'}}Enterprise website built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'h5'}}Mobile H5 app built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'api'}}REST API service built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'mobile-app'}}Mobile app built with hai Agent Framework{{/if_eq}}",
   "keywords": ["hai", {{#unless isSvelteOnlyApp}}"sveltekit", {{/unless}}"svelte5", "{{appType}}"],
   "license": "Apache-2.0",

package/templates/skills/hai-ai/reference.md

@@ -71,6 +71,8 @@ await mcp.connect(new StdioServerTransport())
 
 ### `ai.mcp`
 
+这是进程内注册表，不会自动绑定独立 MCP Server 的 transport。工具注册时编译 JSON Schema、调用时校验输入；非法输入不执行 handler。资源必须恰好含 text/blob 之一；提示词必填参数必须是自身字符串属性，输出使用 SDK 消息类型（含 image/audio）。同名注册覆盖，缺失 requestId 自动补 UUID。已移除未使用的 MCPProvider 与 AIMCPFunctionsDeps 类型；使用 MCPOperations 即可。
+
 | 方法 | 说明 |
 | --- | --- |
 | `registerTool(definition, handler)` | 注册内置工具 |
@@ -212,7 +214,9 @@ const result = await ai.rag.query('核心架构是什么？', {
 | `listMessages(filter)` | 查询 A2A 消息记录 |
 | `callRemoteAgent(remoteUrl, message, options?)` | 调用远端 Agent；只依赖 `ai.init()`，不要求本地 executor |
 
-A2A 服务端 SDK handler 在注册 executor 时延迟创建；远端客户端调用不依赖服务端配置。
+A2A 服务端 SDK handler 在注册 executor 时延迟创建；远端客户端调用不依赖服务端配置。getAgentCard 返回完整 A2A 0.3 Card（MIME、streaming、安全方案）；Kit 默认发现路径为 `/.well-known/agent-card.json`。handleRequest 在未初始化时也返回 JSON-RPC 错误；可信 context.agentId 映射 SDK user.userName。Kit 配置 authenticate 后空身份返回 401；不声明 push notifications、gRPC、REST 支持。
+
+A2A 的任务表和消息表在 `ai.init()` 阶段初始化。任务按可信 `agentId` 隔离读取（含获取、取消和继续消息）；匿名请求共享匿名作用域，需隔离的部署必须开启认证。`listMessages` 是服务端管理接口，支持 `callerId`、`contextId`、`since` 过滤，不能直接向未授权客户端暴露。旧版任务记录没有可靠主体信息，升级后不会自动推断归属或删除数据，需由应用审核后迁移 `object_id` 为 `user:<agentId>`（匿名为 `anonymous`）。旧消息缺少主体/上下文字段时不会匹配相应过滤条件。
 
 `callRemoteAgent` 只接受 HTTP(S) 且拒绝 URL 内嵌凭据。该校验不是完整 SSRF 防护：remote URL 若来自外部输入，应用必须先按 origin 白名单过滤，并通过出口代理限制 DNS 重绑定、重定向到私网与云元数据地址。
 

package/templates/skills/hai-app-review/SKILL.md

@@ -63,6 +63,8 @@ description: 对应用代码进行审查：路由安全 → 认证授权 → i18
 
 ### HaiResult 处理
 
+- [ ] 投递等业务状态按 `sent` 等字段判断，失败保留用户输入；HTTP/HaiResult 成功不代替业务完成
+
 - [ ] 所有框架模块调用都检查 `result.success`
 - [ ] 上游 HaiResult 错误直接透传，不重新包装
 - [ ] 不使用 `try/catch` 来处理框架模块返回的错误（模块 API 不抛异常，统一返回 `HaiResult<T>`）
@@ -179,3 +181,7 @@ if (!result.success)
 - `hai-build`：项目架构总览与 TDD 工作流导航
 - `hai-app-create`：TDD 驱动的应用功能创建规范
 - `hai-app-tests`：TDD 测试规范（Red 阶段详细指引）
+
+管理端数据读取在 HTTP 应用边界保留失败：查询异常返回 503 和可刷新错误页，分页任一页或权限关联失败均中止加载，禁止回退为空列表、零统计或空权限。未知权限代码返回 400，权限读取失败时不得继续写入。底层模块仍使用 HaiResult。
+
+失败与降级提示也必须国际化：官网 API 按请求 locale 生成 AI 降级/邮件送达状态；未送达不能称为已接收。CLI 部署状态使用 cliM，Gallery 加密能力限制使用双语消息。中文与英文分别验证未配置、失败和成功路径，无需调用付费服务。

package/templates/skills/hai-build/SKILL.md

@@ -7,6 +7,12 @@ description: 应用开发入口技能。提供项目架构总览（SSR/SPA/原
 
 ## 能力契约
 
+框架开发、CLI、服务端最低 Node.js 版本统一为 22.12.0；包与脚手架 engines、共享 node22 编译目标和 CI 最低版本必须同步。不再按 Node 20 编写兼容分支。
+
+tsup 包的 Turbo `build` 依赖不缓存的 `build:clean`（仅清本包 dist），再执行构建或恢复缓存。不要移除此步骤：Turbo 缓存恢复不会自动移除另一模式的多余文件。
+
+使用 Turbo 时，影响构建的环境变量必须进入任务 `env`，共享构建配置进入 `globalDependencies`。框架的 `HAI_DOCKER_PROD_BUILD=true` 关闭声明和 sourcemap，应与普通构建使用不同缓存；PUBLIC/VITE/TAURI 变量同样参与构建缓存。切换后验证实际产物并恢复普通开发构建。
+
 | 项目 | 契约 |
 | --- | --- |
 | 能力 | 应用开发入口技能。提供项目架构总览（SSR/SPA/原生 App 多端）、TDD 开发工作流、模块初始化顺序与技能导航。当用户需要了解项目结构、查找正确的技能、或开始新任务时触发。 |
@@ -342,3 +348,5 @@ pnpm test         # Vitest 单元测试
 3. `pnpm test` 通过（单元测试）
 4. `pnpm --filter <app-name> test:e2e` 通过（E2E 测试）
 5. 搜索确认所有引用点已更新
+
+原生交付必须单独执行 Tauri/Gradle/Xcode 打包，并在目标 OS/设备验证安装启动、登录/退出、重启会话、安全 TokenStore、真实 API 域名与覆盖升级。Web 构建/E2E 不代替原生验收。保存提交、包 hash、平台/工具链及逐项结果；缺平台写未验证，禁止静默 skip。hai-framework 仓库参考 `.github/workflows/native.yml` 与 desktop-app / mobile-app README 的「原生交付与验收」章节。

package/templates/skills/hai-cache/SKILL.md

@@ -17,6 +17,8 @@ description: 使用 @h-ai/cache 进行内存或 Redis 缓存操作（kv/hash/lis
 
 > `@h-ai/cache` 提供统一缓存接口，支持 Memory 与 Redis 后端，包含 KV / Hash / List / Set / ZSet / 分布式锁 六类操作。
 
+内存 KV 在到期时间点即失效。整数计数器拒绝 null/boolean/array、非整数增量和安全整数溢出，失败不修改原值；Hash 的 `__proto__` / `constructor` 名称按普通字段保留。
+
 ---
 
 ## 运行环境

package/templates/skills/hai-capacitor/SKILL.md

@@ -377,3 +377,5 @@ async function captureAndUpload() {
 - `hai-api-client`：HTTP 客户端（Token 管理依赖 capacitor 存储）
 - `hai-iam`：认证流程（登录获取 Token → 存储到 Capacitor）
 - `hai-ui`：移动端 UI 组件（SafeArea、BottomNav 等）
+
+原生交付必须单独执行 Tauri/Gradle/Xcode 打包，并在目标 OS/设备验证安装启动、登录/退出、重启会话、安全 TokenStore、真实 API 域名与覆盖升级。Web 构建/E2E 不代替原生验收。保存提交、包 hash、平台/工具链及逐项结果；缺平台写未验证，禁止静默 skip。hai-framework 仓库参考 `.github/workflows/native.yml` 与 desktop-app / mobile-app README 的「原生交付与验收」章节。

package/templates/skills/hai-ci/SKILL.md

@@ -7,6 +7,15 @@ description: 设计和维护 hai-framework 应用仓库的 CI/CD、GitHub Action
 
 ## 能力契约
 
+框架完整质量门禁在 Node.js 22.12.0（声明的最低版本）执行；升级 engines 时同步 CI、README 和脚手架，不能只在更高版本通过后宣称最低版本通过。
+
+框架发布通过实际 npm 精确版本和 GitHub Release 判断完成，不能只看 tag。部分失败重跑原提交，只补发缺失包；npm 全部成功后再建 tag/Release。查询异常与 404 必须区分，tag 指向其他提交时停止补发，禁止将新源码混入旧版本。
+
+
+Turbo 的 `build.env` 必须列出影响产物的变量；框架包含容器构建开关、E2E 构建模式及 PUBLIC/VITE/TAURI 前缀，共享 tsup 配置也纳入依赖。Docker/Testcontainers 连接变量通过测试任务透传。验证缓存须切换变量检查哈希和真实产物，不能只检查配置文本。
+
+框架仓库发布验收使用 `pnpm test:release-local`；其 E2E 与 CI 共用根 `pnpm e2e`，覆盖 CLI 和全部 Web 应用，不能缩减为仅 Admin Console。应用仓库应在自己的根 E2E 命令集中维护所有端到端入口。容器和原生验收须独立记录实际结果。
+
 | 项目 | 契约 |
 | --- | --- |
 | 能力 | 设计和维护 hai-framework 应用仓库的 CI/CD、GitHub Actions、质量门禁、secret scan 与 workflow 安全；当需求涉及 CI、GitHub Actions、required checks、泄漏扫描或 release workflow 编排时使用。 |
@@ -120,3 +129,6 @@ pnpm build
 - `hai-pr-review` — PR 审查与 AI Review 策略
 - `hai-deploy` — 应用部署与云服务开通
 - `hai-framework-sync` — hai-framework 与应用仓库同步策略
+
+发布完成判定始终查询根版本的 npm 包；发布 job 同步包版本但不提交，标签固定指向触发质量验收的源码提交。发布成功后由独立 job 提交版本同步；完整重跑即使无需补发也会执行同步，远端已存在相同内容时成功退出，分支有新源码时拒绝覆盖并要求从最新 main 重跑。
+原生交付必须单独执行 Tauri/Gradle/Xcode 打包，并在目标 OS/设备验证安装启动、登录/退出、重启会话、安全 TokenStore、真实 API 域名与覆盖升级。Web 构建/E2E 不代替原生验收。保存提交、包 hash、平台/工具链及逐项结果；缺平台写未验证，禁止静默 skip。hai-framework 仓库参考 `.github/workflows/native.yml` 与 desktop-app / mobile-app README 的「原生交付与验收」章节。

package/templates/skills/hai-core/SKILL.md

@@ -572,3 +572,5 @@ logger.debug('Data fetched', { count: items.length })
 | `redact` 字段脱敏 | 不生效（需手动脱敏） |
 | `fatal` 级别 | 映射为 `console.error`（带 `[FATAL]` 前缀） |
 | context 输出 | JSON 字符串追加到消息末尾（非结构化对象） |
+
+云资源配置消费：Neon 输出 HAI_DB（PostgreSQL JSON），Upstash 输出 HAI_CACHE（Redis rediss URL JSON），R2 输出 HAI_STORAGE（扁平 S3 JSON）。邮件/短信输出 HAI_REACH_PROVIDERS 数组，deployApp 合并两个渠道并保留 YAML 中的消息模板；此覆盖替换原 providers 数组。Core 支持整体对象/数组覆盖，父节点优先于叶子变量，仍执行 Schema 校验；构建子进程与目标运行环境使用相同开通结果。R2 必须提供已有 S3 accessKeyId/secretAccessKey；Resend 必须提供已验证域名的 from；阿里云必须提供已审核 signName/模板。应用须已有相应 _db/_cache/_storage/_reach.yml 并在启动时加载，网络客户端需要 Node 运行时。

package/templates/skills/hai-crypto/SKILL.md

@@ -281,3 +281,5 @@ if (verifyResult.success && verifyResult.data) {
 - `hai-iam`：密码哈希（内部自动调用 crypto.password）
 - `hai-kit`：SvelteKit 集成（传输加密）
 - `hai-serv` / `hai-api-client`：跨域 HTTP API 的透明传输加密
+
+管理端在线加密演示直接调用 Crypto SM3/SM4 API，SM4 使用随机临时密钥和 IV，并在显示成功前解密校验；密钥不保存。输入改变即清空旧结果，禁止用随机摘要或 Base64 伪装算法结果。

package/templates/skills/hai-deploy/SKILL.md

@@ -7,6 +7,8 @@ description: 使用 @h-ai/deploy 进行自动化部署：Vercel 部署 + 基础
 
 ## 能力契约
 
+`hai deploy` 在模块/配置缺失或凭证、扫描、初始化、部署、关闭失败时返回非零退出码。自动化流程必须以退出码判断成功，不要只判断命令是否完成或是否输出日志。
+
 | 项目 | 契约 |
 | --- | --- |
 | 能力 | 使用 @h-ai/deploy 进行自动化部署：Vercel 部署 + 基础设施开通（Neon/Upstash/R2/Resend/Aliyun）；当需求涉及应用部署、环境配置、凭证管理或云服务开通时使用。 |
@@ -57,13 +59,17 @@ services:
     provisioner: cloudflare-r2
     accountId: ${HAI_DEPLOY_CF_ACCOUNT_ID}
     apiToken: ${HAI_DEPLOY_CF_API_TOKEN}
+    accessKeyId: ${HAI_DEPLOY_R2_ACCESS_KEY_ID}
+    secretAccessKey: ${HAI_DEPLOY_R2_SECRET_ACCESS_KEY}
   email:
     provisioner: resend
     apiKey: ${HAI_DEPLOY_RESEND_API_KEY}
+    from: ${HAI_DEPLOY_RESEND_FROM}
   sms:
     provisioner: aliyun
     accessKeyId: ${HAI_DEPLOY_ALIYUN_ACCESS_KEY_ID}
     accessKeySecret: ${HAI_DEPLOY_ALIYUN_ACCESS_KEY_SECRET}
+    signName: ${HAI_DEPLOY_ALIYUN_SIGN_NAME}
 ```
 
 这些凭证名由 `deploy.credentials` 管理，属于显式特殊映射；若同时设置
@@ -230,3 +236,9 @@ const result = await deploy.deployApp('./apps/my-app')
 - **hai-core** — 配置加载、日志、HaiResult 类型
 - **hai-reldb** — 数据库（Neon PostgreSQL）
 - **hai-cache** — 缓存（Upstash Redis）
+
+失败与降级提示也必须国际化：官网 API 按请求 locale 生成 AI 降级/邮件送达状态；未送达不能称为已接收。CLI 部署状态使用 cliM，Gallery 加密能力限制使用双语消息。中文与英文分别验证未配置、失败和成功路径，无需调用付费服务。
+
+云资源配置消费：Neon 输出 HAI_DB（PostgreSQL JSON），Upstash 输出 HAI_CACHE（Redis rediss URL JSON），R2 输出 HAI_STORAGE（扁平 S3 JSON）。邮件/短信输出 HAI_REACH_PROVIDERS 数组，deployApp 合并两个渠道并保留 YAML 中的消息模板；此覆盖替换原 providers 数组。Core 支持整体对象/数组覆盖，父节点优先于叶子变量，仍执行 Schema 校验；构建子进程与目标运行环境使用相同开通结果。R2 必须提供已有 S3 accessKeyId/secretAccessKey；Resend 必须提供已验证域名的 from；阿里云必须提供已审核 signName/模板。应用须已有相应 _db/_cache/_storage/_reach.yml 并在启动时加载，网络客户端需要 Node 运行时。
+
+部署失败恢复：`ProvisionResult.resourceStatus` 标记 created/reused；`getDeployRecovery(result.error)` 读取 projectName、stage、platformProjectId 和资源清单，unknown 表示请求结果不确定，必须先在服务商控制台核对。失败资源已返回 ID 时保留该 ID。恢复结果不含 envVars、原始异常或连接凭证，CLI 会展示清单和建议。同名重试复用现有资源；不自动删除复用资源，新建资源仅在人工确认未被使用后清理。

package/templates/skills/hai-iam/SKILL.md

@@ -7,6 +7,12 @@ description: 使用 @h-ai/iam 进行身份认证（密码/OTP/LDAP/API Key）、
 
 ## 能力契约
 
+角色成员数使用 `getRoleUserCounts(roleIds)`，一次聚合返回 `HaiResult<Map<string, number>>`；成功时无关联为 0，失败必须展示错误，不能伪造零值。
+
+角色资料和权限必须通过 `createRole({ ..., permissionIds })` / `updateRole(id, { ..., permissionIds })` 一次事务保存，禁止在应用层并行增删权限模拟替换。空数组清空、未传保持、未知权限失败、重复 ID 去重；并发以最后提交的完整集合为准。自管事务提交后同步会话，外部事务由调用方提交后同步。
+
+管理界面自动创建角色时使用 `role_${core.id.generate()}` 生成 code，显示名称独立保存；不要通过移除中文、表情或折叠大小写生成标识。重命名不重建 code。
+
 | 项目 | 契约 |
 | --- | --- |
 | 能力 | 使用 @h-ai/iam 进行身份认证（密码/OTP/LDAP/API Key）、统一 Bearer Token 管理（TokenPair/refresh/revoke）与 RBAC 授权；当需求涉及登录、注册、权限检查、角色管理、Token 认证或通过 @h-ai/api-contract 暴露 IAM API 时使用。 |

package/templates/skills/hai-scheduler/SKILL.md

@@ -7,6 +7,16 @@ description: 使用 @h-ai/scheduler 进行统一定时任务管理、任务持
 
 ## 能力契约
 
+持久化动态任务每个 `tickInterval`（默认 1000ms）在运行节点刷新；API 操作及获锁后的每次尝试重读定义，读取失败或任务已禁用/删除/改期时中断执行。`tasks` 仅表示最近成功刷新快照，已开始的外部副作用不会回滚。跨节点任务使用 `register()` 与共享数据库、Redis；`init({ tasks })` 是节点本地配置，memory cache 不支持跨进程防重。
+
+关闭必须 `await scheduler.close()` 后再关闭数据库和缓存：关闭会拒绝新任务、取消 HTTP/Worker/重试并等待执行链退出。生命周期回调通过事件 `signal` 协作取消，必须自行停止外部副作用，禁止在 Hook 阻塞主线程。旧任务取消后不重试、不删除新实例同 ID 的任务。
+
+JS 任务每次调用独立 Worker，默认 30000 毫秒期限包含线程启动；超时后等待线程终止才返回失败或重试，同步死循环不会占用主事件循环。上下文和结果须支持结构化克隆。Worker/vm 不构成安全沙箱，仍只接受受信任的服务端代码。
+
+初始化为全有或全无：必须检查 `init()` 的 HaiResult。空 ID、重复 ID（包括与数据库记录重复）、无效 cron、持久化读取或解析失败均使初始化失败并清理状态；修正后重试，不会静默跳过任务。
+
+API 任务 `timeout` 默认 30000 毫秒，覆盖请求及完整响应体读取；`maxResponseBytes` 指定实际接收字节上限（正安全整数，默认 1048576 即 1 MiB），例如 `maxResponseBytes: 10 * 1024 * 1024` 允许最大 10 MiB；非法值在请求前失败。超时、超限和非成功 HTTP 状态均失败，重试由任务 retry 策略控制。
+
 | 项目 | 契约 |
 | --- | --- |
 | 能力 | 使用 @h-ai/scheduler 进行统一定时任务管理、任务持久化、手工触发、触发来源审计、全局生命周期回调与执行日志查询；当需求涉及 cron 调度、JS 函数字符串任务、API 任务、分布式锁或任务事件回调时使用。 |
@@ -198,3 +208,5 @@ await scheduler.init({
 | `HaiSchedulerError.LOCK_ACQUIRE_FAILED` | `hai:scheduler:029` | 锁获取失败 |
 | `HaiSchedulerError.JS_COMPILE_FAILED` | `hai:scheduler:030` | JS 编译失败 |
 | `HaiSchedulerError.HOOK_EXECUTION_FAILED` | `hai:scheduler:031` | Hook 执行失败 |
+
+调度循环按分钟时间点匹配 cron，并用同一分钟生成分布式锁键；启动或 tick 延迟至非零秒仍检查当前分钟，同一轮运行不会每个 tick 重复调度。

package/templates/skills/hai-ui/SKILL.md

@@ -41,6 +41,10 @@ description: 使用 @h-ai/ui 构建多端应用界面，包含三层组件架构
 
 ## 使用边界
 
+- 加密输入变更会清空密文，乱序/清空/卸载后的旧结果不会回填；失败显示错误。提交前确认当前密文非空，不缓存上次密文。
+
+- `EncryptedInput` 的 `onencrypt` 必须接入真实加密服务；`algorithm` 仅标注算法。缺少回调时显示不可用，不生成密文，不允许用编码代替加密。
+
 - **优先复用 `@h-ai/ui` 现有组件**，不要在 app 中重复实现同类按钮、表格、表单、弹层或场景页面。
 - **页面级文案与业务逻辑放在应用层**；`@h-ai/ui` 负责展示与交互，不承接业务服务、数据库访问或页面级 i18n 管理。
 - **场景组件自带内置中英文文案**（如 IAM / CRUD / AI / Storage 场景），除非组件显式提供覆盖 prop，否则不要把页面翻译样板再传进去。

package/dist/chunk-U4PA632G.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/commands/cli-config-templates.ts"],"names":[],"mappings":";;AAgBO,SAAS,kBAAA,CAAmB,WAAmB,OAAA,EAAiC;AACrF,EAAA,QAAQ,SAAA;AAAW,IACjB,KAAK,MAAA;AACH,MAAA,OAAO,kBAAA,CAAmB,SAAS,IAAI,CAAA;AAAA,IACzC,KAAK,MAAA;AACH,MAAA,OAAO,kBAAA,EAAmB;AAAA,IAC5B,KAAK,IAAA;AACH,MAAA,OAAO,gBAAA,CAAiB,SAAS,EAAE,CAAA;AAAA,IACrC,KAAK,OAAA;AACH,MAAA,OAAO,mBAAA,CAAoB,SAAS,KAAK,CAAA;AAAA,IAC3C,KAAK,KAAA;AACH,MAAA,OAAO,iBAAA,CAAkB,SAAS,GAAG,CAAA;AAAA,IACvC,KAAK,SAAA;AACH,MAAA,OAAO,qBAAA,CAAsB,SAAS,OAAO,CAAA;AAAA,IAC/C,KAAK,IAAA;AACH,MAAA,OAAO,gBAAA,CAAiB,SAAS,EAAE,CAAA;AAAA,IACrC,KAAK,QAAA;AACH,MAAA,OAAO,oBAAA,EAAqB;AAAA,IAC9B,KAAK,OAAA;AACH,MAAA,OAAO,mBAAA,EAAoB;AAAA,IAC7B,KAAK,OAAA;AACH,MAAA,OAAO,mBAAA,EAAoB;AAAA,IAC7B,KAAK,WAAA;AACH,MAAA,OAAO,uBAAA,EAAwB;AAAA,IACjC,KAAK,OAAA;AACH,MAAA,OAAO,mBAAA,EAAoB;AAAA,IAC7B,KAAK,SAAA;AACH,MAAA,OAAO,qBAAA,EAAsB;AAAA,IAC/B;AACE,MAAA,OAAO,KAAK,SAAS,CAAA;AAAA,CAAA;AAAA;AAE3B;AAEA,SAAS,mBAAmB,GAAA,EAAgC;AAC1D,EAAA,MAAM,IAAA,GAAO,KAAK,IAAA,IAAQ,QAAA;AAC1B,EAAA,MAAM,MAAA,GAAS,KAAK,aAAA,IAAiB,OAAA;AACrC,EAAA,MAAM,gBAAA,GAAmB,WAAW,OAAA,GAChC,CAAA;AAAA,SAAA,CAAA,GACA,CAAA;AAAA,SAAA,CAAA;AAEJ,EAAA,OAAO,CAAA;AAAA;AAAA;;AAAA,MAAA,EAID,IAAI;AAAA;AAAA;AAAA;;AAAA,eAAA,EAKK,MAAM;AAAA;AAAA,EAErB,gBAAgB;AAAA,CAAA;AAElB;AAEA,SAAS,kBAAA,GAA6B;AACpC,EAAA,OAAO,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA,CAAA;AAkBT;AAEA,SAAS,iBAAiB,GAAA,EAA8B;AACtD,EAAA,MAAM,MAAA,GAAS,KAAK,IAAA,IAAQ,QAAA;AAC5B,EAAA,MAAM,QAAA,GAAW,GAAA,EAAK,QAAA,KAAa,MAAA,KAAW,WAAW,eAAA,GAAkB,KAAA,CAAA;AAC3E,EAAA,MAAM,IAAA,GAAO,KAAK,IAAA,IAAQ,WAAA;AAC1B,EAAA,MAAM,IAAA,GAAO,GAAA,EAAK,IAAA,KAAS,MAAA,KAAW,eAAe,IAAA,GAAO,IAAA,CAAA;AAE5D,EAAA,IAAI,WAAW,QAAA,EAAU;AACvB,IAAA,OAAO,CAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA,UAAA,EAQC,QAAQ;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EAQlB;AAEA,EAAA,MAAM,IAAA,GAAO,MAAA,KAAW,YAAA,GAAe,UAAA,GAAa,MAAA;AAEpD,EAAA,OAAO,CAAA;AAAA;AAAA;;AAAA;AAAA,MAAA,EAKD,MAAM;;AAAA;AAAA,UAAA,EAGF,QAAQ;;AAAA;AAAA,MAAA,EAGZ,IAAI;AAAA,MAAA,EACJ,IAAI;AAAA,MAAA,EACJ,IAAI;AAAA;AAAA,CAAA;AAGZ;AAEA,SAAS,oBAAoB,GAAA,EAAiC;AAC5D,EAAA,MAAM,SAAA,GAAY,KAAK,IAAA,IAAQ,QAAA;AAE/B,EAAA,IAAI,cAAc,QAAA,EAAU;AAC1B,IAAA,OAAO,CAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EAcT;AAEA,EAAA,MAAM,IAAA,GAAO,KAAK,IAAA,IAAQ,WAAA;AAC1B,EAAA,MAAM,IAAA,GAAO,KAAK,IAAA,IAAQ,IAAA;AAE1B,EAAA,OAAO,CAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA,MAAA,EAQD,IAAI;AAAA,MAAA,EACJ,IAAI;AAAA;AAAA;AAAA,CAAA;AAIZ;AAEA,SAAS,kBAAkB,GAAA,EAA+B;AACxD,EAAA,MAAM,aAAA,GAAgB,KAAK,aAAA,IAAiB,IAAA;AAC5C,EAAA,MAAM,QAAA,GAAW,KAAK,QAAA,IAAY,KAAA;AAElC,EAAA,OAAO,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA,YAAA,EAMK,aAAa;AAAA,OAAA,EAClB,QAAQ;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA,CAAA;AA0BjB;AAEA,SAAS,sBAAsB,GAAA,EAAmC;AAChE,EAAA,MAAM,WAAA,GAAc,KAAK,IAAA,IAAQ,OAAA;AAEjC,EAAA,IAAI,gBAAgB,OAAA,EAAS;AAC3B,IAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,gBAAA;AACpC,IAAA,OAAO,CAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA,UAAA,EAWC,SAAS;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EAanB;AAEA,EAAA,OAAO,CAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAwBT;AAEA,SAAS,iBAAiB,GAAA,EAA8B;AACtD,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,aAAA;AAI5B,EAAA,OAAO,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAA,EAWE,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAqBhB;AASO,SAAS,kBAAA,CAAmB,UAAuB,OAAA,EAAiC;AACzF,EAAA,MAAM,WAAqB,EAAC;AAG5B,EAAA,QAAA,CAAS,IAAA,CAAK,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+EAAA,CAQgE,CAAA;AAG9E,EAAA,QAAA,CAAS,IAAA,CAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAA,CAOK,CAAA;AAGnB,EAAA,IAAI,QAAA,CAAS,QAAA,CAAS,IAAI,CAAA,EAAG;AAC3B,IAAA,MAAM,MAAA,GAAS,OAAA,EAAS,EAAA,EAAI,IAAA,IAAQ,QAAA;AACpC,IAAA,MAAM,aAAa,OAAA,EAAS,EAAA,EAAI,QAAA,KAAa,MAAA,KAAW,WAAW,eAAA,GAAkB,KAAA,CAAA;AACrF,IAAA,MAAM,WAAW,MAAA,KAAW,QAAA;AAC5B,IAAA,QAAA,CAAS,IAAA,CAAK;AAAA;AAAA;AAAA;AAAA;AAAA,YAAA,EAKJ,MAAM;AAAA;AAAA,gBAAA,EAEF,UAAU,GAAG,QAAA,GAC3B;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAA,CAAA,GAMA;AAAA;AAAA,YAAA,EAEU,OAAA,EAAS,EAAA,EAAI,IAAA,IAAQ,WAAW;AAAA,YAAA,EAChC,SAAS,EAAA,EAAI,IAAA,KAAS,MAAA,KAAW,YAAA,GAAe,OAAO,IAAA,CAAK;AAAA,YAAA,EAC5D,MAAA,KAAW,YAAA,GAAe,UAAA,GAAa,MAAM;AAAA,gBAAA,CAC1C,CAAA,CAAE,CAAA;AAAA,EACjB;AAGA,EAAA,IAAI,QAAA,CAAS,QAAA,CAAS,KAAK,CAAA,EAAG;AAC5B,IAAA,QAAA,CAAS,IAAA,CAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAQjB,CAAA;AAAA,EACC;AAGA,EAAA,IAAI,QAAA,CAAS,QAAA,CAAS,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,SAAA,GAAY,OAAA,EAAS,KAAA,EAAO,IAAA,IAAQ,QAAA;AAC1C,IAAA,IAAI,cAAc,OAAA,EAAS;AACzB,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,eAAA,EAOH,OAAA,EAAS,KAAA,EAAO,IAAA,IAAQ,WAAW;AAAA,eAAA,EACnC,OAAA,EAAS,KAAA,EAAO,IAAA,IAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2BAAA,CAMjB,CAAA;AAAA,IACxB,CAAA,MACK;AACH,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2BAAA,CAcQ,CAAA;AAAA,IACxB;AAAA,EACF;AAGA,EAAA,IAAI,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA,EAAG;AAChC,IAAA,MAAM,WAAA,GAAc,OAAA,EAAS,OAAA,EAAS,IAAA,IAAQ,OAAA;AAC9C,IAAA,IAAI,gBAAgB,IAAA,EAAM;AACxB,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iDAAA,CAc8B,CAAA;AAAA,IAC9C,CAAA,MACK;AACH,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iCAAA,EAOe,OAAA,EAAS,OAAA,EAAS,SAAA,IAAa,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+CAAA,CAOlC,CAAA;AAAA,IAC5C;AAAA,EACF;AAGA,EAAA,IAAI,QAAA,CAAS,QAAA,CAAS,IAAI,CAAA,EAAG;AAC3B,IAAA,MAAM,QAAA,GAAW,OAAA,EAAS,EAAA,EAAI,eAAA,IAAmB,QAAA;AACjD,IAAA,IAAI,aAAa,WAAA,EAAa;AAC5B,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAAA,CAQF,CAAA;AAAA,IACd,CAAA,MAAA,IACS,aAAa,QAAA,EAAU;AAC9B,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAAA,CAQF,CAAA;AAAA,IACd,CAAA,MACK;AACH,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAAA,CAQF,CAAA;AAAA,IACd;AAAA,EACF;AAGA,EAAA,IAAI,QAAA,CAAS,QAAA,CAAS,OAAO,CAAA,EAAG;AAC9B,IAAA,QAAA,CAAS,IAAA,CAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAWjB,CAAA;AAAA,EACC;AAGA,EAAA,IAAI,QAAA,CAAS,QAAA,CAAS,OAAO,CAAA,EAAG;AAC9B,IAAA,QAAA,CAAS,IAAA,CAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAUjB,CAAA;AAAA,EACC;AAGA,EAAA,IAAI,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA,EAAG;AAChC,IAAA,QAAA,CAAS,IAAA,CAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAiBjB,CAAA;AAAA,EACC;AAGA,EAAA,QAAA,CAAS,IAAA,CAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAMf,CAAA;AAEC,EAAA,OAAO,QAAA,CAAS,KAAK,IAAI,CAAA;AAC3B;AAEA,SAAS,oBAAA,GAA+B;AACtC,EAAA,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAyCT;AAEA,SAAS,mBAAA,GAA8B;AACrC,EAAA,OAAO,CAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AA4BT;AAEA,SAAS,mBAAA,GAA8B;AACrC,EAAA,OAAO,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAwCT;AAEA,SAAS,uBAAA,GAAkC;AACzC,EAAA,OAAO,CAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA,CAAA;AAsBT;AAEA,SAAS,mBAAA,GAA8B;AACrC,EAAA,OAAO,CAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA,CAAA;AAgBT;AAEA,SAAS,qBAAA,GAAgC;AACvC,EAAA,OAAO,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAyBT","file":"chunk-U4PA632G.js","sourcesContent":["/**\n * @h-ai/cli — 配置文件模板\n *\n * 为各模块生成默认配置文件内容。\n * @module cli-config-templates\n */\n\nimport type { AiModuleConfig, CacheModuleConfig, CoreModuleConfig, DbModuleConfig, FeatureId, IamModuleConfig, ModuleConfigs, StorageModuleConfig } from '../cli-types.js'\n\n/**\n * 生成模块配置文件内容\n *\n * @param moduleKey - 模块标识（core/serv/db/cache/iam/storage/ai）\n * @param configs - 用户自定义配置值\n * @returns YAML 格式的配置内容\n */\nexport function generateConfigFile(moduleKey: string, configs?: ModuleConfigs): string {\n  switch (moduleKey) {\n    case 'core':\n      return generateCoreConfig(configs?.core)\n    case 'serv':\n      return generateServConfig()\n    case 'db':\n      return generateDbConfig(configs?.db)\n    case 'cache':\n      return generateCacheConfig(configs?.cache)\n    case 'iam':\n      return generateIamConfig(configs?.iam)\n    case 'storage':\n      return generateStorageConfig(configs?.storage)\n    case 'ai':\n      return generateAiConfig(configs?.ai)\n    case 'deploy':\n      return generateDeployConfig()\n    case 'vecdb':\n      return generateVecdbConfig()\n    case 'reach':\n      return generateReachConfig()\n    case 'scheduler':\n      return generateSchedulerConfig()\n    case 'audit':\n      return generateAuditConfig()\n    case 'payment':\n      return generatePaymentConfig()\n    default:\n      return `# ${moduleKey} 配置\\n`\n  }\n}\n\nfunction generateCoreConfig(cfg?: CoreModuleConfig): string {\n  const name = cfg?.name ?? 'my-app'\n  const locale = cfg?.defaultLocale ?? 'zh-CN'\n  const supportedLocales = locale === 'en-US'\n    ? `  - en-US\\n  - zh-CN`\n    : `  - zh-CN\\n  - en-US`\n\n  return `# =============================================================================\n# 应用配置\n# =============================================================================\n\nname: ${name}\nversion: 0.1.0\nenv: development\ndebug: false\n\ndefaultLocale: ${locale}\nsupportedLocales:\n${supportedLocales}\n`\n}\n\nfunction generateServConfig(): string {\n  return `# =============================================================================\n# Service / HTTP 入口配置\n# =============================================================================\n\nhttp:\n  apiPrefix: /api/v1\n  openapi:\n    path: /openapi.json\n  docs:\n    path: /docs\n  health:\n    path: /health\n    readyPath: /ready\n  rpc: false\n\n# 开发期默认关闭 transport；启用 @h-ai/crypto 后可按需改为对象配置\ntransport: false\n`\n}\n\nfunction generateDbConfig(cfg?: DbModuleConfig): string {\n  const dbType = cfg?.type ?? 'sqlite'\n  const database = cfg?.database ?? (dbType === 'sqlite' ? './data/app.db' : 'hai')\n  const host = cfg?.host ?? 'localhost'\n  const port = cfg?.port ?? (dbType === 'postgresql' ? 5432 : 3306)\n\n  if (dbType === 'sqlite') {\n    return `# =============================================================================\n# 数据库配置\n# =============================================================================\n\n# 数据库类型: sqlite | postgresql | mysql\ntype: sqlite\n\n# SQLite 数据库路径\ndatabase: ${database}\n\n# PostgreSQL/MySQL 配置（可选）\n# host: localhost\n# port: 5432\n# user: postgres\n# password: ''\n`\n  }\n\n  const user = dbType === 'postgresql' ? 'postgres' : 'root'\n\n  return `# =============================================================================\n# 数据库配置\n# =============================================================================\n\n# 数据库类型: sqlite | postgresql | mysql\ntype: ${dbType}\n\n# 数据库名称\ndatabase: ${database}\n\n# 连接配置\nhost: ${host}\nport: ${port}\nuser: ${user}\npassword: ''\n`\n}\n\nfunction generateCacheConfig(cfg?: CacheModuleConfig): string {\n  const cacheType = cfg?.type ?? 'memory'\n\n  if (cacheType === 'memory') {\n    return `# =============================================================================\n# 缓存配置\n# =============================================================================\n\n# 缓存类型: memory | redis\ntype: memory\n\n# Redis 配置（当 type 为 redis 时使用）\n# url: redis://localhost:6379/0\n# host: localhost\n# port: 6379\n# password: ''\n# keyPrefix: 'hai:'\n`\n  }\n\n  const host = cfg?.host ?? 'localhost'\n  const port = cfg?.port ?? 6379\n\n  return `# =============================================================================\n# 缓存配置\n# =============================================================================\n\n# 缓存类型: memory | redis\ntype: redis\n\n# Redis 配置\nhost: ${host}\nport: ${port}\npassword: ''\nkeyPrefix: 'hai:'\n`\n}\n\nfunction generateIamConfig(cfg?: IamModuleConfig): string {\n  const loginPassword = cfg?.loginPassword ?? true\n  const loginOtp = cfg?.loginOtp ?? false\n\n  return `# =============================================================================\n# IAM 配置\n# =============================================================================\n\n# 登录配置\nlogin:\n  password: ${loginPassword}\n  otp: ${loginOtp}\n  ldap: false\n\n# 密码策略\npassword:\n  minLength: 8\n  maxLength: 128\n  requireUppercase: false\n  requireLowercase: false\n  requireNumber: false\n  requireSpecialChar: false\n\n# 会话配置\nsession:\n  maxAge: 86400 # 会话超时（秒），默认 24 小时\n  sliding: true # 滑动窗口（每次请求刷新过期时间）\n  singleDevice: false # 单设备登录\n  refreshTokenMaxAge: 604800 # refreshToken 过期（秒），默认 7 天\n\n# RBAC 配置\nrbac:\n  defaultRole: user\n\n# 是否自动创建默认数据\nseedDefaultData: true\n`\n}\n\nfunction generateStorageConfig(cfg?: StorageModuleConfig): string {\n  const storageType = cfg?.type ?? 'local'\n\n  if (storageType === 'local') {\n    const localPath = cfg?.localPath ?? './data/uploads'\n    return `# =============================================================================\n# 存储配置\n# =============================================================================\n\n# 默认 Provider\ndefaultProvider: local\n\n# Provider 配置\nproviders:\n  local:\n    type: local\n    root: ${localPath}\n    maxFileSize: 10485760  # 10MB\n\n  # S3 配置（可选）\n  # s3:\n  #   type: s3\n  #   bucket: my-bucket\n  #   region: us-east-1\n  #   accessKeyId: ''\n  #   secretAccessKey: ''\n  #   endpoint: ''\n  #   forcePathStyle: false\n`\n  }\n\n  return `# =============================================================================\n# 存储配置\n# =============================================================================\n\n# 默认 Provider\ndefaultProvider: s3\n\n# Provider 配置\nproviders:\n  s3:\n    type: s3\n    bucket: ''\n    region: us-east-1\n    accessKeyId: ''\n    secretAccessKey: ''\n    # endpoint: ''\n    # forcePathStyle: false\n\n  # 本地存储（可选）\n  # local:\n  #   type: local\n  #   root: ./data/uploads\n  #   maxFileSize: 10485760  # 10MB\n`\n}\n\nfunction generateAiConfig(cfg?: AiModuleConfig): string {\n  const model = cfg?.model ?? 'gpt-4o-mini'\n\n  // AIConfigSchema 结构：llm（必填）+ 可选子模块\n  // LLMConfigSchema 支持顶层 apiKey/model，以及多模型 models 数组\n  return `# =============================================================================\n# AI 配置\n# =============================================================================\n\n# LLM 配置（必填）\nllm:\n  # API Key（约定环境变量 HAI_AI_LLM_APIKEY 优先）\n  apiKey: ''\n  # Base URL（约定环境变量 HAI_AI_LLM_BASEURL 优先）\n  # baseUrl: https://api.openai.com/v1\n  # 默认模型\n  model: ${model}\n  # 全局最大 Token 数（默认 4096）\n  # maxTokens: 4096\n  # 采样温度（0-2，默认 0.7）\n  # temperature: 0.7\n  # 请求超时（毫秒，默认 60000）\n  # timeout: 60000\n\n  # 多模型配置（可选，用于场景路由）\n  # models:\n  #   - id: fast\n  #     model: gpt-4o-mini\n  #   - id: smart\n  #     model: gpt-4o\n  #     apiKey: ''\n\n  # 场景模型映射（可选）\n  # scenarios:\n  #   default: fast\n  #   analysis: smart\n`\n}\n\n/**\n * 根据选中的功能模块生成 .env.example 内容\n *\n * @param features - 选中的功能模块列表\n * @param configs - 用户自定义配置值\n * @returns .env.example 文件内容\n */\nexport function generateEnvExample(features: FeatureId[], configs?: ModuleConfigs): string {\n  const sections: string[] = []\n\n  // 文件头\n  sections.push(`# =============================================================================\n# Environment Variables\n# =============================================================================\n#\n# Copy this file to .env and fill in actual values.\n# Config files use literal defaults; matching HAI variables override YAML leaves.\n#\n# Naming convention: HAI_<config name>_<YAML path>\n# =============================================================================`)\n\n  // 应用基础（始终生成）\n  sections.push(`\n# =============================================================================\n# Application\n# =============================================================================\n# Environment: development | production | test\nHAI_CORE_ENV=development\n# Enable debug mode\nHAI_CORE_DEBUG=false`)\n\n  // 数据库\n  if (features.includes('db')) {\n    const dbType = configs?.db?.type ?? 'sqlite'\n    const dbDatabase = configs?.db?.database ?? (dbType === 'sqlite' ? './data/app.db' : 'hai')\n    const isSqlite = dbType === 'sqlite'\n    sections.push(`\n# =============================================================================\n# Database (@h-ai/reldb)\n# =============================================================================\n# Database type: sqlite | postgresql | mysql\nHAI_DB_TYPE=${dbType}\n# SQLite: file path; PostgreSQL/MySQL: database name\nHAI_DB_DATABASE=${dbDatabase}${isSqlite\n  ? `\n# PostgreSQL/MySQL connection (uncomment when not using sqlite)\n# HAI_DB_HOST=localhost\n# HAI_DB_PORT=5432\n# HAI_DB_USER=postgres\n# HAI_DB_PASSWORD=`\n  : `\n# Connection\nHAI_DB_HOST=${configs?.db?.host ?? 'localhost'}\nHAI_DB_PORT=${configs?.db?.port ?? (dbType === 'postgresql' ? 5432 : 3306)}\nHAI_DB_USER=${dbType === 'postgresql' ? 'postgres' : 'root'}\nHAI_DB_PASSWORD=`}`)\n  }\n\n  // IAM / Session\n  if (features.includes('iam')) {\n    sections.push(`\n# =============================================================================\n# IAM (@h-ai/iam)\n# =============================================================================\n# HAI_IAM_PASSWORD_MINLENGTH=8\n# HAI_IAM_SESSION_MAXAGE=86400\n# HAI_IAM_SESSION_REFRESHTOKENMAXAGE=604800\n# HAI_KIT_COOKIE_KEY=                 # 32-char hex for SM4-CBC cookie encryption\n`)\n  }\n\n  // 缓存\n  if (features.includes('cache')) {\n    const cacheType = configs?.cache?.type ?? 'memory'\n    if (cacheType === 'redis') {\n      sections.push(`\n# =============================================================================\n# Cache (@h-ai/cache)\n# =============================================================================\n# Cache type: memory | redis\nHAI_CACHE_TYPE=redis\n# Redis connection\nHAI_CACHE_HOST=${configs?.cache?.host ?? 'localhost'}\nHAI_CACHE_PORT=${configs?.cache?.port ?? 6379}\nHAI_CACHE_PASSWORD=\n# HAI_CACHE_URL=redis://localhost:6379/0\n# HAI_CACHE_DB=0\n# HAI_CACHE_CONNECT_TIMEOUT=10000\n# HAI_CACHE_COMMAND_TIMEOUT=5000\n# HAI_CACHE_KEY_PREFIX=hai:`)\n    }\n    else {\n      sections.push(`\n# =============================================================================\n# Cache (@h-ai/cache)\n# =============================================================================\n# Cache type: memory | redis\nHAI_CACHE_TYPE=memory\n# Redis connection (uncomment when type=redis)\n# HAI_CACHE_URL=redis://localhost:6379/0\n# HAI_CACHE_HOST=localhost\n# HAI_CACHE_PORT=6379\n# HAI_CACHE_PASSWORD=\n# HAI_CACHE_DB=0\n# HAI_CACHE_CONNECT_TIMEOUT=10000\n# HAI_CACHE_COMMAND_TIMEOUT=5000\n# HAI_CACHE_KEY_PREFIX=hai:`)\n    }\n  }\n\n  // 存储\n  if (features.includes('storage')) {\n    const storageType = configs?.storage?.type ?? 'local'\n    if (storageType === 's3') {\n      sections.push(`\n# =============================================================================\n# Storage (@h-ai/storage)\n# =============================================================================\n# Default storage provider: local | s3\nHAI_STORAGE_DEFAULTPROVIDER=s3\n# S3 / S3-compatible\nHAI_STORAGE_PROVIDERS_S3_BUCKET=\nHAI_STORAGE_PROVIDERS_S3_REGION=us-east-1\nHAI_STORAGE_PROVIDERS_S3_ACCESSKEYID=\nHAI_STORAGE_PROVIDERS_S3_SECRETACCESSKEY=\n# HAI_STORAGE_PROVIDERS_S3_ENDPOINT=          # Custom endpoint for MinIO / Aliyun OSS etc.\n# HAI_STORAGE_PROVIDERS_S3_FORCEPATHSTYLE=false\n# Local storage (uncomment when type=local)\n# HAI_STORAGE_PROVIDERS_LOCAL_ROOT=./data/uploads`)\n    }\n    else {\n      sections.push(`\n# =============================================================================\n# Storage (@h-ai/storage)\n# =============================================================================\n# Default storage provider: local | s3\nHAI_STORAGE_DEFAULTPROVIDER=local\n# Local storage root path\nHAI_STORAGE_PROVIDERS_LOCAL_ROOT=${configs?.storage?.localPath ?? './data/uploads'}\n# S3 / S3-compatible (uncomment when type=s3)\n# HAI_STORAGE_PROVIDERS_S3_BUCKET=\n# HAI_STORAGE_PROVIDERS_S3_REGION=us-east-1\n# HAI_STORAGE_PROVIDERS_S3_ACCESSKEYID=\n# HAI_STORAGE_PROVIDERS_S3_SECRETACCESSKEY=\n# HAI_STORAGE_PROVIDERS_S3_ENDPOINT=          # Custom endpoint for MinIO / Aliyun OSS etc.\n# HAI_STORAGE_PROVIDERS_S3_FORCEPATHSTYLE=false`)\n    }\n  }\n\n  // AI\n  if (features.includes('ai')) {\n    const provider = configs?.ai?.defaultProvider ?? 'openai'\n    if (provider === 'anthropic') {\n      sections.push(`\n# =============================================================================\n# AI (@h-ai/ai)\n# =============================================================================\n# OpenAI-compatible API Key (Anthropic models via OpenAI-compatible proxy)\nHAI_AI_LLM_APIKEY=\n# HAI_AI_LLM_BASEURL=               # Custom base URL\n# Optional compatibility fallback\n# OPENAI_API_KEY=`)\n    }\n    else if (provider === 'openai') {\n      sections.push(`\n# =============================================================================\n# AI (@h-ai/ai)\n# =============================================================================\n# OpenAI / OpenAI-compatible\nHAI_AI_LLM_APIKEY=\n# HAI_AI_LLM_BASEURL=               # Custom base URL (e.g. local proxy, Azure)\n# Optional compatibility fallback\n# OPENAI_API_KEY=`)\n    }\n    else {\n      sections.push(`\n# =============================================================================\n# AI (@h-ai/ai)\n# =============================================================================\n# OpenAI-compatible provider\nHAI_AI_LLM_APIKEY=\n# HAI_AI_LLM_BASEURL=               # Custom base URL\n# Optional compatibility fallback\n# OPENAI_API_KEY=`)\n    }\n  }\n\n  // VecDB\n  if (features.includes('vecdb')) {\n    sections.push(`\n# =============================================================================\n# Vector Database (@h-ai/vecdb)\n# =============================================================================\n# Backend type: lancedb | pgvector | qdrant\nHAI_VECDB_TYPE=lancedb\n# LanceDB data path\nHAI_VECDB_PATH=./data/vecdb\n# Qdrant (uncomment when type=qdrant)\n# HAI_VECDB_URL=http://localhost:6333\n# HAI_VECDB_APIKEY=\n`)\n  }\n\n  // Reach\n  if (features.includes('reach')) {\n    sections.push(`\n# =============================================================================\n# Reach (@h-ai/reach)\n# =============================================================================\n# SMTP (uncomment when enabling email provider)\n# HAI_REACH_SMTP_HOST=smtp.example.com\n# HAI_REACH_SMTP_PORT=465\n# HAI_REACH_SMTP_USER=\n# HAI_REACH_SMTP_PASS=\n# HAI_REACH_SMTP_FROM=noreply@example.com\n`)\n  }\n\n  // Payment\n  if (features.includes('payment')) {\n    sections.push(`\n# =============================================================================\n# Payment (@h-ai/payment)\n# =============================================================================\n# WeChat Pay\n# HAI_PAYMENT_WECHAT_MCHID=\n# HAI_PAYMENT_WECHAT_APIV3KEY=\n# HAI_PAYMENT_WECHAT_SERIALNO=\n# HAI_PAYMENT_WECHAT_PRIVATEKEY=\n# HAI_PAYMENT_WECHAT_APPID=\n# Alipay\n# HAI_PAYMENT_ALIPAY_APPID=\n# HAI_PAYMENT_ALIPAY_PRIVATEKEY=\n# HAI_PAYMENT_ALIPAY_ALIPAYPUBLICKEY=\n# Stripe\n# HAI_PAYMENT_STRIPE_SECRETKEY=\n# HAI_PAYMENT_STRIPE_WEBHOOKSECRET=\n`)\n  }\n\n  // 测试（始终生成）\n  sections.push(`\n# =============================================================================\n# Testing\n# =============================================================================\n# E2E test mode (relaxes rate limiting etc.)\n# HAI_E2E=1\n`)\n\n  return sections.join('\\n')\n}\n\nfunction generateDeployConfig(): string {\n  return `# =============================================================================\n# 部署配置 (@h-ai/deploy)\n# =============================================================================\n# 部署平台凭证通过 ~/.hai/credentials.yml 管理\n# 环境变量引用格式: \\${VAR_NAME:default_value}\n\n# 部署平台\nprovider:\n  type: vercel\n  token: \\${HAI_DEPLOY_VERCEL_TOKEN}\n\n# 基础设施服务（按需开启）\nservices:\n  # PostgreSQL 数据库 (Neon)\n  # db:\n  #   provisioner: neon\n  #   apiKey: \\${HAI_DEPLOY_NEON_API_KEY}\n\n  # Redis 缓存 (Upstash)\n  # cache:\n  #   provisioner: upstash\n  #   email: \\${HAI_DEPLOY_UPSTASH_EMAIL}\n  #   apiKey: \\${HAI_DEPLOY_UPSTASH_API_KEY}\n\n  # S3 存储 (Cloudflare R2)\n  # storage:\n  #   provisioner: cloudflare-r2\n  #   accountId: \\${HAI_DEPLOY_CF_ACCOUNT_ID}\n  #   apiToken: \\${HAI_DEPLOY_CF_API_TOKEN}\n\n  # 邮件 (Resend)\n  # email:\n  #   provisioner: resend\n  #   apiKey: \\${HAI_DEPLOY_RESEND_API_KEY}\n\n  # 短信 (阿里云)\n  # sms:\n  #   provisioner: aliyun\n  #   accessKeyId: \\${HAI_DEPLOY_ALIYUN_ACCESS_KEY_ID}\n  #   accessKeySecret: \\${HAI_DEPLOY_ALIYUN_ACCESS_KEY_SECRET}\n`\n}\n\nfunction generateVecdbConfig(): string {\n  return `# =============================================================================\n# 向量数据库配置 (@h-ai/vecdb)\n# =============================================================================\n\n# 数据库类型: lancedb | pgvector | qdrant\ntype: lancedb\n\n# LanceDB 数据目录\npath: ./data/vecdb\n\n# 距离度量: cosine | euclidean | dot\n# metric: cosine\n\n# pgvector 配置（当 type 为 pgvector 时使用）\n# type: pgvector\n# host: localhost\n# port: 5432\n# database: hai\n# user: postgres\n# password: ''\n# indexType: hnsw\n# tablePrefix: vec_\n\n# Qdrant 配置（当 type 为 qdrant 时使用）\n# type: qdrant\n# url: http://localhost:6333\n# apiKey: ''\n`\n}\n\nfunction generateReachConfig(): string {\n  return `# =============================================================================\n# 消息推送配置 (@h-ai/reach)\n# =============================================================================\n\nproviders:\n  # 控制台输出（开发/测试用）\n  - name: console_dev\n    type: console\n\n  # SMTP 邮件（按需开启）\n  # - name: email\n  #   type: smtp\n  #   host: \\${HAI_REACH_SMTP_HOST:smtp.example.com}\n  #   port: \\${HAI_REACH_SMTP_PORT:465}\n  #   secure: true\n  #   user: \\${HAI_REACH_SMTP_USER:}\n  #   pass: \\${HAI_REACH_SMTP_PASS:}\n  #   from: \\${HAI_REACH_SMTP_FROM:noreply@example.com}\n\n  # 阿里云短信（按需开启）\n  # - name: sms\n  #   type: aliyun-sms\n  #   accessKeyId: \\${HAI_REACH_SMS_ACCESS_KEY}\n  #   accessKeySecret: \\${HAI_REACH_SMS_SECRET_KEY}\n  #   signName: MyApp\n\n# 模板（可选）\n# templates:\n#   - name: verification_code\n#     provider: email\n#     subject: \"验证码: {code}\"\n#     body: \"您的验证码是 {code}，有效期 {minutes} 分钟。\"\n\n# 免打扰（可选）\n# dnd:\n#   enabled: true\n#   strategy: delay\n#   start: \"22:00\"\n#   end: \"08:00\"\n`\n}\n\nfunction generateSchedulerConfig(): string {\n  return `# =============================================================================\n# 任务调度配置 (@h-ai/scheduler)\n# =============================================================================\n\n# 是否启用数据库日志（需要 @h-ai/reldb）\nenableDb: true\n\n# 执行日志表名\ntableName: hai_scheduler_logs\n\n# 任务定义表名\ntaskTableName: hai_scheduler_tasks\n\n# 分布式锁表名\nlockTableName: hai_scheduler_locks\n\n# 检查间隔（毫秒）\ntickInterval: 1000\n\n# 锁过期时间（毫秒）\nlockExpireMs: 300000\n`\n}\n\nfunction generateAuditConfig(): string {\n  return `# =============================================================================\n# 审计日志配置 (@h-ai/audit)\n# =============================================================================\n\n# 审计日志表名\ntableName: hai_audit_logs\n\n# 用户表名（用于 JOIN 查询）\nuserTable: hai_iam_users\n\n# 用户表主键列名\nuserIdColumn: id\n\n# 用户名列名\nuserNameColumn: username\n`\n}\n\nfunction generatePaymentConfig(): string {\n  return `# =============================================================================\n# 支付配置 (@h-ai/payment)\n# =============================================================================\n\n# 微信支付（按需开启）\n# wechat:\n#   mchId: ''\n#   apiV3Key: ''\n#   serialNo: ''\n#   privateKey: ''\n#   appId: ''\n\n# 支付宝（按需开启）\n# alipay:\n#   appId: ''\n#   privateKey: ''\n#   alipayPublicKey: ''\n#   signType: RSA2\n#   sandbox: false\n\n# Stripe（按需开启）\n# stripe:\n#   secretKey: ''\n#   webhookSecret: ''\n`\n}\n"]}

package/dist/cli-config-templates-GSXKLGU5.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-export { generateConfigFile, generateEnvExample } from './chunk-U4PA632G.js';
-import './chunk-2H7UOFLK.js';
-//# sourceMappingURL=cli-config-templates-GSXKLGU5.js.map
-//# sourceMappingURL=cli-config-templates-GSXKLGU5.js.map