@h-ai/cli 0.1.0-alpha.66 → 0.1.0-alpha.68

package/templates/base/.dockerignore.hbs

@@ -1,19 +1,25 @@
-.git
+**/.git
+**/node_modules
+**/.pnpm-store
+**/.cache
+**/.svelte-kit
+**/.turbo
+**/build
+**/dist
+**/coverage
+**/playwright-report
+**/test-results
+**/src-tauri/target
+**/hash-core/target
+tmp
 **/*.tar
 .github
 .agents
 .claude
 .codex
 .opencode
-.svelte-kit
-.turbo
 android
-build
-dist
 ios
-node_modules
-playwright-report
-test-results
 **/data
 *.log
 # 仅保留公共基础 .env；分环境配置、私有覆盖及已有交付包不进入构建上下文。

package/templates/base/.gitignore.hbs

@@ -32,3 +32,10 @@ playwright-report/
 # 本机私有配置；公共 .env 与 dev/test/prod 环境文件纳入版本控制。
 .env.local
 .env.*.local
+
+# 构建器生成的安装输入快照
+**/images/dependencies/
+
+# 项目本地缓存
+**/.pnpm-store/
+**/.cache/

package/templates/base/e2e/app.spec.ts.hbs

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto'
 import { mkdir } from 'node:fs/promises'
 import path from 'node:path'
 import process from 'node:process'
@@ -23,6 +24,16 @@ test('home page renders from browser', async ({ page }) => {
   await expect(page.locator('main, section').first()).toBeVisible()
   await expect(page.locator('header').first()).toBeVisible()
   await expect(page.locator('footer').first()).toBeAttached()
+  // 大屏使用可用空间，窄屏由组件内部滚动，不能撑宽整个页面。
+  for (const width of [390, 1440, 1920, 2560, 3840]) {
+    await page.setViewportSize({ width, height: 960 })
+    const availableWidth = await page.evaluate(() => document.documentElement.clientWidth)
+    expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+    const shell = page.locator('.hai-mobile-shell')
+    if (await shell.count())
+      expect((await shell.boundingBox())!.width).toBeGreaterThan(availableWidth - 2)
+  }
+  await page.setViewportSize({ width: 390, height: 844 })
 {{#if_eq appType 'h5'}}
   // 在手机宽度验证导航真正切换路由，避免样式失效但首页渲染测试仍通过。
   const nav = page.locator('nav')
@@ -57,7 +68,7 @@ test('configured IAM registration and password login', async ({ page, context })
 {{/if_eq}}
   const evidence = process.env.HAI_AUTH_EVIDENCE_DIR || path.resolve('test-results/auth-screenshots')
   await mkdir(evidence, { recursive: true })
-  const username = `scaf${Date.now()}`
+  const username = `scaf${randomUUID().replaceAll('-', '').slice(0, 12)}`
   const password = 'ScaffoldPassword123'
   const authUrl = '{{#if isCapacitorApp}}/{{else}}/auth/login{{/if}}'
   await page.goto(authUrl)
@@ -66,11 +77,15 @@ test('configured IAM registration and password login', async ({ page, context })
   await expect(page.locator('footer')).toBeVisible()
   await page.screenshot({ path: path.join(evidence, '{{projectName}}-login.png'), fullPage: true })
   await page.getByRole('{{#if isCapacitorApp}}button{{else}}link{{/if}}', { name: /立即注册|Register now/i }).click()
-  await expect(page.locator('input[name="username"]')).toBeVisible()
+{{#unless isCapacitorApp}}
+  await expect(page).toHaveURL(/\/auth\/register(?:\?|$)/)
+{{/unless}}
+  const registerForm = page.locator('.register-form')
+  await expect(registerForm.locator('#register-username')).toBeVisible()
   await page.screenshot({ path: path.join(evidence, '{{projectName}}-register.png'), fullPage: true })
   if (process.env.IAM_NOTIFICATION_URL) {
     // 协议弹窗留在认证页，关闭后继续填写注册表单。
-    await page.getByRole('button', { name: /用户协议|User Agreement/i, exact: true }).click()
+    await registerForm.getByRole('button', { name: /用户协议|Terms of Service/i, exact: true }).click()
     await expect(page.getByRole('dialog')).toBeVisible()
     await expect(page.getByRole('dialog').getByRole('heading', { name: 'Configured registration agreement' })).toBeVisible()
     await expect(page.locator('iframe')).toHaveCount(0)
@@ -78,11 +93,11 @@ test('configured IAM registration and password login', async ({ page, context })
     await page.keyboard.press('Escape')
     await expect(page.getByRole('dialog')).not.toBeVisible()
   }
-  await page.locator('input[name="username"]').fill(username)
-  await page.locator('input[name="email"]').fill(`${username}@example.com`)
-  await page.locator('input[type="password"]').nth(0).fill(password)
-  await page.locator('input[type="password"]').nth(1).fill(password)
-  await page.locator('button[type="submit"]').click()
+  await registerForm.locator('#register-username').fill(username)
+  await registerForm.locator('#register-email').fill(`${username}@example.com`)
+  await registerForm.locator('#register-password').fill(password)
+  await registerForm.locator('#register-confirm-password').fill(password)
+  await registerForm.locator('button[type="submit"]').click()
   await expect(page.locator('.register-form')).not.toBeVisible()
 {{#unless isCapacitorApp}}
   const me = await page.request.get('/api/auth/me')

package/templates/base/hai.build.json.hbs

@@ -1 +1 @@
-{ "images": [{ "name": "app", "target": "runtime", "containerPort": {{#if isSvelteOnlyApp}}8080{{else}}3000{{/if}} }] }
+{ "images": [{ "name": "app", "dockerfile": "images/app.Dockerfile", "containerPort": {{#if isSvelteOnlyApp}}8080{{else}}3000{{/if}} }] }

package/templates/base/{Dockerfile.hbs → images/app.Dockerfile.hbs}

@@ -1,48 +1,51 @@
-# syntax=docker/dockerfile:1.7
 {{#if isSvelteOnlyApp}}
-FROM node:24-bookworm-slim AS build
-ARG SQLITE_PREBUILD_MIRROR
-ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
+FROM node:24.22.1-bookworm-slim AS build
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
 ENV CI=true
+ENV ONNXRUNTIME_NODE_INSTALL_CUDA=skip
 WORKDIR /workspace
 
-RUN corepack enable && corepack prepare pnpm@12.11.2 --activate
+RUN corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY images/dependencies/ ./
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --ignore-scripts
 COPY . .
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
 RUN pnpm compile
 
-FROM nginxinc/nginx-unprivileged:1.29-alpine AS runtime
+FROM nginxinc/nginx-unprivileged:1.29.8-alpine AS runtime
 
-COPY --chmod=755 docker/19-runtime-config.sh /docker-entrypoint.d/19-hai-runtime-config.sh
-COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --chmod=755 images/web/19-runtime-config.sh /docker-entrypoint.d/19-hai-runtime-config.sh
+COPY images/web/nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /workspace/dist /usr/share/nginx/html
 
 EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD wget -q -O /dev/null http://127.0.0.1:8080/health || exit 1
 {{else}}
-FROM node:24-bookworm-slim AS build
-ARG SQLITE_PREBUILD_MIRROR
+FROM node:24.22.1-bookworm-slim AS build
+ARG SQLITE_PREBUILD_MIRROR=
 ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
 ENV CI=true
+ENV ONNXRUNTIME_NODE_INSTALL_CUDA=skip
 WORKDIR /workspace
 
-RUN corepack enable && corepack prepare pnpm@12.11.2 --activate
+RUN corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY images/dependencies/ ./
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --ignore-scripts
 COPY . .
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
 RUN pnpm compile
-RUN if [ -d node_modules/better-sqlite3 ]; then cd node_modules/better-sqlite3; for attempt in 1 2 3; do node -e "require('node:child_process').execFileSync(process.execPath,[require.resolve('prebuild-install/bin.js'),'--verbose'],{stdio:'inherit'})" && break; [ "$attempt" = 3 ] && exit 1; sleep 3; done; fi
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm pm deploy --filter {{projectName}} --prod /prod/app
+RUN --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds if [ -d node_modules/better-sqlite3 ]; then cd node_modules/better-sqlite3; for attempt in 1 2 3; do node -e "require('node:child_process').execFileSync(process.execPath,[require.resolve('prebuild-install/bin.js'),'--verbose'],{stdio:'inherit'})" && break; [ "$attempt" = 3 ] && exit 1; sleep 3; done; fi
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds pnpm pm deploy --filter {{projectName}} --prod /prod/app
 
-FROM node:24-bookworm-slim AS runtime-base
+FROM node:24.22.1-bookworm-slim AS runtime-base
 
 ENV NODE_ENV=production
 ENV HOST=0.0.0.0
@@ -58,5 +61,4 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
   CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+'/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
 CMD ["node", "build"]
 
-FROM runtime-base AS runtime
 {{/if}}

package/templates/base/package.json.hbs

@@ -1,7 +1,7 @@
 {
   "engines": { "node": "^22.22.2 || ^24.15.0 || >=26.0.0" },
   "name": "{{projectName}}",
-  "version": "0.1.0-alpha.66",
+  "version": "0.1.0-alpha.68",
   "private": true,
   "packageManager": "pnpm@12.11.2",
   "description": "{{#if_eq appType 'admin'}}Enterprise management system built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'website'}}Enterprise website built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'h5'}}Mobile H5 app built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'api'}}REST API service built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'mobile-app'}}Mobile app built with hai Agent Framework{{/if_eq}}",
@@ -25,7 +25,9 @@
     "dev:prod": "vite dev --mode prod",
     "compile": "{{#if hasI18n}}pnpm paraglide:compile && {{/if}}vite build",
     "build": "hai build",
+{{#if features.deploy}}
     "deploy": "hai deploy",
+{{/if}}
 {{#unless isSvelteOnlyApp}}
     "start": "node --env-file=.env --env-file=.env.prod --env-file-if-exists=.env.local build/index.js",
     "start:test": "node --env-file=.env --env-file=.env.test --env-file-if-exists=.env.local build/index.js",
@@ -57,6 +59,9 @@
   {{#if isSvelteOnlyApp}}
     "@h-ai/api-client": "{{haiPackageSpecifier}}",
     "@h-ai/capacitor": "{{haiPackageSpecifier}}",
+{{#if features.crypto}}
+    "@h-ai/crypto": "{{haiPackageSpecifier}}",
+{{/if}}
     "@h-ai/ui": "{{haiPackageSpecifier}}"
   {{else}}
     "@h-ai/core": "{{haiPackageSpecifier}}",
@@ -73,16 +78,19 @@
     "@h-ai/payment": "{{haiPackageSpecifier}}"{{/if}}{{#if features.vecdb}},
     "@h-ai/vecdb": "{{haiPackageSpecifier}}"{{/if}}{{#if features.datapipe}},
     "@h-ai/datapipe": "{{haiPackageSpecifier}}"{{/if}}{{#if features.scheduler}},
-    "@h-ai/scheduler": "{{haiPackageSpecifier}}"{{/if}}{{#if features.deploy}},
-    "@h-ai/deploy": "{{haiPackageSpecifier}}"{{/if}}{{#if features.api-client}},
+    "@h-ai/scheduler": "{{haiPackageSpecifier}}"{{/if}}{{#if features.api-client}},
     "@h-ai/api-client": "{{haiPackageSpecifier}}"{{/if}}{{#if features.capacitor}},
     "@h-ai/capacitor": "{{haiPackageSpecifier}}"{{/if}}{{#if isCapacitorApp}}{{#unless features.api-client}},
     "@h-ai/api-client": "{{haiPackageSpecifier}}"{{/unless}}{{#unless features.capacitor}},
     "@h-ai/capacitor": "{{haiPackageSpecifier}}"{{/unless}}{{/if}},
+    "sm-crypto": "0.5.7",
     "zod": "{{versions.zod}}"
 {{/if}}
   },
   "devDependencies": {
+{{#if features.deploy}}
+    "@h-ai/deploy": "{{haiPackageSpecifier}}",
+{{/if}}
     "@h-ai/cli": "{{haiPackageSpecifier}}",
 {{#if isSvelteOnlyApp}}
     "@h-ai/core": "{{haiPackageSpecifier}}",

package/templates/base/playwright.config.ts

@@ -1,5 +1,6 @@
 import process from 'node:process'
 import { defineConfig } from '@playwright/test'
+import { createE2eNotificationEnv, createE2eServerEnv, createE2eTransportRing } from './scripts/e2e-env.js'
 
 const DEFAULT_BASE_URL = 'http://localhost:4173'
 const baseURL = process.env.BASE_URL || DEFAULT_BASE_URL
@@ -35,9 +36,9 @@ function resolvePortFromBaseUrl(urlString: string, fallbackPort: string): string
  */
 export default defineConfig({
   testDir: './e2e',
-  fullyParallel: false,
+  fullyParallel: true,
   forbidOnly: !!process.env.CI,
-  retries: process.env.CI ? 2 : 0,
+  retries: 0,
   workers: 2,
   reporter: 'list',
   timeout: 30_000,
@@ -45,13 +46,23 @@ export default defineConfig({
   use: {
     baseURL,
     channel: 'chrome',
-    trace: 'on-first-retry',
+    trace: 'retain-on-failure',
     screenshot: 'only-on-failure',
   },
 
   webServer: {
     command: `pnpm build && pnpm preview --host ${previewHost} --port ${previewPort} --strictPort`,
-    env: { HAI_E2E: '1', BASE_URL: baseURL },
+    env: createE2eServerEnv({
+      ...createE2eNotificationEnv(),
+      HAI_CORE_ENV: 'test',
+      BASE_URL: baseURL,
+      PUBLIC_API_BASE: process.env.PUBLIC_API_BASE || '',
+      HAI_DB: JSON.stringify({ type: 'sqlite', database: `${process.env.HAI_E2E_DATA_ROOT}/app.db` }),
+      HAI_CACHE: JSON.stringify({ type: 'memory' }),
+      HAI_STORAGE: JSON.stringify({ type: 'local', root: `${process.env.HAI_E2E_DATA_ROOT}/uploads` }),
+      HAI_VECDB: JSON.stringify({ type: 'lancedb', path: `${process.env.HAI_E2E_DATA_ROOT}/vecdb` }),
+      HAI_CRYPTO_TRANSPORT_SERVERKEYRING: createE2eTransportRing(),
+    }),
     url: baseURL,
     reuseExistingServer: false,
     timeout: 180_000,

package/templates/base/src/hooks.server.ts.hbs

@@ -5,10 +5,16 @@
  */
 
 import type { Handle } from '@sveltejs/kit'
+{{#if features.cache}}
+import process from 'node:process'
+{{/if}}
 {{#if hasI18n}}
 import { paraglideMiddleware } from '$lib/paraglide/server.js'
 {{/if}}
 import { initApp } from '$lib/server/init.js'
+{{#if features.cache}}
+import { cache } from '@h-ai/cache'
+{{/if}}
 import { core } from '@h-ai/core'
 {{#if features.iam}}
 import { iam } from '@h-ai/iam'
@@ -54,16 +60,14 @@ const i18nHandle: Handle = async ({ event, resolve }) => {
   if (event.url.pathname.startsWith('/api/')) {
     const locale = event.cookies.get('PARAGLIDE_LOCALE') ?? '{{defaultLocale}}'
     event.locals.locale = locale
-    kit.i18n.setLocale(locale)
-    return resolve(event)
+    return kit.i18n.runWithLocale(locale, () => resolve(event))
   }
 
   return paraglideMiddleware(event.request, async ({ locale }) => {
     event.locals.locale = locale
-    kit.i18n.setLocale(locale)
-    return resolve(event, {
+    return kit.i18n.runWithLocale(locale, () => resolve(event, {
       transformPageChunk: ({ html }) => html.replace('%lang%', locale),
-    })
+    }))
   })
 }
 
@@ -95,7 +99,12 @@ const haiHandle = kit.createHandle({
     operations: () => iam.auth,
   },
 {{/if}}
-  rateLimit: { windowMs: 60000, maxRequests: 200 },
+{{#if features.cache}}
+  rateLimit: { windowMs: 60000, maxRequests: 200, store: kit.middleware.createCacheRateLimitStore(cache, { namespace: '{{projectName}}', allowMemory: process.env.NODE_ENV !== 'production' || process.env.HAI_E2E === '1' }) },
+{{else}}
+  // 未选择cache能力时不启用限流；启用前须接入共享原子store。
+  rateLimit: false,
+{{/if}}
   logging: { logBody: false },
   onError: (error: unknown, _event) => {
     core.logger.error('Request error:', { error })

package/templates/base/src/lib/server/init.ts.hbs

@@ -33,7 +33,7 @@ import type { AIConfigInput } from '@h-ai/ai'
 {{#if features.audit}}
 import type { AuditInitConfigInput } from '@h-ai/audit'
 {{/if}}
-import type { CoreConfig } from '@h-ai/core'
+import type { CoreConfig, HaiResult } from '@h-ai/core'
 {{#if features.iam}}
 import type { IamConfigSettingsInput } from '@h-ai/iam'
 {{/if}}
@@ -44,7 +44,7 @@ import type { ReachConfigInput } from '@h-ai/reach'
 import type { StorageConfigInput } from '@h-ai/storage'
 {{/if}}
 {{#if features.ai}}
-import { ai } from '@h-ai/ai'
+import { ai, AIConfigSchema } from '@h-ai/ai'
 {{/if}}
 {{#if features.audit}}
 import { audit, AuditInitConfigSchema } from '@h-ai/audit'
@@ -68,6 +68,9 @@ import { reldb, ReldbConfigSchema } from '@h-ai/reldb'
 {{#if features.storage}}
 import { storage, StorageConfigSchema } from '@h-ai/storage'
 {{/if}}
+{{#if features.vecdb}}
+import { vecdb, VecdbConfigSchema } from '@h-ai/vecdb'
+{{/if}}
 
 {{#if features.db}}
 type DbConfigInput = Parameters<typeof reldb.init>[0]
@@ -77,14 +80,46 @@ type CacheConfigInput = Parameters<typeof cache.init>[0]
 {{/if}}
 
 let initialized = false
+let initializing: Promise<void> | undefined
+let closing: Promise<void> | undefined
+let cleanupPending = false
 
 /**
  * 初始化应用
  */
 export async function initApp(): Promise<void> {
+  if (closing)
+    await closing
   if (initialized)
     return
+  if (!initializing) {
+    initializing = (async () => {
+      if (cleanupPending)
+        await cleanupModules()
+      cleanupPending = true
+      try {
+        await doInit()
+        initialized = true
+        cleanupPending = false
+      }
+      catch (error) {
+        try {
+          await cleanupModules()
+        }
+        catch (cleanupError) {
+          throw new AggregateError([error, cleanupError], 'Application startup and cleanup failed')
+        }
+        throw error
+      }
+    })().finally(() => {
+      initializing = undefined
+    })
+  }
+  return initializing
+}
 
+/** 实际启动只有一个调用者执行，失败由外层检查清理结果后再抛出。 */
+async function doInit(): Promise<void> {
   // 1. 加载配置
   core.init({
     configDir: './config',
@@ -115,6 +150,16 @@ export async function initApp(): Promise<void> {
   if (!auditValidation.success)
     throw new Error(`Audit config invalid: ${auditValidation.error.message}`)
 {{/if}}
+{{#if features.vecdb}}
+  const vectorValidation = core.config.validate('vecdb', VecdbConfigSchema)
+  if (!vectorValidation.success)
+    throw new Error(`VecDB config invalid: ${vectorValidation.error.message}`)
+{{/if}}
+{{#if features.ai}}
+  const aiValidation = core.config.validate('ai', AIConfigSchema)
+  if (!aiValidation.success)
+    throw new Error(`AI config invalid: ${aiValidation.error.message}`)
+{{/if}}
 
 {{#if features.db}}
   // ─── 获取配置 ───
@@ -130,13 +175,16 @@ export async function initApp(): Promise<void> {
   const auditConfig = core.config.getOrThrow<AuditInitConfigInput>('audit')
 {{/if}}
 {{#if features.storage}}
-  const storageConfig = core.config.get<StorageConfigInput>('storage')
+  const storageConfig = core.config.getOrThrow<StorageConfigInput>('storage')
 {{/if}}
 {{#if features.ai}}
-  const aiConfig = core.config.get<AIConfigInput>('ai')
+  const aiConfig = core.config.getOrThrow<AIConfigInput>('ai')
+{{/if}}
+{{#if features.vecdb}}
+  const vectorConfig = core.config.getOrThrow<Parameters<typeof vecdb.init>[0]>('vecdb')
 {{/if}}
 {{#if features.reach}}
-  const reachConfig = core.config.get<ReachConfigInput>('reach')
+  const reachConfig = core.config.getOrThrow<ReachConfigInput>('reach')
 {{/if}}
 
 {{#if features.db}}
@@ -166,26 +214,25 @@ export async function initApp(): Promise<void> {
 {{/if}}
 
 {{#if features.storage}}
-  // ─── 初始化存储（可选） ───
-  if (storageConfig) {
-    const storageValidation = core.config.validate('storage', StorageConfigSchema)
-    if (storageValidation.success) {
-      const storageResult = await storage.init(storageConfig)
-      if (!storageResult.success) {
-        core.logger.warn('Storage initialization failed', { error: storageResult.error.message })
-      }
-    }
-  }
+  const storageValidation = core.config.validate('storage', StorageConfigSchema)
+  if (!storageValidation.success)
+    throw new Error(`Storage config invalid: ${storageValidation.error.message}`)
+  const storageResult = await storage.init(storageConfig)
+  if (!storageResult.success)
+    throw new Error(`Storage initialization failed: ${storageResult.error.message}`)
+{{/if}}
+
+{{#if features.vecdb}}
+  // 共享向量存储必须在 AI 选择默认 Store 之前就绪。
+  const vectorResult = await vecdb.init(vectorConfig)
+  if (!vectorResult.success)
+    throw new Error(`VecDB initialization failed: ${vectorResult.error.message}`)
 {{/if}}
 
 {{#if features.reach}}
-  // ─── 初始化触达服务（可选） ───
-  if (reachConfig) {
-    const reachResult = await reach.init(reachConfig)
-    if (!reachResult.success) {
-      core.logger.warn('Reach initialization failed', { error: reachResult.error.message })
-    }
-  }
+  const reachResult = await reach.init(reachConfig)
+  if (!reachResult.success)
+    throw new Error(`Reach initialization failed: ${reachResult.error.message}`)
 {{/if}}
 
 {{#if features.iam}}
@@ -205,15 +252,77 @@ export async function initApp(): Promise<void> {
 {{/if}}
 
 {{#if features.ai}}
-  // ─── 初始化 AI（可选） ───
-  if (aiConfig?.llm?.apiKey) {
-    const aiResult = await ai.init(aiConfig)
-    if (!aiResult.success) {
-      core.logger.warn('AI initialization failed', { error: aiResult.error.message })
-    }
-  }
+  // 显式启用的 AI 不得在持久 Store 不可用时降级为启动成功。
+  const aiResult = await ai.init(aiConfig)
+  if (!aiResult.success)
+    throw new Error(`AI initialization failed: ${aiResult.error.message}`)
 {{/if}}
 
-  initialized = true
   core.logger.info('Application initialized', { app: core.config.getOrThrow<CoreConfig>('core').name })
 }
+
+/** 逆序关闭所有应用拥有的模块；保留失败义务以便下一次重试。 */
+async function cleanupModules(): Promise<void> {
+  const failures: unknown[] = []
+  const closers: Array<() => Promise<HaiResult<void> | void>> = [
+{{#if features.ai}}
+    () => ai.close(),
+{{/if}}
+{{#if features.audit}}
+    () => audit.close(),
+{{/if}}
+{{#if features.iam}}
+    () => iam.close(),
+{{/if}}
+{{#if features.reach}}
+    () => reach.close(),
+{{/if}}
+{{#if features.vecdb}}
+    () => vecdb.close(),
+{{/if}}
+{{#if features.storage}}
+    () => storage.close(),
+{{/if}}
+{{#if features.cache}}
+    () => cache.close(),
+{{/if}}
+{{#if features.db}}
+    () => reldb.close(),
+{{/if}}
+{{#if features.crypto}}
+    () => crypto.close(),
+{{/if}}
+  ]
+  for (const close of closers) {
+    try {
+      const result = await close()
+      if (result && !result.success)
+        failures.push(result.error)
+    }
+    catch (error) {
+      failures.push(error)
+    }
+  }
+  initialized = false
+  cleanupPending = failures.length > 0
+  if (cleanupPending)
+    throw new AggregateError(failures, 'Application cleanup failed; retry closeApp()')
+}
+
+/**
+ * 关闭应用模块并与并发启动/关闭合并；清理失败抛错并允许重试。
+ * @example `await closeApp()`
+ */
+export async function closeApp(): Promise<void> {
+  if (!closing) {
+    const pending = initializing
+    closing = (async () => {
+      if (pending)
+        await pending.catch(() => undefined)
+      await cleanupModules()
+    })().finally(() => {
+      closing = undefined
+    })
+  }
+  return closing
+}

package/templates/base/vite.config.ts.hbs

@@ -27,7 +27,7 @@ import { publicRuntimeConfig } from './scripts/vite-runtime-config.js'
 {{/if}}
 
 export default defineConfig(({ mode, command }) => {
-  const envResult = command === 'build' ? { success: true as const, data: {} as Record<string, string> } : core.config.loadEnvFiles({ mode, envDir: process.cwd() })
+  const envResult = command === 'build' || process.env.HAI_E2E === '1' ? { success: true as const, data: {} as Record<string, string> } : core.config.loadEnvFiles({ mode, envDir: process.cwd() })
   if (!envResult.success)
     throw new Error(envResult.error.message)
   const env = envResult.data
@@ -53,7 +53,7 @@ export default defineConfig(({ mode, command }) => {
 {{/if}}
     plugins: [
   {{#if isSvelteOnlyApp}}
-      publicRuntimeConfig({ apiBase: process.env.PUBLIC_API_BASE, core: appConfig }),
+      publicRuntimeConfig({ apiBase: process.env.PUBLIC_API_BASE, {{#if features.crypto}}apiTransport: process.env.PUBLIC_API_TRANSPORT, apiKeyExchangePath: process.env.PUBLIC_API_KEY_EXCHANGE_PATH, {{/if}}core: appConfig }),
       svelte(),
   {{else}}
       sveltekit(),
@@ -80,7 +80,9 @@ export default defineConfig(({ mode, command }) => {
 {{/if}}
 {{#unless isSvelteOnlyApp}}
     ssr: {
-      noExternal: [/@h-ai\//],
+      noExternal: ['@h-ai/ui', '@h-ai/kit'],
+      // sm-crypto 同时列入生产依赖，避免 adapter-node 再次打包其动态 require。
+      external: ['@h-ai/core', 'sm-crypto'],
     },
 {{/unless}}
     server: {

package/templates/features/iam/routes-shared/api/auth/logout/+server.ts

@@ -7,11 +7,16 @@ import { kit } from '@h-ai/kit'
 
 export const POST: RequestHandler = kit.handler(async ({ cookies, locals }) => {
   const token = cookies.get('session_token')
-  if (token) {
-    const result = await iam.auth.logout(token)
-    if (!result.success)
-      return kit.response.fromError(result.error, locals.requestId)
+  try {
+    if (token) {
+      const result = await iam.auth.logout(token)
+      if (!result.success)
+        return kit.response.fromError(result.error, locals.requestId)
+    }
+    return kit.response.ok({ authenticated: false }, locals.requestId)
+  }
+  finally {
+    // 本地Cookie清理不代表服务端撤销成功，失败响应必须保留。
+    cookies.delete('session_token', { path: '/' })
   }
-  cookies.delete('session_token', { path: '/' })
-  return kit.response.ok({ authenticated: false }, locals.requestId)
 })