@h-ai/cli 0.1.0-alpha.67 → 0.1.0-alpha.68

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@h-ai/cli",
   "type": "module",
-  "version": "0.1.0-alpha.67",
+  "version": "0.1.0-alpha.68",
   "description": "Hai Framework CLI for project scaffolding and code generation.",
   "license": "Apache-2.0",
   "keywords": [
@@ -30,7 +30,7 @@
     "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
   },
   "dependencies": {
-    "@h-ai/core": "0.1.0-alpha.67",
+    "@h-ai/core": "0.1.0-alpha.68",
     "cac": "^7.0.1",
     "chalk": "^6.0.1",
     "fast-wrap-ansi": "^0.2.2",
@@ -41,12 +41,13 @@
     "yaml": "^2.9.1"
   },
   "devDependencies": {
-    "@h-ai/cache": "0.1.0-alpha.67",
-    "@h-ai/crypto": "0.1.0-alpha.67",
-    "@h-ai/deploy": "0.1.0-alpha.67",
-    "@h-ai/reach": "0.1.0-alpha.67",
-    "@h-ai/reldb": "0.1.0-alpha.67",
-    "@h-ai/storage": "0.1.0-alpha.67",
+    "@h-ai/api-client": "0.1.0-alpha.68",
+    "@h-ai/cache": "0.1.0-alpha.68",
+    "@h-ai/crypto": "0.1.0-alpha.68",
+    "@h-ai/deploy": "0.1.0-alpha.68",
+    "@h-ai/reach": "0.1.0-alpha.68",
+    "@h-ai/reldb": "0.1.0-alpha.68",
+    "@h-ai/storage": "0.1.0-alpha.68",
     "@types/fs-extra": "^11.0.4",
     "@types/node": "^26.6.5",
     "@types/prompts": "^2.4.9",

package/templates/apps/admin/messages/ja-JP.json

@@ -0,0 +1,38 @@
+{
+  "app_title": "管理コンソール",
+  "app_description": "hai Agent Frameworkで構築した管理コンソール",
+  "meta_description": "管理コンソール — 企業管理システム",
+  "nav_home": "ホーム",
+  "nav_dashboard": "ダッシュボード",
+  "nav_settings": "設定",
+  "nav_admin": "管理画面へ",
+  "page_home_title": "管理コンソール",
+  "page_home_subtitle": "hai Agent Frameworkで構築",
+  "page_home_badge": "Powered by hai",
+  "page_dashboard_title": "ダッシュボード",
+  "page_dashboard_subtitle": "システム稼働状況の概要",
+  "page_dashboard_total_users": "総ユーザー数",
+  "page_dashboard_today_active": "本日のアクティブユーザー",
+  "page_dashboard_revenue": "月間売上",
+  "page_dashboard_orders": "未処理の注文",
+  "page_settings_title": "システム設定",
+  "page_settings_subtitle": "システム設定を管理",
+  "page_settings_basic": "基本設定",
+  "page_settings_desc": "ここでシステムの設定を管理します。",
+  "auth_login_title": "ログイン",
+  "auth_login_submit": "ログイン",
+  "auth_login_loading": "ログイン中...",
+  "auth_login_failed": "ログインに失敗しました",
+  "auth_login_to_register": "アカウントをお持ちでない方は新規登録",
+  "auth_register_title": "登録",
+  "auth_register_submit": "登録",
+  "auth_register_loading": "登録中...",
+  "auth_register_failed": "登録に失敗しました",
+  "auth_register_to_login": "既にアカウントをお持ちの方はログイン",
+  "auth_label_username": "ユーザー名",
+  "auth_label_email": "メールアドレス",
+  "auth_label_password": "パスワード",
+  "auth_label_confirm_password": "パスワードの確認",
+  "auth_error_network": "ネットワークエラー",
+  "auth_error_password_mismatch": "パスワードが一致しません"
+}

package/templates/apps/admin/src/routes/+layout.svelte.hbs

@@ -9,8 +9,8 @@
 {{/if}}
   import { page } from '$app/state'
 {{#if hasI18n}}
-  import { getLocale } from '$lib/paraglide/runtime.js'
-  import { setGlobalLocale } from '@h-ai/ui'
+  import { getLocale, setLocale } from '$lib/paraglide/runtime.js'
+  import { LanguageSwitch, setGlobalLocale } from '@h-ai/ui'
 {{/if}}
   import '../app.css'
 
@@ -21,6 +21,11 @@
   const { children }: Props = $props()
 {{#if hasI18n}}
 
+  function handleLanguageChange(language: string) {
+    setGlobalLocale(language)
+    setLocale(language as Parameters<typeof setLocale>[0])
+  }
+
   if (browser) {
     const paraglideLocale = getLocale()
     setGlobalLocale(paraglideLocale)
@@ -32,8 +37,13 @@
   <title>{page.data.appConfig.name}</title>
 </svelte:head>
 
-<div class='min-h-screen flex flex-col bg-base-200'>
-  <header class='navbar border-b border-base-300 bg-base-100 px-6'><span class='text-lg font-semibold'>{page.data.appConfig.name}</span></header>
-  <div class='flex-1'>{@render children()}</div>
-  <footer class='border-t border-base-300 bg-base-100 p-3 text-center text-xs text-base-content/60'>{page.data.appConfig.name} · {page.data.appConfig.version} · {page.data.appConfig.env}</footer>
+<div class='h-dvh flex flex-col overflow-hidden bg-base-200'>
+  <header class='navbar shrink-0 border-b border-base-300 bg-base-100 px-6'>
+    <span class='flex-1 text-lg font-semibold'>{page.data.appConfig.name}</span>
+{{#if hasI18n}}
+    <LanguageSwitch currentLanguage={getLocale()} onchange={handleLanguageChange} />
+{{/if}}
+  </header>
+  <div class='flex min-h-0 flex-1 flex-col overflow-auto'>{@render children()}</div>
+  <footer class='shrink-0 border-t border-base-300 bg-base-100 p-3 text-center text-xs text-base-content/60'>{page.data.appConfig.name} · {page.data.appConfig.version} · {page.data.appConfig.env}</footer>
 </div>

package/templates/apps/admin/src/routes/admin/+layout.svelte.hbs

@@ -27,10 +27,10 @@
   ] as const)
 </script>
 
-<div class='drawer lg:drawer-open'>
+<div class='drawer min-h-0 flex-1 lg:drawer-open'>
   <input id='admin-drawer' type='checkbox' class='drawer-toggle' />
-  <div class='drawer-content min-w-0 p-4 sm:p-6'>
-    <label for='admin-drawer' class='btn btn-ghost btn-sm drawer-button lg:hidden mb-4'>
+  <div class='drawer-content flex min-h-0 min-w-0 flex-col overflow-auto p-4 sm:p-6'>
+    <label for='admin-drawer' class='btn btn-ghost btn-sm drawer-button shrink-0 self-start lg:hidden mb-4'>
       <span class='icon-[tabler--menu-2] size-5'></span>
     </label>
     {@render children()}

package/templates/apps/api/apps/{{projectName}}-contract/src/index.ts.hbs

@@ -1,3 +1,5 @@
 export * from './app-contract.js'
 export * from './app-schemas.js'
 export * from './{{projectName}}-contract.js'
+
+// @hai-generator:contracts:exports

package/templates/apps/api/apps/{{projectName}}-contract/src/{{projectName}}-contract.ts.hbs

@@ -1,12 +1,15 @@
 import { apiContract } from '@h-ai/api-contract'
 import { appContract } from './app-contract.js'
 
+// @hai-generator:contracts:imports
+
 /** 工程级应用 contract。 */
 export const {{api.contractExportName}} = apiContract.create({
 {{#if features.iam}}  iam: apiContract.iam,
 {{/if}}{{#if features.storage}}  storage: apiContract.storage,
 {{/if}}{{#if features.ai}}  ai: apiContract.ai,
-{{/if}}  app: appContract,
+{{/if}}  // @hai-generator:contracts:entries
+  app: appContract,
 })
 
 export type ApiWorkspaceContract = typeof {{api.contractExportName}}

package/templates/apps/api/apps/{{projectName}}-service/README.md.hbs

@@ -27,6 +27,10 @@ pnpm --filter {{api.servicePackageName}} test
 
 ### 关键目录
 
+{{#if features.crypto}}启用 transport 时，`serverKeyRing` 与客户端 `keyStore` 都必须显式提供。CLI 在本服务被忽略的 `.env.local` 中一次性生成独立开发 ring，变量为 `HAI_CRYPTO_TRANSPORT_SERVERKEYRING`；运行时不生成密钥。部署使用 Secret Manager 向所有节点分发相同受管 ring，配合共享数据库 registry。公钥/版本参与协商，私钥不进入普通 YAML、PUBLIC_/VITE_、日志或公开响应。轮换先分发新旧版本再切 activeKeyId，过渡期后撤销旧 ID；无需会话粘性。
+{{#unless features.db}}本模板未选择 db，registry 仅在 development/test 显式使用内存；production/staging 会拒绝启动 transport。选择 db 并配置共享数据库后再部署，或显式关闭 transport。
+{{/unless}}{{/if}}
+
 - `config/`：service 配置
 - `src/app.ts`：HTTP App 装配
 - `src/lib/server/init.ts`：模块初始化与关闭
@@ -37,7 +41,7 @@ pnpm --filter {{api.servicePackageName}} test
 
 服务端 `config/_iam.yml` 统一控制登录、注册、重置、协议与 `ui` 品牌。邮件/短信可用 `_reach.yml` 中的 Provider/标准模板或自定义发送回调。客户端可通过安全公开配置和框架认证动作接入 `AuthPanel`。单实例可使用 Memory；多实例需共享数据库与 Redis，并按工程根 README 配置写入路由和传输会话。
 
-LDAP/Reach 均可选：基础认证无需安装。默认 LDAP 客户端需在 IAM 服务端 workspace 安装 ldapts，再配置 login.ldap 与连接信息。自定义 onOtpSendEmail/onOtpSendSms/onPasswordResetRequest 回调可独立于 Reach 使用，投递失败须拒绝 Promise。协议在 Modal 显示；LoginForm/RegisterForm 提供 header/extraFields/footer，AuthPanel 透传 loginHeader/loginFields/loginFooter 和 registerHeader/registerFields/registerFooter。配置及例子见生成项目的 hai-iam/hai-ui skills。
+LDAP/Reach 均可选：基础认证无需安装。默认 LDAP 客户端需在 IAM 服务端 workspace 安装 ldapts，再配置 login.ldap 与连接信息。自定义 onOtpSendEmail/onOtpSendSms/onPasswordResetRequest 回调可独立于 Reach 使用，投递失败须拒绝 Promise；回调第三参数 context 提供 expiresAt/idempotencyKey，发送服务按稳定键持久化去重，异常/超时为结果未知且不自动重发。协议在 Modal 显示；LoginForm/RegisterForm 提供 header/extraFields/footer，AuthPanel 透传 loginHeader/loginFields/loginFooter 和 registerHeader/registerFields/registerFooter。配置及例子见生成项目的 hai-iam/hai-ui skills。
 
 协议支持配置中的 userAgreementMarkdown/privacyPolicyMarkdown 正文及 URL；同主题优先 Markdown，由安全渲染器在弹窗显示。
 

package/templates/apps/api/apps/{{projectName}}-service/config/_core.yml.hbs

@@ -5,7 +5,6 @@
 name: {{projectName}} API Service
 version: 0.1.0
 env: ${HAI_CORE_ENV:development}
-debug: ${HAI_CORE_DEBUG:false}
 
 logging:
   level: info
@@ -16,12 +15,3 @@ logging:
     - secret
 
 defaultLocale: {{defaultLocale}}
-supportedLocales:
-{{#if_eq defaultLocale 'en-US'}}  - en-US
-  - zh-CN
-{{else}}  - zh-CN
-  - en-US
-{{/if_eq}}
-
-features:
-  apiAccess: true

package/templates/apps/api/apps/{{projectName}}-service/config/_serv.yml.hbs

@@ -27,11 +27,13 @@ cors:
     - Content-Type
 {{#if features.crypto}}    - X-Client-Id
     - X-Encrypted
+    - X-Hai-Transport
 {{/if}}    - X-Hai-Locale
     - X-Request-Id
     - X-Requested-With
   exposedHeaders:
 {{#if features.crypto}}    - X-Encrypted
+    - X-Hai-Transport
 {{/if}}    - X-Request-Id
 
 {{#if features.crypto}}transport:
@@ -42,6 +44,5 @@ cors:
     - /openapi.json
     - /docs
     - /_hai/scalar.js
-  maxClients: 10000
 {{else}}transport: false
 {{/if}}

package/templates/apps/api/apps/{{projectName}}-service/src/app.ts.hbs

@@ -1,9 +1,12 @@
 import type { CoreConfig } from '@h-ai/core'
-import type { ServConfig } from '@h-ai/serv'
+import type { ServConfig{{#if features.crypto}}, ServTransportConfig{{/if}} } from '@h-ai/serv'
+{{#if features.crypto}}import process from 'node:process'
+{{/if}}
 import { core } from '@h-ai/core'
-{{#if features.crypto}}import { crypto } from '@h-ai/crypto'
+{{#if features.crypto}}import { {{#if features.db}}createReldbTransportKeyStore{{else}}createInMemoryKeyStore{{/if}}, crypto, parseTransportServerKeyRing } from '@h-ai/crypto'
 {{/if}}{{#if features.iam}}import { iam } from '@h-ai/iam'
-{{/if}}import { serv } from '@h-ai/serv'
+{{/if}}{{#if features.crypto}}{{#if features.db}}import { reldb } from '@h-ai/reldb'
+{{/if}}{{/if}}import { serv } from '@h-ai/serv'
 import { {{api.contractExportName}} } from '{{api.contractPackageName}}'
 import { {{api.serviceProceduresFactoryName}} } from './server/procedures/index.js'
 
@@ -24,14 +27,24 @@ export function {{api.serviceAppFactoryName}}(_options: CreateApiServiceAppOptio
     nativeOrigins: servConfig.cors.nativeOrigins,
   })
 {{#if features.crypto}}  const transportMode = _options.transport ?? 'config'
-  const transport = transportMode === 'disabled' || servConfig.transport === false
-    ? undefined
-    : {
-        crypto,
-        keyExchangePath: servConfig.transport.keyExchangePath,
-        excludePaths: [...servConfig.transport.excludePaths],
-        maxClients: servConfig.transport.maxClients,
-      }
+  let transport: ServTransportConfig | undefined
+  if (transportMode !== 'disabled' && servConfig.transport !== false) {
+{{#unless features.db}}    if (coreConfig.env !== 'development' && coreConfig.env !== 'test')
+      throw new Error('Production transport requires a shared registry; enable the db feature and configure a shared database')
+{{/unless}}
+    const ring = parseTransportServerKeyRing(process.env.HAI_CRYPTO_TRANSPORT_SERVERKEYRING)
+    if (!ring.success)
+      throw new Error(ring.error.message)
+    transport = {
+      crypto,
+      serverKeyRing: ring.data,
+{{#if features.db}}      keyStore: createReldbTransportKeyStore({ reldb, ttlSeconds: 3600 }),
+{{else}}      keyStore: createInMemoryKeyStore(), // 无 db 的模板仅在 development/test 使用内存 registry。
+{{/if}}
+      keyExchangePath: servConfig.transport.keyExchangePath,
+      excludePaths: [...servConfig.transport.excludePaths],
+    }
+  }
 {{else}}  const transport = undefined
 {{/if}}
 {{#if features.iam}}

package/templates/apps/api/apps/{{projectName}}-service/src/index.ts.hbs

@@ -21,7 +21,14 @@ async function main(): Promise<void> {
   })
 }
 
-main().catch((error: unknown) => {
+main().catch(async (error: unknown) => {
   core.logger.error('API service failed to start', { error })
   process.exitCode = 1
+  try {
+    // 包括初始化后的 app/transport 创建失败，均须释放已建立的连接。
+    await closeApp()
+  }
+  catch (cleanupError) {
+    core.logger.error('API service startup cleanup failed', { error: cleanupError })
+  }
 })

package/templates/apps/api/apps/{{projectName}}-service/src/lib/server/init.ts.hbs

@@ -21,23 +21,47 @@
 
 let initialized = false
 let initPromise: Promise<void> | null = null
+/** 记录启动/关闭后未确认释放的资源，使失败清理可以重试。 */
+let cleanupPending = false
+let closePromise: Promise<void> | null = null
 {{#if features.crypto}}let cryptoInitialized = false
 {{/if}}
 
+/**
+ * 合并并发启动；任一步失败先逆序清理，未释放的资源会在下次启动前重试。
+ * @throws Error | AggregateError - 启动失败，或启动与资源清理同时失败。
+ * @example
+ * await initApp()
+ */
 export async function initApp(): Promise<void> {
+  if (closePromise)
+    await closePromise
   if (initialized)
     return
   if (initPromise)
     return initPromise
+  if (cleanupPending) {
+    await closeApp()
+    return await initApp()
+  }
 
-  initPromise = doInit()
-  try {
-    await initPromise
+  cleanupPending = true
+  initPromise = doInit().then(() => {
     initialized = true
-  }
-  finally {
+    cleanupPending = false
+  }).catch(async (error: unknown) => {
+    // 私有清理不等待 initPromise，避免启动失败时等待自身。
+    try {
+      await cleanupModules()
+    }
+    catch (cleanupError) {
+      throw new AggregateError([error, cleanupError], 'Application startup and cleanup failed')
+    }
+    throw error
+  }).finally(() => {
     initPromise = null
-  }
+  })
+  return await initPromise
 }
 
 async function doInit(): Promise<void> {
@@ -160,16 +184,38 @@ async function doInit(): Promise<void> {
   core.logger.info('API service initialized')
 }
 
+/**
+ * 等待启动并关闭所有模块；失败时保留重试入口。
+ * @throws AggregateError - 任一资源未确认释放。
+ * @example
+ * await closeApp()
+ */
 export async function closeApp(): Promise<void> {
-  if (!initialized && !initPromise)
+  closePromise ??= doCloseApp().finally(() => {
+    closePromise = null
+  })
+  return await closePromise
+}
+
+/** 等待启动结束后逐一释放；HaiResult 失败与异常都会聚合报告并保留重试入口。 */
+async function doCloseApp(): Promise<void> {
+  if (!initialized && !initPromise && !cleanupPending)
     return
 
+  if (initPromise)
+    await initPromise.catch(() => undefined)
+  await cleanupModules()
+}
+
+/** 不等待启动屏障，供启动失败与显式关闭共用的逆序清理。 */
+async function cleanupModules(): Promise<void> {
+  const failures: unknown[] = []
   const closers: Array<readonly [string, () => unknown]> = [
 {{#if features.ai}}    ['ai', () => ai.close()],
 {{/if}}{{#if features.storage}}    ['storage', () => storage.close()],
 {{/if}}{{#if features.iam}}    ['iam', () => iam.close()],
-{{/if}}{{#if features.reach}}    ['reach', () => reach.close()],
 {{/if}}{{#if features.vecdb}}    ['vecdb', () => vecdb.close()],
+{{/if}}{{#if features.reach}}    ['reach', () => reach.close()],
 {{/if}}{{#if features.cache}}    ['cache', () => cache.close()],
 {{/if}}{{#if features.db}}    ['reldb', () => reldb.close()],
 {{/if}}  ]
@@ -180,14 +226,25 @@ export async function closeApp(): Promise<void> {
 
   for (const [name, close] of closers) {
     try {
-      await close()
+      const result = await close()
+      if (result && typeof result === 'object' && 'success' in result && result.success === false) {
+        failures.push('error' in result ? result.error : new Error('Module close failed'))
+        core.logger.warn(`Module close failed: ${name}`)
+        continue
+      }
+{{#if features.crypto}}      if (name === 'crypto')
+        cryptoInitialized = false
+{{/if}}
     }
     catch (error) {
+      failures.push(error)
       core.logger.warn(`Module close failed: ${name}`, { error })
     }
   }
 
   initialized = false
-{{#if features.crypto}}  cryptoInitialized = false
-{{/if}}  core.logger.info('API service closed')
+  cleanupPending = failures.length > 0
+  if (cleanupPending)
+    throw new AggregateError(failures, 'Application resource cleanup failed; retry closeApp()')
+  core.logger.info('API service closed')
 }

package/templates/apps/api/apps/{{projectName}}-service/src/server/procedures/index.ts.hbs

@@ -7,12 +7,20 @@ import type { AppProcedureDeps } from './app-procedures.js'
 import { storage } from '@h-ai/storage'
 {{/if}}import { createAppProcedures } from './app-procedures.js'
 
+// @hai-generator:procedures:imports
+
 /** 创建应用级 procedures 聚合。 */
 export function {{api.serviceProceduresFactoryName}}(deps: { app: AppProcedureDeps }) {
   return {
+    // @hai-generator:procedures:entries
 {{#if features.iam}}    iam: createIamProcedures({ iam }),
-{{/if}}{{#if features.storage}}    storage: createStorageProcedures({ storage }),
-{{/if}}{{#if features.ai}}    ai: createAiProcedures({ ai }),
+{{/if}}{{#if features.storage}}    storage: createStorageProcedures({
+      storage,
+      authorize: ({ context, keys }) => keys.every(key =>
+        key.startsWith(`users/${encodeURIComponent(context.session.userId)}/`)),
+    }),
+{{/if}}{{#if features.ai}}    // AI 默认绑定可信 session.userId，跨主体访问需另行提供 authorizeObject 策略。
+    ai: createAiProcedures({ ai }),
 {{/if}}    app: createAppProcedures(deps.app),
   }
 }

package/templates/apps/api/e2e/api-service.spec.ts.hbs

@@ -19,7 +19,7 @@ test.beforeAll(async () => {
     auth: { storage: apiClient.tokenStorage.memory() },
 {{/if}}
 {{#if features.crypto}}
-    transport: process.env.HAI_SERV_TRANSPORT === 'false' ? undefined : { crypto },
+    transport: { crypto },
 {{/if}}
   })
   expect(result.success).toBe(true)
@@ -46,7 +46,7 @@ test('service app.info endpoint returns HaiResult', async () => {
     return
   expect(body.data.name).toBe(process.env.HAI_CORE_NAME ?? '{{projectName}} API Service')
   expect(body.data.version).toBe(process.env.HAI_CORE_VERSION ?? '0.1.0')
-  expect(body.data.env).toBe(process.env.HAI_CORE_ENV ?? 'development')
+  expect(body.data.env).toBe('test')
   expect(typeof body.data.transportEnabled).toBe('boolean')
 })
 {{#if features.iam}}

package/templates/apps/api/package.json.hbs

@@ -13,7 +13,7 @@
     "start:prod": "pnpm --filter {{api.servicePackageName}} start:prod",
     "dev:test": "pnpm --filter {{api.servicePackageName}} dev:test",
     "dev:prod": "pnpm --filter {{api.servicePackageName}} dev:prod",
-    "compile": "pnpm --filter {{api.contractPackageName}} build && pnpm -r --if-present build",
+    "compile": "pnpm -r --if-present build",
     "build": "hai build",
 {{#if features.deploy}}
     "deploy": "hai deploy apps/{{projectName}}-service",

package/templates/apps/api/playwright.config.ts.hbs

@@ -1,5 +1,6 @@
 import process from 'node:process'
 import { defineConfig } from '@playwright/test'
+import { createE2eNotificationEnv, createE2eServerEnv, createE2eTransportRing } from './scripts/e2e-env.js'
 
 const defaultBaseURL = 'http://127.0.0.1:3000'
 const baseURL = process.env.BASE_URL || defaultBaseURL
@@ -33,25 +34,32 @@ function resolvePortFromBaseUrl(urlString: string, fallbackPort: string): string
 export default defineConfig({
   testDir: './e2e',
   globalSetup: './e2e/capture-evidence.ts',
-  fullyParallel: false,
+  fullyParallel: true,
   forbidOnly: !!process.env.CI,
-  retries: process.env.CI ? 2 : 0,
-  workers: 1,
+  retries: 0,
+  workers: 2,
   reporter: 'list',
   timeout: 30_000,
   use: {
     baseURL,
     channel: 'chrome',
-    trace: 'on-first-retry',
+    trace: 'retain-on-failure',
     screenshot: 'only-on-failure',
   },
   webServer: [{
     name: '{{api.servicePackageName}}',
-    command: 'pnpm --filter {{api.servicePackageName}} start',
-    env: {
+    command: 'pnpm --filter {{api.servicePackageName}} exec node dist/index.js',
+    env: createE2eServerEnv({
+      ...createE2eNotificationEnv(),
+      HAI_CORE_ENV: 'test',
+      HAI_DB: JSON.stringify({ type: 'sqlite', database: `${process.env.HAI_E2E_DATA_ROOT}/api.db` }),
+      HAI_CACHE: JSON.stringify({ type: 'memory' }),
+      HAI_STORAGE: JSON.stringify({ type: 'local', root: `${process.env.HAI_E2E_DATA_ROOT}/uploads` }),
+      HAI_VECDB: JSON.stringify({ type: 'lancedb', path: `${process.env.HAI_E2E_DATA_ROOT}/vecdb` }),
+      HAI_CRYPTO_TRANSPORT_SERVERKEYRING: createE2eTransportRing(),
       HOST: serviceHost,
       PORT: servicePort,
-    },
+    }),
     url: `${baseURL}/health`,
     reuseExistingServer: false,
     timeout: 120_000,

package/templates/apps/fullstack/apps/{{projectName}}-app/README.md.hbs

@@ -47,7 +47,7 @@ pnpm --filter {{projectName}}-app cap:build:ios
 
 服务端 `config/_iam.yml` 统一控制登录、注册、重置、协议与 `ui` 品牌。邮件/短信可用 `_reach.yml` 中的 Provider/标准模板或自定义发送回调。`AuthPanel` 使用安全公开配置及框架认证动作；无需在页面适配 Token、验证码倒计时和错误提示。单实例可使用 Memory；多实例需共享数据库与 Redis，并按工程根 README 配置写入路由和传输会话。
 
-LDAP/Reach 均可选：基础认证无需安装。默认 LDAP 客户端需在 IAM 服务端 workspace 安装 ldapts，再配置 login.ldap 与连接信息。自定义 onOtpSendEmail/onOtpSendSms/onPasswordResetRequest 回调可独立于 Reach 使用，投递失败须拒绝 Promise。协议在 Modal 显示；LoginForm/RegisterForm 提供 header/extraFields/footer，AuthPanel 透传 loginHeader/loginFields/loginFooter 和 registerHeader/registerFields/registerFooter。配置及例子见生成项目的 hai-iam/hai-ui skills。
+LDAP/Reach 均可选：基础认证无需安装。默认 LDAP 客户端需在 IAM 服务端 workspace 安装 ldapts，再配置 login.ldap 与连接信息。自定义 onOtpSendEmail/onOtpSendSms/onPasswordResetRequest 回调可独立于 Reach 使用，投递失败须拒绝 Promise；回调第三参数 context 提供 expiresAt/idempotencyKey，发送服务按稳定键持久化去重，异常/超时为结果未知且不自动重发。协议在 Modal 显示；LoginForm/RegisterForm 提供 header/extraFields/footer，AuthPanel 透传 loginHeader/loginFields/loginFooter 和 registerHeader/registerFields/registerFooter。配置及例子见生成项目的 hai-iam/hai-ui skills。
 
 协议支持配置中的 userAgreementMarkdown/privacyPolicyMarkdown 正文及 URL；同主题优先 Markdown，由安全渲染器在弹窗显示。
 

package/templates/apps/fullstack/apps/{{projectName}}-app/messages/ja-JP.json.hbs

@@ -0,0 +1,7 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.app}}
+{
+  "$schema": "https://inlang.com/schema/inlang-message-format",
+  "page_title": "{name}"
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-app/src/App.svelte.hbs

@@ -3,6 +3,7 @@
 <script lang="ts">
   import type { ManagementApiOptions } from '{{fullstack.sharedPackageName}}'
   import { capacitor, createCapacitorTokenStorage } from '@h-ai/capacitor'
+  import { core } from '@h-ai/core'
   import { Alert } from '@h-ai/ui/components/compounds/index'
   import { Button, Spinner } from '@h-ai/ui/components/primitives/index'
   import { onMount } from 'svelte'
@@ -29,7 +30,12 @@
   }
   onMount(() => {
     void initialize()
-    return () => void capacitor.close()
+    return () => {
+      void capacitor.close().then((closed) => {
+        if (!closed.success)
+          core.logger.warn('Native listener cleanup failed; retry on next initialization')
+      })
+    }
   })
 </script>
 

package/templates/apps/fullstack/apps/{{projectName}}-app/vite.config.ts.hbs

@@ -12,7 +12,7 @@ import { defineConfig } from 'vitest/config'
 const envDir = fileURLToPath(new URL('../../', import.meta.url))
 
 export default defineConfig(({ mode, command }) => {
-  const envResult = command === 'build' ? { success: true as const, data: {} as Record<string, string> } : core.config.loadEnvFiles({ mode, envDir })
+  const envResult = command === 'build' || process.env.HAI_E2E === '1' ? { success: true as const, data: {} as Record<string, string> } : core.config.loadEnvFiles({ mode, envDir })
   if (!envResult.success)
     throw new Error(envResult.error.message)
   const env = envResult.data

package/templates/apps/fullstack/apps/{{projectName}}-desktop/README.md.hbs

@@ -46,7 +46,7 @@ pnpm build --target desktop --platform windows --arch x64
 
 服务端 `config/_iam.yml` 统一控制登录、注册、重置、协议与 `ui` 品牌。邮件/短信可用 `_reach.yml` 中的 Provider/标准模板或自定义发送回调。`AuthPanel` 使用安全公开配置及框架认证动作；无需在页面适配 Token、验证码倒计时和错误提示。单实例可使用 Memory；多实例需共享数据库与 Redis，并按工程根 README 配置写入路由和传输会话。
 
-LDAP/Reach 均可选：基础认证无需安装。默认 LDAP 客户端需在 IAM 服务端 workspace 安装 ldapts，再配置 login.ldap 与连接信息。自定义 onOtpSendEmail/onOtpSendSms/onPasswordResetRequest 回调可独立于 Reach 使用，投递失败须拒绝 Promise。协议在 Modal 显示；LoginForm/RegisterForm 提供 header/extraFields/footer，AuthPanel 透传 loginHeader/loginFields/loginFooter 和 registerHeader/registerFields/registerFooter。配置及例子见生成项目的 hai-iam/hai-ui skills。
+LDAP/Reach 均可选：基础认证无需安装。默认 LDAP 客户端需在 IAM 服务端 workspace 安装 ldapts，再配置 login.ldap 与连接信息。自定义 onOtpSendEmail/onOtpSendSms/onPasswordResetRequest 回调可独立于 Reach 使用，投递失败须拒绝 Promise；回调第三参数 context 提供 expiresAt/idempotencyKey，发送服务按稳定键持久化去重，异常/超时为结果未知且不自动重发。协议在 Modal 显示；LoginForm/RegisterForm 提供 header/extraFields/footer，AuthPanel 透传 loginHeader/loginFields/loginFooter 和 registerHeader/registerFields/registerFooter。配置及例子见生成项目的 hai-iam/hai-ui skills。
 
 协议支持配置中的 userAgreementMarkdown/privacyPolicyMarkdown 正文及 URL；同主题优先 Markdown，由安全渲染器在弹窗显示。
 

package/templates/apps/fullstack/apps/{{projectName}}-desktop/messages/ja-JP.json.hbs

@@ -0,0 +1,7 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.desktop}}
+{
+  "$schema": "https://inlang.com/schema/inlang-message-format",
+  "page_title": "{name}"
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-desktop/vite.config.ts.hbs

@@ -13,7 +13,7 @@ const host = process.env.TAURI_DEV_HOST
 const envDir = fileURLToPath(new URL('../../', import.meta.url))
 
 export default defineConfig(({ mode, command }) => {
-  const envResult = command === 'build' ? { success: true as const, data: {} as Record<string, string> } : core.config.loadEnvFiles({ mode, envDir })
+  const envResult = command === 'build' || process.env.HAI_E2E === '1' ? { success: true as const, data: {} as Record<string, string> } : core.config.loadEnvFiles({ mode, envDir })
   if (!envResult.success)
     throw new Error(envResult.error.message)
   const env = envResult.data

package/templates/apps/fullstack/apps/{{projectName}}-miniapp/messages/ja-JP.json.hbs

@@ -0,0 +1,12 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.hasMiniapp}}
+{
+  "$schema": "https://inlang.com/schema/inlang-message-format",
+  "mini_title": "{{projectName}} ミニアプリ",
+  "mini_status": "予約済みのプレースホルダー",
+  "mini_description": "ミニアプリの対象では、まだビルド可能なパッケージは生成しません。標準のinlang project.inlangとmessagesを用意しているため、後でミニアプリ用フレームワークに組み込めます。",
+  "mini_shared_contract": "packages/{{fullstack.contractPackageName}}のスキーマとルート定数を再利用してください。",
+  "mini_own_messages": "ミニアプリ固有の文案はapps/{{projectName}}-miniapp/messagesに配置します。",
+  "mini_customize": "端末間の言語切り替えを揃えるため、言語一覧をsharedと一致させてください。"
+}
+{{/if}}

package/templates/apps/fullstack/apps/{{projectName}}-web/README.md.hbs

@@ -38,7 +38,7 @@ pnpm --filter {{projectName}}-web build
 
 服务端 `config/_iam.yml` 统一控制登录、注册、重置、协议与 `ui` 品牌。邮件/短信可用 `_reach.yml` 中的 Provider/标准模板或自定义发送回调。`AuthPanel` 使用安全公开配置及框架认证动作；无需在页面适配 Token、验证码倒计时和错误提示。单实例可使用 Memory；多实例需共享数据库与 Redis，并按工程根 README 配置写入路由和传输会话。
 
-LDAP/Reach 均可选：基础认证无需安装。默认 LDAP 客户端需在 IAM 服务端 workspace 安装 ldapts，再配置 login.ldap 与连接信息。自定义 onOtpSendEmail/onOtpSendSms/onPasswordResetRequest 回调可独立于 Reach 使用，投递失败须拒绝 Promise。协议在 Modal 显示；LoginForm/RegisterForm 提供 header/extraFields/footer，AuthPanel 透传 loginHeader/loginFields/loginFooter 和 registerHeader/registerFields/registerFooter。配置及例子见生成项目的 hai-iam/hai-ui skills。
+LDAP/Reach 均可选：基础认证无需安装。默认 LDAP 客户端需在 IAM 服务端 workspace 安装 ldapts，再配置 login.ldap 与连接信息。自定义 onOtpSendEmail/onOtpSendSms/onPasswordResetRequest 回调可独立于 Reach 使用，投递失败须拒绝 Promise；回调第三参数 context 提供 expiresAt/idempotencyKey，发送服务按稳定键持久化去重，异常/超时为结果未知且不自动重发。协议在 Modal 显示；LoginForm/RegisterForm 提供 header/extraFields/footer，AuthPanel 透传 loginHeader/loginFields/loginFooter 和 registerHeader/registerFields/registerFooter。配置及例子见生成项目的 hai-iam/hai-ui skills。
 
 协议支持配置中的 userAgreementMarkdown/privacyPolicyMarkdown 正文及 URL；同主题优先 Markdown，由安全渲染器在弹窗显示。
 

package/templates/apps/fullstack/apps/{{projectName}}-web/messages/ja-JP.json.hbs

@@ -0,0 +1,7 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.frontends.web}}
+{
+  "$schema": "https://inlang.com/schema/inlang-message-format",
+  "page_title": "{name}"
+}
+{{/if}}