@h-ai/cli 0.1.0-alpha9 → 1.0.0-beta.2

package/templates/base/src/hooks.server.ts.hbs

@@ -4,25 +4,50 @@
  * =============================================================================
  */
 
+{{#if features.crypto}}
+import type { TransportEncryptionOptions } from '@h-ai/kit'
+{{/if}}
 import type { Handle } from '@sveltejs/kit'
+{{#if features.cache}}
+import process from 'node:process'
+{{else}}
+{{#if features.crypto}}
+import process from 'node:process'
+{{/if}}
+{{/if}}
+{{#if hasI18n}}
+import { base } from '$app/paths'
+{{else}}
+{{#if features.iam}}
+import { base } from '$app/paths'
+{{else}}
+{{#if features.crypto}}
+import { base } from '$app/paths'
+{{/if}}
+{{/if}}
+{{/if}}
+{{#if hasI18n}}
+import { paraglideMiddleware } from '$lib/paraglide/server.js'
+{{/if}}
 import { initApp } from '$lib/server/init.js'
+import { getKitConfig } from '$lib/server/kit-config.js'
+{{#if features.cache}}
+import { cache } from '@h-ai/cache'
+{{/if}}
 import { core } from '@h-ai/core'
-import { kit } from '@h-ai/kit'
+{{#if features.crypto}}
+import { {{#if features.db}}createReldbTransportKeyStore{{else}}createInMemoryKeyStore{{/if}}, crypto, parseTransportServerKeyRing } from '@h-ai/crypto'
+{{/if}}
 {{#if features.iam}}
 import { iam } from '@h-ai/iam'
 {{/if}}
+import { kit } from '@h-ai/kit'
 {{#if features.crypto}}
-import { crypto } from '@h-ai/crypto'
+{{#if features.db}}
+import { reldb } from '@h-ai/reldb'
 {{/if}}
-{{#if hasI18n}}
-import { paraglideMiddleware } from '$lib/paraglide/server.js'
 {{/if}}
 
-{{#if features.crypto}}
-// 初始化加密模块（同步）
-crypto.init()
-
-{{/if}}
 // =============================================================================
 // 应用初始化
 // =============================================================================
@@ -59,19 +84,17 @@ const initHandle: Handle = async ({ event, resolve }) => {
  * API 请求跳过 paraglideMiddleware（不需要页面级 locale + 避免消耗 body）
  */
 const i18nHandle: Handle = async ({ event, resolve }) => {
-  if (event.url.pathname.startsWith('/api/')) {
+  if (event.url.pathname.startsWith(`${base}/api/`)) {
     const locale = event.cookies.get('PARAGLIDE_LOCALE') ?? '{{defaultLocale}}'
     event.locals.locale = locale
-    kit.i18n.setLocale(locale)
-    return resolve(event)
+    return kit.i18n.runWithLocale(locale, () => resolve(event))
   }
 
   return paraglideMiddleware(event.request, async ({ locale }) => {
     event.locals.locale = locale
-    kit.i18n.setLocale(locale)
-    return resolve(event, {
+    return kit.i18n.runWithLocale(locale, () => resolve(event, {
       transformPageChunk: ({ html }) => html.replace('%lang%', locale),
-    })
+    }))
   })
 }
 
@@ -80,35 +103,84 @@ const i18nHandle: Handle = async ({ event, resolve }) => {
 // hai Handle（会话验证 + 限流 + 日志）
 // =============================================================================
 
-const haiHandle = kit.createHandle({
-{{#if features.iam}}
-  auth: {
-    verifyToken: async (token) => {
-      const result = await iam.auth.verifyToken(token)
-      return result.success ? result.data : null
-    },
-    operations: iam.auth,
-    loginUrl: '/auth/login',
-    protectedPaths: ['/admin/*', '/api/*'],
-    publicPaths: ['/api/auth/*', '/api/public/*', '/api/health'],
-  },
-{{/if}}
-  rateLimit: { windowMs: 60000, maxRequests: 200 },
-  logging: { logBody: false },
-  onError: (error: unknown, _event) => {
-    core.logger.error('Request error:', { error })
-    return new Response(
-      JSON.stringify({
-        success: false,
-        error: {
-          code: 'INTERNAL_ERROR',
-          message: error instanceof Error ? error.message : 'Unknown error',
+let configuredHandle: Handle | undefined
+const haiHandle: Handle = async (input) => {
+  if (!configuredHandle) {
+    const settings = getKitConfig()
+{{#if features.crypto}}
+    let transport: TransportEncryptionOptions | undefined
+    if (settings.transport !== false) {
+{{#unless features.db}}
+      if (core.module.requiresSharedState(process.env))
+        throw new Error('Production transport requires the db feature and a shared database registry')
+{{/unless}}
+      const ring = parseTransportServerKeyRing(process.env.HAI_CRYPTO_TRANSPORT_SERVERKEYRING)
+      if (!ring.success)
+        throw new Error(`HAI_CRYPTO_TRANSPORT_SERVERKEYRING: ${ring.error.message} (${ring.error.code})`)
+      transport = {
+        ...settings.transport,
+        basePath: base,
+        serverKeyRing: ring.data,
+{{#if features.db}}
+        keyStore: createReldbTransportKeyStore({ reldb, ttlSeconds: 3600 }),
+{{else}}
+        keyStore: createInMemoryKeyStore(),
+{{/if}}
+      }
+    }
+{{else}}
+    if (settings.transport !== false)
+      throw new Error('Transport encryption requires the crypto feature; add it before enabling kit.transport')
+{{/if}}
+    configuredHandle = kit.createHandle({
+      trustedProxies: settings.trustedProxies,
+      access: settings.access,
+{{#if features.crypto}}
+      crypto: { crypto, transport },
+{{/if}}
+    {{#if features.iam}}
+      auth: {
+        verifyToken: async (token) => {
+          const result = await iam.auth.verifyToken(token)
+          if (!result.success)
+            return null
+          const session = result.data
+          // 映射为 kit 的 SessionData 形态（携带守卫所需的核心字段）
+          return {
+            userId: session.userId,
+            username: session.username,
+            roles: session.roles,
+            permissions: session.permissions,
+            data: session.data,
+          }
         },
-      }),
-      { status: 500, headers: { 'Content-Type': 'application/json' } },
-    )
-  },
-})
+        loginUrl: `${base}/auth/login`,
+        protectedPaths: ['/admin/*', '/api/*'].map(path => `${base}${path}`),
+        publicPaths: [...kit.auth.publicPaths, '/api/auth/logout', '/api/public/*', '/api/health'].map(path => `${base}${path}`),
+        operations: () => iam.auth,
+      },
+    {{/if}}
+    {{#if features.cache}}
+      rateLimit: { windowMs: 60000, maxRequests: 200, store: kit.middleware.createCacheRateLimitStore(cache, { namespace: '{{projectName}}', allowMemory: process.env.NODE_ENV !== 'production' || process.env.HAI_E2E === '1' }) },
+    {{else}}
+      // 未选择cache能力时不启用限流；启用前须接入共享原子store。
+      rateLimit: false,
+    {{/if}}
+      logging: { logBody: false },
+      onError: (error: unknown, _event) => {
+        core.logger.error('Request error:', { error })
+        return new Response(
+          JSON.stringify({
+            success: false,
+            error: core.error.toPublic({ code: 'INTERNAL_ERROR', message: '', httpStatus: 500 }),
+          }),
+          { status: 500, headers: { 'Content-Type': 'application/json' } },
+        )
+      },
+    })
+  }
+  return configuredHandle(input)
+}
 
 // =============================================================================
 // 组合 Handle

package/templates/base/src/lib/build-metadata.ts.hbs

@@ -0,0 +1,7 @@
+{{! @skipIfEmpty }}
+{{#if features.feedback}}
+/** 当前应用编译时烘焙的产物身份；运行时配置不能覆盖。 */
+declare const __HAI_BUILD_METADATA__: { appVersion: string, buildId: string, commit: string }
+
+export const buildMetadata = __HAI_BUILD_METADATA__
+{{/if}}

package/templates/base/src/lib/server/init.ts.hbs

@@ -1,190 +1,163 @@
-/**
- * =============================================================================
- * {{projectName}} - 应用初始化
- * =============================================================================
- *
- * 统一管理所有模块的初始化流程。
- *
- * 初始化顺序：
- * 1. core.init — 加载配置文件（约定优于配置）
-{{#if features.db}}
- * 2. reldb.init — 数据库连接
+/** 应用声明真实模块顺序；并发、失败回滚与关闭重试由 core 处理。 */
+{{#if features.ai}}
+import { ai, AIConfigSchema } from '@h-ai/ai'
+{{/if}}
+{{#if features.audit}}
+import { audit, AuditInitConfigSchema } from '@h-ai/audit'
 {{/if}}
 {{#if features.cache}}
- * 3. cache.init — 缓存
+import { cache, CacheConfigSchema } from '@h-ai/cache'
 {{/if}}
-{{#if features.storage}}
- * 4. storage.init — 文件存储（可选）
+import { core } from '@h-ai/core'
+{{#if features.crypto}}
+import { crypto } from '@h-ai/crypto'
 {{/if}}
-{{#if features.reach}}
- * 5. reach.init — 触达服务（可选）
+{{#if features.feedback}}
+import { feedback } from '@h-ai/feedback'
 {{/if}}
 {{#if features.iam}}
- * 6. iam.init — 身份认证
+import { iam, IamConfigSchema } from '@h-ai/iam'
 {{/if}}
-{{#if features.ai}}
- * 7. ai.init — AI 集成（可选）
+{{#if features.reach}}
+import { reach, ReachConfigSchema } from '@h-ai/reach'
 {{/if}}
- */
-
-import { core } from '@h-ai/core'
 {{#if features.db}}
 import { reldb, ReldbConfigSchema } from '@h-ai/reldb'
 {{/if}}
-{{#if features.cache}}
-import { cache, CacheConfigSchema } from '@h-ai/cache'
+{{#if features.audit}}
+{{#if features.scheduler}}
+import { scheduler, SchedulerConfigSchema } from '@h-ai/scheduler'
 {{/if}}
-{{#if features.iam}}
-import type { IamConfigSettingsInput } from '@h-ai/iam'
-import { iam } from '@h-ai/iam'
 {{/if}}
 {{#if features.storage}}
-import type { StorageConfigInput } from '@h-ai/storage'
 import { storage, StorageConfigSchema } from '@h-ai/storage'
 {{/if}}
-{{#if features.ai}}
-import type { AIConfigInput } from '@h-ai/ai'
-import { ai } from '@h-ai/ai'
-{{/if}}
-{{#if features.reach}}
-import type { ReachConfigInput } from '@h-ai/reach'
-import { reach } from '@h-ai/reach'
-{{/if}}
-{{#if features.audit}}
-import { audit } from '@h-ai/audit'
-{{/if}}
-
-{{#if features.db}}
-type DbConfigInput = Parameters<typeof reldb.init>[0]
-{{/if}}
-{{#if features.cache}}
-type CacheConfigInput = Parameters<typeof cache.init>[0]
-{{/if}}
-
-let initialized = false
-
-/**
- * 初始化应用
- */
-export async function initApp(): Promise<void> {
-  if (initialized)
-    return
+{{#if features.vecdb}}
+import { vecdb, VecdbConfigSchema } from '@h-ai/vecdb'
+{{/if}}
+{{#if features.feedback}}
+import { buildMetadata } from '../build-metadata.js'
+{{/if}}
+
+{{#if features.feedback}}
+let feedbackRetry: ReturnType<typeof setTimeout> | undefined
+let feedbackStarting: Promise<void> | undefined
+let feedbackClosing = false
+let feedbackFailure: string | number | undefined
+
+/** 可选辅助能力独立重试；不能回滚已经就绪的 IAM 与业务模块。 */
+function startFeedback(): Promise<void> {
+  if (feedbackStarting)
+    return feedbackStarting
+  feedbackClosing = false
+  feedbackStarting = (async () => {
+    try {
+      const result = await feedback.init({ ...core.config.getOrThrow<import('@h-ai/feedback').FeedbackConfigInput>('feedback'), ...buildMetadata })
+      if (!result.success) {
+        if (feedbackFailure !== result.error.code)
+          core.logger.warn('Optional feedback unavailable; business runtime remains ready', { module: 'feedback', code: result.error.code })
+        feedbackFailure = result.error.code
+      }
+      else {
+        feedbackFailure = undefined
+      }
+    }
+    catch {
+      if (feedbackFailure !== 'configuration')
+        core.logger.warn('Optional feedback configuration unavailable; business runtime remains ready', { module: 'feedback' })
+      feedbackFailure = 'configuration'
+    }
+    if (feedbackFailure && !feedbackClosing) {
+      feedbackRetry = setTimeout(() => {
+        feedbackRetry = undefined
+        void startFeedback()
+      }, 30000)
+      feedbackRetry.unref()
+    }
+  })().finally(() => { feedbackStarting = undefined })
+  return feedbackStarting
+}
 
-  // 1. 加载配置
-  core.init({
-    configDir: './config',
-    logging: { level: 'info' },
-  })
+async function closeFeedback() {
+  feedbackClosing = true
+  if (feedbackRetry)
+    clearTimeout(feedbackRetry)
+  feedbackRetry = undefined
+  await feedbackStarting
+  return feedback.close()
+}
 
-{{#if features.db}}
-  // ─── 配置校验 ───
-  const dbValidation = core.config.validate('db', ReldbConfigSchema)
-  if (!dbValidation.success) {
-    throw new Error(`DB config invalid: ${dbValidation.error.message}`)
-  }
-{{/if}}
-{{#if features.cache}}
-  const cacheValidation = core.config.validate('cache', CacheConfigSchema)
-  if (!cacheValidation.success) {
-    throw new Error(`Cache config invalid: ${cacheValidation.error.message}`)
-  }
 {{/if}}
 
+const runtime = core.module.createRuntime([
+  { name: 'configuration', start: () => { core.init({ configDir: './config' }) }, close: () => {} },
 {{#if features.db}}
-  // ─── 获取配置 ───
-  const dbConfig = core.config.getOrThrow<DbConfigInput>('db')
+  { name: 'reldb', start: async () => {
+    const config = ReldbConfigSchema.parse(core.config.getOrThrow('db'))
+    if (config.type === 'sqlite' && config.database !== ':memory:') {
+      const { mkdir } = await import('node:fs/promises')
+      const { dirname } = await import('node:path')
+      await mkdir(dirname(config.database), { recursive: true })
+    }
+    return reldb.init(config)
+  }, close: () => reldb.close() },
 {{/if}}
 {{#if features.cache}}
-  const cacheConfig = core.config.getOrThrow<CacheConfigInput>('cache')
-{{/if}}
-{{#if features.iam}}
-  const iamConfig = core.config.getOrThrow<IamConfigSettingsInput>('iam')
+  { name: 'cache', start: () => cache.init(CacheConfigSchema.parse(core.config.getOrThrow('cache'))), close: () => cache.close() },
 {{/if}}
-{{#if features.storage}}
-  const storageConfig = core.config.get<StorageConfigInput>('storage')
-{{/if}}
-{{#if features.ai}}
-  const aiConfig = core.config.get<AIConfigInput>('ai')
-{{/if}}
-{{#if features.reach}}
-  const reachConfig = core.config.get<ReachConfigInput>('reach')
-{{/if}}
-
-{{#if features.db}}
-  // ─── 确保数据目录存在（SQLite） ───
-  if (dbConfig.type === 'sqlite') {
-    const path = await import('node:path')
-    const fs = await import('node:fs')
-    const dbDir = path.dirname(dbConfig.database)
-    if (!fs.existsSync(dbDir)) {
-      fs.mkdirSync(dbDir, { recursive: true })
-    }
-  }
-
-  // ─── 初始化数据库 ───
-  const dbResult = await reldb.init(dbConfig)
-  if (!dbResult.success) {
-    throw new Error(`Database initialization failed: ${dbResult.error.message}`)
-  }
+{{#if features.vecdb}}
+  { name: 'vecdb', start: () => vecdb.init(VecdbConfigSchema.parse(core.config.getOrThrow('vecdb'))), close: () => vecdb.close() },
 {{/if}}
-
-{{#if features.cache}}
-  // ─── 初始化缓存 ───
-  const cacheResult = await cache.init(cacheConfig)
-  if (!cacheResult.success) {
-    throw new Error(`Cache initialization failed: ${cacheResult.error.message}`)
-  }
+{{#if features.crypto}}
+  { name: 'crypto', start: () => crypto.init(), close: () => crypto.close() },
 {{/if}}
-
 {{#if features.storage}}
-  // ─── 初始化存储（可选） ───
-  if (storageConfig) {
-    const storageValidation = core.config.validate('storage', StorageConfigSchema)
-    if (storageValidation.success) {
-      const storageResult = await storage.init(storageConfig)
-      if (!storageResult.success) {
-        core.logger.warn('Storage initialization failed', { error: storageResult.error.message })
-      }
-    }
-  }
+  { name: 'storage', start: () => storage.init(StorageConfigSchema.parse(core.config.getOrThrow('storage'))), close: () => storage.close() },
 {{/if}}
-
 {{#if features.reach}}
-  // ─── 初始化触达服务（可选） ───
-  if (reachConfig) {
-    const reachResult = await reach.init(reachConfig)
-    if (!reachResult.success) {
-      core.logger.warn('Reach initialization failed', { error: reachResult.error.message })
-    }
-  }
+  { name: 'reach', enabled: () => Boolean(core.config.get('reach')), start: () => reach.init(ReachConfigSchema.parse(core.config.getOrThrow('reach'))), close: () => reach.close() },
+{{/if}}
+{{#if features.audit}}
+  { name: 'audit', start: () => audit.init({ ...AuditInitConfigSchema.parse(core.config.get('audit') ?? {}){{#if features.storage}}, storage{{/if}}{{#if features.reach}}, reach{{/if}} }), close: () => audit.close() },
 {{/if}}
-
 {{#if features.iam}}
-  // ─── 初始化 IAM ───
-  const iamResult = await iam.init(iamConfig)
-  if (!iamResult.success) {
-    throw new Error(`IAM initialization failed: ${iamResult.error.message}`)
-  }
+  { name: 'iam', start: () => iam.init({ ...IamConfigSchema.parse(core.config.getOrThrow('iam')){{#if features.reach}}, reach{{/if}} }), close: () => iam.close() },
 {{/if}}
-
 {{#if features.audit}}
-  // ─── 初始化审计 ───
-  const auditResult = await audit.init()
-  if (!auditResult.success) {
-    core.logger.warn('Audit initialization failed', { error: auditResult.error.message })
-  }
+{{#if features.scheduler}}
+  { name: 'audit-jobs', enabled: () => Boolean(audit.schedulerPlan), start: async () => {
+    const schedule = audit.schedulerPlan
+    if (!schedule)
+      return
+    const initialized = await scheduler.init({ ...SchedulerConfigSchema.parse(core.config.get('scheduler') ?? {}), ...schedule })
+    if (!initialized.success)
+      return initialized
+    const started = scheduler.start()
+    if (!started.success)
+      await scheduler.close()
+    return started
+  }, close: () => scheduler.close() },
+{{/if}}
+{{/if}}
+{{#if features.feedback}}
+  { name: 'feedback', enabled: () => Boolean(core.config.get('feedback')), start: startFeedback, close: closeFeedback },
 {{/if}}
-
 {{#if features.ai}}
-  // ─── 初始化 AI（可选） ───
-  if (aiConfig?.llm?.apiKey) {
-    const aiResult = await ai.init(aiConfig)
-    if (!aiResult.success) {
-      core.logger.warn('AI initialization failed', { error: aiResult.error.message })
-    }
-  }
+  { name: 'ai', start: () => ai.init(AIConfigSchema.parse(core.config.getOrThrow('ai'))), close: () => ai.close() },
 {{/if}}
+  { name: 'bootstrap', start: () => { core.logger.info('Application initialized') }, close: () => {} },
+])
+
+/** 启动失败只报告模块、错误码和配置路径，私密值不进入错误上下文。 */
+export async function initApp(): Promise<void> {
+  const result = await runtime.start()
+  if (!result.success)
+    throw new Error(result.error.message, { cause: result.error })
+}
 
-  initialized = true
-  core.logger.info('{{projectName}} initialized.')
+/** 清理失败时保留依赖和清理义务，可再次调用。 */
+export async function closeApp(): Promise<void> {
+  const result = await runtime.close()
+  if (!result.success)
+    throw new Error(result.error.message, { cause: result.error })
 }

package/templates/base/src/lib/server/kit-config.ts.hbs

@@ -0,0 +1,40 @@
+{{! @skipIfEmpty }}
+{{#unless isSvelteOnlyApp}}
+import type { KitConfig } from '@h-ai/kit'
+import { base } from '$app/paths'
+import { core } from '@h-ai/core'
+import { KitConfigSchema } from '@h-ai/kit'
+
+let configured: KitConfig | undefined
+
+/** 输入已由 Schema 校验为绝对路径；宿主补构建目录并保留绝对路径类型。 */
+function mounted(path: string): `/${string}` {
+  if (!base || path === base || path.startsWith(`${base}/`))
+    return `/${path.slice(1)}`
+  return `/${base.slice(1)}${path}`
+}
+
+/** 启动时固定服务端配置；浏览器只能接收根 load 明确投影的 transport。 */
+export function getKitConfig(): KitConfig {
+  if (configured)
+    return configured
+  const loaded = core.config.load('kit', './config/_kit.yml', KitConfigSchema)
+  if (!loaded.success)
+    throw new Error(loaded.error.message)
+  const transport = loaded.data.transport
+  configured = {
+    ...loaded.data,
+    transport: transport === false
+      ? false
+      : {
+          ...transport,
+          keyExchangePath: mounted(transport.keyExchangePath),
+          excludePaths: transport.excludePaths.map(mounted),
+          routePlaintextBytes: transport.routePlaintextBytes
+            ? Object.fromEntries(Object.entries(transport.routePlaintextBytes).map(([path, bytes]) => [mounted(path), bytes]))
+            : undefined,
+        },
+  }
+  return configured
+}
+{{/unless}}

package/templates/base/src/routes/+layout.server.ts.hbs

@@ -0,0 +1,35 @@
+{{! @skipIfEmpty }}
+{{#unless isSvelteOnlyApp}}
+import type { CoreConfig } from '@h-ai/core'
+import type { KitPublicConfig } from '@h-ai/kit'
+import { getKitConfig } from '$lib/server/kit-config.js'
+import { core } from '@h-ai/core'
+{{#if features.iam}}
+import { iam } from '@h-ai/iam'
+import { error } from '@sveltejs/kit'
+{{/if}}
+
+/** 只向浏览器提供公开配置，避免暴露日志上下文、凭证或其它模块配置。 */
+export async function load() {
+  const config = core.config.getOrThrow<CoreConfig>('core')
+{{#if features.iam}}
+  const publicConfig = await iam.getPublicConfig()
+  if (!publicConfig.success) {
+    core.logger.error('Failed to load public authentication configuration', { error: publicConfig.error })
+    error(503, { message: core.error.toPublic(publicConfig.error).message })
+  }
+{{/if}}
+  return {
+    kitConfig: { transport: getKitConfig().transport } satisfies KitPublicConfig,
+{{#if features.iam}}
+    iamPublicConfig: publicConfig.data,
+{{/if}}
+    appConfig: {
+      name: config.name,
+      version: config.version,
+      env: config.env,
+      defaultLocale: config.defaultLocale,
+    },
+  }
+}
+{{/unless}}