@h-ai/cli 1.0.0-beta.15 → 1.0.0-beta.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/{chunk-H4JCLCNZ.js → chunk-S2ZP7BHG.js} +10 -2
- package/dist/chunk-S2ZP7BHG.js.map +1 -0
- package/dist/cli-config-templates-MKVYSK3E.js +5 -0
- package/dist/{cli-config-templates-Y5B3DCCP.js.map → cli-config-templates-MKVYSK3E.js.map} +1 -1
- package/dist/index.js +2 -2
- package/dist/metafile-esm.json +1 -1
- package/package.json +14 -14
- package/templates/apps/api/apps/{{projectName}}-serv/README.md.hbs +2 -0
- package/templates/apps/fullstack/packages/{{projectName}}-serv/README.md.hbs +1 -0
- package/templates/base/package.json.hbs +1 -1
- package/templates/skills/hai-deploy/SKILL.md +2 -0
- package/templates/skills/hai-serv/reference.md +5 -3
- package/dist/chunk-H4JCLCNZ.js.map +0 -1
- package/dist/cli-config-templates-Y5B3DCCP.js +0 -5
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@h-ai/cli",
|
|
3
3
|
"type": "module",
|
|
4
|
-
"version": "1.0.0-beta.
|
|
4
|
+
"version": "1.0.0-beta.16",
|
|
5
5
|
"description": "Hai Framework CLI for project scaffolding and code generation.",
|
|
6
6
|
"license": "Apache-2.0",
|
|
7
7
|
"keywords": [
|
|
@@ -30,7 +30,7 @@
|
|
|
30
30
|
"node": "^22.23.4 || ^24.22.1 || ^26.12.1"
|
|
31
31
|
},
|
|
32
32
|
"dependencies": {
|
|
33
|
-
"@h-ai/core": "1.0.0-beta.
|
|
33
|
+
"@h-ai/core": "1.0.0-beta.16",
|
|
34
34
|
"cac": "^7.0.1",
|
|
35
35
|
"chalk": "^6.0.1",
|
|
36
36
|
"fast-wrap-ansi": "^0.2.2",
|
|
@@ -41,18 +41,18 @@
|
|
|
41
41
|
"yaml": "^2.9.1"
|
|
42
42
|
},
|
|
43
43
|
"devDependencies": {
|
|
44
|
-
"@h-ai/api-client": "1.0.0-beta.
|
|
45
|
-
"@h-ai/cache": "1.0.0-beta.
|
|
46
|
-
"@h-ai/crypto": "1.0.0-beta.
|
|
47
|
-
"@h-ai/deploy": "1.0.0-beta.
|
|
48
|
-
"@h-ai/feedback": "1.0.0-beta.
|
|
49
|
-
"@h-ai/iam": "1.0.0-beta.
|
|
50
|
-
"@h-ai/kit": "1.0.0-beta.
|
|
51
|
-
"@h-ai/payment": "1.0.0-beta.
|
|
52
|
-
"@h-ai/reach": "1.0.0-beta.
|
|
53
|
-
"@h-ai/reldb": "1.0.0-beta.
|
|
54
|
-
"@h-ai/storage": "1.0.0-beta.
|
|
55
|
-
"@h-ai/vecdb": "1.0.0-beta.
|
|
44
|
+
"@h-ai/api-client": "1.0.0-beta.16",
|
|
45
|
+
"@h-ai/cache": "1.0.0-beta.16",
|
|
46
|
+
"@h-ai/crypto": "1.0.0-beta.16",
|
|
47
|
+
"@h-ai/deploy": "1.0.0-beta.16",
|
|
48
|
+
"@h-ai/feedback": "1.0.0-beta.16",
|
|
49
|
+
"@h-ai/iam": "1.0.0-beta.16",
|
|
50
|
+
"@h-ai/kit": "1.0.0-beta.16",
|
|
51
|
+
"@h-ai/payment": "1.0.0-beta.16",
|
|
52
|
+
"@h-ai/reach": "1.0.0-beta.16",
|
|
53
|
+
"@h-ai/reldb": "1.0.0-beta.16",
|
|
54
|
+
"@h-ai/storage": "1.0.0-beta.16",
|
|
55
|
+
"@h-ai/vecdb": "1.0.0-beta.16",
|
|
56
56
|
"@types/fs-extra": "^11.0.4",
|
|
57
57
|
"@types/node": "^26.6.5",
|
|
58
58
|
"@types/prompts": "^2.4.9",
|
|
@@ -23,6 +23,8 @@ pnpm --filter {{api.servPackageName}} test
|
|
|
23
23
|
|
|
24
24
|
|
|
25
25
|
- 配置默认打包自本目录 `config/`，可在运行时只读挂载到 `/app/config`，敏感值通过环境变量注入。
|
|
26
|
+
{{#if features.iam}}- 受控内网或 VPN 的生产 HTTP 入口可设置 `HAI_SERV_REFRESH_COOKIE_SECURE=false` 和实际 `HAI_SERV_CORS_ORIGIN`，重新部署后端后重新登录。刷新凭据会经 HTTP 明文传输。
|
|
27
|
+
{{/if}}
|
|
26
28
|
|
|
27
29
|
|
|
28
30
|
### 关键目录
|
|
@@ -53,6 +53,7 @@ CLI 同时在根 `.env.dev.local/.env.test.local/.env.prod.local` 分别生成
|
|
|
53
53
|
- 服务镜像直接由 `@h-ai/serv` 对外监听，配置挂载点为 `/app/config`，数据目录为 `/app/data`，不包含额外转发进程。
|
|
54
54
|
- Web 镜像不烘焙 API 地址；启动时使用 `-e PUBLIC_API_BASE=https://api.example.com` 注入，同一镜像可部署到不同环境。未设置时 Web 默认请求自身 origin。
|
|
55
55
|
- YAML 配置使用 `${ENV_NAME:default}` 接收运行时环境变量；不要把密钥写入镜像。
|
|
56
|
+
- 受控内网或 VPN 的生产 HTTP 入口可在 `.env.prod.local` 设置 `HAI_SERV_REFRESH_COOKIE_SECURE=false` 和实际 `HAI_SERV_CORS_ORIGIN`，重新部署后端后重新登录。刷新凭据会经 HTTP 明文传输。
|
|
56
57
|
|
|
57
58
|
### IAM 认证配置
|
|
58
59
|
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"engines": { "node": "^22.23.4 || ^24.22.1 || ^26.12.1" },
|
|
3
3
|
"name": "{{projectName}}",
|
|
4
|
-
"version": "1.0.0-beta.
|
|
4
|
+
"version": "1.0.0-beta.16",
|
|
5
5
|
"private": true,
|
|
6
6
|
"packageManager": "pnpm@12.11.2",
|
|
7
7
|
"description": "{{#if_eq appType 'admin'}}Enterprise management system built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'website'}}Enterprise website built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'h5'}}Mobile H5 app built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'api'}}REST API service built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'mobile-app'}}Mobile app built with hai Agent Framework{{/if_eq}}",
|
|
@@ -49,6 +49,8 @@ description: "构建并发布或交付已有镜像：完整离线包、按服务
|
|
|
49
49
|
|
|
50
50
|
默认.tar.gz，显式--output release.tar为未压缩，README仅外层。镜像从解包目录导入，release只留配置/恢复状态；成功后清理本次incoming，失败保留诊断。中间件归档按镜像内容ID缓存且复用前验摘要。
|
|
51
51
|
|
|
52
|
+
Serv 生产登录的刷新 Cookie 默认带 `Secure`。受控内网或 VPN 的 HTTP 部署可在所选 `.env.prod.local` 配置 `HAI_SERV_REFRESH_COOKIE_SECURE=false` 和实际 `HAI_SERV_CORS_ORIGIN`，再重新部署后端。详见 [Serv Cookie 配置](../hai-serv/reference.md#cookie-规格)。
|
|
53
|
+
|
|
52
54
|
## 后端运行配置重载
|
|
53
55
|
|
|
54
56
|
交付 README 仅列初始账号变量名及所选环境文件或 `process.env` 来源，不打印密码。Fullstack 初始密码在创建工程时生成，部署带入已有值；已有账号不因环境变量变更重置密码或恢复旧职责，自定义应用以实际引导逻辑为准。
|
|
@@ -113,7 +113,7 @@ const app = serv.createApp({
|
|
|
113
113
|
- 生产环境 `cors.origin` 禁止为空或 `*`，启动时 fail-fast。
|
|
114
114
|
- 普通 Web Origin 仅接受 HTTP(S)；原生 Origin 通过 `cors.nativeOrigins` 显式允许 HTTP(S)、Capacitor 或 Tauri。
|
|
115
115
|
- Origin 按完整规范化值精确匹配，不使用前缀/后缀匹配。
|
|
116
|
-
-
|
|
116
|
+
- 生产环境默认给刷新 Cookie 加 `Secure`，并关闭 OpenAPI 和 docs。受控内网或 VPN 的 HTTP 入口可在后端进程设置 `HAI_SERV_REFRESH_COOKIE_SECURE=false`，重启并重新登录。HTTP 会明文传输刷新凭据，生产 CORS 仍须配置完整的实际 Origin。
|
|
117
117
|
|
|
118
118
|
### 2.1 Audio WebSocket 安全接入
|
|
119
119
|
|
|
@@ -750,7 +750,7 @@ const app = serv.createApp({
|
|
|
750
750
|
refreshCookie: {
|
|
751
751
|
// cookieName?: string 默认 'hai_refresh_token'
|
|
752
752
|
// maxAge?: number 默认 30 * 24 * 3600（30 天）
|
|
753
|
-
// secure?: boolean
|
|
753
|
+
// secure?: boolean 显式值优先于后端变量 HAI_SERV_REFRESH_COOKIE_SECURE
|
|
754
754
|
// onRefresh?: (token) => ... 可选：覆盖默认的 iam.session.refresh
|
|
755
755
|
nativeTokenTransport: {
|
|
756
756
|
// 必须 fail-closed：同时校验平台标识与允许的原生 Origin。
|
|
@@ -773,9 +773,11 @@ const app = serv.createApp({
|
|
|
773
773
|
| Path | `{apiPrefix}/auth/refresh`（最小范围） |
|
|
774
774
|
| HttpOnly | ✓ |
|
|
775
775
|
| SameSite | `Strict` |
|
|
776
|
-
| Secure |
|
|
776
|
+
| Secure | 显式 `secure` 优先，然后读取 `HAI_SERV_REFRESH_COOKIE_SECURE` 的 `true` 或 `false`，其余值按环境默认 |
|
|
777
777
|
| Max-Age | 30 天（可配置） |
|
|
778
778
|
|
|
779
|
+
直接调用 `serv.createApp` 时，环境默认根据 `NODE_ENV` 或 `HAI_CORE_ENV` 是否为 `production` 判断。通过 `serv.createRuntimeSecurityPolicy` 赋值时，策略的默认值来自传入的 `environment`。测试开关不参与该判断。
|
|
780
|
+
|
|
779
781
|
## 测试
|
|
780
782
|
|
|
781
783
|
```bash
|