@h-ai/cli 1.0.0-beta.2 → 1.0.0-beta.21

package/templates/apps/api/apps/{{projectName}}-serv/src/app.ts.hbs

@@ -1,14 +1,27 @@
 import type { CoreConfig } from '@h-ai/core'
 import type { {{#if features.feedback}}CreateServContext, {{/if}}ServConfig{{#if features.crypto}}, ServTransportConfig{{/if}} } from '@h-ai/serv'
-{{#if features.crypto}}import process from 'node:process'
-{{/if}}
-{{#if features.feedback}}import { resolveFeedbackBudget } from '@h-ai/api-contract/feedback'
-{{/if}}import { core } from '@h-ai/core'
-{{#if features.crypto}}import { {{#if features.db}}createReldbTransportKeyStore{{else}}createInMemoryKeyStore{{/if}}, crypto, parseTransportServerKeyRing } from '@h-ai/crypto'
-{{/if}}{{#if features.feedback}}import { FeedbackConfigSchema } from '@h-ai/feedback'
-{{/if}}{{#if features.iam}}import { iam } from '@h-ai/iam'
-{{/if}}{{#if features.crypto}}{{#if features.db}}import { reldb } from '@h-ai/reldb'
-{{/if}}{{/if}}import { serv } from '@h-ai/serv'
+{{#if features.crypto}}
+import process from 'node:process'
+{{/if}}
+{{#if features.feedback}}
+import { resolveFeedbackBudget } from '@h-ai/api-contract/feedback'
+{{/if}}
+import { core } from '@h-ai/core'
+{{#if features.crypto}}
+import { {{#if features.db}}createReldbTransportKeyStore{{else}}createInMemoryKeyStore{{/if}}, crypto, parseTransportServerKeyRing } from '@h-ai/crypto'
+{{/if}}
+{{#if features.feedback}}
+import { FeedbackConfigSchema } from '@h-ai/feedback'
+{{/if}}
+{{#if features.iam}}
+import { iam } from '@h-ai/iam'
+{{/if}}
+{{#if features.crypto}}
+{{#if features.db}}
+import { reldb } from '@h-ai/reldb'
+{{/if}}
+{{/if}}
+import { serv } from '@h-ai/serv'
 import { {{api.contractExportName}} } from '{{api.contractPackageName}}'
 import { {{api.serviceProceduresFactoryName}} } from './server/procedures/index.js'
 
@@ -28,45 +41,80 @@ export function {{api.serviceAppFactoryName}}(_options: CreateApiServiceAppOptio
     corsOrigin: servConfig.cors.origin,
     nativeOrigins: servConfig.cors.nativeOrigins,
   })
-{{#if features.crypto}}  const transportMode = _options.transport ?? 'config'
+{{#if features.crypto}}
+  const transportMode = _options.transport ?? 'config'
   let transport: ServTransportConfig | undefined
   if (transportMode !== 'disabled' && servConfig.transport !== false) {
-{{#unless features.db}}    if (coreConfig.env !== 'development' && coreConfig.env !== 'test')
-      throw new Error('Production transport requires a shared registry; enable the db feature and configure a shared database')
+{{#unless features.db}}
+if (coreConfig.env !== 'development' && coreConfig.env !== 'test')
+                throw new Error('Production transport requires a shared registry; enable the db feature and configure a shared database')
 {{/unless}}
     const ring = parseTransportServerKeyRing(process.env.HAI_CRYPTO_TRANSPORT_SERVERKEYRING)
     if (!ring.success)
       throw new Error(`HAI_CRYPTO_TRANSPORT_SERVERKEYRING: ${ring.error.message} (${ring.error.code})`)
-{{#if features.feedback}}    // 可选反馈故障重试期间仍使用配置预算，避免缓存默认容量。
+{{#if features.feedback}}
+    // 可选反馈故障重试期间仍使用配置预算，避免缓存默认容量。
     const feedbackSettings = FeedbackConfigSchema.safeParse(core.config.get('feedback'))
-    const feedbackBudget = resolveFeedbackBudget(feedbackSettings.success ? feedbackSettings.data : {})
-{{/if}}    transport = {
+    const feedbackBudget = resolveFeedbackBudget(feedbackSettings.success
+      ? feedbackSettings.data
+      : {})
+{{/if}}
+    transport = {
       crypto,
       serverKeyRing: ring.data,
-{{#if features.db}}      keyStore: createReldbTransportKeyStore({ reldb, ttlSeconds: 3600 }),
-{{else}}      keyStore: createInMemoryKeyStore(), // 无 db 的模板仅在 development/test 使用内存 registry。
+{{#if features.db}}
+      keyStore: createReldbTransportKeyStore({ reldb, ttlSeconds: 3600 }),
+{{else}}
+keyStore: createInMemoryKeyStore(), // 无 db 的模板仅在 development/test 使用内存 registry。
 {{/if}}
       keyExchangePath: servConfig.transport.keyExchangePath,
       maxPlaintextBytes: servConfig.transport.maxPlaintextBytes,
-{{#if features.feedback}}      routePlaintextBytes: {
+      maxFutureSkewSeconds: servConfig.transport.maxFutureSkewSeconds,
+      maxRequestAgeSeconds: servConfig.transport.maxRequestAgeSeconds,
+{{#if features.feedback}}
+      routePlaintextBytes: {
         [`${servConfig.http.apiPrefix}/feedback/reports`]: feedbackBudget.maxTransportBytes,
         [`${servConfig.http.apiPrefix}/feedback/reports/*/evidence`]: feedbackBudget.maxTransportBytes,
         [`${servConfig.http.apiPrefix}/feedback/reports/*/attachments/*`]: feedbackBudget.maxTransportBytes,
         [`${servConfig.http.apiPrefix}/feedback/reports/*/exports/*`]: feedbackBudget.maxTransportBytes,
         ...servConfig.transport.routePlaintextBytes,
       },
-{{else}}      routePlaintextBytes: servConfig.transport.routePlaintextBytes,
+{{else}}
+routePlaintextBytes: servConfig.transport.routePlaintextBytes,
 {{/if}}
-      excludePaths: [...servConfig.transport.excludePaths],
+      excludePaths: [
+        ...new Set([
+          ...servConfig.transport.excludePaths,
+          ...(servConfig.http.health
+            ? [servConfig.http.health.path, servConfig.http.health.readyPath].filter((path): path is `/${string}` => Boolean(path))
+            : []),
+          ...(servConfig.http.openapi && security.exposeApiDocs
+            ? [servConfig.http.openapi.path]
+            : []),
+          ...(servConfig.http.docs && security.exposeApiDocs
+            ? [servConfig.http.docs.path, `${servConfig.http.docs.path.slice(0, servConfig.http.docs.path.lastIndexOf('/') + 1)}_hai/scalar.js`]
+            : []),
+        ]),
+      ],
     }
   }
-{{else}}  const transport = undefined
+{{else}}
+  const transport = undefined
 {{/if}}
 {{#if features.iam}}
-  const refreshCookie = _options.refreshCookie === 'disabled' ? undefined : { secure: security.secureRefreshCookie }
+  const refreshCookie = _options.refreshCookie === 'disabled'
+    ? undefined
+    : {
+        secure: security.secureRefreshCookie,
+        nativeTokenTransport: {
+          isRequest: (request: Request) => request.headers.get('x-hai-token-transport') === 'body'
+            && ['hai-mobile-app', 'hai-desktop-app'].includes(request.headers.get('x-request-client') ?? '')
+            && security.isNativeOrigin(request.headers.get('origin') ?? ''),
+        },
+      }
 {{/if}}
 {{#if features.feedback}}
-  // 普通业务日志与反馈使用同一可信应用范围；身份仍由 IAM 验证。
+      // 普通业务日志与反馈使用同一可信应用范围；身份仍由 IAM 验证。
   const authenticatedContext = serv.buildAuthContextFactory(token => iam.auth.verifyToken(token))
   const createContext: CreateServContext = async input => ({
     ...await authenticatedContext(input),
@@ -108,7 +156,9 @@ export function {{api.serviceAppFactoryName}}(_options: CreateApiServiceAppOptio
         middleware: serv.cors({
           origin: security.allowOrigin,
           credentials: servConfig.cors.credentials,
-          allowedHeaders: [...servConfig.cors.allowedHeaders],
+          allowedHeaders: [
+            ...new Set([...servConfig.cors.allowedHeaders, 'x-request-client', 'x-hai-token-transport']),
+          ],
           exposedHeaders: [...servConfig.cors.exposedHeaders],
         }),
       },

package/templates/apps/api/apps/{{projectName}}-serv/src/build-metadata.ts.hbs

@@ -2,6 +2,5 @@
 {{#if features.feedback}}
 /** 当前应用编译时烘焙的产物身份；运行时配置不能覆盖。 */
 declare const __HAI_BUILD_METADATA__: { appVersion: string, buildId: string, commit: string }
-
 export const buildMetadata = __HAI_BUILD_METADATA__
 {{/if}}

package/templates/apps/api/apps/{{projectName}}-serv/src/lib/server/init.ts.hbs

@@ -13,7 +13,7 @@ import { core } from '@h-ai/core'
 import { crypto } from '@h-ai/crypto'
 {{/if}}
 {{#if features.feedback}}
-import { feedback } from '@h-ai/feedback'
+import { feedback, FeedbackConfigSchema } from '@h-ai/feedback'
 {{/if}}
 {{#if features.iam}}
 import { iam, IamConfigSchema } from '@h-ai/iam'
@@ -24,12 +24,12 @@ import { reach, ReachConfigSchema } from '@h-ai/reach'
 {{#if features.db}}
 import { reldb, ReldbConfigSchema } from '@h-ai/reldb'
 {{/if}}
-import { ServConfigSchema } from '@h-ai/serv'
 {{#if features.audit}}
 {{#if features.scheduler}}
 import { scheduler, SchedulerConfigSchema } from '@h-ai/scheduler'
 {{/if}}
 {{/if}}
+import { ServConfigSchema } from '@h-ai/serv'
 {{#if features.storage}}
 import { storage, StorageConfigSchema } from '@h-ai/storage'
 {{/if}}
@@ -53,7 +53,10 @@ function startFeedback(): Promise<void> {
   feedbackClosing = false
   feedbackStarting = (async () => {
     try {
-      const result = await feedback.init({ ...core.config.getOrThrow<import('@h-ai/feedback').FeedbackConfigInput>('feedback'), ...buildMetadata })
+      const result = await feedback.init({
+        ...core.config.getOrThrow<import('@h-ai/feedback').FeedbackConfigInput>('feedback'),
+        ...buildMetadata,
+      })
       if (!result.success) {
         if (feedbackFailure !== result.error.code)
           core.logger.warn('Optional feedback unavailable; business runtime remains ready', { module: 'feedback', code: result.error.code })
@@ -87,67 +90,180 @@ async function closeFeedback() {
   await feedbackStarting
   return feedback.close()
 }
-
 {{/if}}
 
 const runtime = core.module.createRuntime([
-  { name: 'configuration', start: () => { core.init({ configDir: './config' }) }, close: () => {} },
-  { name: 'serv-config', start: () => core.config.validate('serv', ServConfigSchema), close: () => {} },
+  {
+    name: 'configuration',
+    start: () => {
+      core.init({
+        configDir: './config',
+        configSchemas: {
+          serv: ServConfigSchema,
+{{#if features.ai}}
+          ai: AIConfigSchema,
+{{/if}}
+{{#if features.audit}}
+          audit: AuditInitConfigSchema,
+{{/if}}
+{{#if features.cache}}
+          cache: CacheConfigSchema,
+{{/if}}
+{{#if features.feedback}}
+          feedback: FeedbackConfigSchema,
+{{/if}}
+{{#if features.iam}}
+          iam: IamConfigSchema,
+{{/if}}
+{{#if features.reach}}
+          reach: ReachConfigSchema,
+{{/if}}
 {{#if features.db}}
-  { name: 'reldb', start: async () => {
-    const config = ReldbConfigSchema.parse(core.config.getOrThrow('db'))
-    if (config.type === 'sqlite' && config.database !== ':memory:') {
-      const { mkdir } = await import('node:fs/promises')
-      const { dirname } = await import('node:path')
-      await mkdir(dirname(config.database), { recursive: true })
-    }
-    return reldb.init(config)
-  }, close: () => reldb.close() },
+          db: ReldbConfigSchema,
+{{/if}}
+{{#if features.audit}}
+{{#if features.scheduler}}
+          scheduler: SchedulerConfigSchema,
+{{/if}}
+{{/if}}
+{{#if features.storage}}
+          storage: StorageConfigSchema,
+{{/if}}
+{{#if features.vecdb}}
+          vecdb: VecdbConfigSchema,
+{{/if}}
+        },
+      })
+    },
+    close: () => { },
+  },
+  {
+    name: 'serv-config',
+    start: () => core.config.validate('serv', ServConfigSchema),
+    close: () => { },
+  },
+{{#if features.db}}
+  {
+    name: 'reldb',
+    start: async () => {
+      const config = ReldbConfigSchema.parse(core.config.getOrThrow('db'))
+      if (config.type === 'sqlite' && config.database !== ':memory:') {
+        const { mkdir } = await import('node:fs/promises')
+        const { dirname } = await import('node:path')
+        await mkdir(dirname(config.database), { recursive: true })
+      }
+      return reldb.init(config)
+    },
+    close: () => reldb.close(),
+  },
 {{/if}}
 {{#if features.cache}}
-  { name: 'cache', start: () => cache.init(CacheConfigSchema.parse(core.config.getOrThrow('cache'))), close: () => cache.close() },
+  {
+    name: 'cache',
+    start: () => cache.init(CacheConfigSchema.parse(core.config.getOrThrow('cache'))),
+    close: () => cache.close(),
+  },
 {{/if}}
 {{#if features.vecdb}}
-  { name: 'vecdb', start: () => vecdb.init(VecdbConfigSchema.parse(core.config.getOrThrow('vecdb'))), close: () => vecdb.close() },
+  {
+    name: 'vecdb',
+    start: () => vecdb.init(VecdbConfigSchema.parse(core.config.getOrThrow('vecdb'))),
+    close: () => vecdb.close(),
+  },
 {{/if}}
 {{#if features.crypto}}
-  { name: 'crypto', start: () => crypto.init(), close: () => crypto.close() },
+  {
+    name: 'crypto',
+    start: () => crypto.init(),
+    close: () => crypto.close(),
+  },
 {{/if}}
 {{#if features.storage}}
-  { name: 'storage', start: () => storage.init(StorageConfigSchema.parse(core.config.getOrThrow('storage'))), close: () => storage.close() },
+  {
+    name: 'storage',
+    start: () => storage.init(StorageConfigSchema.parse(core.config.getOrThrow('storage'))),
+    close: () => storage.close(),
+  },
 {{/if}}
 {{#if features.reach}}
-  { name: 'reach', enabled: () => Boolean(core.config.get('reach')), start: () => reach.init(ReachConfigSchema.parse(core.config.getOrThrow('reach'))), close: () => reach.close() },
+  {
+    name: 'reach',
+    enabled: () => Boolean(core.config.get('reach')),
+    start: () => reach.init(ReachConfigSchema.parse(core.config.getOrThrow('reach'))),
+    close: () => reach.close(),
+  },
 {{/if}}
 {{#if features.audit}}
-  { name: 'audit', start: () => audit.init({ ...AuditInitConfigSchema.parse(core.config.get('audit') ?? {}){{#if features.storage}}, storage{{/if}}{{#if features.reach}}, reach{{/if}} }), close: () => audit.close() },
+  {
+    name: 'audit',
+    start: () => audit.init({
+      ...AuditInitConfigSchema.parse(core.config.get('audit') ?? {}),
+{{#if features.storage}}
+      storage,
+{{/if}}
+{{#if features.reach}}
+      reach,
+{{/if}}
+    }),
+    close: () => audit.close(),
+  },
 {{/if}}
 {{#if features.iam}}
-  { name: 'iam', start: () => iam.init({ ...IamConfigSchema.parse(core.config.getOrThrow('iam')){{#if features.reach}}, reach{{/if}} }), close: () => iam.close() },
+  {
+    name: 'iam',
+    start: () => iam.init({
+      ...IamConfigSchema.parse(core.config.getOrThrow('iam')),
+{{#if features.reach}}
+      reach,
+{{/if}}
+    }),
+    close: () => iam.close(),
+  },
 {{/if}}
 {{#if features.audit}}
 {{#if features.scheduler}}
-  { name: 'audit-jobs', enabled: () => Boolean(audit.schedulerPlan), start: async () => {
-    const schedule = audit.schedulerPlan
-    if (!schedule)
-      return
-    const initialized = await scheduler.init({ ...SchedulerConfigSchema.parse(core.config.get('scheduler') ?? {}), ...schedule })
-    if (!initialized.success)
-      return initialized
-    const started = scheduler.start()
-    if (!started.success)
-      await scheduler.close()
-    return started
-  }, close: () => scheduler.close() },
+  {
+    name: 'audit-jobs',
+    enabled: () => Boolean(audit.schedulerPlan),
+    start: async () => {
+      const schedule = audit.schedulerPlan
+      if (!schedule)
+        return
+      const initialized = await scheduler.init({
+        ...SchedulerConfigSchema.parse(core.config.get('scheduler') ?? {}),
+        ...schedule,
+      })
+      if (!initialized.success)
+        return initialized
+      const started = scheduler.start()
+      if (!started.success)
+        await scheduler.close()
+      return started
+    },
+    close: () => scheduler.close(),
+  },
 {{/if}}
 {{/if}}
 {{#if features.feedback}}
-  { name: 'feedback', enabled: () => Boolean(core.config.get('feedback')), start: startFeedback, close: closeFeedback },
+  {
+    name: 'feedback',
+    enabled: () => Boolean(core.config.get('feedback')),
+    start: startFeedback,
+    close: closeFeedback,
+  },
 {{/if}}
 {{#if features.ai}}
-  { name: 'ai', start: () => ai.init(AIConfigSchema.parse(core.config.getOrThrow('ai'))), close: () => ai.close() },
+  {
+    name: 'ai',
+    start: () => ai.init(AIConfigSchema.parse(core.config.getOrThrow('ai'))),
+    close: () => ai.close(),
+  },
 {{/if}}
-  { name: 'bootstrap', start: () => { core.logger.info('API service initialized') }, close: () => {} },
+  {
+    name: 'bootstrap',
+    start: () => { core.logger.info('API service initialized') },
+    close: () => { },
+  },
 ])
 
 /** 启动失败只报告模块、错误码和配置路径，私密值不进入错误上下文。 */

package/templates/apps/api/apps/{{projectName}}-serv/src/server/procedures/index.ts.hbs

@@ -1,13 +1,27 @@
 import type { AppProcedureDeps } from './app-procedures.js'
-{{#if features.ai}}import { ai } from '@h-ai/ai'
-{{/if}}{{#if features.feedback}}import { feedback } from '@h-ai/feedback'
-{{/if}}{{#if features.iam}}import { iam } from '@h-ai/iam'
-{{/if}}{{#if features.ai}}import { createAiProcedures } from '@h-ai/serv/features/ai'
-{{/if}}{{#if features.feedback}}import { createFeedbackProcedures } from '@h-ai/serv/features/feedback'
-{{/if}}{{#if features.iam}}import { createIamProcedures } from '@h-ai/serv/features/iam'
-{{/if}}{{#if features.storage}}import { createStorageProcedures } from '@h-ai/serv/features/storage'
+{{#if features.ai}}
+import { ai } from '@h-ai/ai'
+{{/if}}
+{{#if features.feedback}}
+import { feedback } from '@h-ai/feedback'
+{{/if}}
+{{#if features.iam}}
+import { iam } from '@h-ai/iam'
+{{/if}}
+{{#if features.ai}}
+import { createAiProcedures } from '@h-ai/serv/features/ai'
+{{/if}}
+{{#if features.feedback}}
+import { createFeedbackProcedures } from '@h-ai/serv/features/feedback'
+{{/if}}
+{{#if features.iam}}
+import { createIamProcedures } from '@h-ai/serv/features/iam'
+{{/if}}
+{{#if features.storage}}
+import { createStorageProcedures } from '@h-ai/serv/features/storage'
 import { storage } from '@h-ai/storage'
-{{/if}}import { createAppProcedures } from './app-procedures.js'
+{{/if}}
+import { createAppProcedures } from './app-procedures.js'
 
 // @hai-generator:procedures:imports
 
@@ -15,15 +29,21 @@ import { storage } from '@h-ai/storage'
 export function {{api.serviceProceduresFactoryName}}(deps: { app: AppProcedureDeps }) {
   return {
     // @hai-generator:procedures:entries
-{{#if features.iam}}    iam: createIamProcedures({ iam }),
-{{/if}}{{#if features.storage}}    storage: createStorageProcedures({
+{{#if features.iam}}
+    iam: createIamProcedures({ iam }),
+{{/if}}
+{{#if features.storage}}
+    storage: createStorageProcedures({
       storage,
       authorize: ({ context, keys }) => keys.every(key =>
         key.startsWith(`users/${encodeURIComponent(context.session.userId)}/`)),
     }),
-{{/if}}{{#if features.ai}}    // AI 默认绑定可信 session.userId，跨主体访问需另行提供 authorizeObject 策略。
+{{/if}}
+{{#if features.ai}}
+    // AI 默认绑定可信 session.userId，跨主体访问需另行提供 authorizeObject 策略。
     ai: createAiProcedures({ ai }),
-{{/if}}{{#if features.feedback}}
+{{/if}}
+{{#if features.feedback}}
     feedback: createFeedbackProcedures({
       feedback,
       resolveContext: ({ session }) => ({
@@ -31,7 +51,13 @@ export function {{api.serviceProceduresFactoryName}}(deps: { app: AppProcedureDe
         userId: session.userId,
         // 示例角色映射；实际产品应从可信租户与资源权限确定范围。
         permissions: session.roles.includes('admin')
-          ? ['feedback:create', 'feedback:read', 'feedback:process', 'feedback:reopen', 'feedback:export']
+          ? [
+              'feedback:create',
+              'feedback:read',
+              'feedback:process',
+              'feedback:reopen',
+              'feedback:export',
+            ]
           : ['feedback:create'],
       }),
     }),