@h-ai/cli 1.0.0-beta.2 → 1.0.0-beta.21

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/build-metadata.ts.hbs

@@ -2,6 +2,5 @@
 {{#if features.feedback}}
 /** 当前应用编译时烘焙的产物身份；运行时配置不能覆盖。 */
 declare const __HAI_BUILD_METADATA__: { appVersion: string, buildId: string, commit: string }
-
 export const buildMetadata = __HAI_BUILD_METADATA__
 {{/if}}

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/index.ts.hbs

@@ -7,8 +7,7 @@ import { createServerApp } from './app-server.js'
 import { closeModules, initializeModules } from './server/runtime.js'
 
 async function startServer(): Promise<void> {
-  // 加载配置后按依赖顺序初始化；日志设置沿用 _core.yml。
-  core.init({ configDir: './config' })
+  // 运行时先注册模块 Schema 并加载配置，再按依赖顺序初始化；日志设置沿用 _core.yml。
   await initializeModules()
   try {
     // HOST/PORT 环境变量优先于 config/_serv.yml。

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/admin-service.ts.hbs

@@ -11,8 +11,18 @@ import { storage } from '@h-ai/storage'
 import { SUPPORTED_LOCALES } from '{{fullstack.contractPackageName}}'
 import { serverM } from './messages.js'
 
-const ROLE_CODES = new Set<AdminRoleCode>(['admin', 'audit_admin', 'config_admin', 'business_operator', 'user'])
-const SUPPORTED_THEMES = [{{#each fullstack.theme.themes}}'{{this}}'{{#unless @last}}, {{/unless}}{{/each}}] as readonly string[]
+const ROLE_CODES = new Set<AdminRoleCode>([
+  'admin',
+  'audit_admin',
+  'config_admin',
+  'business_operator',
+  'user',
+])
+const SUPPORTED_THEMES = [
+{{#each fullstack.theme.themes}}
+  '{{this}}',
+{{/each}}
+] as readonly string[]
 let adminMutationActive = false
 
 /** 管理写操作串行化，锁内重新鉴权，防止两个管理员同时互相删除或降级。 */
@@ -42,7 +52,10 @@ export async function withAdminMutation<T>(context: ServContext, operation: stri
       void cache.lock.extend(key, 300, owner).then((renewed) => {
         if (!renewed.success || !renewed.data) {
           leaseLost = true
-          core.logger.error('Admin mutation lease renewal failed', { owner, error: renewed.success ? 'lease_not_owned' : renewed.error.code })
+          core.logger.error('Admin mutation lease renewal failed', {
+            owner,
+            error: renewed.success ? 'lease_not_owned' : renewed.error.code,
+          })
         }
       }).catch(() => {
         leaseLost = true
@@ -55,7 +68,9 @@ export async function withAdminMutation<T>(context: ServContext, operation: stri
     const actor = await getAdminUser(context.session?.userId ?? '')
     if (!actor.success)
       return actor
-    const permitted = await iam.authz.checkPermission(actor.data.id, operation.startsWith('iam.roles.') ? 'app.roles.manage' : 'app.users.manage')
+    const permitted = await iam.authz.checkPermission(actor.data.id, operation.startsWith('iam.roles.')
+      ? 'app.roles.manage'
+      : 'app.users.manage')
     if (!permitted.success)
       return permitted
     if (actor.data.accountStatus !== 'active' || (actor.data.accountType === 'temporary' && (!actor.data.accountExpiresAt || new Date(actor.data.accountExpiresAt).getTime() <= Date.now())) || !permitted.data)
@@ -73,8 +88,12 @@ export async function withAdminMutation<T>(context: ServContext, operation: stri
     try {
       if (acquired) {
         const released = await cache.lock.release(key, owner)
-        if (!released.success || !released.data)
-          core.logger.error('Failed to release admin mutation lock', { owner, error: released.success ? 'lease_not_owned' : released.error.code })
+        if (!released.success || !released.data) {
+          core.logger.error('Failed to release admin mutation lock', {
+            owner,
+            error: released.success ? 'lease_not_owned' : released.error.code,
+          })
+        }
       }
     }
     finally {
@@ -123,7 +142,12 @@ export async function createAdminUser(input: AdminCreateUser, context: ServConte
     return role
   if (!role.data)
     return err(HaiCommonError.NOT_FOUND, serverM('notFound', { locale: context.locale }))
-  const registered = await iam.user.createUser({ ...input, accountExpiresAt: input.accountExpiresAt ? new Date(input.accountExpiresAt) : undefined })
+  const registered = await iam.user.createUser({
+    ...input,
+    accountExpiresAt: input.accountExpiresAt
+      ? new Date(input.accountExpiresAt)
+      : undefined,
+  })
   if (!registered.success)
     return registered
   const userId = registered.data.user.id
@@ -139,9 +163,17 @@ export async function createAdminUser(input: AdminCreateUser, context: ServConte
 /** 安全通知发送后发生未知结果时保留账号，不自动重试或删除已发出的邀请。 */
 export async function inviteAdminUser(input: AdminInviteUser, context: ServContext): Promise<HaiResult<AdminUser>> {
   const role = await iam.authz.getRoleByCode(input.role)
-  if (!role.success || !role.data)
-    return role.success ? err(HaiCommonError.NOT_FOUND, serverM('notFound', { locale: context.locale })) : role
-  const created = await iam.user.inviteUser({ ...input, accountExpiresAt: input.accountExpiresAt ? new Date(input.accountExpiresAt) : undefined })
+  if (!role.success || !role.data) {
+    return role.success
+      ? err(HaiCommonError.NOT_FOUND, serverM('notFound', { locale: context.locale }))
+      : role
+  }
+  const created = await iam.user.inviteUser({
+    ...input,
+    accountExpiresAt: input.accountExpiresAt
+      ? new Date(input.accountExpiresAt)
+      : undefined,
+  })
   if (!created.success)
     return created
   const assigned = await iam.authz.syncRoles(created.data.user.id, [role.data.id])
@@ -165,7 +197,9 @@ export async function updateAdminUser(input: AdminUpdateUser, context: ServConte
     return existing
   if (!existing.data)
     return err(HaiCommonError.NOT_FOUND, serverM('notFound', { locale: context.locale }))
-  const role = input.role ? await iam.authz.getRoleByCode(input.role) : undefined
+  const role = input.role
+    ? await iam.authz.getRoleByCode(input.role)
+    : undefined
   if (role && !role.success)
     return role
   if (role?.success && !role.data)
@@ -179,7 +213,14 @@ export async function updateAdminUser(input: AdminUpdateUser, context: ServConte
     if (!assigned.success)
       return assigned
   }
-  const updated = await iam.user.updateUser(id, { ...profile, accountExpiresAt: profile.accountExpiresAt === undefined ? undefined : profile.accountExpiresAt ? new Date(profile.accountExpiresAt) : null })
+  const updated = await iam.user.updateUser(id, {
+    ...profile,
+    accountExpiresAt: profile.accountExpiresAt === undefined
+      ? undefined
+      : profile.accountExpiresAt
+        ? new Date(profile.accountExpiresAt)
+        : null,
+  })
   if (!updated.success) {
     // 角色 ID 可精确还原，避免 undefined 资料字段被 updateUser 忽略后无法补偿。
     if (role?.success && role.data) {
@@ -189,7 +230,10 @@ export async function updateAdminUser(input: AdminUpdateUser, context: ServConte
     }
     return updated
   }
-  await recordAudit(context, 'update', 'users', id, { fields: Object.keys(profile), role: input.role })
+  await recordAudit(context, 'update', 'users', id, {
+    fields: Object.keys(profile),
+    role: input.role,
+  })
   return getAdminUser(id)
 }
 
@@ -201,13 +245,15 @@ export async function getAdminRoles(): Promise<HaiResult<{ items: AdminRole[] }>
   const counts = await iam.authz.getRoleUserCounts(items.map(role => role.id))
   if (!counts.success)
     return counts
-  return ok({ items: items.map(role => ({
-    id: role.id,
-    code: role.code as AdminRoleCode,
-    name: role.name,
-    description: role.description,
-    userCount: counts.data.get(role.id) ?? 0,
-  })) })
+  return ok({
+    items: items.map(role => ({
+      id: role.id,
+      code: role.code as AdminRoleCode,
+      name: role.name,
+      description: role.description,
+      userCount: counts.data.get(role.id) ?? 0,
+    })),
+  })
 }
 
 export async function updateProfile(input: ProfileUpdate, context: ServContext): Promise<HaiResult<AdminUser>> {
@@ -225,7 +271,9 @@ export async function updateProfile(input: ProfileUpdate, context: ServContext):
   const updated = await iam.user.updateCurrentUser(token, { displayName: input.displayName, email: input.email, metadata })
   if (!updated.success)
     return updated
-  await recordAudit(context, 'update', 'profile', current.data.id, { fields: Object.keys(input) })
+  await recordAudit(context, 'update', 'profile', current.data.id, {
+    fields: Object.keys(input),
+  })
   return getAdminUser(current.data.id)
 }
 

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/business-settings.ts.hbs

@@ -5,15 +5,22 @@ import { err, HaiCommonError, ok } from '@h-ai/core'
 import { reldb } from '@h-ai/reldb'
 import { z } from 'zod'
 
-export const BusinessSettingsSchema = z.object({ notice: z.string().trim().max(200) }).strict()
+export const BusinessSettingsSchema = z.object({
+  notice: z.string().trim().max(200),
+}).strict()
 
 export function initBusinessSettings(): Promise<HaiResult<void>> {
-  return reldb.ddl.createTable('app_business_settings', { id: { type: 'TEXT', primaryKey: true }, notice: { type: 'TEXT', notNull: true } })
+  return reldb.ddl.createTable('app_business_settings', {
+    id: { type: 'TEXT', primaryKey: true },
+    notice: { type: 'TEXT', notNull: true },
+  })
 }
 
 export async function readBusinessSettings(): Promise<HaiResult<{ notice: string }>> {
   const row = await reldb.sql.get<{ notice: string }>('SELECT notice FROM app_business_settings WHERE id = ?', ['public'])
-  return row.success ? ok({ notice: row.data?.notice ?? '' }) : row
+  return row.success
+    ? ok({ notice: row.data?.notice ?? '' })
+    : row
 }
 
 export async function saveBusinessSettings(input: { notice: string }): Promise<HaiResult<{ notice: string }>> {
@@ -33,7 +40,14 @@ export async function saveBusinessSettings(input: { notice: string }): Promise<H
       await tx.rollback()
       return saved
     }
-    const logged = await audit.capture({ action: 'business.configuration.update', resource: 'business-settings', category: 'business', details: { fields: ['notice'] } }, { tx })
+    const logged = await audit.capture({
+      action: 'business.configuration.update',
+      resource: 'business-settings',
+      category: 'business',
+      details: {
+        fields: ['notice'],
+      },
+    }, { tx })
     if (!logged.success) {
       await tx.rollback()
       return logged
@@ -41,7 +55,9 @@ export async function saveBusinessSettings(input: { notice: string }): Promise<H
     const committed = await tx.commit()
     if (!committed.success)
       await tx.rollback()
-    return committed.success ? ok(parsed.data) : committed
+    return committed.success
+      ? ok(parsed.data)
+      : committed
   }
   catch (error) {
     await tx.rollback()

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/procedures/admin-procedures.ts.hbs

@@ -28,13 +28,27 @@ export function createAuthProcedures() {
 export function createAdminProcedures() {
   return serv.implement(adminContract).context<ServContext>().route('permissions.list').permission('app.roles.manage').handle(async ({ input }) => {
     const result = await iam.authz.getAllPermissions(input)
-    return result.success ? ok({ total: result.data.total, items: result.data.items.map(item => ({ id: item.id, code: item.code, name: item.name, sensitiveOperations: item.sensitiveOperations ?? [] })) }) : result
+    return result.success
+      ? ok({
+          total: result.data.total,
+          items: result.data.items.map(item => ({
+            id: item.id,
+            code: item.code,
+            name: item.name,
+            sensitiveOperations: item.sensitiveOperations ?? [],
+          })),
+        })
+      : result
   }).route('permissions.update').permission('app.roles.manage').handle(({ input, context }) => withAdminMutation(context, 'iam.permissions.sensitiveOperations', async () => {
     const result = await iam.authz.setPermissionSensitiveOperations(input.id, input.sensitiveOperations)
-    return result.success ? ok({ saved: true as const }) : result
+    return result.success
+      ? ok({ saved: true as const })
+      : result
   })).route('configuration.get').permission('app.config.manage').handle(() => readBusinessSettings()).route('configuration.update').permission('app.config.manage').handle(async ({ input, context }) => {
     const checked = await iam.auth.checkSensitiveOperation(context.accessToken ?? '', 'business.settings.update', context.request.headers.get('x-hai-reauthentication') ?? undefined)
-    return checked.success ? saveBusinessSettings(input) : checked
+    return checked.success
+      ? saveBusinessSettings(input)
+      : checked
   }).route('users.list').permission('app.users.manage').handle(async ({ input }) => {
     const users = await iam.user.listUsers(input)
     if (!users.success)
@@ -42,7 +56,10 @@ export function createAdminProcedures() {
     const roles = await iam.authz.getUserRolesForMany(users.data.items.map(user => user.id))
     if (!roles.success)
       return roles
-    return ok({ ...users.data, items: users.data.items.map(user => toAdminUser(user, roles.data.get(user.id) ?? [])) })
+    return ok({
+      ...users.data,
+      items: users.data.items.map(user => toAdminUser(user, roles.data.get(user.id) ?? [])),
+    })
   }).route('users.resetPassword').permission('app.users.manage').handle(({ input, context }) => withAdminMutation(context, 'iam.users.resetPassword', async () => {
     const result = await iam.user.adminResetPassword(input.id, input.newPassword)
     if (!result.success)
@@ -74,33 +91,68 @@ export function createAdminProcedures() {
     const result = roles.data.items.find(item => item.id === input.id)
     if (!result)
       return err(HaiCommonError.NOT_FOUND, serverM('notFound', { locale: context.locale }))
-    await recordAudit(context, 'update', 'roles', input.id, { fields: ['description'] })
+    await recordAudit(context, 'update', 'roles', input.id, {
+      fields: ['description'],
+    })
     return ok(result)
   })).route('audit.backup').permission('audit:backup').handle(async ({ input, context }) => {
     const checked = await iam.auth.checkSensitiveOperation(context.accessToken ?? '', 'audit.backup', context.request.headers.get('x-hai-reauthentication') ?? undefined)
     if (!checked.success)
       return checked
     const result = await audit.backup.run({ ...input, signal: context.request.signal })
-    return result.success ? ok({ ...result.data, createdAt: result.data.createdAt.toISOString(), cutoff: result.data.cutoff.toISOString() }) : result
+    return result.success
+      ? ok({
+          ...result.data,
+          createdAt: result.data.createdAt.toISOString(),
+          cutoff: result.data.cutoff.toISOString(),
+        })
+      : result
   }).route('audit.list').permission('audit:read').handle(async ({ input, context }) => {
     if (input.startDate && input.endDate && input.startDate > input.endDate)
       return err(HaiCommonError.VALIDATION_ERROR, serverM('invalidDateRange', { locale: context.locale }))
-    const result = await audit.list({ ...input, startDate: input.startDate ? new Date(input.startDate) : undefined, endDate: input.endDate ? new Date(input.endDate) : undefined })
+    const result = await audit.list({
+      ...input,
+      startDate: input.startDate
+        ? new Date(input.startDate)
+        : undefined,
+      endDate: input.endDate
+        ? new Date(input.endDate)
+        : undefined,
+    })
     if (!result.success)
       return result
-    const stats = await audit.getStats(7, { category: input.category, outcome: input.outcome, severity: input.severity, resource: input.resource, scopeId: input.scopeId, userId: input.userId })
+    const stats = await audit.getStats(7, {
+      category: input.category,
+      outcome: input.outcome,
+      severity: input.severity,
+      resource: input.resource,
+      scopeId: input.scopeId,
+      userId: input.userId,
+    })
     if (!stats.success)
       return stats
-    return ok({ ...result.data, stats: stats.data, backupEnabled: AuditInitConfigSchema.parse(core.config.get('audit') ?? {}).backup.enabled, items: result.data.items.map(item => ({ ...item, createdAt: new Date(item.createdAt).toISOString() })) })
+    return ok({
+      ...result.data,
+      stats: stats.data,
+      backupEnabled: AuditInitConfigSchema.parse(core.config.get('audit') ?? {}).backup.enabled,
+      items: result.data.items.map(item => ({
+        ...item,
+        createdAt: new Date(item.createdAt).toISOString(),
+      })),
+    })
   }).build()
 }
 
 export function createProfileProcedures() {
   return serv.implement(profileContract).context<ServContext>().route('update').auth().handle(async ({ input, context }) => {
     const checked = await iam.auth.checkSensitiveOperation(context.accessToken ?? '', 'iam.profile.update', context.request.headers.get('x-hai-reauthentication') ?? undefined)
-    return checked.success ? updateProfile(input, context) : checked
+    return checked.success
+      ? updateProfile(input, context)
+      : checked
   }).route('avatar').auth().handle(async ({ input, context }) => {
     const checked = await iam.auth.checkSensitiveOperation(context.accessToken ?? '', 'iam.profile.avatar', context.request.headers.get('x-hai-reauthentication') ?? undefined)
-    return checked.success ? uploadAvatar(context.session.userId, input, context) : checked
+    return checked.success
+      ? uploadAvatar(context.session.userId, input, context)
+      : checked
   }).build()
 }

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/procedures/app-procedures.ts.hbs

@@ -22,7 +22,12 @@ export function createAppProcedures(options: CreateAppProceduresOptions) {
     .context<ServContext>()
     .route('info', async () => {
       const settings = await readBusinessSettings()
-      return settings.success ? ok({ ...createAppInfo(options), notice: settings.data.notice }) : settings
+      return settings.success
+        ? ok({
+            ...createAppInfo(options),
+            notice: settings.data.notice,
+          })
+        : settings
     })
     .route('echo', ({ input, context }) => {
       const data: AppEchoOutputData = {

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/procedures/index.ts.hbs

@@ -17,7 +17,9 @@ export function createServerProcedures(options: CreateServerProceduresOptions) {
   return {
     // @hai-generator:procedures:entries
     app: createAppProcedures(options.app),
-    iam: { auth: createAuthProcedures() },
+    iam: {
+      auth: createAuthProcedures(),
+    },
     admin: createAdminProcedures(),
     profile: createProfileProcedures(),
 {{#if features.feedback}}

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/runtime.ts.hbs

@@ -10,12 +10,12 @@ import { cache, CacheConfigSchema } from '@h-ai/cache'
 import { core, HaiConfigError } from '@h-ai/core'
 import { crypto } from '@h-ai/crypto'
 {{#if features.feedback}}
-import { feedback } from '@h-ai/feedback'
+import { feedback, FeedbackConfigSchema } from '@h-ai/feedback'
 {{/if}}
 import { iam, IamConfigSchema } from '@h-ai/iam'
 import { reach, ReachConfigSchema } from '@h-ai/reach'
 import { reldb, ReldbConfigSchema } from '@h-ai/reldb'
-import { scheduler } from '@h-ai/scheduler'
+import { scheduler, SchedulerConfigSchema } from '@h-ai/scheduler'
 import { ServConfigSchema } from '@h-ai/serv'
 import { storage, StorageConfigSchema } from '@h-ai/storage'
 {{#if features.vecdb}}
@@ -42,7 +42,10 @@ function startFeedback(): Promise<void> {
   feedbackClosing = false
   feedbackStarting = (async () => {
     try {
-      const result = await feedback.init({ ...core.config.getOrThrow<import('@h-ai/feedback').FeedbackConfigInput>('feedback'), ...buildMetadata })
+      const result = await feedback.init({
+        ...core.config.getOrThrow<import('@h-ai/feedback').FeedbackConfigInput>('feedback'),
+        ...buildMetadata,
+      })
       if (!result.success) {
         if (feedbackFailure !== result.error.code)
           core.logger.warn('Optional feedback unavailable; business runtime remains ready', { module: 'feedback', code: result.error.code })
@@ -76,38 +79,127 @@ async function closeFeedback() {
   await feedbackStarting
   return feedback.close()
 }
-
 {{/if}}
 const runtime = core.module.createRuntime([
-  { name: 'serv-config', start: () => core.config.validate('serv', ServConfigSchema), close: () => {} },
-  { name: 'reldb', start: async () => {
-    const config = ReldbConfigSchema.parse(core.config.getOrThrow('db'))
-    if (config.type === 'sqlite' && config.database !== ':memory:')
-      await mkdir(path.dirname(config.database), { recursive: true })
-    return reldb.init(config)
-  }, close: () => reldb.close() },
-  { name: 'cache', start: () => cache.init(CacheConfigSchema.parse(core.config.getOrThrow('cache'))), close: () => cache.close() },
+  {
+    name: 'configuration',
+    start: () => {
+      core.init({
+        configDir: './config',
+        configSchemas: {
+{{#if features.ai}}
+          ai: AIConfigSchema,
+{{/if}}
+          audit: AuditInitConfigSchema,
+          cache: CacheConfigSchema,
+          db: ReldbConfigSchema,
+{{#if features.feedback}}
+          feedback: FeedbackConfigSchema,
+{{/if}}
+          iam: IamConfigSchema,
+          reach: ReachConfigSchema,
+          scheduler: SchedulerConfigSchema,
+          serv: ServConfigSchema,
+          storage: StorageConfigSchema,
 {{#if features.vecdb}}
-  { name: 'vecdb', start: () => vecdb.init(VecdbConfigSchema.parse(core.config.getOrThrow('vecdb'))), close: () => vecdb.close() },
+          vecdb: VecdbConfigSchema,
 {{/if}}
-  { name: 'crypto', start: () => crypto.init(), close: () => crypto.close() },
-  { name: 'storage', start: () => storage.init(StorageConfigSchema.parse(core.config.getOrThrow('storage'))), close: () => storage.close() },
-  { name: 'reach', enabled: () => Boolean(core.config.get('reach')), start: () => reach.init(ReachConfigSchema.parse(core.config.getOrThrow('reach'))), close: () => reach.close() },
-  { name: 'audit', start: () => audit.init({ ...AuditInitConfigSchema.parse(core.config.get('audit') ?? {}), storage, reach }), close: () => audit.close() },
-  { name: 'iam', start: () => iam.init({ ...IamConfigSchema.parse(core.config.getOrThrow('iam')), reach }), close: () => iam.close() },
-  { name: 'audit-jobs', enabled: () => Boolean(audit.schedulerPlan), start: startAuditJobs, close: () => scheduler.close() },
+        },
+      })
+    },
+    close: () => { },
+  },
+  {
+    name: 'serv-config',
+    start: () => core.config.validate('serv', ServConfigSchema),
+    close: () => { },
+  },
+  {
+    name: 'reldb',
+    start: async () => {
+      const config = ReldbConfigSchema.parse(core.config.getOrThrow('db'))
+      if (config.type === 'sqlite' && config.database !== ':memory:')
+        await mkdir(path.dirname(config.database), { recursive: true })
+      return reldb.init(config)
+    },
+    close: () => reldb.close(),
+  },
+  {
+    name: 'cache',
+    start: () => cache.init(CacheConfigSchema.parse(core.config.getOrThrow('cache'))),
+    close: () => cache.close(),
+  },
+{{#if features.vecdb}}
+  {
+    name: 'vecdb',
+    start: () => vecdb.init(VecdbConfigSchema.parse(core.config.getOrThrow('vecdb'))),
+    close: () => vecdb.close(),
+  },
+{{/if}}
+  {
+    name: 'crypto',
+    start: () => crypto.init(),
+    close: () => crypto.close(),
+  },
+  {
+    name: 'storage',
+    start: () => storage.init(StorageConfigSchema.parse(core.config.getOrThrow('storage'))),
+    close: () => storage.close(),
+  },
+  {
+    name: 'reach',
+    enabled: () => Boolean(core.config.get('reach')),
+    start: () => reach.init(ReachConfigSchema.parse(core.config.getOrThrow('reach'))),
+    close: () => reach.close(),
+  },
+  {
+    name: 'audit',
+    start: () => audit.init({
+      ...AuditInitConfigSchema.parse(core.config.get('audit') ?? {}),
+      storage,
+      reach,
+    }),
+    close: () => audit.close(),
+  },
+  {
+    name: 'iam',
+    start: () => iam.init({
+      ...IamConfigSchema.parse(core.config.getOrThrow('iam')),
+      reach,
+    }),
+    close: () => iam.close(),
+  },
+  {
+    name: 'audit-jobs',
+    enabled: () => Boolean(audit.schedulerPlan),
+    start: startAuditJobs,
+    close: () => scheduler.close(),
+  },
 {{#if features.feedback}}
-  { name: 'feedback', enabled: () => Boolean(core.config.get('feedback')), start: startFeedback, close: closeFeedback },
+  {
+    name: 'feedback',
+    enabled: () => Boolean(core.config.get('feedback')),
+    start: startFeedback,
+    close: closeFeedback,
+  },
 {{/if}}
 {{#if features.ai}}
-  { name: 'ai', start: () => ai.init(AIConfigSchema.parse(core.config.getOrThrow('ai'))), close: () => ai.close() },
+  {
+    name: 'ai',
+    start: () => ai.init(AIConfigSchema.parse(core.config.getOrThrow('ai'))),
+    close: () => ai.close(),
+  },
 {{/if}}
-  { name: 'bootstrap', start: async () => {
-    requireInitialized(await initBusinessSettings(), 'business-settings')
-    await ensureRolesAndAdmin()
-    const app = core.config.getOrThrow<CoreConfig>('core')
-    core.logger.info('Application initialized', { name: app.name, version: app.version, environment: app.env })
-  }, close: () => {} },
+  {
+    name: 'bootstrap',
+    start: async () => {
+      requireInitialized(await initBusinessSettings(), 'business-settings')
+      await ensureRolesAndAdmin()
+      const app = core.config.getOrThrow<CoreConfig>('core')
+      core.logger.info('Application initialized', { name: app.name, version: app.version, environment: app.env })
+    },
+    close: () => { },
+  },
 ])
 
 /** 仅声明模块和业务钩子，失败回滚、并发及关闭重试由 core 负责。 */
@@ -125,15 +217,27 @@ export async function closeModules(): Promise<void> {
 
 /** 此函数仅用于进程启动边界，业务请求继续返回 HaiResult。 */
 function requireInitialized<T>(result: HaiResult<T>, moduleName: string): T {
-  if (!result.success)
-    throw Object.assign(new Error(moduleName), { code: result.error.code, ext: { fields: moduleName === 'iam-bootstrap' ? ['HAI_ADMIN_DEFAULT_PASSWORD'] : [] } })
+  if (!result.success) {
+    throw Object.assign(new Error(moduleName), {
+      code: result.error.code,
+      ext: {
+        fields: moduleName === 'iam-bootstrap'
+          ? ['HAI_ADMIN_DEFAULT_PASSWORD']
+          : [],
+      },
+    })
+  }
   return result.data
 }
 
 async function ensureRolesAndAdmin(): Promise<void> {
   requireInitialized(await seedAppDuties(), 'app-duties')
   await ensureInitialSystemAdmin()
-  for (const [username, password] of [['audit_admin', process.env.HAI_AUDIT_ADMIN_PASSWORD], ['config_admin', process.env.HAI_CONFIG_ADMIN_PASSWORD], ['business_operator', process.env.HAI_BUSINESS_OPERATOR_PASSWORD]] as const)
+  for (const [username, password] of [
+    ['audit_admin', process.env.HAI_AUDIT_ADMIN_PASSWORD],
+    ['config_admin', process.env.HAI_CONFIG_ADMIN_PASSWORD],
+    ['business_operator', process.env.HAI_BUSINESS_OPERATOR_PASSWORD],
+  ] as const)
     requireInitialized(await bootstrapDutyAccount(username, password), 'app-duty-bootstrap')
 }
 
@@ -142,9 +246,19 @@ async function ensureInitialSystemAdmin(): Promise<void> {
   if (users.total > 0)
     return
   const password = process.env.HAI_ADMIN_DEFAULT_PASSWORD?.trim()
-  if (!password)
-    throw Object.assign(new Error('Administrator bootstrap configuration required'), { code: HaiConfigError.CONFIG_ENV_VAR_MISSING.code, ext: { fields: ['HAI_ADMIN_DEFAULT_PASSWORD'] } })
-  const registered = requireInitialized(await iam.user.createUser({ username: 'admin', password, displayName: serverM('admin') }), 'iam-bootstrap')
+  if (!password) {
+    throw Object.assign(new Error('Administrator bootstrap configuration required'), {
+      code: HaiConfigError.CONFIG_ENV_VAR_MISSING.code,
+      ext: {
+        fields: ['HAI_ADMIN_DEFAULT_PASSWORD'],
+      },
+    })
+  }
+  const registered = requireInitialized(await iam.user.createUser({
+    username: 'admin',
+    password,
+    displayName: serverM('admin'),
+  }), 'iam-bootstrap')
   const adminRole = requireInitialized(await iam.authz.getRoleByCode('admin'), 'iam-role')
   if (!adminRole)
     throw new Error('Administrator role is missing')