@h-ai/cli 1.0.0-beta.2 → 1.0.0-beta.4

package/dist/{src-TEBHR5I5.js → src-IR5AU43K.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-export { DEPLOY_MIDDLEWARE, DeployConfigSchema, DeploymentArtifactSchema, HaiDeployError, ProviderConfigSchema, artifactChecksum, createDeploymentPlan, deploy, describeMiddlewareBackend, getDeployCommandState, getDeployRecovery, importDeploymentSecrets, loadDeploymentConfig, loadDeploymentEnvironment, mergeEnvironmentLayers, normalizeProjectName, readDeploymentArtifact, saveDeploymentEnvironment } from './chunk-MUHRBJSW.js';
+export { DEPLOY_MIDDLEWARE, DeployConfigSchema, DeploymentArtifactSchema, HaiDeployError, ProviderConfigSchema, artifactChecksum, createDeploymentPlan, deploy, describeMiddlewareBackend, getDeployCommandState, getDeployRecovery, importDeploymentSecrets, loadDeploymentConfig, loadDeploymentEnvironment, mergeEnvironmentLayers, normalizeProjectName, readDeploymentArtifact, saveDeploymentEnvironment } from './chunk-K6RWTTHD.js';
 import './chunk-ZSDEVXZ7.js';
-//# sourceMappingURL=src-TEBHR5I5.js.map
-//# sourceMappingURL=src-TEBHR5I5.js.map
+//# sourceMappingURL=src-IR5AU43K.js.map
+//# sourceMappingURL=src-IR5AU43K.js.map

package/dist/src-IR5AU43K.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"src-IR5AU43K.js"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@h-ai/cli",
   "type": "module",
-  "version": "1.0.0-beta.2",
+  "version": "1.0.0-beta.4",
   "description": "Hai Framework CLI for project scaffolding and code generation.",
   "license": "Apache-2.0",
   "keywords": [
@@ -30,7 +30,7 @@
     "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
   },
   "dependencies": {
-    "@h-ai/core": "1.0.0-beta.2",
+    "@h-ai/core": "1.0.0-beta.4",
     "cac": "^7.0.1",
     "chalk": "^6.0.1",
     "fast-wrap-ansi": "^0.2.2",
@@ -41,15 +41,15 @@
     "yaml": "^2.9.1"
   },
   "devDependencies": {
-    "@h-ai/api-client": "1.0.0-beta.2",
-    "@h-ai/cache": "1.0.0-beta.2",
-    "@h-ai/crypto": "1.0.0-beta.2",
-    "@h-ai/deploy": "1.0.0-beta.2",
-    "@h-ai/feedback": "1.0.0-beta.2",
-    "@h-ai/iam": "1.0.0-beta.2",
-    "@h-ai/reach": "1.0.0-beta.2",
-    "@h-ai/reldb": "1.0.0-beta.2",
-    "@h-ai/storage": "1.0.0-beta.2",
+    "@h-ai/api-client": "1.0.0-beta.4",
+    "@h-ai/cache": "1.0.0-beta.4",
+    "@h-ai/crypto": "1.0.0-beta.4",
+    "@h-ai/deploy": "1.0.0-beta.4",
+    "@h-ai/feedback": "1.0.0-beta.4",
+    "@h-ai/iam": "1.0.0-beta.4",
+    "@h-ai/reach": "1.0.0-beta.4",
+    "@h-ai/reldb": "1.0.0-beta.4",
+    "@h-ai/storage": "1.0.0-beta.4",
     "@types/fs-extra": "^11.0.4",
     "@types/node": "^26.6.5",
     "@types/prompts": "^2.4.9",

package/templates/apps/api/.dockerignore.hbs

@@ -23,3 +23,13 @@ tmp
 # 仅保留公共基础 .env；分环境配置、私有覆盖及已有交付包不进入构建上下文。
 **/.env.*
 **/.hai
+# 部署证书和测试材料不进入镜像构建上下文。
+**/*.pem
+**/*.key
+**/*.p12
+**/*.pfx
+**/tests
+**/e2e
+**/*.test.*
+**/*.spec.*
+docs

package/templates/apps/api/apps/{{projectName}}-serv/config/_serv.yml.hbs

@@ -7,15 +7,29 @@ server:
   port: 3000
 
 http:
+  # auto 仅在受管私有 Compose 代理中采用容器网段；普通宿主忽略转发头。
+  trustedProxies: auto
+  access: false
+  # 独立文件与下方内联规则二选一，用所选配置块替换 access: false。
+  # access:
+  #   file: ./config/security/request-access.yml
+  # access:
+  #   global:
+  #     timezone: UTC # 可用 HAI_SERV_HTTP_ACCESS_GLOBAL_TIMEZONE=Asia/Shanghai
+  #     allowIps: []
+  #     denyIps: []
+  #     windows: []
+  #   rules: []
   apiPrefix: /api/v1
   openapi:
     path: /openapi.json
+  # HAI_SERV_HTTP_DOCS=false 关闭文档；开启时再配置 path/requireAuth。
   docs:
     path: /docs
+    # requireAuth: true
   health:
     path: /health
     readyPath: /ready
-  rpc: false
 
 cors:
   origin: ${HAI_SERV_CORS_ORIGIN:*}
@@ -43,6 +57,11 @@ cors:
 {{else}}
   maxPlaintextBytes: ${HAI_SERV_TRANSPORT_MAXPLAINTEXTBYTES:1048576}
 {{/if}}
+  # HAI_SERV_TRANSPORT_ROUTEPLAINTEXTBYTES 可填 JSON 路径映射。
+  routePlaintextBytes: {}
+  # 单条路径需要更大请求体时填写字节数，* 只匹配一段路径。
+  # routePlaintextBytes:
+  #   /api/v1/uploads/*: 8388608
   keyExchangePath: /_hai/key-exchange
   excludePaths:
     - /health

package/templates/apps/api/apps/{{projectName}}-serv/src/app.ts.hbs

@@ -57,7 +57,12 @@ export function {{api.serviceAppFactoryName}}(_options: CreateApiServiceAppOptio
       },
 {{else}}      routePlaintextBytes: servConfig.transport.routePlaintextBytes,
 {{/if}}
-      excludePaths: [...servConfig.transport.excludePaths],
+      excludePaths: [...new Set([
+        ...servConfig.transport.excludePaths,
+        ...(servConfig.http.health ? [servConfig.http.health.path, servConfig.http.health.readyPath].filter((path): path is `/${string}` => Boolean(path)) : []),
+        ...(servConfig.http.openapi && security.exposeApiDocs ? [servConfig.http.openapi.path] : []),
+        ...(servConfig.http.docs && security.exposeApiDocs ? [servConfig.http.docs.path, `${servConfig.http.docs.path.slice(0, servConfig.http.docs.path.lastIndexOf('/') + 1)}_hai/scalar.js`] : []),
+      ])],
     }
   }
 {{else}}  const transport = undefined

package/templates/apps/api/apps/{{projectName}}-serv/src/lib/server/init.ts.hbs

@@ -24,12 +24,12 @@ import { reach, ReachConfigSchema } from '@h-ai/reach'
 {{#if features.db}}
 import { reldb, ReldbConfigSchema } from '@h-ai/reldb'
 {{/if}}
-import { ServConfigSchema } from '@h-ai/serv'
 {{#if features.audit}}
 {{#if features.scheduler}}
 import { scheduler, SchedulerConfigSchema } from '@h-ai/scheduler'
 {{/if}}
 {{/if}}
+import { ServConfigSchema } from '@h-ai/serv'
 {{#if features.storage}}
 import { storage, StorageConfigSchema } from '@h-ai/storage'
 {{/if}}

package/templates/apps/api/images/serv.Dockerfile.hbs

@@ -12,13 +12,14 @@ RUN corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config s
 COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY images/dependencies/ ./
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --ignore-scripts
-COPY . .
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+COPY . .
 ARG HAI_BUILD_ID=
 ARG HAI_BUILD_COMMIT=unknown
 RUN HAI_BUILD_ID="$HAI_BUILD_ID" HAI_BUILD_COMMIT="$HAI_BUILD_COMMIT" pnpm compile
 RUN --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds if [ -d node_modules/better-sqlite3 ]; then cd node_modules/better-sqlite3; for attempt in 1 2 3; do node -e "require('node:child_process').execFileSync(process.execPath,[require.resolve('prebuild-install/bin.js'),'--verbose'],{stdio:'inherit'})" && break; [ "$attempt" = 3 ] && exit 1; sleep 3; done; fi
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds pnpm pm deploy --filter {{api.servPackageName}} --prod /prod/app
+RUN rm -f /prod/app/README* && find /prod/app/dist -type f \( -name '*.map' -o -name '*.d.ts' -o -name '*.d.mts' -o -name '*.d.cts' \) -delete
 
 FROM node:24.22.1-bookworm-slim AS runtime-base
 
@@ -33,5 +34,5 @@ RUN mkdir -p /app/data && chown node:node /app/data
 USER node
 EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
-  CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+  CMD node -e "(async () => { try { const { core } = await import('@h-ai/core'); const { ServConfigSchema } = await import('@h-ai/serv'); core.init({ configDir: './config' }); const { server, http } = ServConfigSchema.parse(core.config.getOrThrow('serv')); if (http.health === false) process.exit(0); const response = await fetch('http://127.0.0.1:' + server.port + http.health.path, { signal: AbortSignal.timeout(4000) }); process.exit(response.ok ? 0 : 1); } catch { process.exit(1); } })()"
 CMD ["node", "dist/index.js"]

package/templates/apps/fullstack/.dockerignore.hbs

@@ -23,3 +23,13 @@ tmp
 # 仅保留公共基础 .env；分环境配置、私有覆盖及已有交付包不进入构建上下文。
 **/.env.*
 **/.hai
+# 部署证书和测试材料不进入镜像构建上下文。
+**/*.pem
+**/*.key
+**/*.p12
+**/*.pfx
+**/tests
+**/e2e
+**/*.test.*
+**/*.spec.*
+docs

package/templates/apps/fullstack/apps/{{projectName}}-web/README.md.hbs

@@ -32,7 +32,7 @@ pnpm --filter {{projectName}}-web dev
 pnpm --filter {{projectName}}-web build
 ```
 
-从工程根运行 `pnpm build --target docker` 导出镜像。默认带部署工具，可运行 `pnpm run deploy --env test --build` 一次完成构建发布，或 `pnpm run deploy --env prod --bundle-only` 交付已有镜像及跨平台脚本。完整包包含自建中间件，人工部署与按服务更新见工程根 README。
+从工程根运行 `pnpm build --target image` 导出镜像。默认带部署工具，可运行 `pnpm run deploy --env test --build` 一次完成构建发布，或 `pnpm run deploy --env prod --bundle-only` 交付已有镜像及跨平台脚本。完整包包含自建中间件，人工部署与按服务更新见工程根 README。
 
 ### IAM 认证配置
 

package/templates/apps/fullstack/e2e/fullstack.spec.ts.hbs

@@ -805,6 +805,8 @@ test('administrator and user complete account, avatar, preference, password and
 {{#if fullstack.e2eFrontend}}
 
 test('feedback submits an empty description and business operator can process and reopen it', async ({ page }, testInfo) => {
+  // 附件脱敏、桌面/手机截图和导出校验共用完整流程预算，目录代理也执行相同断言。
+  test.setTimeout(120_000)
   await page.goto('./')
   await login(page, 'business_operator', businessOperatorPassword)
   const feedbackImage = Buffer.from(await page.evaluate(() => {
@@ -887,6 +889,11 @@ test('feedback submits an empty description and business operator can process an
   await expectUncovered(uploaded)
   await capture(page, 'feedback-preview.png', testInfo.outputPath('feedback-preview.png'))
   await uploaded.screenshot({ path: testInfo.outputPath('feedback-image-after-mask-detail.png'), animations: 'disabled' })
+  // 回执只表示记录已受理；等这份大附件真正上传成功，再开始后台处理操作。
+  const largeUpload = page.waitForResponse(response => response.request().method() === 'POST'
+    && /\/feedback\/reports\/[^/]+\/attachments\/[^/]+$/.test(new URL(response.url()).pathname)
+    && (response.request().postDataBuffer()?.byteLength ?? 0) > 2 * 1024 * 1024, { timeout: 60_000 })
+    .then(response => ({ response }), (error: unknown) => ({ error }))
   await dialog.getByRole('button', { name: /提交反馈|Submit Feedback|フィードバックを送信/ }).click()
   await expect(dialog.getByTestId('feedback-receipt')).toContainText(/FB-/)
   const number = (await dialog.getByTestId('feedback-receipt').textContent())?.match(/FB-[A-Za-z0-9-]+/)?.[0]
@@ -895,13 +902,20 @@ test('feedback submits an empty description and business operator can process an
     throw new Error('Feedback receipt number is missing')
   await expectDialogViewport()
   await capture(page, 'feedback-accepted.png', testInfo.outputPath('feedback-accepted.png'))
+  const completedUpload = await largeUpload
+  if ('error' in completedUpload)
+    throw completedUpload.error
+  expect(completedUpload.response.status()).toBe(200)
   await dialog.getByRole('button', { name: /关闭|Close|閉じる/ }).filter({ hasText: /关闭|Close|閉じる/ }).click()
   await page.getByTestId('nav-feedback').click()
   await expect(page.getByTestId('feedback-page')).toBeVisible()
   const row = page.getByRole('row').filter({ hasText: number })
   await expect(row).toBeVisible()
-  await row.getByRole('button', { name: /标记已处理|Mark handled|処理済み/ }).click()
-  await expect(row).toContainText(/已处理|Handled|処理済み/)
+  const handled = page.waitForResponse(response => response.request().method() === 'PATCH' && new URL(response.url()).pathname.endsWith('/status'))
+  await row.getByRole('button', { name: /标记已处理|Mark(?: as)? handled|処理済み/ }).click()
+  expect((await handled).status()).toBe(200)
+  // 仅核对状态徽标；“标记已处理”按钮本身也包含“已处理”，不能据此放行。
+  await expect(row.getByText(/^(已处理|Handled|処理済み)$/)).toBeVisible()
   await row.getByRole('button', { name: /撤销处理|Reopen|処理を取り消す/ }).scrollIntoViewIfNeeded()
   await capture(page, 'feedback-handled.png', testInfo.outputPath('feedback-handled.png'))
   await row.getByRole('button', { name: /撤销处理|Reopen|処理を取り消す/ }).click()

package/templates/apps/fullstack/images/serv.Dockerfile.hbs

@@ -12,14 +12,18 @@ RUN corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config s
 COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY images/dependencies/ ./
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --ignore-scripts
-COPY . .
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+COPY tsconfig.base.json ./
+COPY scripts/ ./scripts/
+COPY packages/{{projectName}}-contract/ ./packages/{{projectName}}-contract/
+COPY packages/{{projectName}}-serv/ ./packages/{{projectName}}-serv/
 ARG HAI_BUILD_ID=
 ARG HAI_BUILD_COMMIT=unknown
 RUN HAI_BUILD_ID="$HAI_BUILD_ID" HAI_BUILD_COMMIT="$HAI_BUILD_COMMIT" pnpm --filter {{fullstack.servPackageName}}... --if-present build
 
 RUN --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds if [ -d node_modules/better-sqlite3 ]; then cd node_modules/better-sqlite3; for attempt in 1 2 3; do node -e "require('node:child_process').execFileSync(process.execPath,[require.resolve('prebuild-install/bin.js'),'--verbose'],{stdio:'inherit'})" && break; [ "$attempt" = 3 ] && exit 1; sleep 3; done; fi
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds pnpm pm deploy --filter {{fullstack.servPackageName}} --prod /prod/service
+RUN rm -f /prod/service/README* && find /prod/service/dist -type f \( -name '*.map' -o -name '*.d.ts' -o -name '*.d.mts' -o -name '*.d.cts' \) -delete
 
 FROM node:24.22.1-bookworm-slim AS service
 
@@ -34,5 +38,5 @@ RUN mkdir -p /app/data && chown node:node /app/data
 USER node
 EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
-  CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+  CMD node -e "(async () => { try { const { core } = await import('@h-ai/core'); const { ServConfigSchema } = await import('@h-ai/serv'); core.init({ configDir: './config' }); const { server, http } = ServConfigSchema.parse(core.config.getOrThrow('serv')); if (http.health === false) process.exit(0); const response = await fetch('http://127.0.0.1:' + server.port + http.health.path, { signal: AbortSignal.timeout(4000) }); process.exit(response.ok ? 0 : 1); } catch { process.exit(1); } })()"
 CMD ["node", "dist/index.js"]

package/templates/apps/fullstack/images/web.Dockerfile.hbs

@@ -12,8 +12,12 @@ RUN corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config s
 COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY images/dependencies/ ./
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --ignore-scripts
-COPY . .
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+COPY tsconfig.base.json ./
+COPY scripts/ ./scripts/
+COPY packages/{{projectName}}-contract/ ./packages/{{projectName}}-contract/
+COPY packages/{{projectName}}-shared/ ./packages/{{projectName}}-shared/
+COPY apps/{{projectName}}-web/ ./apps/{{projectName}}-web/
 ARG HAI_BUILD_ID=
 ARG HAI_BUILD_COMMIT=unknown
 ARG PUBLIC_BASE_PATH=
@@ -30,6 +34,7 @@ COPY images/web/nginx.conf /etc/nginx/conf.d/default.conf
 COPY --chmod=755 images/web/19-runtime-config.envsh /docker-entrypoint.d/19-runtime-config.envsh
 COPY images/web/runtime-config.js.template /etc/nginx/templates/runtime-config.js.template
 COPY --from=build /workspace/apps/{{projectName}}-web/dist /usr/share/nginx/html
+RUN find /usr/share/nginx/html -type f -name '*.map' -delete
 
 EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \

package/templates/apps/fullstack/packages/{{projectName}}-serv/README.md.hbs

@@ -48,7 +48,7 @@ CLI 同时在根 `.env.dev/.env.test/.env.prod` 分别生成独立的 `HAI_CRYPT
 
 ### 容器运行
 
-从工程根运行 `pnpm build --target docker` 导出镜像。默认带部署工具，可运行 `pnpm run deploy --env test --build` 一次完成构建发布，或 `pnpm run deploy --env prod --bundle-only` 交付已有镜像及跨平台脚本。完整包包含自建中间件，人工部署与按服务更新见工程根 README。
+从工程根运行 `pnpm build --target image` 导出镜像。默认带部署工具，可运行 `pnpm run deploy --env test --build` 一次完成构建发布，或 `pnpm run deploy --env prod --bundle-only` 交付已有镜像及跨平台脚本。完整包包含自建中间件，人工部署与按服务更新见工程根 README。
 
 - 服务镜像直接由 `@h-ai/serv` 对外监听，配置挂载点为 `/app/config`，数据目录为 `/app/data`，不包含额外转发进程。
 - Web 镜像不烘焙 API 地址；启动时使用 `-e PUBLIC_API_BASE=https://api.example.com` 注入，同一镜像可部署到不同环境。未设置时 Web 默认请求自身 origin。

package/templates/apps/fullstack/packages/{{projectName}}-serv/config/_reach.yml.hbs

@@ -4,7 +4,10 @@ providers:
     type: console
   - name: sms
     type: console
-  # SMTP 替换 email 控制台 Provider；同名 Provider 只保留一个。
+# 生产示例：用下面 providers 整段替换上方控制台列表；保留需要的项。
+# 数组索引从 0 开始，删掉某项后同步修改其余环境变量中的索引。
+# providers:
+  # SMTP 邮件；名称 email 与下方通知模板对应。
   # - name: email
   #   type: smtp
   #   host: ${HAI_REACH_PROVIDERS_0_HOST:smtp.example.com}
@@ -16,8 +19,8 @@ providers:
   # 阿里云短信替换 sms 控制台 Provider。
   # - name: sms
   #   type: aliyun-sms
-  #   accessKeyId: ${HAI_REACH_PROVIDERS_0_ACCESSKEYID}
-  #   accessKeySecret: ${HAI_REACH_PROVIDERS_0_ACCESSKEYSECRET}
+  #   accessKeyId: ${HAI_REACH_PROVIDERS_1_ACCESSKEYID}
+  #   accessKeySecret: ${HAI_REACH_PROVIDERS_1_ACCESSKEYSECRET}
   #   signName: MyApp
   #   endpoint: dysmsapi.aliyuncs.com
   # 自有发送服务：按需将 template.provider 改为 custom。
@@ -26,9 +29,9 @@ providers:
   #   url: https://notify.example.com/send
   #   method: POST # POST | PUT
   #   headers:
-  #     Authorization: '${HAI_REACH_PROVIDERS_0_HEADERS_AUTHORIZATION}'
+  #     Authorization: '${HAI_REACH_PROVIDERS_2_HEADERS_AUTHORIZATION}'
   #   timeout: 10000
-  #   idempotent: ${HAI_REACH_PROVIDERS_0_IDEMPOTENT:false} # 仅接收端具备原子持久去重时启用；默认在途不明结果转 unknown
+  #   idempotent: ${HAI_REACH_PROVIDERS_2_IDEMPOTENT:false} # 仅接收端具备原子持久去重时启用；默认在途不明结果转 unknown
 templates:
   - name: otp_email
     provider: email
@@ -52,8 +55,8 @@ templates:
 #   start: '22:00'
 #   end: '08:00'
 
-# 延迟队列策略随每条消息保存；最多领取 5 次，指数退避 1 分钟至 1 小时。
-# 超限 dead 只经可信服务端人工恢复；unknown 不允许自动重发。
+# 消息发送失败后最多尝试 5 次。首次重试等待 1 分钟，以后每次加倍，最长等待 1 小时。
+# 尝试次数用完后停止，交给管理员处理；若无法确认对方是否已收到，先核对结果，避免重复发送。
 queue:
   maxAttempts: ${HAI_REACH_QUEUE_MAXATTEMPTS:5}
   retryDelayMs: ${HAI_REACH_QUEUE_RETRYDELAYMS:60000}

package/templates/apps/fullstack/packages/{{projectName}}-serv/config/_serv.yml.hbs

@@ -16,22 +16,24 @@ http:
   access: false
   # access:
   #   file: ./config/security/request-access.yml
+  # 或将 access: false 替换为下列内联配置；与 file 二选一。
+  # access:
+  #   global:
+  #     timezone: UTC # 可用 HAI_SERV_HTTP_ACCESS_GLOBAL_TIMEZONE=Asia/Shanghai
+  #     allowIps: []
+  #     denyIps: []
+  #     windows: []
+  #   rules: []
   apiPrefix: /api/v1
   openapi:
     path: /openapi.json
+  # HAI_SERV_HTTP_DOCS=false 关闭文档；开启时再配置 path/requireAuth。
   docs:
     path: /docs
     # requireAuth: true
   health:
     path: /health
     readyPath: /ready
-  rpc: false
-  # 内部 RPC 可选；启用时用对象替换 false，gateway-only 必须配置网关密钥。
-  # rpc:
-  #   prefix: /api/rpc
-  #   access: gateway-only # loopback | private-network | gateway-only
-  #   gatewayHeader: X-Gateway-Key
-  #   gatewaySecret: ${HAI_SERV_HTTP_RPC_GATEWAYSECRET}
 
 cors:
   origin: ${HAI_SERV_CORS_ORIGIN:*}
@@ -60,5 +62,10 @@ transport:
 {{else}}
   maxPlaintextBytes: ${HAI_SERV_TRANSPORT_MAXPLAINTEXTBYTES:1048576}
 {{/if}}
+  # HAI_SERV_TRANSPORT_ROUTEPLAINTEXTBYTES 可填 JSON，例如 {"/api/v1/uploads/*":8388608}。
+  routePlaintextBytes: {}
   keyExchangePath: /_hai/key-exchange
   # excludePaths: [/health, /ready]
+  # 单条路径需要更大请求体时填写字节数，* 只匹配一段路径。
+  # routePlaintextBytes: # HAI_SERV_TRANSPORT_ROUTEPLAINTEXTBYTES 可填 JSON 路径映射
+  #   /api/v1/uploads/*: 8388608

package/templates/apps/fullstack/packages/{{projectName}}-serv/package.json.hbs

@@ -43,11 +43,17 @@
     "@h-ai/cache": "{{haiPackageSpecifier}}",
     "@h-ai/core": "{{haiPackageSpecifier}}",
     "@h-ai/crypto": "{{haiPackageSpecifier}}",
+{{#if features.datapipe}}
+    "@h-ai/datapipe": "{{haiPackageSpecifier}}",
+{{/if}}
 {{#if features.feedback}}
     "@h-ai/api-contract": "{{haiPackageSpecifier}}",
     "@h-ai/feedback": "{{haiPackageSpecifier}}",
 {{/if}}
     "@h-ai/iam": "{{haiPackageSpecifier}}",
+{{#if features.payment}}
+    "@h-ai/payment": "{{haiPackageSpecifier}}",
+{{/if}}
     "@h-ai/reach": "{{haiPackageSpecifier}}",
     "@h-ai/reldb": "{{haiPackageSpecifier}}",
     "@h-ai/scheduler": "{{haiPackageSpecifier}}",

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/app-server.ts.hbs

@@ -37,7 +37,7 @@ export function createServerApp(): ServHttpApp {
     `${servConfig.http.apiPrefix}/assets`,
     ...(servConfig.http.health ? [servConfig.http.health.path, servConfig.http.health.readyPath].filter((path): path is `/${string}` => Boolean(path)) : []),
     ...(servConfig.http.openapi && security.exposeApiDocs ? [servConfig.http.openapi.path] : []),
-    ...(servConfig.http.docs && security.exposeApiDocs ? [servConfig.http.docs.path] : []),
+    ...(servConfig.http.docs && security.exposeApiDocs ? [servConfig.http.docs.path, `${servConfig.http.docs.path.slice(0, servConfig.http.docs.path.lastIndexOf('/') + 1)}_hai/scalar.js`] : []),
   ]
 {{#if features.feedback}}
   // 普通业务日志与反馈使用同一可信应用范围；身份仍由 IAM 验证。

package/templates/apps/fullstack/packages/{{projectName}}-serv/tests/app-server.test.ts.hbs

@@ -231,7 +231,7 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     }
   })
 
-  it('updates personal preferences, validates images and serves only allowed avatar resources', async () => {
+  it('updates personal preferences and clears the email address', async () => {
     expect((await call('/profile/update', { displayName: 'Updated', locale: 'en-US', theme: '{{fullstack.theme.defaultTheme}}' }, userToken)).success).toBe(true)
     const current = await call<{ metadata: { locale: string, theme: string } }>('/auth/me', undefined, userToken, 'GET')
     expect(current.success).toBe(true)
@@ -242,6 +242,9 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     expect(cleared.success).toBe(true)
     if (cleared.success)
       expect(cleared.data.email).toBe('')
+  })
+
+  it('rejects invalid images, oversized payloads and anonymous avatar uploads', async () => {
     const invalid = await call('/profile/avatar', { contentType: 'image/png', base64: 'PHN2Zz48L3N2Zz4=' }, userToken)
     expect(invalid.success).toBe(false)
     if (!invalid.success)
@@ -252,6 +255,9 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     expect(anonymous.success).toBe(false)
     if (!anonymous.success)
       expect(anonymous.error.httpStatus).toBe(401)
+  })
+
+  it('serves only uploaded avatar resources and restricts profile fields', async () => {
     const injected = await transport.encryptedFetch(`http://localhost${PREFIX}/profile/update`, {
       method: 'POST',
       headers: { 'content-type': 'application/json', 'authorization': `Bearer ${userToken}` },

package/templates/apps/fullstack/packages/{{projectName}}-serv/tests/security.test.ts.hbs

@@ -58,7 +58,7 @@ beforeAll(async () => {
     contract: {{fullstack.contractExportName}},
     procedures: createServerProcedures({ app: { name: 'Security fixture', version: 'test', env: 'test', defaultLocale: 'en-US', supportedLocales: ['en-US'], startedAt: new Date().toISOString(), frontends: ['web'] } }),
     iam,
-    http: { openapi: false, docs: false, rpc: false },
+    http: { openapi: false, docs: false },
   })
   server = serv.listen(app, { host: '127.0.0.1', port: 0 })
   if (!server.server.listening)

package/templates/apps/fullstack/pnpm-workspace.yaml.hbs

@@ -9,6 +9,7 @@ trustPolicyExclude:
 # pnpm 12 配置；原生依赖仅运行明确列出的安装脚本。
 nodeLinker: hoisted
 allowBuilds:
+  onnxruntime-node: true
   protobufjs: true
   vue-demi: true
   better-sqlite3: true

package/templates/apps/website/scripts/static-website.mjs.hbs

@@ -9,21 +9,21 @@ const message = core.i18n.createMessageGetter({
   'zh-CN': {
     flag: 'HAI_BUILD_STATIC仅支持0或1；省略或0保持SSR，1启用website静态构建。',
     base: 'PUBLIC_BASE_PATH须为空或以/开头的站内目录；不允许外部地址、末尾/、查询、片段或路径逃逸。',
-    modules: '静态website不能启用服务端业务模块。请使用--features none创建纯展示站点，或继续使用默认SSR。',
+    modules: '静态website不能启用服务端业务模块。请移除服务端模块及其初始化后再构建，或继续使用默认SSR。',
     routes: '静态website不能包含自定义API、表单actions或未预渲染页面；请移除动态入口或使用SSR。',
     assets: 'static是公开资产目录，不能放入.env私有环境文件或符号链接；请移动私有内容后重新构建。',
   },
   'en-US': {
     flag: 'HAI_BUILD_STATIC accepts only 0 or 1: omitted/0 keeps SSR, and 1 enables a static website build.',
     base: 'PUBLIC_BASE_PATH must be empty or a site-local directory beginning with /. External URLs, trailing /, queries, fragments and path traversal are not allowed.',
-    modules: 'A static website cannot enable server-side business modules. Create a presentation site with --features none, or keep the default SSR mode.',
+    modules: 'A static website cannot enable server-side business modules. Remove server modules and their initialization before building, or keep the default SSR mode.',
     routes: 'A static website cannot contain custom APIs, form actions or pages that were not prerendered. Remove dynamic routes or use SSR.',
     assets: 'static is a public asset directory and cannot contain private .env files or symbolic links. Move private content before building.',
   },
   'ja-JP': {
     flag: 'HAI_BUILD_STATICは0または1です。省略/0はSSR、1はwebsiteの静的構築を有効にします。',
     base: 'PUBLIC_BASE_PATHは空、または/で始まるサイト内ディレクトリーです。外部URL、末尾の/、クエリー、フラグメント、パス逸脱は使えません。',
-    modules: '静的websiteではサーバー業務モジュールを有効にできません。--features noneで表示専用サイトを作成するか、既定のSSRを使用してください。',
+    modules: '静的websiteではサーバー業務モジュールを有効にできません。サーバーモジュールと初期化処理を除去するか、既定のSSRを使用してください。',
     routes: '静的websiteに独自API、form actions、事前描画されないページを含められません。動的ルートを削除するかSSRを使用してください。',
     assets: 'staticは公開資産ディレクトリーです。非公開.envファイルやシンボリックリンクを置かず、非公開内容を移動してから構築してください。',
   },

package/templates/base/.dockerignore.hbs

@@ -25,3 +25,13 @@ ios
 # 仅保留公共基础 .env；分环境配置、私有覆盖及已有交付包不进入构建上下文。
 **/.env.*
 **/.hai
+# 部署证书和测试材料不进入镜像构建上下文。
+**/*.pem
+**/*.key
+**/*.p12
+**/*.pfx
+**/tests
+**/e2e
+**/*.test.*
+**/*.spec.*
+docs

package/templates/base/images/web.Dockerfile.hbs

@@ -11,8 +11,8 @@ RUN corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config s
 COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY images/dependencies/ ./
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --ignore-scripts
-COPY . .
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+COPY . .
 ARG HAI_BUILD_ID=
 ARG HAI_BUILD_COMMIT=unknown
 ARG PUBLIC_BASE_PATH=
@@ -23,6 +23,7 @@ FROM nginxinc/nginx-unprivileged:1.29.8-alpine AS runtime
 COPY --chmod=755 images/web/19-runtime-config.sh /docker-entrypoint.d/19-hai-runtime-config.sh
 COPY images/web/nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /workspace/dist /usr/share/nginx/html
+RUN find /usr/share/nginx/html -type f -name '*.map' -delete
 
 EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
@@ -42,14 +43,15 @@ RUN corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config s
 COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY images/dependencies/ ./
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --ignore-scripts
-COPY . .
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+COPY . .
 ARG HAI_BUILD_ID=
 ARG HAI_BUILD_COMMIT=unknown
 ARG PUBLIC_BASE_PATH=
 RUN HAI_BUILD_ID="$HAI_BUILD_ID" HAI_BUILD_COMMIT="$HAI_BUILD_COMMIT" PUBLIC_BASE_PATH="$PUBLIC_BASE_PATH" pnpm compile
 RUN --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds if [ -d node_modules/better-sqlite3 ]; then cd node_modules/better-sqlite3; for attempt in 1 2 3; do node -e "require('node:child_process').execFileSync(process.execPath,[require.resolve('prebuild-install/bin.js'),'--verbose'],{stdio:'inherit'})" && break; [ "$attempt" = 3 ] && exit 1; sleep 3; done; fi
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds pnpm pm deploy --filter {{projectName}} --prod /prod/app
+RUN rm -f /prod/app/README* && find /prod/app/build -type f \( -name '*.map' -o -name '*.d.ts' -o -name '*.d.mts' -o -name '*.d.cts' \) -delete
 
 FROM node:24.22.1-bookworm-slim AS runtime-base
 

package/templates/base/package.json.hbs

@@ -1,7 +1,7 @@
 {
   "engines": { "node": "^22.23.4 || ^24.22.1 || ^26.12.1" },
   "name": "{{projectName}}",
-  "version": "1.0.0-beta.2",
+  "version": "1.0.0-beta.4",
   "private": true,
   "packageManager": "pnpm@12.11.2",
   "description": "{{#if_eq appType 'admin'}}Enterprise management system built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'website'}}Enterprise website built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'h5'}}Mobile H5 app built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'api'}}REST API service built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'mobile-app'}}Mobile app built with hai Agent Framework{{/if_eq}}",

package/templates/base/src/hooks.server.ts.hbs

@@ -8,13 +8,7 @@
 import type { TransportEncryptionOptions } from '@h-ai/kit'
 {{/if}}
 import type { Handle } from '@sveltejs/kit'
-{{#if features.cache}}
-import process from 'node:process'
-{{else}}
-{{#if features.crypto}}
 import process from 'node:process'
-{{/if}}
-{{/if}}
 {{#if hasI18n}}
 import { base } from '$app/paths'
 {{else}}
@@ -29,7 +23,7 @@ import { base } from '$app/paths'
 {{#if hasI18n}}
 import { paraglideMiddleware } from '$lib/paraglide/server.js'
 {{/if}}
-import { initApp } from '$lib/server/init.js'
+import { closeApp, initApp } from '$lib/server/init.js'
 import { getKitConfig } from '$lib/server/kit-config.js'
 {{#if features.cache}}
 import { cache } from '@h-ai/cache'
@@ -54,6 +48,14 @@ import { reldb } from '@h-ai/reldb'
 
 let appInitPromise: Promise<void> | null = null
 
+// Node 适配器停止接收请求后释放模块，避免数据库或后台任务阻止进程退出。
+process.once('sveltekit:shutdown', () => {
+  void closeApp().catch((error: unknown) => {
+    core.logger.error('Application shutdown failed', { error })
+    process.exitCode = 1
+  })
+})
+
 async function ensureAppInitialized() {
   if (!appInitPromise) {
     appInitPromise = initApp().catch((err: unknown) => {

package/templates/features/payment/routes/api/v1/payment/create/+server.ts

@@ -28,5 +28,7 @@ export const POST: RequestHandler = async ({ request, locals }) => {
     metadata,
     notifyUrl: notifyUrl ?? `${new URL(request.url).origin}${base}/api/v1/payment/notify/${provider}`,
   })
-  return kit.response.fromResult(result, locals.requestId)
+  if (!result.success)
+    return kit.response.fromError(result.error, locals.requestId)
+  return kit.response.ok(result.data, locals.requestId)
 }