@h-ai/core 0.1.0-alpha9 → 1.0.0-beta.1

package/dist/node.js

@@ -1,43 +1,358 @@
-import { createCore, CoreConfigSchema, i18n, err, HaiConfigError, ok, typeUtils } from './chunk-FVCFFZP6.js';
-export { CoreConfigSchema, EnvSchema, HaiCommonError, HaiConfigError, IdConfigSchema, LogFormatSchema, LogLevelSchema, LoggingConfigSchema, err, ok } from './chunk-FVCFFZP6.js';
-import { existsSync, readdirSync, watch, readFileSync } from 'fs';
-import { join } from 'path';
-import process2 from 'process';
+import { installRequestLocales, installRequestContext, createCore, i18n, err, HaiConfigError, ok, RequestAccessConfigSchema, RequestAccessPolicySchema, AccessConditionSchema, requestContext, sanitize, emitLogRecord, sanitizeLogFields, typeUtils, CoreConfigSchema } from './chunk-BEGTB6GL.js';
+export { AccessConditionSchema, CoreConfigSchema, EnvSchema, HaiCommonError, HaiConfigError, LogFormatSchema, LogLevelSchema, LoggingConfigSchema, RequestAccessConfigSchema, RequestAccessPolicySchema, TrustedProxiesSchema, err, ok } from './chunk-BEGTB6GL.js';
+import { AsyncLocalStorage } from 'async_hooks';
+import { Buffer } from 'buffer';
+import { timingSafeEqual } from 'crypto';
+import { existsSync, readFileSync, openSync, constants, fstatSync, readSync, closeSync, readdirSync, watch } from 'fs';
+import path, { join } from 'path';
+import { BlockList, isIP } from 'net';
+import { networkInterfaces } from 'os';
+import process3 from 'process';
 import { parse } from 'yaml';
+import { parseEnv } from 'util';
 import { execSync } from 'child_process';
+import { createRequire } from 'module';
 import pino from 'pino';
 
+var allowed = Object.freeze({ allowed: true });
+var invalidPath = Object.freeze({ allowed: false, reason: "path" });
+var maximumPolicyBytes = 1024 * 1024;
+function normalizeClientIp(value) {
+  if (!value)
+    return void 0;
+  const address = value.trim();
+  if (address.includes("%") || !isIP(address))
+    return void 0;
+  return address.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i)?.[1] ?? address;
+}
+function addAddress(list, entry) {
+  const [address, prefix, extra] = entry.split("/");
+  const family = address ? isIP(address) : 0;
+  if (!family || address?.includes("%") || extra !== void 0)
+    throw new Error("Expected an IP address or CIDR");
+  const type = family === 4 ? "ipv4" : "ipv6";
+  if (prefix === void 0) {
+    list.addAddress(address, type);
+    return;
+  }
+  const bits = Number(prefix);
+  if (!/^\d+$/.test(prefix) || bits < 0 || bits > (family === 4 ? 32 : 128))
+    throw new Error("Invalid CIDR prefix");
+  list.addSubnet(address, bits, type);
+}
+function createClientIpResolver(trustedProxies = "auto") {
+  const entries = trustedProxies === "auto" ? process3.env.HAI_DEPLOY_PRIVATE_PROXY === "1" ? Object.values(networkInterfaces()).flatMap((interfaces) => interfaces?.filter((value) => !value.internal && value.cidr && !value.cidr.includes("%")).map((value) => value.cidr) ?? []) : [] : trustedProxies;
+  if (trustedProxies === "auto" && process3.env.HAI_DEPLOY_PRIVATE_PROXY === "1" && !entries.length)
+    throw new Error("Private proxy mode requires an isolated container network");
+  const proxies = new BlockList();
+  for (const entry of entries)
+    addAddress(proxies, entry);
+  const trusted = (address) => proxies.check(address, isIP(address) === 4 ? "ipv4" : "ipv6");
+  return (request, remoteAddress) => {
+    const peer = normalizeClientIp(remoteAddress);
+    if (!peer || !entries.length || !trusted(peer))
+      return peer;
+    const forwarded = request.headers.get("x-forwarded-for");
+    if (forwarded === null) {
+      const realIp = request.headers.get("x-real-ip");
+      return realIp === null ? peer : normalizeClientIp(realIp);
+    }
+    if (forwarded.length > 2048)
+      return void 0;
+    const chain = forwarded.split(",");
+    if (chain.length > 32)
+      return void 0;
+    let current = peer;
+    for (let index = chain.length - 1; index >= 0 && trusted(current); index--) {
+      const address = normalizeClientIp(chain[index]);
+      if (!address)
+        return void 0;
+      current = address;
+    }
+    return current;
+  };
+}
+function timeReader(timezone) {
+  const formatter = new Intl.DateTimeFormat("en-US", { timeZone: timezone, weekday: "short", hour: "2-digit", minute: "2-digit", hourCycle: "h23" });
+  const weekdays = ["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"];
+  let lastMinute = Number.NaN;
+  let local;
+  return (now) => {
+    const minute = Math.floor(now / 6e4);
+    if (minute !== lastMinute) {
+      const parts = Object.fromEntries(formatter.formatToParts(now).map((part) => [part.type, part.value]));
+      local = { day: weekdays.indexOf(parts.weekday) + 1, time: `${parts.hour}:${parts.minute}` };
+      lastMinute = minute;
+    }
+    return local;
+  };
+}
+function compileCondition(condition, readTime, ruleId) {
+  const allow = new BlockList();
+  const deny = new BlockList();
+  for (const entry of condition.allowIps)
+    addAddress(allow, entry);
+  for (const entry of condition.denyIps)
+    addAddress(deny, entry);
+  const addressDenied = Object.freeze({ allowed: false, reason: "address", ruleId });
+  const timeDenied = Object.freeze({ allowed: false, reason: "time", ruleId });
+  const checksAddress = condition.allowIps.length > 0 || condition.denyIps.length > 0;
+  return (ip) => {
+    if (checksAddress) {
+      const address = normalizeClientIp(ip);
+      if (!address)
+        return addressDenied;
+      const family = isIP(address) === 4 ? "ipv4" : "ipv6";
+      if (deny.check(address, family) || condition.allowIps.length && !allow.check(address, family))
+        return addressDenied;
+    }
+    if (readTime) {
+      const { day, time } = readTime(Date.now());
+      const previous = day === 1 ? 7 : day - 1;
+      if (!condition.windows.some((window) => window.start < window.end ? window.days.includes(day) && time >= window.start && time < window.end : window.days.includes(day) && time >= window.start || window.days.includes(previous) && time < window.end)) {
+        return timeDenied;
+      }
+    }
+    return allowed;
+  };
+}
+function createConditionCheck(input) {
+  const condition = AccessConditionSchema.parse(input);
+  return compileCondition(condition, condition.windows.length ? timeReader(condition.timezone) : void 0);
+}
+function loadPolicy(input = false, baseDirectory = process3.cwd()) {
+  const config2 = RequestAccessConfigSchema.parse(input);
+  if (config2 === false || !("file" in config2))
+    return config2;
+  let descriptor;
+  let content;
+  try {
+    descriptor = openSync(path.resolve(baseDirectory, config2.file), constants.O_RDONLY | constants.O_NONBLOCK);
+    const stat = fstatSync(descriptor);
+    if (!stat.isFile() || stat.size > maximumPolicyBytes)
+      throw new Error("Invalid policy file size or type");
+    const bytes = Buffer.alloc(Math.min(stat.size + 1, maximumPolicyBytes + 1));
+    let length = 0;
+    while (length < bytes.length) {
+      const read = readSync(descriptor, bytes, length, bytes.length - length, null);
+      if (!read)
+        break;
+      length += read;
+    }
+    if (length > maximumPolicyBytes || length !== stat.size)
+      throw new Error("Policy file changed while reading");
+    content = bytes.subarray(0, length).toString("utf8");
+  } catch {
+    throw new Error("Request access policy file could not be read; use a regular YAML file no larger than 1 MiB");
+  } finally {
+    if (descriptor !== void 0)
+      closeSync(descriptor);
+  }
+  let parsed;
+  try {
+    parsed = parse(content, { maxAliasCount: 0, uniqueKeys: true });
+  } catch {
+    throw new Error("Request access policy YAML is invalid; aliases and duplicate keys are not allowed");
+  }
+  const validated = RequestAccessPolicySchema.safeParse(parsed);
+  if (!validated.success)
+    throw new Error(`Request access policy is invalid at ${validated.error.issues.map((issue) => issue.path.join(".") || "root").join(", ")}`);
+  return validated.data;
+}
+function normalizeRequestPath(value) {
+  if (value.length > 8192)
+    return void 0;
+  let decoded = value;
+  if (value.includes("%")) {
+    if (/%(?:2f|5c|00)/i.test(value))
+      return void 0;
+    try {
+      decoded = decodeURIComponent(value);
+    } catch {
+      return void 0;
+    }
+  }
+  if (!decoded.startsWith("/") || /[\\%?#\u0000-\u0020\u007F]/.test(decoded) || decoded.includes("//"))
+    return void 0;
+  if (/(?:^|\/)\.\.?(?:\/|$)/.test(decoded))
+    return void 0;
+  return decoded.length > 1 && decoded.endsWith("/") ? decoded.slice(0, -1) : decoded;
+}
+function createRequestCheck(input = false) {
+  const policy = loadPolicy(input);
+  if (policy === false)
+    return Object.assign(() => allowed, { encryption: () => void 0, requiresEncryption: false });
+  const clocks = /* @__PURE__ */ new Map();
+  const compile = (condition, id) => {
+    let readTime;
+    if (condition.windows.length) {
+      readTime = clocks.get(condition.timezone) ?? timeReader(condition.timezone);
+      clocks.set(condition.timezone, readTime);
+    }
+    return compileCondition(condition, readTime, id);
+  };
+  const globalCheck = policy.global ? compile(policy.global) : () => allowed;
+  const exact = /* @__PURE__ */ new Map();
+  const prefixes = { children: /* @__PURE__ */ new Map(), rules: [] };
+  const allMethods = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "CONNECT", "TRACE", "*"];
+  let requiresEncryption = false;
+  let hasEncryption = false;
+  for (const rule of policy.rules) {
+    const compiled = { methods: new Set(rule.methods), check: compile(rule, rule.id) };
+    for (const pattern of new Set(rule.paths)) {
+      if (rule.encryption) {
+        hasEncryption = true;
+        requiresEncryption ||= rule.encryption === "required";
+        const prefix = pattern.endsWith("/**");
+        const nodes = [prefixes];
+        let node = prefixes;
+        const path2 = normalizeRequestPath(prefix ? pattern.slice(0, -3) || "/" : pattern);
+        for (const segment of path2.split("/").filter(Boolean)) {
+          let child = node.children.get(segment);
+          if (!child) {
+            child = { children: /* @__PURE__ */ new Map(), rules: [] };
+            node.children.set(segment, child);
+          }
+          node = child;
+          nodes.push(node);
+        }
+        const bit = rule.encryption === "required" ? 1 : 2;
+        const opposite = bit === 1 ? 2 : 1;
+        const methods = rule.methods.length ? rule.methods : allMethods;
+        for (const method of methods) {
+          if (nodes.some((parent) => parent.encryption?.has(method) && parent.encryption.get(method) !== rule.encryption) || (prefix ? (node.encryptionBelow?.get(method) ?? 0) & opposite : node.exactEncryption?.has(method) && node.exactEncryption.get(method) !== rule.encryption)) {
+            throw new Error(`Request access encryption conflicts at rule ${rule.id}`);
+          }
+          const modes = prefix ? node.encryption ??= /* @__PURE__ */ new Map() : node.exactEncryption ??= /* @__PURE__ */ new Map();
+          modes.set(method, rule.encryption);
+          for (const parent of nodes) {
+            parent.encryptionBelow ??= /* @__PURE__ */ new Map();
+            parent.encryptionBelow.set(method, (parent.encryptionBelow.get(method) ?? 0) | bit);
+          }
+        }
+      }
+      if (pattern.endsWith("/**")) {
+        let node = prefixes;
+        for (const segment of pattern.slice(0, -3).split("/").filter(Boolean)) {
+          let child = node.children.get(segment);
+          if (!child) {
+            child = { children: /* @__PURE__ */ new Map(), rules: [] };
+            node.children.set(segment, child);
+          }
+          node = child;
+        }
+        node.rules.push(compiled);
+      } else {
+        const path2 = normalizeRequestPath(pattern);
+        const rules = exact.get(path2) ?? [];
+        rules.push(compiled);
+        exact.set(path2, rules);
+      }
+    }
+  }
+  const check = (pathname, method, ip) => {
+    const global = globalCheck(ip);
+    if (!global.allowed)
+      return global;
+    const path2 = normalizeRequestPath(pathname);
+    if (!path2)
+      return invalidPath;
+    for (const rule of exact.get(path2) ?? []) {
+      if (!rule.methods.size || rule.methods.has(method)) {
+        const decision = rule.check(ip);
+        if (!decision.allowed)
+          return decision;
+      }
+    }
+    let node = prefixes;
+    for (const rule of node.rules) {
+      if (!rule.methods.size || rule.methods.has(method)) {
+        const decision = rule.check(ip);
+        if (!decision.allowed)
+          return decision;
+      }
+    }
+    if (node.children.size) {
+      for (const segment of path2.split("/").filter(Boolean)) {
+        node = node.children.get(segment);
+        if (!node)
+          break;
+        for (const rule of node.rules) {
+          if (!rule.methods.size || rule.methods.has(method)) {
+            const decision = rule.check(ip);
+            if (!decision.allowed)
+              return decision;
+          }
+        }
+      }
+    }
+    return allowed;
+  };
+  const encryption = (pathname, method) => {
+    const path2 = normalizeRequestPath(pathname);
+    if (!path2)
+      return void 0;
+    let node = prefixes;
+    let mode = node.encryption?.get(method) ?? node.encryption?.get("*");
+    for (const segment of path2.split("/").filter(Boolean)) {
+      node = node.children.get(segment);
+      if (!node)
+        return mode;
+      mode ??= node.encryption?.get(method) ?? node.encryption?.get("*");
+    }
+    return mode ?? node?.exactEncryption?.get(method) ?? node?.exactEncryption?.get("*");
+  };
+  return Object.assign(check, { encryption: hasEncryption ? encryption : () => void 0, requiresEncryption });
+}
+var access = { normalizeClientIp, createClientIpResolver, createConditionCheck, createRequestCheck, loadPolicy };
 var ENV_VAR_PATTERN = /\$\{([^}:]+)(?::([^}]*))?\}/g;
 var FULL_VAR_PATTERN = /^\$\{[^}:]+(?::[^}]*)?\}$/;
-function interpolateEnv(value) {
+function parseEnvValue(value) {
+  if (value === "")
+    return "";
+  try {
+    const parsed = parse(value);
+    return parsed === void 0 ? value : parsed;
+  } catch {
+    return value;
+  }
+}
+function normalizeEnvSegment(segment) {
+  return segment.replace(/[^a-z0-9]+/gi, "_").replace(/^_+|_+$/g, "").toUpperCase();
+}
+function buildConventionEnvName(name, path2) {
+  return ["HAI", name, ...path2].map(normalizeEnvSegment).filter(Boolean).join("_");
+}
+function resolveEnv(value, name, path2 = []) {
+  const conventionEnvValue = process3.env[buildConventionEnvName(name, path2)];
+  if (conventionEnvValue !== void 0)
+    return ok(parseEnvValue(conventionEnvValue));
   if (typeof value === "string") {
-    let result = value;
     ENV_VAR_PATTERN.lastIndex = 0;
+    const hasExplicitEnv = ENV_VAR_PATTERN.test(value);
+    ENV_VAR_PATTERN.lastIndex = 0;
+    if (!hasExplicitEnv)
+      return ok(value);
+    let result = value;
     while (true) {
       const match = ENV_VAR_PATTERN.exec(value);
       if (!match)
         break;
       const [fullMatch, varName, defaultValue] = match;
-      const envValue = process2.env[varName];
+      const envValue = process3.env[varName];
       if (envValue === void 0 && defaultValue === void 0) {
         return err(HaiConfigError.CONFIG_ENV_VAR_MISSING, i18n.coreM("core_configEnvVarMissing", { params: { varName } }));
       }
-      result = result.replace(fullMatch, envValue ?? defaultValue ?? "");
-    }
-    if (FULL_VAR_PATTERN.test(value)) {
-      try {
-        const coerced = parse(result);
-        if (coerced !== void 0)
-          return ok(coerced);
-      } catch {
-      }
+      result = result.replace(fullMatch, () => envValue ?? defaultValue ?? "");
     }
+    if (FULL_VAR_PATTERN.test(value))
+      return ok(parseEnvValue(result));
     return ok(result);
   }
   if (Array.isArray(value)) {
     const results = [];
-    for (const item of value) {
-      const r = interpolateEnv(item);
+    for (const [index, item] of value.entries()) {
+      const r = resolveEnv(item, name, [...path2, String(index)]);
       if (!r.success)
         return r;
       results.push(r.data);
@@ -47,7 +362,7 @@ function interpolateEnv(value) {
   if (typeUtils.isObject(value)) {
     const results = {};
     for (const [k, v] of Object.entries(value)) {
-      const r = interpolateEnv(v);
+      const r = resolveEnv(v, name, [...path2, k]);
       if (!r.success)
         return r;
       results[k] = r.data;
@@ -84,20 +399,20 @@ function notifyWatchCallbacks(name, result) {
     }
   }
 }
-function loadYaml(filePath) {
+function loadYaml(name, filePath) {
   if (!existsSync(filePath)) {
     return err(HaiConfigError.CONFIG_FILE_NOT_FOUND, i18n.coreM("core_configFileNotExist", { params: { filePath } }));
   }
   try {
     const content = readFileSync(filePath, "utf-8");
     const parsed = parse(content);
-    return interpolateEnv(parsed);
+    return resolveEnv(parsed, name);
   } catch (error) {
     return err(HaiConfigError.CONFIG_PARSE_ERROR, i18n.coreM("core_configParseFailed", { params: { filePath } }), error);
   }
 }
-function loadConfig(filePath, schema) {
-  const yamlResult = loadYaml(filePath);
+function loadConfig(name, filePath, schema) {
+  const yamlResult = loadYaml(name, filePath);
   if (!yamlResult.success)
     return yamlResult;
   const parseResult = schema.safeParse(yamlResult.data);
@@ -107,7 +422,7 @@ function loadConfig(filePath, schema) {
   return ok(parseResult.data);
 }
 function loadAndCache(name, filePath, schema) {
-  const result = schema ? loadConfig(filePath, schema) : loadYaml(filePath);
+  const result = schema ? loadConfig(name, filePath, schema) : loadYaml(name, filePath);
   if (result.success) {
     configCache.set(name, {
       data: result.data,
@@ -143,7 +458,7 @@ function reloadAndNotify(name) {
     notifyWatchCallbacks(name, result2);
     return result2;
   }
-  const result = entry.schema ? loadConfig(entry.filePath, entry.schema) : loadYaml(entry.filePath);
+  const result = entry.schema ? loadConfig(name, entry.filePath, entry.schema) : loadYaml(name, entry.filePath);
   if (result.success) {
     configCache.set(name, {
       ...entry,
@@ -233,6 +548,45 @@ function clearCache(name) {
   }
 }
 var config = {
+  /**
+   * 读取 dotenv 文件并按统一顺序合并，不修改进程环境。
+   *
+   * 优先级：已有进程环境 > .env.local > .env.<mode> > .env。
+   * development/production 分别映射到 dev/prod；不存在的文件跳过。
+   * 返回值可能包含私有配置，仅在 Node 启动/构建边界注入，不下发浏览器。
+   * @param options - 文件所在目录及环境模式
+   * @param options.mode - dev/test/prod 或 Vite 的 development/production
+   * @param options.envDir - dotenv 所在目录，默认进程工作目录
+   * @returns 已合并的变量；非法模式或读取失败返回配置错误，不包含文件内容
+   * @example
+   * ```ts
+   * const env = core.config.loadEnvFiles({ mode: 'dev', envDir: '.' })
+   * if (!env.success) throw new Error(env.error.message)
+   * Object.assign(process.env, env.data)
+   * core.init({ configDir: './config' })
+   * ```
+   */
+  loadEnvFiles(options) {
+    const mode = options.mode === "development" ? "dev" : options.mode === "production" ? "prod" : options.mode;
+    if (!/^[a-z0-9][\w-]*$/i.test(mode))
+      return err(HaiConfigError.CONFIG_VALIDATION_ERROR, i18n.coreM("core_configValidationFailed"));
+    const envDir = options.envDir ?? process3.cwd();
+    try {
+      const merged = {};
+      for (const name of [".env", `.env.${mode}`, ".env.local"]) {
+        const file = join(envDir, name);
+        if (existsSync(file))
+          Object.assign(merged, parseEnv(readFileSync(file, "utf8")));
+      }
+      for (const name of Object.keys(merged)) {
+        if (process3.env[name] !== void 0)
+          merged[name] = process3.env[name];
+      }
+      return ok(merged);
+    } catch {
+      return err(HaiConfigError.CONFIG_PARSE_ERROR, i18n.coreM("core_configParseFailed", { params: { filePath: envDir } }));
+    }
+  },
   /**
    * 加载配置到缓存。
    *
@@ -426,18 +780,16 @@ var config = {
     return watchEntries.has(name);
   }
 };
-if (process2.platform === "win32" && process2.stdout.isTTY) {
+var nodeRequire = createRequire(import.meta.url);
+if (process3.platform === "win32" && process3.stdout.isTTY) {
   try {
     execSync("chcp 65001 > nul", { stdio: "ignore" });
-    if (process2.stdout.setDefaultEncoding) {
-      process2.stdout.setDefaultEncoding("utf8");
+    if (process3.stdout.setDefaultEncoding) {
+      process3.stdout.setDefaultEncoding("utf8");
     }
-    if (process2.stderr.setDefaultEncoding) {
-      process2.stderr.setDefaultEncoding("utf8");
+    if (process3.stderr.setDefaultEncoding) {
+      process3.stderr.setDefaultEncoding("utf8");
     }
-    process2.env.LANG = "zh_CN.UTF-8";
-    process2.env.LC_ALL = "zh_CN.UTF-8";
-    process2.env.PYTHONIOENCODING = "utf-8";
   } catch (_e) {
   }
 }
@@ -445,17 +797,21 @@ var globalLevel = "info";
 var globalFormat = "pretty";
 var globalContext = {};
 var globalRedact = [];
+var outputRevision = 0;
 var defaultLogger = null;
 function configureLogger(config2) {
   if (config2.level)
     globalLevel = config2.level;
-  if (config2.format)
+  if (config2.format) {
     globalFormat = config2.format;
+    outputRevision++;
+  }
   if (config2.context)
     globalContext = { ...globalContext, ...config2.context };
-  if (config2.redact)
-    globalRedact = config2.redact;
-  defaultLogger = null;
+  if (config2.redact) {
+    globalRedact = [...config2.redact];
+    outputRevision++;
+  }
 }
 function setLogLevel(level) {
   globalLevel = level;
@@ -463,35 +819,68 @@ function setLogLevel(level) {
 function getLogLevel() {
   return globalLevel;
 }
-function wrapPino(pinoLogger, context) {
+function sanitizeLogContext(ctx) {
+  if (!ctx || Object.keys(ctx).length === 0) {
+    return ctx;
+  }
+  return sanitizeLogFields(ctx, globalRedact);
+}
+function wrapPino(resolvePino, resolveContext) {
+  const write = (level, message, ctx) => {
+    const output = resolvePino();
+    if (!output.isLevelEnabled(level))
+      return;
+    const context = sanitizeLogContext({ ...resolveContext(), ...ctx, ...requestContext.get() }) ?? {};
+    message = sanitize.sanitizeText(message);
+    output[level](context, message);
+    if (!requestContext.get().suppressLogObservers)
+      emitLogRecord({ timestamp: Date.now(), level, message, context });
+  };
   return {
     trace(message, ctx) {
-      pinoLogger.trace({ ...context, ...ctx }, message);
+      write("trace", message, ctx);
     },
     debug(message, ctx) {
-      pinoLogger.debug({ ...context, ...ctx }, message);
+      write("debug", message, ctx);
     },
     info(message, ctx) {
-      pinoLogger.info({ ...context, ...ctx }, message);
+      write("info", message, ctx);
     },
     warn(message, ctx) {
-      pinoLogger.warn({ ...context, ...ctx }, message);
+      write("warn", message, ctx);
     },
     error(message, ctx) {
-      pinoLogger.error({ ...context, ...ctx }, message);
+      write("error", message, ctx);
     },
     fatal(message, ctx) {
-      pinoLogger.fatal({ ...context, ...ctx }, message);
+      write("fatal", message, ctx);
     },
     child(childContext) {
-      return wrapPino(pinoLogger.child(childContext), { ...context, ...childContext });
+      return wrapPino(resolvePino, () => ({ ...resolveContext(), ...childContext }));
     }
   };
 }
 function createLogger(options = {}) {
+  const localOptions = { ...options, context: { ...options.context } };
+  let revision = outputRevision;
+  let output = createPinoOutput(localOptions);
+  const resolvePino = () => {
+    if (revision !== outputRevision) {
+      const updated = createPinoOutput(localOptions);
+      output.close();
+      output = updated;
+      revision = outputRevision;
+    }
+    const level = localOptions.level ?? globalLevel;
+    if (output.instance.level !== level)
+      output.instance.level = level;
+    return output.instance;
+  };
+  return wrapPino(resolvePino, () => ({ ...globalContext, ...localOptions.context }));
+}
+function createPinoOutput(options) {
   const level = options.level ?? globalLevel;
   const format = options.format ?? globalFormat;
-  const context = { ...globalContext, ...options.context };
   const pinoOptions = {
     level,
     name: options.name,
@@ -506,22 +895,44 @@ function createLogger(options = {}) {
     };
   }
   let pinoInstance;
-  if (format === "pretty") {
-    pinoInstance = pino({
-      ...pinoOptions,
-      transport: {
+  let transport;
+  if (format === "pretty" && isPrettyTransportAvailable()) {
+    try {
+      transport = pino.transport({
         target: "pino-pretty",
         options: {
           colorize: true,
           translateTime: "SYS:standard",
           ignore: "pid,hostname"
         }
+      });
+      pinoInstance = pino(pinoOptions, transport);
+      if ("unref" in transport && typeof transport.unref === "function")
+        transport.unref();
+    } catch (error) {
+      if (isPrettyTransportUnavailable(error)) {
+        pinoInstance = pino(pinoOptions);
+      } else {
+        throw error;
       }
-    });
+    }
   } else {
     pinoInstance = pino(pinoOptions);
   }
-  return wrapPino(pinoInstance, context);
+  return { instance: pinoInstance, close: () => transport?.end() };
+}
+function isPrettyTransportAvailable() {
+  try {
+    nodeRequire.resolve("pino-pretty");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isPrettyTransportUnavailable(error) {
+  const message = error instanceof Error ? error.message : typeof error === "string" ? error : "";
+  const normalized = message.toLowerCase();
+  return normalized.includes("pino-pretty") && (normalized.includes("cannot find module") || normalized.includes("unable to determine transport target") || normalized.includes("cannot load") || normalized.includes("not found"));
 }
 function getLogger() {
   if (!defaultLogger) {
@@ -538,6 +949,9 @@ var logger = {
 };
 
 // src/core-main.node.ts
+installRequestLocales(new AsyncLocalStorage());
+installRequestContext(new AsyncLocalStorage());
+var YAML_EXTENSION_REGEX = /\.ya?ml$/;
 function createNodeCore() {
   const baseCore = createCore({
     createLogger: logger.createLogger,
@@ -548,6 +962,28 @@ function createNodeCore() {
   });
   return {
     ...baseCore,
+    /** Node 专属的可信地址、策略文件读取与已编译访问检查。 */
+    access,
+    string: {
+      ...baseCore.string,
+      /**
+       * Node 凭证比较使用原生恒时原语；不同长度直接失败，长度本身不受保护。
+       * UTF-16LE 保留孤立代理项，避免 UTF-8 替换字符把两个不同字符串误判为相等。
+       * @param a - 第一个原始字符串，不做 Unicode 归一化。
+       * @param b - 第二个原始字符串，不做 Unicode 归一化。
+       * @returns 字符串的 UTF-16 单元是否完全一致。
+       * @example
+       * ```ts
+       * import { core } from '@h-ai/core'
+       * const matches = core.string.constantTimeEqual('example-only', 'example-only')
+       * ```
+       */
+      constantTimeEqual(a, b) {
+        return a.length === b.length && timingSafeEqual(Buffer.from(a, "utf16le"), Buffer.from(b, "utf16le"));
+      }
+    },
+    /** Zod 校验错误 → i18n 消息映射工具（kit / serv / api-client 共享）。 */
+    zodValidation: baseCore.zodValidation,
     /** 配置管理 */
     config,
     /** 初始化 Core */
@@ -567,7 +1003,7 @@ function scanConfigDir(configDir) {
   );
   for (const file of files) {
     const filePath = join(configDir, file);
-    const baseName = file.replace(/\.ya?ml$/, "");
+    const baseName = file.replace(YAML_EXTENSION_REGEX, "");
     if (baseName.startsWith("_")) {
       const moduleName = baseName.slice(1);
       items.push({
@@ -589,11 +1025,11 @@ function initCore(options = {}) {
   if (options.logging) {
     core.logger.configure(options.logging);
   }
-  logger2.info("[core] Initializing...");
   let configItems = [];
   if (options.configDir) {
     configItems = scanConfigDir(options.configDir);
   }
+  configItems.sort((left, right) => Number(right.name === "core") - Number(left.name === "core"));
   for (const item of configItems) {
     if (item.name === "core") {
       const result = config.load(item.name, item.filePath, CoreConfigSchema);