@zhin.js/scaffold-wizard 1.1.1 → 1.1.3

package/src/database.ts

@@ -1,5 +1,31 @@
 import inquirer from 'inquirer';
 import { DatabaseConfig } from './types.js';
+import {
+  DATABASE_DIALECT_DEFINITIONS,
+  databaseChoiceLabel,
+  getDatabaseDialectDefinition,
+  validateDatabaseConfig,
+  type DatabaseDialect,
+} from './database-definitions.js';
+
+function schemaDefault(dialect: DatabaseDialect, ...path: string[]): unknown {
+  let schema = getDatabaseDialectDefinition(dialect)?.schema as Record<string, unknown> | undefined;
+  for (const segment of path) {
+    const properties = schema?.properties as Record<string, Record<string, unknown>> | undefined;
+    schema = properties?.[segment];
+  }
+  return schema?.default;
+}
+
+function parseIntegerInput(input: unknown, minimum: number, maximum = Number.MAX_SAFE_INTEGER): number | string {
+  const raw = String(input).trim();
+  if (!/^\d+$/u.test(raw)) return `请输入有效的整数 (${minimum}-${maximum})`;
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+    return `请输入有效的整数 (${minimum}-${maximum})`;
+  }
+  return value;
+}
 
 // 配置数据库选项
 export async function configureDatabaseOptions(): Promise<DatabaseConfig> {
@@ -8,31 +34,42 @@ export async function configureDatabaseOptions(): Promise<DatabaseConfig> {
       type: 'select',
       name: 'dialect',
       message: '选择数据库类型:',
-      choices: [
-        { name: 'SQLite (推荐, 零配置)', value: 'sqlite' },
-        { name: 'MySQL', value: 'mysql' },
-        { name: 'PostgreSQL', value: 'pg' },
-        { name: 'MongoDB', value: 'mongodb' },
-        { name: 'Redis', value: 'redis' }
-      ],
+      choices: DATABASE_DIALECT_DEFINITIONS.map((definition) => ({
+        name: databaseChoiceLabel(definition),
+        value: definition.dialect,
+      })),
       default: 'sqlite'
     }
   ]);
 
+  let config: DatabaseConfig;
   switch (dialect) {
     case 'sqlite':
-      return await configureSQLite();
+      config = await configureSQLite();
+      break;
     case 'mysql':
-      return await configureMySQL();
+      config = await configureMySQL();
+      break;
     case 'pg':
-      return await configurePostgreSQL();
+      config = await configurePostgreSQL();
+      break;
     case 'mongodb':
-      return await configureMongoDB();
+      config = await configureMongoDB();
+      break;
     case 'redis':
-      return await configureRedis();
+      config = await configureRedis();
+      break;
+    case 'memory':
+      config = { dialect: 'memory' };
+      break;
     default:
       throw new Error(`未支持的数据库类型: ${dialect}`);
   }
+  const issues = validateDatabaseConfig(config);
+  if (issues.length > 0) {
+    throw new TypeError(`数据库配置不符合 Schema：${issues.map((issue) => issue.message).join('；')}`);
+  }
+  return config;
 }
 
 // SQLite 配置
@@ -42,7 +79,7 @@ async function configureSQLite(): Promise<DatabaseConfig> {
       type: 'input',
       name: 'filename',
       message: 'SQLite 数据库文件路径:',
-      default: './data/bot.db',
+      default: schemaDefault('sqlite', 'filename'),
       validate: (input: string) => {
         if (!input.trim()) return '文件路径不能为空';
         return true;
@@ -57,7 +94,7 @@ async function configureSQLite(): Promise<DatabaseConfig> {
         { name: 'DELETE (默认)', value: 'delete' },
         { name: 'MEMORY (内存数据库)', value: 'memory' }
       ],
-      default: 'wal'
+      default: schemaDefault('sqlite', 'mode')
     }
   ]);
 
@@ -75,26 +112,23 @@ async function configureMySQL(): Promise<DatabaseConfig> {
       type: 'input',
       name: 'host',
       message: 'MySQL 主机地址:',
-      default: 'localhost'
+      default: schemaDefault('mysql', 'host')
     },
     {
       type: 'input',
       name: 'port',
       message: 'MySQL 端口:',
-      default: '3306',
+      default: String(schemaDefault('mysql', 'port')),
       validate: (input: string) => {
-        const port = parseInt(input);
-        if (isNaN(port) || port < 1 || port > 65535) {
-          return '请输入有效的端口号 (1-65535)';
-        }
-        return true;
+        const value = parseIntegerInput(input, 1, 65535);
+        return typeof value === 'number' ? true : value;
       }
     },
     {
       type: 'input',
       name: 'user',
       message: 'MySQL 用户名:',
-      default: 'root'
+      default: schemaDefault('mysql', 'user')
     },
     {
       type: 'password',
@@ -105,7 +139,7 @@ async function configureMySQL(): Promise<DatabaseConfig> {
       type: 'input',
       name: 'database',
       message: 'MySQL 数据库名:',
-      default: 'zhin_bot',
+      default: schemaDefault('mysql', 'database'),
       validate: (input: string) => {
         if (!input.trim()) return '数据库名不能为空';
         return true;
@@ -116,7 +150,7 @@ async function configureMySQL(): Promise<DatabaseConfig> {
   return {
     dialect: 'mysql',
     host: config.host,
-    port: parseInt(config.port),
+    port: Number(config.port),
     user: config.user,
     password: config.password,
     database: config.database
@@ -130,26 +164,23 @@ async function configurePostgreSQL(): Promise<DatabaseConfig> {
       type: 'input',
       name: 'host',
       message: 'PostgreSQL 主机地址:',
-      default: 'localhost'
+      default: schemaDefault('pg', 'host')
     },
     {
       type: 'input',
       name: 'port',
       message: 'PostgreSQL 端口:',
-      default: '5432',
+      default: String(schemaDefault('pg', 'port')),
       validate: (input: string) => {
-        const port = parseInt(input);
-        if (isNaN(port) || port < 1 || port > 65535) {
-          return '请输入有效的端口号 (1-65535)';
-        }
-        return true;
+        const value = parseIntegerInput(input, 1, 65535);
+        return typeof value === 'number' ? true : value;
       }
     },
     {
       type: 'input',
       name: 'user',
       message: 'PostgreSQL 用户名:',
-      default: 'postgres'
+      default: schemaDefault('pg', 'user')
     },
     {
       type: 'password',
@@ -160,7 +191,7 @@ async function configurePostgreSQL(): Promise<DatabaseConfig> {
       type: 'input',
       name: 'database',
       message: 'PostgreSQL 数据库名:',
-      default: 'zhin_bot',
+      default: schemaDefault('pg', 'database'),
       validate: (input: string) => {
         if (!input.trim()) return '数据库名不能为空';
         return true;
@@ -171,7 +202,7 @@ async function configurePostgreSQL(): Promise<DatabaseConfig> {
   return {
     dialect: 'pg',
     host: config.host,
-    port: parseInt(config.port),
+    port: Number(config.port),
     user: config.user,
     password: config.password,
     database: config.database
@@ -185,7 +216,7 @@ async function configureMongoDB(): Promise<DatabaseConfig> {
       type: 'input',
       name: 'url',
       message: 'MongoDB 连接字符串:',
-      default: 'mongodb://localhost:27017',
+      default: schemaDefault('mongodb', 'url'),
       validate: (input: string) => {
         if (!input.trim()) return '连接字符串不能为空';
         if (!input.startsWith('mongodb://') && !input.startsWith('mongodb+srv://')) {
@@ -198,7 +229,7 @@ async function configureMongoDB(): Promise<DatabaseConfig> {
       type: 'input',
       name: 'dbName',
       message: 'MongoDB 数据库名:',
-      default: 'zhin_bot',
+      default: schemaDefault('mongodb', 'dbName'),
       validate: (input: string) => {
         if (!input.trim()) return '数据库名不能为空';
         return true;
@@ -220,19 +251,16 @@ async function configureRedis(): Promise<DatabaseConfig> {
       type: 'input',
       name: 'host',
       message: 'Redis 主机地址:',
-      default: 'localhost'
+      default: schemaDefault('redis', 'socket', 'host')
     },
     {
       type: 'input',
       name: 'port',
       message: 'Redis 端口:',
-      default: '6379',
+      default: String(schemaDefault('redis', 'socket', 'port')),
       validate: (input: string) => {
-        const port = parseInt(input);
-        if (isNaN(port) || port < 1 || port > 65535) {
-          return '请输入有效的端口号 (1-65535)';
-        }
-        return true;
+        const value = parseIntegerInput(input, 1, 65535);
+        return typeof value === 'number' ? true : value;
       }
     },
     {
@@ -244,13 +272,10 @@ async function configureRedis(): Promise<DatabaseConfig> {
       type: 'input',
       name: 'db',
       message: 'Redis 数据库索引:',
-      default: '0',
+      default: String(schemaDefault('redis', 'database')),
       validate: (input: string) => {
-        const db = parseInt(input);
-        if (isNaN(db) || db < 0) {
-          return '请输入有效的数据库索引 (>= 0)';
-        }
-        return true;
+        const value = parseIntegerInput(input, 0);
+        return typeof value === 'number' ? true : '请输入有效的数据库索引 (>= 0)';
       }
     }
   ]);
@@ -259,9 +284,9 @@ async function configureRedis(): Promise<DatabaseConfig> {
     dialect: 'redis',
     socket: {
       host: config.host,
-      port: parseInt(config.port)
+      port: Number(config.port)
     },
     password: config.password || undefined,
-    database: parseInt(config.db)
+    database: Number(config.db)
   };
-}
+}

package/src/decisions.ts

@@ -0,0 +1,132 @@
+import inquirer from 'inquirer';
+import chalk from 'chalk';
+import fs from 'fs-extra';
+import path from 'node:path';
+import { formatEnvValue, mergeEnvText } from './env.js';
+import { clonePluginConfigurationMap, mergeDependenciesIntoPackageJson, mergePluginManifestIntoPackageJson } from './apply.js';
+import { isAiEnabledInConfig } from './project-deps.js';
+
+export const TYPESAFE_DECISION_PACKAGE = '@zhin.js/service-typesafe';
+export interface TypeSafeSetupConfig {
+  readonly instanceKey: string;
+  readonly apiKey: string;
+  readonly model: string;
+  readonly mode: 'shadow' | 'active';
+  readonly envVar?: string;
+}
+function hasChatAgent(config: Readonly<Record<string, unknown>>): boolean {
+  if (!isAiEnabledInConfig(config)) return false;
+  const binding = record(record(record(config.ai).agents).zhin);
+  return typeof binding.provider === 'string' && !!binding.provider.trim()
+    && typeof binding.model === 'string' && !!binding.model.trim();
+}
+function record(value: unknown): Record<string, unknown> {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {};
+}
+
+/** An explicitly requested optional integration. Existing AI configuration is preserved. */
+export async function configureTypeSafeDecisions(config: Readonly<Record<string, unknown>>): Promise<TypeSafeSetupConfig> {
+  if (!hasChatAgent(config)) throw new Error('先运行 zhin setup --ai 配置聊天模型，再运行 zhin setup --decisions。Jev 决策模型不能替代聊天模型。');
+  console.log(chalk.blue('\nTypeSafe Jev：选择 Agent / Skill / Tool 的可选决策服务。'));
+  console.log(chalk.gray('shadow 仅记录建议，不改变已有行为；active 启用推荐。审核默认关闭。调用会向外部服务发送经过权限过滤的请求与候选描述。'));
+  const answers = await inquirer.prompt([
+    { type: 'input', name: 'instanceKey', message: '决策插件实例名', default: 'typesafe', validate: (value: string) => /^[a-z][a-z0-9-]*$/.test(value) || '使用小写字母、数字和连字符，字母开头' },
+    { type: 'password', name: 'apiKey', message: 'TypeSafe API Key（仅写入 .env）', mask: '*', validate: (value: string) => value.trim().length > 0 || '请输入 API Key' },
+    { type: 'input', name: 'model', message: 'Jev 模型（生产校准后建议固定版本）', default: 'jev-latest', validate: (value: string) => value.trim().length > 0 || '请输入模型名称' },
+    { type: 'select', name: 'mode', message: 'Skill / Tool 推荐运行方式', default: 'shadow', choices: [ { name: 'shadow：观察建议，评估后再启用', value: 'shadow' }, { name: 'active：启用推荐，权限仍由 Zhin 校验', value: 'active' } ] },
+  ]);
+  const reference = record(record(config.plugins)[answers.instanceKey]).apiKey;
+  const existingVariable = typeof reference === 'string' ? /^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/.exec(reference)?.[1] : undefined;
+  return { ...answers, envVar: existingVariable ?? decisionKeyVariable(answers.instanceKey) };
+}
+
+function decisionKeyVariable(instanceKey: string): string {
+  return instanceKey === 'typesafe' ? 'TYPESAFE_API_KEY' : `TYPESAFE_${instanceKey.toUpperCase().replace(/-/g, '_')}_API_KEY`;
+}
+function envVariable(setup: TypeSafeSetupConfig): string {
+  const name = setup.envVar ?? decisionKeyVariable(setup.instanceKey);
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new Error('Invalid TypeSafe environment variable name.');
+  return name;
+}
+
+/** Plan data separately from writes so secrets cannot enter the configuration document. */
+export function applyTypeSafeDecisionsToConfig(config: Record<string, unknown>, setup: TypeSafeSetupConfig): void {
+  if (!hasChatAgent(config)) throw new Error('TypeSafe decisions require existing AI configuration; run zhin setup --ai first.');
+  if (!/^[a-z][a-z0-9-]*$/.test(setup.instanceKey) || !setup.model.trim() || !setup.apiKey.trim()) throw new Error('Invalid TypeSafe setup configuration.');
+  const plugins = clonePluginConfigurationMap(config);
+  const existing = record(plugins[setup.instanceKey]);
+  plugins[setup.instanceKey] = { ...existing, apiKey: '${' + envVariable(setup) + '}', model: setup.model.trim(), timeoutMs: 10000, maxRetries: 2, enabled: true };
+  config.plugins = plugins;
+  const ai = record(config.ai);
+  const previousDecisions = record(ai.decisions);
+  config.ai = { ...ai, decisions: {
+    ...previousDecisions,
+    provider: `root/${setup.instanceKey}`,
+    skills: { ...record(previousDecisions.skills), mode: setup.mode },
+    tools: { ...record(previousDecisions.tools), mode: setup.mode },
+    agents: previousDecisions.agents ?? { mode: 'off' },
+    memory: previousDecisions.memory ?? { mode: 'off' },
+    approval: previousDecisions.approval ?? { mode: 'off' },
+  } };
+}
+
+export async function saveTypeSafeSetupDependencies(projectDir: string, setup: TypeSafeSetupConfig): Promise<void> {
+  const variable = envVariable(setup);
+  const pkgPath = path.join(projectDir, 'package.json');
+  const pkg = await fs.readJson(pkgPath);
+  const existingManifest = record(pkg.zhin).plugins;
+  if (Array.isArray(existingManifest) && existingManifest.some(entry => record(entry).instanceKey === setup.instanceKey && record(entry).package !== TYPESAFE_DECISION_PACKAGE)) {
+    throw new Error('Decision plugin instance already belongs to another package; choose a different instanceKey.');
+  }
+  await mergePluginManifestIntoPackageJson(projectDir, [{ package: TYPESAFE_DECISION_PACKAGE, instanceKey: setup.instanceKey }]);
+  await mergeDependenciesIntoPackageJson(projectDir, { [TYPESAFE_DECISION_PACKAGE]: '^1.0.0' });
+  const envPath = path.join(projectDir, '.env');
+  const envExists = await fs.pathExists(envPath);
+  const previous = envExists ? await fs.readFile(envPath, 'utf8') : '';
+  // writeFile's mode applies only when creating a file. Restrict existing files
+  // before adding credentials; Windows access control is not POSIX file modes.
+  if (envExists && process.platform !== 'win32') await fs.chmod(envPath, 0o600);
+  await fs.writeFile(envPath, mergeEnvText(previous, `${variable}=${formatEnvValue(setup.apiKey)}\n`), { mode: 0o600 });
+}
+
+/** Local checks only; never sends a paid API request or returns credential values. */
+export function diagnoseDecisionConfig(config: Readonly<Record<string, unknown>>, packageJson: unknown): string[] {
+  const ai = record(config.ai);
+  if (!Object.hasOwn(ai, 'decisions')) return [];
+  const decisions = record(ai.decisions);
+  const issues: string[] = [];
+  const taskNames = ['skills', 'tools', 'memory', 'agents', 'approval'];
+  if (Object.keys(decisions).some(key => !['provider', ...taskNames].includes(key))) issues.push('ai.decisions 含有未知配置字段。');
+  const provider = decisions.provider;
+  if (typeof provider !== 'string' || !/^root(?:\/[a-z0-9][a-z0-9-]*)+$/.test(provider)) return [...issues, 'ai.decisions.provider 必须是精确插件 owner，例如 root/typesafe。'];
+  for (const name of taskNames) {
+    if (!Object.hasOwn(decisions, name)) continue;
+    const task = record(decisions[name]);
+    if (Object.keys(task).some(key => !['mode', 'timeoutMs', 'minConfidence', 'topK', 'maxCandidates', 'maxSelections'].includes(key))) issues.push(`ai.decisions.${name} 含有未知配置字段。`);
+    if (typeof task.mode !== 'string' || !['off', 'shadow', 'active'].includes(task.mode)) issues.push(`ai.decisions.${name}.mode 必须是 off、shadow 或 active。`);
+    for (const field of ['timeoutMs', 'topK', 'maxCandidates', 'maxSelections']) {
+      if (task[field] !== undefined && (!Number.isSafeInteger(task[field]) || Number(task[field]) <= 0 || field === 'timeoutMs' && Number(task[field]) > 2147483647)) issues.push(`ai.decisions.${name}.${field} 必须是正整数。`);
+    }
+    if (task.minConfidence !== undefined && (typeof task.minConfidence !== 'number' || !Number.isFinite(task.minConfidence) || task.minConfidence < 0 || task.minConfidence > 1)) issues.push(`ai.decisions.${name}.minConfidence 必须在 0 到 1 之间。`);
+  }
+  if (!hasChatAgent(config)) issues.push('决策服务需要已启用的 AI Agent；运行 zhin setup --ai。');
+  const enabled = taskNames.some(name => ['shadow', 'active'].includes(String(record(decisions[name]).mode)));
+  if (!enabled) return issues;
+  const key = provider.slice('root/'.length);
+  // Nested Plugin owners are resolved from the actual runtime graph during activation.
+  if (key.includes('/')) return issues;
+  const pkg = record(packageJson);
+  const manifest = record(pkg.zhin).plugins;
+  const entries = Array.isArray(manifest) ? manifest.filter(entry => record(entry).instanceKey === key) : [];
+  if (entries.length !== 1) {
+    issues.push('决策插件实例未在 package.json#zhin.plugins 唯一声明。');
+    return issues;
+  }
+  if (record(entries[0]).package === TYPESAFE_DECISION_PACKAGE) {
+    const configForProvider = record(record(config.plugins)[key]);
+    if (configForProvider.enabled === false) issues.push('绑定的 TypeSafe 插件已禁用。');
+    if (typeof configForProvider.apiKey !== 'string' || !configForProvider.apiKey.trim()) issues.push('TypeSafe 插件缺少 apiKey 环境变量引用。');
+    if (!Object.hasOwn({ ...record(pkg.dependencies), ...record(pkg.devDependencies) }, TYPESAFE_DECISION_PACKAGE)) issues.push('package.json 缺少 @zhin.js/service-typesafe 依赖。');
+  }
+  return issues;
+}

package/src/env.ts

@@ -104,6 +104,7 @@ export function generateDatabaseEnvVars(config: DatabaseConfig): string {
       );
       break;
     case 'sqlite':
+    case 'memory':
     default:
       // SQLite 不需要额外的环境变量
       break;
@@ -111,3 +112,54 @@ export function generateDatabaseEnvVars(config: DatabaseConfig): string {
 
   return envVars.length > 0 ? `\n\n${envVars.join('\n')}` : '';
 }
+
+/**
+ * Generate a version-control-safe database section for `.env.example`.
+ * User-entered passwords and credential-bearing connection URLs are never
+ * copied from the interactive wizard.
+ */
+export function generateDatabaseEnvExample(config: DatabaseConfig): string {
+  let lines: string[] = [];
+  switch (config.dialect) {
+    case 'mysql':
+      lines = [
+        '# MySQL 数据库配置',
+        'DB_HOST=127.0.0.1',
+        'DB_PORT=3306',
+        'DB_USER=root',
+        'DB_PASSWORD=change-me',
+        'DB_DATABASE=zhin_bot',
+      ];
+      break;
+    case 'pg':
+      lines = [
+        '# PostgreSQL 数据库配置',
+        'DB_HOST=127.0.0.1',
+        'DB_PORT=5432',
+        'DB_USER=postgres',
+        'DB_PASSWORD=change-me',
+        'DB_DATABASE=zhin_bot',
+      ];
+      break;
+    case 'mongodb':
+      lines = [
+        '# MongoDB 数据库配置',
+        'DB_URL=mongodb://127.0.0.1:27017',
+        'DB_NAME=zhin_bot',
+      ];
+      break;
+    case 'redis':
+      lines = [
+        '# Redis 数据库配置',
+        'REDIS_HOST=127.0.0.1',
+        'REDIS_PORT=6379',
+        'REDIS_PASSWORD=',
+        'REDIS_DB=0',
+      ];
+      break;
+    case 'sqlite':
+    case 'memory':
+      return '';
+  }
+  return `\n\n${lines.join('\n')}`;
+}

package/src/index.ts

@@ -1,5 +1,17 @@
 export type { InitOptions, DatabaseConfig } from './types.js';
-export { DATABASE_PACKAGES } from './types.js';
+export { DATABASE_DRIVER_VERSIONS, DATABASE_PACKAGES } from './types.js';
+export {
+  DATABASE_DIALECT_DEFINITIONS,
+  databaseChoiceLabel,
+  getDatabaseDialectDefinition,
+  validateDatabaseConfig,
+} from './database-definitions.js';
+export type {
+  DatabaseDialect,
+  DatabaseDialectDefinition,
+  DatabaseDriverDefinition,
+  DatabaseSchemaIssue,
+} from './database-definitions.js';
 
 export type { AdapterSetupResult, AdapterPluginInstance, AdapterDefinition } from './adapter.js';
 export {
@@ -35,6 +47,7 @@ export { configureDatabaseOptions } from './database.js';
 export {
   formatEnvValue,
   mergeEnvText,
+  generateDatabaseEnvExample,
   generateDatabaseEnvVars,
 } from './env.js';
 
@@ -60,9 +73,9 @@ export type { AiStackIncompatibility } from './project-deps.js';
 export {
   ZHIN_STACK_VERSIONS,
   DEFAULT_CREATE_BOT_HTTP_PORT,
-  CREATE_BOT_NPMRC,
+  CREATE_BOT_PACKAGE_MANAGER,
   getCreateBotBaseDependencies,
-  getCreateBotPnpmConfig,
+  getCreateBotPnpmWorkspaceConfig,
   getRequiredZhinDependenciesForConfig,
   diagnoseZhinStackDependencies,
   formatZhinStackFixCommand,
@@ -123,3 +136,9 @@ export {
   buildRuntimeConfigDocument,
   serializeRuntimeConfig,
 } from './apply.js';
+
+export {
+  TYPESAFE_DECISION_PACKAGE, configureTypeSafeDecisions, applyTypeSafeDecisionsToConfig,
+  saveTypeSafeSetupDependencies, diagnoseDecisionConfig,
+} from './decisions.js';
+export type { TypeSafeSetupConfig } from './decisions.js';

package/src/stack-versions.generated.json

@@ -7,7 +7,6 @@
     "@zhin.js/database": "^1.0.77",
     "@zhin.js/client": "^2.1.0",
     "@zhin.js/contract": "^1.0.5",
-    "@zhin.js/satori": "^1.0.16",
     "@zhin.js/speech": "^2.0.0",
     "@zhin.js/html-renderer": "^2.0.0",
     "@zhin.js/mcp": "^5.0.0",

package/src/types.ts

@@ -1,5 +1,6 @@
 import type { AISetupConfig } from './ai.js';
 import type { AdapterSetupResult } from './adapter.js';
+import { DATABASE_DIALECT_DEFINITIONS } from './database-definitions.js';
 
 export type { AISetupConfig } from './ai.js';
 export type { AdapterSetupResult } from './adapter.js';
@@ -19,15 +20,17 @@ export interface InitOptions {
 }
 
 export interface DatabaseConfig {
-  dialect: 'sqlite' | 'mysql' | 'pg' | 'mongodb' | 'redis';
+  dialect: 'sqlite' | 'mysql' | 'pg' | 'mongodb' | 'redis' | 'memory';
   [key: string]: any;
 }
 
-// 数据库配置映射（SQLite 使用 Node 内置 node:sqlite，无需额外安装）
-export const DATABASE_PACKAGES: Record<DatabaseConfig['dialect'], string | undefined> = {
-  sqlite: undefined,
-  mysql: 'mysql2',
-  pg: 'pg',
-  mongodb: 'mongodb',
-  redis: 'redis'
-};
+// 数据库驱动映射（SQLite / Memory 使用内置实现，无需额外安装）
+export const DATABASE_PACKAGES = Object.freeze(Object.fromEntries(
+  DATABASE_DIALECT_DEFINITIONS.map((definition) => [definition.dialect, definition.driver?.package]),
+)) as Readonly<Record<DatabaseConfig['dialect'], string | undefined>>;
+
+export const DATABASE_DRIVER_VERSIONS = Object.freeze(Object.fromEntries(
+  DATABASE_DIALECT_DEFINITIONS.flatMap((definition) => definition.driver
+    ? [[definition.driver.package, definition.driver.version] as const]
+    : []),
+)) as Readonly<Record<string, string>>;

package/src/zhin-stack-deps.ts

@@ -1,12 +1,13 @@
 import { createRequire } from 'node:module';
 import fs from 'fs-extra';
 import path from 'node:path';
-import { DATABASE_PACKAGES } from './types.js';
+import { DATABASE_DRIVER_VERSIONS, DATABASE_PACKAGES } from './types.js';
 import { findMissingPackageDependencies, findUnresolvedPackageInstalls, isAiEnabledInConfig, type PackageJsonLike } from './project-deps.js';
 
 /**
- * User project dependency policy: scaffolded dependencies intentionally float to latest.
- * WARNING: this is not reproducible; pin versions for production. See scaffold-wizard README.
+ * User project dependency policy: scaffolded Zhin packages intentionally float to latest.
+ * Database drivers use the live-tested ranges declared by the database definitions.
+ * WARNING: `latest` is not reproducible; pin Zhin package versions for production.
  */
 export const ZHIN_STACK_VERSIONS = {
   'zhin.js': 'latest',
@@ -27,7 +28,7 @@ export const ZHIN_STACK_VERSIONS = {
   '@zhin.js/tool': 'latest',
   '@zhin.js/client': 'latest',
   '@zhin.js/contract': 'latest',
-  '@zhin.js/satori': 'latest',
+  '@zhin.js/components': 'latest',
   '@zhin.js/speech': 'latest',
   '@zhin.js/html-renderer': 'latest',
   '@zhin.js/mcp': 'latest',
@@ -114,13 +115,17 @@ function resolveStackVersion(packageName: string): string {
 /** create-zhin / minimal-bot 默认 Host 端口（避免与常见 8086 占用冲突） */
 export const DEFAULT_CREATE_BOT_HTTP_PORT = 8068;
 
-/** create-zhin 生成项目的 .npmrc（避免全局 strict-peer-dependencies 阻断 AI 栈安装） */
-export const CREATE_BOT_NPMRC = 'strict-peer-dependencies=false\n';
+/** create-zhin 生成项目固定使用的 pnpm 版本。 */
+export const CREATE_BOT_PACKAGE_MANAGER = 'pnpm@11.27.1';
 
-/** create-zhin 生成项目的 pnpm 配置 */
-export function getCreateBotPnpmConfig(_aiEnabled?: boolean): Record<string, unknown> {
+/** create-zhin 生成项目的 pnpm-workspace.yaml 配置。 */
+export function getCreateBotPnpmWorkspaceConfig(): Record<string, unknown> {
   return {
-    onlyBuiltDependencies: ['esbuild'],
+    packages: ['.', 'plugins/*', 'packages/*'],
+    strictPeerDependencies: false,
+    allowBuilds: {
+      esbuild: true,
+    },
   };
 }
 
@@ -147,7 +152,7 @@ export function getRequiredZhinDependenciesForConfig(config: Record<string, unkn
     const dialect = String((database as Record<string, unknown>).dialect ?? '');
     const driver = DATABASE_PACKAGES[dialect as keyof typeof DATABASE_PACKAGES];
     if (driver) {
-      deps[driver] = 'latest';
+      deps[driver] = DATABASE_DRIVER_VERSIONS[driver];
     }
   }