create-hazejs 0.0.0-stage → 0.1.2

package/templates/react/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "{{name}}",
+  "type": "module",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "dev": "haze dev",
+    "build": "haze build",
+    "start": "haze start",
+    "preview": "haze preview",
+    "queue": "haze queue:work",
+    "schedule": "haze schedule:work",
+    "test": "haze test",
+    "routes": "haze route:list",
+    "typecheck": "tsc --build",
+    "typegen": "haze typegen",
+    "db:generate": "haze db:generate",
+    "db:migrate": "haze db:migrate",
+    "db:seed": "haze db:seed"
+  },
+  "dependencies": {
+    "@hazejs/core": "{{version}}",
+    "@hazejs/orm": "{{version}}",
+    "@hazejs/socket.io": "{{version}}",
+    "@libsql/client": "^0.18.0",
+    "drizzle-orm": "^0.45.4",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
+    "socket.io": "^4.8.0",
+    "socket.io-client": "^4.8.0",
+    "valibot": "^1.1.0"
+  },
+  "devDependencies": {
+    "@hazejs/cli": "{{version}}",
+    "@hazejs/testing": "{{version}}",
+    "@hazejs/vite": "{{version}}",
+    "@types/node": "^24.0.0",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@vitejs/plugin-react": "^6.1.0",
+    "drizzle-kit": "^0.31.11",
+    "typescript": "~6.0.3",
+    "vite": "^8.3.5",
+    "vitest": "^5.0.5"
+  }
+}

package/templates/react/server/app/controller/AuthController.ts

@@ -0,0 +1,45 @@
+import type { HttpContext } from '@hazejs/core'
+import { Hash, Storage, UnauthorizedException, validate } from '@hazejs/core'
+import UserRegistered from '~/app/event/UserRegistered'
+import { User } from '~/app/model/User'
+import { AvatarSchema, LoginSchema, RegisterSchema } from '~/app/validate/auth'
+
+/**
+ * JWT 登录示例（config/auth.ts 的 api Guard）：
+ * 客户端保存 login / register 返回的 token，之后请求带上 `Authorization: Bearer <token>`
+ */
+export class AuthController {
+  async register(ctx: HttpContext) {
+    const { password, ...input } = await validate(RegisterSchema, await ctx.body())
+    const user = await User.create({ ...input, password: await Hash.make(password) })
+    // 事件：监听器投递欢迎邮件任务、推送实时消息（app/listener）
+    await UserRegistered.emit({ userId: user.id, email: user.email })
+    return ctx.created({
+      user,
+      ...await ctx.auth.jwt().login(user),
+    })
+  }
+
+  async login(ctx: HttpContext) {
+    const issued = await ctx.auth.jwt().attempt(await validate(LoginSchema, await ctx.body()))
+    if (!issued)
+      throw new UnauthorizedException('邮箱或密码错误')
+    return issued
+  }
+
+  /** 需要 auth 中间件：未登录时返回 401 */
+  me(ctx: HttpContext) {
+    return ctx.auth.user()
+  }
+
+  /** 上传头像（multipart 字段 avatar）：保存到 public 磁盘，经 /storage/<path> 访问 */
+  async avatar(ctx: HttpContext) {
+    const { avatar } = await validate(AvatarSchema, await ctx.body())
+    const path = await (await ctx.file('avatar'))!.store('avatars', 'public')
+    return ctx.created({
+      path,
+      url: Storage.disk('public').url(path),
+      size: avatar.size,
+    })
+  }
+}

package/templates/react/server/app/controller/GreetingController.ts

@@ -0,0 +1,23 @@
+import type { HttpContext } from '@hazejs/core'
+import type { GreetSchema } from '~/app/validate/greeting'
+import { Config, inject } from '@hazejs/core'
+import { GreetingService } from '~/app/service/GreetingService'
+
+/** 控制层：接收参数 → 调用服务 → 返回数据（框架统一包装为 { code, message, data }） */
+export class GreetingController {
+  private greeting = inject(GreetingService)
+  private config = inject(Config)
+
+  index() {
+    return {
+      app: this.config.get('app.name'),
+      message: this.greeting.greet('hazejs'),
+    }
+  }
+
+  store(ctx: HttpContext<{ body: typeof GreetSchema }>) {
+    return {
+      message: this.greeting.greet(ctx.validated.body.name),
+    }
+  }
+}

package/templates/react/server/app/controller/UserController.ts

@@ -0,0 +1,38 @@
+import type { HttpContext } from '@hazejs/core'
+import type { UserIdParams } from '~/app/validate/user'
+import { validate } from '@hazejs/core'
+import { User } from '~/app/model/User'
+import { CreateUserSchema, UpdateUserSchema } from '~/app/validate/user'
+
+type WithId = HttpContext<{ params: typeof UserIdParams }>
+
+/** RESTful 资源控制器：路由见 route/api.ts 中的 r.resource('/users', UserController) */
+export class UserController {
+  index(ctx: HttpContext) {
+    return User.order('id', 'desc').paginate(Number(ctx.query('page') ?? 1), 20)
+  }
+
+  show(ctx: WithId) {
+    return User.findOrFail(ctx.validated.params.id)
+  }
+
+  async store(ctx: HttpContext) {
+    const input = await validate(CreateUserSchema, await ctx.body())
+    return ctx.created(await User.create(input))
+  }
+
+  async update(ctx: WithId) {
+    const user = await User.findOrFail(ctx.validated.params.id)
+    // 授权：app/policy/UserPolicy.ts
+    await ctx.authorize('update', user)
+    user.fill(await validate(UpdateUserSchema, await ctx.body()))
+    return user.save()
+  }
+
+  async destroy(ctx: WithId) {
+    const user = await User.findOrFail(ctx.validated.params.id)
+    await ctx.authorize('delete', user)
+    await user.delete()
+    return ctx.noContent()
+  }
+}

package/templates/react/server/app/event/UserRegistered.ts

@@ -0,0 +1,6 @@
+import { defineEvent } from '@hazejs/core'
+
+/** 用户注册成功（AuthController.register 触发，监听器见 app/listener） */
+const UserRegistered = defineEvent<{ userId: number, email: string }>()
+
+export default UserRegistered

package/templates/react/server/app/exception/Handler.ts

@@ -0,0 +1,13 @@
+import type { HttpContext } from '@hazejs/core'
+import { ExceptionHandler } from '@hazejs/core'
+
+/**
+ * 全局异常处理：report() 负责记录 / 上报，render() 负责生成响应。
+ * 开发环境中浏览器访问出错的地址会看到带源码定位的错误页。
+ */
+export default class Handler extends ExceptionHandler {
+  override report(error: unknown, ctx: HttpContext) {
+    // ctx.logger 已携带 requestId；可在此接入 Sentry 等上报服务
+    return super.report(error, ctx)
+  }
+}

package/templates/react/server/app/job/SendWelcomeEmail.ts

@@ -0,0 +1,19 @@
+import { defineJob, Mail } from '@hazejs/core'
+import WelcomeMail from '~/app/mail/WelcomeMail'
+import { User } from '~/app/model/User'
+
+/** 注册成功后投递（app/listener/QueueWelcomeEmail.ts）：发送欢迎邮件，失败时按 backoff 重试 */
+const SendWelcomeEmail = defineJob({
+  tries: 3,
+  backoff: [10, 60],
+  timeout: '30s',
+  async handle(payload: { userId: number }, job) {
+    const user = await User.find(payload.userId)
+    if (!user)
+      return
+    await Mail.to({ address: user.email, name: user.name }).send(WelcomeMail, { name: user.name, url: 'http://localhost:5173' })
+    job.logger.info(`Welcome email sent to ${user.email}`)
+  },
+})
+
+export default SendWelcomeEmail

package/templates/react/server/app/listener/BroadcastRegistration.ts

@@ -0,0 +1,7 @@
+import { defineListener, Socket } from '@hazejs/core'
+import UserRegistered from '~/app/event/UserRegistered'
+
+/** 实时推送：订阅了 users 的 WebSocket 连接（route/ws.ts）收到新用户注册的消息 */
+export default defineListener(UserRegistered, ({ userId }) => {
+  Socket.publish('users', { type: 'user.registered', userId })
+})

package/templates/react/server/app/listener/QueueWelcomeEmail.ts

@@ -0,0 +1,6 @@
+import { defineListener } from '@hazejs/core'
+import UserRegistered from '~/app/event/UserRegistered'
+import SendWelcomeEmail from '~/app/job/SendWelcomeEmail'
+
+/** 注册后投递欢迎邮件任务（耗时操作放到队列，不阻塞注册响应） */
+export default defineListener(UserRegistered, ({ userId }) => SendWelcomeEmail.dispatch({ userId }))

package/templates/react/server/app/mail/WelcomeMail.ts

@@ -0,0 +1,17 @@
+import { button, defineMail, html, mailLayout } from '@hazejs/core'
+
+/** 欢迎邮件（app/job/SendWelcomeEmail.ts 发送）：函数返回主题与 html，纯文本版本自动生成 */
+export default defineMail((payload: { name: string, url: string }) => ({
+  subject: `欢迎加入，${payload.name}`,
+  html: mailLayout({
+    brand: '{{name}}',
+    preheader: '感谢注册，开始使用吧',
+    body: html`
+      <h1 style="margin:0 0 16px;font-size:22px">你好，${payload.name}</h1>
+      <p>感谢注册！点击下方按钮开始使用。</p>
+      ${button('开始使用', payload.url)}
+      <p style="color:#71717a">如果这不是你本人的操作，请忽略这封邮件。</p>
+    `,
+    footer: '此邮件由系统自动发送，请勿直接回复',
+  }),
+}), { name: 'WelcomeMail' })

package/templates/react/server/app/model/User.ts

@@ -0,0 +1,11 @@
+import { Model } from '@hazejs/orm'
+import { users } from '~/database/schema/users'
+
+/**
+ * 用户模型：字段与类型来自 database/schema/users.ts。
+ * 常用：User.findOrFail(id)、User.where('name', 'Ada').paginate(1, 20)、User.create(data)、user.save()
+ */
+export class User extends Model.define(users) {
+  // 序列化（接口返回）时隐藏密码哈希
+  static override hidden = ['password']
+}

package/templates/react/server/app/policy/UserPolicy.ts

@@ -0,0 +1,14 @@
+import { definePolicy, deny } from '@hazejs/core'
+import { User } from '~/app/model/User'
+
+/**
+ * 用户的授权策略（app/policy 下自动注册）：
+ * 控制器中 await ctx.authorize('update', user)；路由上也可用 .middleware('can:update,User,id')
+ * 未登录用户默认被拒绝（authorize 返回 401），已登录但无权限返回 403 与 deny() 的消息。
+ */
+export default definePolicy(User, {
+  // 管理员拥有全部权限
+  before: (actor: User | undefined) => actor?.role === 'admin' || undefined,
+  update: (actor: User, user: User) => actor.id === user.id || deny('只能修改自己的资料'),
+  delete: (actor: User, user: User) => actor.id === user.id || deny('只能删除自己的账号'),
+})

package/templates/react/server/app/provider/AppProvider.ts

@@ -0,0 +1,9 @@
+import { defineProvider } from '@hazejs/core'
+import { GreetingService } from '~/app/service/GreetingService'
+
+/** 服务提供者：register() 中注册绑定，boot() 中执行启动逻辑 */
+export default defineProvider({
+  register(container) {
+    container.singleton(GreetingService)
+  },
+})

package/templates/react/server/app/provider/DatabaseProvider.ts

@@ -0,0 +1,4 @@
+import { databaseProvider } from '@hazejs/orm'
+
+// 注册数据库：读取 config/database.ts，Db / Model 自动使用该配置
+export default databaseProvider()

package/templates/react/server/app/provider/SocketProvider.ts

@@ -0,0 +1,4 @@
+import { socketIoProvider } from '@hazejs/socket.io'
+
+// Socket.IO：app/socket 下的命名空间自动注册，与 HTTP 共用端口（/socket.io/）
+export default socketIoProvider()

package/templates/react/server/app/response/Formatter.ts

@@ -0,0 +1,17 @@
+import type { HttpContext, NormalizedError } from '@hazejs/core'
+import { ResponseFormatter } from '@hazejs/core'
+
+/**
+ * 统一响应格式：在这里修改即可全局调整成功 / 失败时出站数据的结构。
+ * 默认：成功 { code: 0, message: 'ok', data }，失败 { code, message, data: null, errors? }。
+ * 单个路由跳过格式化：.meta({ envelope: false }) 或 return raw(value)。
+ */
+export default class Formatter extends ResponseFormatter {
+  override success(data: unknown, ctx: HttpContext) {
+    return super.success(data, ctx)
+  }
+
+  override error(error: NormalizedError, ctx: HttpContext) {
+    return super.error(error, ctx)
+  }
+}

package/templates/react/server/app/service/GreetingService.ts

@@ -0,0 +1,6 @@
+/** 业务层：规则与流程，不感知 HTTP */
+export class GreetingService {
+  greet(name: string): string {
+    return `Hello, ${name}!`
+  }
+}

package/templates/react/server/app/socket/chat.ts

@@ -0,0 +1,17 @@
+import { defineNamespace } from '@hazejs/socket.io'
+
+/**
+ * Socket.IO 命名空间 /chat（前端：src/socket.ts）。
+ * 需要登录时加 middleware: [authenticate()]，客户端 io('/chat', { auth: { token } })；
+ * 在接口、任务、监听器中推送：SocketIO.of('/chat').emit('chat:message', text)
+ */
+export default defineNamespace({
+  connection(socket, _io, chat) {
+    chat.emit('online', chat.sockets.size)
+    socket.on('chat:send', (text: string, ack?: (result: string) => void) => {
+      chat.emit('chat:message', text)
+      ack?.('ok')
+    })
+    socket.on('disconnect', () => chat.emit('online', chat.sockets.size))
+  },
+})

package/templates/react/server/app/validate/auth.ts

@@ -0,0 +1,20 @@
+import * as v from 'valibot'
+
+export const RegisterSchema = v.object({
+  name: v.pipe(v.string('名称必填'), v.trim(), v.minLength(1, '名称不能为空')),
+  email: v.pipe(v.string('邮箱必填'), v.email('邮箱格式不正确')),
+  password: v.pipe(v.string('密码必填'), v.minLength(8, '密码至少 8 位')),
+})
+
+export const LoginSchema = v.object({
+  email: v.pipe(v.string('邮箱必填'), v.email('邮箱格式不正确')),
+  password: v.pipe(v.string('密码必填'), v.minLength(1, '密码必填')),
+})
+
+export const AvatarSchema = v.object({
+  avatar: v.pipe(
+    v.file('请选择图片'),
+    v.mimeType(['image/png', 'image/jpeg', 'image/webp'], '只支持 png / jpeg / webp'),
+    v.maxSize(2 * 1024 * 1024, '图片不能超过 2MB'),
+  ),
+})

package/templates/react/server/app/validate/greeting.ts

@@ -0,0 +1,5 @@
+import * as v from 'valibot'
+
+export const GreetSchema = v.object({
+  name: v.pipe(v.string('name 必填'), v.trim(), v.minLength(1, 'name 不能为空'), v.maxLength(50, 'name 最多 50 个字符')),
+})

package/templates/react/server/app/validate/user.ts

@@ -0,0 +1,12 @@
+import * as v from 'valibot'
+
+export const UserIdParams = v.object({
+  id: v.pipe(v.string(), v.transform(Number), v.integer('用户 ID 必须是整数')),
+})
+
+export const CreateUserSchema = v.object({
+  name: v.pipe(v.string('名称必填'), v.trim(), v.minLength(1, '名称不能为空')),
+  email: v.pipe(v.string('邮箱必填'), v.email('邮箱格式不正确')),
+})
+
+export const UpdateUserSchema = v.partial(CreateUserSchema)

package/templates/react/server/config/app.ts

@@ -0,0 +1,7 @@
+import { defineConfig, env } from '@hazejs/core'
+
+// 读取环境变量时使用函数形式，确保在 .env 加载之后求值。
+// app.debug 默认仅在开发环境开启（错误页、堆栈）；如需强制开启，可在此设置 debug: env('APP_DEBUG', false)
+export default defineConfig(() => ({
+  name: env('APP_NAME', '{{name}}'),
+}))

package/templates/react/server/config/auth.ts

@@ -0,0 +1,23 @@
+import { defineAuthConfig, env } from '@hazejs/core'
+import { modelUserProvider } from '@hazejs/orm'
+import { User } from '~/app/model/User'
+
+/**
+ * 认证：guards 决定“怎么认”（jwt：Authorization: Bearer；session：会话 Cookie），
+ * providers 决定“用户从哪来”。路由上用 .middleware('auth') / 'auth:web,api' 保护。
+ */
+export default defineAuthConfig(() => ({
+  default: 'api',
+  guards: {
+    // 密钥默认为 APP_KEY；也可配置 algorithm: 'ES256' 与 privateKey / publicKey
+    api: {
+      driver: 'jwt',
+      provider: 'users',
+      expiresIn: env('JWT_TTL', '2h'),
+    },
+    // 浏览器同源场景可改用 session：{ driver: 'session', provider: 'users' }
+  },
+  providers: {
+    users: modelUserProvider(() => User, { username: 'email', password: 'password' }),
+  },
+}))

package/templates/react/server/config/cache.ts

@@ -0,0 +1,23 @@
+import { defineCacheConfig, env } from '@hazejs/core'
+
+/**
+ * 缓存：Cache.remember('key', '10m', () => ...)、Cache.increment()、Cache.lock()。
+ * 多实例部署时设置 CACHE_STORE=redis（REDIS_URL），限流（config/throttle.ts）与 Session 也会共享计数 / 数据。
+ */
+export default defineCacheConfig(() => ({
+  default: env('CACHE_STORE', 'memory'),
+  // 多个应用共用一个 Redis 时用前缀区分
+  prefix: env('CACHE_PREFIX', '{{name}}:'),
+  stores: {
+    memory: { driver: 'memory' },
+    // 需要安装 ioredis
+    redis: {
+      driver: 'redis',
+      url: env('REDIS_URL', 'redis://127.0.0.1:6379'),
+    },
+    // Edge / Serverless：Upstash（HTTP，需要安装 @upstash/redis）
+    // upstash: { driver: 'upstash', url: env('UPSTASH_REDIS_REST_URL', ''), token: env('UPSTASH_REDIS_REST_TOKEN', '') },
+    // Cloudflare Workers：KV 绑定（最终一致，适合缓存与 Session，不适合精确限流）
+    // kv: { driver: 'kv', binding: 'CACHE' },
+  },
+}))

package/templates/react/server/config/database.ts

@@ -0,0 +1,17 @@
+import { env } from '@hazejs/core'
+import { defineDatabaseConfig } from '@hazejs/orm'
+
+/**
+ * 数据库连接。driver：sqlite（libsql）| turso（HTTP）| d1（Cloudflare）| postgres | pglite | mysql
+ * 切换数据库：安装对应驱动（postgres / mysql2），修改 driver 与 url，并改用对应方言的表结构。
+ */
+export default defineDatabaseConfig(() => ({
+  default: 'main',
+  connections: {
+    main: {
+      driver: 'sqlite',
+      url: env('DATABASE_URL', 'file:./data/app.db'),
+      logging: env('DB_LOGGING', false),
+    },
+  },
+}))

package/templates/react/server/config/filesystem.ts

@@ -0,0 +1,32 @@
+import { defineFilesystemConfig, env } from '@hazejs/core'
+
+/**
+ * 文件存储：Storage.put('reports/a.csv', csv)、Storage.disk('public').putFile('avatars', file)、
+ * 上传文件 `await file.store('avatars', 'public')`。
+ * public 磁盘的文件经 /storage/<path> 访问；私有文件用 Storage.temporaryUrl(path, '10m') 生成签名链接。
+ */
+export default defineFilesystemConfig(() => ({
+  default: env('FILESYSTEM_DISK', 'local'),
+  disks: {
+    local: { driver: 'local', root: 'storage/app' },
+    public: {
+      driver: 'local',
+      root: 'storage/app/public',
+      url: '/storage',
+      serve: true,
+    },
+    // AWS S3 与 S3 兼容服务（R2 的 S3 接口、MinIO、RustFS 等），需要 pnpm add @aws-sdk/client-s3 @aws-sdk/lib-storage @aws-sdk/s3-request-presigner
+    s3: {
+      driver: 's3',
+      bucket: env('S3_BUCKET', ''),
+      region: env('S3_REGION', 'us-east-1'),
+      endpoint: env('S3_ENDPOINT', '') || undefined,
+      accessKeyId: env('S3_ACCESS_KEY_ID', ''),
+      secretAccessKey: env('S3_SECRET_ACCESS_KEY', ''),
+      // 公共读的桶 / CDN 地址；私有桶用 temporaryUrl() 预签名
+      url: env('S3_URL', '') || undefined,
+    },
+    // Cloudflare Workers：R2 绑定（wrangler.json 的 r2_buckets）
+    // r2: { driver: 'r2', binding: 'BUCKET', url: 'https://files.example.com' },
+  },
+}))

package/templates/react/server/config/mail.ts

@@ -0,0 +1,31 @@
+import { defineMailConfig, env } from '@hazejs/core'
+
+/**
+ * 邮件：await Mail.to(user.email).send(WelcomeMail, { name })，排队发送用 .queue() / .later('10m', ...)。
+ * 开发环境默认 log（只写日志）；本地查看真实邮件可运行 Mailpit 并设置 MAIL_MAILER=smtp MAIL_PORT=1025。
+ */
+export default defineMailConfig(() => ({
+  default: env('MAIL_MAILER', 'log'),
+  from: {
+    address: env('MAIL_FROM_ADDRESS', 'hello@example.com'),
+    name: env('MAIL_FROM_NAME', '{{name}}'),
+  },
+  mailers: {
+    // 需要 pnpm add nodemailer（Cloudflare Workers 不支持 SMTP，请用下面的 HTTP 接口驱动）
+    smtp: {
+      driver: 'smtp',
+      host: env('MAIL_HOST', '127.0.0.1'),
+      port: env('MAIL_PORT', 1025),
+      username: env('MAIL_USERNAME', ''),
+      password: env('MAIL_PASSWORD', ''),
+    },
+    resend: {
+      driver: 'resend',
+      key: env('RESEND_API_KEY', ''),
+    },
+    // postmark: { driver: 'postmark', token: env('POSTMARK_TOKEN', '') },
+    // mailgun: { driver: 'mailgun', key: env('MAILGUN_SECRET', ''), domain: env('MAILGUN_DOMAIN', '') },
+    // 需要 pnpm add @aws-sdk/client-sesv2
+    // ses: { driver: 'ses', region: env('AWS_REGION', 'us-east-1') },
+  },
+}))

package/templates/react/server/config/middleware.ts

@@ -0,0 +1,11 @@
+import { defineMiddlewareConfig } from '@hazejs/core'
+
+// 请求 ID（x-request-id）与访问日志由框架内置，无需注册
+// 内置中间件：cors、secureHeaders、compress、throttle:60,60、bodyLimit:10mb、session、auth / auth:api、guest
+export default defineMiddlewareConfig({
+  // 全局中间件，按顺序作用于所有请求
+  // csrf：修改类请求须带 X-XSRF-TOKEN（src/api.ts 自动处理），Bearer 请求不受影响
+  global: ['secureHeaders', 'compress', 'csrf'],
+  // 别名，在路由中按名引用：.middleware('auth')；用 haze make:middleware 生成
+  alias: {},
+})

package/templates/react/server/config/queue.ts

@@ -0,0 +1,21 @@
+import { defineQueueConfig, env } from '@hazejs/core'
+
+/**
+ * 队列：app/job 下的任务，await SendWelcomeEmail.dispatch({ userId })。
+ * memory 在本进程消费（开发 / 单实例）；生产多实例设置 QUEUE_CONNECTION=redis（需要 pnpm add bullmq ioredis），
+ * 并运行 haze queue:work（构建产物：node dist/…/worker.mjs queue）。
+ */
+export default defineQueueConfig(() => ({
+  default: env('QUEUE_CONNECTION', 'memory'),
+  connections: {
+    memory: { driver: 'memory', concurrency: 2 },
+    sync: { driver: 'sync' },
+    redis: {
+      driver: 'redis',
+      url: env('REDIS_URL', 'redis://127.0.0.1:6379'),
+      queues: ['default'],
+    },
+    // Cloudflare Workers：Queues 绑定（wrangler.json 的 queues.producers / consumers）
+    // cloudflare: { driver: 'cloudflare', binding: 'QUEUE' },
+  },
+}))

package/templates/react/server/config/socketio.ts

@@ -0,0 +1,13 @@
+import { env } from '@hazejs/core'
+import { defineSocketIOConfig } from '@hazejs/socket.io'
+
+// 多实例部署时设置 SOCKET_ADAPTER=redis：房间与广播经 Redis 同步到所有实例（需要 pnpm add @socket.io/redis-adapter ioredis）
+export default defineSocketIOConfig(() => env('SOCKET_ADAPTER', '') === 'redis'
+  ? {
+      adapter: {
+        driver: 'redis',
+        url: env('REDIS_URL', 'redis://127.0.0.1:6379'),
+        key: '{{name}}',
+      },
+    }
+  : {})

package/templates/react/server/config/throttle.ts

@@ -0,0 +1,12 @@
+import { defineThrottleConfig, env } from '@hazejs/core'
+
+// 限流计数存在 config/cache.ts 的存储中（CACHE_STORE=redis 时多实例共享）
+export default defineThrottleConfig(() => ({
+  store: env('CACHE_STORE', 'memory'),
+  // 命名规则：.middleware('throttle:api')
+  limiters: {
+    api: { max: 60, window: '1m' },
+    // Cloudflare Workers：使用 Rate Limiting 绑定（wrangler.json 的 ratelimits）
+    // api: { max: 60, window: '1m', binding: 'API_RATE_LIMITER' },
+  },
+}))

package/templates/react/server/config/websocket.ts

@@ -0,0 +1,12 @@
+import { defineWebSocketConfig, env } from '@hazejs/core'
+
+// 多实例部署时设置 WS_BROADCAST=redis：Socket.publish / peer.publish 经 Redis 转发到所有实例（需要 ioredis）
+export default defineWebSocketConfig(() => env('WS_BROADCAST', '') === 'redis'
+  ? {
+      broadcast: {
+        driver: 'redis',
+        url: env('REDIS_URL', 'redis://127.0.0.1:6379'),
+        channel: '{{name}}:ws',
+      },
+    }
+  : {})

package/templates/react/server/database/migrations/0000_create_users.sql

@@ -0,0 +1,9 @@
+CREATE TABLE `users` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`name` text NOT NULL,
+	`email` text NOT NULL,
+	`created_at` integer,
+	`updated_at` integer
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `users_email_unique` ON `users` (`email`);

package/templates/react/server/database/migrations/0001_add_user_password.sql

@@ -0,0 +1 @@
+ALTER TABLE `users` ADD `password` text;

package/templates/react/server/database/migrations/0002_add_user_role.sql

@@ -0,0 +1 @@
+ALTER TABLE `users` ADD `role` text DEFAULT 'member' NOT NULL;