feat: support primitive response arrays and shared catalog tooling

Define reusable response bodies in .api with typed code mappings, per-route overrides and matching OpenAPI schemas. Add application and callback encoders, early response policy selection, and isolated remote-consumer release verification.

Release v0.8.0-preview after full race, vet, build and local MySQL workflow acceptance.

API.md

@@ -1,7 +1,13 @@
 # API 契约与项目生成
 
+当前生成目录和启动扩展采用新布局，见 [项目维护指南](PROJECT.md)。`@app(defaultResponse: Name)` 在入口选择 App 默认响应。`@body(mode: raw|multipart)` 和 `@produces` 支持自动 Handler，手写 Handler 仅为显式选择的扩展。
+
+首次接入请先看 [README](README.md)：包含固定远程版本安装、可运行项目、完整 `.api` 示例和已有服务接入步骤。本页用于查阅语法与生成规则；下方带 `--framework-dir` 的命令用于框架源码开发。
+
 本阶段目标：从 `.api` 定义生成可运行的 Go 项目；定义、绑定、校验与 OpenAPI 保持一致；重复生成不覆盖业务实现；业务代码继续独立于网络层。实现入口是 `cmd/go-omni/apigen`，运行时契约编译器是 `contract`。
 
+v0.14 的 [完整开发指南](DEVELOPMENT.md) 说明响应根类型、`@request`、multipart 字段、注释/格式化、Go 错误目录导出与共享契约。
+
 ## 与 go-zero 的对应关系
 
 调研参考了 go-zero 官方的 [API DSL](https://go-zero.dev/reference/api-dsl/)、[参数规则](https://go-zero.dev/reference/api-dsl/parameter/)、[goctl API](https://go-zero.dev/reference/cli-guide/api/) 和 [项目结构](https://go-zero.dev/concepts/project-structure/)。借鉴其声明接口后生成项目的工作方式：统一的类型定义、路由声明、分组、前缀和命名中间件。实现独立编写，不引入 go-zero 或 Gin 运行时依赖。
@@ -13,9 +19,9 @@
 | 熟悉的命令别名 | `api go -api user.api -dir .` |
 | 校验契约 | `api validate --api user.api` |
 | CI 检查生成产物是否过期 | `api generate --api user.api --dir . --check` |
-| 业务逻辑目录 | `internal/service/<group>`，沿用 Omni 的 Service 分层 |
-| 依赖装配 | `internal/servicecontext` |
-| 接口文档 | 自动生成 `docs/openapi.json`，同时提供 `/openapi.json` |
+| 业务逻辑目录 | `internal/logic/<group>`，使用标准 context.Context |
+| 依赖装配 | `internal/svc` |
+| 接口文档 | 自动生成 `docs/openapi.json`，HTTP 端点由 `server.endpoints.openapi` 配置 |
 
 这是明确限定的 go-zero 风格方言，**不是完整 goctl 兼容实现**。不支持的声明和校验标签会在生成前报错。
 
@@ -29,10 +35,10 @@ go run ./cmd/go-omni api new \
 
 cd ../omniDemo
 go mod tidy
-go run ./cmd/server
+go run .
 ```
 
-访问 `http://127.0.0.1:8080/api/greet/Alice` 可得到带 `data.message` 的统一响应。`api new` 的问候示例包含可运行逻辑；自定义契约新生成的 Service 会明确返回 501，等待业务实现。
+访问 `http://127.0.0.1:8080/api/greet/Alice` 可得到带 `data.message` 的统一响应。`api new` 的问候示例包含可运行逻辑；自定义契约新生成的 Logic 会明确返回 501，等待业务实现。
 
 用现成的多分组定义生成项目，在 go-omni 仓库执行：
 
@@ -55,11 +61,11 @@ go-omni new --api user.api --module example.com/userService \
 - `--storage none|local|s3|r2|oss`：默认 none，生成统一 Files / Uploads / Downloads / UploadLinks 依赖；本地签名对象端点为 `/storage/object`。
 - `--log-output stdout|stderr|file` 与 `--log-format json|text`：配置和无配置文件启动使用一致默认值。
 
-初次选项记录在 `.goOmni/apiManifest.json`，以后直接 `api generate` 会继承。已有项目通过参数切换选项会报错，因为初始化代码属于业务方；可在新目录生成对照后手动迁移。`--force` 不允许覆盖 API 项目。旧式 CRUD 脚手架仍保留。
+初次选项记录在 `.goOmni/apiManifest.json`，以后直接 `api generate` 会继承。已有项目通过参数切换选项会报错，因为初始化代码属于业务方；可在新目录生成对照后手动迁移。`--force` 不允许覆盖 API 项目。new 与 api new 统一生成契约项目，不再使用旧式 CRUD 目录。
 
-MySQL 密钥只从 `GO_OMNI_DB_DSN` 获取，非秘密池配置位于 YAML，环境变量优先。存储使用原有 `GO_OMNI_STORAGE_*`；API 项目不会额外生成公开的签名发放接口，鉴权和对象权限由业务实现。初始化失败会清理已打开资源，退出清理可重复调用。
+MySQL 使用官方 `database/mysql` 结构化适配器，密码从 `GO_OMNI_DB_PASSWORD` 覆盖，非秘密池配置位于 YAML，环境变量优先。存储使用原有 `GO_OMNI_STORAGE_*`；API 项目不会额外生成公开的签名发放接口，鉴权和对象权限由业务实现。初始化失败会清理已打开资源，退出清理可重复调用。
 
-HTTP 请求类型不能推导数据库表结构；迁移和 Repository 由业务自己维护。完整案例见 [用户管理示例](examples/userService/README.md)，覆盖真实 MySQL、事务审计、鉴权、文件导出和日志。
+HTTP 请求类型不能推导数据库表结构；迁移和 Repository 由业务自己维护。当前目录的完整示例见 [managedService](examples/managedService/README.md)。MySQL、事务审计和鉴权实现可参考 [旧目录用户管理示例](examples/userService/README.md)，接入时按 [项目指南](PROJECT.md) 装配到 config/svc/logic。
 
 ## 接口定义
 
@@ -89,46 +95,202 @@ service user-api {
 }
 ```
 
-类型和 Go 字段使用导出命名；JSON、query、path 名称使用 lowerCamelCase；Header 使用 HTTP 标准名称。响应类型只定义 `data`，统一响应的 `code`、`message`、`requestId` 由框架添加。
+类型和 Go 字段使用导出命名；JSON、query、path 名称使用 lowerCamelCase；Header 使用 HTTP 标准名称。响应类型定义业务返回值。未配置时使用默认公共体；当前源码支持在 `.api` 中声明公共响应模板，选择字段和结构，并按分组复用或由单接口覆盖，详见 [公共响应体](RESPONSE.md)。
 
 支持：
 
 - 可省略的 `syntax = "v1"`；`info` 中的 title、version 和描述性元数据。
 - 单独的 `type X { ... }` 与 `type (...)`；基础标量、指针、嵌套命名类型、切片、字符串键 map。嵌套对象只使用 JSON 字段。
-- 相对 `.api` 导入及 `import (...)`，重复导入去重；拒绝循环和越过入口目录的导入。单文件 1 MiB、总计 8 MiB、最多 64 个文件，限制导入/类型深度及 schema 展开规模。
-- 同一 service 名称的多个块；`@server` 的 group、prefix、middleware，group 可以写 `admin/user`。
-- 每个路由必须有 `@handler`；可选 `@doc "..."`；GET/POST/PUT/PATCH/DELETE/HEAD/OPTIONS。
+- 相对 `.api` 导入及 `import (...)`，重复导入去重；拒绝循环和未授权的目录越界。跨服务共享须在 `omni.imports.json` 声明 roots，见 [共享契约](DEVELOPMENT.md#两个服务共享契约)。单文件 1 MiB、总计 8 MiB、最多 64 个文件，限制导入/类型深度及 schema 展开规模。
+- 同一 service 名称的多个块；`@server` 的 group、prefix、middleware、auth、errors、response，group 可以写 `admin/user`。
+- 每个路由必须有 `@handler`；可选单行/多行 `@doc`、`@auth`、`@errors`、`@response`；GET/POST/PUT/PATCH/DELETE/HEAD/OPTIONS。
 - 可省略请求或响应；有响应默认 200，无响应默认 204。Omni 扩展 `@status 201`、`@status 202`；204 不允许响应类型，HEAD 不允许响应体，GET/HEAD 不允许 JSON 请求体。
-- 每个请求字段只使用一个来源：`json`、`path`、`form`、`header`。本版 `form` 明确表示 URL query，不解析 multipart 或表单 body。query 切片用重复键；header/path 使用标量。
+- 每个请求字段只使用一个来源：`json`、`path`、`form`、`header`，或声明式上传的 `multipart`、`multipartJSON`、`file`。`form` 始终表示 URL query；query 切片用重复键，header/path 使用标量。上传示例与限额见 [声明式 multipart](DEVELOPMENT.md#声明式-multipart)。
 - 来源标签中的 `optional` / `omitempty`、标量 `default`、标量 `options=a|b`、数值 `range=[1:100]`（支持开区间和单边界）。
 - `binding` 的 `required`、`min`、`max`、`len`、`email`。长度按 Unicode 字符或切片元素数；范围边界必须有限且位于 ±2^53 内。
 
-暂不支持匿名嵌入、别名、递归类型、外部 Go 类型、自定义 JSON 编解码、`[]byte`、泛型、`json:",string"`、任意 validator 标签、go-zero 的 JWT/签名/SSE 声明，以及客户端 SDK 生成。认证请用命名中间件接入。`@doc` 块等未列出的语法也会明确报错。
+暂不支持匿名嵌入、别名、递归类型、未声明的外部 Go 类型、未通过 scalar 显式接入的自定义编解码、`[]byte`、泛型、`json:",string"`、任意 validator 标签、go-zero 的 JWT/签名/SSE 声明，以及客户端 SDK 生成。认证验证通过声明关联的命名中间件实现。未列出的语法会明确报错。
+
+业务错误、具名鉴权、多行文档及下述开发命令从 CLI `v0.7.0-preview.1` 提供。公共响应模板从 `v0.8.0-preview` 提供，CLI 与业务项目中的框架依赖需一起升级。
+
+## 业务错误：声明、代码和文档共用一份定义
+
+**错误目录也可以只在 Go 中维护。** 从 `v0.11.1-preview` 起，生成路由没有声明错误列表时，继承 `omni.WithErrors(catalog)` 注册的 App 目录；`.api` 继续定义接口和返回格式，无需重复登记错误。全局中间件提前返回同样适用。显式引用 `.api` 错误时才使用路由独立目录，规则见 [目录继承](errors/README.md)。CLI 不执行项目 Go 配置；可显式用 `errors.ExportCatalog` 导出 `omni.errors.json`，供文档合并同一目录，见 [导出步骤](DEVELOPMENT.md#字段文档格式化go-错误目录导出)。
+
+从 `v0.10.0-preview` 起，推荐用 `errorCatalog` 同时定义逻辑标识、对外业务码、提示和 HTTP 状态：
+
+```text
+errorCatalog CommonErrors (
+    defaultStatus: 200
+    errors: {
+        "UsernameInvalid": {"key": "USERNAME_INVALID", "code": 400002, "message": "用户名格式不正确"},
+        "PasswordInvalid": {"key": "PASSWORD_INVALID", "code": 400002, "message": "密码格式不正确"},
+        "Forbidden": {"key": "FORBIDDEN", "status": 403, "code": 403001, "message": "没有权限"}
+    }
+)
+```
+
+对象键是生成函数名；`key` 是唯一逻辑标识，允许项目自己的命名；`code` 是对外业务码，可以重复。数字码需搭配 `codeType: int32` 或 `int64` 的公共响应；字符串码搭配 `string`。目录不规定返回体字段。
+
+省略 `defaultStatus` 时为 400；设为 200 时，只作用于目录里未单独写 `status` 的条目。生成路由自动绑定它实际声明的错误目录，在 App 中间件之前生效。业务只调用 `apierrors.UsernameInvalid()`；无需再维护 `codes` / `messages`，也无需修改 main。手写路由可复用生成的 `apierrors.Catalog()`。
+
+同一 HTTP 200 下，OpenAPI 用 `anyOf` 保留成功 DTO 和错误体，日志与指标仍识别业务失败。完整语法、路由作用域与手写项目配置见 [统一错误目录](errors/README.md)，可运行契约见 [errors.api](examples/contracts/errors.api)。
+
+从 `v0.11.0-preview` 起，目录条目支持 `params` 有序列表与 `{name}` 提示模板：
+
+```json
+"TextTooLong": {
+    "key": "TEXT_TOO_LONG", "code": 400002,
+    "message": "{label}不能超过{max}个字符",
+    "params": [
+        {"name": "label", "type": "string", "example": "企业名称"},
+        {"name": "max", "type": "int", "example": 100}
+    ]
+}
+```
+
+生成 `apierrors.TextTooLong(label string, max int)`，返回时 Message 已填好；固定提示保持无参数函数。声明顺序决定参数顺序。模板校验、运行时缺参/类型错误、转义及非 HTTP 使用规则见 [提示模板参数](errors/README.md)。OpenAPI 的错误目录保留参数定义，响应示例使用具体文案。
+
+原有声明继续支持：
+
+```go
+error (
+    Unauthenticated 401 "UNAUTHENTICATED" "authentication required"
+    Forbidden 403 "FORBIDDEN" "permission denied"
+    UserNotFound 404 "USER_NOT_FOUND" "user not found"
+    EmailTaken 409 "EMAIL_TAKEN" "email already in use"
+)
+```
+
+也可写单条 `error EmailTaken 409 "EMAIL_TAKEN" "email already in use"`，或把错误目录放进相对导入的 `errors.api`。
+名称用 UpperCamelCase，HTTP 状态允许 200–599 中可携带响应体的最终状态（排除 204/205/304），旧声明的逻辑错误码用大写字母/数字/下划线且全局唯一，message 是可公开返回的稳定提示。`Catalog` 为生成函数保留名称。
+
+`@server (errors: Unauthenticated)` 声明组级错误；路由 `@errors UserNotFound, EmailTaken` 追加到组级列表并去重。
+`@errors none` 清空 `.api` 分组继承的错误列表，随后按未设置路由目录处理，继承 App 错误目录。未声明、重复声明或生成符号冲突会报告源码位置。
+
+生成 `internal/apierrors/errorsGen.go`：
+
+```go
+return nil, apierrors.EmailTaken()
+// 可用 apierrors.CodeEmailTaken 引用同一个错误码。
+```
+
+每次调用返回新错误，避免并发修改共享错误对象。生成器不会自动把任意数据库错误转成业务错误；由 Service/适配层调用这些函数。
+内部 Cause 可能进入访问日志，敏感驱动报错应像 userService 示例一样先归类再转换。
+
+OpenAPI 对每个状态按选定的响应模板生成结构和命名 examples，同一 409 下多个错误不会相互覆盖；平铺模式的纯业务状态还列出 code enum。
+默认框架错误状态与自动添加的鉴权 401 保留开放的 code 字段，容纳校验器/中间件实际错误。
+`x-omni-errors` 提供错误目录与路由关联。目录解析已定义的错误，不自动推断数据库或其他未声明错误的业务含义，也不穷举所有运行时错误。
+
+## 鉴权：声明与路由注册一起变化
+
+```go
+auth UserAuth (
+    type: bearer
+    middleware: Auth
+    description: "Application access token"
+)
+
+@server (
+    group: user
+    prefix: /api/v1
+    auth: UserAuth
+    errors: Unauthenticated
+)
+service user-api {
+    @errors Forbidden, EmailTaken
+    @handler createUser
+    @status 201
+    post /users (CreateUserReq) returns (UserResp)
+
+    @auth none
+    @errors none
+    @handler publicStatus
+    get /status
+}
+```
+
+`auth` 是具名契约，`middleware` 指向实际 hook；生成器把它放在普通 middleware 前面执行，并在注册任何路由前检查 hook 非空。
+新 hook 未实现时返回 501，已有手写 hook 保留。需要在 hook 中验证凭证、失效时间、签发者、权限等；声明不会自动实现登录或 JWT 校验。
+
+- `type: bearer`：对应 HTTP Bearer，可选 `bearerFormat: JWT`，这只是文档提示。
+- `type: apiKey`：必须同时声明 `in: header` 或 `in: cookie` 和 `name`，例如 `X-API-Key` 或 `sessionId`。
+- `auth: UserAuth` 可在组级使用；路由 `@auth OtherAuth` 替换，`@auth none` 撤销继承的声明鉴权。普通 middleware 继续保留。
+- 不要再把该 auth 的 hook 重复写进普通 middleware。不支持 query token、多个方案 AND/OR、OAuth2 scopes 或隐含认证策略。
+- 被保护路由自动描述 401；403 和具体错误码由 `@errors` 明确声明。未声明 auth 的旧项目仍按其原有 middleware 执行。
+
+文档生成 `components.securitySchemes` 与逐接口 `security`；显式公共接口使用空数组。
+结构遵循 [OpenAPI 3.0.3 Security Requirement](https://spec.openapis.org/oas/v3.0.3.html#security-requirement-object)。
+
+## 文档和日常开发命令
+
+保留单行 `@doc "摘要"`，也可以：
+
+```go
+@doc (
+    summary: "Create a user"
+    description: "Writes user data and audit in the same transaction"
+    tags: users, administration
+    deprecated: false
+)
+```
+
+未设置 tags 时使用 group 分组。`info` 的 description/desc 也会进入 OpenAPI；两者不能同时声明。
+
+在生成项目目录内，不必重复输入 API 路径：
+
+```sh
+go-omni api validate              # 发现 manifest 中的入口并校验
+go-omni api inspect               # 方法、路径、Handler、鉴权与业务错误总览
+go-omni api generate --dry-run    # 预览文件变化、契约变更和 Logic 提示，完全不写文件
+go-omni api generate              # 实际生成，保留手写业务
+go-omni api generate --check      # 只读检查产物漂移及明确的 Logic 签名错误，可用于 CI
+go-omni api export > openapi.json # 独立导出纯 JSON，无需启动服务
+go test ./...
+```
+
+`--dry-run` 和 `--check` 不能组合。新项目预览也不创建目录；预览不是审批或锁定，实际生成会重新检查文件状态。
+契约变化会定位到相关 Logic 文件，涵盖嵌套 DTO、原始 body 和流式返回。生成后签名不一致的问题仍可由 `--check` 检出；项目类型别名/build tags 等不确定情况提示 REVIEW，最终用 `go test ./...` 验证。详见 [契约变更提示](PROJECT.md#契约变更提示)。
+在项目外可显式传 `--api`；生成时传 `--dir` 可定位其他项目。不会猜测多个 .api 中哪个是入口。
+路由总览的 `(undeclared)` 仅表示没有声明 auth；旧式中间件仍可能做认证。
+外发文档可用 export；项目内受生成器管理的 `docs/openapi.json` 请通过 generate 更新，以同步文件哈希。
+
+## 迁移扩展
+
+- 动态 JSON 字段 `any` / `interface{}`，包含切片和 map；外围契约仍严格。
+- `scalar Name (...)` 显式引用项目类型，声明 JSON 输入/输出类型及文本绑定；支持已有 JSON/Text 转换方法。
+- `@body (mode: json/raw/multipart; maxBytes: ...)`：按路由限制请求体。
+- `@binding custom` 生成保留的绑定 hook；`@handlerMode manual` 生成保留的整个 Handler，仅用于自定义协议。raw 与未声明上传字段的 multipart 将受限流交给 Logic；声明了上传字段时则交给 Logic 已校验的 DTO。
+- `@produces "text/plain"` 等声明无 DTO 成功输出；自动模式的 Logic 返回 `*httpx.Stream`，Handler 负责流式发送和关闭。默认状态 200。manual 模式保留项目自己的输出实现。
+- 自动 multipart Handler 检查未读部分和结束边界；损坏/截断默认返回 400，超限为 413。公共状态、码和文案仍可用项目错误目录配置，见 [流式接入与错误处理](PROJECT.md#自动上传回调与下载)。
+
+迁移扩展起始于 v0.9.0，原有手写扩展说明见 [迁移扩展指南](MIGRATION.md)。当前根目录入口和自动流式 Handler 要求 CLI 与框架依赖一起使用 v0.14.0-preview；版本说明和新目录维护规则见 [项目指南](PROJECT.md)。不兼容全部 goctl 语法。
 
 ## 参数语义
 
 无 optional/default 的字段按“是否出现”判断必填，`false`、`0`、`""` 是已提供的值。额外声明 `binding:"required"` 才会拒绝标量零值。默认值只在字段缺失时使用，不替换显式的空值。
 
-业务需要区分“没传”和“传了零值”时使用 `*T` 加 optional。指针允许 JSON null；非指针拒绝 null；`binding:"required"` 拒绝指针 null。缺失与 null 都会得到 nil，本版没有三态 Nullable 类型。响应端的 `optional` 不等于 Go 编码器的 `omitempty`；需要省略零值时显式使用 `omitempty`。
+业务需要区分“没传”和“传了零值”时使用 `*T` 加 optional。指针允许 JSON null；普通非指针字段拒绝 null（动态 `any` 允许）；`binding:"required"` 拒绝指针 null。缺失与 null 都会得到 nil，本版没有三态 Nullable 类型。响应端的 `optional` 不等于 Go 编码器的 `omitempty`；需要省略零值时显式使用 `omitempty`。
 
-JSON 必须是一个 object，Content-Type 为 application/json。默认最多 1 MiB，包含 chunked/未知长度和尾部空白；超限返回 413。重复 JSON key、未知字段、多个 JSON 值、标量 query/header 重复值、格式和约束错误返回 400；错误 Content-Type 返回 415。失败不会部分修改目标 DTO；错误详情只保留在内部 cause，公共响应不回显原始参数。
+普通 JSON 请求体必须是一个 object，Content-Type 为 application/json；响应根类型另支持数组、nullable 对象和 null。默认最多 1 MiB，包含 chunked/未知长度和尾部空白；超限返回 413。重复 JSON key、未知字段、多个 JSON 值、标量 query/header 重复值、格式和约束错误返回 400；错误 Content-Type 返回 415。失败不会部分修改目标 DTO；错误详情只保留在内部 cause，公共响应不回显原始参数。
 
-`contract.Binder` 在服务启动时编译，随后并发复用，不会每次请求重新分析标签。CLI 用相同编译器产生文档，因此来源、必填、默认、nullable、枚举、范围和长度具有同一来源。响应类型和约束由业务实现遵守，不在每次响应上再次校验；非 nullable 集合请返回空集合而不是 nil。
+`contract.Binder` 在服务启动时编译，随后并发复用，不会每次请求重新分析标签。CLI 用相同编译器产生文档，因此来源、必填、默认、nullable、枚举、范围和长度具有同一来源。响应类型和约束由业务实现遵守，不在每次响应上再次校验；嵌套的非 nullable 集合请返回空集合而不是 nil，根 `returns ([]Item)` 会把 nil slice 规范为 `[]`。
 
 ## 生成目录和业务边界
 
 ```text
 api/                              # 开发者维护的契约及导入
-cmd/server/main.go                # 启动、日志、优雅退出
+main.go                # 启动、日志、优雅退出
 etc/config.yaml
-internal/settings/
-internal/servicecontext/          # 依赖初始化和释放
-internal/types/typesGen.go
+internal/config/
+internal/svc/          # 依赖初始化和释放
+internal/types/*Gen.go
+internal/apierrors/errorsGen.go    # 声明错误后生成
 internal/handler/routesGen.go
 internal/handler/openapiGen.go
 internal/handler/<group>/handlersGen.go
-internal/service/<group>/service.go
-internal/service/<group>/<operation>.go
+internal/logic/<group>/logic.go
+internal/logic/<group>/<operation>.go
 internal/repository/<group>/repository.go
 internal/middleware/registryGen.go
 internal/middleware/<name>.go
@@ -136,7 +298,7 @@ docs/openapi.json
 .goOmni/apiManifest.json
 ```
 
-Service 方法接收标准 `context.Context` 与生成的请求 DTO；Handler 调用 Service 并完成响应包装。网络适配器仍经 Omni/httpx 接入。Repository 是业务所有的扩展位置，不自动生成虚构 CRUD 查询。
+Logic 方法接收标准 `context.Context` 与生成的请求 DTO；Handler 调用 Logic 并完成响应包装。网络适配器仍经 Omni/httpx 接入。Repository 是业务所有的扩展位置，不自动生成虚构 CRUD 查询。
 
 命名中间件按声明顺序组合，第一个在最外层。新 hook 初始返回 501，必须实现后才放行；registry 自动维护，hook 文件只创建一次。缺失 hook 在注册任何路由前报错。文档通过 `x-omni-middleware` 标出命名 hook，不把名称误当成已实现的认证协议。
 
@@ -151,7 +313,7 @@ go-omni api generate --api api/user.api --dir . --check
 go test ./...
 ```
 
-`Gen.go` 和 OpenAPI 由生成器管理，manifest 保存其 SHA-256。手动修改后更新会报冲突。Service、Repository、main、配置、依赖装配和中间件实现按字节保留；只补缺失文件。删除接口/分组时只移除旧的生成文件，保留业务代码；已删除类型仍被旧业务引用时，需要明确迁移该业务文件，编译器会提示。
+`main.go`、`Gen.go` 和 OpenAPI 由生成器管理，manifest 保存其 SHA-256。手动修改后更新会报冲突。Logic、Repository、配置、依赖装配和中间件实现按字节保留；只补缺失文件。删除接口/分组时只移除旧的生成文件，保留业务代码；已删除类型仍被旧业务引用时，需要明确迁移该业务文件，编译器会提示。
 
 `--check` 只读，检查产物是否过期，以及所需骨架是否缺失。契约复制到项目后，请编辑项目内的 API；外部定义与已存在副本不一致时会拒绝覆盖。一个项目由一个 API 入口管理，可以通过导入拆分文件。
 
@@ -163,7 +325,9 @@ go test ./...
 
 ```sh
 go test -race -p=2 ./contract ./openapi ./cmd/go-omni/...
-python3 scripts/verifyAPI.py
+python3 scripts/verifyManagedProject.py
 ```
 
-Go 测试覆盖契约拒绝规则、多源绑定、零值/缺失、默认/范围/嵌套集合、文档约束、幂等更新、只读检查、业务保留、删除路由、路径边界及生成项目编译。Python 验收会在临时目录生成项目，分别启动 nethttp/native，验证真实 HTTP 请求、中间件、日志 requestId 和优雅退出；结束后清理自己创建的进程和临时文件。结果记录在 `performance/apiGenerationLocal.json`。
+Go 测试覆盖契约拒绝规则、多源绑定、零值/缺失、默认/范围/嵌套集合、文档约束、幂等更新、只读检查、业务保留、删除路由、路径边界及生成项目编译。Python 验收会在临时目录生成项目，分别启动 nethttp/native，验证真实 HTTP 请求、中间件、日志 requestId 和优雅退出；结束后清理自己创建的进程和临时文件。结果记录在 `performance/managedProjectLocal.json`；完整记录见 [第一版验收](performance/managedProjectAcceptance.md)。
+
+内置健康与 OpenAPI 路由可通过配置禁用或修改路径，`.api` 不再固定保留 `/health/live`、`/health/ready`、`/openapi.json`。启用的内置路径与业务 GET 路由重叠时，生成的 NewApp 在监听前返回配置错误；禁用后可以由 `.api` 自己维护这些路径。见 [内置接口配置](PROJECT.md#配置内置接口)。

BUSINESS_DEVELOPMENT.md

@@ -0,0 +1,26 @@
+# 通用业务开发能力完善计划
+
+本轮目标：业务维护契约、配置、依赖装配与业务逻辑，框架持续维护 HTTP 接入、契约校验、通用运行期与文档。按实际生成项目和可删除的业务适配点验收，不写入 eTax 业务规则。
+
+## 实施与验收清单
+
+- [x] 运行期：资源登记、逆序释放、幂等关闭、失败回滚、故障原因保留归框架；生成入口与项目依赖初始化边界明确。多 App 日志隔离、标准 log.Logger 适配、可信请求元数据与依赖中间件示例。
+- [x] 配置：项目完整结构体环境覆盖；默认值→文件→环境；嵌套、duration、slice、显式零值、空值策略、必填与脱敏；日志无副作用完整校验。
+- [x] 数据库：官方 MySQL 结构化配置/TLS/驱动日志适配，继续复用 OpenConnector 和唯一连接池；独立启动检查、失败清理、生成器接入；不内置版本/表结构/业务错误策略。
+- [x] 响应契约：数组、可空对象、成功 null、独立 HTTP 204；Logic/Handler/OpenAPI/漂移检查一致。
+- [x] 请求契约：未知 query、JSON UTF-8/charset、无 Body/必填空对象/可选 Body，App 默认与路由覆盖；scalar/any/数组/大小限制一致，普通 JSON 只绑定一次。
+- [x] 上传：声明文件/文本/JSON 字段，重复/未知/必填/单字段/单文件/总量限制；有界暂存与清理，调用 Logic 前完成普通表单校验；保留流式扩展与 Complete 约定。
+- [x] 文档工具：字段注释、example/枚举描述进入 DTO 与 OpenAPI；保注释、幂等格式化及 check；显式 Go 错误目录元数据导出与文档合并，不自动执行项目代码。
+- [x] 共享契约：受控 roots/摘要、循环/深度/文件数/路径保护；分源文件 DTO、多个独立 module 的工作区检查；版本提示与基础模板升级预览，保留业务文件。
+- [x] 集成：实际生成项目验证新能力、连续生成、业务文件保留、失败清理、nethttp/native 请求与退出；现有错误继承/参数/上传下载回归。
+- [x] 最终回归：全量 race（含生成器集成）、vet、build、格式化/链接检查；使用说明、迁移步骤及验收报告完整，发布后远程无 replace 验收。
+
+已发布 `v0.14.0-preview`。逐项验收、可替换的业务适配点与远程报告见 [验收记录](reports/businessDevelopmentAcceptance.md)；接入和升级见 [开发指南](DEVELOPMENT.md)。
+
+## 核心约定
+
+响应与错误码由项目配置。字段与请求策略由契约表达；基础设施采用可选适配器，保留标准 Connector。所有业务依赖在请求排空后关闭；框架不重试写操作、不自动迁移业务表、不关闭借用资源。
+
+普通 multipart 为保证进入 Logic 前完成校验，以有界复制暂存到临时文件；框架清理自己创建的资源。纯流式路径明确由调用方在提交持久副作用前完成输入检查。
+
+不修改 eTax/ePay 业务，不连接既有业务服务器。真实基础设施如需验证，只使用本轮隔离资源。验收报告明确区分单元测试、生成消费者测试与真实服务测试。

CHANGELOG.md

@@ -1,12 +1,92 @@
 # Changelog
 
+## v0.13.0-preview（2026-09-24）
+
+- 新增通用 lifecycle.Controller，svc.RequestShutdown 支持依赖主动通知正常停止或致命故障，通知不阻塞，首个故障原因保留；生成入口排空 HTTP 后关闭依赖与日志，故障退出码为 1。
+- App.RunContext、ServeContext、RunWith 保留自定义 context 取消原因；正常信号取消仍正常返回。
+- 健康检查默认使用 App 响应模板和错误目录，支持 raw JSON；HTTP 状态保持 200/503，避免业务 HTTP 200 策略掩盖未就绪。内部探针原因仅供日志，失败状态继续记录到日志/指标。
+- 生成项目通过 server.endpoints 配置 liveness/readiness/openapi 的开关与路径；全局中间件继续生效，OpenAPI 保持原始规范。禁用端点不保留路径，启用路径与业务 GET/参数/通配路由冲突时在监听前报错。
+- 生成器最低框架版本更新到 v0.13.0-preview；manifest v2 和业务文件保持。v0.12 项目需要显式升级其 svc 扩展，main/Handler 由重新生成更新。
+- 增加故障退出、排空/清理顺序、初始化期间通知、子进程退出码、健康格式、损坏编码器、端点禁用/改名/冲突的回归验收。
+
+## v0.12.0-preview（2026-09-24）
+
+- 生成项目统一采用根目录 main.go 和 config/svc/logic/handler；new 与 api new 共用受管理生成器，manifest v2 不兼容旧目录。
+- main 和 HTTP 装配持续生成；svc 提供 AppOptions、GlobalMiddleware、OnClose 和幂等 Close，初始化失败回收资源，正常退出先排空 HTTP 再关闭项目依赖及日志。
+- 入口 @app(defaultResponse: Name) 自动接入 App 默认响应；生成路由、全局中间件及 404/405 共用策略，Go 错误目录保持单处注册。
+- raw/multipart 输入和 @produces 流式输出支持自动 Handler，Logic 接收受限请求流/返回可关闭内容流，保留显式手写扩展。
+- 新增真实生成项目生命周期、流式输入输出、文件保留和入口漂移检查，提供可运行 managedService 示例与 PROJECT.md。
+- multipart 流式读取保留解析错误，检查未消费部分与最终边界；损坏请求默认 400，超限保持 413，错误目录可定制公开响应。配置校验与实际 App 响应编码器/错误目录装配使用同一规则，冲突在构造前报错。
+- manifest 保存契约快照；生成/预览/检查提供接口类型、嵌套 DTO、scalar、body/流式模式变更提示，定位受影响的 Logic。轻量源码检查识别签名、语法和重复方法问题；--check 在重新生成后仍拒绝明确的业务签名错误，保留所有手写文件，类型别名/build tags 等不确定情况提示人工复查。
+
+
+## v0.11.1-preview
+
+- 修复生成路由用空错误目录遮蔽 App 目录的问题；空 WithErrors 完全透传，避免 Context 与 Encoder 二次解析时丢失状态、业务码和中文提示。
+- 未声明错误列表的路由继承 App，支持错误只在 Go 中维护；显式路由目录保持独立，响应格式、RawJSON、body limit 和全局中间件提前返回保持正确策略。
+- 兼容已有 v0.11.0 生成代码；CLI 不再为空列表绑定目录。补充纯 Go 错误目录的实际生成消费者与回归验收。
+
+## v0.11.0-preview
+
+- 错误目录增加有序 params 和命名提示模板，生成带类型的错误函数；固定提示保持兼容，业务不再自行拼接文案。
+- 新增 WithParams、参数校验与共用解析器；复制请求参数、保留错误链，重复解析和缓冲链路保留填充结果。非法调用转系统兜底，访问日志提供不含参数值的诊断。
+- OpenAPI 错误目录同步参数类型/示例，响应示例由运行时解析器生成；JSON/YAML 配置同样支持模板。
+- 本地/共享幂等重放保存已解析公开错误快照，不保存原始参数或 cause；Redis Lua 重写记录不损失 int64 业务码精度。
+- 模板编译拒绝未声明/未使用参数、非法类型及示例；模板错误不能再维护同标识的旧 messages 映射。
+- CLI 新生成代码最低要求 v0.11.0-preview；已生成的固定错误函数和 v0.10.0 调用继续支持。
+
+## v0.10.0-preview
+
+- 新增 App/路由独立错误目录：`omni.WithErrors`、`errors.Catalog`、`ByCode` 与不可变 Registry，业务只选逻辑标识；对外码和提示由项目配置。
+- 默认 HTTP 状态与逐项覆盖均可配置，包括 HTTP 200 的业务失败；错误模板、RawJSON、日志、业务失败指标、链路、标准中间件桥接和幂等重放保留失败语义。
+- `.api errorCatalog` 同源生成 Catalog、独立错误函数、路由目录和 OpenAPI；允许重复对外码、不同路由不同码类型、公共契约导入。旧 error 声明也允许 HTTP 200。
+- 同一 200 的成功/错误响应使用 anyOf 保留两种 schema，错误示例保持各自提示；自定义 Encoder 和直接输出继续支持。
+- 目录校验类型、范围、状态和冲突；JSON 配置拒绝重复键，整数保留 int64 精度；未知标识使用系统兜底，默认公开响应不暴露 cause。
+- 新生成代码最低要求 v0.10.0-preview；原有构造函数、Codes/Messages 与旧生成代码继续可用。Catalog 为生成错误包保留函数名。
+
+
+## v0.9.1-preview
+
+- 新增标准 `database.OpenConnector` 和独立 `PoolConfig`；与 DSN 入口共享池参数、限时启动 Ping、失败清理、Health、事务，不注册全局驱动配置。
+- 新增 `omni.WithHTTPConfig` / `Config.HTTP`：读头、读请求、写响应、空闲超时和头大小，贯通代码、JSON/YAML、环境变量、Run/Serve 与 NewServer；nethttp 支持 Go-only ErrorLog。
+- 保持已有默认行为；负值和实验 http2 不支持的超时项在监听前报错；记录各网络层的具体语义。
+- 增加真实 MySQL TLS/驱动日志隔离、连接池归属/取消/事务、nethttp/native 慢连接与写背压验收，以及无本地 replace 的远程消费者脚本。
+- 兼容 v0.9.0-preview 生成代码；不修改业务项目的数据库策略或生成代码最低版本。
+
+
+## v0.9.0-preview
+
+- 标准 HTTP Handler/Middleware 桥接：跟踪 Raw 状态与提交，保留取消、流式能力和中间件跨请求状态；已提交响应不追加 JSON。
+- `.api` 支持动态 JSON `any` / `interface{}`，保持重复键、大小、外围未知字段校验和数字精度。
+- 路由级请求体限额、自定义绑定和 manual Handler；上传、原始 body、下载可保留手写实现，重生成受保护。
+- 自定义 scalar 显式对接项目 JSON/Text 方法；支持可空和集合，分别生成请求/响应 OpenAPI；不放宽其他字段。
+- 新增 [迁移扩展指南](MIGRATION.md)、可运行示例和真实生成项目回归。CLI 与框架依赖一起升级。
+
+## v0.8.0-preview
+
+- 公共响应 `codeType` 支持 `int32` / `int64` / `string`，校验默认码及映射范围，OpenAPI 标注整数位宽；JSON/YAML 和生成代码保留 int64 精度，旧 `integer` 兼容。
+- 公共 JSON 响应体改为可配置模板：支持嵌套结构、独立错误体、错误码类型/映射、提示与空值行为；旧 DTO 仅保留源代码兼容。
+- `.api` 支持 `response Name (...)`、分组引用和单路由覆盖；`@response raw` 输出原始业务 JSON。生成的模板、路由和 OpenAPI 使用同一份配置。
+- 提供应用级/接口级编码器，以及 Text / XML / Bytes 直接输出，允许三方回调独立控制成功和失败的状态、Header、内容。
+- 接口响应策略可在全局中间件之前挂载，覆盖提前鉴权/限流失败和 Context 克隆；内置路由 404/405 使用应用配置。
+- 详见 [公共响应体](RESPONSE.md)。CLI 与项目框架依赖需要一起升级到本版。
+
+## v0.7.0-preview.1
+
+- `.api` 支持集中业务错误目录、组级与路由级错误声明，生成状态/错误码/提示一致的 `internal/apierrors` 函数，以及 OpenAPI 命名响应示例。
+- 具名鉴权声明支持 Bearer、header/cookie API key，关联真实中间件；支持组级继承、单路由覆盖与公共接口，认证 hook 优先执行并在启动时校验。
+- 新增多行 `@doc` 的摘要、描述、标签与弃用标记，`info.description` 同步文档。
+- 新增 `api inspect`、`api export`、`api generate --dry-run`；项目内自动识别 manifest 的 API 入口，减少重复参数。
+- 用户示例用真实 401/403/409 验证声明与行为，业务直接使用生成的错误函数；生成不会改写现有手写 hook 和 Service。
+- 纠正旧文档误将事务 Outbox、分布式锁列为已实现的描述；这两个模块当前没有实现。
+
 ## v0.7.0-preview
 
 - 新增 `.api` 契约驱动生成器：DTO、严格多来源绑定与校验、路由、分组 Handler / Service / Repository、命名中间件及 OpenAPI；生成文件哈希管理、业务文件保护和只读 `--check`。
 - `new --api` / `api new` / `api generate` 可以组合 MySQL、日志以及 Local / S3 / R2 / OSS。保存初始基础设施选项，重生成自动沿用；显式切换已有项目选项会拒绝，避免静默丢失初始化代码。
 - 新增 `examples/userService` 独立业务示例与 `verifyAPIWorkflow.py`：用户 CRUD / 分页、管理员 Token 鉴权、MySQL 事务审计、故障回滚、文件导出、requestId 日志、数据库 readiness 和优雅退出；支持从远程版本验收。
 - 日志新增文件轮转、结构化敏感字段脱敏、异常堆栈及慢请求配置；存储新增统一上传策略、直传签名和云端分片能力。
-- 新增缓存、HTTP 客户端、限流 / 幂等 / 超时、后台任务、Redis 队列、事务 outbox、分布式锁、审计、迁移与 telemetry 等可选模块；业务身份与 Orbit 保持由应用自行组合。
+- 新增缓存、HTTP 客户端、限流 / 幂等 / 超时、后台任务、Redis 队列、审计、迁移与 telemetry 等可选模块；业务身份与 Orbit 保持由应用自行组合。
 - `database.ApplyEnv` 支持文件/默认配置叠加环境变量；数据库配置使用 lowerCamelCase，DSN 不参与 JSON/YAML 序列化。
 - 修复 native 在业务层提前拒绝请求体为 413 时等待继续读取 body 的问题，拒绝后关闭未读连接。
 

DEVELOPMENT.md

@@ -0,0 +1,319 @@
+# 通用业务开发指南（v0.16.0-preview）
+
+从 [README](README.md) 创建服务后，业务主要维护 `.api`、配置、`svc.Init`、Logic、Repository 和项目中间件。本页说明通用接入能力；字段、错误码、权限、表结构和事务边界都由项目定义。
+
+## 返回数组、可空对象和 null
+
+```text
+@handler list
+get /items returns ([]Item)
+
+@handler find
+get /item returns (*Item)
+
+@handler save
+post /item returns (null)
+
+@handler remove
+delete /item
+```
+
+| 契约 | Logic 返回 | 成功数据 |
+| --- | --- | --- |
+| `returns (Item)` | `(*types.Item, error)` | 对象；nil 被视为实现错误 |
+| `returns ([]Item)` | `([]types.Item, error)` | 对象数组；nil 统一输出 `[]` |
+| `returns ([]string)` | `([]string, error)` | 字符串数组 |
+| `returns ([]int64)` / `([]bool)` | `([]int64, error)` / `([]bool, error)` | 数值 / 布尔数组 |
+| `returns ([]any)` | `([]any, error)` | 动态 JSON 数组，元素允许对象、数组、标量和 null |
+| `returns (*Item)` | `(*types.Item, error)` | 对象或 `null` |
+| `returns (null)` | `error` | HTTP 200 和空业务数据 |
+| 不写 returns | `error` | HTTP 204，无响应体 |
+
+统一响应中的空数据是否显示，仍遵循项目模板的 `dataMode`；需要 `data:null` 就设置 `dataMode: always`。`@response raw` 输出业务数据本身，包括 `[]`、对象或 `null`。可用 `@status 201/202`；204 不能声明响应类型。嵌套字段继续支持既有 slice/map/pointer/scalar/any。
+
+基础类型数组还支持 int/int8/int16/int32、uint/uint16/uint32/uint64、float32/float64。nil 根数组都输出 `[]`；`[]any` 在 OpenAPI 中是 `type: array, items: {}`，不限制元素形状，但元素必须可被标准 JSON 编码器序列化。`[]uint8`（Go 的 byte slice）会编码为 base64，故明确拒绝；数字数组可用 `[]int32`，二进制用下载接口。当前不支持根嵌套数组或根自定义 scalar 数组。
+
+## 契约驱动的请求策略
+
+入口文件可以声明默认策略，单个接口按需覆盖：
+
+```text
+@app (
+    defaultResponse: CommonResponse
+    request: {"unknownQuery":"reject", "utf8":"reject", "charset":"utf8"}
+)
+
+@handler create
+@request (body: required)
+post /items (CreateReq) returns (Item)
+
+@handler touch
+@request (body: emptyObject)
+post /touch returns (null)
+```
+
+- `unknownQuery: reject|ignore`：是否拒绝未声明的 URL 查询字段；重复标量仍拒绝，数组用重复的同名 query。
+- `utf8: reject|replace`：拒绝原始非法 UTF-8，或采用 JSON 的替换字符行为。不是只检查解码后的字符串。
+- `charset: utf8|any`：`utf8` 仅接受未声明 charset 或 `utf-8`；不会对其他编码做转码。
+- `body: auto|required|optional|none|emptyObject`：auto 按 JSON 字段推断；required 要求一个对象；optional 允许完全没有 body，但提供 body 后仍完整校验；none 禁止任何 body 字节；emptyObject 必须是 `{}`。
+
+未设置的项继承 App 的 `config.Config.Request`，最后采用既有默认行为。`.api` 的 `@app` 显式字段优先于项目配置；路由 `@request` 优先于 App。raw/multipart 使用各自解析流程，不能套 JSON body 策略。普通 JSON 只解析一次；重复/未知 JSON 字段、约束、scalar 和 `any` 仍使用同一编译器。自定义 binder/manual Handler 的输入逻辑由项目显式负责。
+
+没有 body 与提供 `{}` 不等价。optional 无 body 时 JSON 字段保留零值；需要业务区分是否出现某字段时使用 optional 指针字段。raw/multipart 不继承 App 的 JSON body 策略；GET/HEAD 如遇 App 的 required/optional/emptyObject 默认值，须明确覆盖为 auto 或 none。参数校验不会替代企业权限、记账规则或数据库约束。
+
+## 声明式 multipart
+
+```text
+type UploadReq {
+    Title string `multipart:"title" binding:"required,max=80"`
+    Metadata AttachmentMeta `multipartJSON:"metadata,maxBytes=16384"`
+    Attachment File `file:"attachment,maxBytes=10485760"`
+    Extras []File `file:"extras,optional,maxFiles=3,maxBytes=1048576"`
+}
+type AttachmentMeta {
+    Category string `json:"category"`
+}
+
+@handler upload
+@body (mode: multipart; maxBytes: 16777216; maxParts: 8; maxFieldBytes: 65536)
+post /attachments (UploadReq) returns (AttachmentResp)
+```
+
+Logic 直接得到 `*types.UploadReq`，无需维护 Handler。`form` 仍表示 URL query；`multipart` 表示文本表单字段，可用基础类型、文本 scalar 和重复 scalar 数组；`multipartJSON` 是一个严格解码的 JSON 表单字段，可包含对象、数组和已声明的 scalar。
+
+`File` 提供 `Name`、`ContentType`、`Size`、`Present()` 和 `Open() (io.ReadCloser, error)`。文件名和媒体类型属于客户端元数据，项目继续决定内容检测、存储权限和目标对象名。不要把客户端文件名直接用作存储路径。
+
+```go
+reader, err := req.Attachment.Open()
+if err != nil { return nil, err }
+defer reader.Close()
+// 将 reader 传给项目选定的流式存储接口；不要先 io.ReadAll 整个大文件。
+```
+
+所有声明字段、重复/未知字段、文件数量和各级限额都会在进入 Logic 前校验。缺少必填项、重复标量/JSON 字段、文件与文本类型混用、畸形 JSON 均失败。JSON 的类型、未知字段和重复 key 检查与普通 JSON 一致。
+
+默认总量 1 MiB、最多 128 个 part、单文本/JSON 字段 64 KiB；单文件默认受总量约束，文件数组默认最多 16 个。`@body` 可设置 `maxBytes/maxParts/maxFieldBytes/maxFileBytes`；字段上的 `maxBytes/maxFiles` 再收紧对应限额。总量包括 MIME 头和结尾数据；传输编码的 part 被拒绝，避免字节含义不明确。
+
+文件使用有界复制写入权限为 0600 的临时文件，文本/JSON 字段在各自限额内缓冲。生成 Handler 返回或 panic 时关闭打开的文件 reader 并删除临时文件；不能把请求的 File 留到异步任务使用。失败不会交付半个 DTO，也不会进入 Logic。临时磁盘容量、并发请求上限与 HTTP 超时由部署配置共同约束。
+
+不声明 multipart 字段时，保留原来的 `body *httpx.Body` 流式入口，不创建临时文件。该方式适合特殊协议；项目应在不可撤销副作用之前完成校验并调用 `body.Complete()`。下载和原始回调继续使用 `@produces` / `@body(mode: raw)`。
+
+## 完整业务配置的环境覆盖
+
+生成项目默认执行：代码与 `envDefault` 默认值 → JSON/YAML 文件 → 全结构体环境覆盖 → 既有框架环境别名 → `Validate`。增加业务字段不需要另外写 `os.Getenv`。
+
+```go
+type ClientConfig struct {
+    Endpoint string        `json:"endpoint" env:"CLIENT_ENDPOINT,required"`
+    Token    string        `json:"-" env:"CLIENT_TOKEN,required,secret,empty=reject"`
+    Timeout  time.Duration `json:"timeout" envDefault:"3s"`
+    Retries  []int         `json:"retries"`
+    Enabled  bool          `json:"enabled"`
+}
+```
+
+把字段加入项目 `Config` 后，默认环境名取 `GO_OMNI_` 加 JSON 路径的 UPPER_SNAKE_CASE，如 `GO_OMNI_CLIENT_TIMEOUT`。显式 env 名是完整名称，可以使用自己的业务前缀。`env:"-"` 排除整个子树；`json:"-"` 字段只有显式 env 标签才参与。
+
+duration 使用 `250ms`、`3s`；slice/map 使用 JSON，如 `[1,3,5]`、`{"retry":"2s"}`。支持嵌套、零/false、空数组、自定义 TextUnmarshaler。空环境值默认允许；可选择 `empty=ignore` 或 `empty=reject`。required 要求字符串非空、指针/集合非 nil；0 和 false 可以是合法业务值，范围由项目 Validate 决定。
+
+手写项目可使用 `config.LoadProject(path, defaults, config.EnvOptions{Prefix:"MY_APP_"})`，或分别调用 `ApplyDefaults/DecodeFile/OverlayEnv`。读取失败不修改输入默认值；诊断不会打印输入值。不要主动打印含密钥的整个配置，或把底层解析错误展开到公开响应。Validate 不打开日志文件、数据库或存储连接；证书的可读性和握手信任在依赖初始化阶段验证。
+
+### 一次覆盖完整配置与 HTTP/日志短名称
+
+```go
+cfg, err = config.OverlayEnv(cfg, config.EnvOptions{
+    Prefix: "MY_APP_",
+    Empty: "reject", // allow / ignore / reject，项目自行选择
+    Aliases: config.ServerEnvAliases("MY_APP_", "server"),
+    // Lookup 可注入测试或项目配置源；默认 os.LookupEnv。
+})
+```
+
+不要再紧接着调用 `ApplyEnv(cfg.Server, ...)`。上面的调用同时处理完整配置和 HTTP_ADDR、SERVICE、LOG_LEVEL 等框架短名称。例如 `MY_APP_SERVER_ADDRESS` 与 `MY_APP_HTTP_ADDR` 指向同一字段，**完整名称优先**；未设置时才读取短名称。完整名称显式设空仍优先：allow 交给该字段解析（string 可清空；数字等仍要求合法值），ignore 保留文件/默认值，reject 报错。不会因 ignore 再退回别名。字段 `env` 标签的 empty 规则优先于全局规则。
+
+自定义别名用 `EnvOptions.Aliases`，键是完整环境名、值是按优先级排列的别名数组。两种名称都使用同一 Lookup、空值策略和类型转换；布尔 false、数值 0 与未设置不同。集合始终使用 JSON，包括 `MY_APP_TRUSTED_PROXIES='["127.0.0.1"]'`。
+
+新项目模板一次调用 OverlayEnv，默认 `Empty: "ignore"`。旧 `ApplyEnv` 保留原有忽略空值、修剪空白及 TRUSTED_PROXIES 逗号列表行为。已有项目的 `internal/config` 属于开发者文件，升级不覆盖它；按上例合并原来的两次覆盖调用后，保留项目自己的 Validate。日志输出的显式完整名称也优先于短名称。
+
+## 依赖、日志与中间件
+
+`internal/svc/runtimeGen.go` 持续由生成器维护。项目的 ServiceContext 嵌入 `*lifecycle.Runtime`，只在 `Init(ctx)` 中装配额外依赖：
+
+```go
+func (c *ServiceContext) Init(ctx context.Context) error {
+    client, err := NewClient(c.Config.Client)
+    if err != nil { return err }
+    c.Client = client
+    c.OnClose(client.Close)
+    c.Middlewares["RequireAccess"] = middleware.NewRequireAccess(client)
+    return nil
+}
+```
+
+每个资源初始化成功就登记清理；后续初始化失败自动逆序回滚。正常退出先排空 HTTP 请求，再执行后台组件的 Stop/Drain 阶段，确认收尾后逆序关闭依赖，最后关闭日志。关闭幂等，单个清理函数 panic/返回错误不会跳过其他清理；初始化 panic 清理后继续传播。后台组件按 [分阶段关闭](lifecycle/README.md#后台组件分阶段关闭) 登记；无法确认收尾完成时保留共享依赖并异常退出，不能把取消等同于任务已经结束。
+
+中间件用业务所需的小接口接收依赖，避免反向导入 svc：
+
+```go
+// internal/middleware/accessFactory.go
+package middleware
+
+import (
+    "context"
+    "git.yuntuo.hk/k2safe/go-omni/httpx"
+)
+
+type AccessChecker interface {
+    CheckAccess(context.Context, string) error
+}
+func NewRequireAccess(checker AccessChecker) httpx.Middleware {
+    return func(next httpx.Handler) httpx.Handler {
+        return func(c *httpx.Context) error {
+            if err := checker.CheckAccess(c.Context(), c.Header("Authorization")); err != nil {
+                return err
+            }
+            return next(c)
+        }
+    }
+}
+```
+
+`.api` 声明对应 middleware 后，保留生成的初始 hook，并另建上述工厂；在 Init 用工厂替换 registry 的同名项即可。该包只依赖接口和 HTTP 抽象，不导入 svc，也不把数据库藏到 context 里。
+
+生成入口为每个 App 注入独立 Logger，不修改进程默认 Logger。业务可用 `c.Logger.InfoContext(...)`，或请求链中的 `logx.InfoContext(ctx,...)`。标准库/第三方需要 `*log.Logger` 时使用 `c.Logger.Standard(slog.LevelWarn)`；适配器借用原 Logger，不负责关闭。手写多 App 用 `omni.WithLogInstance(logger)` 显式注入。
+
+`httpx.Metadata(ctx)` 在业务的标准 context 中提供可信代理规则解析后的 ClientIP、HTTP Method 和路由模板；不放入凭据、完整 URL、查询或 body。业务 userId/tenantId 等仍由项目选择，框架不预设身份模型。
+
+`middleware.ContextErrors("REQUEST_CANCELED", "REQUEST_TIMEOUT")` 可将原始取消/超时错误映射到项目错误目录；显式 APIError 优先，内部 cause 链保留。状态、业务码与提示仍在项目 Catalog 配置。
+
+## 字段文档、格式化、Go 错误目录导出
+
+```text
+type Item {
+    // 企业名称
+    Name string `json:"name" example:"示例企业"`
+    State int `json:"state,options=0|1" example:"1" enumDescriptions:"[\"禁用\",\"启用\"]"` // 状态
+}
+```
+
+字段前/同行注释同步到 Go 注释和 OpenAPI description。显式 `description` 标签优先；example 的基础字段值也检查类型和约束，枚举说明按声明值顺序填写。字符串 example 直接写内容，其他类型写 JSON。自定义 scalar 的示例不能替代其项目解码器验证；输入输出类型不同时，不把输入示例冒充输出示例。
+
+```sh
+go-omni api format --api api/service.api
+go-omni api format --api api/service.api --check
+go-omni api generate
+go-omni api generate --check
+```
+
+格式化保留注释、token 和多行字面量，规范四空格缩进、空行、行首尾空白及相邻单行字段的类型/标签/行尾注释对齐；结果幂等。先校验完整契约，check 不写文件；导入的共享目录不被某个服务的格式化命令修改。DTO 按源 `.api` 输出 `dto<Source><摘要>Gen.go`，都属于 `types` 包，跨文件引用无需改包名。
+
+Go Catalog 是错误的唯一来源时，优先使用 workspace 的显式导出配置，不再维护导出/复制脚本。AppOptions 仍通过 `omni.WithErrors(apierrors.Catalog())` 注册同一个 Go 函数，运行期只注册一次。单个项目也可继续使用 `errors.ExportCatalog` 导出入口目录的 `api/omni.errors.json`；此文件和下面的共享 source 二选一。
+
+OpenAPI 自动把有收益的重复响应、schema 和示例移到 `components.responses/schemas/examples`，通过标准 `$ref` 引用。HTTP 200 同时含成功和业务失败时保留两种 schema、业务码、模板参数示例和 data:null；业务响应内容不会改变。消费 OpenAPI 的工具需要支持标准本地引用。
+
+## 两个服务共享契约
+
+```text
+workspace/
+├── contracts/common/response.api
+├── services/api/api/service.api
+├── services/api/api/omni.imports.json
+├── services/id/api/service.api
+├── services/id/api/omni.imports.json
+└── omni.workspace.json
+```
+
+两个服务的 `omni.imports.json` 可以分别声明：
+
+```json
+{"roots":{"common":{"path":"../../../contracts/common","version":"1.0.0"}}}
+```
+
+```text
+import "@common/response.api"
+```
+
+只读取入口目录和显式声明的根。保留真实路径检查、symlink 越界拒绝、循环检测、32 层、64 文件、单文件 1 MiB/总量 8 MiB 限额；最多 16 个共享根。不会下载依赖或复制共享定义进服务。移动目录时显式更新 roots。
+
+`version` 是项目管理的版本标签。生成文档记录每个文件 SHA-256，以及每个共享根所导入文件集合的摘要；可把文档中的 `x-omni-contract-sources.shared.common.sha256` 填入 root 的 `sha256`，固定输入集合，内容变化后必须显式更新。摘要算法是对“该根内相对路径→文件 SHA-256”的键排序 JSON 对象再做 SHA-256，未导入的文件不参与。
+
+工作区清单：
+
+```json
+{"services":[{"dir":"services/api"},{"dir":"services/id"}]}
+```
+
+```sh
+go-omni workspace format --file omni.workspace.json
+go-omni workspace generate --file omni.workspace.json
+go-omni workspace check --file omni.workspace.json
+```
+
+各服务保持独立 module；可显式填写各服务的 `api`（相对服务目录）和 `module`。所有服务预检通过后再写；每个服务独立提交文件事务，不承诺跨项目的崩溃原子性。check 汇总格式与生成漂移；业务编译/测试仍在各 module 执行。
+
+### 同一份 Go 错误目录供多个服务生成
+
+在 workspace 清单显式声明提供目录的 Go 包和函数：
+
+```json
+{
+  "errorCatalogs": [{
+    "dir": ".",
+    "package": "example.com/project/internal/apierrors",
+    "function": "Catalog",
+    "output": "contracts/common/errors.json"
+  }],
+  "services": [{"dir":"services/api"}, {"dir":"services/id"}]
+}
+```
+
+`dir` 相对 workspace，必须包含 go.mod；函数签名为 `func Catalog() errors.Catalog`。允许 module 内的 internal 包。先准备 output 的父目录。生成器构建一个临时导出程序，使用 Go overlay、临时 go.mod/go.sum 和 `-mod=readonly`，不会往项目增加导出命令或修改 go.mod/go.sum。最多 16 个提供方，每个有 90 秒构建/执行总时限和 1 MiB stdout 限制。错误消息不回显程序输出。
+
+只有显式运行 **workspace generate/check** 会执行清单指定的 Go 包及其依赖初始化；不要指向不信任的包。提供目录的函数应只构造目录，不连接数据库、启动服务、写 stdout 或修改项目。框架不扫描其他包，也不通过 shell 执行配置字符串。普通 api validate/export/generate 和 workspace format 只读取现有元数据。
+
+各服务在自己的 `api/omni.imports.json` 引用共享 JSON：
+
+```json
+{
+  "roots": {"common":{"path":"../../../contracts/common","version":"1.0.0"}},
+  "errors": {
+    "source": "@common/errors.json",
+    "include": ["USERNAME_INVALID", "INTERNAL_ERROR"],
+    "routes": {"GET /permissions":["INTERNAL_ERROR"]}
+  }
+}
+```
+
+`include` 省略或 null 表示全部目录，`[]` 表示不列业务错误；routes 按 **大写方法 + 空格 + .api 原路径**（如 `GET /users/:id`）覆盖服务级列表。错误标识、路由拼错或重复标识会明确报错。路由已经通过 `.api @errors` 声明独立运行期目录时，不能再给它设置文档 routes 列表。
+
+**这些列表只决定文档展示，不修改 App 错误目录、路由继承或运行期可返回的错误。** `.api` 不需要重复定义 Go 错误表。状态、业务码、提示和模板参数仍来自同一 Catalog；特殊自定义 Encoder 的文档由项目显式扩展。
+
+```sh
+# 首次生成导出一次共享目录，所有服务预检通过才写入
+# 共享 JSON 不复制到各服务；已有 api/omni.errors.json 请显式移除后改用 source。
+go-omni workspace generate --file omni.workspace.json
+go-omni workspace format --file omni.workspace.json
+go-omni workspace generate --file omni.workspace.json
+go-omni workspace check --file omni.workspace.json
+```
+
+共享 JSON 应纳入版本控制。check 在内存重新导出并比较 JSON，然后检查所有服务；缺失或过期时失败，不更新项目文件。Go 构建缓存仍可能更新；显式提供方的自有副作用不属于生成器可隔离范围。业务 CI 仍执行各 module 的编译与测试。目录函数本身有变化时重新 generate，受控共享根的固定 SHA256 如需改变仍由项目显式更新。
+
+## v0.13 项目升级
+
+先使用与目标框架匹配的 CLI；CLI 会提示与 go.mod 不同的版本。当前生成模板至少需要 v0.16.0-preview（或显式引用当前源码）。
+
+```sh
+go-omni api upgrade --dir . --dry-run
+go-omni api upgrade --dir . --preview .goOmni/upgradePreview
+# 只有标为 safe 的原始模板才会自动替换；review 阻止全部写入。
+go-omni api upgrade --dir . --apply
+go mod tidy
+go-omni api generate --check
+go test ./...
+go build .
+```
+
+自动迁移只替换与 v0.13 原始模板一致的配置/svc 基础文件、移除原始 close.go，并更新最低依赖及生成产物；保留 Logic、Repository、AppOptions、独立命令。迁移失败回滚已改的项目文件。存在业务修改时，仅输出这些基础文件的候选版本和清单，不生成整棵业务代码让人重新拼接。
+
+定制项目按预览定点迁移：保留依赖字段，把初始化移到 Init，嵌入 Runtime，清理改为 OnClose 登记；移除旧 New/Close/OnClose；合并业务配置和结构化 MySQL 配置，更新 go.mod，再正常 generate。生成器会拒绝遗留构造/关闭实现，避免重复函数或悄悄绕过清理。v0.12 及更早的定制结构不能被精确自动合并，使用同一预览逐项迁移并编译验证。

MIGRATION.md

@@ -0,0 +1,182 @@
+# 已有 HTTP 项目逐步接入
+
+从 `v0.9.0-preview` 开始，以下能力贯通运行时、`.api`、代码生成和 OpenAPI。CLI 和项目框架依赖一起升级；入口见 [README](README.md)。这些都是通用扩展点，框架不内置任何项目的 ID、支付回调、鉴权或数据库规则。
+
+## 1. 保留标准 Handler 与中间件
+
+```go
+app := omni.New(omni.WithLogger(true))
+app.Use(httpx.WrapMiddleware(existingMiddleware)) // func(http.Handler) http.Handler
+// go-zero 风格的 func(http.HandlerFunc) http.HandlerFunc：
+app.Use(httpx.WrapFuncMiddleware(existingFuncMiddleware))
+app.POST("/legacy", httpx.WrapHandler(http.HandlerFunc(existingHandler)))
+```
+
+实际使用时先配置所有 `Use`，再注册路由。`WrapHandler` 也接受 `http.FileServer` 等标准 `http.Handler`。
+
+- Handler 经过 App 的日志、requestId、恢复和应用中间件链，原来的 URL、状态码、Header、响应内容由它自己控制。
+- `c.Raw()` 的写入也会更新 `c.Status()` / `c.Responded()`；404 会记为 404。提交响应后返回错误或 panic，不会再追加错误 JSON。103 等临时响应不算最终提交。
+- 桥接器不缓存完整响应。下载继续流式复制；底层支持时保留 Flusher、Hijacker、Pusher、ReaderFrom、CloseNotifier。`http.ResponseController` 可沿 `Unwrap` 访问底层控制能力。能力仍取决于网络适配器和其他中间件。
+- 请求 context、取消信号和已有值继续传递，Omni 的路径参数可用 Go 1.22 的 `r.PathValue("id")` 读取。其他框架私有的参数读取器仍需由项目适配。标准中间件应从原 `r.Context()` 派生上下文；不能换成无关的 Background，也不能在 ServeHTTP 返回后调用 next。异步 timeout middleware 不在此桥接器的契约内。
+- 标准中间件在每条注册链构造一次，状态会跨请求保留。下游返回的错误在标准中间件退出前编码，因此压缩、审计等中间件能处理错误响应。它们自己的缓冲或改写行为仍由项目负责。
+
+调用流使用 `App.Handle/GET/POST` 等入口即可，不要绕到原始 Router 注册。暂不使用 `.api` 的旧接口也能这样接入。
+
+## 2. 动态 JSON：允许渐进补全 DTO
+
+```go
+type LegacyReply {
+    Data any `json:"data"`
+}
+```
+
+`interface{}` 是 `any` 的等价写法，支持 `[]any`、`map[string]any` 和对应的 `interface{}` 写法。带方法的 interface 不支持，会提示明确的类型错误。
+
+动态字段允许 object、array、string、number、bool、null；OpenAPI 字段 schema 为 `{}`，不假装知道内部结构。它放开的是**该字段的内容**，外围 DTO 未声明的字段仍被拒绝，JSON 重复键、深度、总大小限制仍生效。动态数字解析为 `json.Number`，避免大整数先转 float64 丢精度。原始 JSON 的空白、转义和字节布局不会保留；验签请走原始 body 入口。
+
+这不会自动补齐缺少的业务路由，也不代表兼容全部 goctl 语法。能确定结构的新接口优先使用命名 DTO。
+
+## 3. 按路由限制 body 与保留手写入口
+
+普通 JSON 路由只声明需要的大小，不改变其他路由默认的 1 MiB：
+
+```text
+@body (mode: json
+    maxBytes: 2097152
+)
+@handler createItem
+post /items (CreateItemReq) returns (ItemResp)
+```
+
+`maxBytes` 单位为字节，允许 1 至 1 TiB；不写时为 1 MiB。已知超长或读取未知长度/chunked body 超限都按 413 处理。内置 App/RouterGroup 在全局中间件读取前安装 reader 限额；同时保持接口响应策略。网络层若有更小限额，以更小值为准。手写 Handler 吞掉读取错误或已经提交响应后，框架不能重新改写 HTTP 状态，务必检查读取错误。
+
+### 只替换绑定函数
+
+```text
+@binding custom
+@body (mode: json
+    maxBytes: 65536
+)
+@handler createItem
+post /items (CreateItemReq) returns (ItemResp)
+```
+
+首次生成 `internal/handler/<group>/createItemBind.go`：
+
+```go
+func (h *Handler) bindCreateItem(c *httpx.Context, req *types.CreateItemReq) error {
+    // 调用项目自己的解码器，填充 req；失败返回 error。
+}
+```
+
+Handler 继续调用 Service 并使用统一响应；只把绑定过程交给这个函数。初始 hook 返回 501，不能忽略实现。自定义绑定需自己实现 Content-Type、未知字段、尾部数据等校验，并遵守 DTO 文档；框架负责路由总大小限制，不隐式套第二次 JSON 绑定。
+
+### 上传、原文验签、下载
+
+```text
+@handlerMode manual
+@body (mode: multipart
+    maxBytes: 10485760
+)
+@handler upload
+post /files
+
+@handlerMode manual
+@body (mode: raw
+    maxBytes: 65536
+)
+@produces "text/plain"
+@handler callback
+post /callback
+
+@handlerMode manual
+@produces "application/octet-stream"
+@handler download
+get /download
+```
+
+首次生成 `<operation>Manual.go`，由项目实现整个 `func(h *Handler) Callback(c *httpx.Context) error`；依赖通过 `h.deps` 访问。生成器保留路由、中间件与文档管理，不会预读、JSON 解码或重新包装手写输出，也不生成这个路由的 Service 方法。需要调用 Service 时自行组合。
+
+- manual 无返回类型默认成功状态 200；也可 `returns (UploadResp)` 描述 JSON DTO，手写实现按声明调用 `c.OK` 等。`@produces` 用于无 DTO 的手写输出，描述成功响应媒体类型，不会自动设置运行时 Header。
+- raw 的文档为二进制请求体；multipart 为开放对象，具体文件字段与逐部分校验由项目实现。raw/multipart 请求 DTO 仅可含 path/form/header 字段，不能同时声明 JSON body 字段。`form` 始终指 URL query。
+- 原文验签直接读取 `c.Request().Body`，在声明的小限额内 `io.ReadAll`；大文件用 `MultipartReader` 配合 `io.Copy` 流式处理，不能整个读入内存。
+- 使用 `ParseMultipartForm` 时，其内存参数只是内存阈值，不是总上传限额。App/桥接器在请求结束（含错误和 panic）后删除临时文件；业务仍须关闭 `FormFile` 得到的文件。`MultipartReader` 不自动建临时文件，业务自行创建的文件由业务清理。
+- 手写 Handler 的成功输出由它控制；返回的 error、鉴权拒绝仍走接口的错误策略。三方若要求错误也返回指定文本，使用 [自定义 Encoder](RESPONSE.md#手写路由配置文件与三方回调) 并维护对应错误文档；`@produces` 不会改变错误协议。
+
+直接注册 Go 路由：
+
+```go
+app.HandleWithBodyLimit("POST", "/upload", 10<<20, nil, uploadHandler)
+// nil encoder 沿用 App 策略，也可传项目自己的 response.Encoder。
+```
+
+通用注册器使用 `httpx.HandleWithBodyLimit(...)`；实现 `httpx.BodyLimitRegistrar` 可像 App 一样在全局中间件前限流量，未实现时只能在路由中间件入口限制。单独 `httpx.LimitBody` 同样受中间件顺序影响。
+
+### 重新生成规则
+
+`handlersGen.go`、`routesGen.go`、DTO、OpenAPI 继续由生成器管理；`*Bind.go`、`*Manual.go` 只首次创建，后续不会覆盖或删除。切换 manual 回自动模式时，先迁移实现并自行移除对应 Manual 文件，否则生成器明确拒绝，避免重复方法。修改 DTO 导致手写函数签名不匹配时，需要一起调整项目代码；`go test ./...` 是必要检查。
+
+## 4. 自定义标量：项目定义行为，框架连接调用
+
+例如输入 ID 兼容数字/字符串、输出统一为字符串：
+
+```text
+scalar BusinessID (
+    goImport: "example.com/billing/internal/ids"
+    goType: ID
+    jsonInput: string | int64
+    jsonOutput: string
+    text: true
+)
+type ItemReq {
+    ID BusinessID `path:"id"`
+}
+type ItemResp {
+    ID BusinessID `json:"id"`
+}
+```
+
+`goImport`/`goType` 指向项目已有的具体 Go 类型，不是框架内置 ID。生成器创建类型别名和 `types.ContractScalars()`，然后把注册表显式传给每个 Binder。运行时使用标准接口：
+
+| 项目类型的方法 | 用途 |
+| --- | --- |
+| 值接收者 `MarshalJSON() ([]byte, error)` | JSON 输出 |
+| 指针接收者 `UnmarshalJSON([]byte) error` | JSON 输入 |
+| 指针接收者 `UnmarshalText([]byte) error` | `text: true` 时的 path/query/header |
+
+完整参考 [示例 ID 类型](examples/compatibility/ids/id.go)。CLI 校验声明并生成代码，不执行项目 Go 代码；启动时校验方法是否齐全，缺失会明确失败。
+
+输入可选 `string`、`bool`、`int32`、`int64`、`float64`，用 `|` 声明多个允许的 JSON 类型；输出只声明一个。框架先校验 JSON 类型和数字范围，再调用项目转换方法。字符串是否是合法 ID、是否允许空串或负数由项目方法决定，不能把数字溢出静默截断。path/query/header 实际传输文本，OpenAPI 对这些位置描述 string；query 切片通过重复键传递。
+
+普通字段不受注册影响，普通 `int64` 仍拒绝 JSON 字符串。没有全局注册表，也不会自动给所有 ID 放宽规则。标量可嵌套、放入切片/map，`*BusinessID` 允许 null；缺失默认必填，`optional`/`omitempty` 可选。标量的额外约束放在转换器中，目前不叠加 `binding`、default/options/range 等标签。
+
+请求 OpenAPI 按 `string | int64` 生成 `anyOf`，响应按 `string` 生成，避免把输入兼容误描述为输出也有两种类型。输出方法必须遵守声明，框架不会每次重新验证响应；项目需为自定义类型测试边界行为。
+
+不使用 `.api` 也可显式注册：
+
+```go
+binder := contract.MustNew[CreateReq](
+    contract.ScalarOf[ids.ID]("string|int64", "string", true),
+)
+// binder.Bind(c.Request(), httpx.RouteParams(c.Context()), &req)
+```
+
+## 可运行示例与验收
+
+```sh
+go run ./examples/compatibility
+curl -i http://127.0.0.1:8080/legacy
+curl -i -X POST http://127.0.0.1:8080/echo \
+  -H 'Content-Type: application/json' -d '{"id":9223372036854775807,"data":{"hello":true}}'
+curl -i -F file=@README.md http://127.0.0.1:8080/upload
+curl -OJ http://127.0.0.1:8080/download
+```
+
+完整契约：[compatibility.api](examples/contracts/compatibility.api)。生成项目起初的手写 hook 仍为 501；真实实现与原文 HMAC 验签回归见 [消费者 fixture](cmd/go-omni/apigen/testdata/compatibility)。
+
+```sh
+GO_OMNI_SCAFFOLD_INTEGRATION=1 go test -race ./cmd/go-omni/apigen -run Compatibility
+go test -race ./httpx ./contract
+```
+
+这些是框架验收，不代表任何业务项目已经迁移完毕；业务的路由覆盖、响应兼容、权限、资金事务和数据库行为需要业务自己的回归。

PROJECT.md

@@ -0,0 +1,229 @@
+# 生成项目与文件维护边界
+
+v0.16.0-preview 提供受管理的生成项目。安装同版远程 CLI，生成的项目直接引用该版本，无需本地 replace。根目录入口支持 `go run .` 和 `go build .`；框架本身仍然是可直接引用的库。安装和私有仓库访问见 [README](README.md#准备环境与安装)。
+
+## 创建和日常开发
+
+```sh
+# 在存放业务项目的目录执行，目标目录必须为空。
+go-omni new --module example.com/hello ./hello
+cd hello
+go mod tidy
+go run .
+go build .
+```
+
+在项目目录使用同版 CLI：编辑 `api/service.api`，运行 `go-omni api generate`，填写 `internal/logic` 的业务方法。增加接口、分组或具名中间件会自动更新接入代码，无需修改入口。`--dry-run` 预览；`--check` 只读检查，包括 main、HTTP 接入和 OpenAPI。API 文件通过相对 import 拆分模块。
+
+## 契约变更提示
+
+生成器在 manifest 中保存上次成功生成的接口快照，比较请求/返回类型、嵌套 DTO 字段与标签、自定义 scalar、路径、body 模式/限额和流式输出类型。只提示受影响的接口，并标出业务文件；删除或移动接口会提醒整理保留的旧实现。注释、文件排版、Logic 参数名与导入别名不会被当成接口变化。
+
+例如把 `GreetReq` 改名为 `HelloReq`，旧业务方法尚未修改时：
+
+```text
+ERROR [logicSignature] internal/logic/greet/greet.go:12 (GET /api/greet/:name): ...
+  before: Greet(context.Context, *types.GreetReq) (*types.GreetResp, error)
+  after:  Greet(context.Context, *types.HelloReq) (*types.GreetResp, error)
+```
+
+| 命令 | 变更提示与检查行为 |
+| --- | --- |
+| `api generate --dry-run` | 显示计划、契约变化和业务签名问题，不写文件；诊断本身不让预览失败 |
+| `api generate` | 更新生成文件和契约快照，保留业务代码，并显示需要处理的诊断；生成成功不代表业务已通过编译 |
+| `api generate --check` | 只读检查；生成产物过期或发现明确的 Logic 签名/语法/重复方法错误时返回非零退出码 |
+| `api validate` | 只验证 `.api`，不检查项目 Go 实现 |
+
+`REVIEW` 提醒复查业务语义；`ERROR` 表示已发现源代码问题。生成后，旧签名仍会在后续 `--check` 中报错，直到你改好；DTO 字段变化的 REVIEW 与上次生成快照比较，生成后不持续要求确认，也不会替你修改业务。业务方法移到同组其他 Go 文件时仍能定位。
+
+这是轻量源码分析，不运行项目 init、不执行 Go 命令、不下载依赖。项目自定义类型别名、嵌入方法或 build tags 等无法可靠判断时，会给 REVIEW 并交给 Go 编译器验证；不把这些情况强行判为签名错误。它不检查方法体是否引用已删除字段，也不证明业务逻辑正确。CI 中应同时执行 `go-omni api generate --check` 和 `go test ./...`，按项目实际构建参数测试。当前版本首次接手缺少快照的 manifest v2 时，会明确提示建立基线，不猜测旧契约；Logic 签名检查仍会执行。
+
+## 哪些文件由用户维护
+
+| 文件 | 首次生成后由项目维护 |
+| --- | --- |
+| `api/*.api` | 路由、DTO、具名中间件、响应模板、请求/响应模式 |
+| `etc/config.yaml` | 运行参数；密钥通过环境变量提供 |
+| `internal/config/config.go` | 自定义配置字段、加载、默认值与校验 |
+| `internal/svc/serviceContext.go` | 依赖字段和初始化，持有加载后的 Config |
+| `internal/svc/options.go` | AppOptions、GlobalMiddleware；注册 Go 错误目录和全局扩展 |
+| `internal/svc/databaseOptions.go` | 可选 MySQL 驱动与项目启动检查扩展 |
+| `internal/svc/storage.go` | 选用存储时生成，之后保留 |
+| `internal/logic/<group>/*.go` | 业务方法，使用标准 context.Context |
+| `internal/repository/<group>/*.go` | 数据访问，按需实现 |
+| `internal/middleware/<name>.go` | 项目鉴权/权限等具名中间件实现 |
+| 项目 Go 错误包 | 自行维护 Catalog 和常量，可跨服务共用 |
+| 自定义标量文件、`*Bind.go`、`*Manual.go` | 只有显式选择相应扩展时才生成/使用 |
+| 项目测试、迁移、部署脚本、go.mod/go.sum | 项目所有，生成器不重置其内容 |
+
+以上骨架只补缺失文件，既有内容按字节保留。删除已废弃接口后，对应业务文件也不会被自动删除；由开发者整理编译器指出的失效类型或签名。
+
+生成器持续管理：`internal/svc/runtimeGen.go`、`main.go`、`internal/handler/*Gen.go`、分组的 `handlersGen.go`、`internal/types/*Gen.go`、中间件 `registryGen.go`、`docs/openapi.json`、`.goOmni/apiManifest.json`。如果在 `.api` 里选择声明错误，还会管理 `internal/apierrors/errorsGen.go`。文件标注 DO NOT EDIT；手改会被拒绝覆盖，需先移走自定义内容。
+
+Logic 实例在注册时创建并由请求并发复用；请求数据用方法参数和局部变量传递，不存入共享 Logic/svc 字段。
+
+普通 Handler 不需要维护。目录内可以同时有生成文件和单独的手写扩展文件，所有权按文件区分。没有额外 server 包或第二层 service。
+
+## 依赖与启动扩展
+
+`svc.New(ctx, logger, cfg)` 初始化依赖，可返回错误；Logger 由入口创建并借用。New 本身由生成器维护；新增客户端时扩展配置和 svc 的 `Init(ctx) error`：
+
+```go
+client, err := newClient(c.Config.Client)
+if err != nil { return err }
+c.Client = client
+c.OnClose(client.Close) // 创建成功后立即登记，后续失败也能释放
+```
+
+ServiceContext 嵌入 `*lifecycle.Runtime`；框架维护锁、清理栈和失败回滚，项目不再复制 Close/OnClose 实现。OnClose 按登记的相反顺序执行；Close 幂等。项目不要重复关闭同一资源，借用的 Logger 也不应由 svc 关闭。构造器在返回错误前若创建了尚未交付的资源，该构造器自己负责释放。
+
+错误注册写在 `internal/svc/options.go`，错误表可以来自任意项目共用包：
+
+```go
+func (c *ServiceContext) AppOptions() []omni.Option {
+    return []omni.Option{omni.WithErrors(apierrors.Catalog())}
+}
+```
+
+业务调用 `omnierrors.ByCode(apierrors.CodeUsernameInvalid)`，可接 `WithParams` / `WithCause`。无需在 `.api` 重复错误目录。未声明独立错误目录的路由继承 App 目录；独立目录不与 App 合并。普通 `.api` 编译不执行 Go；可在 workspace 显式配置 Catalog 函数，统一导出共享文档元数据，也可沿用 `api/omni.errors.json`，详见 [元数据导出](DEVELOPMENT.md#字段文档格式化go-错误目录导出)。
+
+`GlobalMiddleware()` 提供全局中间件；`Middlewares` 映射提供 `.api` 声明的具名中间件。全部显式调用，不依赖项目 init 注册，也不要求 svc 导入 handler。框架请求链按原有次序运行。
+
+生成入口执行：配置加载/校验 → 日志 → svc.New → 生成的 handler.NewApp（应用 AppOptions、响应策略、校验最终 HTTP 配置、全局中间件、全部路由）→ App.RunContext → 依赖关闭 → 日志关闭。初始化失败、接入配置失败和监听失败也清理资源。
+
+最终配置校验包含自定义响应编码器与错误目录的组合。码类型/映射冲突、编码器已绑定另一份目录等问题在创建 App 前返回错误，进入入口的清理流程，不等到构造 App 时才 panic。
+
+日志在 AppOptions 前初始化，其配置应放在 Config 中。退出信号先触发 HTTP 排空；达到 shutdownTimeout 后按框架规则强制关闭连接。请求仍依赖的后台任务/客户端不能直接绑定信号 context 提前关闭，应持有独立生命周期，使用 WorkContext 并登记成对的 OnStop/OnDrain，详见 [分阶段关闭](lifecycle/README.md#后台组件分阶段关闭)。业务必须响应请求 context 取消；忽略取消的 goroutine 无法保证在超时前结束。
+
+## 依赖主动申请退出
+
+从 v0.13.0-preview 起，生成的 svc 提供 `RequestShutdown(err)`。数据库客户端、节点租约、后台任务等发现不可恢复故障时，由项目决定是否退出：
+
+```go
+// 在 svc 的依赖监控回调中调用；err 是实际故障原因。
+c.RequestShutdown(err)
+```
+
+这只是通知，立即返回，不等待 HTTP 排空，也不直接关闭数据库。生成入口停止接收新请求，等待在途请求完成；超过 `shutdownTimeout` 后取消请求并关闭连接，再执行 svc.Close，最后关闭日志。非空故障原因保留在返回错误链中，进程退出码为 1；`RequestShutdown(nil)` 或正常 SIGINT/SIGTERM 在没有其他故障时退出码为 0。
+
+多个依赖可并发通知，关闭流程仅执行一次，首个非空故障原因保留。正常信号已开始排空时收到的故障也不会被清理动作覆盖。初始化期间的通知同样有效，不依赖 HTTP 监听已经启动。后台监控任务应通过 OnStop/OnDrain 停止并等待，再进入资源清理；关闭完成以后才报告的故障无法参与已经结束的进程结果。
+
+`Lifecycle *lifecycle.Controller` 是 svc 持有的通用控制器，初始化时创建，生成入口使用它的 Context。该 Context 表示服务正在停止，不代表数据库已经关闭。不能把它当作在途请求的 Context，也不要在它取消时立刻关闭请求仍依赖的资源。发号器失去租约后拒绝发号等业务安全规则仍由项目实现。
+
+## 配置内置接口
+
+生成项目在 `etc/config.yaml` 明确列出以下默认配置；可以独立关闭、修改路径，或让健康接口返回原始 JSON：
+
+```yaml
+server:
+  endpoints:
+    liveness:
+      enabled: true
+      path: /health/live
+      responseMode: app
+    readiness:
+      enabled: true
+      path: /health/ready
+      responseMode: app
+    openapi:
+      enabled: true
+      path: /openapi.json
+```
+
+`responseMode: app` 使用项目 App 的响应模板/自定义 Encoder。健康成功使用项目成功码和成功提示；未就绪的 `NOT_READY` 可在项目 Go 错误目录配置业务码和公开提示，无需在 `.api` 再声明。
+
+健康探针的 HTTP 状态固定遵循探针语义：存活/就绪为 200，未就绪为 503；项目错误目录或自定义编码器不能把未就绪改为 HTTP 200。响应模板 `${status}` 同样使用探针状态。失败继续进入业务失败日志/指标，探针底层原因保留在错误链供日志使用，不直接返回给调用方。
+
+`responseMode: raw` 返回 `{"status":"ready"}` 等健康数据，有依赖时包含检查名称、结果与耗时；不包装公共体。存活检查不执行依赖探针；服务开始退出后，就绪检查返回 503，存活仍可返回 200，直到监听关闭。OpenAPI 始终输出规范文档本身，不使用业务响应包装；关闭 HTTP 文档端点不影响生成 `docs/openapi.json`。
+
+环境变量覆盖配置文件，例如 `GO_OMNI_ENDPOINTS_READINESS_PATH=/readyz`、`GO_OMNI_ENDPOINTS_READINESS_RESPONSE_MODE=raw`、`GO_OMNI_ENDPOINTS_OPENAPI_ENABLED=false`；liveness/readiness/openapi 都支持对应的 ENABLED 和 PATH。Config/AppOptions 的最终有效配置决定是否注册。
+
+关闭或改名后，旧路径不再由框架保留，项目可以在 `.api` 自己声明。启用的内置 GET 路由与业务路由相同或被业务参数/通配路径覆盖时，在创建 App、开始监听之前报错；不会覆盖业务路由。内置接口仍经过全局中间件；项目在鉴权中间件中明确决定这些路径的访问规则，框架不自动绕过鉴权。
+
+<a id="从-v012-生成项目升级"></a>
+
+## 从 v0.13 或更早版本升级
+
+请按 [v0.14 定点迁移说明](DEVELOPMENT.md#v013-项目升级) 使用 `api upgrade`。原始模板可以自动升级；含业务修改的基础文件必须参考局部预览合并。旧 New/Close/OnClose 移到框架 Runtime，项目依赖初始化保留在 Init。不要继续向项目里复制生命周期锁和清理栈。
+
+## App 默认响应格式
+
+在 **入口** `.api` 声明一次：
+
+```text
+@app (
+    defaultResponse: CommonResponse
+)
+response CommonResponse (
+    codeType: int32
+    successCode: 0
+    errorCode: 9999
+    messageField: msg
+    dataMode: always
+)
+```
+
+优先级：路由 `@response` → 分组 `@server(response: ...)` → App 默认。模板可以定义在 import 文件里，`@app` 只能在入口声明。重复声明、引用不存在的模板会报错；不会按文件顺序猜默认值。未声明 `@app` 时使用框架现有默认格式。
+
+生成的 App 普通路由、404/405、未单独指定格式的生成路由共用默认模板。已匹配路由的中间件提前报错也使用路由策略。`@response raw` 的成功 JSON 不包装，错误沿用有效模板。
+
+显式 `.api` 默认响应优先于 Config/AppOptions 中的响应配置，保持接口文档和实际响应一致。其他 AppOptions 继续生效；要改变格式就修改 `.api`。项目无需访问 handler 私有变量。
+
+## 自动上传、回调与下载
+
+以下声明生成完整 Handler，用户填写 Logic：
+
+```text
+@handler upload
+@body (mode: multipart; maxBytes: 33554432)
+post /upload returns (UploadResp)
+
+@handler callback
+@body (mode: raw; maxBytes: 65536)
+@produces "text/plain"
+post /callback
+
+@handler download
+@produces "application/octet-stream"
+get /download (DownloadReq)
+```
+
+- 以下为未声明 multipart 字段的流式用法；声明式绑定见 [上传字段](DEVELOPMENT.md#声明式-multipart)。raw/流式 multipart 的 Logic 增加 `body *httpx.Body` 参数。`body.Raw` 是受路由上限约束的原始字节流；`body.Header` 是请求头副本。
+- multipart 用 `body.Parts.NextPart()` 顺序读取，关闭每个 Part；不调用 ParseMultipartForm，不产生上传临时文件，也不把整个文件放入内存。每个字段/文件的业务要求由 Logic 校验。请求 DTO 可定义 path/form/header；`form` 仍是 URL 查询参数，不能用 json DTO 重复读取上传体。
+- Parts 是 `*httpx.MultipartReader`，返回的 `*httpx.MultipartPart` 提供 Read、Close、Header、FormName、FileName；NextRawPart 可读取未做 quoted-printable 解码的部分。NextPart 自动关闭上一个未读完的 Part；Close 会报告读取错误。不要混用 Parts 与 Raw 读取同一个 multipart 请求。
+- multipart 缺少结束边界、头部/内容损坏默认返回 `400 / INVALID_MULTIPART`；超过路由限额仍为 413，媒体类型/缺少 boundary 为 415。框架只提供通用标识和默认提示，项目可以在 Go 错误目录中配置自己的状态、业务码和文案。内部解析原因保留在错误链，不进入公开响应；Logic 自己返回的数据库等错误不会被统一改成 400。
+- raw 数据不经过 JSON 解码。签名算法、密钥及回执内容由业务提供；同一个流只消费一次。若中间件先读取验签，项目必须显式使用受限缓冲/重放，生成器不会自动缓存大文件。
+- `@produces` 使 Logic 返回 `(*httpx.Stream, error)`，其中 Content 是 `io.ReadCloser`，可选 Name 生成附件下载头。ContentType 可携带 charset，但必须与契约媒体类型匹配。Handler 负责关闭内容流，无公共体包装；写出后发生错误不会追加 JSON。
+- Handler 在成功响应前检查剩余请求流，包含未读完的 multipart 部分、最终边界和请求体上限；已经遇到的 multipart 读取错误不会因业务忽略它而变成成功。读取失败和 413 不能撤回 Logic 已产生的外部副作用；重要业务应先调用 `body.Complete()` 确认完整读取/验证，再提交事务或发布文件。Complete 可重复调用。
+- 自动 Handler 采用先完成输入、再发送输出的顺序；不要把正在读取的 body.Raw 直接当作 Stream.Content 返回。需要同时读写请求/响应的协议时使用手写扩展。
+- 大文件的耗时仍受 HTTP 读写超时约束。按接口需要配置，框架不自动无限延长。
+
+默认请求体上限为 1 MiB，按路由设置 maxBytes，不能通过统一放大全局限制替代。`@produces` 仅声明媒体类型，不保证业务返回的内容符合该媒体的语义。Range、SSE 刷新、特殊协议等需要时仍可显式选 `@handlerMode manual`；它是可选扩展，不是普通上传下载的前置条件。
+
+## 旧结构处理
+
+新生成器使用 manifest v2，不兼容原 settings/servicecontext/service 与 cmd/server 布局。已有旧目录会报错，不能通过覆盖 main 自动迁移。试验代码需保留时，在新目录生成，移动 `.api`、Logic、配置和 svc 扩展并调整导入；独立的 `cmd/migrate` 等工具由项目维护。不会静默覆盖手写 main 或删除无关命令。
+
+`go-omni new` 与 `api new` 统一使用此结构。受管理项目通过 `.api` 增加模块，旧的 `add` 手动模块装配方式不适用于该结构。直接引用 go-omni 框架包的项目不受这些目录约定约束。
+
+## 已有服务接入步骤
+
+每个独立服务生成一个项目，module 名称、上层目录和共享业务包由项目选择。接入时固定 CLI 与框架版本为 v0.16.0-preview：
+
+1. 先保留旧服务，整理实际路由及现有响应、鉴权和超时要求。在新目录执行 `go-omni new --api /path/to/service.api --module example.com/service ./service`；不对旧入口强制覆盖。
+2. 在 `.api` 中选择 `@app(defaultResponse: ...)`，显式保留原项目的字段、成功码、错误码和 `dataMode`。需要独立回执的路由单独声明 raw/produces。普通路由、404/405 和提前返回的中间件一起验收。
+3. 把配置放入 `internal/config` 和 `etc/config.yaml`；数据库、自定义 Connector、Redis、ID Client 等依赖放入 `internal/svc`，初始化成功后立即 `OnClose`。现有事务和迁移工具继续由项目维护；数据库扩展见 [database](database/README.md)。
+4. 业务错误目录只在项目 Go 包维护，通过 `svc.AppOptions()` 返回 `omni.WithErrors(apierrors.Catalog())` 注册一次。需要继承 App 目录的路由不要重复声明独立错误目录。项目鉴权放入中间件，业务实现迁入 Logic/Repository；无需修改 main 或生成的 Handler。
+5. 上传、原始请求体验签和下载优先使用自动 Handler；只有特殊协议才选择手写扩展。保留实际验签算法、流式处理、大小限制和存储权限，按 [迁移扩展](MIGRATION.md) 处理旧 Handler 与自定义标量。
+6. 每个服务运行下面的检查，再用实际配置验证依赖连通、启动失败清理和正常退出。业务侧补充原有接口兼容、鉴权、事务回滚与实际上传下载回归；框架测试不能代替这些业务验收。
+
+```sh
+go mod tidy
+go-omni api validate
+go-omni api generate --check
+go test ./...
+go build .
+go run .
+```
+
+后续增加接口修改 `.api` 并重新生成；增加依赖修改配置和 svc。将契约、生成文件、manifest 与业务代码一起提交。完整流程不需要项目另外维护启动器，也不需要读取 handler 的私有变量。

README.md

@@ -1,314 +1,480 @@
 # GoOmni
 
-GoOmni 是一套面向业务复用的 Go 后端基础框架。当前默认使用只依赖标准库的网络适配器，业务代码只依赖 GoOmni 的 transport-neutral API，后续可以替换为自研网络层。
+GoOmni 是面向多个业务项目复用的 Go 后端框架：用 `.api` 定义接口、请求和返回类型，生成项目目录、HTTP 接入代码及 OpenAPI，业务代码负责 Logic 和 Repository。也可以在已有项目中直接使用 `omni.New()`，或单独引入日志、存储等模块。
 
-远程 module 地址是 `git.yuntuo.hk/k2safe/go-omni`。业务项目可以直接引用指定版本：
+**从这份 README 开始接入。** 当前版本 **`v0.16.0-preview`**，新生成项目采用根目录入口和 `config / svc / logic / handler`。可以固定版本开展业务接入；文件维护边界和已有服务迁移步骤见 [项目指南](PROJECT.md)，版本变化与验收见 [发布说明](RELEASE.md)。
+
+Go **1.22+**。框架不依赖 Gin，默认使用标准库网络层，提供可切换的 native HTTP/1.1 和实验性 HTTP/2 适配器。
+
+响应字段、业务码、登录方式、权限规则和数据库表结构由接入项目决定。文中的 `code/msg/data`、`200/9999` 都是示例配置，可以替换。
+
+本版补齐 `returns([]string/[]int64/[]bool/[]any)`、OpenAPI 公共引用、workspace 一次导出共享 Go 错误目录，以及统一环境变量别名覆盖。详细配置与升级步骤见 [业务开发指南](DEVELOPMENT.md)。
+
+已有通用开发能力见 [业务开发指南](DEVELOPMENT.md)：数组/null、严格请求策略、声明式上传、完整配置环境覆盖、资源生命周期、共享契约和升级工具。MySQL 直接使用 [官方适配器](database/mysql/README.md)。
+
+后台组件可在 svc 登记 [分阶段关闭](lifecycle/README.md#后台组件分阶段关闭)，先停止接收工作并等待收尾，再关闭共享资源；无需绑定队列或 ORM。
+
+使用 GORM 的项目可以选择 [gormx 适配器](database/gormx/README.md)，复用数据库初始化和连接池，并将 SQL 日志接入 logx。
+
+## 选择接入方式
+
+| 你的项目 | 从哪里开始 |
+| --- | --- |
+| 新建服务，先定义接口再开发 | [新项目：生成并运行](#新项目生成并运行) |
+| 已有服务，逐步接入 HTTP 或基础模块 | [已有项目：按模块接入](#已有项目按模块接入) |
+| 已有标准 Handler、动态 JSON、上传或自定义 ID 类型 | [迁移扩展指南](MIGRATION.md) |
+| 想统一返回体、业务错误或三方回调 | [配置公共响应与独立协议](#配置公共响应与独立协议) |
+| 要接日志、数据库、鉴权和存储 | [业务开发与依赖装配](#业务开发与依赖装配) |
+| 要切换网络层、配置 TLS 和退出清理 | [配置与运行](#配置与运行) |
+| 已接入，需要升级和检查生成代码 | [日常开发与升级](#日常开发与升级) |
+
+## 准备环境与安装
+
+module 地址是 `git.yuntuo.hk/k2safe/go-omni`。先确保本机 Go 和 Git 可用，并具有仓库读取权限；使用自己的 Git 凭据管理器，不把账号或 Token 写进 module 地址。
+
+安装固定版本的 CLI，后面的命令继续使用同一终端。私有 module 加入 GOPRIVATE，保留已有配置：
 
 ```sh
-go get git.yuntuo.hk/k2safe/go-omni@v0.7.0-preview
+export GOPRIVATE="$(go env GOPRIVATE),git.yuntuo.hk"
+go install git.yuntuo.hk/k2safe/go-omni/cmd/go-omni@v0.16.0-preview
+export PATH="$(go env GOPATH)/bin:$PATH"
+go-omni --help
 ```
 
-`v0.4.0` 移除了 Gin 和 Gin 专属的 `WithMode` 配置；`omni.New()` 直接使用标准库路由，已有业务 Handler / Service 无需修改。
+如果设置过 GOBIN，将该目录加入 PATH。远程 CLI 默认引用自身版本的框架，生成的 go.mod 不需要本地 replace。开发者与 CI 使用同版 CLI；框架源码开发方式见 [CLI 文档](cmd/go-omni/README.md#版本与迁移)。
 
-创建新业务项目：
+## 新项目：生成并运行
+
+在准备存放业务项目的目录执行，`./hello` 必须是新目录或空目录；把 `example.com/hello` 换成自己的 Go module 名称。
 
 ```sh
-go install git.yuntuo.hk/k2safe/go-omni/cmd/go-omni@v0.7.0-preview
-go-omni new --module example.com/billing ./billing
-cd billing
+go-omni api new --module example.com/hello ./hello
+cd hello
 go mod tidy
-go run ./cmd/server
+go run .
 ```
 
-远程安装的 CLI 默认引用自身版本，生成的项目不需要本地 `replace`。
-具体版本和本地开发选项见 [CLI 文档](cmd/go-omni/README.md)。
-
-需要数据库持久化时，使用 `go-omni new --database mysql --module example.com/billing ./billing`。
-生成项目包含完整用户 CRUD、数据库 Repository、ServiceContext、建表脚本和就绪探针。
-先应用生成的 `schema.sql`，再配置 `GO_OMNI_DB_DSN`；启动时会检查连接与表结构，退出时释放连接池。
-
-## API 定义与项目生成
-
-当前源码新增 **API 定义驱动项目生成**：写 `.api` 定义请求、响应和路由，自动生成项目目录、DTO、Handler、Service 骨架及 OpenAPI。重复生成保留业务代码，支持只读 CI 检查，完整语法和示例见 [API 开发指南](API.md)。
+另开终端验证：
 
 ```sh
-go run ./cmd/go-omni api new --framework-dir . \
-  --module example.com/omniDemo ../omniDemo
+curl -i http://127.0.0.1:8080/api/greet/Alice
+curl -i http://127.0.0.1:8080/health/ready
+curl -sS http://127.0.0.1:8080/openapi.json
 ```
 
-API 生成支持 `--database mysql --storage local --log-output file` 组合初始化。上面的命令使用本地源码；远程安装见 [发布说明](RELEASE.md)，完整业务案例见 [userService](examples/userService/README.md)。
+第一个接口返回 HTTP 200，业务数据为 `{"message":"Hello Alice"}`。初始模板未配置响应格式，使用默认公共体：
 
-## 目录结构
+```json
+{"code":"OK","message":"success","data":{"message":"Hello Alice"},"requestId":"本次请求编号"}
+```
+
+按 Ctrl+C 停止服务。进入项目目录即可 `go build .`；该示例不需要数据库或其他外部服务。
+
+### 生成的项目放什么
 
 ```text
-go-omni/
-├── app/          # 应用启动和生命周期
-├── httpx/        # 与网络框架无关的 HTTP 抽象
-├── response/     # 统一响应
-├── errors/       # 统一错误
-├── health/       # 存活和就绪检查
-├── middleware/   # 请求 ID 等基础中间件
-├── logx/         # 业务层结构化日志
-├── metrics/      # 请求指标与状态统计
-├── config/       # 配置管理
-├── validate/     # 参数校验
-├── contract/     # API 字段契约、严格多源绑定与文档约束
-├── auth/         # 认证和权限接口
-├── database/     # database/sql 生命周期和事务
-├── cache/        # 有界内存缓存、Redis 适配与合并回源
-├── httpc/        # 出站 HTTP 连接池、超时和重试
-├── task/         # 有界后台任务与间隔调度
-├── queue/        # 持久队列接口与 Redis Streams 适配
-├── storage/      # Local、S3/R2、OSS 与临时下载链接
-├── openapi/      # 路由和 OpenAPI 3.0.3 契约
-├── telemetry/    # 可注入 OpenTelemetry 观测
-├── resilience/   # 熔断与上游并发隔离
-├── audit/        # 显式业务审计与可注入 Sink
-├── pagination/   # 有界分页和统一结果
-├── transport/nethttp/ # 标准库网络适配器
-├── transport/native/  # 自研 HTTP/1.1 服务端预览
-├── transport/http2/   # opt-in HTTP/2 实验适配器
-├── examples/     # 示例项目
-└── cmd/          # go-omni 项目脚手架
+hello/
+├── api/service.api                  # 维护接口定义，也可 import 其他 .api
+├── main.go                          # 生成器维护：启动、路由注册、优雅退出
+├── etc/config.yaml                  # 项目配置
+├── internal/
+│   ├── config/                      # 配置读取
+│   ├── svc/                         # 数据库、日志、外部客户端等依赖
+│   ├── types/*Gen.go                # 按 .api 文件生成 DTO
+│   ├── handler/                     # 生成的绑定、响应策略、路由及文档
+│   ├── logic/greet/                 # 在这里实现业务逻辑
+│   ├── repository/greet/            # 在这里实现数据访问
+│   └── middleware/                  # 声明鉴权等中间件后生成对应 hook
+├── docs/openapi.json                # 生成的 OpenAPI 3.0.3
+└── .goOmni/apiManifest.json         # 生成文件所有权与校验信息，一起提交 Git
 ```
 
-main 分支新增缓存、出站 HTTP、限流/幂等/超时中间件、后台任务和 `go-omni add` 模块脚手架。
-使用方式、默认容量和进程内能力的适用范围见 [业务基础模块](MODULES.md)，
-可以直接运行 [组合示例](examples/modules/README.md)。这些能力从 `v0.7.0-preview` 提供。
+修改 `api/service.api` 后重新生成，业务写在 `internal/logic`，数据访问写在 `internal/repository`，依赖在 `internal/svc` 装配。声明业务错误后还会生成 `internal/apierrors/errorsGen.go`。
 
-扩展模块还包括 JWT/Session、Policy、文件配置及安全热更新、Redis 共享中间件、持久队列、多平台对象存储、OpenAPI、OpenTelemetry、熔断、迁移、审计和分页。
-使用与边界见 [扩展模块](ADVANCED.md)，可运行 [文件服务组合示例](examples/platform/README.md)。go-omni 不集成 Orbit；需要流程编排的业务项目独立接入。
+`api new` 的问候接口可以直接运行；自定义接口新生成的 Logic 和鉴权 hook 返回 **501**，需要实现后才可用。生成器不会根据 HTTP 字段猜数据库表或业务规则。
 
-## 快速开始
+### 从自己的接口定义生成
+
+保存下面的完整示例为 `catalog.api`，再执行后面的生成命令。这里的响应格式、错误码和提示都由这个业务项目定义。
+
+```text
+syntax = "v1"
+
+@app (defaultResponse: CommonResponse)
+
+response CommonResponse (
+    body: {"code":"${code}", "msg":"${message}", "data":"${data}"}
+    codeType: int32
+    successCode: 200
+    errorCode: 9999
+    successMessage: "操作成功"
+    dataMode: always
+    codes: {"ITEM_NOT_FOUND":404001}
+)
+
+error ItemNotFound 404 "ITEM_NOT_FOUND" "记录不存在"
+
+type GetItemReq {
+    ItemID string `path:"itemId" binding:"required"`
+}
+type ItemResp {
+    ItemID string `json:"itemId"`
+    Name string `json:"name"`
+}
+
+@server (
+    group: item
+    prefix: /api/v1
+    response: CommonResponse
+)
+service catalog-api {
+    @doc "查询商品"
+    @errors ItemNotFound
+    @handler getItem
+    get /items/:itemId (GetItemReq) returns (ItemResp)
+}
+```
+
+```sh
+go-omni api validate --api catalog.api
+go-omni new --api catalog.api \
+  --module example.com/catalog ./catalog
+cd catalog
+go mod tidy
+```
+
+将生成的 `internal/logic/item/getItem.go` 替换为下面的演示实现。实际业务中换成 Repository 查询，Logic 返回业务数据或错误，不再手工包装公共体：
+
+```go
+package item
+
+import (
+    "context"
+
+    "example.com/catalog/internal/apierrors"
+    "example.com/catalog/internal/types"
+)
+
+func (s *Logic) GetItem(ctx context.Context, req *types.GetItemReq) (*types.ItemResp, error) {
+    if req.ItemID != "1001" {
+        return nil, apierrors.ItemNotFound()
+    }
+    return &types.ItemResp{ItemID: req.ItemID, Name: "示例商品"}, nil
+}
+```
+
+示例 import 对应上面的 `example.com/catalog`，使用其他 module 名称时同步替换。启动后，在另一个终端验证：
+
+```sh
+# catalog 项目目录中启动；先停掉前面的 hello 服务，释放 8080 端口。
+go run .
+# 另一个终端：
+curl -i http://127.0.0.1:8080/api/v1/items/1001
+curl -i http://127.0.0.1:8080/api/v1/items/missing
+```
+
+成功时得到 `{"code":200,"msg":"操作成功","data":{"itemId":"1001","name":"示例商品"}}`；不存在时为 HTTP 404、`{"code":404001,"msg":"记录不存在","data":null}`。
+
+需要 MySQL、文件存储或文件日志时，**首次生成**可以使用：
+
+```sh
+go-omni new --api catalog.api \
+  --module example.com/catalogFull --database mysql --storage local \
+  --log-output file --log-format json ./catalogFull
+```
+
+该命令在 `catalog.api` 所在目录执行，目标仍需是新目录。数据库迁移、表结构和 Repository 由项目维护，API 模板不自动建表；MySQL 使用结构化配置，密码通过 `GO_OMNI_DB_PASSWORD` 提供。存储还可选 `s3`、`r2`、`oss`，按生成项目的配置说明提供桶、端点和凭据。完整生成项目示例见 [managedService](examples/managedService/README.md)。
+
+`go-omni new` 与 `go-omni api new` 统一生成契约项目。需要手写项目时，可直接引用框架包；生成器不再提供另一套 CRUD 启动目录。
+
+## 已有项目：按模块接入
+
+在业务项目的 **go.mod 所在目录**执行：
+
+```sh
+go get git.yuntuo.hk/k2safe/go-omni@v0.16.0-preview
+```
+
+已有项目可直接复用现有目录、Service、Repository 和数据库连接，先选择一个接口接入。也可以只用 `logx`、`storage` 等包，暂时保留原来的 HTTP 框架。希望入口和 HTTP 接入都交给生成器的项目，按 [已有服务接入步骤](PROJECT.md#已有服务接入步骤) 在新目录生成后迁入业务代码。
+
+下面是可独立运行的 `main.go` 示例；迁入现有项目时，把路由调用接到自己的业务服务即可。
 
 ```go
 package main
 
-import omni "git.yuntuo.hk/k2safe/go-omni"
-
-func main() {
-	app := omni.New()
-
-	app.GET("/health", func(ctx *omni.Context) error {
-		return ctx.OK(map[string]string{"status": "ok"})
-	})
-
-	app.Run(":8080")
-}
-```
-
-成功响应默认使用统一结构：
-
-```json
-{
-  "code": "OK",
-  "message": "success",
-  "data": {"status": "ok"},
-  "requestId": "..."
-}
-```
-
-业务错误可以直接返回：
-
-```go
-return omni.NotFound("USER_NOT_FOUND", "user was not found")
-```
-
-默认网络适配器位于 `transport/nethttp`。业务层不需要导入具体网络库；如果后续实现自己的网络层，只需要实现 `httpx.Router` / `httpx.RouterGroup`，然后通过 `omni.NewWithRouter` 启动应用：
-
-```go
-application := omni.NewWithRouter(myRouter)
-```
-
-仓库还提供了使用标准库路由的 `transport/nethttp` 参考实现。两种适配器已通过同一套路由、业务处理链和取消传播测试，完整用户 CRUD 复用同一份 Handler / Service。
-
-自研适配器可以直接运行 `transport/transporttest.Run` 验收。具体规则、v0.4.0 的斜杠 / Any / 405 行为调整，以及自研网络内核与当前 HTTP 接口的边界，见 [适配层契约](transport/README.md)。
-
-`app.Engine()` 返回标准 `http.Handler`，`ctx.Raw()` 返回适配器提供的 `http.ResponseWriter`，业务 API 不锁定具体网络实现。
-
-需要试用第一版自研网络层时，业务注册代码无需改变，只替换启动器：
-
-```go
 import (
-	"context"
-	"log"
-	"os"
-	"os/signal"
-	"syscall"
+    "log"
+    "net/http"
 
-	omni "git.yuntuo.hk/k2safe/go-omni"
-	"git.yuntuo.hk/k2safe/go-omni/transport/native"
+    omni "git.yuntuo.hk/k2safe/go-omni"
+    "git.yuntuo.hk/k2safe/go-omni/logx"
+    "git.yuntuo.hk/k2safe/go-omni/response"
 )
 
-ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
-defer cancel()
+func main() {
+    if err := run(); err != nil {
+        log.Fatal(err)
+    }
+}
 
-app := omni.New()
-app.GET("/health", func(ctx *omni.Context) error {
-	return ctx.OK(map[string]string{"status": "ok"})
-})
-if err := app.RunWith(ctx, native.New(nil), ":8080"); err != nil {
-	log.Fatal(err)
+func run() error {
+    closeLog, err := logx.Setup(logx.Config{
+        Service: "catalog", Level: "info", Format: "json", Output: "stdout",
+    })
+    if err != nil {
+        return err
+    }
+    defer closeLog()
+
+    app := omni.New(
+        omni.WithLogger(true),
+        omni.WithResponse(response.Config{
+            Body: map[string]any{
+                "code": "${code}", "msg": "${message}", "data": "${data}",
+            },
+            CodeType: "int32", SuccessCode: 200, ErrorCode: 9999,
+            SuccessMessage: "操作成功", DataMode: "always",
+            Codes: map[string]any{"ITEM_NOT_FOUND": 404001},
+        }),
+    )
+    app.GET("/api/v1/items/:itemId", func(c *omni.Context) error {
+        itemID := c.Param("itemId")
+        logx.InfoContext(c.Context(), "item.get", "itemId", itemID)
+        if itemID != "1001" {
+            return omni.NotFound("ITEM_NOT_FOUND", "记录不存在")
+        }
+        return c.OK(map[string]string{"itemId": itemID, "name": "示例商品"})
+    })
+    // 第三方协议可明确输出文本，不经过公共 JSON 包装。
+    app.GET("/ping", func(c *omni.Context) error {
+        return c.Text(http.StatusOK, "pong")
+    })
+    return app.Run("127.0.0.1:8080")
 }
 ```
 
-`transport/native` 当前支持 HTTP/1.1、Keep-Alive、`Content-Length` 和 chunked 请求体、`http.Flusher` 流式响应、可选 TLS、读写超时和优雅关闭；不支持的传输编码会被拒绝。它会复用连接状态和响应对象，并可通过 `MaxConnections`、`MaxConcurrentRequests` 限制内存峰值。它仍通过标准 HTTP 请求/响应接口连接业务层，适合在现有 Handler / Service 上做网络层验证。
+运行 `go run .`，访问 `/api/v1/items/1001`、`/api/v1/items/missing` 和 `/ping`，可分别验证成功、业务错误及纯文本输出。`App` 实现标准 `http.Handler`，也可挂进现有 `http.Server` 或父路由；这时监听、TLS、信号和资源关闭由现有入口负责，结束时调用 `app.Close()`。
 
-native TLS 当前只支持并宣告 ALPN `http/1.1`；配置 `h2` 会在启动时快速失败。需要 HTTP/2 时，可由 Nginx/Cloudflare 终止后回源 HTTP/1.1，或使用默认的 `transport/nethttp` 适配器。
+现有 `http.HandlerFunc` 可直接通过 `app.POST("/legacy", httpx.WrapHandler(http.HandlerFunc(oldHandler)))` 接入；状态码与访问日志一致，下载和流式输出保持原协议。标准中间件、动态 JSON、上传/原文 body、手写绑定和自定义类型的完整用法见 [迁移扩展指南](MIGRATION.md)。
 
-`transport/http2` 是独立的 opt-in 实验适配器，使用 `x/net/http2` 处理帧和流控，同时保留 GoOmni 的连接上限、全局请求并发闸门和生命周期边界。它不会改变 native 默认路径；实验入口、限制和验收结果见 [HTTP/2 进入条件](transport/native/HTTP2.md)。
+接入现有业务时，逐项确认：
 
-自研网络层还提供 `server.Stats()`，可读取 accepted、rejected、active connections 和 active requests，与上面的业务请求 metrics 组合后能区分连接堆积、过载拒绝和 Handler 慢请求。`rejectedConnections` 表示连接闸门拒绝数，`rejectedRequests` 表示并发请求闸门返回 503 的次数。
+- **协议**：保留既有 URL、HTTP 状态、字段、分页和空值语义。已有业务错误类型需要在项目内转换为 Omni 错误，或使用 `WithResponseEncoder` 适配原错误；设置字段模板不会自动识别其他库的错误。
+- **鉴权**：把现有登录态和权限校验接入中间件，继续使用原来的授权范围和业务规则。原来依赖 `gin.Context` 等类型的 HTTP 代码需要适配；标准 `context.Context` 的业务服务可以继续复用。
+- **数据类型**：ID、金额、日期等按项目协议转换。用 `.api` 的 `scalar` 显式关联项目自己的类型与 JSON/Text 转换方法，分别声明输入和输出协议；普通字段保持严格绑定，见 [自定义标量](MIGRATION.md#4-自定义标量项目定义行为框架连接调用)。
+- **生成器**：它不会自动接管任意已有 Go 项目。希望引入 `.api` 时，先在独立新目录生成对照，再规划路由与生成目录的接入，不要用脚手架覆盖现有业务目录。
 
-业务代码可以直接使用 `git.yuntuo.hk/k2safe/go-omni/logx` 打结构化日志，不需要依赖具体网络库：
+先通过一个接口的成功、参数错误、未登录、无权限及业务错误回归，再按模块迁移。框架不要求所有项目使用同一套业务目录或身份模型。
 
-```go
-func (s *UserService) Create(ctx *httpx.Context) error {
-	logx.InfoContext(ctx.Context(), "user.create", "email", input.Email)
-	return nil
-}
-```
+## 配置公共响应与独立协议
 
-需要基础运行指标时，可以注册 transport-neutral metrics middleware 和接口：
-
-```go
-requestMetrics := omni.NewMetrics()
-app.Use(requestMetrics.Middleware())
-app.GET("/metrics", requestMetrics.Handler())
-```
-
-接口返回请求总数、错误数、当前处理中请求、累计耗时和 HTTP 状态分布。它是进程内快照，生产环境可由业务侧定时采集到监控系统。
-
-`WithLogger(true)` 会启用 GoOmni 的统一 HTTP 访问日志；日志内容和业务日志共用 `requestId`。应用启动时可以调用 `logx.Setup` 配置 JSON/文本格式、级别、服务名和输出文件。文件轮转、敏感字段脱敏、异常堆栈与慢请求配置见 [logx 文档](logx/README.md)；文件直传与云端分片上传见 [storage 文档](storage/README.md)。 创建新业务项目时可通过 `go-omni new --log-output file --storage local` 按需生成配置、装配代码与可运行示例，当前源码使用方式见 [CLI 文档](cmd/go-omni/README.md)。
-
-应用配置可以统一从 `GO_OMNI_*` 环境变量加载，再交给 `omni.New`：
-
-```go
-settings, err := omni.LoadConfig("")
-if err != nil {
-	log.Fatal(err)
-}
-logger, err := logx.New(settings.Log)
-if err != nil {
-	log.Fatal(err)
-}
-application := omni.New(omni.WithConfig(settings))
-application.OnShutdown(logger.Close)
-```
-
-常用变量包括 `GO_OMNI_ENABLE_LOGGER`、`GO_OMNI_LOG_LEVEL`、
-`GO_OMNI_LOG_FORMAT`、`GO_OMNI_LOG_OUTPUT`、`GO_OMNI_SERVICE`、
-`GO_OMNI_ENVIRONMENT`、`GO_OMNI_HTTP_ADDR`、`GO_OMNI_SHUTDOWN_TIMEOUT` 和
-`GO_OMNI_TRUSTED_PROXIES`。可信代理变量使用逗号分隔的 IP/CIDR，例如
-`GO_OMNI_TRUSTED_PROXIES=127.0.0.1,10.0.0.0/8`；只有来自这些地址的连接才会解析
-`X-Forwarded-For`，默认只记录 socket 对端地址。数据库连接仍由
-`database.ConfigFromEnv` 从 `GO_OMNI_DB_*` 加载。
-
-网络层也由同一份配置选择，Handler / Service / Repository 不需要导入具体适配器：
-
-| 配置 | 默认值 / 用途 |
+| 接口来源或需求 | 配置位置 |
 | --- | --- |
-| `GO_OMNI_TRANSPORT` | `nethttp`；可选 `native`、`http2` |
-| `GO_OMNI_TLS_CERT_FILE` | TLS 证书 PEM 文件路径 |
-| `GO_OMNI_TLS_KEY_FILE` | TLS 私钥 PEM 文件路径，必须与证书一起配置 |
-| `GO_OMNI_SHUTDOWN_TIMEOUT` | `10s`，三种适配器共用的请求排空时间 |
+| `.api` 生成的接口 | `response Name (...)` 定义，`@server (response: Name)` 引用 |
+| 多个 `.api` 共用返回体 | 将声明放到 `common.api`，使用 `import "common.api"` |
+| 某个生成接口用另一种 JSON 公共体 | 路由声明 `@response OtherResponse` |
+| 只要业务 JSON、无成功包装 | 路由声明 `@response raw`；失败仍沿用组级格式 |
+| 手写路由和应用级 404/405 | `omni.WithResponse(response.Config{...})`，或读取配置后传入 `WithConfig` |
+| 成功和失败都要遵循特殊回调协议 | `HandleWithResponse` 绑定项目自己的 `response.Encoder` |
+| 单次直接输出 JSON、文本、XML、字节或空响应 | `c.JSON` / `c.Text` / `c.XML` / `c.Bytes` / `c.NoContent` |
 
-例如运行自研 HTTP/1.1，或显式试用独立 HTTP/2 适配器：
+`${data}` 是业务返回值，`${message}` 是公开提示，`${code}` 是业务码；占位符保留原值类型，不是字符串拼接。还支持 `${requestId}`、`${ok}`、`${status}`，字段名和嵌套结构由项目决定。
 
-```sh
-GO_OMNI_TRANSPORT=native go run ./examples/reference
-GO_OMNI_TRANSPORT=http2 GO_OMNI_HTTP_ADDR=127.0.0.1:8443 \
-  GO_OMNI_TLS_CERT_FILE=./server.crt GO_OMNI_TLS_KEY_FILE=./server.key \
-  go run ./examples/reference
-```
+- `codeType` 可以是 `string`、`int32`、`int64`；整数类型需要配置 `successCode` 和 `errorCode`。
+- `codes` 把逻辑错误码映射成对外业务码；未单独映射的失败使用 `errorCode`。JSON 业务码不会改变 HTTP 状态，例如 `404001` 仍对应 HTTP 404。
+- `successMessage` 设置成功提示；未设置 `errorMessage` 时沿用错误的公开提示。`messages` 可按逻辑错误码单独覆盖，优先级最高。全局 `errorMessage` 会替换未单独映射的所有失败提示，只有需要统一失败文案时才设置。
+- `dataMode: always` 在无数据时输出 null；默认 `omitNil` 省略模板里相应对象字段。没有 `returns` 的 `.api` 路由默认 HTTP 204、无响应体，这与 `200 + data:null` 是不同的接口契约。
 
-`http2` 必须配置 TLS；native TLS 只协商 `http/1.1`，nethttp TLS 支持标准库的 HTTP/1.1 和 HTTP/2。
-未知适配器、缺少配对证书、无法加载证书时，`Run` / `RunContext` 在监听前返回错误并执行资源清理，不会退回其他协议。
-HTTP/2 仍为实验适配器，尚未合并到 native 多协议监听器。
+**生成接口的格式以 `.api` 为准**，修改后重新生成，运行时与 OpenAPI 一起更新；应用 YAML 不会覆盖它。404/405 没有匹配到某个 `.api` 接口，使用应用默认配置，需要统一时也配置应用默认值。
 
-代码配置可写成 `omni.New(omni.WithTransport(omni.TransportNative), omni.WithTLS(certFile, keyFile))`。
-`ServeContext(ctx, listener)` 使用相同配置并接管已有 listener；失败或退出时也会关闭它。
-`RunWith(ctx, runner)` 保留自定义网络层入口，由 runner 自己管理 TLS、超时和网络参数；连接/请求上限等适配器专属选项仍通过这个入口设置。
-`NewServer` 仅创建标准库明文服务器，配置选择应用于 `Run`、`RunContext` 和 `ServeContext`。
-三种适配器的配置、真实 TLS 业务和关闭行为已通过 Linux 全量 race 及 10 次重复回归，见 [统一启动验收](performance/transportStartup.md)。
+文本/XML 回调用 Go 编码器或直接输出，`.api` 可用 `@handlerMode manual` 与 `@produces` 声明成功媒体类型；特殊错误协议仍需项目维护。`@response raw` 仅表示原始 JSON。前面示例的 `c.Text` 控制这次正常返回；需要连鉴权失败、业务错误和 panic 都按回调协议响应时使用 `HandleWithResponse`。完整配置和回调示例见 [响应参考](RESPONSE.md)。
 
-`App` 同时实现标准 `http.Handler`。`Run` 监听 `SIGINT` / `SIGTERM`；`RunContext` 则由调用方的 context 控制退出，生成项目已使用 `signal.NotifyContext` 接好信号。
-退出时先停止接收新请求，等待活跃请求完成，再执行资源清理。超过 `ShutdownTimeout` 时强制关闭连接、取消请求 context，并返回超时错误。业务代码应响应 context 取消；框架无法强制结束忽略取消的业务 goroutine。数据库连接池由 `database.Open` 创建，在服务退出时调用 `Close`。
+## 业务开发与依赖装配
 
-应用资源可以直接挂到 `omni.New` 返回的生命周期上：
+### 日志
+
+业务包直接使用 `logx`，不需要 HTTP 框架对象：
 
 ```go
-application := omni.New()
-application.OnShutdown(db.Close)
+// ctx 是 Service 接收的标准 context.Context。
+logx.InfoContext(ctx, "order.created", "orderId", orderID)
+logx.ErrorContext(ctx, "order.failed", "error", err)
 ```
 
-清理函数会按注册顺序的逆序执行，`application.Close()` 和 `RunContext` 都会触发，且重复调用安全。
+入口用 `logx.Setup` 初始化，退出时关闭；生成的 API 项目已经完成日志初始化和退出清理。Service、Repository 和外部请求持续传递请求的 `context.Context`，业务日志可关联 `requestId`，同时保留取消信号。框架不规定或自动注入 `userId`、`tenantId`。
 
-服务可以把数据库、缓存等依赖注册为就绪探针：
+`WithLogger(true)` 开启 HTTP 访问日志。格式、级别、文件轮转、脱敏键和慢请求阈值均可配置，见 [日志](logx/README.md)。
+
+### 鉴权与业务错误
+
+`.api` 可声明认证方式和关联中间件，例如把下面的声明放入契约，并在相应 `@server` 块中加上 `auth: UserAuth`：
+
+```text
+auth UserAuth (
+    type: bearer
+    middleware: Auth
+)
+```
+
+生成器会创建 `internal/middleware/auth.go`，由项目实现凭据校验和身份注入。声明会生成路由绑定与 OpenAPI 的认证描述，**不会自动实现登录或授权规则**；未实现的 hook 返回 501。手写路由可使用 `auth.RequireAuth(authenticator)` 或自己的中间件。JWT、Session 和 Policy 按需选择。
+
+业务错误可以集中定义，业务只选择发生了哪个错误。**HTTP 状态由项目配置，业务失败可以返回 HTTP 200**；框架不根据 HTTP 状态单独判断成功与否。
+
+错误目录支持两种维护方式，按项目选择一种：**Go 中定义并用 `omni.WithErrors` 注册一次**，或者在公共 `.api` 中声明并生成调用函数。前者不要求 `.api` 重复声明目录或逐路由列出错误；生成路由默认继承 App 目录。
+
+采用 `.api` 管理时，其他契约可通过 `import` 引用：
+
+```text
+errorCatalog CommonErrors (
+    defaultStatus: 200
+    errors: {
+        "UsernameInvalid": {"key": "USERNAME_INVALID", "code": 400002, "message": "用户名格式不正确"},
+        "PasswordInvalid": {"key": "PASSWORD_INVALID", "code": 400002, "message": "密码格式不正确"},
+        "PermissionDenied": {"key": "PERMISSION_DENIED", "status": 403, "code": 403001, "message": "没有权限"}
+    }
+)
+```
+
+`UsernameInvalid` 是生成函数名；`key` 是唯一逻辑标识；`code` 是项目对外的字符串或整数业务码，可以重复。条目没有填写 `status` 时使用目录的 `defaultStatus`，未配置目录默认值时为 400。这个默认值只作用于该目录的条目，不会把所有框架异常都改成 200。
+
+在已有公共响应中保留 `codeType: int32` / `int64` / `string`、成功码、未定义错误的兜底码和返回体模板；不再重复填写这几条错误的 `codes` / `messages`。通过 `@server (errors: UsernameInvalid, PasswordInvalid)` 或路由 `@errors UsernameInvalid` 引用它们。
+
+生成后业务调用：
 
 ```go
-checker, err := health.New(health.Probe{
-	Name: "database",
-	Check: db.PingContext,
-})
-if err != nil {
-	log.Fatal(err)
+return TokenResponse{}, apierrors.UsernameInvalid()
+// 需要保留内部原因时：
+return TokenResponse{}, apierrors.UsernameInvalid().WithCause(err)
+```
+
+生成器同时提供 `internal/apierrors.Catalog()`、错误函数、路由错误目录及 OpenAPI。目录会在 App 中间件执行前绑定到生成路由；无需手动改已经生成的 main。HTTP 200 的错误使用失败响应模板；OpenAPI 用 `anyOf` 同时保留成功 DTO 和错误体，多条错误共用数字码时仍保留各自示例。完整契约见 [errors.api](examples/contracts/errors.api)。
+
+手写项目可在启动时加载自己的目录，保留原来的响应配置：
+
+```go
+// omnierrors 是 git.yuntuo.hk/k2safe/go-omni/errors。
+catalog := omnierrors.Catalog{
+    DefaultStatus: 200,
+    Definitions: map[string]omnierrors.Definition{
+        "USERNAME_INVALID": {Code: 400002, Message: "用户名格式不正确"},
+        "PASSWORD_INVALID": {Code: 400002, Message: "密码格式不正确"},
+    },
 }
-application.GET("/health/live", checker.LivenessHandler())
-application.GET("/health/ready", checker.ReadinessHandler())
+app := omni.New(
+    omni.WithErrors(catalog),
+    omni.WithResponse(response.Config{
+        CodeType: "int32", SuccessCode: 0, ErrorCode: 9999,
+        MessageField: "msg", DataMode: "always",
+    }),
+)
+// Service 只返回标准 error，不依赖 App 或 HTTP Context：
+// return omnierrors.ByCode("USERNAME_INVALID").WithCause(err)
 ```
 
-存活检查只确认进程在线；就绪检查会执行全部探针，任意依赖失败时返回 HTTP 503。
+目录也可放入 `config.Config.Errors`，由 JSON/YAML 加载；生成项目的路径为 `server.errors`，生成路由只有显式引用错误定义时才使用 `.api` 独立目录，未声明则继承 App。不同 App 独立持有配置，单路由也可通过 `response.WithErrors` 绑定专用目录与自定义 Encoder。直接输出文本、XML、下载或已提交的响应继续保留原协议。
 
-新项目脚手架会生成项目自己的 `internal/servicecontext`。它集中保存 Logger、数据库、缓存和外部客户端，Service 只依赖这个项目上下文，不把基础设施初始化散落到各个 Handler：
+访问日志保留实际 HTTP 状态，并增加失败标记、逻辑错误标识和目录业务码；指标、链路及框架标准中间件/幂等重放也保留失败语义。未知标识使用系统错误兜底，内部 cause 不写入默认公开响应。旧 `error (...)`、`New` / `BadRequest` / `Codes` / `Messages` 继续支持；新目录与旧映射冲突会报错，避免静默覆盖。
+
+动态提示也可以集中配置，在目录中声明 `message: "{label}不能超过{max}个字符"` 和有序 `params`（label/string、max/int），生成带类型的调用：
 
 ```go
-services, err := servicecontext.New(ctx, logger)
-if err != nil {
-	return err
-}
-defer services.Close()
-userService := service.NewUsers(services)
+return apierrors.TextTooLong("企业名称", 100)
+// 最终提示：企业名称不能超过100个字符
 ```
 
-## 完整业务参考项目
+运行时支持 `omnierrors.ByCode("TEXT_TOO_LONG").WithParams(...)`，与生成函数共用解析器。固定错误继续无参数调用；缺参或类型错误使用系统兜底。模板、参数类型及具体响应示例同步写入 OpenAPI。完整示例见 [errorParams.api](examples/contracts/errorParams.api)。
 
-[`examples/reference`](examples/reference/README.md) 提供按 Handler / Service / Repository / Model 分层的用户 CRUD 示例。默认使用并发安全的内存存储，支持分页、邮箱唯一校验、结构化请求日志和统一错误，无需配置数据库。
+更详细的配置、作用域和升级步骤见 [统一错误目录](errors/README.md)。
 
-从远程版本生成并升级一个独立业务模块，可运行：
+### 数据库、存储及其他模块
+
+生成项目在 `internal/svc` 中创建依赖，提供给 Logic/Repository，并用 `c.OnClose(db.Close)` 登记自有资源。生成的 main 在 HTTP 排空后关闭 svc，再关闭日志。直接使用框架的手写项目则可以用 `app.OnShutdown(db.Close)`；不要对同一资源重复登记。
+
+已有项目使用 `driver.Connector` 时，直接 `database.OpenConnector(ctx, connector, database.DefaultPoolConfig())`。MySQL 可直接用 [database/mysql](database/mysql/README.md) 配置独立 TLS、Logger、时区与拨号参数；任意驱动也可由项目构造 Connector。框架负责连接池、启动 Ping、健康检查及事务。无需转成 DSN，也无需注册全局 TLS/Logger。具体示例和资源归属见 [Connector 接入](database/README.md#connector-接入v091-preview)。
+
+| 能力 | 包与接入说明 |
+| --- | --- |
+| 数据库连接池、事务、显式迁移 | `database`，见 [数据库](database/README.md)；表结构与驱动由项目选择 |
+| 本地文件、S3、R2、OSS、直传与临时下载 | `storage`，见 [文件存储](storage/README.md)；业务依赖接口，装配时选择适配器 |
+| 缓存、出站 HTTP、限流、幂等、后台任务 | `cache`、`httpc`、`middleware`、`task`，见 [基础模块](MODULES.md) |
+| JWT/Session、策略、Redis 队列、审计、分页、观测 | 见 [扩展模块](ADVANCED.md)；按需注入实现 |
+| 存活与就绪检查 | `health`，见 [健康检查](health/README.md)；数据库等依赖作为 readiness 探针 |
+
+API 项目的数据库迁移需要单独维护并显式执行；启动不会自动改表。完整示例 [userService](examples/userService/README.md) 展示 MySQL、事务、鉴权、日志和文件导出，可参考依赖装配方式后接入自己的业务规则。
+
+## 配置与运行
+
+生成项目从 `etc/config.yaml` 读取配置，优先级为 **默认值 → 配置文件 → 环境变量**。密钥通过环境变量提供。手写入口需显式调用配置加载函数并传给 `omni.New(omni.WithConfig(settings))`；单独调用 `omni.New()` 不会自动读取环境变量。
+
+| 环境变量 | 用途 |
+| --- | --- |
+| `GO_OMNI_HTTP_ADDR` | 监听地址；生成项目默认 `127.0.0.1:8080` |
+| `GO_OMNI_TRANSPORT` | `nethttp`（默认）、`native`、`http2` |
+| `GO_OMNI_TLS_CERT_FILE` / `GO_OMNI_TLS_KEY_FILE` | 成对设置 TLS 证书和私钥路径 |
+| `GO_OMNI_HTTP_READ_HEADER_TIMEOUT` / `GO_OMNI_HTTP_READ_TIMEOUT` | 请求头 / 请求读取超时，如 `5s` / `30s` |
+| `GO_OMNI_HTTP_WRITE_TIMEOUT` / `GO_OMNI_HTTP_IDLE_TIMEOUT` | 响应写入 / Keep-Alive 空闲超时 |
+| `GO_OMNI_HTTP_MAX_HEADER_BYTES` | 请求头大小限制，字节数 |
+| `GO_OMNI_SHUTDOWN_TIMEOUT` | 优雅退出等待时间，默认 `10s` |
+| `GO_OMNI_ENABLE_LOGGER` / `GO_OMNI_LOG_LEVEL` | 访问日志开关、日志级别 |
+| `GO_OMNI_TRUSTED_PROXIES` | 可解析转发地址头的可信代理 IP/CIDR，逗号分隔 |
+| `GO_OMNI_DB_HOST/USER/PASSWORD/DATABASE` | 官方 MySQL 适配器的结构化连接配置 |
+
+例如在生成项目中切换 native：
 
 ```sh
-python3 scripts/verifyBusiness.py --version v0.6.0-preview
+GO_OMNI_TRANSPORT=native go run .
 ```
 
-该验收会在临时目录中先固定 `v0.2.0`，再升级到 `v0.6.0-preview`，检查无本地 replace、配置加载、结构化日志、requestId、CRUD、校验错误、业务错误和优雅退出。
+手写入口可用 `omni.WithTransport(omni.TransportNative)`；TLS 配置为 `omni.WithTLS(certFile, keyFile)`。native 提供 HTTP/1.1、Keep-Alive、TLS、超时、连接/请求并发上限和对象复用；HTTP/2 是单独的实验适配器，必须配置 TLS。默认 nethttp 的 TLS 支持 HTTP/1.1 与 HTTP/2。
 
-标准库与 native 的并发、延迟和长连接内存对照见 [PERFORMANCE.md](PERFORMANCE.md)。`python3 scripts/verifyPerformance.py` 运行检查与 benchmark；增加 `--load --output /tmp/goOmniPerf.json` 可测量独立服务进程并保存报告。
+读写超时也可以在生成项目的 `etc/config.yaml` 中声明（放在 `server.http` 下）：
 
-HTTP/2 仍是显式 opt-in 实验适配器，不会改变 native 的 HTTP/1.1 默认路径。Linux TLS 长测使用 `python3 scripts/verifyHTTP2.py --duration 30m`，默认使用普通 Go 运行模式；`--race` 默认改为 60 秒，用于并发检查，其额外内存开销不能当成生产运行基线。
+```yaml
+server:
+  http:
+    readHeaderTimeout: 5s
+    readTimeout: 30s
+    writeTimeout: 30s
+    idleTimeout: 60s
+    maxHeaderBytes: 1048576
+```
 
-多连接混合场景使用 `python3 scripts/verifyHTTP2.py --scenario mixed --duration 30m`：8 条独立 TLS 连接，每条连接 14 个普通请求 worker、1 个慢上传 worker、1 个慢下载 worker，共 128 个 worker。上传为 256 KiB、每 4 KiB 等待 2 ms；下载为 8 MiB、每次最多读取 64 KiB 后等待 20 ms。日志分别记录三类成功数、传输字节数、每条连接的覆盖情况，以及停止并释放测试数据后两次 GC 的采样。
+代码配置使用 `omni.WithHTTPConfig(omni.HTTPConfig{ReadTimeout: 30*time.Second, WriteTimeout: 30*time.Second})`。`Run`、`RunContext`、`ServeContext` 会应用它；`NewServer` 会配置返回的标准 `http.Server`，包含可选的 Go 字段 `ErrorLog`。**正值覆盖、零值保留所选网络层的原有默认行为、负值报错**；不配置时升级行为不变。超时含义与支持范围见 [HTTP 配置](transport/README.md#http-配置v091-preview)，不要把网络 I/O 超时当成业务执行时限。
 
-该脚本默认把测试容器限制为 2 核、2 GiB 内存（禁用 swap）、256 个进程/线程，整个命令最多运行 40 分钟，中断和超时会清理本次容器。这些限制可用 `--cpus`、`--memory-mb`、`--pids-limit`、`--wall-timeout` 调整；共享服务器应先用 `--duration 60s` 短测，再逐步延长。每 15 秒输出的堆、RSS 和 FD 统计包含同一进程内的客户端与服务端。
+自研网络层通过 `RunWith(ctx, runner)` 接入监听与连接生命周期，通过 `NewWithRouter(router)` 替换路由；业务 Handler/Service 不需要导入具体适配器。细节与验收契约见 [网络适配层](transport/README.md)。
 
-Linux amd64 已完成 30 分钟、单 TLS 连接、128 个 worker 的普通模式长测：58,102,476 次请求，0 失败、0 协议错误，采样 RSS 峰值约 22.6 MiB，连接/活动请求归零且 FD 回到基线。完整采样和原始日志见 [HTTP/2 长测报告](performance/http2SoakLinux.json) 与 [原始日志](performance/http2SoakLinux.txt)，此前的 race 对照见 [短测记录](performance/http2SmokeLinux.json)。这项结果覆盖单连接复用。
+生成项目的依赖可调用 `svcCtx.RequestShutdown(err)` 主动申请退出，框架排空请求、清理依赖后保留故障原因并以非零状态退出。健康检查与 OpenAPI 的开关、路径通过 `server.endpoints` 配置，健康响应默认沿用项目公共体；未就绪保持 HTTP 503。完整配置和 v0.12 项目的升级步骤见 [项目指南](PROJECT.md#依赖主动申请退出)。
 
-多连接慢客户端场景也已完成 Linux amd64 的 30 分钟长测：8 条 TLS 连接、128 个 worker，53,079,128 次普通请求、106,971 次慢上传、5,588 次慢下载，共 53,191,687 次，0 失败与协议错误。采样 RSS 峰值约 116.6 MiB（包含客户端、服务端和下载缓冲）；退出后连接/请求归零，goroutine 回到 2、FD 回到 6；释放测试数据并两次 GC 后存活堆约 450 KiB，RSS 不要求立即归还操作系统。完整 120 份采样见 [混合长测报告](performance/http2MixedSoakLinux.json) 和 [原始日志](performance/http2MixedSoakLinux.txt)。连接级窗口耗尽、WINDOW_UPDATE 恢复及零窗口写阻塞的关闭回收也已有独立测试；Nginx 的 HTTP/2 回源验收结果见下方，适配器保持实验状态。
+`Run` 处理 SIGINT/SIGTERM；`RunContext` 接收调用方控制的退出信号。服务先停止接收新请求，等待活跃请求完成，再清理资源；超时会取消请求并关闭连接，业务代码仍需响应 context 取消。
 
-`python3 scripts/verifyHTTP2Proxy.py --count 3` 验证真实 Nginx 双段 TLS/h2、回源连接复用、证书拒绝、超时/取消恢复与新旧实例的 GOAWAY 排空；增加 `--race` 可运行并发检查。Linux amd64、Nginx 1.30.5 的普通与 race 模式各 3 轮均已通过。编译和测试容器顺序运行，均限制为 2 核、2 GiB；测试容器禁用外部网络，全部请求在容器内完成。使用方法、报告及当前边界见 [HTTP/2 代理回源验收](transport/http2/PROXY.md)。
+## 日常开发与升级
 
-在框架根目录运行：
+在已生成的 API 项目目录执行：
 
 ```sh
-go run ./examples/reference
+go-omni api validate
+go-omni api inspect
+go-omni api generate --dry-run
+go-omni api generate
+go-omni api generate --check
+go test ./...
 ```
 
-默认地址为 `http://127.0.0.1:8080`。示例文档提供完整的 curl 操作流程。数据只保存在内存中，重启后清空。
+`main.go`、`Gen.go`、`docs/openapi.json` 和 manifest 由生成器管理，手动修改会报告冲突。Logic、Repository、中间件实现、配置和依赖装配属于项目，重复生成保留手写内容。契约变化会提示受影响的 Logic 文件和 DTO 字段，明确的签名错误会给出原签名与期望签名；生成后 `--check` 仍能检出未修复的问题。将 `.api`、生成文件和 `.goOmni/apiManifest.json` 一起提交，CI 同时运行 `generate --check` 与 `go test ./...`。详见 [契约变更提示与检查边界](PROJECT.md#契约变更提示)。
 
-框架的 `App` 也实现了标准 `http.Handler`，可以直接用于 `http.Server` 和 `httptest.NewServer`；业务路由可通过 `*omni.RouterGroup` 注册，无需导入网络库。
+CLI 与业务 module 固定使用 `v0.16.0-preview`。v0.14.x 项目升级依赖与 CLI 后重新生成，框架维护的 main/runtimeGen 自动更新；v0.13 及更早项目按 [升级预览](DEVELOPMENT.md#v013-项目升级) 处理，不直接覆盖手写入口或业务文件。升级后执行生成检查与业务回归。版本变化、迁移边界和验收记录见 [发布说明](RELEASE.md)。
 
-## 当前边界
+## 按需深入
 
-缓存、消息队列和定时任务暂时作为后续可选模块。认证层只定义 `Authenticator`、`Principal` 和路由保护中间件，具体 JWT、Session 或 OAuth 由项目实现。核心数据库层只依赖 `database/sql`，具体驱动、迁移和表结构由项目选择。
+| 需要了解 | 文档 |
+| --- | --- |
+| `.api` 类型、参数绑定、错误、鉴权和生成规则 | [API 开发指南](API.md) |
+| 公共响应体、提示优先级、独立回调协议 | [响应参考](RESPONSE.md) |
+| CLI 完整参数、本地框架开发与迁移 | [CLI](cmd/go-omni/README.md) |
+| 当前生成项目：Go 错误目录、上传、回调和下载 | [managedService](examples/managedService/README.md) |
+| 数据库/事务业务参考（旧目录示例） | [userService](examples/userService/README.md) |
+| 手写接口分层示例 | [reference](examples/reference/README.md) |
+| 框架成熟度、历史变更 | [路线图](ROADMAP.md)、[更新记录](CHANGELOG.md) |
+| 网络性能、测试条件与适用范围 | [性能说明](PERFORMANCE.md)、[HTTP/2 验收](transport/native/HTTP2.md) |
 
-当前成熟度与后续验收标准见 [ROADMAP.md](ROADMAP.md)，版本变更见 [CHANGELOG.md](CHANGELOG.md)。
+当前版本可用于固定版本接入与业务验证，仍标记为 preview。`.api` 借鉴 go-zero 的接口开发方式，支持范围以本仓库文档为准，不是完整 goctl 语法兼容层；HTTP/2 保持实验状态，OSS/R2 云账号实网验收不属于本次发布范围。

RELEASE.md

@@ -1,63 +1,219 @@
-# v0.7.0-preview
+# v0.16.0-preview
 
-这一版把 API 定义、项目生成、基础模块初始化和完整业务示例接通。
-预览版用于固定版本试用；API 方言有明确范围，HTTP/2 仍是独立实验适配器。
+补齐通用契约与生成体验，业务响应协议继续由项目定义：
 
-## 安装与开始
+- `returns([]string/[]int64/[]bool/[]any)` 及其他支持的基础类型数组，贯通 Logic、Handler、OpenAPI 和生成检查。nil 根数组输出 `[]`；DTO 数组、nullable、null、raw 和 204 保持原语义。字节数组明确拒绝 base64/数组歧义。
+- OpenAPI 以标准 components / `$ref` 共享重复响应、schema、示例；保留同一 HTTP 200 下的成功与失败、模板参数、数字业务码和 data:null。
+- workspace 显式配置 Go Catalog 提供方，一次导出共享 JSON，多服务通过受控根引用。支持服务/路由的文档错误列表，运行期 App 目录继承不变。check 核对导出漂移并保持项目文件不变。
+- EnvOptions.Aliases + ServerEnvAliases 统一完整配置与框架短名称的 Lookup、类型转换、空值规则。完整名称优先，显式空值不等于未设置；旧 ApplyEnv 的空值/逗号列表行为保留。
 
 ```sh
-GOPRIVATE=git.yuntuo.hk go install git.yuntuo.hk/k2safe/go-omni/cmd/go-omni@v0.7.0-preview
-
-go-omni api new --module example.com/demo ./demo
-cd demo
-GOPRIVATE=git.yuntuo.hk go mod tidy
-go run ./cmd/server
+go get git.yuntuo.hk/k2safe/go-omni@v0.16.0-preview
+go install git.yuntuo.hk/k2safe/go-omni/cmd/go-omni@v0.16.0-preview
+go-omni api generate
+go-omni api generate --check
+go test ./...
 ```
 
-需要该 Git 仓库的读取权限时，通过自己的 Git 凭据管理器配置；不要将凭据写入 module path 或 go.mod。
-CLI 会将自身下载版本固定到生成项目的 go.mod。业务项目正常使用远程模块，不需要本地 replace。
+旧项目 config/Logic/svc 继续由开发者维护，不会被重新生成覆盖。已有环境配置需按 [一次覆盖完整配置](DEVELOPMENT.md#一次覆盖完整配置与-http日志短名称) 合并 OverlayEnv 与 ApplyEnv；共享错误目录接入见 [workspace 配置](DEVELOPMENT.md#同一份-go-错误目录供多个服务生成)。已有手写权限 Handler 切换自动生成前，先迁出实现并显式移除 Manual 文件，生成器不会静默删除。
 
-使用已有定义，并一次选择基础模块：
+全量 race（含实际生成消费者）、vet、build、根入口/退出/再生成验证通过。eTax 只读契约验收：API 文档 20,751,149 → 847,171 字节，ID 文档 1,008,210 → 392,481 字节；70 个操作展开引用后与原文档完全一致。详见 [验收记录](reports/contractFollowupAcceptance.md)。这不代表已完成业务项目迁移。
+
+---
+
+# v0.15.0-preview（历史版本）
+
+增加通用后台分阶段关闭：生成入口先完成 HTTP 排空，再运行全部 OnStop、全部 OnDrain，确认组件收尾后逆序释放 OnClose 资源，最后关闭日志。适用于任意后台组件；不引入 Orbit，不改变业务事务或任务一致性策略。
+
+- svc 登记成对、同名的 OnStop/OnDrain，Context 用于早期退出通知，WorkContext 供已接受工作在收尾期间使用。同一阶段并发执行，存在内部先后依赖的组件组合登记。
+- server.lifecycle 配置 stopTimeout、drainTimeout、cancelTimeout。阶段超时取消工作并给未返回钩子收尾窗口；错误与阶段/组件名称可通过错误链追踪。
+- 不能确认后台已经结束时，返回 ErrResourcesRetained，保留共享资源和借用日志，生成进程非零退出。未返回的 Stop 不会与自己的 Drain 重叠；错误、panic 不阻止其他组件尝试收尾。
+- task.Runner 增加 StopAccepting/Wait，原 Shutdown/Close 继续可用。核心 lifecycle 不依赖 task 或其他适配器。
+- 初始化和监听失败复用同一流程；重复关闭只执行一次。生成器继续保留配置、svc 和业务代码。
 
 ```sh
-go-omni new --api user.api --module example.com/userService \
-  --database mysql --storage local --log-output file ./userService
+go get git.yuntuo.hk/k2safe/go-omni@v0.15.0-preview
+go install git.yuntuo.hk/k2safe/go-omni/cmd/go-omni@v0.15.0-preview
+go-omni api generate
+go-omni api generate --check
+go test ./...
 ```
 
-MySQL 与存储需要按生成 README 设置环境变量。任意契约生成的业务方法先返回 501，
-由业务方实现；可直接参考 [完整用户示例](examples/userService/README.md)。
+v0.14.x 无需重写 svc/config；生成器更新 main/runtimeGen，未配置时使用默认时限。也可 api upgrade --dry-run/--apply 更新依赖与生成文件，保留已有项目扩展。需要阶段保证的旧后台 OnClose 登记，应显式迁到 Stop/Drain；v0.13 及更早版本仍按原迁移指南处理。
 
-## 主要变化
+全量 race（含实际生成项目）、vet、build 和隔离 MySQL/GORM 验收已通过。发布后的空缓存远程生成项目与真实 MySQL/GORM 验收也通过，CLI/框架同版且无本地 replace；标签固定在 `16deead70e860052c5b629511207578c03f9b2cb`。详见 [生命周期接入](lifecycle/README.md#后台组件分阶段关闭) 与 [验收记录](reports/phasedLifecycleAcceptance.md)。Go 无法强制结束任意 goroutine；OnClose 仍须能返回，HTTP 处理器仍须响应取消。此版不会将未知的第三方组件自动改造成优雅关闭组件。
 
-- `.api` 生成项目、绑定/校验、路由、业务骨架和 OpenAPI；支持分组、导入、命名中间件。
-- 同一入口初始化 MySQL、日志、Local / S3 / R2 / OSS；标准 context 与 httpx 保持业务/网络分离。
-- 生成器保护手写业务文件，校验自有文件哈希，支持只读 --check；基础设施选项持久化到 manifest。
-- 完整用户示例包含数据库迁移、CRUD / 分页、事务审计、鉴权、文件导出与 requestId 日志。
-- 日志文件轮转/结构化脱敏、上传策略/直传/分片，以及此前 main 分支的通用业务模块一并提供。
+---
 
-所有变化及网络层验收记录见 [CHANGELOG](CHANGELOG.md)。
+# v0.14.1-preview（历史版本）
 
-## 升级注意
+增加可选 `database/gormx`：GORM 复用 go-omni 已初始化的标准池、TLS、限额、健康检查和关闭流程，业务继续使用原生 GORM 模型与事务。核心 App/数据库包的编译依赖链不引入 GORM。
 
-1. 将 CLI 和项目框架依赖固定为相同版本。旧版 CRUD 项目继续使用现有目录；不能直接用 API 生成器接管已有 Go 目录。
-2. Gen.go 由生成器维护，业务实现/配置/迁移由项目维护。新增 API 后执行 generate 和 go test；修改或删除类型需要同步处理自己的业务代码。
-3. `.goOmni/apiManifest.json` 需随代码提交。切换数据库或存储选项时，在新目录生成对照后迁移；重新生成不会改写现有基础设施文件。
-4. 配置使用 lowerCamelCase。DSN、Token、存储密钥由环境变量提供；`database.Config` 的 DSN 不会被 JSON/YAML 序列化。
-5. API 的 none/memory 数据库选项仅表示不打开连接，不会从 HTTP DTO 自动推导内存仓库或数据表。
+在 svc.Init 中调用 `gormx.MySQL(ctx, c.DB, gormx.WithLogger(c.Logger))`；通用 Open 工厂保留其他方言入口。适配器保护借用池不被初始化失败路径关闭，并为初始化查询设置时限。查询使用 WithContext，SQL 日志接入 logx，请求标识、慢查询和错误分类贯通；默认不输出绑定参数与驱动完整错误文本。
 
-## 验证入口
+v0.14.0 项目更新 module 与 CLI 即可，不改生成目录或 main。模板最低运行时保持 v0.14.0；修正新版 CLI 把最低兼容版本误当自身版本、导致同版消费者出现版本提示的问题。其他数据库方言和管理额外池的插件未纳入本次实库验收，原生 PrepareStmt 的生命周期限制见 [接入说明](database/gormx/README.md)。
 
 ```sh
-GO_OMNI_SCAFFOLD_INTEGRATION=1 go test -race -p=2 -count=1 -timeout=300s ./...
+go get git.yuntuo.hk/k2safe/go-omni@v0.14.1-preview
+go install git.yuntuo.hk/k2safe/go-omni/cmd/go-omni@v0.14.1-preview
+```
+
+全量 race（含生成消费者）、vet、build，以及隔离 MySQL 的事务/取消/日志/生成项目接入通过。发布后的空缓存远程 MySQL/GORM 和生成项目验收均通过，无本地 replace，CLI 与框架使用同版。标签固定在 `b8ab6b35219d53d6de392c920fe7ecbe9a76dade`，详见 [GORM 验收](reports/gormAcceptance.md)。
+
+---
+
+# v0.14.0-preview（历史版本）
+
+本版补齐契约驱动的业务开发与通用基础设施。项目继续维护接口、配置、依赖装配、Logic、SQL 和业务规则；生成器维护入口、请求绑定、路由、响应与文档。
+
+## 安装与升级
+
+```sh
+go install git.yuntuo.hk/k2safe/go-omni/cmd/go-omni@v0.14.0-preview
+go-omni new --module example.com/billing ./billing
+```
+
+新生成器与运行时一起升级。已有 v0.13 项目先运行 `go-omni api upgrade --dry-run`，再按 [定点迁移步骤](DEVELOPMENT.md#v013-项目升级) 处理；不会静默覆盖自定义 svc/config。运行期的新构造器由生成器维护，项目初始化迁入 `svc.Init`，使用 `OnClose` 登记资源。
+
+## 本版能力
+
+- `.api` 支持根数组、可空对象、成功 null；真正 204 独立保留。生成 Logic、Handler、OpenAPI 和漂移检查使用相同语义。
+- 请求契约控制未知 query、原始 UTF-8、charset、必须/可选/禁止 body 和严格空对象。路由覆盖 App 策略，普通 JSON 只解析一次。
+- multipart 声明文件、文本和 JSON 表单字段。Logic 收到校验后的 DTO；文件有界暂存、流式读取、请求结束清理，保留底层 raw/multipart/下载扩展。
+- 完整项目配置支持环境覆盖、显式零值、空值策略、必填、嵌套及复杂类型。独立校验先于日志和连接创建。
+- `lifecycle.Runtime` 统一逆序清理、幂等关闭、失败回滚及故障保留；App Logger 独立，支持标准 `log.Logger` 与可信请求元数据。提供依赖中间件装配示例和可选 context 错误映射。
+- 官方 `database/mysql` 适配器提供结构化配置、每连接池独立 TLS/mTLS、驱动日志、启动检查与失败清理。继续返回同一 `database.DB`，不自动迁移表或重试业务事务。
+- 字段注释、示例和枚举说明进入 DTO/OpenAPI；`api format` 幂等格式化。Go 错误目录可显式导出供文档使用，无需复制错误定义。
+- 显式共享契约 roots、来源摘要、分文件 DTO、多服务 workspace 命令、基础模板升级预览；保留目录边界及业务文件所有权。
+
+详见 [业务开发指南](DEVELOPMENT.md)、[数据库接入](database/mysql/README.md) 和 [验收记录](reports/businessDevelopmentAcceptance.md)。
+
+全量 race（含生成项目）、vet、build 与本地进程验收通过。发布后的空缓存远程消费者和隔离 MySQL 验收也均通过；CLI/框架同版且无本地 replace。标签固定在 `f5478cdc7662704b164637649305361e52f7c598`，报告单独提交。
+
+仍需业务维护：契约、配置、svc 依赖创建/探针/清理登记、错误目录、Logic、Repository 和权限中间件。特殊协议可使用保留的扩展点。声明式上传的暂存磁盘和并发量需配置容量；共享契约版本标签由项目管理，框架校验摘要但不下载依赖。此版仍为 preview，不代表 eTax/ePay 已完成业务迁移。
+
+---
+
+# v0.13.0-preview（历史版本）
+
+本版补齐项目依赖主动退出与内置接口配置。ID 租约、数据库或后台任务等故障由项目判断，框架通过统一生命周期完成退出；不内置业务规则。
+
+## 使用与升级
+
+```sh
+go install git.yuntuo.hk/k2safe/go-omni/cmd/go-omni@v0.13.0-preview
+# 在业务 module 中执行
+go get git.yuntuo.hk/k2safe/go-omni@v0.13.0-preview
+go-omni api generate
+```
+
+新项目自动获得全部扩展。v0.12 的 config/svc 属于项目文件，重新生成会保留它们；需按 [升级步骤](PROJECT.md#从-v012-生成项目升级) 给 svc 补入 Lifecycle、RequestShutdown 与清理衔接，main 和 Handler 由生成器更新。旧 v0.11 目录仍按原迁移规则在新目录生成。
+
+## 行为
+
+- `svc.RequestShutdown(err)` 非阻塞通知：停止接收请求、排空、关闭依赖和日志。首个非空故障保留，故障退出码为 1；正常停止在没有其他故障时退出码为 0。初始化期间通知、并发通知和排空期间报告故障均可处理。
+- App 生命周期入口保留异常 context 取消原因；符合 context.Canceled 的信号取消保持正常停止。生成入口还读取 Controller.Err，保留显式依赖故障，即使该故障包装了 context.Canceled。
+- `/health/ready` 修复绕过响应配置的问题，默认与 liveness 一起使用项目 App 的响应格式。就绪成功使用项目成功码与提示；未就绪使用 `NOT_READY` 的项目错误定义，同时固定 HTTP 503。raw 模式只返回健康数据；内部探针原因仅供日志。
+- `server.endpoints` 控制三个内置 GET 接口的开关和路径，健康端点另有 responseMode。支持环境变量覆盖。OpenAPI 保持原始规范，不包业务公共体；关闭 HTTP 端点不影响生成文档。
+- `.api` 不再固定保留三个默认路径；启用的内置路径与业务 GET/参数/通配路由重叠时，启动前返回明确错误并清理已创建的依赖。关闭或改名后允许项目接管旧路径。全局中间件继续执行。
+
+## 验收
+
+源码测试和实际生成项目验证记录见 [生命周期与端点验收](performance/lifecycleEndpointsAcceptance.md)。复验命令：
+
+```sh
+GO_OMNI_SCAFFOLD_INTEGRATION=1 go test -race -p=1 -count=1 -timeout=300s ./...
 go vet ./...
 go build ./...
-python3 scripts/verifyAPIWorkflow.py
-python3 scripts/verifyAPIWorkflow.py --version v0.7.0-preview \
-  --report performance/apiWorkflowRemote.json
+python3 scripts/verifyManagedProject.py --report performance/lifecycleEndpointsLocal.json
+python3 scripts/verifyManagedRelease.py --version v0.13.0-preview --report performance/lifecycleEndpointsRemote.json
 ```
 
-最后一项在全新 module cache 安装远程 CLI，并验证无本地 replace 的项目生成、
-真实 MySQL、nethttp/native 启动与业务流程。容器只使用本机临时资源，结束时清理。
-本轮验收见 [API 业务闭环报告](performance/apiWorkflowAcceptance.md)。
+发布后的远程空缓存验收已通过，耗时 26.55 秒；[机器报告](performance/lifecycleEndpointsRemote.json) 确认 CLI 和生成项目使用同版远程 module，无本地 replace。报告单独提交，发布标签保持在代码提交 `f0991d3ff248e4cb32812c368f0f8ba28740a6c7`。此版仍为 preview；具体业务的租约失效保护、鉴权与事务回归由接入项目验证。资源清理顺序不代表能强行结束忽略 context 取消的业务 goroutine；项目 Close 必须停止并等待自己启动的后台任务。
 
-OSS/R2 云端仍需项目自己的账号做上线环境验收；当前云端适配器检查不等同于这些账号的实网测试。
+---
+
+# v0.12.0-preview（历史版本）
+
+本版用于固定版本开展业务接入。生成器统一维护服务根目录 main.go、路由、HTTP Handler、DTO 和 OpenAPI，业务方维护 `.api`、config、svc、logic、repository 与项目中间件。目录不再生成 cmd/server、settings、servicecontext 或 service。
+
+## 安装与接入
+
+仓库权限及 PATH 配置见 [README](README.md#准备环境与安装)。CLI 与框架使用同一版本：
+
+```sh
+go install git.yuntuo.hk/k2safe/go-omni/cmd/go-omni@v0.12.0-preview
+go-omni new --module example.com/hello ./hello
+cd hello
+go mod tidy
+go run .
+```
+
+已存在的手写项目可直接 `go get git.yuntuo.hk/k2safe/go-omni@v0.12.0-preview`。采用生成目录的旧项目在新目录生成后迁入业务代码，详见 [接入步骤](PROJECT.md#已有服务接入步骤) 和 [文件维护边界](PROJECT.md#哪些文件由用户维护)。新 manifest v2 不兼容旧 manifest；不会静默覆盖手写 main，也不会删除独立 cmd/migrate 等工具。
+
+## 本版行为
+
+- 根目录支持 go run / go build；入口负责配置、日志、依赖、HTTP 启动与信号退出。svc 的 AppOptions、GlobalMiddleware 和 OnClose 是显式扩展入口；初始化/监听失败会释放资源，正常退出先排空请求再关闭依赖和日志。
+- `.api` 入口通过 `@app(defaultResponse: Name)` 选择默认响应，覆盖普通路由、404/405 与相应中间件错误；多模板不会按声明顺序猜默认值。字段、状态、业务码和文案由项目配置。
+- 保持 v0.11.1 的错误目录继承：Go 中注册一次，无独立错误目录的生成路由继承 App。带参数提示、内部错误链、raw 响应和独立目录保持各自行为。
+- raw/multipart 上传及 `@produces` 下载可直接编写 Logic，由生成 Handler 完成受限读取、响应和流关闭。损坏 multipart 默认 400，超限 413；项目可以定制公开错误。
+- 契约变更提示受影响的 Logic、DTO 字段和请求模式；明确的签名/语法/重复方法错误使 `generate --check` 失败。重新生成保留业务文件，main 和其他生成文件的漂移也会被检查。
+
+## 验收与范围
+
+发布前全量 race 测试、go vet、go build 和本地实际生成项目进程验收通过。发布后的空缓存远程验收也已通过，记录见 [生成项目验收](performance/managedProjectAcceptance.md) 和 [远程产物报告](performance/managedProjectRemote.json)。报告作为单独提交保存，v0.12.0-preview 标签保持在发布代码提交 `158b8002b355f09237cd12f49d9b66ee78d493f3`，没有改写。复验命令：
+
+```sh
+GO_OMNI_SCAFFOLD_INTEGRATION=1 go test -race -p=1 -count=1 -timeout=300s ./...
+go vet ./...
+go build ./...
+python3 scripts/verifyManagedProject.py
+python3 scripts/verifyManagedRelease.py --version v0.12.0-preview
+```
+
+远程验收使用空 module 缓存安装已发布 CLI，生成的业务项目仅依赖同版远程 module，无本地 replace；检查根目录运行/构建、重新生成、错误继承/模板参数、上传下载、nethttp/native 的真实请求与退出信号，以及初始化失败/监听失败/请求排空后的清理。
+
+本版不代表具体业务项目已完成迁移验收。HTTP/2 仍为实验状态；真实数据库、云账号和业务服务器不属于本轮验收范围。轻量 Logic 检查不能代替 Go 编译器或业务测试。静态 OpenAPI 不执行 Go 代码，因此不会自动列举仅在 Go 中维护的错误目录。请求流校验不能回滚业务提前执行的副作用，关键写入应放在 `body.Complete()` 成功之后。
+
+---
+
+# v0.11.1-preview（历史版本）
+
+修复生成路由使用空错误目录遮蔽 `omni.WithErrors(catalog)` 的问题。错误现在可以只在 Go 中注册一次，`.api` 无需重复定义错误目录或逐条列出错误。
+
+## 行为
+
+- 未声明路由错误列表：继承 App 目录，包括带参数提示及项目自定义 INTERNAL_ERROR 兜底。
+- 显式引用路由错误：继续使用路由独立目录，不与 App 合并。
+- `@errors none` 清空 `.api` 分组错误列表，随后继承 App。
+- 错误继承不覆盖 `.api` 的返回格式、RawJSON、手写绑定或请求体限额；全局中间件提前返回、标准桥接与克隆保持一致。
+- 空 `response.WithErrors` / `MustWithErrors` 返回原 Encoder，既不覆盖 Context 的目录，也不在编码阶段按空目录重新解析错误。
+
+## 升级
+
+```sh
+go get git.yuntuo.hk/k2safe/go-omni@v0.11.1-preview
+go install git.yuntuo.hk/k2safe/go-omni/cmd/go-omni@v0.11.1-preview
+go-omni api generate --dry-run
+go-omni api generate
+go test ./...
+```
+
+运行时修复也适用于旧 v0.11.0 生成代码，因此升级运行时后即可解除空目录遮蔽。同步升级 CLI 重新生成时不再创建空目录包装；已生成业务文件继续受保护。代码生成最低运行时仍为 v0.11.0-preview。
+
+接入见 [README](README.md)、[错误目录继承](errors/README.md) 和 [只在 Go 注册错误的契约示例](examples/contracts/errorInheritance.api)。静态 OpenAPI 不执行 Go 配置，保留契约响应结构，不自动列举运行时目录内容。
+
+## 验收
+
+复现用例在修复前：普通路由通过，生成/RawJSON 路由和提前返回中间件共 12 项失败，均变成 500/英文系统提示。修复后同一批用例通过。
+
+```sh
+GO_OMNI_SCAFFOLD_INTEGRATION=1 go test -race -p=1 -count=1 -timeout=300s ./...
+go vet ./...
+go build ./...
+python3 scripts/verifyErrorInheritanceRelease.py --version v0.11.1-preview
+python3 scripts/verifyErrorParamsRelease.py --version v0.11.1-preview --report performance/errorInheritanceParamsRemote.json
+python3 scripts/verifyCompatibilityRelease.py --version v0.11.1-preview --report performance/errorInheritanceCompatibilityRemote.json
+```
+
+结果见 [目录继承验收](performance/errorInheritanceAcceptance.md)。本轮未修改 eTax/ePay 业务代码，没有使用业务服务器。

RESPONSE.md

@@ -0,0 +1,149 @@
+# 公共响应体与独立接口协议
+
+这些功能从 `v0.8.0-preview` 提供。CLI 与项目框架依赖请固定到同一版本；源码开发可显式使用 `--framework-dir`。`v0.7.0-preview.1` 不包含响应模板声明。
+
+go-omni 的响应编码由应用或接口配置。没有配置时保留旧版默认值；业务可以定义自己的字段、嵌套结构、错误码类型、提示和空值行为。`response.Response` 仅保留为兼容 DTO，运行时与生成器不再通过它固定响应结构。
+
+## 在 .api 中定义一次、到处引用
+
+```go
+response CommonResponse (
+ body: {
+  "code": "${code}",
+  "msg": "${message}",
+  "data": "${data}"
+ }
+ codeType: int32
+ successCode: 200
+ errorCode: 9999
+ successMessage: "操作成功"
+ dataMode: always
+ codes: {"USER_NOT_FOUND":404001}
+ messages: {"USER_NOT_FOUND":"用户不存在"}
+)
+
+@server (
+ group: user
+ response: CommonResponse
+)
+service user-api {
+ @handler getUser
+ get /users/:userId (GetUserReq) returns (UserResp)
+
+ @response raw
+ @handler rawUser
+ get /rawUsers/:userId (GetUserReq) returns (UserResp)
+}
+```
+
+请求/业务返回类型照常在 `type` 中定义。上例 `UserResp` 是业务数据，由模板中的 `${data}` 放入公共体。请求失败时，同一模板输出映射后的业务错误。错误本身的 HTTP 状态保持不变，业务 `code` 与 HTTP 状态相互独立。
+
+- 公共声明可以放进 `common.api`，其他契约通过 `import "common.api"` 复用。
+- `@server (response: CommonResponse)` 指定整个 service 块的公共体；不同块可以引用同一个模板。
+- `@response PartnerResponse` 为单接口替换模板，成功和错误一起生效。
+- `@response raw` 让成功 JSON 直接返回业务对象，错误沿用组级模板；组本身为 raw 时，错误使用默认模板。
+- 模板名使用 UpperCamelCase；未知模板、未知配置、错误的占位符和冲突设置在生成前报错。
+
+**生成接口以 `.api` 为响应契约来源。** 生成器把选定模板编译进 `internal/handler/responseGen.go`，在全局鉴权、限流等应用中间件之前选定，然后再执行路由中间件和业务。OpenAPI 与运行时共用配置和映射规则。即使 `.api` 没有声明模板，生成接口也明确使用默认契约，不会被应用的 YAML 设置静默改变。
+
+业务只需返回业务数据或业务错误，无需每个 Handler 手工组装公共体。生成器维护模板、路由及文档文件，重复生成不覆盖手写 Service、Repository、middleware 和配置。
+
+## 自定义结构与占位符
+
+公共体没有规定必须出现的字段，也可以把成功和失败分开：
+
+```go
+response PartnerResponse (
+ body: {
+  "accepted": "${ok}",
+  "payload": "${data}",
+  "meta": {"trace":"${requestId}","httpStatus":"${status}"},
+  "version": 1
+ }
+ errorBody: {
+  "accepted": "${ok}",
+  "error": {"reason":"${message}","id":"${code}"}
+ }
+)
+```
+
+`body` 是 JSON 对象，可嵌套对象、数组和常量；`errorBody` 可选，需要同时定义 `body`。空对象 `{}` 也是有效模板。
+
+| 整值占位符 | 输出值 |
+| --- | --- |
+| `${data}` | 当前接口的业务返回值，保留对象/数组/数值等原类型 |
+| `${code}` | 映射后的 string / int32 / int64 业务错误码 |
+| `${message}` | 公开提示，经 message 配置映射 |
+| `${requestId}` | 请求标识；为空时省略所在对象字段 |
+| `${ok}` | 成功为 true；有错误或 HTTP 状态 ≥400 时为 false |
+| `${status}` | HTTP 状态整数 |
+
+占位符只替换整个值，不执行表达式或字符串拼接。字面量 `${data}` 写成 `$${data}`。数据为 nil 时，`dataMode: omitNil`（默认）省略所在对象字段；`always` 输出 null。数组中的占位符保留位置。模板最多嵌套 24 层。
+
+`codeType` 使用与业务字段一致的类型名，默认 `string`：
+
+| 类型 | 含义 | OpenAPI |
+| --- | --- | --- |
+| `string` | 字符串业务码，例如 `"OK"`、`"USER_NOT_FOUND"` | string |
+| `int32` | 32 位有符号整数，−2147483648 到 2147483647 | integer / int32 |
+| `int64` | 64 位有符号整数，−9223372036854775808 到 9223372036854775807 | integer / int64 |
+
+整数类型必须提供 `successCode` 和 `errorCode`，支持 0 和负数；默认码和 `codes` 映射都会校验范围，越界或小数会报错。`int64` 的配置读取和生成代码保留完整整数精度，并按 JSON 数值输出；消费端也需要支持对应的整数精度。需要文本形式时可用 `string` 并配置字符串码。
+
+旧写法 `integer` 保留兼容，沿用 ±(2^53−1) 的数值范围；新配置优先写 `int32` 或 `int64`。
+
+`codes` 按逻辑错误码覆盖默认码；`messages` 优先于 `successMessage` / `errorMessage`。未配置的公开提示沿用原错误消息；内部 cause 不会被默认编码器序列化。
+
+简单的平铺响应也可使用 `codeField` / `messageField` / `dataField` / `requestIdField` 快捷配置，`"-"` 禁用字段。空名称沿用旧默认值。这些字段名快捷配置不能和 `body` 混用，以免两个定义冲突。
+
+## 手写路由、配置文件与三方回调
+
+手写路由的应用默认配置可以放在 JSON/YAML 的 `response` 字段，也可用 Go 选项：
+
+```go
+app := omni.New(omni.WithResponse(response.Config{
+ Body: map[string]any{"code":"${code}", "msg":"${message}", "data":"${data}"},
+ CodeType: "int32", SuccessCode: 200, ErrorCode: 9999, DataMode: "always",
+}))
+```
+
+应用之间的配置独立，模板在创建时验证并复制；没有全局可变的响应格式。应用配置快照也会复制模板和映射。响应配置属于静态配置，变更后需重启。
+
+单次显式输出可使用 `c.JSON(status, value)`、`c.Text(status, text)`、`c.XML(status, value)`、`c.Bytes(status, contentType, bytes)` 或 `c.NoContent()`，都绕过公共体。已经提交的响应不会再追加错误 JSON。
+
+三方回调可能要求成功与失败都返回 HTTP 200，并分别输出 `success` / `fail`。通过接口编码器统一处理成功、错误和 panic：
+
+```go
+ack := response.EncoderFunc(func(r response.Result) (response.Payload, error) {
+ if r.Err != nil || r.Status >= 400 {
+  return response.Text(200, "fail"), nil
+ }
+ return response.Text(200, "success"), nil
+})
+app.HandleWithResponse("POST", "/hooks/payment", ack, paymentHandler)
+```
+
+编码器也可以设置 HTTP 状态、Header、XML 或任意字节。`omni.WithResponseEncoder` 设置应用默认编码器；`httpx.WithResponse` 是普通路由中间件，按中间件顺序生效。需要覆盖全局中间件提前拒绝时，应使用 `HandleWithResponse`。自定义 Registrar 可以实现 `httpx.ResponseRegistrar` 提供相同的早期挂载能力；未实现时辅助函数退化为普通路由中间件。
+
+`@response raw` 表示原始 JSON，不代表任意文本/XML协议。从 v0.9.0-preview 开始，`.api` 可用 `@handlerMode manual` 配合 `@produces` 描述文本/文件等成功输出，详见 [迁移扩展](MIGRATION.md)。自定义回调错误协议仍使用上述 Go 入口，并由应用维护相应文档；生成器不会猜测自定义 Go 编码器的输出。如果在命名中间件里替换编码器，业务也必须同步维护文档。
+
+框架内置路由的 404/405 使用应用默认格式；它们不属于某个 `.api` 分组。TLS 握手、畸形 HTTP、连接级过载等发生在进入应用前，仍按网络层协议处理。自定义编码器失败、panic 或返回非法状态/204 body 时，最终返回空 500，避免递归编码或泄露另一种响应体。
+
+## 运行示例与验证
+
+```sh
+go run ./cmd/go-omni api validate --api examples/contracts/responses.api
+go run ./cmd/go-omni api generate --api examples/contracts/responses.api \
+  --module example.com/responseDemo --framework-dir . --dir ../responseDemo
+```
+
+示例业务方法起初为 501，完成 Service 后就会套用声明的模板。参考 [完整 .api](examples/contracts/responses.api)。验收测试会在临时目录生成真实项目，写入业务方法，执行已生成路由，检查数字错误码、原始 JSON、鉴权错误、路由覆盖与重复生成保护。
+
+
+## 错误目录与 HTTP 200 失败（v0.10.0-preview）
+
+错误含义由项目的 `errors.Catalog` 或 `.api errorCatalog` 集中定义，返回字段/结构仍由本页的 response 模板控制。目录提供独立的逻辑标识、对外字符串/整数码、消息、HTTP 状态，使用 `WithErrors` 或生成路由绑定。详见 [统一错误目录](errors/README.md)。
+
+`response.Result.IsError()` 综合明确失败标记、Err 和 HTTP 状态判断；HTTP 200 的业务错误不会使用成功码/成功提示，仍可选择 `errorBody`。新目录的公开码与提示优先于通用兜底；与同标识 Codes/Messages 冲突会拒绝，不会静默覆盖。没有目录的旧映射保持原有行为。
+
+自定义 Encoder 可读取 `Code`（逻辑标识）、`BusinessCode`（目录对外码）、Message 与 Err，并返回项目要求的最终状态和媒体类型。不要仅通过 Status 判断成功；内部原因默认只供诊断，不应由 Encoder 直接序列化 Err。RawJSON 的成功输出保持原样，失败继续交给所选错误编码器。

ROADMAP.md

@@ -1,5 +1,7 @@
 # GoOmni 成熟度计划
 
+当前进展：`v0.14.0-preview` 已完成契约驱动的业务开发能力、通用 Runtime/配置和官方 MySQL 适配器，并通过全量 race、实际生成服务及空缓存远程验收。新项目/升级以 [README](README.md) 和 [开发指南](DEVELOPMENT.md) 为准；下方为历史阶段记录，完整本轮验收见 [报告](reports/businessDevelopmentAcceptance.md)。具体 eTax/ePay 业务迁移与业务回归仍由接入项目完成。
+
 ## 1. 新项目启动与发布流程（已完成，v0.1.1）
 
 - 修正脚手架固定版本引用，保留显式本地开发选项。
@@ -88,4 +90,18 @@
 - 已完成本地模块测试及 race 检查，Linux 全仓库 race/vet/build、生成项目 CRUD、三个 Runner 的 TLS 示例和独立 Redis/MinIO/MySQL 均通过。共享状态、重复提交、失败消息、未确认消息接管、旧确认拒绝、对象签名和迁移 dirty 阻断有对应证据，见 [扩展模块验收](performance/advancedAcceptance.md)。OSS/R2 尚无云账号实网验收。
 - 契约、使用示例与限制见 [扩展模块](ADVANCED.md)；验证入口为 `scripts/verifyModules.py --advanced`，继续限制单个测试容器 2 CPU / 2 GiB / 256 pids。
 
+## 8. API 驱动项目与真实业务示例（v0.7.0-preview）
+
+- `.api` → DTO / 绑定校验 / 路由 / Handler / Service / Repository / OpenAPI。
+- MySQL、日志与五种存储选择可组合生成；manifest 管理生成文件，保留业务文件。
+- 独立用户示例完成事务审计、鉴权、文件导出、数据库故障恢复与真实远程依赖验收。
+- 证据：[API 业务闭环](performance/apiWorkflowAcceptance.md)。
+
+## 9. 接口开发体验（v0.7.0-preview.1）
+
+- 错误目录与调用函数、401/403/409 文档、具名鉴权和运行时 hook 关联。
+- 组级继承/路由覆盖、多行接口描述、标签和弃用标记。
+- 路由总览、独立 OpenAPI 导出、生成预览与项目入口自动识别。
+- 证据：[接口开发体验验收](performance/apiDeveloperExperienceAcceptance.md)。
+
 以上阶段以验收结果判断完成。当前仍是基础框架试用阶段；MySQL、适配层契约和一次业务模块试用已完成，自研网络层已有可运行预览，稳定性与生产规模验证尚未完成。

app/app.go

@@ -14,7 +14,9 @@ import (
 	"git.yuntuo.hk/k2safe/go-omni/config"
 	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
 	"git.yuntuo.hk/k2safe/go-omni/httpx"
+	"git.yuntuo.hk/k2safe/go-omni/lifecycle"
 	"git.yuntuo.hk/k2safe/go-omni/middleware"
+	"git.yuntuo.hk/k2safe/go-omni/response"
 	netrouter "git.yuntuo.hk/k2safe/go-omni/transport/nethttp"
 )
 
@@ -28,6 +30,7 @@ type App struct {
 	closeOnce        sync.Once
 	closeErr         error
 	clientIPResolver *httpx.ClientIPResolver
+	responseEncoder  response.Encoder
 }
 
 // Runner is the small lifecycle boundary used by an HTTP server
@@ -64,8 +67,22 @@ func configure(options ...config.Option) config.Config {
 }
 
 func newApp(router httpx.Router, settings config.Config) *App {
+	settings.Response = settings.Response.Clone()
+	settings.Errors = settings.Errors.Clone()
+	encoder, responseErr := response.New(settings.Response)
+	if responseErr != nil {
+		panic(responseErr)
+	}
+	var responseEncoder response.Encoder = encoder
+	if settings.ResponseEncoder != nil {
+		responseEncoder = settings.ResponseEncoder
+	}
 	settings.TrustedProxies = append([]string(nil), settings.TrustedProxies...)
 	settings.Log.RedactKeys = append([]string(nil), settings.Log.RedactKeys...)
+	responseEncoder, responseErr = response.WithErrors(settings.Errors, responseEncoder)
+	if responseErr != nil {
+		panic(responseErr)
+	}
 	resolver, err := httpx.NewClientIPResolver(settings.TrustedProxies...)
 	if err != nil {
 		panic("go-omni: " + err.Error())
@@ -75,7 +92,16 @@ func newApp(router httpx.Router, settings config.Config) *App {
 		middlewares = append(middlewares, middleware.AccessLog(middleware.WithSlowRequestThreshold(settings.SlowRequestThreshold)))
 	}
 	middlewares = append(middlewares, middleware.Recovery())
-	return &App{router: router, config: settings, middlewares: middlewares, clientIPResolver: resolver}
+	application := &App{router: router, config: settings, middlewares: middlewares, clientIPResolver: resolver, responseEncoder: responseEncoder}
+	if fallback, ok := router.(httpx.FallbackRouter); ok {
+		adaptError := func(status int, code, message string) http.Handler {
+			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				application.adapt(func(*httpx.Context) error { return apierrors.New(status, code, message) }).ServeHTTP(w, r)
+			})
+		}
+		fallback.SetFallbacks(adaptError(404, "NOT_FOUND", "route not found"), adaptError(405, "METHOD_NOT_ALLOWED", "method not allowed"))
+	}
+	return application
 }
 
 // Router returns the transport contract used by this application.
@@ -93,6 +119,8 @@ func (a *App) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
 // Config returns the effective application configuration.
 func (a *App) Config() config.Config {
 	settings := a.config
+	settings.Response = settings.Response.Clone()
+	settings.Errors = settings.Errors.Clone()
 	settings.TrustedProxies = append([]string(nil), settings.TrustedProxies...)
 	settings.Log.RedactKeys = append([]string(nil), settings.Log.RedactKeys...)
 	return settings
@@ -135,20 +163,29 @@ func (a *App) Run(address ...string) error {
 	return a.RunContext(ctx, address...)
 }
 
-// NewServer creates a plain standard HTTP server around the application.
+// NewServer creates a plain standard HTTP server with the configured HTTP options.
+// Invalid HTTP options panic; RunContext/ServeContext return validation errors.
 // Use RunContext or ServeContext to apply the configured transport and TLS.
 func (a *App) NewServer(address string) *http.Server {
+	if err := a.config.HTTP.Validate(); err != nil {
+		panic(err)
+	}
 	if address == "" {
 		address = a.config.Address
 		if address == "" {
 			address = ":8080"
 		}
 	}
-	return &http.Server{Addr: address, Handler: a.router}
+	cfg := a.config.HTTP
+	return &http.Server{Addr: address, Handler: a.router,
+		ReadHeaderTimeout: cfg.ReadHeaderTimeout, ReadTimeout: cfg.ReadTimeout,
+		WriteTimeout: cfg.WriteTimeout, IdleTimeout: cfg.IdleTimeout,
+		MaxHeaderBytes: cfg.MaxHeaderBytes, ErrorLog: cfg.ErrorLog}
 }
 
 // RunContext serves until the context is canceled, then performs a graceful shutdown.
-func (a *App) RunContext(ctx context.Context, address ...string) error {
+func (a *App) RunContext(ctx context.Context, address ...string) (runErr error) {
+	defer func() { runErr = shutdownResult(ctx, runErr) }()
 	if ctx == nil {
 		ctx = context.Background()
 	}
@@ -170,7 +207,8 @@ func (a *App) RunContext(ctx context.Context, address ...string) error {
 // RunWith starts a custom server runner while keeping App-owned cleanup in the
 // same lifecycle. The runner receives the transport-neutral App handler and
 // owns transport/TLS settings; built-in transport selection is bypassed.
-func (a *App) RunWith(ctx context.Context, runner Runner, address ...string) error {
+func (a *App) RunWith(ctx context.Context, runner Runner, address ...string) (runErr error) {
+	defer func() { runErr = shutdownResult(ctx, runErr) }()
 	if runner == nil {
 		return errors.Join(errors.New("go-omni: nil runner"), a.Close())
 	}
@@ -183,6 +221,13 @@ func (a *App) RunWith(ctx context.Context, runner Runner, address ...string) err
 	return errors.Join(runner.Run(ctx, a, a.listenAddress(address...)), a.Close())
 }
 
+func shutdownResult(ctx context.Context, err error) error {
+	if cause := lifecycle.Cause(ctx); cause != nil && !errors.Is(err, cause) {
+		return errors.Join(err, cause)
+	}
+	return err
+}
+
 func (a *App) listenAddress(address ...string) string {
 	listenOn := a.config.Address
 	if listenOn == "" {
@@ -235,5 +280,5 @@ func (a *App) writeError(ctx *httpx.Context, err error) {
 	if err == nil || ctx.Responded() {
 		return
 	}
-	ctx.WriteError(apierrors.From(err))
+	ctx.WriteError(err)
 }

app/body.go

@@ -0,0 +1,32 @@
+package app
+
+import (
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+	"git.yuntuo.hk/k2safe/go-omni/response"
+	"net/http"
+)
+
+func (a *App) bodyHandler(maxBytes int64, encoder response.Encoder, handler httpx.Handler, middleware ...httpx.Middleware) http.Handler {
+	checked := httpx.LimitBody(maxBytes)(handler)
+	if encoder == nil {
+		encoder = a.responseEncoder
+	}
+	next := a.adaptResponse(encoder, checked, middleware...)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Body != nil {
+			r = r.WithContext(r.Context())
+			r.Body = http.MaxBytesReader(w, r.Body, maxBytes)
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// HandleWithBodyLimit caps the reader before application middleware and preserves
+// the response policy, including auth failures and parameter errors.
+func (a *App) HandleWithBodyLimit(method, path string, maxBytes int64, encoder response.Encoder, handler httpx.Handler, middleware ...httpx.Middleware) {
+	a.router.Handle(method, path, a.bodyHandler(maxBytes, encoder, handler, middleware...))
+}
+func (g *RouterGroup) HandleWithBodyLimit(method, path string, maxBytes int64, encoder response.Encoder, handler httpx.Handler, middleware ...httpx.Middleware) {
+	combined := append(append([]httpx.Middleware{}, g.middlewares...), middleware...)
+	g.group.Handle(method, path, g.app.bodyHandler(maxBytes, encoder, handler, combined...))
+}

app/errorCatalog_test.go

@@ -0,0 +1,178 @@
+package app_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	omni "git.yuntuo.hk/k2safe/go-omni"
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+	"git.yuntuo.hk/k2safe/go-omni/logx"
+	"git.yuntuo.hk/k2safe/go-omni/metrics"
+	"git.yuntuo.hk/k2safe/go-omni/middleware"
+	"git.yuntuo.hk/k2safe/go-omni/response"
+)
+
+func TestAppErrorCatalogHTTP200LogsAndReplay(t *testing.T) {
+	var logs bytes.Buffer
+	logCfg := logx.Default()
+	logCfg.Writer = &logs
+	l, err := logx.New(logCfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	logx.SetDefault(l)
+	defer logx.SetDefault(nil)
+	defer l.Close()
+	cat := apierrors.Catalog{DefaultStatus: 200, Definitions: map[string]apierrors.Definition{"INVALID": {Code: 400002, Message: "项目提示"}, "DENIED": {Status: 403, Code: 9, Message: "no"}}}
+	policy := response.Config{CodeType: "int32", SuccessCode: 0, ErrorCode: 9999, MessageField: "msg", DataMode: "always"}
+	app := omni.New(omni.WithErrors(cat), omni.WithResponse(policy), omni.WithLogger(true))
+	defer app.Close()
+	meter := metrics.New()
+	app.Use(meter.Middleware())
+	cat.Definitions["INVALID"] = apierrors.Definition{Status: 500, Code: 1, Message: "mutated"}
+	app.Config().Errors.Definitions["INVALID"] = apierrors.Definition{Status: 500, Code: 2, Message: "mutated"}
+	app.GET("/error", func(c *omni.Context) error {
+		return fmt.Errorf("wrapped: %w", apierrors.ByCode("INVALID").WithCause(errors.New("private")))
+	})
+	app.GET("/direct", func(c *omni.Context) error { c.WriteError(apierrors.ByCode("INVALID")); return nil })
+	app.GET("/bridge", func(c *omni.Context) error { return apierrors.ByCode("INVALID") }, httpx.WrapMiddleware(func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { next.ServeHTTP(w, r) })
+	}))
+	app.GET("/missing", func(c *omni.Context) error { return apierrors.ByCode("MISSING") })
+	app.GET("/denied", func(c *omni.Context) error { return apierrors.ByCode("DENIED") })
+	app.GET("/committed", func(c *omni.Context) error {
+		if err := c.Text(201, "done"); err != nil {
+			return err
+		}
+		return apierrors.ByCode("INVALID")
+	})
+	app.HandleWithResponse("GET", "/callback", response.EncoderFunc(func(r response.Result) (response.Payload, error) {
+		if !r.IsError() || r.BusinessCode != int64(400002) {
+			t.Fatal(r)
+		}
+		return response.Text(202, "ACK"), nil
+	}), func(c *omni.Context) error { return apierrors.ByCode("INVALID") })
+	idem, err := middleware.NewIdempotency(middleware.IdempotencyConfig{Scope: func(*httpx.Context) (string, error) { return "fixture", nil }})
+	if err != nil {
+		t.Fatal(err)
+	}
+	calls := 0
+	app.POST("/idempotent", func(c *omni.Context) error { calls++; return apierrors.ByCode("INVALID") }, idem.Middleware())
+	shared, err := middleware.NewIdempotency(middleware.IdempotencyConfig{Store: &catalogStore{records: map[string]middleware.IdempotencyRecord{}}, Scope: func(*httpx.Context) (string, error) { return "fixture", nil }})
+	if err != nil {
+		t.Fatal(err)
+	}
+	app.POST("/shared", func(c *omni.Context) error { calls++; return apierrors.ByCode("INVALID") }, shared.Middleware())
+
+	for _, path := range []string{"/error", "/direct", "/bridge", "/idempotent", "/idempotent", "/shared", "/shared"} {
+		method := "GET"
+		if path == "/idempotent" || path == "/shared" {
+			method = "POST"
+		}
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(method, path, nil)
+		r.Header.Set("Idempotency-Key", "same")
+		app.ServeHTTP(w, r)
+		if w.Code != 200 || !strings.Contains(w.Body.String(), `"code":400002`) || !strings.Contains(w.Body.String(), "项目提示") || strings.Contains(w.Body.String(), "private") {
+			t.Fatal(w.Code, w.Body.String())
+		}
+	}
+	if stats := meter.Snapshot(); stats.Errors != 7 || stats.StatusCounts["200"] != 7 {
+		t.Fatal("lost business failure metrics", stats)
+	}
+	if calls != 2 {
+		t.Fatal("replay executed business twice")
+	}
+	for _, test := range []struct {
+		path   string
+		status int
+		body   string
+	}{{"/denied", 403, `"code":9`}, {"/missing", 500, `"code":9999`}, {"/committed", 201, "done"}, {"/callback", 202, "ACK"}} {
+		w := httptest.NewRecorder()
+		app.ServeHTTP(w, httptest.NewRequest("GET", test.path, nil))
+		if w.Code != test.status || !strings.Contains(w.Body.String(), test.body) {
+			t.Fatal(test.path, w.Code, w.Body.String())
+		}
+	}
+	for _, line := range strings.Split(strings.TrimSpace(logs.String()), "\n") {
+		var entry map[string]any
+		if err := json.Unmarshal([]byte(line), &entry); err != nil {
+			t.Fatal(err)
+		}
+		if entry["msg"] != "http.request" {
+			continue
+		}
+		if entry["failed"] != true {
+			t.Fatal("lost failure:", entry)
+		}
+		if entry["path"] == "/callback" {
+			if entry["status"] != float64(202) {
+				t.Fatal(entry)
+			}
+		} else if entry["path"] == "/error" || entry["path"] == "/direct" || entry["path"] == "/bridge" || entry["path"] == "/idempotent" || entry["path"] == "/shared" {
+			if entry["status"] != float64(200) || entry["businessCode"] != float64(400002) || entry["errorKey"] != "INVALID" {
+				t.Fatal(entry)
+			}
+		}
+	}
+	// A second application may interpret the same logical identifier differently.
+	app2 := omni.New(omni.WithErrors(apierrors.Catalog{Definitions: map[string]apierrors.Definition{"INVALID": {Status: 409, Code: "conflict", Message: "other"}}}))
+	defer app2.Close()
+	app2.GET("/", func(*omni.Context) error { return apierrors.ByCode("INVALID") })
+	w := httptest.NewRecorder()
+	app2.ServeHTTP(w, httptest.NewRequest("GET", "/", nil))
+	if w.Code != 409 || !strings.Contains(w.Body.String(), "other") {
+		t.Fatal(w.Code, w.Body.String())
+	}
+}
+
+// A serialized store exercises the shared middleware contract, including replay
+// metadata. No external service or project database is used by this fixture.
+type catalogStore struct {
+	mu      sync.Mutex
+	records map[string]middleware.IdempotencyRecord
+}
+
+func (s *catalogStore) Claim(_ context.Context, key, fp, owner string) (middleware.IdempotencyRecord, bool, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if r, ok := s.records[key]; ok {
+		return r, false, nil
+	}
+	r := middleware.IdempotencyRecord{Fingerprint: fp, Owner: owner, State: "running"}
+	s.records[key] = r
+	return r, true, nil
+}
+func (s *catalogStore) Complete(_ context.Context, key, owner string, response *middleware.StoredResponse, _ time.Duration) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	r := s.records[key]
+	if r.Owner != owner {
+		return errors.New("wrong owner")
+	}
+	r.State = "failed"
+	if response != nil {
+		r.State = "completed"
+		encoded, err := json.Marshal(response)
+		if err != nil {
+			return err
+		}
+		var copy middleware.StoredResponse
+		if err := json.Unmarshal(encoded, &copy); err != nil {
+			return err
+		}
+		r.Response = &copy
+	}
+	s.records[key] = r
+	return nil
+}

app/errorInheritance_test.go

@@ -0,0 +1,126 @@
+package app_test
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	omni "git.yuntuo.hk/k2safe/go-omni"
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+	"git.yuntuo.hk/k2safe/go-omni/response"
+)
+
+func TestRouteInheritsAppErrorCatalog(t *testing.T) {
+	catalog := apierrors.Catalog{DefaultStatus: 400, Definitions: map[string]apierrors.Definition{
+		"USERNAME_INVALID": {Code: 400002, Message: "用户名格式不正确"},
+		"TEXT_TOO_LONG":    {Status: 200, Code: 400003, Message: "{label}不能超过{max}个字符", Params: []apierrors.Parameter{{Name: "label", Type: "string"}, {Name: "max", Type: "int"}}},
+		"INTERNAL_ERROR":   {Status: 500, Code: 9999, Message: "系统错误"},
+	}}
+	format := response.Config{CodeType: "int32", SuccessCode: 0, ErrorCode: 9999, MessageField: "msg", DataMode: "always"}
+	app := omni.New(omni.WithErrors(catalog), omni.WithResponse(format))
+	defer app.Close()
+	getError := func(c *httpx.Context) error {
+		key := c.Header("X-Error")
+		if key == "TEXT_TOO_LONG" {
+			return apierrors.ByCode(key).WithParams(map[string]any{"label": "企业名称", "max": 100})
+		}
+		return apierrors.ByCode(key)
+	}
+	app.Use(func(next httpx.Handler) httpx.Handler {
+		return func(c *httpx.Context) error {
+			if c.Header("X-Early") == "true" {
+				return getError(c)
+			}
+			return next(c)
+		}
+	})
+	bridge := httpx.WrapMiddleware(func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { next.ServeHTTP(w, r) })
+	})
+	app.GET("/plain", getError)
+	// This is exactly the wrapper emitted by v0.11.0, not just the new generator.
+	legacy := response.MustWithErrors(apierrors.Catalog{}, response.MustNew(format))
+	app.HandleWithResponse("GET", "/generated", legacy, getError, bridge)
+	app.HandleWithResponse("GET", "/raw", response.RawJSON(legacy), getError, bridge)
+	for _, path := range []string{"/plain", "/generated", "/raw"} {
+		for _, early := range []string{"false", "true"} {
+			for _, test := range []struct {
+				key          string
+				status, code int
+				message      string
+			}{
+				{"USERNAME_INVALID", 400, 400002, "用户名格式不正确"},
+				{"TEXT_TOO_LONG", 200, 400003, "企业名称不能超过100个字符"},
+				{"MISSING", 500, 9999, "系统错误"},
+			} {
+				t.Run(path+"/"+early+"/"+test.key, func(t *testing.T) {
+					r := httptest.NewRequest("GET", path, nil)
+					r.Header.Set("X-Early", early)
+					r.Header.Set("X-Error", test.key)
+					w := httptest.NewRecorder()
+					app.ServeHTTP(w, r)
+					var value map[string]any
+					if err := json.Unmarshal(w.Body.Bytes(), &value); err != nil {
+						t.Fatal(err, w.Body.String())
+					}
+					if w.Code != test.status || value["code"] != float64(test.code) || value["msg"] != test.message {
+						t.Fatal(w.Code, value)
+					}
+					if data, ok := value["data"]; !ok || data != nil {
+						t.Fatal("data:null lost", value)
+					}
+				})
+			}
+		}
+	}
+}
+
+func TestExplicitRouteErrorCatalogRemainsIndependent(t *testing.T) {
+	format := response.Config{CodeType: "int32", SuccessCode: 0, ErrorCode: 9999, MessageField: "msg", DataMode: "always"}
+	global := apierrors.Catalog{DefaultStatus: 400, Definitions: map[string]apierrors.Definition{
+		"INVALID": {Code: 400002, Message: "全局提示"}, "APP_ONLY": {Code: 400003, Message: "全局独有"},
+		"INTERNAL_ERROR": {Status: 500, Code: 9999, Message: "全局系统错误"},
+	}}
+	local := apierrors.Catalog{DefaultStatus: 409, Definitions: map[string]apierrors.Definition{
+		"INVALID": {Code: 409001, Message: "路由提示"}, "INTERNAL_ERROR": {Status: 500, Code: 9998, Message: "路由系统错误"},
+	}}
+	app := omni.New(omni.WithErrors(global), omni.WithResponse(format))
+	defer app.Close()
+	getError := func(c *httpx.Context) error { return apierrors.ByCode(c.Header("X-Error")) }
+	app.Use(func(next httpx.Handler) httpx.Handler {
+		return func(c *httpx.Context) error {
+			if c.Header("X-Early") == "true" {
+				return getError(c)
+			}
+			return next(c)
+		}
+	})
+	routeFormat := format
+	routeFormat.MessageField = "detail"
+	localEncoder := response.MustWithErrors(local, response.MustNew(routeFormat))
+	app.HandleWithResponse("GET", "/", response.RawJSON(localEncoder), getError)
+	for _, early := range []string{"false", "true"} {
+		for _, test := range []struct {
+			key          string
+			status, code int
+			message      string
+		}{
+			{"INVALID", 409, 409001, "路由提示"}, {"APP_ONLY", 500, 9998, "路由系统错误"},
+		} {
+			r := httptest.NewRequest("GET", "/", nil)
+			r.Header.Set("X-Early", early)
+			r.Header.Set("X-Error", test.key)
+			w := httptest.NewRecorder()
+			app.ServeHTTP(w, r)
+			var value map[string]any
+			if err := json.Unmarshal(w.Body.Bytes(), &value); err != nil {
+				t.Fatal(err)
+			}
+			if w.Code != test.status || value["code"] != float64(test.code) || value["detail"] != test.message || value["msg"] != nil {
+				t.Fatal(w.Code, value)
+			}
+		}
+	}
+}

app/errorParams_test.go

@@ -0,0 +1,186 @@
+package app_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	omni "git.yuntuo.hk/k2safe/go-omni"
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+	"git.yuntuo.hk/k2safe/go-omni/logx"
+	"git.yuntuo.hk/k2safe/go-omni/metrics"
+	"git.yuntuo.hk/k2safe/go-omni/middleware"
+	"git.yuntuo.hk/k2safe/go-omni/response"
+)
+
+func TestTemplateErrorsAcrossPoliciesAndReplay(t *testing.T) {
+	var logs bytes.Buffer
+	lc := logx.Default()
+	lc.Writer = &logs
+	logger, err := logx.New(lc)
+	if err != nil {
+		t.Fatal(err)
+	}
+	logx.SetDefault(logger)
+	defer logx.SetDefault(nil)
+	defer logger.Close()
+	cat := apierrors.Catalog{DefaultStatus: 200, Definitions: map[string]apierrors.Definition{"TOO_LONG": {
+		Code: 400002, Message: "{label}不能超过{max}个字符", Params: []apierrors.Parameter{{Name: "label", Type: "string"}, {Name: "max", Type: "int"}},
+	}}}
+	registry := apierrors.MustRegistry(cat)
+	encoder := response.MustWithErrors(cat, response.MustNew(response.Config{CodeType: "int32", SuccessCode: 0, ErrorCode: 9999, MessageField: "msg", DataMode: "always"}))
+	app := omni.New(omni.WithLogger(true))
+	defer app.Close()
+	meter := metrics.New()
+	app.Use(meter.Middleware())
+	// The clone uses the route policy even though the App has a different default.
+	app.Use(func(next httpx.Handler) httpx.Handler {
+		return func(c *httpx.Context) error {
+			err := next(c)
+			if f := c.Failure(); f != nil && strings.Contains(f.Message, "{label}") {
+				t.Error("unrendered failure", f)
+			}
+			return err
+		}
+	})
+	bridge := httpx.WrapMiddleware(func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { next.ServeHTTP(w, r) })
+	})
+	calls := 0
+	handler := func(c *httpx.Context) error {
+		calls++
+		values := map[string]any{"label": "企业名称", "max": 100}
+		if c.Header("X-Label") == "remark" {
+			values = map[string]any{"label": "备注", "max": 500}
+		}
+		switch c.Header("X-Failure") {
+		case "missing":
+			delete(values, "max")
+		case "type":
+			values["max"] = "private-value"
+		}
+		e := apierrors.ByCode("TOO_LONG").WithParams(values).WithCause(errors.New("private cause"))
+		if c.Header("X-Resolved") == "true" {
+			return registry.Resolve(e)
+		}
+		return e
+	}
+	app.HandleWithResponse("POST", "/direct", encoder, handler, bridge)
+	for _, shared := range []bool{false, true} {
+		cfg := middleware.IdempotencyConfig{Scope: func(*httpx.Context) (string, error) { return "fixture", nil }}
+		path := "/local"
+		if shared {
+			path = "/shared"
+			cfg.Store = &catalogStore{records: map[string]middleware.IdempotencyRecord{}}
+		}
+		idem, err := middleware.NewIdempotency(cfg)
+		if err != nil {
+			t.Fatal(err)
+		}
+		app.HandleWithResponse("POST", path, encoder, handler, idem.Middleware(), bridge)
+	}
+	check := func(path, label, key, kind string, status int, want string) *httptest.ResponseRecorder {
+		t.Helper()
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest("POST", path, nil)
+		r.Header.Set("Idempotency-Key", key)
+		r.Header.Set("X-Label", label)
+		r.Header.Set("X-Failure", kind)
+		r.Header.Set("X-Resolved", "true")
+		app.ServeHTTP(w, r)
+		if w.Code != status || !strings.Contains(w.Body.String(), want) || strings.Contains(w.Body.String(), "private") || strings.Contains(w.Body.String(), "{label}") {
+			t.Fatal(path, w.Code, w.Body.String())
+		}
+		if status == 200 && (!strings.Contains(w.Body.String(), `"data":null`) || !strings.Contains(w.Body.String(), `"code":400002`)) {
+			t.Fatal(w.Body.String())
+		}
+		return w
+	}
+	for _, path := range []string{"/direct", "/local", "/shared"} {
+		for _, label := range []string{"company", "remark"} {
+			want := "企业名称不能超过100个字符"
+			if label == "remark" {
+				want = "备注不能超过500个字符"
+			}
+			first := check(path, label, label, "", 200, want)
+			if path != "/direct" {
+				before := calls
+				second := check(path, label, label, "", 200, want)
+				if calls != before || first.Body.String() != second.Body.String() || second.Header().Get("Idempotency-Replayed") != "true" {
+					t.Fatal("bad replay")
+				}
+			}
+		}
+	}
+	check("/direct", "company", "", "missing", 500, "internal server error")
+	check("/direct", "company", "", "type", 500, "internal server error")
+	stats := meter.Snapshot()
+	if stats.Errors != 12 || stats.StatusCounts["200"] != 10 || stats.StatusCounts["500"] != 2 {
+		t.Fatal(stats)
+	}
+	seen, diagnostics := 0, 0
+	for _, line := range strings.Split(strings.TrimSpace(logs.String()), "\n") {
+		var entry map[string]any
+		if err := json.Unmarshal([]byte(line), &entry); err != nil {
+			t.Fatal(err)
+		}
+		if entry["msg"] != "http.request" {
+			continue
+		}
+		seen++
+		if entry["failed"] != true {
+			t.Fatal(entry)
+		}
+		if entry["status"] == float64(200) && (entry["errorKey"] != "TOO_LONG" || entry["businessCode"] != float64(400002)) {
+			t.Fatal(entry)
+		}
+		if entry["errorParameter"] != nil {
+			diagnostics++
+			if strings.Contains(entry["errorParameter"].(string), "private-value") {
+				t.Fatal(entry)
+			}
+		}
+	}
+	if seen != 12 || diagnostics != 2 {
+		t.Fatal(seen, diagnostics)
+	}
+}
+
+func TestResolvedFailureReplaySurvivesCatalogChanges(t *testing.T) {
+	store := &catalogStore{records: map[string]middleware.IdempotencyRecord{}}
+	var observed []*apierrors.APIError
+	makeApp := func(message string) *omni.App {
+		cat := apierrors.Catalog{DefaultStatus: 200, Definitions: map[string]apierrors.Definition{"T": {Code: "code", Message: message, Params: []apierrors.Parameter{{Name: "label", Type: "string"}}}}}
+		app := omni.New(omni.WithErrors(cat))
+		app.Use(func(next httpx.Handler) httpx.Handler {
+			return func(c *httpx.Context) error { err := next(c); observed = append(observed, c.Failure()); return err }
+		})
+		idem, err := middleware.NewIdempotency(middleware.IdempotencyConfig{Store: store, Scope: func(*httpx.Context) (string, error) { return "fixture", nil }})
+		if err != nil {
+			t.Fatal(err)
+		}
+		app.POST("/", func(c *httpx.Context) error {
+			return apierrors.ByCode("T").WithParams(map[string]any{"label": "企业"})
+		}, idem.Middleware())
+		return app
+	}
+	for _, message := range []string{"{label}原文案", "{label}新文案"} {
+		app := makeApp(message)
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest("POST", "/", nil)
+		r.Header.Set("Idempotency-Key", "same")
+		app.ServeHTTP(w, r)
+		app.Close()
+		if !strings.Contains(w.Body.String(), "企业原文案") {
+			t.Fatal(w.Body.String())
+		}
+	}
+	if len(observed) != 2 || observed[0].Message != "企业原文案" || observed[1].Message != "企业原文案" || observed[1].Code != "T" {
+		t.Fatal(observed)
+	}
+}

app/fatalShutdown_test.go

@@ -0,0 +1,119 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"git.yuntuo.hk/k2safe/go-omni/config"
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+	"git.yuntuo.hk/k2safe/go-omni/lifecycle"
+)
+
+func TestFatalShutdownDrainsAndPreservesCause(t *testing.T) {
+	for _, transport := range []string{config.TransportNetHTTP, config.TransportNative} {
+		t.Run(transport, func(t *testing.T) {
+			app := New(config.WithTransport(transport), config.WithShutdownTimeout(2*time.Second))
+			control := lifecycle.New(context.Background())
+			defer control.RequestShutdown(nil)
+			entered, release := make(chan struct{}), make(chan struct{})
+			var releaseOnce sync.Once
+			unblock := func() { releaseOnce.Do(func() { close(release) }) }
+			defer unblock()
+			var closed atomic.Int32
+			closeErr := errors.New("cleanup diagnostic")
+			app.OnShutdown(func() error { closed.Add(1); return closeErr })
+			app.GET("/work", func(c *httpx.Context) error {
+				close(entered)
+				<-release
+				if closed.Load() != 0 {
+					return errors.New("closed during request")
+				}
+				return c.OK("done")
+			})
+			listener, err := net.Listen("tcp", "127.0.0.1:0")
+			if err != nil {
+				t.Fatal(err)
+			}
+			done := make(chan error, 1)
+			go func() { done <- app.ServeContext(control.Context(), listener) }()
+			requestDone := make(chan error, 1)
+			client := http.Client{Timeout: 3 * time.Second}
+			go func() {
+				res, err := client.Get("http://" + listener.Addr().String() + "/work")
+				if err == nil {
+					_, err = io.Copy(io.Discard, res.Body)
+					_ = res.Body.Close()
+					if res.StatusCode != 200 {
+						err = errors.New("request failed")
+					}
+				}
+				requestDone <- err
+			}()
+			select {
+			case <-entered:
+			case <-time.After(3 * time.Second):
+				t.Fatal("request never started")
+			}
+			fatal := errors.New("lease lost")
+			control.RequestShutdown(fatal)
+			select {
+			case err := <-done:
+				t.Fatal("did not drain", err)
+			case <-time.After(30 * time.Millisecond):
+			}
+			if closed.Load() != 0 {
+				t.Fatal("closed dependency before drain")
+			}
+			unblock()
+			select {
+			case err := <-requestDone:
+				if err != nil {
+					t.Fatal(err)
+				}
+			case <-time.After(3 * time.Second):
+				t.Fatal("request stuck")
+			}
+			select {
+			case err := <-done:
+				if !errors.Is(err, fatal) || !errors.Is(err, closeErr) {
+					t.Fatal("lost cause", err)
+				}
+			case <-time.After(3 * time.Second):
+				t.Fatal("shutdown stuck")
+			}
+			_ = app.Close()
+			if closed.Load() != 1 {
+				t.Fatal("cleanup repeated")
+			}
+		})
+	}
+}
+
+func TestCanceledStartupPreservesFault(t *testing.T) {
+	fatal := errors.New("dependency failed during startup")
+	ctx, cancel := context.WithCancelCause(context.Background())
+	cancel(fatal)
+	app := New()
+	if err := app.RunContext(ctx); !errors.Is(err, fatal) {
+		t.Fatal(err)
+	}
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = New().ServeContext(ctx, listener); !errors.Is(err, fatal) {
+		t.Fatal(err)
+	}
+	normal, stop := context.WithCancel(context.Background())
+	stop()
+	if err = New().RunContext(normal); err != nil {
+		t.Fatal("normal stop failed", err)
+	}
+}

app/httpConfig_test.go

@@ -0,0 +1,199 @@
+package app_test
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	omni "git.yuntuo.hk/k2safe/go-omni"
+)
+
+func TestHTTPConfiguredStandardServer(t *testing.T) {
+	cfg := omni.HTTPConfig{ReadHeaderTimeout: time.Second, ReadTimeout: 2 * time.Second, WriteTimeout: 3 * time.Second, IdleTimeout: 4 * time.Second, MaxHeaderBytes: 8192, ErrorLog: log.New(io.Discard, "", 0)}
+	a := omni.New(omni.WithHTTPConfig(cfg))
+	s := a.NewServer(":9000")
+	if s.ReadHeaderTimeout != cfg.ReadHeaderTimeout || s.ReadTimeout != cfg.ReadTimeout || s.WriteTimeout != cfg.WriteTimeout || s.IdleTimeout != cfg.IdleTimeout || s.MaxHeaderBytes != cfg.MaxHeaderBytes || s.ErrorLog != cfg.ErrorLog || s.Addr != ":9000" {
+		t.Fatalf("server options: %+v", s)
+	}
+	s = omni.New().NewServer("")
+	if s.ReadHeaderTimeout != 0 || s.ReadTimeout != 0 || s.WriteTimeout != 0 || s.IdleTimeout != 0 || s.MaxHeaderBytes != 0 || s.ErrorLog != nil {
+		t.Fatal("default behavior changed")
+	}
+}
+
+func TestHTTPInvalidStartupReleasesResources(t *testing.T) {
+	a := omni.New(omni.WithHTTPConfig(omni.HTTPConfig{ReadTimeout: -time.Second}))
+	called := 0
+	cleanupErr := errors.New("cleanup")
+	a.OnShutdown(func() error { called++; return cleanupErr })
+	err := a.RunContext(context.Background(), "bad address")
+	if err == nil || !strings.Contains(err.Error(), "http.readTimeout") || !errors.Is(err, cleanupErr) || called != 1 {
+		t.Fatalf("validation/cleanup: %v, %d", err, called)
+	}
+	defer func() {
+		if recover() == nil {
+			t.Error("NewServer accepted invalid config")
+		}
+	}()
+	a.NewServer("")
+}
+
+type httpConfigListener struct{ net.Listener }
+
+func (l httpConfigListener) Accept() (net.Conn, error) {
+	c, err := l.Listener.Accept()
+	if err == nil {
+		if tcp, ok := c.(*net.TCPConn); ok {
+			_ = tcp.SetWriteBuffer(32 << 10)
+		}
+	}
+	return c, err
+}
+
+func httpConfigConnection(t *testing.T, transport string, cfg omni.HTTPConfig, handler omni.Handler) net.Conn {
+	t.Helper()
+	a := omni.New(omni.WithTransport(transport), omni.WithHTTPConfig(cfg), omni.WithShutdownTimeout(time.Second))
+	a.GET("/", handler)
+	a.POST("/", handler)
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	go func() { done <- a.ServeContext(ctx, httpConfigListener{l}) }()
+	t.Cleanup(func() {
+		cancel()
+		select {
+		case err := <-done:
+			if err != nil {
+				t.Errorf("server shutdown: %v", err)
+			}
+		case <-time.After(3 * time.Second):
+			t.Error("server did not stop")
+		}
+	})
+	c, err := net.DialTimeout("tcp", l.Addr().String(), time.Second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { c.Close() })
+	_ = c.SetDeadline(time.Now().Add(3 * time.Second))
+	return c
+}
+
+func TestHTTPConfiguredNetworkLimits(t *testing.T) {
+	for _, transport := range []string{omni.TransportNetHTTP, omni.TransportNative} {
+		t.Run(transport, func(t *testing.T) {
+			empty := func(c *omni.Context) error { w := c.Raw(); w.WriteHeader(204); return nil }
+			t.Run("slowHeaders", func(t *testing.T) {
+				c := httpConfigConnection(t, transport, omni.HTTPConfig{ReadHeaderTimeout: 60 * time.Millisecond}, empty)
+				if _, err := io.WriteString(c, "GET / HTTP/1.1\r\nHost: localhost\r\nX-Incomplete:"); err != nil {
+					t.Fatal(err)
+				}
+				_, err := io.ReadAll(c)
+				if e, ok := err.(net.Error); ok && e.Timeout() {
+					t.Fatal("server read-header timeout not applied")
+				}
+			})
+			t.Run("slowBody", func(t *testing.T) {
+				var accepted atomic.Bool
+				c := httpConfigConnection(t, transport, omni.HTTPConfig{ReadTimeout: 60 * time.Millisecond}, func(c *omni.Context) error {
+					_, err := io.ReadAll(c.Request().Body)
+					accepted.Store(err == nil)
+					return nil
+				})
+				if _, err := io.WriteString(c, "POST / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\nContent-Length: 10\r\n\r\nx"); err != nil {
+					t.Fatal(err)
+				}
+				_, err := io.ReadAll(c)
+				if e, ok := err.(net.Error); ok && e.Timeout() {
+					t.Fatal("read timeout not applied")
+				}
+				if accepted.Load() {
+					t.Fatal("incomplete body accepted")
+				}
+			})
+			t.Run("idle", func(t *testing.T) {
+				c := httpConfigConnection(t, transport, omni.HTTPConfig{IdleTimeout: 60 * time.Millisecond}, empty)
+				if _, err := io.WriteString(c, "GET / HTTP/1.1\r\nHost: localhost\r\n\r\n"); err != nil {
+					t.Fatal(err)
+				}
+				r, err := http.ReadResponse(bufio.NewReader(c), nil)
+				if err != nil {
+					t.Fatal(err)
+				}
+				r.Body.Close()
+				if r.StatusCode != 204 {
+					t.Fatal(r.StatusCode)
+				}
+				_, err = c.Read(make([]byte, 1))
+				if e, ok := err.(net.Error); ok && e.Timeout() {
+					t.Fatal("idle timeout not applied")
+				}
+				if err == nil {
+					t.Fatal("idle connection not closed")
+				}
+			})
+			t.Run("writeBackpressure", func(t *testing.T) {
+				done := make(chan error, 1)
+				c := httpConfigConnection(t, transport, omni.HTTPConfig{WriteTimeout: 60 * time.Millisecond}, func(c *omni.Context) error {
+					w := c.Raw()
+					w.WriteHeader(200)
+					if err := http.NewResponseController(w).Flush(); err != nil {
+						done <- err
+						return nil
+					}
+					_, err := io.Copy(w, io.LimitReader(repeatingHTTPReader{}, 64<<20))
+					done <- err
+					return nil
+				})
+				if tcp, ok := c.(*net.TCPConn); ok {
+					_ = tcp.SetReadBuffer(1024)
+				}
+				if _, err := io.WriteString(c, "GET / HTTP/1.1\r\nHost: localhost\r\n\r\n"); err != nil {
+					t.Fatal(err)
+				}
+				select {
+				case err := <-done:
+					if err == nil {
+						t.Fatal("write unexpectedly completed")
+					}
+				case <-time.After(2 * time.Second):
+					t.Fatal("write timeout not applied")
+				}
+			})
+			t.Run("headerLimit", func(t *testing.T) {
+				c := httpConfigConnection(t, transport, omni.HTTPConfig{MaxHeaderBytes: 1024}, empty)
+				if _, err := io.WriteString(c, "GET / HTTP/1.1\r\nHost: localhost\r\nX-Large: "+strings.Repeat("a", 8192)+"\r\n\r\n"); err != nil {
+					t.Fatal(err)
+				}
+				r, err := http.ReadResponse(bufio.NewReader(c), nil)
+				if err != nil {
+					t.Fatal(err)
+				}
+				r.Body.Close()
+				if r.StatusCode != 431 {
+					t.Fatalf("oversized header status: %d", r.StatusCode)
+				}
+			})
+		})
+	}
+}
+
+type repeatingHTTPReader struct{}
+
+func (repeatingHTTPReader) Read(b []byte) (int, error) {
+	for i := range b {
+		b[i] = 'x'
+	}
+	return len(b), nil
+}

app/logIsolation_test.go

@@ -0,0 +1,58 @@
+package app_test
+
+import (
+	"bytes"
+	"context"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	omni "git.yuntuo.hk/k2safe/go-omni"
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+	"git.yuntuo.hk/k2safe/go-omni/logx"
+)
+
+func TestAppLogAndRequestMetadataIsolation(t *testing.T) {
+	var a, b bytes.Buffer
+	la, _ := logx.New(logx.Config{Writer: &a})
+	lb, _ := logx.New(logx.Config{Writer: &b})
+	apps := []*omni.App{
+		omni.New(omni.WithLogger(true), omni.WithLogInstance(la), omni.WithTrustedProxies("127.0.0.1/32")),
+		omni.New(omni.WithLogger(true), omni.WithLogInstance(lb)),
+	}
+	for i, app := range apps {
+		app.GET("/probe/:id", func(c *httpx.Context) error {
+			ctx := c.Context()
+			meta := httpx.Metadata(ctx)
+			expected := "127.0.0.1"
+			if i == 0 {
+				expected = "203.0.113.7"
+			}
+			if meta.ClientIP != expected || meta.Route != "/probe/:id" || meta.Method != "GET" {
+				t.Error(meta)
+			}
+			logx.InfoContext(ctx, "business", "app", i)
+			clone := c.Clone(context.WithValue(ctx, struct{}{}, true), httptest.NewRecorder())
+			if httpx.Metadata(clone.Context()) != meta {
+				t.Error("metadata lost")
+			}
+			return c.OK(nil)
+		})
+	}
+	for _, app := range apps {
+		r := httptest.NewRequest("GET", "/probe/42", nil)
+		r.RemoteAddr = "127.0.0.1:1234"
+		r.Header.Set("X-Forwarded-For", "203.0.113.7")
+		app.ServeHTTP(httptest.NewRecorder(), r)
+	}
+	for i, out := range []string{a.String(), b.String()} {
+		if !strings.Contains(out, "http.request") || !strings.Contains(out, "business") || strings.Contains(out, `"app":`+string(rune('0'+(1-i)))) {
+			t.Fatal(out)
+		}
+	}
+	_ = apps[0].Close()
+	lb.Info("still open")
+	if !strings.Contains(b.String(), "still open") {
+		t.Fatal("borrowed logger closed")
+	}
+}

app/router.go

@@ -3,7 +3,10 @@ package app
 import (
 	"net/http"
 
+	"git.yuntuo.hk/k2safe/go-omni/contract"
 	"git.yuntuo.hk/k2safe/go-omni/httpx"
+	"git.yuntuo.hk/k2safe/go-omni/logx"
+	"git.yuntuo.hk/k2safe/go-omni/response"
 )
 
 func (a *App) handle(routes httpx.RouterGroup, method, path string, handler httpx.Handler, middleware []httpx.Middleware) {
@@ -11,6 +14,10 @@ func (a *App) handle(routes httpx.RouterGroup, method, path string, handler http
 }
 
 func (a *App) adapt(handler httpx.Handler, middleware ...httpx.Middleware) http.Handler {
+	return a.adaptResponse(a.responseEncoder, handler, middleware...)
+}
+
+func (a *App) adaptResponse(encoder response.Encoder, handler httpx.Handler, middleware ...httpx.Middleware) http.Handler {
 	wrapped := handler
 	all := make([]httpx.Middleware, 0, len(a.middlewares)+len(middleware))
 	all = append(all, a.middlewares...)
@@ -21,10 +28,19 @@ func (a *App) adapt(handler httpx.Handler, middleware ...httpx.Middleware) http.
 		}
 	}
 	return http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		request = request.WithContext(logx.WithLogger(contract.WithRequestPolicy(request.Context(), a.config.Request), a.config.LogInstance))
 		if len(a.config.TrustedProxies) > 0 {
 			request = request.WithContext(httpx.WithClientIPResolver(request.Context(), a.clientIPResolver))
 		}
 		requestContext := httpx.NewContext(request, writer, httpx.RouteParams(request.Context()))
+		requestContext.WithContext(httpx.WithRequestMetadata(request.Context(), httpx.RequestMetadata{
+			ClientIP: requestContext.ClientIP(), Method: request.Method, Route: httpx.RoutePattern(request.Context()),
+		}))
+		if provider, ok := a.responseEncoder.(response.ErrorRegistryProvider); ok {
+			requestContext.SetErrorRegistry(provider.ErrorRegistry())
+		}
+		requestContext.SetResponseEncoder(encoder)
+		defer func() { httpx.CleanupMultipart(requestContext.Request()) }()
 		if err := wrapped(requestContext); err != nil {
 			a.writeError(requestContext, err)
 		}
@@ -37,6 +53,14 @@ func (a *App) Handle(method, path string, handler httpx.Handler, middleware ...h
 	a.handle(a.router, method, path, handler, middleware)
 }
 
+// HandleWithResponse selects the route policy before all application middleware.
+func (a *App) HandleWithResponse(method, path string, encoder response.Encoder, handler httpx.Handler, middleware ...httpx.Middleware) {
+	if encoder == nil {
+		encoder = a.responseEncoder
+	}
+	a.router.Handle(method, path, a.adaptResponse(encoder, handler, middleware...))
+}
+
 func (a *App) GET(path string, handler httpx.Handler, middleware ...httpx.Middleware) {
 	a.handle(a.router, http.MethodGet, path, handler, middleware)
 }
@@ -94,6 +118,15 @@ func (g *RouterGroup) Handle(method, path string, handler httpx.Handler, middlew
 	g.route(method, path, handler, middleware)
 }
 
+func (g *RouterGroup) HandleWithResponse(method, path string, encoder response.Encoder, handler httpx.Handler, middleware ...httpx.Middleware) {
+	if encoder == nil {
+		encoder = g.app.responseEncoder
+	}
+	combined := append([]httpx.Middleware{}, g.middlewares...)
+	combined = append(combined, middleware...)
+	g.group.Handle(method, path, g.app.adaptResponse(encoder, handler, combined...))
+}
+
 func (g *RouterGroup) GET(path string, handler httpx.Handler, middleware ...httpx.Middleware) {
 	g.route(http.MethodGet, path, handler, middleware)
 }

app/transport.go

@@ -17,7 +17,8 @@ import (
 // ServeContext serves a caller-created listener using the configured transport
 // and TLS. App takes ownership of the listener, including on startup failure,
 // and runs resource cleanup after the server has stopped.
-func (a *App) ServeContext(ctx context.Context, listener net.Listener) error {
+func (a *App) ServeContext(ctx context.Context, listener net.Listener) (runErr error) {
+	defer func() { runErr = shutdownResult(ctx, runErr) }()
 	if listener == nil {
 		return errors.Join(errors.New("go-omni: nil listener"), a.Close())
 	}
@@ -57,6 +58,22 @@ func (a *App) prepareTransport() (func(context.Context, net.Listener) error, err
 	case config.TransportNative:
 		server := native.New(a)
 		server.ShutdownTimeout = shutdownTimeout
+		cfg := a.config.HTTP
+		if cfg.ReadHeaderTimeout > 0 {
+			server.ReadHeaderTimeout = cfg.ReadHeaderTimeout
+		}
+		if cfg.ReadTimeout > 0 {
+			server.ReadTimeout = cfg.ReadTimeout
+		}
+		if cfg.WriteTimeout > 0 {
+			server.WriteTimeout = cfg.WriteTimeout
+		}
+		if cfg.IdleTimeout > 0 {
+			server.IdleTimeout = cfg.IdleTimeout
+		}
+		if cfg.MaxHeaderBytes > 0 {
+			server.MaxHeaderBytes = cfg.MaxHeaderBytes
+		}
 		if tlsConfig != nil {
 			return func(ctx context.Context, listener net.Listener) error {
 				return server.ServeTLS(ctx, listener, tlsConfig)
@@ -66,6 +83,12 @@ func (a *App) prepareTransport() (func(context.Context, net.Listener) error, err
 	case config.TransportHTTP2:
 		server := h2transport.New(a)
 		server.ShutdownTimeout = shutdownTimeout
+		if a.config.HTTP.IdleTimeout > 0 {
+			server.IdleTimeout = a.config.HTTP.IdleTimeout
+		}
+		if a.config.HTTP.MaxHeaderBytes > 0 {
+			server.MaxHeaderBytes = a.config.HTTP.MaxHeaderBytes
+		}
 		return func(ctx context.Context, listener net.Listener) error {
 			return server.ServeTLS(ctx, listener, tlsConfig)
 		}, nil

cmd/go-omni/README.md

@@ -1,154 +1,67 @@
 # go-omni CLI
 
-## API 契约驱动项目
+v0.16 增加基础类型/动态 JSON 数组返回、OpenAPI 公共引用和 workspace Go Catalog 统一导出。见 [接入与筛选规则](../../DEVELOPMENT.md#同一份-go-错误目录供多个服务生成)。
+
+v0.14 新增 `api format [--check]`、`api upgrade [--dry-run|--preview <空目录>|--apply]`，以及 `workspace format|generate|check --file omni.workspace.json`。详见 [通用开发指南](../../DEVELOPMENT.md)。
+
+新项目采用根目录 `main.go` 与 `internal/config、svc、logic、handler、types`。完整职责、启动扩展、流式接口和生成文件边界见 [项目指南](../../PROJECT.md)。
+
+## 创建项目
 
 ```sh
-# 创建包含可运行问候接口的新项目
-go run ./cmd/go-omni api new --module example.com/demo --framework-dir . ../demo
+# 仓库读取权限与 PATH 配置见根目录 README
+go install git.yuntuo.hk/k2safe/go-omni/cmd/go-omni@v0.16.0-preview
+go-omni new --module example.com/hello ./hello
 
-# 从已有定义生成对应目录、类型、路由和业务骨架
-go run ./cmd/go-omni api generate --api examples/contracts/user.api \
-  --dir ../userService --module example.com/userService --framework-dir .
-
-# 校验定义；也接受 goctl 风格的 api go -api ... -dir ...
-go run ./cmd/go-omni api validate --api examples/contracts/user.api
+# 从自己的契约生成；service.api 及其相对 import 文件需要在本地存在
+go-omni new --api service.api --module example.com/example ./example
 ```
 
-`new --api <file>` 是契约项目的另一个入口。可以组合 `--database mysql --storage local --log-output file`，生成配置、依赖初始化与资源关闭。API 默认无数据库、无对象存储；`--database memory` 等同于不打开连接。`--force` 不允许覆盖 API 项目。初始配置选择写入 manifest，重新生成自动沿用。
+`new` 与 `api new` 统一生成契约项目；不再提供另一套 CRUD 启动目录。未实现的 Logic / 中间件骨架返回 501。进入项目执行 `go mod tidy`、`go run .`、`go build .`。
 
-后续在生成项目内执行 `go-omni api generate --api api/user.api --dir .`。
-`--check` 只读检查生成产物是否过期。生成器记录所有权，保留 Service / Repository / 配置 / main 的手写内容，遇到生成文件被手动修改则报冲突。新 Service 与中间件占位实现返回 501。
+参数：`--database none|memory|mysql`（默认 none；memory 等同 none），`--storage none|local|s3|r2|oss`，`--log-output stdout|stderr|file`，`--log-format json|text`。基础设施按需生成，连接凭据由环境提供，不自动创建数据库、表或云资源。选择 MySQL 不会凭空生成业务表或 Repository 查询。
 
-支持范围、参数语义、目录及安全更新策略见 [API 开发指南](../../API.md)。本版借鉴 go-zero 的工作流，不宣称兼容全部 goctl 语法；仍通过 Omni/httpx 保留网络层替换能力。
+存储配置和客户端位于 config/svc，业务使用统一接口。local 存储签名端点由生成器接入；上传、下载等业务路由由 `.api` 定义。认证与存储路径由项目实现。
 
-## 日志与对象存储按需装配
-
-新增 `--log-output stdout|stderr|file`、`--log-format json|text`、`--storage none|local|s3|r2|oss`。
-指定任意一个新选项后，生成严格的配置文件、初始化代码和项目自身的测试；不指定则保留原有轻量骨架。
-对象存储独立于 `--database memory|mysql`。只有选择文件存储才会生成文件 Handler / Service 和对应适配器。
-
-开发阶段可以使用本地源码；固定远程版本的安装和验收见 [发布说明](../../RELEASE.md)：
+## 日常生成
 
 ```sh
-# 在 go-omni 仓库中运行；目标目录须为空。
-go run ./cmd/go-omni new --framework-dir . \
-  --module example.com/fileService --log-output file --log-format json \
-  --storage local ../fileService
+go-omni api validate
+go-omni api inspect
+go-omni api generate --dry-run
+go-omni api generate
+go-omni api generate --check
+go-omni api export > openapi.json
+go test ./...
 ```
 
-生成项目包含 `etc/config.yaml`、`internal/settings`、`internal/servicecontext/storage.go`、
-文件 Service/Handler、测试和 `MODULES.md`。按生成的 MODULES.md 配置示例 Token 和本地签名密钥后，
-`go mod tidy && go run ./cmd/server` 即可体验。云存储分别选择 `--storage s3`、`r2`、`oss`，
-再设置已有桶/凭据等环境变量；不自动创建桶或修改云资源。
+项目内自动发现 manifest 中的 API 入口，也可显式 `--api ... --dir ...`。`api go -api ... -dir ...` 为命令别名，不代表兼容全部 goctl 语法。
 
-配置优先级为默认值 → YAML/JSON → 环境变量；密钥仅允许环境变量。Service 依赖统一存储接口，
-组合处负责创建客户端与有界连接池，退出时关闭自己创建的资源。文件接口提供服务端上传、直传签名、
-临时下载链接及统一错误处理；日志示例携带 requestId，文件输出默认带轮转。没有固定业务身份上下文。
+main、Gen.go、OpenAPI 和 manifest 由生成器维护；业务文件按字节保留。手改生成文件会报冲突，`--check` 检查入口与所有生成产物。没有 `--force` 覆盖业务的入口。初始基础设施 profile 在重新生成时沿用，后续项目依赖由用户修改 config/svc。
 
-新模板要求 `v0.7.0-preview` 或更新版本；明确指定旧版本并启用新模块会被拒绝，
-避免模板引用旧框架不存在的接口。本地 `--framework-dir` 验证不受此限制。`--force` 可重新生成兼容配置，
-但如果切换配置会遗留引用已移除依赖的旧文件，则拒绝操作，要求使用新目录；不会自动删除修改过的代码。
+生成/预览会比较上次契约快照，提示受影响的 Logic 文件、DTO 字段和 body/流式模式变化。明确的 Logic 签名错误显示文件行号、原签名和期望签名；生成后未调整业务时，`--check` 仍返回失败。REVIEW 不强制确认，类型别名/build tags 等不确定情况交给 `go test ./...` 验证。完整行为见 [契约变更提示](../../PROJECT.md#契约变更提示)。
 
-验证当前生成器：
+`@app(defaultResponse: TemplateName)` 选择 App 默认响应，路由/分组可以覆盖。错误表可以只在 Go 中维护，通过 svc.AppOptions 注册一次。上传和原始 body 的自动 Logic 参数、下载输出见 [项目指南](../../PROJECT.md)。
+
+## 版本与迁移
+
+CLI 与框架依赖固定使用 v0.16.0-preview。远程安装的 CLI 默认把自身版本写入 go.mod，不添加本地 replace；`--framework-version` 可显式指定已发布的兼容版本。仅在开发框架源码时使用本地替换：
 
 ```sh
-GO_OMNI_SCAFFOLD_INTEGRATION=1 go test -race ./cmd/go-omni/...
-python3 scripts/verifyScaffoldModules.py
+# 在 go-omni 源码仓库中执行
+go run ./cmd/go-omni new --module example.com/hello --framework-dir . ../hello
 ```
 
-前者覆盖两种数据库与五种文件存储选择、日志方式/格式，以及生成项目的配置、资源关闭和接口测试。
-后者实际编译启动服务，验证日志、上传/下载/直传链接、错误状态、nethttp/native 下的 SIGINT/SIGTERM 和监听端口释放。
-云端选项的测试使用本地替身，不代表 OSS/R2 实网验收；本批不访问业务服务器。报告见
-[脚手架模块验收](../../performance/scaffoldModulesLocal.json)。
+模板最低需要 v0.16.0-preview 的统一环境变量别名能力，继续使用 manifest v2；GORM 可选适配器从 v0.14.1-preview 提供。已有项目使用 [定点升级与预览](../../DEVELOPMENT.md#v013-项目升级)：原始模板可自动替换，含业务修改的基础文件按预览合并；通用清理由 Runtime 负责。独立工具命令不会被删除。受管理项目通过 `.api` 模块导入增加业务，不使用旧 `add` 命令的手动路由装配。
 
-## 其他命令与远程安装
+## 数据库迁移命令
 
-main 分支还提供 `go-omni add orderItems --dir /path/to/project`，向已有 GoOmni 项目增加
-Handler / Service / Repository / Model 与模块注册入口。模块名为 lowerCamelCase，
-目标目录存在时拒绝覆盖，已有启动代码保持原样。生成模块带可替换的内存 CRUD Repository，
-导入后使用 `orderItems.Register(application, repository, authMiddleware)` 注册。
-该命令从 `v0.7.0-preview` 提供；源码可用 `go build -o /tmp/go-omni ./cmd/go-omni` 构建。
-边界和验证方式见 [业务基础模块](../../MODULES.md)。
-
-从远程安装，生成一个带 Handler / Service / Repository / Model 分层的服务骨架：
-
-```sh
-go install git.yuntuo.hk/k2safe/go-omni/cmd/go-omni@v0.7.0-preview
-go-omni new --module example.com/billing ./billing
-cd billing
-go mod tidy
-go run ./cmd/server
-```
-
-通过 `go install ...@版本` 安装的 CLI 从构建信息中读取版本，并把它固定到生成项目的
-`go.mod`。不会使用不存在的 `v0.0.0`，也不会在普通业务目录中添加本地 `replace`。
-
-需要选择其他已发布版本时，使用完整版本号：
-
-```sh
-go-omni new --framework-version v0.6.0-preview --module example.com/billing ./billing
-```
-
-`--framework-version` 禁用自动本地替换；`main`、`latest` 等浮动引用不接受为固定版本。
-源码构建的 CLI 使用代码中声明的目标发布版本；该版本未发布时请显式选择已发布版本，或用 `--framework-dir` 验证本地源码。
-
-在 GoOmni 源码目录执行时，命令会自动在生成项目的 `go.mod` 中加入本地
-`replace git.yuntuo.hk/k2safe/go-omni => ...`，便于立即运行和测试。目标目录非空时命令会停止，明确传入
-`--force` 才会覆盖脚手架文件。
-
-也可以在任意目录显式指定源码路径：
-
-```sh
-go-omni new --framework-dir /path/to/go-omni --module example.com/billing ./billing
-```
-
-默认生成内存存储版本；选择 MySQL 时：
-
-```sh
-go-omni new --database mysql --module example.com/billing ./billing
-```
-
-MySQL 项目额外包含 `schema.sql`、MySQL Repository 和可选的数据库集成测试。
-先应用建表脚本，再设置 `GO_OMNI_DB_DSN` 启动。ServiceContext 负责连接池初始化、表结构检查、
-就绪探针注册和关闭。两种模式都提供用户 CRUD、分页、输入校验和统一错误响应。
-
-生成服务默认包含 `/health/live`、`/health/ready` 和示例 `/users` CRUD。
-退出信号通过 `signal.NotifyContext` 传入 `RunContext`，Logger 的关闭函数注册到应用生命周期。
-
-发布验收使用 Python 3 标准库脚本，不需要额外 Python 依赖：
-
-```sh
-python3 scripts/verifyScaffold.py --version v0.6.0-preview
-python3 scripts/verifyDatabase.py --version v0.6.0-preview
-```
-
-脚本在源码目录外安装远程 CLI、生成项目，确认固定版本且没有 `replace`，再下载依赖、
-编译、请求接口，并对真实二进制分别发送 `SIGINT` 和 `SIGTERM`。同时验证框架 `Run` 的
-信号处理和清理回调。每个进程都必须退出码为 0、释放监听端口；临时项目和测试进程会被清理。
-
-发布前验证当前源码：
-
-```sh
-go build -o /tmp/go-omni ./cmd/go-omni
-python3 scripts/verifyScaffold.py --cli /tmp/go-omni --framework-dir .
-python3 scripts/verifyDatabase.py --cli /tmp/go-omni --framework-dir .
-```
-
-数据库验收需要本地 Docker，使用独立 MySQL 8.4 容器；不会连接已有业务数据库，结束后清理测试容器与数据卷。
-
-## 显式迁移（main）
-
-SQL 命名为 `0001_createUsers.up.sql`。先预览版本和 SHA-256 清单：
+保留独立迁移工具，应用启动不自动迁移：
 
 ```sh
 go-omni migrate --dir migrations
-```
-
-部署步骤配置 `GO_OMNI_DB_DSN`，显式执行：
-
-```sh
+# 检查预览，配置 GO_OMNI_DB_DSN 后显式应用
 go-omni migrate --dir migrations --apply
 ```
 
-预览不连接数据库；应用启动不自动迁移。失败保留 dirty 状态，不提供自动 down/force。
-脚手架原有 `schema.sql` 不会自动变成有版本的迁移，已有库需要先确定基线。详见 [扩展模块](../../ADVANCED.md)。
+SQL 命名示例 `0001_createUsers.up.sql`；预览只显示版本和 SHA-256，不连接数据库。失败保留 dirty 状态，不自动 down/force。细节见 [扩展模块](../../ADVANCED.md)。

cmd/go-omni/api.go

@@ -1,9 +1,10 @@
 package main
 
 import (
-	"errors"
 	"fmt"
+	"os"
 	"strings"
+	"text/tabwriter"
 
 	"git.yuntuo.hk/k2safe/go-omni/cmd/go-omni/apigen"
 )
@@ -14,15 +15,19 @@ func runAPI(args []string) error {
 		return nil
 	}
 	command := args[0]
+	if command == "upgrade" {
+		return runUpgrade(args[1:])
+	}
 	if command == "go" {
 		command = "generate"
 	}
 	if command == "check" {
 		command = "validate"
 	}
-	if command != "new" && command != "generate" && command != "validate" {
+	if command != "new" && command != "generate" && command != "validate" && command != "inspect" && command != "export" && command != "format" {
 		return fmt.Errorf("unknown api command %q", command)
 	}
+	readOnly := command == "validate" || command == "inspect" || command == "export" || command == "format"
 	o := apigen.Options{}
 	for i := 1; i < len(args); i++ {
 		arg := args[i]
@@ -30,11 +35,15 @@ func runAPI(args []string) error {
 			usage()
 			return nil
 		}
-		if arg == "--check" {
-			if command != "generate" {
-				return errors.New("--check belongs to api generate")
+		if arg == "--check" || arg == "--dry-run" {
+			if command != "generate" && !(command == "format" && arg == "--check") {
+				return fmt.Errorf("%s belongs to api generate", arg)
+			}
+			if arg == "--check" {
+				o.Check = true
+			} else {
+				o.DryRun = true
 			}
-			o.Check = true
 			continue
 		}
 		if !strings.HasPrefix(arg, "-") {
@@ -67,8 +76,8 @@ func runAPI(args []string) error {
 		if strings.TrimSpace(value) == "" {
 			return fmt.Errorf("%s requires a value", name)
 		}
-		if command == "validate" && name != "--api" {
-			return fmt.Errorf("api validate does not accept %s", name)
+		if readOnly && name != "--api" {
+			return fmt.Errorf("api %s does not accept %s", command, name)
 		}
 		switch name {
 		case "--api":
@@ -91,18 +100,64 @@ func runAPI(args []string) error {
 			o.LogFormat = value
 		}
 	}
-	if command == "validate" {
-		if o.API == "" {
-			return errors.New("--api is required")
+	if command != "new" && o.API == "" {
+		dir := o.Dir
+		if dir == "" {
+			dir = "."
 		}
+		var err error
+		o.API, err = apigen.ProjectEntry(dir)
+		if err != nil {
+			return err
+		}
+	}
+	if command == "format" {
+		changes, err := apigen.FormatProject(o.API, o.Check)
+		if err != nil {
+			return err
+		}
+		fmt.Printf("API format: %d files updated\n", len(changes))
+		return nil
+	}
+	if readOnly {
 		spec, err := apigen.Parse(o.API)
 		if err != nil {
 			return err
 		}
-		if _, err = apigen.Compile(spec); err != nil {
+		compiled, err := apigen.Compile(spec)
+		if err != nil {
 			return err
 		}
-		fmt.Printf("valid API: %d types, %d routes\n", len(spec.Types), len(spec.Routes))
+		switch command {
+		case "validate":
+			fmt.Printf("valid API: %d types, %d routes, %d errors, %d auth schemes\n", len(spec.Types), len(spec.Routes), len(spec.Errors), len(spec.Auth))
+		case "export":
+			fmt.Println(string(compiled.Document))
+		case "inspect":
+			writer := tabwriter.NewWriter(os.Stdout, 0, 4, 2, ' ', 0)
+			fmt.Fprintln(writer, "METHOD\tPATH\tHANDLER\tAUTH\tRESPONSE\tERRORS")
+			definitions := map[string]apigen.ErrorDefinition{}
+			for _, e := range spec.Errors {
+				definitions[e.Name] = e
+			}
+			for _, r := range compiled.Spec.Routes {
+				auth := r.Auth
+				if auth == "" {
+					auth = "(undeclared)"
+				}
+				var errs []string
+				for _, name := range r.Errors {
+					e := definitions[name]
+					errs = append(errs, fmt.Sprintf("%d:%s", e.Status, e.Code))
+				}
+				format := r.ResponseFormat
+				if format == "" {
+					format = "default"
+				}
+				fmt.Fprintf(writer, "%s\t%s\t%s/%s\t%s\t%s\t%s\n", strings.ToUpper(r.Method), r.Path, r.Group, r.Handler, auth, format, strings.Join(errs, ", "))
+			}
+			return writer.Flush()
+		}
 		return nil
 	}
 	var out apigen.Output
@@ -115,13 +170,42 @@ func runAPI(args []string) error {
 		}
 		out, err = apigen.Generate(o)
 	}
+	printAPIDiagnostics(out.Diagnostics)
 	if err != nil {
 		return err
 	}
-	if o.Check {
-		fmt.Println("API generated files are current")
+	if o.DryRun {
+		for _, change := range out.Changes {
+			fmt.Printf("%-7s %s\n", change.Action, change.Path)
+		}
+		fmt.Printf("Preview: %d changes; %d existing developer-owned files preserved; no files written\n", len(out.Changes), len(out.Preserved))
+	} else if o.Check {
+		fmt.Println("API generated files are current; no definite Logic signature errors found (run go test ./... for full verification)")
 	} else {
-		fmt.Printf("API project ready: %d generated, %d created, %d preserved, %d removed\n", len(out.Generated), len(out.Created), len(out.Preserved), len(out.Removed))
+		fmt.Printf("API project generated: %d generated, %d created, %d preserved, %d removed\n", len(out.Generated), len(out.Created), len(out.Preserved), len(out.Removed))
 	}
 	return nil
 }
+
+func printAPIDiagnostics(diagnostics []apigen.Diagnostic) {
+	for _, d := range diagnostics {
+		location := d.Path
+		if d.Line > 0 {
+			location += fmt.Sprintf(":%d", d.Line)
+		}
+		fmt.Printf("%s [%s] %s", strings.ToUpper(d.Severity), d.Code, location)
+		if d.Operation != "" {
+			fmt.Printf(" (%s)", d.Operation)
+		}
+		fmt.Printf(": %s\n", d.Message)
+		if d.Before != "" {
+			fmt.Printf("  before: %s\n", d.Before)
+		}
+		if d.After != "" {
+			fmt.Printf("  after:  %s\n", d.After)
+		}
+		for _, detail := range d.Details {
+			fmt.Printf("  - %s\n", detail)
+		}
+	}
+}

cmd/go-omni/api_test.go

@@ -1,6 +1,8 @@
 package main
 
 import (
+	"encoding/json"
+	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -30,7 +32,7 @@ func TestAPICommands(t *testing.T) {
 	if err = runNew([]string{"--api", api, "--module", "example.com/other", "--framework-dir", root, target}); err != nil {
 		t.Fatal(err)
 	}
-	if _, err = os.Stat(filepath.Join(target, "internal/service/greet/greet.go")); err != nil {
+	if _, err = os.Stat(filepath.Join(target, "internal/logic/greet/greet.go")); err != nil {
 		t.Fatal(err)
 	}
 	for _, args := range [][]string{{"validate"}, {"generate", "--api"}, {"new", "--api=x", "somewhere"}, {"generate", "--dir="}, {"generate", "--force"}, {"validate", "--api", api, "--dir", project}, {"validate", "--check"}} {
@@ -38,7 +40,110 @@ func TestAPICommands(t *testing.T) {
 			t.Fatalf("invalid args accepted: %v", args)
 		}
 	}
-	if err = runNew([]string{"--api", api, "--force", target}); err == nil || !strings.Contains(err.Error(), "does not accept --force") {
+	if err = runNew([]string{"--api", api, "--force", target}); err == nil || !strings.Contains(err.Error(), "do not accept --force") {
 		t.Fatalf("incompatible profile: %v", err)
 	}
 }
+
+func TestAPIDeveloperCommands(t *testing.T) {
+	root, err := filepath.Abs("../..")
+	if err != nil {
+		t.Fatal(err)
+	}
+	dir := filepath.Join(t.TempDir(), "project")
+	if err = runAPI([]string{"new", dir, "--framework-dir", root, "--module", "example.com/commands"}); err != nil {
+		t.Fatal(err)
+	}
+	// Generation can resolve the entry from an explicit target directory.
+	if err = runAPI([]string{"generate", "--dir", dir, "--dry-run"}); err != nil {
+		t.Fatal(err)
+	}
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = os.Chdir(dir); err != nil {
+		t.Fatal(err)
+	}
+	defer os.Chdir(wd)
+	for _, args := range [][]string{{"validate"}, {"inspect"}, {"generate", "--check"}} {
+		if err = runAPI(args); err != nil {
+			t.Fatalf("%v: %v", args, err)
+		}
+	}
+	doc := captureAPIOutput(t, []string{"export"})
+	var parsed map[string]any
+	if err = json.Unmarshal([]byte(doc), &parsed); err != nil {
+		t.Fatalf("export must be pure JSON: %v", err)
+	}
+	if parsed["openapi"] != "3.0.3" {
+		t.Fatal("wrong export")
+	}
+	for _, args := range [][]string{{"generate", "--dry-run", "--check"}, {"new", "--dry-run", "other"}, {"inspect", "--dir", dir}, {"export", "--log-output", "file"}} {
+		if err = runAPI(args); err == nil {
+			t.Fatalf("accepted invalid flags: %v", args)
+		}
+	}
+}
+func captureAPIOutput(t *testing.T, args []string) string {
+	t.Helper()
+	data, err := captureAPIResult(t, args)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return data
+}
+
+func captureAPIResult(t *testing.T, args []string) (string, error) {
+	t.Helper()
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	previous := os.Stdout
+	os.Stdout = w
+	defer func() { os.Stdout = previous; r.Close(); w.Close() }()
+	result := make(chan []byte, 1)
+	go func() { data, _ := io.ReadAll(r); result <- data }()
+	callErr := runAPI(args)
+	w.Close()
+	os.Stdout = previous
+	data := <-result
+	return string(data), callErr
+}
+
+func TestAPIChangeDiagnosticsVisibleOnFailure(t *testing.T) {
+	root, err := filepath.Abs("../..")
+	if err != nil {
+		t.Fatal(err)
+	}
+	dir := filepath.Join(t.TempDir(), "app")
+	captureAPIOutput(t, []string{"new", dir, "--module", "example.com/diagnostics", "--framework-dir", root})
+	api := filepath.Join(dir, "api/service.api")
+	data, err := os.ReadFile(api)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = os.WriteFile(api, []byte(strings.ReplaceAll(string(data), "GreetReq", "HelloReq")), 0644); err != nil {
+		t.Fatal(err)
+	}
+	for _, flag := range []string{"--dry-run", "--check", ""} {
+		args := []string{"generate", "--dir", dir}
+		if flag != "" {
+			args = append(args, flag)
+		}
+		text, err := captureAPIResult(t, args)
+		if (flag == "--check") != (err != nil) {
+			t.Fatalf("%s: %v", flag, err)
+		}
+		for _, want := range []string{"REVIEW [contractChanged]", "ERROR [logicSignature]", "internal/logic/greet/greet.go:", "types.HelloReq", "types.GreetReq"} {
+			if !strings.Contains(text, want) {
+				t.Fatalf("%s hides %q:\n%s", flag, want, text)
+			}
+		}
+	}
+	text, err := captureAPIResult(t, []string{"generate", "--dir", dir, "--check"})
+	if err == nil || !strings.Contains(text, "ERROR [logicSignature]") || strings.Contains(text, "files are current") {
+		t.Fatalf("check claimed success: %v\n%s", err, text)
+	}
+}

cmd/go-omni/apigen/apigen_test.go

@@ -87,7 +87,6 @@ func TestInvalidDefinitions(t *testing.T) {
 		"service user { @handler go\n @status 201\n post /go\n}",
 		"type A { Name string `header:\"Name\"` }\nservice user { @handler go\n get /go returns (A)\n}",
 		"@server (group: ../../bad)\nservice user { @handler go\n get /go\n}",
-		"service user { @handler go\n get /health/ready\n}",
 		"type A { Name string `json:\"name\"`\n Name int `json:\"other\"` }\nservice user { @handler go\n post /go (A)\n}",
 		"service user { @handler go\n get /go\n @handler Go\n get /other\n}",
 		"type A { Value []byte `json:\"value\"` }\nservice user { @handler go\n post /go (A)\n}",
@@ -135,7 +134,7 @@ func TestSharedPrefixConflict(t *testing.T) {
 }
 
 func FuzzParser(f *testing.F) {
-	for _, s := range []string{starterAPI, "syntax = \"v1\"", "type (", "@server (prefix: /api)"} {
+	for _, s := range []string{starterAPI, declaredAPI, "error Broken", "auth Auth (type: bearer)", "syntax = \"v1\"", "type (", "@server (prefix: /api)"} {
 		f.Add(s)
 	}
 	f.Fuzz(func(t *testing.T, source string) {
@@ -168,10 +167,10 @@ func TestRegenerationAndConflicts(t *testing.T) {
 	if _, err := Generate(o); err != nil {
 		t.Fatal(err)
 	}
-	servicePath := filepath.Join(dir, "internal/service/greet/greet.go")
+	servicePath := filepath.Join(dir, "internal/logic/greet/greet.go")
 	service := readFile(t, servicePath) + "\n// user edit must survive\n"
 	writeFile(t, servicePath, service)
-	for _, file := range []string{"cmd/server/main.go", "etc/config.yaml", "internal/servicecontext/context.go", "internal/repository/greet/repository.go"} {
+	for _, file := range []string{"etc/config.yaml", "internal/svc/serviceContext.go", "internal/repository/greet/repository.go"} {
 		body := readFile(t, filepath.Join(dir, file))
 		if strings.HasSuffix(file, ".go") {
 			body += "\n// handwritten extension\n"
@@ -204,7 +203,7 @@ func TestRegenerationAndConflicts(t *testing.T) {
 	if _, err := os.Stat(filepath.Join(dir, "internal/handler/extra/handlersGen.go")); !os.IsNotExist(err) {
 		t.Fatal("stale handler remains")
 	}
-	if _, err := os.Stat(filepath.Join(dir, "internal/service/extra/ping.go")); err != nil {
+	if _, err := os.Stat(filepath.Join(dir, "internal/logic/extra/ping.go")); err != nil {
 		t.Fatal("business stub removed")
 	}
 	writeFile(t, filepath.Join(dir, "internal/types/typesGen.go"), typesBefore+"\n// edited generated file\n")
@@ -312,9 +311,9 @@ func TestGeneratedProjectsBuildAndRun(t *testing.T) {
 			if starter {
 				source = consumerStarterTest
 			} else {
-				writeFile(t, filepath.Join(dir, "internal/service/user/updateUser.go"), `package user
+				writeFile(t, filepath.Join(dir, "internal/logic/user/updateUser.go"), `package user
 import("context";"example.com/consumer/internal/types")
-func(s *Service) UpdateUser(ctx context.Context,req *types.UpdateUserReq)(*types.UserResp,error){return &types.UserResp{UserID:req.UserID,Name:req.Name,Active:req.Active},nil}
+func(s *Logic) UpdateUser(ctx context.Context,req *types.UpdateUserReq)(*types.UserResp,error){return &types.UserResp{UserID:req.UserID,Name:req.Name,Active:req.Active},nil}
 `)
 			}
 			writeFile(t, filepath.Join(dir, "contract_test.go"), source)
@@ -339,13 +338,13 @@ func(s *Service) UpdateUser(ctx context.Context,req *types.UpdateUserReq)(*types
 	}
 }
 
-const consumerStarterTest = `package consumer_test
-import("context";"io";"net/http/httptest";"strings";"testing";omni "git.yuntuo.hk/k2safe/go-omni";"git.yuntuo.hk/k2safe/go-omni/logx";"example.com/consumer/internal/handler";"example.com/consumer/internal/servicecontext";"example.com/consumer/internal/settings")
-func TestGreeting(t *testing.T){cfg,err:=settings.Load("etc/config.yaml");if err!=nil{t.Fatal(err)};cfg.Server.Log.Writer=io.Discard;cfg.Server.Log.File="";cfg.Server.Log.Rotation=logx.RotationConfig{};logger,err:=logx.New(cfg.Server.Log);if err!=nil{t.Fatal(err)};defer logger.Close();deps,err:=servicecontext.New(context.Background(),logger);if err!=nil{t.Fatal(err)};defer deps.Close();app:=omni.New();defer app.Close();if err=handler.RegisterRoutes(app,deps);err!=nil{t.Fatal(err)};w:=httptest.NewRecorder();app.Engine().ServeHTTP(w,httptest.NewRequest("GET","/api/greet/Alice",nil));if w.Code!=200||!strings.Contains(w.Body.String(),"Hello Alice")||w.Header().Get("X-Request-ID")==""{t.Fatalf("%d %s",w.Code,w.Body.String())}}
+const consumerStarterTest = `package main_test
+import("context";"io";"net/http/httptest";"strings";"testing";omni "git.yuntuo.hk/k2safe/go-omni";"git.yuntuo.hk/k2safe/go-omni/logx";"example.com/consumer/internal/handler";"example.com/consumer/internal/svc";"example.com/consumer/internal/config")
+func TestGreeting(t *testing.T){cfg,err:=config.Load("etc/config.yaml");if err!=nil{t.Fatal(err)};cfg.Server.Log.Writer=io.Discard;cfg.Server.Log.File="";cfg.Server.Log.Rotation=logx.RotationConfig{};logger,err:=logx.New(cfg.Server.Log);if err!=nil{t.Fatal(err)};defer logger.Close();deps,err:=svc.New(context.Background(),logger);if err!=nil{t.Fatal(err)};defer deps.Close();app:=omni.New();defer app.Close();if err=handler.RegisterRoutes(app,deps);err!=nil{t.Fatal(err)};w:=httptest.NewRecorder();app.Engine().ServeHTTP(w,httptest.NewRequest("GET","/api/greet/Alice",nil));if w.Code!=200||!strings.Contains(w.Body.String(),"Hello Alice")||w.Header().Get("X-Request-ID")==""{t.Fatalf("%d %s",w.Code,w.Body.String())}}
 `
-const consumerContractTest = `package consumer_test
-import("context";"encoding/json";"io";"net/http/httptest";"strings";"testing";omni "git.yuntuo.hk/k2safe/go-omni";"git.yuntuo.hk/k2safe/go-omni/logx";"example.com/consumer/internal/handler";"example.com/consumer/internal/servicecontext")
-func TestContract(t *testing.T){cfg:=logx.Default();cfg.Writer=io.Discard;logger,err:=logx.New(cfg);if err!=nil{t.Fatal(err)};defer logger.Close();deps,err:=servicecontext.New(context.Background(),logger);if err!=nil{t.Fatal(err)};defer deps.Close();app:=omni.New();defer app.Close();if err=handler.RegisterRoutes(app,deps);err!=nil{t.Fatal(err)}
+const consumerContractTest = `package main_test
+import("context";"encoding/json";"io";"net/http/httptest";"strings";"testing";omni "git.yuntuo.hk/k2safe/go-omni";"git.yuntuo.hk/k2safe/go-omni/logx";"example.com/consumer/internal/handler";"example.com/consumer/internal/svc")
+func TestContract(t *testing.T){cfg:=logx.Default();cfg.Writer=io.Discard;logger,err:=logx.New(cfg);if err!=nil{t.Fatal(err)};defer logger.Close();deps,err:=svc.New(context.Background(),logger);if err!=nil{t.Fatal(err)};defer deps.Close();app:=omni.New();defer app.Close();if err=handler.RegisterRoutes(app,deps);err!=nil{t.Fatal(err)}
  for _,tc:=range []struct{method,path,body string;status int}{
  {"PUT","/api/v1/users/7?notify=true",` + "`" + `{"name":"Alice","active":false,"age":0}` + "`" + `,200},
  {"PUT","/api/v1/users/7",` + "`" + `{"name":"Alice"}` + "`" + `,400},

cmd/go-omni/apigen/arrayResponse_test.go

@@ -0,0 +1,104 @@
+package apigen
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestPrimitiveArrayContracts(t *testing.T) {
+	for _, name := range []string{"string", "bool", "int", "int8", "int16", "int32", "int64", "uint", "uint16", "uint32", "uint64", "float32", "float64", "any"} {
+		t.Run(name, func(t *testing.T) {
+			spec, err := parseText(t, fmt.Sprintf("service arrays{\n@handler list\nget /list returns ([]%s)\n}", name))
+			if err != nil {
+				t.Fatal(err)
+			}
+			c, err := Compile(spec)
+			if err != nil {
+				t.Fatal(err)
+			}
+			schema := operation(t, document(t, c), "/list", "get")["responses"].(map[string]any)["200"].(map[string]any)["content"].(map[string]any)["application/json"].(map[string]any)["schema"].(map[string]any)
+			data := schema["properties"].(map[string]any)["data"].(map[string]any)
+			if data["type"] != "array" || data["items"] == nil {
+				t.Fatal(data)
+			}
+			if name == "any" && len(data["items"].(map[string]any)) != 0 {
+				t.Fatal("dynamic JSON was constrained")
+			}
+			if responseGoType("[]"+name) != "[]"+name || responseNeedsTypes("[]"+name) {
+				t.Fatal("wrong Go signature/import")
+			}
+		})
+	}
+	for _, name := range []string{"uint8", "File", "Unknown", "[]string"} {
+		spec, err := parseText(t, fmt.Sprintf("service arrays{\n@handler list\nget /list returns ([]%s)\n}", name))
+		if err == nil {
+			_, err = Compile(spec)
+		}
+		if err == nil {
+			t.Fatal("unsupported root accepted", name)
+		}
+	}
+}
+
+func TestPrimitiveArrayConsumer(t *testing.T) {
+	if os.Getenv("GO_OMNI_SCAFFOLD_INTEGRATION") != "1" {
+		t.Skip("set GO_OMNI_SCAFFOLD_INTEGRATION=1")
+	}
+	dir := filepath.Join(t.TempDir(), "arrays")
+	o := Options{Dir: dir, API: filepath.Join(frameworkRoot(t), "examples/contracts/arrays.api"), Module: "example.com/arrays", FrameworkDir: frameworkRoot(t)}
+	if err := generateManagedTestProject(t, o); err != nil {
+		t.Fatal(err)
+	}
+	for _, name := range []string{"strings", "integers", "dynamic", "empty", "raw"} {
+		writeFile(t, filepath.Join(dir, "internal/logic/arrays/"+name+".go"), "package arrays\n")
+	}
+	writeFile(t, filepath.Join(dir, "internal/logic/arrays/values.go"), readFile(t, "testdata/arrays/values.go"))
+	writeFile(t, filepath.Join(dir, "consumer_test.go"), readFile(t, "testdata/arrays/consumer_test.go"))
+	o.API = filepath.Join(dir, "api/arrays.api")
+	if err := generateManagedTestProject(t, o); err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(readFile(t, filepath.Join(dir, "internal/logic/arrays/values.go")), "企业") {
+		t.Fatal("logic overwritten")
+	}
+	o.Check = true
+	if err := generateManagedTestProject(t, o); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "go", "test", "-race", "-mod=mod", "-count=1", "./...")
+	cmd.Dir = dir
+	cmd.Env = append(os.Environ(), "GOWORK=off")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("%v\n%s", err, out)
+	}
+	if os.Getenv("GO_OMNI_RELEASE_CLI") != "" {
+		cmd = exec.CommandContext(ctx, "go", "list", "-m", "-json", frameworkModule)
+		cmd.Dir = dir
+		cmd.Env = append(os.Environ(), "GOWORK=off")
+		raw, err := cmd.CombinedOutput()
+		if err != nil {
+			t.Fatal(err, string(raw))
+		}
+		var module struct {
+			Version, Sum string
+			Replace      any
+		}
+		if err = json.Unmarshal(raw, &module); err != nil {
+			t.Fatal(err)
+		}
+		if module.Version != os.Getenv("GO_OMNI_RELEASE_VERSION") || module.Replace != nil || module.Sum == "" {
+			t.Fatal("not a fixed remote consumer")
+		}
+		t.Logf("remote framework %s checksum %s; no local replace", module.Version, module.Sum)
+	}
+
+}

cmd/go-omni/apigen/business_test.go

@@ -0,0 +1,91 @@
+package apigen
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestBusinessContract(t *testing.T) {
+	spec, err := Parse(filepath.Join(frameworkRoot(t), "examples/contracts/business.api"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, err := Compile(spec)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var doc map[string]any
+	if err = json.Unmarshal(c.Document, &doc); err != nil {
+		t.Fatal(err)
+	}
+	paths := doc["paths"].(map[string]any)
+	body := paths["/optional"].(map[string]any)["post"].(map[string]any)["requestBody"].(map[string]any)
+	if body["required"] != false {
+		t.Fatal("optional body documented as required")
+	}
+	for _, path := range []string{"/empty", "/absent"} {
+		if paths[path].(map[string]any)["post"].(map[string]any)["x-omni-request-policy"] == nil {
+			t.Fatal("missing policy metadata")
+		}
+	}
+}
+func TestBusinessGeneratedProject(t *testing.T) {
+	if os.Getenv("GO_OMNI_SCAFFOLD_INTEGRATION") != "1" {
+		t.Skip("set GO_OMNI_SCAFFOLD_INTEGRATION=1")
+	}
+	dir := filepath.Join(t.TempDir(), "business")
+	o := Options{Dir: dir, API: filepath.Join(frameworkRoot(t), "examples/contracts/business.api"), Module: "example.com/business", FrameworkDir: frameworkRoot(t)}
+	if err := generateManagedTestProject(t, o); err != nil {
+		t.Fatal(err)
+	}
+	for _, name := range []string{"upload", "nullable", "nothing", "rawNull", "rawArray", "empty", "absent", "optional", "echo", "tolerant", "noContent"} {
+		writeFile(t, filepath.Join(dir, "internal/logic/demo/"+name+".go"), "package demo\n")
+	}
+	writeFile(t, filepath.Join(dir, "internal/logic/demo/list.go"), readFile(t, "testdata/business/operations.go"))
+	writeFile(t, filepath.Join(dir, "consumer_test.go"), readFile(t, "testdata/business/consumer_test.go"))
+	writeFile(t, filepath.Join(dir, "internal/middleware/accessFactory.go"), readFile(t, "testdata/business/accessFactory.go"))
+	writeFile(t, filepath.Join(dir, "internal/svc/client.go"), readFile(t, "testdata/business/client.go"))
+	svcFile := filepath.Join(dir, "internal/svc/serviceContext.go")
+	source := strings.Replace(readFile(t, svcFile), "type ServiceContext struct {", "type ServiceContext struct {\n Client *accessClient", 1)
+	source = strings.Replace(source, "return nil", "return c.initAccess(ctx)", 1)
+	writeFile(t, svcFile, source)
+	o.API = filepath.Join(dir, "api/business.api")
+	o.Check = true
+	if err := generateManagedTestProject(t, o); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "go", "test", "-race", "-mod=mod", "-count=1", "./...")
+	cmd.Dir = dir
+	cmd.Env = append(os.Environ(), "GOWORK=off")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("%v\n%s", err, out)
+	}
+	if os.Getenv("GO_OMNI_RELEASE_CLI") != "" {
+		cmd = exec.CommandContext(ctx, "go", "list", "-m", "-json", frameworkModule)
+		cmd.Dir = dir
+		cmd.Env = append(os.Environ(), "GOWORK=off")
+		raw, err := cmd.CombinedOutput()
+		if err != nil {
+			t.Fatal(err, string(raw))
+		}
+		var module struct {
+			Version, Sum string
+			Replace      any
+		}
+		if err = json.Unmarshal(raw, &module); err != nil {
+			t.Fatal(err)
+		}
+		if module.Version != os.Getenv("GO_OMNI_RELEASE_VERSION") || module.Replace != nil || module.Sum == "" {
+			t.Fatal("not a fixed remote consumer")
+		}
+		t.Logf("remote framework %s checksum %s; no local replace", module.Version, module.Sum)
+	}
+}

cmd/go-omni/apigen/catalogDocument.go

@@ -0,0 +1,161 @@
+package apigen
+
+import (
+	"errors"
+	"fmt"
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"git.yuntuo.hk/k2safe/go-omni/response"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+const catalogDocumentFile = "omni.errors.json"
+
+// DocumentErrors selects documentation only. Runtime App inheritance and
+// route-local @errors declarations are never changed by this metadata.
+// A nil Include lists all errors; [] lists none. Routes override Include.
+type DocumentErrors struct {
+	Source  string              `json:"source"`
+	Include []string            `json:"include"`
+	Routes  map[string][]string `json:"routes,omitempty"`
+}
+
+func readDocumentCatalog(root string, spec *Spec, overrides map[string][]byte) error {
+	name := catalogDocumentFile
+	path := filepath.Join(root, name)
+	// Shared metadata uses the same explicitly authorized roots as .api imports.
+
+	if selection := spec.DocumentErrors; selection != nil {
+		if _, err := os.Lstat(path); !errors.Is(err, os.ErrNotExist) {
+			return errors.New("api: use either local omni.errors.json or shared errors.source, not both")
+		}
+		name = selection.Source
+		alias, sub, ok := strings.Cut(strings.TrimPrefix(name, "@"), "/")
+		declared, found := spec.SharedRoots[alias]
+		if !strings.HasPrefix(name, "@") || !ok || !found || sub == "" || filepath.Ext(sub) != ".json" {
+			return errors.New("api: errors.source must name a JSON file in a declared @root")
+		}
+		if err := safePath(declared.Path, sub); err != nil {
+			return err
+		}
+		path = filepath.Join(declared.Path, filepath.FromSlash(sub))
+	}
+	raw, ok := overrides[path]
+	if !ok {
+		stat, err := os.Lstat(path)
+		if errors.Is(err, os.ErrNotExist) && spec.DocumentErrors == nil {
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		if !stat.Mode().IsRegular() {
+			return errors.New("api: error metadata must be a regular file")
+		}
+		f, err := os.Open(path)
+		if err != nil {
+			return err
+		}
+		defer f.Close()
+		raw, err = io.ReadAll(io.LimitReader(f, (1<<20)+1))
+		if err != nil {
+			return err
+		}
+	}
+	if len(raw) > 1<<20 {
+		return errors.New("api: error metadata exceeds 1 MiB")
+	}
+	var catalog apierrors.Catalog
+	if err := apierrors.DecodeCatalogJSON(raw, &catalog); err != nil {
+		return err
+	}
+	registry, err := apierrors.NewRegistry(catalog)
+	if err != nil {
+		return err
+	}
+	normalized := registry.Catalog()
+	spec.DocumentCatalog = &normalized
+	spec.Sources[name] = raw
+	spec.SourcePaths[name] = path
+	return validateDocumentSelection(spec)
+}
+
+func documentRouteCatalog(spec *Spec, route Route) apierrors.Catalog {
+	catalog := spec.DocumentCatalog.Clone()
+	if spec.DocumentErrors == nil {
+		return catalog
+	}
+	include := spec.DocumentErrors.Include
+	if selected, ok := spec.DocumentErrors.Routes[strings.ToUpper(route.Method)+" "+route.Path]; ok {
+		include = selected
+	}
+	if include != nil {
+		selected := map[string]apierrors.Definition{}
+		for _, key := range include {
+			selected[key] = catalog.Definitions[key]
+		}
+		catalog.Definitions = selected
+	}
+	return catalog
+}
+
+func validateDocumentSelection(spec *Spec) error {
+	cfg := spec.DocumentErrors
+	if cfg == nil {
+		return nil
+	}
+	validate := func(keys []string) error {
+		seen := map[string]bool{}
+		for _, key := range keys {
+			if _, ok := spec.DocumentCatalog.Definitions[key]; !ok {
+				return fmt.Errorf("api: unknown documentation error %q", key)
+			}
+			if seen[key] {
+				return fmt.Errorf("api: duplicate documentation error %q", key)
+			}
+			seen[key] = true
+		}
+		return nil
+	}
+	if err := validate(cfg.Include); err != nil {
+		return err
+	}
+	routes := map[string]Route{}
+	for _, r := range spec.Routes {
+		routes[strings.ToUpper(r.Method)+" "+r.Path] = r
+	}
+	for key, keys := range cfg.Routes {
+		r, ok := routes[key]
+		if !ok {
+			return fmt.Errorf("api: unknown documentation route %q", key)
+		}
+		if len(r.Errors) > 0 {
+			return fmt.Errorf("api: %s already declares route-local errors", key)
+		}
+		if err := validate(keys); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateDocumentCatalog(spec *Spec) error {
+	if spec.DocumentCatalog == nil {
+		return nil
+	}
+	for _, r := range spec.Routes {
+		if len(r.Errors) > 0 {
+			continue
+		}
+		policy, err := response.New(responseConfig(spec, r))
+		if err != nil {
+			return err
+		}
+		if err = policy.ValidateErrors(documentRouteCatalog(spec, r)); err != nil {
+			return err
+		}
+	}
+	return nil
+}

cmd/go-omni/apigen/compatibility_test.go

@@ -0,0 +1,161 @@
+package apigen
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestCompatibilityContract(t *testing.T) {
+	s, err := Parse(filepath.Join(frameworkRoot(t), "examples/contracts/compatibility.api"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, err := Compile(s)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(s.Scalars) != 1 || len(s.Routes) != 6 {
+		t.Fatal("incomplete contract")
+	}
+	if !strings.Contains(string(c.Document), `"anyOf"`) || !strings.Contains(string(c.Document), `"multipart/form-data"`) {
+		t.Fatal("missing schemas")
+	}
+	for _, change := range [][2]string{{"jsonInput: string | int64", "jsonInput: mystery"}, {"text: true", "text: false"}, {"mode: multipart", "mode: invalid"}, {"maxBytes: 128", "maxBytes: 0"}, {"goType: ID", "goType: id"}, {"Data any", "Data interface{ Method() }"}} {
+		source := readFile(t, filepath.Join(frameworkRoot(t), "examples/contracts/compatibility.api"))
+		spec, err := parseText(t, strings.Replace(source, change[0], change[1], 1))
+		if err == nil {
+			_, err = Compile(spec)
+		}
+		if err == nil {
+			t.Fatalf("accepted %s", change[1])
+		}
+	}
+}
+func TestCompatibilityConsumer(t *testing.T) {
+	if os.Getenv("GO_OMNI_SCAFFOLD_INTEGRATION") == "" {
+		t.Skip("consumer integration")
+	}
+	root := frameworkRoot(t)
+	dir := filepath.Join(t.TempDir(), "consumer")
+	o := Options{API: filepath.Join(root, "examples/contracts/compatibility.api"), Dir: dir, Module: "example.com/compatibility", FrameworkDir: root}
+	releaseCLI := os.Getenv("GO_OMNI_RELEASE_CLI")
+	generate := func(check bool) {
+		t.Helper()
+		if releaseCLI == "" {
+			options := o
+			options.Check = check
+			if _, err := Generate(options); err != nil {
+				t.Fatal(err)
+			}
+			return
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+		args := []string{"api", "generate", "--api", o.API, "--dir", dir, "--module", o.Module}
+		if check {
+			args = append(args, "--check")
+		}
+		cmd := exec.CommandContext(ctx, releaseCLI, args...)
+		cmd.Dir = filepath.Dir(dir)
+		if output, err := cmd.CombinedOutput(); err != nil {
+			t.Fatalf("released CLI: %v\n%s", err, output)
+		}
+	}
+	generate(false)
+	files := map[string]string{
+		"internal/logic/demo/echo.go":              "echo.go",
+		"internal/handler/demo/customBind.go":      "hooks.go",
+		"internal/handler/files/downloadManual.go": "download.go",
+		"consumer_test.go":                         "consumer_test.go",
+	}
+	// The fixture implements related methods together; remove only its generated
+	// one-time stubs, then fill every stub so regeneration can preserve all files.
+	for _, name := range []string{"internal/logic/demo/item.go", "internal/logic/demo/custom.go"} {
+		writeFile(t, filepath.Join(dir, name), "package demo\n")
+	}
+	for _, name := range []string{"internal/handler/demo/uploadManual.go", "internal/handler/demo/callbackManual.go"} {
+		writeFile(t, filepath.Join(dir, name), "package demo\n")
+	}
+	for target, source := range files {
+		writeFile(t, filepath.Join(dir, target), readFile(t, filepath.Join("testdata/compatibility", source)))
+	}
+	before := map[string]string{}
+	for target := range files {
+		before[target] = readFile(t, filepath.Join(dir, target))
+	}
+	generate(false)
+	for target, content := range before {
+		if readFile(t, filepath.Join(dir, target)) != content {
+			t.Fatalf("overwrote %s", target)
+		}
+	}
+	generate(true)
+	ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "go", "test", "-mod=mod", "-race", "-count=1", "./...")
+	cmd.Dir = dir
+	cmd.Env = append(os.Environ(), "GOWORK=off")
+	if output, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("consumer: %v\n%s", err, output)
+	}
+	if releaseCLI != "" {
+		cmd = exec.CommandContext(ctx, "go", "list", "-m", "-json", frameworkModule)
+		cmd.Dir = dir
+		cmd.Env = append(os.Environ(), "GOWORK=off")
+		output, err := cmd.CombinedOutput()
+		if err != nil {
+			t.Fatalf("module: %v\n%s", err, output)
+		}
+		var module struct {
+			Version, Sum string
+			Replace      any
+		}
+		if err = json.Unmarshal(output, &module); err != nil {
+			t.Fatal(err)
+		}
+		if module.Version != os.Getenv("GO_OMNI_RELEASE_VERSION") || module.Replace != nil || module.Sum == "" {
+			t.Fatalf("not a fixed remote dependency: %+v", module)
+		}
+		t.Logf("remote framework %s checksum %s; no local replace", module.Version, module.Sum)
+	}
+
+}
+
+func TestNestedDynamicAliases(t *testing.T) {
+	source := readFile(t, filepath.Join(frameworkRoot(t), "examples/contracts/compatibility.api"))
+	for _, typ := range []string{"[]interface{}", "map[string]interface{}", "map[string][]interface{}"} {
+		s, err := parseText(t, strings.Replace(source, "Data any", "Data "+typ, 1))
+		if err == nil {
+			_, err = Compile(s)
+		}
+		if err != nil {
+			t.Fatalf("%s: %v", typ, err)
+		}
+	}
+}
+func TestSwitchFromManualRequiresExplicitMigration(t *testing.T) {
+	root := frameworkRoot(t)
+	o := Options{API: filepath.Join(root, "examples/contracts/compatibility.api"), Dir: filepath.Join(t.TempDir(), "consumer"), Module: "example.com/compatibility", FrameworkDir: root}
+	if _, err := Generate(o); err != nil {
+		t.Fatal(err)
+	}
+	// The hand-written source may contain business code. Never delete it to make
+	// the newly automatic handler compile; fail before touching generated files.
+	o.API = filepath.Join(o.Dir, "api/compatibility.api")
+	source := readFile(t, o.API)
+	source = strings.Replace(source, "@handlerMode manual\n @produces \"application/octet-stream\"", "", 1)
+	writeFile(t, o.API, source)
+	before := snapshot(t, o.Dir)
+	if _, err := Generate(o); err == nil || !strings.Contains(err.Error(), "migrate and remove") {
+		t.Fatalf("unsafe mode switch: %v", err)
+	}
+	if !sameFiles(before, snapshot(t, o.Dir)) {
+		t.Fatal("failed mode switch mutated project")
+	}
+}

cmd/go-omni/apigen/compile.go

@@ -35,8 +35,25 @@ func Compile(spec *Spec) (*Compiled, error) {
 	if spec == nil || len(spec.Routes) == 0 || !serviceName.MatchString(spec.Service) {
 		return nil, errors.New("api: valid service and routes required")
 	}
+	var prepareErr error
+	spec, prepareErr = prepareMetadata(spec)
+	if prepareErr != nil {
+		return nil, prepareErr
+	}
+	if err := validateDocumentCatalog(spec); err != nil {
+		return nil, err
+	}
+	if err := spec.RequestPolicy.Validate(); err != nil {
+		return nil, err
+	}
 	definitions := map[string]Type{}
 	for _, t := range spec.Types {
+		if t.Name == "File" {
+			return nil, errors.New("File is reserved for multipart uploads")
+		}
+		if t.Name == "ContractScalars" && len(spec.Scalars) > 0 {
+			return nil, errors.New("ContractScalars is reserved when declaring scalars")
+		}
 		if !exportedName.MatchString(t.Name) {
 			return nil, fmt.Errorf("%s: type names must be UpperCamelCase", t.Position)
 		}
@@ -45,18 +62,25 @@ func Compile(spec *Spec) (*Compiled, error) {
 		}
 		definitions[t.Name] = t
 	}
+	scalarTypes, scalarDefs, err := compileScalars(spec, definitions)
+	if err != nil {
+		return nil, err
+	}
 	resolved := map[string]reflect.Type{}
 	resolving := map[string]bool{}
 	var resolve func(string, int) (reflect.Type, error)
 	var expression func(ast.Expr, int) (reflect.Type, error)
-	primitives := map[string]reflect.Type{"string": reflect.TypeOf(""), "bool": reflect.TypeOf(false), "int": reflect.TypeOf(int(0)), "int8": reflect.TypeOf(int8(0)), "int16": reflect.TypeOf(int16(0)), "int32": reflect.TypeOf(int32(0)), "int64": reflect.TypeOf(int64(0)), "uint": reflect.TypeOf(uint(0)), "uint8": reflect.TypeOf(uint8(0)), "uint16": reflect.TypeOf(uint16(0)), "uint32": reflect.TypeOf(uint32(0)), "uint64": reflect.TypeOf(uint64(0)), "float32": reflect.TypeOf(float32(0)), "float64": reflect.TypeOf(float64(0))}
+
 	expression = func(e ast.Expr, depth int) (reflect.Type, error) {
 		if depth > 32 {
 			return nil, errors.New("type nesting exceeds 32")
 		}
 		switch e := e.(type) {
 		case *ast.Ident:
-			if t, ok := primitives[e.Name]; ok {
+			if t, ok := scalarTypes[e.Name]; ok {
+				return t, nil
+			}
+			if t, ok := primitiveTypes[e.Name]; ok {
 				return t, nil
 			}
 			return resolve(e.Name, depth+1)
@@ -123,7 +147,7 @@ func Compile(spec *Spec) (*Compiled, error) {
 			if err != nil {
 				return nil, fmt.Errorf("%s.%s: %w", name, f.Name, err)
 			}
-			fields = append(fields, reflect.StructField{Name: f.Name, Type: t, Tag: reflect.StructTag(f.Tag)})
+			fields = append(fields, reflect.StructField{Name: f.Name, Type: t, Tag: reflect.StructTag(fieldTag(f))})
 		}
 		t := reflect.StructOf(fields)
 		resolved[name] = t
@@ -135,7 +159,7 @@ func Compile(spec *Spec) (*Compiled, error) {
 		if err != nil {
 			return nil, err
 		}
-		b, err := contract.ForType(rt)
+		b, err := contract.Describe(rt, scalarDefs...)
 		if err != nil {
 			return nil, fmt.Errorf("%s: %w", t.Position, err)
 		}
@@ -147,12 +171,12 @@ func Compile(spec *Spec) (*Compiled, error) {
 	}
 	handlers, paths, shapes, groups := map[string]bool{}, map[string]bool{}, map[string]string{}, map[string]bool{}
 	middlewareSymbols := map[string]string{}
-	for _, r := range spec.Routes {
+	for routeIndex, r := range spec.Routes {
 		if !goName.MatchString(r.Handler) {
 			return nil, fmt.Errorf("%s: invalid handler name", r.Position)
 		}
-		if strings.EqualFold(r.Handler, "service") {
-			return nil, errors.New("handler name service conflicts with the service constructor file")
+		if strings.EqualFold(r.Handler, "service") || strings.EqualFold(r.Handler, "logic") {
+			return nil, errors.New("handler name conflicts with the Logic constructor file")
 		}
 		if r.Group == "" {
 			return nil, errors.New("group required")
@@ -203,48 +227,68 @@ func Compile(spec *Spec) (*Compiled, error) {
 			return nil, fmt.Errorf("duplicate route %s", pathKey)
 		}
 		paths[pathKey] = true
-		if r.Path == "/health/live" || r.Path == "/health/ready" || r.Path == "/openapi.json" {
-			return nil, fmt.Errorf("route %s is reserved by the generated server", r.Path)
-		}
 		if r.Method != strings.ToLower(r.Method) {
 			return nil, errors.New("HTTP methods must be lowercase")
 		}
 		if r.Status != 200 && r.Status != 201 && r.Status != 202 && r.Status != 204 {
 			return nil, errors.New("@status supports 200, 201, 202 or 204")
 		}
-		if (r.Status == 204) != (r.Response == "") {
+		if !r.Manual && r.Produces == "" && (r.Status == 204) != (r.Response == "") {
 			return nil, errors.New("204 requires no response; other success statuses require a response type")
 		}
 		if r.Method == "head" && r.Response != "" {
 			return nil, errors.New("HEAD must not declare a response body")
 		}
+		if err := validateRouteExtensions(r); err != nil {
+			return nil, fmt.Errorf("%s: %w", r.Position, err)
+		}
+		effectivePolicy := contract.MergePolicy(spec.RequestPolicy, r.RequestPolicy)
+		if (r.Method == "get" || r.Method == "head") && effectivePolicy.Body != "" && effectivePolicy.Body != "auto" && effectivePolicy.Body != "none" {
+			return nil, errors.New("GET/HEAD cannot inherit a JSON body policy; override body with auto or none")
+		}
 		op := openapi.Operation{Method: r.Method, Path: r.Path, OperationID: operationID(r), Summary: r.Summary, Responses: map[int]openapi.Response{}}
 		if r.Request != "" {
 			b, ok := c.Bindings[r.Request]
 			if !ok {
 				return nil, fmt.Errorf("unknown request %s", r.Request)
 			}
+			r.BoundMultipart = b.HasMultipart() && !r.CustomBinding && !r.Manual
+			spec.Routes[routeIndex].BoundMultipart = r.BoundMultipart
+			if b.HasMultipart() && r.BodyMode != "multipart" {
+				return nil, errors.New("multipart fields require @body (mode: multipart)")
+			}
 			op.Parameters = b.Parameters()
 			op.Request = b.BodySchema()
+			if op.Request != nil && (effectivePolicy.Body == "none" || effectivePolicy.Body == "emptyObject") {
+				return nil, errors.New("request policy conflicts with JSON fields")
+			}
+			if op.Request != nil && (r.BodyMode == "raw" || r.BodyMode == "multipart") {
+				return nil, errors.New("raw/multipart request DTOs may declare only path/form/header fields; use the generated body stream for content")
+			}
 			if op.Request != nil && (r.Method == "get" || r.Method == "head") {
 				return nil, errors.New("GET/HEAD requests cannot declare JSON bodies; use form/path/header tags")
 			}
 		}
 		var response *openapi.Schema
 		if r.Response != "" {
-			b, ok := c.Bindings[r.Response]
-			if !ok {
-				return nil, fmt.Errorf("unknown response %s", r.Response)
-			}
-			s, err := b.ResponseSchema()
+			s, err := responseDataSchema(r.Response, c.Bindings)
 			if err != nil {
 				return nil, err
 			}
-			response = openapi.Envelope(s)
-			response.Required = append(response.Required, "data")
+			if r.ResponseFormat == "raw" {
+				response = s
+			} else {
+				response, err = openapi.EnvelopeWith(s, responseConfig(spec, r))
+				if err != nil {
+					return nil, err
+				}
+			}
 		}
 		op.Responses[r.Status] = openapi.Response{Description: "Success", Schema: response}
-		errorSchema := &openapi.Schema{Type: "object", Required: []string{"code", "message"}, Properties: map[string]*openapi.Schema{"code": {Type: "string"}, "message": {Type: "string"}, "requestId": {Type: "string"}}}
+		errorSchema, err := openapi.EnvelopeWith(nil, responseConfig(spec, r))
+		if err != nil {
+			return nil, err
+		}
 		for _, code := range []int{400, 413, 415, 500, 501} {
 			op.Responses[code] = openapi.Response{Description: "Error", Schema: errorSchema}
 		}
@@ -260,25 +304,16 @@ func Compile(spec *Spec) (*Compiled, error) {
 	if err != nil {
 		return nil, err
 	}
-	// Show named hooks in documentation without claiming they implement a
-	// particular authentication scheme. Applications own that policy.
+	// Decorate the document with explicit auth/error contracts. Credential
+	// validation remains in the linked application middleware.
 	var doc map[string]any
 	decoder := json.NewDecoder(bytes.NewReader(c.Document))
 	decoder.UseNumber()
 	if err = decoder.Decode(&doc); err != nil {
 		return nil, err
 	}
-	for _, r := range spec.Routes {
-		if len(r.Middleware) > 0 {
-			path := r.Path
-			for _, part := range strings.Split(r.Path, "/") {
-				if strings.HasPrefix(part, ":") {
-					path = strings.ReplaceAll(path, part, "{"+part[1:]+"}")
-				}
-			}
-			doc["paths"].(map[string]any)[path].(map[string]any)[r.Method].(map[string]any)["x-omni-middleware"] = r.Middleware
-		}
-	}
+	decorateDocument(doc, spec, c.Bindings)
+	compactDocument(doc)
 	c.Document, err = json.MarshalIndent(doc, "", "  ")
 	return c, err
 }

cmd/go-omni/apigen/contractChanges.go

@@ -0,0 +1,245 @@
+package apigen
+
+import (
+	"fmt"
+	"go/ast"
+	goparser "go/parser"
+	"reflect"
+	"sort"
+	"strings"
+)
+
+// Diagnostic points to preserved project code that needs attention. Review
+// notices describe contract changes; errors describe definite source problems.
+type Diagnostic struct {
+	Severity, Code, Path, Operation, Message string
+	Line                                     int
+	Before, After                            string
+	Details                                  []string
+}
+
+// Snapshots describe the last successfully generated contract, never business
+// source or absolute paths. They are persisted in the ownership transaction.
+type contractSnapshot struct {
+	Routes map[string]routeContract `json:"routes"`
+}
+
+type routeContract struct {
+	Method        string                  `json:"method"`
+	Path          string                  `json:"path"`
+	Group         string                  `json:"group"`
+	Handler       string                  `json:"handler"`
+	Signature     string                  `json:"signature"`
+	Request       string                  `json:"request,omitempty"`
+	Response      string                  `json:"response,omitempty"`
+	BodyMode      string                  `json:"bodyMode,omitempty"`
+	Produces      string                  `json:"produces,omitempty"`
+	MaxBodyBytes  int64                   `json:"maxBodyBytes,omitempty"`
+	Manual        bool                    `json:"manual,omitempty"`
+	CustomBinding bool                    `json:"customBinding,omitempty"`
+	Types         map[string]typeContract `json:"types,omitempty"`
+}
+
+type typeContract struct {
+	Fields []contractField `json:"fields,omitempty"`
+	Scalar string          `json:"scalar,omitempty"`
+}
+
+type contractField struct {
+	Name string `json:"name"`
+	Type string `json:"type"`
+	Tag  string `json:"tag"`
+}
+
+func snapshotContract(spec *Spec) *contractSnapshot {
+	definitions := map[string]typeContract{}
+	for _, t := range spec.Types {
+		d := typeContract{}
+		for _, f := range t.Fields {
+			d.Fields = append(d.Fields, contractField{f.Name, f.Type, f.Tag})
+		}
+		definitions[t.Name] = d
+	}
+	for _, s := range spec.Scalars {
+		definitions[s.Name] = typeContract{Scalar: fmt.Sprintf("%s.%s (jsonInput=%s, jsonOutput=%s, text=%t)", s.GoImport, s.GoType, s.JSONInput, s.JSONOutput, s.Text)}
+	}
+	snapshot := &contractSnapshot{Routes: map[string]routeContract{}}
+	for _, r := range spec.Routes {
+		dependencies := map[string]typeContract{}
+		var visit func(string)
+		visit = func(name string) {
+			d, ok := definitions[name]
+			if !ok {
+				return
+			}
+			if _, exists := dependencies[name]; exists {
+				return
+			}
+			dependencies[name] = d
+			for _, f := range d.Fields {
+				expr, err := goparser.ParseExpr(f.Type)
+				if err != nil {
+					continue
+				} // Compile already validates expressions.
+				ast.Inspect(expr, func(n ast.Node) bool {
+					if id, ok := n.(*ast.Ident); ok {
+						visit(id.Name)
+					}
+					return true
+				})
+			}
+		}
+		visit(r.Request)
+		_, responseName := responseShape(r.Response)
+		visit(responseName)
+		op := routeContract{
+			Method: strings.ToUpper(r.Method), Path: r.Path, Group: r.Group, Handler: r.Handler,
+			Request: r.Request, Response: r.Response, BodyMode: r.BodyMode, Produces: r.Produces,
+			MaxBodyBytes: r.MaxBodyBytes, Manual: r.Manual, CustomBinding: r.CustomBinding, Types: dependencies,
+		}
+		if !r.Manual {
+			op.Signature = expectedLogicSignature(r)
+		}
+		snapshot.Routes[r.Group+"/"+lower(r.Handler)] = op
+	}
+	return snapshot
+}
+
+func (r routeContract) file() string {
+	if r.Manual {
+		return "internal/handler/" + r.Group + "/" + lower(r.Handler) + "Manual.go"
+	}
+	return "internal/logic/" + r.Group + "/" + lower(r.Handler) + ".go"
+}
+
+func (r routeContract) operation() string { return r.Method + " " + r.Path }
+
+func compareContracts(old, next *contractSnapshot) []Diagnostic {
+	if old == nil {
+		return nil
+	}
+	var diagnostics []Diagnostic
+	for key, previous := range old.Routes {
+		current, exists := next.Routes[key]
+		if !exists {
+			diagnostics = append(diagnostics, Diagnostic{Severity: "review", Code: "routeRemoved", Path: previous.file(), Operation: previous.operation(), Message: "route removed or moved; its handwritten implementation is preserved; review obsolete code and types"})
+			continue
+		}
+		d := Diagnostic{Severity: "review", Code: "contractChanged", Path: current.file(), Operation: current.operation(), Message: "contract changed; review the preserved implementation"}
+		if previous.Signature != current.Signature {
+			d.Before, d.After = previous.Signature, current.Signature
+			d.Details = append(d.Details, "Logic call signature changed")
+		}
+		if previous.Method != current.Method || previous.Path != current.Path {
+			d.Details = append(d.Details, previous.operation()+" -> "+current.operation())
+		}
+		if previous.Manual != current.Manual || previous.CustomBinding != current.CustomBinding || previous.BodyMode != current.BodyMode || previous.MaxBodyBytes != current.MaxBodyBytes || previous.Produces != current.Produces {
+			d.Details = append(d.Details, fmt.Sprintf("HTTP access: manual=%t customBinding=%t body=%s maxBytes=%d produces=%q -> manual=%t customBinding=%t body=%s maxBytes=%d produces=%q", previous.Manual, previous.CustomBinding, previous.BodyMode, previous.MaxBodyBytes, previous.Produces, current.Manual, current.CustomBinding, current.BodyMode, current.MaxBodyBytes, current.Produces))
+		}
+		d.Details = append(d.Details, changedTypes(previous.Types, current.Types)...)
+		if len(d.Details) > 0 {
+			diagnostics = append(diagnostics, d)
+		}
+	}
+	return diagnostics
+}
+
+func changedTypes(old, next map[string]typeContract) []string {
+	names := map[string]bool{}
+	for name := range old {
+		names[name] = true
+	}
+	for name := range next {
+		names[name] = true
+	}
+	var details []string
+	for name := range names {
+		a, existed := old[name]
+		b, exists := next[name]
+		switch {
+		case !existed:
+			details = append(details, "DTO dependency added: "+name)
+		case !exists:
+			details = append(details, "DTO dependency removed: "+name)
+		case a.Scalar != b.Scalar:
+			details = append(details, fmt.Sprintf("scalar %s: %s -> %s", name, a.Scalar, b.Scalar))
+		case !reflect.DeepEqual(a.Fields, b.Fields):
+			oldFields, newFields := map[string]contractField{}, map[string]contractField{}
+			for _, f := range a.Fields {
+				oldFields[f.Name] = f
+			}
+			for _, f := range b.Fields {
+				newFields[f.Name] = f
+			}
+			before := len(details)
+			for field, f := range oldFields {
+				if n, ok := newFields[field]; !ok {
+					details = append(details, fmt.Sprintf("DTO %s.%s removed", name, field))
+				} else if f != n {
+					details = append(details, fmt.Sprintf("DTO %s.%s: %s `%s` -> %s `%s`", name, field, f.Type, f.Tag, n.Type, n.Tag))
+				}
+			}
+			for field := range newFields {
+				if _, ok := oldFields[field]; !ok {
+					details = append(details, fmt.Sprintf("DTO %s.%s added", name, field))
+				}
+			}
+			if len(details) == before {
+				details = append(details, "DTO "+name+" field order changed; review positional struct literals")
+			}
+		}
+	}
+	sort.Strings(details)
+	return details
+}
+
+func sortDiagnostics(diagnostics []Diagnostic) {
+	sort.Slice(diagnostics, func(i, j int) bool {
+		a, b := diagnostics[i], diagnostics[j]
+		if a.Path != b.Path {
+			return a.Path < b.Path
+		}
+		if a.Line != b.Line {
+			return a.Line < b.Line
+		}
+		if a.Code != b.Code {
+			return a.Code < b.Code
+		}
+		return a.Operation < b.Operation
+	})
+}
+
+func diagnosticErrors(diagnostics []Diagnostic) int {
+	count := 0
+	for _, d := range diagnostics {
+		if d.Severity == "error" {
+			count++
+		}
+	}
+	return count
+}
+
+func expectedLogicSignature(r Route) string {
+	params := []string{"context.Context"}
+	if r.Request != "" {
+		params = append(params, "*types."+r.Request)
+	}
+	if streamsBody(r) {
+		params = append(params, "*httpx.Body")
+	}
+	results := []string{"error"}
+	if r.Produces != "" {
+		results = []string{"*httpx.Stream", "error"}
+	} else if result := responseGoType(r.Response); result != "" {
+		results = []string{result, "error"}
+	}
+	return displaySignature(upper(r.Handler), params, results)
+}
+
+func displaySignature(name string, params, results []string) string {
+	result := strings.Join(results, ", ")
+	if len(results) != 1 {
+		result = "(" + result + ")"
+	}
+	return name + "(" + strings.Join(params, ", ") + ") " + result
+}

cmd/go-omni/apigen/contractChanges_test.go

@@ -0,0 +1,308 @@
+package apigen
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+)
+
+func findDiagnostic(t *testing.T, out Output, code string) Diagnostic {
+	t.Helper()
+	for _, d := range out.Diagnostics {
+		if d.Code == code {
+			return d
+		}
+	}
+	t.Fatalf("missing %s diagnostic: %+v", code, out.Diagnostics)
+	return Diagnostic{}
+}
+
+func TestContractChangesPersistUntilLogicFixed(t *testing.T) {
+	dir := filepath.Join(t.TempDir(), "app")
+	out, err := New(Options{Dir: dir, Module: "example.com/changes", FrameworkDir: frameworkRoot(t)})
+	if err != nil || len(out.Diagnostics) > 0 {
+		t.Fatalf("initial generation: %v %+v", err, out.Diagnostics)
+	}
+	o := Options{Dir: dir, API: filepath.Join(dir, "api/service.api")}
+	logicPath := filepath.Join(dir, "internal/logic/greet/greet.go")
+	logicBefore := readFile(t, logicPath)
+	writeFile(t, o.API, strings.ReplaceAll(readFile(t, o.API), "GreetReq", "HelloReq"))
+	before := snapshot(t, dir)
+	for _, dryRun := range []bool{true, false} {
+		o.DryRun, o.Check = dryRun, !dryRun
+		out, err = Generate(o)
+		if dryRun && err != nil {
+			t.Fatal(err)
+		}
+		if !dryRun && err == nil {
+			t.Fatal("check accepted stale project")
+		}
+		d := findDiagnostic(t, out, "logicSignature")
+		if d.Line <= 0 || d.Path != "internal/logic/greet/greet.go" || !strings.Contains(d.After, "*types.HelloReq") || !strings.Contains(d.Before, "*types.GreetReq") {
+			t.Fatalf("imprecise diagnosis: %+v", d)
+		}
+		findDiagnostic(t, out, "contractChanged")
+		if !sameFiles(before, snapshot(t, dir)) {
+			t.Fatal("preview/check changed files")
+		}
+	}
+	o.DryRun, o.Check = false, false
+	out, err = Generate(o)
+	if err != nil {
+		t.Fatal(err)
+	}
+	findDiagnostic(t, out, "logicSignature")
+	if readFile(t, logicPath) != logicBefore {
+		t.Fatal("business source overwritten")
+	}
+	o.Check = true
+	out, err = Generate(o)
+	if err == nil || strings.Contains(err.Error(), "stale") || len(out.Changes) != 0 {
+		t.Fatalf("signature drift must remain after generation: %v %+v", err, out.Changes)
+	}
+	findDiagnostic(t, out, "logicSignature")
+	// Method location and import/parameter names are project-owned. Find the
+	// method in a different file, honoring aliases and named result variables.
+	writeFile(t, logicPath, "package greet\n// business split into visitor.go\n")
+	writeFile(t, filepath.Join(dir, "internal/logic/greet/visitor.go"), `package greet
+import (ctx "context"; dto "example.com/changes/internal/types")
+func(s *Logic)Greet(input ctx.Context, request *dto.HelloReq)(output *dto.GreetResp, problem error){
+ return &dto.GreetResp{Message:request.Name},nil
+}
+`)
+	out, err = Generate(o)
+	if err != nil || len(out.Diagnostics) > 0 {
+		t.Fatalf("compatible business method rejected: %v %+v", err, out.Diagnostics)
+	}
+	before = snapshot(t, dir)
+	o.Check = false
+	if _, err = Generate(o); err != nil {
+		t.Fatal(err)
+	}
+	if !sameFiles(before, snapshot(t, dir)) {
+		t.Fatal("stable generation changed files")
+	}
+	// Field review notices should point to the actual moved business method.
+	writeFile(t, o.API, strings.Replace(readFile(t, o.API), `max=80`, `max=90`, 1))
+	o.DryRun = true
+	out, err = Generate(o)
+	if err != nil {
+		t.Fatal(err)
+	}
+	d := findDiagnostic(t, out, "contractChanged")
+	if d.Path != "internal/logic/greet/visitor.go" || d.Line == 0 {
+		t.Fatalf("wrong implementation location: %+v", d)
+	}
+	o.DryRun = false
+	if _, err = Generate(o); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "go", "test", "-mod=mod", "./...")
+	cmd.Dir = dir
+	cmd.Env = append(os.Environ(), "GOWORK=off")
+	if data, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("fixed generated consumer: %v\n%s", err, data)
+	}
+}
+
+func TestContractChangesReachNestedDTOs(t *testing.T) {
+	source := `syntax = "v1"
+type Address { Street string ` + "`json:\"street\"`" + ` }
+type Request { Address Address ` + "`json:\"address\"`" + ` }
+type Reply { Accepted bool ` + "`json:\"accepted\"`" + ` }
+@server(group: orders)
+service orders-api {
+ @handler create
+ post /orders (Request) returns (Reply)
+ @handler ping
+ get /ping
+}
+`
+	root := t.TempDir()
+	api := filepath.Join(root, "source/service.api")
+	writeFile(t, api, source)
+	dir := filepath.Join(root, "app")
+	if _, err := Generate(Options{API: api, Dir: dir, Module: "example.com/nested", FrameworkDir: frameworkRoot(t)}); err != nil {
+		t.Fatal(err)
+	}
+	o := Options{API: filepath.Join(dir, "api/service.api"), Dir: dir, DryRun: true}
+	writeFile(t, o.API, strings.Replace(source, "Street string", "Street int64", 1))
+	out, err := Generate(o)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(out.Diagnostics) != 1 {
+		t.Fatalf("unrelated routes should not be warned: %+v", out.Diagnostics)
+	}
+	d := findDiagnostic(t, out, "contractChanged")
+	if d.Path != "internal/logic/orders/create.go" || !strings.Contains(strings.Join(d.Details, "\n"), "Address.Street: string") {
+		t.Fatalf("nested field not explained: %+v", d)
+	}
+	// Import/file/comment/formatting changes are not semantic DTO changes.
+	writeFile(t, o.API, source+"\n// a harmless documentation edit\n")
+	out, err = Generate(o)
+	if err != nil || len(out.Diagnostics) > 0 {
+		t.Fatalf("comment caused false diagnostic: %v %+v", err, out.Diagnostics)
+	}
+	// Removal preserves the old implementation and explicitly points it out.
+	writeFile(t, o.API, strings.Replace(source, " @handler create\n post /orders (Request) returns (Reply)\n", "", 1))
+	out, err = Generate(o)
+	if err != nil {
+		t.Fatal(err)
+	}
+	d = findDiagnostic(t, out, "routeRemoved")
+	if d.Path != "internal/logic/orders/create.go" {
+		t.Fatal(d)
+	}
+}
+
+func TestContractSnapshotSemanticDetails(t *testing.T) {
+	base := &Spec{Types: []Type{{Name: "Req", Fields: []Field{{Name: "ID", Type: "ID", Tag: `form:"id"`}}}}, Scalars: []ScalarDefinition{{Name: "ID", GoImport: "example.com/id", GoType: "Value", JSONInput: "string", JSONOutput: "string"}}, Routes: []Route{{Group: "files", Handler: "send", Method: "post", Path: "/file", Request: "Req", BodyMode: "raw", MaxBodyBytes: 64, Produces: "text/plain"}}}
+	old := snapshotContract(base)
+	base.Scalars[0].Text = true
+	base.Routes[0].BodyMode = "multipart"
+	base.Routes[0].Produces = "application/octet-stream"
+	base.Routes[0].MaxBodyBytes = 128
+	base.Routes[0].Path = "/files"
+	diagnostics := compareContracts(old, snapshotContract(base))
+	if len(diagnostics) != 1 {
+		t.Fatal(diagnostics)
+	}
+	details := strings.Join(diagnostics[0].Details, "\n")
+	for _, want := range []string{"scalar ID", "body=raw", "body=multipart", "POST /file -> POST /files", "maxBytes=128"} {
+		if !strings.Contains(details, want) {
+			t.Fatal("missing", want, details)
+		}
+	}
+	base.Routes[0].Produces = ""
+	diagnostics = compareContracts(old, snapshotContract(base))
+	if !strings.Contains(diagnostics[0].Before, "*httpx.Stream") || !strings.HasSuffix(diagnostics[0].After, ") error") {
+		t.Fatal(diagnostics)
+	}
+}
+
+func TestLogicDiagnosticsSourceBoundaries(t *testing.T) {
+	for _, tc := range []struct{ name, source, code, severity string }{
+		{"wrongResult", `package greet; import "context"; func(s *Logic)Greet(context.Context) error{return nil}`, "logicSignature", "error"},
+		{"syntax", `package greet; func(s *Logic)Greet( {`, "logicSyntax", "error"},
+		{"alias", `package greet; import("context";"example.com/test/internal/types");type Input = types.GreetReq; func(s *Logic)Greet(context.Context,*Input)(*types.GreetResp,error){return nil,nil}`, "logicUnchecked", "review"},
+		{"conditional", "//go:build projectTag\n\npackage greet\n", "logicUnchecked", "review"},
+		{"missing", "package greet\n", "logicNotFound", "review"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			dir := filepath.Join(t.TempDir(), "app")
+			if _, err := New(Options{Dir: dir, Module: "example.com/test", FrameworkDir: frameworkRoot(t)}); err != nil {
+				t.Fatal(err)
+			}
+			writeFile(t, filepath.Join(dir, "internal/logic/greet/greet.go"), tc.source)
+			before := snapshot(t, dir)
+			out, err := Generate(Options{Dir: dir, API: filepath.Join(dir, "api/service.api"), Check: true})
+			d := findDiagnostic(t, out, tc.code)
+			if d.Severity != tc.severity || (tc.severity == "error") != (err != nil) {
+				t.Fatalf("unexpected check result: %v %+v", err, d)
+			}
+			if !sameFiles(before, snapshot(t, dir)) {
+				t.Fatal("analysis modified business source")
+			}
+		})
+	}
+}
+
+func TestContractSnapshotBootstrapAndDeterminism(t *testing.T) {
+	dir := filepath.Join(t.TempDir(), "app")
+	if _, err := New(Options{Dir: dir, Module: "example.com/test", FrameworkDir: frameworkRoot(t)}); err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(dir, manifestPath)
+	var previous manifest
+	if err := json.Unmarshal([]byte(readFile(t, path)), &previous); err != nil {
+		t.Fatal(err)
+	}
+	previous.Contract = nil
+	data, _ := json.MarshalIndent(previous, "", "  ")
+	writeFile(t, path, string(data)+"\n")
+	o := Options{Dir: dir, API: filepath.Join(dir, "api/service.api"), DryRun: true}
+	a, err := Generate(o)
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, err := Generate(o)
+	if err != nil || !reflect.DeepEqual(a, b) {
+		t.Fatal("non-deterministic preview", err)
+	}
+	findDiagnostic(t, a, "contractBaseline")
+	o.DryRun = false
+	if _, err = Generate(o); err != nil {
+		t.Fatal(err)
+	}
+	o.Check = true
+	out, err := Generate(o)
+	if err != nil || len(out.Diagnostics) > 0 {
+		t.Fatal(err, out.Diagnostics)
+	}
+}
+
+func TestLogicResponseAndBodySignatureChanges(t *testing.T) {
+	for _, tc := range []struct {
+		name, after string
+		change      func(string) string
+	}{
+		{"responseType", "*types.HelloResp", func(s string) string { return strings.ReplaceAll(s, "GreetResp", "HelloResp") }},
+		{"bodyParameter", "*httpx.Body", func(s string) string {
+			return strings.Replace(s, " get /greet", " @body (mode: raw; maxBytes: 64)\n post /greet", 1)
+		}},
+		{"streamResult", "*httpx.Stream", func(s string) string {
+			return strings.Replace(strings.Replace(s, " returns (GreetResp)", "", 1), " get /greet", " @produces \"text/plain\"\n get /greet", 1)
+		}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			dir := filepath.Join(t.TempDir(), "app")
+			if _, err := New(Options{Dir: dir, Module: "example.com/test", FrameworkDir: frameworkRoot(t)}); err != nil {
+				t.Fatal(err)
+			}
+			o := Options{Dir: dir, API: filepath.Join(dir, "api/service.api"), DryRun: true}
+			writeFile(t, o.API, tc.change(readFile(t, o.API)))
+			out, err := Generate(o)
+			if err != nil {
+				t.Fatal(err)
+			}
+			d := findDiagnostic(t, out, "logicSignature")
+			if !strings.Contains(d.After, tc.after) {
+				t.Fatal(d)
+			}
+		})
+	}
+}
+
+func TestLogicDuplicateAndTestFiles(t *testing.T) {
+	dir := filepath.Join(t.TempDir(), "app")
+	if _, err := New(Options{Dir: dir, Module: "example.com/test", FrameworkDir: frameworkRoot(t)}); err != nil {
+		t.Fatal(err)
+	}
+	source := readFile(t, filepath.Join(dir, "internal/logic/greet/greet.go"))
+	// String literals mentioning build constraints do not make a file conditional.
+	writeFile(t, filepath.Join(dir, "internal/logic/greet/greet.go"), source+"\nconst diagnosticText=\"//go:build special\"\n")
+	writeFile(t, filepath.Join(dir, "internal/logic/greet/fixture_test.go"), source)
+	o := Options{Dir: dir, API: filepath.Join(dir, "api/service.api"), Check: true}
+	out, err := Generate(o)
+	if err != nil || len(out.Diagnostics) > 0 {
+		t.Fatal(err, out.Diagnostics)
+	}
+	writeFile(t, filepath.Join(dir, "internal/logic/greet/duplicate.go"), source)
+	out, err = Generate(o)
+	if err == nil {
+		t.Fatal("duplicate method passed check")
+	}
+	d := findDiagnostic(t, out, "logicDuplicate")
+	if len(d.Details) != 2 || !strings.Contains(d.Details[0], "duplicate.go:") {
+		t.Fatal(d)
+	}
+}

cmd/go-omni/apigen/contractMetadata.go

@@ -0,0 +1,288 @@
+package apigen
+
+import (
+	"encoding/json"
+	"fmt"
+	"git.yuntuo.hk/k2safe/go-omni/contract"
+	"net/http"
+	"regexp"
+	"sort"
+	"strings"
+
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"git.yuntuo.hk/k2safe/go-omni/openapi"
+	"git.yuntuo.hk/k2safe/go-omni/response"
+)
+
+var errorCode = regexp.MustCompile(`^[A-Z][A-Z0-9_]*$`)
+var credentialName = regexp.MustCompile("^[!#$%&'*+.^_`|~0-9A-Za-z-]+$")
+
+// prepareMetadata returns a detached spec; repeated compilation must not prepend
+// authentication middleware more than once or mutate the parser's output.
+func prepareMetadata(original *Spec) (*Spec, error) {
+	spec := *original
+	spec.Routes = append([]Route(nil), original.Routes...)
+	spec.Errors = append([]ErrorDefinition(nil), original.Errors...)
+	if err := validateResponses(&spec); err != nil {
+		return nil, err
+	}
+	definitions := map[string]ErrorDefinition{}
+	codes, symbols := map[string]bool{}, map[string]bool{"Catalog": true}
+	for _, e := range spec.Errors {
+		if !exportedName.MatchString(e.Name) || !apierrors.ValidErrorStatus(e.Status) || strings.TrimSpace(e.Message) == "" {
+			return nil, fmt.Errorf("%s: error requires UpperCamelCase name, a final body-bearing status (200..599 except 204/205/304) and a nonempty public message", e.Position)
+		}
+		if e.Catalog == "" && !errorCode.MatchString(e.Code) {
+			return nil, fmt.Errorf("%s: legacy error declaration requires UPPER_SNAKE_CASE code", e.Position)
+		}
+		if codes[e.Code] {
+			return nil, fmt.Errorf("%s: duplicate error code %s", e.Position, e.Code)
+		}
+		for _, symbol := range []string{e.Name, "Code" + e.Name} {
+			if symbols[symbol] {
+				return nil, fmt.Errorf("%s: duplicate error symbol %s", e.Position, symbol)
+			}
+			symbols[symbol] = true
+		}
+		codes[e.Code] = true
+		definitions[e.Name] = e
+	}
+	registry, err := apierrors.NewRegistry(errorCatalog(&spec, nil))
+	if err != nil {
+		return nil, err
+	}
+	normalized := registry.Catalog()
+	for i := range spec.Errors {
+		spec.Errors[i].BusinessCode = normalized.Definitions[spec.Errors[i].Code].Code
+		spec.Errors[i].Params = normalized.Definitions[spec.Errors[i].Code].Params
+	}
+	if err := validateErrorPolicies(&spec); err != nil {
+		return nil, err
+	}
+	auth := map[string]AuthDefinition{}
+	for _, a := range spec.Auth {
+		if !exportedName.MatchString(a.Name) || !goName.MatchString(a.Middleware) || strings.EqualFold(a.Middleware, "defaults") || strings.EqualFold(a.Middleware, "registryGen") {
+			return nil, fmt.Errorf("%s: auth requires an UpperCamelCase name and a valid named middleware", a.Position)
+		}
+		if _, ok := auth[a.Name]; ok {
+			return nil, fmt.Errorf("%s: duplicate auth %s", a.Position, a.Name)
+		}
+		switch a.Type {
+		case "bearer":
+			if a.In != "" || a.KeyName != "" {
+				return nil, fmt.Errorf("%s: bearer auth does not accept in/name", a.Position)
+			}
+		case "apiKey":
+			if (a.In != "header" && a.In != "cookie") || !credentialName.MatchString(a.KeyName) || a.BearerFormat != "" {
+				return nil, fmt.Errorf("%s: apiKey requires in header/cookie and a valid name; bearerFormat is not supported", a.Position)
+			}
+			if a.In == "header" && (strings.EqualFold(a.KeyName, "Authorization") || strings.EqualFold(a.KeyName, "Cookie")) {
+				return nil, fmt.Errorf("%s: use bearer for Authorization or in cookie for a session", a.Position)
+			}
+		default:
+			return nil, fmt.Errorf("%s: auth type must be bearer or apiKey", a.Position)
+		}
+		auth[a.Name] = a
+	}
+	for i := range spec.Routes {
+		r := &spec.Routes[i]
+		r.Middleware = append([]string(nil), r.Middleware...)
+		if r.Auth != "" && r.Auth != "none" {
+			a, ok := auth[r.Auth]
+			if !ok {
+				return nil, fmt.Errorf("%s: unknown auth %s; declare auth %s (...) first", r.Position, r.Auth, r.Auth)
+			}
+			for _, m := range r.Middleware {
+				if strings.EqualFold(m, a.Middleware) {
+					return nil, fmt.Errorf("%s: auth %s already installs %s; remove it from middleware", r.Position, r.Auth, a.Middleware)
+				}
+			}
+			r.Middleware = append([]string{a.Middleware}, r.Middleware...)
+		}
+		seen := map[string]bool{}
+		for _, name := range r.Errors {
+			if _, ok := definitions[name]; !ok {
+				return nil, fmt.Errorf("%s: unknown error %s; declare it in errorCatalog or error (...)", r.Position, name)
+			}
+			if seen[name] {
+				return nil, fmt.Errorf("%s: duplicate error %s", r.Position, name)
+			}
+			seen[name] = true
+		}
+		seen = map[string]bool{}
+		for _, tag := range r.Tags {
+			if strings.TrimSpace(tag) == "" || seen[tag] {
+				return nil, fmt.Errorf("%s: @doc tags must be nonempty and unique", r.Position)
+			}
+			seen[tag] = true
+		}
+	}
+	return &spec, nil
+}
+
+func decorateDocument(doc map[string]any, spec *Spec, bindings map[string]*contract.Binder) {
+	doc["x-omni-contract-sources"] = sourceMetadata(spec)
+	if spec.DefaultResponse != "" {
+		doc["x-omni-default-response"] = spec.DefaultResponse
+	}
+	if spec.Description != "" {
+		doc["info"].(map[string]any)["description"] = spec.Description
+	}
+	schemes := map[string]any{}
+	for _, a := range spec.Auth {
+		scheme := map[string]any{}
+		if a.Type == "bearer" {
+			scheme["type"], scheme["scheme"] = "http", "bearer"
+			if a.BearerFormat != "" {
+				scheme["bearerFormat"] = a.BearerFormat
+			}
+		} else {
+			scheme["type"], scheme["in"], scheme["name"] = "apiKey", a.In, a.KeyName
+		}
+		if a.Description != "" {
+			scheme["description"] = a.Description
+		}
+		schemes[a.Name] = scheme
+	}
+	doc["components"].(map[string]any)["securitySchemes"] = schemes
+	definitions := map[string]ErrorDefinition{}
+	declaredRegistry := apierrors.MustRegistry(errorCatalog(spec, nil))
+	var documentRegistry *apierrors.Registry
+	if spec.DocumentCatalog != nil {
+		documentRegistry = apierrors.MustRegistry(*spec.DocumentCatalog)
+		doc["x-omni-app-error-catalog"] = documentRegistry.Catalog()
+	}
+	for _, e := range spec.Errors {
+		definitions[e.Name] = e
+	}
+	if len(spec.Errors) > 0 {
+		doc["x-omni-errors"] = spec.Errors
+	}
+	for _, r := range spec.Routes {
+		registry := declaredRegistry
+		policy := response.MustNew(responseConfig(spec, r))
+		cfg := policy.Config()
+		parts := strings.Split(r.Path, "/")
+		for i, part := range parts {
+			if strings.HasPrefix(part, ":") {
+				parts[i] = "{" + part[1:] + "}"
+			}
+		}
+		op := doc["paths"].(map[string]any)[strings.Join(parts, "/")].(map[string]any)[r.Method].(map[string]any)
+		requestRoute := r
+		requestRoute.RequestPolicy = contract.MergePolicy(spec.RequestPolicy, r.RequestPolicy)
+		decorateRequestOptions(op, requestRoute)
+		if b := bindings[r.Request]; b != nil && b.HasMultipart() {
+			encoding := map[string]any{}
+			for _, name := range b.MultipartJSONFields() {
+				encoding[name] = map[string]any{"contentType": "application/json"}
+			}
+			op["requestBody"] = map[string]any{"required": true, "content": map[string]any{"multipart/form-data": map[string]any{"schema": b.MultipartSchema(), "encoding": encoding}}}
+		}
+		if r.ResponseFormat != "" {
+			op["x-omni-response"] = r.ResponseFormat
+		}
+		if len(r.Middleware) > 0 {
+			op["x-omni-middleware"] = r.Middleware
+		}
+		if r.Auth != "" && r.Auth != "none" {
+			op["security"] = []map[string][]string{{r.Auth: {}}}
+		} else {
+			op["security"] = []any{}
+		}
+		if r.Description != "" {
+			op["description"] = r.Description
+		}
+		if len(r.Tags) > 0 {
+			op["tags"] = r.Tags
+		} else {
+			op["tags"] = []string{r.Group}
+		}
+		if r.Deprecated {
+			op["deprecated"] = true
+		}
+		responses := op["responses"].(map[string]any)
+		if r.Auth != "" && r.Auth != "none" {
+			responses["401"] = genericErrorResponse("Authentication required", cfg)
+		}
+		grouped := map[int][]ErrorDefinition{}
+		for _, name := range r.Errors {
+			e := definitions[name]
+			grouped[e.Status] = append(grouped[e.Status], e)
+		}
+		if len(r.Errors) == 0 && documentRegistry != nil {
+			registry = documentRegistry
+			op["x-omni-error-catalog-scope"] = "app"
+			for key, definition := range documentRouteCatalog(spec, r).Definitions {
+				grouped[definition.Status] = append(grouped[definition.Status], ErrorDefinition{Name: key, Code: key, Status: definition.Status, Message: definition.Message, BusinessCode: definition.Code, Params: definition.Params})
+			}
+		}
+		if len(r.Errors) > 0 {
+			op["x-omni-errors"] = r.Errors
+		}
+		for status, errs := range grouped {
+			key := fmt.Sprint(status)
+			response, exists := responses[key].(map[string]any)
+			if !exists {
+				response = genericErrorResponse(http.StatusText(status), cfg)
+				responses[key] = response
+			}
+			content, ok := response["content"].(map[string]any)
+			if !ok {
+				content = map[string]any{}
+				response["content"] = content
+			}
+			media, hasJSON := content["application/json"].(map[string]any)
+			if !hasJSON {
+				media = map[string]any{}
+				content["application/json"] = media
+			}
+			errorMedia := genericErrorResponse("", cfg)["content"].(map[string]any)["application/json"].(map[string]any)
+			if exists && status < 400 && media["schema"] != nil {
+				media["schema"] = map[string]any{"anyOf": []any{media["schema"], errorMedia["schema"]}}
+			} else if media["schema"] == nil {
+				media["schema"] = errorMedia["schema"]
+			}
+			examples := map[string]any{}
+			codes := []any{}
+			seenCodes := map[string]bool{}
+			description := []string{}
+			if exists {
+				if text, ok := response["description"].(string); ok && text != "" {
+					description = append(description, text)
+				}
+			}
+			sort.Slice(errs, func(i, j int) bool { return errs[i].Name < errs[j].Name })
+			for _, e := range errs {
+				result := responseResult(e)
+				result.Message = registry.Example(e.Code).Message
+				value := policy.Value(result)
+				examples[e.Name] = map[string]any{"summary": result.Message, "value": value}
+				codeKey := fmt.Sprint(value[cfg.CodeField])
+				if !seenCodes[codeKey] {
+					codes = append(codes, value[cfg.CodeField])
+					seenCodes[codeKey] = true
+				}
+				description = append(description, e.Code+": "+e.Message)
+			}
+			media["examples"] = examples
+			if !exists && cfg.Body == nil && cfg.CodeField != "-" {
+				media["schema"].(map[string]any)["properties"].(map[string]any)[cfg.CodeField].(map[string]any)["enum"] = codes
+			}
+			response["description"] = strings.Join(description, "\n")
+		}
+	}
+}
+func responseResult(e ErrorDefinition) response.Result {
+	return response.Result{Status: e.Status, Code: e.Code, Message: e.Message, BusinessCode: e.BusinessCode, Failed: true, RequestID: "exampleRequest"}
+}
+func genericErrorResponse(description string, cfg response.Config) map[string]any {
+	if description == "" {
+		description = "Error"
+	}
+	schema, _ := openapi.EnvelopeWith(nil, cfg)
+	data, _ := json.Marshal(schema)
+	var value map[string]any
+	_ = json.Unmarshal(data, &value)
+	return map[string]any{"description": description, "content": map[string]any{"application/json": map[string]any{"schema": value}}}
+}

cmd/go-omni/apigen/declarations.go

@@ -0,0 +1,170 @@
+package apigen
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+)
+
+// ErrorDefinition declares a public, stable error. Generated constructors return
+// a fresh error each time so WithCause cannot mutate a shared singleton.
+type ErrorDefinition struct {
+	Name         string                `json:"name"`
+	BusinessCode any                   `json:"businessCode,omitempty"`
+	Params       []apierrors.Parameter `json:"params,omitempty"`
+	Catalog      string                `json:"catalog,omitempty"`
+	Status       int                   `json:"status"`
+	Code         string                `json:"code"`
+	Message      string                `json:"message"`
+	Position     string                `json:"-"`
+}
+type AuthDefinition struct {
+	Name, Type, In, KeyName, Middleware, Description, BearerFormat, Position string
+}
+
+func (p *parser) parseErrors() error {
+	p.next()
+	block := p.peek() == "("
+	if block {
+		p.next()
+		p.skip()
+	}
+	for {
+		pos := p.tokens[p.at].position
+		name, err := p.ident()
+		if err != nil {
+			return err
+		}
+		status, err := strconv.Atoi(p.next().text)
+		if err != nil {
+			return p.err("error HTTP status must be an integer")
+		}
+		code, err := p.quoted()
+		if err != nil {
+			return err
+		}
+		message, err := p.quoted()
+		if err != nil {
+			return err
+		}
+		p.spec.Errors = append(p.spec.Errors, ErrorDefinition{Name: name, Status: status, Code: code, Message: message, Position: pos})
+		if p.peek() != "\n" && p.peek() != ";" && !(block && p.peek() == ")") && p.peek() != "" {
+			return p.err("expected end of error declaration")
+		}
+		if !block {
+			return nil
+		}
+		p.skip()
+		if p.peek() == ")" {
+			p.next()
+			return nil
+		}
+	}
+}
+func (p *parser) parseAuth() error {
+	pos := p.next().position
+	name, err := p.ident()
+	if err != nil {
+		return err
+	}
+	p.skip()
+	props, err := p.metadata()
+	if err != nil {
+		return err
+	}
+	a := AuthDefinition{Name: name, Position: pos}
+	for key, value := range props {
+		switch key {
+		case "type":
+			a.Type = value
+		case "in":
+			a.In = value
+		case "name":
+			a.KeyName = value
+		case "middleware":
+			a.Middleware = value
+		case "description":
+			a.Description = value
+		case "bearerFormat":
+			a.BearerFormat = value
+		default:
+			return fmt.Errorf("%s: unsupported auth property %q", pos, key)
+		}
+	}
+	p.spec.Auth = append(p.spec.Auth, a)
+	return nil
+}
+func (p *parser) names() ([]string, error) {
+	var names []string
+	for {
+		name, err := p.ident()
+		if err != nil {
+			return nil, err
+		}
+		for _, prior := range names {
+			if prior == name {
+				return nil, p.err("duplicate name " + name)
+			}
+		}
+		names = append(names, name)
+		if p.peek() != "," {
+			return names, nil
+		}
+		p.next()
+	}
+}
+func commaList(value string) []string {
+	if value == "" {
+		return nil
+	}
+	result := strings.Split(value, ",")
+	for i := range result {
+		result[i] = strings.TrimSpace(result[i])
+	}
+	return result
+}
+func mergeNames(base, extra []string) []string {
+	result := append([]string(nil), base...)
+	for _, name := range extra {
+		found := false
+		for _, prior := range result {
+			found = found || prior == name
+		}
+		if !found {
+			result = append(result, name)
+		}
+	}
+	return result
+}
+func (p *parser) parseDoc(route *Route) error {
+	if p.peek() != "(" {
+		value, err := p.quoted()
+		route.Summary = value
+		return err
+	}
+	pos := p.tokens[p.at].position
+	props, err := p.metadata()
+	if err != nil {
+		return err
+	}
+	for key, value := range props {
+		switch key {
+		case "summary":
+			route.Summary = value
+		case "description":
+			route.Description = value
+		case "tags":
+			route.Tags = commaList(value)
+		case "deprecated":
+			if value != "true" && value != "false" {
+				return fmt.Errorf("%s: deprecated must be true or false", pos)
+			}
+			route.Deprecated = value == "true"
+		default:
+			return fmt.Errorf("%s: unsupported @doc property %q", pos, key)
+		}
+	}
+	return nil
+}

cmd/go-omni/apigen/documentRefs.go

@@ -0,0 +1,86 @@
+package apigen
+
+import "encoding/json"
+
+// compactDocument only replaces standard OpenAPI Reference Object positions.
+// Payloads (including examples containing a literal "$ref") are never walked.
+// Mixed HTTP 200 responses retain both success and error alternatives.
+func compactDocument(doc map[string]any) {
+	type slot struct {
+		parent map[string]any
+		key    string
+	}
+	components := doc["components"].(map[string]any)
+	var responses, schemas, examples []slot
+	for _, path := range doc["paths"].(map[string]any) {
+		for _, value := range path.(map[string]any) {
+			op, ok := value.(map[string]any)
+			if !ok {
+				continue
+			}
+			rs, _ := op["responses"].(map[string]any)
+			for status := range rs {
+				responses = append(responses, slot{rs, status})
+
+			}
+		}
+	}
+	factor := func(kind string, slots []slot) {
+		counts := map[string]int{}
+		for _, s := range slots {
+			raw, _ := json.Marshal(s.parent[s.key])
+			counts[string(raw)]++
+		}
+		shared, _ := components[kind].(map[string]any)
+		if shared == nil {
+			shared = map[string]any{}
+		}
+		for _, s := range slots {
+			raw, _ := json.Marshal(s.parent[s.key])
+			count := counts[string(raw)]
+			if count < 2 {
+				continue
+			}
+			name := "Omni_" + digest(raw)
+			ref := map[string]any{"$ref": "#/components/" + kind + "/" + name}
+			refJSON, _ := json.Marshal(ref)
+			// Keep small objects inline if components would increase size.
+			if (count-1)*len(raw) <= count*len(refJSON)+len(name)+4 {
+				continue
+			}
+			shared[name] = s.parent[s.key]
+			s.parent[s.key] = map[string]any{"$ref": "#/components/" + kind + "/" + name}
+		}
+		if len(shared) > 0 {
+			components[kind] = shared
+		}
+	}
+
+	// Share whole responses before counting inner objects. Otherwise a catalog
+	// copied across 100 routes can create hundreds of unnecessary components
+	// that only one shared response ultimately uses.
+	factor("responses", responses)
+	collectMedia := func(value any) {
+		resp := value.(map[string]any)
+		content, _ := resp["content"].(map[string]any)
+		for _, value := range content {
+			media := value.(map[string]any)
+			if media["schema"] != nil {
+				schemas = append(schemas, slot{media, "schema"})
+			}
+			es, _ := media["examples"].(map[string]any)
+			for name := range es {
+				examples = append(examples, slot{es, name})
+			}
+		}
+	}
+	for _, s := range responses {
+		collectMedia(s.parent[s.key])
+	}
+	sharedResponses, _ := components["responses"].(map[string]any)
+	for _, resp := range sharedResponses {
+		collectMedia(resp)
+	}
+	factor("examples", examples)
+	factor("schemas", schemas)
+}

cmd/go-omni/apigen/documentRefs_test.go

@@ -0,0 +1,107 @@
+package apigen
+
+import (
+	"encoding/json"
+	"fmt"
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"strings"
+	"testing"
+)
+
+func TestSharedErrorDocumentReferences(t *testing.T) {
+	source := `@app(defaultResponse: Common)
+response Common(codeType:int32;successCode:0;errorCode:9999;messageField:msg;dataMode:always)
+service demo {
+`
+	for i := 0; i < 16; i++ {
+		kind := "string"
+		if i%2 == 0 {
+			kind = "int64"
+		}
+		source += fmt.Sprintf("@handler list%d\nget /list%d returns ([]%s)\n", i, i, kind)
+	}
+	source += "}\n"
+	spec, err := parseText(t, source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	catalog := apierrors.Catalog{DefaultStatus: 400, Definitions: map[string]apierrors.Definition{}}
+	for i := 0; i < 80; i++ {
+		status := 400
+		if i%2 == 0 {
+			status = 200
+		}
+		catalog.Definitions[fmt.Sprintf("ERROR_%d", i)] = apierrors.Definition{Status: status, Code: 400000 + i, Message: strings.Repeat("说明", 40) + "{label}不能超过{max}个字符", Params: []apierrors.Parameter{{Name: "label", Type: "string", Example: "企业名称"}, {Name: "max", Type: "int", Example: 100}}}
+	}
+	spec.DocumentCatalog = &catalog
+	compiled, err := Compile(spec)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var raw map[string]any
+	if err = json.Unmarshal(compiled.Document, &raw); err != nil {
+		t.Fatal(err)
+	}
+	components := raw["components"].(map[string]any)
+	for _, kind := range []string{"responses", "examples"} {
+		if len(components[kind].(map[string]any)) == 0 {
+			t.Fatal("missing shared", kind)
+		}
+	}
+	expanded := document(t, compiled)
+	for i := 0; i < 16; i++ {
+		responses := operation(t, expanded, fmt.Sprintf("/list%d", i), "get")["responses"].(map[string]any)
+		for _, status := range []string{"200", "400"} {
+			media := responses[status].(map[string]any)["content"].(map[string]any)["application/json"].(map[string]any)
+			if len(media["examples"].(map[string]any)) != 40 {
+				t.Fatal("examples lost")
+			}
+			if status == "200" {
+				choices := media["schema"].(map[string]any)["anyOf"].([]any)
+				if len(choices) != 2 || choices[0].(map[string]any)["properties"].(map[string]any)["data"].(map[string]any)["type"] != "array" {
+					t.Fatal("200 success shape lost")
+				}
+			}
+			for _, example := range media["examples"].(map[string]any) {
+				value := example.(map[string]any)["value"].(map[string]any)
+				if _, ok := value["data"]; !ok || value["data"] != nil || !strings.Contains(value["msg"].(string), "企业名称不能超过100个字符") {
+					t.Fatal(value)
+				}
+			}
+		}
+	}
+	expandedBytes, _ := json.MarshalIndent(expanded, "", "  ")
+	if len(compiled.Document)*5 > len(expandedBytes) {
+		t.Fatalf("poor dedup: %d vs %d", len(compiled.Document), len(expandedBytes))
+	}
+	again, err := Compile(spec)
+	if err != nil || string(again.Document) != string(compiled.Document) {
+		t.Fatal("non-deterministic document", err)
+	}
+	before, _ := json.Marshal(raw)
+	compactDocument(raw)
+	data, _ := json.Marshal(raw)
+	if string(data) != string(before) {
+		t.Fatal("compaction not idempotent")
+	}
+}
+
+func TestSharedSchemasAndLiteralExampleReference(t *testing.T) {
+	doc := map[string]any{"components": map[string]any{}, "paths": map[string]any{}}
+	paths := doc["paths"].(map[string]any)
+	for _, name := range []string{"first", "second", "third"} {
+		schema := map[string]any{"type": "object", "description": strings.Repeat("schema description ", 40)}
+		example := map[string]any{"summary": strings.Repeat("example ", 50), "value": map[string]any{"$ref": "literal business field"}}
+		paths["/"+name] = map[string]any{"get": map[string]any{"responses": map[string]any{"200": map[string]any{"description": name, "content": map[string]any{"application/json": map[string]any{"schema": schema, "examples": map[string]any{"same": example}}}}}}}
+	}
+	compactDocument(doc)
+	components := doc["components"].(map[string]any)
+	if len(components["schemas"].(map[string]any)) != 1 {
+		t.Fatal("schema not shared")
+	}
+	for _, example := range components["examples"].(map[string]any) {
+		if example.(map[string]any)["value"].(map[string]any)["$ref"] != "literal business field" {
+			t.Fatal("payload reference interpreted")
+		}
+	}
+}

cmd/go-omni/apigen/documentation_test.go

@@ -0,0 +1,127 @@
+package apigen
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestFieldDocumentationAndFormat(t *testing.T) {
+	source := "// 项目说明\n  type Req{\n// 状态\n State int `json:\"state,options=0|1\" example:\"1\" enumDescriptions:\"[\\\"禁用\\\",\\\"启用\\\"]\"` // 状态值\n /* 第一行\n 第二行 */\nName string `json:\"name\" example:\"企业名称\"`\n}\nservice demo{\n @handler echo\npost /echo (Req) returns (Req)\n}\n"
+	formatted, err := Format([]byte(source))
+	if err != nil {
+		t.Fatal(err)
+	}
+	again, err := Format(formatted)
+	if err != nil || !bytes.Equal(formatted, again) {
+		t.Fatal("format is not idempotent", err, string(again))
+	}
+	if !bytes.Contains(formatted, []byte("    // 状态\n    State")) {
+		t.Fatal(string(formatted))
+	}
+	spec, err := parseText(t, string(formatted))
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, err := Compile(spec)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if spec.Types[0].Fields[0].Description != "状态\n状态值" || spec.Types[0].Fields[1].Description != "第一行\n第二行" {
+		t.Fatalf("%+v", spec.Types[0].Fields)
+	}
+	schema, err := c.Bindings["Req"].ResponseSchema()
+	if err != nil {
+		t.Fatal(err)
+	}
+	state := schema.Properties["state"]
+	if state.Description != "状态\n状态值" || len(state.EnumDescriptions) != 2 || state.Example != json.Number("1") {
+		t.Fatalf("%+v", state)
+	}
+	dir := t.TempDir()
+	entry := filepath.Join(dir, "demo.api")
+	writeFile(t, entry, source)
+	if _, err = FormatProject(entry, true); err == nil {
+		t.Fatal("check accepted drift")
+	}
+	if readFile(t, entry) != source {
+		t.Fatal("check wrote source")
+	}
+	if _, err = FormatProject(entry, false); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = FormatProject(entry, true); err != nil {
+		t.Fatal(err)
+	}
+	project := filepath.Join(t.TempDir(), "demo")
+	if _, err = Generate(Options{API: entry, Dir: project, Module: "example.com/docs", FrameworkDir: frameworkRoot(t)}); err != nil {
+		t.Fatal(err)
+	}
+	dto := readFile(t, filepath.Join(project, "internal/types/"+dtoFile("demo.api:1:1")))
+	if !strings.Contains(dto, "// 状态值") || !strings.Contains(dto, `description:"状态\n状态值"`) {
+		t.Fatal(dto)
+	}
+	// Invalid examples fail before project output is created.
+	bad := strings.Replace(source, "example:\"1\"", "example:\"9\"", 1)
+	writeFile(t, entry, bad)
+	if _, err = FormatProject(entry, false); err == nil {
+		t.Fatal("invalid enum example accepted")
+	}
+	if data, _ := os.ReadFile(entry); string(data) != bad {
+		t.Fatal("invalid source changed")
+	}
+}
+
+func TestFormatAlignsFieldsAndPreservesTokens(t *testing.T) {
+	source := []byte("type Req {\n Name string `json:\"name\"` // 名称\n  Sequence int64 `json:\"sequence\"` // 编号\n}\n")
+	out, err := Format(source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	again, err := Format(out)
+	if err != nil || !bytes.Equal(out, again) {
+		t.Fatal("alignment not idempotent", err)
+	}
+	lines := strings.Split(string(out), "\n")
+	if strings.Index(lines[1], "`") != strings.Index(lines[2], "`") || strings.Index(lines[1], "//") != strings.Index(lines[2], "//") {
+		t.Fatal("fields not aligned", string(out))
+	}
+	for _, literal := range []string{"`json:\"name\"`", "`json:\"sequence\"`", "// 名称", "// 编号"} {
+		if !bytes.Contains(out, []byte(literal)) {
+			t.Fatal("literal changed", literal)
+		}
+	}
+}
+
+func TestRequestPolicyCannotCreateGETBody(t *testing.T) {
+	for _, source := range []string{
+		"service demo { @handler get\n @request(body: required)\n get /x }",
+		"@app(request: {\"body\":\"optional\"})\n service demo { @handler get\n get /x }",
+	} {
+		spec, err := parseText(t, source)
+		if err == nil {
+			_, err = Compile(spec)
+		}
+		if err == nil {
+			t.Fatal("GET body policy accepted")
+		}
+	}
+}
+func TestFormatLiteralPreservation(t *testing.T) {
+	source := []byte("type Demo {\n Body string `json:\"body\"\ndescription:\"literal  space\"`\n}\n")
+	out, err := Format(source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Contains(out, []byte("`json:\"body\"\ndescription:\"literal  space\"`")) {
+		t.Fatal(string(out))
+	}
+	for _, src := range []string{"type X {", "}", "info (title:\"unterminated)"} {
+		if _, err := Format([]byte(src)); err == nil {
+			t.Fatal("invalid input accepted")
+		}
+	}
+}

cmd/go-omni/apigen/endpoints_test.go

@@ -0,0 +1,60 @@
+package apigen
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestConfigurableBuiltinRoutesConsumer(t *testing.T) {
+	dir := filepath.Join(t.TempDir(), "endpoints")
+	api := filepath.Join(t.TempDir(), "service.api")
+	writeFile(t, api, "service healthApi {\n @handler customReady\n get /health/ready\n @handler customDoc\n get /openapi.json\n}\n")
+	_, err := Generate(Options{Dir: dir, API: api, Module: "example.com/endpoints", FrameworkDir: frameworkRoot(t)})
+	if err != nil {
+		t.Fatal("built-in paths must be permitted in API contracts", err)
+	}
+	writeFile(t, filepath.Join(dir, "endpoints_test.go"), `package main
+import (
+ "context"
+ "io"
+ "net/http/httptest"
+ "testing"
+ "strings"
+ "example.com/endpoints/internal/config"
+ "example.com/endpoints/internal/svc"
+ "example.com/endpoints/internal/handler"
+ "git.yuntuo.hk/k2safe/go-omni/logx"
+)
+func TestProjectOwnsDisabledBuiltinPaths(t *testing.T){
+ cfg:=config.Default();cfg.Server.Log.Writer=io.Discard
+ logger,_:=logx.New(cfg.Server.Log);defer logger.Close()
+ deps,err:=svc.New(context.Background(),logger,cfg);if err!=nil{t.Fatal(err)};defer deps.Close()
+ if _,err=handler.NewApp(deps);err==nil || !strings.Contains(err.Error(),"overlaps business"){t.Fatal("expected preflight collision",err)}
+ deps.Config.Server.Endpoints.Readiness.Enabled=false
+ deps.Config.Server.Endpoints.OpenAPI.Enabled=false
+ app,err:=handler.NewApp(deps);if err!=nil{t.Fatal(err)};defer app.Close()
+ for _,path:=range []string{"/health/ready","/openapi.json"}{
+  out:=httptest.NewRecorder();app.ServeHTTP(out,httptest.NewRequest("GET",path,nil))
+  if out.Code!=501{t.Fatal("expected generated business Logic stub",path,out.Code,out.Body.String())}
+ }
+ deps.Config.Server.Endpoints.Readiness.Enabled=true
+ deps.Config.Server.Endpoints.Readiness.Path="/readyz"
+ deps.Config.Server.Endpoints.OpenAPI.Enabled=true
+ deps.Config.Server.Endpoints.OpenAPI.Path="/spec.json"
+ app2,err:=handler.NewApp(deps);if err!=nil{t.Fatal(err)};defer app2.Close()
+ for _,path:=range []string{"/readyz","/spec.json"}{out:=httptest.NewRecorder();app2.ServeHTTP(out,httptest.NewRequest("GET",path,nil));if out.Code!=200{t.Fatal(path,out.Code)}}
+}
+`)
+	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "go", "test", "-race", "-mod=mod", "-count=1", "./...")
+	cmd.Dir = dir
+	cmd.Env = append(os.Environ(), "GOWORK=off")
+	if output, err := cmd.CombinedOutput(); err != nil {
+		t.Fatal(err, string(output))
+	}
+}

cmd/go-omni/apigen/errorCatalog.go

@@ -0,0 +1,119 @@
+package apigen
+
+import (
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strconv"
+
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"git.yuntuo.hk/k2safe/go-omni/response"
+)
+
+// A named catalog groups project definitions under one default HTTP status.
+// Each JSON object key supplies the generated Go function's name, while key is
+// the independent logical identifier and code is the public string/integer.
+func (p *parser) parseErrorCatalog() error {
+	pos := p.next().position
+	name, err := p.ident()
+	if err != nil {
+		return err
+	}
+	if !exportedName.MatchString(name) {
+		return p.err("errorCatalog requires an UpperCamelCase name")
+	}
+	for _, prior := range p.spec.ErrorCatalogs {
+		if prior == name {
+			return p.err("duplicate errorCatalog " + name)
+		}
+	}
+	p.spec.ErrorCatalogs = append(p.spec.ErrorCatalogs, name)
+	p.skip()
+	props, err := p.metadata()
+	if err != nil {
+		return err
+	}
+	defaultStatus := 400
+	if value, ok := props["defaultStatus"]; ok {
+		defaultStatus, err = strconv.Atoi(value)
+		if err != nil {
+			return p.err("defaultStatus must be an integer")
+		}
+	}
+	if !apierrors.ValidErrorStatus(defaultStatus) {
+		return p.err("invalid errorCatalog defaultStatus")
+	}
+	for key := range props {
+		if key != "defaultStatus" && key != "errors" {
+			return p.err("unsupported errorCatalog property " + key)
+		}
+	}
+	type entry struct {
+		Key     string                `json:"key"`
+		Code    any                   `json:"code"`
+		Message string                `json:"message"`
+		Status  int                   `json:"status"`
+		Params  []apierrors.Parameter `json:"params"`
+	}
+	var entries map[string]entry
+	if err := apierrors.DecodeCatalogJSON([]byte(props["errors"]), &entries); err != nil {
+		return fmt.Errorf("%s: catalog %s: %w", pos, name, err)
+	}
+	if len(entries) == 0 {
+		return p.err("errorCatalog requires errors")
+	}
+	names := make([]string, 0, len(entries))
+	for key := range entries {
+		names = append(names, key)
+	}
+	sort.Strings(names)
+	for _, fn := range names {
+		e := entries[fn]
+		if e.Code == nil {
+			return p.err("errorCatalog error requires code")
+		}
+		if e.Status == 0 {
+			e.Status = defaultStatus
+		}
+		p.spec.Errors = append(p.spec.Errors, ErrorDefinition{Name: fn, Status: e.Status, Code: e.Key, Message: e.Message, BusinessCode: e.Code, Params: e.Params, Catalog: name, Position: pos})
+	}
+	return nil
+}
+
+func errorCatalog(spec *Spec, names []string) apierrors.Catalog {
+	c := apierrors.Catalog{Definitions: map[string]apierrors.Definition{}}
+	selected := map[string]bool{}
+	for _, n := range names {
+		selected[n] = true
+	}
+	for _, e := range spec.Errors {
+		if names != nil && !selected[e.Name] {
+			continue
+		}
+		c.Definitions[e.Code] = apierrors.Definition{Status: e.Status, Code: e.BusinessCode, Message: e.Message, Params: e.Params}
+	}
+	return c
+}
+
+// Validate the exact catalog/template pair used by each route. Different routes
+// can use different code types without forcing a global response representation.
+func validateErrorPolicies(spec *Spec) error {
+	for _, r := range spec.Routes {
+		f, err := response.New(responseConfig(spec, r))
+		if err != nil {
+			return err
+		}
+		if _, err = response.WithErrors(errorCatalog(spec, append([]string{}, r.Errors...)), f); err != nil {
+			return fmt.Errorf("%s: %w", r.Position, err)
+		}
+	}
+	return nil
+}
+
+func errorCatalogJSON(spec *Spec, names []string) string {
+	data, err := json.Marshal(errorCatalog(spec, names))
+	if err != nil {
+		panic(err)
+	}
+	return string(data)
+}

cmd/go-omni/apigen/errorCatalog_test.go

@@ -0,0 +1,222 @@
+package apigen
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestErrorCatalogDocumentAndValidation(t *testing.T) {
+	path := filepath.Join(frameworkRoot(t), "examples/contracts/errors.api")
+	source := readFile(t, path)
+	spec, err := Parse(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	compiled, err := Compile(spec)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{"/token", "/raw"} {
+		method := "post"
+		if path == "/raw" {
+			method = "get"
+		}
+		op := operation(t, document(t, compiled), path, method)
+		response := op["responses"].(map[string]any)["200"].(map[string]any)
+		media := response["content"].(map[string]any)["application/json"].(map[string]any)
+		alternatives := media["schema"].(map[string]any)["anyOf"].([]any)
+		if len(alternatives) != 2 {
+			t.Fatal("lost success or failure shape")
+		}
+		if path == "/raw" {
+			if alternatives[0].(map[string]any)["properties"].(map[string]any)["token"] == nil {
+				t.Fatal("raw success wrapped")
+			}
+		}
+		examples := media["examples"].(map[string]any)
+		if len(examples) != 2 {
+			t.Fatal(examples)
+		}
+		for _, name := range []string{"UsernameInvalid", "PasswordInvalid"} {
+			value := examples[name].(map[string]any)["value"].(map[string]any)
+			if value["ok"] != false || value["code"] != float64(400002) || value["msg"] == nil {
+				t.Fatal(value)
+			}
+		}
+	}
+	for _, change := range [][2]string{
+		{`defaultStatus: 200`, `defaultStatus: 204`},
+		{`"status": 403`, `"status": 304`},
+		{`"PASSWORD_INVALID"`, `"USERNAME_INVALID"`},
+		{`"code": 400002`, `"code": 2147483648`},
+		{`"code": 400002`, `"code": "400002"`},
+		{`"code": 400002`, `"code": 1.5`},
+		{`"code": 400002`, `"code": null`},
+		{`"code": 400002`, `"code": 400002, "code": 400003`},
+		{`"message": "用户名格式不正确"`, `"message": "用户名格式不正确", "typo": true`},
+		{`@handler token`, `@errors Unknown\n    @handler token`},
+		{`successCode: 0`, `successCode: 0\n    codes: {"USERNAME_INVALID": 999}`},
+	} {
+		text := strings.Replace(source, change[0], strings.ReplaceAll(change[1], `\n`, "\n"), 1)
+		s, err := parseText(t, text)
+		if err == nil {
+			_, err = Compile(s)
+		}
+		if err == nil {
+			t.Errorf("accepted %s", change[1])
+		}
+	}
+	// The legacy declaration is also allowed to carry a HTTP 200 failure.
+	old := strings.Replace(declaredAPI, "EmailTaken 409", "EmailTaken 200", 1)
+	s, err := parseText(t, old)
+	if err == nil {
+		_, err = Compile(s)
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestErrorCatalogConsumer(t *testing.T) {
+	testCatalogConsumer(t, "errors.api", "errorCatalog")
+}
+
+func testCatalogConsumer(t *testing.T, apiFile, fixtureName string, extraFiles ...map[string]string) {
+	t.Helper()
+	if os.Getenv("GO_OMNI_SCAFFOLD_INTEGRATION") == "" {
+		t.Skip("consumer integration")
+	}
+	root := frameworkRoot(t)
+	dir := filepath.Join(t.TempDir(), "consumer")
+	opts := Options{API: filepath.Join(root, "examples/contracts", apiFile), Dir: dir, Module: "example.com/errorCatalog", FrameworkDir: root}
+	cli := os.Getenv("GO_OMNI_RELEASE_CLI")
+	generate := func(check bool) {
+		t.Helper()
+		if cli == "" {
+			o := opts
+			o.Check = check
+			if _, err := Generate(o); err != nil {
+				t.Fatal(err)
+			}
+			return
+		}
+		args := []string{"api", "generate", "--api", opts.API, "--dir", dir, "--module", opts.Module}
+		if check {
+			args = append(args, "--check")
+		}
+		cmd := exec.Command(cli, args...)
+		cmd.Dir = filepath.Dir(dir)
+		if output, err := cmd.CombinedOutput(); err != nil {
+			t.Fatalf("release generate %v\n%s", err, output)
+		}
+	}
+	generate(false)
+
+	files := map[string]string{"consumer_test.go": "consumer_test.go"}
+	for _, extra := range extraFiles {
+		for target, source := range extra {
+			files[target] = source
+		}
+	}
+	before := map[string]string{}
+	for target, source := range files {
+		fixture := readFile(t, filepath.Join("testdata", fixtureName, source))
+		writeFile(t, filepath.Join(dir, target), fixture)
+		before[target] = fixture
+	}
+	generate(false)
+	generate(true)
+	for target, fixture := range before {
+		if readFile(t, filepath.Join(dir, target)) != fixture {
+			t.Fatalf("regeneration overwrote %s", target)
+		}
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "go", "test", "-race", "-mod=mod", "-count=1", "./...")
+	cmd.Dir = dir
+	cmd.Env = append(os.Environ(), "GOWORK=off")
+	if output, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("consumer %v\n%s", err, output)
+	}
+	if cli != "" {
+		cmd = exec.CommandContext(ctx, "go", "list", "-m", "-json", frameworkModule)
+		cmd.Dir = dir
+		cmd.Env = append(os.Environ(), "GOWORK=off")
+		output, err := cmd.CombinedOutput()
+		if err != nil {
+			t.Fatal(err, string(output))
+		}
+		var module struct {
+			Version, Sum string
+			Replace      any
+		}
+		if err = json.Unmarshal(output, &module); err != nil {
+			t.Fatal(err)
+		}
+		if module.Version != os.Getenv("GO_OMNI_RELEASE_VERSION") || module.Replace != nil || module.Sum == "" {
+			t.Fatal("not a fixed remote consumer")
+		}
+		t.Logf("remote framework %s checksum %s; no local replace", module.Version, module.Sum)
+	}
+}
+
+func TestErrorCatalogImportsAndRouteScopes(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "common.api"), `errorCatalog Numeric (
+ defaultStatus: 200
+ errors: {"NumberInvalid":{"key":"number.invalid","code":12,"message":"number"}}
+)
+errorCatalog Text (
+ defaultStatus: 409
+ errors: {"TextInvalid":{"key":"textInvalid","code":"000012","message":"text"}}
+)
+response NumericResponse (
+ codeType: int32
+ successCode: 0
+ errorCode: 9999
+)
+`)
+	writeFile(t, filepath.Join(dir, "service.api"), `import "common.api"
+@server (
+ response: NumericResponse
+ errors: NumberInvalid
+)
+service scopes-api {
+ @handler numeric
+ get /number
+}
+@server (
+ errors: TextInvalid
+)
+service scopes-api {
+ @handler text
+ get /text
+}
+`)
+	s, err := Parse(filepath.Join(dir, "service.api"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	compiled, err := Compile(s)
+	if err != nil {
+		t.Fatal(err)
+	}
+	doc := document(t, compiled)
+	for _, tc := range []struct {
+		path, status, name string
+		code               any
+	}{{"/number", "200", "NumberInvalid", float64(12)}, {"/text", "409", "TextInvalid", "000012"}} {
+		response := operation(t, doc, tc.path, "get")["responses"].(map[string]any)[tc.status].(map[string]any)
+		value := response["content"].(map[string]any)["application/json"].(map[string]any)["examples"].(map[string]any)[tc.name].(map[string]any)["value"].(map[string]any)
+		if value["code"] != tc.code {
+			t.Fatal(value)
+		}
+	}
+}

cmd/go-omni/apigen/errorInheritance_test.go

@@ -0,0 +1,12 @@
+package apigen
+
+import "testing"
+
+func TestErrorInheritanceConsumer(t *testing.T) {
+	testCatalogConsumer(t, "errorInheritance.api", "errorInheritance", map[string]string{
+		"internal/logic/account/plain.go":           "service.go",
+		"internal/logic/account/raw.go":             "emptyService.go",
+		"internal/logic/account/cleared.go":         "emptyService.go",
+		"internal/handler/account/boundedManual.go": "bounded.go",
+	})
+}

cmd/go-omni/apigen/errorParams_test.go

@@ -0,0 +1,86 @@
+package apigen
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestErrorParamsConsumer(t *testing.T) { testCatalogConsumer(t, "errorParams.api", "errorParams") }
+
+func TestErrorParamsDocumentAndValidation(t *testing.T) {
+	path := filepath.Join(frameworkRoot(t), "examples/contracts/errorParams.api")
+	source := readFile(t, path)
+	spec, err := Parse(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	compiled, err := Compile(spec)
+	if err != nil {
+		t.Fatal(err)
+	}
+	doc := document(t, compiled)
+	definitions := doc["x-omni-errors"].([]any)
+	found := false
+	for _, value := range definitions {
+		e := value.(map[string]any)
+		if e["name"] == "TextTooLong" {
+			found = true
+			params := e["params"].([]any)
+			if len(params) != 2 || params[0].(map[string]any)["name"] != "label" || params[1].(map[string]any)["type"] != "int" || e["message"] != "{label}不能超过{max}个字符" {
+				t.Fatal(e)
+			}
+		}
+	}
+	if !found {
+		t.Fatal("missing template definition")
+	}
+	for _, path := range []string{"/token", "/raw"} {
+		method := "post"
+		if path == "/raw" {
+			method = "get"
+		}
+		response := operation(t, doc, path, method)["responses"].(map[string]any)["200"].(map[string]any)
+		media := response["content"].(map[string]any)["application/json"].(map[string]any)
+		value := media["examples"].(map[string]any)["TextTooLong"].(map[string]any)["value"].(map[string]any)
+		if value["msg"] != "企业名称不能超过100个字符" || value["code"] != float64(400002) {
+			t.Fatal(value)
+		}
+		if _, ok := value["data"]; !ok {
+			t.Fatal("data null omitted", value)
+		}
+		if len(media["schema"].(map[string]any)["anyOf"].([]any)) != 2 {
+			t.Fatal("success schema lost")
+		}
+	}
+	for _, change := range [][2]string{
+		{`"{label}不能超过{max}个字符"`, `"{label}不能超过{missing}个字符"`},
+		{`"type": "int"`, `"type": "unknown"`},
+		{`"example": 100`, `"example": "100"`},
+		{`"name": "max"`, `"name": "label"`},
+		{`"name": "max"`, `"name": "type"`},
+		{`successCode: 0`, `successCode: 0\n    messages: {"TEXT_TOO_LONG":"{label}不能超过{max}个字符"}`},
+	} {
+		changed := strings.Replace(source, change[0], strings.ReplaceAll(change[1], `\n`, "\n"), 1)
+		s, err := parseText(t, changed)
+		if err == nil {
+			_, err = Compile(s)
+		}
+		if err == nil {
+			t.Fatal("accepted", change)
+		}
+	}
+	// Removing examples still produces a concrete, deterministic example.
+	noExamples := strings.ReplaceAll(strings.ReplaceAll(source, `, "example": "企业名称"`, ""), `, "example": 100`, "")
+	s, err := parseText(t, noExamples)
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, err := Compile(s)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(c.Document), "label不能超过1个字符") {
+		t.Fatal("missing generated example")
+	}
+}

cmd/go-omni/apigen/format.go

@@ -0,0 +1,207 @@
+package apigen
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+	"text/scanner"
+	"unicode/utf8"
+)
+
+// Format normalizes indentation and blank lines without rewriting tokens,
+// comments, quoted metadata, struct tags or multiline literal contents.
+func Format(source []byte) ([]byte, error) {
+	if len(source) > 1<<20 {
+		return nil, errors.New("api: source size limit exceeded")
+	}
+	var scan scanner.Scanner
+	scan.Init(bytes.NewReader(source))
+	scan.Mode = scanner.ScanIdents | scanner.ScanInts | scanner.ScanStrings | scanner.ScanRawStrings | scanner.ScanComments
+	var scanErr error
+	scan.Error = func(s *scanner.Scanner, msg string) {
+		if scanErr == nil {
+			scanErr = fmt.Errorf("%s: %s", s.Position, msg)
+		}
+	}
+	depths := map[int]int{}
+	protected := map[int]bool{}
+	depth := 0
+	for k := scan.Scan(); k != scanner.EOF; k = scan.Scan() {
+		line := scan.Position.Line
+		value := scan.TokenText()
+		if k == '}' || k == ')' {
+			depth--
+			if depth < 0 {
+				return nil, errors.New("api: unmatched closing delimiter")
+			}
+		}
+		if _, ok := depths[line]; !ok {
+			depths[line] = depth
+		}
+		// Preserve interior lines exactly, including the closing line of a literal.
+		count := strings.Count(value, "\n")
+		for n := 1; n <= count; n++ {
+			protected[line+n] = true
+		}
+		if k == '{' || k == '(' {
+			depth++
+		}
+	}
+	if scanErr != nil {
+		return nil, scanErr
+	}
+	if depth != 0 {
+		return nil, errors.New("api: unclosed delimiter")
+	}
+	lines := strings.Split(string(source), "\n")
+	out := make([]string, 0, len(lines))
+	outProtected := map[int]bool{}
+	blank := true
+	lastDepth := 0
+	for i, line := range lines {
+		if protected[i+1] {
+			out = append(out, line)
+			outProtected[len(out)] = true
+			blank = false
+			continue
+		}
+		trimmed := strings.TrimSpace(line)
+		if trimmed == "" {
+			if !blank {
+				out = append(out, "")
+				blank = true
+			}
+			continue
+		}
+		d, ok := depths[i+1]
+		if ok {
+			lastDepth = d
+		}
+		out = append(out, strings.Repeat("    ", lastDepth)+trimmed)
+		blank = false
+	}
+	for len(out) > 0 && out[len(out)-1] == "" {
+		out = out[:len(out)-1]
+	}
+	alignFieldLines(out, outProtected)
+	return []byte(strings.Join(out, "\n") + "\n"), nil
+}
+
+// Only complete, single-line fields are aligned. Literal bytes and multiline
+// comment contents are never candidates, even when they resemble a field.
+var singleLineField = regexp.MustCompile("^([ \\t]*)([A-Z][A-Za-z0-9_]*)[ \\t]+([^ \\t`]+)[ \\t]+(`[^`]*`)[ \\t]*(//.*)?$")
+
+func alignFieldLines(lines []string, protected map[int]bool) {
+	for start := 0; start < len(lines); {
+		var fields [][]string
+		widths := [3]int{}
+		end := start
+		for end < len(lines) && !protected[end+1] {
+			parts := singleLineField.FindStringSubmatch(lines[end])
+			if parts == nil || (len(fields) > 0 && parts[1] != fields[0][1]) {
+				break
+			}
+			for col := range widths {
+				if n := utf8.RuneCountInString(parts[col+2]); n > widths[col] {
+					widths[col] = n
+				}
+			}
+			fields = append(fields, parts)
+			end++
+		}
+		for i, parts := range fields {
+			line := parts[1]
+			for col := range widths {
+				line += parts[col+2]
+				if col < 2 || parts[5] != "" {
+					line += strings.Repeat(" ", widths[col]-utf8.RuneCountInString(parts[col+2])+1)
+				}
+			}
+			lines[start+i] = line + parts[5]
+		}
+		if end == start {
+			end++
+		}
+		start = end
+	}
+}
+
+// FormatProject validates the full contract before writing any local source.
+// Check mode is read-only and reports every file needing formatting.
+func FormatProject(entry string, check bool) ([]string, error) {
+	spec, err := Parse(entry)
+	if err != nil {
+		return nil, err
+	}
+	if _, err = Compile(spec); err != nil {
+		return nil, err
+	}
+	real, err := filepath.EvalSymlinks(entry)
+	if err != nil {
+		return nil, err
+	}
+	root := filepath.Dir(real)
+	names := make([]string, 0, len(spec.Sources))
+	for name := range spec.Sources {
+		if strings.HasPrefix(name, "@") || filepath.Ext(name) != ".api" {
+			continue
+		}
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	next := map[string][]byte{}
+	var changed []string
+	for _, name := range names {
+		data, err := Format(spec.Sources[name])
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", name, err)
+		}
+		if !bytes.Equal(data, spec.Sources[name]) {
+			next[name] = data
+			changed = append(changed, name)
+		}
+	}
+	if check {
+		if len(changed) > 0 {
+			return changed, fmt.Errorf("API format drift: %s", strings.Join(changed, ", "))
+		}
+		return changed, nil
+	}
+	for _, name := range changed {
+		path := filepath.Join(root, filepath.FromSlash(name))
+		old, err := os.ReadFile(path)
+		if err != nil {
+			return changed, err
+		}
+		if !bytes.Equal(old, spec.Sources[name]) {
+			return changed, fmt.Errorf("API source changed during formatting: %s", name)
+		}
+		stat, err := os.Stat(path)
+		if err != nil {
+			return changed, err
+		}
+		f, err := os.CreateTemp(filepath.Dir(path), ".omni-format-*")
+		if err != nil {
+			return changed, err
+		}
+		tmp := f.Name()
+		err = f.Chmod(stat.Mode().Perm())
+		if err == nil {
+			_, err = f.Write(next[name])
+		}
+		err = errors.Join(err, f.Close())
+		if err == nil {
+			err = os.Rename(tmp, path)
+		}
+		_ = os.Remove(tmp)
+		if err != nil {
+			return changed, err
+		}
+	}
+	return changed, nil
+}

cmd/go-omni/apigen/generate.go

@@ -1,6 +1,7 @@
 package apigen
 
 import (
+	"encoding/json"
 	"errors"
 	"fmt"
 	"go/format"
@@ -18,23 +19,37 @@ import (
 )
 
 const frameworkModule = "git.yuntuo.hk/k2safe/go-omni"
-const minimumVersion = "v0.7.0-preview"
+const minimumVersion = "v0.16.0-preview"
 const generatedHeader = "// Code generated by go-omni api. DO NOT EDIT.\n"
 
 type Options struct {
+	lockHeld                                                               bool
+	documentCatalogs                                                       map[string][]byte
 	Database, Storage                                                      string
 	API, Dir, Module, FrameworkDir, FrameworkVersion, LogOutput, LogFormat string
 	Check                                                                  bool
+	DryRun                                                                 bool
+}
+type FileChange struct {
+	Path   string
+	Action string
+}
+type Output struct {
+	Generated, Created, Preserved, Removed []string
+	Changes                                []FileChange
+	Diagnostics                            []Diagnostic
 }
-type Output struct{ Generated, Created, Preserved, Removed []string }
 
 // Generate creates or safely updates one contract-driven project. It renders
 // and validates every output before applying an ownership-checked transaction.
 func Generate(o Options) (Output, error) {
+	if o.Check && o.DryRun {
+		return Output{}, errors.New("--check and --dry-run cannot be combined")
+	}
 	if o.API == "" || o.Dir == "" {
 		return Output{}, errors.New("--api and --dir are required")
 	}
-	spec, err := Parse(o.API)
+	spec, err := parseWithCatalogs(o.API, o.documentCatalogs)
 	if err != nil {
 		return Output{}, err
 	}
@@ -49,8 +64,8 @@ const starterAPI = "syntax = \"v1\"\n\ninfo (\n title: \"Greeting API\"\n versio
 
 // New creates a runnable greeting project, including its editable API file.
 func New(o Options) (Output, error) {
-	if o.API != "" || o.Check {
-		return Output{}, errors.New("api new does not accept --api or --check")
+	if o.API != "" || o.Check || o.DryRun {
+		return Output{}, errors.New("api new does not accept --api, --check or --dry-run")
 	}
 	if o.Dir == "" {
 		return Output{}, errors.New("project directory required")
@@ -82,10 +97,24 @@ func generate(o Options, c *Compiled, starter bool) (Output, error) {
 		return Output{}, err
 	}
 	o.Dir = directory
+	if err = checkRuntimeExtension(directory); err != nil {
+		return Output{}, err
+	}
+	for _, r := range c.Spec.Routes {
+		if !r.Manual {
+			path := filepath.Join(directory, "internal/handler", r.Group, lower(r.Handler)+"Manual.go")
+			if _, err := os.Lstat(path); err == nil {
+				return Output{}, fmt.Errorf("manual handler %s exists; migrate and remove it explicitly before switching to automatic generation", path)
+			} else if !errors.Is(err, os.ErrNotExist) {
+				return Output{}, err
+			}
+		}
+	}
 	if err := resolveProfile(&o); err != nil {
 		return Output{}, err
 	}
 	seeds := map[string][]byte{}
+	requiredVersion := ""
 	moduleData, readErr := os.ReadFile(filepath.Join(directory, "go.mod"))
 	if readErr == nil {
 		mf, err := modfile.Parse("go.mod", moduleData, nil)
@@ -97,7 +126,6 @@ func generate(o Options, c *Compiled, starter bool) (Output, error) {
 		}
 		o.Module = mf.Module.Mod.Path
 		found := false
-		requiredVersion := ""
 		for _, r := range mf.Require {
 			if r.Mod.Path == frameworkModule {
 				found = true
@@ -118,13 +146,13 @@ func generate(o Options, c *Compiled, starter bool) (Output, error) {
 					if !filepath.IsAbs(path) {
 						path = filepath.Join(directory, path)
 					}
-					if _, err := os.Stat(filepath.Join(path, "contract", "contract.go")); err == nil {
+					if source, err := os.ReadFile(filepath.Join(path, "config", "env.go")); err == nil && strings.Contains(string(source), "func ServerEnvAliases(") {
 						localCurrent = true
 					}
 				}
 			}
 			if !localCurrent {
-				return Output{}, fmt.Errorf("existing framework dependency predates API support; use %s or a current local replacement", minimumVersion)
+				return Output{}, fmt.Errorf("existing framework dependency predates the generated configuration helpers; use %s or a current local replacement", minimumVersion)
 			}
 		}
 		if o.FrameworkDir != "" {
@@ -168,7 +196,16 @@ func generate(o Options, c *Compiled, starter bool) (Output, error) {
 	// from its own api/ tree, including all imports.
 	entry := "api/" + c.Spec.Entry
 	for name, data := range c.Spec.Sources {
-		seeds["api/"+name] = data
+		if !strings.HasPrefix(name, "@") {
+			seeds["api/"+name] = data
+		}
+	}
+	if len(c.Spec.SharedRoots) > 0 {
+		raw, e := sharedSeeds(c.Spec, directory)
+		if e != nil {
+			return Output{}, e
+		}
+		seeds["api/"+importsFile] = raw
 	}
 	if o.API != "" {
 		source, _ := filepath.Abs(o.API)
@@ -177,6 +214,7 @@ func generate(o Options, c *Compiled, starter bool) (Output, error) {
 		rel, e := filepath.Rel(targetReal, sourceReal)
 		if e == nil && rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
 			entry = filepath.ToSlash(rel)
+			delete(seeds, "api/"+importsFile)
 			for name := range c.Spec.Sources {
 				delete(seeds, "api/"+name)
 			}
@@ -185,7 +223,7 @@ func generate(o Options, c *Compiled, starter bool) (Output, error) {
 	// Source collisions must never leave a copied contract different from the
 	// generated code. On updates, use the developer-owned API in the project.
 	for name, data := range seeds {
-		if strings.HasSuffix(name, ".api") {
+		if strings.HasSuffix(name, ".api") || filepath.Base(name) == catalogDocumentFile || filepath.Base(name) == importsFile {
 			current, e := os.ReadFile(filepath.Join(directory, filepath.FromSlash(name)))
 			if e == nil && string(current) != string(data) {
 				return Output{}, fmt.Errorf("%s already differs; regenerate from that project API instead", name)
@@ -204,7 +242,16 @@ func generate(o Options, c *Compiled, starter bool) (Output, error) {
 			}
 		}
 	}
-	return apply(directory, o.Module, entry, generated, seeds, o.Check, o.profile())
+	out, err := apply(directory, o.Module, entry, generated, seeds, o.Check, o.DryRun, o.profile(), snapshotContract(c.Spec), o.lockHeld)
+	expectedVersion := minimumVersion
+	if info, ok := debug.ReadBuildInfo(); ok && info.Main.Path == frameworkModule && info.Main.Sum != "" && semver.IsValid(info.Main.Version) {
+		expectedVersion = info.Main.Version
+	}
+	if requiredVersion != "" && requiredVersion != expectedVersion {
+		out.Diagnostics = append(out.Diagnostics, Diagnostic{Severity: "review", Code: "frameworkVersion", Path: "go.mod", Before: requiredVersion, After: expectedVersion, Message: "project dependency differs from this CLI version; use matching CLI/framework versions, or verify the explicit local replacement"})
+		sortDiagnostics(out.Diagnostics)
+	}
+	return out, err
 }
 
 func moduleFile(o Options) ([]byte, error) {
@@ -289,19 +336,94 @@ func canonical(path string) string {
 func renderProject(o Options, c *Compiled, starter bool) (map[string][]byte, map[string][]byte, error) {
 	generated, seeds := map[string][]byte{}, map[string][]byte{}
 	put := func(files map[string][]byte, name, content string) { files[name] = []byte(content) }
-	types := "package types\n\n"
-	for _, t := range c.Spec.Types {
-		types += "type " + t.Name + " struct {\n"
-		for _, f := range t.Fields {
-			types += fmt.Sprintf("%s %s `%s`\n", f.Name, f.Type, f.Tag)
+	if len(c.Spec.Errors) > 0 {
+		content := "package apierrors\nimport(\"encoding/json\"; omnierrors " + strconv.Quote(frameworkModule+"/errors") + ")\n"
+		content += fmt.Sprintf("func Catalog()omnierrors.Catalog{var c omnierrors.Catalog;if err:=json.Unmarshal([]byte(%q),&c);err!=nil{panic(err)};return c}\nvar errorRegistry=omnierrors.MustRegistry(Catalog())\n", errorCatalogJSON(c.Spec, nil))
+		for _, e := range c.Spec.Errors {
+			var args, values []string
+			for _, p := range e.Params {
+				name := p.Name
+				switch name {
+				case "string", "any", "omnierrors", "errorRegistry", "int", "int32", "int64", "float64", "bool":
+					name = "_" + name
+				}
+				args = append(args, name+" "+p.Type)
+				values = append(values, strconv.Quote(p.Name)+":"+name)
+			}
+			ref := fmt.Sprintf("omnierrors.ByCode(Code%s)", e.Name)
+			if len(args) > 0 {
+				ref += ".WithParams(map[string]any{" + strings.Join(values, ",") + "})"
+			}
+			content += fmt.Sprintf("const Code%s=%q\n// %s returns a fresh, resolved error declared in the API contract.\nfunc %s(%s)*omnierrors.APIError{return errorRegistry.Resolve(%s)}\n", e.Name, e.Code, e.Name, e.Name, strings.Join(args, ","), ref)
 		}
-		types += "}\n"
+		put(generated, "internal/apierrors/errorsGen.go", generatedHeader+content)
+	}
+
+	types := "package types\n\n"
+	needsUpload := false
+	for _, b := range c.Bindings {
+		needsUpload = needsUpload || b.HasMultipart()
+	}
+	if needsUpload {
+		types += fmt.Sprintf("import %q\n", frameworkModule+"/contract")
+	}
+	if len(c.Spec.Scalars) > 0 {
+		types += "import("
+		for i, d := range c.Spec.Scalars {
+			types += fmt.Sprintf("scalar%d %q;", i, d.GoImport)
+		}
+		types += ")\n"
+		registry := fmt.Sprintf("package types\nimport %q\nfunc ContractScalars()[]contract.Scalar{return []contract.Scalar{", frameworkModule+"/contract")
+		for i, d := range c.Spec.Scalars {
+			types += fmt.Sprintf("type %s = scalar%d.%s\n", d.Name, i, d.GoType)
+			registry += fmt.Sprintf("contract.ScalarOf[%s](%q,%q,%t),", d.Name, d.JSONInput, d.JSONOutput, d.Text)
+		}
+		registry += "}}\n"
+		put(generated, "internal/types/scalarsGen.go", generatedHeader+registry)
+	}
+	if needsUpload {
+		types += "type File = contract.File\n"
+	}
+	bySource := map[string]string{}
+	for _, t := range c.Spec.Types {
+		name := dtoFile(t.Position)
+		if bySource[name] == "" {
+			bySource[name] = "package types\n\n"
+		}
+		text := "type " + t.Name + " struct {\n"
+		for _, f := range t.Fields {
+			if f.Description != "" {
+				for _, line := range strings.Split(f.Description, "\n") {
+					text += "// " + line + "\n"
+				}
+			}
+			text += fmt.Sprintf("%s %s `%s`\n", f.Name, f.Type, fieldTag(f))
+		}
+		bySource[name] += text + "}\n"
+	}
+	for name, text := range bySource {
+		put(generated, "internal/types/"+name, generatedHeader+text)
 	}
 	put(generated, "internal/types/typesGen.go", generatedHeader+types)
 	put(generated, "docs/openapi.json", string(c.Document)+"\n")
 	put(generated, "internal/handler/openapiGen.go", generatedHeader+fmt.Sprintf("package handler\nimport (\"net/http\"; %q)\nconst OpenAPIDocument = %q\nfunc OpenAPI(c *httpx.Context) error { return c.WriteResponse(200,http.Header{\"Content-Type\": {\"application/json; charset=utf-8\"}},[]byte(OpenAPIDocument)) }\n", frameworkModule+"/httpx", string(c.Document)+"\n"))
-	imports := fmt.Sprintf("import (\"fmt\"; %q; %q; %q;", frameworkModule+"/httpx", frameworkModule+"/openapi", o.Module+"/internal/servicecontext")
-	routes := "func RegisterRoutes(router openapi.Registrar, deps *servicecontext.Context) error {\n if router==nil || deps==nil {return fmt.Errorf(\"router and dependencies required\")}\n"
+	policySource := fmt.Sprintf("package handler\nimport(\"encoding/json\";\"strings\";%q; omnierrors %q)\nvar responseTemplates=map[string]response.Encoder{\"\":response.Default(),\n", frameworkModule+"/response", frameworkModule+"/errors")
+	for _, definition := range c.Spec.Responses {
+		data, err := json.Marshal(definition.Config)
+		if err != nil {
+			return nil, nil, err
+		}
+		policySource += fmt.Sprintf("%q: newResponseTemplate(%q),\n", definition.Name, string(data))
+	}
+	policySource += "}\nfunc newResponseTemplate(raw string)*response.Formatter{var cfg response.Config;decoder:=json.NewDecoder(strings.NewReader(raw));decoder.UseNumber();if err:=decoder.Decode(&cfg);err!=nil{panic(err)};return response.MustNew(cfg)}\n"
+	policySource += "func responseEncoder(name string,raw bool,catalogJSON string)response.Encoder{encoder:=responseTemplates[name];if encoder==nil{panic(\"unknown response template\")};var catalog omnierrors.Catalog;if err:=json.Unmarshal([]byte(catalogJSON),&catalog);err!=nil{panic(err)};if len(catalog.Definitions)>0{encoder=response.MustWithErrors(catalog,encoder)};if raw{encoder=response.RawJSON(encoder)};return encoder}\n"
+	put(generated, "internal/handler/responseGen.go", generatedHeader+policySource)
+	imports := fmt.Sprintf("import (\"fmt\"; %q; %q; %q;", frameworkModule+"/httpx", frameworkModule+"/openapi", o.Module+"/internal/svc")
+	routes := "func RegisterRoutes(router openapi.Registrar, deps *svc.ServiceContext) error {\n if router==nil || deps==nil {return fmt.Errorf(\"router and dependencies required\")}\n"
+	if len(c.Spec.Scalars) > 0 {
+		imports += fmt.Sprintf("%q;%q;", frameworkModule+"/contract", o.Module+"/internal/types")
+		routes += "if err:=contract.ValidateScalars(types.ContractScalars()...);err!=nil{return err}\n"
+	}
 	middlewareSet := map[string]bool{}
 	for _, r := range c.Spec.Routes {
 		for _, m := range r.Middleware {
@@ -317,8 +439,8 @@ func renderProject(o Options, c *Compiled, starter bool) (map[string][]byte, map
 		routes += fmt.Sprintf("if deps.Middlewares[%q]==nil {return fmt.Errorf(%q)}\n", m, "missing middleware "+m)
 	}
 	for i, group := range c.Groups {
-		imports += fmt.Sprintf("h%d %q; s%d %q;", i, o.Module+"/internal/handler/"+group, i, o.Module+"/internal/service/"+group)
-		routes += fmt.Sprintf("h%d := h%d.New(s%d.New(deps))\n", i, i, i)
+		imports += fmt.Sprintf("h%d %q; s%d %q;", i, o.Module+"/internal/handler/"+group, i, o.Module+"/internal/logic/"+group)
+		routes += fmt.Sprintf("h%d := h%d.New(s%d.New(deps),deps)\n", i, i, i)
 		groupRoutes := []Route{}
 		for _, r := range c.Spec.Routes {
 			if r.Group == group {
@@ -327,12 +449,16 @@ func renderProject(o Options, c *Compiled, starter bool) (map[string][]byte, map
 		}
 		packageName := filepath.Base(group)
 		text := "package " + packageName + "\nimport(\"context\"; \"fmt\";"
-		needsTypes, needsBinder := false, false
+		needsTypes, needsBinder, hasAutomatic := false, false, false
 		for _, r := range groupRoutes {
-			needsTypes = needsTypes || r.Request != "" || r.Response != ""
-			needsBinder = needsBinder || r.Request != ""
+			if r.Manual {
+				continue
+			}
+			hasAutomatic = true
+			needsTypes = needsTypes || r.Request != "" || responseNeedsTypes(r.Response)
+			needsBinder = needsBinder || !r.CustomBinding
 		}
-		text += fmt.Sprintf("%q;", frameworkModule+"/httpx")
+		text += fmt.Sprintf("%q;%q;", frameworkModule+"/httpx", o.Module+"/internal/svc")
 		if needsTypes {
 			text += fmt.Sprintf("%q;", o.Module+"/internal/types")
 		}
@@ -340,63 +466,144 @@ func renderProject(o Options, c *Compiled, starter bool) (map[string][]byte, map
 			text += fmt.Sprintf("%q;", frameworkModule+"/contract")
 		}
 		text += ")\n"
-		text += "type Service interface {\n"
+		text += "type Logic interface {\n"
 		for _, r := range groupRoutes {
-			text += signature(r) + "\n"
+			if !r.Manual {
+				text += signature(r) + "\n"
+			}
 		}
-		text += "}\ntype Handler struct {service Service}\nfunc New(s Service)*Handler {return &Handler{service:s}}\n"
+		text += "}\ntype Handler struct {logic Logic;deps *svc.ServiceContext}\nfunc New(s Logic,deps ...*svc.ServiceContext)*Handler {h:=&Handler{logic:s};if len(deps)>0{h.deps=deps[0]};return h}\n"
 		for _, r := range groupRoutes {
 			name := upper(r.Handler)
-			if r.Request != "" {
-				text += fmt.Sprintf("var %sRequest = contract.MustNew[types.%s]()\n", lower(r.Handler), r.Request)
-			}
-			text += fmt.Sprintf("func(h *Handler) %s(c *httpx.Context)error {\n", name)
-			call := "c.Context()"
-			if r.Request != "" {
-				text += fmt.Sprintf("var req types.%s\nif err:=%sRequest.Bind(c.Request(),httpx.RouteParams(c.Context()),&req);err!=nil{return err}\n", r.Request, lower(r.Handler))
-				call += ", &req"
-			}
-			if r.Response != "" {
-				text += fmt.Sprintf("resp,err:=h.service.%s(%s);if err!=nil{return err};if resp==nil{return fmt.Errorf(\"%s returned a nil response\")}\n", name, call, name)
-				method := map[int]string{200: "OK", 201: "Created", 202: "Accepted"}[r.Status]
-				text += "return c." + method + "(resp)\n}\n"
+			// The response policy and body reader cap are installed before App middleware.
+			if r.MaxBodyBytes > 0 {
+				routes += fmt.Sprintf("httpx.HandleWithBodyLimit(router,%q,%q,%d,responseEncoder(%q,%t,%q),h%d.%s", strings.ToUpper(r.Method), r.Path, r.MaxBodyBytes, responseName(r), r.ResponseFormat == "raw", errorCatalogJSON(c.Spec, append([]string{}, r.Errors...)), i, name)
 			} else {
-				text += fmt.Sprintf("if err:=h.service.%s(%s);err!=nil{return err};return c.NoContent()\n}\n", name, call)
+				routes += fmt.Sprintf("httpx.HandleWithResponse(router,%q,%q,responseEncoder(%q,%t,%q),h%d.%s", strings.ToUpper(r.Method), r.Path, responseName(r), r.ResponseFormat == "raw", errorCatalogJSON(c.Spec, append([]string{}, r.Errors...)), i, name)
 			}
-			routes += fmt.Sprintf("router.Handle(%q,%q,h%d.%s", strings.ToUpper(r.Method), r.Path, i, name)
 			for _, m := range r.Middleware {
 				routes += fmt.Sprintf(",deps.Middlewares[%q]", m)
 			}
 			routes += ")\n"
+			if r.Manual {
+				put(seeds, "internal/handler/"+group+"/"+lower(r.Handler)+"Manual.go", fmt.Sprintf("package %s\nimport(%q;apierrors %q)\n// %s owns raw/multipart binding and response output. h.deps holds project dependencies.\n// This file is preserved on regeneration.\nfunc(h *Handler)%s(c *httpx.Context)error{return apierrors.New(501,\"NOT_IMPLEMENTED\",\"manual handler is not implemented\")}\n", packageName, frameworkModule+"/httpx", frameworkModule+"/errors", name, name))
+				continue
+			}
+			if !r.CustomBinding {
+				scalarArgs := ""
+				if len(c.Spec.Scalars) > 0 {
+					scalarArgs = "types.ContractScalars()..."
+				}
+				requestType := "struct{}"
+				if r.Request != "" {
+					requestType = "types." + r.Request
+				} else {
+					scalarArgs = ""
+				}
+				text += fmt.Sprintf("var %sRequest = contract.MustNew[%s](%s)\n", lower(r.Handler), requestType, scalarArgs)
+			}
+			text += fmt.Sprintf("func(h *Handler) %s(c *httpx.Context)error {\n", name)
+			call := "c.Context()"
+			if r.Request != "" {
+				if r.CustomBinding {
+					text += fmt.Sprintf("var req types.%s\nif err:=h.bind%s(c,&req);err!=nil{return err}\n", r.Request, name)
+					put(seeds, "internal/handler/"+group+"/"+lower(r.Handler)+"Bind.go", fmt.Sprintf("package %s\nimport(%q;%q;apierrors %q)\n// bind%s is project-owned; repeated generation preserves it.\nfunc(h *Handler)bind%s(c *httpx.Context,req *types.%s)error{return apierrors.New(501,\"BINDING_NOT_IMPLEMENTED\",\"custom binding is not implemented\")}\n", packageName, frameworkModule+"/httpx", o.Module+"/internal/types", frameworkModule+"/errors", name, name, r.Request))
+				} else if r.BoundMultipart {
+					text += fmt.Sprintf("var req types.%s\ncleanup,err:=%sRequest.BindMultipart(c.Request(),httpx.RouteParams(c.Context()),&req,contract.MultipartOptions{MaxBodyBytes:%d,MaxParts:%d,MaxFieldBytes:%d,MaxFileBytes:%d,Policy:%s});if err!=nil{return err};defer cleanup()\n", r.Request, lower(r.Handler), r.MaxBodyBytes, r.MaxParts, r.MaxFieldBytes, r.MaxFileBytes, policyLiteral(r.RequestPolicy))
+				} else {
+					limit := ""
+					if r.MaxBodyBytes > 0 {
+						limit = fmt.Sprintf(",%d", r.MaxBodyBytes)
+					}
+					policy := r.RequestPolicy
+					if r.BodyMode == "raw" || r.BodyMode == "multipart" {
+						policy.Body = "auto"
+					}
+					text += fmt.Sprintf("var req types.%s\nif err:=%sRequest.BindWithPolicy(c.Request(),httpx.RouteParams(c.Context()),&req,%s%s);err!=nil{return err}\n", r.Request, lower(r.Handler), policyLiteral(policy), limit)
+				}
+				call += ", &req"
+			} else {
+				limit := ""
+				if r.MaxBodyBytes > 0 {
+					limit = fmt.Sprintf(",%d", r.MaxBodyBytes)
+				}
+				policy := r.RequestPolicy
+				if r.BodyMode == "raw" || r.BodyMode == "multipart" {
+					policy.Body = "auto"
+				}
+				text += fmt.Sprintf("if err:=%sRequest.BindWithPolicy(c.Request(),httpx.RouteParams(c.Context()),&struct{}{},%s%s);err!=nil{return err}\n", lower(r.Handler), policyLiteral(policy), limit)
+			}
+			streamingBody := streamsBody(r)
+			if streamingBody {
+				text += fmt.Sprintf("body,err:=httpx.NewBody(c.Request(),%q);if err!=nil{return err}\n", r.BodyMode)
+				call += ",body"
+			}
+			if r.Produces != "" {
+				text += fmt.Sprintf("resp,err:=h.logic.%s(%s);if err!=nil{if resp!=nil{_ = resp.Close()};return err}\n", name, call)
+				if streamingBody {
+					text += "if err:=body.Complete();err!=nil{if resp!=nil{_ =resp.Close()};return err}\n"
+				}
+				text += fmt.Sprintf("return c.WriteStream(%d,%q,resp)\n}\n", r.Status, r.Produces)
+			} else if responseGoType(r.Response) != "" {
+				text += fmt.Sprintf("resp,err:=h.logic.%s(%s);if err!=nil{return err};\n", name, call)
+				kind, _ := responseShape(r.Response)
+				if kind == "object" {
+					text += fmt.Sprintf("if resp==nil{return fmt.Errorf(%q)}\n", name+" returned a nil response")
+				}
+				if kind == "array" {
+					text += "if resp==nil{resp=make(" + responseGoType(r.Response) + ",0)}\n"
+				}
+				if streamingBody {
+					text += "if err:=body.Complete();err!=nil{return err}\n"
+				}
+				method := map[int]string{200: "OK", 201: "Created", 202: "Accepted"}[r.Status]
+				text += "return c." + method + "(resp)\n}\n"
+			} else {
+				text += fmt.Sprintf("if err:=h.logic.%s(%s);err!=nil{return err};", name, call)
+				if streamingBody {
+					text += "if err:=body.Complete();err!=nil{return err};"
+				}
+				if r.Response == "null" {
+					method := map[int]string{200: "OK", 201: "Created", 202: "Accepted"}[r.Status]
+					text += "return c." + method + "(nil)\n}\n"
+				} else {
+					text += "return c.NoContent()\n}\n"
+				}
+			}
 			service := fmt.Sprintf("package %s\nimport(\"context\"; apierrors %q;", packageName, frameworkModule+"/errors")
-			if r.Request != "" || r.Response != "" {
+			if r.Request != "" || responseNeedsTypes(r.Response) {
 				service += fmt.Sprintf("%q;", o.Module+"/internal/types")
 			}
+			if streamingBody || r.Produces != "" {
+				service += fmt.Sprintf("%q;", frameworkModule+"/httpx")
+			}
 			service += ")\n"
-			service += "// " + name + " implements the business operation. This file is never overwritten.\nfunc(s *Service) " + signature(r) + " {\n"
+			service += "// " + name + " implements the business operation. This file is never overwritten.\nfunc(s *Logic) " + signature(r) + " {\n"
 			if starter && r.Handler == "greet" {
 				service = strings.Replace(service, "apierrors "+strconv.Quote(frameworkModule+"/errors")+";", "\"fmt\";", 1)
 				service += "s.deps.Logger.InfoContext(ctx,\"greet.called\")\nreturn &types.GreetResp{Message:fmt.Sprintf(\"Hello %s\",req.Name)},nil\n}"
 			} else {
 				service += "// TODO: implement business behavior and use s.deps for dependencies.\n"
-				if r.Response != "" {
+				if responseGoType(r.Response) != "" || r.Produces != "" {
 					service += "return nil, "
 				} else {
 					service += "return "
 				}
 				service += "apierrors.New(501,\"NOT_IMPLEMENTED\",\"operation is not implemented\")\n}"
 			}
-			put(seeds, "internal/service/"+group+"/"+lower(r.Handler)+".go", service)
+			put(seeds, "internal/logic/"+group+"/"+lower(r.Handler)+".go", service)
+		}
+		if !hasAutomatic {
+			text = strings.Replace(text, strconv.Quote(frameworkModule+"/httpx")+";", "", 1)
+			text = strings.Replace(text, "\"context\";", "", 1)
 		}
 		if !hasResponse(groupRoutes) {
 			text = strings.Replace(text, "\"fmt\";", "", 1)
 		}
 		put(generated, "internal/handler/"+group+"/handlersGen.go", generatedHeader+text)
-		put(seeds, "internal/service/"+group+"/service.go", fmt.Sprintf("package %s\nimport %q\ntype Service struct {deps *servicecontext.Context}\nfunc New(deps *servicecontext.Context)*Service{return &Service{deps:deps}}\n", packageName, o.Module+"/internal/servicecontext"))
+		put(seeds, "internal/logic/"+group+"/logic.go", fmt.Sprintf("package %s\nimport %q\ntype Logic struct {deps *svc.ServiceContext}\nfunc New(deps *svc.ServiceContext)*Logic{return &Logic{deps:deps}}\n", packageName, o.Module+"/internal/svc"))
 		put(seeds, "internal/repository/"+group+"/repository.go", "// Package "+packageName+" owns persistence contracts for this business group.\n// Define repository interfaces and implementations here; HTTP DTOs do not\n// determine a database schema. This file is never overwritten.\npackage "+packageName+"\n")
 	}
-	// Avoid unused imports when no route uses a named middleware.
-	imports = strings.Replace(imports, strconv.Quote(frameworkModule+"/httpx")+";", "", 1)
 	put(generated, "internal/handler/routesGen.go", generatedHeader+"package handler\n"+imports+")\n"+routes+"return nil\n}\n")
 	registry := "package middleware\nimport " + strconv.Quote(frameworkModule+"/httpx") + "\nfunc Defaults()map[string]httpx.Middleware{return map[string]httpx.Middleware{\n"
 	for _, m := range middlewareNames {
@@ -411,7 +618,11 @@ func renderProject(o Options, c *Compiled, starter bool) (map[string][]byte, map
 		if name == "etc/config.yaml" && o.LogOutput == "file" {
 			content = strings.Replace(content, "output: file", "output: stderr\n    file: ./var/log/server.log\n    rotation:\n      enabled: true\n      maxSizeMb: 100\n      maxBackups: 10\n      maxAgeDays: 7\n      compress: true", 1)
 		}
-		put(seeds, name, content)
+		if name == "main.go" {
+			put(generated, name, generatedHeader+content)
+		} else {
+			put(seeds, name, content)
+		}
 	}
 
 	infra, err := scaffold.APIInfrastructure(o.Module, o.Database, o.Storage, o.LogOutput, o.LogFormat)
@@ -419,7 +630,11 @@ func renderProject(o Options, c *Compiled, starter bool) (map[string][]byte, map
 		return nil, nil, err
 	}
 	for name, data := range infra {
-		seeds[name] = data
+		if strings.HasSuffix(name, "Gen.go") {
+			generated[name] = append([]byte(generatedHeader), data...)
+		} else {
+			seeds[name] = data
+		}
 	}
 	if o.Storage == "local" {
 		for _, r := range c.Spec.Routes {
@@ -427,17 +642,14 @@ func renderProject(o Options, c *Compiled, starter bool) (map[string][]byte, map
 				return nil, nil, errors.New("/storage/object is reserved by local storage")
 			}
 		}
-		main := string(seeds["cmd/server/main.go"])
-		main = strings.Replace(main, " if err=handler.RegisterRoutes", ` for _,method:=range []string{"GET","HEAD","PUT"}{app.Handle(method,"/storage/object",func(c *httpx.Context)error{deps.FileHTTP.ServeHTTP(c.Raw(),c.Request());return nil})}
- if err=handler.RegisterRoutes`, 1)
-		main = strings.Replace(main, `"git.yuntuo.hk/k2safe/go-omni/logx"`, `"git.yuntuo.hk/k2safe/go-omni/logx"; "git.yuntuo.hk/k2safe/go-omni/httpx"`, 1)
-		seeds["cmd/server/main.go"] = []byte(main)
 	}
+	put(generated, "internal/handler/appGen.go", generatedHeader+appSource(o, c.Spec))
+
 	return generated, seeds, nil
 }
 func hasResponse(routes []Route) bool {
 	for _, r := range routes {
-		if r.Response != "" {
+		if kind, _ := responseShape(r.Response); r.Response != "" && kind == "object" && !r.Manual && r.Produces == "" {
 			return true
 		}
 	}
@@ -448,11 +660,41 @@ func signature(r Route) string {
 	if r.Request != "" {
 		s += ",req *types." + r.Request
 	}
+	if streamsBody(r) {
+		s += ",body *httpx.Body"
+	}
 	s += ") "
-	if r.Response != "" {
-		s += "(*types." + r.Response + ",error)"
+	if r.Produces != "" {
+		return s + "(*httpx.Stream,error)"
+	}
+	if result := responseGoType(r.Response); result != "" {
+		s += "(" + result + ",error)"
 	} else {
 		s += "error"
 	}
 	return s
 }
+
+func streamsBody(r Route) bool {
+	return r.BodyMode == "raw" || (r.BodyMode == "multipart" && !r.BoundMultipart)
+}
+
+func dtoFile(position string) string {
+	source := position
+	for i := 0; i < 2; i++ {
+		if idx := strings.LastIndex(source, ":"); idx >= 0 {
+			source = source[:idx]
+		}
+	}
+	stem := strings.TrimSuffix(filepath.Base(source), ".api")
+	var b strings.Builder
+	for _, r := range stem {
+		if r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9' {
+			b.WriteRune(r)
+		}
+	}
+	if b.Len() == 0 {
+		b.WriteString("contract")
+	}
+	return "dto" + upper(b.String()) + digest([]byte(source))[:12] + "Gen.go"
+}

cmd/go-omni/apigen/logicCheck.go

@@ -0,0 +1,240 @@
+package apigen
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"go/ast"
+	"go/build"
+	"go/format"
+	goparser "go/parser"
+	"go/scanner"
+	gotoken "go/token"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+type logicMethod struct {
+	path, signature string
+	line            int
+	known           bool
+}
+
+// checkLogic inspects source only: no project code, init hooks, Go commands or
+// dependency downloads are executed. Seeds participate only when files do not
+// already exist, matching apply's ownership rules.
+func checkLogic(root, module string, contract *contractSnapshot, seeds map[string][]byte) ([]Diagnostic, map[string]logicMethod) {
+	groups := map[string][]routeContract{}
+	knownTypes := map[string]bool{}
+	for _, r := range contract.Routes {
+		if !r.Manual {
+			groups[r.Group] = append(groups[r.Group], r)
+		}
+		for name := range r.Types {
+			knownTypes[name] = true
+		}
+	}
+	// Project-owned aliases may make differently named DTOs identical. Let
+	// the compiler handle such cases rather than rejecting valid Go aliases.
+	typeExtensions := false
+	if entries, err := os.ReadDir(filepath.Join(root, "internal/types")); err == nil {
+		for _, e := range entries {
+			if sourceFile(e.Name()) && !ownedPath("internal/types/"+e.Name()) {
+				typeExtensions = true
+			}
+		}
+	}
+	var diagnostics []Diagnostic
+	locations := map[string]logicMethod{}
+	for group, routes := range groups {
+		directory := "internal/logic/" + group
+		files := map[string][]byte{}
+		uncertain := false
+		entries, err := os.ReadDir(filepath.Join(root, filepath.FromSlash(directory)))
+		if err != nil && !errors.Is(err, os.ErrNotExist) {
+			diagnostics = append(diagnostics, Diagnostic{Severity: "error", Code: "logicUnreadable", Path: directory, Message: err.Error()})
+			continue
+		}
+		for _, e := range entries {
+			if e.IsDir() || !sourceFile(e.Name()) {
+				continue
+			}
+			name := directory + "/" + e.Name()
+			if err := safePath(root, name); err != nil {
+				diagnostics = append(diagnostics, Diagnostic{Severity: "error", Code: "logicUnreadable", Path: name, Message: err.Error()})
+				uncertain = true
+				continue
+			}
+			data, err := os.ReadFile(filepath.Join(root, filepath.FromSlash(name)))
+			if err != nil {
+				diagnostics = append(diagnostics, Diagnostic{Severity: "error", Code: "logicUnreadable", Path: name, Message: err.Error()})
+				uncertain = true
+				continue
+			}
+			files[name] = data
+		}
+		for name, data := range seeds {
+			if filepath.ToSlash(filepath.Dir(name)) == directory && sourceFile(filepath.Base(name)) {
+				if _, exists := files[name]; !exists {
+					files[name] = data
+				}
+			}
+		}
+		methods := map[string][]logicMethod{}
+		var names []string
+		for name := range files {
+			names = append(names, name)
+		}
+		sort.Strings(names)
+		for _, name := range names {
+			data := files[name]
+			// Do not guess the user's GOFLAGS/build-tag combination. Flag the
+			// group for compiler verification if conditional files are present.
+			if _, err := os.Stat(filepath.Join(root, filepath.FromSlash(name))); err == nil {
+				match, err := build.Default.MatchFile(filepath.Join(root, filepath.FromSlash(directory)), filepath.Base(name))
+				if err != nil || !match {
+					uncertain = true
+					continue
+				}
+			}
+			positions := gotoken.NewFileSet()
+			file, err := goparser.ParseFile(positions, name, data, goparser.SkipObjectResolution|goparser.ParseComments)
+			if err != nil {
+				d := Diagnostic{Severity: "error", Code: "logicSyntax", Path: name, Message: "cannot parse Logic source: " + err.Error()}
+				if list, ok := err.(scanner.ErrorList); ok && len(list) > 0 {
+					d.Line = list[0].Pos.Line
+				}
+				diagnostics = append(diagnostics, d)
+				uncertain = true
+				continue
+			}
+			conditional := false
+			for _, group := range file.Comments {
+				for _, comment := range group.List {
+					if comment.Pos() < file.Package && (strings.HasPrefix(comment.Text, "//go:build ") || strings.HasPrefix(comment.Text, "// +build ")) {
+						conditional = true
+					}
+				}
+			}
+			if conditional {
+				uncertain = true
+				continue
+			}
+			imports := map[string]string{}
+			for _, imp := range file.Imports {
+				path, err := strconv.Unquote(imp.Path.Value)
+				if err != nil {
+					continue
+				}
+				alias := filepath.Base(path)
+				if imp.Name != nil {
+					alias = imp.Name.Name
+				}
+				imports[alias] = path
+			}
+			for _, decl := range file.Decls {
+				fn, ok := decl.(*ast.FuncDecl)
+				if !ok || fn.Recv == nil || len(fn.Recv.List) != 1 {
+					continue
+				}
+				receiver := fn.Recv.List[0].Type
+				if pointer, ok := receiver.(*ast.StarExpr); ok {
+					receiver = pointer.X
+				}
+				id, ok := receiver.(*ast.Ident)
+				if !ok || id.Name != "Logic" {
+					continue
+				}
+				params, a := canonicalFields(fn.Type.Params, imports, module, knownTypes, typeExtensions)
+				results, b := canonicalFields(fn.Type.Results, imports, module, knownTypes, typeExtensions)
+				methods[fn.Name.Name] = append(methods[fn.Name.Name], logicMethod{name, displaySignature(fn.Name.Name, params, results), positions.Position(fn.Pos()).Line, a && b})
+			}
+		}
+		for _, r := range routes {
+			found := methods[upper(r.Handler)]
+			if len(found) == 1 && !uncertain {
+				locations[r.file()] = found[0]
+			}
+			d := Diagnostic{Path: r.file(), Operation: r.operation(), After: r.Signature}
+			switch {
+			case uncertain:
+				d.Severity, d.Code, d.Message = "review", "logicUnchecked", "conditional or unreadable source prevents a complete signature check; run go test ./... with your build settings"
+			case len(found) == 0:
+				d.Severity, d.Code, d.Message = "review", "logicNotFound", "no direct Logic method found; check embedded/aliased implementations with go test ./..."
+			case len(found) > 1:
+				d.Severity, d.Code, d.Message = "error", "logicDuplicate", "multiple Logic methods have this name"
+				for _, m := range found {
+					d.Details = append(d.Details, fmt.Sprintf("%s:%d", m.path, m.line))
+				}
+			case !found[0].known:
+				d.Severity, d.Code, d.Message = "review", "logicUnchecked", "signature uses project-specific type names; verify aliases with go test ./..."
+				d.Path, d.Line, d.Before = found[0].path, found[0].line, found[0].signature
+			case found[0].signature != r.Signature:
+				d.Severity, d.Code, d.Message = "error", "logicSignature", "preserved Logic signature differs from the generated call; update this method"
+				d.Path, d.Line, d.Before = found[0].path, found[0].line, found[0].signature
+			default:
+				continue
+			}
+			diagnostics = append(diagnostics, d)
+		}
+	}
+	return diagnostics, locations
+}
+
+func sourceFile(name string) bool {
+	return strings.HasSuffix(name, ".go") && !strings.HasSuffix(name, "_test.go") && !strings.HasPrefix(name, ".") && !strings.HasPrefix(name, "_")
+}
+
+func canonicalFields(fields *ast.FieldList, imports map[string]string, module string, knownTypes map[string]bool, extensions bool) ([]string, bool) {
+	var values []string
+	known := true
+	if fields != nil {
+		for _, field := range fields.List {
+			value, ok := canonicalType(field.Type, imports, module, knownTypes, extensions)
+			known = known && ok
+			count := len(field.Names)
+			if count == 0 {
+				count = 1
+			}
+			for i := 0; i < count; i++ {
+				values = append(values, value)
+			}
+		}
+	}
+	return values, known
+}
+
+func canonicalType(expr ast.Expr, imports map[string]string, module string, knownTypes map[string]bool, extensions bool) (string, bool) {
+	switch e := expr.(type) {
+	case *ast.ParenExpr:
+		return canonicalType(e.X, imports, module, knownTypes, extensions)
+	case *ast.StarExpr:
+		value, ok := canonicalType(e.X, imports, module, knownTypes, extensions)
+		return "*" + value, ok
+	case *ast.Ellipsis:
+		value, ok := canonicalType(e.Elt, imports, module, knownTypes, extensions)
+		return "..." + value, ok
+	case *ast.Ident:
+		switch e.Name {
+		case "error", "bool", "string", "int", "int8", "int16", "int32", "int64", "uint", "uint8", "uint16", "uint32", "uint64", "uintptr", "float32", "float64", "complex64", "complex128", "any":
+			return e.Name, true
+		}
+	case *ast.SelectorExpr:
+		if pkg, ok := e.X.(*ast.Ident); ok {
+			switch imports[pkg.Name] {
+			case "context":
+				return "context." + e.Sel.Name, true
+			case frameworkModule + "/httpx":
+				return "httpx." + e.Sel.Name, true
+			case module + "/internal/types":
+				return "types." + e.Sel.Name, knownTypes[e.Sel.Name] || !extensions
+			}
+		}
+	}
+	var b bytes.Buffer
+	_ = format.Node(&b, gotoken.NewFileSet(), expr)
+	return b.String(), false
+}

cmd/go-omni/apigen/managed_test.go

@@ -0,0 +1,215 @@
+package apigen
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestManagedDefaultValidation(t *testing.T) {
+	source := readFile(t, filepath.Join(frameworkRoot(t), "examples/contracts/managed.api"))
+	spec, err := parseText(t, source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, err := Compile(spec)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if spec.Routes[0].ResponseFormat != "" {
+		t.Fatal("compile mutated source")
+	}
+	var doc map[string]any
+	if err = json.Unmarshal(c.Document, &doc); err != nil {
+		t.Fatal(err)
+	}
+	if doc["x-omni-default-response"] != "CommonResponse" {
+		t.Fatal("missing default metadata")
+	}
+	for _, bad := range []string{
+		strings.Replace(source, "defaultResponse: CommonResponse", "defaultResponse: Missing", 1),
+		source + "\n@app (defaultResponse: CommonResponse)\n",
+		strings.Replace(source, "maxBytes: 2048", "maxBytes: 0", 1),
+		strings.Replace(source, "@produces \"text/plain\"", "@produces \"text/plain; charset=utf-8\"", 1),
+	} {
+		s, err := parseText(t, bad)
+		if err == nil {
+			_, err = Compile(s)
+		}
+		if err == nil {
+			t.Fatal("invalid contract accepted")
+		}
+	}
+	root := t.TempDir()
+	writeFile(t, filepath.Join(root, "service.api"), "import \"child.api\"\nservice demo {\n@handler hello\nget /hello\n}")
+	writeFile(t, filepath.Join(root, "child.api"), "@app (defaultResponse: Shared)\nresponse Shared ()")
+	if _, err = Parse(filepath.Join(root, "service.api")); err == nil {
+		t.Fatal("import owns App defaults")
+	}
+}
+
+func TestManagedGeneratedProject(t *testing.T) {
+	root := frameworkRoot(t)
+	dir := filepath.Join(t.TempDir(), "managed")
+	o := Options{Dir: dir, API: filepath.Join(root, "examples/contracts/managed.api"), Module: "example.com/managed", FrameworkDir: root}
+	if err := generateManagedTestProject(t, o); err != nil {
+		t.Fatal(err)
+	}
+	o.API = filepath.Join(dir, "api/managed.api")
+	for _, path := range []string{"cmd/server/main.go", "internal/settings", "internal/servicecontext", "internal/service"} {
+		if _, err := os.Stat(filepath.Join(dir, path)); !os.IsNotExist(err) {
+			t.Fatalf("old layout remains: %s", path)
+		}
+	}
+	mainBefore := readFile(t, filepath.Join(dir, "main.go"))
+	files := map[string]string{
+		"consumer_test.go": "consumer_test.go", "internal/svc/options.go": "options.go", "internal/svc/client.go": "client.go", "internal/logic/demo/check.go": "operations.go",
+		"shutdown_test.go": "shutdown_test.go",
+		"phases_test.go":   "phases_test.go", "internal/svc/background.go": "background.go",
+	}
+	for path, fixture := range files {
+		writeFile(t, filepath.Join(dir, path), readFile(t, filepath.Join("testdata/managed", fixture)))
+	}
+	for _, name := range []string{"other", "rawJSON", "upload", "download", "callback", "slow"} {
+		writeFile(t, filepath.Join(dir, "internal/logic/demo", name+".go"), "package demo\n")
+	}
+	configPath := filepath.Join(dir, "internal/config/config.go")
+	writeFile(t, configPath, strings.Replace(readFile(t, configPath), "type Config struct {", "type Config struct {\n BackgroundMode string `json:\"backgroundMode\"`\n FailInit bool `json:\"failInit\"`\n ShutdownInit bool `json:\"shutdownInit\"`", 1))
+	svcPath := filepath.Join(dir, "internal/svc/serviceContext.go")
+	source := strings.Replace(readFile(t, svcPath), "type ServiceContext struct {", "type ServiceContext struct {\n Client *Client", 1)
+	source = strings.Replace(source, "return nil", "return initClient(ctx,c)", 1)
+	writeFile(t, svcPath, source)
+	// Independent tooling stays outside generator ownership.
+	writeFile(t, filepath.Join(dir, "cmd/migrate/main.go"), "package main\nfunc main(){}\n")
+	before := snapshot(t, dir)
+	if err := generateManagedTestProject(t, o); err != nil {
+		t.Fatal(err)
+	}
+	if !sameFiles(before, snapshot(t, dir)) {
+		t.Fatal("regeneration changed handwritten files")
+	}
+	o.Check = true
+	if err := generateManagedTestProject(t, o); err != nil {
+		t.Fatal(err)
+	}
+	o.Check = false
+	// Add an API endpoint: handler and Logic stub appear without touching main or business code.
+	api := readFile(t, o.API)
+	writeFile(t, o.API, api+"\n@server (group: extra)\nservice managed-api {\n@handler extra\nget /extra\n}\n")
+	if err := generateManagedTestProject(t, o); err != nil {
+		t.Fatal(err)
+	}
+	if readFile(t, filepath.Join(dir, "main.go")) != mainBefore {
+		t.Fatal("main requires business-specific edits")
+	}
+	for path := range files {
+		if readFile(t, filepath.Join(dir, path)) != string(before[path]) {
+			t.Fatal("business file changed", path)
+		}
+	}
+	// Main is owned, checked, and restored when missing. Hand edits are a conflict.
+	writeFile(t, filepath.Join(dir, "main.go"), mainBefore+"\n// drift\n")
+	o.Check = true
+	if err := generateManagedTestProject(t, o); err == nil {
+		t.Fatal("main drift accepted")
+	}
+	o.Check = false
+	if err := os.Remove(filepath.Join(dir, "main.go")); err != nil {
+		t.Fatal(err)
+	}
+	if err := generateManagedTestProject(t, o); err != nil {
+		t.Fatal(err)
+	}
+	o.Check = true
+	if err := generateManagedTestProject(t, o); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
+	defer cancel()
+	for _, args := range [][]string{{"test", "-race", "-mod=mod", "-count=1", "./..."}, {"build", "-mod=mod", "."}} {
+		cmd := exec.CommandContext(ctx, "go", args...)
+		cmd.Dir = dir
+		cmd.Env = append(os.Environ(), "GOWORK=off")
+		if out, err := cmd.CombinedOutput(); err != nil {
+			t.Fatalf("%v: %v\n%s", args, err, out)
+		}
+	}
+	if os.Getenv("GO_OMNI_RELEASE_CLI") != "" {
+		cmd := exec.CommandContext(ctx, "go", "list", "-m", "-json", frameworkModule)
+		cmd.Dir = dir
+		cmd.Env = append(os.Environ(), "GOWORK=off")
+		data, err := cmd.CombinedOutput()
+		if err != nil {
+			t.Fatal(err, string(data))
+		}
+		var dependency struct {
+			Version, Sum string
+			Replace      any
+		}
+		if err = json.Unmarshal(data, &dependency); err != nil {
+			t.Fatal(err)
+		}
+		if dependency.Version != os.Getenv("GO_OMNI_RELEASE_VERSION") || dependency.Replace != nil || dependency.Sum == "" {
+			t.Fatal("not a fixed remote consumer")
+		}
+		t.Logf("remote framework %s checksum %s; no local replace", dependency.Version, dependency.Sum)
+	}
+
+}
+
+func generateManagedTestProject(t *testing.T, o Options) error {
+	t.Helper()
+	cli := os.Getenv("GO_OMNI_RELEASE_CLI")
+	if cli == "" {
+		_, err := Generate(o)
+		return err
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	args := []string{"api", "generate", "--api", o.API, "--dir", o.Dir, "--module", o.Module}
+	if o.Check {
+		args = append(args, "--check")
+	}
+	cmd := exec.CommandContext(ctx, cli, args...)
+	cmd.Dir = filepath.Dir(o.Dir)
+	if data, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("released CLI: %w\n%s", err, data)
+	}
+	return nil
+}
+
+func TestManagedOwnershipRejectsOldOrHandwrittenEntry(t *testing.T) {
+	for _, oldLayout := range []bool{false, true} {
+		t.Run(map[bool]string{false: "handwrittenMain", true: "oldManifest"}[oldLayout], func(t *testing.T) {
+			dir := filepath.Join(t.TempDir(), "app")
+			if _, err := New(Options{Dir: dir, Module: "example.com/entry", FrameworkDir: frameworkRoot(t)}); err != nil {
+				t.Fatal(err)
+			}
+			var m manifest
+			if err := json.Unmarshal([]byte(readFile(t, filepath.Join(dir, manifestPath))), &m); err != nil {
+				t.Fatal(err)
+			}
+			if oldLayout {
+				m.Version = 1
+			} else {
+				delete(m.Generated, "main.go")
+				writeFile(t, filepath.Join(dir, "main.go"), "package main\nfunc main(){}\n")
+			}
+			data, _ := json.Marshal(m)
+			writeFile(t, filepath.Join(dir, manifestPath), string(data))
+			before := snapshot(t, dir)
+			if _, err := Generate(Options{Dir: dir, API: filepath.Join(dir, "api/service.api")}); err == nil {
+				t.Fatal("unowned layout accepted")
+			}
+			if !sameFiles(before, snapshot(t, dir)) {
+				t.Fatal("rejected migration modified project")
+			}
+		})
+	}
+}

cmd/go-omni/apigen/metadata_test.go

@@ -0,0 +1,323 @@
+package apigen
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+const declaredAPI = `syntax = "v1"
+info (
+ title: "Declared API"
+ description: "Errors and authentication share one contract"
+)
+error (
+ Unauthenticated 401 "UNAUTHENTICATED" "authentication required"
+ Forbidden 403 "FORBIDDEN" "permission denied"
+ EmailTaken 409 "EMAIL_TAKEN" "email already in use"
+ NameTaken 409 "NAME_TAKEN" "name already in use"
+)
+auth UserAuth (
+ type: bearer
+ middleware: Auth
+ description: "Verified application token"
+)
+auth PartnerAuth (
+ type: apiKey
+ in: header
+ name: X-API-Key
+ middleware: Partner
+)
+auth SessionAuth (
+ type: apiKey
+ in: cookie
+ name: sessionId
+ middleware: Session
+)
+@server (
+ group: user
+ auth: UserAuth
+ errors: Unauthenticated
+ middleware: Audit
+)
+service declared-api {
+ @doc (
+  summary: "Create a user"
+  description: "Uniqueness is enforced in a transaction"
+  tags: users, administration
+  deprecated: true
+ )
+ @errors Forbidden, EmailTaken, NameTaken
+ @handler create
+ post /users
+ @auth none
+ @errors none
+ @handler public
+ get /public
+ @auth PartnerAuth
+ @handler partner
+ get /partner
+ @auth SessionAuth
+ @handler session
+ get /session
+}
+`
+
+func document(t *testing.T, c *Compiled) map[string]any {
+	t.Helper()
+	var doc map[string]any
+	if err := json.Unmarshal(c.Document, &doc); err != nil {
+		t.Fatal(err)
+	}
+	return expandDocumentRefs(t, doc, doc).(map[string]any)
+}
+func operation(t *testing.T, doc map[string]any, path, method string) map[string]any {
+	t.Helper()
+	return doc["paths"].(map[string]any)[path].(map[string]any)[method].(map[string]any)
+}
+func TestDeclaredErrorsAndAuthentication(t *testing.T) {
+	spec, err := parseText(t, declaredAPI)
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, err := Compile(spec)
+	if err != nil {
+		t.Fatal(err)
+	}
+	again, err := Compile(spec)
+	if err != nil || string(c.Document) != string(again.Document) {
+		t.Fatalf("compile is not repeatable: %v", err)
+	}
+	if strings.Join(spec.Routes[0].Middleware, ",") != "Audit" {
+		t.Fatal("parser output mutated")
+	}
+	if strings.Join(c.Spec.Routes[0].Middleware, ",") != "Auth,Audit" {
+		t.Fatal("authentication must be first")
+	}
+	if strings.Join(c.Spec.Routes[1].Middleware, ",") != "Audit" {
+		t.Fatal("public override retained automatic auth")
+	}
+	doc := document(t, c)
+	op := operation(t, doc, "/users", "post")
+	if op["deprecated"] != true || op["description"] == nil || len(op["tags"].([]any)) != 2 {
+		t.Fatalf("documentation missing: %v", op)
+	}
+	security := op["security"].([]any)
+	if _, ok := security[0].(map[string]any)["UserAuth"]; !ok {
+		t.Fatal("security requirement absent")
+	}
+	schemes := doc["components"].(map[string]any)["securitySchemes"].(map[string]any)
+	if len(schemes) != 3 || schemes["UserAuth"].(map[string]any)["scheme"] != "bearer" || schemes["SessionAuth"].(map[string]any)["in"] != "cookie" {
+		t.Fatalf("wrong security schemes: %v", schemes)
+	}
+	responses := op["responses"].(map[string]any)
+	for _, status := range []string{"401", "403", "409"} {
+		if responses[status] == nil {
+			t.Fatal("missing status " + status)
+		}
+	}
+	media := responses["409"].(map[string]any)["content"].(map[string]any)["application/json"].(map[string]any)
+	if len(media["examples"].(map[string]any)) != 2 {
+		t.Fatal("same-status errors were overwritten")
+	}
+	codes := media["schema"].(map[string]any)["properties"].(map[string]any)["code"].(map[string]any)["enum"].([]any)
+	if len(codes) != 2 {
+		t.Fatal("business code enum absent")
+	}
+	public := operation(t, doc, "/public", "get")
+	if len(public["security"].([]any)) != 0 || public["responses"].(map[string]any)["401"] != nil || public["x-omni-errors"] != nil {
+		t.Fatal("public overrides did not clear group declarations")
+	}
+}
+func TestInvalidDeclarations(t *testing.T) {
+	replacements := [][2]string{
+		{`"EMAIL_TAKEN"`, `"UNAUTHENTICATED"`},
+		{`EmailTaken 409`, `EmailTaken 204`},
+		{`EmailTaken 409`, `emailTaken 409`},
+		{`NameTaken 409`, `CodeEmailTaken 409`},
+		{`auth: UserAuth`, `auth: Unknown`},
+		{`errors: Unauthenticated`, `errors: Unknown`},
+		{`middleware: Audit`, `middleware: Auth`},
+		{`type: bearer`, `type: oauth2`},
+		{`in: header`, `in: query`},
+		{`name: X-API-Key`, `name: Authorization`},
+		{`deprecated: true`, `deprecated: yes`},
+		{`tags: users, administration`, `tags: users, users`},
+		{`@errors Forbidden, EmailTaken, NameTaken`, `@errors Forbidden, Forbidden`},
+		{`middleware: Auth`, `middleware: Defaults`},
+	}
+	for _, change := range replacements {
+		spec, err := parseText(t, strings.Replace(declaredAPI, change[0], change[1], 1))
+		if err == nil {
+			_, err = Compile(spec)
+		}
+		if err == nil {
+			t.Fatalf("accepted invalid %q", change[1])
+		}
+		if !strings.Contains(err.Error(), "service.api:") {
+			t.Fatalf("source position missing: %v", err)
+		}
+	}
+}
+func TestImportedErrorCatalog(t *testing.T) {
+	root := t.TempDir()
+	writeFile(t, filepath.Join(root, "errors.api"), `error Conflict 409 "CONFLICT" "conflict"`)
+	writeFile(t, filepath.Join(root, "service.api"), "import \"errors.api\"\nservice imported-api { @errors Conflict\n @handler create\n post /users\n }")
+	spec, err := Parse(filepath.Join(root, "service.api"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = Compile(spec); err != nil {
+		t.Fatal(err)
+	}
+}
+func TestDryRunAndEntryDiscovery(t *testing.T) {
+	root := t.TempDir()
+	source := filepath.Join(root, "input/service.api")
+	writeFile(t, source, declaredAPI)
+	dir := filepath.Join(root, "project")
+	o := Options{API: source, Dir: dir, Module: "example.com/dx", FrameworkDir: frameworkRoot(t), DryRun: true}
+	out, err := Generate(o)
+	if err != nil || len(out.Changes) == 0 {
+		t.Fatalf("empty plan: %v", err)
+	}
+	if _, err = os.Stat(dir); !os.IsNotExist(err) {
+		t.Fatal("dry-run created directory")
+	}
+	o.DryRun = false
+	if _, err = Generate(o); err != nil {
+		t.Fatal(err)
+	}
+	entry, err := ProjectEntry(dir)
+	if err != nil || entry != filepath.Join(dir, "api/service.api") {
+		t.Fatalf("entry: %s %v", entry, err)
+	}
+	o = Options{API: entry, Dir: dir, DryRun: true}
+	before := snapshot(t, dir)
+	out, err = Generate(o)
+	if err != nil || len(out.Changes) != 0 {
+		t.Fatalf("unchanged project plan: %v %+v", err, out.Changes)
+	}
+	writeFile(t, entry, strings.Replace(declaredAPI, "email already in use", "email is already registered", 1))
+	before = snapshot(t, dir)
+	out, err = Generate(o)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !sameFiles(before, snapshot(t, dir)) {
+		t.Fatal("dry-run changed project")
+	}
+	actions := map[string]string{}
+	for _, c := range out.Changes {
+		actions[c.Path] = c.Action
+	}
+	if actions["internal/apierrors/errorsGen.go"] != "update" || actions["docs/openapi.json"] != "update" {
+		t.Fatalf("missing plan: %v", actions)
+	}
+	o.Check = true
+	if _, err = Generate(o); err == nil {
+		t.Fatal("check and dry-run combined")
+	}
+	// A malformed manifest cannot redirect the shorthand outside its project.
+	writeFile(t, filepath.Join(dir, manifestPath), `{"version":1,"entry":"../input/service.api"}`)
+	if _, err = ProjectEntry(dir); err == nil {
+		t.Fatal("unsafe manifest entry accepted")
+	}
+}
+
+func TestDeclaredContractConsumer(t *testing.T) {
+	if os.Getenv("GO_OMNI_SCAFFOLD_INTEGRATION") == "" {
+		t.Skip("consumer integration")
+	}
+	root := t.TempDir()
+	source := filepath.Join(root, "input/service.api")
+	writeFile(t, source, declaredAPI)
+	dir := filepath.Join(root, "project")
+	if _, err := Generate(Options{API: source, Dir: dir, Module: "example.com/dx", FrameworkDir: frameworkRoot(t)}); err != nil {
+		t.Fatal(err)
+	}
+	writeFile(t, filepath.Join(dir, "contract_test.go"), declaredConsumerTest)
+	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "go", "test", "-mod=mod", "-race", "-count=1", "./...")
+	cmd.Dir = dir
+	cmd.Env = append(os.Environ(), "GOWORK=off", "GOFLAGS=")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("consumer: %v\n%s", err, out)
+	}
+}
+
+const declaredConsumerTest = `package main_test
+import (
+ "context";"errors";"io";"net/http/httptest";"strings";"testing"
+ omni "git.yuntuo.hk/k2safe/go-omni"
+ "git.yuntuo.hk/k2safe/go-omni/httpx"
+ "git.yuntuo.hk/k2safe/go-omni/logx"
+ "example.com/dx/internal/apierrors"
+ "example.com/dx/internal/handler"
+ "example.com/dx/internal/svc"
+)
+func TestRuntimeAuthAndFreshErrors(t *testing.T){
+ first:=apierrors.EmailTaken().WithCause(errors.New("private"));second:=apierrors.EmailTaken()
+ if first==second||second.Cause!=nil||second.Code!=apierrors.CodeEmailTaken||second.Status!=409{t.Fatal("shared error instance")}
+ cfg:=logx.Default();cfg.Writer=io.Discard;logger,err:=logx.New(cfg);if err!=nil{t.Fatal(err)};defer logger.Close()
+ deps,err:=svc.New(context.Background(),logger);if err!=nil{t.Fatal(err)};defer deps.Close()
+ app:=omni.New();defer app.Close();if err=handler.RegisterRoutes(app,deps);err!=nil{t.Fatal(err)}
+ w:=httptest.NewRecorder();app.Engine().ServeHTTP(w,httptest.NewRequest("POST","/users",nil))
+ if w.Code!=501||!strings.Contains(w.Body.String(),"MIDDLEWARE_NOT_IMPLEMENTED"){t.Fatal("unimplemented auth did not fail closed")}
+ var called []string
+ deps.Middlewares["Auth"]=func(next httpx.Handler)httpx.Handler{return func(c *httpx.Context)error{called=append(called,"auth");if c.Header("Authorization")!="Bearer valid"{return apierrors.Unauthenticated()};return next(c)}}
+ deps.Middlewares["Audit"]=func(next httpx.Handler)httpx.Handler{return func(c *httpx.Context)error{called=append(called,"audit");return next(c)}}
+ app2:=omni.New();defer app2.Close();if err=handler.RegisterRoutes(app2,deps);err!=nil{t.Fatal(err)}
+ w=httptest.NewRecorder();app2.Engine().ServeHTTP(w,httptest.NewRequest("POST","/users",nil))
+ if w.Code!=401||strings.Join(called,",")!="auth"{t.Fatal("unauthenticated request reached other middleware")}
+ called=nil;req:=httptest.NewRequest("POST","/users",nil);req.Header.Set("Authorization","Bearer valid")
+ w=httptest.NewRecorder();app2.Engine().ServeHTTP(w,req)
+ if w.Code!=501||strings.Join(called,",")!="auth,audit"{t.Fatal("middleware order changed")}
+ called=nil;w=httptest.NewRecorder();app2.Engine().ServeHTTP(w,httptest.NewRequest("GET","/public",nil))
+ if w.Code!=501||strings.Join(called,",")!="audit"||strings.Contains(w.Body.String(),"MIDDLEWARE_NOT_IMPLEMENTED"){t.Fatal("public override retained auth")}
+ delete(deps.Middlewares,"Auth");app3:=omni.New();defer app3.Close()
+ if err=handler.RegisterRoutes(app3,deps);err==nil{t.Fatal("missing auth registration accepted")}
+ w=httptest.NewRecorder();app3.Engine().ServeHTTP(w,httptest.NewRequest("GET","/public",nil))
+ if w.Code!=404{t.Fatal("failed auth preflight registered partial routes")}
+}
+`
+
+func TestAuthMetadataWithParameterNamePrefixes(t *testing.T) {
+	source := "type Req {\n ID int `path:\"id\"`\n IDLong int `path:\"idLong\"`\n}\nauth Gate (\n type: bearer\n middleware: Auth\n)\n@server (auth: Gate)\nservice prefix-api {\n @handler read\n get /items/:id/children/:idLong (Req)\n}"
+	spec, err := parseText(t, source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, err := Compile(spec)
+	if err != nil {
+		t.Fatal(err)
+	}
+	op := operation(t, document(t, c), "/items/{id}/children/{idLong}", "get")
+	if len(op["security"].([]any)) != 1 {
+		t.Fatal("auth metadata lost")
+	}
+}
+
+// Existing semantic assertions resolve the standard local references emitted
+// by the compiler. documentRefs_test additionally checks the actual references.
+func expandDocumentRefs(t *testing.T, doc map[string]any, v any) any {
+ t.Helper()
+ switch v:=v.(type){
+ case map[string]any:
+  if ref,ok:=v["$ref"].(string);ok && strings.HasPrefix(ref,"#/components/") && len(v)==1 {
+   var target any=doc
+   for _,part:=range strings.Split(strings.TrimPrefix(ref,"#/"),"/"){m,ok:=target.(map[string]any);if !ok{t.Fatal("invalid reference",ref)};target=m[part]}
+   if target==nil{t.Fatal("dangling reference",ref)};return expandDocumentRefs(t,doc,target)
+  }
+  out:=map[string]any{};for k,x:=range v{out[k]=expandDocumentRefs(t,doc,x)};return out
+ case []any:
+  out:=make([]any,len(v));for i,x:=range v{out[i]=expandDocumentRefs(t,doc,x)};return out
+ default:return v
+ }
+}

cmd/go-omni/apigen/parse.go

@@ -5,6 +5,8 @@ package apigen
 import (
 	"errors"
 	"fmt"
+	"git.yuntuo.hk/k2safe/go-omni/contract"
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
 	"io"
 	"os"
 	"path/filepath"
@@ -14,27 +16,55 @@ import (
 )
 
 type Spec struct {
-	Title, Version, Service string
-	Types                   []Type
-	Routes                  []Route
-	Sources                 map[string][]byte // relative to the entry API's directory
-	Entry                   string
+	DocumentCatalog                      *apierrors.Catalog
+	DocumentErrors                       *DocumentErrors
+	SharedRoots                          map[string]SharedRoot
+	SourcePaths                          map[string]string
+	RequestPolicy                        contract.RequestPolicy
+	DefaultResponse                      string
+	appDeclared                          bool
+	Title, Version, Service, Description string
+	Errors                               []ErrorDefinition
+	ErrorCatalogs                        []string
+	Auth                                 []AuthDefinition
+	Responses                            []ResponseDefinition
+	Scalars                              []ScalarDefinition
+	Types                                []Type
+	Routes                               []Route
+	Sources                              map[string][]byte // relative to the entry API's directory
+	Entry                                string
 }
 type Type struct {
 	Name     string
 	Fields   []Field
 	Position string
 }
-type Field struct{ Name, Type, Tag string }
+type Field struct{ Name, Type, Tag, Description string }
 type Route struct {
+	BoundMultipart                                           bool
+	MaxParts                                                 int
+	MaxFieldBytes, MaxFileBytes                              int64
+	RequestPolicy                                            contract.RequestPolicy
+	Manual, CustomBinding                                    bool
+	BodyMode, Produces                                       string
+	MaxBodyBytes                                             int64
 	Method, Path, Request, Response, Handler, Group, Summary string
 	Middleware                                               []string
+	Auth                                                     string
+	ResponseFormat                                           string
+	ErrorResponseFormat                                      string
+	Errors                                                   []string
+	Description                                              string
+	Tags                                                     []string
+	Deprecated                                               bool
 	Status                                                   int
 	Position                                                 string
 }
 type token struct {
 	text, position string
+	comment        string
 	kind           rune
+	space          bool
 }
 type parser struct {
 	tokens  []token
@@ -43,7 +73,9 @@ type parser struct {
 	imports []string
 }
 
-func Parse(path string) (*Spec, error) {
+func Parse(path string) (*Spec, error) { return parseWithCatalogs(path, nil) }
+
+func parseWithCatalogs(path string, catalogs map[string][]byte) (*Spec, error) {
 	entry, err := filepath.Abs(path)
 	if err != nil {
 		return nil, err
@@ -53,11 +85,16 @@ func Parse(path string) (*Spec, error) {
 		return nil, err
 	}
 	root := filepath.Dir(entry)
-	spec := &Spec{Version: "1.0.0", Sources: map[string][]byte{}, Entry: filepath.Base(entry)}
+	shared, err := readSharedConfig(root)
+	if err != nil {
+		return nil, err
+	}
+	roots := shared.Roots
+	spec := &Spec{Version: "1.0.0", DocumentErrors: shared.Errors, SharedRoots: roots, SourcePaths: map[string]string{}, Sources: map[string][]byte{}, Entry: filepath.Base(entry)}
 	visiting, visited := map[string]bool{}, map[string]bool{}
 	total := 0
-	var visit func(string, int) error
-	visit = func(name string, depth int) error {
+	var visit func(string, string, int) error
+	visit = func(name, alias string, depth int) error {
 		if depth > 32 || len(visited)+len(visiting) >= 64 {
 			return errors.New("api: import limit exceeded")
 		}
@@ -65,9 +102,16 @@ func Parse(path string) (*Spec, error) {
 		if err != nil {
 			return err
 		}
-		rel, err := filepath.Rel(root, real)
-		if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
-			return errors.New("api: imports must stay within the entry API directory")
+		sourceRoot := root
+		if alias != "" {
+			sourceRoot = roots[alias].Path
+		}
+		rel, err := sourceWithin(sourceRoot, real)
+		if err != nil {
+			return err
+		}
+		if alias != "" {
+			rel = "@" + alias + "/" + rel
 		}
 		if filepath.Ext(real) != ".api" {
 			return errors.New("api: expected .api file")
@@ -102,18 +146,37 @@ func Parse(path string) (*Spec, error) {
 			return err
 		}
 		spec.Sources[filepath.ToSlash(rel)] = data
+		spec.SourcePaths[filepath.ToSlash(rel)] = real
 		for _, imp := range p.imports {
 			if filepath.IsAbs(imp) || strings.Contains(imp, "\\") {
 				return errors.New("api: imports must use relative slash paths")
 			}
-			if err = visit(filepath.Join(filepath.Dir(real), filepath.FromSlash(imp)), depth+1); err != nil {
+			nextAlias := alias
+			next := filepath.Join(filepath.Dir(real), filepath.FromSlash(imp))
+			if strings.HasPrefix(imp, "@") {
+				var sub string
+				var ok bool
+				nextAlias, sub, ok = strings.Cut(strings.TrimPrefix(imp, "@"), "/")
+				declared, found := roots[nextAlias]
+				if !ok || !found || sub == "" || strings.HasPrefix(sub, "/") || strings.HasPrefix(sub, "../") || filepath.ToSlash(filepath.Clean(sub)) != sub {
+					return errors.New("api: import needs a declared @root and a clean relative path")
+				}
+				next = filepath.Join(declared.Path, filepath.FromSlash(sub))
+			}
+			if err = visit(next, nextAlias, depth+1); err != nil {
 				return err
 			}
 		}
 		visited[real] = true
 		return nil
 	}
-	if err = visit(entry, 0); err != nil {
+	if err = visit(entry, "", 0); err != nil {
+		return nil, err
+	}
+	if err = readDocumentCatalog(root, spec, catalogs); err != nil {
+		return nil, err
+	}
+	if err = validateSharedPins(spec); err != nil {
 		return nil, err
 	}
 	if spec.Service == "" || len(spec.Routes) == 0 {
@@ -128,7 +191,7 @@ func lex(name, source string) ([]token, error) {
 	var s scanner.Scanner
 	s.Init(strings.NewReader(source))
 	s.Filename = name
-	s.Mode = scanner.ScanIdents | scanner.ScanInts | scanner.ScanStrings | scanner.ScanRawStrings | scanner.ScanComments | scanner.SkipComments
+	s.Mode = scanner.ScanIdents | scanner.ScanInts | scanner.ScanStrings | scanner.ScanRawStrings | scanner.ScanComments
 	s.Whitespace ^= 1 << '\n'
 	var scanErr error
 	s.Error = func(s *scanner.Scanner, message string) {
@@ -137,9 +200,31 @@ func lex(name, source string) ([]token, error) {
 		}
 	}
 	var out []token
+	end := 0
+	pending := ""
+	lastLine := 0
+	lastToken := -1
 	for {
 		kind := s.Scan()
-		out = append(out, token{s.TokenText(), s.Position.String(), kind})
+		if kind == scanner.Comment {
+			comment := cleanComment(s.TokenText())
+			if lastToken >= 0 && s.Position.Line == lastLine {
+				out[lastToken].comment = joinComment(out[lastToken].comment, comment)
+			} else {
+				pending = joinComment(pending, comment)
+			}
+			end = s.Position.Offset + len(s.TokenText())
+			continue
+		}
+		current := token{text: s.TokenText(), position: s.Position.String(), kind: kind, space: s.Position.Offset > end}
+		if kind != '\n' {
+			current.comment = pending
+			pending = ""
+			lastLine = s.Position.Line
+			lastToken = len(out)
+		}
+		out = append(out, current)
+		end = s.Position.Offset + len(s.TokenText())
 		if kind == scanner.EOF {
 			break
 		}
@@ -186,6 +271,10 @@ func (p *parser) parse() error {
 	syntaxSeen := false
 	for p.skip(); p.tokens[p.at].kind != scanner.EOF; p.skip() {
 		switch p.peek() {
+		case "scalar":
+			if err := p.parseScalar(); err != nil {
+				return err
+			}
 		case "syntax":
 			if syntaxSeen {
 				return p.err("duplicate syntax")
@@ -208,13 +297,20 @@ func (p *parser) parse() error {
 			if err != nil {
 				return err
 			}
+			if _, a := m["desc"]; a {
+				if _, b := m["description"]; b {
+					return p.err("use only one of info desc and description")
+				}
+			}
 			for k, v := range m {
 				switch k {
 				case "title":
 					p.spec.Title = v
 				case "version":
 					p.spec.Version = v
-				case "desc", "description", "author", "email":
+				case "desc", "description":
+					p.spec.Description = v
+				case "author", "email":
 				default:
 					return p.err("unsupported info property " + k)
 				}
@@ -238,6 +334,22 @@ func (p *parser) parse() error {
 				}
 				p.imports = append(p.imports, v)
 			}
+		case "errorCatalog":
+			if err := p.parseErrorCatalog(); err != nil {
+				return err
+			}
+		case "error":
+			if err := p.parseErrors(); err != nil {
+				return err
+			}
+		case "auth":
+			if err := p.parseAuth(); err != nil {
+				return err
+			}
+		case "response":
+			if err := p.parseResponse(); err != nil {
+				return err
+			}
 		case "type":
 			p.next()
 			if p.peek() == "(" {
@@ -255,6 +367,38 @@ func (p *parser) parse() error {
 			}
 		case "@":
 			p.next()
+			if p.peek() == "app" {
+				if p.spec.appDeclared {
+					return p.err("duplicate @app declaration")
+				}
+				// Defaults belong to the entry contract, never an imported module.
+				if !strings.HasPrefix(p.tokens[p.at].position, p.spec.Entry+":") {
+					return p.err("@app must be declared in the entry API file")
+				}
+				p.next()
+				m, err := p.metadata()
+				if err != nil {
+					return err
+				}
+				if len(m) == 0 {
+					return p.err("@app requires defaultResponse or request")
+				}
+				for key, value := range m {
+					switch key {
+					case "defaultResponse":
+					case "request":
+						p.spec.RequestPolicy, err = decodeRequestPolicy(value)
+						if err != nil {
+							return err
+						}
+					default:
+						return p.err("unsupported @app property " + key)
+					}
+				}
+				p.spec.DefaultResponse = m["defaultResponse"]
+				p.spec.appDeclared = true
+				continue
+			}
 			if err := p.expect("server"); err != nil {
 				return err
 			}
@@ -267,7 +411,7 @@ func (p *parser) parse() error {
 			}
 			server = m
 			for k := range m {
-				if k != "prefix" && k != "group" && k != "middleware" {
+				if k != "prefix" && k != "group" && k != "middleware" && k != "auth" && k != "errors" && k != "response" {
 					return p.err("unsupported @server option " + k + "; wire authentication through named middleware")
 				}
 			}
@@ -304,6 +448,29 @@ func (p *parser) metadata() (map[string]string, error) {
 			if err != nil {
 				return nil, err
 			}
+		} else if p.peek() == "{" {
+			depth := 0
+			var object strings.Builder
+			for {
+				t := p.next()
+				if t.kind == scanner.EOF {
+					return nil, p.err("unterminated metadata object")
+				}
+				if t.text == "{" {
+					depth++
+				}
+				if t.text == "}" {
+					depth--
+				}
+				if t.space {
+					object.WriteByte(' ')
+				}
+				object.WriteString(t.text)
+				if depth == 0 {
+					break
+				}
+			}
+			value = object.String()
 		} else {
 			for p.peek() != "\n" && p.peek() != ";" && p.peek() != ")" && p.tokens[p.at].kind != scanner.EOF {
 				value += p.next().text
@@ -332,13 +499,22 @@ func (p *parser) parseType() error {
 	}
 	typ := Type{Name: name, Position: pos}
 	for p.skip(); p.peek() != "}"; p.skip() {
+		description := p.tokens[p.at].comment
 		name, err := p.ident()
 		if err != nil {
 			return err
 		}
 		expression := ""
 		for p.peek() != "\n" && p.peek() != ";" && p.peek() != "}" && p.tokens[p.at].kind != scanner.RawString && p.tokens[p.at].kind != scanner.EOF {
-			expression += p.next().text
+			if p.peek() == "interface" {
+				p.next()
+				if p.expect("{") != nil || p.expect("}") != nil {
+					return p.err("only empty interface{} is supported; use any for dynamic JSON")
+				}
+				expression += "any"
+			} else {
+				expression += p.next().text
+			}
 		}
 		if expression == "" {
 			return p.err("field type required; embedded types are not supported")
@@ -346,11 +522,13 @@ func (p *parser) parseType() error {
 		if p.tokens[p.at].kind != scanner.RawString {
 			return p.err("field source tag required")
 		}
-		tag, err := strconv.Unquote(p.next().text)
+		tagToken := p.next()
+		description = joinComment(description, tagToken.comment)
+		tag, err := strconv.Unquote(tagToken.text)
 		if err != nil {
 			return err
 		}
-		typ.Fields = append(typ.Fields, Field{Name: name, Type: expression, Tag: tag})
+		typ.Fields = append(typ.Fields, Field{Name: name, Type: expression, Tag: tag, Description: description})
 	}
 	p.next()
 	p.spec.Types = append(p.spec.Types, typ)
@@ -379,7 +557,7 @@ func (p *parser) parseService(server map[string]string) error {
 		return err
 	}
 	for p.skip(); p.peek() != "}"; p.skip() {
-		route := Route{Group: server["group"], Status: 200, Position: p.tokens[p.at].position}
+		route := Route{ResponseFormat: server["response"], Auth: server["auth"], Errors: commaList(server["errors"]), Group: server["group"], Status: 200, Position: p.tokens[p.at].position}
 		if route.Group == "" {
 			route.Group = "api"
 		}
@@ -398,10 +576,55 @@ func (p *parser) parseService(server map[string]string) error {
 			}
 			seen[annotation] = true
 			switch annotation {
+			case "request":
+				var props map[string]string
+				props, e = p.metadata()
+				if e == nil {
+					route.RequestPolicy, e = parseRequestPolicy(props)
+				}
+			case "handlerMode":
+				mode, err := p.ident()
+				if err != nil {
+					return err
+				}
+				if mode != "manual" {
+					return p.err("handlerMode must be manual")
+				}
+				route.Manual = true
+			case "binding":
+				mode, err := p.ident()
+				if err != nil {
+					return err
+				}
+				if mode != "custom" {
+					return p.err("binding must be custom")
+				}
+				route.CustomBinding = true
+			case "produces":
+				route.Produces, e = p.quoted()
+			case "body":
+				e = p.parseBody(&route)
 			case "handler":
 				route.Handler, e = p.ident()
 			case "doc":
-				route.Summary, e = p.quoted()
+				e = p.parseDoc(&route)
+			case "auth":
+				route.Auth, e = p.ident()
+			case "response":
+				var format string
+				format, e = p.ident()
+				if format == "raw" && route.ResponseFormat != "raw" {
+					route.ErrorResponseFormat = route.ResponseFormat
+				}
+				route.ResponseFormat = format
+			case "errors":
+				var names []string
+				names, e = p.names()
+				if len(names) == 1 && names[0] == "none" {
+					route.Errors = nil
+				} else {
+					route.Errors = mergeNames(route.Errors, names)
+				}
 			case "status":
 				route.Status, e = strconv.Atoi(p.next().text)
 			default:
@@ -440,7 +663,7 @@ func (p *parser) parseService(server map[string]string) error {
 		if p.peek() != "\n" && p.peek() != ";" && p.peek() != "}" {
 			return p.err("unexpected route suffix")
 		}
-		if route.Response == "" && !seen["status"] {
+		if route.Response == "" && !seen["status"] && !route.Manual && route.Produces == "" {
 			route.Status = 204
 		}
 		p.spec.Routes = append(p.spec.Routes, route)
@@ -452,9 +675,48 @@ func (p *parser) routeType() (string, error) {
 	if err := p.expect("("); err != nil {
 		return "", err
 	}
+	prefix := ""
+	if p.peek() == "[" {
+		p.next()
+		if err := p.expect("]"); err != nil {
+			return "", err
+		}
+		prefix = "[]"
+	} else if p.peek() == "*" {
+		p.next()
+		prefix = "*"
+	}
 	name, err := p.ident()
 	if err != nil {
 		return "", err
 	}
-	return name, p.expect(")")
+	return prefix + name, p.expect(")")
+}
+
+func joinComment(a, b string) string {
+	if a == "" {
+		return b
+	}
+	if b == "" {
+		return a
+	}
+	return a + "\n" + b
+}
+func cleanComment(s string) string {
+	if strings.HasPrefix(s, "//") {
+		return strings.TrimSpace(strings.TrimPrefix(s, "//"))
+	}
+	s = strings.TrimSuffix(strings.TrimPrefix(s, "/*"), "*/")
+	lines := strings.Split(s, "\n")
+	for i, line := range lines {
+		lines[i] = strings.TrimSpace(strings.TrimPrefix(strings.TrimSpace(line), "*"))
+	}
+	return strings.TrimSpace(strings.Join(lines, "\n"))
+}
+func fieldTag(f Field) string {
+	tags, err := contract.ParseTags(f.Tag)
+	if err != nil || f.Description == "" || tags["description"] != "" {
+		return f.Tag
+	}
+	return f.Tag + " description:" + strconv.Quote(f.Description)
 }

cmd/go-omni/apigen/profile_test.go

@@ -33,7 +33,7 @@ func TestInfrastructureProfileOwnership(t *testing.T) {
 		}
 	}
 	// Restoring a missing seed must use the saved profile, not current defaults.
-	if err := os.Remove(filepath.Join(dir, "internal/servicecontext/storage.go")); err != nil {
+	if err := os.Remove(filepath.Join(dir, "internal/svc/storage.go")); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := Generate(o); err == nil {
@@ -62,7 +62,7 @@ func TestAPIInfrastructureConsumers(t *testing.T) {
 				if _, err := Generate(Options{Dir: dir, API: filepath.Join(dir, "api/service.api"), Check: true}); err != nil {
 					t.Fatal(err)
 				}
-				test := `package settings
+				test := `package config
 import("testing";"os")
 func TestConfiguration(t *testing.T){
  t.Setenv("GO_OMNI_DB_DSN","test:test@tcp(127.0.0.1:1)/test")
@@ -73,6 +73,8 @@ func TestConfiguration(t *testing.T){
  cfg,err:=Load("../../etc/config.yaml");if err!=nil{t.Fatal(err)}
  if cfg.Server.Log.File==""{t.Fatal("file logger absent")}
  t.Setenv("GO_OMNI_LOG_OUTPUT","stdout");cfg,err=Load("");if err!=nil||cfg.Server.Log.File!=""{t.Fatalf("override: %v",err)}
+ t.Setenv("GO_OMNI_SERVER_LOG_FILE","./explicit.log");cfg,err=Load("");if err!=nil||cfg.Server.Log.File!="./explicit.log"{t.Fatalf("canonical log file: %v",err)}
+ t.Setenv("GO_OMNI_SERVER_LOG_OUTPUT","stderr");cfg,err=Load("");if err!=nil||cfg.Server.Log.Output!="stderr"{t.Fatalf("canonical output: %v",err)}
  _=os.Getenv("unused")
 }`
 				endpoint := ""
@@ -82,7 +84,7 @@ func TestConfiguration(t *testing.T){
 				if storage == "oss" {
 					endpoint = "https://oss-cn-hangzhou.aliyuncs.com"
 				}
-				writeFile(t, filepath.Join(dir, "internal/settings/profile_test.go"), strings.ReplaceAll(test, `"ENDPOINT"`, `"`+endpoint+`"`))
+				writeFile(t, filepath.Join(dir, "internal/config/profile_test.go"), strings.ReplaceAll(test, `"ENDPOINT"`, `"`+endpoint+`"`))
 				ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
 				defer cancel()
 				cmd := exec.CommandContext(ctx, "go", "test", "-mod=mod", "-race", "-count=1", "./...")

cmd/go-omni/apigen/projectEntry.go

@@ -0,0 +1,35 @@
+package apigen
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// ProjectEntry discovers the API entry recorded by generation, never guessing
+// which of several .api files is the service entry.
+func ProjectEntry(directory string) (string, error) {
+	root, err := filepath.Abs(directory)
+	if err != nil {
+		return "", err
+	}
+	if err = safePath(root, manifestPath); err != nil {
+		return "", err
+	}
+	data, err := os.ReadFile(filepath.Join(root, manifestPath))
+	if err != nil {
+		return "", fmt.Errorf("--api is required outside a generated project (no readable %s)", manifestPath)
+	}
+	var m manifest
+	if err = json.Unmarshal(data, &m); err != nil {
+		return "", fmt.Errorf("invalid API project manifest: %w", err)
+	}
+	if m.Version != 2 || filepath.Ext(m.Entry) != ".api" {
+		return "", fmt.Errorf("invalid API entry in %s; pass --api explicitly", manifestPath)
+	}
+	if err = safePath(root, m.Entry); err != nil {
+		return "", err
+	}
+	return filepath.Join(root, filepath.FromSlash(m.Entry)), nil
+}

cmd/go-omni/apigen/requestOptions.go

@@ -0,0 +1,154 @@
+package apigen
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"git.yuntuo.hk/k2safe/go-omni/contract"
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"mime"
+	"strconv"
+	"strings"
+)
+
+func (p *parser) parseBody(r *Route) error {
+	props, err := p.metadata()
+	if err != nil {
+		return err
+	}
+	for key, value := range props {
+		switch key {
+		case "maxParts":
+			r.MaxParts, err = strconv.Atoi(value)
+			if err != nil || r.MaxParts < 1 || r.MaxParts > 10000 {
+				return p.err("maxParts must be 1..10000")
+			}
+		case "maxFieldBytes", "maxFileBytes":
+			limit, e := strconv.ParseInt(value, 10, 64)
+			if e != nil || limit < 1 || limit > 1<<30 {
+				return p.err("part limits must be 1..1073741824 bytes")
+			}
+			if key == "maxFieldBytes" {
+				r.MaxFieldBytes = limit
+			} else {
+				r.MaxFileBytes = limit
+			}
+		case "mode":
+			r.BodyMode = value
+		case "maxBytes":
+			r.MaxBodyBytes, err = strconv.ParseInt(value, 10, 64)
+			if err != nil || r.MaxBodyBytes <= 0 || r.MaxBodyBytes > 1<<40 {
+				return p.err("maxBytes must be 1..1099511627776 bytes")
+			}
+		default:
+			return fmt.Errorf("unknown body property %s", key)
+		}
+	}
+	if r.MaxBodyBytes == 0 {
+		r.MaxBodyBytes = contract.DefaultMaxBodyBytes
+	}
+	return nil
+}
+func validateRouteExtensions(r Route) error {
+	if (r.MaxParts > 0 || r.MaxFieldBytes > 0 || r.MaxFileBytes > 0) && r.BodyMode != "multipart" {
+		return errors.New("part limits require multipart mode")
+	}
+
+	if err := r.RequestPolicy.Validate(); err != nil {
+		return err
+	}
+	if (r.BodyMode == "raw" || r.BodyMode == "multipart") && r.RequestPolicy.Body != "" && r.RequestPolicy.Body != "auto" {
+		return errors.New("raw/multipart cannot declare a JSON body policy")
+	}
+	if r.BodyMode != "" && r.BodyMode != "json" && r.BodyMode != "raw" && r.BodyMode != "multipart" {
+		return errors.New("body mode must be json, raw or multipart")
+	}
+	if r.CustomBinding && (r.Manual || r.Request == "") {
+		return errors.New("@binding custom requires an automatic handler with a request DTO")
+	}
+	if r.MaxBodyBytes > 0 && (r.Method == "get" || r.Method == "head") {
+		return errors.New("GET/HEAD cannot declare a body limit")
+	}
+	if (r.Method == "get" || r.Method == "head") && r.RequestPolicy.Body != "" && r.RequestPolicy.Body != "auto" && r.RequestPolicy.Body != "none" {
+		return errors.New("GET/HEAD cannot declare a JSON body policy")
+	}
+	if r.Produces != "" {
+		media, params, err := mime.ParseMediaType(r.Produces)
+		if err != nil || len(params) != 0 || media != r.Produces || strings.Contains(media, "*") {
+			return errors.New("produces requires a concrete media type without parameters")
+		}
+		if r.Response != "" || r.Status == 204 || r.Method == "head" {
+			return errors.New("@produces requires a stream response without a DTO, 204 or HEAD")
+		}
+	}
+	if r.Manual && r.Status == 204 && r.Response != "" {
+		return errors.New("204 cannot declare a response")
+	}
+	return nil
+}
+
+func decorateRequestOptions(op map[string]any, r Route) {
+	if r.BodyMode == "raw" || r.BodyMode == "multipart" {
+		r.RequestPolicy.Body = "auto"
+	}
+	op["x-omni-request-policy"] = r.RequestPolicy
+	if r.BodyMode == "multipart" {
+		limits, _ := (contract.MultipartOptions{MaxBodyBytes: r.MaxBodyBytes, MaxParts: r.MaxParts, MaxFieldBytes: r.MaxFieldBytes, MaxFileBytes: r.MaxFileBytes}).Normalized()
+		op["x-omni-multipart-limits"] = map[string]any{"maxBytes": limits.MaxBodyBytes, "maxParts": limits.MaxParts, "maxFieldBytes": limits.MaxFieldBytes, "maxFileBytes": limits.MaxFileBytes}
+	}
+	if r.BodyMode != "raw" && r.BodyMode != "multipart" {
+		if body, ok := op["requestBody"].(map[string]any); ok && r.RequestPolicy.Body == "optional" {
+			body["required"] = false
+		}
+		if _, ok := op["requestBody"]; !ok && (r.RequestPolicy.Body == "emptyObject" || r.RequestPolicy.Body == "required" || r.RequestPolicy.Body == "optional") {
+			op["requestBody"] = map[string]any{"required": r.RequestPolicy.Body != "optional", "content": map[string]any{"application/json": map[string]any{"schema": map[string]any{"type": "object", "additionalProperties": false}}}}
+		}
+	}
+
+	if r.Manual {
+		op["x-omni-handler-mode"] = "manual"
+	}
+	if r.CustomBinding {
+		op["x-omni-binding"] = "custom"
+	}
+	if r.MaxBodyBytes > 0 {
+		op["x-omni-max-body-bytes"] = r.MaxBodyBytes
+	}
+	if r.BodyMode == "raw" || r.BodyMode == "multipart" {
+		media := "application/octet-stream"
+		schema := map[string]any{"type": "string", "format": "binary"}
+		if r.BodyMode == "multipart" {
+			media = "multipart/form-data"
+			schema = map[string]any{"type": "object", "additionalProperties": true}
+		}
+		op["requestBody"] = map[string]any{"required": true, "content": map[string]any{media: map[string]any{"schema": schema}}}
+	}
+	if r.Produces != "" {
+		schema := map[string]any{"type": "string"}
+		if r.Produces == "application/octet-stream" {
+			schema["format"] = "binary"
+		}
+		if r.Produces == "application/json" {
+			schema = map[string]any{}
+		}
+		op["responses"].(map[string]any)[strconv.Itoa(r.Status)] = map[string]any{"description": "Success", "content": map[string]any{r.Produces: map[string]any{"schema": schema}}}
+	}
+}
+
+func parseRequestPolicy(props map[string]string) (contract.RequestPolicy, error) {
+	data, err := json.Marshal(props)
+	if err != nil {
+		return contract.RequestPolicy{}, err
+	}
+	return decodeRequestPolicy(string(data))
+}
+func decodeRequestPolicy(raw string) (contract.RequestPolicy, error) {
+	var p contract.RequestPolicy
+	if err := apierrors.DecodeCatalogJSON([]byte(raw), &p); err != nil {
+		return p, fmt.Errorf("request policy: %w", err)
+	}
+	return p, p.Validate()
+}
+func policyLiteral(p contract.RequestPolicy) string {
+	return fmt.Sprintf("contract.RequestPolicy{UnknownQuery:%q,UTF8:%q,Charset:%q,Body:%q}", p.UnknownQuery, p.UTF8, p.Charset, p.Body)
+}

cmd/go-omni/apigen/response.go

@@ -0,0 +1,126 @@
+package apigen
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"strings"
+
+	"git.yuntuo.hk/k2safe/go-omni/response"
+)
+
+type ResponseDefinition struct {
+	Name     string
+	Config   response.Config
+	Position string
+}
+
+func (p *parser) parseResponse() error {
+	pos := p.next().position
+	name, err := p.ident()
+	if err != nil {
+		return err
+	}
+	p.skip()
+	props, err := p.metadata()
+	if err != nil {
+		return err
+	}
+	values := map[string]any{}
+	for key, value := range props {
+		switch key {
+		case "successCode", "errorCode":
+			if kind := props["codeType"]; kind == "integer" || kind == "int32" || kind == "int64" {
+				var number json.Number
+				if err = json.Unmarshal([]byte(value), &number); err != nil {
+					return fmt.Errorf("%s: %s must be an integer", pos, key)
+				}
+				values[key] = number
+			} else {
+				values[key] = value
+			}
+		case "codes", "messages", "body", "errorBody":
+			decoder := json.NewDecoder(strings.NewReader(value))
+			decoder.UseNumber()
+			var object map[string]any
+			if err = decoder.Decode(&object); err != nil || object == nil {
+				return fmt.Errorf("%s: %s must be a JSON object", pos, key)
+			}
+			var extra any
+			if decoder.Decode(&extra) != io.EOF {
+				return fmt.Errorf("%s: invalid %s mapping", pos, key)
+			}
+			values[key] = object
+		default:
+			values[key] = value
+		}
+	}
+	data, err := json.Marshal(values)
+	if err != nil {
+		return err
+	}
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	decoder.UseNumber()
+	decoder.DisallowUnknownFields()
+	var cfg response.Config
+	if err = decoder.Decode(&cfg); err != nil {
+		return fmt.Errorf("%s: response %s: %w", pos, name, err)
+	}
+	if err = cfg.Validate(); err != nil {
+		return fmt.Errorf("%s: %w", pos, err)
+	}
+	p.spec.Responses = append(p.spec.Responses, ResponseDefinition{Name: name, Config: cfg, Position: pos})
+	return nil
+}
+
+func responseConfig(spec *Spec, route Route) response.Config {
+	name := responseName(route)
+	for _, definition := range spec.Responses {
+		if definition.Name == name {
+			return definition.Config
+		}
+	}
+	return response.Config{}
+}
+
+func responseName(route Route) string {
+	if route.ResponseFormat == "raw" {
+		return route.ErrorResponseFormat
+	}
+	return route.ResponseFormat
+}
+
+func validateResponses(spec *Spec) error {
+	seen := map[string]bool{}
+	for _, definition := range spec.Responses {
+		if !exportedName.MatchString(definition.Name) || seen[definition.Name] {
+			return fmt.Errorf("%s: response template requires a unique UpperCamelCase name", definition.Position)
+		}
+		if err := definition.Config.Validate(); err != nil {
+			return fmt.Errorf("%s: %w", definition.Position, err)
+		}
+		seen[definition.Name] = true
+	}
+	if spec.DefaultResponse != "" && !seen[spec.DefaultResponse] {
+		return fmt.Errorf("unknown App default response template %s", spec.DefaultResponse)
+	}
+	for i := range spec.Routes {
+		r := &spec.Routes[i]
+		if r.ResponseFormat == "" {
+			r.ResponseFormat = spec.DefaultResponse
+		}
+		if r.ResponseFormat == "raw" && r.ErrorResponseFormat == "" {
+			r.ErrorResponseFormat = spec.DefaultResponse
+		}
+	}
+	for _, r := range spec.Routes {
+		if r.ResponseFormat != "" && r.ResponseFormat != "raw" && !seen[r.ResponseFormat] {
+			return fmt.Errorf("%s: unknown response template %s", r.Position, r.ResponseFormat)
+		}
+		if r.ErrorResponseFormat != "" && !seen[r.ErrorResponseFormat] {
+			return fmt.Errorf("%s: unknown error response template %s", r.Position, r.ErrorResponseFormat)
+		}
+	}
+	return nil
+}

cmd/go-omni/apigen/responseShape.go

@@ -0,0 +1,78 @@
+package apigen
+
+import (
+	"fmt"
+	"git.yuntuo.hk/k2safe/go-omni/contract"
+	"git.yuntuo.hk/k2safe/go-omni/openapi"
+	"reflect"
+	"strings"
+)
+
+// Response roots allow named DTOs, []DTO, []primitive, *DTO and null.
+// A nil root slice is always encoded as an empty JSON array.
+func responseShape(value string) (kind, name string) {
+	if value == "null" {
+		return "null", ""
+	}
+	if strings.HasPrefix(value, "[]") {
+		return "array", strings.TrimPrefix(value, "[]")
+	}
+	if strings.HasPrefix(value, "*") {
+		return "nullable", strings.TrimPrefix(value, "*")
+	}
+	return "object", value
+}
+func responseGoType(value string) string {
+	kind, name := responseShape(value)
+	if kind == "null" || value == "" {
+		return ""
+	}
+	if kind == "array" {
+		if primitiveTypes[name] != nil {
+			return "[]" + name
+		}
+		return "[]types." + name
+	}
+	return "*types." + name
+}
+func responseDataSchema(value string, bindings map[string]*contract.Binder) (*openapi.Schema, error) {
+	kind, name := responseShape(value)
+	if kind == "null" {
+		return &openapi.Schema{Type: "object", Nullable: true, Enum: []any{nil}}, nil
+	}
+	if kind == "array" && primitiveTypes[name] != nil {
+		if name == "File" {
+			return nil, fmt.Errorf("File is request-only; use a response DTO")
+		}
+		// Reuse the contract compiler, including integer bounds and byte-slice rules.
+		t := reflect.StructOf([]reflect.StructField{{Name: "Value", Type: reflect.SliceOf(primitiveTypes[name]), Tag: `json:"value"`}})
+		b, err := contract.Describe(t)
+		if err != nil {
+			return nil, err
+		}
+		s, err := b.ResponseSchema()
+		if err != nil {
+			return nil, err
+		}
+		return s.Properties["value"], nil
+	}
+	b, ok := bindings[name]
+	if !ok {
+		return nil, fmt.Errorf("unknown response DTO %q; use Name, []Name, []string/[]int64/[]bool/[]any, *Name or null", name)
+	}
+	s, err := b.ResponseSchema()
+	if err != nil {
+		return nil, err
+	}
+	switch kind {
+	case "array":
+		return &openapi.Schema{Type: "array", Items: s}, nil
+	case "nullable":
+		s.Nullable = true
+	}
+	return s, nil
+}
+
+var primitiveTypes = map[string]reflect.Type{"File": reflect.TypeOf(contract.File{}), "any": reflect.TypeOf((*any)(nil)).Elem(), "string": reflect.TypeOf(""), "bool": reflect.TypeOf(false), "int": reflect.TypeOf(int(0)), "int8": reflect.TypeOf(int8(0)), "int16": reflect.TypeOf(int16(0)), "int32": reflect.TypeOf(int32(0)), "int64": reflect.TypeOf(int64(0)), "uint": reflect.TypeOf(uint(0)), "uint8": reflect.TypeOf(uint8(0)), "uint16": reflect.TypeOf(uint16(0)), "uint32": reflect.TypeOf(uint32(0)), "uint64": reflect.TypeOf(uint64(0)), "float32": reflect.TypeOf(float32(0)), "float64": reflect.TypeOf(float64(0))}
+
+func responseNeedsTypes(value string) bool { return strings.Contains(responseGoType(value), "types.") }

cmd/go-omni/apigen/response_test.go

@@ -0,0 +1,360 @@
+package apigen
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+const configurableResponseAPI = `syntax = "v1"
+response CommonResponse (
+ codeField: code
+ messageField: msg
+ dataField: data
+ requestIdField: "-"
+ codeType: integer
+ successCode: 200
+ errorCode: 9999
+ successMessage: "操作成功"
+ errorMessage: "系统错误"
+ dataMode: always
+ codes: {
+  "UNAUTHENTICATED": 401001,
+  "EMAIL_TAKEN": 409001
+ }
+ messages: {"UNAUTHENTICATED":"请先登录","EMAIL_TAKEN":"邮箱已存在"}
+)
+response PartnerResponse (
+ codeField: result
+ messageField: notice
+ dataField: payload
+ requestIdField: trace
+ successCode: "PASS"
+)
+error (
+ Unauthenticated 401 "UNAUTHENTICATED" "authentication required"
+ EmailTaken 409 "EMAIL_TAKEN" "email already taken"
+)
+auth Access (type: bearer
+ middleware: Auth
+)
+type ItemResponse {
+ Name string ` + "`json:\"name\"`" + `
+}
+@server (
+ group: items
+ response: CommonResponse
+ auth: Access
+ errors: Unauthenticated
+)
+service response-api {
+ @errors EmailTaken
+ @handler item
+ get /item returns (ItemResponse)
+ @response raw
+ @handler callback
+ post /callback returns (ItemResponse)
+ @response PartnerResponse
+ @handler partner
+ get /partner returns (ItemResponse)
+}
+`
+
+func TestResponseTemplatesDocumentAndValidation(t *testing.T) {
+	spec, err := parseText(t, configurableResponseAPI)
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, err := Compile(spec)
+	if err != nil {
+		t.Fatal(err)
+	}
+	doc := document(t, c)
+	getSchema := func(path, status string) map[string]any {
+		method := "get"
+		if path == "/callback" {
+			method = "post"
+		}
+		return operation(t, doc, path, method)["responses"].(map[string]any)[status].(map[string]any)["content"].(map[string]any)["application/json"].(map[string]any)["schema"].(map[string]any)
+	}
+	properties := getSchema("/item", "200")["properties"].(map[string]any)
+	if len(properties) != 3 || properties["code"].(map[string]any)["type"] != "integer" || properties["msg"] == nil || properties["requestId"] != nil {
+		t.Fatal(properties)
+	}
+	if getSchema("/callback", "200")["properties"].(map[string]any)["name"] == nil {
+		t.Fatal("raw JSON was wrapped")
+	}
+	if getSchema("/callback", "401")["properties"].(map[string]any)["msg"] == nil {
+		t.Fatal("raw override lost group error policy")
+	}
+	if getSchema("/partner", "200")["properties"].(map[string]any)["payload"] == nil {
+		t.Fatal("route override not applied")
+	}
+	conflict := operation(t, doc, "/item", "get")["responses"].(map[string]any)["409"].(map[string]any)["content"].(map[string]any)["application/json"].(map[string]any)
+	value := conflict["examples"].(map[string]any)["EmailTaken"].(map[string]any)["value"].(map[string]any)
+	if value["code"] != float64(409001) || value["msg"] != "邮箱已存在" || len(value) != 3 {
+		t.Fatal(value)
+	}
+	if got := conflict["schema"].(map[string]any)["properties"].(map[string]any)["code"].(map[string]any)["enum"].([]any); got[0] != float64(409001) {
+		t.Fatal(got)
+	}
+	for _, change := range [][2]string{{"response: CommonResponse", "response: Missing"}, {"messageField: msg", "messageField: code"}, {"codeType: integer", "codeType: boolean"}, {"successCode: 200", "successCode: 2.5"}, {"requestIdField: \"-\"", "unknownOption: value"}, {"@response raw", "@response missing"}} {
+		invalid, err := parseText(t, strings.Replace(configurableResponseAPI, change[0], change[1], 1))
+		if err == nil {
+			_, err = Compile(invalid)
+		}
+		if err == nil || !strings.Contains(err.Error(), "service.api:") {
+			t.Fatalf("bad declaration %s: %v", change[1], err)
+		}
+	}
+}
+
+func TestImportedResponseTemplate(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "common.api"), "response Shared (messageField: msg)\n")
+	writeFile(t, filepath.Join(dir, "service.api"), "import \"common.api\"\n@server (response: Shared)\nservice shared-api {\n@handler ping\nget /ping\n}")
+	spec, err := Parse(filepath.Join(dir, "service.api"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = Compile(spec); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestResponseNestedBodyDocument(t *testing.T) {
+	definition := `response Nested (
+ body: {"success":"${ok}","result":"${data}","meta":{"status":"${status}","trace":"${requestId}"},"version":1}
+ errorBody: {"success":"${ok}","error":{"id":"${code}","reason":"${message}"}}
+ codeType: integer
+ successCode: 0
+ errorCode: 9999
+ codes: {"EMAIL_TAKEN":409001}
+)
+`
+	spec, err := parseText(t, definition+strings.Replace(configurableResponseAPI, "response: CommonResponse", "response: Nested", 1))
+	if err != nil {
+		t.Fatal(err)
+	}
+	compiled, err := Compile(spec)
+	if err != nil {
+		t.Fatal(err)
+	}
+	doc := document(t, compiled)
+	responses := operation(t, doc, "/item", "get")["responses"].(map[string]any)
+	success := responses["200"].(map[string]any)["content"].(map[string]any)["application/json"].(map[string]any)["schema"].(map[string]any)["properties"].(map[string]any)
+	if success["code"] != nil || success["result"] == nil || success["success"].(map[string]any)["type"] != "boolean" {
+		t.Fatal(success)
+	}
+	media := responses["409"].(map[string]any)["content"].(map[string]any)["application/json"].(map[string]any)
+	schema := media["schema"].(map[string]any)["properties"].(map[string]any)
+	if schema["error"].(map[string]any)["properties"].(map[string]any)["id"].(map[string]any)["type"] != "integer" || schema["result"] != nil {
+		t.Fatal(schema)
+	}
+	example := media["examples"].(map[string]any)["EmailTaken"].(map[string]any)["value"].(map[string]any)
+	if example["success"] != false || example["error"].(map[string]any)["id"] != float64(409001) {
+		t.Fatal(example)
+	}
+}
+
+func TestResponseTemplateJSONTokens(t *testing.T) {
+	for _, tc := range []struct {
+		body  string
+		valid bool
+	}{
+		{`{"scale":-1.5,"exponent":1e-3,"items":[true,null,"${data}"],"label":"a b"}`, true},
+		{`{"scale":1 2}`, false}, {`{"scale":- 12}`, false},
+		{`{"scale":tru e}`, false}, {`{"scale":1. 2}`, false},
+	} {
+		text := "response Shared (\nbody: " + tc.body + "\n)\n@server (response: Shared)\nservice test-api {\n@handler ping\nget /ping\n}\n"
+		spec, err := parseText(t, text)
+		if err == nil {
+			_, err = Compile(spec)
+		}
+		if (err == nil) != tc.valid {
+			t.Fatalf("%s: %v", tc.body, err)
+		}
+	}
+}
+
+func TestResponseCodeTypeDeclarations(t *testing.T) {
+	for _, kind := range []string{"int32", "int64"} {
+		source := strings.Replace(configurableResponseAPI, "codeType: integer", "codeType: "+kind, 1)
+		spec, err := parseText(t, source)
+		if err != nil {
+			t.Fatal(err)
+		}
+		compiled, err := Compile(spec)
+		if err != nil {
+			t.Fatal(err)
+		}
+		doc := document(t, compiled)
+		for _, status := range []string{"200", "401", "409", "500"} {
+			responses := operation(t, doc, "/item", "get")["responses"].(map[string]any)
+			schema := responses[status].(map[string]any)["content"].(map[string]any)["application/json"].(map[string]any)["schema"].(map[string]any)
+			code := schema["properties"].(map[string]any)["code"].(map[string]any)
+			if code["type"] != "integer" || code["format"] != kind {
+				t.Fatal(code)
+			}
+		}
+		for _, bad := range []string{"2.5", "9223372036854775808", "-9223372036854775809"} {
+			invalid := strings.Replace(source, "successCode: 200", "successCode: "+bad, 1)
+			if _, err := parseText(t, invalid); err == nil || !strings.Contains(err.Error(), "service.api:") {
+				t.Fatalf("%s %s: %v", kind, bad, err)
+			}
+		}
+	}
+	invalid := strings.Replace(configurableResponseAPI, "codeType: integer", "codeType: int32", 1)
+	invalid = strings.Replace(invalid, `"EMAIL_TAKEN": 409001`, `"EMAIL_TAKEN": 2147483648`, 1)
+	if _, err := parseText(t, invalid); err == nil {
+		t.Fatal("overflowing int32 mapping accepted")
+	}
+}
+
+func TestResponseTemplateConsumer(t *testing.T) {
+	if os.Getenv("GO_OMNI_SCAFFOLD_INTEGRATION") == "" {
+		t.Skip("consumer integration")
+	}
+	dir := filepath.Join(t.TempDir(), "project")
+	source := filepath.Join(t.TempDir(), "service.api")
+	// Use an explicitly declared public body, rather than field-name shortcuts.
+	sourceText := strings.Replace(configurableResponseAPI, " codeField: code\n messageField: msg\n dataField: data\n requestIdField: \"-\"", ` body: {"code":"${code}","msg":"${message}","data":"${data}"}`, 1)
+	sourceText = strings.Replace(sourceText, "codeType: integer", "codeType: int64", 1)
+	sourceText = strings.Replace(sourceText, "successCode: 200", "successCode: 9223372036854775807", 1)
+	writeFile(t, source, sourceText)
+	releaseCLI := os.Getenv("GO_OMNI_RELEASE_CLI")
+	generate := func(api string, initial bool) {
+		t.Helper()
+		if releaseCLI != "" {
+			ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+			defer cancel()
+			cmd := exec.CommandContext(ctx, releaseCLI, "api", "generate", "--api", api, "--dir", dir, "--module", "example.com/responseConsumer")
+			// The framework checkout intentionally enables local development mode.
+			// Run the installed CLI outside it to exercise remote-only consumption.
+			cmd.Dir = filepath.Dir(dir)
+			if output, err := cmd.CombinedOutput(); err != nil {
+				t.Fatalf("released CLI: %v\n%s", err, output)
+			}
+			return
+		}
+		o := Options{API: api, Dir: dir}
+		if initial {
+			o.Module = "example.com/responseConsumer"
+			o.FrameworkDir = frameworkRoot(t)
+		}
+		if _, err := Generate(o); err != nil {
+			t.Fatal(err)
+		}
+	}
+	generate(source, true)
+	writeFile(t, filepath.Join(dir, "response_test.go"), responseConsumerTest)
+	for _, method := range []string{"Item", "Callback", "Partner"} {
+		body := `return &types.ItemResponse{Name:"` + strings.ToLower(method) + `"},nil`
+		if method == "Partner" {
+			body = `return nil,apierrors.EmailTaken()`
+		}
+		imports := `"context";"example.com/responseConsumer/internal/types"`
+		if method == "Partner" {
+			imports += `;"example.com/responseConsumer/internal/apierrors"`
+		}
+		writeFile(t, filepath.Join(dir, "internal/logic/items", strings.ToLower(method)+".go"), "package items\nimport("+imports+")\nfunc(s *Logic)"+method+"(ctx context.Context)(*types.ItemResponse,error){"+body+"}\n")
+	}
+	before := snapshot(t, dir)
+	generate(filepath.Join(dir, "api/service.api"), false)
+	if !sameFiles(before, snapshot(t, dir)) {
+		t.Fatal("regeneration changed hand-written files")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "go", "test", "-mod=mod", "-race", "-count=1", "./...")
+	cmd.Dir = dir
+	cmd.Env = append(os.Environ(), "GOWORK=off", "GOFLAGS=")
+	if output, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("consumer: %v\n%s", err, output)
+	}
+	if releaseCLI != "" {
+		cmd = exec.CommandContext(ctx, "go", "list", "-m", "-json", frameworkModule)
+		cmd.Dir = dir
+		cmd.Env = append(os.Environ(), "GOWORK=off", "GOFLAGS=")
+		output, err := cmd.CombinedOutput()
+		if err != nil {
+			t.Fatalf("released module: %v\n%s", err, output)
+		}
+		var module struct {
+			Version, Sum string
+			Replace      any
+		}
+		if err = json.Unmarshal(output, &module); err != nil {
+			t.Fatal(err)
+		}
+		if module.Version != os.Getenv("GO_OMNI_RELEASE_VERSION") || module.Replace != nil || module.Sum == "" {
+			t.Fatalf("expected fixed remote module without replacement: %+v", module)
+		}
+		t.Logf("remote framework %s checksum %s; no local replace", module.Version, module.Sum)
+	}
+	manifestBytes, err := os.ReadFile(filepath.Join(dir, manifestPath))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var manifest manifest
+	if err = json.Unmarshal(manifestBytes, &manifest); err != nil {
+		t.Fatal(err)
+	}
+	if manifest.Generated["internal/handler/responseGen.go"] == "" {
+		t.Fatal("response policy not ownership-managed")
+	}
+}
+
+const responseConsumerTest = `package main_test
+import (
+ "bytes";"encoding/json";"io";"net/http/httptest";"testing"
+ omni "git.yuntuo.hk/k2safe/go-omni"
+ "git.yuntuo.hk/k2safe/go-omni/httpx"
+ "git.yuntuo.hk/k2safe/go-omni/logx"
+ "git.yuntuo.hk/k2safe/go-omni/response"
+ "example.com/responseConsumer/internal/apierrors"
+ "example.com/responseConsumer/internal/handler"
+ item "example.com/responseConsumer/internal/handler/items"
+ "example.com/responseConsumer/internal/types"
+ "context"
+ "example.com/responseConsumer/internal/svc"
+)
+type service struct{}
+func(service)Item(context.Context)(*types.ItemResponse,error){return &types.ItemResponse{Name:"item"},nil}
+func(service)Callback(context.Context)(*types.ItemResponse,error){return &types.ItemResponse{Name:"callback"},nil}
+func(service)Partner(context.Context)(*types.ItemResponse,error){return nil,apierrors.EmailTaken()}
+func TestResponseContract(t *testing.T){
+ app:=omni.New();defer app.Close()
+ cfg:=logx.Default();cfg.Writer=io.Discard;logger,err:=logx.New(cfg);if err!=nil{t.Fatal(err)};defer logger.Close()
+ deps,err:=svc.New(context.Background(),logger);if err!=nil{t.Fatal(err)};defer deps.Close()
+ deps.Middlewares["Auth"]=func(next httpx.Handler)httpx.Handler{return func(c *httpx.Context)error{if c.Header("Authorization")!="Bearer valid"{return apierrors.Unauthenticated()};return next(c)}}
+ if err=handler.RegisterRoutes(app,deps);err!=nil{t.Fatal(err)}
+ // Registered routes use the compiled policy before even running authentication.
+ for _,path:=range []string{"/item","/callback"}{
+   method:="GET";if path=="/callback"{method="POST"};w:=httptest.NewRecorder();app.ServeHTTP(w,httptest.NewRequest(method,path,nil))
+   var value map[string]any;json.Unmarshal(w.Body.Bytes(),&value)
+   if w.Code!=401||value["code"]!=float64(401001)||value["msg"]!="请先登录"||len(value)!=3{t.Fatalf("%s: %s",path,w.Body.String())}
+ }
+ // Execute the real generated registration and user-owned service files.
+ for _,tc:=range []struct{method,path string;status int;key string}{{"GET","/item",200,"data"},{"POST","/callback",200,"name"},{"GET","/partner",409,"result"}}{
+   w:=httptest.NewRecorder();r:=httptest.NewRequest(tc.method,tc.path,nil);r.Header.Set("Authorization","Bearer valid");app.ServeHTTP(w,r)
+   var value map[string]any;decoder:=json.NewDecoder(bytes.NewReader(w.Body.Bytes()));decoder.UseNumber();if err:=decoder.Decode(&value);err!=nil{t.Fatal(err)}
+   if w.Code!=tc.status||value[tc.key]==nil{t.Fatalf("generated %s: %d %s",tc.path,w.Code,w.Body.String())}
+   if tc.path=="/item"&&value["code"]!=json.Number("9223372036854775807"){t.Fatalf("generated int64 lost precision: %s",w.Body.String())}
+ }
+ // Business handlers also honor the same runtime policy and raw override.
+ h:=item.New(service{});runtime:=omni.New();defer runtime.Close()
+ common:=response.MustNew(response.Config{CodeType:"integer",SuccessCode:200,ErrorCode:9999,MessageField:"msg",RequestIDField:"-",DataMode:"always"})
+ runtime.GET("/item",h.Item,httpx.WithResponse(common))
+ runtime.POST("/callback",h.Callback,httpx.WithResponse(response.RawJSON(common)))
+ for _,tc:=range []struct{method,path,key string}{{"GET","/item","data"},{"POST","/callback","name"}}{
+  w:=httptest.NewRecorder();runtime.ServeHTTP(w,httptest.NewRequest(tc.method,tc.path,nil));var value map[string]any;json.Unmarshal(w.Body.Bytes(),&value)
+  if w.Code!=200||value[tc.key]==nil{t.Fatal(w.Body.String())}
+ }
+}
+`

cmd/go-omni/apigen/scalar.go

@@ -0,0 +1,74 @@
+package apigen
+
+import (
+	"fmt"
+	"git.yuntuo.hk/k2safe/go-omni/contract"
+	"golang.org/x/mod/module"
+	"reflect"
+	"strings"
+)
+
+type ScalarDefinition struct {
+	Name, GoImport, GoType, JSONInput, JSONOutput, Position string
+	Text                                                    bool
+}
+
+func (p *parser) parseScalar() error {
+	pos := p.next().position
+	name, err := p.ident()
+	if err != nil {
+		return err
+	}
+	p.skip()
+	props, err := p.metadata()
+	if err != nil {
+		return err
+	}
+	d := ScalarDefinition{Name: name, Position: pos}
+	for key, value := range props {
+		switch key {
+		case "goImport":
+			d.GoImport = value
+		case "goType":
+			d.GoType = value
+		case "jsonInput":
+			d.JSONInput = value
+		case "jsonOutput":
+			d.JSONOutput = value
+		case "text":
+			if value != "true" && value != "false" {
+				return p.err("text must be true or false")
+			}
+			d.Text = value == "true"
+		default:
+			return fmt.Errorf("%s: unknown scalar property %s", pos, key)
+		}
+	}
+	p.spec.Scalars = append(p.spec.Scalars, d)
+	return nil
+}
+func compileScalars(spec *Spec, types map[string]Type) (map[string]reflect.Type, []contract.Scalar, error) {
+	out := map[string]reflect.Type{}
+	var defs []contract.Scalar
+	goTypes := map[string]bool{}
+	for _, d := range spec.Scalars {
+		key := d.GoImport + "." + d.GoType
+		if d.Name == "ContractScalars" || !exportedName.MatchString(d.Name) || !exportedName.MatchString(d.GoType) || out[d.Name] != nil || types[d.Name].Name != "" || goTypes[key] {
+			return nil, nil, fmt.Errorf("%s: scalar names and Go types must be unique; names must be UpperCamelCase", d.Position)
+		}
+		if err := module.CheckImportPath(d.GoImport); err != nil || strings.Contains(d.GoImport, "\\") {
+			return nil, nil, fmt.Errorf("%s: invalid scalar goImport", d.Position)
+		}
+		// Unique stand-in types allow CLI schema checks without executing project code.
+		t := reflect.StructOf([]reflect.StructField{{Name: d.Name, Type: reflect.TypeOf(false)}})
+		def := contract.Scalar{Type: t, JSONInput: d.JSONInput, JSONOutput: d.JSONOutput, Text: d.Text}
+		probe := reflect.StructOf([]reflect.StructField{{Name: "Value", Type: t, Tag: `json:"value"`}})
+		if _, err := contract.Describe(probe, def); err != nil {
+			return nil, nil, fmt.Errorf("%s: %w", d.Position, err)
+		}
+		out[d.Name] = t
+		defs = append(defs, def)
+		goTypes[key] = true
+	}
+	return out, defs, nil
+}

cmd/go-omni/apigen/shared.go

@@ -0,0 +1,151 @@
+package apigen
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+const importsFile = "omni.imports.json"
+
+// SharedRoot explicitly authorizes reads from one canonical local directory.
+// Version is a project-owned label; SHA256 optionally pins the imported source
+// set, not a remote tag. The CLI never downloads or executes shared contracts.
+type SharedRoot struct {
+	Path    string `json:"path"`
+	Version string `json:"version,omitempty"`
+	SHA256  string `json:"sha256,omitempty"`
+}
+type sharedConfig struct {
+	Roots  map[string]SharedRoot `json:"roots"`
+	Errors *DocumentErrors       `json:"errors,omitempty"`
+}
+
+func readSharedConfig(root string) (sharedConfig, error) {
+	stat, err := os.Lstat(filepath.Join(root, importsFile))
+	if errors.Is(err, os.ErrNotExist) {
+		return sharedConfig{}, nil
+	}
+	if err != nil {
+		return sharedConfig{}, err
+	}
+	if !stat.Mode().IsRegular() {
+		return sharedConfig{}, errors.New("api: shared root configuration must be a regular file")
+	}
+	f, err := os.Open(filepath.Join(root, importsFile))
+	if errors.Is(err, os.ErrNotExist) {
+		return sharedConfig{}, nil
+	}
+	if err != nil {
+		return sharedConfig{}, err
+	}
+	defer f.Close()
+	raw, err := io.ReadAll(io.LimitReader(f, 65537))
+	if err != nil {
+		return sharedConfig{}, err
+	}
+	if len(raw) > 65536 {
+		return sharedConfig{}, errors.New("api: shared root config too large")
+	}
+	var cfg sharedConfig
+	if err = apierrors.DecodeCatalogJSON(raw, &cfg); err != nil {
+		return sharedConfig{}, err
+	}
+	if len(cfg.Roots) > 16 {
+		return sharedConfig{}, errors.New("api: at most 16 shared roots")
+	}
+	for name, r := range cfg.Roots {
+		if !lowerName.MatchString(name) || r.Path == "" || len(r.Version) > 128 {
+			return sharedConfig{}, errors.New("api: invalid shared root")
+		}
+		if r.SHA256 != "" && (len(r.SHA256) != 64 || strings.Trim(r.SHA256, "0123456789abcdef") != "") {
+			return sharedConfig{}, errors.New("api: shared sha256 must be 64 lowercase hex characters")
+		}
+		path := r.Path
+		if !filepath.IsAbs(path) {
+			path = filepath.Join(root, path)
+		}
+		r.Path, err = filepath.EvalSymlinks(path)
+		if err != nil {
+			return sharedConfig{}, err
+		}
+		r.Path, err = filepath.Abs(r.Path)
+		if err != nil {
+			return sharedConfig{}, err
+		}
+		stat, err := os.Stat(r.Path)
+		if err != nil {
+			return sharedConfig{}, err
+		}
+		if !stat.IsDir() {
+			return sharedConfig{}, errors.New("api: shared root must be a directory")
+		}
+		cfg.Roots[name] = r
+	}
+	return cfg, nil
+}
+func sourceWithin(root, name string) (string, error) {
+	real, err := filepath.EvalSymlinks(name)
+	if err != nil {
+		return "", err
+	}
+	rel, err := filepath.Rel(root, real)
+	if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+		return "", errors.New("api: imports must stay within their declared contract root")
+	}
+	return filepath.ToSlash(rel), nil
+}
+func sharedHash(sources map[string][]byte, alias string) string {
+	values := map[string]string{}
+	for name, data := range sources {
+		if strings.HasPrefix(name, "@"+alias+"/") {
+			values[strings.TrimPrefix(name, "@"+alias+"/")] = digest(data)
+		}
+	}
+	raw, _ := json.Marshal(values)
+	return digest(raw)
+}
+func sourceMetadata(spec *Spec) map[string]any {
+	hashes := map[string]string{}
+	for name, data := range spec.Sources {
+		hashes[name] = digest(data)
+	}
+	shared := map[string]any{}
+	for alias, r := range spec.SharedRoots {
+		shared[alias] = map[string]string{"version": r.Version, "sha256": sharedHash(spec.Sources, alias)}
+	}
+	return map[string]any{"files": hashes, "shared": shared}
+}
+func sharedSeeds(spec *Spec, directory string) ([]byte, error) {
+	cfg := sharedConfig{Roots: map[string]SharedRoot{}, Errors: spec.DocumentErrors}
+	for name, r := range spec.SharedRoots {
+		rel, err := filepath.Rel(filepath.Join(directory, "api"), r.Path)
+		if err != nil {
+			return nil, err
+		}
+		r.Path = filepath.ToSlash(rel)
+		cfg.Roots[name] = r
+	}
+	data, err := json.MarshalIndent(cfg, "", "  ")
+	return append(data, '\n'), err
+}
+func validateSharedPins(spec *Spec) error {
+	names := make([]string, 0, len(spec.SharedRoots))
+	for name := range spec.SharedRoots {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	for _, name := range names {
+		r := spec.SharedRoots[name]
+		if r.SHA256 != "" && r.SHA256 != sharedHash(spec.Sources, name) {
+			return fmt.Errorf("api: shared contract %s checksum differs (got %s)", name, sharedHash(spec.Sources, name))
+		}
+	}
+	return nil
+}

cmd/go-omni/apigen/shared_test.go

@@ -0,0 +1,96 @@
+package apigen
+
+import (
+	"bytes"
+	"encoding/json"
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestControlledSharedContracts(t *testing.T) {
+	root := t.TempDir()
+	shared := filepath.Join(root, "shared")
+	writeFile(t, filepath.Join(shared, "response.api"), "response Common (codeType: int32; successCode: 0; errorCode: 9999; dataMode: always)\ntype Item { Name string `json:\"name\"` }\n")
+	for _, service := range []string{"api", "id"} {
+		dir := filepath.Join(root, service)
+		entry := filepath.Join(dir, "api/service.api")
+		writeFile(t, entry, "import \"@common/response.api\"\n@app(defaultResponse: Common)\nservice demo {\n@handler get\nget /get returns (Item)\n}\n")
+		config := `{"roots":{"common":{"path":"../../shared","version":"1.0.0"}}}`
+		writeFile(t, filepath.Join(dir, "api/omni.imports.json"), config)
+		spec, err := Parse(entry)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(spec.Sources) != 2 || len(spec.SourcePaths) != 2 {
+			t.Fatalf("%+v", spec)
+		}
+		pin := sharedHash(spec.Sources, "common")
+		config = strings.Replace(config, `"version":"1.0.0"`, `"version":"1.0.0","sha256":"`+pin+`"`, 1)
+		writeFile(t, filepath.Join(dir, "api/omni.imports.json"), config)
+		o := Options{Dir: dir, API: entry, Module: "example.com/" + service, FrameworkDir: frameworkRoot(t)}
+		if _, err = Generate(o); err != nil {
+			t.Fatal(err)
+		}
+		o.Check = true
+		if _, err = Generate(o); err != nil {
+			t.Fatal(err)
+		}
+		if _, err = os.Stat(filepath.Join(dir, "api/@common")); !os.IsNotExist(err) {
+			t.Fatal("shared contract copied into service")
+		}
+		document := readFile(t, filepath.Join(dir, "docs/openapi.json"))
+		if !strings.Contains(document, pin) || !strings.Contains(document, "@common/response.api") {
+			t.Fatal("missing provenance")
+		}
+		writeFile(t, filepath.Join(dir, "api/omni.imports.json"), strings.Replace(config, pin, strings.Repeat("0", 64), 1))
+		if _, err = Parse(entry); err == nil {
+			t.Fatal("checksum mismatch accepted")
+		}
+	}
+	// An undeclared alias, traversal, symlink escape and cycle are all rejected.
+	for _, imp := range []string{"@missing/response.api", "@common/../outside.api", "../shared/response.api", "@common/escape.api", "@common/cycle.api"} {
+		local := filepath.Join(root, "consumer")
+		writeFile(t, filepath.Join(local, "omni.imports.json"), `{"roots":{"common":{"path":"../shared"}}}`)
+		writeFile(t, filepath.Join(root, "outside.api"), "type Outside {}\n")
+		_ = os.Symlink(filepath.Join(root, "outside.api"), filepath.Join(shared, "escape.api"))
+		writeFile(t, filepath.Join(shared, "cycle.api"), "import \"cycle.api\"\n")
+		entry := filepath.Join(local, "service.api")
+		writeFile(t, entry, "import "+strconvQuote(imp)+"\nservice demo{\n@handler get\nget /get\n}\n")
+		if _, err := Parse(entry); err == nil {
+			t.Fatal("unsafe import accepted", imp)
+		}
+	}
+}
+func strconvQuote(value string) string { data, _ := json.Marshal(value); return string(data) }
+func TestCatalogDocumentExportDoesNotGenerateRuntimeRegistry(t *testing.T) {
+	dir := t.TempDir()
+	entry := filepath.Join(dir, "service.api")
+	writeFile(t, entry, "@app(defaultResponse: Common)\nresponse Common(codeType: int32; successCode: 0; errorCode: 9999; messageField: msg; dataMode: always)\nservice demo{\n@handler get\nget /get returns (null)\n}\n")
+	var exported bytes.Buffer
+	err := apierrors.ExportCatalog(&exported, apierrors.Catalog{DefaultStatus: 200, Definitions: map[string]apierrors.Definition{"TOO_LONG": {Code: 400002, Message: "{label}不能超过{max}个字符", Params: []apierrors.Parameter{{Name: "label", Type: "string", Example: "企业名称"}, {Name: "max", Type: "int", Example: 100}}}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	writeFile(t, filepath.Join(dir, "omni.errors.json"), exported.String())
+	spec, err := Parse(entry)
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, err := Compile(spec)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(c.Spec.Errors) != 0 || !strings.Contains(string(c.Document), "企业名称不能超过100个字符") {
+		t.Fatal(string(c.Document))
+	}
+	target := filepath.Join(t.TempDir(), "catalog")
+	if _, err = Generate(Options{Dir: target, API: entry, Module: "example.com/catalog", FrameworkDir: frameworkRoot(t)}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = os.Stat(filepath.Join(target, "internal/apierrors/errorsGen.go")); !os.IsNotExist(err) {
+		t.Fatal("document metadata became a runtime error registry")
+	}
+}

cmd/go-omni/apigen/startup.go

@@ -0,0 +1,71 @@
+package apigen
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+func appSource(o Options, spec *Spec) string {
+	source := fmt.Sprintf(`package handler
+import (
+ "fmt"
+ omni %q
+ %q
+ %q
+ %q
+ %q
+)
+// NewApp is generated HTTP composition. The caller owns deps and its logger.
+func NewApp(deps *svc.ServiceContext)(*omni.App,error){
+ if deps==nil || deps.Lifecycle==nil{return nil,fmt.Errorf("service context and lifecycle controller required; see PROJECT.md upgrade instructions")}
+ cfg:=deps.Config.Server
+ cfg.LogInstance=deps.Logger
+ for _,option:=range deps.AppOptions(){if option!=nil{option(&cfg)}}
+`, frameworkModule, frameworkModule+"/httpx", frameworkModule+"/config", frameworkModule+"/health", o.Module+"/internal/svc")
+	source += fmt.Sprintf("cfg.Request=contract.MergePolicy(cfg.Request,%#v)\n", spec.RequestPolicy)
+	source = strings.Replace(source, "\"fmt\"", "\"fmt\";"+fmt.Sprintf("%q", frameworkModule+"/contract"), 1)
+	if spec.DefaultResponse != "" {
+		for _, r := range spec.Responses {
+			if r.Name == spec.DefaultResponse {
+				data, _ := json.Marshal(r.Config)
+				source += fmt.Sprintf("cfg.Response=newResponseTemplate(%q).Config();cfg.ResponseEncoder=nil\n", string(data))
+			}
+		}
+	}
+	source += "if err:=cfg.Validate();err!=nil{return nil,err}\n"
+	source += "if err:=cfg.Endpoints.ValidateRoutes([]config.EndpointRoute{\n"
+	for _, route := range spec.Routes {
+		source += fmt.Sprintf("{Method:%q,Path:%q},\n", route.Method, route.Path)
+	}
+	if o.Storage == "local" {
+		source += "{Method: \"GET\",Path: \"/storage/object\"},\n"
+	}
+	source += `}...);err!=nil{return nil,err}
+ if (cfg.Endpoints.Liveness.Enabled || cfg.Endpoints.Readiness.Enabled) && deps.Health==nil{return nil,fmt.Errorf("enabled health endpoints require a checker")}
+ app:=omni.New(omni.WithConfig(cfg))
+ app.Use(deps.GlobalMiddleware()...)
+ if err:=RegisterRoutes(app,deps);err!=nil{_ = app.Close();return nil,err}
+ if cfg.Endpoints.OpenAPI.Enabled{app.GET(cfg.Endpoints.OpenAPI.Path,OpenAPI)}
+ if cfg.Endpoints.Liveness.Enabled{
+  var options []health.HandlerOption
+  if cfg.Endpoints.Liveness.ResponseMode=="raw"{options=append(options,health.WithRawResponse())}
+  app.GET(cfg.Endpoints.Liveness.Path,deps.Health.LivenessHandler(options...))
+ }
+ if cfg.Endpoints.Readiness.Enabled{
+  options:=[]health.HandlerOption{health.WithShutdownContext(deps.Lifecycle.Context())}
+  if cfg.Endpoints.Readiness.ResponseMode=="raw"{options=append(options,health.WithRawResponse())}
+  app.GET(cfg.Endpoints.Readiness.Path,deps.Health.ReadinessHandler(options...))
+ }
+`
+	if o.Storage == "local" {
+		source += `if deps.FileHTTP==nil{return nil,fmt.Errorf("local storage handler required")}
+ for _,method:=range []string{"GET","HEAD","PUT"}{app.Handle(method,"/storage/object",httpx.WrapHandler(deps.FileHTTP))}
+`
+	}
+	source += "return app,nil\n}\n"
+	if o.Storage != "local" {
+		source = strings.Replace(source, fmt.Sprintf("%q", frameworkModule+"/httpx"), "", 1)
+	}
+	return source
+}

cmd/go-omni/apigen/templates.go

@@ -3,7 +3,7 @@ package apigen
 import "fmt"
 
 var baseTemplates = map[string]string{
-	"cmd/server/main.go": `package main
+	"main.go": `package main
 import (
  "context"
  "errors"
@@ -12,35 +12,33 @@ import (
  "os"
  "os/signal"
  "syscall"
- omni "git.yuntuo.hk/k2safe/go-omni"
  "git.yuntuo.hk/k2safe/go-omni/logx"
+ "git.yuntuo.hk/k2safe/go-omni/lifecycle"
+ "MODULE/internal/config"
  "MODULE/internal/handler"
- "MODULE/internal/servicecontext"
- "MODULE/internal/settings"
+ "MODULE/internal/svc"
 )
 func main(){
  path:=flag.String("config","etc/config.yaml","configuration file; empty uses defaults and environment")
  flag.Parse()
- if err:=run(*path);err!=nil{log.Fatal(err)}
-}
-func run(path string)(runErr error){
  ctx,stop:=signal.NotifyContext(context.Background(),os.Interrupt,syscall.SIGTERM)
  defer stop()
- cfg,err:=settings.Load(path);if err!=nil{return err}
+ if err:=run(ctx,*path);err!=nil{log.Fatal(err)}
+}
+func run(ctx context.Context,path string)(runErr error){
+ cfg,err:=config.Load(path);if err!=nil{return err}
  logger,err:=logx.New(cfg.Server.Log);if err!=nil{return err}
- defer func(){runErr=errors.Join(runErr,logger.Close())}()
- logx.SetDefault(logger)
- deps,err:=servicecontext.New(ctx,logger,cfg);if err!=nil{return err}
- defer func(){runErr=errors.Join(runErr,deps.Close())}()
- app:=omni.New(omni.WithConfig(cfg.Server))
- app.OnShutdown(logger.Close)
- app.OnShutdown(deps.Close)
- if err=handler.RegisterRoutes(app,deps);err!=nil{return err}
- app.GET("/openapi.json",handler.OpenAPI)
- app.GET("/health/live",deps.Health.LivenessHandler())
- app.GET("/health/ready",deps.Health.ReadinessHandler())
- logger.InfoContext(ctx,"service.starting","address",cfg.Server.Address)
- return app.RunContext(ctx,cfg.Server.Address)
+ // Unjoined background work may still log. The owning process exits on this
+ // error; do not close its borrowed logger before that work has finished.
+ defer func(){if !errors.Is(runErr,lifecycle.ErrResourcesRetained){runErr=errors.Join(runErr,logger.Close())}}()
+ deps,err:=svc.New(ctx,logger,cfg);if err!=nil{return err}
+ // RunContext drains HTTP requests before returning. This scope owns dependencies
+ // and closes them exactly once, before closing the borrowed logger.
+ defer func(){runErr=deps.Finish(runErr)}()
+ app,err:=handler.NewApp(deps);if err!=nil{return err}
+ defer func(){runErr=errors.Join(runErr,app.Close())}()
+ logger.InfoContext(ctx,"service.starting","address",app.Config().Address)
+ return app.RunContext(deps.Lifecycle.Context())
 }
 `,
 	".gitignore": "/server\n/var/\n.env\n.env.*\n!.env.example\n/.goOmni/api.lock\n",
@@ -51,16 +49,21 @@ func projectREADME(module, entry string) string {
 
 This project is generated from an editable API contract. Business code uses
 standard context.Context; generated HTTP handlers use Omni's transport-neutral httpx.
+main.go and HTTP composition are continuously generator-owned.
 
 ## Run
 
 `+"```sh"+`
 go mod tidy
-go run ./cmd/server
+go run .
 `+"```"+`
 
 GET /health/live and /health/ready check the running service. GET /openapi.json
 serves the same document as docs/openapi.json. Bind address defaults to localhost.
+Configure server.endpoints to disable or move each built-in route. Health
+responseMode is app by default (project format), or raw for plain health data.
+Probe HTTP statuses remain 200/503 even when business errors use HTTP 200.
+OpenAPI remains an unwrapped document; disabled endpoints reserve no paths.
 Set GO_OMNI_TRANSPORT=native to select the native transport without changing services.
 The greeting starter works immediately; other new operation stubs return 501 until
 their business logic is implemented. Authentication hooks also fail closed with 501.
@@ -71,16 +74,21 @@ their business logic is implemented. Authentication hooks also fail closed with
 2. Run the same go-omni CLI version as the framework dependency:
 
 `+"```sh"+`
-go-omni api validate --api %s
-go-omni api generate --api %s --dir .
-go-omni api generate --api %s --dir . --check
+go-omni api validate
+go-omni api inspect
+go-omni api generate --dry-run
+go-omni api generate
+go-omni api generate --check
+go-omni api export > openapi.json
 go test ./...
 `+"```"+`
 
+Commands inside a generated project discover the recorded API entry automatically.
+--dry-run previews create/update/remove actions without writing files.
 The --check command is read-only and suitable for CI. It fails on stale or missing
-generated files and missing business scaffolds. go.mod, configuration, main,
-Service, Repository, servicecontext, middleware hook bodies and API files are
-created once and then preserved byte for byte. Gen.go files and OpenAPI are owned
+generated files and missing business scaffolds. go.mod, configuration, Logic,
+Repository, svc, middleware hook bodies and API files are created once and then
+preserved byte for byte. main.go, Gen.go files and OpenAPI are owned
 by the generator; manual edits cause a conflict instead of being overwritten.
 Commit .goOmni/apiManifest.json alongside the generated files. Do not edit it.
 Avoid editing files while generation is running; api.lock serializes generators.
@@ -90,29 +98,68 @@ business files remain: remove/adapt obsolete implementations explicitly if an
 API change makes their old types or signatures fail to compile. Every regeneration
 must be followed by go test ./... . Do not delete service files to change contracts.
 
+Generation compares the last saved contract with the new one and reports affected
+Logic files, including nested DTO field/tag changes and streaming/body changes.
+REVIEW notices require a business review. ERROR diagnostics identify definite
+Logic signature, syntax or duplicate-method problems. Generation preserves
+business code and still writes valid generated output; fix those methods next.
+--check fails on definite Logic errors even after generated files are current.
+Import aliases, parameter names and moved methods within a group are supported.
+Project type aliases, embedded methods or build tags may need compiler verification
+and produce REVIEW notices. This source scan does not execute project code or
+replace go test ./... . Snapshot-based REVIEW notices describe changes since the
+last successful generation; they do not persist as an acknowledgement checklist.
+
+## Contract tools
+
+api format [--check] preserves comments and normalizes indentation. api upgrade
+previews changed infrastructure; --apply only replaces recognized prior seeds.
+Use @request policy overrides and @app(request: {...}) for query/JSON strictness.
+Explicitly exported api/omni.errors.json documents the Go-owned error catalog;
+the CLI never executes project Go. omni.imports.json permits named shared roots;
+workspace format/generate/check processes explicitly listed independent services.
+Full reference: https://git.yuntuo.hk/k2safe/go-omni/src/branch/main/DEVELOPMENT.md
+
 ## Layout
 
 `+"```text"+`
 api/                         # editable contract and imported types
-cmd/server/main.go           # startup, lifecycle and route registration
+main.go                      # GENERATED startup, lifecycle and route registration
 etc/config.yaml              # lowerCamelCase configuration
-internal/settings/           # defaults -> file -> environment
-internal/servicecontext/     # dependency initialization and cleanup
-internal/types/typesGen.go    # generated request/response types
-internal/handler/<group>/     # generated binding and service adapters
-internal/service/<group>/     # developer-owned business operations
+internal/config/             # defaults -> file -> environment
+internal/svc/                # dependency initialization and cleanup
+internal/types/*Gen.go        # DTOs split by source API, one types package
+internal/svc/runtimeGen.go    # GENERATED lifecycle and infrastructure startup
+internal/apierrors/errorsGen.go # generated fresh error constructors, when declared
+internal/handler/<group>/     # generated binding and Logic adapters
+internal/logic/<group>/      # developer-owned business operations
 internal/repository/<group>/  # developer-owned persistence contracts
 internal/middleware/         # named hooks and generated registry
 docs/openapi.json             # generated OpenAPI 3.0.3
 .goOmni/apiManifest.json      # ownership and content hashes
 `+"```"+`
 
-The API response describes data only. Omni adds code, message and requestId.
-Do not define the envelope again in each response. Handlers reject nil successful
-responses. Body DTOs use application/json and have a 1 MiB limit by default.
-Use contract.Binder.Bind's optional limit in a custom adapter for larger payloads.
+The API response type describes business data. Declare response Name (...) and
+select the App default with @app(defaultResponse: Name) in the entry API.
+@server(response: Name) and @response Name override it for groups/routes;
+@response raw returns the business JSON directly. Without a template, the default
+envelope includes code, message, data and requestId. Generated routes and OpenAPI
+use the same contract. 404/405 and ordinary App routes use the declared App default.
+No template is selected by declaration/import order. Without @app, existing framework
+response defaults apply. An explicit API App default takes precedence over response
+options in svc, keeping generated routes and OpenAPI consistent.
+Object responses reject nil; []DTO maps nil to []; *DTO permits null; returns(null) is a successful null value. No returns means 204. Body DTOs use application/json and have a 1 MiB limit by default.
+Use @body(maxBytes: ...) for route limits. @body(mode: raw|multipart; maxBytes: ...)
+adds a *httpx.Body argument to Logic, without handwritten handlers. Raw is the exact
+limited request stream; Parts supports sequential multipart reading with no temp files.
+@produces "application/octet-stream" (or another concrete media type) generates a
+Logic result of *httpx.Stream; the handler closes Content and streams it unwrapped.
+Signature verification and storage policy belong to Logic/middleware. A consumed
+request stream cannot be reread automatically; use one reader owner or explicitly
+bounded buffering. Stream reads respect configured server timeouts. Declare multipart/multipartJSON/file DTO fields for validated uploads; without those fields the existing streaming Body is passed. form tags remain URL query parameters. The optional manual
+handler/custom binder hooks are preserved, and are needed only for custom protocols.
 
-Fields require exactly one source tag: json, path, form (URL query only), header.
+Fields require one source tag: json, path, form (URL query), header, multipart, multipartJSON or file. Multipart fields select full automatic binding before Logic; File/[]File are request-scoped disk-backed uploads. Use File.Open to stream them; generated cleanup owns their lifetime.
 All are required by presence unless optional, omitempty or default is specified.
 Zero and false are valid present values; binding:"required" rejects scalar zero.
 Use *T with optional when business logic needs to distinguish missing from zero.
@@ -123,15 +170,54 @@ and binding compiler. Responses are expected to honor their declared constraints
 they are not validated on every response. Do not return nil slices/maps for a
 non-nullable collection (initialize empty collections instead).
 
+Go-owned errors can be registered once through svc.ServiceContext.AppOptions with
+omni.WithErrors(projecterrors.Catalog()). Generated routes inherit them unless they
+declare an independent catalog. Do not repeat Go-owned errors in the API contract.
+Alternatively, declare public business errors in error (...) and reference them with @errors.
+Use internal/apierrors constructors to share status, code and message with OpenAPI.
+Auth declarations connect a bearer/header/cookie scheme to a real named middleware.
+The selected auth runs first; @auth none removes inherited declarative auth.
+Validation policy remains in the middleware implementation. Public messages must
+not contain secrets; error causes may be included in server logs.
+
+Generated svc.New receives Config and a borrowed Logger. Add dependencies in svc.Init,
+then immediately register each cleanup with OnClose. A later initialization failure
+runs registered cleanups in reverse order. Close is idempotent. GlobalMiddleware
+provides global hooks; Middlewares supplies named API hooks. AppOptions is evaluated
+once before route registration; logging is configured earlier through Config.
+The generated main runs HTTP draining, all OnStop hooks, all OnDrain hooks, resource
+OnClose callbacks, then logger close. Stop/drain hooks within a phase run concurrently;
+combine components with ordering dependencies into one pair. Pair OnStop/OnDrain
+with the same name. OnDrain returns nil only after final work and acknowledgements
+have finished. Use WorkContext for accepted background work; Context is an early
+shutdown notification. server.lifecycle configures stopTimeout (5s), drainTimeout
+(10s), and cancelTimeout (5s grace per timed-out phase). Zero uses defaults.
+Timeout/failure cancels WorkContext. If hooks cannot prove completion, resources
+and the borrowed logger are retained and the generated process exits unsuccessfully.
+Errors retain their causes. No automatic retry of close or force killing of goroutines.
+Do not close borrowed resources or attach duplicate cleanup hooks to App. The startup
+context cancels on signals; long-lived clients/workers that requests depend on need
+their own lifetime, canceled by OnClose after HTTP draining.
+
+svc.RequestShutdown(err) lets a dependency report a fatal service failure.
+It returns immediately. Generated main stops accepting requests, drains them,
+closes dependencies and logs, then exits nonzero with the original cause.
+nil requests a normal stop. Concurrent calls keep the first non-nil failure;
+notifications during initialization or draining are retained. Close must stop
+and join project-owned monitors before the final shutdown result is returned.
+The svc lifecycle context signals draining, not permission to close resources
+still used by active requests. Liveness and readiness are different: shutdown
+makes readiness 503; it does not turn a running process's liveness into failure.
+
 Named middleware is composed in declaration order (first is outermost). Implement
-the generated hooks or replace entries in servicecontext; never bypass an auth
+the generated hooks or replace entries in svc; never bypass an auth
 hook merely to make the server start. Middleware names do not imply a JWT policy.
 
 This CLI supports a documented go-zero-style subset, not all goctl features.
 Database tables and repositories cannot be inferred from an HTTP contract. Add
-business repositories through servicecontext. Database and storage options are
+business repositories through svc. Database and storage options are
 composed at creation; the original profile is retained on regeneration.
-`, module, entry, entry, entry, entry)
+`, module, entry)
 }
 
 func infrastructureREADME(o Options) string {
@@ -140,7 +226,7 @@ func infrastructureREADME(o Options) string {
 
 Selected database: %s; storage: %s; logging: %s/%s.
 MySQL uses database/sql through deps.DB, including InTx and a readiness probe.
-Set GO_OMNI_DB_DSN; pool settings live in etc/config.yaml and GO_OMNI_DB_*.
+Use structured database/mysql configuration and GO_OMNI_DB_PASSWORD. Other connection/pool/TLS settings live in etc/config.yaml and GO_OMNI_DB_*.
 No tables are invented or migrated automatically from request/response DTOs.
 The none/memory selection opens no database; implement repositories per business.
 

cmd/go-omni/apigen/testdata/arrays/consumer_test.go

@@ -0,0 +1,54 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"example.com/arrays/internal/config"
+	"example.com/arrays/internal/handler"
+	"example.com/arrays/internal/svc"
+	"git.yuntuo.hk/k2safe/go-omni/logx"
+	"io"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestArrayWire(t *testing.T) {
+	cfg := config.Default()
+	cfg.Server.Log.Writer = io.Discard
+	logger, err := logx.New(cfg.Server.Log)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer logger.Close()
+	deps, err := svc.New(context.Background(), logger, cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer deps.Close()
+	app, err := handler.NewApp(deps)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Close()
+	for path, want := range map[string]string{
+		"/strings": `["企业","备注"]`, "/integers": `[9223372036854775807,-3]`, "/dynamic": `["text",7,true,null,{"name":"企业"},[false,2]]`, "/empty": `[]`, "/raw": `[true,false]`,
+	} {
+		w := httptest.NewRecorder()
+		app.ServeHTTP(w, httptest.NewRequest("GET", path, nil))
+		got := strings.TrimSpace(w.Body.String())
+		if w.Code != 200 {
+			t.Fatal(got)
+		}
+		if path != "/raw" {
+			var obj map[string]json.RawMessage
+			if err := json.Unmarshal(w.Body.Bytes(), &obj); err != nil {
+				t.Fatal(err)
+			}
+			got = string(obj["data"])
+		}
+		if got != want {
+			t.Fatalf("%s got %s want %s", path, got, want)
+		}
+	}
+}

cmd/go-omni/apigen/testdata/arrays/values.go

@@ -0,0 +1,13 @@
+package arrays
+
+import "context"
+
+func (s *Logic) Strings(context.Context) ([]string, error) { return []string{"企业", "备注"}, nil }
+func (s *Logic) Integers(context.Context) ([]int64, error) {
+	return []int64{9223372036854775807, -3}, nil
+}
+func (s *Logic) Dynamic(context.Context) ([]any, error) {
+	return []any{"text", 7, true, nil, map[string]any{"name": "企业"}, []any{false, 2}}, nil
+}
+func (s *Logic) Empty(context.Context) ([]any, error) { return nil, nil }
+func (s *Logic) Raw(context.Context) ([]bool, error)  { return []bool{true, false}, nil }

cmd/go-omni/apigen/testdata/business/accessFactory.go

@@ -0,0 +1,22 @@
+package middleware
+
+import (
+	"context"
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+)
+
+// This package deliberately imports no svc; the dependency is supplied explicitly.
+type AccessChecker interface {
+	CheckAccess(context.Context, string) error
+}
+
+func NewRequireAccess(checker AccessChecker) httpx.Middleware {
+	return func(next httpx.Handler) httpx.Handler {
+		return func(c *httpx.Context) error {
+			if err := checker.CheckAccess(c.Context(), c.Header("Authorization")); err != nil {
+				return err
+			}
+			return next(c)
+		}
+	}
+}

cmd/go-omni/apigen/testdata/business/client.go

@@ -0,0 +1,32 @@
+package svc
+
+import (
+	"context"
+	"example.com/business/internal/middleware"
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+	"sync/atomic"
+)
+
+// A local fixture checks wiring; production authentication is project-owned.
+type accessClient struct{ closed atomic.Bool }
+
+func (c *accessClient) Close() error { c.closed.Store(true); return nil }
+func (c *accessClient) CheckAccess(ctx context.Context, token string) error {
+	if c.closed.Load() {
+		return apierrors.New(503, "CLOSED", "closed")
+	}
+	if httpx.Metadata(ctx).Route == "" {
+		return apierrors.New(500, "NO_METADATA", "missing route")
+	}
+	if token == "reject" {
+		return apierrors.New(403, "DENIED", "denied")
+	}
+	return nil
+}
+func (c *ServiceContext) initAccess(ctx context.Context) error {
+	c.Client = &accessClient{}
+	c.OnClose(c.Client.Close)
+	c.Middlewares["RequireAccess"] = middleware.NewRequireAccess(c.Client)
+	return nil
+}

cmd/go-omni/apigen/testdata/business/consumer_test.go

@@ -0,0 +1,119 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"example.com/business/internal/config"
+	"example.com/business/internal/handler"
+	"example.com/business/internal/svc"
+	"git.yuntuo.hk/k2safe/go-omni/logx"
+	"io"
+	"mime/multipart"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestShapesAndPolicy(t *testing.T) {
+	cfg := config.Default()
+	cfg.Server.Log.Writer = io.Discard
+	logger, err := logx.New(cfg.Server.Log)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer logger.Close()
+	deps, err := svc.New(context.Background(), logger, cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer deps.Close()
+	app, err := handler.NewApp(deps)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Close()
+	for _, tt := range []struct {
+		method, path, body, media string
+		status                    int
+		data                      string
+		raw                       bool
+	}{
+		{"GET", "/list", "", "", 200, `[]`, false},
+		{"GET", "/list?mode=full&tags=a&tags=b", "", "", 200, `[{"name":"one"}]`, false},
+		{"GET", "/nullable", "", "", 200, `null`, false},
+		{"GET", "/nullable?mode=full", "", "", 200, `{"name":"one"}`, false},
+		{"POST", "/nothing", "", "", 200, `null`, false},
+		{"GET", "/rawNull", "", "", 200, `null`, true},
+		{"GET", "/rawArray", "", "", 200, `[]`, true},
+		{"DELETE", "/noContent", "", "", 204, "", true},
+		{"POST", "/empty", `{}`, "application/json", 200, `null`, false},
+		{"POST", "/empty", ``, "application/json", 400, "", false},
+		{"POST", "/empty", `{"unknown":1}`, "application/json", 400, "", false},
+		{"POST", "/absent", ``, "", 200, `null`, false},
+		{"POST", "/absent", `{}`, "application/json", 400, "", false},
+		{"POST", "/optional", ``, "", 200, `{"name":""}`, false},
+		{"POST", "/optional", `{}`, "application/json", 400, "", false},
+		{"POST", "/echo", `{"name":"ok"}`, "application/json", 200, `{"name":"ok"}`, false},
+		{"POST", "/echo", `{"name":"ok"}`, "application/json; charset=latin1", 415, "", false},
+		{"POST", "/echo", "{\"name\":\"\xff\"}", "application/json", 400, "", false},
+		{"GET", "/list?unknown=1", "", "", 400, "", false},
+		{"GET", "/rawNull?unknown=1", "", "", 400, "", false},
+		{"POST", "/tolerant?unknown=1", "{\"name\":\"\xff\"}", "application/json; charset=latin1", 200, `{"name":"<22>"}`, false},
+	} {
+		t.Run(tt.method+tt.path+tt.body+tt.media, func(t *testing.T) {
+			r := httptest.NewRequest(tt.method, tt.path, strings.NewReader(tt.body))
+			if tt.media != "" {
+				r.Header.Set("Content-Type", tt.media)
+			}
+			w := httptest.NewRecorder()
+			app.ServeHTTP(w, r)
+			if w.Code != tt.status {
+				t.Fatalf("%d %s", w.Code, w.Body)
+			}
+			if tt.status >= 400 {
+				return
+			}
+			data := strings.TrimSpace(w.Body.String())
+			if !tt.raw {
+				var obj map[string]json.RawMessage
+				if err := json.Unmarshal(w.Body.Bytes(), &obj); err != nil {
+					t.Fatal(err)
+				}
+				v, ok := obj["data"]
+				if !ok {
+					t.Fatal("missing data")
+				}
+				data = string(v)
+			}
+			if data != tt.data {
+				t.Fatalf("data %s expected %s", data, tt.data)
+			}
+		})
+	}
+	var body bytes.Buffer
+	form := multipart.NewWriter(&body)
+	_ = form.WriteField("title", "title")
+	_ = form.WriteField("metadata", `{"name":"meta"}`)
+	f, err := form.CreateFormFile("attachment", "a.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = io.WriteString(f, "content")
+	_ = form.Close()
+	r := httptest.NewRequest("POST", "/upload", &body)
+	r.Header.Set("Content-Type", form.FormDataContentType())
+	w := httptest.NewRecorder()
+	app.ServeHTTP(w, r)
+	if w.Code != 200 || !strings.Contains(w.Body.String(), "title:meta:content") {
+		t.Fatal(w.Code, w.Body.String())
+	}
+	denied := httptest.NewRequest("GET", "/list", nil)
+	denied.Header.Set("Authorization", "reject")
+	result := httptest.NewRecorder()
+	app.ServeHTTP(result, denied)
+	if result.Code != 403 {
+		t.Fatal("injected middleware did not run", result.Code, result.Body.String())
+	}
+
+}

cmd/go-omni/apigen/testdata/business/operations.go

@@ -0,0 +1,42 @@
+package demo
+
+import (
+	"context"
+	"example.com/business/internal/types"
+	"io"
+)
+
+func (s *Logic) List(ctx context.Context, req *types.Query) ([]types.Item, error) {
+	if req.Mode == "full" {
+		return []types.Item{{Name: "one"}}, nil
+	}
+	return nil, nil
+}
+func (s *Logic) Nullable(ctx context.Context, req *types.Query) (*types.Item, error) {
+	if req.Mode == "full" {
+		return &types.Item{Name: "one"}, nil
+	}
+	return nil, nil
+}
+func (s *Logic) Nothing(ctx context.Context) error                                  { return nil }
+func (s *Logic) RawNull(ctx context.Context) error                                  { return nil }
+func (s *Logic) RawArray(ctx context.Context) ([]types.Item, error)                 { return nil, nil }
+func (s *Logic) Empty(ctx context.Context) error                                    { return nil }
+func (s *Logic) Absent(ctx context.Context) error                                   { return nil }
+func (s *Logic) Optional(ctx context.Context, req *types.Item) (*types.Item, error) { return req, nil }
+func (s *Logic) Echo(ctx context.Context, req *types.Item) (*types.Item, error)     { return req, nil }
+func (s *Logic) Tolerant(ctx context.Context, req *types.Item) (*types.Item, error) { return req, nil }
+func (s *Logic) NoContent(ctx context.Context) error                                { return nil }
+
+func (s *Logic) Upload(ctx context.Context, req *types.Upload) (*types.Item, error) {
+	f, err := req.Attachment.Open()
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+	data, err := io.ReadAll(f)
+	if err != nil {
+		return nil, err
+	}
+	return &types.Item{Name: req.Title + ":" + req.Metadata.Name + ":" + string(data)}, nil
+}

cmd/go-omni/apigen/testdata/compatibility/consumer_test.go

@@ -0,0 +1,117 @@
+package main_test
+
+import (
+	"bytes"
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"example.com/compatibility/internal/handler"
+	"example.com/compatibility/internal/svc"
+	omni "git.yuntuo.hk/k2safe/go-omni"
+	"git.yuntuo.hk/k2safe/go-omni/logx"
+	"io"
+	"mime/multipart"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestGeneratedCompatibility(t *testing.T) {
+	logger, err := logx.New(logx.Config{Writer: io.Discard})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer logger.Close()
+	deps, err := svc.New(context.Background(), logger)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer deps.Close()
+	app := omni.New()
+	defer app.Close()
+	if err = handler.RegisterRoutes(app, deps); err != nil {
+		t.Fatal(err)
+	}
+	send := func(method, path, body, contentType string) *httptest.ResponseRecorder {
+		r := httptest.NewRequest(method, path, strings.NewReader(body))
+		r.Header.Set("Content-Type", contentType)
+		w := httptest.NewRecorder()
+		app.ServeHTTP(w, r)
+		return w
+	}
+	for _, id := range []string{`9223372036854775807`, `"9223372036854775807"`} {
+		w := send("POST", "/echo", `{"id":`+id+`,"data":{"n":9223372036854775807}}`, "application/json")
+		if w.Code != 200 || !strings.Contains(w.Body.String(), `"id":"9223372036854775807"`) || !strings.Contains(w.Body.String(), `"n":9223372036854775807`) {
+			t.Fatalf("scalar/dynamic: %d %s", w.Code, w.Body)
+		}
+	}
+	for _, body := range []string{`{"id":true,"data":null}`, `{"id":9223372036854775808,"data":null}`, `{"id":1,"data":{"x":1,"x":2}}`, `{"id":1,"data":null,"extra":1}`} {
+		if w := send("POST", "/echo", body, "application/json"); w.Code != 400 {
+			t.Fatalf("accepted %s: %d", body, w.Code)
+		}
+	}
+	payload := `{"id":1,"data":"` + strings.Repeat("x", (1<<20)+1) + `"}`
+	if w := send("POST", "/echo", payload, "application/json"); w.Code != 200 {
+		t.Fatalf("route limit not passed to Binder: %d", w.Code)
+	}
+	if w := send("POST", "/echo", `{"id":1,"data":"`+strings.Repeat("x", 2<<20)+`"}`, "application/json"); w.Code != 413 {
+		t.Fatalf("large JSON: %d", w.Code)
+	}
+	if w := send("GET", "/items/9223372036854775807", "", ""); w.Code != 200 || !strings.Contains(w.Body.String(), `"id":"9223372036854775807"`) {
+		t.Fatalf("text scalar: %d %s", w.Code, w.Body)
+	}
+	if w := send("POST", "/custom", `{"value":"hello"}`, "application/json"); w.Code != 200 || !strings.Contains(w.Body.String(), "HELLO") {
+		t.Fatalf("custom binder: %d %s", w.Code, w.Body)
+	}
+	raw := `{ "event": 1, "id": "original bytes" }`
+	mac := hmac.New(sha256.New, []byte("fixture-only-key"))
+	mac.Write([]byte(raw))
+	r := httptest.NewRequest("POST", "/callback", strings.NewReader(raw))
+	r.Header.Set("X-Signature", hex.EncodeToString(mac.Sum(nil)))
+	w := httptest.NewRecorder()
+	app.ServeHTTP(w, r)
+	if w.Code != 200 || w.Body.String() != "accepted" {
+		t.Fatalf("raw callback: %d %s", w.Code, w.Body)
+	}
+	r = httptest.NewRequest("POST", "/callback", strings.NewReader(strings.Repeat("x", 129)))
+	r.ContentLength = -1
+	w = httptest.NewRecorder()
+	app.ServeHTTP(w, r)
+	if w.Code != 413 {
+		t.Fatalf("chunked body limit: %d %s", w.Code, w.Body)
+	}
+	temp := t.TempDir()
+	t.Setenv("TMPDIR", temp)
+	var form bytes.Buffer
+	writer := multipart.NewWriter(&form)
+	part, err := writer.CreateFormFile("file", "sample.bin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	part.Write(bytes.Repeat([]byte("x"), 8192))
+	writer.Close()
+	w = send("POST", "/upload", form.String(), writer.FormDataContentType())
+	if w.Code != 200 || !strings.Contains(w.Body.String(), `"bytes":8192`) {
+		t.Fatalf("upload: %d %s", w.Code, w.Body)
+	}
+	entries, err := os.ReadDir(temp)
+	if err != nil || len(entries) != 0 {
+		t.Fatalf("multipart temp files leaked: %v %v", entries, err)
+	}
+	w = send("GET", "/download", "", "")
+	if w.Code != 200 || w.Body.Len() != 128<<10 || w.Header().Get("Content-Disposition") == "" {
+		t.Fatalf("download wrapped: %d %d", w.Code, w.Body.Len())
+	}
+	var doc map[string]any
+	if err = json.Unmarshal([]byte(handler.OpenAPIDocument), &doc); err != nil {
+		t.Fatal(err)
+	}
+	paths := doc["paths"].(map[string]any)
+	media := paths["/download"].(map[string]any)["get"].(map[string]any)["responses"].(map[string]any)["200"].(map[string]any)["content"].(map[string]any)
+	if media["application/octet-stream"] == nil || media["application/json"] != nil {
+		t.Fatal("download schema is JSON")
+	}
+}

cmd/go-omni/apigen/testdata/compatibility/download.go

@@ -0,0 +1,16 @@
+package files
+
+import (
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+	"io"
+	"net/http"
+	"strings"
+)
+
+func (h *Handler) Download(c *httpx.Context) error {
+	return httpx.WrapHandler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/octet-stream")
+		w.Header().Set("Content-Disposition", `attachment; filename="demo.bin"`)
+		_, _ = io.Copy(w, strings.NewReader(strings.Repeat("x", 128<<10)))
+	}))(c)
+}

cmd/go-omni/apigen/testdata/compatibility/echo.go

@@ -0,0 +1,16 @@
+package demo
+
+import (
+	"context"
+	"example.com/compatibility/internal/types"
+)
+
+func (s *Logic) Echo(ctx context.Context, req *types.EchoReq) (*types.EchoResp, error) {
+	return &types.EchoResp{ID: req.ID, Data: req.Data}, nil
+}
+func (s *Logic) Item(ctx context.Context, req *types.ItemReq) (*types.EchoResp, error) {
+	return &types.EchoResp{ID: req.ID, Data: map[string]any{"found": true}}, nil
+}
+func (s *Logic) Custom(ctx context.Context, req *types.CustomReq) (*types.CustomResp, error) {
+	return &types.CustomResp{Value: req.Value}, nil
+}

cmd/go-omni/apigen/testdata/compatibility/hooks.go

@@ -0,0 +1,58 @@
+package demo
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"example.com/compatibility/internal/types"
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+	"io"
+	"net/http"
+	"strings"
+)
+
+func (h *Handler) bindCustom(c *httpx.Context, req *types.CustomReq) error {
+	decoder := json.NewDecoder(c.Request().Body)
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(req); err != nil {
+		return apierrors.BadRequest("INVALID_REQUEST", "invalid request").WithCause(err)
+	}
+	var extra any
+	if err := decoder.Decode(&extra); err != io.EOF {
+		return apierrors.BadRequest("INVALID_REQUEST", "one JSON value required").WithCause(err)
+	}
+	req.Value = strings.ToUpper(req.Value)
+	return nil
+}
+func (h *Handler) Upload(c *httpx.Context) error {
+	// The small memory threshold deliberately exercises disk spill and cleanup.
+	if err := c.Request().ParseMultipartForm(8); err != nil {
+		return err
+	}
+	file, _, err := c.Request().FormFile("file")
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	count, err := io.Copy(io.Discard, file)
+	if err != nil {
+		return err
+	}
+	return c.OK(map[string]any{"bytes": count})
+}
+func (h *Handler) Callback(c *httpx.Context) error {
+	raw, err := io.ReadAll(c.Request().Body)
+	if err != nil {
+		return err
+	}
+	// This fixed key belongs only to the test fixture. Applications inject secrets.
+	mac := hmac.New(sha256.New, []byte("fixture-only-key"))
+	mac.Write(raw)
+	signature, err := hex.DecodeString(c.Header("X-Signature"))
+	if err != nil || !hmac.Equal(signature, mac.Sum(nil)) {
+		return c.Text(http.StatusUnauthorized, "invalid signature")
+	}
+	return c.Text(http.StatusOK, "accepted")
+}

cmd/go-omni/apigen/testdata/errorCatalog/consumer_test.go

@@ -0,0 +1,92 @@
+package main_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"example.com/errorCatalog/internal/apierrors"
+	"example.com/errorCatalog/internal/handler"
+	"example.com/errorCatalog/internal/svc"
+	omni "git.yuntuo.hk/k2safe/go-omni"
+	omnierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+	"git.yuntuo.hk/k2safe/go-omni/logx"
+)
+
+func TestGeneratedCatalog(t *testing.T) {
+	first := apierrors.UsernameInvalid().WithCause(errors.New("private"))
+	second := apierrors.UsernameInvalid()
+	if first == second || second.Cause != nil || second.Status != 200 || second.BusinessCode != int64(400002) {
+		t.Fatal("shared or incomplete generated error")
+	}
+	copy := apierrors.Catalog()
+	delete(copy.Definitions, apierrors.CodeUsernameInvalid)
+	if len(apierrors.Catalog().Definitions) != 3 {
+		t.Fatal("shared catalog")
+	}
+	cfg := logx.Default()
+	cfg.Writer = io.Discard
+	logger, err := logx.New(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer logger.Close()
+	deps, err := svc.New(context.Background(), logger)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer deps.Close()
+	app := omni.New()
+	defer app.Close()
+	// Global middleware exits early: generated route policy must already be active.
+	app.Use(func(next httpx.Handler) httpx.Handler {
+		return func(c *httpx.Context) error {
+			switch c.Header("X-Fixture") {
+			case "username":
+				return omnierrors.ByCode(apierrors.CodeUsernameInvalid).WithCause(errors.New("private"))
+			case "password":
+				return apierrors.PasswordInvalid()
+			case "denied":
+				return apierrors.PermissionDenied()
+			case "unknown":
+				return omnierrors.ByCode("MISSING")
+			default:
+				return c.OK(map[string]string{"token": "ok"})
+			}
+		}
+	})
+	if err := handler.RegisterRoutes(app, deps); err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{"/token", "/raw"} {
+		for _, test := range []struct {
+			kind   string
+			status int
+			want   string
+		}{{"username", 200, "用户名格式不正确"}, {"password", 200, "密码格式不正确"}, {"denied", 403, "没有权限"}, {"unknown", 500, "internal server error"}, {"", 200, `"token":"ok"`}} {
+			method := "POST"
+			if path == "/raw" {
+				method = "GET"
+			}
+			w := httptest.NewRecorder()
+			r := httptest.NewRequest(method, path, nil)
+			r.Header.Set("X-Fixture", test.kind)
+			app.ServeHTTP(w, r)
+			if w.Code != test.status || !strings.Contains(w.Body.String(), test.want) || strings.Contains(w.Body.String(), "private") {
+				t.Fatal(path, test.kind, w.Code, w.Body.String())
+			}
+			if test.kind == "username" || test.kind == "password" {
+				if !strings.Contains(w.Body.String(), `"code":400002`) || !strings.Contains(w.Body.String(), `"ok":false`) {
+					t.Fatal(w.Body.String())
+				}
+			}
+			if path == "/raw" && test.kind == "" && strings.Contains(w.Body.String(), "code") {
+				t.Fatal("raw success wrapped")
+			}
+		}
+	}
+}

cmd/go-omni/apigen/testdata/errorInheritance/bounded.go

@@ -0,0 +1,13 @@
+package account
+
+import (
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+	"io"
+)
+
+func (h *Handler) Bounded(c *httpx.Context) error {
+	if _, err := io.Copy(io.Discard, c.Request().Body); err != nil {
+		return err
+	}
+	return c.Text(200, "ACK")
+}

cmd/go-omni/apigen/testdata/errorInheritance/consumer_test.go

@@ -0,0 +1,129 @@
+package main_test
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"example.com/errorCatalog/internal/handler"
+	"example.com/errorCatalog/internal/svc"
+	omni "git.yuntuo.hk/k2safe/go-omni"
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+	"git.yuntuo.hk/k2safe/go-omni/logx"
+	"git.yuntuo.hk/k2safe/go-omni/response"
+)
+
+func TestGoOwnedCatalogOnGeneratedRoutes(t *testing.T) {
+	catalog := apierrors.Catalog{DefaultStatus: 400, Definitions: map[string]apierrors.Definition{
+		"USERNAME_INVALID": {Code: 400002, Message: "用户名格式不正确"},
+		"TEXT_TOO_LONG":    {Status: 200, Code: 400003, Message: "{label}不能超过{max}个字符", Params: []apierrors.Parameter{{Name: "label", Type: "string"}, {Name: "max", Type: "int"}}},
+		"INTERNAL_ERROR":   {Status: 500, Code: 9999, Message: "系统错误"},
+		"BODY_TOO_LARGE":   {Status: 413, Code: 413001, Message: "请求体超限"},
+	}}
+	lc := logx.Default()
+	lc.Writer = io.Discard
+	logger, err := logx.New(lc)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer logger.Close()
+	deps, err := svc.New(context.Background(), logger)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer deps.Close()
+	format := response.Config{CodeType: "int32", SuccessCode: 0, ErrorCode: 9999, MessageField: "msg", DataMode: "always", RequestIDField: "-"}
+	app := omni.New(omni.WithErrors(catalog), omni.WithResponse(format))
+	defer app.Close()
+	resolve := func(c *httpx.Context) error {
+		switch c.Request().URL.Query().Get("kind") {
+		case "long":
+			return apierrors.ByCode("TEXT_TOO_LONG").WithParams(map[string]any{"label": "企业名称", "max": 100})
+		case "unknown":
+			return apierrors.ByCode("NOT_REGISTERED")
+		default:
+			return apierrors.ByCode("USERNAME_INVALID")
+		}
+	}
+	app.Use(func(next httpx.Handler) httpx.Handler {
+		return func(c *httpx.Context) error {
+			if c.Header("X-Early") == "true" {
+				return resolve(c)
+			}
+			return next(c)
+		}
+	})
+	app.GET("/ordinary", resolve)
+	if err := handler.RegisterRoutes(app, deps); err != nil {
+		t.Fatal(err)
+	}
+	// Explicit route policy stays independent of App errors and response fields.
+	local := apierrors.Catalog{Definitions: map[string]apierrors.Definition{"USERNAME_INVALID": {Status: 409, Code: 409001, Message: "路由提示"}}}
+	localFormat := format
+	localFormat.MessageField = "detail"
+	app.HandleWithResponse("GET", "/independent", response.MustWithErrors(local, response.MustNew(localFormat)), resolve)
+	for _, early := range []string{"false", "true"} {
+		for _, test := range []struct {
+			kind         string
+			status, code int
+			message      string
+		}{
+			{"invalid", 400, 400002, "用户名格式不正确"}, {"long", 200, 400003, "企业名称不能超过100个字符"}, {"unknown", 500, 9999, "系统错误"},
+		} {
+			var ordinary string
+			for _, path := range []string{"/ordinary", "/plain", "/raw", "/cleared"} {
+				r := httptest.NewRequest("GET", path+"?kind="+test.kind, nil)
+				r.Header.Set("X-Early", early)
+				w := httptest.NewRecorder()
+				app.ServeHTTP(w, r)
+				var body map[string]any
+				if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil {
+					t.Fatal(err, w.Body.String())
+				}
+				if w.Code != test.status || body["code"] != float64(test.code) || body["msg"] != test.message {
+					t.Fatal(path, early, w.Code, body)
+				}
+				if value, ok := body["data"]; !ok || value != nil {
+					t.Fatal("data:null missing", body)
+				}
+				if path == "/ordinary" {
+					ordinary = w.Body.String()
+				} else if w.Body.String() != ordinary {
+					t.Fatal("generated response differs", ordinary, w.Body.String())
+				}
+			}
+		}
+		r := httptest.NewRequest("GET", "/independent", nil)
+		r.Header.Set("X-Early", early)
+		w := httptest.NewRecorder()
+		app.ServeHTTP(w, r)
+		if w.Code != 409 || !strings.Contains(w.Body.String(), `"detail":"路由提示"`) || !strings.Contains(w.Body.String(), `"code":409001`) {
+			t.Fatal(w.Code, w.Body.String())
+		}
+	}
+	for _, path := range []string{"/plain", "/raw"} {
+		w := httptest.NewRecorder()
+		app.ServeHTTP(w, httptest.NewRequest("GET", path+"?kind=success", nil))
+		if w.Code != 200 || !strings.Contains(w.Body.String(), `"ok":true`) {
+			t.Fatal(w.Code, w.Body.String())
+		}
+		if path == "/raw" && strings.Contains(w.Body.String(), "code") {
+			t.Fatal("raw success wrapped")
+		}
+	}
+	for _, size := range []int{8, 65} {
+		w := httptest.NewRecorder()
+		app.ServeHTTP(w, httptest.NewRequest("POST", "/bounded", strings.NewReader(strings.Repeat("x", size))))
+		if size == 8 {
+			if w.Code != 200 || w.Body.String() != "ACK" {
+				t.Fatal(w.Code, w.Body.String())
+			}
+		} else if w.Code != 413 || !strings.Contains(w.Body.String(), "请求体超限") {
+			t.Fatal(w.Code, w.Body.String())
+		}
+	}
+}

cmd/go-omni/apigen/testdata/errorInheritance/emptyService.go

@@ -0,0 +1 @@
+package account

cmd/go-omni/apigen/testdata/errorInheritance/service.go

@@ -0,0 +1,29 @@
+package account
+
+import (
+	"context"
+	"example.com/errorCatalog/internal/types"
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+)
+
+func check(kind string) (*types.CheckResponse, error) {
+	switch kind {
+	case "success":
+		return &types.CheckResponse{OK: true}, nil
+	case "long":
+		return nil, apierrors.ByCode("TEXT_TOO_LONG").WithParams(map[string]any{"label": "企业名称", "max": 100})
+	case "unknown":
+		return nil, apierrors.ByCode("NOT_REGISTERED")
+	default:
+		return nil, apierrors.ByCode("USERNAME_INVALID")
+	}
+}
+func (s *Logic) Plain(ctx context.Context, req *types.CheckRequest) (*types.CheckResponse, error) {
+	return check(req.Kind)
+}
+func (s *Logic) Raw(ctx context.Context, req *types.CheckRequest) (*types.CheckResponse, error) {
+	return check(req.Kind)
+}
+func (s *Logic) Cleared(ctx context.Context, req *types.CheckRequest) (*types.CheckResponse, error) {
+	return check(req.Kind)
+}

cmd/go-omni/apigen/testdata/errorParams/consumer_test.go

@@ -0,0 +1,149 @@
+package main_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+
+	"example.com/errorCatalog/internal/apierrors"
+	"example.com/errorCatalog/internal/handler"
+	"example.com/errorCatalog/internal/svc"
+	omni "git.yuntuo.hk/k2safe/go-omni"
+	omnierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+	"git.yuntuo.hk/k2safe/go-omni/logx"
+)
+
+func TestGeneratedTemplateErrors(t *testing.T) {
+	var document map[string]any
+	if err := json.Unmarshal([]byte(handler.OpenAPIDocument), &document); err != nil {
+		t.Fatal(err)
+	}
+	operation := document["paths"].(map[string]any)["/token"].(map[string]any)["post"].(map[string]any)
+	media := operation["responses"].(map[string]any)["200"].(map[string]any)["content"].(map[string]any)["application/json"].(map[string]any)
+	example := media["examples"].(map[string]any)["TextTooLong"].(map[string]any)["value"].(map[string]any)
+	if example["msg"] != "企业名称不能超过100个字符" || example["code"] != float64(400002) {
+		t.Fatal(example)
+	}
+	if len(media["schema"].(map[string]any)["anyOf"].([]any)) != 2 {
+		t.Fatal("missing success/failure schema")
+	}
+	found := false
+	for _, raw := range document["x-omni-errors"].([]any) {
+		entry := raw.(map[string]any)
+		if entry["name"] == "TextTooLong" {
+			found = true
+			params := entry["params"].([]any)
+			if len(params) != 2 || params[0].(map[string]any)["type"] != "string" || params[1].(map[string]any)["type"] != "int" {
+				t.Fatal(params)
+			}
+		}
+	}
+	if !found {
+		t.Fatal("missing template metadata")
+	}
+	// Assigning to a typed function also verifies declaration order and Go types.
+	var typed func(string, int) *omnierrors.APIError = apierrors.TextTooLong
+	private := errors.New("private cause")
+	first := typed("企业名称", 100).WithCause(private)
+	second := typed("备注", 500)
+	if first.Message != "企业名称不能超过100个字符" || second.Message != "备注不能超过500个字符" || second.Cause != nil || !errors.Is(first, private) {
+		t.Fatal(first, second)
+	}
+	if apierrors.UsernameInvalid().Message != "用户名格式不正确" {
+		t.Fatal("fixed compatibility")
+	}
+	cat := apierrors.Catalog()
+	cat.Definitions["TEXT_TOO_LONG"].Params[0].Type = "bool"
+	if typed("企业名称", 100).Message != first.Message {
+		t.Fatal("mutable catalog")
+	}
+	var wg sync.WaitGroup
+	for n := 0; n < 40; n++ {
+		wg.Add(1)
+		go func(n int) {
+			defer wg.Done()
+			if n%2 == 0 {
+				if typed("企业名称", 100).Message != first.Message {
+					t.Error("isolation")
+				}
+			} else {
+				if typed("备注", 500).Message != second.Message {
+					t.Error("isolation")
+				}
+			}
+		}(n)
+	}
+	wg.Wait()
+	cfg := logx.Default()
+	cfg.Writer = io.Discard
+	logger, err := logx.New(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer logger.Close()
+	deps, err := svc.New(context.Background(), logger)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer deps.Close()
+	app := omni.New()
+	defer app.Close()
+	app.Use(func(next httpx.Handler) httpx.Handler {
+		return func(c *httpx.Context) error {
+			switch c.Header("X-Fixture") {
+			case "company":
+				return typed("企业名称", 100).WithCause(private)
+			case "remark":
+				return omnierrors.ByCode("TEXT_TOO_LONG").WithParams(map[string]any{"label": "备注", "max": 500})
+			case "missing":
+				return omnierrors.ByCode("TEXT_TOO_LONG").WithParams(map[string]any{"label": "企业名称"})
+			case "type":
+				return omnierrors.ByCode("TEXT_TOO_LONG").WithParams(map[string]any{"label": "企业名称", "max": "100"})
+			case "fixed":
+				return apierrors.UsernameInvalid()
+			case "denied":
+				return apierrors.ResourceDenied("资源")
+			default:
+				return c.OK(map[string]string{"token": "ok"})
+			}
+		}
+	})
+	if err := handler.RegisterRoutes(app, deps); err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{"/token", "/raw"} {
+		for _, test := range []struct {
+			kind   string
+			status int
+			want   string
+		}{
+			{"company", 200, first.Message}, {"remark", 200, second.Message}, {"missing", 500, "internal server error"}, {"type", 500, "internal server error"}, {"fixed", 200, "用户名格式不正确"}, {"denied", 403, "资源不可用"}, {"", 200, `"token":"ok"`},
+		} {
+			method := "POST"
+			if path == "/raw" {
+				method = "GET"
+			}
+			w := httptest.NewRecorder()
+			r := httptest.NewRequest(method, path, nil)
+			r.Header.Set("X-Fixture", test.kind)
+			app.ServeHTTP(w, r)
+			if w.Code != test.status || !strings.Contains(w.Body.String(), test.want) || strings.Contains(w.Body.String(), "private") || strings.Contains(w.Body.String(), "{label}") {
+				t.Fatal(test.kind, w.Code, w.Body.String())
+			}
+			if test.kind == "company" || test.kind == "remark" {
+				if !strings.Contains(w.Body.String(), `"code":400002`) || !strings.Contains(w.Body.String(), `"data":null`) {
+					t.Fatal(w.Body.String())
+				}
+			}
+			if path == "/raw" && test.kind == "" && strings.Contains(w.Body.String(), "code") {
+				t.Fatal("raw response wrapped")
+			}
+		}
+	}
+}

cmd/go-omni/apigen/testdata/managed/background.go

@@ -0,0 +1,49 @@
+package svc
+
+import (
+	"context"
+	"errors"
+	"git.yuntuo.hk/k2safe/go-omni/task"
+	"sync/atomic"
+	"time"
+)
+
+type BackgroundState struct {
+	Stop, Drain, Release, Started chan struct{}
+	Wrote                         atomic.Bool
+	Future                        *task.Future
+}
+
+var Background atomic.Pointer[BackgroundState]
+
+func initBackground(c *ServiceContext) error {
+	state := &BackgroundState{Stop: make(chan struct{}), Drain: make(chan struct{}), Release: make(chan struct{}), Started: make(chan struct{})}
+	baseline := Closed.Load()
+	runner, err := task.New(task.Config{Workers: 1, QueueSize: 1, TaskTimeout: time.Minute, OnError: func(string, error) {}})
+	if err != nil {
+		return err
+	}
+	c.OnStop("jobs", func(ctx context.Context) error { close(state.Stop); return runner.StopAccepting(ctx) })
+	c.OnDrain("jobs", func(ctx context.Context) error { close(state.Drain); return runner.Wait(ctx) })
+	state.Future, err = runner.Submit(c.WorkContext(), "finish", func(ctx context.Context) error {
+		close(state.Started)
+		if c.Config.BackgroundMode == "auto" {
+			<-state.Stop
+		} else {
+			<-state.Release
+		}
+		if ctx.Err() != nil {
+			return ctx.Err()
+		}
+		if Closed.Load() != baseline {
+			return errors.New("shared client closed before background write")
+		}
+		state.Wrote.Store(true)
+		return nil
+	})
+	if err == nil {
+		<-state.Started
+	}
+	Background.Store(state)
+	return err
+}

cmd/go-omni/apigen/testdata/managed/client.go

@@ -0,0 +1,36 @@
+package svc
+
+import (
+	"context"
+	"errors"
+	"sync/atomic"
+)
+
+var Opened, Closed, DownloadClosed atomic.Int32
+var Started = make(chan struct{}, 1)
+var Release = make(chan struct{})
+var Current atomic.Pointer[ServiceContext]
+var FatalDependency = errors.New("test dependency cannot continue")
+
+// This fake client exercises the same lifetime contract as a database/client.
+type Client struct{}
+
+func initClient(ctx context.Context, c *ServiceContext) error {
+	Current.Store(c)
+	Opened.Add(1)
+	c.Client = &Client{}
+	c.OnClose(func() error { Closed.Add(1); c.Logger.Info("test.client.closed"); return nil })
+	if c.Config.BackgroundMode != "" {
+		if err := initBackground(c); err != nil {
+			return err
+		}
+	}
+	if c.Config.FailInit {
+		return errors.New("client initialization failed")
+	}
+	if c.Config.ShutdownInit {
+		c.RequestShutdown(FatalDependency)
+		return nil
+	}
+	return ctx.Err()
+}

cmd/go-omni/apigen/testdata/managed/consumer_test.go

@@ -0,0 +1,235 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"mime/multipart"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"example.com/managed/internal/config"
+	"example.com/managed/internal/handler"
+	"example.com/managed/internal/svc"
+	omni "git.yuntuo.hk/k2safe/go-omni"
+	"git.yuntuo.hk/k2safe/go-omni/logx"
+)
+
+func application(t *testing.T) *omni.App {
+	t.Helper()
+	cfg := config.Default()
+	cfg.Server.Log.Writer = io.Discard
+	logger, err := logx.New(cfg.Server.Log)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = logger.Close() })
+	deps, err := svc.New(context.Background(), logger, cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = deps.Close() })
+	app, err := handler.NewApp(deps)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = app.Close() })
+	return app
+}
+func response(t *testing.T, app *omni.App, method, path string, body io.Reader, headers map[string]string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(method, path, body)
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	out := httptest.NewRecorder()
+	app.ServeHTTP(out, req)
+	return out
+}
+func assertError(t *testing.T, out *httptest.ResponseRecorder, status, code int, message, field string) {
+	t.Helper()
+	var data map[string]any
+	if err := json.Unmarshal(out.Body.Bytes(), &data); err != nil {
+		t.Fatal(out.Body.String(), err)
+	}
+	value, exists := data["data"]
+	if out.Code != status || data["code"] != float64(code) || data[field] != message || !exists || value != nil {
+		t.Fatalf("unexpected error: %d %s", out.Code, out.Body.String())
+	}
+}
+func TestGeneratedAppPolicies(t *testing.T) {
+	app := application(t)
+	assertError(t, response(t, app, "GET", "/check?kind=fixed", nil, nil), 400, 400002, "用户名格式不正确", "msg")
+	assertError(t, response(t, app, "GET", "/check?kind=params", nil, nil), 400, 400003, "企业名称不能超过100个字符", "msg")
+	assertError(t, response(t, app, "GET", "/check?kind=unknown", nil, nil), 500, 9999, "系统错误", "msg")
+	assertError(t, response(t, app, "GET", "/other?kind=fixed", nil, nil), 400, 400002, "用户名格式不正确", "detail")
+	for _, path := range []string{"/check", "/missing", "/callback"} {
+		assertError(t, response(t, app, "GET", path, nil, map[string]string{"X-Fail": "1"}), 400, 400002, "用户名格式不正确", "msg")
+	}
+	assertError(t, response(t, app, "GET", "/missing", nil, nil), 404, 404001, "接口不存在", "msg")
+	assertError(t, response(t, app, "POST", "/check", nil, nil), 405, 405001, "请求方法不支持", "msg")
+	out := response(t, app, "GET", "/raw", nil, nil)
+	if strings.TrimSpace(out.Body.String()) != `{"bytes":3}` {
+		t.Fatal(out.Body.String())
+	}
+}
+func TestGeneratedTransfers(t *testing.T) {
+	app := application(t)
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+	file, err := writer.CreateFormFile("file", "x.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = file.Write([]byte("hello"))
+	_ = writer.Close()
+	out := response(t, app, "POST", "/upload", &body, map[string]string{"Content-Type": writer.FormDataContentType()})
+	if out.Code != 200 || !strings.Contains(out.Body.String(), `"bytes":5`) {
+		t.Fatalf("upload: %d %s", out.Code, out.Body.String())
+	}
+	out = response(t, app, "POST", "/upload", strings.NewReader("bad"), map[string]string{"Content-Type": "application/json"})
+	if out.Code != 415 {
+		t.Fatal(out.Code, out.Body.String())
+	}
+	// Truncated uploads must use the project's public error catalog rather
+	// than succeed or be mistaken for an internal failure.
+	out = response(t, app, "POST", "/upload", strings.NewReader("--b\r\nContent-Disposition: form-data; name=\"file\"\r\n\r\nprivate file"), map[string]string{"Content-Type": "multipart/form-data; boundary=b"})
+	assertError(t, out, 400, 400004, "上传内容不完整", "msg")
+	out = response(t, app, "POST", "/callback", strings.NewReader("{ \"exact\" : 123 }"), map[string]string{"X-Signature": "valid"})
+	if out.Code != 200 || out.Body.String() != "ACK:{ \"exact\" : 123 }" || out.Header().Get("Content-Type") != "text/plain" {
+		t.Fatal(out.Code, out.Body.String())
+	}
+	assertError(t, response(t, app, "POST", "/callback", strings.NewReader("{}"), nil), 400, 400002, "用户名格式不正确", "msg")
+	// Unknown length must be limited by reads too, not just Content-Length.
+	req := httptest.NewRequest("POST", "/callback", strings.NewReader(strings.Repeat("x", 65)))
+	req.ContentLength = -1
+	req.Header.Set("X-Signature", "valid")
+	out = httptest.NewRecorder()
+	app.ServeHTTP(out, req)
+	assertError(t, out, 413, 413001, "请求体太大", "msg")
+	before := svc.DownloadClosed.Load()
+	out = response(t, app, "GET", "/download", nil, nil)
+	if out.Body.String() != "file-content" || out.Header().Get("Content-Type") != "application/octet-stream" || !strings.Contains(out.Header().Get("Content-Disposition"), "attachment") || svc.DownloadClosed.Load() != before+1 {
+		t.Fatal(out.Code, out.Body.String(), out.Header())
+	}
+}
+func configFile(t *testing.T, address string, fail bool) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "config.json")
+	data, _ := json.Marshal(map[string]any{"server": map[string]any{"address": address}, "failInit": fail})
+	if err := os.WriteFile(path, data, 0600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+func waitReady(t *testing.T, url string, done <-chan error) {
+	t.Helper()
+	client := http.Client{Timeout: 100 * time.Millisecond}
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		select {
+		case err := <-done:
+			t.Fatalf("startup failed: %v", err)
+		default:
+		}
+		res, err := client.Get(url + "/health/ready")
+		if err == nil {
+			_ = res.Body.Close()
+			if res.StatusCode == 200 {
+				return
+			}
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatal("server did not become ready")
+}
+func TestGeneratedMainLifecycle(t *testing.T) {
+	t.Run("initializationFailure", func(t *testing.T) {
+		before := svc.Closed.Load()
+		if err := run(context.Background(), configFile(t, "127.0.0.1:0", true)); err == nil {
+			t.Fatal("failure hidden")
+		}
+		if svc.Closed.Load() != before+1 {
+			t.Fatal("initialized client leaked or closed twice")
+		}
+	})
+	t.Run("listenFailure", func(t *testing.T) {
+		listener, err := net.Listen("tcp", "127.0.0.1:0")
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer listener.Close()
+		before := svc.Closed.Load()
+		if err = run(context.Background(), configFile(t, listener.Addr().String(), false)); err == nil {
+			t.Fatal("occupied listener accepted")
+		}
+		if svc.Closed.Load() != before+1 {
+			t.Fatal("listen failure cleanup")
+		}
+	})
+	t.Run("drainBeforeClose", func(t *testing.T) {
+		listener, err := net.Listen("tcp", "127.0.0.1:0")
+		if err != nil {
+			t.Fatal(err)
+		}
+		address := listener.Addr().String()
+		_ = listener.Close()
+		svc.Closed.Store(0)
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+		done := make(chan error, 1)
+		path := configFile(t, address, false)
+		go func() { done <- run(ctx, path) }()
+		base := "http://" + address
+		waitReady(t, base, done)
+		requestDone := make(chan error, 1)
+		go func() {
+			res, err := http.Get(base + "/slow")
+			if err == nil {
+				data, _ := io.ReadAll(res.Body)
+				_ = res.Body.Close()
+				if res.StatusCode != 200 || !strings.Contains(string(data), `"bytes":1`) {
+					err = io.ErrUnexpectedEOF
+				}
+			}
+			requestDone <- err
+		}()
+		select {
+		case <-svc.Started:
+		case <-time.After(3 * time.Second):
+			t.Fatal("request did not enter logic")
+		}
+		cancel()
+		time.Sleep(30 * time.Millisecond)
+		if svc.Closed.Load() != 0 {
+			t.Fatal("dependency closed before drain")
+		}
+		close(svc.Release)
+		select {
+		case err := <-requestDone:
+			if err != nil {
+				t.Fatal(err)
+			}
+		case <-time.After(3 * time.Second):
+			t.Fatal("request stuck")
+		}
+		select {
+		case err := <-done:
+			if err != nil {
+				t.Fatal(err)
+			}
+		case <-time.After(3 * time.Second):
+			t.Fatal("shutdown stuck")
+		}
+		if svc.Closed.Load() != 1 {
+			t.Fatal("client closed more/less than once", svc.Closed.Load())
+		}
+	})
+}

cmd/go-omni/apigen/testdata/managed/operations.go

@@ -0,0 +1,81 @@
+package demo
+
+import (
+	"context"
+	"errors"
+	"io"
+	"strings"
+
+	"example.com/managed/internal/svc"
+	"example.com/managed/internal/types"
+	omnierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+)
+
+func (l *Logic) Check(ctx context.Context, req *types.CheckReq) (*types.Receipt, error) {
+	switch req.Kind {
+	case "fixed":
+		return nil, omnierrors.ByCode("INVALID")
+	case "params":
+		return nil, omnierrors.ByCode("TOO_LONG").WithParams(map[string]any{"label": "企业名称", "max": 100})
+	case "unknown":
+		return nil, omnierrors.ByCode("UNKNOWN").WithCause(errors.New("private cause"))
+	}
+	return &types.Receipt{Bytes: 42}, nil
+}
+func (l *Logic) Other(ctx context.Context, req *types.CheckReq) (*types.Receipt, error) {
+	return l.Check(ctx, req)
+}
+func (l *Logic) RawJSON(context.Context) (*types.Receipt, error) {
+	return &types.Receipt{Bytes: 3}, nil
+}
+func (l *Logic) Upload(ctx context.Context, body *httpx.Body) (*types.Receipt, error) {
+	var total int64
+	for {
+		part, err := body.Parts.NextPart()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return nil, err
+		}
+		n, err := io.Copy(io.Discard, part)
+		closeErr := part.Close()
+		if err != nil {
+			return nil, err
+		}
+		if closeErr != nil {
+			return nil, closeErr
+		}
+		total += n
+	}
+	return &types.Receipt{Bytes: total}, nil
+}
+func (l *Logic) Callback(ctx context.Context, body *httpx.Body) (*httpx.Stream, error) {
+	// The route's 64-byte limit bounds this example's memory use. A real signature
+	// implementation can hash body.Raw incrementally and authenticate its headers.
+	data, err := io.ReadAll(body.Raw)
+	if err != nil {
+		return nil, err
+	}
+	if body.Header.Get("X-Signature") != "valid" {
+		return nil, omnierrors.ByCode("INVALID")
+	}
+	return &httpx.Stream{Content: io.NopCloser(strings.NewReader("ACK:" + string(data)))}, nil
+}
+func (l *Logic) Download(context.Context) (*httpx.Stream, error) {
+	return &httpx.Stream{Content: &countedReader{Reader: strings.NewReader("file-content")}, Name: "测试.txt"}, nil
+}
+
+type countedReader struct{ io.Reader }
+
+func (c *countedReader) Close() error { svc.DownloadClosed.Add(1); return nil }
+func (l *Logic) Slow(context.Context) (*types.Receipt, error) {
+	before := svc.Closed.Load()
+	svc.Started <- struct{}{}
+	<-svc.Release
+	if svc.Closed.Load() != before {
+		return nil, errors.New("dependency closed before drain")
+	}
+	return &types.Receipt{Bytes: 1}, nil
+}

cmd/go-omni/apigen/testdata/managed/options.go

@@ -0,0 +1,34 @@
+package svc
+
+import (
+	omni "git.yuntuo.hk/k2safe/go-omni"
+	omnierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+)
+
+func (c *ServiceContext) AppOptions() []omni.Option {
+	return []omni.Option{omni.WithErrors(omnierrors.Catalog{
+		DefaultStatus: 400,
+		Definitions: map[string]omnierrors.Definition{
+			"INVALID":            {Code: 400002, Message: "用户名格式不正确"},
+			"TOO_LONG":           {Code: 400003, Message: "{label}不能超过{max}个字符", Params: []omnierrors.Parameter{{Name: "label", Type: "string"}, {Name: "max", Type: "int"}}},
+			"INTERNAL_ERROR":     {Status: 500, Code: 9999, Message: "系统错误"},
+			"NOT_FOUND":          {Status: 404, Code: 404001, Message: "接口不存在"},
+			"METHOD_NOT_ALLOWED": {Status: 405, Code: 405001, Message: "请求方法不支持"},
+			"BODY_TOO_LARGE":     {Status: 413, Code: 413001, Message: "请求体太大"},
+			"INVALID_MULTIPART":  {Status: 400, Code: 400004, Message: "上传内容不完整"},
+		},
+	})}
+}
+func (c *ServiceContext) GlobalMiddleware() []httpx.Middleware {
+	return []httpx.Middleware{
+		func(next httpx.Handler) httpx.Handler {
+			return func(c *httpx.Context) error {
+				if c.Header("X-Fail") != "" {
+					return omnierrors.ByCode("INVALID")
+				}
+				return next(c)
+			}
+		},
+	}
+}

cmd/go-omni/apigen/testdata/managed/phases_test.go

@@ -0,0 +1,155 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"example.com/managed/internal/svc"
+	"git.yuntuo.hk/k2safe/go-omni/lifecycle"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func phasedConfig(t *testing.T, address, mode string, fail bool) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "config.json")
+	drainTimeout := "1s"
+	if mode == "stuck" {
+		drainTimeout = "50ms"
+	}
+	data, _ := json.Marshal(map[string]any{"backgroundMode": mode, "failInit": fail, "server": map[string]any{"address": address, "lifecycle": map[string]string{"stopTimeout": "1s", "drainTimeout": drainTimeout, "cancelTimeout": "50ms"}}})
+	if err := os.WriteFile(path, data, 0600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+func await(t *testing.T, ch <-chan struct{}) {
+	t.Helper()
+	select {
+	case <-ch:
+	case <-time.After(3 * time.Second):
+		t.Fatal("phase did not arrive")
+	}
+}
+
+func TestGeneratedBackgroundPhases(t *testing.T) {
+	for _, transport := range []string{"nethttp", "native"} {
+		t.Run(transport, func(t *testing.T) {
+			t.Setenv("GO_OMNI_TRANSPORT", transport)
+			listener, err := net.Listen("tcp", "127.0.0.1:0")
+			if err != nil {
+				t.Fatal(err)
+			}
+			addr := listener.Addr().String()
+			_ = listener.Close()
+			svc.Started = make(chan struct{}, 1)
+			svc.Release = make(chan struct{})
+			before := svc.Closed.Load()
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+			done := make(chan error, 1)
+			path := phasedConfig(t, addr, "hold", false)
+			go func() { done <- run(ctx, path) }()
+			waitReady(t, "http://"+addr, done)
+			state := svc.Background.Load()
+			defer func() {
+				select {
+				case <-state.Release:
+				default:
+					close(state.Release)
+				}
+			}()
+			requestDone := make(chan error, 1)
+			go func() {
+				client := http.Client{Timeout: 3 * time.Second}
+				resp, e := client.Get("http://" + addr + "/slow")
+				if e == nil {
+					_, _ = io.Copy(io.Discard, resp.Body)
+					_ = resp.Body.Close()
+					if resp.StatusCode != 200 {
+						e = errors.New("HTTP drain failed")
+					}
+				}
+				requestDone <- e
+			}()
+			await(t, svc.Started)
+			deps := svc.Current.Load()
+			deps.RequestShutdown(svc.FatalDependency)
+			if deps.WorkContext().Err() != nil {
+				t.Fatal("accepted work canceled at signal")
+			}
+			select {
+			case <-state.Stop:
+				t.Fatal("stopped background before HTTP finished")
+			default:
+			}
+			close(svc.Release)
+			if err := <-requestDone; err != nil {
+				t.Fatal(err)
+			}
+			await(t, state.Drain)
+			if svc.Closed.Load() != before {
+				t.Fatal("client closed during background drain")
+			}
+			close(state.Release)
+			if err := <-done; !errors.Is(err, svc.FatalDependency) || errors.Is(err, lifecycle.ErrResourcesRetained) {
+				t.Fatal(err)
+			}
+			if !state.Wrote.Load() || svc.Closed.Load() != before+1 {
+				t.Fatal("missing final write or cleanup")
+			}
+			if err := state.Future.Wait(context.Background()); err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+
+func TestGeneratedBackgroundFailureCleanup(t *testing.T) {
+	for _, failInit := range []bool{false, true} {
+		t.Run(map[bool]string{true: "initialization", false: "listen"}[failInit], func(t *testing.T) {
+			l, err := net.Listen("tcp", "127.0.0.1:0")
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer l.Close()
+			before := svc.Closed.Load()
+			err = run(context.Background(), phasedConfig(t, l.Addr().String(), "auto", failInit))
+			if err == nil || errors.Is(err, lifecycle.ErrResourcesRetained) {
+				t.Fatal(err)
+			}
+			state := svc.Background.Load()
+			if !state.Wrote.Load() || svc.Closed.Load() != before+1 {
+				t.Fatal("failure cleanup did not join background first")
+			}
+		})
+	}
+}
+
+func TestGeneratedBackgroundTimeoutProcess(t *testing.T) {
+	if path := os.Getenv("OMNI_PHASE_TIMEOUT_CONFIG"); path != "" {
+		os.Args = []string{os.Args[0], "-config", path}
+		main()
+		return
+	}
+	path := phasedConfig(t, "127.0.0.1:0", "stuck", true)
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, os.Args[0], "-test.run=^TestGeneratedBackgroundTimeoutProcess$")
+	cmd.Env = append(os.Environ(), "OMNI_PHASE_TIMEOUT_CONFIG="+path)
+	output, err := cmd.CombinedOutput()
+	var exit *exec.ExitError
+	if !errors.As(err, &exit) || exit.ExitCode() != 1 || ctx.Err() != nil {
+		t.Fatal(err, string(output))
+	}
+	if strings.Contains(string(output), "test.client.closed") || !strings.Contains(string(output), "shared resources retained") || !strings.Contains(string(output), "client initialization failed") {
+		t.Fatal(string(output))
+	}
+}

cmd/go-omni/apigen/testdata/managed/shutdown_test.go

@@ -0,0 +1,231 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"example.com/managed/internal/config"
+	"example.com/managed/internal/handler"
+	"example.com/managed/internal/svc"
+	"git.yuntuo.hk/k2safe/go-omni/health"
+	"git.yuntuo.hk/k2safe/go-omni/logx"
+)
+
+func TestGeneratedEndpointSettings(t *testing.T) {
+	cfg := config.Default()
+	cfg.Server.Log.Writer = io.Discard
+	cfg.Server.Endpoints.Liveness.Path = "/livez"
+	cfg.Server.Endpoints.Readiness.Path = "/readyz"
+	cfg.Server.Endpoints.OpenAPI.Enabled = false
+	logger, err := logx.New(cfg.Server.Log)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer logger.Close()
+	deps, err := svc.New(context.Background(), logger, cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer deps.Close()
+	app, err := handler.NewApp(deps)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Close()
+	for _, path := range []string{"/health/live", "/health/ready", "/openapi.json"} {
+		if out := response(t, app, "GET", path, nil, nil); out.Code != 404 {
+			t.Fatal(path, out.Code)
+		}
+	}
+	for _, path := range []string{"/readyz", "/livez"} {
+		out := response(t, app, "GET", path, nil, nil)
+		var data map[string]any
+		_ = json.Unmarshal(out.Body.Bytes(), &data)
+		if out.Code != 200 || data["code"] != float64(0) || data["msg"] != "success" || data["message"] != nil || data["requestId"] != nil {
+			t.Fatal(path, out.Code, out.Body.String())
+		}
+	}
+	deps.RequestShutdown(errors.New("private shutdown cause"))
+	out := response(t, app, "GET", "/readyz", nil, nil)
+	if out.Code != 503 || strings.Contains(out.Body.String(), "private") {
+		t.Fatal(out.Code, out.Body.String())
+	}
+	if out = response(t, app, "GET", "/livez", nil, nil); out.Code != 200 {
+		t.Fatal("liveness should still work")
+	}
+	// NewApp uses the project's latest configuration, including endpoint switches.
+	deps.Config.Server.Endpoints.Readiness.ResponseMode = "raw"
+	deps.Config.Server.Endpoints.Liveness.Enabled = false
+	deps.Config.Server.Endpoints.OpenAPI.Enabled = true
+	deps.Config.Server.Endpoints.OpenAPI.Path = "/spec.json"
+	app2, err := handler.NewApp(deps)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app2.Close()
+	out = response(t, app2, "GET", "/readyz", nil, nil)
+	if out.Code != 503 || strings.Contains(out.Body.String(), `"code"`) || !strings.Contains(out.Body.String(), `"status":"not_ready"`) {
+		t.Fatal(out.Body.String())
+	}
+	out = response(t, app2, "GET", "/spec.json", nil, nil)
+	if out.Code != 200 || !strings.Contains(out.Body.String(), `"openapi":`) || strings.Contains(out.Body.String(), `"msg":"操作成功"`) {
+		t.Fatal("OpenAPI was wrapped")
+	}
+	deps.Config.Server.Endpoints.Readiness.Path = "/check"
+	if _, err = handler.NewApp(deps); err == nil || !strings.Contains(err.Error(), "overlaps business") {
+		t.Fatal("collision accepted", err)
+	}
+	deps.Config.Server.Endpoints.Readiness.Enabled = false
+	if a, err := handler.NewApp(deps); err != nil {
+		t.Fatal("disabled endpoint reserves path", err)
+	} else {
+		_ = a.Close()
+	}
+}
+
+func TestGeneratedFailedProbe(t *testing.T) {
+	cfg := config.Default()
+	cfg.Server.Log.Writer = io.Discard
+	logger, _ := logx.New(cfg.Server.Log)
+	defer logger.Close()
+	deps, err := svc.New(context.Background(), logger, cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer deps.Close()
+	if err = deps.Health.Add(health.Probe{Name: "database", Check: func(context.Context) error { return errors.New("private connection details") }}); err != nil {
+		t.Fatal(err)
+	}
+	app, err := handler.NewApp(deps)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Close()
+	out := response(t, app, "GET", "/health/ready", nil, nil)
+	if out.Code != 503 || strings.Contains(out.Body.String(), "private") || !strings.Contains(out.Body.String(), `"msg":`) {
+		t.Fatal(out.Code, out.Body.String())
+	}
+}
+
+func TestGeneratedDependencyShutdown(t *testing.T) {
+	for _, transport := range []string{"nethttp", "native"} {
+		t.Run(transport, func(t *testing.T) {
+			listener, err := net.Listen("tcp", "127.0.0.1:0")
+			if err != nil {
+				t.Fatal(err)
+			}
+			address := listener.Addr().String()
+			_ = listener.Close()
+			t.Setenv("GO_OMNI_TRANSPORT", transport)
+			svc.Started = make(chan struct{}, 1)
+			svc.Release = make(chan struct{})
+			before := svc.Closed.Load()
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+			done := make(chan error, 1)
+			path := configFile(t, address, false)
+			go func() { done <- run(ctx, path) }()
+			base := "http://" + address
+			waitReady(t, base, done)
+			deps := svc.Current.Load()
+			requestDone := make(chan error, 1)
+			go func() {
+				client := http.Client{Timeout: 3 * time.Second}
+				res, err := client.Get(base + "/slow")
+				if err == nil {
+					_, _ = io.Copy(io.Discard, res.Body)
+					_ = res.Body.Close()
+					if res.StatusCode != 200 {
+						err = io.ErrUnexpectedEOF
+					}
+				}
+				requestDone <- err
+			}()
+			select {
+			case <-svc.Started:
+			case <-time.After(3 * time.Second):
+				t.Fatal("request did not start")
+			}
+			deps.RequestShutdown(svc.FatalDependency)
+			// Inspect the same generated readiness handler during draining, even if
+			// the network listener has already stopped accepting new connections.
+			probe, _ := handler.NewApp(deps)
+			out := httptest.NewRecorder()
+			probe.ServeHTTP(out, httptest.NewRequest("GET", "/health/ready", nil))
+			_ = probe.Close()
+			if out.Code != 503 {
+				t.Fatal("draining remained ready", out.Body.String())
+			}
+			if svc.Closed.Load() != before {
+				t.Fatal("dependency closed before drain")
+			}
+			close(svc.Release)
+			select {
+			case err = <-requestDone:
+				if err != nil {
+					t.Fatal(err)
+				}
+			case <-time.After(3 * time.Second):
+				t.Fatal("request stuck")
+			}
+			select {
+			case err = <-done:
+				if !errors.Is(err, svc.FatalDependency) {
+					t.Fatal("fatal cause lost", err)
+				}
+			case <-time.After(3 * time.Second):
+				t.Fatal("shutdown stuck")
+			}
+			if svc.Closed.Load() != before+1 {
+				t.Fatal("cleanup did not run once")
+			}
+		})
+	}
+}
+
+func TestGeneratedFatalProcessExit(t *testing.T) {
+	if path := os.Getenv("OMNI_TEST_FATAL_CONFIG"); path != "" {
+		os.Args = []string{os.Args[0], "-config", path}
+		main()
+		return
+	}
+	path := filepath.Join(t.TempDir(), "config.json")
+	if err := os.WriteFile(path, []byte(`{"shutdownInit":true,"server":{"address":"127.0.0.1:0"}}`), 0600); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, os.Args[0], "-test.run=^TestGeneratedFatalProcessExit$")
+	cmd.Env = append(os.Environ(), "OMNI_TEST_FATAL_CONFIG="+path)
+	output, err := cmd.CombinedOutput()
+	var exit *exec.ExitError
+	if !errors.As(err, &exit) || exit.ExitCode() != 1 {
+		t.Fatal("fatal shutdown must exit 1", err, string(output))
+	}
+	if !strings.Contains(string(output), svc.FatalDependency.Error()) || strings.Count(string(output), "test.client.closed") != 1 {
+		t.Fatal("missing failure or cleanup", string(output))
+	}
+}
+
+func TestGeneratedEndpointConflictCleansUp(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "config.json")
+	if err := os.WriteFile(path, []byte(`{"server":{"address":"127.0.0.1:0","endpoints":{"readiness":{"path":"/check"}}}}`), 0600); err != nil {
+		t.Fatal(err)
+	}
+	before := svc.Closed.Load()
+	err := run(context.Background(), path)
+	if err == nil || !strings.Contains(err.Error(), "overlaps business") || svc.Closed.Load() != before+1 {
+		t.Fatal("collision leaked resources or started serving", err)
+	}
+}

cmd/go-omni/apigen/upgrade.go

@@ -0,0 +1,302 @@
+package apigen
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"git.yuntuo.hk/k2safe/go-omni/cmd/go-omni/scaffold"
+	"go/ast"
+	"go/format"
+	goparser "go/parser"
+	gotoken "go/token"
+	"golang.org/x/mod/modfile"
+	"golang.org/x/mod/semver"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+type UpgradeChange struct {
+	Path, Action  string
+	Manual        bool
+	before, after []byte
+	mode          os.FileMode
+	exists        bool
+}
+type UpgradePlan struct {
+	Changes       []UpgradeChange
+	Module, Entry string
+}
+
+// PlanUpgrade compares infrastructure against the exact previous release seeds.
+// A custom file is never classified as safe to replace. Logic, middleware,
+// options and repositories outside the changed templates are left untouched.
+func PlanUpgrade(dir string) (UpgradePlan, error) {
+	var plan UpgradePlan
+	root := canonical(dir)
+	if err := safePath(root, manifestPath); err != nil {
+		return plan, err
+	}
+	raw, err := os.ReadFile(filepath.Join(root, manifestPath))
+	if err != nil {
+		return plan, err
+	}
+	var m manifest
+	if err = json.Unmarshal(raw, &m); err != nil {
+		return plan, err
+	}
+	if m.Version != 2 || m.Profile == nil {
+		return plan, errors.New("upgrade requires a managed v0.13+ project")
+	}
+	if filepath.Ext(m.Entry) != ".api" {
+		return plan, errors.New("upgrade requires a valid API entry")
+	}
+	if err = safePath(root, m.Entry); err != nil {
+		return plan, err
+	}
+	plan.Module, plan.Entry = m.Module, m.Entry
+	if semver.IsValid(m.TemplateVersion) && semver.Compare(m.TemplateVersion, minimumVersion) >= 0 {
+		return plan, nil
+	}
+	p := m.Profile
+	legacy, err := scaffold.LegacyAPIInfrastructure(m.Module, p.Database, p.Storage, p.LogOutput, p.LogFormat)
+	if err != nil {
+		return plan, err
+	}
+	current, err := scaffold.APIInfrastructure(m.Module, p.Database, p.Storage, p.LogOutput, p.LogFormat)
+	if err != nil {
+		return plan, err
+	}
+	names := map[string]bool{}
+	for name := range legacy {
+		names[name] = true
+	}
+	for name := range current {
+		if !strings.HasSuffix(name, "Gen.go") {
+			names[name] = true
+		}
+	}
+	// v0.14 already owns config/svc extensions. Only bump the module here;
+	// Generate updates generator-owned main/runtime files without replaying the
+	// v0.13 seed migration over developer configuration and dependency code.
+	if semver.IsValid(m.TemplateVersion) && semver.Compare(m.TemplateVersion, "v0.14.0-preview") >= 0 {
+		names = map[string]bool{}
+	}
+	sorted := make([]string, 0, len(names))
+	for name := range names {
+		sorted = append(sorted, name)
+	}
+	sort.Strings(sorted)
+	for _, name := range sorted {
+		// options.go is unchanged by this release. Its application customizations remain untouched.
+		previous, next := legacy[name], current[name]
+		if strings.HasSuffix(name, ".go") {
+			if previous != nil {
+				previous, err = format.Source(previous)
+				if err != nil {
+					return plan, err
+				}
+			}
+			if next != nil {
+				next, err = format.Source(next)
+				if err != nil {
+					return plan, err
+				}
+			}
+		}
+		if bytes.Equal(previous, next) {
+			continue
+		}
+		if err = safePath(root, name); err != nil {
+			return plan, err
+		}
+		existing, readErr := os.ReadFile(filepath.Join(root, name))
+		if readErr != nil && !errors.Is(readErr, os.ErrNotExist) {
+			return plan, readErr
+		}
+		exists := readErr == nil
+		if bytes.Equal(existing, next) {
+			continue
+		}
+		mode := os.FileMode(0644)
+		if exists {
+			stat, e := os.Stat(filepath.Join(root, name))
+			if e != nil {
+				return plan, e
+			}
+			mode = stat.Mode().Perm()
+		}
+		action := "update"
+		if next == nil {
+			action = "remove"
+		} else if !exists {
+			action = "create"
+		}
+		plan.Changes = append(plan.Changes, UpgradeChange{Path: name, Action: action, Manual: exists && !bytes.Equal(existing, previous), before: existing, after: next, mode: mode, exists: exists})
+	}
+	if err = safePath(root, "go.mod"); err != nil {
+		return plan, err
+	}
+	raw, err = os.ReadFile(filepath.Join(root, "go.mod"))
+	if err != nil {
+		return plan, err
+	}
+	mf, err := modfile.Parse("go.mod", raw, nil)
+	if err != nil {
+		return plan, err
+	}
+	for _, r := range mf.Require {
+		if r.Mod.Path == frameworkModule && semver.Compare(r.Mod.Version, minimumVersion) < 0 {
+			if err = mf.AddRequire(frameworkModule, minimumVersion); err != nil {
+				return plan, err
+			}
+			next, e := mf.Format()
+			if e != nil {
+				return plan, e
+			}
+			stat, e := os.Stat(filepath.Join(root, "go.mod"))
+			if e != nil {
+				return plan, e
+			}
+			plan.Changes = append(plan.Changes, UpgradeChange{Path: "go.mod", Action: "update", before: raw, after: next, exists: true, mode: stat.Mode().Perm()})
+			break
+		}
+	}
+	return plan, nil
+}
+
+// PreviewUpgrade writes only proposed infrastructure files into an empty directory.
+// It never mutates the service or emits a replacement business tree.
+func PreviewUpgrade(dir, destination string) (UpgradePlan, error) {
+	plan, err := PlanUpgrade(dir)
+	if err != nil {
+		return plan, err
+	}
+	if entries, e := os.ReadDir(destination); e == nil && len(entries) > 0 {
+		return plan, errors.New("upgrade preview directory must be empty")
+	} else if e != nil && !errors.Is(e, os.ErrNotExist) {
+		return plan, e
+	}
+	for _, c := range plan.Changes {
+		if c.after == nil {
+			continue
+		}
+		if err = safePath(destination, c.Path); err != nil {
+			return plan, err
+		}
+		if err = atomicWrite(destination, c.Path, c.after, 0644); err != nil {
+			return plan, err
+		}
+	}
+	note := "# Infrastructure upgrade preview\n\nOnly untouched v0.13 seed files can be replaced automatically. Custom files require a targeted edit; this preview is never copied over the project automatically.\n\nMove dependency initialization into ServiceContext.Init; embed *lifecycle.Runtime; register cleanup with OnClose. Remove old New/Close/OnClose implementations after preserving their project work in Init or cleanup hooks. Use structured database/mysql.Config and DatabaseOptions. Preserve business configuration fields, AppOptions, middleware and Logic.\n\n"
+	for _, c := range plan.Changes {
+		note += fmt.Sprintf("- %s %s (manual review: %t)\n", c.Action, c.Path, c.Manual)
+	}
+	if err = safePath(destination, "UPGRADE.md"); err != nil {
+		return plan, err
+	}
+	return plan, atomicWrite(destination, "UPGRADE.md", []byte(note), 0644)
+}
+
+// ApplyUpgrade applies only recognized seed changes under the same generation
+// lock. A generation failure restores every changed developer file. Any manual
+// review item blocks all writes; use PreviewUpgrade and migrate that file first.
+func ApplyUpgrade(dir string) (plan UpgradePlan, err error) {
+	root := canonical(dir)
+	if err = safePath(root, ".goOmni/api.lock"); err != nil {
+		return plan, err
+	}
+	lock, err := os.OpenFile(filepath.Join(root, ".goOmni/api.lock"), os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0600)
+	if err != nil {
+		return plan, err
+	}
+	_ = lock.Close()
+	defer os.Remove(filepath.Join(root, ".goOmni/api.lock"))
+	plan, err = PlanUpgrade(root)
+	if err != nil {
+		return plan, err
+	}
+	for _, c := range plan.Changes {
+		if c.Manual {
+			return plan, fmt.Errorf("upgrade: %s contains project changes; inspect an upgrade preview and migrate it explicitly", c.Path)
+		}
+	}
+	var changed []UpgradeChange
+	defer func() {
+		if err != nil {
+			for i := len(changed) - 1; i >= 0; i-- {
+				c := changed[i]
+				if c.exists {
+					err = errors.Join(err, atomicWrite(root, c.Path, c.before, c.mode))
+				} else {
+					e := os.Remove(filepath.Join(root, c.Path))
+					if !errors.Is(e, os.ErrNotExist) {
+						err = errors.Join(err, e)
+					}
+				}
+			}
+		}
+	}()
+	for _, c := range plan.Changes {
+		if c.after == nil {
+			err = os.Remove(filepath.Join(root, c.Path))
+		} else {
+			err = atomicWrite(root, c.Path, c.after, c.mode)
+		}
+		if err != nil {
+			return plan, err
+		}
+		changed = append(changed, c)
+	}
+	preview, e := Generate(Options{Dir: root, API: filepath.Join(root, plan.Entry), DryRun: true, lockHeld: true})
+	if e != nil {
+		return plan, e
+	}
+	if diagnosticErrors(preview.Diagnostics) > 0 {
+		return plan, errors.New("upgrade: Logic checks failed; resolve diagnostics before applying")
+	}
+	_, err = Generate(Options{Dir: root, API: filepath.Join(root, plan.Entry), lockHeld: true})
+	return plan, err
+}
+
+func checkRuntimeExtension(root string) error {
+	directory := filepath.Join(root, "internal/svc")
+	files, err := os.ReadDir(directory)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	for _, entry := range files {
+		if !sourceFile(entry.Name()) || strings.HasSuffix(entry.Name(), "Gen.go") {
+			continue
+		}
+		path := filepath.Join(directory, entry.Name())
+		file, err := goparser.ParseFile(gotoken.NewFileSet(), path, nil, goparser.SkipObjectResolution)
+		if err != nil {
+			return err
+		}
+		for _, decl := range file.Decls {
+			fn, ok := decl.(*ast.FuncDecl)
+			if !ok {
+				continue
+			}
+			if fn.Recv == nil && fn.Name.Name == "New" {
+				return fmt.Errorf("%s owns New; run go-omni api upgrade --dir %s and move project initialization into ServiceContext.Init", path, root)
+			}
+			if fn.Recv != nil && (fn.Name.Name == "Close" || fn.Name.Name == "OnClose" || fn.Name.Name == "Finish") {
+				receiver := fn.Recv.List[0].Type
+				if p, ok := receiver.(*ast.StarExpr); ok {
+					receiver = p.X
+				}
+				if id, ok := receiver.(*ast.Ident); ok && id.Name == "ServiceContext" {
+					return fmt.Errorf("%s overrides framework resource lifecycle; inspect go-omni api upgrade and register cleanup in Init", path)
+				}
+			}
+		}
+	}
+	return nil
+}

cmd/go-omni/apigen/upgrade_test.go

@@ -0,0 +1,167 @@
+package apigen
+
+import (
+	"encoding/json"
+	"git.yuntuo.hk/k2safe/go-omni/cmd/go-omni/scaffold"
+	"go/format"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func oldInfrastructureProject(t *testing.T) string {
+	t.Helper()
+	dir := filepath.Join(t.TempDir(), "app")
+	if _, err := New(Options{Dir: dir, Module: "example.com/upgrade", FrameworkDir: frameworkRoot(t)}); err != nil {
+		t.Fatal(err)
+	}
+	previous, err := scaffold.LegacyAPIInfrastructure("example.com/upgrade", "none", "none", "stderr", "json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for name, content := range previous {
+		if strings.HasSuffix(name, ".go") {
+			content, err = format.Source(content)
+			if err != nil {
+				t.Fatal(err)
+			}
+		}
+		writeFile(t, filepath.Join(dir, name), string(content))
+	}
+	var m manifest
+	if err = json.Unmarshal([]byte(readFile(t, filepath.Join(dir, manifestPath))), &m); err != nil {
+		t.Fatal(err)
+	}
+	delete(m.Generated, "internal/svc/runtimeGen.go")
+	m.TemplateVersion = ""
+	_ = os.Remove(filepath.Join(dir, "internal/svc/runtimeGen.go"))
+	raw, _ := json.Marshal(m)
+	writeFile(t, filepath.Join(dir, manifestPath), string(raw))
+	path := filepath.Join(dir, "go.mod")
+	writeFile(t, path, strings.ReplaceAll(readFile(t, path), minimumVersion, "v0.13.0-preview"))
+	return dir
+}
+
+func TestUpgradeRejectsEscapingEntry(t *testing.T) {
+	dir := oldInfrastructureProject(t)
+	var m manifest
+	if err := json.Unmarshal([]byte(readFile(t, filepath.Join(dir, manifestPath))), &m); err != nil {
+		t.Fatal(err)
+	}
+	m.Entry = "../outside.api"
+	raw, _ := json.Marshal(m)
+	writeFile(t, filepath.Join(dir, manifestPath), string(raw))
+	before := snapshot(t, dir)
+	if _, err := ApplyUpgrade(dir); err == nil {
+		t.Fatal("escaping API entry accepted")
+	}
+	if !sameFiles(before, snapshot(t, dir)) {
+		t.Fatal("invalid upgrade wrote project")
+	}
+}
+
+func TestUpgradeV014PreservesExtensions(t *testing.T) {
+	dir := filepath.Join(t.TempDir(), "service")
+	if _, err := New(Options{Dir: dir, Module: "example.com/upgrade", FrameworkDir: frameworkRoot(t)}); err != nil {
+		t.Fatal(err)
+	}
+	var m manifest
+	if err := json.Unmarshal([]byte(readFile(t, filepath.Join(dir, manifestPath))), &m); err != nil {
+		t.Fatal(err)
+	}
+	m.TemplateVersion = "v0.14.0-preview"
+	raw, _ := json.Marshal(m)
+	writeFile(t, filepath.Join(dir, manifestPath), string(raw))
+	mod := filepath.Join(dir, "go.mod")
+	writeFile(t, mod, strings.ReplaceAll(readFile(t, mod), minimumVersion, "v0.14.1-preview"))
+	owned := map[string]string{}
+	for _, name := range []string{"internal/svc/serviceContext.go", "internal/config/config.go", "etc/config.yaml"} {
+		path := filepath.Join(dir, name)
+		value := readFile(t, path)
+		if strings.HasSuffix(name, ".go") {
+			value += "\n// project extension kept\n"
+		} else {
+			value += "\n# project configuration kept\n"
+		}
+		writeFile(t, path, value)
+		owned[path] = value
+	}
+	plan, err := PlanUpgrade(dir)
+	if err != nil || len(plan.Changes) != 1 || plan.Changes[0].Path != "go.mod" {
+		t.Fatal(plan, err)
+	}
+	if _, err := ApplyUpgrade(dir); err != nil {
+		t.Fatal(err)
+	}
+	for path, want := range owned {
+		if readFile(t, path) != want {
+			t.Fatal("developer file modified", path)
+		}
+	}
+	if _, err := Generate(Options{Dir: dir, API: filepath.Join(dir, "api/service.api"), Check: true}); err != nil {
+		t.Fatal(err)
+	}
+}
+func TestSafeInfrastructureUpgrade(t *testing.T) {
+	dir := oldInfrastructureProject(t)
+	before := snapshot(t, dir)
+	if _, err := Generate(Options{Dir: dir, API: filepath.Join(dir, "api/service.api")}); err == nil {
+		t.Fatal("legacy constructor accepted")
+	}
+	if !sameFiles(before, snapshot(t, dir)) {
+		t.Fatal("failed generate wrote files")
+	}
+	plan, err := PlanUpgrade(dir)
+	if err != nil || len(plan.Changes) == 0 {
+		t.Fatal(plan, err)
+	}
+	for _, c := range plan.Changes {
+		if c.Manual {
+			t.Fatal(c.Path)
+		}
+	}
+	preview := filepath.Join(t.TempDir(), "preview")
+	if _, err = PreviewUpgrade(dir, preview); err != nil {
+		t.Fatal(err)
+	}
+	if !sameFiles(before, snapshot(t, dir)) {
+		t.Fatal("preview changed project")
+	}
+	logic := readFile(t, filepath.Join(dir, "internal/logic/greet/greet.go"))
+	if _, err = ApplyUpgrade(dir); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = os.Stat(filepath.Join(dir, "internal/svc/close.go")); !os.IsNotExist(err) {
+		t.Fatal("old lifecycle remains")
+	}
+	if readFile(t, filepath.Join(dir, "internal/logic/greet/greet.go")) != logic {
+		t.Fatal("business changed")
+	}
+	if _, err = Generate(Options{Dir: dir, API: filepath.Join(dir, "api/service.api"), Check: true}); err != nil {
+		t.Fatal(err)
+	}
+	plan, err = PlanUpgrade(dir)
+	if err != nil || len(plan.Changes) != 0 {
+		t.Fatal("upgrade not idempotent", plan, err)
+	}
+}
+func TestUpgradePreservesCustomFilesAndRollsBack(t *testing.T) {
+	for _, custom := range []bool{true, false} {
+		dir := oldInfrastructureProject(t)
+		if custom {
+			path := filepath.Join(dir, "internal/svc/serviceContext.go")
+			writeFile(t, path, readFile(t, path)+"\n// custom dependency\n")
+		} else {
+			path := filepath.Join(dir, "internal/logic/greet/greet.go")
+			writeFile(t, path, "package greet;func(s *Logic)Greet(){}")
+		}
+		before := snapshot(t, dir)
+		if _, err := ApplyUpgrade(dir); err == nil {
+			t.Fatal("unsafe upgrade accepted")
+		}
+		if !sameFiles(before, snapshot(t, dir)) {
+			t.Fatal("failed upgrade changed project")
+		}
+	}
+}

cmd/go-omni/apigen/workspace.go

@@ -0,0 +1,144 @@
+package apigen
+
+import (
+	"errors"
+	"fmt"
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+type WorkspaceService struct {
+	Dir    string `json:"dir"`
+	API    string `json:"api,omitempty"`
+	Module string `json:"module,omitempty"`
+}
+type WorkspaceConfig struct {
+	Services      []WorkspaceService `json:"services"`
+	ErrorCatalogs []WorkspaceCatalog `json:"errorCatalogs,omitempty"`
+}
+
+// Workspace operates independent Go modules listed in an explicit local file.
+// All projects are preflighted before generate/format writes. Each generator
+// transaction is atomic within its project; no cross-module transaction is promised.
+func Workspace(path, command string, w io.Writer) error {
+	if command != "generate" && command != "check" && command != "format" {
+		return errors.New("workspace command must be generate, check or format")
+	}
+	if w == nil {
+		w = io.Discard
+	}
+	real, err := filepath.Abs(path)
+	if err != nil {
+		return err
+	}
+	stat, err := os.Lstat(real)
+	if err != nil {
+		return err
+	}
+	if !stat.Mode().IsRegular() || stat.Size() > 65536 {
+		return errors.New("workspace configuration must be a regular file of at most 64 KiB")
+	}
+	raw, err := os.ReadFile(real)
+	if err != nil {
+		return err
+	}
+	var cfg WorkspaceConfig
+	if err = apierrors.DecodeCatalogJSON(raw, &cfg); err != nil {
+		return err
+	}
+	if len(cfg.Services) == 0 || len(cfg.Services) > 64 {
+		return errors.New("workspace must list 1..64 services")
+	}
+	root := canonical(filepath.Dir(real))
+	var options []Options
+	seen := map[string]bool{}
+	for _, service := range cfg.Services {
+		if service.Dir == "" || service.Dir == "." {
+			return errors.New("workspace requires distinct relative service directories")
+		}
+		if err = safePath(root, service.Dir+"/.goOmniWorkspaceCheck"); err != nil {
+			return err
+		}
+		dir := filepath.Join(root, filepath.FromSlash(service.Dir))
+		key := strings.ToLower(dir)
+		for prior := range seen {
+			if prior == key || strings.HasPrefix(key, prior+string(filepath.Separator)) || strings.HasPrefix(prior, key+string(filepath.Separator)) {
+				return errors.New("workspace service directories overlap")
+			}
+		}
+		seen[key] = true
+		entry := service.API
+		if entry == "" {
+			entry, err = ProjectEntry(dir)
+		} else {
+			if err = safePath(dir, entry); err != nil {
+				return err
+			}
+			entry = filepath.Join(dir, entry)
+		}
+		if err != nil {
+			return err
+		}
+		options = append(options, Options{API: entry, Dir: dir, Module: service.Module, DryRun: true})
+	}
+	var catalogs map[string][]byte
+	if command != "format" {
+		catalogs, err = prepareWorkspaceCatalogs(root, cfg.ErrorCatalogs, command == "check")
+		if err != nil {
+			return err
+		}
+		for i := range options {
+			options[i].documentCatalogs = catalogs
+		}
+	}
+	var failures error
+	for _, o := range options {
+		if command == "format" {
+			spec, e := Parse(o.API)
+			if e == nil {
+				_, e = Compile(spec)
+			}
+			err = e
+		} else {
+			_, err = Generate(o)
+		}
+		if err != nil {
+			failures = errors.Join(failures, fmt.Errorf("%s: %w", o.Dir, err))
+		}
+	}
+	if failures != nil {
+		return failures
+	}
+	if command == "generate" {
+		for path, data := range catalogs {
+			if err = writeWorkspaceCatalog(path, data); err != nil {
+				return err
+			}
+		}
+	}
+	for _, o := range options {
+		switch command {
+		case "format":
+			_, err = FormatProject(o.API, false)
+		case "generate":
+			o.DryRun = false
+			_, err = Generate(o)
+		case "check":
+			_, fmtErr := FormatProject(o.API, true)
+			o.DryRun = false
+			o.Check = true
+			_, genErr := Generate(o)
+			err = errors.Join(fmtErr, genErr)
+		}
+		if err != nil {
+			failures = errors.Join(failures, fmt.Errorf("%s: %w", o.Dir, err))
+			fmt.Fprintf(w, "FAIL %s\n", o.Dir)
+		} else {
+			fmt.Fprintf(w, "OK   %s\n", o.Dir)
+		}
+	}
+	return failures
+}

cmd/go-omni/apigen/workspaceCatalog.go

@@ -0,0 +1,217 @@
+package apigen
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	gotoken "go/token"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"golang.org/x/mod/modfile"
+	"golang.org/x/mod/module"
+)
+
+// WorkspaceCatalog is an explicitly trusted Go provider: func() errors.Catalog.
+// Only workspace generate/check execute providers. Parsing an .api never does.
+type WorkspaceCatalog struct {
+	Dir      string `json:"dir"`
+	Package  string `json:"package"`
+	Function string `json:"function"`
+	Output   string `json:"output"`
+}
+
+type limitedCatalogBuffer struct {
+	bytes.Buffer
+	limit int
+}
+
+func (b *limitedCatalogBuffer) Write(p []byte) (int, error) {
+	if len(p) > b.limit-b.Len() {
+		return 0, errors.New("catalog provider output exceeds limit")
+	}
+	return b.Buffer.Write(p)
+}
+
+func exportWorkspaceCatalog(root string, cfg WorkspaceCatalog) ([]byte, error) {
+	if cfg.Dir == "" || cfg.Output == "" || !gotoken.IsIdentifier(cfg.Function) || !gotoken.IsExported(cfg.Function) || module.CheckImportPath(cfg.Package) != nil {
+		return nil, errors.New("workspace catalog requires dir, an importable package, an exported function and output")
+	}
+	if err := safePath(root, filepath.ToSlash(filepath.Join(cfg.Dir, ".goOmniExportCheck"))); err != nil {
+		return nil, err
+	}
+	if err := safePath(root, cfg.Output); err != nil {
+		return nil, err
+	}
+	if filepath.Ext(cfg.Output) != ".json" {
+		return nil, errors.New("workspace catalog output must be .json")
+	}
+	dir := filepath.Join(root, filepath.FromSlash(cfg.Dir))
+	if stat, err := os.Stat(filepath.Join(dir, "go.mod")); err != nil || !stat.Mode().IsRegular() {
+		return nil, errors.New("workspace catalog dir must contain go.mod")
+	}
+	temp, err := os.MkdirTemp("", "go-omni-catalog-*")
+	if err != nil {
+		return nil, err
+	}
+	defer os.RemoveAll(temp)
+	// Overlay a virtual Go file under the provider module. This allows internal
+	// packages without creating files or changing go.mod/go.sum in that module.
+	virtual := filepath.Join(dir, ".goOmniCatalogExport", "main.go")
+	if _, err := os.Lstat(filepath.Dir(virtual)); !errors.Is(err, os.ErrNotExist) {
+		return nil, errors.New("reserved catalog export path already exists")
+	}
+	source := fmt.Sprintf("package main\nimport (\"os\"; provider %q; omnierrors %q)\nfunc main(){if err:=omnierrors.ExportCatalog(os.Stdout,provider.%s());err!=nil{os.Exit(1)}}\n", cfg.Package, frameworkModule+"/errors", cfg.Function)
+	backing := filepath.Join(temp, "main.go")
+	if err = os.WriteFile(backing, []byte(source), 0600); err != nil {
+		return nil, err
+	}
+	overlay, _ := json.Marshal(map[string]any{"Replace": map[string]string{virtual: backing}})
+	overlayPath := filepath.Join(temp, "overlay.json")
+	if err = os.WriteFile(overlayPath, overlay, 0600); err != nil {
+		return nil, err
+	}
+	// Keep all module metadata writes in the temporary directory as well.
+	// -mod=readonly alone must not be relied on to protect every go.sum update.
+	moduleData, err := os.ReadFile(filepath.Join(dir, "go.mod"))
+	if err != nil {
+		return nil, err
+	}
+	mf, err := modfile.Parse("go.mod", moduleData, nil)
+	if err != nil {
+		return nil, errors.New("workspace catalog has invalid go.mod")
+	}
+	replacements := append([]*modfile.Replace(nil), mf.Replace...)
+	for _, r := range replacements {
+		if r.New.Version == "" && !filepath.IsAbs(r.New.Path) {
+			if err = mf.AddReplace(r.Old.Path, r.Old.Version, filepath.Join(dir, r.New.Path), ""); err != nil {
+				return nil, err
+			}
+		}
+	}
+	moduleData, err = mf.Format()
+	if err != nil {
+		return nil, err
+	}
+	modPath := filepath.Join(temp, "go.mod")
+	if err = os.WriteFile(modPath, moduleData, 0600); err != nil {
+		return nil, err
+	}
+	if sums, e := os.ReadFile(filepath.Join(dir, "go.sum")); e == nil {
+		if err = os.WriteFile(filepath.Join(temp, "go.sum"), sums, 0600); err != nil {
+			return nil, err
+		}
+	} else if !errors.Is(e, os.ErrNotExist) {
+		return nil, e
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
+	defer cancel()
+
+	executable := filepath.Join(temp, "catalogExport")
+	// Build first, then execute the binary directly: cancellation kills the
+	// provider itself instead of only terminating a go-run wrapper process.
+	build := exec.CommandContext(ctx, "go", "build", "-mod=readonly", "-modfile", modPath, "-overlay", overlayPath, "-o", executable, virtual)
+	build.Dir = dir
+	build.Env = append(os.Environ(), "GOWORK=off")
+	build.WaitDelay = 2 * time.Second
+	build.Stdout = &limitedCatalogBuffer{limit: 64 << 10}
+	build.Stderr = &limitedCatalogBuffer{limit: 64 << 10}
+	if err = build.Run(); err != nil {
+		return nil, fmt.Errorf("workspace catalog %s.%s: build failed (%v); check module dependencies and func() errors.Catalog signature", cfg.Package, cfg.Function, err)
+	}
+	cmd := exec.CommandContext(ctx, executable)
+	cmd.Dir = dir
+	cmd.Env = append(os.Environ(), "GOWORK=off")
+	cmd.WaitDelay = 2 * time.Second
+	stdout := &limitedCatalogBuffer{limit: 1 << 20}
+	stderr := &limitedCatalogBuffer{limit: 64 << 10}
+	cmd.Stdout = stdout
+	cmd.Stderr = stderr
+	if err = cmd.Run(); err != nil {
+		if ctx.Err() != nil {
+			return nil, fmt.Errorf("workspace catalog %s: %w", cfg.Package, ctx.Err())
+		}
+		// Provider output can contain arbitrary application data. Do not echo it.
+		return nil, fmt.Errorf("workspace catalog %s.%s: execution failed (%v); provider must return errors.Catalog without writing stdout", cfg.Package, cfg.Function, err)
+	}
+	var catalog apierrors.Catalog
+	if err = apierrors.DecodeCatalogJSON(stdout.Bytes(), &catalog); err != nil {
+		return nil, errors.New("workspace catalog provider did not emit a valid catalog")
+	}
+	var normalized bytes.Buffer
+	if err = apierrors.ExportCatalog(&normalized, catalog); err != nil {
+		return nil, err
+	}
+	return normalized.Bytes(), nil
+}
+
+func prepareWorkspaceCatalogs(root string, configs []WorkspaceCatalog, check bool) (map[string][]byte, error) {
+	if len(configs) > 16 {
+		return nil, errors.New("workspace supports at most 16 catalog providers")
+	}
+	result := map[string][]byte{}
+	for _, cfg := range configs {
+		if err := safePath(root, cfg.Output); err != nil {
+			return nil, err
+		}
+		path := filepath.Join(root, filepath.FromSlash(cfg.Output))
+		for prior := range result {
+			if strings.EqualFold(prior, path) {
+				return nil, errors.New("workspace catalog outputs overlap")
+			}
+		}
+		data, err := exportWorkspaceCatalog(root, cfg)
+		if err != nil {
+			return nil, err
+		}
+		if check {
+			old, err := os.ReadFile(path)
+			if err != nil || !bytes.Equal(old, data) {
+				return nil, fmt.Errorf("workspace catalog drift: %s; run workspace generate", cfg.Output)
+			}
+		}
+		result[path] = data
+	}
+	return result, nil
+}
+
+func writeWorkspaceCatalog(path string, data []byte) error {
+	mode := os.FileMode(0644)
+	if stat, err := os.Lstat(path); err == nil {
+		if !stat.Mode().IsRegular() {
+			return errors.New("workspace catalog output must be a regular file")
+		}
+		mode = stat.Mode().Perm()
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return err
+	}
+	old, err := os.ReadFile(path)
+	if err == nil && bytes.Equal(old, data) {
+		return nil
+	}
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return err
+	}
+	f, err := os.CreateTemp(filepath.Dir(path), ".omni-catalog-*")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(f.Name())
+	if err = f.Chmod(mode); err != nil {
+		_ = f.Close()
+		return err
+	}
+	_, writeErr := io.Copy(f, bytes.NewReader(data))
+	err = errors.Join(writeErr, f.Close())
+	if err != nil {
+		return err
+	}
+	return os.Rename(f.Name(), path)
+}

cmd/go-omni/apigen/workspaceCatalog_test.go

@@ -0,0 +1,168 @@
+package apigen
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestWorkspaceSharedGoCatalog(t *testing.T) {
+	root := t.TempDir()
+	writeFile(t, filepath.Join(root, "go.mod"), fmt.Sprintf("module example.com/catalogs\n\ngo 1.24.0\nrequire %s v0.15.0-preview\nreplace %s => %s\n", frameworkModule, frameworkModule, strconvQuote(frameworkRoot(t))))
+	writeFile(t, filepath.Join(root, "internal/apierrors/catalog.go"), `package apierrors
+import errors "git.yuntuo.hk/k2safe/go-omni/errors"
+func Catalog() errors.Catalog {return errors.Catalog{DefaultStatus:400,Definitions:map[string]errors.Definition{
+"INVALID":{Code:"INVALID",Message:"invalid input"},"MISSING":{Status:404,Code:"MISSING",Message:"missing"},
+}}}
+`)
+	if err := os.MkdirAll(filepath.Join(root, "contracts"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	for _, name := range []string{"api", "id"} {
+		dir := filepath.Join(root, "services", name)
+		if _, err := New(Options{Dir: dir, Module: "example.com/" + name, FrameworkDir: frameworkRoot(t)}); err != nil {
+			t.Fatal(err)
+		}
+		writeFile(t, filepath.Join(dir, "api/omni.imports.json"), `{"roots":{"common":{"path":"../../../contracts"}},"errors":{"source":"@common/errors.json","include":["INVALID"],"routes":{"GET /api/greet/:name":["MISSING"]}}}`)
+	}
+	workspace := filepath.Join(root, "omni.workspace.json")
+	writeFile(t, workspace, `{"errorCatalogs":[{"dir":".","package":"example.com/catalogs/internal/apierrors","function":"Catalog","output":"contracts/errors.json"}],"services":[{"dir":"services/api"},{"dir":"services/id"}]}`)
+	if err := Workspace(workspace, "generate", io.Discard); err != nil {
+		t.Fatal(err)
+	}
+	if err := Workspace(workspace, "format", io.Discard); err != nil {
+		t.Fatal(err)
+	}
+	if err := Workspace(workspace, "generate", io.Discard); err != nil {
+		t.Fatal(err)
+	}
+	before := snapshot(t, root)
+	if err := Workspace(workspace, "check", io.Discard); err != nil {
+		t.Fatal(err)
+	}
+	if !sameFiles(before, snapshot(t, root)) {
+		t.Fatal("check wrote project files")
+	}
+	for _, name := range []string{"api", "id"} {
+		entry := filepath.Join(root, "services", name, "api/service.api")
+		spec, err := Parse(entry)
+		if err != nil {
+			t.Fatal(err)
+		}
+		c, err := Compile(spec)
+		if err != nil {
+			t.Fatal(err)
+		}
+		op := operation(t, document(t, c), "/api/greet/{name}", "get")
+		if op["responses"].(map[string]any)["404"] == nil || len(spec.Errors) != 0 || len(spec.Routes[0].Errors) != 0 {
+			t.Fatal("selection changed runtime catalog")
+		}
+		if _, err = os.Stat(filepath.Join(filepath.Dir(entry), catalogDocumentFile)); !os.IsNotExist(err) {
+			t.Fatal("shared catalog was copied")
+		}
+	}
+	shared := filepath.Join(root, "contracts/errors.json")
+	data := readFile(t, shared)
+	writeFile(t, shared, strings.Replace(data, "invalid input", "stale", 1))
+	before = snapshot(t, root)
+	if err := Workspace(workspace, "check", io.Discard); err == nil || !strings.Contains(err.Error(), "catalog drift") {
+		t.Fatal(err)
+	}
+	if !sameFiles(before, snapshot(t, root)) {
+		t.Fatal("drift check wrote files")
+	}
+	if err := Workspace(workspace, "generate", io.Discard); err != nil {
+		t.Fatal(err)
+	}
+	if got := readFile(t, shared); got != data {
+		t.Fatal("catalog not refreshed")
+	}
+	// Failed provider/preflight may not update even the shared metadata.
+	source := filepath.Join(root, "internal/apierrors/catalog.go")
+	writeFile(t, source, readFile(t, source)+"\ninvalid go source")
+	before = snapshot(t, root)
+	if err := Workspace(workspace, "generate", io.Discard); err == nil {
+		t.Fatal("provider failure ignored")
+	}
+	if !sameFiles(before, snapshot(t, root)) {
+		t.Fatal("provider failure mutated project")
+	}
+}
+
+func TestDocumentSelectionBoundaries(t *testing.T) {
+	root := t.TempDir()
+	local := filepath.Join(root, "api")
+	shared := filepath.Join(root, "shared")
+	entry := filepath.Join(local, "service.api")
+	writeFile(t, entry, "service demo {\n@handler list\nget /list returns ([]string)\n}\n")
+	writeFile(t, filepath.Join(shared, "errors.json"), `{"defaultStatus":400,"definitions":{"INVALID":{"code":400002,"message":"invalid"}}}`)
+	for _, cfg := range []string{
+		`{"source":"@common/errors.json","include":["UNKNOWN"]}`,
+		`{"source":"@common/errors.json","routes":{"GET /absent":["INVALID"]}}`,
+		`{"source":"@common/../api/service.api"}`,
+		`{"source":"../shared/errors.json"}`,
+	} {
+		writeFile(t, filepath.Join(local, importsFile), `{"roots":{"common":{"path":"../shared"}},"errors":`+cfg+`}`)
+		if _, err := Parse(entry); err == nil {
+			t.Fatal("bad selection accepted", cfg)
+		}
+	}
+	writeFile(t, filepath.Join(local, importsFile), `{"roots":{"common":{"path":"../shared"}},"errors":{"source":"@common/errors.json","include":[]}}`)
+	spec, err := Parse(entry)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(documentRouteCatalog(spec, spec.Routes[0]).Definitions) != 0 {
+		t.Fatal("empty include ignored")
+	}
+	seeded, err := sharedSeeds(spec, filepath.Join(root, "generated"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var cfg sharedConfig
+	if err = json.Unmarshal(seeded, &cfg); err != nil {
+		t.Fatal(err)
+	}
+	if cfg.Errors.Include == nil || !bytes.Contains(seeded, []byte(`"include": []`)) {
+		t.Fatal("empty selection lost during relocation")
+	}
+}
+
+func TestWorkspaceCatalogPathsAndProviderValidation(t *testing.T) {
+	root := t.TempDir()
+	writeFile(t, filepath.Join(root, "go.mod"), "module example.com/test\ngo 1.24.0\n")
+	good := WorkspaceCatalog{Dir: ".", Package: "example.com/test/internal/errors", Function: "Catalog", Output: "errors.json"}
+	cases := []WorkspaceCatalog{}
+	for _, change := range []func(*WorkspaceCatalog){
+		func(c *WorkspaceCatalog) { c.Dir = "../outside" },
+		func(c *WorkspaceCatalog) { c.Output = "../outside.json" },
+		func(c *WorkspaceCatalog) { c.Package = "example.com/pkg;bad" },
+		func(c *WorkspaceCatalog) { c.Function = "Catalog()" },
+		func(c *WorkspaceCatalog) { c.Output = "go.mod" },
+	} {
+		c := good
+		change(&c)
+		cases = append(cases, c)
+	}
+	for _, c := range cases {
+		if _, err := exportWorkspaceCatalog(root, c); err == nil {
+			t.Fatal("bad provider accepted", c)
+		}
+	}
+	outside := filepath.Join(t.TempDir(), "errors.json")
+	writeFile(t, outside, `{}`)
+	if err := os.Symlink(outside, filepath.Join(root, "errors.json")); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := prepareWorkspaceCatalogs(root, []WorkspaceCatalog{good}, false); err == nil {
+		t.Fatal("symlink output accepted")
+	}
+	if readFile(t, outside) != `{}` {
+		t.Fatal("outside file modified")
+	}
+}

cmd/go-omni/apigen/workspace_test.go

@@ -0,0 +1,43 @@
+package apigen
+
+import (
+	"io"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestWorkspaceIndependentModules(t *testing.T) {
+	root := t.TempDir()
+	for _, name := range []string{"api", "id"} {
+		dir := filepath.Join(root, "services", name)
+		if _, err := New(Options{Dir: dir, Module: "example.com/" + name, FrameworkDir: frameworkRoot(t)}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	config := filepath.Join(root, "omni.workspace.json")
+	writeFile(t, config, `{"services":[{"dir":"services/api"},{"dir":"services/id"}]}`)
+	for _, op := range []string{"format", "generate", "check", "generate", "check"} {
+		if err := Workspace(config, op, io.Discard); err != nil {
+			t.Fatal(op, err)
+		}
+	}
+	// A bad second service must not leave the first service partially regenerated.
+	first := filepath.Join(root, "services/api/api/service.api")
+	writeFile(t, first, strings.Replace(readFile(t, first), "Greet a visitor", "Greet", 1))
+	second := filepath.Join(root, "services/id/api/service.api")
+	writeFile(t, second, "invalid source")
+	before := snapshot(t, root)
+	if err := Workspace(config, "generate", io.Discard); err == nil {
+		t.Fatal("invalid workspace accepted")
+	}
+	if !sameFiles(before, snapshot(t, root)) {
+		t.Fatal("preflight failure changed project")
+	}
+	for _, bad := range []string{`{"services":[{"dir":"../outside"}]}`, `{"services":[{"dir":"services/api"},{"dir":"services/api/nested"}]}`, `{"services":[{"dir":"services/api","dir":"services/id"}]}`} {
+		writeFile(t, config, bad)
+		if err := Workspace(config, "check", io.Discard); err == nil {
+			t.Fatal("invalid workspace accepted")
+		}
+	}
+}

cmd/go-omni/apigen/write.go

@@ -16,11 +16,13 @@ import (
 const manifestPath = ".goOmni/apiManifest.json"
 
 type manifest struct {
-	Profile   *projectProfile   `json:"profile,omitempty"`
-	Version   int               `json:"version"`
-	Module    string            `json:"module"`
-	Entry     string            `json:"entry"`
-	Generated map[string]string `json:"generated"`
+	TemplateVersion string            `json:"templateVersion,omitempty"`
+	Profile         *projectProfile   `json:"profile,omitempty"`
+	Version         int               `json:"version"`
+	Module          string            `json:"module"`
+	Entry           string            `json:"entry"`
+	Generated       map[string]string `json:"generated"`
+	Contract        *contractSnapshot `json:"contract,omitempty"`
 }
 type change struct {
 	name            string
@@ -29,7 +31,7 @@ type change struct {
 	mode            os.FileMode
 }
 
-func apply(root, module, entry string, generated, seeds map[string][]byte, check bool, profile projectProfile) (Output, error) {
+func apply(root, module, entry string, generated, seeds map[string][]byte, check, dryRun bool, profile projectProfile, contract *contractSnapshot, lockHeld ...bool) (Output, error) {
 	var result Output
 	if info, err := os.Lstat(root); err == nil {
 		if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
@@ -60,7 +62,7 @@ func apply(root, module, entry string, generated, seeds map[string][]byte, check
 	if err := safePath(root, manifestPath); err != nil {
 		return result, err
 	}
-	if !check {
+	if !check && !dryRun && !(len(lockHeld) > 0 && lockHeld[0]) {
 		if err := os.MkdirAll(filepath.Join(root, ".goOmni"), 0755); err != nil {
 			return result, err
 		}
@@ -82,7 +84,7 @@ func apply(root, module, entry string, generated, seeds map[string][]byte, check
 		if old.Profile != nil && *old.Profile != profile {
 			return result, errors.New("api: profile changed during generation; retry")
 		}
-		if old.Version != 1 || old.Module != module || old.Entry != entry {
+		if old.Version != 2 || old.Module != module || old.Entry != entry {
 			return result, errors.New("api: manifest version/module/entry differs; one API entry owns this project")
 		}
 	} else if !errors.Is(err, os.ErrNotExist) {
@@ -107,7 +109,7 @@ func apply(root, module, entry string, generated, seeds map[string][]byte, check
 			return result, err
 		}
 	}
-	next := manifest{Profile: &profile, Version: 1, Module: module, Entry: entry, Generated: map[string]string{}}
+	next := manifest{TemplateVersion: minimumVersion, Profile: &profile, Version: 2, Module: module, Entry: entry, Generated: map[string]string{}, Contract: contract}
 	for name, data := range generated {
 		next.Generated[name] = digest(data)
 	}
@@ -179,6 +181,20 @@ func apply(root, module, entry string, generated, seeds map[string][]byte, check
 		}
 		changes = append(changes, change{name: name, before: current, after: content, existed: exists, mode: mode})
 	}
+	result.Diagnostics = append(result.Diagnostics, compareContracts(old.Contract, contract)...)
+	logicDiagnostics, locations := checkLogic(root, module, contract, seeds)
+	for i := range result.Diagnostics {
+		if d := &result.Diagnostics[i]; d.Code == "contractChanged" {
+			if location, found := locations[d.Path]; found {
+				d.Path, d.Line = location.path, location.line
+			}
+		}
+	}
+	result.Diagnostics = append(result.Diagnostics, logicDiagnostics...)
+	if oldData != nil && old.Contract == nil {
+		result.Diagnostics = append(result.Diagnostics, Diagnostic{Severity: "review", Code: "contractBaseline", Path: manifestPath, Message: "no saved contract snapshot; past contract changes cannot be compared; regeneration establishes a baseline"})
+	}
+	sortDiagnostics(result.Diagnostics)
 	data, err := json.MarshalIndent(next, "", "  ")
 	if err != nil {
 		return result, err
@@ -188,16 +204,33 @@ func apply(root, module, entry string, generated, seeds map[string][]byte, check
 		changes = append(changes, change{name: manifestPath, before: oldData, after: data, existed: oldData != nil, mode: 0644})
 	}
 	sort.Strings(result.Removed)
+	for _, c := range changes {
+		action := "create"
+		if c.remove {
+			action = "remove"
+		} else if c.existed {
+			action = "update"
+		}
+		result.Changes = append(result.Changes, FileChange{Path: c.name, Action: action})
+	}
+	sort.Slice(result.Changes, func(i, j int) bool { return result.Changes[i].Path < result.Changes[j].Path })
+	if dryRun {
+		return result, nil
+	}
 	if check {
+		var checkErr error
 		if len(changes) > 0 {
 			var stale []string
 			for _, c := range changes {
 				stale = append(stale, c.name)
 			}
 			sort.Strings(stale)
-			return result, fmt.Errorf("api: generated project is stale: %s", strings.Join(stale, ", "))
+			checkErr = fmt.Errorf("api: generated project is stale: %s", strings.Join(stale, ", "))
 		}
-		return result, nil
+		if count := diagnosticErrors(result.Diagnostics); count > 0 {
+			checkErr = errors.Join(checkErr, fmt.Errorf("api: %d Logic source checks failed; see diagnostics and run go test ./... after fixing business code", count))
+		}
+		return result, checkErr
 	}
 	// A rollback restores bytes/modes if an ordinary filesystem write fails.
 	// File replacement is atomic; the whole directory is not crash-atomic.
@@ -239,7 +272,13 @@ func apply(root, module, entry string, generated, seeds map[string][]byte, check
 }
 func digest(data []byte) string { sum := sha256.Sum256(data); return hex.EncodeToString(sum[:]) }
 func ownedPath(name string) bool {
-	if name == "docs/openapi.json" || name == "internal/types/typesGen.go" || name == "internal/handler/routesGen.go" || name == "internal/handler/openapiGen.go" || name == "internal/middleware/registryGen.go" {
+	if strings.HasPrefix(name, "internal/types/dto") && strings.HasSuffix(name, "Gen.go") && goName.MatchString(strings.TrimSuffix(filepath.Base(name), ".go")) {
+		return true
+	}
+	if name == "main.go" || name == "internal/svc/runtimeGen.go" || name == "internal/handler/appGen.go" || name == "internal/handler/responseGen.go" || name == "internal/types/scalarsGen.go" {
+		return true
+	}
+	if name == "internal/apierrors/errorsGen.go" || name == "docs/openapi.json" || name == "internal/types/typesGen.go" || name == "internal/handler/routesGen.go" || name == "internal/handler/openapiGen.go" || name == "internal/middleware/registryGen.go" {
 		return true
 	}
 	return strings.HasPrefix(name, "internal/handler/") && strings.HasSuffix(name, "/handlersGen.go")

cmd/go-omni/main.go

@@ -18,6 +18,11 @@ func main() {
 	}
 
 	switch os.Args[1] {
+	case "workspace":
+		if err := runWorkspace(os.Args[2:]); err != nil {
+			fmt.Fprintln(os.Stderr, "go-omni workspace:", err)
+			os.Exit(1)
+		}
 	case "api":
 		if err := runAPI(os.Args[2:]); err != nil {
 			fmt.Fprintln(os.Stderr, "go-omni api:", err)
@@ -142,26 +147,22 @@ func runNew(args []string) error {
 		options.Module = filepath.Base(filepath.Clean(target))
 	}
 	options.Dir = target
+	if options.Force {
+		return errors.New("managed projects do not accept --force; use api generate to update owned files")
+	}
+	o := apigen.Options{API: apiFile, Dir: target, Module: options.Module, FrameworkDir: options.FrameworkDir, FrameworkVersion: options.FrameworkVersion, LogOutput: options.LogOutput, LogFormat: options.LogFormat, Database: options.Database, Storage: options.Storage}
+	var err error
+	var out apigen.Output
 	if apiFile != "" {
-		if options.Force {
-			return errors.New("--api protects existing business code and does not accept --force")
-		}
-		_, err := apigen.Generate(apigen.Options{API: apiFile, Dir: target, Module: options.Module, FrameworkDir: options.FrameworkDir, FrameworkVersion: options.FrameworkVersion, LogOutput: options.LogOutput, LogFormat: options.LogFormat, Database: options.Database, Storage: options.Storage})
-		if err != nil {
-			return err
-		}
-		fmt.Printf("created API project %s; implement internal/service operations\n", filepath.Clean(target))
-		return nil
+		out, err = apigen.Generate(o)
+	} else {
+		out, err = apigen.New(o)
 	}
-	if _, err := os.Lstat(filepath.Join(target, ".goOmni", "apiManifest.json")); err == nil {
-		return errors.New("this is an API project; use api generate instead of the CRUD/module starter")
-	} else if !errors.Is(err, os.ErrNotExist) {
+	printAPIDiagnostics(out.Diagnostics)
+	if err != nil {
 		return err
 	}
-	if err := scaffold.Generate(options); err != nil {
-		return err
-	}
-	fmt.Printf("created GoOmni project %s\n", filepath.Clean(target))
+	fmt.Printf("created API project %s; implement internal/logic operations; run with go run .\n", filepath.Clean(target))
 	return nil
 }
 
@@ -170,15 +171,20 @@ func usage() {
 	fmt.Fprintln(os.Stderr, "")
 	fmt.Fprintln(os.Stderr, "Usage:")
 	fmt.Fprintln(os.Stderr, "  go-omni migrate [--dir migrations] [--apply] [--dsn-env GO_OMNI_DB_DSN]")
-	fmt.Fprintln(os.Stderr, "  go-omni new [--module <module>] [--force] <directory>")
+	fmt.Fprintln(os.Stderr, "  go-omni new [--module <module>] <directory>")
 	fmt.Fprintln(os.Stderr, "  go-omni new --api <file.api> [--module <module>] <directory>")
 	fmt.Fprintln(os.Stderr, "  go-omni api new [--module <module>] <directory>  Create a runnable API project")
-	fmt.Fprintln(os.Stderr, "  go-omni api generate --api <file.api> --dir <project> [--check]")
+	fmt.Fprintln(os.Stderr, "  go-omni api generate [--api <file.api>] [--dir <project>] [--check|--dry-run]")
+	fmt.Fprintln(os.Stderr, "  go-omni api format [--api <file.api>] [--check]")
+	fmt.Fprintln(os.Stderr, "  go-omni api upgrade [--dir <project>] [--dry-run|--preview <directory>|--apply]")
+	fmt.Fprintln(os.Stderr, "  go-omni workspace <format|generate|check> [--file omni.workspace.json]")
+	fmt.Fprintln(os.Stderr, "  go-omni api inspect [--api <file.api>]  Show routes, auth and business errors")
+	fmt.Fprintln(os.Stderr, "  go-omni api export [--api <file.api>]   Write OpenAPI JSON to stdout")
 	fmt.Fprintln(os.Stderr, "  go-omni api validate --api <file.api>  Validate definitions and OpenAPI")
 	fmt.Fprintln(os.Stderr, "  go-omni add <name> [--dir <project>]  Generate an isolated business module")
 	fmt.Fprintln(os.Stderr, "  --framework-version <version>  Pin a remote framework version (defaults to CLI version)")
 	fmt.Fprintln(os.Stderr, "  --framework-dir <directory>    Use a local framework checkout")
-	fmt.Fprintln(os.Stderr, "  --database <none|memory|mysql>       API defaults to none; CRUD defaults to memory")
+	fmt.Fprintln(os.Stderr, "  --database <none|memory|mysql>       Defaults to none")
 	fmt.Fprintln(os.Stderr, "  --log-output <stdout|stderr|file>  Generate configured logging (default stderr)")
 	fmt.Fprintln(os.Stderr, "  --log-format <json|text>          Select structured log format (default json)")
 	fmt.Fprintln(os.Stderr, "  --storage <none|local|s3|r2|oss>   Select optional storage adapter (default none)")
@@ -205,6 +211,9 @@ func runAdd(args []string) error {
 			return fmt.Errorf("unexpected argument %q", arg)
 		}
 	}
+	if _, err := os.Stat(filepath.Join(directory, ".goOmni", "apiManifest.json")); err == nil {
+		return errors.New("managed API projects add modules through .api imports and api generate")
+	}
 	if err := scaffold.AddModule(directory, name); err != nil {
 		return err
 	}

cmd/go-omni/main_test.go

@@ -8,7 +8,7 @@ import (
 )
 
 func TestNewWithRemoteFrameworkVersion(t *testing.T) {
-	for _, flag := range [][]string{{"--framework-version", "v0.1.0"}, {"--framework-version=v0.1.0"}} {
+	for _, flag := range [][]string{{"--framework-version", "v0.16.0-preview"}, {"--framework-version=v0.16.0-preview"}} {
 		project := filepath.Join(t.TempDir(), "billing")
 		args := append([]string{"--module", "example.com/billing"}, flag...)
 		if err := runNew(append(args, project)); err != nil {
@@ -18,7 +18,7 @@ func TestNewWithRemoteFrameworkVersion(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		if !strings.Contains(string(content), "go-omni v0.1.0") || strings.Contains(string(content), "replace ") {
+		if !strings.Contains(string(content), "go-omni v0.16.0-preview") || strings.Contains(string(content), "replace ") {
 			t.Fatalf("CLI did not pin remote dependency: %s", content)
 		}
 	}
@@ -42,11 +42,8 @@ func TestAddModuleCLI(t *testing.T) {
 		if equals {
 			args = []string{"--dir=" + project, "orders"}
 		}
-		if err := runAdd(args); err != nil {
-			t.Fatal(err)
-		}
-		if _, err := os.Stat(filepath.Join(project, "internal/orders/module.go")); err != nil {
-			t.Fatal(err)
+		if err := runAdd(args); err == nil || !strings.Contains(err.Error(), ".api imports") {
+			t.Fatalf("expected contract-driven module guidance: %v", err)
 		}
 	}
 	for _, args := range [][]string{nil, {"orders", "--dir"}, {"orders", "--dir="}, {"orders", "extra"}, {"orders", "--unknown"}} {
@@ -63,7 +60,7 @@ func TestNewMySQLDatabaseOptions(t *testing.T) {
 		if err := runNew(append(args, project)); err != nil {
 			t.Fatal(err)
 		}
-		if _, err := os.Stat(filepath.Join(project, "schema.sql")); err != nil {
+		if _, err := os.Stat(filepath.Join(project, "internal/svc/serviceContext.go")); err != nil {
 			t.Fatal(err)
 		}
 	}

cmd/go-omni/scaffold/apiInfrastructure.go

@@ -8,14 +8,36 @@ import (
 // APIInfrastructure renders shared infrastructure without inventing business
 // tables or routes. The API generator applies these as developer-owned seeds.
 func APIInfrastructure(module, database, storage, logOutput, logFormat string) (map[string][]byte, error) {
+	return apiInfrastructure(module, database, storage, logOutput, logFormat, false)
+}
+
+// LegacyAPIInfrastructure renders only the known v0.13 seed baseline for a safe upgrade.
+func LegacyAPIInfrastructure(module, database, storage, logOutput, logFormat string) (map[string][]byte, error) {
+	return apiInfrastructure(module, database, storage, logOutput, logFormat, true)
+}
+func apiInfrastructure(module, database, storage, logOutput, logFormat string, legacy bool) (map[string][]byte, error) {
 	data := templateData{Module: module, Database: database, Storage: storage, LogOutput: logOutput, LogFormat: logFormat, API: true, Modules: true}
 	files := map[string]string{
-		"internal/settings/config.go":        "templates/modules-settings.go.tmpl",
-		"etc/config.yaml":                    "templates/modules-config.yaml.tmpl",
-		"internal/servicecontext/context.go": "templates/api-context.go.tmpl",
+		"internal/svc/runtimeGen.go":     "templates/api-runtime.go.tmpl",
+		"internal/svc/options.go":        "templates/api-options.go.tmpl",
+		"internal/config/config.go":      "templates/api-config.go.tmpl",
+		"etc/config.yaml":                "templates/modules-config.yaml.tmpl",
+		"internal/svc/serviceContext.go": "templates/api-context.go.tmpl",
+	}
+	if database == "mysql" {
+		files["internal/svc/databaseOptions.go"] = "templates/api-databaseOptions.go.tmpl"
 	}
 	if storage != "none" {
-		files["internal/servicecontext/storage.go"] = "templates/modules-storage.go.tmpl"
+		files["internal/svc/storage.go"] = "templates/modules-storage.go.tmpl"
+	}
+	if legacy {
+		delete(files, "internal/svc/runtimeGen.go")
+		delete(files, "internal/svc/databaseOptions.go")
+		files["internal/svc/close.go"] = "templates/api-close.go.tmpl"
+		files["internal/config/config.go"] = "templates/modules-settings.go.tmpl"
+		for name, source := range files {
+			files[name] = strings.Replace(source, "templates/", "templates/legacyV013/", 1)
+		}
 	}
 	result := make(map[string][]byte, len(files))
 	for name, source := range files {
@@ -23,6 +45,15 @@ func APIInfrastructure(module, database, storage, logOutput, logFormat string) (
 		if err != nil {
 			return nil, fmt.Errorf("render %s: %w", name, err)
 		}
+		content = strings.ReplaceAll(content, "package settings", "package config")
+		content = strings.ReplaceAll(content, "package servicecontext", "package svc")
+		content = strings.ReplaceAll(content, "/internal/settings", "/internal/config")
+		content = strings.ReplaceAll(content, "settings.", "config.")
+		if strings.HasPrefix(name, "internal/svc/") {
+			content = strings.ReplaceAll(content, "*Context", "*ServiceContext")
+			content = strings.ReplaceAll(content, "&Context{", "&ServiceContext{")
+			content = strings.ReplaceAll(content, "type Context struct", "type ServiceContext struct")
+		}
 		result[name] = []byte(strings.TrimRight(content, "\n") + "\n")
 	}
 	return result, nil

cmd/go-omni/scaffold/templates/api-close.go.tmpl

@@ -0,0 +1,23 @@
+package servicecontext
+import "errors"
+// Close is idempotent, including startup failure and graceful shutdown.
+func(c *Context)Close()error{
+ if c==nil{return nil}
+ c.closeOnce.Do(func(){
+ if c.Lifecycle!=nil{c.Lifecycle.RequestShutdown(nil)}
+ c.closeMu.Lock();c.closed=true;cleanups:=c.cleanups;c.cleanups=nil;c.closeMu.Unlock()
+ for i:=len(cleanups)-1;i>=0;i--{c.closeErr=errors.Join(c.closeErr,cleanups[i]())}
+ {{if ne .Storage "none"}}if c.storageClose!=nil{c.closeErr=errors.Join(c.closeErr,c.storageClose())}{{end}}
+ {{if eq .Database "mysql"}}if c.DB!=nil{c.closeErr=errors.Join(c.closeErr,c.DB.Close())}{{end}}
+ })
+ return c.closeErr
+}
+
+// OnClose transfers a resource cleanup to this context immediately after creation.
+// Hooks run once in reverse order, also when later initialization fails.
+func(c *Context)OnClose(cleanup func()error) {
+ if cleanup==nil{return}
+ c.closeMu.Lock();defer c.closeMu.Unlock()
+ if c.closed{panic("svc: register cleanup after Close")}
+ c.cleanups=append(c.cleanups,cleanup)
+}

cmd/go-omni/scaffold/templates/api-config.go.tmpl

@@ -0,0 +1,104 @@
+package settings
+import (
+ "os"
+ {{if and (not .API) (ne .Storage "none")}}"strings"{{end}}
+ "time"
+ "git.yuntuo.hk/k2safe/go-omni/config"
+ "git.yuntuo.hk/k2safe/go-omni/logx"
+ {{if eq .Database "mysql"}}mysqladapter "git.yuntuo.hk/k2safe/go-omni/database/mysql"{{end}}
+ {{if ne .Storage "none"}}"errors"
+ {{if ne .Storage "r2"}}"net/url"{{else}}"regexp"{{end}}
+ "git.yuntuo.hk/k2safe/go-omni/storage"{{end}}
+)
+type Config struct {
+ Server config.Config `json:"server"`
+ {{if eq .Database "mysql"}}Database mysqladapter.Config `json:"database" env:"GO_OMNI_DB"`{{end}}
+ {{if ne .Storage "none"}}Storage StorageConfig `json:"storage" env:"GO_OMNI_STORAGE"`{{end}}
+}
+func Default() Config {
+ server:=config.Default()
+ server.Address="127.0.0.1:8080"
+ server.EnableLogger=true
+ server.SlowRequestThreshold=500*time.Millisecond
+ server.Log.Service={{printf "%q" .Module}}
+ server.Log.Format={{printf "%q" .LogFormat}}
+ {{if eq .LogOutput "file"}}server.Log.File="./var/log/server.log"
+ server.Log.Rotation=logx.RotationConfig{Enabled:true,MaxSizeMB:100,MaxBackups:10,MaxAgeDays:7,Compress:true}
+ {{else}}server.Log.Output={{printf "%q" .LogOutput}}{{end}}
+ return Config{Server:server{{if and .API (eq .Database "mysql")}},Database:mysqladapter.DefaultConfig(){{end}}{{if ne .Storage "none"}},Storage:StorageConfig{
+  Provider:{{printf "%q" .Storage}}, Root:"./var/files", PublicURL:"http://127.0.0.1:8080/storage/object",
+  Secure:true, MaxBytes:32<<20, ContentTypes:[]string{"text/plain","image/png","image/jpeg","application/pdf"},
+  LinkTTL:5*time.Minute, RequestTimeout:30*time.Second,
+  {{if eq .Storage "s3"}}Region:"us-east-1",{{end}}
+  {{if eq .Storage "r2"}}Region:"auto",{{end}}
+  {{if eq .Storage "oss"}}Region:"cn-hangzhou",{{end}}
+ }{{end}}}
+}
+
+// Load applies defaults -> file -> typed environment -> validation.
+// New fields automatically use GO_OMNI_<JSON_PATH>, or an explicit env tag.
+func Load(path string)(Config,error){
+ cfg:=Default();var err error
+ cfg,err=config.ApplyDefaults(cfg);if err!=nil{return Config{},err}
+ if path!="" {cfg,err=config.DecodeFile(path,cfg);if err!=nil{return Config{},err}}
+ cfg,err=config.OverlayEnv(cfg,config.EnvOptions{Prefix:"GO_OMNI_",Empty:"ignore",Aliases:config.ServerEnvAliases("GO_OMNI_","server")});if err!=nil{return Config{},err}
+ output,outputSet:=os.LookupEnv("GO_OMNI_SERVER_LOG_OUTPUT");if !outputSet {output=os.Getenv("GO_OMNI_LOG_OUTPUT")}
+ file,fileSet:=os.LookupEnv("GO_OMNI_SERVER_LOG_FILE");if !fileSet {file=os.Getenv("GO_OMNI_LOG_FILE")}
+ if output!="" && file=="" {cfg.Server.Log.File="";cfg.Server.Log.Rotation=logx.RotationConfig{}}
+ return cfg,cfg.Validate()
+}
+func(c Config)Validate()error{
+ if err:=c.Server.Validate();err!=nil{return err}
+ {{if eq .Database "mysql"}}if err:=c.Database.Validate();err!=nil{return err}{{end}}
+ {{if ne .Storage "none"}}if err:=c.Storage.Validate();err!=nil{return err}{{end}}
+ return nil
+}
+{{if ne .Storage "none"}}
+type StorageConfig struct {
+ Provider string `json:"provider"`
+ Root string `json:"root"`
+ PublicURL string `json:"publicUrl"`
+ Endpoint string `json:"endpoint"`
+ Region string `json:"region"`
+ Bucket string `json:"bucket"`
+ AccountID string `json:"accountId"`
+ Secure bool `json:"secure"`
+ MaxBytes int64 `json:"maxBytes"`
+ ContentTypes []string `json:"contentTypes"`
+ LinkTTL time.Duration `json:"linkTtl"`
+ RequestTimeout time.Duration `json:"requestTimeout"`
+ // Secrets are environment-only and cannot be populated by config files.
+ FilesToken string `json:"-" env:"GO_OMNI_FILES_TOKEN,secret"`
+ SigningKey string `json:"-" env:"GO_OMNI_STORAGE_SIGNING_KEY,secret"`
+ AccessKey string `json:"-" env:"GO_OMNI_STORAGE_ACCESS_KEY,secret"`
+ SecretKey string `json:"-" env:"GO_OMNI_STORAGE_SECRET_KEY,secret"`
+ SessionToken string `json:"-" env:"GO_OMNI_STORAGE_SESSION_TOKEN,secret"`
+}
+func (s StorageConfig) Policy()storage.UploadPolicy{return storage.UploadPolicy{MaxBytes:s.MaxBytes,ContentTypes:s.ContentTypes}}
+func (s StorageConfig) Validate()error {
+ if s.Provider!={{printf "%q" .Storage}} {return errors.New("storage.provider must match the adapter selected at generation")}
+ if err:=s.Policy().Validate();err!=nil{return err}
+ if s.LinkTTL<time.Second || s.LinkTTL>time.Hour{return errors.New("storage.linkTtl must be 1s..1h")}
+ if s.RequestTimeout<=0 || s.RequestTimeout>5*time.Minute{return errors.New("storage.requestTimeout must be >0 and <=5m")}
+ {{if not .API}}if len(s.FilesToken)<32 || strings.ContainsAny(s.FilesToken," \t\r\n") {return errors.New("set GO_OMNI_FILES_TOKEN to a token of at least 32 bytes without whitespace")}{{end}}
+ {{if eq .Storage "local"}}
+ if s.Root=="" {return errors.New("storage.root is required")}
+ u,err:=url.Parse(s.PublicURL)
+ if err!=nil || u.Host=="" || u.Hostname()=="" || (u.Scheme!="http" && u.Scheme!="https") || u.User!=nil || u.RawQuery!="" || u.Fragment!="" || u.Path!="/storage/object" {return errors.New("storage.publicUrl must be an absolute HTTP(S) URL ending in /storage/object")}
+ if len(s.SigningKey)<32 {return errors.New("set GO_OMNI_STORAGE_SIGNING_KEY to a stable secret of at least 32 bytes")}
+ {{else}}
+ if s.Bucket=="" || s.Region=="" || s.AccessKey=="" || s.SecretKey=="" {return errors.New("storage bucket, region and GO_OMNI_STORAGE_ACCESS_KEY/SECRET_KEY are required")}
+ {{if eq .Storage "r2"}}
+ if !regexp.MustCompile(`^[a-fA-F0-9]{32}$`).MatchString(s.AccountID) || s.Region!="auto" || !s.Secure {return errors.New("R2 requires a 32-hex accountId, region auto and secure=true")}
+ if s.Endpoint!=""{return errors.New("this R2 profile derives endpoint from accountId; customize servicecontext for a jurisdiction-specific endpoint")}
+ {{else if eq .Storage "s3"}}
+ u,err:=url.Parse("https://"+s.Endpoint)
+ if err!=nil || s.Endpoint=="" || u.Hostname()=="" || u.User!=nil || u.Path!="" || u.RawQuery!="" || u.Fragment!="" {return errors.New("S3 endpoint must be host[:port] without scheme or path")}
+ {{else if eq .Storage "oss"}}
+ if s.Endpoint!="" {u,err:=url.Parse(s.Endpoint);if err!=nil || u.Scheme!="https" || u.Hostname()=="" || u.User!=nil || u.Path!="" || u.RawQuery!="" || u.Fragment!="" {return errors.New("OSS endpoint must be an HTTPS origin")}}
+ if !s.Secure{return errors.New("OSS requires secure=true")}
+ {{end}}
+ {{end}}
+ return nil
+}
+{{end}}

cmd/go-omni/scaffold/templates/api-context.go.tmpl

@@ -1,22 +1,20 @@
 package servicecontext
 import (
  "context"
- "errors"
- "sync"
  {{if ne .Storage "none"}}"net/http"
  "git.yuntuo.hk/k2safe/go-omni/storage"{{end}}
- {{if eq .Database "mysql"}}"time"
- "git.yuntuo.hk/k2safe/go-omni/database"
- "github.com/go-sql-driver/mysql"{{end}}
+ {{if eq .Database "mysql"}}"git.yuntuo.hk/k2safe/go-omni/database"{{end}}
  "git.yuntuo.hk/k2safe/go-omni/health"
  "git.yuntuo.hk/k2safe/go-omni/httpx"
  "git.yuntuo.hk/k2safe/go-omni/logx"
+ "git.yuntuo.hk/k2safe/go-omni/lifecycle"
  "{{.Module}}/internal/settings"
- "{{.Module}}/internal/middleware"
 )
-// Context owns infrastructure, while Logger is borrowed from main.
-// Add business repositories here; HTTP contracts do not define database tables.
+// Context holds project dependencies. Runtime owns cleanup and shutdown.
+// Logger is borrowed; the generated entry closes it after dependencies.
 type Context struct {
+ *lifecycle.Runtime
+ Config settings.Config
  Logger *logx.Logger
  Health *health.Checker
  Middlewares map[string]httpx.Middleware
@@ -27,43 +25,11 @@ type Context struct {
  Downloads storage.Presigner
  UploadLinks storage.UploadPresigner
  FileHTTP http.Handler
- storageClose func()error
  {{end}}
- closeMu sync.Mutex
- closed bool
- closeOnce sync.Once
- closeErr error
-}
-// Pass the settings loaded by main. The optional form supports lightweight
-// tests without infrastructure; selected adapters still require valid settings.
-func New(ctx context.Context,logger *logx.Logger,configs ...settings.Config)(result *Context,err error){
- if ctx==nil{ctx=context.Background()}
- if err=ctx.Err();err!=nil{return nil,err}
- if len(configs)>1{return nil,errors.New("expected at most one configuration")}
- cfg:=settings.Default();if len(configs)==1{cfg=configs[0]}
- _=cfg
- checker,err:=health.New();if err!=nil{return nil,err}
- c:=&Context{Logger:logger,Health:checker,Middlewares:middleware.Defaults()}
- defer func(){if err!=nil{err=errors.Join(err,c.Close())}}()
- {{if eq .Database "mysql"}}
- if err=cfg.Validate();err!=nil{return nil,err}
- dsn,parseErr:=mysql.ParseDSN(cfg.Database.DSN)
- if parseErr!=nil || dsn.DBName=="" {return nil,errors.New("GO_OMNI_DB_DSN must contain a valid MySQL database name")}
- dsn.ParseTime=true;dsn.Loc=time.UTC
- cfg.Database.DSN=dsn.FormatDSN()
- c.DB,err=database.Open(ctx,cfg.Database);if err!=nil{return nil,err}
- if err=checker.Add(health.Probe{Name:"database",Timeout:cfg.Database.PingTimeout,Check:c.DB.Health});err!=nil{return nil,err}
- {{end}}
- {{if ne .Storage "none"}}if err=c.InitStorage(ctx,cfg.Storage);err!=nil{return nil,err}{{end}}
- return c,nil
-}
-// Close is idempotent, including startup failure and graceful shutdown.
-func(c *Context)Close()error{
- if c==nil{return nil}
- c.closeMu.Lock();defer c.closeMu.Unlock();c.closed=true
- c.closeOnce.Do(func(){
- {{if ne .Storage "none"}}if c.storageClose!=nil{c.closeErr=errors.Join(c.closeErr,c.storageClose())}{{end}}
- {{if eq .Database "mysql"}}if c.DB!=nil{c.closeErr=errors.Join(c.closeErr,c.DB.Close())}{{end}}
- })
- return c.closeErr
 }
+// Init is project-owned. Add dependencies here and immediately register each
+// cleanup with c.OnClose. Background components use paired OnStop/OnDrain hooks
+// and WorkContext. Failed initialization stops/drains before releasing resources;
+// unjoined background work returns ErrResourcesRetained instead of closing its dependencies.
+// Generated infrastructure is ready here. Never create another App or logger.
+func(c *Context)Init(ctx context.Context)error {return nil}

cmd/go-omni/scaffold/templates/api-databaseOptions.go.tmpl

@@ -0,0 +1,5 @@
+package servicecontext
+import mysqladapter "git.yuntuo.hk/k2safe/go-omni/database/mysql"
+// DatabaseOptions supplies explicit driver settings or bounded startup checks.
+// Keep schema/version requirements in this project; do not open another pool.
+func(c *Context)DatabaseOptions()[]mysqladapter.Option{return nil}

cmd/go-omni/scaffold/templates/api-options.go.tmpl

@@ -0,0 +1,11 @@
+package servicecontext
+import (
+ omni "git.yuntuo.hk/k2safe/go-omni"
+ "git.yuntuo.hk/k2safe/go-omni/httpx"
+)
+// AppOptions runs before routes are registered. Register project error catalogs
+// here with omni.WithErrors. It must not create resources or another App.
+func(c *Context)AppOptions()[]omni.Option{return nil}
+// GlobalMiddleware runs for all endpoints, including App 404/405 fallbacks.
+// Named route middleware lives in Middlewares and is selected by the API contract.
+func(c *Context)GlobalMiddleware()[]httpx.Middleware{return nil}

cmd/go-omni/scaffold/templates/api-runtime.go.tmpl

@@ -0,0 +1,34 @@
+package servicecontext
+import (
+ "context"
+ "errors"
+ "git.yuntuo.hk/k2safe/go-omni/health"
+ "git.yuntuo.hk/k2safe/go-omni/lifecycle"
+ "git.yuntuo.hk/k2safe/go-omni/logx"
+ {{if eq .Database "mysql"}}mysqladapter "git.yuntuo.hk/k2safe/go-omni/database/mysql"{{end}}
+ "{{.Module}}/internal/settings"
+ "{{.Module}}/internal/middleware"
+)
+// New is generator-owned. Customize dependencies in ServiceContext.Init.
+func New(ctx context.Context,logger *logx.Logger,configs ...settings.Config)(result *Context,err error){
+ if ctx==nil{ctx=context.Background()}
+ if err=ctx.Err();err!=nil{return nil,errors.Join(err,lifecycle.Cause(ctx))}
+ if logger==nil{return nil,errors.New("service context requires a logger")}
+ if len(configs)>1{return nil,errors.New("expected at most one configuration")}
+ cfg:=settings.Default();if len(configs)==1{cfg=configs[0]}
+ if err=cfg.Validate();err!=nil{return nil,err}
+ checker,err:=health.New();if err!=nil{return nil,err}
+ runtime,err:=lifecycle.NewRuntimeWithConfig(logx.WithLogger(ctx,logger),cfg.Server.Lifecycle);if err!=nil{return nil,err}
+ c:=&Context{Config:cfg,Logger:logger,Health:checker,Middlewares:middleware.Defaults(),Runtime:runtime}
+ ctx=logx.WithLogger(c.Context(),logger)
+ defer func(){if p:=recover();p!=nil{_ = c.Close();panic(p)};if err!=nil{err=c.Finish(err)}}()
+ {{if eq .Database "mysql"}}
+ options:=append([]mysqladapter.Option{mysqladapter.WithLogger(logger)},c.DatabaseOptions()...)
+ c.DB,err=mysqladapter.Open(ctx,cfg.Database,options...);if err!=nil{return nil,err}
+ c.OnClose(c.DB.Close)
+ if err=checker.Add(health.Probe{Name:"database",Timeout:cfg.Database.Pool.PingTimeout,Check:c.DB.Health});err!=nil{return nil,err}
+ {{end}}
+ {{if ne .Storage "none"}}if err=c.InitStorage(ctx,cfg.Storage);err!=nil{return nil,err}{{end}}
+ if err=c.Init(ctx);err!=nil{return nil,err}
+ return c,nil
+}

cmd/go-omni/scaffold/templates/legacyV013/api-close.go.tmpl

@@ -0,0 +1,23 @@
+package servicecontext
+import "errors"
+// Close is idempotent, including startup failure and graceful shutdown.
+func(c *Context)Close()error{
+ if c==nil{return nil}
+ c.closeOnce.Do(func(){
+ if c.Lifecycle!=nil{c.Lifecycle.RequestShutdown(nil)}
+ c.closeMu.Lock();c.closed=true;cleanups:=c.cleanups;c.cleanups=nil;c.closeMu.Unlock()
+ for i:=len(cleanups)-1;i>=0;i--{c.closeErr=errors.Join(c.closeErr,cleanups[i]())}
+ {{if ne .Storage "none"}}if c.storageClose!=nil{c.closeErr=errors.Join(c.closeErr,c.storageClose())}{{end}}
+ {{if eq .Database "mysql"}}if c.DB!=nil{c.closeErr=errors.Join(c.closeErr,c.DB.Close())}{{end}}
+ })
+ return c.closeErr
+}
+
+// OnClose transfers a resource cleanup to this context immediately after creation.
+// Hooks run once in reverse order, also when later initialization fails.
+func(c *Context)OnClose(cleanup func()error) {
+ if cleanup==nil{return}
+ c.closeMu.Lock();defer c.closeMu.Unlock()
+ if c.closed{panic("svc: register cleanup after Close")}
+ c.cleanups=append(c.cleanups,cleanup)
+}

cmd/go-omni/scaffold/templates/legacyV013/api-context.go.tmpl

@@ -0,0 +1,68 @@
+package servicecontext
+import (
+ "context"
+ "errors"
+ "sync"
+ {{if ne .Storage "none"}}"net/http"
+ "git.yuntuo.hk/k2safe/go-omni/storage"{{end}}
+ {{if eq .Database "mysql"}}"time"
+ "git.yuntuo.hk/k2safe/go-omni/database"
+ "github.com/go-sql-driver/mysql"{{end}}
+ "git.yuntuo.hk/k2safe/go-omni/health"
+ "git.yuntuo.hk/k2safe/go-omni/httpx"
+ "git.yuntuo.hk/k2safe/go-omni/logx"
+ "git.yuntuo.hk/k2safe/go-omni/lifecycle"
+ "{{.Module}}/internal/settings"
+ "{{.Module}}/internal/middleware"
+)
+// Context owns infrastructure, while Logger is borrowed from main.
+// Add business repositories here; HTTP contracts do not define database tables.
+type Context struct {
+ Lifecycle *lifecycle.Controller
+ Config settings.Config
+ cleanups []func()error
+ Logger *logx.Logger
+ Health *health.Checker
+ Middlewares map[string]httpx.Middleware
+ {{if eq .Database "mysql"}}DB *database.DB{{end}}
+ {{if ne .Storage "none"}}
+ Files storage.Store
+ Uploads *storage.Uploader
+ Downloads storage.Presigner
+ UploadLinks storage.UploadPresigner
+ FileHTTP http.Handler
+ storageClose func()error
+ {{end}}
+ closeMu sync.Mutex
+ closed bool
+ closeOnce sync.Once
+ closeErr error
+}
+// Pass the settings loaded by main. The optional form supports lightweight
+// tests without infrastructure; selected adapters still require valid settings.
+func New(ctx context.Context,logger *logx.Logger,configs ...settings.Config)(result *Context,err error){
+ if ctx==nil{ctx=context.Background()}
+ if err=ctx.Err();err!=nil{return nil,errors.Join(err,lifecycle.Cause(ctx))}
+ if len(configs)>1{return nil,errors.New("expected at most one configuration")}
+ cfg:=settings.Default();if len(configs)==1{cfg=configs[0]}
+ _=cfg
+ checker,err:=health.New();if err!=nil{return nil,err}
+ c:=&Context{Config:cfg,Logger:logger,Health:checker,Middlewares:middleware.Defaults(),Lifecycle:lifecycle.New(ctx)}
+ ctx=c.Lifecycle.Context()
+ defer func(){if err!=nil{err=errors.Join(err,c.Close());if cause:=c.Lifecycle.Err();cause!=nil && !errors.Is(err,cause){err=errors.Join(err,cause)}}}()
+ {{if eq .Database "mysql"}}
+ if err=cfg.Validate();err!=nil{return nil,err}
+ dsn,parseErr:=mysql.ParseDSN(cfg.Database.DSN)
+ if parseErr!=nil || dsn.DBName=="" {return nil,errors.New("GO_OMNI_DB_DSN must contain a valid MySQL database name")}
+ dsn.ParseTime=true;dsn.Loc=time.UTC
+ cfg.Database.DSN=dsn.FormatDSN()
+ c.DB,err=database.Open(ctx,cfg.Database);if err!=nil{return nil,err}
+ if err=checker.Add(health.Probe{Name:"database",Timeout:cfg.Database.PingTimeout,Check:c.DB.Health});err!=nil{return nil,err}
+ {{end}}
+ {{if ne .Storage "none"}}if err=c.InitStorage(ctx,cfg.Storage);err!=nil{return nil,err}{{end}}
+ return c,nil
+}
+
+// RequestShutdown reports a fatal dependency failure, or a normal stop when
+// err is nil. It returns immediately; generated main drains and cleans up.
+func(c *Context)RequestShutdown(err error){c.Lifecycle.RequestShutdown(err)}

cmd/go-omni/scaffold/templates/legacyV013/api-options.go.tmpl

@@ -0,0 +1,11 @@
+package servicecontext
+import (
+ omni "git.yuntuo.hk/k2safe/go-omni"
+ "git.yuntuo.hk/k2safe/go-omni/httpx"
+)
+// AppOptions runs before routes are registered. Register project error catalogs
+// here with omni.WithErrors. It must not create resources or another App.
+func(c *Context)AppOptions()[]omni.Option{return nil}
+// GlobalMiddleware runs for all endpoints, including App 404/405 fallbacks.
+// Named route middleware lives in Middlewares and is selected by the API contract.
+func(c *Context)GlobalMiddleware()[]httpx.Middleware{return nil}