@_tc/template-core 0.0.1-bate.53 → 0.0.1-bate.55

package/.skills/tc-component-usage-skills/SKILL.md

@@ -119,6 +119,8 @@ When consuming the published TemplateCore package, `@_tc/template-core/fe/rc` re
 import { Button, DataTable, TableSearch } from '@_tc/template-core/fe/rc'
 ```
 
+Inside this source repository, use `@tc/ui-react` for the raw UI workspace package. The `@_tc/template-core/fe/rc` path is a published TemplateCore package export generated into `dist/package.json`.
+
 Style entry:
 
 ```tsx

package/.skills/tc-component-usage-skills/reference/component-api.md

@@ -310,7 +310,7 @@ interface SchemaFormProps<T> {
   buttonClassName?: string
   submitButtonProps?: Omit<ButtonElementProps, 'type' | 'onClick' | 'children'>
   cancelButtonProps?: Omit<ButtonElementProps, 'onClick' | 'children'>
-  preserve?: boolean                        // default: false
+  preserve?: boolean                        // passed through to rc-field-form; TemplateCore does not set a default
 }
 ```
 
@@ -709,8 +709,8 @@ Max 5 visible messages.
 
 ```typescript
 interface NotificationProps {
-  type: 'info' | 'success' | 'warning' | 'error'
-  title: ReactNode
+  type?: 'info' | 'success' | 'warning' | 'error'  // default: 'info'
+  title?: ReactNode
   message?: ReactNode
   duration?: number
   closable?: boolean

package/.skills/tc-component-usage-skills/reference/patterns.md

@@ -350,10 +350,10 @@ import { Notification } from '@tc/ui-react'
 
 ## Compound Component Pattern
 
-Three components use compound patterns with Context:
+Three component families use context-based composition:
 
 1. **Menu**: `<Menu>` + `<Menu.Item>` + `<Menu.SubMenu>` + `<Menu.CollapseToggle>`
-2. **Radio**: `<Radio.Group>` + `<Radio>`
+2. **Radio**: `<RadioGroup>` + `<Radio>`
 3. **Breadcrumb**: `<Breadcrumb>` + `<BreadcrumbList>` + `<BreadcrumbItem>` + ...
 
 Children auto-detect parent via Context and inherit configuration.

package/.skills/tc-component-usage-skills/reference/template-core-frontend.md

@@ -9,7 +9,7 @@ import { AsyncSelect, LanguageSwitch, ThemeSwitch } from '@_tc/template-core/fe'
 import { Button, DataTable, TableSearch } from '@_tc/template-core/fe/rc'
 ```
 
-Inside this repository, `@tc/ui-react` is also valid for the raw UI library. In published business projects, prefer `@_tc/template-core/fe/rc` for UI components and `@_tc/template-core/fe` for frontend runtime helpers.
+Inside this repository, use `@tc/ui-react` for the raw UI workspace package. In published business projects, prefer `@_tc/template-core/fe/rc` for UI components and `@_tc/template-core/fe` for frontend runtime helpers.
 
 ## LanguageSwitch
 

package/.skills/tc-generator/reference/project-template/model/product/project/default.js

@@ -1,5 +1,7 @@
 module.exports = {
   name: "Default Product Project",
   desc: "Project-level overrides can be added here.",
+  // Single-project scaffolds can include projk directly. For shared multi-project
+  // models, prefer keeping mode.js project-neutral and override homePage per project.
   homePage: "/_sidebar_/product?projk=default",
 };

package/.skills/tc-generator/reference/runtime-extensions.md

@@ -76,6 +76,74 @@ module.exports = (app) => {
 
 If the runtime does not support the built-in SQLite module or the project needs another store, generate `app/extend/db.js` or `app/extend/db.ts` and preserve the same method names so existing controllers keep working.
 
+## Default Crypto
+
+`app.extends.crypto` is available by default for backend code. It uses `app.config.signKey` as the default signing secret.
+
+Use it for lightweight signed payloads, auth tokens, API signatures, base64url encoding, and constant-time string comparison.
+
+Common methods:
+
+```ts
+app.extends.crypto.base64urlEncode(value)
+app.extends.crypto.base64urlDecode(value)
+app.extends.crypto.base64urlDecodeToBuffer(value)
+app.extends.crypto.hmacSign(payload, { secret, algorithm })
+app.extends.crypto.safeEqual(left, right)
+app.extends.crypto.createSignedPayload(payload, { secret, algorithm, separator })
+app.extends.crypto.verifySignedPayload(token, { secret, algorithm, separator })
+```
+
+Signed payload example:
+
+```js
+module.exports = (app) => {
+  return class AuthService {
+    createToken(account) {
+      const now = Date.now();
+
+      return app.extends.crypto.createSignedPayload({
+        account,
+        exp: now + 1000 * 60 * 60 * 24 * 7,
+        iat: now,
+      });
+    }
+
+    verifyToken(token) {
+      const payload = app.extends.crypto.verifySignedPayload(
+        token && token.replace(/^Bearer\s+/i, "")
+      );
+
+      if (!payload || Date.now() > payload.exp) return null;
+
+      return payload;
+    }
+
+    comparePassword(inputPassword, storedPassword) {
+      return app.extends.crypto.safeEqual(inputPassword, storedPassword);
+    }
+  };
+};
+```
+
+Custom signing options:
+
+```js
+const token = app.extends.crypto.createSignedPayload(
+  { id: 1, scope: "admin" },
+  {
+    secret: "custom-secret",
+    algorithm: "sha512",
+    separator: ".",
+  }
+);
+
+const payload = app.extends.crypto.verifySignedPayload(token, {
+  secret: "custom-secret",
+  algorithm: "sha512",
+});
+```
+
 ## Dashboard Component Slot
 
 Use `frontend/extended/dash/components.tsx` to fill supported Dashboard slots. The current slot is:
@@ -177,6 +245,8 @@ Import UI components from the published UI re-export:
 import { Button, DataTable, TableSearch } from '@_tc/template-core/fe/rc'
 ```
 
+Inside this source repository, use `@tc/ui-react` for the raw UI workspace package. The `@_tc/template-core/fe/rc` path is for published TemplateCore consumers.
+
 `LanguageSwitch` updates the shared i18n language and persists through `tc_language`. `ThemeSwitch` toggles the root `dark` class and persists through `tc_theme`. `AsyncSelect` loads options from a `fetchConfig` endpoint returning `{ label, value, searchText? }[]`.
 
 ## SchemaForm Extensions

package/AGENT_README.md

@@ -12,7 +12,7 @@ TemplateCore 是一个 TypeScript + Koa + React 的后台框架包。它提供
 - 前端构建 `buildFE()` 和消费方 Node/backend 构建 `buildBE()`。
 - 类型扩展机制，用于扩展 SchemaForm 字段、CallCom 组件和 Koa app 类型。
 
-优先使用公开入口，不要从包内部源码路径导入。
+优先使用公开入口，不要从包内部源码路径导入。下面这些入口以 npm 发布产物为准；源码仓库根 `package.json` 的 `exports` 会在构建发布包时生成到 `dist/package.json`。
 
 | 入口 | 用途 |
 | --- | --- |
@@ -83,11 +83,11 @@ export default {
 http://localhost:9000/dash?projk=demo
 ```
 
-`projk` 对应 `model/{modelKey}/project/{projectKey}.ts`。
+`projk` 对应 `model/{modelKey}/project/{projectKey}.ts` 里的 `projectKey`，运行时按 project key 全局查找，建议保持全局唯一。
 
 ## 3. 后端约定
 
-`serverStart({ baseDir })` 会按目录自动加载业务代码：
+`serverStart({ baseDir })` 会按目录自动加载业务代码；`model/` 由内置 project service 通过 `modelLoader(app)` 读取，不会在 `serverStart` 阶段直接挂到 `app.model`：
 
 ```text
 app/controller/**/*.(js|ts)      -> app.controller
@@ -99,7 +99,7 @@ app/router-schema/**/*.(js|ts)   -> app.routerSchema
 app/extend/*.(js|ts)             -> app.extends
 config/config.default.(js|ts)    -> app.config
 config/config.{env}.(js|ts)      -> app.config
-model/**/*.(js|ts)               -> 项目模型配置
+model/**/*.(js|ts)               -> 内置 project service 读取的项目模型配置
 ```
 
 Controller 示例：
@@ -184,6 +184,7 @@ export default (_app: KoaApp) => {
 内置扩展：
 
 - `app.extends.$fetch`：Node 侧 axios 风格 fetch 实例。
+- `app.extends.crypto`：Node 侧加密辅助方法，支持 base64url 编解码、HMAC 签名、签名 payload 和常量时间比较。
 - `app.extends.db`：默认 SQLite 数据存储，可用业务 `app/extend/db.ts` 覆盖。
 
 ## 4. model 配置
@@ -361,11 +362,64 @@ import { Button, DataTable, Form, Input, Modal, Select } from '@_tc/template-cor
 - 请求方法：`request`、`get`、`post`、`put`、`patch`、`del`。
 - Schema 通信：`schemaEventBus`、`eventsInfo`、`merge`。
 - 共享状态：`modeStore`、`schemaStore`、`apiFreezerStore` 及对应 hooks。
-- 多语言：`i18nStore.addResources()`，配置文案可写 `$i18n::...`。
+- 多语言：`i18nStore.getState().addResources()`，配置文案可写 `$i18n::...`。
 - 主题：`ThemeSwitch` 会同步根节点 `dark` class 和 `localStorage`。
 
 不要直接依赖 `frontend/src/...`、`packages/react/ui/...` 这类包内部路径。
 
+### 自定义前端入口和 HTML 插槽
+
+前端入口必须命名为 `.entry.tsx`、`.entry.ts`、`.entry.jsx` 或 `.entry.js`，否则 `buildFE()` 不会扫描。
+
+最小入口：
+
+```tsx
+// frontend/admin/admin.entry.tsx
+import { initApp } from '@_tc/template-core/fe'
+import type { ReactNode } from 'react'
+
+const AdminApp = ({ children }: { children: ReactNode }) => (
+  <main>{children}</main>
+)
+
+initApp(AdminApp, {
+  initModeData: false,
+})
+```
+
+如果需要给页面加额外 `meta`、预连接资源或启动脚本，可以在入口同目录放 `.html` 插槽文件。这个文件不是完整 HTML，只能包含 `tc-slot` 块：
+
+```html
+<!-- frontend/admin/admin.html -->
+<!-- tc-slot:head -->
+<meta name="description" content="Admin Console" />
+<link rel="preconnect" href="https://example.com" />
+<!-- /tc-slot:head -->
+
+<!-- tc-slot:body-before-root -->
+<div id="boot-mask"></div>
+<!-- /tc-slot:body-before-root -->
+
+<!-- tc-slot:body-after-root -->
+<script>
+  window.__ADMIN_BOOT_TIME__ = Date.now()
+</script>
+<!-- /tc-slot:body-after-root -->
+```
+
+命名规则：
+
+```text
+frontend/admin/admin.entry.tsx
+frontend/admin/admin.html       yes
+
+frontend/report/index.entry.tsx
+frontend/report/index.html      yes
+frontend/report/report.html     yes
+```
+
+不要在插槽文件里写 `<!DOCTYPE html>`、`<html>`、`<body>` 或 `<div id="root"></div>`。页面外壳由 TemplateCore 的 `app/view/entry.tpl` 统一生成，`window._basePath`、`window._projKey`、`window._signKey`、`window.appOptions` 也由它注入。构建器会把合成后的临时 HTML 写入 `.tc-entry-html/`，这个目录不要提交，也不要在业务代码中引用。
+
 ## 6. 构建
 
 前端资源构建：
@@ -495,8 +549,9 @@ chokidar
 
 1. 在业务 `frontend/` 下添加入口 `*.entry.tsx`。
 2. 需要样式时引入 `@_tc/template-core/fe/tailwind_ui.css`。
-3. 在 `model` 菜单中使用 `moduleType: 'custom'`，让 `customConfig.path` 指向页面路径。
-4. 使用 `buildFE('dev')` 或 `buildFE('prod')` 生成资源。
+3. 如需改 head 或 root 前后内容，只添加入口同目录 `.html` 插槽文件，不要写完整 HTML。
+4. 在 `model` 菜单中使用 `moduleType: 'custom'`，让 `customConfig.path` 指向页面路径。
+5. 使用 `buildFE('dev')` 或 `buildFE('prod')` 生成资源。
 
 扩展前端类型或组件：
 
@@ -513,11 +568,11 @@ chokidar
 | 任务 | 建议阅读 |
 | --- | --- |
 | 完整安装和使用说明 | npm 包根目录 `README.md` |
-| 生成项目、model、CRUD | `.skills/tc-generator/SKILL.md` |
-| 组件选型和用法 | `.skills/tc-component-usage-skills/SKILL.md` |
-| model/schema 配置细节 | `.skills/tc-generator/reference/model-schema.md` |
-| 完整 CRUD 示例 | `.skills/tc-generator/reference/example.md` |
-| 可复制项目骨架 | `.skills/tc-generator/reference/project-template/` |
+| 生成项目、model、CRUD | npm 包：`.skills/tc-generator/SKILL.md`；源码仓库：`skills/tc-generator/SKILL.md` |
+| 组件选型和用法 | npm 包：`.skills/tc-component-usage-skills/SKILL.md`；源码仓库：`skills/tc-component-usage-skills/SKILL.md` |
+| model/schema 配置细节 | npm 包：`.skills/tc-generator/reference/model-schema.md`；源码仓库：`skills/tc-generator/reference/model-schema.md` |
+| 完整 CRUD 示例 | npm 包：`.skills/tc-generator/reference/example.md`；源码仓库：`skills/tc-generator/reference/example.md` |
+| 可复制项目骨架 | npm 包：`.skills/tc-generator/reference/project-template/`；源码仓库：`skills/tc-generator/reference/project-template/` |
 | UI 组件现场预览 | 启动服务后访问 `/ui-components` |
 | 已安装包的类型细节 | 查看对应公开入口的 `.d.ts` 文件 |
 

package/README.md

@@ -12,7 +12,7 @@ pnpm add @_tc/template-core
 
 - Node.js >= 18
 - pnpm >= 8
-- 使用内置前端时，需要安装 React、Vite 等 peer dependencies
+- 使用内置前端时，需要安装 peer dependencies；完整清单以包内 `package.json` 的 `peerDependencies` 为准，包括 Koa、React、Vite、路由、状态、表单和 UI 相关依赖。
 
 ## 可选：给项目 AI 助手的文档与 Skill
 
@@ -28,9 +28,9 @@ pnpm add @_tc/template-core
 如果你的 Agent 支持本地 skills 目录，可以从已安装的 npm 包复制安装。以 Codex 为例：
 
 ```bash
-mkdir -p “${CODEX_HOME:-$HOME/.codex}/skills”
-cp -R node_modules/@_tc/template-core/.skills/tc-generator “${CODEX_HOME:-$HOME/.codex}/skills/tc-generator”
-cp -R node_modules/@_tc/template-core/.skills/tc-component-usage-skills “${CODEX_HOME:-$HOME/.codex}/skills/tc-component-usage-skills”
+mkdir -p "${CODEX_HOME:-$HOME/.codex}/skills"
+cp -R node_modules/@_tc/template-core/.skills/tc-generator "${CODEX_HOME:-$HOME/.codex}/skills/tc-generator"
+cp -R node_modules/@_tc/template-core/.skills/tc-component-usage-skills "${CODEX_HOME:-$HOME/.codex}/skills/tc-component-usage-skills"
 ```
 
 安装后重启对应 Agent，让新 skill 生效。使用时可以直接说”用 tc-generator 生成一个商品管理模块”或”用 tc-component-usage-skills 帮我写一个带搜索的分页表格”。
@@ -99,7 +99,6 @@ main().catch((error) => {
 | `baseDir` | `string` | 否 | - | 项目根目录，通常为 `join(__dirname, '.')` |
 | `pageBasePage` | `string` | 否 | `'/'` | 页面访问前缀，所有前端页面路由的基础路径 |
 | `homePage` | `string` | 否 | - | 应用首页路径 |
-| `frameBaseDir` | `string` | 否 | - | 框架根目录，通常不需要手动设置 |
 | `additionalPublicPaths` | `string | string[]` | 否 | - | 追加静态资源目录和 Nunjucks 模板查找目录，必须传绝对路径 |
 
 框架会自动读取 `config/config.default.ts` 中的配置（如 `port`、`env` 等）。
@@ -117,7 +116,7 @@ buildFE(mode: 'dev' | 'prod', options?: BuildFEOptions)
 - `'prod'`：生产模式，构建优化后的静态资源
 
 **options.output**：构建输出位置
-- `'frame'`（默认）：输出到框架包内的 `node_modules/@_tc/template-core/app/public/dist`
+- `'frame'`（默认）：输出到当前导入格式对应的框架静态目录，例如 `node_modules/@_tc/template-core/esm/app/public/dist` 或 `node_modules/@_tc/template-core/cjs/app/public/dist`
 - `'run'`：输出到项目根目录的 `app/public/dist`，适合 TypeScript 编译后的项目
 - `() => string`：自定义函数，返回输出目录的绝对路径
 
@@ -153,7 +152,9 @@ http://localhost:9000/dash?projk=demo
 
 `projk` 对应 `model/{modelKey}/project/{projectKey}.ts` 里的 `projectKey`。
 
-## 公开入口
+## 常用公开入口
+
+完整 exports 以发布包内 `package.json` 为准，除下表外还包含 `./fe/main`、`./fe/*`、`./fe/rc/*`、`./fe/rc/hooks/*` 等子路径。
 
 | 入口 | 用途 |
 | --- | --- |
@@ -292,12 +293,12 @@ import type {
 
 ### 前端多语言
 
-TemplateCore 前端复用 `@tc/ui-react/i18n`。框架内置中文、英文资源，项目可以继续追加自己的资源。
+TemplateCore 前端通过 `@_tc/template-core/fe` 暴露 i18n 能力。框架内置中文、英文资源，项目可以继续追加自己的资源。
 
 **追加自定义语言资源**：
 
 ```ts
-import { i18nStore } from '@tc/ui-react/i18n'
+import { i18nStore } from '@_tc/template-core/fe'
 
 i18nStore.getState().addResources('zh-CN', {
   business: {
@@ -383,7 +384,7 @@ const title = '$i18n::business.product.createTitle'
 **切换语言**：
 
 ```ts
-import { i18nStore } from '@tc/ui-react/i18n'
+import { i18nStore } from '@_tc/template-core/fe'
 
 i18nStore.getState().setLanguage('en-US')
 i18nStore.getState().setLanguage('zh-CN')
@@ -582,7 +583,7 @@ try {
 | --- | --- | --- |
 | `Modal` | 模态框组件 | `@_tc/template-core/fe/rc` |
 | `Drawer` | 抽屉组件 | `@_tc/template-core/fe/rc` |
-| `Message` | 消息提示组件 | `@_tc/template-core/fe/rc` |
+| `message` | 消息提示方法 | `@_tc/template-core/fe/rc` |
 | `Notification` | 通知组件 | `@_tc/template-core/fe/rc` |
 | `ConfirmDialog` | 确认对话框组件 | `@_tc/template-core/fe/rc` |
 | `Popup` | 弹出层组件 | `@_tc/template-core/fe/rc` |
@@ -658,6 +659,7 @@ model/**/*.(js|ts)               -> 项目模型配置
 内置扩展：
 
 - `app.extends.$fetch`：Node 侧基于 `fetch` 的 axios 风格请求实例，支持 `get/post/put/patch/delete` 和 `create(config)`。
+- `app.extends.crypto`：Node 侧加密辅助方法，支持 base64url 编解码、HMAC 签名、签名 payload 和常量时间比较。
 - `app.extends.db`：默认 SQLite 框架数据库，提供 `getDBData/setDBData` 等通用数据方法。
 
 ### 数据库扩展
@@ -721,6 +723,36 @@ SQL 注入边界：
 - `queryDB`、`runDB`、`getDBFirst` 是原始 SQL 入口，用户输入必须放到 `params`，不要拼接到 SQL 字符串里。
 - `execDB` 没有参数绑定能力，只建议用于固定 SQL，例如建表或迁移。
 
+### 加密扩展
+
+`app.extends.crypto` 默认使用 `app.config.signKey` 作为签名密钥，适合生成登录 token、接口签名和安全比较。
+
+常用方法：
+
+- `base64urlEncode(value)`：把字符串或二进制数据编码为 base64url。
+- `base64urlDecode(value)`：把 base64url 解码回 UTF-8 字符串。
+- `base64urlDecodeToBuffer(value)`：把 base64url 解码回 Buffer。
+- `hmacSign(payload, options)`：对文本做 HMAC 签名，默认算法 `sha256`。
+- `safeEqual(left, right)`：常量时间比较字符串。
+- `createSignedPayload(payload, options)`：生成 `payload.signature` 形式的签名串。
+- `verifySignedPayload(token, options)`：验证并解析签名串，失败返回 `null`。
+
+```ts
+const token = app.extends.crypto.createSignedPayload({
+  account: 'admin',
+  exp: Date.now() + 1000 * 60 * 60 * 24 * 7,
+  iat: Date.now(),
+})
+
+const payload = app.extends.crypto.verifySignedPayload<{
+  account: string
+  exp: number
+  iat: number
+}>(token)
+
+const same = app.extends.crypto.safeEqual('abc', 'abc')
+```
+
 ```ts
 // 推荐：参数绑定
 const users = app.extends.db.queryDB(
@@ -1536,6 +1568,55 @@ frontend/admin/admin.entry.tsx
 
 入口文件名必须包含 `.entry.`，构建器才会扫描。
 
+最小入口示例：
+
+```tsx
+// frontend/admin/admin.entry.tsx
+import { initApp } from '@_tc/template-core/fe'
+import type { ReactNode } from 'react'
+
+const AdminApp = ({ children }: { children: ReactNode }) => (
+  <main>{children}</main>
+)
+
+initApp(AdminApp, {
+  initModeData: false,
+})
+```
+
+如果需要给页面加额外 `meta`、预连接资源或启动脚本，可以在入口同目录放 `.html` 插槽文件。这个文件不是完整 HTML，只能包含 `tc-slot` 块：
+
+```html
+<!-- frontend/admin/admin.html -->
+<!-- tc-slot:head -->
+<meta name="description" content="Admin Console" />
+<link rel="preconnect" href="https://example.com" />
+<!-- /tc-slot:head -->
+
+<!-- tc-slot:body-before-root -->
+<div id="boot-mask"></div>
+<!-- /tc-slot:body-before-root -->
+
+<!-- tc-slot:body-after-root -->
+<script>
+  window.__ADMIN_BOOT_TIME__ = Date.now()
+</script>
+<!-- /tc-slot:body-after-root -->
+```
+
+命名规则：
+
+```text
+frontend/admin/admin.entry.tsx
+frontend/admin/admin.html       yes
+
+frontend/report/index.entry.tsx
+frontend/report/index.html      yes
+frontend/report/report.html     yes
+```
+
+不要在插槽文件里写 `<!DOCTYPE html>`、`<html>`、`<body>` 或 `<div id="root"></div>`。页面外壳由 TemplateCore 的 `app/view/entry.tpl` 统一生成，`window._basePath`、`window._projKey`、`window._signKey`、`window.appOptions` 也由它注入。
+
 扩展 Dashboard 路由：
 
 ```tsx
@@ -1597,7 +1678,7 @@ buildFE('dev')
 buildFE('prod')
 ```
 
-默认输出到框架包的 `app/public/dist`。如果要输出到项目：
+默认输出到当前导入格式对应的框架静态目录，例如 `esm/app/public/dist` 或 `cjs/app/public/dist`。如果要输出到项目：
 
 ```ts
 buildFE('prod', {
@@ -1768,4 +1849,4 @@ await buildBE({
 - Dashboard 登录守卫放在 `frontend/extended/dash/routeGuard.ts`；登录页通常不在 Dash 路由下，返回登录页 URL 即可。
 - 服务端兜底守卫放在业务 `app/router-guard.ts|js`，不是 `app/business` 子目录。
 - 前端入口必须命名为 `.entry.tsx`、`.entry.ts`、`.entry.jsx` 或 `.entry.js`。
-- **使用方不建议在 `/frontend/apps/` 下保留 `html` 文件。** Vite 构建时会根据模板文件（`app/view/entry.tpl`）自动生成 html，如果保留 html 文件，可能与模板不同步而导致内容过时。
+- 入口同目录的 `.html` 只能作为插槽文件使用，不能写完整 HTML 文档；页面外壳始终由 `app/view/entry.tpl` 生成。

package/cjs/app/extend/crypto.js

@@ -0,0 +1 @@
+require(`../../_virtual/_rolldown/runtime.js`);let e=require(`node:crypto`);var t=`sha256`,n=`.`,r=`template-core-crypto`,i=(e,t)=>String(t??e.config.signKey??r),a=e=>e??t,o=e=>e||n,s=e=>Buffer.isBuffer(e)?e:Buffer.from(e),c=t=>{let n=e=>s(e).toString(`base64url`),r=e=>Buffer.from(e,`base64url`),c=e=>r(e).toString(`utf8`),l=(n,r)=>(0,e.createHmac)(a(r?.algorithm),i(t,r?.secret)).update(n).digest(`base64url`),u=(t,n)=>{let r=Buffer.from(t),i=Buffer.from(n);return r.length===i.length?(0,e.timingSafeEqual)(r,i):!1};return{base64urlEncode:n,base64urlDecode:c,base64urlDecodeToBuffer:r,hmacSign:l,safeEqual:u,createSignedPayload:(e,t)=>{let r=o(t?.separator),i=n(JSON.stringify(e));return`${i}${r}${l(i,t)}`},verifySignedPayload:(e,t)=>{if(!e)return null;let n=o(t?.separator),[r,i,...a]=e.split(n);if(!r||!i||a.length>0||!u(l(r,t),i))return null;try{return JSON.parse(c(r))}catch{return null}}}};module.exports=c;

package/cjs/app/view/entry.tpl

@@ -5,6 +5,7 @@
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
         <link rel="icon" type="image/x-icon" href="/static/logo.png" />
         <title>{{ name }}</title>
+        <!-- TC_HEAD_SLOT -->
     </head>
 
     <script id="input">
@@ -22,7 +23,9 @@
     </script>
 
     <body>
+        <!-- TC_BODY_BEFORE_ROOT_SLOT -->
         <div id="root"></div>
+        <!-- TC_BODY_AFTER_ROOT_SLOT -->
     </body>
 
     <!-- {{InsertScript}} -->

package/cjs/bundler/index.js

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`./buildBE.js`),t=require(`../packages/common/log/index.js`),n=require(`./state.js`),r=require(`./dev.js`),i=require(`./prod.js`);var a=(e,a)=>{switch(n.setBuildFEOptions(a),e){case`dev`:r.dev();break;case`prod`:i.prod();break;default:t.logRed(`Usage: npx tsx scripts/index.ts [dev|prod]`)}};exports.buildBE=e.buildBE,exports.buildFE=a;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`./buildBE.js`),t=require(`../packages/common/log/index.js`),n=require(`./state.js`),r=require(`./dev.js`),i=require(`./prod.js`);var a=(e,a)=>{switch(n.setBuildFEOptions(a),e){case`dev`:return r.dev();case`prod`:return i.prod();default:return t.logRed(`Usage: npx tsx scripts/index.ts [dev|prod]`),Promise.resolve()}};exports.buildBE=e.buildBE,exports.buildFE=a;

package/cjs/bundler/utils.js

@@ -1 +1,3 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`../_virtual/_rolldown/runtime.js`),t=require(`../packages/utils/path.js`);require(`../packages/utils/index.js`);const n=require(`../packages/common/log/index.js`),r=require(`./state.js`);let i=require(`path`);i=e.__toESM(i);let a=require(`glob`);a=e.__toESM(a);let o=require(`fs`),s=require(`vite`),c=require(`@tailwindcss/vite`);c=e.__toESM(c);let l=require(`module`),u=require(`url`);var d=typeof __filename==`string`?__filename:(0,u.fileURLToPath)({}.url),f=i.default.dirname(d),p=process.cwd(),m=(0,l.createRequire)(d),h=i.default.resolve(f,`../../`),g=i.default.resolve(f,`../`),_=i.default.resolve(h,`./fe/frontend`),v=i.default.resolve(p,`.`),y=i.default.resolve(v,`./frontend`),b=e=>i.default.dirname(m.resolve(`${e}/package.json`));function x(){n.logWhite(`frameFEPath: `+_),n.logWhite(`runFEPath: `+y);let e=[_,y].reduce((e,n)=>{let r=[`js`,`jsx`,`ts`,`tsx`].map(e=>t.resolve(n,`/**`,`/*.`+e)),i=a.sync(r).filter(e=>e.includes(`.entry.`)).filter(e=>!e.includes(`.d.ts`));return[...e,...i]},[]),r={};if(!e.length)return r;let s;for(let n=0;n<e.length;n++){let c=e[n],l=i.default.resolve(c,`../`),u=a.sync(t.resolve(l,`*.html`))[0];if(u){let e=i.default.basename(u,`.html`);r[e]=i.default.resolve(p,u)}else{s||=(0,o.readFileSync)(i.default.resolve(g,`./app/view/entry.tpl`),`utf-8`);let e=c.split(i.default.sep).at(-1),t=s.replace(`<!-- {{InsertScript}} -->`,`<script type="module" src="./${e}"><\/script>`),n=l.split(i.default.sep).at(-1),a=i.default.join(l,n+`.html`);(0,o.writeFileSync)(a,t),r[n]=a}}return r}function S(){let e=r.buildFESharedState.options.output??`frame`;return e!==`frame`&&n.logRed(`Please pay attention to the build output.`),e===`run`?i.default.join(v,`./app/public/dist`):typeof e==`function`?e():i.default.join(g,`./app/public/dist`)}var C=async e=>{let t=(await import(`chokidar`)).watch(y,{ignored:/(^|[\/\\])\../,persistent:!0,ignoreInitial:!0}),r=!1;t.on(`change`,async t=>{if(!r){r=!0,n.logYellow(`changed: ${t}`);try{await e?.()}catch(e){n.logRed(e)}finally{r=!1}}}),n.logYellow(`watching ${y}/...`)};function w(e=`.html`){let t=[...new Set(Array.isArray(e)?e:[e])];return{name:`flatten-html`,apply:`build`,closeBundle(){let e=S();if(!(0,o.existsSync)(e))return;let r=a.sync(`**/*.html`,{cwd:e,dot:!0});for(let n of r){let r=i.default.join(e,n),a=i.default.basename(n,`.html`),s=`.entry`;a.indexOf(s)===-1&&(a+=s);for(let n of t){let t=a+n,s=i.default.join(e,t);r!==s&&(0,o.copyFileSync)(r,s)}t.some(t=>r===i.default.join(e,a+t))||(0,o.unlinkSync)(r)}let s=[...new Set(r.map(e=>i.default.dirname(e)))].sort().reverse(),c=e=>{if(!((0,o.existsSync)(e)?(0,o.readdirSync)(e):[1]).length){(0,o.rmdirSync)(e);let t=e.split(i.default.sep).slice(0,-1);t.length&&c(t.join(i.default.sep))}};for(let t of s)t&&t!==`.`&&c(i.default.join(e,t));let l=t.flatMap(t=>a.sync(`**/*`+t,{cwd:e,dot:!0}));for(let e of l)n.logYellow(`final file path -----> `+e)}}}function T(e){let t=[``,`.ts`,`.tsx`,`.js`,`.jsx`];return e.reduce((e,[n,r,a=y,s=`./defaultAlias`])=>{let c=t.map(e=>i.default.resolve(a,r+e)).find(e=>(0,o.existsSync)(e)),l=i.default.resolve(f,s);return c&&(l=c),e[n]=l,e},{})}var E=(...e)=>new RegExp(e.join(`[\\/]`)),D=e=>`_${e}_tcC`,O=async(e,t)=>{try{await(0,s.build)({configFile:!1,base:`/dist`,plugins:[(await import(`@vitejs/plugin-react`)).default(),w([`.tpl`,`.html`]),(0,c.default)()],build:{outDir:S(),emptyOutDir:!0,sourcemap:t===`dev`?`inline`:`hidden`,rolldownOptions:{input:e,output:{codeSplitting:{groups:[{name:D(`__nm`),test:E(`node_modules`),maxSize:5e5,minShareCount:2,priority:1},{name:D(`r`),test:E(`node_modules`,`react`),minShareCount:2,maxSize:5e5,priority:5},{name:D(`r-d`),test:E(`node_modules`,`react-dom`),minShareCount:2,maxSize:2e5,priority:10},{name:D(`r-r-d`),test:E(`node_modules`,`react-router-dom`),minShareCount:2,maxSize:5e5,priority:10},{name:D(`ajv`),test:E(`node_modules`,`ajv`),minShareCount:2,maxSize:2e5,priority:10},{name:D(`ui-lib`),test:E(`components`),minShareCount:2,maxSize:2e5,priority:5},{name:D(`ui-f-lib`),test:E(`components`,`.*?[Ff]orm.*?`),minShareCount:2,maxSize:5e4,priority:10}]}}}},resolve:{alias:{react:b(`react`),"react-dom":b(`react-dom`),"@tc/ui-react/hooks":i.default.resolve(f,`../../fe/packages/react/hooks/`),"@tc/ui-react":i.default.resolve(f,`../../fe/packages/react/ui/`),...T([[`@tc/scalability/SchemaForm/frameData`,`./extended/SchemaForm/data`,_],[`@tc/scalability/SchemaForm/data`,`./extended/SchemaForm/data`],[`@tc/scalability/SchemaPage/CallCom/data`,`./extended/SchemaPage/CallCom/data`],[`@tc/scalability/dash/customRoutes`,`./extended/dash/customRoutes`],[`@tc/scalability/dash/components`,`./extended/dash/components`],[`@tc/scalability/dash/routeGuard`,`./extended/dash/routeGuard`,void 0,`./defaultRouteGuard`]])}}}),n.logJoinColorized(n.colorize(`builded`,`green`),n.colorize(` -> `,`white`),n.colorize(`time: `,`cyan`),n.colorize(new Date,`pink`))}catch(e){if(n.logRed(e),t!==`dev`)throw e}};exports.VBuildFE=O,exports.entries=x,exports.outDir=S,exports.watchFiles=C;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`../_virtual/_rolldown/runtime.js`),t=require(`../packages/utils/path.js`);require(`../packages/utils/index.js`);const n=require(`../packages/common/log/index.js`),r=require(`./state.js`);let i=require(`path`);i=e.__toESM(i);let a=require(`glob`);a=e.__toESM(a);let o=require(`fs`),s=require(`vite`),c=require(`@tailwindcss/vite`);c=e.__toESM(c);let l=require(`module`),u=require(`url`);var d=typeof __filename==`string`?__filename:(0,u.fileURLToPath)({}.url),f=i.default.dirname(d),p=process.cwd(),m=(0,l.createRequire)(d),h=i.default.resolve(f,`../../`),g=i.default.resolve(f,`../`),_=i.default.resolve(h,`./fe/frontend`),v=i.default.resolve(p,`.`),y=i.default.resolve(v,`./frontend`),b=e=>i.default.dirname(m.resolve(`${e}/package.json`)),x=i.default.join(v,`.tc-entry-html`),S=`<!-- {{InsertScript}} -->`,C={head:`<!-- TC_HEAD_SLOT -->`,bodyBeforeRoot:`<!-- TC_BODY_BEFORE_ROOT_SLOT -->`,bodyAfterRoot:`<!-- TC_BODY_AFTER_ROOT_SLOT -->`},w=[`head`,`body-before-root`,`body-after-root`],T=()=>({head:``,"body-before-root":``,"body-after-root":``}),E=e=>e.split(i.default.sep).join(`/`),D=e=>{let t=E(e);return t.startsWith(`.`)||t.startsWith(`/`)?t:`./${t}`},O=e=>/<html[\s>]/i.test(e)&&e.includes(`window['_basePath']`)&&/<div\s+id=["']root["']\s*><\/div>/i.test(e),k=e=>{let t=T(),r=(0,o.readFileSync)(e,`utf-8`),i=/<!--\s*tc-slot:([\w-]+)\s*-->([\s\S]*?)<!--\s*\/tc-slot:\1\s*-->/g,a=!1,s=r;if(r.replace(i,(n,r,i)=>{if(a=!0,!w.includes(r))throw Error(`Invalid html slot "${r}" in ${e}. Allowed slots: ${w.join(`, `)}.`);return t[r]+=i.trim()?`${i}\n`:``,s=s.replace(n,``),n}),s.trim()){if(O(r))return n.logYellow(`ignored legacy generated entry html: ${e}`),T();throw Error([`Invalid custom entry html: ${e}.`,`Custom entry html can only contain tc-slot blocks, for example:`,`<!-- tc-slot:head -->`,`<meta name="description" content="..." />`,`<!-- /tc-slot:head -->`].join(`
+`))}return a&&n.logYellow(`using custom entry html slots: ${e}`),t},A=(e,n)=>{let r=i.default.basename(e),s=[i.default.join(e,`${n}.html`),i.default.join(e,`${r}.html`)].find(e=>(0,o.existsSync)(e));if(s)return s;if(a.sync(t.resolve(e,`*.html`)).length)throw Error([`Entry html filename is not supported in ${e}.`,`Use ${n}.html or ${r}.html as a tc-slot file.`].join(`
+`))},j=(e,t)=>e.replace(C.head,t.head).replace(C.bodyBeforeRoot,t[`body-before-root`]).replace(C.bodyAfterRoot,t[`body-after-root`]),M=(e,t,n,r)=>{let a=i.default.join(x,`${n}.html`),s=D(i.default.relative(i.default.dirname(a),t));return(0,o.writeFileSync)(a,j(e,r).replace(S,`<script type="module" src="${s}"><\/script>`)),a};function N(){n.logWhite(`frameFEPath: `+_),n.logWhite(`runFEPath: `+y);let e=[_,y].reduce((e,n)=>{let r=[`js`,`jsx`,`ts`,`tsx`].map(e=>t.resolve(n,`/**`,`/*.`+e)),i=a.sync(r).filter(e=>e.includes(`.entry.`)).filter(e=>!e.includes(`.d.ts`));return[...e,...i]},[]),r={};if(!e.length)return r;(0,o.rmSync)(x,{recursive:!0,force:!0}),(0,o.mkdirSync)(x,{recursive:!0});let s=(0,o.readFileSync)(i.default.resolve(g,`./app/view/entry.tpl`),`utf-8`);for(let t=0;t<e.length;t++){let n=e[t],a=i.default.resolve(n,`../`),o=A(a,i.default.basename(n).replace(/\.entry\.[^.]+$/,``)),c=o?i.default.basename(o,`.html`):a.split(i.default.sep).at(-1);r[c]=M(s,n,c,o?k(o):T())}return r}function P(){let e=r.buildFESharedState.options.output??`frame`;return e!==`frame`&&n.logRed(`Please pay attention to the build output.`),e===`run`?i.default.join(v,`./app/public/dist`):typeof e==`function`?e():i.default.join(g,`./app/public/dist`)}var F=async e=>{let t=(await import(`chokidar`)).watch(y,{ignored:/(^|[\/\\])\../,persistent:!0,ignoreInitial:!0}),r=!1;t.on(`change`,async t=>{if(!r){r=!0,n.logYellow(`changed: ${t}`);try{await e?.()}catch(e){n.logRed(e)}finally{r=!1}}}),n.logYellow(`watching ${y}/...`)};function I(e=`.html`){let t=[...new Set(Array.isArray(e)?e:[e])];return{name:`flatten-html`,apply:`build`,closeBundle(){let e=P();if(!(0,o.existsSync)(e))return;let r=a.sync(`**/*.html`,{cwd:e,dot:!0});for(let n of r){let r=i.default.join(e,n),a=i.default.basename(n,`.html`),s=`.entry`;a.indexOf(s)===-1&&(a+=s);for(let n of t){let t=a+n,s=i.default.join(e,t);r!==s&&(0,o.copyFileSync)(r,s)}t.some(t=>r===i.default.join(e,a+t))||(0,o.unlinkSync)(r)}let s=[...new Set(r.map(e=>i.default.dirname(e)))].sort().reverse(),c=e=>{if(!((0,o.existsSync)(e)?(0,o.readdirSync)(e):[1]).length){(0,o.rmdirSync)(e);let t=e.split(i.default.sep).slice(0,-1);t.length&&c(t.join(i.default.sep))}};for(let t of s)t&&t!==`.`&&c(i.default.join(e,t));let l=t.flatMap(t=>a.sync(`**/*`+t,{cwd:e,dot:!0}));for(let e of l)n.logYellow(`final file path -----> `+e)}}}function L(e){let t=[``,`.ts`,`.tsx`,`.js`,`.jsx`];return e.reduce((e,[n,r,a=y,s=`./defaultAlias`])=>{let c=t.map(e=>i.default.resolve(a,r+e)).find(e=>(0,o.existsSync)(e)),l=i.default.resolve(f,s);return c&&(l=c),e[n]=l,e},{})}var R=(...e)=>new RegExp(e.join(`[\\/]`)),z=e=>`_${e}_tcC`,B=async(e,t)=>{try{await(0,s.build)({configFile:!1,base:`/dist`,plugins:[(await import(`@vitejs/plugin-react`)).default(),I([`.tpl`,`.html`]),(0,c.default)()],build:{outDir:P(),emptyOutDir:!0,sourcemap:t===`dev`?`inline`:`hidden`,rolldownOptions:{input:e,output:{codeSplitting:{groups:[{name:z(`__nm`),test:R(`node_modules`),maxSize:5e5,minShareCount:2,priority:1},{name:z(`r`),test:R(`node_modules`,`react`),minShareCount:2,maxSize:5e5,priority:5},{name:z(`r-d`),test:R(`node_modules`,`react-dom`),minShareCount:2,maxSize:2e5,priority:10},{name:z(`r-r-d`),test:R(`node_modules`,`react-router-dom`),minShareCount:2,maxSize:5e5,priority:10},{name:z(`ajv`),test:R(`node_modules`,`ajv`),minShareCount:2,maxSize:2e5,priority:10},{name:z(`ui-lib`),test:R(`components`),minShareCount:2,maxSize:2e5,priority:5},{name:z(`ui-f-lib`),test:R(`components`,`.*?[Ff]orm.*?`),minShareCount:2,maxSize:5e4,priority:10}]}}}},resolve:{alias:{react:b(`react`),"react-dom":b(`react-dom`),"@tc/ui-react/hooks":i.default.resolve(f,`../../fe/packages/react/hooks/`),"@tc/ui-react":i.default.resolve(f,`../../fe/packages/react/ui/`),...L([[`@tc/scalability/SchemaForm/frameData`,`./extended/SchemaForm/data`,_],[`@tc/scalability/SchemaForm/data`,`./extended/SchemaForm/data`],[`@tc/scalability/SchemaPage/CallCom/data`,`./extended/SchemaPage/CallCom/data`],[`@tc/scalability/dash/customRoutes`,`./extended/dash/customRoutes`],[`@tc/scalability/dash/components`,`./extended/dash/components`],[`@tc/scalability/dash/routeGuard`,`./extended/dash/routeGuard`,void 0,`./defaultRouteGuard`]])}}}),n.logJoinColorized(n.colorize(`builded`,`green`),n.colorize(` -> `,`white`),n.colorize(`time: `,`cyan`),n.colorize(new Date,`pink`))}catch(e){if(n.logRed(e),t!==`dev`)throw e}};exports.VBuildFE=B,exports.entries=N,exports.outDir=P,exports.watchFiles=F;

package/esm/app/extend/crypto.js

@@ -0,0 +1,31 @@
+import { createHmac as e, timingSafeEqual as t } from "node:crypto";
+//#region app/extend/crypto.ts
+var n = "sha256", r = ".", i = "template-core-crypto", a = (e, t) => String(t ?? e.config.signKey ?? i), o = (e) => e ?? n, s = (e) => e || r, c = (e) => Buffer.isBuffer(e) ? e : Buffer.from(e), l = (n) => {
+	let r = (e) => c(e).toString("base64url"), i = (e) => Buffer.from(e, "base64url"), l = (e) => i(e).toString("utf8"), u = (t, r) => e(o(r?.algorithm), a(n, r?.secret)).update(t).digest("base64url"), d = (e, n) => {
+		let r = Buffer.from(e), i = Buffer.from(n);
+		return r.length === i.length ? t(r, i) : !1;
+	};
+	return {
+		base64urlEncode: r,
+		base64urlDecode: l,
+		base64urlDecodeToBuffer: i,
+		hmacSign: u,
+		safeEqual: d,
+		createSignedPayload: (e, t) => {
+			let n = s(t?.separator), i = r(JSON.stringify(e));
+			return `${i}${n}${u(i, t)}`;
+		},
+		verifySignedPayload: (e, t) => {
+			if (!e) return null;
+			let n = s(t?.separator), [r, i, ...a] = e.split(n);
+			if (!r || !i || a.length > 0 || !d(u(r, t), i)) return null;
+			try {
+				return JSON.parse(l(r));
+			} catch {
+				return null;
+			}
+		}
+	};
+};
+//#endregion
+export { l as default };

package/esm/app/view/entry.tpl

@@ -5,6 +5,7 @@
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
         <link rel="icon" type="image/x-icon" href="/static/logo.png" />
         <title>{{ name }}</title>
+        <!-- TC_HEAD_SLOT -->
     </head>
 
     <script id="input">
@@ -22,7 +23,9 @@
     </script>
 
     <body>
+        <!-- TC_BODY_BEFORE_ROOT_SLOT -->
         <div id="root"></div>
+        <!-- TC_BODY_AFTER_ROOT_SLOT -->
     </body>
 
     <!-- {{InsertScript}} -->

package/esm/bundler/index.js

@@ -6,13 +6,9 @@ import { prod as i } from "./prod.js";
 //#region bundler/index.ts
 var a = (e, a) => {
 	switch (n(a), e) {
-		case "dev":
-			r();
-			break;
-		case "prod":
-			i();
-			break;
-		default: t("Usage: npx tsx scripts/index.ts [dev|prod]");
+		case "dev": return r();
+		case "prod": return i();
+		default: return t("Usage: npx tsx scripts/index.ts [dev|prod]"), Promise.resolve();
 	}
 };
 //#endregion

package/esm/bundler/utils.js

@@ -4,16 +4,54 @@ import { colorize as t, logJoinColorized as n, logRed as r, logWhite as i, logYe
 import { buildFESharedState as o } from "./state.js";
 import s from "path";
 import * as c from "glob";
-import { copyFileSync as l, existsSync as u, readFileSync as d, readdirSync as f, rmdirSync as p, unlinkSync as m, writeFileSync as h } from "fs";
-import { build as g } from "vite";
-import _ from "@tailwindcss/vite";
-import { createRequire as v } from "module";
-import { fileURLToPath as y } from "url";
+import { copyFileSync as l, existsSync as u, mkdirSync as d, readFileSync as f, readdirSync as p, rmSync as m, rmdirSync as h, unlinkSync as g, writeFileSync as _ } from "fs";
+import { build as v } from "vite";
+import y from "@tailwindcss/vite";
+import { createRequire as b } from "module";
+import { fileURLToPath as x } from "url";
 //#region bundler/utils.ts
-var b = typeof __filename == "string" ? __filename : y(import.meta.url), x = s.dirname(b), S = process.cwd(), C = v(b), w = s.resolve(x, "../../"), T = s.resolve(x, "../"), E = s.resolve(w, "./fe/frontend"), D = s.resolve(S, "."), O = s.resolve(D, "./frontend"), k = (e) => s.dirname(C.resolve(`${e}/package.json`));
-function A() {
-	i("frameFEPath: " + E), i("runFEPath: " + O);
-	let t = [E, O].reduce((t, n) => {
+var S = typeof __filename == "string" ? __filename : x(import.meta.url), C = s.dirname(S), w = process.cwd(), T = b(S), E = s.resolve(C, "../../"), D = s.resolve(C, "../"), O = s.resolve(E, "./fe/frontend"), k = s.resolve(w, "."), A = s.resolve(k, "./frontend"), j = (e) => s.dirname(T.resolve(`${e}/package.json`)), M = s.join(k, ".tc-entry-html"), N = "<!-- {{InsertScript}} -->", P = {
+	head: "<!-- TC_HEAD_SLOT -->",
+	bodyBeforeRoot: "<!-- TC_BODY_BEFORE_ROOT_SLOT -->",
+	bodyAfterRoot: "<!-- TC_BODY_AFTER_ROOT_SLOT -->"
+}, F = [
+	"head",
+	"body-before-root",
+	"body-after-root"
+], I = () => ({
+	head: "",
+	"body-before-root": "",
+	"body-after-root": ""
+}), L = (e) => e.split(s.sep).join("/"), R = (e) => {
+	let t = L(e);
+	return t.startsWith(".") || t.startsWith("/") ? t : `./${t}`;
+}, z = (e) => /<html[\s>]/i.test(e) && e.includes("window['_basePath']") && /<div\s+id=["']root["']\s*><\/div>/i.test(e), B = (e) => {
+	let t = I(), n = f(e, "utf-8"), r = /<!--\s*tc-slot:([\w-]+)\s*-->([\s\S]*?)<!--\s*\/tc-slot:\1\s*-->/g, i = !1, o = n;
+	if (n.replace(r, (n, r, a) => {
+		if (i = !0, !F.includes(r)) throw Error(`Invalid html slot "${r}" in ${e}. Allowed slots: ${F.join(", ")}.`);
+		return t[r] += a.trim() ? `${a}\n` : "", o = o.replace(n, ""), n;
+	}), o.trim()) {
+		if (z(n)) return a(`ignored legacy generated entry html: ${e}`), I();
+		throw Error([
+			`Invalid custom entry html: ${e}.`,
+			"Custom entry html can only contain tc-slot blocks, for example:",
+			"<!-- tc-slot:head -->",
+			"<meta name=\"description\" content=\"...\" />",
+			"<!-- /tc-slot:head -->"
+		].join("\n"));
+	}
+	return i && a(`using custom entry html slots: ${e}`), t;
+}, V = (t, n) => {
+	let r = s.basename(t), i = [s.join(t, `${n}.html`), s.join(t, `${r}.html`)].find((e) => u(e));
+	if (i) return i;
+	if (c.sync(e(t, "*.html")).length) throw Error([`Entry html filename is not supported in ${t}.`, `Use ${n}.html or ${r}.html as a tc-slot file.`].join("\n"));
+}, H = (e, t) => e.replace(P.head, t.head).replace(P.bodyBeforeRoot, t["body-before-root"]).replace(P.bodyAfterRoot, t["body-after-root"]), U = (e, t, n, r) => {
+	let i = s.join(M, `${n}.html`), a = R(s.relative(s.dirname(i), t));
+	return _(i, H(e, r).replace(N, `<script type="module" src="${a}"><\/script>`)), i;
+};
+function W() {
+	i("frameFEPath: " + O), i("runFEPath: " + A);
+	let t = [O, A].reduce((t, n) => {
 		let r = [
 			"js",
 			"jsx",
@@ -23,26 +61,23 @@ function A() {
 		return [...t, ...i];
 	}, []), n = {};
 	if (!t.length) return n;
-	let r;
-	for (let i = 0; i < t.length; i++) {
-		let a = t[i], o = s.resolve(a, "../"), l = c.sync(e(o, "*.html"))[0];
-		if (l) {
-			let e = s.basename(l, ".html");
-			n[e] = s.resolve(S, l);
-		} else {
-			r ||= d(s.resolve(T, "./app/view/entry.tpl"), "utf-8");
-			let e = a.split(s.sep).at(-1), t = r.replace("<!-- {{InsertScript}} -->", `<script type="module" src="./${e}"><\/script>`), i = o.split(s.sep).at(-1), c = s.join(o, i + ".html");
-			h(c, t), n[i] = c;
-		}
+	m(M, {
+		recursive: !0,
+		force: !0
+	}), d(M, { recursive: !0 });
+	let r = f(s.resolve(D, "./app/view/entry.tpl"), "utf-8");
+	for (let e = 0; e < t.length; e++) {
+		let i = t[e], a = s.resolve(i, "../"), o = V(a, s.basename(i).replace(/\.entry\.[^.]+$/, "")), c = o ? s.basename(o, ".html") : a.split(s.sep).at(-1);
+		n[c] = U(r, i, c, o ? B(o) : I());
 	}
 	return n;
 }
-function j() {
+function G() {
 	let e = o.options.output ?? "frame";
-	return e !== "frame" && r("Please pay attention to the build output."), e === "run" ? s.join(D, "./app/public/dist") : typeof e == "function" ? e() : s.join(T, "./app/public/dist");
+	return e !== "frame" && r("Please pay attention to the build output."), e === "run" ? s.join(k, "./app/public/dist") : typeof e == "function" ? e() : s.join(D, "./app/public/dist");
 }
-var M = async (e) => {
-	let t = (await import("chokidar")).watch(O, {
+var K = async (e) => {
+	let t = (await import("chokidar")).watch(A, {
 		ignored: /(^|[\/\\])\../,
 		persistent: !0,
 		ignoreInitial: !0
@@ -58,15 +93,15 @@ var M = async (e) => {
 				n = !1;
 			}
 		}
-	}), a(`watching ${O}/...`);
+	}), a(`watching ${A}/...`);
 };
-function N(e = ".html") {
+function q(e = ".html") {
 	let t = [...new Set(Array.isArray(e) ? e : [e])];
 	return {
 		name: "flatten-html",
 		apply: "build",
 		closeBundle() {
-			let e = j();
+			let e = G();
 			if (!u(e)) return;
 			let n = c.sync("**/*.html", {
 				cwd: e,
@@ -79,11 +114,11 @@ function N(e = ".html") {
 					let t = i + r, a = s.join(e, t);
 					n !== a && l(n, a);
 				}
-				t.some((t) => n === s.join(e, i + t)) || m(n);
+				t.some((t) => n === s.join(e, i + t)) || g(n);
 			}
 			let r = [...new Set(n.map((e) => s.dirname(e)))].sort().reverse(), i = (e) => {
-				if (!(u(e) ? f(e) : [1]).length) {
-					p(e);
+				if (!(u(e) ? p(e) : [1]).length) {
+					h(e);
 					let t = e.split(s.sep).slice(0, -1);
 					t.length && i(t.join(s.sep));
 				}
@@ -97,7 +132,7 @@ function N(e = ".html") {
 		}
 	};
 }
-function P(e) {
+function J(e) {
 	let t = [
 		"",
 		".ts",
@@ -105,73 +140,73 @@ function P(e) {
 		".js",
 		".jsx"
 	];
-	return e.reduce((e, [n, r, i = O, a = "./defaultAlias"]) => {
-		let o = t.map((e) => s.resolve(i, r + e)).find((e) => u(e)), c = s.resolve(x, a);
+	return e.reduce((e, [n, r, i = A, a = "./defaultAlias"]) => {
+		let o = t.map((e) => s.resolve(i, r + e)).find((e) => u(e)), c = s.resolve(C, a);
 		return o && (c = o), e[n] = c, e;
 	}, {});
 }
-var F = (...e) => new RegExp(e.join("[\\/]")), I = (e) => `_${e}_tcC`, L = async (e, i) => {
+var Y = (...e) => new RegExp(e.join("[\\/]")), X = (e) => `_${e}_tcC`, Z = async (e, i) => {
 	try {
-		await g({
+		await v({
 			configFile: !1,
 			base: "/dist",
 			plugins: [
 				(await import("@vitejs/plugin-react")).default(),
-				N([".tpl", ".html"]),
-				_()
+				q([".tpl", ".html"]),
+				y()
 			],
 			build: {
-				outDir: j(),
+				outDir: G(),
 				emptyOutDir: !0,
 				sourcemap: i === "dev" ? "inline" : "hidden",
 				rolldownOptions: {
 					input: e,
 					output: { codeSplitting: { groups: [
 						{
-							name: I("__nm"),
-							test: F("node_modules"),
+							name: X("__nm"),
+							test: Y("node_modules"),
 							maxSize: 5e5,
 							minShareCount: 2,
 							priority: 1
 						},
 						{
-							name: I("r"),
-							test: F("node_modules", "react"),
+							name: X("r"),
+							test: Y("node_modules", "react"),
 							minShareCount: 2,
 							maxSize: 5e5,
 							priority: 5
 						},
 						{
-							name: I("r-d"),
-							test: F("node_modules", "react-dom"),
+							name: X("r-d"),
+							test: Y("node_modules", "react-dom"),
 							minShareCount: 2,
 							maxSize: 2e5,
 							priority: 10
 						},
 						{
-							name: I("r-r-d"),
-							test: F("node_modules", "react-router-dom"),
+							name: X("r-r-d"),
+							test: Y("node_modules", "react-router-dom"),
 							minShareCount: 2,
 							maxSize: 5e5,
 							priority: 10
 						},
 						{
-							name: I("ajv"),
-							test: F("node_modules", "ajv"),
+							name: X("ajv"),
+							test: Y("node_modules", "ajv"),
 							minShareCount: 2,
 							maxSize: 2e5,
 							priority: 10
 						},
 						{
-							name: I("ui-lib"),
-							test: F("components"),
+							name: X("ui-lib"),
+							test: Y("components"),
 							minShareCount: 2,
 							maxSize: 2e5,
 							priority: 5
 						},
 						{
-							name: I("ui-f-lib"),
-							test: F("components", ".*?[Ff]orm.*?"),
+							name: X("ui-f-lib"),
+							test: Y("components", ".*?[Ff]orm.*?"),
 							minShareCount: 2,
 							maxSize: 5e4,
 							priority: 10
@@ -180,15 +215,15 @@ var F = (...e) => new RegExp(e.join("[\\/]")), I = (e) => `_${e}_tcC`, L = async
 				}
 			},
 			resolve: { alias: {
-				react: k("react"),
-				"react-dom": k("react-dom"),
-				"@tc/ui-react/hooks": s.resolve(x, "../../fe/packages/react/hooks/"),
-				"@tc/ui-react": s.resolve(x, "../../fe/packages/react/ui/"),
-				...P([
+				react: j("react"),
+				"react-dom": j("react-dom"),
+				"@tc/ui-react/hooks": s.resolve(C, "../../fe/packages/react/hooks/"),
+				"@tc/ui-react": s.resolve(C, "../../fe/packages/react/ui/"),
+				...J([
 					[
 						"@tc/scalability/SchemaForm/frameData",
 						"./extended/SchemaForm/data",
-						E
+						O
 					],
 					["@tc/scalability/SchemaForm/data", "./extended/SchemaForm/data"],
 					["@tc/scalability/SchemaPage/CallCom/data", "./extended/SchemaPage/CallCom/data"],
@@ -208,4 +243,4 @@ var F = (...e) => new RegExp(e.join("[\\/]")), I = (e) => `_${e}_tcC`, L = async
 	}
 };
 //#endregion
-export { L as VBuildFE, A as entries, j as outDir, M as watchFiles };
+export { Z as VBuildFE, W as entries, G as outDir, K as watchFiles };

package/fe/frontend/apps/dash/Dashboard.js

@@ -1,6 +1,6 @@
+import { getAuthToken } from "../../src/common/auth/index.js";
 import { getText } from "../../src/common/language.js";
 import { generateMenuItemData } from "../../src/common/generateMenuData.js";
-import { getAuthTokenSync } from "../../src/common/auth/index.js";
 import defaultAlias_default from "../../../bundler/defaultAlias.js";
 import { Menu } from "../../../packages/react/ui/components/Menu/Menu.js";
 import "../../../packages/react/ui/components/index.js";
@@ -113,7 +113,7 @@ var Dashboard = () => {
 		if (initData && projectInfo) {
 			if (isInit.current) return;
 			if (typeof defaultRouteGuard_default === "function") {
-				const authToken = getAuthTokenSync();
+				const authToken = getAuthToken();
 				const loginUrl = defaultRouteGuard_default({
 					projectInfo,
 					params,

package/fe/frontend/apps/ui-components/index.js

@@ -1,16 +1,8 @@
-import { frontendLangKeys } from "../../src/language/index.js";
-import { getText } from "../../src/common/language.js";
-import { Button } from "../../../packages/react/ui/components/Button/Button.js";
-import "../../../packages/react/ui/components/index.js";
 import TestPage from "../../../packages/react/ui/components/testPage/index.js";
-import { jsx, jsxs } from "react/jsx-runtime";
+import { jsx } from "react/jsx-runtime";
 //#region frontend/apps/ui-components/index.tsx
 var ui_components_default = () => {
-	return /* @__PURE__ */ jsxs("div", { children: [
-		/* @__PURE__ */ jsx("h1", { children: getText(frontendLangKeys.uiComponentsTitle) }),
-		/* @__PURE__ */ jsx(Button, { children: getText(frontendLangKeys.uiComponentsButton) }),
-		/* @__PURE__ */ jsx(TestPage, {})
-	] });
+	return /* @__PURE__ */ jsx("div", { children: /* @__PURE__ */ jsx(TestPage, {}) });
 };
 //#endregion
 export { ui_components_default as default };

package/fe/frontend/src/common/auth/index.d.ts

@@ -1,6 +1,10 @@
+export declare const localKeyMap: {
+    AUTH_LOCAL_KEY: string;
+    API_AUTH_LOCAL_KEY: string;
+};
 export declare const AUTH_HEADER_KEY = "Authorization";
-export declare function getAuthTokenSync(): string | null;
-export declare function getAuthToken(): Promise<string | null>;
+export declare function getAuthToken(): string | null;
+export declare function setAuthToken(t: string): void | null;
 export declare function clearAuthToken(): Promise<void>;
 export declare const API_AUTH_HEADER_KEY = "projk";
 export declare const getApiAuth: () => string;

package/fe/frontend/src/common/auth/index.js

@@ -1,24 +1,27 @@
 //#region frontend/src/common/auth/index.ts
-var AUTH_LOCAL_KEY = "auth_token";
-var API_AUTH_LOCAL_KEY = "p_J_k";
+var localKeyMap = {
+	AUTH_LOCAL_KEY: "auth_token",
+	API_AUTH_LOCAL_KEY: "p_J_k"
+};
 var AUTH_HEADER_KEY = "Authorization";
-function getAuthTokenSync() {
+function getAuthToken() {
 	if (typeof localStorage === "undefined") return null;
-	return localStorage.getItem(AUTH_LOCAL_KEY);
+	return localStorage.getItem(localKeyMap.AUTH_LOCAL_KEY);
 }
-async function getAuthToken() {
-	return getAuthTokenSync();
+function setAuthToken(t) {
+	if (typeof localStorage === "undefined") return null;
+	return localStorage.setItem(localKeyMap.AUTH_LOCAL_KEY, t);
 }
 async function clearAuthToken() {
 	if (typeof localStorage === "undefined") return;
-	localStorage.removeItem(AUTH_LOCAL_KEY);
+	localStorage.removeItem(localKeyMap.AUTH_LOCAL_KEY);
 }
 var API_AUTH_HEADER_KEY = "projk";
 var getApiAuth = () => {
-	return localStorage.getItem(API_AUTH_LOCAL_KEY) ?? "";
+	return localStorage.getItem(localKeyMap.API_AUTH_LOCAL_KEY) ?? "";
 };
 var setApiAuth = (v) => {
-	return localStorage.setItem(API_AUTH_LOCAL_KEY, v);
+	return localStorage.setItem(localKeyMap.API_AUTH_LOCAL_KEY, v);
 };
 //#endregion
-export { API_AUTH_HEADER_KEY, AUTH_HEADER_KEY, clearAuthToken, getApiAuth, getAuthToken, getAuthTokenSync, setApiAuth };
+export { API_AUTH_HEADER_KEY, AUTH_HEADER_KEY, clearAuthToken, getApiAuth, getAuthToken, localKeyMap, setApiAuth, setAuthToken };

package/fe/frontend/src/common/request.js

@@ -1,6 +1,6 @@
+import { API_AUTH_HEADER_KEY, AUTH_HEADER_KEY, clearAuthToken, getApiAuth, getAuthToken } from "./auth/index.js";
 import { frontendLangKeys } from "../language/index.js";
 import { getText } from "./language.js";
-import { API_AUTH_HEADER_KEY, AUTH_HEADER_KEY, clearAuthToken, getApiAuth, getAuthToken } from "./auth/index.js";
 import { FreezeState, apiFreezerStore } from "../stores/apiFreezer.js";
 import FetchAxios from "../../../packages/common/http/index.js";
 import md5 from "md5";

package/fe/frontend/src/index.d.ts

@@ -2,10 +2,11 @@ import "./typing/scalability";
 export type * from "../apps/dash/types";
 export * from "./main";
 export type { CallComComponentsMap, CallComRenderer } from "./defaultPages/SchemaPage/schemaType";
-export type { FormFieldSchema, SchemaFormComponentsMap, SchemaFormNamespace, SelectProps } from "../../packages/react/ui/index";
 export * from "./components/index";
+export type { FormFieldSchema, SchemaFormComponentsMap, SchemaFormNamespace, SelectProps } from "../../packages/react/ui/index";
 export { del, get, patch, post, put, request } from "./common/request";
 export * from "./defaultPages/SchemaPage/data/eventInfo";
 export { merge } from "./defaultPages/SchemaPage/utils/permissions";
 export * from "./exportStore";
 export { i18n, i18nStore } from "../../packages/react/ui/i18n/index";
+export { getAuthToken, localKeyMap, setAuthToken } from "./common/auth/index";

package/fe/frontend/src/index.js

@@ -1,3 +1,4 @@
+import { getAuthToken, localKeyMap, setAuthToken } from "./common/auth/index.js";
 import { i18n, i18nStore } from "../../packages/common/i18n/index.js";
 import "../../packages/react/ui/i18n/index.js";
 import { FreezeState, apiFreezerStore, useApiFreezer } from "./stores/apiFreezer.js";
@@ -16,4 +17,4 @@ import ThemeSwitch_default from "./components/ThemeSwitch/index.js";
 import "./components/index.js";
 import { eventsInfo } from "./defaultPages/SchemaPage/data/eventInfo.js";
 import { merge } from "./defaultPages/SchemaPage/utils/permissions.js";
-export { AsyncSelect_default as AsyncSelect, FreezeState, HeaderView, LanguageSwitch_default as LanguageSwitch, ThemeSwitch_default as ThemeSwitch, apiFreezerStore, del, eventsInfo, generateRouter, get, i18n, i18nStore, initApp, merge, modeStore, patch, post, put, request, schemaEventBus, schemaStore, themeSwitchStorageKey, useApiFreezer, useModeStore, useSchemaStore };
+export { AsyncSelect_default as AsyncSelect, FreezeState, HeaderView, LanguageSwitch_default as LanguageSwitch, ThemeSwitch_default as ThemeSwitch, apiFreezerStore, del, eventsInfo, generateRouter, get, getAuthToken, i18n, i18nStore, initApp, localKeyMap, merge, modeStore, patch, post, put, request, schemaEventBus, schemaStore, setAuthToken, themeSwitchStorageKey, useApiFreezer, useModeStore, useSchemaStore };

package/fe/frontend/src/stores/mode.js

@@ -1,5 +1,5 @@
-import { createStoreHook } from "../../../packages/react/ui/lib/createStoreHook.js";
 import { setApiAuth } from "../common/auth/index.js";
+import { createStoreHook } from "../../../packages/react/ui/lib/createStoreHook.js";
 import { getModelList, getProjectData } from "../api/baseInfo.js";
 import { deserializationUrlSearch } from "../common/menu.js";
 import { createStore } from "zustand";

package/fe/model/types/data/component.d.ts

@@ -1,5 +1,5 @@
-import type { FormFieldType, FormItemProps, SchemaFormAllPropsMap } from "../../../packages/react/ui/index";
 import type { BuiltInCallComConfigMap } from "../../../frontend/src/defaultPages/SchemaPage/components/CallCom/builtIn";
+import type { FormFieldType, FormItemProps, SchemaFormAllPropsMap } from "../../../packages/react/ui/index";
 export type { BuiltInCallComConfigMap, BuiltInCallComNames } from "../../../frontend/src/defaultPages/SchemaPage/components/CallCom/builtIn";
 export declare namespace CallComNamespace {
     interface ConfigMap {
@@ -11,7 +11,7 @@ export type ComponentConfig = BuiltInCallComConfigMap & Partial<CallComNamespace
 export type ComponentNames = Extract<keyof ComponentConfig, string>;
 type FormComponentOption = FormItemProps & {
     visible?: boolean;
-    disbaled?: boolean;
+    disabled?: boolean;
     default?: any;
 } & ComponentOption;
 export type BuiltInCallComOptionMap = {

package/model/frontend/src/common/auth/index.d.ts

@@ -1,6 +1,10 @@
+export declare const localKeyMap: {
+    AUTH_LOCAL_KEY: string;
+    API_AUTH_LOCAL_KEY: string;
+};
 export declare const AUTH_HEADER_KEY = "Authorization";
-export declare function getAuthTokenSync(): string | null;
-export declare function getAuthToken(): Promise<string | null>;
+export declare function getAuthToken(): string | null;
+export declare function setAuthToken(t: string): void | null;
 export declare function clearAuthToken(): Promise<void>;
 export declare const API_AUTH_HEADER_KEY = "projk";
 export declare const getApiAuth: () => string;

package/model/model/types/data/component.d.ts

@@ -1,5 +1,5 @@
-import type { FormFieldType, FormItemProps, SchemaFormAllPropsMap } from "../../../../fe/packages/react/ui/index";
 import type { BuiltInCallComConfigMap } from "../../../../fe/frontend/src/defaultPages/SchemaPage/components/CallCom/builtIn";
+import type { FormFieldType, FormItemProps, SchemaFormAllPropsMap } from "../../../../fe/packages/react/ui/index";
 export type { BuiltInCallComConfigMap, BuiltInCallComNames } from "../../../../fe/frontend/src/defaultPages/SchemaPage/components/CallCom/builtIn";
 export declare namespace CallComNamespace {
     interface ConfigMap {
@@ -11,7 +11,7 @@ export type ComponentConfig = BuiltInCallComConfigMap & Partial<CallComNamespace
 export type ComponentNames = Extract<keyof ComponentConfig, string>;
 type FormComponentOption = FormItemProps & {
     visible?: boolean;
-    disbaled?: boolean;
+    disabled?: boolean;
     default?: any;
 } & ComponentOption;
 export type BuiltInCallComOptionMap = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@_tc/template-core",
-  "version": "0.0.1-bate.53",
+  "version": "0.0.1-bate.55",
   "description": "A full-stack TypeScript admin framework powered by Koa, React, and Vite - monorepo root",
   "types": "./types/index.d.ts",
   "exports": {

package/types/app/extend/crypto.d.ts

@@ -0,0 +1,64 @@
+import type { KoaApp } from "../type";
+export type CryptoHashAlgorithm = 'sha256' | 'sha384' | 'sha512';
+export interface HmacSignOptions {
+    secret?: string;
+    algorithm?: CryptoHashAlgorithm;
+}
+export interface SignedPayloadOptions extends HmacSignOptions {
+    separator?: string;
+}
+export interface VerifySignedPayloadOptions extends HmacSignOptions {
+    separator?: string;
+}
+export interface CryptoExtend {
+    /**
+     * 将 UTF-8 字符串或二进制数据编码为 base64url 字符串。
+     *
+     * base64url 不包含 `+`、`/` 和结尾 `=`，适合放在 URL、Cookie、Header 或 token 片段中。
+     */
+    base64urlEncode: (value: string | Buffer | Uint8Array) => string;
+    /**
+     * 将 base64url 字符串解码为 UTF-8 字符串。
+     *
+     * 常用于还原 token payload；如果原始内容不是 UTF-8 文本，请使用 `base64urlDecodeToBuffer`。
+     */
+    base64urlDecode: (value: string) => string;
+    /**
+     * 将 base64url 字符串解码为 Buffer。
+     *
+     * 适合处理二进制 payload，避免 UTF-8 字符串转换造成数据损坏。
+     */
+    base64urlDecodeToBuffer: (value: string) => Buffer;
+    /**
+     * 使用 HMAC 对文本内容签名，并返回 base64url 签名。
+     *
+     * 默认使用 `app.config.signKey` 作为密钥、`sha256` 作为算法；可通过 options 覆盖。
+     */
+    hmacSign: (payload: string, options?: HmacSignOptions) => string;
+    /**
+     * 常量时间比较两个字符串是否相等。
+     *
+     * 用于比较密码、签名、token 等敏感值，降低普通字符串比较带来的计时攻击风险。
+     */
+    safeEqual: (left: string, right: string) => boolean;
+    /**
+     * 创建带签名的 payload 字符串。
+     *
+     * 返回格式默认为 `${base64url(JSON.stringify(payload))}.${hmacSign(encodedPayload)}`，
+     * 适合生成轻量登录 token 或一次性校验串。
+     */
+    createSignedPayload: <T>(payload: T, options?: SignedPayloadOptions) => string;
+    /**
+     * 验证带签名的 payload 字符串并还原原始对象。
+     *
+     * 签名不匹配、格式错误或 JSON 解析失败时返回 null，不向外抛出解析异常。
+     */
+    verifySignedPayload: <T = unknown>(signedPayload: string | null | undefined, options?: VerifySignedPayloadOptions) => T | null;
+}
+/**
+ * 创建框架加密扩展对象。
+ *
+ * 该扩展会挂载到 `app.extends.crypto`，用于复用 base64url 编码、HMAC 签名、签名 payload 和安全比较能力。
+ */
+declare const _default: (app: KoaApp) => CryptoExtend;
+export default _default;

package/types/app/type.d.ts

@@ -3,3 +3,4 @@ export type KoaRouter = import('./typings').KoaRouter;
 export type Ctx = KoaApp['context'];
 export type ControllerFN<T extends object = object> = (app: KoaApp) => new () => T;
 export type ServiceFN<T extends object = object> = (app: KoaApp) => new () => T;
+export type RouterFN = (app: KoaApp, router: KoaRouter) => void;

package/types/app/typings.d.ts

@@ -4,6 +4,7 @@ import type { DefaultAppConfig } from "../config/config.default";
 import type getProjectController from "./controller/project";
 import type getViewController from "./controller/view";
 import type getFetch from "./extend/$fetch";
+import type getCrypto from "./extend/crypto";
 import type getDB from "./extend/db";
 import type generateErrorMessage from "./extend/generateErrorMessage";
 import type getLogger from "./extend/logger";
@@ -21,6 +22,7 @@ declare module '../packages/core/index' {
             view: GetInstance<typeof getViewController>;
         }
         interface IExtendsAugmented {
+            crypto: ReturnType<typeof getCrypto>;
             db: UnwrapPromise<ReturnType<typeof getDB>>;
             logger: UnwrapPromise<ReturnType<typeof getLogger>>;
             generateErrorMessage: ReturnType<typeof generateErrorMessage>;

package/types/bundler/index.d.ts

@@ -1,4 +1,4 @@
 import type { BuildFEOptions } from "./state";
 export { buildBE } from "./buildBE";
 export type { BuildBEAlias, BuildBEFormat, BuildBEOptions, BuildBEResult } from "./buildBE";
-export declare const buildFE: (mode: "dev" | "prod", options?: BuildFEOptions) => void;
+export declare const buildFE: (mode: "dev" | "prod", options?: BuildFEOptions) => Promise<void>;

package/types/index.d.ts

@@ -4,6 +4,7 @@ import "./app/typings";
 import { MOmit } from "./typings/type";
 export type { FrameworkAugment, KoaApp } from "./packages/core/index";
 export type { ControllerFN, Ctx, ServiceFN } from "./app/type";
+export type { CryptoExtend, CryptoHashAlgorithm, HmacSignOptions, SignedPayloadOptions, VerifySignedPayloadOptions, } from "./app/extend/crypto";
 export type { DB, DBDataOptions, DBDataRecord, DBFactory, DBRunResult, FrameworkDB, ListDBDataOptions, SQLiteParams, SQLiteValue, } from "./app/extend/db";
 export type { Router };
 export declare const serverStart: (options?: MOmit<StartOptions, "frameBaseDir">) => Promise<import("./packages/core/index").KoaApp>;