@h-ai/cli 0.1.0-alpha.56 → 0.1.0-alpha.58

package/templates/apps/fullstack/packages/{{projectName}}-shared/tests/management-store.test.ts.hbs

@@ -0,0 +1,101 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import * as m from '../src/lib/paraglide/messages.js'
+import { ManagementStore } from '../src/lib/stores/management-store.svelte.js'
+
+const api = vi.hoisted(() => ({
+  auth: { clear: vi.fn(), setTokens: vi.fn() },
+  iam: { auth: { login: vi.fn(), logout: vi.fn(), currentUser: vi.fn() } },
+  admin: { users: { list: vi.fn() } },
+}))
+vi.mock('../src/lib/api/api-client.js', () => ({
+  managementApi: api,
+  initializeManagementApi: vi.fn(),
+  resolveAvatarUrl: (url: string | undefined) => url,
+}))
+
+const member = {
+  id: 'member-id',
+  username: 'member',
+  enabled: true,
+  roles: ['user'],
+  permissions: [],
+  createdAt: '2026-01-01T00:00:00.000Z',
+  updatedAt: '2026-01-01T00:00:00.000Z',
+}
+const administrator = { ...member, id: 'admin-id', username: 'admin', roles: ['admin'] }
+const forbidden = { success: false, error: { code: 'test:forbidden', message: 'Forbidden', httpStatus: 403 } } as const
+
+function deferred<T>() {
+  let resolve!: (result: T) => void
+  const promise = new Promise<T>((done) => {
+    resolve = done
+  })
+  return { promise, resolve }
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  api.iam.auth.login.mockResolvedValue({ success: true, data: { tokens: { accessToken: 'test-access', expiresIn: 3600, tokenType: 'Bearer' } } })
+  api.iam.auth.logout.mockResolvedValue({ success: true })
+  api.iam.auth.currentUser.mockResolvedValue({ success: true, data: member })
+})
+
+describe('management session and request ownership', () => {
+  it('ignores a previous administrator failure after logout and another user login', async () => {
+    const oldRequest = deferred<typeof forbidden>()
+    api.admin.users.list.mockReturnValueOnce(oldRequest.promise)
+    const store = new ManagementStore()
+    store.user = administrator
+    const loading = store.loadUsers()
+    await store.logout()
+    await store.login({ username: 'member', password: 'test-password', rememberMe: false })
+    oldRequest.resolve(forbidden)
+    await loading
+    expect(store.user?.id).toBe(member.id)
+    expect(store.page).toBe('settings')
+    expect(store.error).toBe('')
+    expect(store.loading).toBe(false)
+    expect(api.iam.auth.currentUser).toHaveBeenCalledTimes(1)
+  })
+
+  it('ignores an obsolete page failure after opening personal settings', async () => {
+    const oldRequest = deferred<typeof forbidden>()
+    api.admin.users.list.mockReturnValueOnce(oldRequest.promise)
+    const store = new ManagementStore()
+    store.user = administrator
+    const loading = store.loadUsers()
+    await store.navigate('settings')
+    oldRequest.resolve(forbidden)
+    await loading
+    expect(store.user?.id).toBe(administrator.id)
+    expect(store.page).toBe('settings')
+    expect(store.error).toBe('')
+    expect(store.loading).toBe(false)
+    expect(api.iam.auth.currentUser).not.toHaveBeenCalled()
+  })
+
+  it('refreshes revoked roles once and clears administration data', async () => {
+    api.admin.users.list.mockResolvedValueOnce(forbidden)
+    const store = new ManagementStore()
+    store.user = administrator
+    store.roles = [{ id: 'role-id', code: 'admin', name: 'Administrator', userCount: 1 }]
+    await store.loadUsers()
+    expect(store.user?.roles).toEqual(['user'])
+    expect(store.page).toBe('settings')
+    expect(store.roles).toEqual([])
+    expect(store.users).toEqual([])
+    expect(store.loading).toBe(false)
+    expect(store.error).toBe(m.forbidden())
+    expect(api.iam.auth.currentUser).toHaveBeenCalledTimes(1)
+  })
+
+  it('reports a connection failure separately from invalid credentials', async () => {
+    api.iam.auth.login.mockResolvedValueOnce({ success: false, error: { code: 'test:unavailable', message: 'Unavailable', httpStatus: 502 } })
+    const store = new ManagementStore()
+    await store.login({ username: 'member', password: 'test-password', rememberMe: false })
+    expect(store.error).toBe(m.network_error())
+    expect(store.error).not.toBe(m.login_invalid())
+    expect(store.saving).toBe(false)
+    expect(api.iam.auth.currentUser).not.toHaveBeenCalled()
+  })
+})

package/templates/apps/fullstack/packages/{{projectName}}-shared/vitest.config.ts.hbs

@@ -0,0 +1,7 @@
+import { svelte } from '@sveltejs/vite-plugin-svelte'
+import { defineConfig } from 'vitest/config'
+
+export default defineConfig({
+  plugins: [svelte()],
+  test: { environment: 'node', include: ['tests/**/*.test.ts'] },
+})

package/templates/apps/fullstack/playwright.config.ts.hbs

@@ -55,6 +55,12 @@ export default defineConfig({
       env: {
         HOST: serviceHost,
         PORT: servicePort,
+        // 仅供脚手架验收：生产启动必须由部署环境提供初始管理员密码。
+        HAI_ADMIN_DEFAULT_PASSWORD: process.env.E2E_ADMIN_PASSWORD || 'Scaffold-test-Admin123!',
+        HAI_CORE_NAME: process.env.HAI_CORE_NAME || 'Configured scaffold',
+        HAI_CORE_VERSION: process.env.HAI_CORE_VERSION || '9.8.7',
+        HAI_CORE_ENV: process.env.HAI_CORE_ENV || 'test',
+        HAI_CORE_LOGGING_LEVEL: 'warn',
       },
       url: `${serviceBaseURL}/health`,
       reuseExistingServer: false,

package/templates/apps/fullstack/pnpm-workspace.yaml.hbs

@@ -2,6 +2,30 @@
 shellEmulator: true
 
 trustPolicy: no-downgrade
+# 上游构建工具仍要求 4.x；4.0.3 tarball 已核对原 lockfile 的 SHA-512。
+trustPolicyExclude:
+  - chokidar@4.0.3
+
+# pnpm 12 配置；原生依赖仅运行明确列出的安装脚本。
+nodeLinker: hoisted
+allowBuilds:
+  onnxruntime-node: true
+  protobufjs: true
+  vue-demi: true
+  better-sqlite3: true
+  esbuild: true
+  core-js: false
+
+overrides:
+  "@ai-sdk/provider-utils@>=4.0.0 <4.0.33": 4.0.57
+  cookie@<0.7.0: 0.7.2
+  esbuild@<0.28.1: 0.28.2
+  katex@<0.18.2: 0.18.10
+  sharp@<0.35.5: 0.35.5
+  tinypool@<2.1.2: 2.2.0
+  '@qdrant/js-client-rest>undici': 7.30.0
+  xcode>uuid: 11.1.1
+  "@types/node": "{{versions.nodeTypes}}"
 
 packages:
   - packages/*

package/templates/apps/fullstack/tsconfig.base.json

@@ -3,7 +3,6 @@
     "target": "ES2022",
     "module": "NodeNext",
     "moduleResolution": "NodeNext",
-    "ignoreDeprecations": "6.0",
     "resolveJsonModule": true,
     "strict": true,
     "esModuleInterop": true,

package/templates/apps/h5/src/routes/+layout.svelte.hbs

@@ -42,6 +42,10 @@
 {{/if}}
 </script>
 
+<svelte:head>
+  <title>{page.data.appConfig.name}</title>
+</svelte:head>
+
 <div class='min-h-screen flex flex-col bg-base-200'>
   <main class='flex-1 pb-16'>
     {@render children()}

package/templates/apps/h5/src/routes/+page.svelte.hbs

@@ -1,5 +1,6 @@
 {{!-- H5 首页 --}}
 <script lang='ts'>
+  import { page } from '$app/state'
   /**
    * H5 首页
    */
@@ -11,9 +12,9 @@
 
 <svelte:head>
 {{#if hasI18n}}
-  <title>{m.app_title()}</title>
+  <title>{page.data.appConfig.name}</title>
 {{else}}
-  <title>H5 应用</title>
+  <title>{page.data.appConfig.name}</title>
 {{/if}}
 </svelte:head>
 

package/templates/apps/mobile-app/index.html.hbs

@@ -4,10 +4,10 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
     <meta name="theme-color" content="#2563eb" />
-    <title>{{projectName}}</title>
+    <title></title>
   </head>
   <body>
     <div id="app"></div>
     <script type="module" src="/src/main.ts"></script>
   </body>
-</html>
+</html>

package/templates/apps/mobile-app/src/App.svelte.hbs

@@ -2,6 +2,7 @@
   import { applyTheme, getSavedTheme, setGlobalLocale } from '@h-ai/ui'
   import { onMount } from 'svelte'
   import { closeApi, initApi, resolveApiBase, usesNativeTokenStorage } from './lib/api.js'
+  import { appConfig, initClientCore } from './lib/app-config.js'
   import { initCapacitor, isNativeApp } from './lib/capacitor.js'
   import * as m from './lib/paraglide/messages.js'
   import { getLocale } from './lib/paraglide/runtime.js'
@@ -22,6 +23,8 @@
 
   async function bootstrap(): Promise<void> {
     try {
+      initClientCore()
+      document.title = appConfig.name
       applyTheme(getSavedTheme(), false)
       setGlobalLocale(getLocale())
       await initCapacitor()
@@ -73,7 +76,7 @@
 {:else}
   <div class='hai-mobile-viewport'>
     <div class='hai-mobile-shell max-w-lg'>
-      <AppBar title={m.app_title()} safeArea fixed={false} class='bg-base-100/95 backdrop-blur border-base-content/8' />
+      <AppBar title={appConfig.name} safeArea fixed={false} class='bg-base-100/95 backdrop-blur border-base-content/8' />
 
       <main class='hai-mobile-main'>
         {#if activeTab === 'home'}
@@ -102,6 +105,7 @@
             </div>
 
             <Card title={m.status_title()} shadow='sm'>
+              <p class='mb-3 text-xs text-base-content/50'>{appConfig.name} · {appConfig.version} · {appConfig.env}</p>
               <div class='grid grid-cols-2 gap-3 text-sm'>
                 <div>
                   <p class='text-base-content/50'>{m.status_api_label()}</p>
@@ -159,4 +163,4 @@
   </div>
 {/if}
 
-<ToastContainer />
+<ToastContainer />

package/templates/apps/mobile-app/src/lib/app-config.ts.hbs

@@ -0,0 +1,13 @@
+import type { CoreConfig } from '@h-ai/core'
+import { core } from '@h-ai/core'
+
+declare const __APP_CORE_CONFIG__: Pick<CoreConfig, 'name' | 'version' | 'env' | 'defaultLocale'> & {
+  logging?: Pick<NonNullable<CoreConfig['logging']>, 'level' | 'format'>
+}
+
+/** Vite 经 core 加载后注入的公开配置，修改 YAML 后重新构建客户端。 */
+export const appConfig = __APP_CORE_CONFIG__
+
+export function initClientCore(): void {
+  core.init({ logging: appConfig.logging })
+}

package/templates/apps/website/src/routes/+layout.svelte.hbs

@@ -8,6 +8,7 @@
   import { browser } from '$app/environment'
 {{/if}}
   import { resolve } from '$app/paths'
+  import { page } from '$app/state'
 {{#if hasI18n}}
   import * as m from '$lib/paraglide/messages'
   import { getLocale } from '$lib/paraglide/runtime.js'
@@ -43,13 +44,17 @@
 {{/if}}
 </script>
 
+<svelte:head>
+  <title>{page.data.appConfig.name}</title>
+</svelte:head>
+
 <div class='min-h-screen flex flex-col'>
   <header class='navbar bg-base-100 shadow-sm'>
     <div class='flex-1'>
 {{#if hasI18n}}
-      <a href={resolve('/', {})} class='btn btn-ghost text-xl font-black tracking-tight'>{m.app_title()}</a>
+      <a href={resolve('/', {})} class='btn btn-ghost text-xl font-black tracking-tight'>{page.data.appConfig.name}</a>
 {{else}}
-      <a href={resolve('/', {})} class='btn btn-ghost text-xl font-black tracking-tight'>官网</a>
+      <a href={resolve('/', {})} class='btn btn-ghost text-xl font-black tracking-tight'>{page.data.appConfig.name}</a>
 {{/if}}
     </div>
     <nav class='flex-none'>
@@ -66,6 +71,7 @@
   </main>
 
   <footer class='footer footer-center p-4 bg-base-300 text-base-content'>
+    <span>{page.data.appConfig.name} · {page.data.appConfig.version} · {page.data.appConfig.env}</span>
 {{#if hasI18n}}
     <p>{m.footer_copyright({ year: new Date().getFullYear() })}</p>
 {{else}}

package/templates/apps/website/src/routes/+page.svelte.hbs

@@ -4,6 +4,7 @@
    * 官网首页
    */
   import { resolve } from '$app/paths'
+  import { page } from '$app/state'
 {{#if hasI18n}}
   import * as m from '$lib/paraglide/messages'
 {{/if}}
@@ -12,9 +13,9 @@
 
 <svelte:head>
 {{#if hasI18n}}
-  <title>{m.app_title()}</title>
+  <title>{page.data.appConfig.name}</title>
 {{else}}
-  <title>官网</title>
+  <title>{page.data.appConfig.name}</title>
 {{/if}}
 </svelte:head>
 
@@ -25,7 +26,7 @@
         <Badge variant='primary'>
           <span class='icon-[tabler--sparkles] size-4'></span>
 {{#if hasI18n}}
-          {m.app_title()}
+          {page.data.appConfig.name}
 {{else}}
           由 hai 驱动
 {{/if}}

package/templates/base/.npmrc.hbs

@@ -0,0 +1 @@
+# 注册表与认证可配置在此；pnpm 专属设置统一位于 pnpm-workspace.yaml。

package/templates/base/Dockerfile.hbs

@@ -1,15 +1,15 @@
 # syntax=docker/dockerfile:1.7
 {{#if isSvelteOnlyApp}}
-FROM node:22-bookworm-slim AS build
+FROM node:24-bookworm-slim AS build
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
 ENV CI=true
 WORKDIR /workspace
 
-RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
+RUN corepack enable && corepack prepare pnpm@12.11.2 --activate
 COPY pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --frozen-lockfile
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch
 COPY . .
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
 RUN pnpm build
@@ -23,24 +23,25 @@ EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD wget -q -O /dev/null http://127.0.0.1:8080/health || exit 1
 {{else}}
-FROM node:22-bookworm-slim AS build
+FROM node:24-bookworm-slim AS build
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
 ENV CI=true
 WORKDIR /workspace
 
-RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
+RUN corepack enable && corepack prepare pnpm@12.11.2 --activate
 COPY pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --frozen-lockfile
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch
 COPY . .
 RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
 RUN pnpm build
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm --filter {{projectName}} --prod deploy /prod/app
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm pm deploy --filter {{projectName}} --prod /prod/app
 
-FROM node:22-bookworm-slim AS runtime-base
+FROM node:24-bookworm-slim AS runtime-base
 
 ENV NODE_ENV=production
+ENV HAI_CORE_ENV=production
 ENV HOST=0.0.0.0
 ENV PORT=3000
 WORKDIR /app

package/templates/base/e2e/app.spec.ts.hbs

@@ -5,6 +5,7 @@ test('home page renders from browser', async ({ page }) => {
   const pageErrors: string[] = []
   page.on('pageerror', error => pageErrors.push(error.message))
   await page.goto('/')
+  await expect(page).toHaveTitle(process.env.HAI_CORE_NAME ?? '{{projectName}}')
   await expect(pageErrors).toEqual([])
   await expect(page.locator('main, section').first()).toBeVisible()
 })

package/templates/base/eslint-rules.js

@@ -0,0 +1,45 @@
+/**
+ * 应用共享质量门禁。依赖 Antfu 已注册的 TypeScript / ESLint comments 插件。
+ * 必要第三方 workaround 使用单行 eslint-disable-next-line <规则> -- 具体原因，
+ * 不关闭整个文件的检查。秘密泄漏、输入/权限校验仍需结合业务审查。
+ */
+export const haiQualityConfig = {
+  files: ['**/*.{js,mjs,cjs,ts,tsx,svelte}'],
+  linterOptions: {
+    reportUnusedDisableDirectives: 'error',
+  },
+  rules: {
+    'no-console': ['error', {}],
+    'ts/no-explicit-any': 'error',
+    'ts/ban-ts-comment': ['error', {
+      'ts-ignore': true,
+      'ts-nocheck': true,
+      'ts-check': false,
+      'ts-expect-error': 'allow-with-description',
+      'minimumDescriptionLength': 10,
+    }],
+    'eslint-comments/no-unlimited-disable': 'error',
+    'eslint-comments/require-description': 'error',
+    // 只禁内部源码/构建目录，公开的 /client、/adapter 等 exports 子路径可用。
+    'no-restricted-imports': ['error', {
+      patterns: [{
+        group: ['@h-ai/*/src', '@h-ai/*/src/**', '@h-ai/*/dist', '@h-ai/*/dist/**'],
+        message: 'Use the public exports of hai packages instead of their src/dist internals.',
+      }],
+    }],
+    'no-restricted-syntax': ['error', {
+      selector: ':matches(TSAsExpression, TSTypeAssertion)[expression.typeAnnotation.type="TSUnknownKeyword"]',
+      message: 'Use the real upstream type or narrow unknown. Explain necessary third-party workarounds with a scoped lint exception.',
+    }, {
+      selector: 'ImportExpression[source.value=/^@h-ai\\/[^/]+\\/(src|dist)(\\/|$)/]',
+      message: 'Use the public exports of hai packages instead of their src/dist internals.',
+    }, {
+      // 仅识别明确的静态敏感键；变量键、别名及业务敏感程度仍需审查。
+      selector: 'CallExpression[callee.property.name="setItem"][callee.object.name="localStorage"][arguments.0.value=/^(token|password|secret|api[_-]?key|(access|refresh|auth|session)[_-]?token)$/i]',
+      message: 'Keep sensitive tokens in memory, httpOnly cookies or a secure native TokenStore instead of localStorage.',
+    }, {
+      selector: 'CallExpression[callee.property.name="setItem"][callee.object.property.name="localStorage"][arguments.0.value=/^(token|password|secret|api[_-]?key|(access|refresh|auth|session)[_-]?token)$/i]',
+      message: 'Keep sensitive tokens in memory, httpOnly cookies or a secure native TokenStore instead of localStorage.',
+    }],
+  },
+}

package/templates/base/eslint.config.js.hbs

@@ -4,9 +4,12 @@
  * @see https://github.com/antfu/eslint-config
  */
 
-import antfu from '@antfu/eslint-config'
+import antfu, { GLOB_SRC } from '@antfu/eslint-config'
+import { haiQualityConfig } from './eslint-rules.js'
 
 export default antfu({
+  // unused-imports 使用 TS 规则，JS 同样使用 TS parser 以保持 scope 契约一致。
+  typescript: { files: [GLOB_SRC] },
   formatters: true,
   ignores: [
 {{#unless isSvelteOnlyApp}}
@@ -18,6 +21,7 @@ export default antfu({
     '**/project.inlang/**',
     '**/paraglide/**',
     '**/.agents/**',
+    '**/.claude/**',
     '**/.github/**',
     '**/AGENTS.md',
     '**/CLAUDE.md',
@@ -27,10 +31,4 @@ export default antfu({
     '**/pnpm-workspace.yaml',
   ],
   svelte: true,
-}, {
-  files: ['**/*.ts', '**/*.svelte'],
-  rules: {
-    'no-console': 'error',
-    'ts/no-explicit-any': 'error',
-  },
-})
+}, haiQualityConfig)

package/templates/base/package.json.hbs

@@ -1,9 +1,9 @@
 {
-  "engines": { "node": ">=22.12.0" },
+  "engines": { "node": "^22.22.2 || ^24.15.0 || >=26.0.0" },
   "name": "{{projectName}}",
-  "version": "0.1.0-alpha.56",
+  "version": "0.1.0-alpha.58",
   "private": true,
-  "packageManager": "pnpm@9.15.0",
+  "packageManager": "pnpm@12.11.2",
   "description": "{{#if_eq appType 'admin'}}Enterprise management system built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'website'}}Enterprise website built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'h5'}}Mobile H5 app built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'api'}}REST API service built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'mobile-app'}}Mobile app built with hai Agent Framework{{/if_eq}}",
   "keywords": ["hai", {{#unless isSvelteOnlyApp}}"sveltekit", {{/unless}}"svelte5", "{{appType}}"],
   "license": "Apache-2.0",
@@ -75,51 +75,48 @@
     "@h-ai/capacitor": "{{haiPackageSpecifier}}"{{/if}}{{#if isCapacitorApp}}{{#unless features.api-client}},
     "@h-ai/api-client": "{{haiPackageSpecifier}}"{{/unless}}{{#unless features.capacitor}},
     "@h-ai/capacitor": "{{haiPackageSpecifier}}"{{/unless}}{{/if}},
-    "zod": "^4.4.3"
+    "zod": "{{versions.zod}}"
 {{/if}}
   },
   "devDependencies": {
-    "@antfu/eslint-config": "^9.0.0",
-    "@playwright/test": "^1.60.0",
+    "@antfu/eslint-config": "{{versions.antfuEslintConfig}}",
+    "@playwright/test": "{{versions.playwright}}",
 {{#if isCapacitorApp}}
-    "@aparajita/capacitor-secure-storage": "^8.0.0",
-    "@capacitor/app": "^8.0.1",
-    "@capacitor/camera": "^8.0.1",
-    "@capacitor/cli": "^8.3.4",
-    "@capacitor/core": "^8.3.4",
-    "@capacitor/android": "^8.3.4",
-    "@capacitor/device": "^8.0.1",
-    "@capacitor/ios": "^8.3.4",
-    "@capacitor/preferences": "^8.0.1",
-    "@capacitor/push-notifications": "^8.0.1",
-    "@capacitor/status-bar": "^8.0.1",
+    "@aparajita/capacitor-secure-storage": "{{versions.capacitorSecureStorage}}",
+    "@capacitor/app": "{{versions.capacitorApp}}",
+    "@capacitor/camera": "{{versions.capacitorCamera}}",
+    "@capacitor/cli": "{{versions.capacitorCli}}",
+    "@capacitor/core": "{{versions.capacitorCore}}",
+    "@capacitor/android": "{{versions.capacitorAndroid}}",
+    "@capacitor/device": "{{versions.capacitorDevice}}",
+    "@capacitor/ios": "{{versions.capacitorIos}}",
+    "@capacitor/preferences": "{{versions.capacitorPreferences}}",
+    "@capacitor/push-notifications": "{{versions.capacitorPushNotifications}}",
+    "@capacitor/status-bar": "{{versions.capacitorStatusBar}}",
 {{else}}
-    "@sveltejs/adapter-node": "^5.5.4",
+    "@sveltejs/adapter-node": "{{versions.svelteAdapterNode}}",
 {{/if}}
 {{#unless isSvelteOnlyApp}}
-    "@sveltejs/kit": "^2.61.1",
+    "@sveltejs/kit": "{{versions.svelteKit}}",
 {{/unless}}
-    "@sveltejs/vite-plugin-svelte": "^7.1.2",
-    "@types/node": "^25.9.1",
-    "eslint": "^10.4.0",
-    "eslint-plugin-format": "^2.0.1",
-    "eslint-plugin-svelte": "^3.17.1",
-    "rimraf": "^6.1.3",
-    "svelte": "^5.55.9",
-    "svelte-check": "^4.4.8",
-    "svelte-eslint-parser": "^1.6.1",
-    "typescript": "^6.0.3",
-    "vite": "^8.0.14",
-    "vitest": "^4.1.7"{{#if hasUi}},
-    "@tailwindcss/vite": "^4.3.0",
-    "tailwindcss": "^4.3.0",
-    "daisyui": "^5.5.20",
-    "@iconify-json/tabler": "^1.2.35",
-    "@iconify/tailwind4": "^1.2.3"{{/if}}{{#if hasI18n}},
-    "@inlang/paraglide-js": "^2.18.1",
-    "@inlang/plugin-message-format": "^4.4.0"{{/if}}
-  }{{#if features.db}},
-  "pnpm": {
-    "onlyBuiltDependencies": ["better-sqlite3"]
-  }{{/if}}
+    "@sveltejs/vite-plugin-svelte": "{{versions.sveltePlugin}}",
+    "@types/node": "{{versions.nodeTypes}}",
+    "eslint": "{{versions.eslint}}",
+    "eslint-plugin-format": "{{versions.eslintPluginFormat}}",
+    "eslint-plugin-svelte": "{{versions.eslintPluginSvelte}}",
+    "rimraf": "{{versions.rimraf}}",
+    "svelte": "{{versions.svelte}}",
+    "svelte-check": "{{versions.svelteCheck}}",
+    "svelte-eslint-parser": "{{versions.svelteEslintParser}}",
+    "typescript": "{{versions.typescript}}",
+    "vite": "{{versions.vite}}",
+    "vitest": "{{versions.vitest}}"{{#if hasUi}},
+    "@tailwindcss/vite": "{{versions.tailwindcssVite}}",
+    "tailwindcss": "{{versions.tailwindcss}}",
+    "daisyui": "{{versions.daisyui}}",
+    "@iconify-json/tabler": "{{versions.iconifyJsonTabler}}",
+    "@iconify/tailwind4": "{{versions.iconifyTailwind}}"{{/if}}{{#if hasI18n}},
+    "@inlang/paraglide-js": "{{versions.inlangParaglide}}",
+    "@inlang/plugin-message-format": "{{versions.inlangMessageFormat}}"{{/if}}
+  }
 }

package/templates/base/pnpm-workspace.yaml.hbs

@@ -3,6 +3,32 @@
 shellEmulator: true
 
 trustPolicy: no-downgrade
+# 上游构建工具仍要求 4.x；4.0.3 tarball 已核对原 lockfile 的 SHA-512。
+trustPolicyExclude:
+  - chokidar@4.0.3
+
+# pnpm 12 配置；原生依赖仅运行明确列出的安装脚本。
+nodeLinker: hoisted
+allowBuilds:
+  cpu-features: true
+  onnxruntime-node: true
+  protobufjs: true
+  ssh2: true
+  vue-demi: true
+  better-sqlite3: true
+  esbuild: true
+  core-js: false
+
+overrides:
+  "@ai-sdk/provider-utils@>=4.0.0 <4.0.33": 4.0.57
+  cookie@<0.7.0: 0.7.2
+  esbuild@<0.28.1: 0.28.2
+  katex@<0.18.2: 0.18.10
+  sharp@<0.35.5: 0.35.5
+  tinypool@<2.1.2: 2.2.0
+  '@qdrant/js-client-rest>undici': 7.30.0
+  xcode>uuid: 11.1.1
+  "@types/node": "{{versions.nodeTypes}}"
 
 packages:
   - .

package/templates/base/src/app.d.ts.hbs

@@ -6,6 +6,10 @@ import '@h-ai/ui/auto-import'
 {{/if}}
 declare global {
   namespace App {
+    interface PageData {
+      /** 经服务端 core 解析后可公开的应用配置 */
+      appConfig: Pick<import('@h-ai/core').CoreConfig, 'name' | 'version' | 'env' | 'defaultLocale'>
+    }
     interface Locals {
       /** 请求 ID */
       requestId: string

package/templates/base/src/hooks.server.ts.hbs

@@ -10,19 +10,11 @@ import { paraglideMiddleware } from '$lib/paraglide/server.js'
 {{/if}}
 import { initApp } from '$lib/server/init.js'
 import { core } from '@h-ai/core'
-{{#if features.crypto}}
-import { crypto } from '@h-ai/crypto'
-{{/if}}
 {{#if features.iam}}
 import { iam } from '@h-ai/iam'
 {{/if}}
 import { kit } from '@h-ai/kit'
 
-{{#if features.crypto}}
-// 初始化加密模块（同步）
-crypto.init()
-
-{{/if}}
 // =============================================================================
 // 应用初始化
 // =============================================================================