@h-ai/cli 0.1.0-alpha9 → 1.0.0-beta.2

package/templates/apps/fullstack/packages/{{projectName}}-shared/tests/api-client.test.ts.hbs

@@ -0,0 +1,150 @@
+import { HaiApiClientError } from '@h-ai/api-client'
+import { authenticateTransportRequest, createInMemoryKeyStore, crypto, TRANSPORT_PROTOCOL } from '@h-ai/crypto'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import { initializeManagementApi, managementApi, resolveAvatarUrl } from '../src/lib/api/api-client.js'
+
+const runtimeInfo = {
+  name: 'Configured workspace',
+  version: '9.8.7',
+  env: 'test',
+  defaultLocale: 'zh-CN',
+  supportedLocales: ['zh-CN', 'en-US'],
+  startedAt: '2026-01-01T00:00:00.000Z',
+  frontends: ['web'],
+}
+
+/** 使用真实 crypto 公共入口模拟对端，覆盖握手及双向加解密。 */
+function createServerFetch() {
+  const key = crypto.asymmetric.generateKeyPair()
+  if (!key.success)
+    throw new Error(key.error.message)
+  const created = crypto.transport.createServer({ serverKeyRing: { activeKeyId: 'test-v1', keys: { 'test-v1': key.data } }, keyStore: createInMemoryKeyStore() })
+  if (!created.success)
+    throw new Error(created.error.message)
+  const server = created.data
+  const requests: Request[] = []
+  const messages: string[] = []
+  const fetchFn: typeof fetch = async (input, init) => {
+    const request = new Request(input, init)
+    requests.push(request.clone())
+    const url = new URL(request.url)
+    if (url.pathname.endsWith('/_hai/key-exchange')) {
+      const body = await request.json() as { clientPublicKey: string }
+      const clientId = await server.registerClientKey(body.clientPublicKey)
+      return Response.json({ serverKeyId: server.getServerKeyId(), serverPublicKey: server.getServerPublicKey(), clientId })
+    }
+    const clientId = request.headers.get(TRANSPORT_PROTOCOL.CLIENT_ID_HEADER)
+    if (!clientId)
+      return Response.json({ success: false }, { status: 400 })
+    const verified = await authenticateTransportRequest(server, request)
+    if (!verified.success)
+      throw new Error(verified.error.message)
+    let data: unknown = runtimeInfo
+    if (url.pathname.endsWith('/app/echo')) {
+      expect(request.headers.get(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER)).toBe(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER_VALUE)
+      const payload = JSON.parse(verified.data.plaintext) as { message: string }
+      messages.push(payload.message)
+      data = { message: payload.message, echoedAt: '2026-01-01T00:00:00.000Z', requestId: 'test-request' }
+    }
+    const response = await server.encryptResponse(verified.data.context, JSON.stringify({ success: true, data }), 200)
+    if (!response.success)
+      throw new Error(response.error.message)
+    return Response.json(response.data, { headers: { [TRANSPORT_PROTOCOL.ENCRYPTED_HEADER]: TRANSPORT_PROTOCOL.ENCRYPTED_HEADER_VALUE } })
+  }
+  return { fetchFn, requests, messages }
+}
+
+describe('shared API transport', () => {
+  beforeAll(async () => {
+    expect((await crypto.init()).success).toBe(true)
+  })
+  afterAll(async () => {
+    await managementApi.close()
+    await crypto.close()
+  })
+
+  it('decrypts configured core metadata and includes refresh cookies', async () => {
+    const server = createServerFetch()
+    expect((await initializeManagementApi({ fetchFn: server.fetchFn, baseUrl: 'https://api.example.com', clientName: 'configured-client' })).success).toBe(true)
+    const info = await managementApi.app.info()
+    expect(info.success).toBe(true)
+    if (info.success)
+      expect(info.data).toEqual(runtimeInfo)
+    expect(server.requests.every(request => request.credentials === 'include')).toBe(true)
+    expect(server.requests.at(-1)?.headers.get('x-request-client')).toBe('configured-client')
+  })
+
+  it.each([false, true])('uses the injected API origin when native configuration is required: %s', async (requireApiBase) => {
+    Object.assign(globalThis, { __HAI_PUBLIC_CONFIG__: { apiBase: 'https://runtime.example.com' } })
+    const server = createServerFetch()
+    try {
+      expect((await initializeManagementApi({ fetchFn: server.fetchFn, requireApiBase })).success).toBe(true)
+      expect((await managementApi.app.info()).success).toBe(true)
+      expect(server.requests.every(request => request.url.startsWith('https://runtime.example.com/api/v1/'))).toBe(true)
+    }
+    finally {
+      Reflect.deleteProperty(globalThis, '__HAI_PUBLIC_CONFIG__')
+    }
+  })
+
+  it('encrypts business input and preserves the native token transport header', async () => {
+    const server = createServerFetch()
+    const init = await initializeManagementApi({ fetchFn: server.fetchFn, baseUrl: 'https://api.example.com/api/v1', headers: { 'X-HAI-Token-Transport': 'body' } })
+    expect(init.success).toBe(true)
+    try {
+      const result = await managementApi.app.echo({ message: 'private message' })
+      expect(result.success).toBe(true)
+      if (result.success)
+        expect(result.data.message).toBe('private message')
+      expect(server.messages).toEqual(['private message'])
+      expect(server.requests.at(-1)?.headers.get('X-HAI-Token-Transport')).toBe('body')
+    }
+    finally {
+      await managementApi.close()
+    }
+  })
+
+  it('resolves avatars only under the configured API origin', async () => {
+    const server = createServerFetch()
+    expect((await initializeManagementApi({ fetchFn: server.fetchFn, baseUrl: 'https://trusted.example.com/api/v1' })).success).toBe(true)
+    try {
+      const path = '/api/v1/assets/avatars/user-id/asset-id.png'
+      expect(resolveAvatarUrl(path)).toBe(`https://trusted.example.com${path}`)
+      expect(resolveAvatarUrl(`https://host-injection.example.com${path}`)).toBe(`https://trusted.example.com${path}`)
+      expect(resolveAvatarUrl('https://host-injection.example.com/pixel.png')).toBeUndefined()
+      expect(resolveAvatarUrl('/api/v1/assets/avatars/../secrets.txt')).toBeUndefined()
+      expect(resolveAvatarUrl('data:image/svg+xml,<svg/>')).toBeUndefined()
+    }
+    finally {
+      await managementApi.close()
+    }
+  })
+
+  it('requires an explicit API origin for a native build', async () => {
+    vi.stubEnv('PUBLIC_API_BASE', '')
+    try {
+      const result = await initializeManagementApi({ requireApiBase: true })
+      expect(result.success).toBe(false)
+      if (!result.success)
+        expect(result.error.code).toBe(HaiApiClientError.CONFIG_ERROR.code)
+    }
+    finally {
+      vi.unstubAllEnvs()
+    }
+  })
+
+  it('preserves a configured API prefix for transport and avatars', async () => {
+    const server = createServerFetch()
+    expect((await initializeManagementApi({ fetchFn: server.fetchFn, baseUrl: 'https://trusted.example.com/custom-api/' })).success).toBe(true)
+    try {
+      expect((await managementApi.app.info()).success).toBe(true)
+      expect(server.requests.every(request => request.url.startsWith('https://trusted.example.com/custom-api/'))).toBe(true)
+      const avatar = '/custom-api/assets/avatars/user-id/asset-id.png'
+      expect(resolveAvatarUrl(avatar)).toBe(`https://trusted.example.com${avatar}`)
+      expect(resolveAvatarUrl('/api/v1/assets/avatars/user-id/asset-id.png')).toBeUndefined()
+    }
+    finally {
+      await managementApi.close()
+    }
+  })
+})

package/templates/apps/fullstack/packages/{{projectName}}-shared/tests/management-store.test.ts.hbs

@@ -0,0 +1,253 @@
+import type { AdminUser } from '{{fullstack.contractPackageName}}'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { HashRouter } from '../src/lib/navigation/hash-router.svelte.js'
+import * as m from '../src/lib/paraglide/messages.js'
+import { ManagementStore } from '../src/lib/stores/management-store.svelte.js'
+
+const api = vi.hoisted(() => ({
+  initialize: vi.fn(),
+  app: { info: vi.fn() },
+  auth: { clear: vi.fn() },
+  iam: { auth: { logout: vi.fn(), currentUser: vi.fn(), reauthenticate: vi.fn(), changePassword: vi.fn() } },
+  admin: { users: { list: vi.fn(), resetPassword: vi.fn() }, audit: { list: vi.fn() } },
+}))
+vi.mock('../src/lib/api/api-client.js', () => ({
+  managementApi: api,
+  managementAuthActions: { reauthenticate: api.iam.auth.reauthenticate },
+  initializeManagementApi: api.initialize,
+  resolveAvatarUrl: (url: string | undefined) => url,
+}))
+
+const member = {
+  id: 'member-id',
+  username: 'member',
+  accountStatus: 'active' as const,
+  roles: ['user'],
+  permissions: [],
+  createdAt: '2026-01-01T00:00:00.000Z',
+  updatedAt: '2026-01-01T00:00:00.000Z',
+}
+const administrator = { ...member, id: 'admin-id', username: 'admin', roles: ['admin'], permissions: ['app.users.manage', 'app.roles.manage'] }
+const forbidden = { success: false, error: { code: 'test:forbidden', message: 'Forbidden', httpStatus: 403 } } as const
+
+function deferred<T>() {
+  let resolve!: (result: T) => void
+  const promise = new Promise<T>((done) => {
+    resolve = done
+  })
+  return { promise, resolve }
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  vi.stubGlobal('location', { hash: '#/users' })
+  vi.stubGlobal('history', { replaceState: vi.fn(), pushState: vi.fn() })
+  api.iam.auth.logout.mockResolvedValue({ success: true })
+  api.iam.auth.currentUser.mockResolvedValue({ success: true, data: member })
+})
+
+afterEach(() => vi.unstubAllGlobals())
+
+/** 会话测试使用真实路由状态，浏览器历史由 E2E 验证。 */
+function createStore() {
+  return new ManagementStore(new HashRouter(['../pages/users.svelte', '../pages/settings.svelte'], '/users'))
+}
+
+describe('management session and request ownership', () => {
+  it('password validation explains missing current password and mismatched confirmation without a request', async () => {
+    const store = createStore()
+    store.user = member
+    await store.changePassword({ newPassword: 'NewPassword123!', confirmPassword: 'NewPassword123!' })
+    expect(store.error).toBe(m.password_current_required())
+    await store.changePassword({ oldPassword: 'CurrentPassword123!', newPassword: 'NewPassword123!', confirmPassword: 'ＮewPassword123!' })
+    expect(store.error).toBe(m.password_confirmation_mismatch())
+    expect(api.iam.auth.changePassword).not.toHaveBeenCalled()
+    expect(api.auth.clear).not.toHaveBeenCalled()
+  })
+
+  it.each(['hai:iam:002', 'hai:iam:034', 'hai:iam:999'])('password failures use safe messages and keep the active session: %s', async (code) => {
+    api.iam.auth.changePassword.mockResolvedValueOnce({ success: false, error: { code, message: 'Private password or database detail', httpStatus: code === 'hai:iam:002' ? 401 : code === 'hai:iam:999' ? 500 : 400, traceId: 'password-failure' } })
+    const store = createStore()
+    store.user = member
+    await store.changePassword({ oldPassword: 'CurrentPassword123!', newPassword: 'NewPassword123!', confirmPassword: 'NewPassword123!' })
+    expect(store.error).toContain('traceId: password-failure')
+    expect(store.error).not.toContain('Private')
+    expect(store.error).not.toBe(m.session_expired())
+    expect(store.user?.id).toBe(member.id)
+    expect(api.auth.clear).not.toHaveBeenCalled()
+    expect(api.iam.auth.changePassword).toHaveBeenCalledWith({ oldPassword: 'CurrentPassword123!', newPassword: 'NewPassword123!' })
+  })
+
+  it('an accepted password change clears local tokens only after the server confirms success', async () => {
+    api.iam.auth.changePassword.mockResolvedValueOnce({ success: true, data: undefined })
+    const store = createStore()
+    store.user = member
+    await store.changePassword({ oldPassword: 'CurrentPassword123!', newPassword: 'NewPassword123!', confirmPassword: 'NewPassword123!' })
+    expect(api.auth.clear).toHaveBeenCalledOnce()
+    expect(store.user).toBeNull()
+  })
+
+  it.each(['dormant', 'closed'] as const)('resetting another duty password preserves its %s state and the administrator session', async (accountStatus) => {
+    const target: AdminUser = { ...member, roles: ['config_admin'], accountStatus, accountType: 'permanent', accountExpiresAt: null, lastLoginAt: null }
+    api.admin.users.resetPassword.mockResolvedValueOnce({ success: true })
+    const store = createStore()
+    store.user = administrator
+    store.users = [target]
+    expect(await store.resetUserPassword(target, 'NewPassword123!')).toBe(true)
+    expect(api.admin.users.resetPassword).toHaveBeenCalledWith({ id: target.id, newPassword: 'NewPassword123!' }, expect.objectContaining({ context: expect.any(Object) }))
+    expect(store.users[0]?.accountStatus).toBe(accountStatus)
+    expect(store.user?.id).toBe(administrator.id)
+    expect(api.auth.clear).not.toHaveBeenCalled()
+    expect(store.saving).toBe(false)
+  })
+
+  it('an unsuccessful self reset retains authentication and hides private server details', async () => {
+    const target: AdminUser = { ...administrator, roles: ['admin'], accountType: 'permanent', accountExpiresAt: null, lastLoginAt: null }
+    api.admin.users.resetPassword.mockResolvedValueOnce({ success: false, error: { code: 'hai:iam:999', httpStatus: 500, message: 'Private password reset detail', traceId: 'reset-failure' } })
+    const store = createStore()
+    store.user = administrator
+    expect(await store.resetUserPassword(target, 'NewPassword123!')).toBe(false)
+    expect(store.user?.id).toBe(administrator.id)
+    expect(api.auth.clear).not.toHaveBeenCalled()
+    expect(store.error).not.toContain('Private')
+    expect(store.error).toContain('traceId: reset-failure')
+  })
+
+  it('a successful self reset clears local authentication after the server confirms revocation', async () => {
+    const target: AdminUser = { ...administrator, roles: ['admin'], accountType: 'permanent', accountExpiresAt: null, lastLoginAt: null }
+    const response = deferred<{ success: true }>()
+    api.admin.users.resetPassword.mockReturnValueOnce(response.promise)
+    const store = createStore()
+    store.user = administrator
+    const reset = store.resetUserPassword(target, 'NewPassword123!')
+    expect(api.auth.clear).not.toHaveBeenCalled()
+    expect(store.user?.id).toBe(administrator.id)
+    response.resolve({ success: true })
+    expect(await reset).toBe(true)
+    expect(api.auth.clear).toHaveBeenCalledOnce()
+    expect(store.user).toBeNull()
+  })
+
+  it('preserves the clock synchronization advice when application bootstrap is rejected', async () => {
+    const message = 'Synchronize device and server clocks, then refresh to retry.'
+    api.initialize.mockResolvedValueOnce({ success: true })
+    api.app.info.mockResolvedValueOnce({ success: false, error: { code: 'hai:api-client:007', httpStatus: 400, message, cause: { transportCode: 'hai:crypto:071' } } })
+    const store = createStore()
+    await store.initialize({ baseUrl: 'https://api.example.test' })
+    expect(store.error).toBe(message)
+    expect(store.initializing).toBe(false)
+    expect(api.iam.auth.currentUser).not.toHaveBeenCalled()
+  })
+
+  it('preserves useful validation advice instead of replacing it with a generic operation error', async () => {
+    const message = 'Synchronize device and server clocks, then refresh to retry.'
+    api.admin.users.list.mockResolvedValueOnce({ success: false, error: { code: 'hai:api-client:007', httpStatus: 400, message } })
+    const store = createStore()
+    store.user = administrator
+    await store.loadUsers()
+    expect(store.error).toBe(message)
+    expect(store.loading).toBe(false)
+  })
+  it('ignores a previous administrator failure after logout and another user login', async () => {
+    const oldRequest = deferred<typeof forbidden>()
+    api.admin.users.list.mockReturnValueOnce(oldRequest.promise)
+    const store = createStore()
+    store.user = administrator
+    const loading = store.loadUsers()
+    await store.logout()
+    await store.authenticated()
+    oldRequest.resolve(forbidden)
+    await loading
+    expect(store.user?.id).toBe(member.id)
+    expect(store.page).toBe('settings')
+    expect(store.error).toBe('')
+    expect(store.loading).toBe(false)
+    expect(api.iam.auth.currentUser).toHaveBeenCalledTimes(1)
+  })
+
+  it('ignores an obsolete page failure after opening personal settings', async () => {
+    const oldRequest = deferred<typeof forbidden>()
+    api.admin.users.list.mockReturnValueOnce(oldRequest.promise)
+    const store = createStore()
+    store.user = administrator
+    const loading = store.loadUsers()
+    await store.navigate('settings')
+    oldRequest.resolve(forbidden)
+    await loading
+    expect(store.user?.id).toBe(administrator.id)
+    expect(store.page).toBe('settings')
+    expect(store.error).toBe('')
+    expect(store.loading).toBe(false)
+    expect(api.iam.auth.currentUser).not.toHaveBeenCalled()
+  })
+
+  it('refreshes revoked roles once and clears administration data', async () => {
+    api.admin.users.list.mockResolvedValueOnce(forbidden)
+    const store = createStore()
+    store.user = administrator
+    store.roles = [{ id: 'role-id', code: 'admin', name: 'Administrator', userCount: 1 }]
+    await store.loadUsers()
+    expect(store.user?.roles).toEqual(['user'])
+    expect(store.page).toBe('settings')
+    expect(store.roles).toEqual([])
+    expect(store.users).toEqual([])
+    expect(store.loading).toBe(false)
+    expect(store.error).toBe(m.forbidden())
+    expect(api.iam.auth.currentUser).toHaveBeenCalledTimes(1)
+  })
+
+  it.each(['hai:iam:105', 'hai:common:100'])('keeps the page, original user and unsaved fields when an expired session request is cancelled: %s', async (code) => {
+    api.admin.users.list.mockResolvedValueOnce({ success: false, error: { code, message: 'Expired', httpStatus: 401 } })
+    const store = createStore()
+    store.user = administrator
+    store.businessNotice = 'Unsaved business input'
+    await store.loadUsers()
+    expect(store.user?.id).toBe(administrator.id)
+    expect(store.businessNotice).toBe('Unsaved business input')
+    expect(store.page).toBe('settings')
+    expect(api.auth.clear).not.toHaveBeenCalled()
+    expect(store.error).toBe(m.session_expired())
+  })
+
+  it('reports a connection failure when loading the authenticated user', async () => {
+    api.iam.auth.currentUser.mockRejectedValueOnce(new Error('Connection unavailable'))
+    const store = createStore()
+    await store.authenticated()
+    expect(store.error).toBe(m.network_error())
+    expect(store.error).not.toBe(m.login_invalid())
+    expect(store.saving).toBe(false)
+    expect(api.iam.auth.currentUser).toHaveBeenCalledTimes(1)
+  })
+})
+
+it('user paging and header sorting keep applied filters until Query submits drafts', async () => {
+  api.admin.users.list.mockResolvedValue({ success: true, data: { items: [], total: 60, page: 1, pageSize: 20 } })
+  const store = createStore()
+  store.user = administrator
+  store.usersSearch = 'applied'
+  store.usersStatus = 'active'
+  await store.queryUsers()
+  store.usersSearch = 'draft'
+  store.usersStatus = 'dormant'
+  await store.loadUsers(2)
+  expect(api.admin.users.list).toHaveBeenLastCalledWith(expect.objectContaining({ page: 2, search: 'applied', accountStatus: 'active' }))
+  await store.sortUsers('username', 'asc')
+  expect(api.admin.users.list).toHaveBeenLastCalledWith(expect.objectContaining({ page: 1, search: 'applied', accountStatus: 'active', sortBy: 'username', sortDirection: 'asc' }))
+  await store.queryUsers()
+  expect(api.admin.users.list).toHaveBeenLastCalledWith(expect.objectContaining({ search: 'draft', accountStatus: 'dormant' }))
+})
+
+it('audit paging and header sorting do not submit unfinished filter drafts', async () => {
+  api.admin.audit.list.mockResolvedValue({ success: true, data: { items: [], stats: [], backupEnabled: false, total: 60, page: 1, pageSize: 20 } })
+  const store = createStore()
+  store.user = administrator
+  store.auditResource = 'applied'
+  await store.queryAudit()
+  store.auditResource = 'draft'
+  await store.loadAudit(2)
+  expect(api.admin.audit.list).toHaveBeenLastCalledWith(expect.objectContaining({ page: 2, resource: 'applied' }))
+  await store.sortAudit('action', 'asc')
+  expect(api.admin.audit.list).toHaveBeenLastCalledWith(expect.objectContaining({ page: 1, resource: 'applied', sortBy: 'action', sortDirection: 'asc' }))
+  await store.queryAudit()
+  expect(api.admin.audit.list).toHaveBeenLastCalledWith(expect.objectContaining({ page: 1, resource: 'draft' }))
+})

package/templates/apps/fullstack/packages/{{projectName}}-shared/tsconfig.json.hbs

@@ -0,0 +1,17 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "allowImportingTsExtensions": true,
+    "allowJs": true,
+    "checkJs": false,
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "noEmit": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "types": ["svelte", "vite/client"],
+    "verbatimModuleSyntax": true
+  },
+  "include": ["src/**/*", "src/**/*.svelte"],
+  "exclude": ["node_modules", "src/lib/paraglide"]
+}

package/templates/apps/fullstack/packages/{{projectName}}-shared/vitest.config.ts.hbs

@@ -0,0 +1,7 @@
+import { svelte } from '@sveltejs/vite-plugin-svelte'
+import { defineConfig } from 'vitest/config'
+
+export default defineConfig({
+  plugins: [svelte()],
+  test: { environment: 'node', include: ['tests/**/*.test.ts'] },
+})

package/templates/apps/fullstack/playwright.config.ts.hbs

@@ -0,0 +1,114 @@
+import process from 'node:process'
+import { defineConfig } from '@playwright/test'
+import { createE2eNotificationEnv, createE2eServerEnv, createE2eTransportRing } from './scripts/e2e-env.js'
+
+const defaultBaseURL = '{{#if fullstack.e2eFrontend}}http://127.0.0.1:{{fullstack.e2eFrontend.port}}{{else}}http://127.0.0.1:3000{{/if}}'
+const defaultServiceBaseURL = 'http://127.0.0.1:3000'
+const baseURL = process.env.BASE_URL || defaultBaseURL
+const primaryFrontend = '{{fullstack.e2eFrontend.target}}'
+const frontendUrls = {
+  web: process.env.HAI_E2E_WEB_URL,
+  app: process.env.HAI_E2E_APP_URL,
+  desktop: process.env.HAI_E2E_DESKTOP_URL,
+}
+const frontends: { target: string, name: string, url: string }[] = [
+{{#each fullstack.frontendApps}}
+  {
+    target: '{{target}}',
+    name: '{{packageName}}',
+    url: frontendUrls.{{target}} || 'http://127.0.0.1:{{port}}',
+  },
+{{/each}}
+]
+const serviceBaseURL = process.env.SERVICE_BASE_URL || defaultServiceBaseURL
+const serviceHost = resolveHostFromBaseUrl(serviceBaseURL, '127.0.0.1')
+const servicePort = resolvePortFromBaseUrl(serviceBaseURL, '3000')
+
+function resolveHostFromBaseUrl(urlString: string, fallbackHost: string): string {
+  try {
+    const url = new URL(urlString)
+    return url.hostname || fallbackHost
+  }
+  catch {
+    return fallbackHost
+  }
+}
+
+function resolvePortFromBaseUrl(urlString: string, fallbackPort: string): string {
+  try {
+    const url = new URL(urlString)
+    if (url.port) {
+      return url.port
+    }
+
+    return url.protocol === 'https:' ? '443' : '80'
+  }
+  catch {
+    return fallbackPort
+  }
+}
+
+export default defineConfig({
+  testDir: './e2e',
+  testIgnore: '**/session-close.spec.ts',
+  // 多个界面验收共用管理员资料与引导状态，保留串行以免互相覆盖。
+  fullyParallel: false,
+  forbidOnly: !!process.env.CI,
+  retries: 0,
+  workers: 1,
+  reporter: 'list',
+  timeout: 30_000,
+  use: {
+    baseURL,
+    channel: 'chrome',
+    trace: 'retain-on-failure',
+    screenshot: 'only-on-failure',
+  },
+  webServer: [
+    {
+      name: '{{fullstack.servPackageName}}',
+      command: 'pnpm --filter {{fullstack.servPackageName}} exec node dist/index.js',
+      env: createE2eServerEnv({
+        ...createE2eNotificationEnv(),
+        HAI_DB: JSON.stringify({ type: 'sqlite', database: `${process.env.HAI_E2E_DATA_ROOT}/fullstack.db` }),
+        HAI_CACHE: JSON.stringify({ type: 'memory' }),
+        HAI_STORAGE: JSON.stringify({ type: 'local', root: `${process.env.HAI_E2E_DATA_ROOT}/uploads` }),
+        HAI_VECDB: JSON.stringify({ type: 'lancedb', path: `${process.env.HAI_E2E_DATA_ROOT}/vecdb` }),
+        HAI_CRYPTO_TRANSPORT_SERVERKEYRING: createE2eTransportRing(),
+        HOST: serviceHost,
+        PORT: servicePort,
+        // 仅供脚手架验收；验收已部署环境时，E2E_*_PASSWORD须与该环境初始凭据一致，不记录密码。
+        HAI_ADMIN_DEFAULT_PASSWORD: process.env.E2E_ADMIN_PASSWORD || 'Scaffold-test-Admin123!',
+        HAI_AUDIT_ADMIN_PASSWORD: process.env.E2E_AUDIT_ADMIN_PASSWORD || 'Scaffold-test-Audit123!',
+        HAI_CONFIG_ADMIN_PASSWORD: process.env.E2E_CONFIG_ADMIN_PASSWORD || 'Scaffold-test-Config123!',
+        HAI_BUSINESS_OPERATOR_PASSWORD: process.env.E2E_BUSINESS_OPERATOR_PASSWORD || 'Scaffold-test-Operator123!',
+        HAI_IAM_PASSWORD_PREVENTSAMEPASSWORD: 'true',
+        HAI_IAM_CAPTCHA_ENABLED: 'true',
+        HAI_IAM_CAPTCHA_COST: '100',
+        HAI_IAM_CAPTCHA_MAXCOUNTER: '2',
+        HAI_IAM_INITIALCREDENTIALS_ENABLED: 'true',
+        HAI_IAM_REAUTHENTICATION_ENABLED: 'true',
+        HAI_IAM_REAUTHENTICATION_OPERATIONS: JSON.stringify(['iam.users.invite', 'audit.backup']),
+        HAI_AUDIT_BACKUP_ENABLED: 'true',
+        HAI_CORE_NAME: process.env.HAI_CORE_NAME || 'Configured scaffold',
+        HAI_CORE_VERSION: process.env.HAI_CORE_VERSION || '9.8.7',
+        HAI_CORE_ENV: 'test',
+        HAI_CORE_LOGGING_LEVEL: 'warn',
+      }),
+      url: `${serviceBaseURL}/health`,
+      reuseExistingServer: false,
+      timeout: 120_000,
+    },
+    ...frontends.map((frontend) => {
+      const url = frontend.target === primaryFrontend ? baseURL : frontend.url
+      return {
+        name: frontend.name,
+        command: `pnpm --filter ${frontend.name} exec vite preview --host ${resolveHostFromBaseUrl(url, '127.0.0.1')} --port ${resolvePortFromBaseUrl(url, '3000')} --strictPort`,
+        env: createE2eServerEnv({ PUBLIC_API_BASE: serviceBaseURL }),
+        url,
+        reuseExistingServer: false,
+        timeout: 120_000,
+      }
+    }),
+  ],
+})

package/templates/apps/fullstack/playwright.session-close.config.ts.hbs

@@ -0,0 +1,18 @@
+{{! @skipIfEmpty }}
+{{#if fullstack.e2eFrontend}}
+/** 页面离开策略使用独立数据目录与服务配置，普通会话恢复场景仍在默认组验证。 */
+import { defineConfig } from '@playwright/test'
+import base from './playwright.config.js'
+
+export default defineConfig({
+  ...base,
+  testMatch: '**/session-close.spec.ts',
+  testIgnore: [],
+  webServer: (Array.isArray(base.webServer) ? base.webServer : base.webServer ? [base.webServer] : []).map(server => ({
+    ...server,
+    env: server.env?.HAI_ADMIN_DEFAULT_PASSWORD
+      ? { ...server.env, HAI_IAM_SESSION_ENDONPAGEHIDE: 'true', HAI_IAM_SESSION_IDLETIMEOUT: '5', HAI_IAM_SESSION_ABSOLUTETIMEOUT: '60', HAI_IAM_PASSWORD_REQUIREINITIALCHANGE: 'true' }
+      : server.env,
+  })),
+})
+{{/if~}}

package/templates/apps/fullstack/pnpm-workspace.yaml.hbs

@@ -0,0 +1,38 @@
+{{! @skipIfEmpty }}
+shellEmulator: true
+
+trustPolicy: no-downgrade
+# 上游构建工具仍要求 4.x；4.0.3 tarball 已核对原 lockfile 的 SHA-512。
+trustPolicyExclude:
+  - chokidar@4.0.3
+
+# pnpm 12 配置；原生依赖仅运行明确列出的安装脚本。
+nodeLinker: hoisted
+allowBuilds:
+  protobufjs: true
+  vue-demi: true
+  better-sqlite3: true
+  esbuild: true
+  core-js: false
+
+overrides:
+  "@ai-sdk/provider-utils@>=4.0.0 <4.0.33": 4.0.57
+  cookie@<0.7.0: 0.7.2
+  esbuild@<0.28.1: 0.28.2
+  katex@<0.18.2: 0.18.10
+  sharp@<0.35.5: 0.35.5
+  tinypool@<2.1.2: 2.2.0
+  '@qdrant/js-client-rest>undici': 7.30.0
+  xcode>uuid: 11.1.1
+  "@types/node": "{{versions.nodeTypes}}"
+
+packages:
+  - packages/*
+  - apps/*
+
+{{#if useCatalogProtocol}}
+catalog:
+{{#each haiCatalogPackages}}
+  '{{@key}}': {{this}}
+{{/each}}
+{{/if}}

package/templates/apps/fullstack/tsconfig.base.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "resolveJsonModule": true,
+    "strict": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "isolatedModules": true,
+    "verbatimModuleSyntax": true,
+    "skipLibCheck": true
+  }
+}

package/templates/apps/h5/messages/en-US.json

@@ -4,6 +4,8 @@
   "nav_home": "Home",
   "nav_discover": "Discover",
   "nav_profile": "Profile",
+  "page_home_title": "Home",
+  "page_home_desc": "Welcome to H5 App",
   "page_home_search": "Search...",
   "page_home_feature1": "Feature 1",
   "page_home_feature2": "Feature 2",
@@ -14,6 +16,7 @@
   "page_discover_title": "Discover",
   "page_discover_desc": "Explore more content.",
   "page_profile_title": "Profile",
+  "page_profile_desc": "Manage your personal information",
   "page_profile_username": "Username",
   "page_profile_login_hint": "Tap to login",
   "page_profile_info": "Personal Info",