@h-ai/cli 1.0.0-beta.17 → 1.0.0-beta.19

package/templates/apps/fullstack/e2e/fullstack.spec.ts.hbs

@@ -35,7 +35,13 @@ async function capture(page: Page, name: string, fallback: string) {
     await mkdir(evidence, { recursive: true })
   await expect(page.getByTestId('guide-loading')).toHaveCount(0)
   await page.evaluate(() => document.fonts.ready)
-  await page.screenshot({ path: evidence ? path.join(evidence, name) : fallback, fullPage: true, animations: 'disabled' })
+  await page.screenshot({
+    path: evidence
+      ? path.join(evidence, name)
+      : fallback,
+    fullPage: true,
+    animations: 'disabled',
+  })
 }
 
 async function dismissToasts(page: Page) {
@@ -62,13 +68,18 @@ async function login(page: Page, username: string, password: string, keepGuide =
 async function userEditor(page: Page, username: string) {
   await page.getByTestId('users-search').locator('input').fill(username)
   await page.getByTestId('users-page').getByRole('button', { name: /查询|Search/ }).click()
-  const row = page.getByRole('row').filter({ has: page.getByText(`@${username}`, { exact: true }) })
+  const row = page.getByRole('row').filter({
+    has: page.getByText(`@${username}`, { exact: true }),
+  })
   await expect(row).toBeVisible()
   await row.getByRole('button', { name: /编辑|Edit/, exact: true }).click()
   return row
 }
 
-for (const scenario of [{ offset: -600_000, width: 1440 }, { offset: 600_000, width: 390 }]) {
+for (const scenario of [
+  { offset: -600_000, width: 1440 },
+  { offset: 600_000, width: 390 },
+]) {
   test(`clock offset ${scenario.offset} displays synchronization advice and recovers after correction`, async ({ page }, testInfo) => {
     await page.setViewportSize({ width: scenario.width, height: 900 })
     await page.addInitScript((offset) => {
@@ -99,10 +110,11 @@ test('service health endpoint is ready', async ({ request }) => {
 })
 
 test('service rejects plaintext business requests', async ({ request }) => {
-  const response = await request.post(`${apiBaseUrl}${apiPrefix}${apiContract.pathOf({{fullstack.contractExportName}}.app.echo)}`, { data: { message: 'hello e2e' } })
+  const response = await request.post(`${apiBaseUrl}${apiPrefix}${apiContract.pathOf({{fullstack.contractExportName}}.app.echo)}`, {
+    data: { message: 'hello e2e' },
+  })
   expect(response.status()).toBe(400)
 })
-
 {{#if fullstack.e2eFrontend}}
 test('hash routing and responsive workspace preserve usable content width', async ({ page }, testInfo) => {
   await page.goto('./#/roles?source=direct')
@@ -289,7 +301,11 @@ const additionalFrontends = [
 
 for (const frontend of additionalFrontends) {
   test(`${frontend.target} preview supports login, tour, help and profile navigation`, async ({ browser }, testInfo) => {
-    const page = await browser.newPage({ viewport: frontend.target === 'app' ? { width: 390, height: 844 } : { width: 1440, height: 960 } })
+    const page = await browser.newPage({
+      viewport: frontend.target === 'app'
+        ? { width: 390, height: 844 }
+        : { width: 1440, height: 960 },
+    })
     const pageErrors: string[] = []
     page.on('pageerror', error => pageErrors.push(error.message))
     try {
@@ -329,11 +345,17 @@ test('shared authentication supports public registration with configuration', as
   await mkdir(evidence, { recursive: true })
   await page.goto('./')
   await expect(page.getByTestId('login-form')).toBeVisible()
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-login.png'), fullPage: true })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-login.png'),
+    fullPage: true,
+  })
   await page.getByRole('button', { name: /立即注册|Register now/i }).click()
   const registerForm = page.locator('.register-form')
   await expect(registerForm.locator('#register-username')).toBeVisible()
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-register.png'), fullPage: true })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-register.png'),
+    fullPage: true,
+  })
   const username = `signup${randomUUID().replaceAll('-', '').slice(0, 12)}`
   await registerForm.locator('#register-username').fill(username)
   await registerForm.locator('#register-email').fill(`${username}@example.com`)
@@ -347,7 +369,10 @@ test('shared authentication supports public registration with configuration', as
   const email = `${username}@example.com`
   await page.getByTestId('logout').click()
   await page.getByRole('button', { name: /邮件验证码|Email code/i, exact: true }).click()
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-email.png'), fullPage: true })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-email.png'),
+    fullPage: true,
+  })
   await page.locator('#login-username').fill(email)
   await page.getByRole('button', { name: /发送验证码|Send code/i, exact: true }).click()
   await expect(page.getByRole('button', { name: /秒后重发|Resend in/ })).toBeDisabled()
@@ -363,14 +388,20 @@ test('shared authentication supports public registration with configuration', as
   await expect(page.getByTestId('settings-page')).toBeVisible()
   await page.getByTestId('logout').click()
   await page.getByRole('button', { name: /忘记密码|Forgot password/i }).click()
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-forgot.png'), fullPage: true })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-forgot.png'),
+    fullPage: true,
+  })
   await page.locator('input[type="email"]').fill(email)
   await page.locator('button[type="submit"]').click()
   await expect(page.locator('.hai-toast-item[data-variant="success"]')).toBeVisible()
   const reset = await received('password_reset')
   expect(Boolean(reset?.token)).toBe(true)
   await page.getByRole('button', { name: /已有重置令牌|I have a reset token/i }).click()
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-reset.png'), fullPage: true })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-reset.png'),
+    fullPage: true,
+  })
   await page.goto(`./?token=${encodeURIComponent(reset?.token ?? '')}`)
   await expect(page.locator('input[type="password"]').nth(0)).toBeVisible()
   await page.locator('input[type="password"]').nth(0).fill('FullstackReset456')
@@ -401,7 +432,12 @@ test('frontend displays configured core metadata and restores the administrator
   const evidence = process.env.HAI_AUTH_EVIDENCE_DIR
   if (evidence)
     await mkdir(evidence, { recursive: true })
-  await page.screenshot({ path: evidence ? path.join(evidence, '{{projectName}}-users.png') : testInfo.outputPath('users.png'), fullPage: true })
+  await page.screenshot({
+    path: evidence
+      ? path.join(evidence, '{{projectName}}-users.png')
+      : testInfo.outputPath('users.png'),
+    fullPage: true,
+  })
   await page.getByTestId('logout').click()
   await expect(page.getByTestId('login-form')).toBeVisible()
 })
@@ -524,9 +560,13 @@ test('audit filters collapse without losing values and fit compact workspaces',
     await page.setViewportSize({ width, height: 900 })
     if (width < 1024)
       await expect.poll(() => page.locator('aside').evaluate(sidebar => sidebar.getBoundingClientRect().right)).toBeLessThanOrEqual(1)
-    const controls = await page.getByTestId('audit-advanced').evaluate(panel => [...panel.querySelectorAll('input')].map((element) => {
+    const controls = await page.getByTestId('audit-advanced').evaluate(panel => [
+      ...panel.querySelectorAll('input'),
+    ].map((element) => {
       // 复合控件的点击框包含边框和留白，内部文字输入区不等于完整控件高度。
-      const control = element.closest('.fieldset') ? element.parentElement! : element
+      const control = element.closest('.fieldset')
+        ? element.parentElement!
+        : element
       const rect = control.getBoundingClientRect()
       return { left: rect.left, right: rect.right, height: rect.height }
     }))
@@ -542,7 +582,13 @@ test('audit filters collapse without losing values and fit compact workspaces',
       if (evidence)
         await mkdir(evidence, { recursive: true })
       const file = `{{projectName}}-audit-${width}.png`
-      await page.screenshot({ path: evidence ? path.join(evidence, file) : testInfo.outputPath(file), fullPage: true, animations: 'disabled' })
+      await page.screenshot({
+        path: evidence
+          ? path.join(evidence, file)
+          : testInfo.outputPath(file),
+        fullPage: true,
+        animations: 'disabled',
+      })
     }
   }
   const reset = page.waitForResponse(response => new URL(response.url()).pathname.endsWith('/admin/audit/list'))
@@ -563,7 +609,11 @@ test('audit filters collapse without losing values and fit compact workspaces',
   await toggle.click()
   await page.getByTestId('audit-page').getByRole('button', { name: /详情|Details/ }).first().click()
   await expect(page.getByRole('dialog')).toBeVisible()
-  await page.screenshot({ path: testInfo.outputPath('audit-short-table-details.png'), fullPage: true, animations: 'disabled' })
+  await page.screenshot({
+    path: testInfo.outputPath('audit-short-table-details.png'),
+    fullPage: true,
+    animations: 'disabled',
+  })
 })
 
 test('administrator manages every duty through one lifecycle and the shared password reset form', async ({ page, browser }, testInfo) => {
@@ -718,8 +768,16 @@ test('administrator and user complete account, avatar, preference, password and
     await userPage.getByRole('option', { name: 'English', exact: true }).click()
     await expect(userPage.getByTestId('nav-settings')).toHaveText('Personal settings')
     await expect(userPage.locator('html')).toHaveAttribute('lang', 'en-US')
-    const themes = [{{#each fullstack.theme.themes}}'{{this}}'{{#unless @last}}, {{/unless}}{{/each}}]
-    const selectedTheme = themes.includes('formal') ? 'formal' : themes.includes('high-contrast') ? 'high-contrast' : themes.find(theme => theme !== '{{fullstack.theme.defaultTheme}}') ?? themes[0]
+    const themes = [
+{{#each fullstack.theme.themes}}
+      '{{this}}',
+{{/each}}
+    ]
+    const selectedTheme = themes.includes('formal')
+      ? 'formal'
+      : themes.includes('high-contrast')
+        ? 'high-contrast'
+        : themes.find(theme => theme !== '{{fullstack.theme.defaultTheme}}') ?? themes[0]
     await userPage.getByTestId('profile-theme').click()
     await userPage.getByRole('option').nth(themes.indexOf(selectedTheme)).click()
     await expect(userPage.locator('html')).toHaveAttribute('data-theme', selectedTheme)
@@ -738,7 +796,10 @@ test('administrator and user complete account, avatar, preference, password and
       await expect(userPage.locator('html')).toHaveAttribute('data-theme', 'eye-care')
       await expect.poll(() => userPage.evaluate(() => getComputedStyle(document.documentElement).colorScheme)).toBe('light')
       await expect.poll(() => userPage.evaluate(() => getComputedStyle(document.documentElement).getPropertyValue('--color-base-100').trim())).toBe('#e8f0df')
-      await userPage.screenshot({ path: testInfo.outputPath('fullstack-eye-care.png'), animations: 'disabled' })
+      await userPage.screenshot({
+        path: testInfo.outputPath('fullstack-eye-care.png'),
+        animations: 'disabled',
+      })
     }
     await expect(userPage.getByTestId('profile-form').locator('input[name="displayName"]')).toHaveValue('Updated member')
     await expect(userPage.getByTestId('profile-form').locator('input[name="email"]')).toHaveValue('')
@@ -868,7 +929,11 @@ test('feedback submits an empty description and business operator can process an
   await dialog.locator('input[type=file]').setInputFiles([
     { name: 'attached-preview.png', mimeType: 'image/png', buffer: feedbackImage },
     { name: 'attached-large-log.txt', mimeType: 'text/plain', buffer: feedbackLog },
-    { name: 'discarded.txt', mimeType: 'text/plain', buffer: Buffer.from('discarded local material') },
+    {
+      name: 'discarded.txt',
+      mimeType: 'text/plain',
+      buffer: Buffer.from('discarded local material'),
+    },
   ])
   const uploaded = dialog.locator('img[alt="attached-preview.png"]')
   await expect(uploaded).toBeVisible()
@@ -876,7 +941,10 @@ test('feedback submits an empty description and business operator can process an
   await expectDialogViewport()
   await expectUncovered(uploaded)
   await capture(page, 'feedback-image-before-mask.png', testInfo.outputPath('feedback-image-before-mask.png'))
-  await uploaded.screenshot({ path: testInfo.outputPath('feedback-image-before-mask-detail.png'), animations: 'disabled' })
+  await uploaded.screenshot({
+    path: testInfo.outputPath('feedback-image-before-mask-detail.png'),
+    animations: 'disabled',
+  })
   const originalPreview = await uploaded.getAttribute('src')
   await dialog.getByRole('button', { name: /遮挡敏感区域|Mask sensitive area|機密情報を隠す/ }).last().click()
   await dialog.getByRole('button', { name: /应用标注|Apply annotation|注釈を適用/ }).last().click()
@@ -901,7 +969,10 @@ test('feedback submits an empty description and business operator can process an
   await expectDialogViewport()
   await expectUncovered(uploaded)
   await capture(page, 'feedback-preview.png', testInfo.outputPath('feedback-preview.png'))
-  await uploaded.screenshot({ path: testInfo.outputPath('feedback-image-after-mask-detail.png'), animations: 'disabled' })
+  await uploaded.screenshot({
+    path: testInfo.outputPath('feedback-image-after-mask-detail.png'),
+    animations: 'disabled',
+  })
   // 回执只表示记录已受理；等这份大附件真正上传成功，再开始后台处理操作。
   const largeUpload = page.waitForResponse(response => response.request().method() === 'POST'
     && /\/feedback\/reports\/[^/]+\/attachments\/[^/]+$/.test(new URL(response.url()).pathname)
@@ -972,7 +1043,12 @@ test('feedback submits an empty description and business operator can process an
   const serverManifest: { version: string } = JSON.parse(await readFile(path.resolve('packages/{{projectName}}-serv/package.json'), 'utf8'))
   let expectedCommit = 'unknown'
   try {
-    execFileSync('git', ['ls-files', '--error-unmatch', '--', 'package.json'], { stdio: 'pipe', windowsHide: true })
+    execFileSync('git', [
+      'ls-files',
+      '--error-unmatch',
+      '--',
+      'package.json',
+    ], { stdio: 'pipe', windowsHide: true })
     expectedCommit = execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8', stdio: 'pipe', windowsHide: true }).trim()
   }
   catch { /* 无 Git 的源码归档必须明确保留 unknown，不冒用父工程提交。 */ }
@@ -981,7 +1057,10 @@ test('feedback submits an empty description and business operator can process an
     expect(expectedCommit).toMatch(/^(?:[a-f\d]{40}|[a-f\d]{64})$/i)
     expect(browserManifest.version).not.toBe(serverManifest.version)
   }
-  for (const [metadata, version] of [[browserMetadata, browserManifest.version], [serverMetadata, serverManifest.version]] as const) {
+  for (const [metadata, version] of [
+    [browserMetadata, browserManifest.version],
+    [serverMetadata, serverManifest.version],
+  ] as const) {
     expect(Object.keys(metadata).sort()).toEqual(['appVersion', 'buildId', 'commit'])
     expect(metadata.appVersion).toBe(version)
     expect(metadata.buildId).toMatch(/^[\w.+-]{1,160}$/)
@@ -993,7 +1072,10 @@ test('feedback submits an empty description and business operator can process an
   expect(browserEnvironment?.data).toMatchObject(browserMetadata)
   expect(serverEnvironment?.data.service).toMatchObject(serverMetadata)
   expect(bundle.report).toMatchObject(browserMetadata)
-  await testInfo.attach('feedback-build-metadata', { body: JSON.stringify({ browser: browserMetadata, server: serverMetadata }), contentType: 'application/json' })
+  await testInfo.attach('feedback-build-metadata', {
+    body: JSON.stringify({ browser: browserMetadata, server: serverMetadata }),
+    contentType: 'application/json',
+  })
   expect(bundle.report.number).toBe(number)
   expect(bundle.manifest.reportId).toBe(bundle.report.id)
   expect(bundle.manifest.evidenceRevision).toBe(bundle.report.evidenceRevision)
@@ -1009,7 +1091,10 @@ test('feedback submits an empty description and business operator can process an
     throw new Error('The exported large log attachment is missing')
   expect(bundle.files[largeLog.path]).toEqual(new Uint8Array(feedbackLog))
   expect(bundle.manifest.files.some(file => file.name === 'discarded.txt')).toBe(false)
-  await testInfo.attach('feedback-export-masked', { body: Buffer.from(bundle.files[masked.path]!), contentType: 'image/png' })
+  await testInfo.attach('feedback-export-masked', {
+    body: Buffer.from(bundle.files[masked.path]!),
+    contentType: 'image/png',
+  })
 })
 {{/if}}
 {{/if}}

package/templates/apps/fullstack/e2e/session-close.spec.ts.hbs

@@ -20,8 +20,13 @@ async function login(page: Page, username = 'admin', initialPassword = process.e
   // 每例使用独立初始账号，真实完成服务端限制下的首次改密后才能建立普通会话。
   await expect(page.locator('#old-password')).toBeVisible()
   await expect(page.getByTestId('logout')).toHaveCount(0)
-  await page.screenshot({ path: test.info().outputPath('initial-password-renewal.png'), fullPage: true })
-  const form = page.locator('form').filter({ has: page.locator('#old-password') })
+  await page.screenshot({
+    path: test.info().outputPath('initial-password-renewal.png'),
+    fullPage: true,
+  })
+  const form = page.locator('form').filter({
+    has: page.locator('#old-password'),
+  })
   const error = page.locator('.hai-toast-item[data-variant=error]')
   await dismissToasts(page)
   // 同密码仍由服务端拒绝，显示安全原因与关联编号；本地确认不一致则直接提示字段。
@@ -34,7 +39,10 @@ async function login(page: Page, username = 'admin', initialPassword = process.e
   await error.getByRole('button', { name: /^(查看排查信息|View diagnostic details|調査情報を表示)$/ }).click()
   await expect(error.locator('code')).toHaveText(/^[\w.:-]{1,128}$/)
   await expect(page.getByTestId('logout')).toHaveCount(0)
-  await page.screenshot({ path: test.info().outputPath('initial-password-same.png'), fullPage: true })
+  await page.screenshot({
+    path: test.info().outputPath('initial-password-same.png'),
+    fullPage: true,
+  })
   await expect(form.locator('.alert-error')).toHaveCount(0)
   await dismissToasts(page)
   const password = `${initialPassword}-Renewed!`
@@ -100,13 +108,19 @@ test('server idle expiry opens normal login in place and resumes one rejected sa
   const dialog = page.getByTestId('session-recovery-dialog')
   await expect(dialog).toBeVisible()
   await expect(page.getByTestId('business-notice-input').locator('textarea')).toHaveValue(draft)
-  await page.screenshot({ path: test.info().outputPath('idle-session-recovery.png'), fullPage: true })
+  await page.screenshot({
+    path: test.info().outputPath('idle-session-recovery.png'),
+    fullPage: true,
+  })
   const form = dialog.locator('form.login-form')
   await form.locator('input[type=password]').fill('Incorrect-test-password!')
   await form.locator('button[type=submit]').click()
   await expect(page.locator('.hai-toast-item[data-variant=error]')).toBeVisible()
   await expect(page.locator('.hai-toast-item[data-variant=error]')).toBeInViewport({ ratio: 1 })
-  await page.screenshot({ path: test.info().outputPath('idle-session-recovery-error-toast.png'), fullPage: true })
+  await page.screenshot({
+    path: test.info().outputPath('idle-session-recovery-error-toast.png'),
+    fullPage: true,
+  })
   expect(statuses).toHaveLength(1)
   await form.locator('input[type=password]').fill(password)
   await form.locator('button[type=submit]').click()

package/templates/apps/fullstack/eslint.config.js.hbs

@@ -3,7 +3,9 @@ import { haiQualityConfig } from './eslint-rules.js'
 
 export default antfu({
   // unused-imports 使用 TS 规则，JS 同样使用 TS parser 以保持 scope 契约一致。
-  typescript: { files: [GLOB_SRC] },
+  typescript: {
+    files: [GLOB_SRC],
+  },
   formatters: true,
   ignores: [
     '**/build/**',

package/templates/apps/fullstack/images/serv.Dockerfile.hbs

@@ -1,7 +1,5 @@
 ARG HAI_NODE_IMAGE=node:24.22.1-bookworm-slim
 FROM ${HAI_NODE_IMAGE} AS build
-ARG SQLITE_PREBUILD_MIRROR=
-ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
@@ -26,8 +24,9 @@ ARG HAI_BUILD_ID=
 ARG HAI_BUILD_COMMIT=unknown
 RUN HAI_BUILD_ID="$HAI_BUILD_ID" HAI_BUILD_COMMIT="$HAI_BUILD_COMMIT" pnpm --filter {{fullstack.servPackageName}}... --if-present build
 
-RUN --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds if [ -d node_modules/better-sqlite3 ]; then cd node_modules/better-sqlite3; for attempt in 1 2 3; do node -e "require('node:child_process').execFileSync(process.execPath,[require.resolve('prebuild-install/bin.js'),'--verbose'],{stdio:'inherit'})" && break; [ "$attempt" = 3 ] && exit 1; sleep 3; done; fi
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds pnpm pm deploy --filter {{fullstack.servPackageName}} --prod /prod/service
+# SQLite 13 的原生二进制随 npm 包交付，在构建时验证实际加载。
+RUN if [ -d node_modules/better-sqlite3 ]; then node -e "const Database=require('better-sqlite3');const db=new Database(':memory:');db.prepare('SELECT 1').get();db.close()"; fi
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm pm deploy --filter {{fullstack.servPackageName}} --prod /prod/service
 RUN rm -f /prod/service/README* && find /prod/service/dist -type f \( -name '*.map' -o -name '*.d.ts' -o -name '*.d.mts' -o -name '*.d.cts' \) -delete
 
 FROM ${HAI_NODE_IMAGE} AS service

package/templates/apps/fullstack/images/web.Dockerfile.hbs

@@ -2,8 +2,6 @@ ARG HAI_NODE_IMAGE=node:24.22.1-bookworm-slim
 ARG HAI_NGINX_IMAGE=nginxinc/nginx-unprivileged:1.29.8-alpine
 {{#if fullstack.frontends.web}}
 FROM ${HAI_NODE_IMAGE} AS build
-ARG SQLITE_PREBUILD_MIRROR=
-ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH

package/templates/apps/fullstack/packages/{{projectName}}-contract/src/admin-contract.ts.hbs

@@ -22,54 +22,145 @@ import {
 /** mini 管理示例的业务路径；四类职责与权限由应用配置，可按项目需求调整。 */
 export const adminContract = {
   permissions: {
-    list: apiContract.route({ method: 'POST', path: '/admin/permissions/list', tags: ['admin'] }).input(z.object({ page: z.number().int().min(1).default(1), pageSize: z.number().int().min(1).max(100).default(20) })).output(apiContract.haiResultSchema(z.object({ items: z.array(AdminPermissionPolicySchema), total: z.number() }))),
-    update: apiContract.route({ method: 'POST', path: '/admin/permissions/update', tags: ['admin'] }).input(AdminPermissionPolicyInputSchema).output(apiContract.haiResultSchema(z.object({ saved: z.literal(true) }))),
+    list: apiContract.route({
+      method: 'POST',
+      path: '/admin/permissions/list',
+      tags: ['admin'],
+    }).input(z.object({
+      page: z.number().int().min(1).default(1),
+      pageSize: z.number().int().min(1).max(100).default(20),
+    })).output(apiContract.haiResultSchema(z.object({
+      items: z.array(AdminPermissionPolicySchema),
+      total: z.number(),
+    }))),
+    update: apiContract.route({
+      method: 'POST',
+      path: '/admin/permissions/update',
+      tags: ['admin'],
+    }).input(AdminPermissionPolicyInputSchema).output(apiContract.haiResultSchema(z.object({
+      saved: z.literal(true),
+    }))),
   },
   configuration: {
-    get: apiContract.route({ method: 'POST', path: '/admin/configuration/get', tags: ['admin'] }).output(apiContract.haiResultSchema(BusinessSettingsSchema)),
-    update: apiContract.route({ method: 'POST', path: '/admin/configuration/update', tags: ['admin'] }).input(BusinessSettingsSchema).output(apiContract.haiResultSchema(BusinessSettingsSchema)),
+    get: apiContract.route({
+      method: 'POST',
+      path: '/admin/configuration/get',
+      tags: ['admin'],
+    }).output(apiContract.haiResultSchema(BusinessSettingsSchema)),
+    update: apiContract.route({
+      method: 'POST',
+      path: '/admin/configuration/update',
+      tags: ['admin'],
+    }).input(BusinessSettingsSchema).output(apiContract.haiResultSchema(BusinessSettingsSchema)),
   },
   users: {
-    resetPassword: apiContract.route({ method: 'POST', path: '/admin/users/reset-password', tags: ['admin'] })
+    resetPassword: apiContract.route({
+      method: 'POST',
+      path: '/admin/users/reset-password',
+      tags: ['admin'],
+    })
       .input(IamAdminResetPasswordInputSchema.strict())
-      .output(apiContract.haiResultSchema(z.object({ reset: z.literal(true) }))),
-    invite: apiContract.route({ method: 'POST', path: '/admin/users/invite', tags: ['admin'] }).input(AdminInviteUserSchema).output(apiContract.haiResultSchema(AdminUserSchema)),
-    list: apiContract.route({ method: 'POST', path: '/admin/users/list', tags: ['admin'] })
+      .output(apiContract.haiResultSchema(z.object({
+        reset: z.literal(true),
+      }))),
+    invite: apiContract.route({
+      method: 'POST',
+      path: '/admin/users/invite',
+      tags: ['admin'],
+    }).input(AdminInviteUserSchema).output(apiContract.haiResultSchema(AdminUserSchema)),
+    list: apiContract.route({
+      method: 'POST',
+      path: '/admin/users/list',
+      tags: ['admin'],
+    })
       .input(AdminUsersInputSchema)
       .output(apiContract.haiResultSchema(AdminUsersSchema)),
-    create: apiContract.route({ method: 'POST', path: '/admin/users/create', tags: ['admin'] })
+    create: apiContract.route({
+      method: 'POST',
+      path: '/admin/users/create',
+      tags: ['admin'],
+    })
       .input(AdminCreateUserSchema)
       .output(apiContract.haiResultSchema(AdminUserSchema)),
-    update: apiContract.route({ method: 'POST', path: '/admin/users/update', tags: ['admin'] })
+    update: apiContract.route({
+      method: 'POST',
+      path: '/admin/users/update',
+      tags: ['admin'],
+    })
       .input(AdminUpdateUserSchema)
       .output(apiContract.haiResultSchema(AdminUserSchema)),
-    delete: apiContract.route({ method: 'POST', path: '/admin/users/delete', tags: ['admin'] })
-      .input(z.object({ id: z.string().min(1) }).strict())
-      .output(apiContract.haiResultSchema(z.object({ deleted: z.literal(true) }))),
-    avatar: apiContract.route({ method: 'POST', path: '/admin/users/avatar', tags: ['admin'] })
-      .input(AvatarUploadSchema.extend({ id: z.string().min(1) }))
+    delete: apiContract.route({
+      method: 'POST',
+      path: '/admin/users/delete',
+      tags: ['admin'],
+    })
+      .input(z.object({
+        id: z.string().min(1),
+      }).strict())
+      .output(apiContract.haiResultSchema(z.object({
+        deleted: z.literal(true),
+      }))),
+    avatar: apiContract.route({
+      method: 'POST',
+      path: '/admin/users/avatar',
+      tags: ['admin'],
+    })
+      .input(AvatarUploadSchema.extend({
+        id: z.string().min(1),
+      }))
       .output(apiContract.haiResultSchema(AvatarOutputSchema)),
   },
   roles: {
-    list: apiContract.route({ method: 'POST', path: '/admin/roles/list', tags: ['admin'] })
-      .output(apiContract.haiResultSchema(z.object({ items: z.array(AdminRoleSchema) }))),
-    update: apiContract.route({ method: 'POST', path: '/admin/roles/update', tags: ['admin'] })
-      .input(z.object({ id: z.string().min(1), description: z.string().max(300) }).strict())
+    list: apiContract.route({
+      method: 'POST',
+      path: '/admin/roles/list',
+      tags: ['admin'],
+    })
+      .output(apiContract.haiResultSchema(z.object({
+        items: z.array(AdminRoleSchema),
+      }))),
+    update: apiContract.route({
+      method: 'POST',
+      path: '/admin/roles/update',
+      tags: ['admin'],
+    })
+      .input(z.object({
+        id: z.string().min(1),
+        description: z.string().max(300),
+      }).strict())
       .output(apiContract.haiResultSchema(AdminRoleSchema)),
   },
   audit: {
-    backup: apiContract.route({ method: 'POST', path: '/admin/audit/backup', tags: ['admin'] }).input(z.object({ id: z.uuid() }).strict()).output(apiContract.haiResultSchema(AuditBackupReceiptSchema)),
-    list: apiContract.route({ method: 'POST', path: '/admin/audit/list', tags: ['admin'] })
+    backup: apiContract.route({
+      method: 'POST',
+      path: '/admin/audit/backup',
+      tags: ['admin'],
+    }).input(z.object({
+      id: z.uuid(),
+    }).strict()).output(apiContract.haiResultSchema(AuditBackupReceiptSchema)),
+    list: apiContract.route({
+      method: 'POST',
+      path: '/admin/audit/list',
+      tags: ['admin'],
+    })
       .input(AdminAuditInputSchema)
       .output(apiContract.haiResultSchema(AdminAuditSchema)),
   },
 }
 
 export const profileContract = {
-  update: apiContract.route({ method: 'POST', path: '/profile/update', tags: ['profile'] })
+  update: apiContract.route({
+    method: 'POST',
+    path: '/profile/update',
+    tags: ['profile'],
+  })
     .input(ProfileUpdateSchema)
     .output(apiContract.haiResultSchema(AdminUserSchema)),
-  avatar: apiContract.route({ method: 'POST', path: '/profile/avatar', tags: ['profile'] })
+  avatar: apiContract.route({
+    method: 'POST',
+    path: '/profile/avatar',
+    tags: ['profile'],
+  })
     .input(AvatarUploadSchema)
     .output(apiContract.haiResultSchema(AvatarOutputSchema)),
 }