@h-ai/cli 1.0.0-beta.17 → 1.0.0-beta.19

package/templates/apps/fullstack/packages/{{projectName}}-contract/src/admin-schemas.ts.hbs

@@ -2,13 +2,26 @@ import { IamListUsersInputSchema, IamPermissionSchema } from '@h-ai/api-contract
 import { z } from 'zod'
 
 /** 权限的敏感操作配置复用框架字段；职责授权仍由应用控制。 */
-export const AdminPermissionPolicySchema = IamPermissionSchema.pick({ id: true, code: true, name: true, sensitiveOperations: true })
+export const AdminPermissionPolicySchema = IamPermissionSchema.pick({
+  id: true,
+  code: true,
+  name: true,
+  sensitiveOperations: true,
+})
 export const AdminPermissionPolicyInputSchema = AdminPermissionPolicySchema.pick({ id: true, sensitiveOperations: true })
 export type AdminPermissionPolicy = z.infer<typeof AdminPermissionPolicySchema>
 
-export const BusinessSettingsSchema = z.object({ notice: z.string().trim().max(200) }).strict()
+export const BusinessSettingsSchema = z.object({
+  notice: z.string().trim().max(200),
+}).strict()
 
-export const AdminRoleCodeSchema = z.enum(['admin', 'audit_admin', 'config_admin', 'business_operator', 'user'])
+export const AdminRoleCodeSchema = z.enum([
+  'admin',
+  'audit_admin',
+  'config_admin',
+  'business_operator',
+  'user',
+])
 export const AdminPageInputSchema = z.object({
   page: z.number().int().min(1).default(1),
   pageSize: z.number().int().min(1).max(100).default(20),
@@ -49,10 +62,16 @@ export const AdminCreateUserSchema = z.object({
   accountStatus: z.enum(['active', 'dormant', 'closed']).default('active'),
   accountExpiresAt: z.string().datetime().nullable().optional(),
 }).strict()
-export const AdminInviteUserSchema = AdminCreateUserSchema.omit({ password: true }).extend({ phone: z.string().trim().min(1).max(32).optional(), accountStatus: z.literal('active').default('active') })
+export const AdminInviteUserSchema = AdminCreateUserSchema.omit({ password: true }).extend({
+  phone: z.string().trim().min(1).max(32).optional(),
+  accountStatus: z.literal('active').default('active'),
+})
 export const AdminUpdateUserSchema = z.object({
   id: z.string().min(1),
-  email: z.union([z.email(), z.literal('')]).optional(),
+  email: z.union([
+    z.email(),
+    z.literal(''),
+  ]).optional(),
   displayName: z.string().max(100).optional(),
   accountType: z.enum(['permanent', 'temporary']).optional(),
   accountStatus: z.enum(['active', 'dormant', 'closed']).optional(),
@@ -73,7 +92,14 @@ export const AdminAuditInputSchema = AdminPageInputSchema.extend({
   scopeId: z.string().max(256).optional(),
   requestId: z.string().max(256).optional(),
   traceId: z.string().max(256).optional(),
-  sortBy: z.enum(['createdAt', 'action', 'resource', 'category', 'outcome', 'severity']).optional(),
+  sortBy: z.enum([
+    'createdAt',
+    'action',
+    'resource',
+    'category',
+    'outcome',
+    'severity',
+  ]).optional(),
   sortDirection: z.enum(['asc', 'desc']).optional(),
   userId: z.string().max(100).optional(),
   action: z.string().max(50).optional(),
@@ -88,7 +114,12 @@ export const AdminAuditLogSchema = z.object({
   scopeId: z.string().nullish(),
   requestId: z.string().nullish(),
   traceId: z.string().nullish(),
-  actorSnapshot: z.object({ id: z.string(), username: z.string().optional(), displayName: z.string().optional(), roles: z.array(z.string()).optional() }).nullish(),
+  actorSnapshot: z.object({
+    id: z.string(),
+    username: z.string().optional(),
+    displayName: z.string().optional(),
+    roles: z.array(z.string()).optional(),
+  }).nullish(),
   id: z.string(),
   userId: z.string().nullable(),
   username: z.string().nullable(),
@@ -100,10 +131,20 @@ export const AdminAuditLogSchema = z.object({
   userAgent: z.string().nullable(),
   createdAt: z.string().datetime(),
 })
-export const AuditBackupReceiptSchema = z.object({ id: z.string(), key: z.string(), recordCount: z.number(), sha256: z.string(), createdAt: z.string().datetime(), cutoff: z.string().datetime() })
+export const AuditBackupReceiptSchema = z.object({
+  id: z.string(),
+  key: z.string(),
+  recordCount: z.number(),
+  sha256: z.string(),
+  createdAt: z.string().datetime(),
+  cutoff: z.string().datetime(),
+})
 export const AdminAuditSchema = z.object({
   backupEnabled: z.boolean(),
-  stats: z.array(z.object({ action: z.string(), count: z.number() })),
+  stats: z.array(z.object({
+    action: z.string(),
+    count: z.number(),
+  })),
   items: z.array(AdminAuditLogSchema),
   total: z.number(),
   page: z.number(),
@@ -111,7 +152,10 @@ export const AdminAuditSchema = z.object({
 })
 export const ProfileUpdateSchema = z.object({
   displayName: z.string().max(100).optional(),
-  email: z.union([z.email(), z.literal('')]).optional(),
+  email: z.union([
+    z.email(),
+    z.literal(''),
+  ]).optional(),
   locale: z.enum([{{#each fullstack.i18n.locales}}'{{this}}'{{#unless @last}}, {{/unless}}{{/each}}]).optional(),
   theme: z.string().min(1).max(40).regex(/^[\w-]+$/).optional(),
 }).strict()
@@ -120,7 +164,9 @@ export const AvatarUploadSchema = z.object({
   contentType: z.enum(['image/png', 'image/jpeg', 'image/webp']),
   base64: z.string().min(1).max(699052).regex(/^[A-Z\d+/]+={0,2}$/i),
 }).strict()
-export const AvatarOutputSchema = z.object({ avatarUrl: z.string().describe('Generated relative asset path') })
+export const AvatarOutputSchema = z.object({
+  avatarUrl: z.string().describe('Generated relative asset path'),
+})
 
 export type AdminUser = z.infer<typeof AdminUserSchema>
 export type AdminRole = z.infer<typeof AdminRoleSchema>

package/templates/apps/fullstack/packages/{{projectName}}-contract/tsup.config.ts.hbs

@@ -3,7 +3,9 @@ import { defineConfig } from 'tsup'
 export default defineConfig({
   entry: ['src/index.ts'],
   format: ['esm'],
-  dts: { compilerOptions: { ignoreDeprecations: '6.0' } },
+  dts: {
+    compilerOptions: { ignoreDeprecations: '6.0' },
+  },
   sourcemap: true,
   clean: true,
 })

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/app-server.ts.hbs

@@ -1,8 +1,10 @@
 import type { CoreConfig } from '@h-ai/core'
 import type { {{#if features.feedback}}CreateServContext, {{/if}}ServHttpApp } from '@h-ai/serv'
 import process from 'node:process'
-{{#if features.feedback}}import { resolveFeedbackBudget } from '@h-ai/api-contract/feedback'
-{{/if}}import { core } from '@h-ai/core'
+{{#if features.feedback}}
+import { resolveFeedbackBudget } from '@h-ai/api-contract/feedback'
+{{/if}}
+import { core } from '@h-ai/core'
 import { createReldbTransportKeyStore, crypto, parseTransportServerKeyRing } from '@h-ai/crypto'
 {{#if features.feedback}}
 import { FeedbackConfigSchema } from '@h-ai/feedback'
@@ -25,19 +27,29 @@ export function createServerApp(): ServHttpApp {
   const ring = parseTransportServerKeyRing(process.env.HAI_CRYPTO_TRANSPORT_SERVERKEYRING)
   if (!ring.success)
     throw new Error(`HAI_CRYPTO_TRANSPORT_SERVERKEYRING: ${ring.error.message} (${ring.error.code})`)
-{{#if features.feedback}}  // 可选反馈故障重试期间仍使用配置预算，避免缓存默认容量。
+{{#if features.feedback}}
+  // 可选反馈故障重试期间仍使用配置预算，避免缓存默认容量。
   const feedbackSettings = FeedbackConfigSchema.safeParse(core.config.get('feedback'))
-  const feedbackBudget = resolveFeedbackBudget(feedbackSettings.success ? feedbackSettings.data : {})
-{{/if}}  const security = serv.createRuntimeSecurityPolicy({
+  const feedbackBudget = resolveFeedbackBudget(feedbackSettings.success
+    ? feedbackSettings.data
+    : {})
+{{/if}}
+  const security = serv.createRuntimeSecurityPolicy({
     environment: coreConfig.env,
     corsOrigin: servConfig.cors.origin,
     nativeOrigins: servConfig.cors.nativeOrigins,
   })
   const publicPaths = [
     `${servConfig.http.apiPrefix}/assets`,
-    ...(servConfig.http.health ? [servConfig.http.health.path, servConfig.http.health.readyPath].filter((path): path is `/${string}` => Boolean(path)) : []),
-    ...(servConfig.http.openapi && security.exposeApiDocs ? [servConfig.http.openapi.path] : []),
-    ...(servConfig.http.docs && security.exposeApiDocs ? [servConfig.http.docs.path, `${servConfig.http.docs.path.slice(0, servConfig.http.docs.path.lastIndexOf('/') + 1)}_hai/scalar.js`] : []),
+    ...(servConfig.http.health
+      ? [servConfig.http.health.path, servConfig.http.health.readyPath].filter((path): path is `/${string}` => Boolean(path))
+      : []),
+    ...(servConfig.http.openapi && security.exposeApiDocs
+      ? [servConfig.http.openapi.path]
+      : []),
+    ...(servConfig.http.docs && security.exposeApiDocs
+      ? [servConfig.http.docs.path, `${servConfig.http.docs.path.slice(0, servConfig.http.docs.path.lastIndexOf('/') + 1)}_hai/scalar.js`]
+      : []),
   ]
 {{#if features.feedback}}
   // 普通业务日志与反馈使用同一可信应用范围；身份仍由 IAM 验证。
@@ -67,9 +79,11 @@ export function createServerApp(): ServHttpApp {
 {{/if}}
     refreshCookie: {
       secure: security.secureRefreshCookie,
-      nativeTokenTransport: { isRequest: request => request.headers.get('x-hai-token-transport') === 'body'
-        && ['{{projectName}}-app', '{{projectName}}-desktop'].includes(request.headers.get('x-request-client') ?? '')
-        && security.isNativeOrigin(request.headers.get('origin') ?? '') },
+      nativeTokenTransport: {
+        isRequest: request => request.headers.get('x-hai-token-transport') === 'body'
+          && ['{{projectName}}-app', '{{projectName}}-desktop'].includes(request.headers.get('x-request-client') ?? '')
+          && security.isNativeOrigin(request.headers.get('origin') ?? ''),
+      },
     },
     // 管理业务默认强制双向加密；各节点复用受管服务端密钥环与共享 reldb 客户端 registry。
     transport: {
@@ -83,7 +97,12 @@ export function createServerApp(): ServHttpApp {
         ...servConfig.transport.routePlaintextBytes,
       },
 {{/if}}
-      excludePaths: [...new Set([...publicPaths, ...servConfig.transport.excludePaths])],
+      excludePaths: [
+        ...new Set([
+          ...publicPaths,
+          ...servConfig.transport.excludePaths,
+        ]),
+      ],
       crypto,
       serverKeyRing: ring.data,
       keyStore: createReldbTransportKeyStore({ reldb, ttlSeconds: 3600 }),
@@ -93,23 +112,39 @@ export function createServerApp(): ServHttpApp {
       openapi: security.exposeApiDocs ? servConfig.http.openapi : false,
       docs: security.exposeApiDocs ? servConfig.http.docs : false,
     },
-    middlewares: [{
-      middleware: serv.cors({
-        origin: security.allowOrigin,
-        credentials: servConfig.cors.credentials,
-        allowedHeaders: [...new Set([...servConfig.cors.allowedHeaders, 'X-Client-Id', 'X-Encrypted', 'X-Hai-Transport', 'X-Request-Client', 'X-HAI-Token-Transport', 'X-Hai-Reauthentication', 'X-Hai-Terminal'])],
-        exposedHeaders: [...new Set([...servConfig.cors.exposedHeaders, 'X-Encrypted', 'X-Hai-Transport'])],
-      }),
-    }, {
-      path: `${servConfig.http.apiPrefix}/assets/*`,
-      middleware: serv.storageAssets({
-        storage,
-        pathPrefix: `${servConfig.http.apiPrefix}/assets/`,
-        keyPattern: /^avatars\/[\w-]+\/[\w-]+\.(png|jpg|webp)$/,
-        allowedContentTypes: ['image/png', 'image/jpeg', 'image/webp'],
-        cacheControl: 'public, max-age=31536000, immutable',
-        crossOriginResourcePolicy: 'cross-origin',
-      }),
-    }],
+    middlewares: [
+      {
+        middleware: serv.cors({
+          origin: security.allowOrigin,
+          credentials: servConfig.cors.credentials,
+          allowedHeaders: [
+            ...new Set([
+              ...servConfig.cors.allowedHeaders,
+              'X-Client-Id',
+              'X-Encrypted',
+              'X-Hai-Transport',
+              'X-Request-Client',
+              'X-HAI-Token-Transport',
+              'X-Hai-Reauthentication',
+              'X-Hai-Terminal',
+            ]),
+          ],
+          exposedHeaders: [
+            ...new Set([...servConfig.cors.exposedHeaders, 'X-Encrypted', 'X-Hai-Transport']),
+          ],
+        }),
+      },
+      {
+        path: `${servConfig.http.apiPrefix}/assets/*`,
+        middleware: serv.storageAssets({
+          storage,
+          pathPrefix: `${servConfig.http.apiPrefix}/assets/`,
+          keyPattern: /^avatars\/[\w-]+\/[\w-]+\.(png|jpg|webp)$/,
+          allowedContentTypes: ['image/png', 'image/jpeg', 'image/webp'],
+          cacheControl: 'public, max-age=31536000, immutable',
+          crossOriginResourcePolicy: 'cross-origin',
+        }),
+      },
+    ],
   })
 }

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/build-metadata.ts.hbs

@@ -2,6 +2,5 @@
 {{#if features.feedback}}
 /** 当前应用编译时烘焙的产物身份；运行时配置不能覆盖。 */
 declare const __HAI_BUILD_METADATA__: { appVersion: string, buildId: string, commit: string }
-
 export const buildMetadata = __HAI_BUILD_METADATA__
 {{/if}}

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/admin-service.ts.hbs

@@ -11,8 +11,18 @@ import { storage } from '@h-ai/storage'
 import { SUPPORTED_LOCALES } from '{{fullstack.contractPackageName}}'
 import { serverM } from './messages.js'
 
-const ROLE_CODES = new Set<AdminRoleCode>(['admin', 'audit_admin', 'config_admin', 'business_operator', 'user'])
-const SUPPORTED_THEMES = [{{#each fullstack.theme.themes}}'{{this}}'{{#unless @last}}, {{/unless}}{{/each}}] as readonly string[]
+const ROLE_CODES = new Set<AdminRoleCode>([
+  'admin',
+  'audit_admin',
+  'config_admin',
+  'business_operator',
+  'user',
+])
+const SUPPORTED_THEMES = [
+{{#each fullstack.theme.themes}}
+  '{{this}}',
+{{/each}}
+] as readonly string[]
 let adminMutationActive = false
 
 /** 管理写操作串行化，锁内重新鉴权，防止两个管理员同时互相删除或降级。 */
@@ -42,7 +52,10 @@ export async function withAdminMutation<T>(context: ServContext, operation: stri
       void cache.lock.extend(key, 300, owner).then((renewed) => {
         if (!renewed.success || !renewed.data) {
           leaseLost = true
-          core.logger.error('Admin mutation lease renewal failed', { owner, error: renewed.success ? 'lease_not_owned' : renewed.error.code })
+          core.logger.error('Admin mutation lease renewal failed', {
+            owner,
+            error: renewed.success ? 'lease_not_owned' : renewed.error.code,
+          })
         }
       }).catch(() => {
         leaseLost = true
@@ -55,7 +68,9 @@ export async function withAdminMutation<T>(context: ServContext, operation: stri
     const actor = await getAdminUser(context.session?.userId ?? '')
     if (!actor.success)
       return actor
-    const permitted = await iam.authz.checkPermission(actor.data.id, operation.startsWith('iam.roles.') ? 'app.roles.manage' : 'app.users.manage')
+    const permitted = await iam.authz.checkPermission(actor.data.id, operation.startsWith('iam.roles.')
+      ? 'app.roles.manage'
+      : 'app.users.manage')
     if (!permitted.success)
       return permitted
     if (actor.data.accountStatus !== 'active' || (actor.data.accountType === 'temporary' && (!actor.data.accountExpiresAt || new Date(actor.data.accountExpiresAt).getTime() <= Date.now())) || !permitted.data)
@@ -73,8 +88,12 @@ export async function withAdminMutation<T>(context: ServContext, operation: stri
     try {
       if (acquired) {
         const released = await cache.lock.release(key, owner)
-        if (!released.success || !released.data)
-          core.logger.error('Failed to release admin mutation lock', { owner, error: released.success ? 'lease_not_owned' : released.error.code })
+        if (!released.success || !released.data) {
+          core.logger.error('Failed to release admin mutation lock', {
+            owner,
+            error: released.success ? 'lease_not_owned' : released.error.code,
+          })
+        }
       }
     }
     finally {
@@ -123,7 +142,12 @@ export async function createAdminUser(input: AdminCreateUser, context: ServConte
     return role
   if (!role.data)
     return err(HaiCommonError.NOT_FOUND, serverM('notFound', { locale: context.locale }))
-  const registered = await iam.user.createUser({ ...input, accountExpiresAt: input.accountExpiresAt ? new Date(input.accountExpiresAt) : undefined })
+  const registered = await iam.user.createUser({
+    ...input,
+    accountExpiresAt: input.accountExpiresAt
+      ? new Date(input.accountExpiresAt)
+      : undefined,
+  })
   if (!registered.success)
     return registered
   const userId = registered.data.user.id
@@ -139,9 +163,17 @@ export async function createAdminUser(input: AdminCreateUser, context: ServConte
 /** 安全通知发送后发生未知结果时保留账号，不自动重试或删除已发出的邀请。 */
 export async function inviteAdminUser(input: AdminInviteUser, context: ServContext): Promise<HaiResult<AdminUser>> {
   const role = await iam.authz.getRoleByCode(input.role)
-  if (!role.success || !role.data)
-    return role.success ? err(HaiCommonError.NOT_FOUND, serverM('notFound', { locale: context.locale })) : role
-  const created = await iam.user.inviteUser({ ...input, accountExpiresAt: input.accountExpiresAt ? new Date(input.accountExpiresAt) : undefined })
+  if (!role.success || !role.data) {
+    return role.success
+      ? err(HaiCommonError.NOT_FOUND, serverM('notFound', { locale: context.locale }))
+      : role
+  }
+  const created = await iam.user.inviteUser({
+    ...input,
+    accountExpiresAt: input.accountExpiresAt
+      ? new Date(input.accountExpiresAt)
+      : undefined,
+  })
   if (!created.success)
     return created
   const assigned = await iam.authz.syncRoles(created.data.user.id, [role.data.id])
@@ -165,7 +197,9 @@ export async function updateAdminUser(input: AdminUpdateUser, context: ServConte
     return existing
   if (!existing.data)
     return err(HaiCommonError.NOT_FOUND, serverM('notFound', { locale: context.locale }))
-  const role = input.role ? await iam.authz.getRoleByCode(input.role) : undefined
+  const role = input.role
+    ? await iam.authz.getRoleByCode(input.role)
+    : undefined
   if (role && !role.success)
     return role
   if (role?.success && !role.data)
@@ -179,7 +213,14 @@ export async function updateAdminUser(input: AdminUpdateUser, context: ServConte
     if (!assigned.success)
       return assigned
   }
-  const updated = await iam.user.updateUser(id, { ...profile, accountExpiresAt: profile.accountExpiresAt === undefined ? undefined : profile.accountExpiresAt ? new Date(profile.accountExpiresAt) : null })
+  const updated = await iam.user.updateUser(id, {
+    ...profile,
+    accountExpiresAt: profile.accountExpiresAt === undefined
+      ? undefined
+      : profile.accountExpiresAt
+        ? new Date(profile.accountExpiresAt)
+        : null,
+  })
   if (!updated.success) {
     // 角色 ID 可精确还原，避免 undefined 资料字段被 updateUser 忽略后无法补偿。
     if (role?.success && role.data) {
@@ -189,7 +230,10 @@ export async function updateAdminUser(input: AdminUpdateUser, context: ServConte
     }
     return updated
   }
-  await recordAudit(context, 'update', 'users', id, { fields: Object.keys(profile), role: input.role })
+  await recordAudit(context, 'update', 'users', id, {
+    fields: Object.keys(profile),
+    role: input.role,
+  })
   return getAdminUser(id)
 }
 
@@ -201,13 +245,15 @@ export async function getAdminRoles(): Promise<HaiResult<{ items: AdminRole[] }>
   const counts = await iam.authz.getRoleUserCounts(items.map(role => role.id))
   if (!counts.success)
     return counts
-  return ok({ items: items.map(role => ({
-    id: role.id,
-    code: role.code as AdminRoleCode,
-    name: role.name,
-    description: role.description,
-    userCount: counts.data.get(role.id) ?? 0,
-  })) })
+  return ok({
+    items: items.map(role => ({
+      id: role.id,
+      code: role.code as AdminRoleCode,
+      name: role.name,
+      description: role.description,
+      userCount: counts.data.get(role.id) ?? 0,
+    })),
+  })
 }
 
 export async function updateProfile(input: ProfileUpdate, context: ServContext): Promise<HaiResult<AdminUser>> {
@@ -225,7 +271,9 @@ export async function updateProfile(input: ProfileUpdate, context: ServContext):
   const updated = await iam.user.updateCurrentUser(token, { displayName: input.displayName, email: input.email, metadata })
   if (!updated.success)
     return updated
-  await recordAudit(context, 'update', 'profile', current.data.id, { fields: Object.keys(input) })
+  await recordAudit(context, 'update', 'profile', current.data.id, {
+    fields: Object.keys(input),
+  })
   return getAdminUser(current.data.id)
 }
 

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/business-settings.ts.hbs

@@ -5,15 +5,22 @@ import { err, HaiCommonError, ok } from '@h-ai/core'
 import { reldb } from '@h-ai/reldb'
 import { z } from 'zod'
 
-export const BusinessSettingsSchema = z.object({ notice: z.string().trim().max(200) }).strict()
+export const BusinessSettingsSchema = z.object({
+  notice: z.string().trim().max(200),
+}).strict()
 
 export function initBusinessSettings(): Promise<HaiResult<void>> {
-  return reldb.ddl.createTable('app_business_settings', { id: { type: 'TEXT', primaryKey: true }, notice: { type: 'TEXT', notNull: true } })
+  return reldb.ddl.createTable('app_business_settings', {
+    id: { type: 'TEXT', primaryKey: true },
+    notice: { type: 'TEXT', notNull: true },
+  })
 }
 
 export async function readBusinessSettings(): Promise<HaiResult<{ notice: string }>> {
   const row = await reldb.sql.get<{ notice: string }>('SELECT notice FROM app_business_settings WHERE id = ?', ['public'])
-  return row.success ? ok({ notice: row.data?.notice ?? '' }) : row
+  return row.success
+    ? ok({ notice: row.data?.notice ?? '' })
+    : row
 }
 
 export async function saveBusinessSettings(input: { notice: string }): Promise<HaiResult<{ notice: string }>> {
@@ -33,7 +40,14 @@ export async function saveBusinessSettings(input: { notice: string }): Promise<H
       await tx.rollback()
       return saved
     }
-    const logged = await audit.capture({ action: 'business.configuration.update', resource: 'business-settings', category: 'business', details: { fields: ['notice'] } }, { tx })
+    const logged = await audit.capture({
+      action: 'business.configuration.update',
+      resource: 'business-settings',
+      category: 'business',
+      details: {
+        fields: ['notice'],
+      },
+    }, { tx })
     if (!logged.success) {
       await tx.rollback()
       return logged
@@ -41,7 +55,9 @@ export async function saveBusinessSettings(input: { notice: string }): Promise<H
     const committed = await tx.commit()
     if (!committed.success)
       await tx.rollback()
-    return committed.success ? ok(parsed.data) : committed
+    return committed.success
+      ? ok(parsed.data)
+      : committed
   }
   catch (error) {
     await tx.rollback()

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/procedures/admin-procedures.ts.hbs

@@ -28,13 +28,27 @@ export function createAuthProcedures() {
 export function createAdminProcedures() {
   return serv.implement(adminContract).context<ServContext>().route('permissions.list').permission('app.roles.manage').handle(async ({ input }) => {
     const result = await iam.authz.getAllPermissions(input)
-    return result.success ? ok({ total: result.data.total, items: result.data.items.map(item => ({ id: item.id, code: item.code, name: item.name, sensitiveOperations: item.sensitiveOperations ?? [] })) }) : result
+    return result.success
+      ? ok({
+          total: result.data.total,
+          items: result.data.items.map(item => ({
+            id: item.id,
+            code: item.code,
+            name: item.name,
+            sensitiveOperations: item.sensitiveOperations ?? [],
+          })),
+        })
+      : result
   }).route('permissions.update').permission('app.roles.manage').handle(({ input, context }) => withAdminMutation(context, 'iam.permissions.sensitiveOperations', async () => {
     const result = await iam.authz.setPermissionSensitiveOperations(input.id, input.sensitiveOperations)
-    return result.success ? ok({ saved: true as const }) : result
+    return result.success
+      ? ok({ saved: true as const })
+      : result
   })).route('configuration.get').permission('app.config.manage').handle(() => readBusinessSettings()).route('configuration.update').permission('app.config.manage').handle(async ({ input, context }) => {
     const checked = await iam.auth.checkSensitiveOperation(context.accessToken ?? '', 'business.settings.update', context.request.headers.get('x-hai-reauthentication') ?? undefined)
-    return checked.success ? saveBusinessSettings(input) : checked
+    return checked.success
+      ? saveBusinessSettings(input)
+      : checked
   }).route('users.list').permission('app.users.manage').handle(async ({ input }) => {
     const users = await iam.user.listUsers(input)
     if (!users.success)
@@ -42,7 +56,10 @@ export function createAdminProcedures() {
     const roles = await iam.authz.getUserRolesForMany(users.data.items.map(user => user.id))
     if (!roles.success)
       return roles
-    return ok({ ...users.data, items: users.data.items.map(user => toAdminUser(user, roles.data.get(user.id) ?? [])) })
+    return ok({
+      ...users.data,
+      items: users.data.items.map(user => toAdminUser(user, roles.data.get(user.id) ?? [])),
+    })
   }).route('users.resetPassword').permission('app.users.manage').handle(({ input, context }) => withAdminMutation(context, 'iam.users.resetPassword', async () => {
     const result = await iam.user.adminResetPassword(input.id, input.newPassword)
     if (!result.success)
@@ -74,33 +91,68 @@ export function createAdminProcedures() {
     const result = roles.data.items.find(item => item.id === input.id)
     if (!result)
       return err(HaiCommonError.NOT_FOUND, serverM('notFound', { locale: context.locale }))
-    await recordAudit(context, 'update', 'roles', input.id, { fields: ['description'] })
+    await recordAudit(context, 'update', 'roles', input.id, {
+      fields: ['description'],
+    })
     return ok(result)
   })).route('audit.backup').permission('audit:backup').handle(async ({ input, context }) => {
     const checked = await iam.auth.checkSensitiveOperation(context.accessToken ?? '', 'audit.backup', context.request.headers.get('x-hai-reauthentication') ?? undefined)
     if (!checked.success)
       return checked
     const result = await audit.backup.run({ ...input, signal: context.request.signal })
-    return result.success ? ok({ ...result.data, createdAt: result.data.createdAt.toISOString(), cutoff: result.data.cutoff.toISOString() }) : result
+    return result.success
+      ? ok({
+          ...result.data,
+          createdAt: result.data.createdAt.toISOString(),
+          cutoff: result.data.cutoff.toISOString(),
+        })
+      : result
   }).route('audit.list').permission('audit:read').handle(async ({ input, context }) => {
     if (input.startDate && input.endDate && input.startDate > input.endDate)
       return err(HaiCommonError.VALIDATION_ERROR, serverM('invalidDateRange', { locale: context.locale }))
-    const result = await audit.list({ ...input, startDate: input.startDate ? new Date(input.startDate) : undefined, endDate: input.endDate ? new Date(input.endDate) : undefined })
+    const result = await audit.list({
+      ...input,
+      startDate: input.startDate
+        ? new Date(input.startDate)
+        : undefined,
+      endDate: input.endDate
+        ? new Date(input.endDate)
+        : undefined,
+    })
     if (!result.success)
       return result
-    const stats = await audit.getStats(7, { category: input.category, outcome: input.outcome, severity: input.severity, resource: input.resource, scopeId: input.scopeId, userId: input.userId })
+    const stats = await audit.getStats(7, {
+      category: input.category,
+      outcome: input.outcome,
+      severity: input.severity,
+      resource: input.resource,
+      scopeId: input.scopeId,
+      userId: input.userId,
+    })
     if (!stats.success)
       return stats
-    return ok({ ...result.data, stats: stats.data, backupEnabled: AuditInitConfigSchema.parse(core.config.get('audit') ?? {}).backup.enabled, items: result.data.items.map(item => ({ ...item, createdAt: new Date(item.createdAt).toISOString() })) })
+    return ok({
+      ...result.data,
+      stats: stats.data,
+      backupEnabled: AuditInitConfigSchema.parse(core.config.get('audit') ?? {}).backup.enabled,
+      items: result.data.items.map(item => ({
+        ...item,
+        createdAt: new Date(item.createdAt).toISOString(),
+      })),
+    })
   }).build()
 }
 
 export function createProfileProcedures() {
   return serv.implement(profileContract).context<ServContext>().route('update').auth().handle(async ({ input, context }) => {
     const checked = await iam.auth.checkSensitiveOperation(context.accessToken ?? '', 'iam.profile.update', context.request.headers.get('x-hai-reauthentication') ?? undefined)
-    return checked.success ? updateProfile(input, context) : checked
+    return checked.success
+      ? updateProfile(input, context)
+      : checked
   }).route('avatar').auth().handle(async ({ input, context }) => {
     const checked = await iam.auth.checkSensitiveOperation(context.accessToken ?? '', 'iam.profile.avatar', context.request.headers.get('x-hai-reauthentication') ?? undefined)
-    return checked.success ? uploadAvatar(context.session.userId, input, context) : checked
+    return checked.success
+      ? uploadAvatar(context.session.userId, input, context)
+      : checked
   }).build()
 }

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/procedures/app-procedures.ts.hbs

@@ -22,7 +22,12 @@ export function createAppProcedures(options: CreateAppProceduresOptions) {
     .context<ServContext>()
     .route('info', async () => {
       const settings = await readBusinessSettings()
-      return settings.success ? ok({ ...createAppInfo(options), notice: settings.data.notice }) : settings
+      return settings.success
+        ? ok({
+            ...createAppInfo(options),
+            notice: settings.data.notice,
+          })
+        : settings
     })
     .route('echo', ({ input, context }) => {
       const data: AppEchoOutputData = {

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/procedures/index.ts.hbs

@@ -17,7 +17,9 @@ export function createServerProcedures(options: CreateServerProceduresOptions) {
   return {
     // @hai-generator:procedures:entries
     app: createAppProcedures(options.app),
-    iam: { auth: createAuthProcedures() },
+    iam: {
+      auth: createAuthProcedures(),
+    },
     admin: createAdminProcedures(),
     profile: createProfileProcedures(),
 {{#if features.feedback}}