@h-ai/cli 1.0.0-beta.18 → 1.0.0-beta.19

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/runtime.ts.hbs

@@ -42,7 +42,10 @@ function startFeedback(): Promise<void> {
   feedbackClosing = false
   feedbackStarting = (async () => {
     try {
-      const result = await feedback.init({ ...core.config.getOrThrow<import('@h-ai/feedback').FeedbackConfigInput>('feedback'), ...buildMetadata })
+      const result = await feedback.init({
+        ...core.config.getOrThrow<import('@h-ai/feedback').FeedbackConfigInput>('feedback'),
+        ...buildMetadata,
+      })
       if (!result.success) {
         if (feedbackFailure !== result.error.code)
           core.logger.warn('Optional feedback unavailable; business runtime remains ready', { module: 'feedback', code: result.error.code })
@@ -76,62 +79,127 @@ async function closeFeedback() {
   await feedbackStarting
   return feedback.close()
 }
-
 {{/if}}
 const runtime = core.module.createRuntime([
-  { name: 'configuration', start: () => {
-    core.init({
-      configDir: './config',
-      configSchemas: {
+  {
+    name: 'configuration',
+    start: () => {
+      core.init({
+        configDir: './config',
+        configSchemas: {
 {{#if features.ai}}
-        ai: AIConfigSchema,
+          ai: AIConfigSchema,
 {{/if}}
-        audit: AuditInitConfigSchema,
-        cache: CacheConfigSchema,
-        db: ReldbConfigSchema,
+          audit: AuditInitConfigSchema,
+          cache: CacheConfigSchema,
+          db: ReldbConfigSchema,
 {{#if features.feedback}}
-        feedback: FeedbackConfigSchema,
+          feedback: FeedbackConfigSchema,
 {{/if}}
-        iam: IamConfigSchema,
-        reach: ReachConfigSchema,
-        scheduler: SchedulerConfigSchema,
-        serv: ServConfigSchema,
-        storage: StorageConfigSchema,
+          iam: IamConfigSchema,
+          reach: ReachConfigSchema,
+          scheduler: SchedulerConfigSchema,
+          serv: ServConfigSchema,
+          storage: StorageConfigSchema,
 {{#if features.vecdb}}
-        vecdb: VecdbConfigSchema,
+          vecdb: VecdbConfigSchema,
 {{/if}}
-      },
-    })
-  }, close: () => {} },
-  { name: 'serv-config', start: () => core.config.validate('serv', ServConfigSchema), close: () => {} },
-  { name: 'reldb', start: async () => {
-    const config = ReldbConfigSchema.parse(core.config.getOrThrow('db'))
-    if (config.type === 'sqlite' && config.database !== ':memory:')
-      await mkdir(path.dirname(config.database), { recursive: true })
-    return reldb.init(config)
-  }, close: () => reldb.close() },
-  { name: 'cache', start: () => cache.init(CacheConfigSchema.parse(core.config.getOrThrow('cache'))), close: () => cache.close() },
+        },
+      })
+    },
+    close: () => { },
+  },
+  {
+    name: 'serv-config',
+    start: () => core.config.validate('serv', ServConfigSchema),
+    close: () => { },
+  },
+  {
+    name: 'reldb',
+    start: async () => {
+      const config = ReldbConfigSchema.parse(core.config.getOrThrow('db'))
+      if (config.type === 'sqlite' && config.database !== ':memory:')
+        await mkdir(path.dirname(config.database), { recursive: true })
+      return reldb.init(config)
+    },
+    close: () => reldb.close(),
+  },
+  {
+    name: 'cache',
+    start: () => cache.init(CacheConfigSchema.parse(core.config.getOrThrow('cache'))),
+    close: () => cache.close(),
+  },
 {{#if features.vecdb}}
-  { name: 'vecdb', start: () => vecdb.init(VecdbConfigSchema.parse(core.config.getOrThrow('vecdb'))), close: () => vecdb.close() },
+  {
+    name: 'vecdb',
+    start: () => vecdb.init(VecdbConfigSchema.parse(core.config.getOrThrow('vecdb'))),
+    close: () => vecdb.close(),
+  },
 {{/if}}
-  { name: 'crypto', start: () => crypto.init(), close: () => crypto.close() },
-  { name: 'storage', start: () => storage.init(StorageConfigSchema.parse(core.config.getOrThrow('storage'))), close: () => storage.close() },
-  { name: 'reach', enabled: () => Boolean(core.config.get('reach')), start: () => reach.init(ReachConfigSchema.parse(core.config.getOrThrow('reach'))), close: () => reach.close() },
-  { name: 'audit', start: () => audit.init({ ...AuditInitConfigSchema.parse(core.config.get('audit') ?? {}), storage, reach }), close: () => audit.close() },
-  { name: 'iam', start: () => iam.init({ ...IamConfigSchema.parse(core.config.getOrThrow('iam')), reach }), close: () => iam.close() },
-  { name: 'audit-jobs', enabled: () => Boolean(audit.schedulerPlan), start: startAuditJobs, close: () => scheduler.close() },
+  {
+    name: 'crypto',
+    start: () => crypto.init(),
+    close: () => crypto.close(),
+  },
+  {
+    name: 'storage',
+    start: () => storage.init(StorageConfigSchema.parse(core.config.getOrThrow('storage'))),
+    close: () => storage.close(),
+  },
+  {
+    name: 'reach',
+    enabled: () => Boolean(core.config.get('reach')),
+    start: () => reach.init(ReachConfigSchema.parse(core.config.getOrThrow('reach'))),
+    close: () => reach.close(),
+  },
+  {
+    name: 'audit',
+    start: () => audit.init({
+      ...AuditInitConfigSchema.parse(core.config.get('audit') ?? {}),
+      storage,
+      reach,
+    }),
+    close: () => audit.close(),
+  },
+  {
+    name: 'iam',
+    start: () => iam.init({
+      ...IamConfigSchema.parse(core.config.getOrThrow('iam')),
+      reach,
+    }),
+    close: () => iam.close(),
+  },
+  {
+    name: 'audit-jobs',
+    enabled: () => Boolean(audit.schedulerPlan),
+    start: startAuditJobs,
+    close: () => scheduler.close(),
+  },
 {{#if features.feedback}}
-  { name: 'feedback', enabled: () => Boolean(core.config.get('feedback')), start: startFeedback, close: closeFeedback },
+  {
+    name: 'feedback',
+    enabled: () => Boolean(core.config.get('feedback')),
+    start: startFeedback,
+    close: closeFeedback,
+  },
 {{/if}}
 {{#if features.ai}}
-  { name: 'ai', start: () => ai.init(AIConfigSchema.parse(core.config.getOrThrow('ai'))), close: () => ai.close() },
+  {
+    name: 'ai',
+    start: () => ai.init(AIConfigSchema.parse(core.config.getOrThrow('ai'))),
+    close: () => ai.close(),
+  },
 {{/if}}
-  { name: 'bootstrap', start: async () => {
-    requireInitialized(await initBusinessSettings(), 'business-settings')
-    await ensureRolesAndAdmin()
-    const app = core.config.getOrThrow<CoreConfig>('core')
-    core.logger.info('Application initialized', { name: app.name, version: app.version, environment: app.env })
-  }, close: () => {} },
+  {
+    name: 'bootstrap',
+    start: async () => {
+      requireInitialized(await initBusinessSettings(), 'business-settings')
+      await ensureRolesAndAdmin()
+      const app = core.config.getOrThrow<CoreConfig>('core')
+      core.logger.info('Application initialized', { name: app.name, version: app.version, environment: app.env })
+    },
+    close: () => { },
+  },
 ])
 
 /** 仅声明模块和业务钩子，失败回滚、并发及关闭重试由 core 负责。 */
@@ -149,15 +217,27 @@ export async function closeModules(): Promise<void> {
 
 /** 此函数仅用于进程启动边界，业务请求继续返回 HaiResult。 */
 function requireInitialized<T>(result: HaiResult<T>, moduleName: string): T {
-  if (!result.success)
-    throw Object.assign(new Error(moduleName), { code: result.error.code, ext: { fields: moduleName === 'iam-bootstrap' ? ['HAI_ADMIN_DEFAULT_PASSWORD'] : [] } })
+  if (!result.success) {
+    throw Object.assign(new Error(moduleName), {
+      code: result.error.code,
+      ext: {
+        fields: moduleName === 'iam-bootstrap'
+          ? ['HAI_ADMIN_DEFAULT_PASSWORD']
+          : [],
+      },
+    })
+  }
   return result.data
 }
 
 async function ensureRolesAndAdmin(): Promise<void> {
   requireInitialized(await seedAppDuties(), 'app-duties')
   await ensureInitialSystemAdmin()
-  for (const [username, password] of [['audit_admin', process.env.HAI_AUDIT_ADMIN_PASSWORD], ['config_admin', process.env.HAI_CONFIG_ADMIN_PASSWORD], ['business_operator', process.env.HAI_BUSINESS_OPERATOR_PASSWORD]] as const)
+  for (const [username, password] of [
+    ['audit_admin', process.env.HAI_AUDIT_ADMIN_PASSWORD],
+    ['config_admin', process.env.HAI_CONFIG_ADMIN_PASSWORD],
+    ['business_operator', process.env.HAI_BUSINESS_OPERATOR_PASSWORD],
+  ] as const)
     requireInitialized(await bootstrapDutyAccount(username, password), 'app-duty-bootstrap')
 }
 
@@ -166,9 +246,19 @@ async function ensureInitialSystemAdmin(): Promise<void> {
   if (users.total > 0)
     return
   const password = process.env.HAI_ADMIN_DEFAULT_PASSWORD?.trim()
-  if (!password)
-    throw Object.assign(new Error('Administrator bootstrap configuration required'), { code: HaiConfigError.CONFIG_ENV_VAR_MISSING.code, ext: { fields: ['HAI_ADMIN_DEFAULT_PASSWORD'] } })
-  const registered = requireInitialized(await iam.user.createUser({ username: 'admin', password, displayName: serverM('admin') }), 'iam-bootstrap')
+  if (!password) {
+    throw Object.assign(new Error('Administrator bootstrap configuration required'), {
+      code: HaiConfigError.CONFIG_ENV_VAR_MISSING.code,
+      ext: {
+        fields: ['HAI_ADMIN_DEFAULT_PASSWORD'],
+      },
+    })
+  }
+  const registered = requireInitialized(await iam.user.createUser({
+    username: 'admin',
+    password,
+    displayName: serverM('admin'),
+  }), 'iam-bootstrap')
   const adminRole = requireInitialized(await iam.authz.getRoleByCode('admin'), 'iam-role')
   if (!adminRole)
     throw new Error('Administrator role is missing')

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/security-roles.ts.hbs

@@ -8,14 +8,26 @@ export const APP_DUTIES = {
   admin: ['app.users.manage', 'app.roles.manage'],
   audit_admin: ['audit:read', 'audit:backup'],
   config_admin: ['app.config.manage'],
-  business_operator: ['feedback:create', 'feedback:read', 'feedback:process', 'feedback:reopen', 'feedback:export'],
+  business_operator: [
+    'feedback:create',
+    'feedback:read',
+    'feedback:process',
+    'feedback:reopen',
+    'feedback:export',
+  ],
   user: ['feedback:create'],
 } as const
 
 export async function seedAppDuties(): Promise<HaiResult<void>> {
   if (iam.config?.rbac.superAdminRole && iam.config.rbac.superAdminRole in APP_DUTIES)
     return err(HaiCommonError.VALIDATION_ERROR)
-  for (const code of ['admin', 'audit_admin', 'config_admin', 'business_operator', 'user'] as const) {
+  for (const code of [
+    'admin',
+    'audit_admin',
+    'config_admin',
+    'business_operator',
+    'user',
+  ] as const) {
     const permissionIds: string[] = []
     for (const permissionCode of APP_DUTIES[code]) {
       let permission = await iam.authz.getPermissionByCode(permissionCode)
@@ -25,8 +37,11 @@ export async function seedAppDuties(): Promise<HaiResult<void>> {
         permission = await iam.authz.createPermission({ code: permissionCode, name: permissionCode, type: 'api' })
         if (!permission.success) {
           permission = await iam.authz.getPermissionByCode(permissionCode)
-          if (!permission.success || !permission.data)
-            return permission.success ? err(HaiCommonError.INTERNAL_ERROR) : permission
+          if (!permission.success || !permission.data) {
+            return permission.success
+              ? err(HaiCommonError.INTERNAL_ERROR)
+              : permission
+          }
         }
       }
       if (permission.data)
@@ -36,16 +51,26 @@ export async function seedAppDuties(): Promise<HaiResult<void>> {
     if (!role.success)
       return role
     if (!role.data) {
-      role = await iam.authz.createRole({ code, name: serverM(code), isSystem: true })
+      role = await iam.authz.createRole({
+        code,
+        name: serverM(code),
+        isSystem: true,
+      })
       if (!role.success) {
         role = await iam.authz.getRoleByCode(code)
-        if (!role.success || !role.data)
-          return role.success ? err(HaiCommonError.INTERNAL_ERROR) : role
+        if (!role.success || !role.data) {
+          return role.success
+            ? err(HaiCommonError.INTERNAL_ERROR)
+            : role
+        }
       }
     }
     if (!role.data)
       return err(HaiCommonError.INTERNAL_ERROR)
-    const updated = await iam.authz.updateRole(role.data.id, { name: serverM(code), permissionIds })
+    const updated = await iam.authz.updateRole(role.data.id, {
+      name: serverM(code),
+      permissionIds,
+    })
     if (!updated.success)
       return updated
   }
@@ -58,11 +83,17 @@ export async function bootstrapDutyAccount(username: 'audit_admin' | 'config_adm
   if (!password)
     return ok(undefined)
   const created = await iam.user.createUser({ username, password })
-  if (!created.success)
-    return created.error.code === HaiIamError.USER_ALREADY_EXISTS.code ? ok(undefined) : created
+  if (!created.success) {
+    return created.error.code === HaiIamError.USER_ALREADY_EXISTS.code
+      ? ok(undefined)
+      : created
+  }
   const role = await iam.authz.getRoleByCode(username)
-  if (!role.success || !role.data)
-    return role.success ? err(HaiCommonError.INTERNAL_ERROR) : role
+  if (!role.success || !role.data) {
+    return role.success
+      ? err(HaiCommonError.INTERNAL_ERROR)
+      : role
+  }
   const assigned = await iam.authz.syncRoles(created.data.user.id, [role.data.id])
   if (!assigned.success) {
     const removed = await iam.user.deleteUser(created.data.user.id)

package/templates/apps/fullstack/packages/{{projectName}}-serv/tests/app-server.test.ts.hbs

@@ -34,8 +34,17 @@ interface LoginData { user: { id: string }, tokens: { accessToken: string, refre
 async function call<T>(route: string, input?: object, token?: string, method = 'POST'): Promise<HaiResult<T>> {
   const response = await transport.encryptedFetch(`http://localhost${PREFIX}${route}`, {
     method,
-    headers: { 'content-type': 'application/json', ...(token ? { authorization: `Bearer ${token}` } : {}) },
-    ...(input ? { body: JSON.stringify(input) } : {}),
+    headers: {
+      'content-type': 'application/json',
+      ...(token
+        ? { authorization: `Bearer ${token}` }
+        : {}),
+    },
+    ...(input
+      ? {
+          body: JSON.stringify(input),
+        }
+      : {}),
   })
   return response.json() as Promise<HaiResult<T>>
 }
@@ -49,7 +58,10 @@ beforeAll(async () => {
   const key = crypto.asymmetric.generateKeyPair()
   if (!key.success)
     throw new Error(key.error.message)
-  vi.stubEnv('HAI_CRYPTO_TRANSPORT_SERVERKEYRING', JSON.stringify({ activeKeyId: 'test-v1', keys: { 'test-v1': key.data } }))
+  vi.stubEnv('HAI_CRYPTO_TRANSPORT_SERVERKEYRING', JSON.stringify({
+    activeKeyId: 'test-v1',
+    keys: { 'test-v1': key.data },
+  }))
   app = createServerApp()
   transport = crypto.transport.createClient({
     keyExchangeUrl: `http://localhost${PREFIX}/_hai/key-exchange`,
@@ -99,7 +111,12 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     if (!result.success)
       return
     const config = core.config.getOrThrow<CoreConfig>('core')
-    expect(result.data).toMatchObject({ name: config.name, version: config.version, env: config.env, defaultLocale: config.defaultLocale })
+    expect(result.data).toMatchObject({
+      name: config.name,
+      version: config.version,
+      env: config.env,
+      defaultLocale: config.defaultLocale,
+    })
     const invalid = await transport.encryptedFetch(`http://localhost${PREFIX}/app/echo`, {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
@@ -129,7 +146,14 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
   it('mounts public auth routes while keeping default IAM administration routes private', async () => {
     const config = await transport.encryptedFetch(`http://localhost${PREFIX}/auth/config`)
     expect(config.status).toBe(200)
-    for (const route of ['/auth/register', '/auth/login/ldap', '/auth/login/otp', '/auth/otp/send', '/auth/password-reset/request', '/auth/password-reset/confirm']) {
+    for (const route of [
+      '/auth/register',
+      '/auth/login/ldap',
+      '/auth/login/otp',
+      '/auth/otp/send',
+      '/auth/password-reset/request',
+      '/auth/password-reset/confirm',
+    ]) {
       const response = await transport.encryptedFetch(`http://localhost${PREFIX}${route}`, {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
@@ -144,14 +168,21 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
       const response = await transport.encryptedFetch(`http://localhost${PREFIX}${route}`, {
         method,
         headers: { 'content-type': 'application/json', 'authorization': `Bearer ${adminToken}` },
-        ...(method === 'POST' ? { body: '{}' } : {}),
+        ...(method === 'POST'
+          ? { body: '{}' }
+          : {}),
       })
       expect(response.status).toBe(404)
     }
   })
 
   it('creates a normal user and enforces guards on every administration API', async () => {
-    const created = await call<AdminUser>('/admin/users/create', { username: 'normal-user', password: TEST_PASSWORD, role: 'user', accountStatus: 'active' }, adminToken)
+    const created = await call<AdminUser>('/admin/users/create', {
+      username: 'normal-user',
+      password: TEST_PASSWORD,
+      role: 'user',
+      accountStatus: 'active',
+    }, adminToken)
     expect(created.success).toBe(true)
     if (!created.success)
       return
@@ -162,14 +193,35 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
       return
     userToken = loggedIn.data.tokens.accessToken
     for (const [route, input] of [
-      ['/admin/users/list', { page: 1, pageSize: 20 }],
-      ['/admin/users/create', { username: 'forbidden', password: TEST_PASSWORD }],
-      ['/admin/users/update', { id: adminId, accountStatus: 'dormant' }],
-      ['/admin/users/delete', { id: adminId }],
-      ['/admin/users/avatar', { id: adminId, contentType: 'image/png', base64: PNG }],
+      [
+        '/admin/users/list',
+        { page: 1, pageSize: 20 },
+      ],
+      [
+        '/admin/users/create',
+        { username: 'forbidden', password: TEST_PASSWORD },
+      ],
+      [
+        '/admin/users/update',
+        { id: adminId, accountStatus: 'dormant' },
+      ],
+      [
+        '/admin/users/delete',
+        { id: adminId },
+      ],
+      [
+        '/admin/users/avatar',
+        { id: adminId, contentType: 'image/png', base64: PNG },
+      ],
       ['/admin/roles/list', undefined],
-      ['/admin/roles/update', { id: 'missing', description: 'x' }],
-      ['/admin/audit/list', { page: 1, pageSize: 20 }],
+      [
+        '/admin/roles/update',
+        { id: 'missing', description: 'x' },
+      ],
+      [
+        '/admin/audit/list',
+        { page: 1, pageSize: 20 },
+      ],
     ] as const) {
       const denied = await call(route, input, userToken)
       expect(denied.success).toBe(false)
@@ -179,8 +231,16 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
   })
 
   it('allows refresh-token body transport only for an identified trusted native origin', async () => {
-    for (const [clientName, origin] of [['{{projectName}}-app', 'capacitor://localhost'], ['{{projectName}}-desktop', 'http://tauri.localhost']] as const) {
-      const headers = { 'content-type': 'application/json', 'x-request-client': clientName, 'x-hai-token-transport': 'body', origin }
+    for (const [clientName, origin] of [
+      ['{{projectName}}-app', 'capacitor://localhost'],
+      ['{{projectName}}-desktop', 'http://tauri.localhost'],
+    ] as const) {
+      const headers = {
+        'content-type': 'application/json',
+        'x-request-client': clientName,
+        'x-hai-token-transport': 'body',
+        origin,
+      }
       const login = await transport.encryptedFetch(`http://localhost${PREFIX}/auth/login`, {
         method: 'POST',
         headers,
@@ -202,10 +262,18 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
       if (refreshed.success)
         expect(refreshed.data.tokens.refreshToken).not.toBe(result.data.tokens.refreshToken)
     }
-    for (const [clientName, origin] of [['{{projectName}}-app', 'http://untrusted.example'], ['unrecognized-client', 'capacitor://localhost']] as const) {
+    for (const [clientName, origin] of [
+      ['{{projectName}}-app', 'http://untrusted.example'],
+      ['unrecognized-client', 'capacitor://localhost'],
+    ] as const) {
       const response = await transport.encryptedFetch(`http://localhost${PREFIX}/auth/login`, {
         method: 'POST',
-        headers: { 'content-type': 'application/json', 'x-request-client': clientName, 'x-hai-token-transport': 'body', origin },
+        headers: {
+          'content-type': 'application/json',
+          'x-request-client': clientName,
+          'x-hai-token-transport': 'body',
+          origin,
+        },
         body: JSON.stringify({ identifier: 'admin', password: TEST_PASSWORD }),
       })
       const result = await response.json() as HaiResult<LoginData>
@@ -222,7 +290,20 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
       expect(listed.data.items).toHaveLength(1)
       expect(listed.data.total).toBe(2)
     }
-    for (const [route, input] of [['/admin/users/delete', { id: adminId }], ['/admin/users/update', { id: adminId, accountStatus: 'dormant' }], ['/admin/users/update', { id: adminId, role: 'user' }]] as const) {
+    for (const [route, input] of [
+      [
+        '/admin/users/delete',
+        { id: adminId },
+      ],
+      [
+        '/admin/users/update',
+        { id: adminId, accountStatus: 'dormant' },
+      ],
+      [
+        '/admin/users/update',
+        { id: adminId, role: 'user' },
+      ],
+    ] as const) {
       const denied = await call(route, input, adminToken)
       expect(denied.success).toBe(false)
       if (!denied.success)
@@ -248,7 +329,10 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     expect(invalid.success).toBe(false)
     if (!invalid.success)
       expect(invalid.error.httpStatus).toBe(400)
-    const oversized = await call('/profile/avatar', { contentType: 'image/png', base64: Buffer.alloc(512 * 1024 + 1).toString('base64') }, userToken)
+    const oversized = await call('/profile/avatar', {
+      contentType: 'image/png',
+      base64: Buffer.alloc(512 * 1024 + 1).toString('base64'),
+    }, userToken)
     expect(oversized.success).toBe(false)
     const anonymous = await call('/profile/avatar', { contentType: 'image/png', base64: PNG })
     expect(anonymous.success).toBe(false)
@@ -296,7 +380,13 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     const roles = await call<{ items: { id: string, code: string, userCount: number }[] }>('/admin/roles/list', undefined, adminToken)
     expect(roles.success).toBe(true)
     if (roles.success) {
-      expect(roles.data.items.map(item => item.code).sort()).toEqual(['admin', 'audit_admin', 'business_operator', 'config_admin', 'user'])
+      expect(roles.data.items.map(item => item.code).sort()).toEqual([
+        'admin',
+        'audit_admin',
+        'business_operator',
+        'config_admin',
+        'user',
+      ])
       const role = roles.data.items.find(item => item.code === 'user')!
       expect(role.userCount).toBe(1)
       expect((await call('/admin/roles/update', { id: role.id, description: 'Updated description' }, adminToken)).success).toBe(true)
@@ -324,7 +414,12 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     const before = await iam.user.getUser(user.id)
     expect(before.success).toBe(true)
     const sync = vi.spyOn(iam.authz, 'syncRoles').mockResolvedValueOnce(err(HaiCommonError.API_ERROR, 'Injected role persistence failure'))
-    const failed = await call('/admin/users/update', { id: user.id, role: 'admin', email: 'changed@example.com', displayName: 'Should not change' }, adminToken)
+    const failed = await call('/admin/users/update', {
+      id: user.id,
+      role: 'admin',
+      email: 'changed@example.com',
+      displayName: 'Should not change',
+    }, adminToken)
     sync.mockRestore()
     expect(failed.success).toBe(false)
     const after = await iam.user.getUser(user.id)
@@ -338,7 +433,7 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     const log = vi.spyOn(audit, 'log').mockImplementation((input, tx) => input.action === 'update' && input.resource === 'profile'
       ? Promise.resolve(err(HaiCommonError.API_ERROR, 'Injected audit persistence failure'))
       : originalLog(input, tx))
-    const logger = vi.spyOn(core.logger, 'error').mockImplementation(() => {})
+    const logger = vi.spyOn(core.logger, 'error').mockImplementation(() => { })
     try {
       const result = await call<AdminUser>('/profile/update', { displayName: 'Committed profile' }, userToken)
       expect(result.success).toBe(true)
@@ -374,9 +469,22 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     const snapshot = await iam.session.get(userToken)
     if (!snapshot.success || !snapshot.data)
       throw new Error('Session unavailable')
-    const stale = await iam.session.update(userToken, { roles: ['admin'], permissions: ['*'] }, snapshot.data.version)
+    const stale = await iam.session.update(userToken, {
+      roles: ['admin'],
+      permissions: ['*'],
+    }, snapshot.data.version)
     expect(stale.success).toBe(true)
-    for (const [route, input] of [['/admin/users/list', { page: 1, pageSize: 20 }], ['/admin/roles/list', undefined], ['/admin/audit/list', { page: 1, pageSize: 20 }]] as const) {
+    for (const [route, input] of [
+      [
+        '/admin/users/list',
+        { page: 1, pageSize: 20 },
+      ],
+      ['/admin/roles/list', undefined],
+      [
+        '/admin/audit/list',
+        { page: 1, pageSize: 20 },
+      ],
+    ] as const) {
       const denied = await call(route, input, userToken)
       expect(denied.success).toBe(false)
       if (!denied.success)
@@ -415,8 +523,8 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     expect(otherLogin.success).toBe(true)
     if (!otherLogin.success)
       return
-    let resume: () => void = () => {}
-    let entered: () => void = () => {}
+    let resume: () => void = () => { }
+    let entered: () => void = () => { }
     const paused = new Promise<void>((resolve) => {
       resume = resolve
     })
@@ -467,7 +575,10 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
       call('/admin/users/update', { id: adminId, accountStatus: 'dormant' }, loggedIn.data.tokens.accessToken),
     ])
     expect(results.filter(result => result.success)).toHaveLength(1)
-    const admins = await iam.user.listUsers({ accountStatus: 'active', include: ['roles'] })
+    const admins = await iam.user.listUsers({
+      accountStatus: 'active',
+      include: ['roles'],
+    })
     expect(admins.success).toBe(true)
     if (admins.success) {
       const surviving = admins.data.items.filter(item => item.roles?.some(role => role.code === 'admin'))