@h-ai/cli 1.0.0-beta.18 → 1.0.0-beta.19

package/templates/apps/fullstack/packages/{{projectName}}-serv/tests/runtime.test.ts.hbs

@@ -15,7 +15,6 @@ import { afterEach, beforeEach, expect, it, vi } from 'vitest'
 import { closeModules, initializeModules } from '../src/server/runtime.js'
 
 let storageRoot: string
-
 beforeEach(async () => {
   storageRoot = await mkdtemp(path.join(os.tmpdir(), '{{projectName}}-bootstrap-'))
   vi.stubEnv('HAI_DB_DATABASE', '":memory:"')
@@ -23,22 +22,33 @@ beforeEach(async () => {
   vi.stubEnv('HAI_IAM_PASSWORD_REQUIREUPPERCASE', 'true')
   core.init({ configDir: './config' })
 })
-
 afterEach(async () => {
   await closeModules()
   vi.unstubAllEnvs()
   await rm(storageRoot, { recursive: true, force: true })
 })
-
 it.each([
   { password: 'abc' },
   { password: 'lowercase123!' },
 ])('startup explains the failed password policy and permits a clean retry: $password', async ({ password }) => {
   vi.stubEnv('HAI_ADMIN_DEFAULT_PASSWORD', password)
-  await expect(initializeModules()).rejects.toMatchObject({ cause: { ext: { module: 'bootstrap', fields: ['HAI_ADMIN_DEFAULT_PASSWORD'] } } })
-  for (const module of [audit, iam, storage, crypto, cache, reldb])
+  await expect(initializeModules()).rejects.toMatchObject({
+    cause: {
+      ext: {
+        module: 'bootstrap',
+        fields: ['HAI_ADMIN_DEFAULT_PASSWORD'],
+      },
+    },
+  })
+  for (const module of [
+    audit,
+    iam,
+    storage,
+    crypto,
+    cache,
+    reldb,
+  ])
     expect(module.isInitialized).toBe(false)
-
   // 失败后再次初始化，确认未保留半成品管理员或未释放的模块。
   vi.stubEnv('HAI_ADMIN_DEFAULT_PASSWORD', 'Bootstrap-retry-Admin123!')
   await initializeModules()
@@ -49,14 +59,27 @@ it.each([
     expect(users.data.items[0]?.username).toBe('admin')
   }
 })
-
 it.each(['', '   '])('startup identifies an unset administrator password without exposing its value', async (password) => {
   vi.stubEnv('HAI_ADMIN_DEFAULT_PASSWORD', password)
-  await expect(initializeModules()).rejects.toMatchObject({ cause: { ext: { module: 'bootstrap', code: HaiConfigError.CONFIG_ENV_VAR_MISSING.code, fields: ['HAI_ADMIN_DEFAULT_PASSWORD'] } } })
-  for (const module of [audit, iam, storage, crypto, cache, reldb])
+  await expect(initializeModules()).rejects.toMatchObject({
+    cause: {
+      ext: {
+        module: 'bootstrap',
+        code: HaiConfigError.CONFIG_ENV_VAR_MISSING.code,
+        fields: ['HAI_ADMIN_DEFAULT_PASSWORD'],
+      },
+    },
+  })
+  for (const module of [
+    audit,
+    iam,
+    storage,
+    crypto,
+    cache,
+    reldb,
+  ])
     expect(module.isInitialized).toBe(false)
 })
-
 {{#if features.feedback}}
 it('optional feedback failure does not roll back authentication and business modules', async () => {
   vi.stubEnv('HAI_ADMIN_DEFAULT_PASSWORD', 'Bootstrap-retry-Admin123!')

package/templates/apps/fullstack/packages/{{projectName}}-serv/tests/security.test.ts.hbs

@@ -29,11 +29,23 @@ beforeAll(async () => {
   expect((await reldb.init({ type: 'sqlite', database: ':memory:' })).success).toBe(true)
   expect((await cache.init({ type: 'memory' })).success).toBe(true)
   expect((await storage.init({ type: 'local', root: directory })).success).toBe(true)
-  expect((await audit.init({ storage, backup: { enabled: true } })).success).toBe(true)
+  expect((await audit.init({
+    storage,
+    backup: { enabled: true },
+  })).success).toBe(true)
   expect((await iam.init({
     initialCredentials: { enabled: true },
     passwordReset: { enabled: true, mode: 'email' },
-    reauthentication: { enabled: true, operations: ['iam.users.create', 'iam.users.invite', 'iam.users.resetPassword', 'audit.backup', 'business.settings.update'] },
+    reauthentication: {
+      enabled: true,
+      operations: [
+        'iam.users.create',
+        'iam.users.invite',
+        'iam.users.resetPassword',
+        'audit.backup',
+        'business.settings.update',
+      ],
+    },
     onPasswordResetRequest: async (user, token) => {
       invitations.set(user.username, token)
       if (deliveryUnknown)
@@ -56,7 +68,17 @@ beforeAll(async () => {
   }
   const app = serv.createApp({
     contract: {{fullstack.contractExportName}},
-    procedures: createServerProcedures({ app: { name: 'Security fixture', version: 'test', env: 'test', defaultLocale: 'en-US', supportedLocales: ['en-US'], startedAt: new Date().toISOString(), frontends: ['web'] } }),
+    procedures: createServerProcedures({
+      app: {
+        name: 'Security fixture',
+        version: 'test',
+        env: 'test',
+        defaultLocale: 'en-US',
+        supportedLocales: ['en-US'],
+        startedAt: new Date().toISOString(),
+        frontends: ['web'],
+      },
+    }),
     iam,
     http: { openapi: false, docs: false },
   })
@@ -100,23 +122,57 @@ async function proof(code: Duty, operation: string) {
 }
 
 function post(code: Duty, route: string, input: object = {}, ticket?: string) {
-  return fetch(`${base}${route}`, { method: 'POST', headers: { 'content-type': 'application/json', 'authorization': `Bearer ${actor(code).token}`, ...(ticket ? { 'x-hai-reauthentication': ticket } : {}) }, body: JSON.stringify(input) })
+  return fetch(`${base}${route}`, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      'authorization': `Bearer ${actor(code).token}`,
+      ...(ticket
+        ? { 'x-hai-reauthentication': ticket }
+        : {}),
+    },
+    body: JSON.stringify(input),
+  })
 }
 
 it('系统、审计、配置与业务职责的直接 HTTP 请求各有边界', async () => {
-  expect(await (await post('audit_admin', '/admin/users/list')).json()).toMatchObject({ success: false, error: { httpStatus: 403 } })
-  expect(await (await post('admin', '/admin/audit/list')).json()).toMatchObject({ success: false, error: { httpStatus: 403 } })
-  expect(await (await post('admin', '/admin/configuration/update', { notice: 'Rejected' })).json()).toMatchObject({ success: false, error: { httpStatus: 403 } })
-  expect(await (await post('business_operator', '/admin/users/list')).json()).toMatchObject({ success: false, error: { httpStatus: 403 } })
+  expect(await (await post('audit_admin', '/admin/users/list')).json()).toMatchObject({
+    success: false,
+    error: { httpStatus: 403 },
+  })
+  expect(await (await post('admin', '/admin/audit/list')).json()).toMatchObject({
+    success: false,
+    error: { httpStatus: 403 },
+  })
+  expect(await (await post('admin', '/admin/configuration/update', { notice: 'Rejected' })).json()).toMatchObject({
+    success: false,
+    error: { httpStatus: 403 },
+  })
+  expect(await (await post('business_operator', '/admin/users/list')).json()).toMatchObject({
+    success: false,
+    error: { httpStatus: 403 },
+  })
   const ticket = await proof('config_admin', 'business.settings.update')
   expect(await (await post('config_admin', '/admin/configuration/update', { notice: 'Authorized public notice' }, ticket)).json()).toMatchObject({ success: true })
   const info = await fetch(`${base}/app/info`, { method: 'POST' })
-  expect(await info.json()).toMatchObject({ success: true, data: { notice: 'Authorized public notice' } })
+  expect(await info.json()).toMatchObject({
+    success: true,
+    data: { notice: 'Authorized public notice' },
+  })
 })
 
 it('再鉴别按用途单次使用，临时账号状态变化立即阻止旧会话', async () => {
-  const input = { username: 'temporary-member', password: 'Temporary-example-123!', role: 'user', accountType: 'temporary', accountExpiresAt: new Date(Date.now() + 3600000).toISOString() }
-  expect(await (await post('admin', '/admin/users/create', input)).json()).toMatchObject({ success: false, error: { code: 'hai:iam:027' } })
+  const input = {
+    username: 'temporary-member',
+    password: 'Temporary-example-123!',
+    role: 'user',
+    accountType: 'temporary',
+    accountExpiresAt: new Date(Date.now() + 3600000).toISOString(),
+  }
+  expect(await (await post('admin', '/admin/users/create', input)).json()).toMatchObject({
+    success: false,
+    error: { code: 'hai:iam:027' },
+  })
   const ticket = await proof('admin', 'iam.users.create')
   const response = await post('admin', '/admin/users/create', input, ticket)
   const created = apiContract.haiResultSchema(AdminUserSchema).parse(await response.json())
@@ -135,7 +191,12 @@ it('再鉴别按用途单次使用，临时账号状态变化立即阻止旧会
 
 it('设密邀请可完成，投递未知时保留账号；系统管理员可创建其他职责账号', async () => {
   const createdDuty = await post('admin', '/admin/users/create', { username: 'managed-auditor', password: 'Example-123!', role: 'audit_admin' }, await proof('admin', 'iam.users.create'))
-  expect(await createdDuty.json()).toMatchObject({ success: true, data: { roles: ['audit_admin'] } })
+  expect(await createdDuty.json()).toMatchObject({
+    success: true,
+    data: {
+      roles: ['audit_admin'],
+    },
+  })
   const invite = await post('admin', '/admin/users/invite', { username: 'invited-member', email: 'member@example.test' }, await proof('admin', 'iam.users.invite'))
   expect(await invite.json()).toMatchObject({ success: true })
   const token = invitations.get('invited-member')
@@ -145,39 +206,94 @@ it('设密邀请可完成，投递未知时保留账号；系统管理员可创
   deliveryUnknown = true
   try {
     const unknown = await post('admin', '/admin/users/invite', { username: 'delivery-unknown-member', email: 'unknown@example.test' }, await proof('admin', 'iam.users.invite'))
-    expect(await unknown.json()).toMatchObject({ success: false, error: { code: 'hai:iam:028' } })
+    expect(await unknown.json()).toMatchObject({
+      success: false,
+      error: { code: 'hai:iam:028' },
+    })
     const found = await iam.user.listUsers({ search: 'delivery-unknown-member' })
-    expect(found).toMatchObject({ success: true, data: { total: 1 } })
+    expect(found).toMatchObject({
+      success: true,
+      data: { total: 1 },
+    })
   }
   finally { deliveryUnknown = false }
 })
 
 it('只有审计职责可手动备份且私有归档可验证', async () => {
   const id = crypto.randomUUID()
-  expect(await (await post('admin', '/admin/audit/backup', { id })).json()).toMatchObject({ success: false, error: { httpStatus: 403 } })
+  expect(await (await post('admin', '/admin/audit/backup', { id })).json()).toMatchObject({
+    success: false,
+    error: { httpStatus: 403 },
+  })
   const result = await post('audit_admin', '/admin/audit/backup', { id }, await proof('audit_admin', 'audit.backup'))
   const body: unknown = await result.json()
-  expect(body).toMatchObject({ success: true, data: { id, key: expect.stringContaining('hai-private/audit-backups/'), sha256: expect.stringMatching(/^[a-f\d]{64}$/) } })
+  expect(body).toMatchObject({
+    success: true,
+    data: {
+      id,
+      key: expect.stringContaining('hai-private/audit-backups/'),
+      sha256: expect.stringMatching(/^[a-f\d]{64}$/),
+    },
+  })
   const verified = await audit.backup.verify(`hai-private/audit-backups/${id}.jsonl`)
   expect(verified.success).toBe(true)
 })
 
-it.each(['admin', 'audit_admin', 'config_admin', 'business_operator', 'user'] as const)('系统管理员统一管理 %s 的资料、生命周期、角色和密码', async (role) => {
+it.each([
+  'admin',
+  'audit_admin',
+  'config_admin',
+  'business_operator',
+  'user',
+] as const)('系统管理员统一管理 %s 的资料、生命周期、角色和密码', async (role) => {
   const username = `managed-${role}`
   const created = apiContract.haiResultSchema(AdminUserSchema).parse(await (await post('admin', '/admin/users/create', { username, password: 'Managed-example-123!', role }, await proof('admin', 'iam.users.create'))).json())
-  expect(created).toMatchObject({ success: true, data: { roles: [role], accountStatus: 'active' } })
+  expect(created).toMatchObject({
+    success: true,
+    data: {
+      roles: [role],
+      accountStatus: 'active',
+    },
+  })
   if (!created.success)
     throw new Error('Managed account fixture failed')
-  const input = { id: created.data.id, displayName: 'Managed profile', accountStatus: 'dormant', role: 'user' }
-  expect(await (await post('admin', '/admin/users/update', input)).json()).toMatchObject({ success: true, data: { displayName: 'Managed profile', roles: ['user'], accountStatus: 'dormant' } })
+  const input = {
+    id: created.data.id,
+    displayName: 'Managed profile',
+    accountStatus: 'dormant',
+    role: 'user',
+  }
+  expect(await (await post('admin', '/admin/users/update', input)).json()).toMatchObject({
+    success: true,
+    data: {
+      displayName: 'Managed profile',
+      roles: ['user'],
+      accountStatus: 'dormant',
+    },
+  })
   const reset = { id: created.data.id, newPassword: 'Reset-example-456!' }
-  expect(await (await post('admin', '/admin/users/reset-password', reset)).json()).toMatchObject({ success: false, error: { code: 'hai:iam:027' } })
+  expect(await (await post('admin', '/admin/users/reset-password', reset)).json()).toMatchObject({
+    success: false,
+    error: { code: 'hai:iam:027' },
+  })
   const ticket = await proof('admin', 'iam.users.resetPassword')
-  expect(await (await post('admin', '/admin/users/reset-password', reset, ticket)).json()).toMatchObject({ success: true, data: { reset: true } })
+  expect(await (await post('admin', '/admin/users/reset-password', reset, ticket)).json()).toMatchObject({
+    success: true,
+    data: { reset: true },
+  })
   expect(await (await post('admin', '/admin/users/reset-password', reset, ticket)).json()).toMatchObject({ success: false })
-  expect(await iam.user.getUser(created.data.id)).toMatchObject({ success: true, data: { accountStatus: 'dormant' } })
-  expect(await iam.auth.login({ identifier: username, password: reset.newPassword })).toMatchObject({ success: false, error: { code: 'hai:iam:002' } })
+  expect(await iam.user.getUser(created.data.id)).toMatchObject({
+    success: true,
+    data: { accountStatus: 'dormant' },
+  })
+  expect(await iam.auth.login({ identifier: username, password: reset.newPassword })).toMatchObject({
+    success: false,
+    error: { code: 'hai:iam:002' },
+  })
   expect(await (await post('admin', '/admin/users/update', { id: created.data.id, accountStatus: 'active' })).json()).toMatchObject({ success: true })
   expect((await iam.auth.login({ identifier: username, password: reset.newPassword })).success).toBe(true)
-  expect(await (await post('audit_admin', '/admin/users/reset-password', reset)).json()).toMatchObject({ success: false, error: { httpStatus: 403 } })
+  expect(await (await post('audit_admin', '/admin/users/reset-password', reset)).json()).toMatchObject({
+    success: false,
+    error: { httpStatus: 403 },
+  })
 })

package/templates/apps/fullstack/packages/{{projectName}}-serv/tsup.config.ts.hbs

@@ -6,13 +6,17 @@ import { resolveBuildMetadata } from '../../scripts/build-metadata.js'
 const buildMetadata = resolveBuildMetadata(fileURLToPath(new URL('.', import.meta.url)))
 
 export default defineConfig({
-  define: { __HAI_BUILD_METADATA__: JSON.stringify(buildMetadata) },
+  define: {
+    __HAI_BUILD_METADATA__: JSON.stringify(buildMetadata),
+  },
   async onSuccess() {
     await writeFile(new URL('./dist/build-metadata.json', import.meta.url), JSON.stringify(buildMetadata))
   },
   entry: ['src/index.ts'],
   format: ['esm'],
-  dts: { compilerOptions: { ignoreDeprecations: '6.0' } },
+  dts: {
+    compilerOptions: { ignoreDeprecations: '6.0' },
+  },
   sourcemap: true,
   clean: true,
 })

package/templates/apps/fullstack/packages/{{projectName}}-serv/vitest.config.ts.hbs

@@ -3,7 +3,9 @@ import { defineConfig } from 'vitest/config'
 import { resolveBuildMetadata } from '../../scripts/build-metadata.js'
 
 export default defineConfig({
-  define: { __HAI_BUILD_METADATA__: JSON.stringify(resolveBuildMetadata(fileURLToPath(new URL('.', import.meta.url)))) },
+  define: {
+    __HAI_BUILD_METADATA__: JSON.stringify(resolveBuildMetadata(fileURLToPath(new URL('.', import.meta.url)))),
+  },
   test: {
     globals: true,
     environment: 'node',

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/api/api-client.ts.hbs

@@ -40,7 +40,12 @@ export async function initializeManagementApi(options: ManagementApiOptions = {}
     clientName: options.clientName ?? '{{fullstack.sharedPackageName}}',
     fetch: createCredentialedFetch(options.fetchFn),
     headers: options.headers,
-    auth: { recoverSession: sessionRecovery.recover, terminalType: options.terminalType ?? 'web', storage: options.tokenStorage, onRefreshFailed: options.onSessionExpired },
+    auth: {
+      recoverSession: sessionRecovery.recover,
+      terminalType: options.terminalType ?? 'web',
+      storage: options.tokenStorage,
+      onRefreshFailed: options.onSessionExpired,
+    },
     transport: { crypto },
   })
 }
@@ -65,7 +70,9 @@ export function resolveAvatarUrl(value: string | undefined): string | undefined
 function resolveDefaultApiOrigin(): string {
   return resolveRuntimeApiOrigin()
     || import.meta.env.PUBLIC_API_BASE
-    || (typeof globalThis.location === 'undefined' ? DEFAULT_API_ORIGIN : globalThis.location.origin)
+    || (typeof globalThis.location === 'undefined'
+      ? DEFAULT_API_ORIGIN
+      : globalThis.location.origin)
 }
 
 /** 跨端浏览器请求携带服务端管理的 httpOnly refresh Cookie。 */

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/api/feedback-client.ts.hbs

@@ -2,12 +2,10 @@
 {{#if features.feedback}}
 import { createFeedbackClient, createFeedbackReview, saveFeedbackFile } from '@h-ai/feedback/client'
 import { managementApi } from './api-client.js'
-
 /** 仅装配共享采集器，不复制采集、脱敏、上传或离线打包逻辑。 */
 export const browserFeedback = createFeedbackClient()
 export const feedbackReview = createFeedbackReview(managementApi.feedback.reports)
 export { feedbackDataBytes } from '@h-ai/feedback/client'
-
 export async function initializeBrowserFeedback(metadata: { appVersion: string, buildId: string, commit: string }): Promise<void> {
   const result = await browserFeedback.init({
     appId: '{{projectName}}',
@@ -26,7 +24,6 @@ export async function initializeBrowserFeedback(metadata: { appVersion: string,
   if (!result.success)
     throw new Error(result.error.message, { cause: result.error })
 }
-
 /** 下载的内容来自受权 API 或本地采集器；对象 URL 在发起后释放。 */
 export async function downloadFeedback(bytes: Uint8Array, name: string, contentType = 'application/zip'): Promise<void> {
   const result = await saveFeedbackFile(bytes, name, contentType)

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/api/sensitive-actions.svelte.ts.hbs

@@ -10,7 +10,19 @@ export const sensitiveActions = createSensitiveActions(authActions)
 /** 用途凭据只传给本次 typed client 调用，不使用共享 header。 */
 export async function requestSensitive<T>(operation: string, run: (options: { context: { reauthentication?: string, reauthorize: () => Promise<string | null | undefined> } }) => Promise<HaiResult<T>>): Promise<HaiResult<T>> {
   const ticket = await sensitiveActions.authorize(operation)
-  if (ticket === null)
-    return err({ code: 'app:cancelled', httpStatus: 400, message: m.security_action_cancelled() })
-  return run({ context: { ...(ticket ? { reauthentication: ticket } : {}), reauthorize: () => sensitiveActions.authorize(operation) } })
+  if (ticket === null) {
+    return err({
+      code: 'app:cancelled',
+      httpStatus: 400,
+      message: m.security_action_cancelled(),
+    })
+  }
+  return run({
+    context: {
+      ...(ticket
+        ? { reauthentication: ticket }
+        : {}),
+      reauthorize: () => sensitiveActions.authorize(operation),
+    },
+  })
 }

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/components/AppShell.svelte.hbs

@@ -30,14 +30,38 @@
   })
   let menuOpen = $state(false)
   const items = $derived([
-    { id: 'users', label: m.nav_users(), icon: 'icon-[tabler--users]' },
-    { id: 'roles', label: m.nav_roles(), icon: 'icon-[tabler--shield-lock]' },
-    { id: 'configuration', label: m.business_settings_title(), icon: 'icon-[tabler--adjustments]' },
-    { id: 'audit', label: m.nav_audit(), icon: 'icon-[tabler--file-text]' },
+    {
+      id: 'users',
+      label: m.nav_users(),
+      icon: 'icon-[tabler--users]',
+    },
+    {
+      id: 'roles',
+      label: m.nav_roles(),
+      icon: 'icon-[tabler--shield-lock]',
+    },
+    {
+      id: 'configuration',
+      label: m.business_settings_title(),
+      icon: 'icon-[tabler--adjustments]',
+    },
+    {
+      id: 'audit',
+      label: m.nav_audit(),
+      icon: 'icon-[tabler--file-text]',
+    },
 {{#if features.feedback}}
-    { id: 'feedback', label: m.nav_feedback(), icon: 'icon-[tabler--message-report]' },
+    {
+      id: 'feedback',
+      label: m.nav_feedback(),
+      icon: 'icon-[tabler--message-report]',
+    },
 {{/if}}
-    { id: 'settings', label: m.settings_title(), icon: 'icon-[tabler--settings]' },
+    {
+      id: 'settings',
+      label: m.settings_title(),
+      icon: 'icon-[tabler--settings]',
+    },
   ].filter(item => store.canOpenPage(item.id)))
   const title = $derived(items.find(item => item.id === store.page)?.label ?? store.info?.name ?? '')
 
@@ -61,7 +85,9 @@
     </div>
     <nav class="flex-1 space-y-1 p-3" aria-label={m.navigation()}>
       {#each items as item (item.id)}
-        <BareButton class="flex w-full items-center gap-3 rounded-lg px-3 py-2.5 text-left text-sm transition-colors {store.page === item.id ? 'bg-primary/10 font-medium text-primary' : 'text-base-content/60 hover:bg-base-content/4'}" onclick={() => navigate(item.id)} data-testid="nav-{item.id}">
+        <BareButton class="flex w-full items-center gap-3 rounded-lg px-3 py-2.5 text-left text-sm transition-colors {store.page === item.id
+? 'bg-primary/10 font-medium text-primary'
+: 'text-base-content/60 hover:bg-base-content/4'}" onclick={() => navigate(item.id)} data-testid="nav-{item.id}">
           <span class="{item.icon} size-4.5"></span>{item.label}
         </BareButton>
       {/each}

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/components/FeedbackEntry.svelte.hbs

@@ -41,7 +41,13 @@
     }
   }
   function input(data: FeedbackFormData) {
-    return { description: data.description, category: data.type, contact: data.contact, files: data.files, removedAttachmentIds: data.removedAttachmentIds }
+    return {
+      description: data.description,
+      category: data.type,
+      contact: data.contact,
+      files: data.files,
+      removedAttachmentIds: data.removedAttachmentIds,
+    }
   }
   async function submit(data: FeedbackFormData) {
     const result = await browserFeedback.submit(input(data))
@@ -82,5 +88,13 @@
 <Button variant='ghost' size='sm' loading={preparing} onclick={() => void prepare()} data-testid='feedback-open'>{m.nav_feedback()}</Button>
 <FeedbackModal bind:open {attachments} budget={browserFeedback.budget} resetKey={draft?.submissionId} onsubmit={submit} oncapture={capturePage} onannotate={annotate} onexport={exportLocal} onfileschange={addFiles}
   evidence={draft?.evidence ?? []}
-  evidenceSummary={draft?.missing.length ? [{ label: m.feedback_logs(), status: 'partial', detail: draft.missing.join(', ') }] : []} />
+  evidenceSummary={draft?.missing.length
+? [
+{
+label: m.feedback_logs(),
+status: 'partial',
+detail: draft.missing.join(', '),
+},
+]
+: []} />
 {{/if}}

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/pages/audit.svelte.hbs

@@ -9,14 +9,44 @@
   const { store }: Props = $props()
   let selected = $state<AdminAuditLog | null>(null)
   const columns = $derived([
-    { key: 'createdAt', sortable: true, label: m.created_at() },
-    { key: 'username', label: m.audit_actor() },
-    { key: 'action', sortable: true, label: m.audit_action() },
-    { key: 'category', sortable: true, label: m.audit_category() },
-    { key: 'outcome', sortable: true, label: m.audit_outcome() },
-    { key: 'severity', sortable: true, label: m.audit_severity() },
-    { key: 'resource', sortable: true, label: m.audit_resource() },
-    { key: 'ipAddress', label: m.audit_ip() },
+    {
+      key: 'createdAt',
+      sortable: true,
+      label: m.created_at(),
+    },
+    {
+      key: 'username',
+      label: m.audit_actor(),
+    },
+    {
+      key: 'action',
+      sortable: true,
+      label: m.audit_action(),
+    },
+    {
+      key: 'category',
+      sortable: true,
+      label: m.audit_category(),
+    },
+    {
+      key: 'outcome',
+      sortable: true,
+      label: m.audit_outcome(),
+    },
+    {
+      key: 'severity',
+      sortable: true,
+      label: m.audit_severity(),
+    },
+    {
+      key: 'resource',
+      sortable: true,
+      label: m.audit_resource(),
+    },
+    {
+      key: 'ipAddress',
+      label: m.audit_ip(),
+    },
   ])
 </script>
 
@@ -30,7 +60,15 @@
       event.preventDefault()
       void store.queryAudit()
     }}>
-      <FilterBar data-testid='audit-filters' activeCount={[store.auditAction, store.auditResource, store.auditStartDate, store.auditEndDate, store.auditCategory, store.auditOutcome, store.auditSeverity].filter(Boolean).length} onreset={() => {
+      <FilterBar data-testid='audit-filters' activeCount={[
+store.auditAction,
+store.auditResource,
+store.auditStartDate,
+store.auditEndDate,
+store.auditCategory,
+store.auditOutcome,
+store.auditSeverity,
+].filter(Boolean).length} onreset={() => {
         store.auditAction = ''
         store.auditResource = ''
         store.auditStartDate = ''
@@ -48,9 +86,60 @@
           <FormField label={m.audit_resource()}><Input size='sm' id="audit-resource" bind:value={store.auditResource} placeholder={m.audit_resource_placeholder()} data-testid="audit-resource" /></FormField>
           <FormField label={m.audit_start()} for="audit-start"><input id="audit-start" type="date" class="input block h-9 min-w-0 w-full" bind:value={store.auditStartDate} /></FormField>
           <FormField label={m.audit_end()} for="audit-end"><input id="audit-end" type="date" class="input block h-9 min-w-0 w-full" bind:value={store.auditEndDate} /></FormField>
-          <FormField label={m.audit_category()}><Select size='sm' bind:value={store.auditCategory} options={[{ value: '', label: m.audit_all() }, { value: 'system', label: m.audit_category_system() }, { value: 'business', label: m.audit_category_business() }]} data-testid='audit-category' /></FormField>
-          <FormField label={m.audit_outcome()}><Select size='sm' bind:value={store.auditOutcome} options={[{ value: '', label: m.audit_all() }, { value: 'success', label: m.audit_success() }, { value: 'failure', label: m.audit_failure() }, { value: 'denied', label: m.audit_denied() }]} data-testid='audit-outcome' /></FormField>
-          <FormField label={m.audit_severity()}><Select size='sm' bind:value={store.auditSeverity} options={[{ value: '', label: m.audit_all() }, { value: 'info', label: m.audit_info() }, { value: 'warning', label: m.audit_warning() }, { value: 'error', label: m.audit_error() }, { value: 'critical', label: m.audit_critical() }]} data-testid='audit-severity' /></FormField>
+          <FormField label={m.audit_category()}><Select size='sm' bind:value={store.auditCategory} options={[
+{
+value: '',
+label: m.audit_all(),
+},
+{
+value: 'system',
+label: m.audit_category_system(),
+},
+{
+value: 'business',
+label: m.audit_category_business(),
+},
+]} data-testid='audit-category' /></FormField>
+          <FormField label={m.audit_outcome()}><Select size='sm' bind:value={store.auditOutcome} options={[
+{
+value: '',
+label: m.audit_all(),
+},
+{
+value: 'success',
+label: m.audit_success(),
+},
+{
+value: 'failure',
+label: m.audit_failure(),
+},
+{
+value: 'denied',
+label: m.audit_denied(),
+},
+]} data-testid='audit-outcome' /></FormField>
+          <FormField label={m.audit_severity()}><Select size='sm' bind:value={store.auditSeverity} options={[
+{
+value: '',
+label: m.audit_all(),
+},
+{
+value: 'info',
+label: m.audit_info(),
+},
+{
+value: 'warning',
+label: m.audit_warning(),
+},
+{
+value: 'error',
+label: m.audit_error(),
+},
+{
+value: 'critical',
+label: m.audit_critical(),
+},
+]} data-testid='audit-severity' /></FormField>
         </FormLayout>
       <div class='w-full space-y-2'>
         <p class='text-xs text-base-content/60'>{m.audit_stats_hint()}</p>
@@ -81,7 +170,9 @@
       <dt>{m.audit_request_id()}</dt><dd class='break-all'>{selected.requestId ?? '—'}</dd>
       <dt>{m.audit_trace_id()}</dt><dd class='break-all'>{selected.traceId ?? '—'}</dd>
       <dt>{m.audit_scope()}</dt><dd class='break-all'>{selected.scopeId ?? '—'}</dd>
-      <dt>{m.audit_actor_snapshot()}</dt><dd class='break-all'>{selected.actorSnapshot ? JSON.stringify(selected.actorSnapshot) : '—'}</dd>
+      <dt>{m.audit_actor_snapshot()}</dt><dd class='break-all'>{selected.actorSnapshot
+? JSON.stringify(selected.actorSnapshot)
+: '—'}</dd>
       <dt class="text-base-content/50">{m.created_at()}</dt><dd>{store.formatDate(selected.createdAt)}</dd>
       <dt class="text-base-content/50">{m.audit_actor()}</dt><dd class="break-all">{selected.username || m.audit_system()}</dd>
       <dt class="text-base-content/50">{m.audit_action()}</dt><dd>{selected.action}</dd>