@h-ai/cli 1.0.0-beta.18 → 1.0.0-beta.19

package/templates/base/e2e/app.spec.ts.hbs

@@ -12,7 +12,7 @@ import { expect, test } from '@playwright/test'
 {{#if_eq appType 'h5'}}
 /** 延迟客户端脚本，覆盖 SSR 已显示而事件尚未绑定的阶段。 */
 async function whileClientBootPaused(page: Page, inspect: () => Promise<void>) {
-  let resumeClient = () => {}
+  let resumeClient = () => { }
   const clientBoot = new Promise<void>((resolve) => {
     resumeClient = resolve
   })
@@ -29,7 +29,6 @@ async function whileClientBootPaused(page: Page, inspect: () => Promise<void>) {
     await page.unrouteAll({ behavior: 'wait' })
   }
 }
-
 {{/if_eq}}
 {{#if_eq appType 'admin'}}
 test('high contrast appearance is selectable and survives reload', async ({ page }) => {
@@ -51,7 +50,6 @@ test('high contrast appearance is selectable and survives reload', async ({ page
   expect(await header.locator('button').first().evaluate(element => getComputedStyle(element).borderTopLeftRadius)).toBe('0px')
 })
 {{/if_eq}}
-
 {{#if hasUi}}
 {{#unless isCapacitorApp}}
 test('eye care appearance is selectable and survives reload', async ({ page }, testInfo) => {
@@ -73,19 +71,28 @@ test('eye care appearance is selectable and survives reload', async ({ page }, t
   await expect(page.locator('html')).toHaveAttribute('data-theme', 'eye-care')
   await expect.poll(() => page.evaluate(() => getComputedStyle(document.documentElement).colorScheme)).toBe('light')
   await expect.poll(() => page.evaluate(() => getComputedStyle(document.documentElement).getPropertyValue('--color-base-100').trim())).toBe('#e8f0df')
-  await page.screenshot({ path: testInfo.outputPath('eye-care-desktop.png'), animations: 'disabled' })
+  await page.screenshot({
+    path: testInfo.outputPath('eye-care-desktop.png'),
+    animations: 'disabled',
+  })
   await page.setViewportSize({ width: 390, height: 844 })
   expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
-  await page.screenshot({ path: testInfo.outputPath('eye-care-mobile.png'), animations: 'disabled' })
+  await page.screenshot({
+    path: testInfo.outputPath('eye-care-mobile.png'),
+    animations: 'disabled',
+  })
 })
 {{/unless}}
 {{/if}}
-
 {{#if_eq appType 'h5'}}
-test.use({ viewport: { width: 390, height: 844 } })
+test.use({
+  viewport: { width: 390, height: 844 },
+})
 {{/if_eq}}
 {{#if isCapacitorApp}}
-test.use({ viewport: { width: 390, height: 844 } })
+test.use({
+  viewport: { width: 390, height: 844 },
+})
 {{/if}}
 
 /** 首页从真实浏览器页面发起，覆盖基础渲染链路。 */
@@ -137,7 +144,11 @@ test('home page renders from browser', async ({ page }) => {
   const evidence = process.env.HAI_AUTH_EVIDENCE_DIR || path.resolve('test-results/auth-screenshots')
   await mkdir(evidence, { recursive: true })
   await page.evaluate(() => document.fonts.ready)
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-home.png'), fullPage: true, animations: 'disabled' })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-home.png'),
+    fullPage: true,
+    animations: 'disabled',
+  })
 })
 {{#if features.iam}}
 
@@ -156,21 +167,30 @@ test('configured IAM registration and password login', async ({ page, context })
   await expect(page.locator('#login-username')).toBeVisible()
   await expect(page.locator('header').first()).toBeVisible()
   await expect(page.locator('footer')).toBeVisible()
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-login.png'), fullPage: true })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-login.png'),
+    fullPage: true,
+  })
   await page.getByRole('{{#if isCapacitorApp}}button{{else}}link{{/if}}', { name: /立即注册|Register now/i }).click()
 {{#unless isCapacitorApp}}
   await expect(page).toHaveURL(/\/auth\/register(?:\?|$)/)
 {{/unless}}
   const registerForm = page.locator('.register-form')
   await expect(registerForm.locator('#register-username')).toBeVisible()
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-register.png'), fullPage: true })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-register.png'),
+    fullPage: true,
+  })
   if (process.env.IAM_NOTIFICATION_URL) {
     // 协议弹窗留在认证页，关闭后继续填写注册表单。
     await registerForm.getByRole('button', { name: /用户协议|Terms of Service/i, exact: true }).click()
     await expect(page.getByRole('dialog')).toBeVisible()
     await expect(page.getByRole('dialog').getByRole('heading', { name: 'Configured registration agreement' })).toBeVisible()
     await expect(page.locator('iframe')).toHaveCount(0)
-    await page.screenshot({ path: path.join(evidence, '{{projectName}}-agreement.png'), fullPage: true })
+    await page.screenshot({
+      path: path.join(evidence, '{{projectName}}-agreement.png'),
+      fullPage: true,
+    })
     await page.keyboard.press('Escape')
     await expect(page.getByRole('dialog')).not.toBeVisible()
   }
@@ -193,7 +213,11 @@ test('configured IAM registration and password login', async ({ page, context })
   await expect(page.getByTestId('profile-theme')).toBeVisible()
   await expect(page.locator('html')).toHaveAttribute('data-theme', 'eye-care')
   await expect.poll(() => page.evaluate(() => getComputedStyle(document.documentElement).getPropertyValue('--color-base-100').trim())).toBe('#e8f0df')
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-eye-care.png'), fullPage: true, animations: 'disabled' })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-eye-care.png'),
+    fullPage: true,
+    animations: 'disabled',
+  })
 {{else}}
   // 通过页面 fetch 复用 Cookie 与已安装的传输加密，避免 HTTP 辅助客户端绕过浏览器协议。
   const me = await page.evaluate(async url => (await fetch(url)).status, new URL('./api/auth/me', test.info().project.use.baseURL).href)
@@ -215,7 +239,10 @@ test('configured IAM registration and password login', async ({ page, context })
   await page.reload()
   await page.goto(authUrl)
   await page.getByRole('button', { name: /邮件验证码|Email code/i, exact: true }).click()
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-email.png'), fullPage: true })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-email.png'),
+    fullPage: true,
+  })
   const email = `${username}@example.com`
   await page.locator('#login-username').fill(email)
   await page.getByRole('button', { name: /发送验证码|Send code/i, exact: true }).click()
@@ -234,14 +261,20 @@ test('configured IAM registration and password login', async ({ page, context })
   await page.reload()
   await page.goto(authUrl)
   await page.getByRole('button', { name: /忘记密码|Forgot password/i }).click()
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-forgot.png'), fullPage: true })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-forgot.png'),
+    fullPage: true,
+  })
   await page.locator('input[type="email"]').fill(email)
   await page.locator('button[type="submit"]').click()
   await expect(page.locator('.hai-toast-item[data-variant="success"]')).toBeVisible()
   const reset = await received('password_reset')
   expect(Boolean(reset?.token)).toBe(true)
   await page.getByRole('button', { name: /已有重置令牌|I have a reset token/i }).click()
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-reset.png'), fullPage: true })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-reset.png'),
+    fullPage: true,
+  })
   const resetUrl = `{{#if isCapacitorApp}}/{{else}}/auth/reset-password{{/if}}?token=${encodeURIComponent(reset?.token ?? '')}`
 {{#if_eq appType 'h5'}}
   await whileClientBootPaused(page, async () => {

package/templates/base/eslint-rules.js

@@ -11,35 +11,54 @@ export const haiQualityConfig = {
   rules: {
     'no-console': ['error', {}],
     'ts/no-explicit-any': 'error',
-    'ts/ban-ts-comment': ['error', {
-      'ts-ignore': true,
-      'ts-nocheck': true,
-      'ts-check': false,
-      'ts-expect-error': 'allow-with-description',
-      'minimumDescriptionLength': 10,
-    }],
+    'ts/ban-ts-comment': [
+      'error',
+      {
+        'ts-ignore': true,
+        'ts-nocheck': true,
+        'ts-check': false,
+        'ts-expect-error': 'allow-with-description',
+        'minimumDescriptionLength': 10,
+      },
+    ],
     'eslint-comments/no-unlimited-disable': 'error',
     'eslint-comments/require-description': 'error',
     // 只禁内部源码/构建目录，公开的 /client、/adapter 等 exports 子路径可用。
-    'no-restricted-imports': ['error', {
-      patterns: [{
-        group: ['@h-ai/*/src', '@h-ai/*/src/**', '@h-ai/*/dist', '@h-ai/*/dist/**'],
+    'no-restricted-imports': [
+      'error',
+      {
+        patterns: [
+          {
+            group: [
+              '@h-ai/*/src',
+              '@h-ai/*/src/**',
+              '@h-ai/*/dist',
+              '@h-ai/*/dist/**',
+            ],
+            message: 'Use the public exports of hai packages instead of their src/dist internals.',
+          },
+        ],
+      },
+    ],
+    'no-restricted-syntax': [
+      'error',
+      {
+        selector: ':matches(TSAsExpression, TSTypeAssertion)[expression.typeAnnotation.type="TSUnknownKeyword"]',
+        message: 'Use the real upstream type or narrow unknown. Explain necessary third-party workarounds with a scoped lint exception.',
+      },
+      {
+        selector: 'ImportExpression[source.value=/^@h-ai\\/[^/]+\\/(src|dist)(\\/|$)/]',
         message: 'Use the public exports of hai packages instead of their src/dist internals.',
-      }],
-    }],
-    'no-restricted-syntax': ['error', {
-      selector: ':matches(TSAsExpression, TSTypeAssertion)[expression.typeAnnotation.type="TSUnknownKeyword"]',
-      message: 'Use the real upstream type or narrow unknown. Explain necessary third-party workarounds with a scoped lint exception.',
-    }, {
-      selector: 'ImportExpression[source.value=/^@h-ai\\/[^/]+\\/(src|dist)(\\/|$)/]',
-      message: 'Use the public exports of hai packages instead of their src/dist internals.',
-    }, {
+      },
+      {
       // 仅识别明确的静态敏感键；变量键、别名及业务敏感程度仍需审查。
-      selector: 'CallExpression[callee.property.name="setItem"][callee.object.name="localStorage"][arguments.0.value=/^(token|password|secret|api[_-]?key|(access|refresh|auth|session)[_-]?token)$/i]',
-      message: 'Keep sensitive tokens in memory, httpOnly cookies or a secure native TokenStore instead of localStorage.',
-    }, {
-      selector: 'CallExpression[callee.property.name="setItem"][callee.object.property.name="localStorage"][arguments.0.value=/^(token|password|secret|api[_-]?key|(access|refresh|auth|session)[_-]?token)$/i]',
-      message: 'Keep sensitive tokens in memory, httpOnly cookies or a secure native TokenStore instead of localStorage.',
-    }],
+        selector: 'CallExpression[callee.property.name="setItem"][callee.object.name="localStorage"][arguments.0.value=/^(token|password|secret|api[_-]?key|(access|refresh|auth|session)[_-]?token)$/i]',
+        message: 'Keep sensitive tokens in memory, httpOnly cookies or a secure native TokenStore instead of localStorage.',
+      },
+      {
+        selector: 'CallExpression[callee.property.name="setItem"][callee.object.property.name="localStorage"][arguments.0.value=/^(token|password|secret|api[_-]?key|(access|refresh|auth|session)[_-]?token)$/i]',
+        message: 'Keep sensitive tokens in memory, httpOnly cookies or a secure native TokenStore instead of localStorage.',
+      },
+    ],
   },
 }

package/templates/base/eslint.config.js.hbs

@@ -9,7 +9,9 @@ import { haiQualityConfig } from './eslint-rules.js'
 
 export default antfu({
   // unused-imports 使用 TS 规则，JS 同样使用 TS parser 以保持 scope 契约一致。
-  typescript: { files: [GLOB_SRC] },
+  typescript: {
+    files: [GLOB_SRC],
+  },
   formatters: true,
   ignores: [
 {{#unless isSvelteOnlyApp}}

package/templates/base/images/web.Dockerfile.hbs

@@ -36,8 +36,6 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD wget -q -O /dev/null http://127.0.0.1:8080/health || exit 1
 {{else}}
 FROM ${HAI_NODE_IMAGE} AS build
-ARG SQLITE_PREBUILD_MIRROR=
-ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
@@ -59,8 +57,9 @@ ARG HAI_BUILD_ID=
 ARG HAI_BUILD_COMMIT=unknown
 ARG PUBLIC_BASE_PATH=
 RUN HAI_BUILD_ID="$HAI_BUILD_ID" HAI_BUILD_COMMIT="$HAI_BUILD_COMMIT" PUBLIC_BASE_PATH="$PUBLIC_BASE_PATH" pnpm compile
-RUN --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds if [ -d node_modules/better-sqlite3 ]; then cd node_modules/better-sqlite3; for attempt in 1 2 3; do node -e "require('node:child_process').execFileSync(process.execPath,[require.resolve('prebuild-install/bin.js'),'--verbose'],{stdio:'inherit'})" && break; [ "$attempt" = 3 ] && exit 1; sleep 3; done; fi
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds pnpm pm deploy --filter {{projectName}} --prod /prod/app
+# SQLite 13 的原生二进制随 npm 包交付，在构建时验证实际加载。
+RUN if [ -d node_modules/better-sqlite3 ]; then node -e "const Database=require('better-sqlite3');const db=new Database(':memory:');db.prepare('SELECT 1').get();db.close()"; fi
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm pm deploy --filter {{projectName}} --prod /prod/app
 RUN rm -f /prod/app/README* && find /prod/app/build -type f \( -name '*.map' -o -name '*.d.ts' -o -name '*.d.mts' -o -name '*.d.cts' \) -delete
 
 FROM ${HAI_NODE_IMAGE} AS runtime-base

package/templates/base/package.json.hbs

@@ -1,13 +1,14 @@
 {
   "engines": { "node": "^22.23.4 || ^24.22.1 || ^26.12.1" },
   "name": "{{projectName}}",
-  "version": "1.0.0-beta.18",
+  "version": "1.0.0-beta.19",
   "private": true,
   "packageManager": "pnpm@12.11.2",
   "description": "{{#if_eq appType 'admin'}}Enterprise management system built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'website'}}Enterprise website built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'h5'}}Mobile H5 app built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'api'}}REST API service built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'mobile-app'}}Mobile app built with hai Agent Framework{{/if_eq}}",
   "keywords": ["hai", {{#unless isSvelteOnlyApp}}"sveltekit", {{/unless}}"svelte5", "{{appType}}"],
   "license": "Apache-2.0",
   "type": "module",
+  "imports": { "#lib/*": "./src/lib/*" },
 {{#unless isSvelteOnlyApp}}
   "files": [
     "build",
@@ -38,8 +39,8 @@
     "typecheck": "{{#if hasI18n}}pnpm paraglide:compile && {{/if}}{{#if isSvelteOnlyApp}}svelte-check --tsconfig ./tsconfig.json{{else}}svelte-kit sync && svelte-check --tsconfig ./tsconfig.json{{/if}}",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
-    "test": "{{#if hasI18n}}pnpm paraglide:compile && {{/if}}vitest run",
-    "test:watch": "vitest",
+    "test": "{{#if hasI18n}}pnpm paraglide:compile && {{/if}}{{#unless isSvelteOnlyApp}}svelte-kit sync && {{/unless}}vitest run",
+    "test:watch": "{{#if hasI18n}}pnpm paraglide:compile && {{/if}}{{#unless isSvelteOnlyApp}}svelte-kit sync && {{/unless}}vitest",
     "test:e2e": "node scripts/run-e2e.mjs",
     "clean": "{{#if isSvelteOnlyApp}}rimraf dist build .turbo src/lib/paraglide{{else}}rimraf .svelte-kit build .turbo{{/if}}"{{#if isCapacitorApp}},
     "cap:add:android": "cap add android",
@@ -87,7 +88,7 @@
     "@h-ai/capacitor": "{{haiPackageSpecifier}}"{{/if}}{{#if isCapacitorApp}}{{#unless features.api-client}},
     "@h-ai/api-client": "{{haiPackageSpecifier}}"{{/unless}}{{#unless features.capacitor}},
     "@h-ai/capacitor": "{{haiPackageSpecifier}}"{{/unless}}{{/if}},
-    "sm-crypto": "0.5.7",
+    "sm-crypto": "0.5.8",
     "zod": "{{versions.zod}}"
 {{/if}}
   },

package/templates/base/patches/daisyui-5.7.50.patch

@@ -0,0 +1,8 @@
+diff --git a/utilities/join/object.js b/utilities/join/object.js
+--- a/utilities/join/object.js
++++ b/utilities/join/object.js
+@@ -1 +1 @@
+-export default {".join":{"display":"inline-flex","align-items":"stretch","--join-ss":"0","--join-se":"0","--join-es":"0","--join-ee":"0","--join-ml":"0","--join-mt":"0","--join-v":"0","--join-h":"1","@scope (&)":{"> :where(:focus, :has(:focus))":{"z-index":2},"@media (hover: hover)":{"> :where(.btn:hover, :has(.btn:hover))":{"z-index":1}},":where(:scope > :first-child)":{"--join-ss":"var(--radius-field)","--join-se":"calc(var(--radius-field) * var(--join-v))","--join-es":"calc(var(--radius-field) * var(--join-h))","--join-ee":"0"},":where(:scope > :last-child)":{"--join-ss":"0","--join-se":"calc(var(--radius-field) * var(--join-h))","--join-es":"calc(var(--radius-field) * var(--join-v))","--join-ee":"var(--radius-field)"},":where(:scope > :only-child)":{"--join-ss":"var(--radius-field)","--join-se":"var(--radius-field)","--join-es":"var(--radius-field)","--join-ee":"var(--radius-field)"},":where(:scope > :not(:first-child))":{"--join-ml":"calc(var(--border, 1px) * -1 * var(--join-h))","--join-mt":"calc(var(--border, 1px) * -1 * var(--join-v))"}}},".join-item":{"@layer daisyui.l1.l2.l3.l4":{"> *":{"--join-ss":"initial","--join-se":"initial","--join-es":"initial","--join-ee":"initial"}},"border-style":"solid","border-width":"var(--border, 1px)","border-start-start-radius":"var(--join-ss)","border-start-end-radius":"var(--join-se)","border-end-start-radius":"var(--join-es)","border-end-end-radius":"var(--join-ee)","&:not(:disabled, [disabled], .btn-disabled)":{"margin-inline-start":"var(--join-ml, 0)","margin-block-start":"var(--join-mt, 0)"},"&:is(:disabled, [disabled], .btn-disabled)":{"border-width":"var(--border, 1px)","border-inline-end-width":"calc(var(--border, 1px) * var(--join-v))","border-block-end-width":"calc(var(--border, 1px) * var(--join-h))"}},".join-vertical":{"flex-direction":"column","--join-v":"1","--join-h":"0"},".join-horizontal":{"flex-direction":"row","--join-v":"0","--join-h":"1"}};
+
++export default {".join":{"display":"inline-flex","align-items":"stretch","--join-ss":"0","--join-se":"0","--join-es":"0","--join-ee":"0","--join-ml":"0","--join-mt":"0","--join-v":"0","--join-h":"1","@scope (&)":{":where(:scope) > :where(:focus, :has(:focus))":{"z-index":2},"@media (hover: hover)":{":where(:scope) > :where(.btn:hover, :has(.btn:hover))":{"z-index":1}},":where(:scope > :first-child)":{"--join-ss":"var(--radius-field)","--join-se":"calc(var(--radius-field) * var(--join-v))","--join-es":"calc(var(--radius-field) * var(--join-h))","--join-ee":"0"},":where(:scope > :last-child)":{"--join-ss":"0","--join-se":"calc(var(--radius-field) * var(--join-h))","--join-es":"calc(var(--radius-field) * var(--join-v))","--join-ee":"var(--radius-field)"},":where(:scope > :only-child)":{"--join-ss":"var(--radius-field)","--join-se":"var(--radius-field)","--join-es":"var(--radius-field)","--join-ee":"var(--radius-field)"},":where(:scope > :not(:first-child))":{"--join-ml":"calc(var(--border, 1px) * -1 * var(--join-h))","--join-mt":"calc(var(--border, 1px) * -1 * var(--join-v))"}}},".join-item":{"@layer daisyui.l1.l2.l3.l4":{"> *":{"--join-ss":"initial","--join-se":"initial","--join-es":"initial","--join-ee":"initial"}},"border-style":"solid","border-width":"var(--border, 1px)","border-start-start-radius":"var(--join-ss)","border-start-end-radius":"var(--join-se)","border-end-start-radius":"var(--join-es)","border-end-end-radius":"var(--join-ee)","&:not(:disabled, [disabled], .btn-disabled)":{"margin-inline-start":"var(--join-ml, 0)","margin-block-start":"var(--join-mt, 0)"},"&:is(:disabled, [disabled], .btn-disabled)":{"border-width":"var(--border, 1px)","border-inline-end-width":"calc(var(--border, 1px) * var(--join-v))","border-block-end-width":"calc(var(--border, 1px) * var(--join-h))"}},".join-vertical":{"flex-direction":"column","--join-v":"1","--join-h":"0"},".join-horizontal":{"flex-direction":"row","--join-v":"0","--join-h":"1"}};
+

package/templates/base/patches/deepmerge-4.3.1.patch

@@ -0,0 +1,51 @@
+diff --git a/index.js b/index.js
+--- a/index.js
++++ b/index.js
+@@ -55,11 +55,12 @@
+ 	var destination = {}
+ 	if (options.isMergeableObject(target)) {
+ 		getKeys(target).forEach(function(key) {
++			if (key === '__proto__') return
+ 			destination[key] = cloneUnlessOtherwiseSpecified(target[key], options)
+ 		})
+ 	}
+ 	getKeys(source).forEach(function(key) {
+-		if (propertyIsUnsafe(target, key)) {
++		if (key === '__proto__' || propertyIsUnsafe(target, key)) {
+ 			return
+ 		}
+ 
+diff --git a/dist/cjs.js b/dist/cjs.js
+--- a/dist/cjs.js
++++ b/dist/cjs.js
+@@ -80,11 +80,12 @@
+ 	var destination = {};
+ 	if (options.isMergeableObject(target)) {
+ 		getKeys(target).forEach(function(key) {
++			if (key === '__proto__') return
+ 			destination[key] = cloneUnlessOtherwiseSpecified(target[key], options);
+ 		});
+ 	}
+ 	getKeys(source).forEach(function(key) {
+-		if (propertyIsUnsafe(target, key)) {
++		if (key === '__proto__' || propertyIsUnsafe(target, key)) {
+ 			return
+ 		}
+ 
+diff --git a/dist/umd.js b/dist/umd.js
+--- a/dist/umd.js
++++ b/dist/umd.js
+@@ -84,11 +84,12 @@
+ 		var destination = {};
+ 		if (options.isMergeableObject(target)) {
+ 			getKeys(target).forEach(function(key) {
++			if (key === '__proto__') return
+ 				destination[key] = cloneUnlessOtherwiseSpecified(target[key], options);
+ 			});
+ 		}
+ 		getKeys(source).forEach(function(key) {
+-			if (propertyIsUnsafe(target, key)) {
++			if (key === '__proto__' || propertyIsUnsafe(target, key)) {
+ 				return
+ 			}
+ 

package/templates/base/playwright.config.ts

@@ -24,7 +24,9 @@ function resolvePortFromBaseUrl(urlString: string, fallbackPort: string): string
       return url.port
     }
 
-    return url.protocol === 'https:' ? '443' : '80'
+    return url.protocol === 'https:'
+      ? '443'
+      : '80'
   }
   catch {
     return fallbackPort

package/templates/base/pnpm-workspace.yaml.hbs

@@ -1,6 +1,6 @@
 {{! @skipIfEmpty }}
 {{#if useCatalogProtocol}}
-shellEmulator: true
+minimumReleaseAgeExcludePrune: true
 
 trustPolicy: no-downgrade
 # 上游构建工具仍要求 4.x；4.0.3 tarball 已核对原 lockfile 的 SHA-512。
@@ -9,32 +9,49 @@ trustPolicyExclude:
 
 # pnpm 12 配置；原生依赖仅运行明确列出的安装脚本。
 nodeLinker: hoisted
-allowBuilds:
-  cpu-features: true
-  onnxruntime-node: true
-  protobufjs: true
-  ssh2: true
-  vue-demi: true
-  better-sqlite3: true
-  esbuild: true
-  core-js: false
+shellEmulator: true
+
+packages:
+  - .
 
+# 构建与浏览器依赖的安全修复；版本与框架工作区同步维护。
 overrides:
-  "@ai-sdk/provider-utils@>=4.0.0 <4.0.33": 4.0.57
+  '@ai-sdk/provider-utils@>=4.0.0 <4.0.33': 4.0.57
+  '@types/node': {{versions.nodeTypes}}
+  body-parser@>=2 <2.4.0: 2.4.0
   cookie@<0.7.0: 0.7.2
+  dompurify@>=3 <3.4.17: 3.4.17
   esbuild@<0.28.1: 0.28.2
+  fast-uri@>=3 <3.1.9: 3.1.9
+  follow-redirects@>=1.16.0 <1.16.2: 1.16.2
+  glob@>=9 <=14.0.1: 14.0.4
+  ip-address@<=10.7.3: 10.7.6
   katex@<0.18.2: 0.18.10
+  minimatch@>=7 <11.0.1: 11.0.5
+  parse5@>=8 <8.1.0: 8.1.0
+  qs@>=6.7 <6.16.1: 6.17.1
+  runed@<0.38.0: 0.38.0
   sharp@<0.35.5: 0.35.5
   tinypool@<2.1.2: 2.2.0
-  '@qdrant/js-client-rest>undici': 7.30.0
   xcode>uuid: 11.1.1
-  "@types/node": "{{versions.nodeTypes}}"
 
-packages:
-  - .
+{{#if hasUi}}
+patchedDependencies:
+  daisyui@5.7.50: patches/daisyui-5.7.50.patch
+  deepmerge@4.3.1: patches/deepmerge-4.3.1.patch
+{{/if}}
+
+allowBuilds:
+  core-js: false
+  cpu-features: true
+  esbuild: true
+  onnxruntime-node: true
+  protobufjs: true
+  ssh2: true
+  vue-demi: true
 
 catalog:
 {{#each haiCatalogPackages}}
-  '{{@key}}': {{this}}
+  {{{yaml @key this}}}
 {{/each}}
 {{/if}}

package/templates/base/src/app.d.ts.hbs

@@ -27,5 +27,5 @@ declare global {
   }
 }
 
-export {}
+export { }
 {{/unless}}

package/templates/base/src/hooks.server.ts.hbs

@@ -3,28 +3,22 @@
  * {{projectName}} - Server Hooks
  * =============================================================================
  */
-
 {{#if features.crypto}}
 import type { TransportEncryptionOptions } from '@h-ai/kit'
 {{/if}}
-import type { Handle } from '@sveltejs/kit'
+import type { Handle } from '@sveltejs/kit/hooks'
 import process from 'node:process'
 {{#if hasI18n}}
-import { base } from '$app/paths'
+import { resolve as resolvePath } from '$app/paths'
 {{else}}
 {{#if features.iam}}
-import { base } from '$app/paths'
+import { resolve as resolvePath } from '$app/paths'
 {{else}}
 {{#if features.crypto}}
-import { base } from '$app/paths'
-{{/if}}
+import { resolve as resolvePath } from '$app/paths'
 {{/if}}
 {{/if}}
-{{#if hasI18n}}
-import { paraglideMiddleware } from '$lib/paraglide/server.js'
 {{/if}}
-import { closeApp, initApp } from '$lib/server/init.js'
-import { getKitConfig } from '$lib/server/kit-config.js'
 {{#if features.cache}}
 import { cache } from '@h-ai/cache'
 {{/if}}
@@ -41,6 +35,11 @@ import { kit } from '@h-ai/kit'
 import { reldb } from '@h-ai/reldb'
 {{/if}}
 {{/if}}
+{{#if hasI18n}}
+import { paraglideMiddleware } from '#lib/paraglide/server.js'
+{{/if}}
+import { closeApp, initApp } from '#lib/server/init.js'
+import { getKitConfig } from '#lib/server/kit-config.js'
 
 // =============================================================================
 // 应用初始化
@@ -74,7 +73,6 @@ const initHandle: Handle = async ({ event, resolve }) => {
   await ensureAppInitialized()
   return resolve(event)
 }
-
 {{#if hasI18n}}
 // =============================================================================
 // Paraglide i18n Middleware
@@ -86,7 +84,7 @@ const initHandle: Handle = async ({ event, resolve }) => {
  * API 请求跳过 paraglideMiddleware（不需要页面级 locale + 避免消耗 body）
  */
 const i18nHandle: Handle = async ({ event, resolve }) => {
-  if (event.url.pathname.startsWith(`${base}/api/`)) {
+  if (event.url.pathname.startsWith(`${resolvePath('/').replace(/\/$/, '')}/api/`)) {
     const locale = event.cookies.get('PARAGLIDE_LOCALE') ?? '{{defaultLocale}}'
     event.locals.locale = locale
     return kit.i18n.runWithLocale(locale, () => resolve(event))
@@ -99,7 +97,6 @@ const i18nHandle: Handle = async ({ event, resolve }) => {
     }))
   })
 }
-
 {{/if}}
 // =============================================================================
 // hai Handle（会话验证 + 限流 + 日志）
@@ -113,20 +110,20 @@ const haiHandle: Handle = async (input) => {
     let transport: TransportEncryptionOptions | undefined
     if (settings.transport !== false) {
 {{#unless features.db}}
-      if (core.module.requiresSharedState(process.env))
-        throw new Error('Production transport requires the db feature and a shared database registry')
+          if (core.module.requiresSharedState(process.env))
+            throw new Error('Production transport requires the db feature and a shared database registry')
 {{/unless}}
       const ring = parseTransportServerKeyRing(process.env.HAI_CRYPTO_TRANSPORT_SERVERKEYRING)
       if (!ring.success)
         throw new Error(`HAI_CRYPTO_TRANSPORT_SERVERKEYRING: ${ring.error.message} (${ring.error.code})`)
       transport = {
         ...settings.transport,
-        basePath: base,
+        basePath: resolvePath('/').replace(/\/$/, ''),
         serverKeyRing: ring.data,
 {{#if features.db}}
         keyStore: createReldbTransportKeyStore({ reldb, ttlSeconds: 3600 }),
 {{else}}
-        keyStore: createInMemoryKeyStore(),
+            keyStore: createInMemoryKeyStore(),
 {{/if}}
       }
     }
@@ -140,7 +137,7 @@ const haiHandle: Handle = async (input) => {
 {{#if features.crypto}}
       crypto: { crypto, transport },
 {{/if}}
-    {{#if features.iam}}
+{{#if features.iam}}
       auth: {
         verifyToken: async (token) => {
           const result = await iam.auth.verifyToken(token)
@@ -156,18 +153,27 @@ const haiHandle: Handle = async (input) => {
             data: session.data,
           }
         },
-        loginUrl: `${base}/auth/login`,
-        protectedPaths: ['/admin/*', '/api/*'].map(path => `${base}${path}`),
-        publicPaths: [...kit.auth.publicPaths, '/api/auth/logout', '/api/public/*', '/api/health'].map(path => `${base}${path}`),
+        loginUrl: `${resolvePath('/').replace(/\/$/, '')}/auth/login`,
+        protectedPaths: ['/admin/*', '/api/*'].map(path => `${resolvePath('/').replace(/\/$/, '')}${path}`),
+        publicPaths: [
+          ...kit.auth.publicPaths,
+          '/api/auth/logout',
+          '/api/public/*',
+          '/api/health',
+        ].map(path => `${resolvePath('/').replace(/\/$/, '')}${path}`),
         operations: () => iam.auth,
       },
-    {{/if}}
-    {{#if features.cache}}
-      rateLimit: { windowMs: 60000, maxRequests: 200, store: kit.middleware.createCacheRateLimitStore(cache, { namespace: '{{projectName}}', allowMemory: process.env.NODE_ENV !== 'production' || process.env.HAI_E2E === '1' }) },
-    {{else}}
+{{/if}}
+{{#if features.cache}}
+      rateLimit: {
+        windowMs: 60000,
+        maxRequests: 200,
+        store: kit.middleware.createCacheRateLimitStore(cache, { namespace: '{{projectName}}', allowMemory: process.env.NODE_ENV !== 'production' || process.env.HAI_E2E === '1' }),
+      },
+{{else}}
       // 未选择cache能力时不启用限流；启用前须接入共享原子store。
       rateLimit: false,
-    {{/if}}
+{{/if}}
       logging: { logBody: false },
       onError: (error: unknown, _event) => {
         core.logger.error('Request error:', { error })
@@ -176,7 +182,10 @@ const haiHandle: Handle = async (input) => {
             success: false,
             error: core.error.toPublic({ code: 'INTERNAL_ERROR', message: '', httpStatus: 500 }),
           }),
-          { status: 500, headers: { 'Content-Type': 'application/json' } },
+          {
+            status: 500,
+            headers: { 'Content-Type': 'application/json' },
+          },
         )
       },
     })

package/templates/base/src/lib/build-metadata.ts.hbs

@@ -2,6 +2,5 @@
 {{#if features.feedback}}
 /** 当前应用编译时烘焙的产物身份；运行时配置不能覆盖。 */
 declare const __HAI_BUILD_METADATA__: { appVersion: string, buildId: string, commit: string }
-
 export const buildMetadata = __HAI_BUILD_METADATA__
 {{/if}}