@h-ai/cli 1.0.0-beta.2 → 1.0.0-beta.20

package/templates/apps/fullstack/e2e/fullstack.spec.ts.hbs

@@ -35,7 +35,13 @@ async function capture(page: Page, name: string, fallback: string) {
     await mkdir(evidence, { recursive: true })
   await expect(page.getByTestId('guide-loading')).toHaveCount(0)
   await page.evaluate(() => document.fonts.ready)
-  await page.screenshot({ path: evidence ? path.join(evidence, name) : fallback, fullPage: true, animations: 'disabled' })
+  await page.screenshot({
+    path: evidence
+      ? path.join(evidence, name)
+      : fallback,
+    fullPage: true,
+    animations: 'disabled',
+  })
 }
 
 async function dismissToasts(page: Page) {
@@ -62,13 +68,18 @@ async function login(page: Page, username: string, password: string, keepGuide =
 async function userEditor(page: Page, username: string) {
   await page.getByTestId('users-search').locator('input').fill(username)
   await page.getByTestId('users-page').getByRole('button', { name: /查询|Search/ }).click()
-  const row = page.getByRole('row').filter({ has: page.getByText(`@${username}`, { exact: true }) })
+  const row = page.getByRole('row').filter({
+    has: page.getByText(`@${username}`, { exact: true }),
+  })
   await expect(row).toBeVisible()
   await row.getByRole('button', { name: /编辑|Edit/, exact: true }).click()
   return row
 }
 
-for (const scenario of [{ offset: -600_000, width: 1440 }, { offset: 600_000, width: 390 }]) {
+for (const scenario of [
+  { offset: -600_000, width: 1440 },
+  { offset: 600_000, width: 390 },
+]) {
   test(`clock offset ${scenario.offset} displays synchronization advice and recovers after correction`, async ({ page }, testInfo) => {
     await page.setViewportSize({ width: scenario.width, height: 900 })
     await page.addInitScript((offset) => {
@@ -78,6 +89,8 @@ for (const scenario of [{ offset: -600_000, width: 1440 }, { offset: 600_000, wi
     await page.goto('./')
     const advice = page.getByRole('alert').filter({ hasText: /同步|synchron|時刻/i })
     await expect(advice).toBeVisible()
+    await expect(advice).toContainText(/\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} UTC/)
+    await expect(advice).toContainText(/请开启设备的自动校时或手工修改时间|set your device time manually|手動で時刻を設定/i)
     await expect(advice).toContainText(/刷新|refresh|再読み込み/i)
     await capture(page, `clock-skew-${scenario.width}.png`, testInfo.outputPath(`clock-skew-${scenario.width}.png`))
     // 校时后由用户明确刷新；不能自动重放之前失败的业务请求。
@@ -97,10 +110,11 @@ test('service health endpoint is ready', async ({ request }) => {
 })
 
 test('service rejects plaintext business requests', async ({ request }) => {
-  const response = await request.post(`${apiBaseUrl}${apiPrefix}${apiContract.pathOf({{fullstack.contractExportName}}.app.echo)}`, { data: { message: 'hello e2e' } })
+  const response = await request.post(`${apiBaseUrl}${apiPrefix}${apiContract.pathOf({{fullstack.contractExportName}}.app.echo)}`, {
+    data: { message: 'hello e2e' },
+  })
   expect(response.status()).toBe(400)
 })
-
 {{#if fullstack.e2eFrontend}}
 test('hash routing and responsive workspace preserve usable content width', async ({ page }, testInfo) => {
   await page.goto('./#/roles?source=direct')
@@ -287,7 +301,11 @@ const additionalFrontends = [
 
 for (const frontend of additionalFrontends) {
   test(`${frontend.target} preview supports login, tour, help and profile navigation`, async ({ browser }, testInfo) => {
-    const page = await browser.newPage({ viewport: frontend.target === 'app' ? { width: 390, height: 844 } : { width: 1440, height: 960 } })
+    const page = await browser.newPage({
+      viewport: frontend.target === 'app'
+        ? { width: 390, height: 844 }
+        : { width: 1440, height: 960 },
+    })
     const pageErrors: string[] = []
     page.on('pageerror', error => pageErrors.push(error.message))
     try {
@@ -327,11 +345,17 @@ test('shared authentication supports public registration with configuration', as
   await mkdir(evidence, { recursive: true })
   await page.goto('./')
   await expect(page.getByTestId('login-form')).toBeVisible()
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-login.png'), fullPage: true })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-login.png'),
+    fullPage: true,
+  })
   await page.getByRole('button', { name: /立即注册|Register now/i }).click()
   const registerForm = page.locator('.register-form')
   await expect(registerForm.locator('#register-username')).toBeVisible()
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-register.png'), fullPage: true })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-register.png'),
+    fullPage: true,
+  })
   const username = `signup${randomUUID().replaceAll('-', '').slice(0, 12)}`
   await registerForm.locator('#register-username').fill(username)
   await registerForm.locator('#register-email').fill(`${username}@example.com`)
@@ -345,7 +369,10 @@ test('shared authentication supports public registration with configuration', as
   const email = `${username}@example.com`
   await page.getByTestId('logout').click()
   await page.getByRole('button', { name: /邮件验证码|Email code/i, exact: true }).click()
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-email.png'), fullPage: true })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-email.png'),
+    fullPage: true,
+  })
   await page.locator('#login-username').fill(email)
   await page.getByRole('button', { name: /发送验证码|Send code/i, exact: true }).click()
   await expect(page.getByRole('button', { name: /秒后重发|Resend in/ })).toBeDisabled()
@@ -361,14 +388,20 @@ test('shared authentication supports public registration with configuration', as
   await expect(page.getByTestId('settings-page')).toBeVisible()
   await page.getByTestId('logout').click()
   await page.getByRole('button', { name: /忘记密码|Forgot password/i }).click()
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-forgot.png'), fullPage: true })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-forgot.png'),
+    fullPage: true,
+  })
   await page.locator('input[type="email"]').fill(email)
   await page.locator('button[type="submit"]').click()
   await expect(page.locator('.hai-toast-item[data-variant="success"]')).toBeVisible()
   const reset = await received('password_reset')
   expect(Boolean(reset?.token)).toBe(true)
   await page.getByRole('button', { name: /已有重置令牌|I have a reset token/i }).click()
-  await page.screenshot({ path: path.join(evidence, '{{projectName}}-reset.png'), fullPage: true })
+  await page.screenshot({
+    path: path.join(evidence, '{{projectName}}-reset.png'),
+    fullPage: true,
+  })
   await page.goto(`./?token=${encodeURIComponent(reset?.token ?? '')}`)
   await expect(page.locator('input[type="password"]').nth(0)).toBeVisible()
   await page.locator('input[type="password"]').nth(0).fill('FullstackReset456')
@@ -399,7 +432,12 @@ test('frontend displays configured core metadata and restores the administrator
   const evidence = process.env.HAI_AUTH_EVIDENCE_DIR
   if (evidence)
     await mkdir(evidence, { recursive: true })
-  await page.screenshot({ path: evidence ? path.join(evidence, '{{projectName}}-users.png') : testInfo.outputPath('users.png'), fullPage: true })
+  await page.screenshot({
+    path: evidence
+      ? path.join(evidence, '{{projectName}}-users.png')
+      : testInfo.outputPath('users.png'),
+    fullPage: true,
+  })
   await page.getByTestId('logout').click()
   await expect(page.getByTestId('login-form')).toBeVisible()
 })
@@ -522,9 +560,13 @@ test('audit filters collapse without losing values and fit compact workspaces',
     await page.setViewportSize({ width, height: 900 })
     if (width < 1024)
       await expect.poll(() => page.locator('aside').evaluate(sidebar => sidebar.getBoundingClientRect().right)).toBeLessThanOrEqual(1)
-    const controls = await page.getByTestId('audit-advanced').evaluate(panel => [...panel.querySelectorAll('input')].map((element) => {
+    const controls = await page.getByTestId('audit-advanced').evaluate(panel => [
+      ...panel.querySelectorAll('input'),
+    ].map((element) => {
       // 复合控件的点击框包含边框和留白，内部文字输入区不等于完整控件高度。
-      const control = element.closest('.fieldset') ? element.parentElement! : element
+      const control = element.closest('.fieldset')
+        ? element.parentElement!
+        : element
       const rect = control.getBoundingClientRect()
       return { left: rect.left, right: rect.right, height: rect.height }
     }))
@@ -540,7 +582,13 @@ test('audit filters collapse without losing values and fit compact workspaces',
       if (evidence)
         await mkdir(evidence, { recursive: true })
       const file = `{{projectName}}-audit-${width}.png`
-      await page.screenshot({ path: evidence ? path.join(evidence, file) : testInfo.outputPath(file), fullPage: true, animations: 'disabled' })
+      await page.screenshot({
+        path: evidence
+          ? path.join(evidence, file)
+          : testInfo.outputPath(file),
+        fullPage: true,
+        animations: 'disabled',
+      })
     }
   }
   const reset = page.waitForResponse(response => new URL(response.url()).pathname.endsWith('/admin/audit/list'))
@@ -561,7 +609,11 @@ test('audit filters collapse without losing values and fit compact workspaces',
   await toggle.click()
   await page.getByTestId('audit-page').getByRole('button', { name: /详情|Details/ }).first().click()
   await expect(page.getByRole('dialog')).toBeVisible()
-  await page.screenshot({ path: testInfo.outputPath('audit-short-table-details.png'), fullPage: true, animations: 'disabled' })
+  await page.screenshot({
+    path: testInfo.outputPath('audit-short-table-details.png'),
+    fullPage: true,
+    animations: 'disabled',
+  })
 })
 
 test('administrator manages every duty through one lifecycle and the shared password reset form', async ({ page, browser }, testInfo) => {
@@ -647,7 +699,7 @@ test('administrator manages every duty through one lifecycle and the shared pass
   await expect(row).toHaveCount(0)
 })
 
-test('administrator and user complete account, avatar, preference, password and audit workflows', async ({ page, browser }) => {
+test('administrator and user complete account, avatar, preference, password and audit workflows', async ({ page, browser }, testInfo) => {
   test.setTimeout(120_000)
   const username = `member-${randomUUID().slice(0, 8)}`
   const password = 'User-test-Pass123!'
@@ -716,8 +768,16 @@ test('administrator and user complete account, avatar, preference, password and
     await userPage.getByRole('option', { name: 'English', exact: true }).click()
     await expect(userPage.getByTestId('nav-settings')).toHaveText('Personal settings')
     await expect(userPage.locator('html')).toHaveAttribute('lang', 'en-US')
-    const themes = [{{#each fullstack.theme.themes}}'{{this}}'{{#unless @last}}, {{/unless}}{{/each}}]
-    const selectedTheme = themes.includes('formal') ? 'formal' : themes.includes('high-contrast') ? 'high-contrast' : themes.find(theme => theme !== '{{fullstack.theme.defaultTheme}}') ?? themes[0]
+    const themes = [
+{{#each fullstack.theme.themes}}
+      '{{this}}',
+{{/each}}
+    ]
+    const selectedTheme = themes.includes('formal')
+      ? 'formal'
+      : themes.includes('high-contrast')
+        ? 'high-contrast'
+        : themes.find(theme => theme !== '{{fullstack.theme.defaultTheme}}') ?? themes[0]
     await userPage.getByTestId('profile-theme').click()
     await userPage.getByRole('option').nth(themes.indexOf(selectedTheme)).click()
     await expect(userPage.locator('html')).toHaveAttribute('data-theme', selectedTheme)
@@ -727,6 +787,20 @@ test('administrator and user complete account, avatar, preference, password and
     await expect(userPage.getByTestId('settings-page')).toBeVisible()
     await expect(userPage.getByTestId('nav-settings')).toHaveText('Personal settings')
     await expect(userPage.locator('html')).toHaveAttribute('data-theme', selectedTheme)
+    if (themes.includes('eye-care')) {
+      await userPage.getByTestId('profile-theme').click()
+      await userPage.getByRole('option', { name: 'Eye care', exact: true }).click()
+      await expect(userPage.locator('html')).toHaveAttribute('data-theme', 'eye-care')
+      await userPage.reload()
+      await expect(userPage.getByTestId('settings-page')).toBeVisible()
+      await expect(userPage.locator('html')).toHaveAttribute('data-theme', 'eye-care')
+      await expect.poll(() => userPage.evaluate(() => getComputedStyle(document.documentElement).colorScheme)).toBe('light')
+      await expect.poll(() => userPage.evaluate(() => getComputedStyle(document.documentElement).getPropertyValue('--color-base-100').trim())).toBe('#e8f0df')
+      await userPage.screenshot({
+        path: testInfo.outputPath('fullstack-eye-care.png'),
+        animations: 'disabled',
+      })
+    }
     await expect(userPage.getByTestId('profile-form').locator('input[name="displayName"]')).toHaveValue('Updated member')
     await expect(userPage.getByTestId('profile-form').locator('input[name="email"]')).toHaveValue('')
     await expect.poll(() => userPage.getByTestId('profile-form').locator('img').evaluate((image: HTMLImageElement) => image.complete && image.naturalWidth > 0)).toBe(true)
@@ -805,6 +879,8 @@ test('administrator and user complete account, avatar, preference, password and
 {{#if fullstack.e2eFrontend}}
 
 test('feedback submits an empty description and business operator can process and reopen it', async ({ page }, testInfo) => {
+  // 附件脱敏、桌面/手机截图和导出校验共用完整流程预算，目录代理也执行相同断言。
+  test.setTimeout(120_000)
   await page.goto('./')
   await login(page, 'business_operator', businessOperatorPassword)
   const feedbackImage = Buffer.from(await page.evaluate(() => {
@@ -853,7 +929,11 @@ test('feedback submits an empty description and business operator can process an
   await dialog.locator('input[type=file]').setInputFiles([
     { name: 'attached-preview.png', mimeType: 'image/png', buffer: feedbackImage },
     { name: 'attached-large-log.txt', mimeType: 'text/plain', buffer: feedbackLog },
-    { name: 'discarded.txt', mimeType: 'text/plain', buffer: Buffer.from('discarded local material') },
+    {
+      name: 'discarded.txt',
+      mimeType: 'text/plain',
+      buffer: Buffer.from('discarded local material'),
+    },
   ])
   const uploaded = dialog.locator('img[alt="attached-preview.png"]')
   await expect(uploaded).toBeVisible()
@@ -861,7 +941,10 @@ test('feedback submits an empty description and business operator can process an
   await expectDialogViewport()
   await expectUncovered(uploaded)
   await capture(page, 'feedback-image-before-mask.png', testInfo.outputPath('feedback-image-before-mask.png'))
-  await uploaded.screenshot({ path: testInfo.outputPath('feedback-image-before-mask-detail.png'), animations: 'disabled' })
+  await uploaded.screenshot({
+    path: testInfo.outputPath('feedback-image-before-mask-detail.png'),
+    animations: 'disabled',
+  })
   const originalPreview = await uploaded.getAttribute('src')
   await dialog.getByRole('button', { name: /遮挡敏感区域|Mask sensitive area|機密情報を隠す/ }).last().click()
   await dialog.getByRole('button', { name: /应用标注|Apply annotation|注釈を適用/ }).last().click()
@@ -886,7 +969,15 @@ test('feedback submits an empty description and business operator can process an
   await expectDialogViewport()
   await expectUncovered(uploaded)
   await capture(page, 'feedback-preview.png', testInfo.outputPath('feedback-preview.png'))
-  await uploaded.screenshot({ path: testInfo.outputPath('feedback-image-after-mask-detail.png'), animations: 'disabled' })
+  await uploaded.screenshot({
+    path: testInfo.outputPath('feedback-image-after-mask-detail.png'),
+    animations: 'disabled',
+  })
+  // 回执只表示记录已受理；等这份大附件真正上传成功，再开始后台处理操作。
+  const largeUpload = page.waitForResponse(response => response.request().method() === 'POST'
+    && /\/feedback\/reports\/[^/]+\/attachments\/[^/]+$/.test(new URL(response.url()).pathname)
+    && (response.request().postDataBuffer()?.byteLength ?? 0) > 2 * 1024 * 1024, { timeout: 60_000 })
+    .then(response => ({ response }), (error: unknown) => ({ error }))
   await dialog.getByRole('button', { name: /提交反馈|Submit Feedback|フィードバックを送信/ }).click()
   await expect(dialog.getByTestId('feedback-receipt')).toContainText(/FB-/)
   const number = (await dialog.getByTestId('feedback-receipt').textContent())?.match(/FB-[A-Za-z0-9-]+/)?.[0]
@@ -895,13 +986,20 @@ test('feedback submits an empty description and business operator can process an
     throw new Error('Feedback receipt number is missing')
   await expectDialogViewport()
   await capture(page, 'feedback-accepted.png', testInfo.outputPath('feedback-accepted.png'))
+  const completedUpload = await largeUpload
+  if ('error' in completedUpload)
+    throw completedUpload.error
+  expect(completedUpload.response.status()).toBe(200)
   await dialog.getByRole('button', { name: /关闭|Close|閉じる/ }).filter({ hasText: /关闭|Close|閉じる/ }).click()
   await page.getByTestId('nav-feedback').click()
   await expect(page.getByTestId('feedback-page')).toBeVisible()
   const row = page.getByRole('row').filter({ hasText: number })
   await expect(row).toBeVisible()
-  await row.getByRole('button', { name: /标记已处理|Mark handled|処理済み/ }).click()
-  await expect(row).toContainText(/已处理|Handled|処理済み/)
+  const handled = page.waitForResponse(response => response.request().method() === 'PATCH' && new URL(response.url()).pathname.endsWith('/status'))
+  await row.getByRole('button', { name: /标记已处理|Mark(?: as)? handled|処理済み/ }).click()
+  expect((await handled).status()).toBe(200)
+  // 仅核对状态徽标；“标记已处理”按钮本身也包含“已处理”，不能据此放行。
+  await expect(row.getByText(/^(已处理|Handled|処理済み)$/)).toBeVisible()
   await row.getByRole('button', { name: /撤销处理|Reopen|処理を取り消す/ }).scrollIntoViewIfNeeded()
   await capture(page, 'feedback-handled.png', testInfo.outputPath('feedback-handled.png'))
   await row.getByRole('button', { name: /撤销处理|Reopen|処理を取り消す/ }).click()
@@ -945,7 +1043,12 @@ test('feedback submits an empty description and business operator can process an
   const serverManifest: { version: string } = JSON.parse(await readFile(path.resolve('packages/{{projectName}}-serv/package.json'), 'utf8'))
   let expectedCommit = 'unknown'
   try {
-    execFileSync('git', ['ls-files', '--error-unmatch', '--', 'package.json'], { stdio: 'pipe', windowsHide: true })
+    execFileSync('git', [
+      'ls-files',
+      '--error-unmatch',
+      '--',
+      'package.json',
+    ], { stdio: 'pipe', windowsHide: true })
     expectedCommit = execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8', stdio: 'pipe', windowsHide: true }).trim()
   }
   catch { /* 无 Git 的源码归档必须明确保留 unknown，不冒用父工程提交。 */ }
@@ -954,7 +1057,10 @@ test('feedback submits an empty description and business operator can process an
     expect(expectedCommit).toMatch(/^(?:[a-f\d]{40}|[a-f\d]{64})$/i)
     expect(browserManifest.version).not.toBe(serverManifest.version)
   }
-  for (const [metadata, version] of [[browserMetadata, browserManifest.version], [serverMetadata, serverManifest.version]] as const) {
+  for (const [metadata, version] of [
+    [browserMetadata, browserManifest.version],
+    [serverMetadata, serverManifest.version],
+  ] as const) {
     expect(Object.keys(metadata).sort()).toEqual(['appVersion', 'buildId', 'commit'])
     expect(metadata.appVersion).toBe(version)
     expect(metadata.buildId).toMatch(/^[\w.+-]{1,160}$/)
@@ -966,7 +1072,10 @@ test('feedback submits an empty description and business operator can process an
   expect(browserEnvironment?.data).toMatchObject(browserMetadata)
   expect(serverEnvironment?.data.service).toMatchObject(serverMetadata)
   expect(bundle.report).toMatchObject(browserMetadata)
-  await testInfo.attach('feedback-build-metadata', { body: JSON.stringify({ browser: browserMetadata, server: serverMetadata }), contentType: 'application/json' })
+  await testInfo.attach('feedback-build-metadata', {
+    body: JSON.stringify({ browser: browserMetadata, server: serverMetadata }),
+    contentType: 'application/json',
+  })
   expect(bundle.report.number).toBe(number)
   expect(bundle.manifest.reportId).toBe(bundle.report.id)
   expect(bundle.manifest.evidenceRevision).toBe(bundle.report.evidenceRevision)
@@ -982,7 +1091,10 @@ test('feedback submits an empty description and business operator can process an
     throw new Error('The exported large log attachment is missing')
   expect(bundle.files[largeLog.path]).toEqual(new Uint8Array(feedbackLog))
   expect(bundle.manifest.files.some(file => file.name === 'discarded.txt')).toBe(false)
-  await testInfo.attach('feedback-export-masked', { body: Buffer.from(bundle.files[masked.path]!), contentType: 'image/png' })
+  await testInfo.attach('feedback-export-masked', {
+    body: Buffer.from(bundle.files[masked.path]!),
+    contentType: 'image/png',
+  })
 })
 {{/if}}
 {{/if}}

package/templates/apps/fullstack/e2e/session-close.spec.ts.hbs

@@ -20,8 +20,13 @@ async function login(page: Page, username = 'admin', initialPassword = process.e
   // 每例使用独立初始账号，真实完成服务端限制下的首次改密后才能建立普通会话。
   await expect(page.locator('#old-password')).toBeVisible()
   await expect(page.getByTestId('logout')).toHaveCount(0)
-  await page.screenshot({ path: test.info().outputPath('initial-password-renewal.png'), fullPage: true })
-  const form = page.locator('form').filter({ has: page.locator('#old-password') })
+  await page.screenshot({
+    path: test.info().outputPath('initial-password-renewal.png'),
+    fullPage: true,
+  })
+  const form = page.locator('form').filter({
+    has: page.locator('#old-password'),
+  })
   const error = page.locator('.hai-toast-item[data-variant=error]')
   await dismissToasts(page)
   // 同密码仍由服务端拒绝，显示安全原因与关联编号；本地确认不一致则直接提示字段。
@@ -34,7 +39,10 @@ async function login(page: Page, username = 'admin', initialPassword = process.e
   await error.getByRole('button', { name: /^(查看排查信息|View diagnostic details|調査情報を表示)$/ }).click()
   await expect(error.locator('code')).toHaveText(/^[\w.:-]{1,128}$/)
   await expect(page.getByTestId('logout')).toHaveCount(0)
-  await page.screenshot({ path: test.info().outputPath('initial-password-same.png'), fullPage: true })
+  await page.screenshot({
+    path: test.info().outputPath('initial-password-same.png'),
+    fullPage: true,
+  })
   await expect(form.locator('.alert-error')).toHaveCount(0)
   await dismissToasts(page)
   const password = `${initialPassword}-Renewed!`
@@ -100,13 +108,19 @@ test('server idle expiry opens normal login in place and resumes one rejected sa
   const dialog = page.getByTestId('session-recovery-dialog')
   await expect(dialog).toBeVisible()
   await expect(page.getByTestId('business-notice-input').locator('textarea')).toHaveValue(draft)
-  await page.screenshot({ path: test.info().outputPath('idle-session-recovery.png'), fullPage: true })
+  await page.screenshot({
+    path: test.info().outputPath('idle-session-recovery.png'),
+    fullPage: true,
+  })
   const form = dialog.locator('form.login-form')
   await form.locator('input[type=password]').fill('Incorrect-test-password!')
   await form.locator('button[type=submit]').click()
   await expect(page.locator('.hai-toast-item[data-variant=error]')).toBeVisible()
   await expect(page.locator('.hai-toast-item[data-variant=error]')).toBeInViewport({ ratio: 1 })
-  await page.screenshot({ path: test.info().outputPath('idle-session-recovery-error-toast.png'), fullPage: true })
+  await page.screenshot({
+    path: test.info().outputPath('idle-session-recovery-error-toast.png'),
+    fullPage: true,
+  })
   expect(statuses).toHaveLength(1)
   await form.locator('input[type=password]').fill(password)
   await form.locator('button[type=submit]').click()

package/templates/apps/fullstack/eslint.config.js.hbs

@@ -3,7 +3,9 @@ import { haiQualityConfig } from './eslint-rules.js'
 
 export default antfu({
   // unused-imports 使用 TS 规则，JS 同样使用 TS parser 以保持 scope 契约一致。
-  typescript: { files: [GLOB_SRC] },
+  typescript: {
+    files: [GLOB_SRC],
+  },
   formatters: true,
   ignores: [
     '**/build/**',

package/templates/apps/fullstack/images/serv.Dockerfile.hbs

@@ -1,6 +1,5 @@
-FROM node:24.22.1-bookworm-slim AS build
-ARG SQLITE_PREBUILD_MIRROR=
-ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
+ARG HAI_NODE_IMAGE=node:24.22.1-bookworm-slim
+FROM ${HAI_NODE_IMAGE} AS build
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
@@ -8,20 +7,29 @@ ENV CI=true
 ENV ONNXRUNTIME_NODE_INSTALL_CUDA=skip
 WORKDIR /workspace
 
-RUN corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
+ARG HAI_NPM_REGISTRY=https://registry.npmjs.org
+ARG COREPACK_NPM_REGISTRY=$HAI_NPM_REGISTRY
+ARG npm_config_registry=$HAI_NPM_REGISTRY
+ARG pnpm_config_registry=$HAI_NPM_REGISTRY
+RUN node -e "const p=process.env.HTTPS_PROXY||process.env.HTTP_PROXY;if(p){const u=new URL(p);const s=require('node:net').connect({host:u.hostname,port:Number(u.port||(u.protocol==='https:'?443:80))});s.setTimeout(3000);s.on('connect',()=>s.end());const fail=()=>{process.stderr.write('Build proxy is unreachable from the container. Check the host address and proxy listener.\\n');process.exit(1)};s.on('error',fail);s.on('timeout',fail)}" && corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
 COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY images/dependencies/ ./
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --ignore-scripts
-COPY . .
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --reporter=append-only --ignore-scripts
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --reporter=append-only --offline --frozen-lockfile --ignore-scripts
+COPY tsconfig.base.json ./
+COPY scripts/ ./scripts/
+COPY packages/{{projectName}}-contract/ ./packages/{{projectName}}-contract/
+COPY packages/{{projectName}}-serv/ ./packages/{{projectName}}-serv/
 ARG HAI_BUILD_ID=
 ARG HAI_BUILD_COMMIT=unknown
 RUN HAI_BUILD_ID="$HAI_BUILD_ID" HAI_BUILD_COMMIT="$HAI_BUILD_COMMIT" pnpm --filter {{fullstack.servPackageName}}... --if-present build
 
-RUN --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds if [ -d node_modules/better-sqlite3 ]; then cd node_modules/better-sqlite3; for attempt in 1 2 3; do node -e "require('node:child_process').execFileSync(process.execPath,[require.resolve('prebuild-install/bin.js'),'--verbose'],{stdio:'inherit'})" && break; [ "$attempt" = 3 ] && exit 1; sleep 3; done; fi
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store --mount=type=cache,id={{projectName}}-sqlite,target=/root/.npm/_prebuilds pnpm pm deploy --filter {{fullstack.servPackageName}} --prod /prod/service
+# SQLite 13 的原生二进制随 npm 包交付，在构建时验证实际加载。
+RUN if [ -d node_modules/better-sqlite3 ]; then node -e "const Database=require('better-sqlite3');const db=new Database(':memory:');db.prepare('SELECT 1').get();db.close()"; fi
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm pm deploy --filter {{fullstack.servPackageName}} --prod /prod/service
+RUN rm -f /prod/service/README* && find /prod/service/dist -type f \( -name '*.map' -o -name '*.d.ts' -o -name '*.d.mts' -o -name '*.d.cts' \) -delete
 
-FROM node:24.22.1-bookworm-slim AS service
+FROM ${HAI_NODE_IMAGE} AS service
 
 ENV NODE_ENV=production
 ENV HOST=0.0.0.0
@@ -34,5 +42,5 @@ RUN mkdir -p /app/data && chown node:node /app/data
 USER node
 EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
-  CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+  CMD node -e "(async () => { try { const { core } = await import('@h-ai/core'); const { ServConfigSchema } = await import('@h-ai/serv'); core.init({ configDir: './config', configSchemas: { serv: ServConfigSchema } }); const { server, http } = ServConfigSchema.parse(core.config.getOrThrow('serv')); if (http.health === false) process.exit(0); const response = await fetch('http://127.0.0.1:' + server.port + http.health.path, { signal: AbortSignal.timeout(4000) }); process.exit(response.ok ? 0 : 1); } catch { process.exit(1); } })()"
 CMD ["node", "dist/index.js"]

package/templates/apps/fullstack/images/web.Dockerfile.hbs

@@ -1,25 +1,33 @@
+ARG HAI_NODE_IMAGE=node:24.22.1-bookworm-slim
+ARG HAI_NGINX_IMAGE=nginxinc/nginx-unprivileged:1.29.8-alpine
 {{#if fullstack.frontends.web}}
-FROM node:24.22.1-bookworm-slim AS build
-ARG SQLITE_PREBUILD_MIRROR=
-ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
+FROM ${HAI_NODE_IMAGE} AS build
 
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
 ENV CI=true
 WORKDIR /workspace
 
-RUN corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
+ARG HAI_NPM_REGISTRY=https://registry.npmjs.org
+ARG COREPACK_NPM_REGISTRY=$HAI_NPM_REGISTRY
+ARG npm_config_registry=$HAI_NPM_REGISTRY
+ARG pnpm_config_registry=$HAI_NPM_REGISTRY
+RUN node -e "const p=process.env.HTTPS_PROXY||process.env.HTTP_PROXY;if(p){const u=new URL(p);const s=require('node:net').connect({host:u.hostname,port:Number(u.port||(u.protocol==='https:'?443:80))});s.setTimeout(3000);s.on('connect',()=>s.end());const fail=()=>{process.stderr.write('Build proxy is unreachable from the container. Check the host address and proxy listener.\\n');process.exit(1)};s.on('error',fail);s.on('timeout',fail)}" && corepack enable && corepack prepare pnpm@12.11.2 --activate && pnpm config set store-dir /pnpm/store
 COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY images/dependencies/ ./
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --ignore-scripts
-COPY . .
-RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --offline --frozen-lockfile --ignore-scripts
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm fetch --reporter=append-only --ignore-scripts
+RUN --mount=type=cache,id={{projectName}}-pnpm,target=/pnpm/store pnpm install --reporter=append-only --offline --frozen-lockfile --ignore-scripts
+COPY tsconfig.base.json ./
+COPY scripts/ ./scripts/
+COPY packages/{{projectName}}-contract/ ./packages/{{projectName}}-contract/
+COPY packages/{{projectName}}-shared/ ./packages/{{projectName}}-shared/
+COPY apps/{{projectName}}-web/ ./apps/{{projectName}}-web/
 ARG HAI_BUILD_ID=
 ARG HAI_BUILD_COMMIT=unknown
 ARG PUBLIC_BASE_PATH=
 RUN pnpm --filter {{fullstack.sharedPackageName}} paraglide:compile && HAI_BUILD_ID="$HAI_BUILD_ID" HAI_BUILD_COMMIT="$HAI_BUILD_COMMIT" PUBLIC_BASE_PATH="$PUBLIC_BASE_PATH" pnpm --filter {{projectName}}-web... --if-present build
 
-FROM nginxinc/nginx-unprivileged:1.29.8-alpine AS web
+FROM ${HAI_NGINX_IMAGE} AS web
 
 ENV PUBLIC_API_BASE=
 ENV NGINX_ENVSUBST_FILTER=PUBLIC_API_BASE_BASE64
@@ -30,6 +38,7 @@ COPY images/web/nginx.conf /etc/nginx/conf.d/default.conf
 COPY --chmod=755 images/web/19-runtime-config.envsh /docker-entrypoint.d/19-runtime-config.envsh
 COPY images/web/runtime-config.js.template /etc/nginx/templates/runtime-config.js.template
 COPY --from=build /workspace/apps/{{projectName}}-web/dist /usr/share/nginx/html
+RUN find /usr/share/nginx/html -type f -name '*.map' -delete
 
 EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \

package/templates/apps/fullstack/package.json.hbs

@@ -26,7 +26,7 @@
     "lint:fix": "eslint *.js *.ts e2e --fix && pnpm -r --if-present lint:fix",
     "test": "pnpm --filter {{fullstack.contractPackageName}} build && pnpm i18n:compile && pnpm -r --if-present test",
     "test:watch": "pnpm -r --parallel --if-present test:watch",
-    "test:e2e": "pnpm compile && node scripts/run-e2e.mjs --config playwright.config.ts{{#if fullstack.e2eFrontend}} --next --config playwright.session-close.config.ts{{/if}}",
+    "test:e2e": "pnpm compile && node scripts/run-e2e.mjs --config playwright.config.ts{{#if fullstack.e2eFrontend}} --next --e2e-group=session-close --config playwright.config.ts{{/if}}",
     "clean": "pnpm -r --if-present clean && rimraf node_modules .turbo"
   },
   "dependencies": {
@@ -35,6 +35,7 @@
     "{{fullstack.sharedPackageName}}": "workspace:*"
   },
   "devDependencies": {
+    "@h-ai/core": "{{haiPackageSpecifier}}",
     "@h-ai/cli": "{{haiPackageSpecifier}}",
 {{#if features.feedback}}
     "@h-ai/feedback": "{{haiPackageSpecifier}}",

package/templates/apps/fullstack/packages/{{projectName}}-contract/README.md.hbs

@@ -14,6 +14,13 @@
 
 ### 骨架说明
 
+| 功能 | 输入示例 | 成功输出与边界 |
+| --- | --- | --- |
+| app.info | 无业务参数 | notice、名称/版本/环境、语言、启动时间及frontends；只返回公开元信息 |
+| app.echo | `{ message: 'hello' }`，1–200字符 | 相同message、echoedAt、requestId；演示回显，不持久化 |
+| admin契约 | 用户、角色、审计、公告或个人设置操作参数 | 受当前身份/权限与资源范围约束的HaiResult；先检查success再读data |
+| 工程聚合 | app/admin及框架模块contract | Serv和所有前端共用类型，契约声明不会自动授予权限 |
+
 - `src/app-schemas.ts`：跨接口、跨层复用的输入/数据 Schema 与类型。
 - `src/app-contract.ts`：app 领域 contract；每个业务 path 直接写在对应接口定义中。
 - `src/admin-schemas.ts` / `src/admin-contract.ts`：示例管理员用户、系统/审计/配置/业务操作员及基础成员角色、账号生命周期、邀请、用户列表服务端排序、审计分类/列头排序/统计/备份、业务公告和个人设置、加密 JSON 头像上传 Schema/类型/路由；认证复用框架的 IAM auth contract，通过服务端配置启用注册、密码/LDAP/验证码登录及密码重置。
@@ -23,11 +30,6 @@
 API 前缀、健康检查与跨端 Header 等传输配置位于 serv 包的 `config/_serv.yml`。
 `SUPPORTED_LOCALES` 为生成时实际编译的语言列表；`app.info` 中名称、版本、环境、默认语言来自后端 core 配置。更新公开契约时同时更新 serv、shared typed API client、各端 UI 与测试。
 
-### 开发
-
-- `pnpm --filter {{fullstack.contractPackageName}} typecheck`
-- `pnpm --filter {{fullstack.contractPackageName}} test`
-
 ## 开发测试
 
 ```sh