@jumentix/cli-init 0.0.0

package/templates/backend/src/shared/utils.ts

@@ -0,0 +1,77 @@
+import {
+  _VALIDATION_ERROR_NAME_,
+  _DOMAIN_VALIDATION_ERROR_NAME_,
+  _FORBIDDEN_ERROR_NAME_,
+  _NOT_FOUND_ERROR_NAME_,
+  _DOMAIN_NOT_FOUND_ERROR_NAME_,
+  _DATABASE_NOT_FOUND_ERROR_NAME_,
+  _DATABASE_CONFLICT_ERROR_NAME_,
+  _EVENT_INVALID_MESSAGE_,
+  _UNAUTHORIZED_ERROR_NAME_,
+  _INFRA_NOT_IMPLEMENTED_,
+  _DATABASE_PAGING_ERROR_,
+  _LOCKED_RESOURCE_ERROR_NAME_
+
+} from '@src/config/constants';
+import { BaseError, EErrorNumberCodes, EErrorStringCodes } from '@src/infra/exceptions';
+
+export function replaceVars(path: string): string {
+  return path.toString().replace(/{/g, ':').replace(/}/g, '');
+}
+
+export function toHttpStatus(stringCode: EErrorStringCodes): number {
+  return EErrorNumberCodes[stringCode as any] as unknown as number;
+}
+
+export function formatErrorMessage(error: BaseError) {
+  let message: string = '';
+  if (
+    error.name === _VALIDATION_ERROR_NAME_
+    || error.name === _DOMAIN_VALIDATION_ERROR_NAME_
+    || error.name === _EVENT_INVALID_MESSAGE_
+    || error.name === _DATABASE_PAGING_ERROR_
+  ) {
+    message = `Bad Request - ${error.message}`;
+  } else if (error.name === _FORBIDDEN_ERROR_NAME_) {
+    message = `Forbidden - ${error.message}`;
+  } else if (error.name === _UNAUTHORIZED_ERROR_NAME_) {
+    message = `Unauthorized - ${error.message}`;
+  } else if (error.name === _LOCKED_RESOURCE_ERROR_NAME_) {
+    message = `Locked - ${error.message}`;
+  } else if (
+    error.name === _NOT_FOUND_ERROR_NAME_
+    || error.name === _DOMAIN_NOT_FOUND_ERROR_NAME_
+    || error.name === _DATABASE_NOT_FOUND_ERROR_NAME_
+  ) {
+    message = `Not Found - ${error.message}`;
+  } else if (error.name === _DATABASE_CONFLICT_ERROR_NAME_) {
+    message = `Conflict - ${error.message}`;
+  } else if (error.name === _INFRA_NOT_IMPLEMENTED_) {
+    message = `Not Implemented - ${error.message}`;
+  }
+
+  return message;
+}
+
+export function isProductionEnv(env: NodeJS.ProcessEnv = process.env): boolean {
+  const nodeEnv = String(env.NODE_ENV || '').trim().toLowerCase();
+  return nodeEnv === 'prod' || nodeEnv === 'production';
+}
+
+export function shouldExposeInternalErrors(env: NodeJS.ProcessEnv = process.env): boolean {
+  return !isProductionEnv(env);
+}
+
+export function buildErrorResponsePayload(
+  error: BaseError,
+  env: NodeJS.ProcessEnv = process.env
+): Record<string, unknown> {
+  const payload: Record<string, unknown> = {
+    message: formatErrorMessage(error),
+    correlationId: error.correlationId || undefined
+  };
+  if (shouldExposeInternalErrors(env)) {
+    payload.error = error;
+  }
+  return payload;
+}

package/templates/backend/src/shared/validators/index.ts

@@ -0,0 +1,118 @@
+import {
+  _PASSWORD_MIN_LENGTH_
+} from '@src/config/constants';
+import { DomainNotFoundError, DomainValidationError } from '@src/infra/exceptions';
+import { readProductEnv } from '@src/interface/runtime/RuntimeEnvironment';
+
+export function throwIfNotFound(found: boolean) {
+  if (!found) {
+    throw new DomainNotFoundError('Record not found');
+  }
+}
+
+export function throwIfValuesAreDifferent(values: any[]) {
+  const set = new Set(values);
+  if (set.size === values.length) {
+    throw new DomainValidationError('The provided values are different');
+  }
+}
+
+export function throwIfIsNotObject(field: string, value: any) {
+  if (
+    (typeof value !== 'object')
+    || (typeof value === 'object' && Array.isArray(value))
+  ) {
+    throw new DomainValidationError(`The property ${field} must be an object`);
+  }
+}
+
+export function canNotWriteDirectly(field: string) {
+  throw new DomainValidationError(`The property ${field} can not be directly changed`);
+}
+
+export function mustBeNumeric(field: string, value: number) {
+  if (typeof value !== 'number') throw new DomainValidationError(`${field} must be a number`);
+}
+
+export function mustBePassword(field: string, value: string) {
+  if (typeof value !== 'string') {
+    throw new DomainValidationError(`${field} must be a string.`);
+  }
+  if (value.length < _PASSWORD_MIN_LENGTH_) {
+    throw new DomainValidationError(`${field} must have at least 8 chars.`);
+  }
+
+  const strictPasswordPolicy = String(readProductEnv(process.env, 'JUMENTIX_STRICT_PASSWORD_POLICY') || '').toLowerCase() === 'yes';
+  if (!strictPasswordPolicy) return;
+
+  if (!/[A-Z]/.test(value)) throw new DomainValidationError(`${field} must include at least one uppercase letter.`);
+  if (!/[a-z]/.test(value)) throw new DomainValidationError(`${field} must include at least one lowercase letter.`);
+  if (!/[0-9]/.test(value)) throw new DomainValidationError(`${field} must include at least one number.`);
+  if (!/[^A-Za-z0-9]/.test(value)) throw new DomainValidationError(`${field} must include at least one symbol.`);
+}
+
+export function mustBeArray<T>(field: string, value: T[]) {
+  if (!Array.isArray(value)) throw new DomainValidationError(`${field} must be an array`);
+}
+
+export function mustBeGreaterThanZero(field: string, value: number) {
+  let msg = '';
+  if (typeof value !== 'number') {
+    msg = `${field} must be a number.`;
+  }
+  if (value <= 0) {
+    msg = `${field} must be greater than 0`;
+  }
+  if (msg !== '') {
+    throw new DomainValidationError(msg);
+  }
+}
+
+export function mustBePositiveNumber(field: string, value: number) {
+  let msg = '';
+  if (typeof value !== 'number') {
+    msg = `${field} must be a number.`;
+  }
+  if (value < 0) {
+    msg = `${field} must be a positive number`;
+  }
+  if (msg !== '') {
+    throw new DomainValidationError(msg);
+  }
+}
+
+export function throwIfReadOnly(field: string, value: boolean) {
+  if (value) throw new DomainValidationError(`Can not write to ${field}. The model is read only`);
+}
+
+export function throwIfPreUpdateValidationFails(id: string, data: any) {
+  let errorMessage = '';
+  if (id !== data.id) {
+    errorMessage = 'id and data.id must match';
+  }
+  if (errorMessage !== '') {
+    throw new DomainValidationError(errorMessage);
+  }
+}
+
+export function canNotBeEmpty(field: string, value: any) {
+  const msg = `${field} can not be empty`;
+  if (typeof value === 'undefined') throw new DomainValidationError(msg);
+  if (value === null) throw new DomainValidationError(msg);
+
+  if (typeof value === 'string') if (value === '') throw new DomainValidationError(msg);
+
+  if (typeof value === 'object' && (!Array.isArray(value))) {
+    if (Object.keys(value).length === 0) throw new DomainValidationError(msg);
+  } else if (typeof value === 'object' && (Array.isArray(value))) {
+    if (value.length === 0) throw new DomainValidationError(msg);
+  }
+}
+export function mustEndsAtLeastInMinutes(_eventDate: Date, minutesIntheFuture: number): void {
+  const error = new DomainValidationError(`Event must ends in at least ${minutesIntheFuture} minutes in the future`);
+  const eventDate = new Date(_eventDate);
+  const dateNow = new Date();
+  const minimumFutureWindowMs = minutesIntheFuture * 60 * 1000;
+  const diffMs = eventDate.getTime() - dateNow.getTime();
+  if (Number.isNaN(diffMs) || diffMs < minimumFutureWindowMs) throw error;
+}

package/templates/frontend/.browserslistrc

@@ -0,0 +1,3 @@
+> 1%
+last 2 versions
+not dead

package/templates/frontend/.editorconfig

@@ -0,0 +1,14 @@
+# Editor configuration, see http://editorconfig.org
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 2
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+max_line_length = off
+trim_trailing_whitespace = false

package/templates/frontend/.gitattributes

@@ -0,0 +1,2 @@
+# Enforce Unix newlines
+* text=auto eol=lf

package/templates/frontend/.prettierrc.js

@@ -0,0 +1,7 @@
+module.exports = {
+  semi: false,
+  trailingComma: "all",
+  singleQuote: true,
+  printWidth: 100,
+  tabWidth: 2,
+};

package/templates/frontend/README.md

@@ -0,0 +1,76 @@
+# @jumentix/frontend
+
+Seed for the frontends the Jumentix factory generates — the *Hybrid Backend + Frontend* and
+*Frontend-only SPA/PWA* modes of the service factory matrix. An OAS-driven enterprise admin SPA
+(Vue 3 + Vite + CoreUI + Pinia) over the Users / Organizations domain of `apps/backend-template`.
+
+A versão em português está em [README.pt-BR.md](./README.pt-BR.md).
+Full technical description: [Frontend Seed and the X-CRUD Kit](../../documentation/md/FRONTEND-SEED-AND-XCRUD.md).
+
+## Contract boundary (Requirement 136)
+
+The frontend knows the backend **only through its OpenAPI document**. `scripts/sync-contracts.mjs`
+bakes `spec/1.0.0.yml` into `src/contracts/openapi.json` (`predev`/`prebuild`); the SDK
+`@jumentix/sdk-rest-client` is the only HTTP channel. Importing from `apps/backend-template/**`
+— even type-only — is forbidden and caught by `arch:check-workspace-boundaries`.
+
+## What renders from the contract
+
+- **Forms** from `components.schemas` (`type`, `format`, `required`, lengths, `enum`, `pattern`,
+  `default`, `nullable`); `x-hide` keeps a property out of every form.
+- **Labels** from `x-label` (`{ en, 'pt-BR' }`) → `title` → humanized name; `description` is help
+  text under the control.
+- **Validation** from `x-validation` (CPF mod-11, SSN, BR/US phones, pattern caps) before any HTTP.
+- **References** from `x-references`: selects show the referenced label and emit the id; arrays
+  of ids (organization members) resolve to labels too.
+- **RBAC** from `info.x-rbac` + per-operation `security`: routes, nav items and buttons follow the
+  signed-in roles; the backend enforces.
+- **Lists** from `x-list-capabilities`: the X-CRUD kit asks the server for pages
+  ([Paginated List Contract](../../documentation/md/PAGINATED-LIST-CONTRACT.md)) and renders sort,
+  filter and search only for the declared fields; without the extension it falls back to memory.
+
+## Surface
+
+- **Auth** — login/register built from `RequestLogin`/`RequestRegister`; unauthenticated users go
+  to `/login`; scope-guarded routes (`meta.operationId`); a rejected session drops to `/login`.
+- **Dashboard** — real totals from the list envelopes and the signed-in roles/organization; an
+  honest "no access" for roles without read scope.
+- **Users / Organizations** — X-CRUD sub-apps: server-side listing (search, per-column filters,
+  sort, pager or scroll), row detail with one tab per array field, create/update/preview forms
+  with array editors, bulk delete, export, column visibility, aggregates.
+- **Profile** — scalars, emails, documents, phones from the OAS sub-resource schemas.
+- **i18n** — `en` and `pt-BR`, switchable from the account menu, persisted per browser.
+
+## Layout
+
+```text
+src/contracts/   OAS engine: formSchema, oasForm, validation, labels, listSchema, rbac,
+                 apiClient, appOperations, errors, openapi.json (generated)
+src/components/  OasFormField, SearchableEnumInput, x-crud/* (XCrud, grid, toolbar, forms,
+                 row detail, array editor, reference input, panels, chart, useXCrud)
+src/features/    auth, dashboard, profile, users, organizations
+src/stores/      auth, profile, network, entityStore, sidebar, theme
+src/i18n/        messages (en, pt-BR), t(), localized(), useI18n()
+template/        frozen CoreUI catalog — reference only, never imported
+test/unit        bun:test — contract engine, stores, router, kit state
+test/component   @vue/test-utils + happy-dom mounting the shipped .vue components
+cypress/e2e      Cypress against the containerised backend (e2e/docker-compose.yml)
+```
+
+## Commands
+
+```sh
+bun install                 # from the monorepo root
+bun run dev                 # vite on :3001, /api proxied to :3010
+                            # VITE_DEV_PORT / VITE_API_PROXY_TARGET override both
+bun run build               # vite build
+bun run test                # unit + component suites
+bun run test:coverage       # writes coverage/frontend/lcov.info (root: frontend:coverage:check)
+bun run test:e2e            # Docker backend + Vite + Cypress (Chrome headless by default)
+bun run typecheck && bun run lint
+```
+
+Seeded dev accounts: `eduardo@xpertminds.dev` / `eduardo@123456` (superadmin),
+`admin@xpertminds.dev` / `admin@123456`, `user@xpertminds.dev` / `user@123456`.
+
+Agent rules for this workspace: [AGENTS.md](./AGENTS.md).

package/templates/frontend/README.pt-BR.md

@@ -0,0 +1,79 @@
+# @jumentix/frontend
+
+Seed dos frontends que a fábrica Jumentix gera — os modos *Hybrid Backend + Frontend* e
+*Frontend-only SPA/PWA* da matriz da fábrica. Uma SPA administrativa enterprise dirigida pela OAS
+(Vue 3 + Vite + CoreUI + Pinia) sobre o domínio Users / Organizations do `apps/backend-template`.
+
+The English version is at [README.md](./README.md).
+Descrição técnica completa: [Seed de Frontend e o Kit X-CRUD](../../documentation/md/FRONTEND-SEED-AND-XCRUD.pt-BR.md).
+
+## Fronteira de contrato (Requisito 136)
+
+O frontend conhece o backend **só pelo documento OpenAPI**. `scripts/sync-contracts.mjs` grava
+`spec/1.0.0.yml` em `src/contracts/openapi.json` (`predev`/`prebuild`); o SDK
+`@jumentix/sdk-rest-client` é o único canal HTTP. Importar de `apps/backend-template/**` — mesmo
+type-only — é proibido e pego por `arch:check-workspace-boundaries`.
+
+## O que renderiza a partir do contrato
+
+- **Formulários** de `components.schemas` (`type`, `format`, `required`, tamanhos, `enum`,
+  `pattern`, `default`, `nullable`); `x-hide` tira a propriedade de todo formulário.
+- **Rótulos** de `x-label` (`{ en, 'pt-BR' }`) → `title` → nome humanizado; `description` é texto
+  de ajuda sob o controle.
+- **Validação** de `x-validation` (CPF mod-11, SSN, telefones BR/US, limites de pattern) antes de
+  qualquer HTTP.
+- **Referências** de `x-references`: selects mostram o label referenciado e emitem o id; arrays de
+  ids (membros de organização) também resolvem para labels.
+- **RBAC** de `info.x-rbac` + `security` por operação: rotas, itens de menu e botões seguem os
+  papéis logados; o backend aplica.
+- **Listagens** de `x-list-capabilities`: o kit X-CRUD pede páginas ao servidor
+  ([Contrato de Listagem Paginada](../../documentation/md/PAGINATED-LIST-CONTRACT.pt-BR.md)) e
+  renderiza ordenação, filtro e busca só para os campos declarados; sem a extensão, volta ao modo
+  memória.
+
+## Superfície
+
+- **Auth** — login/cadastro montados de `RequestLogin`/`RequestRegister`; não autenticado vai para
+  `/login`; rotas com guarda de escopo (`meta.operationId`); sessão rejeitada cai em `/login`.
+- **Dashboard** — totais reais dos envelopes de listagem e os papéis/organização logados; "sem
+  acesso" honesto para papéis sem escopo de leitura.
+- **Users / Organizations** — sub-apps X-CRUD: listagem no servidor (busca, filtros por coluna,
+  ordenação, pager ou scroll), row detail com uma tab por campo array, formulários
+  create/update/preview com editores de array, exclusão em massa, exportação, visibilidade de
+  colunas, agregadores.
+- **Perfil** — escalares, e-mails, documentos, telefones a partir dos schemas de sub-recurso.
+- **i18n** — `en` e `pt-BR`, trocável no menu da conta, persistido por navegador.
+
+## Layout
+
+```text
+src/contracts/   motor OAS: formSchema, oasForm, validation, labels, listSchema, rbac,
+                 apiClient, appOperations, errors, openapi.json (gerado)
+src/components/  OasFormField, SearchableEnumInput, x-crud/* (XCrud, grid, toolbar, forms,
+                 row detail, array editor, reference input, panels, chart, useXCrud)
+src/features/    auth, dashboard, profile, users, organizations
+src/stores/      auth, profile, network, entityStore, sidebar, theme
+src/i18n/        messages (en, pt-BR), t(), localized(), useI18n()
+template/        catálogo CoreUI congelado — só referência, nunca importado
+test/unit        bun:test — motor de contratos, stores, router, estado do kit
+test/component   @vue/test-utils + happy-dom montando os .vue reais
+cypress/e2e      Cypress contra o backend em contêiner (e2e/docker-compose.yml)
+```
+
+## Comandos
+
+```sh
+bun install                 # na raiz do monorepo
+bun run dev                 # vite em :3001, /api em proxy para :3010
+                            # VITE_DEV_PORT / VITE_API_PROXY_TARGET sobrescrevem
+bun run build               # vite build
+bun run test                # suítes unit + component
+bun run test:coverage       # grava coverage/frontend/lcov.info (raiz: frontend:coverage:check)
+bun run test:e2e            # backend em Docker + Vite + Cypress (Chrome headless por padrão)
+bun run typecheck && bun run lint
+```
+
+Contas seed de dev: `eduardo@xpertminds.dev` / `eduardo@123456` (superadmin),
+`admin@xpertminds.dev` / `admin@123456`, `user@xpertminds.dev` / `user@123456`.
+
+Regras para agentes neste workspace: [AGENTS.md](./AGENTS.md).

package/templates/frontend/cypress/e2e/auth.cy.ts

@@ -0,0 +1,46 @@
+import { accounts } from '../support/e2e';
+
+/**
+ * JUM-776 — authentication against the real backend: login, RBAC-driven
+ * navigation per role, unauthenticated redirect, logout.
+ */
+describe('authentication', () => {
+  it('redirects an unauthenticated visitor to /login and shows the OAS-driven form', () => {
+    cy.visit('/#/users');
+    cy.location('hash').should('eq', '#/login');
+    cy.get('label[for="oas-field-username"]').should('contain', 'Username');
+    cy.get('#oas-field-schemaType').should('not.exist');
+  });
+
+  it('shows the contract error for wrong credentials without leaving the page', () => {
+    cy.visit('/#/login');
+    cy.get('#oas-field-username').type(accounts.user.username);
+    cy.get('#oas-field-password').type('wrong-password');
+    cy.get('form').submit();
+    cy.get('[role="alert"]').should('be.visible');
+    cy.location('hash').should('eq', '#/login');
+  });
+
+  it('signs in each seeded role and the sidebar reflects its scopes', () => {
+    cy.login('superadmin');
+    cy.get('.sidebar-nav').should('contain', 'Users');
+    cy.get('[data-module-tabs]').should('contain', 'Organizations');
+
+    cy.login('admin');
+    cy.get('.sidebar-nav').should('contain', 'Users');
+    cy.get('[data-module-tabs]').should('contain', 'Organizations');
+
+    cy.login('user');
+    cy.get('.sidebar-nav').should('contain', 'Users').and('not.contain', 'Organizations');
+    cy.get('[data-module-tabs]').should('contain', 'Users').and('not.contain', 'Organizations');
+    cy.visit('/#/organizations');
+    cy.location('hash').should('eq', '#/m/users/dashboard');
+  });
+
+  it('logs out from the account menu and lands on /login', () => {
+    cy.login('user');
+    cy.get('.header [aria-label="Account"]').click();
+    cy.contains('.dropdown-item', 'Logout').click();
+    cy.location('hash').should('eq', '#/login');
+  });
+});

package/templates/frontend/cypress/e2e/dashboard-a11y.cy.ts

@@ -0,0 +1,32 @@
+/**
+ * JUM-813 — axe on the dashboard tab at the three shell viewports.
+ */
+const assertDashboardA11y = (width: number, height: number): void => {
+  cy.viewport(width, height);
+  cy.login('superadmin');
+  cy.get('[data-dashboard-grid]').should('exist');
+  cy.get('[data-chart-table-toggle]').first().click();
+  cy.get('[data-chart-table]').first().should('be.visible');
+  cy.injectAxe();
+  cy.checkA11y('[data-dashboard-grid]', {
+    includedImpacts: ['critical', 'serious'],
+    rules: {
+      // Chart.js canvas: numbers live in the table fallback.
+      'color-contrast': { enabled: false }
+    }
+  });
+};
+
+describe('dashboard accessibility', () => {
+  it('has no serious/critical axe violations at 375×812', () => {
+    assertDashboardA11y(375, 812);
+  });
+
+  it('has no serious/critical axe violations at 768×1024', () => {
+    assertDashboardA11y(768, 1024);
+  });
+
+  it('has no serious/critical axe violations at 1280×800', () => {
+    assertDashboardA11y(1280, 800);
+  });
+});

package/templates/frontend/cypress/e2e/offline-boot.cy.ts

@@ -0,0 +1,16 @@
+/**
+ * JUM-802 — Cana opens before the login form, with users and organizations stores.
+ */
+describe('offline boot', () => {
+  it('opens IndexedDB tables before login', () => {
+    cy.visit('/#/login');
+    cy.get('#oas-field-username');
+    cy.window().then(async (win) => {
+      const dbs = await win.indexedDB.databases();
+      expect(dbs.map((item) => item.name)).to.include('jumentix-frontend');
+      const stores = (win as Window & { __jumentixObjectStores?: () => string[] })
+        .__jumentixObjectStores?.() ?? [];
+      expect(stores).to.include.members(['users', 'organizations', 'meta', 'outbox']);
+    });
+  });
+});

package/templates/frontend/cypress/e2e/offline-pwa.cy.ts

@@ -0,0 +1,15 @@
+/**
+ * JUM-808 — listings survive a failed /api after the first sync (Vite dest
+ * does not register the service worker unless VITE_PWA=1).
+ */
+describe('offline listings after sync', () => {
+  it('still lists users when GET /api/users fails', () => {
+    cy.login('superadmin');
+    cy.visit('/#/users');
+    cy.get('.xcrud-grid tbody tr').should('have.length.at.least', 6);
+    cy.intercept('GET', '/api/1.0.0/users?*', { forceNetworkError: true });
+    cy.get('input[aria-label="search"]').type('obama');
+    cy.get('.xcrud-grid tbody tr').should('have.length', 1);
+    cy.get('.xcrud-grid tbody tr').first().should('contain', 'Barack');
+  });
+});

package/templates/frontend/cypress/e2e/offline-sync.cy.ts

@@ -0,0 +1,28 @@
+/**
+ * JUM-805 — first login runs a full load behind a progress bar, then the shell.
+ */
+describe('offline sync', () => {
+  it('shows sync progress then the dashboard, and a second user wipes local data', () => {
+    cy.visit('/#/login');
+    cy.get('#oas-field-username').type('eduardo@xpertminds.dev');
+    cy.get('#oas-field-password').type('eduardo@123456');
+    cy.get('form').submit();
+    cy.location('hash', { timeout: 15000 }).should('be.oneOf', [
+      '#/sync',
+      '#/m/users/dashboard'
+    ]);
+    cy.location('hash', { timeout: 30000 }).should('eq', '#/m/users/dashboard');
+    cy.contains('Users');
+
+    cy.get('.header [aria-label="Account"]').click();
+    cy.contains('.dropdown-item', 'Logout').click();
+    cy.get('#oas-field-username').clear().type('user@xpertminds.dev');
+    cy.get('#oas-field-password').clear().type('user@123456');
+    cy.get('form').submit();
+    cy.location('hash', { timeout: 15000 }).should('be.oneOf', [
+      '#/sync',
+      '#/m/users/dashboard'
+    ]);
+    cy.location('hash', { timeout: 30000 }).should('eq', '#/m/users/dashboard');
+  });
+});

package/templates/frontend/cypress/e2e/offline-writes.cy.ts

@@ -0,0 +1,20 @@
+/**
+ * JUM-806 — local-first writes stay visible as pending when the API is down.
+ */
+describe('offline writes', () => {
+  it('keeps a created user locally while /api is failing', () => {
+    cy.login('superadmin');
+    cy.visit('/#/users');
+    cy.get('.xcrud-grid tbody tr').should('have.length.at.least', 6);
+    cy.goOffline();
+    const username = `offline-${Date.now()}@x.dev`;
+    cy.contains('.nav-link', 'New User').click();
+    cy.get('#oas-field-firstName').type('Offline');
+    cy.get('#oas-field-lastName').type('Row');
+    cy.get('#oas-field-username').type(username);
+    cy.get('#oas-field-password').type('e2e@123456');
+    cy.get('#oas-field-primaryEmail').type(username);
+    cy.contains('button', 'Create').click();
+    cy.get('.xcrud-grid tbody tr').contains(username);
+  });
+});

package/templates/frontend/cypress/e2e/organizations-dashboard.cy.ts

@@ -0,0 +1,64 @@
+/**
+ * JUM-811/812/813 — dashboard totals and domain widgets vs the metrics contract.
+ */
+const backendOrigin = `http://127.0.0.1:${Cypress.env('FRONTEND_E2E_BACKEND_PORT') || '3130'}`;
+
+describe('organizations, dashboard and profile', () => {
+  it('lists organizations with member usernames and totals on the dashboard', () => {
+    cy.login('superadmin');
+    cy.window().then((win) => {
+      const raw = win.localStorage.getItem('jumentix-frontend-auth');
+      expect(raw).to.be.a('string');
+      const { token } = JSON.parse(raw as string) as { token: string };
+      cy.request({
+        url: `${backendOrigin}/api/1.0.0/users/metrics?metric=count`,
+        headers: { Authorization: token }
+      }).then((usersMetrics) => {
+        const usersTotal = usersMetrics.body.buckets[0].count as number;
+        cy.get('[data-metric="users"]').should('contain', String(usersTotal));
+      });
+      cy.request({
+        url: `${backendOrigin}/api/1.0.0/organizations/metrics?metric=count`,
+        headers: { Authorization: token }
+      }).then((orgMetrics) => {
+        const orgTotal = orgMetrics.body.buckets[0].count as number;
+        cy.get('[data-metric="organizations"]').should('contain', String(orgTotal));
+      });
+    });
+    cy.get('[data-widget="users:admin-user-ratio"]').should('contain', '/');
+    cy.get('[data-widget="users:members-per-org"]').should('exist');
+    cy.get('[data-metric="signups-30d"]').should('exist');
+    cy.get('body').should('not.contain', 'Traffic');
+    cy.visit('/#/organizations');
+    cy.contains('.xcrud-grid tbody tr', 'ACME').should('contain', 'user2');
+    cy.contains('.xcrud-grid tbody tr', 'ACME').invoke('text').should('not.match', /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}/);
+    cy.contains('.xcrud-grid tbody tr', 'ACME').find('button[aria-label^="preview "]').click();
+    cy.get('.xcrud-row-detail').should('contain', 'user2');
+  });
+
+  it('updates the profile scalars and lists sub-resources with contract labels', () => {
+    cy.login('admin');
+    cy.get('.header [aria-label="Account"]').click();
+    cy.contains('.dropdown-item', 'Profile').click();
+    cy.location('hash').should('eq', '#/profile');
+    cy.get('h2').should('contain', 'My profile');
+    cy.get('table').first().find('th').first()
+      .should('contain', 'Email');
+    cy.get('#oas-field-lastName').clear().type('XpertMinds');
+    cy.contains('button', 'Save profile').click();
+    cy.get('.alert-success').should('contain', 'Profile saved');
+  });
+
+  it('drops the session and returns to /login when the token is no longer accepted', () => {
+    cy.login('user');
+    cy.window().then((win) => {
+      const raw = win.localStorage.getItem('jumentix-frontend-auth')!;
+      const parsed = JSON.parse(raw);
+      parsed.token = 'Bearer invalid.token.value';
+      win.localStorage.setItem('jumentix-frontend-auth', JSON.stringify(parsed));
+    });
+    cy.visit('/#/profile');
+    cy.reload();
+    cy.location('hash').should('eq', '#/login');
+  });
+});

package/templates/frontend/cypress/e2e/shell-multitask.cy.ts

@@ -0,0 +1,21 @@
+/**
+ * JUM-796/800 — multitask shell against the real backend: one task per
+ * module, keep-alive across switches, reload restores the taskbar.
+ */
+describe('multitask shell', () => {
+  it('keeps an open Users edit after visiting the dashboard tab and restores tasks on reload', () => {
+    cy.login('superadmin');
+    cy.visit('/#/users');
+    cy.get('.xcrud-grid tbody tr').should('have.length.at.least', 6);
+    cy.contains('.xcrud-grid tbody tr', 'Barack').find('button[aria-label^="preview "]').click();
+    cy.get('.xcrud-row-detail').should('be.visible');
+    cy.contains('[data-module-tabs] .nav-link', 'Dashboard').click();
+    cy.get('[data-metric="users"]').should('be.visible');
+    cy.contains('[data-module-tabs] .nav-link', 'Users').click();
+    cy.get('.xcrud-row-detail').should('be.visible').and('contain', 'Barack');
+    cy.get('[data-taskbar] [data-active="true"]').should('contain', 'Users');
+    cy.reload();
+    cy.get('[data-taskbar] [data-active="true"]').should('contain', 'Users');
+    cy.location('hash').should('include', '/m/users');
+  });
+});