@nocobase/app-template-default 0.0.0-stage → 1.0.0-beta.58

package/config.example.yml

@@ -0,0 +1,156 @@
+# Copy this file to config.yml before starting the application.
+
+# app:
+#   Public origin used for callbacks and redirects in production.
+#   publicOrigin: https://apps.example.com
+
+# The language the application starts in, for the browser and the server alike. Which languages it offers follows
+# from the files in client/locales and server/locales, not from configuration.
+# i18n:
+#   defaultLocale: zh-CN
+
+# Limits every /api request meets before its route, each off until set. bodyLimit refuses a larger body with 413
+# BODY_TOO_LARGE; a route may set its own, usually smaller, limit. timeout answers 503 REQUEST_TIMEOUT when a handler
+# has not produced its response in time; a streaming response that has started is not cut off. rateLimit allows max
+# requests per window from each client address and answers 429 RATE_LIMITED with Retry-After; GET /api/healthz is
+# exempt. Counters live in each process, so every instance counts on its own, and behind a reverse proxy the proxy is
+# the client address. API_BODY_LIMIT and API_TIMEOUT set the first two.
+# api:
+#   bodyLimit: 10mb
+#   timeout: 30s
+#   rateLimit:
+#     max: 600
+#     window: 1m
+
+# Values under client are public and embedded in the SPA HTML.
+client:
+  app:
+    title: NocoBase
+    # Defaults apply only when no valid browser-local choice is saved.
+    # defaultColorScheme: system # light | dark | system
+    # defaultTheme: compact # ID from client/theme/theme-presets.ts
+
+users:
+  # The first administrator, created only when seeding an empty user table. Changing these values later does not
+  # reset an existing account. Replace the password before exposing the application. INITIAL_ADMIN_USERNAME,
+  # INITIAL_ADMIN_EMAIL and INITIAL_ADMIN_PASSWORD set them from the environment instead.
+  initialAdmin:
+    username: nocobase # 3–30 letters, digits, underscores or dots; stored lowercase
+    email: admin@nocobase.com # stored lowercase; also signs in
+    password: admin123
+
+# Master keys for what the application encrypts at rest — stored credentials and API keys, OAuth tokens — and from
+# which the sign-in and session keys are derived. The first key is current; the others only decrypt. To rotate, put a
+# new key first with a higher version, run `pnpm nocobase secrets rotate`, then remove the old key. Changing the current
+# key signs everyone out. Generate a key with: openssl rand -hex 32. SECRETS_KEYS=2:<key>,1:<key> sets the list from
+# the environment instead.
+secrets:
+  keys:
+    - version: 1
+      key: replace-with-a-unique-secret
+
+auth:
+  emailAndPassword:
+    enabled: true
+    autoSignIn: false
+  session:
+    storeSessionInDatabase: true
+
+notification:
+  channels:
+    inbox:
+      provider: in-app
+
+    # Uncomment and configure independent email Channels.
+    # Values are read as written: ${NAME} is not expanded. To take a secret from the environment instead, map a
+    # variable onto its path in env of server/config/notification.ts, such as SMTP_PASSWORD.
+    # system-email:
+    #   provider: smtp
+    #   host: smtp.example.com
+    #   port: 587
+    #   auth:
+    #     user: notifications@example.com
+    #     pass: replace-with-the-smtp-password
+    #   from: notifications@example.com
+    # marketing-email:
+    #   provider: resend
+    #   apiKey: replace-with-the-resend-api-key
+    #   from: marketing@example.com
+
+    # ops-feishu:
+    #   provider: feishu-webhook
+    #   webhookUrl: https://open.feishu.cn/open-apis/bot/v2/hook/replace-with-the-token
+    # ops-dingtalk:
+    #   provider: dingtalk-webhook
+    #   webhookUrl: https://oapi.dingtalk.com/robot/send?access_token=replace-with-the-token
+
+# DB_DIALECT, DB_HOST, DB_PORT, DB_DATABASE, DB_USERNAME, DB_PASSWORD, DB_SSL and DB_FILENAME override the main
+# connection's fields from the environment.
+database:
+  default: main
+  connections:
+    main:
+      dialect: sqlite
+      database: database.sqlite
+      debug: false
+      # For Oracle, use dialect: oracle and replace database with serviceName: FREEPDB1.
+      # For SQL Server, use dialect: mssql and configure encrypt and trustServerCertificate.
+      schemaManagement: managed
+      migrations:
+        autoRun: true
+      seeds:
+        autoRun: true
+    # Additional managed databases use database/<connectionName>/{migrations,seeds}.
+    # analytics:
+    #   dialect: postgres
+    #   host: localhost
+    #   database: analytics
+    #   username: postgres
+    #   password: replace-with-the-password # or DB_ANALYTICS_PASSWORD, declared with connectionEnvironment('analytics', 'DB_ANALYTICS')
+    #   schemaManagement: managed
+    #   migrations:
+    #     autoRun: false
+    #   seeds:
+    #     autoRun: false
+    # An existing database another system owns sets schemaManagement: external and runs no tasks. Its titles,
+    # descriptions and relations are read from database/<connection>/metadata/<name>.json unless metadataStore says otherwise.
+
+snowflake:
+  # Assign a unique worker ID to each concurrently running instance.
+  workerId: 0
+  epoch: 1605024000
+
+# Scheduled jobs, such as the Scheduler plugin's. Without jobs.default they run on the built-in memory adapter:
+# state kept in the process, read from storage/jobs at startup and written back when the application stops, so a
+# process that is killed loses what changed since it started. It serves one process: every other process or instance
+# would run its own copy. Set default to memory to keep that without the startup warning, or to redis to run several.
+# Redis must persist its data (AOF or RDB) and use maxmemory-policy noeviction, or schedules can be lost.
+# jobs:
+#   default: redis
+#   redis:
+#     connection:
+#       host: 127.0.0.1
+#       port: 6379
+#     # namespace: my-app # defaults to the application name; set it when deployments share one Redis
+
+# The jobs configuration the Scheduler plugin's schedules run on, by name. Left out, they follow jobs.default.
+# scheduler:
+#   jobs: redis
+
+# File logging is independent of terminal formatting.
+logging:
+  level: info
+  file:
+    enabled: true
+    retentionDays: 7
+    name: app
+    maxFileSizeMB: 10
+    maxTotalSizeMB: 500
+  loggers:
+    request:
+      file:
+        name: request
+  console:
+    enabled: true
+    # Set true for human-readable terminal output.
+    pretty: false

package/database/main/migrations/202610060001_create_device_code.ts

@@ -0,0 +1,37 @@
+import { defineMigration, type MigrationDefinition } from '@nocobase/db';
+
+/**
+ * Creates the `deviceCode` table Better Auth's `deviceAuthorization()` plugin reads and writes: a CLI's sign-in
+ * through the browser (RFC 8628). The shape is the plugin's schema in better-auth 1.7.5, spelled out here so a later
+ * release cannot change what this migration did; when that schema gains a field, add it in a new migration.
+ *
+ * `pollingInterval` is milliseconds. A row lives until its code is redeemed, denied or found expired.
+ */
+const migration: MigrationDefinition = defineMigration({
+  name: '202610060001_create_device_code',
+
+  async up({ builder }) {
+    await builder.createCollection('deviceCode', (collection) => {
+      collection.string('id', { length: 64 }).notNull();
+      collection.string('deviceCode', { length: 191 }).notNull();
+      collection.string('userCode', { length: 191 }).notNull();
+      collection.string('userId', { length: 64 }).nullable();
+      collection.datetime('expiresAt').notNull();
+      collection.string('status', { length: 32 }).notNull();
+      collection.datetime('lastPolledAt').nullable();
+      collection.integer('pollingInterval').nullable();
+      collection.string('clientId', { length: 255 }).nullable();
+      collection.text('scope').nullable();
+
+      collection.primary('id', { name: 'pk_device_code' });
+      collection.unique('deviceCode', { name: 'uq_device_code_device_code' });
+      collection.unique('userCode', { name: 'uq_device_code_user_code' });
+    });
+  },
+
+  async down({ builder }) {
+    await builder.dropCollection('deviceCode');
+  },
+});
+
+export default migration;

package/database/tsconfig.json

@@ -0,0 +1,4 @@
+{
+  "extends": "../tsconfig.server.json",
+  "include": ["**/*.ts"]
+}

package/ecosystem.config.js

@@ -0,0 +1,35 @@
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+
+// The pm2 process name. `APP_PM2_NAME` chooses it; otherwise it follows the application's package name, read from the
+// project root or, beside an unpacked deployment archive, from `dist/package.json`. Two applications on one machine
+// then get different names: pm2 treats `pm2 start` on a name it already runs as a restart of that process.
+const manifest = ['package.json', 'dist/package.json']
+  .map((file) => path.join(import.meta.dirname, file))
+  .find((file) => existsSync(file));
+const packageName = manifest
+  ? JSON.parse(readFileSync(manifest, 'utf8')).name
+  : undefined;
+const name =
+  process.env.APP_PM2_NAME ||
+  `nocobase-${String(packageName ?? 'app').replace(/^@[^/]+\//, '')}`;
+
+export const apps = [
+  {
+    name,
+    // pm2's fork mode loads a script through its own wrapper, so
+    // import.meta.main is false there and standalone.js never starts the
+    // server. Running node itself keeps standalone.js the main module.
+    script: 'node',
+    args: './dist/server/standalone.js',
+    // Resolve `args` against this file's directory rather than wherever
+    // `pm2 start` runs, so the path to this file can be given from anywhere.
+    cwd: import.meta.dirname,
+    interpreter: 'none',
+    env: {
+      NODE_ENV: 'production',
+    },
+  },
+];
+
+export default { apps };

package/eslint.config.js

@@ -0,0 +1,24 @@
+import { createApplicationConfig } from '@nocobase/dev-config/eslint';
+
+export default createApplicationConfig({
+  tsconfigRootDir: import.meta.dirname,
+  ignores: [
+    '.extension-state/**',
+    'client-old/**',
+    'public/r/**',
+    'storage/**',
+  ],
+  overrides: [
+    {
+      // Top-level workflow definitions and handlers use the server project.
+      files: ['workflows/**/*.ts'],
+      ignores: ['workflows/*/client/**'],
+      languageOptions: {
+        parserOptions: {
+          projectService: false,
+          project: './tsconfig.server.json',
+        },
+      },
+    },
+  ],
+});

package/index.html

@@ -0,0 +1,100 @@
+<!doctype html>
+<html lang="en-US">
+  <head>
+    <meta charset="utf-8" />
+    <link rel="icon" type="image/x-icon" href="/assets/favicon.ico" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="theme-color" content="#171717" />
+    <meta name="description" content="NocoBase administration console" />
+    <meta data-rh="true" property="og:image" content="/assets/logo-mark.png" />
+    <meta data-rh="true" name="twitter:image" content="/assets/logo-mark.png" />
+    <style>
+      .app-bootstrap-loading {
+        display: flex;
+        min-height: 100svh;
+        width: 100%;
+        align-items: center;
+        justify-content: center;
+        background: oklch(0.985 0 0);
+        color: oklch(0.18 0 0);
+      }
+
+      .app-bootstrap-loading [data-slot='loading-indicator'] {
+        width: 1.75rem;
+        height: 1.75rem;
+        opacity: 0;
+        animation:
+          app-bootstrap-reveal 0s 200ms forwards,
+          app-bootstrap-spin 1s linear 200ms infinite;
+      }
+
+      html,
+      body {
+        margin: 0;
+      }
+
+      @keyframes app-bootstrap-spin {
+        to {
+          transform: rotate(360deg);
+        }
+      }
+
+      @keyframes app-bootstrap-reveal {
+        to {
+          opacity: 1;
+        }
+      }
+
+      @media (prefers-color-scheme: dark) {
+        .app-bootstrap-loading {
+          background: oklch(0.145 0 0);
+          color: oklch(0.9 0 0);
+        }
+      }
+
+      @media (prefers-reduced-motion: reduce) {
+        .app-bootstrap-loading [data-slot='loading-indicator'] {
+          animation: none;
+          opacity: 0.65;
+        }
+      }
+    </style>
+    <title>NocoBase</title>
+  </head>
+  <body>
+    <noscript>You need to enable JavaScript to run this app.</noscript>
+    <div id="root">
+      <div
+        class="app-bootstrap-loading"
+        role="status"
+        aria-label="Loading application"
+      >
+        <svg
+          data-slot="loading-indicator"
+          viewBox="0 0 24 24"
+          fill="none"
+          aria-hidden="true"
+        >
+          <path
+            d="M21 12a9 9 0 1 1-6.219-8.56"
+            stroke="currentColor"
+            stroke-width="2"
+            stroke-linecap="round"
+            stroke-linejoin="round"
+          />
+        </svg>
+      </div>
+    </div>
+    <script type="module" src="/client/index.tsx"></script>
+    <!--
+      This HTML file is a template.
+      If you open it directly in the browser, you will see an empty page.
+
+      You can add webfonts, meta tags, or analytics to this file.
+      The build step will place the bundled scripts into the <body> tag.
+
+      To begin development, run `pnpm dev`.
+      To create a production bundle, run `pnpm build`.
+    -->
+  </body>
+</html>

package/package.json

@@ -1,6 +1,201 @@
 {
   "name": "@nocobase/app-template-default",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "displayName": "Default Template",
+  "version": "1.0.0-beta.58",
+  "type": "module",
+  "prettier": "@nocobase/dev-config/prettier",
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "nocobase": {
+    "templateKind": "app",
+    "defaultTemplateVersion": "1.0.0-beta.58"
+  },
+  "devDependencies": {
+    "@ai-sdk/react": "2.0.0",
+    "@base-ui/react": "^1.6.0",
+    "@dicebear/core": "^9.4.3",
+    "@gchust/agent-annotations": "0.1.9",
+    "@hookform/resolvers": "^5.0.1",
+    "@nocobase/ai-employee-avatars": "^1.0.2",
+    "@playwright/test": "^1.62.1",
+    "@refinedev/cli": "^2.16.48",
+    "@refinedev/core": "^5.0.8",
+    "@refinedev/react-hook-form": "^5.0.0",
+    "@refinedev/react-router": "^2.0.0",
+    "@refinedev/react-table": "^6.0.0",
+    "@silurus/ooxml": "0.85.1",
+    "@tailwindcss/postcss": "^4.1.4",
+    "@tailwindcss/vite": "^4.1.8",
+    "@tanstack/react-query": "^5.81.5",
+    "@testing-library/jest-dom": "^7.0.0",
+    "@testing-library/react": "^16.3.2",
+    "@testing-library/user-event": "^14.6.3",
+    "@tiptap/core": "3.30.2",
+    "@tiptap/extension-link": "3.30.2",
+    "@tiptap/extension-placeholder": "3.30.2",
+    "@tiptap/extension-text-style": "3.30.2",
+    "@tiptap/pm": "3.30.2",
+    "@tiptap/react": "3.30.2",
+    "@tiptap/starter-kit": "3.30.2",
+    "@types/node": "^24.0.0",
+    "@types/react": "^19.2.0",
+    "@types/react-dom": "^19.2.0",
+    "@vitejs/plugin-react": "^4.4.1",
+    "@vitest/coverage-v8": "^4.1.10",
+    "ai": "5.0.0",
+    "class-variance-authority": "^0.7.1",
+    "cn": "^0.4.0",
+    "dayjs": "^1.10.7",
+    "dingtalk-jsapi": "3.1.1",
+    "echarts": "^5.5.0",
+    "echarts-for-react": "3.0.2",
+    "eslint": "^10.0.0",
+    "eventsource-parser": "3.1.0",
+    "ignore": "^7.0.6",
+    "jsdom": "^30.0.1",
+    "knex": "^3.1.0",
+    "lucide-react": "^0.487.0",
+    "next-themes": "^0.4.6",
+    "postcss": "^8.5.3",
+    "prettier": "^3.9.6",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
+    "react-error-boundary": "^6.0.0",
+    "react-hook-form": "^7.57.0",
+    "react-i18next": "^17.0.12",
+    "react-markdown": "^10.1.0",
+    "react-router": "^7.0.2",
+    "remark-gfm": "^4.0.1",
+    "shadcn": "^4.13.1",
+    "tailwindcss": "^4.1.4",
+    "tsc-alias": "^1.9.2",
+    "tsx": "^4.21.0",
+    "tw-animate-css": "^1.2.5",
+    "typescript": "^6.0.3",
+    "vite": "^6.3.5",
+    "vitest": "^4.1.10",
+    "tar": "^7.5.22",
+    "@nocobase/app-client": "^2.0.0-beta.2",
+    "@nocobase/app-plugin-template-print": "0.0.2-beta.1",
+    "@nocobase/app-skills": "0.1.0-beta.26",
+    "@nocobase/app-testing": "0.1.0-beta.1",
+    "@nocobase/app-websocket": "^0.0.1",
+    "@nocobase/dev-config": "0.1.0-beta.20",
+    "@nocobase/drive": "^0.1.0-beta.4",
+    "@nocobase/hub-cli": "^1.0.0-beta.2",
+    "@nocobase/logging": "^0.1.0-beta.6",
+    "@nocobase/session": "^0.1.0-beta.2"
+  },
+  "files": [
+    ".prettierignore",
+    ".mcp.json",
+    ".cursor/mcp.json",
+    ".vscode/mcp.json",
+    "cli",
+    "client",
+    "server",
+    "workflows",
+    "database/tsconfig.json",
+    "database/*/migrations/**",
+    "database/*/seeds/**",
+    "public",
+    "tests",
+    "index.html",
+    "components.json",
+    "tailwind.config.mjs",
+    "vite.config.ts",
+    "vitest.config.ts",
+    "eslint.config.js",
+    "tsconfig.json",
+    "tsconfig.node.json",
+    "tsconfig.server.json",
+    "ecosystem.config.js",
+    "Dockerfile",
+    "Dockerfile.dockerignore",
+    "config.example.yml",
+    "README.MD",
+    "AGENTS.md",
+    "CLAUDE.md",
+    "playwright.config.ts"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nocobase/nocobase.git",
+    "directory": "packages/templates/app-template-default"
+  },
+  "browserslist": {
+    "production": [
+      ">0.2%",
+      "not dead",
+      "not op_mini all"
+    ],
+    "development": [
+      "last 1 chrome version",
+      "last 1 firefox version",
+      "last 1 safari version"
+    ]
+  },
+  "dependencies": {
+    "zod": "^4.6.5",
+    "@oclif/core": "^4.14.0",
+    "better-auth": "1.7.5",
+    "hono": "^4.13.2",
+    "@nocobase/app-plugin-api-keys": "^1.0.0-beta.13",
+    "@nocobase/app-plugin-authentication": "^2.0.0-beta.2",
+    "@nocobase/app-plugin-authorization": "^1.0.0-beta.25",
+    "@nocobase/app-plugin-database-explorer": "^1.0.0-beta.11",
+    "@nocobase/app-plugin-file": "^1.0.0-beta.21",
+    "@nocobase/app-plugin-i18n": "^1.0.0-beta.13",
+    "@nocobase/app-plugin-notification": "^1.0.0-beta.24",
+    "@nocobase/app-plugin-notification-in-app": "^1.0.0-beta.22",
+    "@nocobase/app-plugin-notification-providers": "^0.2.0-beta.10",
+    "@nocobase/app-plugin-scheduler": "^1.0.0-beta.15",
+    "@nocobase/app-plugin-users": "^2.0.0-beta.1",
+    "@nocobase/app-plugin-workflow": "^2.0.0-beta.1",
+    "@nocobase/app-server": "^2.0.0-beta.2",
+    "@nocobase/config": "^0.1.0-beta.2",
+    "@nocobase/db": "^1.0.0-beta.18",
+    "@nocobase/db-sqlite": "^0.1.0-beta.4",
+    "@nocobase/service-provider": "^0.0.2-beta.1",
+    "@nocobase/snowflake": "^1.0.0-beta.3",
+    "@nocobase/app-plugin-authz-default-access": "^1.0.0-beta.10",
+    "@nocobase/app-plugin-authz-sharing-rules": "^1.0.0-beta.10",
+    "@nocobase/app-plugin-authz-restriction-rules": "^1.0.0-beta.9",
+    "@nocobase/authorization": "^1.0.0-beta.12",
+    "@nocobase/queue": "^0.1.0-beta.8",
+    "@nocobase/jobs": "^0.1.0-beta.2",
+    "@nocobase/i18n": "^1.0.0-beta.5",
+    "@nocobase/caching": "^0.1.0-beta.2",
+    "@nocobase/repository-input": "^0.1.0-beta.2",
+    "@nocobase/app-cli": "^1.0.0-beta.15"
+  },
+  "description": "NocoBase 3 application template with the standard product capabilities.",
+  "imports": {
+    "#components/*": "./client/components/*.js",
+    "#hooks/*": "./client/hooks/*.js",
+    "#lib/*": "./client/lib/*.js",
+    "#extensions/*": "./client/extensions/*.js",
+    "#pages/*": "./client/pages/*.js"
+  },
+  "scripts": {
+    "postinstall": "nocobase skills sync",
+    "dev": "nocobase dev",
+    "build": "nocobase build",
+    "start": "nocobase start",
+    "check": "pnpm lint && pnpm format:check && pnpm typecheck && pnpm test && pnpm build",
+    "fix": "pnpm lint:fix && pnpm format",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.node.json --noEmit && tsc -p tsconfig.server.json --noEmit",
+    "lint": "eslint . --max-warnings 0",
+    "lint:fix": "eslint . --fix --max-warnings 0",
+    "format": "prettier . --write",
+    "format:check": "prettier . --check",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "test:e2e": "playwright test --pass-with-no-tests"
+  }
 }

package/playwright.config.ts

@@ -0,0 +1,10 @@
+import { defineConfig } from '@playwright/test';
+
+export default defineConfig({
+  testDir: './tests/playwright',
+  testMatch: '**/*.test.ts',
+  timeout: 120_000,
+  workers: 1,
+  reporter: 'list',
+  use: { trace: 'off' },
+});

package/server/app.ts

@@ -0,0 +1,50 @@
+import type { Application } from '@nocobase/app-server/application';
+import { DatabaseProvider } from '@nocobase/app-server/database';
+import { I18nProvider, i18nHttpMiddleware } from '@nocobase/app-server/i18n';
+import { CachingProvider } from '@nocobase/app-server/caching';
+import { DriveProvider } from '@nocobase/app-server/drive';
+import { IdGeneratorProvider } from '@nocobase/app-server/id-generator';
+import {
+  LoggingProvider,
+  requestLoggingMiddleware,
+} from '@nocobase/app-server/logging';
+import { QueueServiceProvider } from '@nocobase/app-server/queue';
+import { SecretsProvider } from '@nocobase/app-server/secrets';
+import { JobExecutorServiceProvider } from '@nocobase/app-server/jobs';
+import {
+  SessionProvider,
+  sessionHttpMiddleware,
+} from '@nocobase/app-server/session';
+import { healthCheckApiRoutes } from '@nocobase/app-server/router';
+import {
+  createAppFromRuntime,
+  type AppRuntimeContext,
+} from '@nocobase/app-server/runtime';
+import { spaRootRoutes } from '@nocobase/app-server/spa';
+
+export function createApp(runtime: AppRuntimeContext): Application {
+  const app = createAppFromRuntime(runtime);
+
+  app.addServiceProvider(DatabaseProvider);
+  app.addServiceProvider(I18nProvider);
+  app.addServiceProvider(LoggingProvider);
+  app.addServiceProvider(CachingProvider);
+  app.addServiceProvider(IdGeneratorProvider);
+  app.addServiceProvider(SecretsProvider);
+  app.addServiceProvider(SessionProvider);
+  app.addServiceProvider(DriveProvider);
+  app.addServiceProvider(QueueServiceProvider, {
+    nodeEnv: runtime.env.NODE_ENV,
+  });
+  app.addServiceProvider(JobExecutorServiceProvider, {
+    nodeEnv: runtime.env.NODE_ENV,
+  });
+  app.addHttpMiddleware(requestLoggingMiddleware);
+  app.addHttpMiddleware(sessionHttpMiddleware);
+  app.addHttpMiddleware(i18nHttpMiddleware);
+  app.addRoutes(healthCheckApiRoutes);
+  app.addRuntimeContributions(runtime);
+  app.addRoutes(spaRootRoutes);
+
+  return app;
+}

package/server/config/api.ts

@@ -0,0 +1,8 @@
+import type { AppConfigFactory } from '@nocobase/app-server/config';
+import { defineApiConfig, type ApiConfig } from '@nocobase/app-server/router';
+
+// Limits every /api request meets ahead of its route: bodyLimit, timeout and rateLimit. Each is off until config.yml
+// sets it; see the commented api section in config.example.yml. API_BODY_LIMIT and API_TIMEOUT set the first two.
+const api: AppConfigFactory<ApiConfig> = defineApiConfig();
+
+export default api;