create-lumal-admin 0.0.5-beta → 0.0.6-beta

package/templates/presets/standard/tests/profile.test.ts.template

@@ -0,0 +1,72 @@
+import type { BusinessTransport, DataRow } from '../src/app/services/contracts';
+import { beforeEach, describe, expect, it } from 'vitest';
+import { createProfileService, passwordInput, profileInput } from '../src/modules/profile/api';
+import { createLocalHandler } from '../src/modules/profile/local';
+
+let users: DataRow[];
+let api: ReturnType<typeof createProfileService>;
+beforeEach(() => {
+  users = [
+    {
+      id: 'admin',
+      username: 'admin',
+      nickname: '管理员',
+      phone: '',
+      roles: ['admin'],
+      status: 'enabled',
+      password: 'lumal123',
+    },
+  ];
+  const handler = createLocalHandler({
+    db: {
+      read: <T extends DataRow>() => structuredClone(users) as T[],
+      write: (_key, rows) => {
+        users = structuredClone(rows);
+      },
+    },
+    user: () => ({ id: 'admin', username: 'admin', name: '管理员' }),
+    assertPermission: () => {},
+  });
+  const transport: BusinessTransport = {
+    request: async <T>(method: Parameters<BusinessTransport['request']>[0], path: string, input = {}) =>
+      (await handler.request(method, path, input)) as T,
+  };
+  api = createProfileService(transport);
+});
+describe('个人资料与密码业务契约', () => {
+  it('读取与修改允许字段，不泄露密码或允许修改身份与角色', async () => {
+    expect(await api.get()).not.toHaveProperty('password');
+    const saved = await api.save(
+      profileInput({ nickname: '已修改', phone: '13800138000', username: 'injected', roles: [] }),
+    );
+    expect(saved.nickname).toBe('已修改');
+    expect(saved.username).toBe('admin');
+    expect(saved.roles).toEqual(['admin']);
+    expect(users[0]?.password).toBe('lumal123');
+    expect(() => profileInput({ nickname: '', phone: 'bad' })).toThrow();
+  });
+  it('错误密码不写入；真实保存后新密码才生效', async () => {
+    await expect(api.changePassword({ currentPassword: 'wrong', newPassword: 'new-password' })).rejects.toThrow(
+      '当前密码',
+    );
+    expect(users[0]?.password).toBe('lumal123');
+    expect(() =>
+      passwordInput({ currentPassword: 'lumal123', newPassword: 'new-password', confirmPassword: 'other' }),
+    ).toThrow('两次');
+    await api.changePassword(
+      passwordInput({ currentPassword: 'lumal123', newPassword: 'new-password', confirmPassword: 'new-password' }),
+    );
+    expect(users[0]?.password).toBe('new-password');
+  });
+  it('hTTP 能力未接入时向页面传播失败，不伪造保存结果', async () => {
+    const http = createProfileService({
+      request: async () => {
+        throw new Error('HTTP 404：未配置个人资料接口');
+      },
+    });
+    await expect(http.get()).rejects.toThrow('HTTP 404');
+    await expect(http.changePassword({ currentPassword: 'old', newPassword: 'new-password' })).rejects.toThrow(
+      'HTTP 404',
+    );
+  });
+});

package/templates/screen/README.md

@@ -0,0 +1,6 @@
+# Screen
+
+独立大屏，不包含 Admin 菜单、标签和系统管理。默认纯静态、无 API、无认证。
+
+首次运行 `pnpm install`，开发使用 `pnpm dev`，提交前执行 `pnpm check`。
+工程规范见 [开发约定](docs/DEVELOPMENT.md)。

package/templates/screen/src/App.vue

@@ -0,0 +1,7 @@
+<script setup lang="ts">
+import ScreenEntry from './screen/ScreenEntry.vue';
+</script>
+
+<template>
+  <ScreenEntry />
+</template>

package/templates/screen/src/screen/ScreenEntry.vue

@@ -0,0 +1,18 @@
+<script setup lang="ts">
+import ScreenView from './ScreenView.vue';
+</script>
+
+<template>
+  <div class="screen-entry">
+    <ScreenView />
+  </div>
+</template>
+
+<style scoped>
+.screen-entry {
+  display: flex;
+  flex-direction: column;
+  height: 100dvh;
+  min-height: 0;
+}
+</style>

package/templates/screen/src/screen/ScreenView.vue

@@ -0,0 +1,48 @@
+<script setup lang="ts">
+import ScreenMetrics from './components/ScreenMetrics.vue';
+// SCREEN_VISUALIZATION_IMPORT
+
+/***********************静态演示数据*********************/
+const metrics = [
+  { label: '任务总数', value: 128 },
+  { label: '已完成', value: 96 },
+  { label: '进行中', value: 32 },
+];
+</script>
+
+<template>
+  <main class="screen-view">
+    <header class="screen-view__header">
+      <h1>数据总览</h1>
+      <span>静态示例</span>
+    </header>
+    <ScreenMetrics :metrics="metrics" />
+    <!-- SCREEN_VISUALIZATION -->
+  </main>
+</template>
+
+<style scoped>
+.screen-view {
+  height: 100%;
+  min-width: 0;
+  min-height: 0;
+  flex: 1;
+  overflow: auto;
+  padding: 32px;
+  font-size: max(14px, var(--lumal-viewport-min-font-size, 14px));
+}
+
+.screen-view__header {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+  margin-bottom: 32px;
+}
+
+.screen-view__header h1 {
+  margin: 0;
+  font-size: max(28px, var(--lumal-viewport-min-font-size, 14px));
+}
+</style>

package/templates/screen/src/screen/components/ScreenMetrics.vue

@@ -0,0 +1,40 @@
+<script setup lang="ts">
+/***********************指标输入*********************/
+defineProps<{ metrics: { label: string; value: number }[] }>();
+</script>
+
+<template>
+  <dl class="screen-metrics">
+    <div v-for="metric in metrics" :key="metric.label" class="screen-metrics__item">
+      <dt>{{ metric.label }}</dt>
+      <dd>{{ metric.value.toLocaleString() }}</dd>
+    </div>
+  </dl>
+</template>
+
+<style scoped>
+.screen-metrics {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(min(100%, 240px), 1fr));
+  gap: 24px;
+  margin: 0;
+}
+
+.screen-metrics__item {
+  padding: 24px;
+  border: 1px solid #d8e0e6;
+  border-top: 3px solid #118c74;
+  border-radius: 4px;
+  background: #fff;
+}
+
+.screen-metrics__item dt {
+  color: #53616f;
+}
+
+.screen-metrics__item dd {
+  margin: 12px 0 0;
+  font-size: max(36px, var(--lumal-viewport-min-font-size, 14px));
+  font-weight: 600;
+}
+</style>

package/templates/screen-auth/src/screen/ScreenEntry.vue

@@ -0,0 +1,52 @@
+<script setup lang="ts">
+import { shallowRef } from 'vue';
+import { authDemo, authEnabled } from '../services/auth-adapter';
+import { authenticated, signIn, signOut } from '../services/session';
+import ScreenLoginForm from './components/ScreenLoginForm.vue';
+import ScreenView from './ScreenView.vue';
+
+/***********************认证门禁*********************/
+const loading = shallowRef(false);
+const error = shallowRef('');
+async function login(username: string, password: string) {
+  loading.value = true;
+  error.value = '';
+  try {
+    await signIn(username, password);
+  } catch (cause) {
+    error.value = cause instanceof Error ? cause.message : '登录失败';
+  } finally {
+    loading.value = false;
+  }
+}
+</script>
+
+<template>
+  <div v-if="authenticated" class="screen-entry">
+    <div class="screen-session">
+      <span v-if="authDemo">Local Demo</span>
+      <button type="button" @click="signOut">退出登录</button>
+    </div>
+    <ScreenView />
+  </div>
+  <main v-else>
+    <ScreenLoginForm :loading="loading" :error="error" :enabled="authEnabled" :demo="authDemo" @submit="login" />
+  </main>
+</template>
+
+<style scoped>
+.screen-entry {
+  display: flex;
+  flex-direction: column;
+  height: 100dvh;
+  min-height: 0;
+}
+.screen-session {
+  flex: none;
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 16px;
+  padding: 12px 32px;
+}
+</style>

package/templates/screen-auth/src/screen/components/ScreenLoginForm.vue

@@ -0,0 +1,44 @@
+<script setup lang="ts">
+import { shallowRef } from 'vue';
+
+/***********************登录输入*********************/
+defineProps<{ loading: boolean; error: string; enabled: boolean; demo: boolean }>();
+const emit = defineEmits<{ submit: [username: string, password: string] }>();
+const username = shallowRef('');
+const password = shallowRef('');
+</script>
+
+<template>
+  <form class="screen-login" @submit.prevent="emit('submit', username, password)">
+    <h1>登录</h1>
+    <p v-if="demo" role="status">Local Demo 认证，仅限开发：demo / demo</p>
+    <p v-if="!enabled" role="alert">生产环境禁止 Local Demo 登录</p>
+    <p v-if="error" role="alert">{{ error }}</p>
+    <label>用户名<input v-model="username" name="username" autocomplete="username" required /></label>
+    <label
+      >密码<input v-model="password" name="password" type="password" autocomplete="current-password" required
+    /></label>
+    <button type="submit" :disabled="loading || !enabled">{{ loading ? '登录中' : '登录' }}</button>
+  </form>
+</template>
+
+<style scoped>
+.screen-login {
+  display: grid;
+  gap: 20px;
+  width: min(360px, calc(100% - 40px));
+  margin: 12vh auto;
+}
+.screen-login label {
+  display: grid;
+  gap: 8px;
+}
+.screen-login input {
+  box-sizing: border-box;
+  width: 100%;
+  min-height: 40px;
+}
+.screen-login button {
+  min-height: 40px;
+}
+</style>

package/templates/screen-auth/src/services/session.ts

@@ -0,0 +1,61 @@
+import type { AuthSessionData } from '@lumal/core/auth';
+import { createAuthSession } from '@lumal/core/auth';
+import { shallowRef } from 'vue';
+import { authEnabled, authenticate, refreshAuth } from './auth-adapter';
+
+/***********************独立会话*********************/
+const session = createAuthSession({
+  storage: typeof sessionStorage === 'undefined' ? undefined : sessionStorage,
+  tokenKey: 'screen:session',
+});
+if (!authEnabled) session.clearToken();
+const saved = session.getSession();
+if (saved?.expiresAt !== undefined && saved.expiresAt <= Date.now()) session.clearToken();
+export const authenticated = shallowRef(session.isAuthenticated());
+let controller = new AbortController();
+let generation = 0;
+let expiry: ReturnType<typeof setTimeout> | undefined;
+export const getSessionToken = () => session.getToken() || undefined;
+export const getSessionSignal = () => controller.signal;
+export const getSessionScope = () => String(generation);
+
+function scheduleExpiry() {
+  clearTimeout(expiry);
+  const expiresAt = session.getSession()?.expiresAt;
+  if (expiresAt === undefined) return;
+  const remaining = expiresAt - Date.now();
+  if (remaining <= 0) signOut();
+  else expiry = setTimeout(scheduleExpiry, Math.min(remaining, 2_147_483_647));
+}
+
+export function signOut() {
+  generation += 1;
+  controller.abort();
+  controller = new AbortController();
+  clearTimeout(expiry);
+  session.clearToken();
+  authenticated.value = false;
+}
+
+function applySession(data: AuthSessionData, expected: number) {
+  if (generation !== expected) throw new Error('会话已切换');
+  session.setSession(data);
+  authenticated.value = true;
+  scheduleExpiry();
+}
+
+export async function signIn(username: string, password: string) {
+  signOut();
+  const expected = generation;
+  const data = await authenticate(username, password, controller.signal);
+  applySession(data, expected);
+}
+
+export async function refreshSession() {
+  const expected = generation;
+  const data = await refreshAuth(session.getRefreshToken(), controller.signal);
+  applySession(data, expected);
+}
+
+scheduleExpiry();
+if (import.meta.hot) import.meta.hot.dispose(() => signOut());

package/templates/screen-auth/tests/session.test.ts.template

@@ -0,0 +1,54 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { authenticate, refreshAuth } from '../src/services/auth-adapter';
+import {
+  authenticated,
+  getSessionSignal,
+  getSessionToken,
+  refreshSession,
+  signIn,
+  signOut,
+} from '../src/services/session';
+
+vi.mock('../src/services/auth-adapter', () => ({
+  authEnabled: true,
+  authenticate: vi.fn(),
+  refreshAuth: vi.fn(),
+}));
+afterEach(() => {
+  signOut();
+  vi.resetAllMocks();
+  vi.useRealTimers();
+});
+
+describe('独立 Screen 会话', () => {
+  it('登录、刷新、退出并取消旧请求', async () => {
+    vi.mocked(authenticate).mockResolvedValue({ accessToken: 'fixture', refreshToken: 'refresh' });
+    vi.mocked(refreshAuth).mockResolvedValue({ accessToken: 'renewed' });
+    await signIn('test', 'secret');
+    const previous = getSessionSignal();
+    await refreshSession();
+    expect(getSessionToken()).toBe('renewed');
+    signOut();
+    expect(previous.aborted).toBe(true);
+    expect(authenticated.value).toBe(false);
+  });
+  it('迟到登录不能恢复已退出的身份', async () => {
+    let finish!: (data: { accessToken: string }) => void;
+    vi.mocked(authenticate).mockImplementation(() => new Promise((resolve) => (finish = resolve)));
+    const pending = signIn('old', 'secret');
+    signOut();
+    finish({ accessToken: 'late' });
+    await expect(pending).rejects.toThrow('会话已切换');
+    expect(getSessionToken()).toBeUndefined();
+  });
+  it('登录失败不回退，过期清除凭据', async () => {
+    vi.mocked(authenticate).mockRejectedValueOnce(new Error('401'));
+    await expect(signIn('wrong', 'wrong')).rejects.toThrow('401');
+    expect(authenticated.value).toBe(false);
+    vi.useFakeTimers();
+    vi.mocked(authenticate).mockResolvedValue({ accessToken: 'short', expiresAt: Date.now() + 100 });
+    await signIn('user', 'secret');
+    vi.advanceTimersByTime(101);
+    expect(authenticated.value).toBe(false);
+  });
+});

package/templates/screen-auth-http/src/services/auth-adapter.ts

@@ -0,0 +1,14 @@
+import { parseAuthSession } from '@lumal/core/auth';
+import { publicRequest } from './http';
+
+export const authDemo = false;
+export const authEnabled = true;
+
+export async function authenticate(username: string, password: string, signal: AbortSignal) {
+  return parseAuthSession(await publicRequest.post('/auth/login', { body: { username, password }, signal }));
+}
+
+export async function refreshAuth(refreshToken: string, signal: AbortSignal) {
+  if (!refreshToken) throw new Error('会话已过期，请重新登录');
+  return parseAuthSession(await publicRequest.post('/auth/refresh', { body: { refreshToken }, signal }));
+}

package/templates/screen-auth-http/tests/auth-adapter.test.ts.template

@@ -0,0 +1,17 @@
+import { describe, expect, it, vi } from 'vitest';
+import { authenticate } from '../src/services/auth-adapter';
+import { publicRequest } from '../src/services/http';
+
+vi.mock('../src/services/http', () => ({ publicRequest: { post: vi.fn() } }));
+describe('接口登录契约', () => {
+  it('验证响应，401 不回退演示', async () => {
+    vi.mocked(publicRequest.post).mockResolvedValueOnce({ accessToken: 'fixture' });
+    await expect(authenticate('user', 'secret', new AbortController().signal)).resolves.toEqual({
+      accessToken: 'fixture',
+    });
+    vi.mocked(publicRequest.post).mockRejectedValueOnce(new Error('Unauthorized'));
+    await expect(authenticate('user', 'bad', new AbortController().signal)).rejects.toThrow('Unauthorized');
+    vi.mocked(publicRequest.post).mockResolvedValueOnce({ code: 403 });
+    await expect(authenticate('user', 'bad', new AbortController().signal)).rejects.toThrow();
+  });
+});

package/templates/screen-auth-local-demo/src/services/auth-adapter.ts

@@ -0,0 +1,15 @@
+import type { AuthSessionData } from '@lumal/core/auth';
+
+export const authDemo = true;
+export const authEnabled = import.meta.env.DEV;
+
+export async function authenticate(username: string, password: string, signal: AbortSignal): Promise<AuthSessionData> {
+  signal.throwIfAborted();
+  if (!authEnabled) throw new Error('生产环境禁止 Local Demo 登录');
+  if (username !== 'demo' || password !== 'demo') throw new Error('演示凭据错误');
+  return { accessToken: 'local-demo-only', expiresAt: Date.now() + 3_600_000 };
+}
+
+export async function refreshAuth(_refreshToken: string, _signal: AbortSignal): Promise<AuthSessionData> {
+  throw new Error('Local Demo 过期后请重新登录');
+}

package/templates/screen-auth-local-demo/tests/auth-adapter.test.ts.template

@@ -0,0 +1,18 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+  vi.resetModules();
+});
+describe('本地 Demo 安全边界', () => {
+  it('开发显式认证，错误凭据不成功', async () => {
+    const { authenticate } = await import('../src/services/auth-adapter');
+    await expect(authenticate('demo', 'demo', new AbortController().signal)).resolves.toHaveProperty('accessToken');
+    await expect(authenticate('bad', 'bad', new AbortController().signal)).rejects.toThrow('演示凭据');
+  });
+  it('生产禁用，即使知道演示凭据', async () => {
+    vi.stubEnv('DEV', false);
+    const { authenticate } = await import('../src/services/auth-adapter');
+    await expect(authenticate('demo', 'demo', new AbortController().signal)).rejects.toThrow('生产环境禁止');
+  });
+});

package/templates/screen-data/src/screen/ScreenView.vue

@@ -0,0 +1,69 @@
+<script setup lang="ts">
+import type { ScreenMetric } from '../services/metrics-types';
+import { onBeforeUnmount, onMounted, shallowRef } from 'vue';
+import { loadMetrics } from '../services/metrics';
+import ScreenMetrics from './components/ScreenMetrics.vue';
+// SCREEN_VISUALIZATION_IMPORT
+
+/***********************指标加载*********************/
+const metrics = shallowRef<ScreenMetric[]>([]);
+const loading = shallowRef(false);
+const error = shallowRef('');
+let controller: AbortController | undefined;
+
+async function reload() {
+  controller?.abort();
+  const current = new AbortController();
+  controller = current;
+  loading.value = true;
+  error.value = '';
+  try {
+    const result = await loadMetrics(current.signal);
+    if (!current.signal.aborted) metrics.value = result;
+  } catch (cause) {
+    if (!current.signal.aborted) error.value = cause instanceof Error ? cause.message : '数据加载失败';
+  } finally {
+    if (!current.signal.aborted) loading.value = false;
+  }
+}
+
+onMounted(() => void reload());
+onBeforeUnmount(() => controller?.abort());
+</script>
+
+<template>
+  <main class="screen-view" :aria-busy="loading">
+    <header class="screen-view__header">
+      <h1>数据总览</h1>
+      <button type="button" :disabled="loading" @click="reload">刷新数据</button>
+    </header>
+    <p v-if="error" role="alert">{{ error }}</p>
+    <p v-else-if="loading" role="status">加载中</p>
+    <ScreenMetrics :metrics="metrics" />
+    <!-- SCREEN_VISUALIZATION -->
+  </main>
+</template>
+
+<style scoped>
+.screen-view {
+  height: 100%;
+  min-width: 0;
+  min-height: 0;
+  flex: 1;
+  overflow: auto;
+  padding: 32px;
+  font-size: max(14px, var(--lumal-viewport-min-font-size, 14px));
+}
+.screen-view__header {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+  margin-bottom: 32px;
+}
+.screen-view__header h1 {
+  margin: 0;
+  font-size: max(28px, var(--lumal-viewport-min-font-size, 14px));
+}
+</style>

package/templates/screen-data/src/services/metrics-types.ts

@@ -0,0 +1,4 @@
+export interface ScreenMetric {
+  label: string;
+  value: number;
+}

package/templates/screen-data-http/src/services/metrics.ts

@@ -0,0 +1,20 @@
+import type { ScreenMetric } from './metrics-types';
+import { request } from './request';
+
+export async function loadMetrics(signal?: AbortSignal): Promise<ScreenMetric[]> {
+  const data = await request.get<unknown>('/screen/metrics', { signal });
+  if (
+    !Array.isArray(data) ||
+    !data.every(
+      (item) =>
+        item !== null &&
+        typeof item === 'object' &&
+        typeof item.label === 'string' &&
+        typeof item.value === 'number' &&
+        Number.isFinite(item.value),
+    )
+  ) {
+    throw new Error('指标响应不符合 API-CONTRACT.md');
+  }
+  return data as ScreenMetric[];
+}

package/templates/screen-data-http/src/services/request.ts

@@ -0,0 +1,3 @@
+import { publicRequest } from './http';
+
+export const request = publicRequest;

package/templates/screen-data-http/tests/metrics.test.ts.template

@@ -0,0 +1,21 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { loadMetrics } from '../src/services/metrics';
+import { request } from '../src/services/request';
+
+vi.mock('../src/services/request', () => ({ request: { get: vi.fn() } }));
+beforeEach(() => vi.resetAllMocks());
+
+describe('接口指标 Adapter', () => {
+  it('透传取消并验证响应', async () => {
+    vi.mocked(request.get).mockResolvedValue([{ label: '任务', value: 3 }]);
+    const signal = new AbortController().signal;
+    expect(await loadMetrics(signal)).toEqual([{ label: '任务', value: 3 }]);
+    expect(request.get).toHaveBeenCalledWith('/screen/metrics', { signal });
+  });
+  it('接口失败不能回退静态示例', async () => {
+    vi.mocked(request.get).mockRejectedValue(new Error('backend rejected'));
+    await expect(loadMetrics()).rejects.toThrow('backend rejected');
+    vi.mocked(request.get).mockResolvedValue({ code: 403 });
+    await expect(loadMetrics()).rejects.toThrow('指标响应');
+  });
+});

package/templates/screen-data-local/src/services/metrics.ts

@@ -0,0 +1,11 @@
+import type { ScreenMetric } from './metrics-types';
+
+/** 明确的本地示例，不会在 HTTP 失败时被调用。 */
+export async function loadMetrics(signal?: AbortSignal): Promise<ScreenMetric[]> {
+  signal?.throwIfAborted();
+  return [
+    { label: '任务总数', value: 128 },
+    { label: '已完成', value: 96 },
+    { label: '进行中', value: 32 },
+  ];
+}

package/templates/screen-data-local/tests/metrics.test.ts.template

@@ -0,0 +1,9 @@
+import { describe, expect, it } from 'vitest';
+import { loadMetrics } from '../src/services/metrics';
+
+describe('本地指标', () => {
+  it('返回明确的示例且尊重取消', async () => {
+    expect(await loadMetrics()).toHaveLength(3);
+    await expect(loadMetrics(AbortSignal.abort())).rejects.toBeDefined();
+  });
+});

package/templates/screen-http/API-CONTRACT.md

@@ -0,0 +1,20 @@
+# Screen HTTP 契约
+
+仅为生成项目的应用 Adapter 约定，不是对任意真实后端的兼容承诺。
+先配置 `VITE_API_BASE_URL`。无配置明确报错，不使用演示数据兜底。
+
+- 选择 HTTP 业务数据时：`GET /screen/metrics` 返回 `[{ label: string, value: number }]`。
+- 选择 HTTP 认证时：`POST /auth/login` 接收 `{ username, password }`，
+  返回 `{ accessToken, refreshToken?, expiresAt? }`。`expiresAt` 是毫秒时间戳。
+- 配置了 refreshToken 时，认证失效通过 `POST /auth/refresh` 接收 `{ refreshToken }`，
+  返回相同会话结构。刷新失败退出，不降级。未提供 refreshToken 时过期直接退出。
+- `Authorization: Bearer <token>` 由 Core 注入。后端仍必须执行权限检查。
+- 默认请求超时 15 秒；取消不会伪装为成功。退出、切换身份会取消旧会话请求。
+- 无认证的 HTTP 数据请求 401 只展示错误，不假定需要登录。
+
+`http.ts`、`auth-adapter.ts`、`metrics.ts` 是应用可以修改的 Adapter。
+后端有 `code/data/msg` 包装时，在客户端的 `onResponse` 显式接入
+`createStandardResponseParser`；字段映射和业务上下文不得写进 Core。
+Token 使用当前标签页的 sessionStorage；按部署安全要求调整，不把演示凭据用于真实后端。
+登录页只在原路径切换内容，路由不会来回跳转或丢失当前 Screen 路径。
+服务端 Token 撤销、单点登录和业务 Store 清理由应用按接口契约补充。

package/templates/screen-http/src/services/http.ts

@@ -0,0 +1,17 @@
+import { createRequestClient } from '@lumal/core/request';
+
+/** 可在这里配置成功码或字段映射；默认协议直接返回 JSON，不猜测业务包装。 */
+export const apiBaseURL = import.meta.env.VITE_API_BASE_URL?.trim() ?? '';
+
+export function prepareRequest(init: RequestInit) {
+  if (!apiBaseURL) throw new Error('请配置 VITE_API_BASE_URL');
+  const signals = [AbortSignal.timeout(15_000)];
+  if (init.signal) signals.push(init.signal);
+  init.signal = AbortSignal.any(signals);
+}
+
+// 登录/刷新用独立客户端，401 不触发已登录会话的退出或递归刷新。
+export const publicRequest = createRequestClient({
+  baseURL: apiBaseURL,
+  onRequest: ({ init }) => prepareRequest(init),
+});