
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@lark-apaas/fullstack-cli
Advanced tools
Fullstack 开发工具集 - 文件派生、数据库 Schema 生成、OpenAPI 生成、能力管理、构建工具
npm install --save-dev @lark-apaas/fullstack-cli
每次运行 npm install 时,会自动派生文件到项目:
派生内容:
scripts/ - Shell 脚本目录(总是覆盖).gitignore - 追加 fullstack-cli 相关忽略规则⚠️ scripts/ 目录由 CLI 自动管理,请勿手动修改!
从现有数据库生成 Drizzle ORM schema:
npm run gen:db-schema
环境变量配置:
# 必需
SUDA_DATABASE_URL=postgresql://user:pass@host:port/dbname?schema=public
# 可选
DB_SCHEMA_OUTPUT=server/database/schema.ts # 输出路径
DRIZZLE_SCHEMA_FILTER=public,custom # Schema 过滤器
DRIZZLE_TABLES_FILTER=users,orders # 表过滤器
工作流程:
SUDA_DATABASE_URL 读取数据库连接drizzle.config.ts(用户无需维护)drizzle-kit introspectserver/database/schema.ts自动生成 OpenAPI 文档和客户端 SDK:
npm run gen:openapi
环境变量配置:
# 可选
APP_MODULE_PATH=server/app.module # AppModule 路径(不含扩展名)
CLIENT_BASE_PATH=/ # 客户端基础路径
工作流程:
AppModule管理 Action 插件的安装、更新、删除和查看:
# 安装插件(默认最新版)
fullstack-cli action-plugin install @office/feishu-create-group
# 安装指定版本
fullstack-cli action-plugin install @office/feishu-create-group@1.0.0
# 更新插件到最新版
fullstack-cli action-plugin update @office/feishu-create-group
# 删除插件
fullstack-cli action-plugin remove @office/feishu-create-group
# 查看已安装的插件列表
fullstack-cli action-plugin list
命令别名:
| 完整命令 | 别名 |
|---|---|
action-plugin install | action-plugin i |
action-plugin update | action-plugin up |
action-plugin remove | action-plugin rm |
action-plugin list | action-plugin ls |
插件存储:
node_modules/<plugin-name>/(标准 npm 包位置).capabilityrc.json(记录已安装的 action 插件元信息)查看和管理项目中的能力配置:
# 列出所有能力(充血后,带 actions 信息)
fullstack-cli capability list
# 列出所有能力(原始配置,不充血)
fullstack-cli capability list --summary
# 获取指定能力配置
fullstack-cli capability list --id create_feishu_group_for_task
# 获取指定能力原始配置
fullstack-cli capability list --id create_feishu_group_for_task --summary
能力充血:
{ dynamic: true } 的 schema 会运行时生成capability.paramsSchema > 动态 schema > 静态 schema_hydrateError 字段(不抛异常)--summary 返回原始配置(存储在 server/capabilities/*.json 中的内容)将老版本 capability 配置(capabilities.json)迁移到新版本(独立 JSON 文件):
# 执行迁移
fullstack-cli capability migration
# 预览模式(不修改文件)
fullstack-cli capability migration --dry-run
# 跳过插件安装
fullstack-cli capability migration --skip-install
# 跳过代码迁移
fullstack-cli capability migration --skip-code
迁移步骤:
JSON 文件迁移
server/capabilities.json(老格式:数组)server/capabilities/<id>.json(新格式)capabilities.json.backup插件安装
sourceActionID → pluginID 映射表查找对应插件fullstack-cli action-plugin install 安装缺失的插件代码迁移
server/ 目录下的 TypeScript 文件import xxx from '@/capabilities/xxx'CapabilityService 依赖注入capabilityService.load('xxx').call('run', params)老格式 vs 新格式:
// 老格式 (capabilities.json)
{
"id": "create_group",
"sourceActionID": "feishu_group_create", // 老字段
"name": "创建群组",
"desc": "创建飞书群组", // 老字段
"actionInput": { ... }, // 老字段
"inputSchema": { ... }
}
// 新格式 (server/capabilities/create_group.json)
{
"id": "create_group",
"pluginID": "@official/feishu-group", // 新字段
"pluginVersion": "1.0.0", // 新字段
"name": "创建群组",
"description": "创建飞书群组", // 重命名
"formValue": { ... }, // 重命名
"paramsSchema": { ... }
}
映射文件格式:
{
"feishu_group_create": "@official/feishu-group",
"feishu_send_message": "@official/feishu-message"
}
获取构建流程所需的 STI 制品上传凭证:
# Pipeline 发布场景 - 需要 commit-id
fullstack-cli build get-token --app-id app_xxx --scene pipeline --commit-id abc123
# 静态资源部署场景
fullstack-cli build get-token --app-id app_xxx --scene static
参数说明:
| 参数 | 必填 | 说明 |
|---|---|---|
--app-id <id> | 是 | 应用 ID |
--scene <scene> | 是 | 构建场景(pipeline、static) |
--commit-id <id> | scene=pipeline 时必填 | Git Commit ID |
输出: stdout 输出 API 返回的完整 JSON,日志/错误输出到 stderr,便于脚本解析:
token_response=$(fullstack-cli build get-token --app-id "$APP_ID" --scene pipeline --commit-id "$COMMIT_ID")
credential=$(echo "$token_response" | jq -r '.data.accessKeyID')
环境变量:
FORCE_AUTHN_INNERAPI_DOMAIN — API 域名FORCE_AUTHN_ACCESS_KEY — Access KeyFORCE_AUTHN_ACCESS_SECRET — Secret KeyFORCE_FRAMEWORK_CLI_CANARY_ENV — Canary 环境(可选)# 查看帮助
fullstack-cli --help
# 生成数据库 schema
fullstack-cli gen-db-schema
# 生成 OpenAPI
fullstack-cli gen-openapi
# Action 插件管理
fullstack-cli action-plugin --help
fullstack-cli action-plugin install <plugin>
fullstack-cli action-plugin list
# 能力配置管理
fullstack-cli capability --help
fullstack-cli capability list
fullstack-cli capability migration --dry-run
# 构建工具
fullstack-cli build --help
fullstack-cli build get-token --app-id <id> --scene <scene> [--commit-id <id>]
# 查看版本
fullstack-cli --version
支持通过 --canary 选项指定 canary 环境,会在 HTTP 请求中添加 x-tt-env header:
# 通过命令行参数指定
fullstack-cli --canary boe_canary action-plugin install @office/feishu-create-group
# 也可以放在命令后面
fullstack-cli action-plugin install @office/feishu-create-group --canary boe_canary
也支持通过环境变量设置:
FORCE_FRAMEWORK_CLI_CANARY_ENV=boe_canary fullstack-cli action-plugin install @office/feishu-create-group
在用户项目的 package.json 中添加:
{
"scripts": {
"gen:db-schema": "fullstack-cli gen-db-schema",
"gen:openapi": "NODE_ENV=development DEPRECATED_SKIP_INIT_DB_CONNECTION=true fullstack-cli gen-openapi"
},
"devDependencies": {
"@lark-apaas/fullstack-cli": "^0.1.0",
"drizzle-kit": "^0.20.0" // 如果使用数据库功能
}
}
派生规则在 src/postinstall.config.ts 中定义:
export default {
sync: [
{
from: 'templates/scripts',
to: 'scripts',
type: 'directory',
overwrite: true,
},
{
from: 'templates/.gitignore.append',
to: '.gitignore',
type: 'append',
},
],
permissions: {
'**/*.sh': 0o755,
},
};
CLI 内置 templates/drizzle.config.ts,通过环境变量动态配置:
drizzle.config.tsAppModule@lark-apaas/fullstack-nestjs-core 的 DevToolsModulefullstack-cli
↓ 依赖
@lark-apaas/devtool-kits (核心逻辑)
用户项目 peerDependencies:
- @nestjs/core (用于 gen-openapi)
- @lark-apaas/fullstack-nestjs-core (用于 gen-openapi)
- drizzle-kit (用于 gen-db-schema,可选)
可以删除的文件:
scripts/gen-db-schema.ts - 已内置到 CLIscripts/gen-openapi.ts - 已内置到 CLIdrizzle.config.ts - 已由 CLI 管理更新 package.json:
{
"scripts": {
- "gen:db-schema": "ts-node scripts/gen-db-schema.ts",
+ "gen:db-schema": "fullstack-cli gen-db-schema",
- "gen:openapi": "nest start --entryFile ../scripts/gen-openapi",
+ "gen:openapi": "fullstack-cli gen-openapi"
}
}
如果项目使用老版本的 capability 系统(capabilities.json 文件),可以使用迁移命令自动升级:
# 1. 先预览迁移效果
fullstack-cli capability migration --dry-run
# 2. 确认无误后执行迁移
fullstack-cli capability migration
迁移会自动完成:
MIT
FAQs
CLI tool for fullstack template management
We found that @lark-apaas/fullstack-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.