@allbluecn/admin-app 0.3.2 → 0.3.4

package/src/lib/auth/page-gate.ts

@@ -0,0 +1,28 @@
+import { redirect } from '@tanstack/react-router'
+
+interface SessionLike {
+  user?: { id?: string; role?: string | null } | null
+}
+
+/**
+ * admin「需登录页面」beforeLoad gate：未登录跳登录并携带回跳；
+ * 已登录但非管理员（ADMIN/SUPER_ADMIN）拒绝回登录页。
+ * session 取自 __root beforeLoad 注入的 context.session（勿在此重复调 getSessionFn）。
+ */
+export function requireAdminPage(args: {
+  context: { session: SessionLike | null }
+  location: { pathname: string; searchStr: string }
+}): void {
+  if (!args.context.session?.user?.id) {
+    throw redirect({
+      to: '/login',
+      search: { redirect: args.location.pathname + args.location.searchStr },
+    })
+  }
+  if (
+    args.context.session.user.role !== 'ADMIN' &&
+    args.context.session.user.role !== 'SUPER_ADMIN'
+  ) {
+    throw redirect({ to: '/login' })
+  }
+}

package/src/lib/auth.config.ts

@@ -22,6 +22,7 @@ import type { PrismaClient } from '@allbluecn/database'
 import bcrypt from 'bcryptjs'
 import { getRandomConfig, presetBgColors } from '@/components/settings/avatar/avatar-config'
 import { resolveIpLocation, getClientIp } from '@allbluecn/kernel'
+import { isLoginBlocked, recordLoginFailure, clearLoginFailures } from '@/server/middlewares/auth-rate-limit'
 
 let _prisma: PrismaClient | null = null
 async function getDb(): Promise<PrismaClient> {
@@ -66,13 +67,7 @@ export const authConfig: StartAuthJSConfig = {
         const creds = credentials as { email: string; password: string; remember?: string; stayLoggedIn?: string }
         if (!creds.email || !creds.password) return null
 
-        const user = await getDb().then(db => db.user.findUnique({
-          where: { email: creds.email },
-          select: { id: true, email: true, username: true, password: true, role: true, status: true },
-        }))
-
-        // 用户不存在：userId 为外键，无法记录日志（保持现状）
-        if (!user) return null
+        const loginEmail = creds.email.toLowerCase().trim()
 
         // 安全提取 IP/UA（start-authjs 传递的 request 类型可能不标准，失败不阻塞登录）
         let ip: string | null = null
@@ -84,7 +79,26 @@ export const authConfig: StartAuthJSConfig = {
             userAgent = headers.get('user-agent') || null
           }
         } catch {
-          // 忽略：IP/UA 仅用于日志，获取失败不影响登录
+          // 忽略：IP/UA 仅用于限流与日志，获取失败不影响登录
+        }
+
+        // SEC-09：登录失败限流（email+IP 维度，仅失败计数，成功清零）。
+        // 被限流返回 null——与密码错误不可区分，不暴露「被限流」细节（防枚举）。
+        // 测试环境豁免（NODE_ENV=test）在限流器内部处理，e2e 成功登录不受影响。
+        if (isLoginBlocked(loginEmail, ip)) return null
+
+        const user = await getDb().then(db => db.user.findUnique({
+          // 邮箱按原样查询：admin 建号/初始 setup 均原样大小写入库（zod .email() 不转
+          // 小写），归一化查询会静默锁死存量混合大小写账号。限流 key 的归一在
+          // auth-rate-limit 的 loginKey() 内部完成，与 DB 查询口径无关。
+          where: { email: creds.email },
+          select: { id: true, email: true, username: true, password: true, role: true, status: true },
+        }))
+
+        // 用户不存在：userId 为外键，无法记录日志（保持现状）
+        if (!user) {
+          recordLoginFailure(loginEmail, ip)
+          return null
         }
 
         // 安全记录登录日志（DB 异常不阻塞登录流程）
@@ -128,11 +142,13 @@ export const authConfig: StartAuthJSConfig = {
         // 密码校验
         const isValid = await bcrypt.compare(creds.password, user.password)
         if (!isValid) {
+          recordLoginFailure(loginEmail, ip)
           await recordLog(false, '密码错误')
           return null
         }
 
-        // 登录成功：记录 IP/UA/地理位置
+        // 登录成功：清零失败计数 + 记录 IP/UA/地理位置
+        clearLoginFailures(loginEmail, ip)
         const location = await resolveIpLocation(ip)
         await recordLog(true, undefined, location)
         await getDb().then(db => db.user.update({ where: { id: user.id }, data: { lastLoginAt: new Date() } }))

package/src/lib/i18n/detect.ts

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
-import { supportedLngs, fallbackLng, isSupportedLocale, type AppLocale } from './config'
+import { fallbackLng, isSupportedLocale, type AppLocale } from './config'
 
 export function detectLocale(request: Request, userLocale: string | null): AppLocale {
   const url = new URL(request.url)

package/src/lib/loader-serial.ts

@@ -0,0 +1,14 @@
+// loader 预取数据的 JSON 归一化：客户端 RPC 路径返回纯 JSON（Date → ISO 字符串），
+// SSR loader 路径若保留 Date 会让同组件在两条路径下收到不同形态。
+// 统一在 loader 出口归一为 JSON 形态，保证与既有 useState + 客户端 fetch 行为一致。
+export type Jsonified<T> = T extends (infer U)[]
+  ? Jsonified<U>[]
+  : T extends Date
+    ? string
+    : T extends object
+      ? { [K in keyof T]: Jsonified<T[K]> }
+      : T
+
+export function jsonify<T>(value: T): Jsonified<T> {
+  return JSON.parse(JSON.stringify(value)) as Jsonified<T>
+}

package/src/providers/index.tsx

@@ -18,7 +18,7 @@
 
 import { ThemeProvider } from "next-themes";
 import { type ReactNode } from "react";
-import { TooltipProvider } from "@/components/ui/tooltip";
+import { TooltipProvider } from "@allbluecn/ui/tooltip";
 
 export function Providers({
   children,

package/src/routeTree.gen.ts

@@ -37,7 +37,7 @@ import { Route as NavPermissionsRouteRouteImport } from './routes/_nav/permissio
 import { Route as NavSettingsRouteRouteImport } from './routes/_nav/settings/route'
 import { Route as NavSsoRouteRouteImport } from './routes/_nav/sso/route'
 import { Route as NavUsersRouteRouteImport } from './routes/_nav/users/route'
-import { Route as ApiSentryTestRouteImport } from './routes/api.sentry-test'
+import { Route as ApiSentryTestRouteImport } from './routes/api/sentry-test'
 import { Route as NavAiPromptsKeyRouteRouteImport } from './routes/_nav/ai-prompts/$key/route'
 import { Route as NavAiProvidersNewRouteRouteImport } from './routes/_nav/ai-providers/new/route'
 import { Route as NavBillingInvoicesRouteRouteImport } from './routes/_nav/billing/invoices/route'
@@ -47,9 +47,14 @@ import { Route as NavKnowledgePublicComplianceRouteRouteImport } from './routes/
 import { Route as NavKnowledgePublicLegalRouteRouteImport } from './routes/_nav/knowledge-public/legal/route'
 import { Route as NavLicensesLicenseIdRouteRouteImport } from './routes/_nav/licenses/$licenseId/route'
 import { Route as NavMonitoringAiUsageRouteRouteImport } from './routes/_nav/monitoring/ai-usage/route'
+import { Route as NavMonitoringErrorsRouteRouteImport } from './routes/_nav/monitoring/errors/route'
+import { Route as NavMonitoringHealthRouteRouteImport } from './routes/_nav/monitoring/health/route'
+import { Route as NavMonitoringLogsRouteRouteImport } from './routes/_nav/monitoring/logs/route'
+import { Route as NavMonitoringMetricsRouteRouteImport } from './routes/_nav/monitoring/metrics/route'
+import { Route as NavMonitoringOverviewRouteRouteImport } from './routes/_nav/monitoring/overview/route'
 import { Route as NavMonitoringSentryRouteRouteImport } from './routes/_nav/monitoring/sentry/route'
 import { Route as NavUsersUserIdRouteRouteImport } from './routes/_nav/users/$userId/route'
-import { Route as ApiAuthSplatRouteImport } from './routes/api.auth.$'
+import { Route as ApiAuthSplatRouteImport } from './routes/api/auth/$'
 import { Route as ApiComplianceDownloadJobIdRouteImport } from './routes/api/compliance-download/$jobId'
 import { Route as ApiObservabilityErrorsRouteImport } from './routes/api/observability/errors'
 import { Route as ApiObservabilityHealthRouteImport } from './routes/api/observability/health'
@@ -63,21 +68,6 @@ const NavAiProvidersIndexRouteLazyRouteImport = createFileRoute(
 )()
 const NavLicensesNewRouteLazyRouteImport =
   createFileRoute('/_nav/licenses/new')()
-const NavMonitoringErrorsRouteLazyRouteImport = createFileRoute(
-  '/_nav/monitoring/errors',
-)()
-const NavMonitoringHealthRouteLazyRouteImport = createFileRoute(
-  '/_nav/monitoring/health',
-)()
-const NavMonitoringLogsRouteLazyRouteImport = createFileRoute(
-  '/_nav/monitoring/logs',
-)()
-const NavMonitoringMetricsRouteLazyRouteImport = createFileRoute(
-  '/_nav/monitoring/metrics',
-)()
-const NavMonitoringOverviewRouteLazyRouteImport = createFileRoute(
-  '/_nav/monitoring/overview',
-)()
 
 const IndexRouteRoute = IndexRouteRouteImport.update({
   id: '/',
@@ -355,40 +345,39 @@ const NavMonitoringAiUsageRouteRoute =
   } as any).lazy(() =>
     import('./routes/_nav/monitoring/ai-usage/route.lazy').then((d) => d.Route),
   )
-const NavMonitoringErrorsRouteLazyRoute =
-  NavMonitoringErrorsRouteLazyRouteImport.update({
+const NavMonitoringErrorsRouteRoute =
+  NavMonitoringErrorsRouteRouteImport.update({
     id: '/errors',
     path: '/errors',
     getParentRoute: () => NavMonitoringRouteRoute,
   } as any).lazy(() =>
     import('./routes/_nav/monitoring/errors/route.lazy').then((d) => d.Route),
   )
-const NavMonitoringHealthRouteLazyRoute =
-  NavMonitoringHealthRouteLazyRouteImport.update({
+const NavMonitoringHealthRouteRoute =
+  NavMonitoringHealthRouteRouteImport.update({
     id: '/health',
     path: '/health',
     getParentRoute: () => NavMonitoringRouteRoute,
   } as any).lazy(() =>
     import('./routes/_nav/monitoring/health/route.lazy').then((d) => d.Route),
   )
-const NavMonitoringLogsRouteLazyRoute =
-  NavMonitoringLogsRouteLazyRouteImport.update({
-    id: '/logs',
-    path: '/logs',
-    getParentRoute: () => NavMonitoringRouteRoute,
-  } as any).lazy(() =>
-    import('./routes/_nav/monitoring/logs/route.lazy').then((d) => d.Route),
-  )
-const NavMonitoringMetricsRouteLazyRoute =
-  NavMonitoringMetricsRouteLazyRouteImport.update({
+const NavMonitoringLogsRouteRoute = NavMonitoringLogsRouteRouteImport.update({
+  id: '/logs',
+  path: '/logs',
+  getParentRoute: () => NavMonitoringRouteRoute,
+} as any).lazy(() =>
+  import('./routes/_nav/monitoring/logs/route.lazy').then((d) => d.Route),
+)
+const NavMonitoringMetricsRouteRoute =
+  NavMonitoringMetricsRouteRouteImport.update({
     id: '/metrics',
     path: '/metrics',
     getParentRoute: () => NavMonitoringRouteRoute,
   } as any).lazy(() =>
     import('./routes/_nav/monitoring/metrics/route.lazy').then((d) => d.Route),
   )
-const NavMonitoringOverviewRouteLazyRoute =
-  NavMonitoringOverviewRouteLazyRouteImport.update({
+const NavMonitoringOverviewRouteRoute =
+  NavMonitoringOverviewRouteRouteImport.update({
     id: '/overview',
     path: '/overview',
     getParentRoute: () => NavMonitoringRouteRoute,
@@ -488,6 +477,11 @@ export interface FileRoutesByFullPath {
   '/knowledge-public/legal': typeof NavKnowledgePublicLegalRouteRoute
   '/licenses/$licenseId': typeof NavLicensesLicenseIdRouteRoute
   '/monitoring/ai-usage': typeof NavMonitoringAiUsageRouteRoute
+  '/monitoring/errors': typeof NavMonitoringErrorsRouteRoute
+  '/monitoring/health': typeof NavMonitoringHealthRouteRoute
+  '/monitoring/logs': typeof NavMonitoringLogsRouteRoute
+  '/monitoring/metrics': typeof NavMonitoringMetricsRouteRoute
+  '/monitoring/overview': typeof NavMonitoringOverviewRouteRoute
   '/monitoring/sentry': typeof NavMonitoringSentryRouteRoute
   '/users/$userId': typeof NavUsersUserIdRouteRoute
   '/api/auth/$': typeof ApiAuthSplatRoute
@@ -497,11 +491,6 @@ export interface FileRoutesByFullPath {
   '/ai-prompts/': typeof NavAiPromptsIndexRouteLazyRoute
   '/ai-providers/': typeof NavAiProvidersIndexRouteLazyRoute
   '/licenses/new': typeof NavLicensesNewRouteLazyRoute
-  '/monitoring/errors': typeof NavMonitoringErrorsRouteLazyRoute
-  '/monitoring/health': typeof NavMonitoringHealthRouteLazyRoute
-  '/monitoring/logs': typeof NavMonitoringLogsRouteLazyRoute
-  '/monitoring/metrics': typeof NavMonitoringMetricsRouteLazyRoute
-  '/monitoring/overview': typeof NavMonitoringOverviewRouteLazyRoute
   '/ai-providers/$id/edit': typeof NavAiProvidersIdEditRouteRoute
   '/billing/subscriptions/$subscriptionId': typeof NavBillingSubscriptionsSubscriptionIdRouteRoute
 }
@@ -539,6 +528,11 @@ export interface FileRoutesByTo {
   '/knowledge-public/legal': typeof NavKnowledgePublicLegalRouteRoute
   '/licenses/$licenseId': typeof NavLicensesLicenseIdRouteRoute
   '/monitoring/ai-usage': typeof NavMonitoringAiUsageRouteRoute
+  '/monitoring/errors': typeof NavMonitoringErrorsRouteRoute
+  '/monitoring/health': typeof NavMonitoringHealthRouteRoute
+  '/monitoring/logs': typeof NavMonitoringLogsRouteRoute
+  '/monitoring/metrics': typeof NavMonitoringMetricsRouteRoute
+  '/monitoring/overview': typeof NavMonitoringOverviewRouteRoute
   '/monitoring/sentry': typeof NavMonitoringSentryRouteRoute
   '/users/$userId': typeof NavUsersUserIdRouteRoute
   '/api/auth/$': typeof ApiAuthSplatRoute
@@ -548,11 +542,6 @@ export interface FileRoutesByTo {
   '/ai-prompts': typeof NavAiPromptsIndexRouteLazyRoute
   '/ai-providers': typeof NavAiProvidersIndexRouteLazyRoute
   '/licenses/new': typeof NavLicensesNewRouteLazyRoute
-  '/monitoring/errors': typeof NavMonitoringErrorsRouteLazyRoute
-  '/monitoring/health': typeof NavMonitoringHealthRouteLazyRoute
-  '/monitoring/logs': typeof NavMonitoringLogsRouteLazyRoute
-  '/monitoring/metrics': typeof NavMonitoringMetricsRouteLazyRoute
-  '/monitoring/overview': typeof NavMonitoringOverviewRouteLazyRoute
   '/ai-providers/$id/edit': typeof NavAiProvidersIdEditRouteRoute
   '/billing/subscriptions/$subscriptionId': typeof NavBillingSubscriptionsSubscriptionIdRouteRoute
 }
@@ -594,6 +583,11 @@ export interface FileRoutesById {
   '/_nav/knowledge-public/legal': typeof NavKnowledgePublicLegalRouteRoute
   '/_nav/licenses/$licenseId': typeof NavLicensesLicenseIdRouteRoute
   '/_nav/monitoring/ai-usage': typeof NavMonitoringAiUsageRouteRoute
+  '/_nav/monitoring/errors': typeof NavMonitoringErrorsRouteRoute
+  '/_nav/monitoring/health': typeof NavMonitoringHealthRouteRoute
+  '/_nav/monitoring/logs': typeof NavMonitoringLogsRouteRoute
+  '/_nav/monitoring/metrics': typeof NavMonitoringMetricsRouteRoute
+  '/_nav/monitoring/overview': typeof NavMonitoringOverviewRouteRoute
   '/_nav/monitoring/sentry': typeof NavMonitoringSentryRouteRoute
   '/_nav/users/$userId': typeof NavUsersUserIdRouteRoute
   '/api/auth/$': typeof ApiAuthSplatRoute
@@ -603,11 +597,6 @@ export interface FileRoutesById {
   '/_nav/ai-prompts/': typeof NavAiPromptsIndexRouteLazyRoute
   '/_nav/ai-providers/': typeof NavAiProvidersIndexRouteLazyRoute
   '/_nav/licenses/new': typeof NavLicensesNewRouteLazyRoute
-  '/_nav/monitoring/errors': typeof NavMonitoringErrorsRouteLazyRoute
-  '/_nav/monitoring/health': typeof NavMonitoringHealthRouteLazyRoute
-  '/_nav/monitoring/logs': typeof NavMonitoringLogsRouteLazyRoute
-  '/_nav/monitoring/metrics': typeof NavMonitoringMetricsRouteLazyRoute
-  '/_nav/monitoring/overview': typeof NavMonitoringOverviewRouteLazyRoute
   '/_nav/ai-providers/$id/edit': typeof NavAiProvidersIdEditRouteRoute
   '/_nav/billing/subscriptions/$subscriptionId': typeof NavBillingSubscriptionsSubscriptionIdRouteRoute
 }
@@ -649,6 +638,11 @@ export interface FileRouteTypes {
     | '/knowledge-public/legal'
     | '/licenses/$licenseId'
     | '/monitoring/ai-usage'
+    | '/monitoring/errors'
+    | '/monitoring/health'
+    | '/monitoring/logs'
+    | '/monitoring/metrics'
+    | '/monitoring/overview'
     | '/monitoring/sentry'
     | '/users/$userId'
     | '/api/auth/$'
@@ -658,11 +652,6 @@ export interface FileRouteTypes {
     | '/ai-prompts/'
     | '/ai-providers/'
     | '/licenses/new'
-    | '/monitoring/errors'
-    | '/monitoring/health'
-    | '/monitoring/logs'
-    | '/monitoring/metrics'
-    | '/monitoring/overview'
     | '/ai-providers/$id/edit'
     | '/billing/subscriptions/$subscriptionId'
   fileRoutesByTo: FileRoutesByTo
@@ -700,6 +689,11 @@ export interface FileRouteTypes {
     | '/knowledge-public/legal'
     | '/licenses/$licenseId'
     | '/monitoring/ai-usage'
+    | '/monitoring/errors'
+    | '/monitoring/health'
+    | '/monitoring/logs'
+    | '/monitoring/metrics'
+    | '/monitoring/overview'
     | '/monitoring/sentry'
     | '/users/$userId'
     | '/api/auth/$'
@@ -709,11 +703,6 @@ export interface FileRouteTypes {
     | '/ai-prompts'
     | '/ai-providers'
     | '/licenses/new'
-    | '/monitoring/errors'
-    | '/monitoring/health'
-    | '/monitoring/logs'
-    | '/monitoring/metrics'
-    | '/monitoring/overview'
     | '/ai-providers/$id/edit'
     | '/billing/subscriptions/$subscriptionId'
   id:
@@ -754,6 +743,11 @@ export interface FileRouteTypes {
     | '/_nav/knowledge-public/legal'
     | '/_nav/licenses/$licenseId'
     | '/_nav/monitoring/ai-usage'
+    | '/_nav/monitoring/errors'
+    | '/_nav/monitoring/health'
+    | '/_nav/monitoring/logs'
+    | '/_nav/monitoring/metrics'
+    | '/_nav/monitoring/overview'
     | '/_nav/monitoring/sentry'
     | '/_nav/users/$userId'
     | '/api/auth/$'
@@ -763,11 +757,6 @@ export interface FileRouteTypes {
     | '/_nav/ai-prompts/'
     | '/_nav/ai-providers/'
     | '/_nav/licenses/new'
-    | '/_nav/monitoring/errors'
-    | '/_nav/monitoring/health'
-    | '/_nav/monitoring/logs'
-    | '/_nav/monitoring/metrics'
-    | '/_nav/monitoring/overview'
     | '/_nav/ai-providers/$id/edit'
     | '/_nav/billing/subscriptions/$subscriptionId'
   fileRoutesById: FileRoutesById
@@ -1064,35 +1053,35 @@ declare module '@tanstack/react-router' {
       id: '/_nav/monitoring/errors'
       path: '/errors'
       fullPath: '/monitoring/errors'
-      preLoaderRoute: typeof NavMonitoringErrorsRouteLazyRouteImport
+      preLoaderRoute: typeof NavMonitoringErrorsRouteRouteImport
       parentRoute: typeof NavMonitoringRouteRoute
     }
     '/_nav/monitoring/health': {
       id: '/_nav/monitoring/health'
       path: '/health'
       fullPath: '/monitoring/health'
-      preLoaderRoute: typeof NavMonitoringHealthRouteLazyRouteImport
+      preLoaderRoute: typeof NavMonitoringHealthRouteRouteImport
       parentRoute: typeof NavMonitoringRouteRoute
     }
     '/_nav/monitoring/logs': {
       id: '/_nav/monitoring/logs'
       path: '/logs'
       fullPath: '/monitoring/logs'
-      preLoaderRoute: typeof NavMonitoringLogsRouteLazyRouteImport
+      preLoaderRoute: typeof NavMonitoringLogsRouteRouteImport
       parentRoute: typeof NavMonitoringRouteRoute
     }
     '/_nav/monitoring/metrics': {
       id: '/_nav/monitoring/metrics'
       path: '/metrics'
       fullPath: '/monitoring/metrics'
-      preLoaderRoute: typeof NavMonitoringMetricsRouteLazyRouteImport
+      preLoaderRoute: typeof NavMonitoringMetricsRouteRouteImport
       parentRoute: typeof NavMonitoringRouteRoute
     }
     '/_nav/monitoring/overview': {
       id: '/_nav/monitoring/overview'
       path: '/overview'
       fullPath: '/monitoring/overview'
-      preLoaderRoute: typeof NavMonitoringOverviewRouteLazyRouteImport
+      preLoaderRoute: typeof NavMonitoringOverviewRouteRouteImport
       parentRoute: typeof NavMonitoringRouteRoute
     }
     '/_nav/monitoring/sentry': {
@@ -1227,22 +1216,22 @@ const NavLicensesRouteRouteWithChildren =
 
 interface NavMonitoringRouteRouteChildren {
   NavMonitoringAiUsageRouteRoute: typeof NavMonitoringAiUsageRouteRoute
+  NavMonitoringErrorsRouteRoute: typeof NavMonitoringErrorsRouteRoute
+  NavMonitoringHealthRouteRoute: typeof NavMonitoringHealthRouteRoute
+  NavMonitoringLogsRouteRoute: typeof NavMonitoringLogsRouteRoute
+  NavMonitoringMetricsRouteRoute: typeof NavMonitoringMetricsRouteRoute
+  NavMonitoringOverviewRouteRoute: typeof NavMonitoringOverviewRouteRoute
   NavMonitoringSentryRouteRoute: typeof NavMonitoringSentryRouteRoute
-  NavMonitoringErrorsRouteLazyRoute: typeof NavMonitoringErrorsRouteLazyRoute
-  NavMonitoringHealthRouteLazyRoute: typeof NavMonitoringHealthRouteLazyRoute
-  NavMonitoringLogsRouteLazyRoute: typeof NavMonitoringLogsRouteLazyRoute
-  NavMonitoringMetricsRouteLazyRoute: typeof NavMonitoringMetricsRouteLazyRoute
-  NavMonitoringOverviewRouteLazyRoute: typeof NavMonitoringOverviewRouteLazyRoute
 }
 
 const NavMonitoringRouteRouteChildren: NavMonitoringRouteRouteChildren = {
   NavMonitoringAiUsageRouteRoute: NavMonitoringAiUsageRouteRoute,
+  NavMonitoringErrorsRouteRoute: NavMonitoringErrorsRouteRoute,
+  NavMonitoringHealthRouteRoute: NavMonitoringHealthRouteRoute,
+  NavMonitoringLogsRouteRoute: NavMonitoringLogsRouteRoute,
+  NavMonitoringMetricsRouteRoute: NavMonitoringMetricsRouteRoute,
+  NavMonitoringOverviewRouteRoute: NavMonitoringOverviewRouteRoute,
   NavMonitoringSentryRouteRoute: NavMonitoringSentryRouteRoute,
-  NavMonitoringErrorsRouteLazyRoute: NavMonitoringErrorsRouteLazyRoute,
-  NavMonitoringHealthRouteLazyRoute: NavMonitoringHealthRouteLazyRoute,
-  NavMonitoringLogsRouteLazyRoute: NavMonitoringLogsRouteLazyRoute,
-  NavMonitoringMetricsRouteLazyRoute: NavMonitoringMetricsRouteLazyRoute,
-  NavMonitoringOverviewRouteLazyRoute: NavMonitoringOverviewRouteLazyRoute,
 }
 
 const NavMonitoringRouteRouteWithChildren =

package/src/routes/__root.tsx

@@ -21,7 +21,7 @@ import globalsCss from '../styles/globals.css?url'
 import type { RouterContext } from '@/lib/router-context'
 import type { AppLocale } from '@/lib/i18n/config'
 import { Providers } from '@/providers'
-import { Toaster } from '@/components/ui/toast'
+import { Toaster } from '@allbluecn/ui/toast'
 import { getSessionFn } from '@/server/serverFns/auth/session'
 import { getLocaleFn } from '@/server/serverFns/locale'
 import { reportClientError } from '@/server/serverFns/monitoring/report-error'
@@ -103,7 +103,7 @@ function RootComponent() {
       <body className="w-full h-full min-h-screen antialiased">
         <Providers>
           <Outlet />
-<Toaster />
+<Toaster position="bottom-right" />
 </Providers>
         <Scripts />
       </body>
@@ -127,8 +127,8 @@ function NotFoundPageInner() {
   )
 }
 
-function ErrorBoundary({ error }: { error: Error }) {
-  return <ErrorBoundaryInner error={error} />
+function ErrorBoundary({ error }: { error: unknown }) {
+  return <ErrorBoundaryInner error={error instanceof Error ? error : new Error(String(error))} />
 }
 
 function ErrorBoundaryInner({ error }: { error: Error }) {

package/src/routes/_nav/audit/route.lazy.tsx

@@ -18,7 +18,7 @@
 import { createLazyFileRoute } from '@tanstack/react-router'
 import { m } from '@/paraglide/messages.js'
 import type React from 'react'
-import { Badge } from '@/components/ui/badge'
+import { Badge } from '@allbluecn/ui/badge'
 
 export const Route = createLazyFileRoute('/_nav/audit')({
   pendingComponent: () => (
@@ -38,7 +38,6 @@ function AuditLogPage(): React.ReactElement {
       resourceId: string | null
       userId: string | null
       workspaceId: string | null
-      metadata: Record<string, unknown>
       ip: string | null
       userAgent: string | null
       createdAt: string

package/src/routes/_nav/compliance/route.lazy.tsx

@@ -19,11 +19,11 @@ import { createLazyFileRoute } from '@tanstack/react-router'
 import { m } from '@/paraglide/messages.js'
 import { useQuery, useQueryClient } from '@tanstack/react-query'
 import { useServerFn } from '@tanstack/react-start'
-import { toast } from '@/components/ui/toast'
+import { toast } from '@allbluecn/ui/toast'
 import type React from 'react'
 import { listComplianceExportsFn, executeComplianceJobFn } from '@/server/serverFns/compliance'
-import { Badge } from '@/components/ui/badge'
-import { Button } from '@/components/ui/button'
+import { Badge } from '@allbluecn/ui/badge'
+import { Button } from '@allbluecn/ui/button'
 import { Loader2 } from 'lucide-react'
 
 export const Route = createLazyFileRoute('/_nav/compliance')({
@@ -156,6 +156,8 @@ function CompliancePage(): React.ReactElement {
                         </span>
                       )}
                       {item.status === 'completed' && !isExpired(item) && (
+                        // 豁免原生 <a>：文件下载语义（download 属性触发浏览器下载而非路由导航），
+                        // TanStack <Link> 不支持 download，替换会丢失下载行为
                         <a
                           href={`/api/compliance-download/${item.id}`}
                           download={`allblue-export-${item.id}.json`}

package/src/routes/_nav/components/route.lazy.tsx

@@ -15,28 +15,18 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-import { useState, useEffect } from 'react'
+import { useState } from 'react'
 import { createLazyFileRoute, useNavigate, useRouter } from '@tanstack/react-router'
-import { BUILTIN_COMPONENTS, registerComponents, unregisterComponent } from '@allbluecn/web-app/prototype'
 import { Plus, Search, Download } from 'lucide-react'
-import { Button } from '@/components/ui/button'
-import { Input } from '@/components/ui/input'
-import {
-  AlertDialog,
-  AlertDialogAction,
-  AlertDialogCancel,
-  AlertDialogContent,
-  AlertDialogDescription,
-  AlertDialogFooter,
-  AlertDialogHeader,
-  AlertDialogTitle,
-} from '@/components/ui/alert-dialog'
+import { Button } from '@allbluecn/ui/button'
+import { Input } from '@allbluecn/ui/input'
+import { ConfirmDialog } from '@allbluecn/ui/components/confirm-dialog'
 import { cn } from '@/lib/utils'
 import { ComponentTable, type ComponentItem } from '@/components/component/component-table'
 import { ComponentFormDialog } from '@/components/component/component-form-dialog'
 import { ComponentImportDialog } from '@/components/component/component-import-dialog'
 import { deleteComponentFn } from '@/server/serverFns/components/mutations'
-import { toast } from '@/components/ui/toast'
+import { toast } from '@allbluecn/ui/toast'
 
 const CATEGORY_TABS = [
   { key: 'all', label: '全部' },
@@ -60,11 +50,6 @@ function ComponentsPage() {
   const navigate = useNavigate({ from: '/components' })
   const router = useRouter()
 
-  useEffect(() => {
-    registerComponents(BUILTIN_COMPONENTS)
-    return () => { BUILTIN_COMPONENTS.forEach((c) => unregisterComponent(c.type)) }
-  }, [])
-
   const [searchInput, setSearchInput] = useState(urlSearch ?? '')
   const [createOpen, setCreateOpen] = useState(false)
   const [editing, setEditing] = useState<ComponentItem | null>(null)
@@ -165,20 +150,15 @@ function ComponentsPage() {
         onSuccess={() => router.invalidate()}
       />
 
-      <AlertDialog open={!!deleting} onOpenChange={(o: boolean) => !o && setDeleting(null)}>
-        <AlertDialogContent>
-          <AlertDialogHeader>
-            <AlertDialogTitle>删除组件「{deleting?.name}」？</AlertDialogTitle>
-            <AlertDialogDescription>
-              组件将被标记为已删除（软删除），不影响已使用该组件的原型页面。可在数据库中恢复。
-            </AlertDialogDescription>
-          </AlertDialogHeader>
-          <AlertDialogFooter>
-            <AlertDialogCancel>取消</AlertDialogCancel>
-            <AlertDialogAction onClick={handleDelete}>删除</AlertDialogAction>
-          </AlertDialogFooter>
-        </AlertDialogContent>
-      </AlertDialog>
+      <ConfirmDialog
+        open={!!deleting}
+        onOpenChange={(o: boolean) => !o && setDeleting(null)}
+        title={<>删除组件「{deleting?.name}」？</>}
+        description="组件将被标记为已删除（软删除），不影响已使用该组件的原型页面。可在数据库中恢复。"
+        cancelLabel="取消"
+        confirmLabel="删除"
+        onConfirm={handleDelete}
+      />
     </div>
   )
 }