@h-ai/cli 0.1.0-alpha.59 → 0.1.0-alpha.61

package/templates/apps/fullstack/packages/{{projectName}}-serv/config/_reach.yml.hbs

@@ -0,0 +1,52 @@
+# 开发触达示例；生产环境改为 SMTP、短信或 API Provider。
+providers:
+  - name: email
+    type: console
+  - name: sms
+    type: console
+  # SMTP 替换 email 控制台 Provider；同名 Provider 只保留一个。
+  # - name: email
+  #   type: smtp
+  #   host: ${HAI_REACH_SMTP_HOST:smtp.example.com}
+  #   port: ${HAI_REACH_SMTP_PORT:465}
+  #   secure: true
+  #   user: ${HAI_REACH_SMTP_USER:}
+  #   pass: ${HAI_REACH_SMTP_PASS:}
+  #   from: ${HAI_REACH_SMTP_FROM:noreply@example.com}
+  # 阿里云短信替换 sms 控制台 Provider。
+  # - name: sms
+  #   type: aliyun-sms
+  #   accessKeyId: ${HAI_REACH_SMS_ACCESS_KEY}
+  #   accessKeySecret: ${HAI_REACH_SMS_SECRET_KEY}
+  #   signName: MyApp
+  #   endpoint: dysmsapi.aliyuncs.com
+  # 自有发送服务：按需将 template.provider 改为 custom。
+  # - name: custom
+  #   type: api
+  #   url: https://notify.example.com/send
+  #   method: POST # POST | PUT
+  #   headers:
+  #     Authorization: 'Bearer ${HAI_REACH_API_TOKEN}'
+  #   timeout: 10000
+templates:
+  - name: otp_email
+    provider: email
+    subject: Verification code
+    body: 'Your verification code is {code}.'
+  - name: otp_sms
+    provider: sms
+    body: 'Your verification code is {code}.'
+  - name: password_reset
+    provider: email
+    subject: Password reset
+    body: 'Reset your password: {resetUrl}. Expires at {expiresAt}.'
+  - name: password_reset_sms
+    provider: sms
+    body: 'Reset your password: {resetUrl}. Expires at {expiresAt}.'
+
+# 免打扰可选；验证码应避免 delay，以免延迟到失效后投递。
+# dnd:
+#   enabled: false
+#   strategy: discard # discard | delay
+#   start: '22:00'
+#   end: '08:00'

package/templates/apps/fullstack/packages/{{projectName}}-serv/config/_scheduler.yml.hbs

@@ -0,0 +1 @@
+{{{moduleConfig 'scheduler' features.scheduler}}}

package/templates/apps/fullstack/packages/{{projectName}}-serv/config/_serv.yml.hbs

@@ -15,10 +15,17 @@ http:
     path: /openapi.json
   docs:
     path: /docs
+    # requireAuth: true
   health:
     path: /health
     readyPath: /ready
   rpc: false
+  # 内部 RPC 可选；启用时用对象替换 false，gateway-only 必须配置网关密钥。
+  # rpc:
+  #   prefix: /api/rpc
+  #   access: gateway-only # loopback | private-network | gateway-only
+  #   gatewayHeader: X-Gateway-Key
+  #   gatewaySecret: ${HAI_SERV_HTTP_RPC_GATEWAYSECRET}
 
 cors:
   origin: ${HAI_CORS_ORIGIN:*}
@@ -40,3 +47,4 @@ cors:
 transport:
   keyExchangePath: /_hai/key-exchange
   maxClients: 10000
+  # excludePaths: [/health, /ready]

package/templates/apps/fullstack/packages/{{projectName}}-serv/config/_storage.yml.hbs

@@ -1,3 +1 @@
-# HAI_STORAGE 可整体替换为 S3/MinIO/RustFS 配置。
-type: local
-root: ./data/uploads
+{{{moduleConfig 'storage' true}}}

package/templates/apps/fullstack/packages/{{projectName}}-serv/config/_vecdb.yml.hbs

@@ -0,0 +1 @@
+{{{moduleConfig 'vecdb' features.vecdb}}}

package/templates/apps/fullstack/packages/{{projectName}}-serv/package.json.hbs

@@ -34,6 +34,7 @@
     "@h-ai/core": "{{haiPackageSpecifier}}",
     "@h-ai/crypto": "{{haiPackageSpecifier}}",
     "@h-ai/iam": "{{haiPackageSpecifier}}",
+    "@h-ai/reach": "{{haiPackageSpecifier}}",
     "@h-ai/reldb": "{{haiPackageSpecifier}}",
     "@h-ai/serv": "{{haiPackageSpecifier}}",
     "@h-ai/storage": "{{haiPackageSpecifier}}",

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/admin-service.ts.hbs

@@ -113,7 +113,7 @@ export async function createAdminUser(input: AdminCreateUser, context: ServConte
     return role
   if (!role.data)
     return err(HaiCommonError.NOT_FOUND, serverM('notFound', { locale: context.locale }))
-  const registered = await iam.user.register(input)
+  const registered = await iam.user.createUser(input)
   if (!registered.success)
     return registered
   const userId = registered.data.user.id

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/procedures/admin-procedures.ts.hbs

@@ -20,7 +20,7 @@ import { serverM } from '../messages.js'
 
 /** 身份认证沿用框架公共契约与 refresh-cookie 传输。 */
 export function createAuthProcedures() {
-  const { currentUser, refresh } = createIamProcedures({ iam }).auth
+  const { currentUser, refresh, publicConfig, loginWithOtp, loginWithLdap, register, sendOtp, requestPasswordReset, confirmPasswordReset } = createIamProcedures({ iam }).auth
   const { login, logout, changePassword } = authContract
   // 仅覆写需要业务审计的认证操作，其余直接复用框架；未选认证入口不挂载。
   const audited = serv.implement({ login, logout, changePassword }).context<ServContext>().route('login', async ({ input, context }) => {
@@ -42,7 +42,7 @@ export function createAuthProcedures() {
     await recordAudit(context, 'password-change', 'profile', context.session.userId)
     return result
   }).build()
-  return { ...audited, currentUser, refresh }
+  return { ...audited, currentUser, refresh, publicConfig, loginWithOtp, loginWithLdap, register, sendOtp, requestPasswordReset, confirmPasswordReset }
 }
 
 export function createAdminProcedures() {

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/runtime.ts.hbs

@@ -7,6 +7,7 @@ import { cache, CacheConfigSchema } from '@h-ai/cache'
 import { core } from '@h-ai/core'
 import { crypto } from '@h-ai/crypto'
 import { iam, IamConfigSchema } from '@h-ai/iam'
+import { reach, ReachConfigSchema } from '@h-ai/reach'
 import { reldb, ReldbConfigSchema } from '@h-ai/reldb'
 import { ServConfigSchema } from '@h-ai/serv'
 import { storage, StorageConfigSchema } from '@h-ai/storage'
@@ -39,7 +40,10 @@ async function runInitialization(): Promise<void> {
     requireInitialized(await cache.init(cacheConfig), 'cache')
     requireInitialized(await crypto.init(), 'crypto')
     requireInitialized(await storage.init(storageConfig), 'storage')
-    requireInitialized(await iam.init(iamConfig), 'iam')
+    const reachConfig = core.config.get('reach')
+    if (reachConfig)
+      requireInitialized(await reach.init(ReachConfigSchema.parse(reachConfig)), 'reach')
+    requireInitialized(await iam.init({ ...iamConfig, reach }), 'iam')
     requireInitialized(await audit.init(auditConfig), 'audit')
     await ensureRolesAndAdmin()
     initialized = true
@@ -71,7 +75,7 @@ async function ensureRolesAndAdmin(): Promise<void> {
   const password = process.env.HAI_ADMIN_DEFAULT_PASSWORD?.trim()
   if (!password)
     throw new Error('Set HAI_ADMIN_DEFAULT_PASSWORD before the first start to create the administrator account')
-  const registered = requireInitialized(await iam.user.register({ username: 'admin', password, displayName: serverM('admin') }), 'iam-bootstrap')
+  const registered = requireInitialized(await iam.user.createUser({ username: 'admin', password, displayName: serverM('admin') }), 'iam-bootstrap')
   const adminRole = requireInitialized(await iam.authz.getRoleByCode('admin'), 'iam-role')
   if (!adminRole)
     throw new Error('Administrator role is missing')
@@ -87,7 +91,7 @@ async function ensureRolesAndAdmin(): Promise<void> {
 
 /** 关闭顺序与依赖初始化顺序相反，同时覆盖启动失败路径。 */
 export async function closeModules(): Promise<void> {
-  for (const [name, module] of [['audit', audit], ['iam', iam], ['storage', storage], ['crypto', crypto], ['cache', cache], ['reldb', reldb]] as const) {
+  for (const [name, module] of [['audit', audit], ['iam', iam], ['reach', reach], ['storage', storage], ['crypto', crypto], ['cache', cache], ['reldb', reldb]] as const) {
     if (!module.isInitialized)
       continue
     const result = await module.close()

package/templates/apps/fullstack/packages/{{projectName}}-serv/tests/app-server.test.ts.hbs

@@ -113,11 +113,18 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     }
   })
 
-  it('does not mount unselected default IAM routes', async () => {
+  it('mounts public auth routes while keeping default IAM administration routes private', async () => {
+    const config = await transport.encryptedFetch(`http://localhost${PREFIX}/auth/config`)
+    expect(config.status).toBe(200)
+    for (const route of ['/auth/register', '/auth/login/ldap', '/auth/login/otp', '/auth/otp/send', '/auth/password-reset/request', '/auth/password-reset/confirm']) {
+      const response = await transport.encryptedFetch(`http://localhost${PREFIX}${route}`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: '{}',
+      })
+      expect(response.status).toBe(400)
+    }
     for (const [route, method] of [
-      ['/auth/register', 'POST'],
-      ['/auth/login/otp', 'POST'],
-      ['/auth/otp/send', 'POST'],
       ['/iam/users', 'GET'],
       ['/iam/roles', 'POST'],
     ] as const) {

package/templates/apps/fullstack/packages/{{projectName}}-shared/README.md.hbs

@@ -25,8 +25,20 @@ Language and theme preferences are saved in IAM user metadata, restored after lo
 
 Shared page copy belongs in `messages/{zh-CN,en-US}.json`. Frontend-specific copy belongs in each app's own messages directory. Keep `baseLocale` and `locales` aligned across all enabled projects, then run root `pnpm i18n:compile`; do not edit generated Paraglide files.
 
+All frontend and shared projects load the installed message-format plugin from the workspace root `node_modules`, matching the scaffold's hoisted dependency layout. Compilation uses the workspace dependency version and does not fetch a plugin from a CDN.
+
 The scaffold theme configuration determines the themes compiled into frontend CSS. Personal settings offer only those available themes. Customize the common layout in `src/lib/components/AppShell.svelte`, the management pages in adjacent components, and business behavior in `src/lib/stores/management-store.svelte.ts`.
 
 ## Validation
 
 Run root `pnpm typecheck`, `pnpm lint`, `pnpm build`, `pnpm test` and `pnpm test:e2e`. Shared API tests exercise real transport key exchange, encrypted request/response handling, configured core metadata and credential forwarding. Root browser tests cover administrator and ordinary-user workflows, avatar rendering, persisted preferences, password/session invalidation and narrow-screen layout.
+
+## IAM configuration
+
+The service's `config/_iam.yml` controls login methods, registration, password reset, agreements and `ui` branding. Email and SMS use providers/templates in `_reach.yml` or custom callbacks. `AuthPanel` uses the public configuration and framework auth actions to manage tokens, resend countdowns and errors. All service nodes must share the same database and Redis; memory cache is for a single process.
+
+LDAP and Reach are optional. Install ldapts in the IAM service workspace only when using its default LDAP client, then enable login.ldap and set connection settings. Custom onOtpSendEmail/onOtpSendSms/onPasswordResetRequest callbacks work without Reach and must reject on delivery failure. Agreements open in a Modal. LoginForm/RegisterForm support header/extraFields/footer snippets; AuthPanel forwards loginHeader/loginFields/loginFooter and registerHeader/registerFields/registerFooter. See the generated hai-iam/hai-ui skills for configuration and examples.
+
+协议支持配置中的 userAgreementMarkdown/privacyPolicyMarkdown 正文及 URL；同主题优先 Markdown，由安全渲染器在弹窗显示。
+
+See `.agents/skills/hai-iam/reference.md` in the generated application for the complete contract.

package/templates/apps/fullstack/packages/{{projectName}}-shared/messages/en-US.json.hbs

@@ -39,7 +39,7 @@
   "preferences_title": "Preferences",
   "preferences_description": "Your language and appearance preferences follow your account across devices.",
   "password_title": "Change password",
-  "password_rules": "Use at least 8 characters. Choose a different password. You will need to sign in again after changing it.",
+  "password_rules": "Choose a different password.",
   "password_changed": "Password updated. Please sign in with your new password.",
   "avatar_hint": "Upload a PNG, JPEG or WebP image, up to 512 KB.",
   "avatar_invalid": "Choose a PNG, JPEG or WebP image no larger than 512 KB.",
@@ -55,7 +55,7 @@
   "user_role": "Role",
   "user_status": "Status",
   "user_create": "Add user",
-  "initial_password_rules": "Use at least 8 characters.",
+  "initial_password_rules": "Use at least {min} characters.",
   "account_enabled": "Allow sign-in",
   "users_empty": "No matching accounts. Try another search or create a user.",
   "user_edit": "Edit user",

package/templates/apps/fullstack/packages/{{projectName}}-shared/messages/zh-CN.json.hbs

@@ -39,7 +39,7 @@
   "preferences_title": "偏好设置",
   "preferences_description": "语言与界面风格保存到个人账户，在不同设备上保持一致。",
   "password_title": "修改密码",
-  "password_rules": "密码至少 8 个字符，请使用与旧密码不同的新密码。修改后需要重新登录。",
+  "password_rules": "请使用与旧密码不同的新密码。",
   "password_changed": "密码已修改，请使用新密码重新登录。",
   "avatar_hint": "支持 PNG、JPEG 和 WebP 图片，大小不超过 512 KB。",
   "avatar_invalid": "请选择不超过 512 KB 的 PNG、JPEG 或 WebP 图片。",
@@ -55,7 +55,7 @@
   "user_role": "角色",
   "user_status": "状态",
   "user_create": "新增用户",
-  "initial_password_rules": "密码至少 8 个字符。",
+  "initial_password_rules": "密码至少 {min} 个字符。",
   "account_enabled": "启用账户",
   "users_empty": "没有匹配的账户，请调整查询条件或新增用户。",
   "user_edit": "编辑用户",

package/templates/apps/fullstack/packages/{{projectName}}-shared/package.json.hbs

@@ -31,6 +31,7 @@
   },
   "dependencies": {
     "@h-ai/api-client": "{{haiPackageSpecifier}}",
+    "@h-ai/api-contract": "{{haiPackageSpecifier}}",
     "@h-ai/core": "{{haiPackageSpecifier}}",
     "@h-ai/crypto": "{{haiPackageSpecifier}}",
     "@h-ai/ui": "{{haiPackageSpecifier}}",

package/templates/apps/fullstack/packages/{{projectName}}-shared/project.inlang/settings.json.hbs

@@ -3,7 +3,7 @@
   "baseLocale": "{{fullstack.i18n.baseLocale}}",
   "locales": [{{#each fullstack.i18n.locales}}"{{this}}"{{#unless @last}}, {{/unless}}{{/each}}],
   "modules": [
-    "https://cdn.jsdelivr.net/npm/@inlang/plugin-message-format@latest/dist/index.js"
+    "../../node_modules/@inlang/plugin-message-format/dist/index.js"
   ],
   "plugin.inlang.messageFormat": {
     "pathPattern": "./messages/{locale}.json"

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/api/api-client.ts.hbs

@@ -86,3 +86,6 @@ function normalizeApiBaseUrl(value: string): string {
     url.pathname = '/api/v1'
   return url.toString().replace(/\/+$/, '')
 }
+
+/** 标准 IAM 表单动作，平台安全 TokenStorage 由原有初始化配置决定。 */
+export const managementAuthActions = apiClient.createAuthActions(managementApi)

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/components/AdminWorkspace.svelte.hbs

@@ -1,9 +1,10 @@
-<script lang="ts">
+<script lang='ts'>
   import type { ManagementApiOptions } from '../api/api-client.js'
   import { Alert, Skeleton } from '@h-ai/ui/components/compounds/index'
   import { Button } from '@h-ai/ui/components/primitives/index'
-  import { LoginForm } from '@h-ai/ui/components/scenes/iam/index'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
   import { onMount } from 'svelte'
+  import { managementAuthActions } from '../api/api-client.js'
   import * as m from '../paraglide/messages.js'
   import { ManagementStore } from '../stores/management-store.svelte.js'
   import AppShell from './AppShell.svelte'
@@ -15,7 +16,16 @@
   }
   const { platform, apiOptions = {}, onLocaleChange }: Props = $props()
   const store = new ManagementStore()
-  const loginErrors = $derived({ general: store.error })
+  let resetToken = $state('')
+  async function authenticated() {
+    await store.authenticated()
+    if (resetToken) {
+      const url = new URL(location.href)
+      url.searchParams.delete('token')
+      history.replaceState(history.state, '', url)
+    }
+    resetToken = ''
+  }
   const pageComponent = $derived.by(() => {
     if (store.isAdmin && store.page === 'users')
       return import('./UserManagement.svelte')
@@ -26,6 +36,7 @@
     return import('./ProfileSettings.svelte')
   })
   onMount(() => {
+    resetToken = new URL(location.href).searchParams.get('token') ?? ''
     void store.initialize(apiOptions, onLocaleChange)
     return () => {
       void store.close()
@@ -39,31 +50,29 @@
 
 {#key store.locale}
   {#if store.initializing}
-    <div class="grid min-h-dvh place-items-center bg-base-200/50"><div class="w-72 space-y-4"><Skeleton variant="title" /><Skeleton count={3} /><p class="text-center text-sm text-base-content/50">{m.home_loading()}</p></div></div>
-  {:else if !store.user}
-    <main class="grid min-h-dvh place-items-center bg-base-200/50 px-4 py-10">
-      <section class="w-full max-w-md rounded-2xl border border-base-content/8 bg-base-100 p-7 shadow-xl shadow-base-content/3 sm:p-9" data-testid="login-page">
-        <div class="mb-7 flex items-center gap-3">
-          <span class="grid size-11 place-items-center rounded-xl bg-primary text-primary-content"><span class="icon-[tabler--hexagon-letter-h] size-6"></span></span>
-          <div><h1 class="text-lg font-semibold" data-testid="app-name">{store.info?.name || m.login_title()}</h1><p class="mt-1 text-xs text-base-content/45">{m.login_description()}</p></div>
+    <div class='grid min-h-dvh place-items-center bg-base-200/50'><div class='w-72 space-y-4'><Skeleton variant='title' /><Skeleton count={3} /><p class='text-center text-sm text-base-content/50'>{m.home_loading()}</p></div></div>
+  {:else if !store.user || resetToken}
+    <main data-testid='login-page'>
+      {#if !store.info || !store.authConfig}
+        <section class='mx-auto mt-20 max-w-md space-y-4 p-6'>
+          <Alert variant='error'>{store.error || m.home_error()}</Alert>
+          <Button variant='primary' onclick={() => void store.initialize(apiOptions, onLocaleChange)}>{m.home_refresh()}</Button>
+        </section>
+      {:else}
+        <div data-testid='login-form'>
+          {#if store.authConfig && store.error}<Alert variant='error' class='mx-auto max-w-lg'>{store.error}</Alert>{/if}
+          <AuthPanel config={store.authConfig} actions={managementAuthActions} {resetToken} initialMode={resetToken ? 'reset' : 'login'} error={store.authConfig ? '' : store.error} onretry={() => void store.initialize(apiOptions, onLocaleChange)} onauthenticated={authenticated} />
         </div>
-        {#if store.notice}<Alert variant="success" class="mb-5" data-testid="notice">{store.notice}</Alert>{/if}
-        {#if !store.info}
-          <Alert variant="error">{store.error || m.home_error()}</Alert>
-          <Button class="mt-5 w-full" variant="primary" onclick={() => void store.initialize(apiOptions, onLocaleChange)}>{m.home_refresh()}</Button>
-        {:else}
-          <LoginForm loading={store.saving} showRememberMe={false} showForgotPassword={false} errors={loginErrors} onsubmit={data => store.login(data)} data-testid="login-form" />
-          <p class="mt-6 text-center text-xs text-base-content/40"><span data-testid="app-version">v{store.info.version}</span> · <span data-testid="app-environment">{store.info.env}</span></p>
-        {/if}
-      </section>
+        <p class='fixed bottom-3 left-0 right-0 text-center text-xs text-base-content/50'><span data-testid='app-name'>{store.info.name}</span> · <span data-testid='app-version'>v{store.info.version}</span> · <span data-testid='app-environment'>{store.info.env}</span></p>
+      {/if}
     </main>
   {:else}
     <AppShell {platform} {store}>
-      <div class="space-y-5">
-        {#if store.error}<Alert variant="error" data-testid="error">{store.error}</Alert>{/if}
-        {#if store.notice}<Alert variant="success" data-testid="notice">{store.notice}</Alert>{/if}
+      <div class='space-y-5'>
+        {#if store.error}<Alert variant='error' data-testid='error'>{store.error}</Alert>{/if}
+        {#if store.notice}<Alert variant='success' data-testid='notice'>{store.notice}</Alert>{/if}
         {#await pageComponent}
-          <div class="space-y-4"><Skeleton variant="title" /><Skeleton count={3} /></div>
+          <div class='space-y-4'><Skeleton variant='title' /><Skeleton count={3} /></div>
         {:then { default: Page }}
           <Page {store} />
         {/await}

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/components/ProfileSettings.svelte.hbs

@@ -1,4 +1,4 @@
-<script lang="ts">
+<script lang='ts'>
   import type { ManagementStore } from '../stores/management-store.svelte.js'
   import { Card } from '@h-ai/ui/components/compounds/index'
   import { Avatar, Select } from '@h-ai/ui/components/primitives/index'
@@ -14,44 +14,44 @@
   const themeOptions = AVAILABLE_THEMES.map(theme => ({ value: theme, label: getThemeInfo(theme)?.name ?? theme }))
 </script>
 
-<section class="space-y-5" data-testid="settings-page">
+<section class='space-y-5' data-testid='settings-page'>
   <div>
-    <h1 class="text-xl font-semibold tracking-tight">{m.settings_title()}</h1>
-    <p class="mt-1 text-sm text-base-content/50">{m.settings_description()}</p>
+    <h1 class='text-xl font-semibold tracking-tight'>{m.settings_title()}</h1>
+    <p class='mt-1 text-sm text-base-content/50'>{m.settings_description()}</p>
   </div>
   {#if store.user}
-    <div class="grid gap-5 xl:grid-cols-[0.75fr_1.25fr]">
-      <Card bordered shadow={false} class="h-fit">
-        <div class="flex items-center gap-4">
-          <Avatar name={store.user.displayName || store.user.username} src={store.user.avatarUrl} size="lg" />
-          <div class="min-w-0">
-            <h2 class="truncate text-lg font-semibold">{store.user.displayName || store.user.username}</h2>
-            <p class="text-sm text-base-content/50">@{store.user.username}</p>
-            <p class="mt-2 text-xs text-primary">{store.isAdmin ? m.role_admin() : m.role_user()}</p>
+    <div class='grid gap-5 xl:grid-cols-[0.75fr_1.25fr]'>
+      <Card bordered shadow={false} class='h-fit'>
+        <div class='flex items-center gap-4'>
+          <Avatar name={store.user.displayName || store.user.username} src={store.user.avatarUrl} size='lg' />
+          <div class='min-w-0'>
+            <h2 class='truncate text-lg font-semibold'>{store.user.displayName || store.user.username}</h2>
+            <p class='text-sm text-base-content/50'>@{store.user.username}</p>
+            <p class='mt-2 text-xs text-primary'>{store.isAdmin ? m.role_admin() : m.role_user()}</p>
           </div>
         </div>
-        <p class="mt-4 text-xs leading-6 text-base-content/50">{m.avatar_hint()}</p>
+        <p class='mt-4 text-xs leading-6 text-base-content/50'>{m.avatar_hint()}</p>
       </Card>
       <Card title={m.profile_title()} bordered shadow={false}>
-        <UserProfile user={store.user} editable alwaysEditable fields={['avatar', 'displayName', 'email']} avatarAccept="image/png,image/jpeg,image/webp" avatarHint={m.avatar_hint()} loading={store.saving} onsubmit={data => store.saveProfile(data)} onavatarchange={file => void store.uploadAvatar(file)} data-testid="profile-form" />
+        <UserProfile user={store.user} editable alwaysEditable fields={['avatar', 'displayName', 'email']} avatarAccept='image/png,image/jpeg,image/webp' avatarHint={m.avatar_hint()} loading={store.saving} onsubmit={data => store.saveProfile(data)} onavatarchange={file => void store.uploadAvatar(file)} data-testid='profile-form' />
       </Card>
     </div>
     <Card title={m.preferences_title()} bordered shadow={false}>
-      <p class="mb-5 text-sm text-base-content/50">{m.preferences_description()}</p>
-      <div class="grid gap-6 sm:grid-cols-2">
-        <div class="space-y-2">
-          <label class="text-sm font-medium" for="profile-language">{m.settings_language()}</label>
-          <Select id="profile-language" value={store.locale} options={languageOptions} disabled={store.saving} onchange={locale => void store.savePreferences({ locale })} data-testid="profile-language" />
+      <p class='mb-5 text-sm text-base-content/50'>{m.preferences_description()}</p>
+      <div class='grid gap-6 sm:grid-cols-2'>
+        <div class='space-y-2'>
+          <label class='text-sm font-medium' for='profile-language'>{m.settings_language()}</label>
+          <Select id='profile-language' value={store.locale} options={languageOptions} disabled={store.saving} onchange={locale => void store.savePreferences({ locale })} data-testid='profile-language' />
         </div>
-        <div class="space-y-2">
-          <label class="text-sm font-medium" for="profile-theme">{m.settings_theme()}</label>
-          <Select id="profile-theme" value={themeStore.current} options={themeOptions} disabled={store.saving} onchange={theme => void store.savePreferences({ theme })} data-testid="profile-theme" />
+        <div class='space-y-2'>
+          <label class='text-sm font-medium' for='profile-theme'>{m.settings_theme()}</label>
+          <Select id='profile-theme' value={themeStore.current} options={themeOptions} disabled={store.saving} onchange={theme => void store.savePreferences({ theme })} data-testid='profile-theme' />
         </div>
       </div>
     </Card>
     <Card title={m.password_title()} bordered shadow={false}>
-      <p class="mb-5 text-sm text-base-content/50">{m.password_rules()}</p>
-      <div class="max-w-xl"><ChangePasswordForm loading={store.saving} minPasswordLength={8} onsubmit={data => store.changePassword(data)} data-testid="password-form" /></div>
+      <p class='mb-5 text-sm text-base-content/50'>{m.password_rules()}</p>
+      <div class='max-w-xl'><ChangePasswordForm loading={store.saving} passwordPolicy={store.authConfig?.password} minPasswordLength={store.authConfig?.password.minLength ?? 8} onsubmit={data => store.changePassword(data)} data-testid='password-form' /></div>
     </Card>
   {/if}
 </section>

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/components/UserManagement.svelte.hbs

@@ -141,7 +141,7 @@
     <FormField label={m.user_display_name()}><Input bind:value={displayName} maxlength={100} data-testid="user-display-name" /></FormField>
     <FormField label={m.user_email()}><Input type="email" bind:value={email} data-testid="user-email" /></FormField>
     {#if !editing}
-      <FormField label={m.user_password()} hint={m.initial_password_rules()} required><PasswordInput bind:value={password} autocomplete="new-password" minLength={8} data-testid="user-password" /></FormField>
+      <FormField label={m.user_password()} hint={m.initial_password_rules({ min: store.authConfig?.password.minLength ?? 8 })} required><PasswordInput bind:value={password} autocomplete="new-password" minLength={store.authConfig?.password.minLength ?? 8} data-testid="user-password" /></FormField>
     {/if}
     <FormField label={m.user_role()}><Select bind:value={role} options={roleOptions} disabled={editing?.id === store.user?.id} data-testid="user-role" /></FormField>
     <Checkbox bind:checked={enabled} label={m.account_enabled()} disabled={editing?.id === store.user?.id} />

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/stores/management-store.svelte.ts.hbs

@@ -1,5 +1,6 @@
+import type { IamPublicConfig } from '@h-ai/api-contract'
 import type { HaiResult } from '@h-ai/core'
-import type { ChangePasswordFormData, LoginFormData, UserProfileSubmitData } from '@h-ai/ui'
+import type { ChangePasswordFormData, UserProfileSubmitData } from '@h-ai/ui'
 import type { AdminAuditLog, AdminCreateUser, AdminRole, AdminUpdateUser, AdminUser, AvatarUpload, ProfileUpdate } from '{{fullstack.contractPackageName}}'
 import type { AppInfo, ManagementApiOptions } from '../api/api-client.js'
 import { HaiApiClientError } from '@h-ai/api-client'
@@ -17,6 +18,7 @@ export type ManagementPage = 'users' | 'roles' | 'audit' | 'settings'
 /** 页面状态和业务操作在共享 store 中收敛，宿主端仅装配平台能力。 */
 export class ManagementStore {
   info = $state<AppInfo | null>(null)
+  authConfig = $state<IamPublicConfig | null>(null)
   user = $state<CurrentUser | null>(null)
   page = $state<ManagementPage>('settings')
   locale = $state(getLocale())
@@ -63,6 +65,12 @@ export class ManagementStore {
         return
       }
       this.info = info.data
+      const authConfig = await managementApi.iam.auth.publicConfig()
+      if (!authConfig.success) {
+        this.error = authConfig.error.message
+        return
+      }
+      this.authConfig = authConfig.data
       this.applyLocale(info.data.defaultLocale)
       // 默认 Cookie 存储通过 api-client 的加密刷新链路恢复会话。
       const me = await managementApi.iam.auth.currentUser()
@@ -89,20 +97,12 @@ export class ManagementStore {
     await managementApi.close()
   }
 
-  async login(data: LoginFormData): Promise<void> {
-    await this.mutate(async () => {
-      const login = await managementApi.iam.auth.login({ identifier: data.username, password: data.password })
-      if (!login.success) {
-        this.error = login.error.httpStatus && login.error.httpStatus < 500 ? m.login_invalid() : m.network_error()
-        return
-      }
-      await managementApi.auth.setTokens(login.data.tokens)
-      const me = await this.request(() => managementApi.iam.auth.currentUser())
-      if (!me?.success)
-        return
-      this.setUser(me.data)
-      await this.navigate(this.isAdmin ? 'users' : 'settings')
-    })
+  async authenticated(): Promise<void> {
+    const me = await this.request(() => managementApi.iam.auth.currentUser())
+    if (!me?.success)
+      return
+    this.setUser(me.data)
+    await this.navigate(this.isAdmin ? 'users' : 'settings')
   }
 
   async logout(): Promise<void> {
@@ -135,8 +135,8 @@ export class ManagementStore {
     await this.load(async (version) => {
       const result = await this.request(() => managementApi.admin.users.list({
         page,
-pageSize: this.pageSize,
-search: this.usersSearch.trim() || undefined,
+        pageSize: this.pageSize,
+        search: this.usersSearch.trim() || undefined,
         enabled: this.usersStatus === 'all' ? undefined : this.usersStatus === 'enabled',
       }), version)
       if (result?.success && version === this.requestVersion) {
@@ -163,8 +163,8 @@ search: this.usersSearch.trim() || undefined,
     await this.load(async (version) => {
       const result = await this.request(() => managementApi.admin.audit.list({
         page,
-pageSize: this.pageSize,
-action: this.auditAction.trim() || undefined,
+        pageSize: this.pageSize,
+        action: this.auditAction.trim() || undefined,
         resource: this.auditResource.trim() || undefined,
         startDate: this.auditStartDate ? new SvelteDate(`${this.auditStartDate}T00:00:00`).toISOString() : undefined,
         endDate: this.auditEndDate ? new SvelteDate(`${this.auditEndDate}T23:59:59.999`).toISOString() : undefined,
@@ -340,7 +340,7 @@ action: this.auditAction.trim() || undefined,
       if (!result.success) {
         if (result.error.httpStatus === 401 && this.user) {
           this.expireSession()
-}
+        }
         else if (result.error.httpStatus === 403 && this.user) {
           const current = await managementApi.iam.auth.currentUser()
           if (!isCurrent())

package/templates/apps/fullstack/packages/{{projectName}}-shared/tests/management-store.test.ts.hbs

@@ -3,8 +3,8 @@ import * as m from '../src/lib/paraglide/messages.js'
 import { ManagementStore } from '../src/lib/stores/management-store.svelte.js'
 
 const api = vi.hoisted(() => ({
-  auth: { clear: vi.fn(), setTokens: vi.fn() },
-  iam: { auth: { login: vi.fn(), logout: vi.fn(), currentUser: vi.fn() } },
+  auth: { clear: vi.fn() },
+  iam: { auth: { logout: vi.fn(), currentUser: vi.fn() } },
   admin: { users: { list: vi.fn() } },
 }))
 vi.mock('../src/lib/api/api-client.js', () => ({
@@ -35,7 +35,6 @@ function deferred<T>() {
 
 beforeEach(() => {
   vi.resetAllMocks()
-  api.iam.auth.login.mockResolvedValue({ success: true, data: { tokens: { accessToken: 'test-access', expiresIn: 3600, tokenType: 'Bearer' } } })
   api.iam.auth.logout.mockResolvedValue({ success: true })
   api.iam.auth.currentUser.mockResolvedValue({ success: true, data: member })
 })
@@ -48,7 +47,7 @@ describe('management session and request ownership', () => {
     store.user = administrator
     const loading = store.loadUsers()
     await store.logout()
-    await store.login({ username: 'member', password: 'test-password', rememberMe: false })
+    await store.authenticated()
     oldRequest.resolve(forbidden)
     await loading
     expect(store.user?.id).toBe(member.id)
@@ -89,13 +88,13 @@ describe('management session and request ownership', () => {
     expect(api.iam.auth.currentUser).toHaveBeenCalledTimes(1)
   })
 
-  it('reports a connection failure separately from invalid credentials', async () => {
-    api.iam.auth.login.mockResolvedValueOnce({ success: false, error: { code: 'test:unavailable', message: 'Unavailable', httpStatus: 502 } })
+  it('reports a connection failure when loading the authenticated user', async () => {
+    api.iam.auth.currentUser.mockRejectedValueOnce(new Error('Connection unavailable'))
     const store = new ManagementStore()
-    await store.login({ username: 'member', password: 'test-password', rememberMe: false })
+    await store.authenticated()
     expect(store.error).toBe(m.network_error())
     expect(store.error).not.toBe(m.login_invalid())
     expect(store.saving).toBe(false)
-    expect(api.iam.auth.currentUser).not.toHaveBeenCalled()
+    expect(api.iam.auth.currentUser).toHaveBeenCalledTimes(1)
   })
 })