@h-ai/cli 0.1.0-alpha.59 → 0.1.0-alpha.61

package/templates/apps/h5/src/routes/+layout.svelte.hbs

@@ -3,16 +3,20 @@
   /**
    * H5 应用根布局
    */
+  import type { BottomNavItem } from '@h-ai/ui'
   import type { Snippet } from 'svelte'
 {{#if hasI18n}}
   import { browser } from '$app/environment'
 {{/if}}
+  import { goto } from '$app/navigation'
   import { resolve } from '$app/paths'
   import { page } from '$app/state'
 {{#if hasI18n}}
   import * as m from '$lib/paraglide/messages'
   import { getLocale } from '$lib/paraglide/runtime.js'
-  import { setGlobalLocale } from '@h-ai/ui'
+  import { BottomNav, setGlobalLocale } from '@h-ai/ui'
+{{else}}
+  import { BottomNav } from '@h-ai/ui'
 {{/if}}
   import '../app.css'
 
@@ -22,17 +26,27 @@
 
   const { children }: Props = $props()
 
-  const navItems = [
+  const navItems: (BottomNavItem & { path: '/' | '/discover' | '/profile' })[] = [
 {{#if hasI18n}}
-    { path: '/', label: m.nav_home(), icon: 'icon-[tabler--home]' },
-    { path: '/discover', label: m.nav_discover(), icon: 'icon-[tabler--compass]' },
-    { path: '/profile', label: m.nav_profile(), icon: 'icon-[tabler--user]' },
+    { id: 'home', path: '/', label: m.nav_home(), iconClass: 'icon-[tabler--home]' },
+    { id: 'discover', path: '/discover', label: m.nav_discover(), iconClass: 'icon-[tabler--compass]' },
+    { id: 'profile', path: '/profile', label: m.nav_profile(), iconClass: 'icon-[tabler--user]' },
 {{else}}
-    { path: '/', label: '首页', icon: 'icon-[tabler--home]' },
-    { path: '/discover', label: '发现', icon: 'icon-[tabler--compass]' },
-    { path: '/profile', label: '我的', icon: 'icon-[tabler--user]' },
+    { id: 'home', path: '/', label: '首页', iconClass: 'icon-[tabler--home]' },
+    { id: 'discover', path: '/discover', label: '发现', iconClass: 'icon-[tabler--compass]' },
+    { id: 'profile', path: '/profile', label: '我的', iconClass: 'icon-[tabler--user]' },
 {{/if}}
-  ] as const
+  ]
+
+  const activeNav = $derived(navItems.find(item => item.path === page.url.pathname)?.id)
+  // 认证页面独立显示；业务页面复用框架导航和移动端安全区域样式。
+  const isAuthPage = $derived(page.url.pathname.startsWith('/auth'))
+
+  function handleNavigation(id: string) {
+    const item = navItems.find(item => item.id === id)
+    if (item)
+      void goto(resolve(item.path, {}))
+  }
 {{#if hasI18n}}
 
   if (browser) {
@@ -46,17 +60,15 @@
   <title>{page.data.appConfig.name}</title>
 </svelte:head>
 
-<div class='min-h-screen flex flex-col bg-base-200'>
-  <main class='flex-1 pb-16'>
-    {@render children()}
-  </main>
-
-  <nav class='btm-nav btm-nav-sm'>
-    {#each navItems as item (item.path)}
-      <a href={resolve(item.path, {})} class:active={page.url.pathname === item.path} class:text-primary={page.url.pathname === item.path}>
-        <span class='{item.icon} size-5'></span>
-        <span class='btm-nav-label'>{item.label}</span>
-      </a>
-    {/each}
-  </nav>
-</div>
+{#if isAuthPage}
+  {@render children()}
+{:else}
+  <div class='hai-mobile-viewport'>
+    <div class='hai-mobile-shell max-w-lg'>
+      <main class='hai-mobile-main'>
+        {@render children()}
+      </main>
+      <BottomNav items={navItems} active={activeNav} onchange={handleNavigation} centered maxWidth='lg' safeArea />
+    </div>
+  </div>
+{/if}

package/templates/apps/mobile-app/src/App.svelte.hbs

@@ -1,5 +1,12 @@
 <script lang='ts'>
+{{#if features.iam}}
+  import type { IamPublicConfig } from '@h-ai/api-contract'
+  import { apiClient } from '@h-ai/api-client'
+{{/if}}
   import { applyTheme, getSavedTheme, setGlobalLocale } from '@h-ai/ui'
+{{#if features.iam}}
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+{{/if}}
   import { onMount } from 'svelte'
   import { closeApi, initApi, resolveApiBase, usesNativeTokenStorage } from './lib/api.js'
   import { appConfig, initClientCore } from './lib/app-config.js'
@@ -7,6 +14,23 @@
   import * as m from './lib/paraglide/messages.js'
   import { getLocale } from './lib/paraglide/runtime.js'
 
+{{#if features.iam}}
+  const authActions = apiClient.createAuthActions(apiClient)
+  let authConfig = $state<IamPublicConfig | null>(null)
+  let authenticated = $state(false)
+  let resetToken = $state('')
+
+  function handleAuthenticated() {
+    if (resetToken) {
+      const url = new URL(location.href)
+      url.searchParams.delete('token')
+      history.replaceState(history.state, '', url)
+    }
+    resetToken = ''
+    authenticated = true
+  }
+{{/if}}
+
   type TabId = 'home' | 'tasks' | 'profile'
 
   let booting = $state(true)
@@ -29,6 +53,16 @@
       setGlobalLocale(getLocale())
       await initCapacitor()
       await initApi()
+{{#if features.iam}}
+      const config = await authActions.publicConfig()
+      if (!config.success)
+        throw new Error(config.error.message)
+      authConfig = config.data
+      if (!authConfig)
+        throw new Error(m.boot_failed_title())
+      const me = await apiClient.iam.auth.currentUser()
+      authenticated = !resetToken && me.success
+{{/if}}
       nativeRuntime = await isNativeApp()
       nativeTokenStorage = await usesNativeTokenStorage()
     }
@@ -46,6 +80,9 @@
   }
 
   onMount(() => {
+{{#if features.iam}}
+    resetToken = new URL(location.href).searchParams.get('token') ?? ''
+{{/if}}
     void bootstrap()
 
     return () => {
@@ -73,6 +110,12 @@
       </div>
     </div>
   </div>
+{{#if features.iam}}
+{:else if !authenticated}
+  <main>
+    <AuthPanel config={authConfig} actions={authActions} {resetToken} initialMode={resetToken ? 'reset' : 'login'} onauthenticated={handleAuthenticated} />
+  </main>
+{{/if}}
 {:else}
   <div class='hai-mobile-viewport'>
     <div class='hai-mobile-shell max-w-lg'>

package/templates/base/.gitignore.hbs

@@ -13,8 +13,7 @@ ios
 .DS_Store
 test-results/
 playwright-report/
-data/*
-!**/data/.gitkeep
+**/data/
 
 # hai deploy 产物（compose / .env.runtime / 镜像 tar / sidecar 凭据）
 .hai/

package/templates/base/e2e/app.spec.ts.hbs

@@ -1,11 +1,158 @@
+{{#if features.iam}}
+import { mkdir } from 'node:fs/promises'
+import path from 'node:path'
+{{/if}}
+import process from 'node:process'
 import { expect, test } from '@playwright/test'
 
 /** 首页从真实浏览器页面发起，覆盖基础渲染链路。 */
 test('home page renders from browser', async ({ page }) => {
+{{#if_eq appType 'h5'}}
+  await page.setViewportSize({ width: 390, height: 844 })
+{{/if_eq}}
   const pageErrors: string[] = []
   page.on('pageerror', error => pageErrors.push(error.message))
   await page.goto('/')
   await expect(page).toHaveTitle(process.env.HAI_CORE_NAME ?? '{{projectName}}')
   await expect(pageErrors).toEqual([])
   await expect(page.locator('main, section').first()).toBeVisible()
+{{#if_eq appType 'h5'}}
+  // 在手机宽度验证导航真正切换路由，避免样式失效但首页渲染测试仍通过。
+  const nav = page.locator('nav')
+  await nav.getByRole('button', { name: /发现|Discover/i, exact: true }).click()
+  await expect(page).toHaveURL(/\/discover$/)
+  await nav.getByRole('button', { name: /首页|Home/i, exact: true }).click()
+  await expect(page).toHaveURL(/\/$/)
+  expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+{{#if features.iam}}
+  const evidence = process.env.HAI_AUTH_EVIDENCE_DIR || path.resolve('test-results/auth-screenshots')
+  await mkdir(evidence, { recursive: true })
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-home.png'), fullPage: true })
+{{/if}}
+{{/if_eq}}
 })
+{{#if features.iam}}
+
+/** 实际注册和密码登录；截图只保存空白表单。 */
+test('configured IAM registration and password login', async ({ page, context }) => {
+  test.setTimeout(90_000)
+{{#if_eq appType 'h5'}}
+  await page.setViewportSize({ width: 390, height: 844 })
+{{/if_eq}}
+  const evidence = process.env.HAI_AUTH_EVIDENCE_DIR || path.resolve('test-results/auth-screenshots')
+  await mkdir(evidence, { recursive: true })
+  const username = `scaf${Date.now()}`
+  const password = 'ScaffoldPassword123'
+  const authUrl = '{{#if isCapacitorApp}}/{{else}}/auth/login{{/if}}'
+  await page.goto(authUrl)
+  await expect(page.locator('#login-username')).toBeVisible()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-login.png'), fullPage: true })
+  await page.getByRole('{{#if isCapacitorApp}}button{{else}}link{{/if}}', { name: /立即注册|Register now/i }).click()
+  await expect(page.locator('input[name="username"]')).toBeVisible()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-register.png'), fullPage: true })
+  if (process.env.IAM_NOTIFICATION_URL) {
+    // 协议弹窗留在认证页，关闭后继续填写注册表单。
+    await page.getByRole('button', { name: /用户协议|User Agreement/i, exact: true }).click()
+    await expect(page.getByRole('dialog')).toBeVisible()
+    await expect(page.getByRole('dialog').getByRole('heading', { name: 'Configured registration agreement' })).toBeVisible()
+    await expect(page.locator('iframe')).toHaveCount(0)
+    await page.screenshot({ path: path.join(evidence, '{{projectName}}-agreement.png'), fullPage: true })
+    await page.keyboard.press('Escape')
+    await expect(page.getByRole('dialog')).not.toBeVisible()
+  }
+  await page.locator('input[name="username"]').fill(username)
+  await page.locator('input[name="email"]').fill(`${username}@example.com`)
+  await page.locator('input[type="password"]').nth(0).fill(password)
+  await page.locator('input[type="password"]').nth(1).fill(password)
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.register-form')).not.toBeVisible()
+{{#unless isCapacitorApp}}
+  const me = await page.request.get('/api/auth/me')
+  expect(me.ok()).toBe(true)
+  await context.clearCookies()
+{{/unless}}
+  await page.reload()
+  await page.goto(authUrl)
+  await expect(page.locator('#login-username')).toBeVisible()
+  await page.locator('#login-username').fill(username)
+  await page.locator('input[type="password"]').fill(password)
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.login-form')).not.toBeVisible()
+  expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+
+  if (!process.env.IAM_NOTIFICATION_URL)
+    return
+  await context.clearCookies()
+  await page.reload()
+  await page.goto(authUrl)
+  await page.getByRole('button', { name: /邮件验证码|Email code/i, exact: true }).click()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-email.png'), fullPage: true })
+  const email = `${username}@example.com`
+  await page.locator('#login-username').fill(email)
+  await page.getByRole('button', { name: /发送验证码|Send code/i, exact: true }).click()
+  await expect(page.getByRole('button', { name: /秒后重发|Resend in/ })).toBeDisabled()
+  async function received(template: string) {
+    const response = await page.request.get(`${process.env.IAM_NOTIFICATION_URL}/messages?to=${encodeURIComponent(email)}`)
+    const messages = await response.json() as { template: string, vars: Record<string, string> }[]
+    return messages.findLast(item => item.template === template)?.vars
+  }
+  const otp = await received('otp_email')
+  expect(Boolean(otp?.code)).toBe(true)
+  await page.locator('#login-code').fill(otp?.code ?? '')
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.login-form')).not.toBeVisible()
+  await context.clearCookies()
+  await page.reload()
+  await page.goto(authUrl)
+  await page.getByRole('button', { name: /忘记密码|Forgot password/i }).click()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-forgot.png'), fullPage: true })
+  await page.locator('input[type="email"]').fill(email)
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.alert-success')).toBeVisible()
+  const reset = await received('password_reset')
+  expect(Boolean(reset?.token)).toBe(true)
+  await page.getByRole('button', { name: /已有重置令牌|I have a reset token/i }).click()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-reset.png'), fullPage: true })
+  const resetUrl = `{{#if isCapacitorApp}}/{{else}}/auth/reset-password{{/if}}?token=${encodeURIComponent(reset?.token ?? '')}`
+{{#if_eq appType 'h5'}}
+  // 延迟客户端脚本，确定性覆盖 SSR 页面已显示、事件绑定尚未完成的窗口。
+  let resumeClient = () => {}
+  const clientBoot = new Promise<void>((resolve) => {
+    resumeClient = resolve
+  })
+  await page.route('**/*.js', async (route) => {
+    await clientBoot
+    await route.continue()
+  })
+  try {
+    await page.goto(resetUrl, { waitUntil: 'commit' })
+    await expect(page.locator('input[type="password"]').nth(0)).toBeDisabled()
+  }
+  finally {
+    resumeClient()
+    // 等待正在恢复的路由完成，避免提前移除拦截导致 continue 被重复处理。
+    await page.unrouteAll({ behavior: 'wait' })
+  }
+{{else}}
+  await page.goto(resetUrl)
+{{/if_eq}}
+  await expect(page.locator('input[type="password"]').nth(0)).toBeVisible()
+  await page.locator('input[type="password"]').nth(0).fill('ScaffoldReset456')
+  await page.locator('input[type="password"]').nth(1).fill('ScaffoldReset456')
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.alert-success')).toBeVisible()
+  await page.getByRole('{{#if isCapacitorApp}}button{{else}}link{{/if}}', { name: /^(登录|Sign in|Login)$/i }).click()
+  await page.locator('#login-username').fill(username)
+  await page.locator('input[type="password"]').fill('ScaffoldReset456')
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.login-form')).not.toBeVisible()
+  expect(new URL(page.url()).searchParams.has('token')).toBe(false)
+  await page.reload()
+{{#if isCapacitorApp}}
+  // Web 预览采用内存 TokenStore，刷新后应回到登录，而不是已消费令牌的重置页面。
+  await expect(page.locator('#login-username')).toBeVisible()
+{{else}}
+  await expect(await page.request.get('/api/auth/me')).toBeOK()
+{{/if}}
+})
+{{/if}}

package/templates/base/package.json.hbs

@@ -1,7 +1,7 @@
 {
   "engines": { "node": "^22.22.2 || ^24.15.0 || >=26.0.0" },
   "name": "{{projectName}}",
-  "version": "0.1.0-alpha.59",
+  "version": "0.1.0-alpha.61",
   "private": true,
   "packageManager": "pnpm@12.11.2",
   "description": "{{#if_eq appType 'admin'}}Enterprise management system built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'website'}}Enterprise website built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'h5'}}Mobile H5 app built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'api'}}REST API service built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'mobile-app'}}Mobile app built with hai Agent Framework{{/if_eq}}",

package/templates/base/src/hooks.server.ts.hbs

@@ -89,10 +89,10 @@ const haiHandle = kit.createHandle({
         data: session.data,
       }
     },
-    operations: iam.auth,
     loginUrl: '/auth/login',
     protectedPaths: ['/admin/*', '/api/*'],
-    publicPaths: ['/api/auth/*', '/api/public/*', '/api/health'],
+    publicPaths: [...kit.auth.publicPaths, '/api/auth/logout', '/api/public/*', '/api/health'],
+    operations: () => iam.auth,
   },
 {{/if}}
   rateLimit: { windowMs: 60000, maxRequests: 200 },

package/templates/base/src/lib/server/init.ts.hbs

@@ -190,7 +190,7 @@ export async function initApp(): Promise<void> {
 
 {{#if features.iam}}
   // ─── 初始化 IAM ───
-  const iamResult = await iam.init(iamConfig)
+  const iamResult = await iam.init({ ...iamConfig{{#if features.reach}}, reach{{/if}} })
   if (!iamResult.success) {
     throw new Error(`IAM initialization failed: ${iamResult.error.message}`)
   }

package/templates/base/src/routes/+layout.server.ts.hbs

@@ -2,11 +2,17 @@
 {{#unless isSvelteOnlyApp}}
 import type { CoreConfig } from '@h-ai/core'
 import { core } from '@h-ai/core'
+{{#if features.iam}}
+import { iam } from '@h-ai/iam'
+{{/if}}
 
 /** 只向浏览器提供公开配置，避免暴露日志上下文、凭证或其它模块配置。 */
 export function load() {
   const config = core.config.getOrThrow<CoreConfig>('core')
   return {
+{{#if features.iam}}
+    iamPublicConfig: iam.publicConfig,
+{{/if}}
     appConfig: {
       name: config.name,
       version: config.version,

package/templates/base/tests/scaffold.test.ts.hbs

@@ -55,6 +55,9 @@ describe('generated scaffold', () => {
     const config = core.config.getOrThrow<CoreConfig>('core')
     expect(core.logger.getLevel()).toBe(config.logging?.level ?? 'info')
     expect(load()).toEqual({
+{{#if features.iam}}
+      iamPublicConfig: null,
+{{/if}}
       appConfig: { name: config.name, version: config.version, env: config.env, defaultLocale: config.defaultLocale },
     })
   })

package/templates/base/vite.config.ts.hbs

@@ -42,6 +42,7 @@ export default defineConfig(({ mode }) => {
 {{/if}}
 
   return {
+    envPrefix: ['VITE_', 'PUBLIC_'],
 {{#if isSvelteOnlyApp}}
     define: { __APP_CORE_CONFIG__: JSON.stringify(appConfig) },
 {{/if}}

package/templates/features/iam/routes-admin/(auth)/+layout.svelte.hbs

@@ -1,21 +1,7 @@
-{{!-- 认证布局（登录/注册共用） --}}
 <script lang='ts'>
-  /**
-   * 认证布局（登录/注册共用）
-   */
   import type { Snippet } from 'svelte'
 
-  interface Props {
-    children: Snippet
-  }
-
-  const { children }: Props = $props()
+  const { children }: { children: Snippet } = $props()
 </script>
 
-<div class='min-h-screen flex items-center justify-center bg-base-200'>
-  <div class='card w-full max-w-md bg-base-100 shadow-xl'>
-    <div class='card-body'>
-      {@render children()}
-    </div>
-  </div>
-</div>
+{@render children()}

package/templates/features/iam/routes-admin/(auth)/auth/forgot-password/+page.svelte.hbs

@@ -0,0 +1,10 @@
+<script lang='ts'>
+  import { resolve } from '$app/paths'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+
+  const actions = kit.client.createAuthActions()
+</script>
+
+<AuthPanel config={page.data.iamPublicConfig} {actions} initialMode='forgot' resetToken={page.url.searchParams.get('token') ?? ''} loginUrl={resolve('/auth/login', {})} />

package/templates/features/iam/routes-admin/(auth)/auth/login/+page.svelte.hbs

@@ -1,100 +1,11 @@
-{{!-- Admin 登录页面 --}}
 <script lang='ts'>
-  /**
-   * 登录页面
-   */
+  import { goto } from '$app/navigation'
   import { resolve } from '$app/paths'
-{{#if hasI18n}}
-  import * as m from '$lib/paraglide/messages'
-{{/if}}
-  import { Alert, Button, FormField, Input } from '@h-ai/ui'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
 
-  let username = $state('')
-  let password = $state('')
-  let error = $state('')
-  let loading = $state(false)
-
-  async function handleLogin(event: SubmitEvent) {
-    event.preventDefault()
-    error = ''
-    loading = true
-    try {
-      const res = await fetch('/api/auth/login', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ identifier: username, password }),
-      })
-      const data = await res.json()
-      if (data.success) {
-        window.location.href = '/admin'
-      }
-      else {
-{{#if hasI18n}}
-        error = data.error?.message || m.auth_login_failed()
-{{else}}
-        error = data.error?.message || '登录失败'
-{{/if}}
-      }
-    }
-    catch {
-{{#if hasI18n}}
-      error = m.auth_error_network()
-{{else}}
-      error = '网络错误'
-{{/if}}
-    }
-    finally {
-      loading = false
-    }
-  }
+  const actions = kit.client.createAuthActions()
 </script>
 
-<svelte:head>
-{{#if hasI18n}}
-  <title>{m.auth_login_title()}</title>
-{{else}}
-  <title>登录</title>
-{{/if}}
-</svelte:head>
-
-{{#if hasI18n}}
-<h2 class='text-2xl font-bold text-center mb-6'>{m.auth_login_title()}</h2>
-{{else}}
-<h2 class='text-2xl font-bold text-center mb-6'>登录</h2>
-{{/if}}
-
-{#if error}
-  <Alert variant='error' class='mb-4'>{error}</Alert>
-{/if}
-
-<form onsubmit={handleLogin} class='space-y-4'>
-{{#if hasI18n}}
-  <FormField label={m.auth_label_username()} required>
-    <Input id='username' type='text' bind:value={username} required />
-  </FormField>
-  <FormField label={m.auth_label_password()} required>
-    <Input id='password' type='password' bind:value={password} required />
-  </FormField>
-  <Button type='submit' variant='primary' loading={loading} class='w-full'>
-    {loading ? m.auth_login_loading() : m.auth_login_submit()}
-  </Button>
-{{else}}
-  <FormField label='用户名' required>
-    <Input id='username' type='text' bind:value={username} required />
-  </FormField>
-  <FormField label='密码' required>
-    <Input id='password' type='password' bind:value={password} required />
-  </FormField>
-  <Button type='submit' variant='primary' loading={loading} class='w-full'>
-    {loading ? '登录中...' : '登录'}
-  </Button>
-{{/if}}
-</form>
-
-<div class='text-center mt-4'>
-{{#if hasI18n}}
-  <a href={resolve('/auth/register', {})} class='link link-primary text-sm'>{m.auth_login_to_register()}</a>
-{{else}}
-  <a href={resolve('/auth/register', {})} class='link link-primary text-sm'>没有账号？立即注册</a>
-{{/if}}
-</div>
+<AuthPanel config={page.data.iamPublicConfig} {actions} initialMode='login' loginUrl={resolve('/auth/login', {})} registerUrl={resolve('/auth/register', {})} onauthenticated={() => goto(resolve('/admin', {}))} />