@h-ai/cli 0.1.0-alpha9 → 1.0.0-beta.2

package/templates/features/iam/routes-admin/(auth)/auth/register/+page.svelte.hbs

@@ -1,124 +1,11 @@
-{{!-- Admin 注册页面 --}}
-<script lang="ts">
-  /**
-   * 注册页面
-   */
-{{#if hasI18n}}
-  import * as m from '$lib/paraglide/messages'
-{{/if}}
-
-  let username = $state('')
-  let email = $state('')
-  let password = $state('')
-  let confirmPassword = $state('')
-  let error = $state('')
-  let loading = $state(false)
-
-  async function handleRegister() {
-    error = ''
-    if (password !== confirmPassword) {
-{{#if hasI18n}}
-      error = m.auth_error_password_mismatch()
-{{else}}
-      error = '密码不一致'
-{{/if}}
-      return
-    }
-    loading = true
-    try {
-      const res = await fetch('/api/auth/register', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ username, email, password, confirmPassword }),
-      })
-      const data = await res.json()
-      if (data.success) {
-        window.location.href = '/auth/login'
-      } else {
-{{#if hasI18n}}
-        error = data.error?.message || m.auth_register_failed()
-{{else}}
-        error = data.error?.message || '注册失败'
-{{/if}}
-      }
-    } catch {
-{{#if hasI18n}}
-      error = m.auth_error_network()
-{{else}}
-      error = '网络错误'
-{{/if}}
-    } finally {
-      loading = false
-    }
-  }
+<script lang='ts'>
+  import { goto } from '$app/navigation'
+  import { base, resolve } from '$app/paths'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+
+  const actions = kit.client.createAuthActions({ basePath: `${base}/api/auth` })
 </script>
 
-<svelte:head>
-{{#if hasI18n}}
-  <title>{m.auth_register_title()}</title>
-{{else}}
-  <title>注册</title>
-{{/if}}
-</svelte:head>
-
-{{#if hasI18n}}
-<h2 class="card-title justify-center mb-4">{m.auth_register_title()}</h2>
-{{else}}
-<h2 class="card-title justify-center mb-4">注册</h2>
-{{/if}}
-
-{#if error}
-  <div class="alert alert-error mb-4">
-    <span>{error}</span>
-  </div>
-{/if}
-
-<form onsubmit={(e) => { e.preventDefault(); handleRegister() }} class="space-y-4">
-  <div class="form-control">
-{{#if hasI18n}}
-    <label class="label" for="username"><span class="label-text">{m.auth_label_username()}</span></label>
-{{else}}
-    <label class="label" for="username"><span class="label-text">用户名</span></label>
-{{/if}}
-    <input id="username" type="text" class="input input-bordered w-full" bind:value={username} required />
-  </div>
-  <div class="form-control">
-{{#if hasI18n}}
-    <label class="label" for="email"><span class="label-text">{m.auth_label_email()}</span></label>
-{{else}}
-    <label class="label" for="email"><span class="label-text">邮箱</span></label>
-{{/if}}
-    <input id="email" type="email" class="input input-bordered w-full" bind:value={email} required />
-  </div>
-  <div class="form-control">
-{{#if hasI18n}}
-    <label class="label" for="password"><span class="label-text">{m.auth_label_password()}</span></label>
-{{else}}
-    <label class="label" for="password"><span class="label-text">密码</span></label>
-{{/if}}
-    <input id="password" type="password" class="input input-bordered w-full" bind:value={password} required />
-  </div>
-  <div class="form-control">
-{{#if hasI18n}}
-    <label class="label" for="confirmPassword"><span class="label-text">{m.auth_label_confirm_password()}</span></label>
-{{else}}
-    <label class="label" for="confirmPassword"><span class="label-text">确认密码</span></label>
-{{/if}}
-    <input id="confirmPassword" type="password" class="input input-bordered w-full" bind:value={confirmPassword} required />
-  </div>
-  <button type="submit" class="btn btn-primary w-full" disabled={loading}>
-{{#if hasI18n}}
-    {loading ? m.auth_register_loading() : m.auth_register_submit()}
-{{else}}
-    {loading ? '注册中...' : '注册'}
-{{/if}}
-  </button>
-</form>
-
-<div class="text-center mt-4">
-{{#if hasI18n}}
-  <a href="/auth/login" class="link link-primary text-sm">{m.auth_register_to_login()}</a>
-{{else}}
-  <a href="/auth/login" class="link link-primary text-sm">已有账号？立即登录</a>
-{{/if}}
-</div>
+<AuthPanel config={page.data.iamPublicConfig} {actions} initialMode='register' loginUrl={resolve('/auth/login', {})} registerUrl={resolve('/auth/register', {})} onauthenticated={() => goto(resolve('/admin', {}))} />

package/templates/features/iam/routes-admin/(auth)/auth/reset-password/+page.svelte.hbs

@@ -0,0 +1,10 @@
+<script lang='ts'>
+  import { base, resolve } from '$app/paths'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+
+  const actions = kit.client.createAuthActions({ basePath: `${base}/api/auth` })
+</script>
+
+<AuthPanel config={page.data.iamPublicConfig} {actions} initialMode='reset' resetToken={page.url.searchParams.get('token') ?? ''} loginUrl={resolve('/auth/login', {})} />

package/templates/features/iam/routes-h5/auth/forgot-password/+page.svelte.hbs

@@ -0,0 +1,10 @@
+<script lang='ts'>
+  import { base, resolve } from '$app/paths'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+
+  const actions = kit.client.createAuthActions({ basePath: `${base}/api/auth` })
+</script>
+
+<AuthPanel config={page.data.iamPublicConfig} {actions} initialMode='forgot' resetToken={page.url.searchParams.get('token') ?? ''} loginUrl={resolve('/auth/login', {})} />

package/templates/features/iam/routes-h5/auth/login/+page.svelte.hbs

@@ -1,98 +1,11 @@
-{{!-- H5 登录页面 --}}
-<script lang="ts">
-  /**
-   * H5 登录页面
-   */
-{{#if hasI18n}}
-  import * as m from '$lib/paraglide/messages'
-{{/if}}
-
-  let username = $state('')
-  let password = $state('')
-  let error = $state('')
-  let loading = $state(false)
-
-  async function handleLogin() {
-    error = ''
-    loading = true
-    try {
-      const res = await fetch('/api/auth/login', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ username, password }),
-      })
-      const data = await res.json()
-      if (data.success) {
-        window.location.href = '/'
-      } else {
-{{#if hasI18n}}
-        error = data.error?.message || m.auth_login_failed()
-{{else}}
-        error = data.error?.message || '登录失败'
-{{/if}}
-      }
-    } catch {
-{{#if hasI18n}}
-      error = m.auth_error_network()
-{{else}}
-      error = '网络错误'
-{{/if}}
-    } finally {
-      loading = false
-    }
-  }
+<script lang='ts'>
+  import { goto } from '$app/navigation'
+  import { base, resolve } from '$app/paths'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+
+  const authActions = kit.client.createAuthActions({ basePath: `${base}/api/auth` })
 </script>
 
-<svelte:head>
-{{#if hasI18n}}
-  <title>{m.auth_login_title()}</title>
-{{else}}
-  <title>登录</title>
-{{/if}}
-</svelte:head>
-
-<div class="p-4 pt-12">
-{{#if hasI18n}}
-  <h1 class="text-2xl font-bold text-center mb-8">{m.auth_login_title()}</h1>
-{{else}}
-  <h1 class="text-2xl font-bold text-center mb-8">登录</h1>
-{{/if}}
-
-  {#if error}
-    <div class="alert alert-error mb-4">
-      <span>{error}</span>
-    </div>
-  {/if}
-
-  <form onsubmit={(e) => { e.preventDefault(); handleLogin() }} class="space-y-4">
-    <div class="form-control">
-{{#if hasI18n}}
-      <input type="text" placeholder={m.auth_label_username()} class="input input-bordered w-full" bind:value={username} required />
-{{else}}
-      <input type="text" placeholder="用户名" class="input input-bordered w-full" bind:value={username} required />
-{{/if}}
-    </div>
-    <div class="form-control">
-{{#if hasI18n}}
-      <input type="password" placeholder={m.auth_label_password()} class="input input-bordered w-full" bind:value={password} required />
-{{else}}
-      <input type="password" placeholder="密码" class="input input-bordered w-full" bind:value={password} required />
-{{/if}}
-    </div>
-    <button type="submit" class="btn btn-primary w-full" disabled={loading}>
-{{#if hasI18n}}
-      {loading ? m.auth_login_loading() : m.auth_login_submit()}
-{{else}}
-      {loading ? '登录中...' : '登录'}
-{{/if}}
-    </button>
-  </form>
-
-  <div class="text-center mt-6">
-{{#if hasI18n}}
-    <a href="/auth/register" class="link link-primary text-sm">{m.auth_login_to_register()}</a>
-{{else}}
-    <a href="/auth/register" class="link link-primary text-sm">没有账号？立即注册</a>
-{{/if}}
-  </div>
-</div>
+<AuthPanel config={page.data.iamPublicConfig} actions={authActions} initialMode='login' loginUrl={resolve('/auth/login', {})} registerUrl={resolve('/auth/register', {})} onauthenticated={() => goto(resolve('/', {}))} />

package/templates/features/iam/routes-h5/auth/register/+page.svelte.hbs

@@ -1,114 +1,11 @@
-{{!-- H5 注册页面 --}}
-<script lang="ts">
-  /**
-   * H5 注册页面
-   */
-{{#if hasI18n}}
-  import * as m from '$lib/paraglide/messages'
-{{/if}}
-
-  let username = $state('')
-  let password = $state('')
-  let confirmPassword = $state('')
-  let error = $state('')
-  let loading = $state(false)
-
-  async function handleRegister() {
-    error = ''
-    if (password !== confirmPassword) {
-{{#if hasI18n}}
-      error = m.auth_error_password_mismatch()
-{{else}}
-      error = '密码不一致'
-{{/if}}
-      return
-    }
-    loading = true
-    try {
-      const res = await fetch('/api/auth/register', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ username, password, confirmPassword }),
-      })
-      const data = await res.json()
-      if (data.success) {
-        window.location.href = '/auth/login'
-      } else {
-{{#if hasI18n}}
-        error = data.error?.message || m.auth_register_failed()
-{{else}}
-        error = data.error?.message || '注册失败'
-{{/if}}
-      }
-    } catch {
-{{#if hasI18n}}
-      error = m.auth_error_network()
-{{else}}
-      error = '网络错误'
-{{/if}}
-    } finally {
-      loading = false
-    }
-  }
+<script lang='ts'>
+  import { goto } from '$app/navigation'
+  import { base, resolve } from '$app/paths'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+
+  const authActions = kit.client.createAuthActions({ basePath: `${base}/api/auth` })
 </script>
 
-<svelte:head>
-{{#if hasI18n}}
-  <title>{m.auth_register_title()}</title>
-{{else}}
-  <title>注册</title>
-{{/if}}
-</svelte:head>
-
-<div class="p-4 pt-12">
-{{#if hasI18n}}
-  <h1 class="text-2xl font-bold text-center mb-8">{m.auth_register_title()}</h1>
-{{else}}
-  <h1 class="text-2xl font-bold text-center mb-8">注册</h1>
-{{/if}}
-
-  {#if error}
-    <div class="alert alert-error mb-4">
-      <span>{error}</span>
-    </div>
-  {/if}
-
-  <form onsubmit={(e) => { e.preventDefault(); handleRegister() }} class="space-y-4">
-    <div class="form-control">
-{{#if hasI18n}}
-      <input type="text" placeholder={m.auth_label_username()} class="input input-bordered w-full" bind:value={username} required />
-{{else}}
-      <input type="text" placeholder="用户名" class="input input-bordered w-full" bind:value={username} required />
-{{/if}}
-    </div>
-    <div class="form-control">
-{{#if hasI18n}}
-      <input type="password" placeholder={m.auth_label_password()} class="input input-bordered w-full" bind:value={password} required />
-{{else}}
-      <input type="password" placeholder="密码" class="input input-bordered w-full" bind:value={password} required />
-{{/if}}
-    </div>
-    <div class="form-control">
-{{#if hasI18n}}
-      <input type="password" placeholder={m.auth_label_confirm_password()} class="input input-bordered w-full" bind:value={confirmPassword} required />
-{{else}}
-      <input type="password" placeholder="确认密码" class="input input-bordered w-full" bind:value={confirmPassword} required />
-{{/if}}
-    </div>
-    <button type="submit" class="btn btn-primary w-full" disabled={loading}>
-{{#if hasI18n}}
-      {loading ? m.auth_register_loading() : m.auth_register_submit()}
-{{else}}
-      {loading ? '注册中...' : '注册'}
-{{/if}}
-    </button>
-  </form>
-
-  <div class="text-center mt-6">
-{{#if hasI18n}}
-    <a href="/auth/login" class="link link-primary text-sm">{m.auth_register_to_login()}</a>
-{{else}}
-    <a href="/auth/login" class="link link-primary text-sm">已有账号？立即登录</a>
-{{/if}}
-  </div>
-</div>
+<AuthPanel config={page.data.iamPublicConfig} actions={authActions} initialMode='register' loginUrl={resolve('/auth/login', {})} registerUrl={resolve('/auth/register', {})} onauthenticated={() => goto(resolve('/', {}))} />

package/templates/features/iam/routes-h5/auth/reset-password/+page.svelte.hbs

@@ -0,0 +1,10 @@
+<script lang='ts'>
+  import { base, resolve } from '$app/paths'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+
+  const actions = kit.client.createAuthActions({ basePath: `${base}/api/auth` })
+</script>
+
+<AuthPanel config={page.data.iamPublicConfig} {actions} initialMode='reset' resetToken={page.url.searchParams.get('token') ?? ''} loginUrl={resolve('/auth/login', {})} />

package/templates/features/iam/routes-shared/api/auth/captcha/+server.ts.hbs

@@ -0,0 +1,4 @@
+import { iam } from '@h-ai/iam'
+import { kit } from '@h-ai/kit'
+
+export const POST = kit.auth.createApi(iam).createCaptcha

package/templates/features/iam/routes-shared/api/auth/config/+server.ts

@@ -0,0 +1,4 @@
+import { iam } from '@h-ai/iam'
+import { kit } from '@h-ai/kit'
+
+export const GET = kit.auth.createApi(iam).publicConfig

package/templates/features/iam/routes-shared/api/auth/login/+server.ts

@@ -1,32 +1,4 @@
-/**
- * 登录 API
- */
-import type { RequestHandler } from './$types'
 import { iam } from '@h-ai/iam'
 import { kit } from '@h-ai/kit'
 
-export const POST: RequestHandler = async ({ request, cookies, locals }) => {
-  const body = await request.json()
-  const { identifier, password } = body
-
-  if (!identifier || !password) {
-    return kit.response.badRequest('identifier and password are required')
-  }
-
-  const result = await iam.auth.login({ identifier, password })
-  if (!result.success) {
-    return kit.response.unauthorized(result.error.message)
-  }
-
-  const { tokens } = result.data
-
-  cookies.set('session_token', tokens.accessToken, {
-    path: '/',
-    httpOnly: true,
-    sameSite: 'lax',
-    secure: false,
-    maxAge: tokens.expiresIn,
-  })
-
-  return kit.response.ok({ message: 'Login successful' }, locals.requestId)
-}
+export const POST = kit.auth.createApi(iam).login

package/templates/features/iam/routes-shared/api/auth/login/ldap/+server.ts

@@ -0,0 +1,4 @@
+import { iam } from '@h-ai/iam'
+import { kit } from '@h-ai/kit'
+
+export const POST = kit.auth.createApi(iam).loginWithLdap

package/templates/features/iam/routes-shared/api/auth/login/otp/+server.ts

@@ -0,0 +1,4 @@
+import { iam } from '@h-ai/iam'
+import { kit } from '@h-ai/kit'
+
+export const POST = kit.auth.createApi(iam).loginWithOtp

package/templates/features/iam/routes-shared/api/auth/logout/+server.ts

@@ -5,11 +5,18 @@ import type { RequestHandler } from './$types'
 import { iam } from '@h-ai/iam'
 import { kit } from '@h-ai/kit'
 
-export const POST: RequestHandler = async ({ cookies, locals }) => {
+export const POST: RequestHandler = kit.handler(async ({ cookies, locals }) => {
   const token = cookies.get('session_token')
-  if (token) {
-    await iam.auth.logout(token)
+  try {
+    if (token) {
+      const result = await iam.auth.logout(token)
+      if (!result.success)
+        return kit.response.fromError(result.error, locals.requestId)
+    }
+    return kit.response.ok({ authenticated: false }, locals.requestId)
   }
-  cookies.delete('session_token', { path: '/' })
-  return kit.response.ok({ message: 'Logout successful' }, locals.requestId)
-}
+  finally {
+    // 本地Cookie清理不代表服务端撤销成功，失败响应必须保留。
+    cookies.delete('session_token', { path: '/' })
+  }
+})

package/templates/features/iam/routes-shared/api/auth/otp/send/+server.ts

@@ -0,0 +1,4 @@
+import { iam } from '@h-ai/iam'
+import { kit } from '@h-ai/kit'
+
+export const POST = kit.auth.createApi(iam).sendOtp

package/templates/features/iam/routes-shared/api/auth/password/renew/+server.ts

@@ -0,0 +1,5 @@
+/** 首次或过期密码更新；服务端验证账号和原密码后要求重新登录。 */
+import { iam } from '@h-ai/iam'
+import { kit } from '@h-ai/kit'
+
+export const POST = kit.auth.createApi(iam).renewPassword

package/templates/features/iam/routes-shared/api/auth/password-reset/confirm/+server.ts

@@ -0,0 +1,4 @@
+import { iam } from '@h-ai/iam'
+import { kit } from '@h-ai/kit'
+
+export const POST = kit.auth.createApi(iam).confirmPasswordReset

package/templates/features/iam/routes-shared/api/auth/password-reset/request/+server.ts

@@ -0,0 +1,4 @@
+import { iam } from '@h-ai/iam'
+import { kit } from '@h-ai/kit'
+
+export const POST = kit.auth.createApi(iam).requestPasswordReset

package/templates/features/iam/routes-shared/api/auth/reauthenticate/+server.ts

@@ -0,0 +1,5 @@
+/** 敏感操作的短期单次再鉴别凭据；不属于匿名端点。 */
+import { iam } from '@h-ai/iam'
+import { kit } from '@h-ai/kit'
+
+export const POST = kit.auth.createApi(iam).reauthenticate

package/templates/features/iam/routes-shared/api/auth/register/+server.ts

@@ -1,26 +1,4 @@
-/**
- * 注册 API
- */
-import type { RequestHandler } from './$types'
 import { iam } from '@h-ai/iam'
 import { kit } from '@h-ai/kit'
 
-export const POST: RequestHandler = async ({ request, locals }) => {
-  const body = await request.json()
-  const { username, email, password, confirmPassword } = body
-
-  if (!username || !password) {
-    return kit.response.badRequest('Username and password are required')
-  }
-
-  if (password !== confirmPassword) {
-    return kit.response.badRequest('Passwords do not match')
-  }
-
-  const result = await iam.user.register({ username, email, password })
-  if (!result.success) {
-    return kit.response.badRequest(result.error.message)
-  }
-
-  return kit.response.ok({ message: 'Registration successful' }, locals.requestId)
-}
+export const POST = kit.auth.createApi(iam).register

package/templates/features/iam/routes-shared/api/auth/session/close/+server.ts.hbs

@@ -0,0 +1,4 @@
+import { iam } from '@h-ai/iam'
+import { kit } from '@h-ai/kit'
+
+export const POST = kit.auth.createApi(iam).closeSession

package/templates/features/iam/routes-website/auth/forgot-password/+page.svelte.hbs

@@ -0,0 +1,10 @@
+<script lang='ts'>
+  import { base, resolve } from '$app/paths'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+
+  const actions = kit.client.createAuthActions({ basePath: `${base}/api/auth` })
+</script>
+
+<AuthPanel config={page.data.iamPublicConfig} {actions} initialMode='forgot' resetToken={page.url.searchParams.get('token') ?? ''} loginUrl={resolve('/auth/login', {})} />

package/templates/features/iam/routes-website/auth/login/+page.svelte.hbs

@@ -0,0 +1,11 @@
+<script lang='ts'>
+  import { goto } from '$app/navigation'
+  import { base, resolve } from '$app/paths'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+
+  const authActions = kit.client.createAuthActions({ basePath: `${base}/api/auth` })
+</script>
+
+<AuthPanel config={page.data.iamPublicConfig} actions={authActions} initialMode='login' loginUrl={resolve('/auth/login', {})} registerUrl={resolve('/auth/register', {})} onauthenticated={() => goto(resolve('/', {}))} />

package/templates/features/iam/routes-website/auth/register/+page.svelte.hbs

@@ -0,0 +1,11 @@
+<script lang='ts'>
+  import { goto } from '$app/navigation'
+  import { base, resolve } from '$app/paths'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+
+  const authActions = kit.client.createAuthActions({ basePath: `${base}/api/auth` })
+</script>
+
+<AuthPanel config={page.data.iamPublicConfig} actions={authActions} initialMode='register' loginUrl={resolve('/auth/login', {})} registerUrl={resolve('/auth/register', {})} onauthenticated={() => goto(resolve('/', {}))} />

package/templates/features/iam/routes-website/auth/reset-password/+page.svelte.hbs

@@ -0,0 +1,10 @@
+<script lang='ts'>
+  import { base, resolve } from '$app/paths'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+
+  const actions = kit.client.createAuthActions({ basePath: `${base}/api/auth` })
+</script>
+
+<AuthPanel config={page.data.iamPublicConfig} {actions} initialMode='reset' resetToken={page.url.searchParams.get('token') ?? ''} loginUrl={resolve('/auth/login', {})} />

package/templates/features/payment/routes/api/v1/payment/create/+server.ts

@@ -1,30 +1,32 @@
-/**
- * 创建支付订单 API
- */
+/** 创建支付参数 API；渠道、场景与 openid 必须通过显式校验，禁止回落到其它支付模式。 */
 import type { RequestHandler } from './$types'
+import { base } from '$app/paths'
 import { kit } from '@h-ai/kit'
 import { payment } from '@h-ai/payment'
+import { z } from 'zod'
 
-export const POST: RequestHandler = async ({ request, locals }) => {
-  const body = await request.json()
-  const { provider, tradeType, outTradeNo, totalAmount, subject, notifyUrl } = body
-
-  if (!provider || !outTradeNo || !totalAmount || !subject) {
-    return kit.response.badRequest('Missing required fields: provider, outTradeNo, totalAmount, subject')
-  }
+/** 本模板的业务字段；服务端仍需从可信订单重新核对金额、描述、订单号和所属用户。 */
+const CreatePaymentSchema = z.object({
+  provider: z.enum(['wechat', 'alipay', 'stripe']),
+  tradeType: z.enum(['jsapi', 'h5']),
+  outTradeNo: z.string().min(1),
+  totalAmount: z.number().int().positive(),
+  subject: z.string().min(1),
+  userId: z.string().trim().min(1).max(128).optional(),
+  metadata: z.record(z.string(), z.string()).optional(),
+  notifyUrl: z.url({ protocol: /^https?$/ }).optional(),
+}).strict().refine(input => input.tradeType === (input.provider === 'wechat' ? 'jsapi' : 'h5'), { path: ['tradeType'] }).refine(input => input.provider !== 'wechat' || input.userId !== undefined, { path: ['userId'] })
 
-  const result = await payment.createOrder({
-    provider,
-    tradeType: tradeType ?? 'JSAPI',
-    outTradeNo,
-    totalAmount,
-    subject,
-    notifyUrl: notifyUrl ?? `${new URL(request.url).origin}/api/v1/payment/notify/${provider}`,
+export const POST: RequestHandler = async ({ request, locals }) => {
+  const { provider, tradeType, outTradeNo, totalAmount, subject, notifyUrl, userId, metadata } = await kit.validate.body(request, CreatePaymentSchema)
+  const result = await payment.createOrder(provider, {
+    orderNo: outTradeNo,
+    amount: totalAmount,
+    description: subject,
+    tradeType,
+    userId,
+    metadata,
+    notifyUrl: notifyUrl ?? `${new URL(request.url).origin}${base}/api/v1/payment/notify/${provider}`,
   })
-
-  if (!result.success) {
-    return kit.response.internalError(result.error.message)
-  }
-
-  return kit.response.ok(result.data, locals.requestId)
+  return kit.response.fromResult(result, locals.requestId)
 }