@nocobase/app-template-default 1.0.0-beta.60 → 1.0.0-beta.62

package/AGENTS.md

@@ -244,6 +244,14 @@ The languages the application offers are its own locale files, not a configured
 
 The account menu language control in `client/layouts/components/language-switcher.tsx` uses a shadcn submenu with radio items. Render it inside `DropdownMenuContent` to preserve menu keyboard navigation and selection semantics.
 
+## Application access URLs
+
+When reporting or opening this application's address, use the `Local:` URL printed by `pnpm dev`, including the application base path. In normal full-stack development, the Hono server proxies Vite: the user-facing entry uses the server port (`APP_SERVER_PORT`, default 13000), while Vite's port (normally 5173) serves the frontend development process. A response from Vite alone does not verify the application entry.
+
+For an existing run without available startup output, identify its process and working directory, confirm the actual server listening port and configured base path, and check that URL before sharing it. Occupied ports advance automatically, so do not assume defaults. Report when the run belongs to another checkout. Use a host reachable by the user; `localhost` refers to the machine where the browser runs.
+
+With `PROXY_TARGET_URL`, the local Hono server is skipped and Vite becomes the local application entry. Use the printed `Local:` URL in this mode too; `APP_SERVER_PORT` selects its local port (default 5173). See the remote backend development guidance below.
+
 ## Development file watching
 
 Changes to `.env` and `.env.local` (including creation, atomic replacement, and deletion) restart the full development run after its previous processes exit. The new run reloads environment files, ports, proxy settings, and startup hooks; explicit shell variables still take precedence. Use the newly printed URL if the port or base path changes. This also applies in proxy mode. `config.yml` changes restart only the local server. `NOCOBASE_STRICT_STARTUP=true` disables both automatic restarts.

package/README.MD

@@ -167,6 +167,8 @@ Database tasks support `--connection <name>` and `--all`; no argument targets `d
 
 ### Plugins
 
+Mail (`@nocobase/app-plugin-mail`) is included and registered on the client and server. Configure mailbox providers under `mail.providers` in `config.yml` before connecting accounts; no provider credentials or demo mailboxes are included. See the [Mail configuration guide](.agents/skills/nocobase-app-plugin-mail/references/configuration-and-accounts.md). The plugin provides services and UI components; applications compose their own mailbox pages.
+
 Plugins add features to your application. Let these commands edit `package.json`, `client/plugins.ts`, and `server/plugins.ts` for you rather than editing those files by hand.
 
 | Command                                  | What it does                                                |

package/client/components/ui/sidebar.tsx

@@ -679,7 +679,7 @@ function SidebarMenuSubButton({
     props: mergeProps<'a'>(
       {
         className: cn(
-          'flex h-7 min-w-0 -translate-x-px items-center gap-2 overflow-hidden rounded-md px-2 text-sidebar-foreground ring-sidebar-ring outline-hidden group-data-[collapsible=icon]:hidden hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 active:bg-sidebar-accent active:text-sidebar-accent-foreground disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 data-[size=md]:text-sm data-[size=sm]:text-xs data-active:bg-sidebar-accent data-active:text-sidebar-accent-foreground [&>span:last-child]:truncate [&>svg]:size-4 [&>svg]:shrink-0 [&>svg]:text-sidebar-accent-foreground',
+          'flex h-7 min-w-0 -translate-x-px items-center gap-2 overflow-hidden rounded-md px-2 text-sidebar-foreground ring-sidebar-ring outline-hidden group-data-[collapsible=icon]:hidden hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 active:bg-sidebar-accent active:text-sidebar-accent-foreground disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 data-[size=md]:text-sm data-[size=sm]:text-xs data-active:bg-sidebar-accent data-active:text-sidebar-accent-foreground [&>span:last-child]:truncate [&>svg]:size-4 [&>svg]:shrink-0',
           className,
         ),
       },

package/client/locales/system/en-US.ts

@@ -25,6 +25,11 @@ const systemEnUS = {
   'auth.forgotTitle': 'Forgot password',
   'auth.forgotDescription':
     'Enter your email and we will send a reset link if the account exists.',
+  'auth.passwordResetUnavailable':
+    'Self-service password reset is not enabled. Contact an administrator to reset your password.',
+  'auth.capabilityLoadFailed': 'Could not check password reset availability.',
+  'auth.retry': 'Retry',
+  'auth.loading': 'Loading',
   'auth.resetDescription': 'Choose a new password for your account.',
   'auth.resetTitle': 'Reset password',
   'auth.identifier': 'Username or email',
@@ -135,14 +140,29 @@ const systemEnUS = {
             label: 'Close sign-up',
             text: 'This application is for company employees only. Administrators create all accounts.\nDisable self-registration and remove the registration link from the sign-in page.\nExisting employees must still be able to sign in with their accounts and passwords.\nKeep the forgot-password link.',
           },
-          passwordRules: {
-            label: 'Password rules',
-            text: 'Require at least 12 characters when registering or resetting a password.\nShow this requirement in both forms and use consistent validation messages.\nKeep existing accounts able to sign in without requiring an immediate password change.',
-          },
           companySso: {
             label: 'Company SSO',
             text: "Let employees sign in with our company identity platform using OIDC.\n\nKeep account-password sign-in and add a Company account button.\nThe button opens the company identity platform. After successful sign-in, return to the application's home page.\n\nAllow first sign-in to create an application account, identified by the platform's stable user identifier.\nDo not automatically link accounts by matching names or emails. New accounts use the application's default permissions.\n\nList the information the identity platform administrator must provide and the callback URL they need to register.",
           },
+          apiKeys: {
+            label: 'API keys',
+            text: "Add an Integration keys entry to the user menu, using the application's built-in API keys capability.\nEmployees manage only the keys they created, entering a purpose and a validity period in days.\nShow the full key only once after creation, with a prompt to copy and store it right away.\nList each key's name, an identifiable fragment, status, expiry, and last use, and allow revoking it after confirmation.\nNever show the full key in the list, logs, or details.",
+          },
+        },
+      },
+      dataSources: {
+        title: 'Data sources',
+        description:
+          'Choose the application database and use business data from existing external databases.',
+        prompts: {
+          postgres: {
+            label: 'Switch database',
+            text: "Switch the application database from SQLite to PostgreSQL.\nRead the connection details from the server's runtime configuration, not from source code.\nExplain which database driver to install and which settings to fill in, and remind me that existing data is not migrated automatically.",
+          },
+          externalDatabase: {
+            label: 'External database',
+            text: "Connect the company's existing finance database as a read-only external data source; do not modify its tables.\nMatch records by supplier number and add a Settlement section to supplier details showing the settlement cycle, credit limit, and settlement status, labeled with its source.\nKeep reading supplier contact details from the application database, and read settlement data directly from the external database without importing it.\nRead the connection credentials from the server's runtime configuration.",
+          },
         },
       },
       authorization: {
@@ -158,9 +178,28 @@ const systemEnUS = {
             label: 'Data scopes',
             text: "Let purchase requesters view only their own orders, using the order's requester field to determine ownership.\nOrder reviewers can view all orders and process pending approvals.\nAdministrators can adjust each job's order-viewing scope in its permission set.",
           },
-          sharing: {
-            label: 'Sharing',
-            text: "Share Bob's order PO-2026-004 with Alice so she can review it.\nAlice already has permission to view orders; add viewing access to this order.\nKeep her existing responsibilities. Order reviewers still process approvals.\nLet administrators manage this sharing rule.",
+          restrictions: {
+            label: 'Restrictions',
+            text: 'Bob is temporarily helping review purchase orders and may view only orders of 2,000 or less.\nAdd an amount limit to his View orders action, keeping his existing job and data scopes.\nApply the limit to his own orders and to orders shared with him.\nAdministrators can change the amount or remove the rule; before removal, explain that his visible scope may grow.',
+          },
+        },
+      },
+      workflow: {
+        title: 'Workflows',
+        description:
+          'Move business records through stages, with waiting, timeouts, retries, and a history of who did what.',
+        prompts: {
+          stages: {
+            label: 'Stages',
+            text: "Add a process to purchase orders: Pending approval → Pending purchase → Received → Completed.\nReviewers approve or reject; a rejection requires a reason and returns the order to the applicant to revise and resubmit.\nAfter the buyer places the purchase, the order is pending purchase; confirming delivery with a signed receipt moves it to Received, and the applicant's confirmation completes it.\nOrder details offer only the actions of the current stage, and ordinary edits cannot change the stage.\nCheck stages and required information on the server, and never overwrite a result someone else has already submitted.",
+          },
+          backgroundExport: {
+            label: 'Background export',
+            text: 'Add an order report page that exports existing orders to CSV.\nAfter submission the export waits to be processed, is generated in the background, and completes with a download link.\nShow the current stage, filename, number of exported orders, and the submission and system processing records.\nRetry failed generation according to rules, and keep a final failure for the owner to handle; running it again must not create duplicate report files.\nKeep the progress and result visible after a page refresh, and allow only authorized people to export orders.',
+          },
+          history: {
+            label: 'History',
+            text: 'Show the current stage and processing history in order details.\nEach entry shows who acted, when, the action, the stage before and after, and any rejection reason or signed receipt.\nMark actions performed automatically as done by the system.\nKeep the progress and history after a page refresh, so the whole process can be reviewed once completed.',
           },
         },
       },
@@ -199,13 +238,17 @@ const systemEnUS = {
         description:
           'Connect personal mailboxes, then read, reply to, and send business email.',
         prompts: {
+          providers: {
+            label: 'Mail provider',
+            text: "Configure mailbox.org for the application in the server configuration's mail.providers:\n- IMAP incoming server: imap.mailbox.org, port 993, SSL/TLS.\n- SMTP outgoing server: smtp.mailbox.org, port 465, SSL/TLS.\nUsers enter their own email address, username, and password on the mailbox accounts page and choose the date to start the first synchronization from; never write mailbox passwords into configuration or source code.",
+          },
           mailCenter: {
             label: 'Mail center',
-            text: 'Add a mail center and a mailbox account management entry to the application. Users can connect their own mailboxes, select a mailbox, synchronize incoming messages, read messages and attachments, and reply.\n\nWhen a sales representative receives a quotation request, they can reply from the mail center. Keep the original subject and conversation context, and address the reply to the original sender. Each user works with their own connected mailboxes.',
+            text: 'Mail is built into this application; reuse it instead of building it again or installing another plugin.\nAdd Mail center and Mailbox accounts pages to the navigation, using the mail workspace and mailbox accounts pages the mail capability provides.\nUsers can connect their own mailboxes, synchronize incoming messages, read messages and attachments, and reply, keeping the original subject and conversation context and addressing the reply to the original sender.\nEach user works with their own connected mailboxes.',
           },
           correspondence: {
             label: 'Customer emails',
-            text: "Add a correspondence section to customer details. Show messages whose sender or recipient matches the current customer's contact email addresses. Sales representatives can read messages, view attachments, and reply using their own connected mailboxes.",
+            text: "Add a correspondence section to customer details, reusing the application's built-in mail reading and compose components.\nShow messages whose sender or recipient matches the current customer's contact email addresses. Sales representatives can read messages, view attachments, and reply using their own connected mailboxes.",
           },
         },
       },
@@ -224,21 +267,6 @@ const systemEnUS = {
           },
         },
       },
-      templatePrint: {
-        title: 'Template printing',
-        description:
-          'Fill business data into Word or Excel templates and generate files.',
-        prompts: {
-          approvalForm: {
-            label: 'Approval form',
-            text: "Add a “Generate approval form” action to order details.\n\nUse the Word template I provided to fill in the current order's number, purchase request, applicant, amount, approval result, and processing time.\nKeep the template's heading, table layout, and sign-off area. Name the output “Purchase-approval-order-number” and provide a Word download.\nAnyone with access to the order can generate its approval form. Use the current order data when generating the file.",
-          },
-          pdf: {
-            label: 'PDF output',
-            text: "Add PDF download for the purchase approval form, preserving the Word template's fonts, tables, and sign-off area.",
-          },
-        },
-      },
       i18n: {
         title: 'Languages',
         description:

package/client/locales/system/zh-CN.ts

@@ -20,6 +20,10 @@ const systemZhCN: SystemResource = {
   'auth.registerDescription': '创建账户以开始使用。',
   'auth.forgotTitle': '忘记密码',
   'auth.forgotDescription': '输入邮箱，如果账户存在，我们将发送重置链接。',
+  'auth.passwordResetUnavailable': '未开启自助找回，请联系管理员重置密码。',
+  'auth.capabilityLoadFailed': '无法检查自助找回是否已开启。',
+  'auth.retry': '重试',
+  'auth.loading': '加载中',
   'auth.resetDescription': '为账户设置新密码。',
   'auth.resetTitle': '重置密码',
   'auth.identifier': '用户名或邮箱',
@@ -124,14 +128,28 @@ const systemZhCN: SystemResource = {
             label: '关闭注册',
             text: '这个应用只供公司员工使用，账号由管理员统一创建。\n请关闭自助注册，登录页不再显示注册入口。\n已有员工仍能使用原账号和密码登录，保留忘记密码入口。',
           },
-          passwordRules: {
-            label: '密码规则',
-            text: '新注册和重置密码时，密码至少需要 12 个字符。\n在注册和重置密码表单中显示这条要求，并使用一致的校验提示。\n保留已有账号的登录能力，已有用户无需立即修改密码。',
-          },
           companySso: {
             label: '企业账号登录',
             text: '请让员工使用公司的统一身份平台登录，采用 OIDC。\n\n保留原有账号密码登录，在登录页增加「企业账号登录」入口。\n点击后进入企业身份平台，登录成功后返回应用首页。\n\n首次登录允许创建应用账号，以身份平台的稳定用户标识识别用户。\n不要根据同名或相同邮箱自动关联已有账号，新账号沿用应用默认权限。\n\n请列出身份平台管理员需要提供的信息，以及需要登记的回调地址。',
           },
+          apiKeys: {
+            label: '集成密钥',
+            text: '在用户菜单中增加「集成密钥」入口，接入应用已有的 API keys 能力。\n员工只能管理自己创建的 Key，创建时填写用途名称和有效天数。\n创建成功后只显示一次完整 Key，并提示立即复制保存。\n列表显示名称、可辨认的片段、状态、有效期和最近使用时间，支持撤销并二次确认。\n不要在列表、日志或详情中显示完整 Key。',
+          },
+        },
+      },
+      dataSources: {
+        title: '数据源',
+        description: '选择应用数据库，接入已有外部数据库中的业务数据。',
+        prompts: {
+          postgres: {
+            label: '切换数据库',
+            text: '把应用数据库从 SQLite 切换为 PostgreSQL。\n连接信息从服务端运行配置读取，不写进源码。\n说明需要安装的数据库驱动和需要填写的配置，并提醒我原有数据不会自动迁移。',
+          },
+          externalDatabase: {
+            label: '外部数据库',
+            text: '将公司已有的财务数据库作为外部数据源接入，只读取数据，不修改外部表。\n通过供应商编号匹配，在供应商详情增加「结算资料」，展示结算周期、信用额度和结算状态，并标明数据来源。\n供应商联系信息仍从应用数据库读取，结算资料直接从外部数据库读取，不导入应用数据库。\n连接凭据从服务端运行配置读取。',
+          },
         },
       },
       authorization: {
@@ -146,9 +164,28 @@ const systemZhCN: SystemResource = {
             label: '数据范围',
             text: '采购申请人只查看自己申请的订单，以订单的申请人字段判断归属。\n订单审批人可以查看所有订单，处理待审批订单。\n管理员可以在权限集中分别调整两个岗位的订单查看范围。',
           },
-          sharing: {
-            label: '共享记录',
-            text: '请将 Bob 的 PO-2026-004 订单共享给 Alice，让她协助复核。\nAlice 已有订单查看权限，本次增加这笔订单的查看范围。\n保留她原有的岗位职责，审批仍由订单审批人处理。\n这项共享需要能由管理员管理。',
+          restrictions: {
+            label: '限制规则',
+            text: 'Bob 临时协助核对采购订单，只允许他查看金额不超过 2,000 元的订单。\n为他的「查看订单」操作增加金额上限，保留已有岗位和数据范围。\n限制同时作用于他本人的订单和共享给他的订单。\n管理员可以调整金额或移除规则；移除前说明可见范围可能扩大。',
+          },
+        },
+      },
+      workflow: {
+        title: '工作流',
+        description:
+          '让业务单据按阶段推进，处理等待、超时、失败重试和处理记录。',
+        prompts: {
+          stages: {
+            label: '流程阶段',
+            text: '为采购订单增加处理流程：待审批→待采购→已到货→已完成。\n审批人可以批准或驳回，驳回必须填写原因，订单退回申请人修改后重新提交。\n采购员下单后进入待采购，确认到货并上传签收单后进入已到货，申请人确认后完成。\n订单详情只提供当前阶段的操作，普通编辑不能直接修改流程阶段。\n在服务端检查阶段和必填信息，多人同时处理时不要覆盖别人已提交的结果。',
+          },
+          backgroundExport: {
+            label: '后台导出',
+            text: '增加订单报表页面，将现有订单导出为 CSV。\n提交后进入等待处理，由后台生成，成功后自动完成并提供下载入口。\n显示当前阶段、文件名、导出订单数，以及提交和系统处理的记录。\n生成失败时按规则重试，最终失败保留结果供负责人处理；重复执行不要生成重复的报表文件。\n刷新页面后仍可查看进度与结果，只有获得授权的人员可以导出订单。',
+          },
+          history: {
+            label: '处理记录',
+            text: '在订单详情展示当前流程阶段和处理历史。\n每条记录显示操作人、时间、操作名称、前后阶段，以及驳回原因或签收单。\n系统自动执行的动作标明由系统执行。\n刷新页面后仍保留进度和记录，完成后可以回看整个处理过程。',
           },
         },
       },
@@ -184,13 +221,17 @@ const systemZhCN: SystemResource = {
         title: '邮件',
         description: '关联个人邮箱，阅读、回复和发送业务邮件。',
         prompts: {
+          providers: {
+            label: '配置邮箱服务商',
+            text: '为应用配置 mailbox.org 邮箱接入，写入服务端配置的 mail.providers：\n- IMAP 收信服务器：imap.mailbox.org，端口 993，使用 SSL/TLS。\n- SMTP 发信服务器：smtp.mailbox.org，端口 465，使用 SSL/TLS。\n用户在邮箱账号页填写自己的邮箱地址、用户名和密码，并选择首次同步的起始日期；邮箱密码不写进配置或源码。',
+          },
           mailCenter: {
             label: '邮件中心',
-            text: '为应用添加邮件中心和邮箱账号管理入口。用户可以关联自己的邮箱，按邮箱查看收件箱、同步来信、阅读正文和附件，并回复邮件。\n\n销售人员收到客户的报价咨询后，可以在邮件中心回复。回复时保留原邮件主题和上下文，收件人使用原发件人。每位用户只处理自己关联的邮箱。',
+            text: '应用已内置邮件能力，请直接复用，不要重新开发或另装插件。\n在导航中增加「邮件中心」和「邮箱账号」两个页面，分别使用邮件能力提供的邮件工作台和邮箱账号页面。\n用户可以关联自己的邮箱，同步来信，阅读正文和附件，并回复邮件；回复时保留原邮件主题和上下文，收件人使用原发件人。\n每位用户只处理自己关联的邮箱。',
           },
           correspondence: {
             label: '客户往来邮件',
-            text: '在客户详情页添加往来邮件区，展示发件人或收件人与当前客户联系人邮箱匹配的邮件。销售人员可以在这里阅读正文、查看附件和回复，使用自己关联的邮箱。',
+            text: '在客户详情页添加往来邮件区，复用应用内置的邮件阅读和编辑组件。\n展示发件人或收件人与当前客户联系人邮箱匹配的邮件。销售人员可以在这里阅读正文、查看附件和回复，使用自己关联的邮箱。',
           },
         },
       },
@@ -208,20 +249,6 @@ const systemZhCN: SystemResource = {
           },
         },
       },
-      templatePrint: {
-        title: '模板打印',
-        description: '把业务数据填入 Word 或 Excel 模板，生成可下载的文件。',
-        prompts: {
-          approvalForm: {
-            label: '审批单',
-            text: '在订单详情中增加“生成采购审批单”功能。\n\n使用我提供的 Word 模板，填入当前订单的编号、采购事项、申请人、金额、审批结果和处理时间。\n保留模板的标题、表格布局和签名区域，生成文件名为“采购审批单-订单编号”，提供 Word 文件下载。\n有权查看该订单的人员可以生成审批单，生成文件使用当前订单的数据。',
-          },
-          pdf: {
-            label: 'PDF 输出',
-            text: '为采购审批单增加 PDF 下载，保留 Word 模板的字体、表格和签名区域。',
-          },
-        },
-      },
       i18n: {
         title: '多语言',
         description: '切换界面语言，添加新语言，设置默认语言。',

package/client/pages/auth/forgot-password.tsx

@@ -1,3 +1,4 @@
+import { usePasswordResetCapability } from '@nocobase/app-plugin-authentication/client';
 import { usePasswordResetRequest } from '@nocobase/app-plugin-authentication/client/actions';
 import { useTranslation } from '@nocobase/i18n/client';
 import type { ReactElement } from 'react';
@@ -6,34 +7,67 @@ import { Link } from 'react-router';
 import { PasswordResetRequestForm } from '#extensions/nocobase-auth-forms/password-reset-request-form';
 
 import { AuthPage } from './shared.js';
+import { AuthFormStatus } from '#extensions/nocobase-auth-forms/form-parts';
+import { Button } from '#components/ui/button';
 
 export default function ForgotPasswordPage(): ReactElement {
   const { t } = useTranslation();
   const request = usePasswordResetRequest();
+  const capability = usePasswordResetCapability();
 
   return (
     <AuthPage
-      description={t('auth.forgotDescription')}
+      description={
+        capability.data?.passwordResetAvailable === false
+          ? ''
+          : t('auth.forgotDescription')
+      }
       title={t('auth.forgotTitle')}
     >
-      <PasswordResetRequestForm
-        error={request.error?.message}
-        footer={
-          <>
+      {capability.isPending ? (
+        <div
+          className='h-48 animate-pulse rounded-md bg-muted'
+          aria-label={t('auth.loading')}
+        />
+      ) : capability.isError ? (
+        <div className='space-y-4'>
+          <AuthFormStatus type='error'>
+            {t('auth.capabilityLoadFailed')}
+          </AuthFormStatus>
+          <Button variant='outline' onClick={() => void capability.refetch()}>
+            {t('auth.retry')}
+          </Button>
+        </div>
+      ) : capability.data?.passwordResetAvailable !== true ? (
+        <div className='space-y-4'>
+          <AuthFormStatus type='error'>
+            {t('auth.passwordResetUnavailable')}
+          </AuthFormStatus>
+          <p className='text-center text-sm text-muted-foreground'>
             {t('auth.rememberPassword')}{' '}
             <Link to='/login'>{t('auth.signIn')}</Link>
-          </>
-        }
-        labels={{
-          email: t('auth.email'),
-          submit: t('auth.sendResetLink'),
-          submitting: t('auth.sending'),
-          success: t('auth.resetSent'),
-        }}
-        onSubmit={request.submit}
-        submitting={request.isPending}
-        success={request.isSuccess}
-      />
+          </p>
+        </div>
+      ) : (
+        <PasswordResetRequestForm
+          error={request.error?.message}
+          footer={
+            <>
+              {t('auth.rememberPassword')}{' '}
+              <Link to='/login'>{t('auth.signIn')}</Link>
+            </>
+          }
+          labels={{
+            email: t('auth.email'),
+            submit: t('auth.sendResetLink'),
+            submitting: t('auth.sending'),
+            success: t('auth.resetSent'),
+          }}
+          onSubmit={request.submit}
+          submitting={request.isPending}
+          success={request.isSuccess}
+        />
+      )}
     </AuthPage>
   );
 }

package/client/pages/auth/login.tsx

@@ -1,4 +1,7 @@
-import { useSignUpAvailable } from '@nocobase/app-plugin-authentication/client';
+import {
+  usePasswordResetCapability,
+  useSignUpAvailable,
+} from '@nocobase/app-plugin-authentication/client';
 import { usePasswordLogin } from '@nocobase/app-plugin-authentication/client/actions';
 import { useTranslation } from '@nocobase/i18n/client';
 import type { ReactElement } from 'react';
@@ -14,6 +17,7 @@ export default function LoginPage(): ReactElement {
   const login = usePasswordLogin();
   // The sign-up link follows the server: it is hidden while `auth.emailAndPassword` turns sign-up off.
   const signUpAvailable = useSignUpAvailable();
+  const resetCapability = usePasswordResetCapability();
 
   return (
     <AuthPage
@@ -43,7 +47,9 @@ export default function LoginPage(): ReactElement {
                   ) : undefined
                 }
                 forgotPasswordLink={
-                  <Link to='/forgot-password'>{t('auth.forgotLink')}</Link>
+                  resetCapability.data?.passwordResetAvailable === true ? (
+                    <Link to='/forgot-password'>{t('auth.forgotLink')}</Link>
+                  ) : undefined
                 }
                 labels={{
                   hidePassword: t('auth.hidePassword'),

package/client/pages/home/capabilities.ts

@@ -1,13 +1,14 @@
 import {
   Bell,
   CalendarClock,
+  Database,
   KeyRound,
   Languages,
   Mail,
   Palette,
   Paperclip,
-  Printer,
   ShieldCheck,
+  Workflow,
   type LucideIcon,
 } from 'lucide-react';
 
@@ -22,31 +23,40 @@ export interface Capability {
   readonly prompts: readonly string[];
 }
 
-// The default prompts follow the examples in the documentation's Capabilities chapter.
+// The default prompts follow the examples in the documentation's Capabilities chapter, in the order of its sidebar.
 export const CAPABILITIES: readonly Capability[] = [
   {
     id: 'auth',
     icon: KeyRound,
-    prompts: ['disableSignUp', 'passwordRules', 'companySso'],
+    prompts: ['disableSignUp', 'companySso', 'apiKeys'],
+  },
+  {
+    id: 'dataSources',
+    icon: Database,
+    prompts: ['postgres', 'externalDatabase'],
   },
   {
     id: 'authorization',
     icon: ShieldCheck,
-    prompts: ['jobs', 'dataScopes', 'sharing'],
+    prompts: ['jobs', 'dataScopes', 'restrictions'],
+  },
+  {
+    id: 'workflow',
+    icon: Workflow,
+    prompts: ['stages', 'backgroundExport', 'history'],
   },
+  { id: 'file', icon: Paperclip, prompts: ['attachments', 'avatar'] },
+  { id: 'i18n', icon: Languages, prompts: ['addLanguage', 'defaultLanguage'] },
+  { id: 'theme', icon: Palette, prompts: ['changeTheme', 'newTheme'] },
+  { id: 'notification', icon: Bell, prompts: ['inApp', 'email'] },
   {
     id: 'scheduler',
     icon: CalendarClock,
     prompts: ['reminder', 'weeklyReport'],
   },
-  { id: 'notification', icon: Bell, prompts: ['inApp', 'email'] },
   {
     id: 'mail',
     icon: Mail,
-    prompts: ['mailCenter', 'correspondence'],
+    prompts: ['providers', 'mailCenter', 'correspondence'],
   },
-  { id: 'file', icon: Paperclip, prompts: ['attachments', 'avatar'] },
-  { id: 'templatePrint', icon: Printer, prompts: ['approvalForm', 'pdf'] },
-  { id: 'i18n', icon: Languages, prompts: ['addLanguage', 'defaultLanguage'] },
-  { id: 'theme', icon: Palette, prompts: ['changeTheme', 'newTheme'] },
 ];

package/client/plugins.ts

@@ -15,6 +15,7 @@ import i18n from '@nocobase/app-plugin-i18n/client';
 import notification from '@nocobase/app-plugin-notification/client';
 import scheduler from '@nocobase/app-plugin-scheduler/client';
 import file from '@nocobase/app-plugin-file/client';
+import mail from '@nocobase/app-plugin-mail/client';
 
 // Array order is contribution order. A plugin is enabled by appearing in this
 // list; removing its entry and its import disables it.
@@ -32,6 +33,7 @@ const clientPlugins: AppClientPlugins = defineClientPlugins([
   notification(),
   file(),
   scheduler(),
+  mail(),
 ]);
 
 export default clientPlugins;

package/config.example.yml

@@ -137,6 +137,11 @@ snowflake:
 # scheduler:
 #   jobs: redis
 
+# Mail is registered by default. Configure mailbox provider instances before connecting accounts.
+# See .agents/skills/nocobase-app-plugin-mail/references/configuration-and-accounts.md.
+mail:
+  providers: {}
+
 # File logging is independent of terminal formatting.
 logging:
   level: info

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nocobase/app-template-default",
   "displayName": "Default Template",
-  "version": "1.0.0-beta.60",
+  "version": "1.0.0-beta.62",
   "type": "module",
   "prettier": "@nocobase/dev-config/prettier",
   "engines": {
@@ -9,7 +9,7 @@
   },
   "nocobase": {
     "templateKind": "app",
-    "defaultTemplateVersion": "1.0.0-beta.60"
+    "defaultTemplateVersion": "1.0.0-beta.62"
   },
   "devDependencies": {
     "@ai-sdk/react": "2.0.0",
@@ -77,7 +77,7 @@
     "tar": "^7.5.22",
     "@nocobase/app-client": "^3.0.0-beta.0",
     "@nocobase/app-plugin-template-print": "0.0.2-beta.1",
-    "@nocobase/app-skills": "0.1.0-beta.28",
+    "@nocobase/app-skills": "0.1.0-beta.30",
     "@nocobase/app-testing": "0.1.0-beta.2",
     "@nocobase/app-websocket": "^0.0.1",
     "@nocobase/dev-config": "0.1.0-beta.21",
@@ -141,17 +141,18 @@
     "@oclif/core": "^4.14.0",
     "better-auth": "1.7.5",
     "hono": "^4.13.2",
-    "@nocobase/app-plugin-authentication": "^2.0.0-beta.3",
     "@nocobase/app-plugin-api-keys": "^1.0.0-beta.14",
+    "@nocobase/app-plugin-authentication": "^2.0.0-beta.5",
     "@nocobase/app-plugin-authorization": "^1.0.0-beta.26",
     "@nocobase/app-plugin-database-explorer": "^1.0.0-beta.12",
     "@nocobase/app-plugin-file": "^1.0.0-beta.22",
     "@nocobase/app-plugin-i18n": "^1.0.0-beta.14",
-    "@nocobase/app-plugin-notification": "^1.0.0-beta.25",
+    "@nocobase/app-plugin-mail": "^1.0.0-beta.10",
+    "@nocobase/app-plugin-notification": "^1.0.0-beta.26",
     "@nocobase/app-plugin-notification-in-app": "^1.0.0-beta.23",
     "@nocobase/app-plugin-notification-providers": "^0.2.0-beta.10",
     "@nocobase/app-plugin-scheduler": "^1.0.0-beta.16",
-    "@nocobase/app-plugin-users": "^2.0.0-beta.2",
+    "@nocobase/app-plugin-users": "^2.0.0-beta.3",
     "@nocobase/app-server": "^2.0.0-beta.3",
     "@nocobase/config": "^0.1.0-beta.2",
     "@nocobase/db": "^1.0.0-beta.18",
@@ -163,11 +164,12 @@
     "@nocobase/app-plugin-authz-restriction-rules": "^1.0.0-beta.10",
     "@nocobase/authorization": "^1.0.0-beta.12",
     "@nocobase/queue": "^0.1.0-beta.8",
+    "@nocobase/jobs": "^0.1.0-beta.2",
+    "@nocobase/lifecycle": "^0.1.0-beta.0",
     "@nocobase/i18n": "^1.0.0-beta.6",
     "@nocobase/caching": "^0.1.0-beta.2",
     "@nocobase/repository-input": "^0.1.0-beta.2",
-    "@nocobase/app-cli": "^1.0.0-beta.17",
-    "@nocobase/jobs": "^0.1.0-beta.2"
+    "@nocobase/app-cli": "^1.0.0-beta.18"
   },
   "description": "NocoBase 3 application template with the standard product capabilities.",
   "imports": {

package/server/config/index.ts

@@ -5,6 +5,7 @@ import {
 import auth from './auth.js';
 import authorization from './authorization.js';
 import notification from './notification.js';
+import mail from './mail.js';
 import secrets from './secrets.js';
 import session from './session.js';
 import server from './server.js';
@@ -26,6 +27,7 @@ const defaultConfigs: AppConfigFactory<{
   auth: ReturnType<typeof auth>;
   authorization: ReturnType<typeof authorization>;
   notification: ReturnType<typeof notification>;
+  mail: ReturnType<typeof mail>;
   secrets: ReturnType<typeof secrets>;
   session: ReturnType<typeof session>;
   server: ReturnType<typeof server>;
@@ -46,6 +48,7 @@ const defaultConfigs: AppConfigFactory<{
   auth,
   authorization,
   notification,
+  mail,
   secrets,
   session,
   server,

package/server/config/mail.ts

@@ -0,0 +1,3 @@
+import { mailConfig } from '@nocobase/app-plugin-mail/server';
+
+export default mailConfig;

package/server/plugins.ts

@@ -16,6 +16,7 @@ import {
 } from '@nocobase/app-server/plugins';
 import scheduler from '@nocobase/app-plugin-scheduler/server';
 import file from '@nocobase/app-plugin-file/server';
+import mail from '@nocobase/app-plugin-mail/server';
 
 const serverPlugins: AppServerPlugins = defineServerPlugins([
   authentication,
@@ -32,6 +33,7 @@ const serverPlugins: AppServerPlugins = defineServerPlugins([
   notificationProviders,
   file,
   scheduler,
+  mail,
 ]);
 
 export default serverPlugins;

package/tests/components/auth-i18n.test.tsx

@@ -13,6 +13,12 @@ import { Loading } from '../../client/components/loading.js';
 
 vi.mock('@nocobase/app-plugin-authentication/client', () => ({
   useSignUpAvailable: () => true,
+  usePasswordResetCapability: () => ({
+    data: { passwordResetAvailable: true },
+    isPending: false,
+    isError: false,
+    refetch: vi.fn(),
+  }),
 }));
 
 vi.mock('@nocobase/app-plugin-authentication/client/actions', () => ({

package/tests/logic/client-auth.test.tsx

@@ -9,6 +9,7 @@ import { describe, expect, it, vi } from 'vitest';
 
 import enUS from '../../client/locales/en-US.ts';
 import LoginPage from '../../client/pages/auth/login.tsx';
+import ForgotPasswordPage from '../../client/pages/auth/forgot-password.tsx';
 import RegisterPage from '../../client/pages/auth/register.tsx';
 
 const passwordLoginAction = vi.hoisted(() => ({
@@ -18,14 +19,28 @@ const passwordLoginAction = vi.hoisted(() => ({
 }));
 
 const signUpAvailable = vi.hoisted(() => ({ value: true }));
+const resetCapability = vi.hoisted(() => ({
+  data: { passwordResetAvailable: true } as
+    { passwordResetAvailable: boolean } | undefined,
+  isPending: false,
+  isError: false,
+  refetch: vi.fn(),
+}));
+const passwordResetRequest = vi.hoisted(() => ({
+  isPending: false,
+  isSuccess: false,
+  submit: vi.fn(),
+}));
 
 vi.mock('@nocobase/app-plugin-authentication/client/actions', () => ({
   usePasswordLogin: () => passwordLoginAction,
   usePasswordRegistration: () => ({ isPending: false, submit: vi.fn() }),
+  usePasswordResetRequest: () => passwordResetRequest,
 }));
 
 vi.mock('@nocobase/app-plugin-authentication/client', () => ({
   useSignUpAvailable: () => signUpAvailable.value,
+  usePasswordResetCapability: () => resetCapability,
 }));
 
 const runtime = await createTestI18nRuntime({
@@ -113,6 +128,68 @@ describe('application authentication pages', () => {
     );
   });
 
+  it('hides password recovery when it is not available', () => {
+    resetCapability.data = { passwordResetAvailable: false };
+    renderAt('/', <LoginPage />);
+    expect(
+      screen.queryByRole('link', { name: 'Forgot password?' }),
+    ).not.toBeInTheDocument();
+    resetCapability.data = { passwordResetAvailable: true };
+  });
+
+  it('shows the administrator contact message on direct access while recovery is disabled', () => {
+    resetCapability.data = { passwordResetAvailable: false };
+    renderAt('/forgot-password', <ForgotPasswordPage />);
+    expect(screen.getByRole('alert')).toHaveTextContent(
+      'Self-service password reset is not enabled',
+    );
+    expect(screen.queryByLabelText('Email')).not.toBeInTheDocument();
+    resetCapability.data = { passwordResetAvailable: true };
+  });
+
+  it('shows loading, retries a failed capability request, and restores the form', () => {
+    resetCapability.data = undefined;
+    resetCapability.isPending = true;
+    resetCapability.isError = false;
+    const { rerender } = renderAt('/forgot-password', <ForgotPasswordPage />);
+    expect(screen.getByLabelText('Loading')).toBeVisible();
+
+    resetCapability.isPending = false;
+    resetCapability.isError = true;
+    rerender(
+      <TestI18nProvider runtime={runtime}>
+        <MemoryRouter initialEntries={['/forgot-password']}>
+          <Routes>
+            <Route element={<ForgotPasswordPage />} path='/forgot-password' />
+          </Routes>
+        </MemoryRouter>
+      </TestI18nProvider>,
+    );
+    fireEvent.click(screen.getByRole('button', { name: 'Retry' }));
+    expect(resetCapability.refetch).toHaveBeenCalled();
+
+    resetCapability.data = { passwordResetAvailable: true };
+    resetCapability.isPending = false;
+    resetCapability.isError = false;
+    passwordResetRequest.submit.mockClear();
+    rerender(
+      <TestI18nProvider runtime={runtime}>
+        <MemoryRouter initialEntries={['/forgot-password']}>
+          <Routes>
+            <Route element={<ForgotPasswordPage />} path='/forgot-password' />
+          </Routes>
+        </MemoryRouter>
+      </TestI18nProvider>,
+    );
+    fireEvent.change(screen.getByLabelText('Email'), {
+      target: { value: 'person@example.com' },
+    });
+    fireEvent.click(screen.getByRole('button', { name: 'Send reset link' }));
+    expect(passwordResetRequest.submit).toHaveBeenCalledWith({
+      email: 'person@example.com',
+    });
+  });
+
   it('sends a visitor back to sign-in while sign-up is off', () => {
     signUpAvailable.value = false;
     renderAt('/register', <RegisterPage />);