@svadmin/core 0.30.0 → 0.31.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/core",
-  "version": "0.30.0",
+  "version": "0.31.0",
   "author": "zuohuadong",
   "repository": {
     "type": "git",
@@ -38,8 +38,8 @@
       "default": "./src/i18n.svelte.ts"
     },
     "./permissions": {
-      "types": "./src/permissions.ts",
-      "default": "./src/permissions.ts"
+      "types": "./src/permissions.svelte.ts",
+      "default": "./src/permissions.svelte.ts"
     },
     "./toast": {
       "types": "./src/toast.svelte.ts",

package/src/auth-hooks.svelte.ts

@@ -114,6 +114,24 @@ export function useUpdatePassword() {
   });
 }
 
+// ─── useUpdateIdentity / useUpdateProfile ────────────────────
+
+export function useUpdateIdentity() {
+  return createAuthMutation({
+    method: 'updateIdentity',
+    successMessage: t('common.operationSuccess'),
+    onSuccess: (result) => { if (result.redirectTo) navigate(result.redirectTo); }
+  });
+}
+
+export function useUpdateProfile() {
+  return createAuthMutation({
+    method: 'updateProfile',
+    successMessage: t('common.operationSuccess'),
+    onSuccess: (result) => { if (result.redirectTo) navigate(result.redirectTo); }
+  });
+}
+
 // ─── useGetIdentity ──────────────────────────────────────────
 
 export function useGetIdentity() {
@@ -297,4 +315,3 @@ export function usePermissions<T = unknown>() {
     can: (resource: string, action: string): boolean => hasFn(`${resource}:${action}`),
   };
 }
-

package/src/data-transfer.svelte.ts

@@ -1,6 +1,10 @@
 import { getDataProviderForResource } from './context.svelte';
 import { useParsed } from './useParsed.svelte';
 import type { Sort, Filter, BaseRecord } from './types';
+import { downloadData } from './export-format';
+import type { ExportFormat } from './export-format';
+export { downloadData, toCsv, toJson, toXlsx, escapeCsvField } from './export-format';
+export type { ExportFormat } from './export-format';
 
 export interface UseExportOptions<TData extends BaseRecord = BaseRecord> {
   resource?: string;
@@ -10,13 +14,15 @@ export interface UseExportOptions<TData extends BaseRecord = BaseRecord> {
   maxItemCount?: number;
   pageSize?: number;
   download?: boolean;
+  /** 导出格式，默认 csv（兼容旧版） */
+  format?: ExportFormat;
   meta?: Record<string, unknown>;
   dataProviderName?: string;
   onError?: (error: Error) => void;
 }
 
 /**
- * useExport — export records from a resource as CSV download
+ * useExport — export records from a resource as CSV/JSON/XLSX download
  * Supports mapData, sorters, filters, maxItemCount, pageSize
  */
 export function useExport<TData extends BaseRecord = BaseRecord>(options: UseExportOptions<TData> = {}) {
@@ -57,29 +63,7 @@ export function useExport<TData extends BaseRecord = BaseRecord>(options: UseExp
         : allRecords.map(r => r as unknown as Record<string, unknown>);
 
       if (options.download !== false && typeof document !== 'undefined') {
-        const fields = Object.keys(mapped[0]);
-        const escapeCsvField = (s: string) => {
-          let val = s;
-          if (/^[=+@\t\r]/.test(val)) val = "'" + val;
-          return val.includes(',') || val.includes('"') || val.includes('\n') || val.includes('\r') ? `"${val.replace(/"/g, '""')}"` : val;
-        };
-        const header = fields.map(escapeCsvField).join(',');
-        const rows = mapped.map(record =>
-          fields.map(f => {
-            const val = record[f];
-            const str = val === null || val === undefined ? '' : typeof val === 'object' ? JSON.stringify(val) : String(val);
-            return escapeCsvField(str);
-          }).join(',')
-        );
-
-        const csv = [header, ...rows].join('\n');
-        const blob = new Blob(['\uFEFF' + csv], { type: 'text/csv;charset=utf-8;' });
-        const url = URL.createObjectURL(blob);
-        const a = document.createElement('a');
-        a.href = url;
-        a.download = `${exportResource}_export.csv`;
-        a.click();
-        setTimeout(() => URL.revokeObjectURL(url), 10000);
+        downloadData(mapped, exportResource, options.format ?? 'csv');
       }
 
       return allRecords;
@@ -99,6 +83,8 @@ export function useExport<TData extends BaseRecord = BaseRecord>(options: UseExp
 
 export interface UseImportOptions<TData = Record<string, unknown>> {
   resource?: string;
+  /** 指定导入文件格式；默认 auto = 根据文件扩展名推断。注意：import 仅支持 csv 和 json，不支持 xlsx 解析 */
+  format?: 'auto' | 'csv' | 'json';
   mapData?: (item: Record<string, unknown>) => TData;
   batchSize?: number;
   onFinish?: (result: { succeeded: unknown[]; errored: { request: unknown; error: unknown }[] }) => void;
@@ -131,21 +117,40 @@ export function useImport<TData = Record<string, unknown>>(options: UseImportOpt
         text = text.slice(1);
       }
 
-      const rows = parseCSV(text);
-      if (rows.length < 2) {
-        mutationResult = { succeeded: [], errored: [] };
-        options.onFinish?.({ succeeded: [], errored: [] });
-        return;
-      }
+      // 自动检测或使用指定格式
+      const format = options.format ?? 'auto';
+      const isJson = format === 'json' || (format === 'auto' && info.file.name.toLowerCase().endsWith('.json'));
 
-      const headers = rows[0];
-      const records: Record<string, unknown>[] = [];
+      let records: Record<string, unknown>[];
 
-      for (let i = 1; i < rows.length; i++) {
-        const values = rows[i];
-        const record: Record<string, unknown> = {};
-        headers.forEach((h, idx) => { record[h] = values[idx] ?? ''; });
-        records.push(options.mapData ? (options.mapData(record) as unknown as Record<string, unknown>) : record);
+      if (isJson) {
+        // JSON 格式：期望数组对象
+        const parsed = JSON.parse(text);
+        if (!Array.isArray(parsed)) {
+          mutationResult = { succeeded: [], errored: [{ request: null, error: new Error('JSON import requires an array of objects') }] };
+          options.onFinish?.(mutationResult);
+          return;
+        }
+        records = parsed.map((item: unknown) =>
+          options.mapData ? (options.mapData(item as Record<string, unknown>) as unknown as Record<string, unknown>) : (item as Record<string, unknown>)
+        );
+      } else {
+        // CSV 格式
+        const rows = parseCSV(text);
+        if (rows.length < 2) {
+          mutationResult = { succeeded: [], errored: [] };
+          options.onFinish?.({ succeeded: [], errored: [] });
+          return;
+        }
+
+        const headers = rows[0];
+        records = [];
+        for (let i = 1; i < rows.length; i++) {
+          const values = rows[i];
+          const record: Record<string, unknown> = {};
+          headers.forEach((h, idx) => { record[h] = values[idx] ?? ''; });
+          records.push(options.mapData ? (options.mapData(record) as unknown as Record<string, unknown>) : record);
+        }
       }
 
       const batchSize = options.batchSize ?? 1;
@@ -198,13 +203,16 @@ export function useImport<TData = Record<string, unknown>>(options: UseImportOpt
   }
 
   return {
-    inputProps: { type: 'file' as const, accept: '.csv' },
+    inputProps: { type: 'file' as const, accept: '.csv,.json' },
     handleChange,
     get isLoading() { return isLoading; },
     get mutationResult() { return mutationResult; },
   };
 }
 
+
+// ─── 解析工具 ────────────────────────────────────────────────────
+
 /** Parse full CSV text respecting quoted multi-line fields */
 function parseCSV(text: string): string[][] {
   const rows: string[][] = [];

package/src/export-format.ts

@@ -0,0 +1,115 @@
+// 纯函数导出格式化工具 — 不依赖 Svelte runes 或浏览器 API（downloadData 除外）
+// 可被 bun:test 直接测试
+
+/** 支持的导出/导入格式 */
+export type ExportFormat = 'csv' | 'json' | 'xlsx';
+
+/** CSV 转义，含公式注入防护 */
+export function escapeCsvField(s: string): string {
+  let val = s;
+  if (/^[=+@\t\r]/.test(val)) val = "'" + val;
+  return val.includes(',') || val.includes('"') || val.includes('\n') || val.includes('\r')
+    ? `"${val.replace(/"/g, '""')}"`
+    : val;
+}
+
+/** 将记录数组转为 CSV 字符串 */
+export function toCsv(records: Record<string, unknown>[]): string {
+  if (records.length === 0) return '';
+  const fields = Object.keys(records[0]);
+  const header = fields.map(escapeCsvField).join(',');
+  const rows = records.map(record =>
+    fields.map(f => {
+      const val = record[f];
+      const str = val === null || val === undefined ? '' : typeof val === 'object' ? JSON.stringify(val) : String(val);
+      return escapeCsvField(str);
+    }).join(',')
+  );
+  return [header, ...rows].join('\n');
+}
+
+/** 将记录数组转为格式化的 JSON 字符串 */
+export function toJson(records: Record<string, unknown>[]): string {
+  return JSON.stringify(records, null, 2);
+}
+
+/** 转义 XML 特殊字符 */
+export function escapeXml(s: string): string {
+  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
+/**
+ * 生成最小可用的 XLSX（SpreadsheetML）——零依赖。
+ */
+export function toXlsx(records: Record<string, unknown>[]): string {
+  if (records.length === 0) return '';
+  const fields = Object.keys(records[0]);
+
+  const headerCells = fields.map(f => `<Cell><Data ss:Type="String">${escapeXml(f)}</Data></Cell>`).join('');
+  const dataRows = records.map(record =>
+    `<Row>${fields.map(f => {
+      const val = record[f];
+      if (val === null || val === undefined) return '<Cell><Data ss:Type="String"></Data></Cell>';
+      if (typeof val === 'number') return `<Cell><Data ss:Type="Number">${val}</Data></Cell>`;
+      if (typeof val === 'boolean') return `<Cell><Data ss:Type="Boolean">${val ? 1 : 0}</Data></Cell>`;
+      const str = typeof val === 'object' ? JSON.stringify(val) : String(val);
+      return `<Cell><Data ss:Type="String">${escapeXml(str)}</Data></Cell>`;
+    }).join('')}</Row>`
+  ).join('\n');
+
+  return `<?xml version="1.0"?>
+<?mso-application progid="Excel.Sheet"?>
+<Workbook xmlns="urn:schemas-microsoft-com:office:spreadsheet"
+ xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet">
+ <Worksheet ss:Name="Export">
+  <Table>
+   <Row>${headerCells}</Row>
+${dataRows}
+  </Table>
+ </Worksheet>
+</Workbook>`;
+}
+
+/**
+ * 将记录以指定格式下载为文件。
+ * 依赖浏览器 document API；在 Node/bun:test 中需 mock。
+ */
+export function downloadData(
+  records: Record<string, unknown>[],
+  resource: string,
+  format: ExportFormat = 'csv',
+): void {
+  if (records.length === 0) return;
+  if (typeof document === 'undefined') return;
+
+  let content: string;
+  let mimeType: string;
+  let ext: string;
+
+  switch (format) {
+    case 'json':
+      content = toJson(records);
+      mimeType = 'application/json;charset=utf-8;';
+      ext = 'json';
+      break;
+    case 'xlsx':
+      content = toXlsx(records);
+      mimeType = 'application/vnd.ms-excel;charset=utf-8;';
+      ext = 'xls';
+      break;
+    case 'csv':
+    default:
+      content = toCsv(records);
+      mimeType = 'text/csv;charset=utf-8;';
+      ext = 'csv';
+      break;
+  }
+
+  const blob = new Blob(['\uFEFF' + content], { type: mimeType });
+  const url = URL.createObjectURL(blob);
+  const a = document.createElement('a');
+  a.href = url;
+  a.download = `${resource}_export.${ext}`;
+  a.click();
+  setTimeout(() => URL.revokeObjectURL(url), 10000);
+}

package/src/i18n.svelte.ts

@@ -122,6 +122,7 @@ const baseLocales: Record<string, Record<string, string>> = {
     'auth.hasAccount': '已有账号？',
     'auth.forgotPasswordLink': '忘记密码？',
     'auth.forgotPasswordDescription': '输入您的邮箱地址，我们将发送重置密码的链接。',
+    'auth.resetPasswordDescription': '设置一个新的登录密码。',
     'auth.resetLinkSent': '重置链接已发送，请查看您的邮箱。',
     'auth.passwordMismatch': '两次输入的密码不一致',
     'auth.emailRequired': '请输入邮箱',
@@ -309,6 +310,114 @@ const baseLocales: Record<string, Record<string, string>> = {
     'profile.currentPassword': '当前密码',
     'profile.passwordChanged': '密码已修改',
     'profile.updatePassword': '更新密码',
+    'profile.newPassword': '新密码',
+    'profile.company': '企业',
+    'profile.gamer': '玩家',
+    'profile.companyName': '公司名称',
+    'profile.industry': '行业',
+    'profile.website': '网站',
+    'profile.employees': '员工',
+    'profile.founded': '成立于',
+    'profile.companyDescription': '公司介绍',
+    'profile.level': '等级',
+    'profile.gamesPlayed': '游戏场次',
+    'profile.winRate': '胜率',
+    'profile.rank': '段位',
+    // Public profile
+    'publicProfile.projects': '项目',
+    'publicProfile.projects2Col': '两栏项目',
+    'publicProfile.projects3Col': '三栏项目',
+    'publicProfile.activity': '活动',
+    'publicProfile.teams': '团队',
+    'publicProfile.followers': '关注者',
+    'publicProfile.following': '正在关注',
+    'publicProfile.editProfile': '编辑资料',
+    'publicProfile.sendMessage': '发送消息',
+    'publicProfile.joinedDate': '{date} 加入',
+    'publicProfile.noProjects': '暂无项目',
+    'publicProfile.noActivity': '暂无活动',
+    'publicProfile.noTeams': '暂无团队',
+    'publicProfile.projectMembers': '{count} 名成员',
+    'publicProfile.projectTasks': '{count} 个任务',
+    'publicProfile.viewProfile': '查看资料',
+    'publicProfile.activityPosted': '发布了动态',
+    'publicProfile.activityCommented': '评论了',
+    'publicProfile.activityJoined': '加入了',
+    'publicProfile.activityCreated': '创建了',
+    // Account demo pages
+    'account.getStarted': '开始使用',
+    'account.getStartedDescription': '按照步骤补齐资料、连接服务并邀请团队成员。',
+    'account.uploadAvatar': '上传头像',
+    'account.setupProfile': '完善个人资料',
+    'account.connectProvider': '连接身份提供方',
+    'account.setupTeam': '创建团队空间',
+    'account.completeSetup': '完成设置',
+    'account.skipSetup': '跳过',
+    'account.step': '第 {current} / {total} 步',
+    'account.companyProfile': '公司资料',
+    'account.companyProfileDescription': '维护组织基础信息、行业属性和公开展示内容。',
+    'account.settingsPlain': '纯净设置',
+    'account.settingsPlainDescription': '以单页表单方式管理账号、安全与通知偏好。',
+    'account.settingsSidebar': '侧边栏设置',
+    'account.settingsSidebarDescription': '调整导航密度、默认折叠和菜单显示偏好。',
+    'account.settingsEnterprise': '企业设置',
+    'account.settingsEnterpriseDescription': '配置 SSO、会话策略、审计日志和合规保留周期。',
+    'account.membersStarter': '成员入门',
+    'account.membersStarterDescription': '快速邀请核心成员并检查初始角色配置。',
+    'account.teamMembers': '团队成员',
+    'account.teamMembersDescription': '按部门、角色、状态和最近活跃时间管理团队名册。',
+    'account.inviteMember': '邀请成员',
+    'account.active': '活跃',
+    'account.invited': '已邀请',
+    'account.inactive': '未活跃',
+    'account.member': '成员',
+    'account.role': '角色',
+    'account.status': '状态',
+    'account.joined': '加入时间',
+    'account.importMembers': '导入成员',
+    'account.importMembersDescription': '上传 CSV 或 Excel 文件，批量创建成员并预分配角色。',
+    'account.importComplete': '导入完成',
+    'account.imported': '已成功导入 {count} 位成员。',
+    'account.dragOrClick': '拖拽文件到这里，或点击选择文件',
+    'account.supportedFormats': '支持 CSV、XLSX，建议不超过 5MB。',
+    'account.importProgress': '导入中',
+    'account.startImport': '开始导入',
+    'account.downloadTemplate': '下载模板',
+    'account.securityLog': '安全日志',
+    'account.securityLogDescription': '查看登录、密钥、2FA 和会话变更记录。',
+    // Security log
+    'securityLog.event': '事件',
+    'securityLog.ip': 'IP 地址',
+    'securityLog.device': '设备',
+    'securityLog.location': '位置',
+    'securityLog.time': '时间',
+    'securityLog.loginSuccess': '登录成功',
+    'securityLog.loginFailed': '登录失败',
+    'securityLog.apiKeyCreated': '创建 API 密钥',
+    'securityLog.apiKeyRevoked': '撤销 API 密钥',
+    'securityLog.twoFactorEnabled': '启用两步验证',
+    'securityLog.passwordChanged': '修改密码',
+    'securityLog.sessionRevoked': '撤销会话',
+    // Network
+    'network.userCards': '用户卡片',
+    'network.userCardsDescription': '以收藏卡片方式展示社区、资产和连接状态。',
+    'network.teamCrew': '团队成员表',
+    'network.teamCrewDescription': '用表格方式查看跨部门成员、在线状态和项目投入。',
+    'network.nftCollection': '藏品',
+    'network.floorPrice': '底价',
+    'network.volume': '交易量',
+    'network.connected': '已连接',
+    'network.connect': '连接',
+    // Two-factor authentication
+    'auth.twoFactorSetup': '两步验证设置',
+    'auth.twoFactorScanQR': '扫描二维码',
+    'auth.twoFactorEnterCode': '输入验证码',
+    'auth.twoFactorSaveRecovery': '保存恢复码',
+    'auth.twoFactorRecoveryHint': '请把恢复码保存在安全位置，手机不可用时可以用它登录。',
+    'auth.twoFactorVerify': '验证代码',
+    'auth.twoFactorRecovery': '恢复码',
+    'auth.twoFactorVerifySuccess': '两步验证已启用',
+    'auth.twoFactorDisable': '停用两步验证',
     // Tasks
     'task.drawerTitle': '任务中心',
     'task.listTitle': '任务列表',
@@ -492,6 +601,7 @@ const baseLocales: Record<string, Record<string, string>> = {
     'auth.hasAccount': 'Already have an account?',
     'auth.forgotPasswordLink': 'Forgot password?',
     'auth.forgotPasswordDescription': 'Enter your email address and we will send you a reset link.',
+    'auth.resetPasswordDescription': 'Set a new sign-in password.',
     'auth.resetLinkSent': 'Reset link sent! Check your email.',
     'auth.passwordMismatch': 'Passwords do not match',
     'auth.emailRequired': 'Email is required',
@@ -679,6 +789,114 @@ const baseLocales: Record<string, Record<string, string>> = {
     'profile.currentPassword': 'Current Password',
     'profile.passwordChanged': 'Password updated successfully',
     'profile.updatePassword': 'Update Password',
+    'profile.newPassword': 'New Password',
+    'profile.company': 'Company',
+    'profile.gamer': 'Gamer',
+    'profile.companyName': 'Company Name',
+    'profile.industry': 'Industry',
+    'profile.website': 'Website',
+    'profile.employees': 'Employees',
+    'profile.founded': 'Founded',
+    'profile.companyDescription': 'Company Description',
+    'profile.level': 'Level',
+    'profile.gamesPlayed': 'Games Played',
+    'profile.winRate': 'Win Rate',
+    'profile.rank': 'Rank',
+    // Public profile
+    'publicProfile.projects': 'Projects',
+    'publicProfile.projects2Col': 'Projects - 2 Columns',
+    'publicProfile.projects3Col': 'Projects - 3 Columns',
+    'publicProfile.activity': 'Activity',
+    'publicProfile.teams': 'Teams',
+    'publicProfile.followers': 'Followers',
+    'publicProfile.following': 'Following',
+    'publicProfile.editProfile': 'Edit Profile',
+    'publicProfile.sendMessage': 'Send Message',
+    'publicProfile.joinedDate': 'Joined {date}',
+    'publicProfile.noProjects': 'No projects yet',
+    'publicProfile.noActivity': 'No activity yet',
+    'publicProfile.noTeams': 'No teams yet',
+    'publicProfile.projectMembers': '{count} members',
+    'publicProfile.projectTasks': '{count} tasks',
+    'publicProfile.viewProfile': 'View Profile',
+    'publicProfile.activityPosted': 'posted',
+    'publicProfile.activityCommented': 'commented on',
+    'publicProfile.activityJoined': 'joined',
+    'publicProfile.activityCreated': 'created',
+    // Account demo pages
+    'account.getStarted': 'Get Started',
+    'account.getStartedDescription': 'Complete profile basics, connect services, and invite your team.',
+    'account.uploadAvatar': 'Upload Avatar',
+    'account.setupProfile': 'Set Up Profile',
+    'account.connectProvider': 'Connect Identity Provider',
+    'account.setupTeam': 'Set Up Team',
+    'account.completeSetup': 'Complete Setup',
+    'account.skipSetup': 'Skip',
+    'account.step': 'Step {current} of {total}',
+    'account.companyProfile': 'Company Profile',
+    'account.companyProfileDescription': 'Maintain organization details, industry fields, and public profile content.',
+    'account.settingsPlain': 'Settings - Plain',
+    'account.settingsPlainDescription': 'Manage account, security, and notification preferences in one page.',
+    'account.settingsSidebar': 'Settings - Sidebar',
+    'account.settingsSidebarDescription': 'Adjust navigation density, default collapse, and menu display preferences.',
+    'account.settingsEnterprise': 'Enterprise Settings',
+    'account.settingsEnterpriseDescription': 'Configure SSO, session policy, audit logs, and compliance retention.',
+    'account.membersStarter': 'Members Starter',
+    'account.membersStarterDescription': 'Invite core members and check initial role setup.',
+    'account.teamMembers': 'Team Members',
+    'account.teamMembersDescription': 'Manage the team roster by department, role, status, and recent activity.',
+    'account.inviteMember': 'Invite Member',
+    'account.active': 'Active',
+    'account.invited': 'Invited',
+    'account.inactive': 'Inactive',
+    'account.member': 'Member',
+    'account.role': 'Role',
+    'account.status': 'Status',
+    'account.joined': 'Joined',
+    'account.importMembers': 'Import Members',
+    'account.importMembersDescription': 'Upload a CSV or Excel file to create members and pre-assign roles in bulk.',
+    'account.importComplete': 'Import Complete',
+    'account.imported': 'Imported {count} members successfully.',
+    'account.dragOrClick': 'Drag a file here, or click to select one',
+    'account.supportedFormats': 'CSV and XLSX supported, up to 5MB recommended.',
+    'account.importProgress': 'Importing',
+    'account.startImport': 'Start Import',
+    'account.downloadTemplate': 'Download Template',
+    'account.securityLog': 'Security Log',
+    'account.securityLogDescription': 'Review login, key, 2FA, and session change events.',
+    // Security log
+    'securityLog.event': 'Event',
+    'securityLog.ip': 'IP Address',
+    'securityLog.device': 'Device',
+    'securityLog.location': 'Location',
+    'securityLog.time': 'Time',
+    'securityLog.loginSuccess': 'Login successful',
+    'securityLog.loginFailed': 'Login failed',
+    'securityLog.apiKeyCreated': 'API key created',
+    'securityLog.apiKeyRevoked': 'API key revoked',
+    'securityLog.twoFactorEnabled': 'Two-factor authentication enabled',
+    'securityLog.passwordChanged': 'Password changed',
+    'securityLog.sessionRevoked': 'Session revoked',
+    // Network
+    'network.userCards': 'User Cards',
+    'network.userCardsDescription': 'Showcase community profiles, asset collections, and connection status.',
+    'network.teamCrew': 'Team Crew',
+    'network.teamCrewDescription': 'Review cross-functional members, presence, and project commitment in a table.',
+    'network.nftCollection': 'Collection',
+    'network.floorPrice': 'Floor Price',
+    'network.volume': 'Volume',
+    'network.connected': 'Connected',
+    'network.connect': 'Connect',
+    // Two-factor authentication
+    'auth.twoFactorSetup': 'Two-Factor Authentication Setup',
+    'auth.twoFactorScanQR': 'Scan QR Code',
+    'auth.twoFactorEnterCode': 'Enter Verification Code',
+    'auth.twoFactorSaveRecovery': 'Save Recovery Codes',
+    'auth.twoFactorRecoveryHint': 'Keep recovery codes somewhere safe so you can sign in if your device is unavailable.',
+    'auth.twoFactorVerify': 'Verify Code',
+    'auth.twoFactorRecovery': 'Recovery Codes',
+    'auth.twoFactorVerifySuccess': 'Two-factor authentication is enabled',
+    'auth.twoFactorDisable': 'Disable Two-Factor Authentication',
     // Tasks
     'task.drawerTitle': 'Task Center',
     'task.listTitle': 'Tasks',
@@ -763,19 +981,56 @@ function detectLocale(): string {
 
 let currentLocale = $state(detectLocale());
 
+/**
+ * I18nProvider — pluggable translation boundary.
+ * When set, all t/getLocale/getAvailableLocales delegates to it first,
+ * falling back to the built-in locale tables. This lets apps integrate
+ * existing i18n systems (svelte-i18n, paraglide, etc.) without rewriting callsites.
+ */
+export interface I18nProvider {
+  translate: (key: string, params?: Record<string, string | number>) => string;
+  getLocale: () => string;
+  setLocale: (locale: string) => void;
+  getAvailableLocales?: () => string[];
+}
+
+let i18nProvider: I18nProvider | undefined;
+
+export function setI18nProvider(provider: I18nProvider | undefined): void {
+  i18nProvider = provider;
+}
+
+export function getI18nProvider(): I18nProvider | undefined {
+  return i18nProvider;
+}
+
 export function setLocale(locale: string): void {
+  if (i18nProvider) {
+    i18nProvider.setLocale(locale);
+  }
+  // 同步更新 local state，确保 Svelte $state 依赖追踪触发模板刷新
   currentLocale = locale;
 }
 
 export function getLocale(): string {
+  // 读取 currentLocale 以保持 Svelte $state 响应式追踪
+  // eslint-disable-next-line @typescript-eslint/no-unused-expressions
+  currentLocale;
+  if (i18nProvider) return i18nProvider.getLocale();
   return currentLocale;
 }
 
 export function getAvailableLocales(): string[] {
+  if (i18nProvider?.getAvailableLocales) return i18nProvider.getAvailableLocales();
   return Object.keys(locales);
 }
 
 export function t(key: string, params?: Record<string, string | number>): string {
+  // 读取 currentLocale 以建立 Svelte $state 依赖追踪，
+  // 确保无论是否使用 provider，语言切换都能触发模板刷新。
+  // eslint-disable-next-line @typescript-eslint/no-unused-expressions
+  currentLocale;
+  if (i18nProvider) return i18nProvider.translate(key, params);
   const locale = locales[currentLocale];
   let text = locale?.[key] ?? locales['en']?.[key] ?? key;
 
@@ -794,6 +1049,7 @@ export function addTranslations(locale: string, translations: Record<string, str
 export function resetI18n(): void {
   currentLocale = detectLocale();
   locales = initialLocales;
+  i18nProvider = undefined;
 }
 
 /**
@@ -805,9 +1061,9 @@ export function useTranslation() {
     return t(key, params);
   };
   
-  return { 
+  return {
     get t() { return translate; },
-    get locale() { return currentLocale; },
+    get locale() { return getLocale(); },
     setLocale,
     getAvailableLocales
   };

package/src/index.ts

@@ -23,7 +23,7 @@ export {
   useNavigation, useGo, useBack,
   useGetToPath, useLink,
   useResource,
-  useModalForm, useDrawerForm, useModal,
+  useModalForm, useDrawerForm, useModal, useCheckboxGroup, useRadioGroup, useAutocomplete,
   useOvertime, useRelation,
   useNotification, useDataProvider,
   useMenu, useBreadcrumb, useThemedLayoutContext,
@@ -36,7 +36,8 @@ export { setAccessControlProvider, getAccessControlProvider, getAccessControlOpt
 export { useLive, useSubscription, usePublish } from './live.svelte';
 export { toast, getToastQueue, consumeToastQueue, getPromiseQueue, consumePromiseQueue, resetToast } from './toast.svelte';
 export { notify, closeNotification, setNotificationProvider, getNotificationProvider } from './notification.svelte';
-export { t, setLocale, getLocale, getAvailableLocales, addTranslations, useTranslation } from './i18n.svelte';
+export { t, setLocale, getLocale, getAvailableLocales, addTranslations, useTranslation, setI18nProvider, getI18nProvider, resetI18n } from './i18n.svelte';
+export type { I18nProvider } from './i18n.svelte';
 export { audit, setAuditHandler, setAuditLogProvider, getAuditLogProvider } from './audit';
 export type { AuditLogProvider } from './audit';
 export { setChatProvider, getChatProvider, setChatContext, getChatContext, setAgentProvider, getAgentProvider, registerApproval, resolveApproval, hasPendingApprovals, resetChatProvider } from './chatProvider.svelte';
@@ -79,11 +80,12 @@ export type { UseCanOptions, UseCanResult } from './useCan';
 export { createCaslAccessControl } from './adapters/casl';
 export { createCasbinAccessControl } from './adapters/casbin';
 export type { CasbinAdapterOptions } from './adapters/casbin';
-export { useExport, useImport } from './data-transfer.svelte';
-export type { UseExportOptions, UseImportOptions } from './data-transfer.svelte';
+export { useExport, useImport, downloadData } from './data-transfer.svelte';
+export type { UseExportOptions, UseImportOptions, ExportFormat } from './data-transfer.svelte';
 export {
   useLogin, useLogout,
   useRegister, useForgotPassword, useUpdatePassword,
+  useUpdateIdentity, useUpdateProfile,
   useGetIdentity, useIsAuthenticated,
   useOnError, usePermissions,
   getLogoutVersion, resetLogoutVersion,

package/src/permissions.svelte.ts

@@ -9,6 +9,7 @@ export interface CanParams {
   resource: string;
   action: Action;
   params?: { id?: string | number; [key: string]: unknown };
+  meta?: Record<string, unknown>;
 }
 
 export interface CanResult {
@@ -81,8 +82,8 @@ export function getAccessControlOptions() {
  * Supports both single capability requests or an array of batched checks.
  */
 export async function canAccessAsync(params: CanParams[]): Promise<CanResult[]>;
-export async function canAccessAsync(resource: string, action: Action, params?: Record<string, unknown>): Promise<CanResult>;
-export async function canAccessAsync(resourceOrBatch: string | CanParams[], action?: Action, params?: Record<string, unknown>): Promise<CanResult | CanResult[]> {
+export async function canAccessAsync(resource: string, action: Action, params?: Record<string, unknown>, meta?: Record<string, unknown>): Promise<CanResult>;
+export async function canAccessAsync(resourceOrBatch: string | CanParams[], action?: Action, params?: Record<string, unknown>, meta?: Record<string, unknown>): Promise<CanResult | CanResult[]> {
   if (!provider) {
     return Array.isArray(resourceOrBatch)
       ? resourceOrBatch.map(() => ({ can: true }))
@@ -93,7 +94,7 @@ export async function canAccessAsync(resourceOrBatch: string | CanParams[], acti
     return provider.can(resourceOrBatch);
   }
   
-  return provider.can({ resource: resourceOrBatch, action: action as string, params }) as Promise<CanResult>;
+  return provider.can({ resource: resourceOrBatch, action: action as string, params, meta }) as Promise<CanResult>;
 }
 
 // ─── Feature Gate ─────────────────────────────────────────────

package/src/query-hooks.svelte.ts

@@ -87,9 +87,26 @@ export function useList<TData extends BaseRecord = BaseRecord, TError = HttpErro
     const queryOptions = opts.queryOptions;
     const pagination = cloneQueryKeyPart(opts.pagination);
     const sorters = cloneQueryKeyPart(opts.sorters);
-    const filters = cloneQueryKeyPart(opts.filters);
+    const explicitFilters = cloneQueryKeyPart(opts.filters);
     const meta = cloneQueryKeyPart(opts.meta);
-    
+
+    // 自动注入嵌套资源 parent filter
+    // 仅消费路径解析出的 parentParams（如 /teams/123/users 的 teamId），
+    // 不再从 query params 中误取，避免 ?tenantId=1 等被静默转成 filter。
+    //
+    // 安全边界：仅在 useList 未显式指定 resource（回退到 parsed.resource），
+    // 或显式 resource 与当前路由资源一致时注入。
+    const parentFilters: typeof explicitFilters = [];
+    const injectParent = !opts.resource || opts.resource === parsed.resource;
+    if (injectParent && parsed.parentParams) {
+      for (const [paramKey, paramVal] of Object.entries(parsed.parentParams)) {
+        if (paramKey.endsWith('Id') && paramVal) {
+          parentFilters.push({ field: paramKey, operator: 'eq' as const, value: paramVal });
+        }
+      }
+    }
+    const filters = [...parentFilters, ...(explicitFilters ?? [])];
+
     return {
       queryKey: [opts.dataProviderName, resource, 'list', pagination, sorters, filters, meta],
       queryFn: async () => provider.getList<TData>({

package/src/routing-hooks.svelte.ts

@@ -99,6 +99,15 @@ export function useResource(resourceName?: string) {
     get resource() { return resolvedResource; },
     get resources() { return getResources(); },
     get identifier() { return resolvedResource?.identifier ?? resolvedResource?.name; },
+    /** 当前 URL 解析出的 parent 资源信息（嵌套资源路由） */
+    get parent() {
+      const parentParams: Record<string, string> = {};
+      // 只取路径解析出的 parent params，排除 query params 的误判
+      for (const [k, v] of Object.entries(parsed.parentParams)) {
+        if (v) parentParams[k] = v;
+      }
+      return Object.keys(parentParams).length > 0 ? parentParams : undefined;
+    },
     /** Resolve a resource by name — useful for dynamic lookups inside callbacks */
     select: (name: string) => {
       try {

package/src/types.ts

@@ -72,6 +72,7 @@ export interface GetListParams {
 export interface GetListResult<TData extends BaseRecord = BaseRecord> {
   data: TData[];
   total: number;
+  [key: string]: unknown;
 }
 
 export interface GetOneParams {
@@ -315,6 +316,8 @@ export interface AuthProvider {
   register?: (params: Record<string, unknown>) => Promise<AuthActionResult>;
   forgotPassword?: (params: Record<string, unknown>) => Promise<AuthActionResult>;
   updatePassword?: (params: Record<string, unknown>) => Promise<AuthActionResult>;
+  /** Update current user's identity fields such as name or email. */
+  updateIdentity?: (params: Partial<Identity> & Record<string, unknown>) => Promise<AuthActionResult>;
   /** Update user profile (name, avatar, etc.) */
   updateProfile?: (params: { name?: string; avatar?: string | File; [key: string]: unknown }) => Promise<AuthActionResult>;
   /** Get list of system roles for RBAC mapping */

package/src/useCan.ts

@@ -8,6 +8,7 @@ export interface UseCanOptions {
   resource: string;
   action: Action;
   params?: Record<string, unknown>;
+  meta?: Record<string, unknown>;
   queryOptions?: {
     enabled?: boolean;
     staleTime?: number;
@@ -34,8 +35,8 @@ export function useCan(options: () => UseCanOptions): UseCanResult {
   const query = createQuery<CanResult>(() => {
     const opts = options();
     return {
-      queryKey: ['useCan', opts.resource, opts.action, opts.params] as const,
-      queryFn: () => canAccessAsync(opts.resource, opts.action, opts.params),
+      queryKey: ['useCan', opts.resource, opts.action, opts.params, opts.meta] as const,
+      queryFn: () => canAccessAsync(opts.resource, opts.action, opts.params, opts.meta),
       enabled: opts.queryOptions?.enabled ?? true,
       staleTime: opts.queryOptions?.staleTime ?? 5 * 60 * 1000,
     };

package/src/useParsed.svelte.ts

@@ -10,7 +10,10 @@ interface ParsedRoute {
   resourcePath?: string;
   action?: 'list' | 'create' | 'edit' | 'show' | 'clone';
   id?: string;
+  /** Query params parsed from the URL search string (e.g. ?page=2). */
   params: Record<string, string>;
+  /** Parent path params derived from nested routes (e.g. /teams/123/users -> teamId). */
+  parentParams: Record<string, string>;
 }
 
 let globalPath = $state('/');
@@ -21,6 +24,16 @@ export function resetGlobalPath(): void {
 export function syncGlobalPath(): void {
   if (typeof window !== 'undefined') globalPath = currentPath();
 }
+
+/** 简单的英文名词单数化，处理常见复数模式（-ies, -ses, -es, -s） */
+function singularize(word: string): string {
+  if (word.endsWith('ies') && word.length > 3) return word.slice(0, -3) + 'y';
+  if (word.endsWith('ses') && word.length > 3) return word.slice(0, -2);
+  if (word.endsWith('es') && word.length > 2) return word.slice(0, -2);
+  if (word.endsWith('s') && word.length > 1) return word.slice(0, -1);
+  return word;
+}
+
 registerRouterSync(syncGlobalPath);
 
 if (typeof window !== 'undefined') {
@@ -41,13 +54,15 @@ if (typeof window !== 'undefined') {
  *   // parsed.resource === 'posts'
  *   // parsed.action === 'edit'
  *   // parsed.id === '123'
+ *   // parsed.params contains query params only
+ *   // parsed.parentParams contains nested route params such as teamId
  */
 export function useParsed(): ParsedRoute {
   const resources = $derived((() => { try { return getResources(); } catch { return []; } })());
 
   const parsed = $derived.by(() => {
     const p = globalPath;
-    const result: ParsedRoute = { params: {} };
+    const result: ParsedRoute = { params: {}, parentParams: {} };
 
     // Parse query params from hash
     const [pathname, queryString] = p.split('?');
@@ -75,12 +90,15 @@ export function useParsed(): ParsedRoute {
       result.resource = segments[resourceIndex];
       result.resourcePath = segments.slice(0, resourceIndex + 1).join('/');
 
-      // Add parent path params based on `<parentResource>/<parentId>` structure
+      // Add parent path params based on `<parentResource>/<parentId>` structure.
+      // These are kept separate from query params so that downstream filter
+      // injection only applies to path-derived parent params, never to
+      // arbitrary query params like ?tenantId=1.
       for (let i = 0; i < resourceIndex; i += 2) {
         if (segments[i] && segments[i + 1]) {
           const parentName = segments[i];
-          const singular = parentName.endsWith('s') ? parentName.slice(0, -1) : parentName;
-          result.params[`${singular}Id`] = segments[i + 1];
+          const singular = singularize(parentName);
+          result.parentParams[`${singular}Id`] = segments[i + 1];
         }
       }
 
@@ -136,5 +154,6 @@ export function useParsed(): ParsedRoute {
     get action() { return parsed.action; },
     get id() { return parsed.id; },
     get params() { return parsed.params; },
+    get parentParams() { return parsed.parentParams; },
   };
 }

package/src/utility-hooks.svelte.ts

@@ -8,6 +8,8 @@ import { t } from './i18n.svelte';
 import type { BaseRecord, HttpError, Filter, KnownResources, ResourceDefinition } from './types';
 import { useList, type UseListOptions } from './query-hooks.svelte';
 import { toast } from './toast.svelte';
+import type { UseSelectOptions } from './hooks.svelte';
+import { useSelect as useSelectImpl } from './hooks.svelte';
 
 // ─── useModal ─────────────────────────────────────────────────
 export function useModal(options?: { defaultVisible?: boolean }) {
@@ -181,3 +183,112 @@ export function useRelation<TData extends BaseRecord = BaseRecord, TError = Http
 export function useNotification() {
   return { open: toast.info, success: toast.success, error: toast.error, warning: toast.warning };
 }
+
+// ─── Field-specific hooks (refine-compatible) ─────────────────────
+// useCheckboxGroup / useRadioGroup / useAutocomplete are convenience
+// wrappers around useSelect for common form field patterns.
+
+export interface UseCheckboxGroupOptions<TData extends BaseRecord = BaseRecord> extends Omit<UseSelectOptions<TData>, 'optionLabel' | 'optionValue' | 'defaultValue'> {
+  /** Field on the record used as the option label (default: 'title') */
+  optionLabel?: string | ((item: TData) => string);
+  /** Field on the record used as the checkbox value (default: 'id') */
+  optionValue?: string | ((item: TData) => string | number);
+  /** Currently selected values — controlled mode */
+  defaultValue?: (string | number)[];
+}
+
+/**
+ * useCheckboxGroup — multi-select field state backed by a resource query.
+ * Provides a list of checkbox options plus helpers to toggle individual values.
+ */
+export function useCheckboxGroup<TData extends BaseRecord = BaseRecord>(options: UseCheckboxGroupOptions<TData>) {
+  const select = useSelectImpl<TData>(options);
+  let selected = $state<(string | number)[]>(options.defaultValue ?? []);
+
+  function toggle(value: string | number) {
+    const idx = selected.findIndex(v => String(v) === String(value));
+    if (idx >= 0) {
+      selected = selected.filter(v => String(v) !== String(value));
+    } else {
+      selected = [...selected, value];
+    }
+  }
+
+  function isSelected(value: string | number): boolean {
+    return selected.some(v => String(v) === String(value));
+  }
+
+  return {
+    query: select.query,
+    get options() { return select.options; },
+    onSearchChange: select.onSearchChange,
+    get selected() { return selected; },
+    toggle,
+    isSelected,
+    setSelected: (values: (string | number)[]) => { selected = values; },
+  };
+}
+
+export interface UseRadioGroupOptions<TData extends BaseRecord = BaseRecord> extends Omit<UseSelectOptions<TData>, 'optionLabel' | 'optionValue' | 'defaultValue'> {
+  optionLabel?: string | ((item: TData) => string);
+  optionValue?: string | ((item: TData) => string | number);
+  defaultValue?: string | number;
+}
+
+/**
+ * useRadioGroup — single-select field state backed by a resource query.
+ * Provides a list of radio options plus a setter for the currently selected value.
+ */
+export function useRadioGroup<TData extends BaseRecord = BaseRecord>(options: UseRadioGroupOptions<TData>) {
+  const { defaultValue: _dv, ...selectOpts } = options;
+  // useSelect 的 defaultValue 是数组类型；透传单值以便远程选项回填当前已选值
+  const select = useSelectImpl<TData>({
+    ...selectOpts,
+    defaultValue: _dv !== undefined ? [_dv] : [],
+  });
+  let value = $state<string | number | undefined>(_dv);
+
+  return {
+    query: select.query,
+    get options() { return select.options; },
+    onSearchChange: select.onSearchChange,
+    get value() { return value; },
+    setValue: (v: string | number) => { value = v; },
+  };
+}
+
+export interface UseAutocompleteOptions<TData extends BaseRecord = BaseRecord> extends Omit<UseSelectOptions<TData>, 'onSearch' | 'defaultValue'> {
+  optionLabel?: string | ((item: TData) => string);
+  optionValue?: string | ((item: TData) => string | number);
+  /** Field name to search against (default: optionLabel) */
+  searchField?: string;
+  defaultValue?: string | number;
+}
+
+/**
+ * useAutocomplete — typeahead search field backed by a resource query.
+ * Builds a 'contains' filter on the search field and debounces input.
+ */
+export function useAutocomplete<TData extends BaseRecord = BaseRecord>(options: UseAutocompleteOptions<TData>) {
+  const { searchField, defaultValue: _dv, ...selectOpts } = options;
+  const labelField = typeof options.optionLabel === 'string' ? options.optionLabel : 'title';
+
+  const select = useSelectImpl<TData>({
+    ...selectOpts,
+    defaultValue: _dv !== undefined ? [_dv] : [],
+    onSearch: (term) => [{
+      field: searchField ?? labelField,
+      operator: 'contains' as const,
+      value: term,
+    }],
+  });
+  let value = $state<string | number | undefined>(_dv);
+
+  return {
+    query: select.query,
+    get options() { return select.options; },
+    onSearchChange: select.onSearchChange,
+    get value() { return value; },
+    setValue: (v: string | number) => { value = v; },
+  };
+}