elcrm 1.1.24 → 1.1.26

package/dist/index.js

@@ -1901,6 +1901,9 @@ async function migrateFormNative(cwd, dry) {
   const changes = [];
   const files = projectCodeRoots(cwd).flatMap((r) => walkCodeFiles(r)).filter((f) => /\.(tsx|jsx)$/.test(f));
   for (const file of files) {
+    if (/(^|\/)pages\/Auth\.tsx$/.test(rel(cwd, file).replace(/\\/g, "/"))) {
+      continue;
+    }
     const raw = readFileSync14(file, "utf8");
     const { next, hits } = rewriteFormNative(raw);
     if (hits === 0)
@@ -2637,7 +2640,7 @@ function collectFrontIssues(cwd, pkg) {
           });
         }
       }
-      if (/(?:^|\s)native(?:\s|$|=|\/|>)/.test(line) && !/\bnavigator\b|\bnativeEvent\b|\bcreateNative/.test(line) && !/['"`]native['"`]/.test(line) && !(/\binstallMode\b/.test(line) && /\bnative\b/.test(line))) {
+      if (!/(^|\/)pages\/Auth\.tsx$/.test(rel2.replace(/\\/g, "/")) && /(?:^|\s)native(?:\s|$|=|\/|>)/.test(line) && !/\bnavigator\b|\bnativeEvent\b|\bcreateNative/.test(line) && !/['"`]native['"`]/.test(line) && !(/\binstallMode\b/.test(line) && /\bnative\b/.test(line))) {
         if (pkg.name !== "@elcrm/form") {
           issues.push({
             level: "warn",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "elcrm",
-  "version": "1.1.24",
+  "version": "1.1.26",
   "description": "CLI @elcrm/*: doctor --fix (порядок проекта), update, css, docs, cursor, kit, migrate",
   "type": "module",
   "license": "MIT",
@@ -53,6 +53,9 @@
     "dev": "bun run ./src/index.ts",
     "elcrm": "bun run ./src/index.ts",
     "test": "bun test src/lib/migrate src/lib/tidy.test.ts src/lib/kit src/vite",
+    "demo": "bun run scripts/dev-template.ts",
+    "demo:panel": "bun run scripts/dev-template.ts panel",
+    "demo:orbit": "bun run scripts/dev-template.ts orbit",
     "link:local": "bun run build && bun link",
     "prepublishOnly": "bun run test && bun run build",
     "publish:npm": "npm publish"

package/templates/elcrm-docs/BUTTON.elCRM.md

@@ -26,7 +26,8 @@ import { Button } from "@elcrm/button";
 - `onSend(setDisabled, event)`: синхронный `false` — без pending; промис/`async` — pending до settle; иначе снять через `setDisabled(false)`
 - Если задан `onClick` — `onSend` **не** вызывается
 - `buttonType`: `button` \| `submit` \| `reset`
-- Точечно: `@elcrm/button/Button`
+- **`IconButton`** — только иконка: `icon` + обязательный `label` → `aria-label`. Имя иконки + tooltip — `@elcrm/components` `IconButton`.
+- Точечно: `@elcrm/button/Button`, `@elcrm/button/IconButton`
 
 ## Нельзя
 

package/templates/elcrm-docs/CLI.elCRM.md

@@ -67,7 +67,7 @@ elcrm migrate front          # пакет (то же, что doctor --fix без
                              #   form-tokens → components → css-sanitize →
                              #   size-sml → field-border → modal-create →
                              #   socket-server
-elcrm migrate form-native    # снять prop native у @elcrm/form
+elcrm migrate form-native    # снять prop native у @elcrm/form (не трогает pages/Auth.tsx)
 elcrm migrate native-html    # <input|textarea> → StringField/CheckField/…
 elcrm migrate css-sanitize   # осиротевшие in srgb / transparent);
 elcrm migrate components     # Block/Row → Stack, --page-* / --item-* → --shell-*

package/templates/elcrm-docs/COMPONENTS.elCRM.md

@@ -17,6 +17,7 @@ import {
   Card, Stat, ActionGroup, Toolbar, TextGroup, ItemColumn, List, Item, PageHead, PageShell, ChatList, ChatMessages, ChatSplit, Sidebar, Popover,
   Healthmap, PanelInfo,
   Loading, EmptyState, RadioGroup, PricingGroup, PricingTable,
+  Table, CodeBlock, SplitPane, Banner, IconButton,
   createLazyResolver,
 } from "@elcrm/components";
 import type { PricingPlan, HealthmapData } from "@elcrm/components";
@@ -43,6 +44,11 @@ import type { PricingPlan, HealthmapData } from "@elcrm/components";
 - **TextGroup** — две строки: `title` + `description` (без аватара; с аватаром — AvatarName).
 - **Item** — строка списка. `as` button/a/li, `active`. `variant="card"` — рамка и muted-фон (идеи / тикеты / inbox). Не дублировать `.desk-row` в приложении.
 - **ItemColumn** — внутри Item: `icon` слева, столбик `title` / `description` / `footer` или `meta`, `extra` — бейджи справа сверху, `aside` — колонка справа. `unread` — жирный title. Title: `--item-column-title-size` / `--item-column-title-line` (в console = `--button-size-s` / `--button-line-height`).
+- **Table** — `<table>` в обёртке со скроллом. `layout="fixed"` для фиксированной сетки. Токены `--table-*`.
+- **CodeBlock** — bar + `<pre>`, `onCopy`, `children` для подсветки. Токены `--code-block-*`.
+- **SplitPane** — две панели + drag handle. `direction`, `ratio`, `onRatioChange`, `minFirst` / `minSecond`. Не `ChatSplit` (только чат). Токены `--split-handle-*`.
+- **Banner** — статусная полоса (`tone`: info / warning / danger / success). Не toast — не `Notice`.
+- **IconButton** — `name` (`Icons.Line`) + обязательный `label` + `Tooltip` по умолчанию. `tooltip={false}` без подсказки. Низкий уровень — `@elcrm/button/IconButton` (`icon` + `label`).
 
 ## Меню
 

package/templates/elcrm-docs/FORM.elCRM.md

@@ -14,6 +14,14 @@ const form = useForm({ login: "", password: "" });
 <Form.Init onNotice={(msg) => { /* тост */ }} />
 <StringField name="login" form={form} label="Логин" autoComplete="username" />
 <PasswordField name="password" form={form} label="Пароль" />
+
+{/* Экран входа: native обязателен — autofill и Passkey (autocomplete="username webauthn") */}
+<StringField
+  name="login"
+  form={form}
+  native
+  autoComplete="username webauthn"
+/>
 ```
 
 `Form.Init` — если нужны notice / модалки для `ModalField` / `OptionsField`.
@@ -40,7 +48,7 @@ const form = useForm({ login: "", password: "" });
 - Алиасы: `ProgressField` → `RangeField`, `ReadonlyField` → `DisplayField`, `OtpField` → `CodeField`, `SegmentField` → `TabsField`, `DragonDropField` → `DragDropField`. Чинит `elcrm migrate form-aliases`.
 - В форме: `Search` из `@elcrm/search` → `SearchField` (`form`+`name`). Хедер — `@elcrm/search`.
 - Токены `--search-*` → `--field-*` (`elcrm migrate form-tokens`).
-- Проп `native` на полях — `elcrm test` предупреждает; снять: `elcrm migrate form-native`. У `StringField` `native` исторически для autofill; у `PasswordField` `native` значит «не рендерить» — не путать.
+- Проп `native` на обычных полях — `elcrm test` предупреждает; снять: `elcrm migrate form-native`. **Исключение — авторизация:** у логина на экране входа нужен `native` (браузерный autofill + WebAuthn / Passkey, `autoComplete="username webauthn"`). Без `native` менеджер паролей и Passkey не видят поле. У `PasswordField` `native` значит «не рендерить» — на пароле входа **не** ставить.
 - Legacy-токены: `--field-note-padding*`, `--control-inner-padding`, `--control-side-padding`, `--field-side-padding`, `--date-popup-shadow` → `elcrm migrate form-tokens`.
 - Пересоздавать `options` селекта на каждый рендер — константа модуля.
 - Серверные пакеты `@elcrm/db|jwt|cron|tb` на фронте.

package/templates/elcrm-docs/PASSKEY.elCRM.md

@@ -19,6 +19,8 @@ await passkey.remove({ userId, credentialId });
 
 Ядро **без React**. Хуки — `@elcrm/passkey/react`. Ошибки: `PasskeyError.code`.
 
+На экране входа у поля логина обязателен проп **`native`** у `StringField` и `autoComplete="username webauthn"` — иначе браузер не предлагает Passkey / autofill.
+
 ## Нельзя
 
 - `createPasskey` / `authenticateWithPasskey` — **не экспортируются** (`elcrm test` error).

package/templates/orbit/api/src/index.ts

@@ -2,6 +2,7 @@
  * orbit.api — createRouter + createServer; JWT/CORS/cron из конфига.
  */
 import { createServer, cors as serverCors } from "@elcrm/server";
+import { createNotifications } from "@elcrm/server/notifications";
 import { DB_PATH, getCorsOrigin, PORT, TOKEN } from "./config";
 import { initDatabase } from "./lib/db";
 import { jwt } from "./lib/jwt";
@@ -13,9 +14,22 @@ async function start() {
   if (!process.env.TOKEN?.trim()) {
     process.env.TOKEN = TOKEN;
   }
+  if (!process.env.PASSKEY_RP_ID?.trim()) {
+    process.env.PASSKEY_RP_ID = "localhost";
+  }
+  if (!process.env.PASSKEY_ORIGIN?.trim()) {
+    process.env.PASSKEY_ORIGIN = "http://localhost:5173";
+  }
+  if (!process.env.PASSKEY_STORAGE_ADAPTER?.trim()) {
+    process.env.PASSKEY_STORAGE_ADAPTER = "sqlite";
+  }
 
   await initDatabase();
   registerRoutes();
+  await createNotifications({
+    defaultTenantId: "orbit",
+    vapidSubject: "mailto:admin@localhost",
+  });
 
   try {
     createServer({

package/templates/orbit/api/src/lib/db.ts

@@ -36,6 +36,17 @@ async function migrate() {
     )
   `);
 
+  await db.run(`
+    CREATE TABLE IF NOT EXISTS password_resets (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      token_hash TEXT NOT NULL,
+      user_id INTEGER NOT NULL,
+      expires_at TEXT NOT NULL,
+      used INTEGER NOT NULL DEFAULT 0,
+      attempts INTEGER NOT NULL DEFAULT 0
+    )
+  `);
+
   const count = await db.get<{ n: number }>(
     "SELECT count(*) AS n FROM users",
   );

package/templates/orbit/api/src/lib/passwordReset.ts

@@ -0,0 +1,143 @@
+/**
+ * Сброс пароля: 6-значный код. В демо код пишется в лог API.
+ */
+import { createHash, randomInt } from "node:crypto";
+import { db } from "./db";
+import { jwt } from "./jwt";
+
+const TTL_MS = 15 * 60 * 1000;
+const MIN_PASSWORD = 6;
+const MAX_ATTEMPTS = 5;
+
+type ResetRow = {
+  id: number;
+  token_hash: string;
+  user_id: number;
+  expires_at: string;
+  used: number;
+  attempts: number;
+};
+
+type UserLite = {
+  id: number;
+  login: string;
+  email: string | null;
+  active: number | null;
+};
+
+function hashCode(code: string): string {
+  return createHash("sha256").update(code.trim()).digest("hex");
+}
+
+function generateCode(): string {
+  return String(randomInt(100_000, 1_000_000));
+}
+
+const hits = new Map<string, { n: number; until: number }>();
+
+function rateOk(key: string): boolean {
+  const now = Date.now();
+  const row = hits.get(key);
+  if (!row || now > row.until) {
+    hits.set(key, { n: 1, until: now + 15 * 60 * 1000 });
+    return true;
+  }
+  if (row.n >= 5) return false;
+  row.n += 1;
+  return true;
+}
+
+/** Найти пользователя по логину или email */
+export async function findUserForRestore(loginOrEmail: string) {
+  const q = loginOrEmail.trim();
+  if (!q) return null;
+  return db.get<UserLite>(
+    `SELECT id, login, email, active FROM users
+     WHERE lower(login) = lower(?) OR lower(ifnull(email, '')) = lower(?)
+     LIMIT 1`,
+    [q, q],
+  );
+}
+
+export async function requestPasswordReset(
+  loginOrEmail: string,
+  ip: string,
+): Promise<void> {
+  const q = loginOrEmail.trim();
+  if (!q) return;
+  if (!rateOk(`ip:${ip}`) || !rateOk(`login:${q.toLowerCase()}`)) {
+    return;
+  }
+
+  const user = await findUserForRestore(q);
+  if (!user || user.active === 0) return;
+
+  const code = generateCode();
+  const expires = new Date(Date.now() + TTL_MS).toISOString();
+
+  await db.run("DELETE FROM password_resets WHERE user_id = ?", [user.id]);
+  await db.run(
+    `INSERT INTO password_resets (token_hash, user_id, expires_at, used, attempts)
+     VALUES (?, ?, ?, 0, 0)`,
+    [hashCode(code), user.id, expires],
+  );
+
+  console.log(`[auth/restore] код для ${user.login}: ${code}`);
+}
+
+export async function confirmPasswordReset(
+  loginOrEmail: string,
+  code: string,
+  password: string,
+): Promise<{ ok: true } | { error: string }> {
+  const login = loginOrEmail.trim();
+  const digits = code.trim();
+  if (!login || !digits) return { error: "Укажите email, код и новый пароль" };
+  if (!/^\d{6}$/.test(digits)) {
+    return { error: "Код должен состоять из 6 цифр" };
+  }
+  if (password.length < MIN_PASSWORD) {
+    return { error: "Пароль не короче 6 символов" };
+  }
+
+  const user = await findUserForRestore(login);
+  if (!user || user.active === 0) {
+    return { error: "Неверный или истёкший код" };
+  }
+
+  const row = await db.get<ResetRow>(
+    `SELECT id, token_hash, user_id, expires_at, used, attempts
+     FROM password_resets WHERE user_id = ? AND used = 0
+     ORDER BY id DESC LIMIT 1`,
+    [user.id],
+  );
+  if (!row) return { error: "Неверный или истёкший код" };
+  if (new Date(row.expires_at).getTime() < Date.now()) {
+    await db.run("DELETE FROM password_resets WHERE id = ?", [row.id]);
+    return { error: "Неверный или истёкший код" };
+  }
+  const attempts = Number(row.attempts ?? 0);
+  if (attempts >= MAX_ATTEMPTS) {
+    await db.run("DELETE FROM password_resets WHERE id = ?", [row.id]);
+    return { error: "Слишком много попыток. Запросите новый код." };
+  }
+  if (hashCode(digits) !== row.token_hash) {
+    const next = attempts + 1;
+    await db.run("UPDATE password_resets SET attempts = ? WHERE id = ?", [
+      next,
+      row.id,
+    ]);
+    if (next >= MAX_ATTEMPTS) {
+      await db.run("DELETE FROM password_resets WHERE id = ?", [row.id]);
+      return { error: "Слишком много попыток. Запросите новый код." };
+    }
+    return { error: "Неверный или истёкший код" };
+  }
+
+  await db.run("UPDATE users SET password = ? WHERE id = ?", [
+    jwt.password(password),
+    user.id,
+  ]);
+  await db.run("UPDATE password_resets SET used = 1 WHERE id = ?", [row.id]);
+  return { ok: true };
+}

package/templates/orbit/api/src/routes/auth.ts

@@ -7,6 +7,11 @@ import {
 } from "@elcrm/server";
 import { db } from "../lib/db";
 import { jwt } from "../lib/jwt";
+import {
+  confirmPasswordReset,
+  findUserForRestore,
+  requestPasswordReset,
+} from "../lib/passwordReset";
 
 type UserRow = {
   id: number;
@@ -43,8 +48,10 @@ function publicUser(
  * Не вызываем jwt.init повторно — только наличие user.
  * publicMethods: pass (логин без сессии).
  */
+const PUBLIC = new Set(["pass", "restore", "restoreConfirm"]);
+
 const requireUser: Middleware = async ({ path, user }) => {
-  if (path[1] === "pass") return;
+  if (PUBLIC.has(String(path[1] ?? ""))) return;
   if (!user?.id) return rpcLogout();
 };
 
@@ -52,17 +59,19 @@ export function registerAuthRoutes() {
   createRouter("auth")
     .use(requireUser)
     .use("pass", async ({ body, headers, jwt: jwtCtx }) => {
-      const login = String(body?.login ?? "").trim();
+      const login = String(body?.login ?? body?.email ?? "").trim();
       const password = String(body?.password ?? "");
 
       if (!login || !password) {
         return rpcErr("Неверные данные", 400);
       }
 
-      const data = await db.get<UserRow>(
-        "SELECT * FROM users WHERE login = ?",
-        [login],
-      );
+      const found = await findUserForRestore(login);
+      const data = found
+        ? await db.get<UserRow>("SELECT * FROM users WHERE id = ?", [
+            found.id,
+          ])
+        : null;
 
       if (!data) return rpcErr("Пользователь не найден");
       if (data.active === 0) {
@@ -110,5 +119,47 @@ export function registerAuthRoutes() {
       );
       if (!row) return rpcErr("Пользователь не найден", 404);
       return rpcOk(publicUser(row));
+    })
+    .use("password", async ({ user, body }) => {
+      const password = String(body?.password ?? "");
+      if (password.length < 6) {
+        return rpcErr("Пароль не короче 6 символов", 400);
+      }
+      await db.run("UPDATE users SET password = ? WHERE id = ?", [
+        jwt.password(password),
+        user.id,
+      ]);
+      return rpcOk({ ok: true });
+    })
+    .use("restore", async ({ body, headers }) => {
+      const login = String(body?.login ?? body?.email ?? "").trim();
+      if (!login) return rpcErr("Укажите email или логин", 400);
+      try {
+        await requestPasswordReset(login, clientIp(headers));
+      } catch (e) {
+        console.error("auth/restore:", e);
+        return rpcErr("Не удалось отправить код", 500);
+      }
+      return rpcOk({ ok: true });
+    })
+    .use("restoreConfirm", async ({ body }) => {
+      const login = String(body?.login ?? body?.email ?? "").trim();
+      const code = String(body?.code ?? body?.token ?? "").trim();
+      const password = String(body?.password ?? "");
+      const result = await confirmPasswordReset(login, code, password);
+      if ("error" in result) return rpcErr(result.error, 400);
+      return rpcOk({ ok: true });
     });
 }
+
+function clientIp(headers: unknown): string {
+  const h = headers as { get?: (k: string) => string | null } & Record<
+    string,
+    string | undefined
+  >;
+  const raw =
+    (typeof h?.get === "function"
+      ? h.get("x-forwarded-for") || h.get("x-real-ip")
+      : h?.["x-forwarded-for"] || h?.["x-real-ip"]) || "";
+  return String(raw).split(",")[0]?.trim() || "local";
+}

package/templates/orbit/api/src/routes/index.ts

@@ -1,10 +1,11 @@
 import { createRouter, rpcOk } from "@elcrm/server";
 import { registerAuthRoutes } from "./auth";
 import { registerDeployRoutes } from "./deploy";
+import { registerPasskeyRoutes } from "./passkey";
 
 export function registerRoutes() {
   createRouter("health").use("ping", async () =>
-    rpcOk({ ok: true, service: "panel.api" }),
+    rpcOk({ ok: true, service: "orbit.api" }),
   );
 
   createRouter("version").use("get", async () =>
@@ -12,5 +13,6 @@ export function registerRoutes() {
   );
 
   registerAuthRoutes();
+  registerPasskeyRoutes();
   registerDeployRoutes();
 }

package/templates/orbit/api/src/routes/passkey.ts

@@ -0,0 +1,145 @@
+/**
+ * WebAuthn Passkey: регистрация / вход / удаление.
+ */
+import { createRouter, rpcErr, rpcOk } from "@elcrm/server";
+import {
+  createPasskey,
+  createPasskeyAuthentication,
+  handlePasskeyAuthVerify,
+  handlePasskeyRegisterVerify,
+  handlePasskeyRemove,
+  listPasskeyCredentials,
+} from "@elcrm/server/passkey";
+import { db } from "../lib/db";
+import { jwt } from "../lib/jwt";
+import { findUserForRestore } from "../lib/passwordReset";
+
+type UserRow = {
+  id: number;
+  login: string;
+  active: number | null;
+  admin: number | null;
+};
+
+async function findUserByLogin(login: string) {
+  const found = await findUserForRestore(login);
+  if (!found) return null;
+  return db.get<UserRow>(
+    "SELECT id, login, active, admin FROM users WHERE id = ?",
+    [found.id],
+  );
+}
+
+export function registerPasskeyRoutes() {
+  createRouter("passkey")
+    .use("registerOptions", async ({ user, body }) => {
+      if (!user?.id) return { status: "logout", data: null };
+
+      const row = await db.get<UserRow>(
+        "SELECT id, login, active FROM users WHERE id = ?",
+        [user.id],
+      );
+      if (!row || row.active === 0) {
+        return { status: "logout", data: null };
+      }
+
+      const name = String(body?.username ?? row.login);
+      const options = await createPasskey({
+        id: String(row.id),
+        name,
+        displayName: name,
+      });
+      return rpcOk({ options });
+    })
+    .use("registerVerify", async ({ user, body }) => {
+      if (!user?.id) return { status: "logout", data: null };
+
+      const result = await handlePasskeyRegisterVerify({
+        userId: String(user.id),
+        credential: body?.credential,
+      });
+      if (!result.ok) {
+        return rpcErr(result.reason ?? result.code, result.status ?? 400);
+      }
+      return rpcOk(result);
+    })
+    .use("authOptions", async ({ body }) => {
+      const login = String(body?.login ?? body?.userId ?? "").trim();
+      if (!login) return rpcErr("login required", 400);
+
+      let userId = login;
+      if (!/^\d+$/.test(login)) {
+        const row = await findUserByLogin(login);
+        if (!row || row.active === 0) {
+          return rpcErr("Пользователь не найден");
+        }
+        userId = String(row.id);
+      }
+
+      const options = await createPasskeyAuthentication(userId);
+      return rpcOk({ options, userId });
+    })
+    .use("authVerify", async ({ body, headers, jwt: jwtCtx }) => {
+      const login = String(body?.login ?? body?.userId ?? "").trim();
+      if (!login) return rpcErr("login required", 400);
+
+      let row: UserRow | null = null;
+      if (/^\d+$/.test(login)) {
+        row = await db.get<UserRow>(
+          "SELECT id, login, active, admin FROM users WHERE id = ?",
+          [Number(login)],
+        );
+      } else {
+        row = await findUserByLogin(login);
+      }
+
+      if (!row || row.active === 0) {
+        return rpcErr("Пользователь не найден");
+      }
+
+      const result = await handlePasskeyAuthVerify({
+        userId: String(row.id),
+        credential: body?.credential,
+      });
+      if (!result.ok) {
+        return rpcErr(result.reason ?? result.code, result.status ?? 400);
+      }
+
+      const admin = Number(row.admin) === 1 ? 1 : 0;
+      const tokenApi = jwtCtx ?? jwt;
+      const ssid = await tokenApi.create(
+        { id: row.id, admin },
+        { headers },
+      );
+
+      return rpcOk({ id: row.id, login: row.login, admin }, { ssid });
+    })
+    .use("list", async ({ user }) => {
+      if (!user?.id) return { status: "logout", data: null };
+      try {
+        const rows = await listPasskeyCredentials(String(user.id));
+        return rpcOk(rows);
+      } catch (err) {
+        console.error("[passkey/list]", err);
+        return rpcErr("Не удалось загрузить Passkey", 500);
+      }
+    })
+    .use("remove", async ({ user, body }) => {
+      if (!user?.id) return { status: "logout", data: null };
+
+      const credentialId = String(body?.credentialId ?? "");
+      if (!credentialId) return rpcErr("credentialId required", 400);
+
+      const result = await handlePasskeyRemove({
+        userId: String(user.id),
+        credentialId,
+      });
+      if (!result.ok) {
+        return rpcErr(
+          result.reason ?? (result as { code?: string }).code,
+          result.status ?? 400,
+        );
+      }
+      return rpcOk(result);
+    });
+}

package/templates/orbit/web/index.html

@@ -3,6 +3,12 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="theme-color" content="#f6f6f4" />
+    <meta name="mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-title" content="Orbit" />
+    <link rel="icon" href="/logo.svg" type="image/svg+xml" />
+    <link rel="apple-touch-icon" href="/logo.svg" />
     <title>Orbit</title>
     <script>
       try {

package/templates/orbit/web/package.json

@@ -16,7 +16,7 @@
     "@elcrm/core": "0.1.3",
     "@elcrm/crypto": "0.0.2",
     "@elcrm/error-boundary": "0.0.2",
-    "@elcrm/form": "0.1.12",
+    "@elcrm/form": "0.1.17",
     "@elcrm/icons": "^0.1.5",
     "@elcrm/modal": "0.0.34",
     "@elcrm/notice": "0.1.4",
@@ -35,6 +35,7 @@
     "@types/react-dom": "^18.2.25",
     "@vitejs/plugin-react": "^4.3.1",
     "typescript": "^5.8.2",
-    "vite": "^5.4.2"
+    "vite": "^5.4.2",
+    "vite-plugin-pwa": "^0.21.2"
   }
 }

package/templates/orbit/web/public/logo.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
+  <rect width="512" height="512" rx="96" fill="#1a1a1a"/>
+  <path fill="#fff" d="M156 140h200v48H220v56h120v48H220v80h-64z"/>
+</svg>

package/templates/orbit/web/src/App.tsx

@@ -1,9 +1,9 @@
 import { Alert } from "@elcrm/alert";
 import { Modal } from "@elcrm/modal";
 import { Notice } from "@elcrm/notice";
-import { Notifications } from "@elcrm/notifications";
 import { Form } from "@elcrm/form";
 import { LoadRoute } from "@elcrm/router";
+import { AppNotificationsInit } from "./lib/notifications";
 
 /**
  * Корень Orbit: Init пакетов + страница.
@@ -14,7 +14,7 @@ export default function App() {
       <Alert.Init />
       <Modal.Init />
       <Notice.Init position="top-right" durationMs={2200} maxVisible={4} />
-      <Notifications.Init appBadge={false} autoSync={false} />
+      <AppNotificationsInit />
       <Form.Init onNotice={(msg) => Notice.Remark(String(msg))} />
       <LoadRoute
         variant="page"