feat(hub): drop redundant /admin/org/:slug path + release v0.0.35

Silo hostname already carries tenancy. Admin SPA routes become /admin/...,
legacy /admin/org/:slug/* bookmarks redirect, login lands on /admin.

.gitea/workflows/checker-check.yml

@@ -1,12 +1,12 @@
 name: checker check
 
 # Builds and lints the Rust implementation crates under crates/ (the rule-based
-# lesson checker).
+# checker that "stands in Lean's position" at product runtime).
 #
-# This is an INTERNAL gate on the implementation's own health
+# Like spec-check, this is an INTERNAL gate on the implementation's own health
-# (does it build, pass its tests, satisfy clippy + rustfmt?). There is no
+# (does it build, pass its tests, satisfy clippy + rustfmt?). It is NOT a
-# decision-to-implementation conformance gate — implementations align to the
+# spec-to-implementation conformance gate — implementations align to the Lean
-# ADRs by human review, not by CI. See the repo README.
+# contract by human review, not by CI. See the repo README.
 
 on:
   push:

.gitea/workflows/hub-check.yml

@@ -1,8 +1,8 @@
 name: hub check
 
 # Builds, type-checks, and tests the Hub TS package under hub/.
-# The Hub is the Feishu-group collaboration + agent runtime half.
+# The Hub is the Feishu-group collaboration + agent runtime half
-# This is an INTERNAL gate on the Hub's own
+# (spec/System implementation). This is an INTERNAL gate on the Hub's own
 # health, like checker-check is for the Rust half.
 
 on:

.gitea/workflows/spec-check.yml

@@ -0,0 +1,20 @@
+name: spec check
+
+# Builds the Lean semantic master spec under spec/.
+# This is an INTERNAL well-formedness gate (does the contract type-check?),
+# NOT a spec-to-implementation conformance gate — implementations align to the
+# contract by human review, not by CI. See repo README.
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  spec-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: leanprover/lean-action@v1
+        with:
+          lake-package-directory: spec

.gitignore

@@ -1,3 +1,7 @@
+# Lean / Lake build artifacts (spec/ has its own .gitignore too)
+.lake/
+**/.lake/
+
 # Rust / Cargo build artifacts (repo-wide cargo workspace at root)
 /target
 **/*.pdf

.omo/run-continuation/ses_0705f8afbffePWIq7GrFfwfFwV.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_0705f8afbffePWIq7GrFfwfFwV",
-  "updatedAt": "2026-07-23T15:40:15.630Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-23T15:40:15.630Z"
-    }
-  }
-}

.omo/run-continuation/ses_07252990dffeRFmXnvdyynty2z.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_07252990dffeRFmXnvdyynty2z",
-  "updatedAt": "2026-07-23T06:33:33.086Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-23T06:33:33.086Z"
-    }
-  }
-}

.omo/run-continuation/ses_075d214a0ffe6mU8VNgukUfH5L.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_075d214a0ffe6mU8VNgukUfH5L",
-  "updatedAt": "2026-07-22T14:15:01.741Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-22T14:15:01.741Z"
-    }
-  }
-}

.omo/run-continuation/ses_075d3282bffejz0HFE00taOaGM.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_075d3282bffejz0HFE00taOaGM",
-  "updatedAt": "2026-07-22T14:13:54.785Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-22T14:13:54.785Z"
-    }
-  }
-}

.omo/run-continuation/ses_0781484caffeKJHXVKiD4BqEJw.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_0781484caffeKJHXVKiD4BqEJw",
-  "updatedAt": "2026-07-22T06:17:18.238Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-22T06:17:18.238Z"
-    }
-  }
-}

.omo/run-continuation/ses_07b163c13ffeudULxSfIfK986T.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_07b163c13ffeudULxSfIfK986T",
-  "updatedAt": "2026-07-21T13:55:58.878Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-21T13:55:58.878Z"
-    }
-  }
-}

.omo/run-continuation/ses_07b1e6c8effeq7bdmj6NgO0LqC.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_07b1e6c8effeq7bdmj6NgO0LqC",
-  "updatedAt": "2026-07-21T13:38:01.132Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-21T13:38:01.132Z"
-    }
-  }
-}

.omo/run-continuation/ses_07b932dddffecSipFLwlJOvoJ9.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_07b932dddffecSipFLwlJOvoJ9",
-  "updatedAt": "2026-07-21T11:27:10.420Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-21T11:27:10.420Z"
-    }
-  }
-}

.omo/run-continuation/ses_07b9c4268ffeic4mMXCPUt225j.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_07b9c4268ffeic4mMXCPUt225j",
-  "updatedAt": "2026-07-21T11:18:53.449Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-21T11:18:53.449Z"
-    }
-  }
-}

.omo/run-continuation/ses_07b9c4346ffeVBdV5pf4h6s9PW.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_07b9c4346ffeVBdV5pf4h6s9PW",
-  "updatedAt": "2026-07-21T11:18:29.979Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-21T11:18:29.979Z"
-    }
-  }
-}

.omo/run-continuation/ses_07b9c9a75ffeOyJ4ewp3DBvXhz.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_07b9c9a75ffeOyJ4ewp3DBvXhz",
-  "updatedAt": "2026-07-21T11:21:09.776Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-21T11:21:09.776Z"
-    }
-  }
-}

.omo/run-continuation/ses_07cdbac0effeiBrdcHLUUUfwuF.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_07cdbac0effeiBrdcHLUUUfwuF",
-  "updatedAt": "2026-07-23T15:37:59.918Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-23T15:37:59.918Z"
-    }
-  }
-}

.omo/文件库-开工计划.md

@@ -1,114 +0,0 @@
-# 文件库 · 开工计划（v1.0）
-
-> 配套文档：《文件库-接口契约.md》(v0.1，仓库根目录)。本计划已吸收规划顾问评审意见，包含开工前必须先冻结的**架构收口决策 D11–D19**（回写契约 v0.2 时并入）。
-> 工期按 1 人全栈估算；前端从 Phase 2 后可并行。
-
-## 开工判定
-
-**可以开工。** 四个外部依赖（版本包 / Group / 审计 / 平台身份）全部有契约可依、可 mock 并行开发；无阻塞项。唯一前置：本文件的 D11–D19 决策在写第一行 schema 前过一遍（半天，自查即可，有异议再升级）。
-
-## 架构收口决策（新增，先冻结再动工）
-
-| 编号 | 决策 | 理由 |
-|---|---|---|
-| D11 | `creator` 是 Node 的**不可变列**，创建时同时落一条 Manage grant；独立权限开关关闭时，**creator 的 Manage 仍生效**，其余项目级 grant 冻结不参与计算 | 否则 creator 可能被自己关掉的开关锁死 |
-| D12 | 移动节点授权 = **本节点 Manage + 目标父 Edit+**；移动在事务 + Postgres 咨询锁内完成，防并发成环 | 预检环检测在并发下不安全 |
-| D13 | Group resolve 失败返回 **503**（不伪装 404/403）；每次 HTTP 请求 fresh resolve，不跨请求缓存；单请求内多次校验合并为一次调用（此点与 Group 团队确认，OPEN-9） | 依赖故障 ≠ 无权限；契约 G4 要求实时 |
-| D14 | 命名规则：NFC 归一化、trim、≤128 字符、禁 `/` 与控制字符；**活跃兄弟节点大小写不敏感唯一**；根节点全局唯一 | 缺命名规则必有脏数据 |
-| D15 | 删除 = 只给被删节点打标，后代**不递归打标**，靠"任一祖先已删"过滤；所有查询链路强制此过滤（含递归 SQL，不只靠 Prisma middleware） | 递归打标的写放大与恢复复杂度不可控 |
-| D16 | `baseVersion` 为**文件级版本**（GET file 返回的 version）；无关文件的提交不产生冲突 | 与 C1 `head(dir, filePath)` 语义一致 |
-| D17 | breadcrumb 只暴露用户有 View 的祖先名称；无权限祖先显示占位符 `…`，不暴露名字 | 404 不泄露语义（D8）延伸到面包屑 |
-| D18 | v1 **单副本部署**（git 仓库在本地磁盘）；多副本需共享存储或分片，后置 | 不解决不存在的扩展问题 |
-| D19 | 网站管理员**不隐式读内容**；force_adjust 凭 node id 操作（id 从审计或用户上报获得） | C4 已定的最小权限原则 |
-
-## 阶段计划
-
-### Phase 0 · 骨架与身份先行（1–2 天）
-
-- [ ] 过 D11–D19，回写契约 v0.2
-- [ ] repo 骨架 `server/` + `web/`，Postgres docker-compose，CI（lint / typecheck / vitest / 集成测试用真实 Postgres service container）
-- [ ] **JWT 中间件 + 本地 JWKS 测试服务 + 签名 token fixtures**（有效/过期/错 issuer/错 audience/错算法/未知 kid/轮换）——身份先行，不做"宽松 mock 身份"
-- [ ] 4 个 port 接口定义 + mock：`VersionStore`、`GroupResolver`、`AuditSink`（直写 outbox 表的实现就是真的，mock 的是对端服务）、`ExportAdapter`
-- [ ] fastify-swagger 接入，OpenAPI 骨架——**OpenAPI 随每个端点同步产出，不留到最后**
-- **验收**：骨架可 `pnpm dev` 起服务；本地 JWKS 六类 token fixture（有效/过期/错 issuer/错 audience/错算法/未知 kid）中间件行为全对；CI 流水线绿
-
-### Phase 1 · 数据模型与权限引擎（2–3 天）⚑ 心脏
-
-- [ ] Prisma schema：`Node`（parentId **权威** + id 编码的 materialized path 派生列，name 不入 path）、`Grant`、`ProjectIndependentSettings`、`OutboxEvent`（含 attempts/nextAttemptAt/lease/lastError，relay 字段一次到位）、`ExportJob`
-- [ ] 数据库约束：kind 枚举、项目无子节点、活跃兄弟名唯一（部分唯一索引，root 的 NULL parent 特殊处理）、活跃 grant 按 (nodeId, principalType, principalId) 唯一、独立设置仅项目
-- [ ] **纯权限 reducer**：输入已解析的 grants + 祖先链 + 用户组集合，输出 role|null；不碰 DB/网络。fast-check 属性测试：max 单调、加 grant 只升不降、祖先继承、toggle 行为、顺序无关、软删过滤
-- [ ] 数据获取层 + `effective(user, node)` 组装
-- [ ] 树操作服务：create（creator 自动 Manage、root 仅管理员且必带 ≥1 Manage）、rename、move（D12 事务+咨询锁）、soft delete（D15）、breadcrumb（D17）
-- **验收**：并发对移（A→B 与 B→A）、移动+并发建子、property tests、删除祖先过滤，真实 Postgres 全绿
-
-### Phase 2 · 树与授权 API（1–2 天）
-
-- [ ] nodes 端点组 + grants 端点组 + independent-permission 开关 + effective-permission 自查
-- [ ] 授权矩阵校验（契约 8.1：creator-only 授 Manage、Manage 不可动 creator、force_adjust 独立通道）
-- [ ] 全部写操作落 outbox 事件（C3 词汇表）
-- **验收**：契约 8.1 矩阵逐格 API 测试；D8 的 404/403/503 三分语义测试
-
-### Phase 3 · 仓库生命周期与文件 API（2 天）
-
-- [ ] 项目 provisioning 状态机 `PROVISIONING → READY | FAILED`：先建 DB 行（PROVISIONING）→ 调 `VersionStore.init`（幂等）→ 置 READY；失败可重试；孤儿仓库对账 job
-- [ ] 每项目写锁（Postgres 咨询锁，跨进程安全）——不假设版本包能跨进程串行
-- [ ] 路径安全：canonical 后必须落在项目根内、拒绝 `.git`、禁 symlink 逃逸、路径长度上限
-- [ ] 上传限额（单文件 10MB / 单项目配额，数值 OPEN-5）+ 流式接收
-- [ ] files 端点组全量（list/read/upload/commits→409/diff/history/delete）+ 双客户端冲突 e2e
-- **验收**：DB/git 故障注入（init 失败、提交后崩溃）→ 对账能收敛；路径穿越语料库测试全拒
-
-### Phase 4 · 外部集成（1–2 天）
-
-- [ ] `GroupResolver` HTTP client：超时/5xx/429/畸形 JSON/万级 group 的故障注入测试；失败 → 503（D13）
-- [ ] Audit relay worker：租约领取、指数退避、eventId 幂等、重启恢复、积压告警
-- [ ] 导出 job：状态机 + 轮询 + 下载权限校验；`ExportAdapter` 桩（参数 OPEN-6 未定前**不计入完成标准**）
-- **验收**：relay 重启不丢不重（对端幂等）；group 故障时写操作 503、读操作按 D13
-
-### Phase 5 · 前端（3–5 天，Phase 2 后并行启动）
-
-- [ ] 登录（平台 SSO 占位 + 本地 JWKS 直通开关）
-- [ ] 树浏览（懒加载 + 分页）、breadcrumb（D17 占位符）、创建对话框（类型 + 批量授权选择器，Group search 接 C2）
-- [ ] 权限管理面板（按 8.1 矩阵控制可选项，creator 标识）
-- [ ] 文件页：查看/上传/下载/历史列表（编辑 UI 不归我方，留对接位）
-- [ ] 导出按钮 + job 轮询
-- **验收**：无权限节点全链路不可见；授权面板不会送出矩阵禁止的组合
-
-### Phase 6 · 硬化与交付（1–2 天）
-
-- [ ] 404/403/503 全端点核对；并发与重试幂等抽查
-- [ ] 备份脚本（DB + git 仓库一致性快照）、健康检查（DB/JWKS/磁盘/Group）、磁盘水位告警
-- [ ] OpenAPI 终稿 + 部署脚本 + 一页运维手册
-
-## 里程碑
-
-| 里程碑 | 内容 | 累计工期 |
-|---|---|---|
-| M1 | Phase 0–1：骨架 + 权限引擎 + 树操作可跑 | ~4 天 |
-| M2 | Phase 2–3：后端 API 全量（含文件冲突流） | ~7 天 |
-| M3 | Phase 4：外部集成（导出不计） | ~9 天 |
-| M4 | Phase 5–6：前端 + 硬化，可交付 | ~14–18 天 |
-
-## Mock 保真红线（mock 可以顶，但不许骗）
-
-| Mock | 不许掩盖的事 | 真身到位后的契约测试 |
-|---|---|---|
-| VersionStore | 磁盘延迟、半初始化、锁残留、跨进程并发 | 真包跑临时仓库：并发 commit/init 重试/遍历与 symlink 语料 |
-| GroupResolver | 超时、5xx、畸形响应、大规模组集 | 故障注入 HTTP 桩全过；我方绝不自己推祖先 |
-| GroupSearch（前端选择器） | 与 resolve 是**两个独立端点**，不可用 resolve mock 顶替 | C2 `/groups/search` 真身到位后跑分页/空结果/超时 |
-| Audit 对端 | 重复投递、乱序、长时间不可用 | relay 重启恢复 + 对端幂等 |
-| JWT | issuer/audience/算法/轮换 | 本地 JWKS 全用例 |
-| ExportAdapter | 参数、幂等、耗时 | 参数定了再写，之前不算完成 |
-
-## Top 5 风险
-
-1. **DB/git 分裂**（崩溃导致元数据、仓库、审计三边不一致）→ provisioning 状态机 + 对账 job，Phase 3 前置
-2. **移动子树改变整树权限** → D12 事务+锁+源目标双授权，并发测试
-3. **creator/独立权限开关交互** → D11 先冻结
-4. **外部契约缺口**（导出参数、请求内 resolve 合并）→ OPEN 清单跟踪，mock 保真红线不许掩盖
-5. **存储滥用/路径逃逸** → 路径安全 + 配额进 Phase 3 验收，不拖到硬化
-
-## OPEN 清单（在契约文档基础上增补）
-
-- OPEN-9：单请求内合并多次 resolve 是否符合 G4"实时"语义（找 Group 团队确认）
-- OPEN-10：恶意软件扫描归属（我方/平台/不做）
-- 其余 OPEN-1~8 见《文件库-接口契约.md》第 10 节

.scratch/saas-production-readiness/issues/05-define-abuse-capacity-controls.md

@@ -29,7 +29,7 @@ workload brakes.
 
 The full current-state inventory, accepted behavior, and release evidence are
 recorded in [Initial abuse and capacity controls](../assets/initial-abuse-capacity-controls.md),
-with the durable decision in ADR-0022. Numerical
+with the durable decision in ADR-0022 and `Spec.System.Capacity`. Numerical
 ceilings remain open until production-like calibration.
 
 The implementation frontier is:

.scratch/saas-production-readiness/issues/08-prove-production-release-gate.md

@@ -7,6 +7,6 @@ Blocked by: 01, 02, 03, 04, 05, 06, 07, 09, 10, 11, 12, 13, 14, 15, 16, 17, 18,
 ## Question
 
 After the readiness investigations and resulting fixes are resolved, can one
-repeatable release procedure prove build/test health, deploy a clean
+repeatable release procedure prove build/test/spec health, deploy a clean
 production-like environment, exercise critical tenant and agent journeys,
 verify observability and recovery, and either roll forward or roll back safely?

.scratch/saas-production-readiness/issues/27-reconcile-audit-history-contract.md

@@ -8,7 +8,7 @@ Blocked by: 04
 
 Separate or unify run-bound audit entries, pre-run security/permission events,
 structured messages, and operational recovery events without weakening
-the pinned AuditEntry-to-run relation. Decide durability,
+`Spec.System.Audit`'s pinned AuditEntry-to-run relation. Decide durability,
 failure, retention, and query semantics; then enforce referential integrity and
 observable/recoverable writes instead of silently swallowing lost evidence.
 Do not merge these customer Project/Run records with ADR-0023's already-decided

.scratch/saas-production-readiness/issues/42-decide-platform-admin-identity-audit.md

@@ -40,7 +40,9 @@ an off-host recovery key, an incident and reason, and issues only an expiring
 Emergency Platform Grant.
 
 The complete accepted decision and implementation divergences are in
-[ADR-0023](../../../docs/adr/0023-platform-administrator-identity-and-audit.md),
+[ADR-0023](../../../docs/adr/0023-platform-administrator-identity-and-audit.md).
+The pinned semantic invariants are in
+[`Spec.System.PlatformAdministration`](../../../spec/Spec/System/PlatformAdministration.lean),
 and the canonical terms are in [`CONTEXT.md`](../../../CONTEXT.md).
 
 Exact numeric session/invitation/step-up limits and browser mechanics remain

AGENTS.md

@@ -1,25 +1,29 @@
 # AGENTS.md —— agent 操作手册(全 repo)
 
-本 repo 是 monorepo。先读根 `README.md` 的"宪法"4 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
+本 repo 是 monorepo。先读根 `README.md` 的"宪法"5 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
 
 ## 这个 repo 是什么
 
-- `docs/adr/` 是系统级决策的唯一权威来源;`CONTEXT.md` 是平台语言词汇表;代码注释把关键不变量锚到 ADR 编号,可 grep。
+- `spec/` 是一份**人机共识的契约**(Lean 语义母本),是产品语义的上游参照。
+- 其余部件(将来的 `spec/` 外文件夹)是**向 `spec/` 对齐的实现**。
 - `hub/` 的平台层按 SaaS 形态演进:`Organization` 是 tenant root;`Project`/`Team`
-  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020)。
+  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020 / `Spec.System.Organization`)。
 - org 后台 project explorer 里 `Folder` 是透明组织节点,不是权限资源;project 仍是权限边界。
-  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021)。
+  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021 /
+  `Spec.System.ProjectWorkspace`)。
 - 每个 org 自选 BYOK 或平台托管 model provider connection;平台托管也必须是该 org
-  独享的 key/base URL,不得让无关 org 共用 process-global provider key(见 ADR-0021)。
+  独享的 key/base URL,不得让无关 org 共用 process-global provider key(见 ADR-0021 /
+  `Spec.System.Organization`)。
 - Feishu/provider secret 使用本地版本化 master-key keyring 的信封加密;生产由 systemd
   credential 注入,运行时只允许显式 org/project scope 的 fail-closed resolver,不得回退
   process-global credential;Agent child 只接收 run-scoped loopback proxy capability,
-  不接收 org provider credential(见 ADR-0024)。
+  不接收 org provider credential(见 ADR-0024 / `Spec.System.Organization`)。
 - 生产容量按不可突破的 platform ceiling 与 org 可下调 policy 分层;有效限制取两者较低值。
-  Agent admission 必须持久、有界、跨 org 公平且显式背压(见 ADR-0022)。
+  Agent admission 必须持久、有界、跨 org 公平且显式背压(见 ADR-0022 /
+  `Spec.System.Capacity`)。
 - 平台管理员只通过独立的 platform-owned 飞书应用与可撤销 Platform Session 认证,不复用
   客户 `User`/org membership;平台写操作与 append-only audit 同事务,break-glass 只走
-  双因子的离线恢复流程(见 ADR-0023)。
+  双因子的离线恢复流程(见 ADR-0023 / `Spec.System.PlatformAdministration`)。
 - 受控 alpha 暂采用一 Organization 一具名 systemd Silo:独立 database role/database、
   service identity、workspace、keyring 与 Feishu/provider connection；进程必须由
   `HUB_SILO_ORGANIZATION_ID` fail-closed 绑定唯一 org，平台后台不开放。共享 SaaS
@@ -40,12 +44,12 @@
 
 ## 纪律
 
-1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。ADR 与 `CONTEXT.md` 是语义的唯一权威来源;没写的,就是没定的。
+1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。契约里 prose doc 注释是语义的唯一权威来源;契约没写的,就是没定的。
 
-2. **凡 ADR 未写明者,不得假设。** 遇到没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
+2. **凡契约未写明者,不得假设。** 遇到标了 `OPEN` 的地方,或契约根本没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
 
-3. **新语义决策进 ADR。** 跨部件的语义分歧点按编号顺延新增 `docs/adr/NNNN-*.md`;代码里的关键不变量用注释锚到 ADR 编号,保持可 grep。已有 ADR 正文不改写历史——推翻旧决策就写新 ADR 标记 supersede。
+3. **改 `spec/` 必须保持其 `lake build` 通过。** 在 `spec/` 目录下跑 `lake build`。新增声明必须带 `/-- … -/` doc 注释和恰当标签(`PINNED` / `OPEN` / `ADR-NNNN`)。规范见 `spec/README.md`。不准用 `sorry` 把 build 糊绿。
 
-4. **实现向 ADR 对齐;偏离必须 surface。** 没有 CI gate 替你把关 ADR↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与决策不一致时,报告它,不要默默让其中一边将就另一边。
+4. **实现向契约对齐;偏离必须 surface。** 没有 CI gate 替你把关 spec↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与契约不一致时,报告它,不要默默让其中一边将就另一边。
 
 5. **写操作谨慎。** 线上操作、git 写操作前与开发者确认(这是开发者的全局偏好)。

CLAUDE.md

@@ -1,23 +1,25 @@
 # CLAUDE.md —— agent 操作手册(全 repo)
 
-本 repo 是 monorepo。先读根 `README.md` 的"宪法"4 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
+本 repo 是 monorepo。先读根 `README.md` 的"宪法"5 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
 
 ## 这个 repo 是什么
 
-- `docs/adr/` 是系统级决策的唯一权威来源;`CONTEXT.md` 是平台语言词汇表;代码注释把关键不变量锚到 ADR 编号,可 grep。
+- `spec/` 是一份**人机共识的契约**(Lean 语义母本),是产品语义的上游参照。
+- 其余部件(将来的 `spec/` 外文件夹)是**向 `spec/` 对齐的实现**。
 - `hub/` 的平台层按 SaaS 形态演进:`Organization` 是 tenant root;`Project`/`Team`
-  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020)。
+  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020 / `Spec.System.Organization`)。
 - org 后台 project explorer 里 `Folder` 是透明组织节点,不是权限资源;project 仍是权限边界。
-  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021)。
+  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021 /
+  `Spec.System.ProjectWorkspace`)。
 
 ## 纪律
 
-1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。ADR 与 `CONTEXT.md` 是语义的唯一权威来源;没写的,就是没定的。
+1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。契约里 prose doc 注释是语义的唯一权威来源;契约没写的,就是没定的。
 
-2. **凡 ADR 未写明者,不得假设。** 遇到没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
+2. **凡契约未写明者,不得假设。** 遇到标了 `OPEN` 的地方,或契约根本没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
 
-3. **新语义决策进 ADR。** 跨部件的语义分歧点按编号顺延新增 `docs/adr/NNNN-*.md`;代码里的关键不变量用注释锚到 ADR 编号,保持可 grep。已有 ADR 正文不改写历史——推翻旧决策就写新 ADR 标记 supersede。
+3. **改 `spec/` 必须保持其 `lake build` 通过。** 在 `spec/` 目录下跑 `lake build`。新增声明必须带 `/-- … -/` doc 注释和恰当标签(`PINNED` / `OPEN` / `ADR-NNNN`)。规范见 `spec/README.md`。不准用 `sorry` 把 build 糊绿。
 
-4. **实现向 ADR 对齐;偏离必须 surface。** 没有 CI gate 替你把关 ADR↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与决策不一致时,报告它,不要默默让其中一边将就另一边。
+4. **实现向契约对齐;偏离必须 surface。** 没有 CI gate 替你把关 spec↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与契约不一致时,报告它,不要默默让其中一边将就另一边。
 
 5. **写操作谨慎。** 线上操作、git 写操作前与开发者确认(这是开发者的全局偏好)。

CONTEXT.md

@@ -99,7 +99,3 @@ _Avoid_: Cost budget, unlimited run
 **Emergency Workload Brake**:
 An audited Platform Administrator control that prevents new agent work for one Organization or the whole platform and may explicitly stop active work during an incident.
 _Avoid_: Organization deletion, service restart
-
-**Member Group**:
-A global, unlimited-depth, nestable authorization principal managed by the website administrator; a file-library grant on a group applies to that group and its whole descendant subtree, and a user's effective permission collects every group they belong to plus those groups' ancestors (ADR-0028). It stores no folder/project permission itself — only the user→group membership. Global: not owned by any Organization.
-_Avoid_: Team (the org-scoped flat grouping), Feishu department

README.md

@@ -2,7 +2,7 @@
 
 教研生产的数字化解决方案。核心思路:课程像 DAW / 剪辑软件那样有一个**结构化的工程文件**;coding agent 协助编辑它;一个 rule-based checker(类编译器)校验其合法性并给出 helpful fix hint。目标是把教研从一次性的文档,沉淀成**可累积、可校验、可复用的资产**。
 
-这是一个 **monorepo**。它的组织方式本身就表达了一条原则:**`docs/adr/` 是系统级决策的唯一权威来源,代码注释把关键不变量锚到 ADR 编号,可 grep。**
+这是一个 **monorepo**。它的组织方式本身就表达了一条原则:**`spec/` 是上游的语义母本,其余部件是向它对齐的实现。**
 
 ## 安装 `cph` 命令行
 
@@ -33,40 +33,47 @@ cph completions zsh > ~/.zfunc/_cph        # 或 bash/fish/powershell/elvish
 ```
 README.md          ← 本文件:总览 + 宪法(下面 5 条)
 CLAUDE.md          ← 全局 agent 操作手册(管整个 repo)
-docs/adr/          ← 系统级架构决策记录(跨部件,决策的唯一权威来源)
+docs/adr/          ← 系统级架构决策记录(跨部件,被 spec 契约引用)
-CONTEXT.md         ← 平台语言词汇表(术语与禁用说法)
+spec/              ← Lean 语义母本(自包含的 Lean 工程)。见 spec/README.md
 Cargo.toml         ← 仓库级 cargo workspace(实现部件共用,便于跨部件复用 crate)
-crates/            ← 实现:rule-based checker(语义由 ADR 锚定)。见 crates/README.md
+crates/            ← 实现:rule-based checker(向 spec 对齐)。见 crates/README.md
   cph-diag / cph-model / cph-schema / cph-typst   ← 可复用基础(模型/校验/typst 引擎)
   cph-check / cph-cli                             ← checker 本体 + `cph` 命令行
-render/            ← typst 渲染包 cph-render(checker 的渲染后端,ADR-0005)
+render/            ← typst 渲染包 cph-render(母本的渲染后端之一,ADR-0005)
 examples/          ← 样例工程文件(如 TH-141),流水线的真实输入
 hub/              ← SaaS Hub:飞书协作、org 管理、agent runtime 与生产部署
-(exporter/ …)     ← 将来的其他部件,平级于 crates/
+(exporter/ …)     ← 将来的其他部件,平级于 spec/
 ```
 
+`spec/` 与实现部件**物理分离、平级共存**:谁是上游、谁向谁对齐,一眼可见。
 实现部件共用一个仓库根的 cargo workspace,使基础 crate(模型、typst 引擎)能被
 未来部件(如 exporter)复用,而非各自重造。
 
 ## 宪法
 
-这 4 条是本仓库的协作约定,是一切工作的前提。
+这 5 条是 `spec/` 这份语义母本的定位与约束,是本仓库一切工作的前提。
 
-1. **角色 —— ADR 是决策真相。**
+1. **角色 —— Lean 是研发侧的上游参照。**
-   跨部件的语义决策只记录在 `docs/adr/`,一份决策一份 ADR,编号顺延、正文不改写历史。代码里的关键不变量用注释锚到 ADR 编号,保持可 grep。没有第二份权威文档。
+   `spec/` 用 Lean 编写,是开发者(领域专家)与 coding agent **共用**的 spec 工具,用来沉淀产品各部件的**语义**。它**不进入产品运行时**——产品里"站在 Lean 这个位置"的那个 checker 用什么技术实现,尚未决定;但那个东西的语义,先在 `spec/` 里固定下来。
 
-2. **对齐机制 —— 人肉承载,无机器兜底。**
+2. **对齐机制 —— Lean 只做上游参照。**
-   CI 只验各部件自身良构(build / test / clippy),**没有**决策↔实现的一致性 gate。实现对齐 ADR,由"开发者 review + agent 巡逻 diff"这个人肉环节承载。发现漂移,报告它,不要默默让其中一边将就另一边。
+   不做 extract / codegen,不派生 conformance test,CI 里**没有** spec→实现的 gate。实现对齐 spec,由"开发者 review + agent 巡逻 diff"这个人肉环节承载。
+   (CI 里的 `spec check` 只验 spec **自身**能否 type-check,即契约内部良构,不是 spec↔实现的对齐检查。)
 
-3. **形态 —— 自包含。**
+3. **资产性 —— 由 review 纪律承载,无机器兜底。**
-   凡 ADR 未明文规定的,开发者与 agent 双方都不该假设;遇到没覆盖的地方,**显式 surface** 出来让开发者决定。
+   这份仓库给你的是"精确、自洽、机器验内部良构的语义共识",**不是**"实现正确性保证"。spec 与实现之间那道缝,是我们自愿用人来守的——清醒地守,它就是资产;放任实现漂移而不回头同步,它就退化成最贵的过期文档。
 
-4. **深度判据 —— 只收录分歧点。**
+4. **形态 —— 它是人机共识的契约。**
-   一条语义该不该写进 ADR,取决于一句话:**"不写明,开发者与 agent 会不会各自做出不同假设?"** 会 → 进 ADR;显然的东西 / 纯 plumbing / 普通 CRUD 字段 → 不进(写进去只稀释信噪比、增加维护面)。
+   契约必须**自包含**:凡契约未明文规定的,开发者与 agent 双方都不该假设。这比"文档"严格——type checker 会逼这份契约在结构上无洞。
-   深度上限是**你愿意在每次实现变更时手动回头同步的量**——写得比你能维护的更深,多出来的部分会率先过期、反过来误导实现。
+
+5. **深度判据 —— 只收录分歧点。**
+   一条语义该不该写进 Lean,取决于一句话:**"不写明,开发者与 agent 会不会各自做出不同假设?"** 会 → 进契约;显然的东西 / 纯 plumbing / 普通 CRUD 字段 → 不进(写进去只稀释信噪比、增加维护面)。
+   深度上限不是 Lean 的表达力,而是**你愿意在每次实现变更时手动回头同步的量**——写得比你能维护的更深,多出来的部分会率先过期、反过来误导实现。
 
 ## CI
 
+`.gitea/workflows/spec-check.yml` 在每次 push / PR 时于 `spec/` 下跑 `lake build`,确保契约始终 type-check 通过(从第一天起就是"绿"的)。这是良构 gate,见宪法第 2 条。
+
 Rust checker 的本地与 CI 工具链由根 `rust-toolchain.toml` 固定;`.gitea/workflows/checker-check.yml`
 必须安装同一精确版本并执行 `cargo fmt --all --check`、Clippy `-D warnings` 与 workspace
 全测试。升级 Rust 时这两处必须在同一提交更新并通过完整 checker gate。

crates/README.md

@@ -1,8 +1,7 @@
 # crates/
 
-These crates implement the rule-based lesson checker whose semantics are
+These crates implement the rule-based lesson checker that aligns to the
-pinned by the ADRs in `docs/adr/`: it reads an engineering-file (one lesson,
+semantic master in `spec/`: it reads an engineering-file (one lesson, ADR-0005)
-ADR-0005)
 laid out per ADR-0008 (declarative `manifest.toml` + per-element
 `element.toml`), validates structure and content, and emits diagnostics.
 `cph-diag` (the shared diagnostic vocabulary), `cph-model` (the ADR-0008 loader),

crates/cph-check/src/lib.rs

@@ -19,11 +19,13 @@ const DEFAULT_TARGET: &str = "student";
 
 /// Severity of the render-coverage ("element ignored under a target") diagnostic.
 ///
-/// **PINNED to `warning` by ADR-0005:** when a
+/// **PINNED to `warning` by the contract.** Mirrors the Lean master's
+/// `Spec.Courseware.renderIgnoredSeverity : Severity := .warning`
+/// (`spec/Spec/Courseware/Check/Diagnostic.lean`), itself citing ADR-0005: when a
 /// `(kind, target)` pair has no render rule the checker reports that the element
 /// is ignored under that target and **does not block the export**. Naming the
-/// severity as a const makes "it is a warning, not an error" a greppable
+/// severity as a const makes "it is a warning, not an error" a greppable,
-/// fact rather than an inline literal.
+/// alignable fact rather than an inline literal.
 const RENDER_IGNORED_SEVERITY: Severity = Severity::Warning;
 
 /// The result of running [`check`] (or the check phases of [`build`]).
@@ -55,12 +57,12 @@ impl CheckReport {
 
     /// Whether any collected diagnostic is `Error`-severity.
     ///
-    /// **Legality decision (ADR-0010).** `!has_errors()` decides lesson
+    /// **Legality decision (spec alignment).** `!has_errors()` is the
-    /// legality: a lesson is *legal* iff its diagnostics contain no error-level
+    /// implementation of `Spec.Courseware.Legal` (`spec/Spec/Courseware/Check/Diagnostic.lean`):
-    /// diagnostic (warnings are non-blocking — see `Severity`). There is no CI
+    /// a lesson is *legal* iff its diagnostics contain no error-level diagnostic
-    /// gate enforcing ADR↔implementation alignment (repo constitution); it is
+    /// (warnings are non-blocking — see `Severity` / ADR-0010). There is no CI
-    /// kept greppable here so a reviewer can tie the orchestrator's gate to
+    /// gate enforcing this alignment (repo constitution); it is kept greppable
-    /// the ADR.
+    /// here so a reviewer can tie the orchestrator's gate to the Lean master.
     pub fn has_errors(&self) -> bool {
         self.diagnostics
             .iter()

crates/cph-diag/src/lib.rs

@@ -2,7 +2,7 @@
 //!
 //! Every other crate in the workspace depends on these types to report
 //! problems. The vocabulary is intentionally small and stable: a [`Severity`]
-//! (two-valued, ADR-0010), a closed set of machine-stable [`DiagCode`]s, an
+//! (mirroring the Lean master), a closed set of machine-stable [`DiagCode`]s, an
 //! optional [`SourceSpan`] pointing back at the offending source, and a
 //! [`Diagnostic`] tying them together with a human message and a fix hint.
 //!
@@ -17,27 +17,32 @@ use serde::Serialize;
 
 /// Severity of a diagnostic.
 ///
-/// **Pinned by ADR-0005 / ADR-0010: exactly two values.**
+/// **Mirrors `Spec.Courseware.Diagnostic.Severity`** in the Lean semantic
+/// master (`spec/Spec/Courseware/Check/Diagnostic.lean`), whose definition is
+/// exactly:
 ///
 /// ```text
-/// warning | error
+/// inductive Severity where
+///   | warning
+///   | error
 /// ```
 ///
-/// This two-valued shape is a **contract decision**, not an accident: the
+/// This two-valued shape is a **contract decision**, not an accident: the Lean
-/// finer levels (`info` / `hint` / `note`) are deliberately undecided, so we
+/// module pins `Severity` to exactly `warning | error` and states the finer
+/// levels (`info` / `hint` / `note`) are deliberately undecided. We therefore
 /// do **not** add an info/note level here. `error` blocks (the artifact is
 /// invalid); `warning` does not block (the artifact still exports, but with
 /// loss / an ignored element — e.g. ADR-0005's "missing render ⇒ warning").
 ///
-/// There is no CI gate enforcing ADR↔implementation alignment (see the repo
+/// There is no CI gate enforcing this alignment (see the repo constitution);
-/// constitution); it is maintained by review, which is why the decision is
+/// it is maintained by review, which is why this correspondence is documented
-/// documented here rather than only in the ADR.
+/// here rather than only in the spec.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
 pub enum Severity {
     /// Non-blocking: the artifact still exports, but is lossy / has an ignored
-    /// element. ADR-0010 `warning`.
+    /// element. Mirrors Lean `Severity.warning`.
     Warning,
-    /// Blocking: the artifact is invalid. ADR-0010 `error`.
+    /// Blocking: the artifact is invalid. Mirrors Lean `Severity.error`.
     Error,
 }
 

crates/cph-model/src/lib.rs

@@ -3,7 +3,9 @@
 //! This crate is the **loader**, not the full checker. It reads
 //! `<root>/manifest.toml` (project / info / ordered `[[parts]]` / declared
 //! `[targets.*]`) and each part's `<root>/<path>/element.toml`, and produces an
-//! ordered [`Lesson`], where the order of `parts` carries teaching semantics.
+//! ordered [`Lesson`] — mirroring the Lean master's `Lesson = List (Element P)`
+//! (`spec/Spec/Courseware/Model/Lesson.lean`), where the order of `parts` carries
+//! teaching semantics.
 //!
 //! Scope boundaries (deliberately staying in lane):
 //! - It validates **structure** only: manifest shape, element.toml shape, and
@@ -21,7 +23,7 @@ use serde::{Deserialize, Serialize};
 
 /// An ordered, in-memory lesson loaded from an engineering file.
 ///
-/// `parts` is an ordered
+/// Mirrors the Lean master's `Lesson = List (Element P)`: `parts` is an ordered
 /// `Vec`, and that order is the lesson's order (ADR-0008 §"the lesson manifest
 /// is declarative" — the `[[parts]]` array order is the single source of truth).
 #[derive(Debug, Clone, PartialEq, Serialize)]
@@ -84,8 +86,9 @@ pub struct TargetConfig {
     /// with template `exports/<name>.typ` when no `[[steps]]` are given.
     pub steps: Vec<Step>,
     /// The **render-coverage declaration**: which element kinds this target
-    /// renders. Realizes ADR-0011's "render
+    /// renders. Realizes `Spec.Courseware.TargetSpec.covers : KindId → Prop`
-    /// coverage is a declaration, not a payload": the declaration keeps *which
+    /// (`spec/Spec/Courseware/Export/Render.lean`) and ADR-0011's "render
+    /// coverage is a declaration, not a payload": the contract keeps *which
     /// kinds a target renders* (used by the `renderIgnored` seed diagnostic),
     /// while the rendering "how" lives in the template/steps.
     ///
@@ -99,10 +102,13 @@ pub struct TargetConfig {
 
 /// The artifact an export target produces (ADR-0009/0011).
 ///
-/// **Pinned by ADR-0011** as an ADT with fields:
+/// **Mirrors `Spec.Courseware.Artifact`** in the Lean semantic master
+/// (`spec/Spec/Courseware/Export/Artifact.lean`), whose definition is exactly:
 ///
 /// ```text
-/// Artifact = singleFile (filepath) | fileTree (root, outputs)
+/// inductive Artifact where
+///   | singleFile (filepath : String)
+///   | fileTree (root : String) (outputs : String)
 /// ```
 ///
 /// ADR-0011 pinned the artifact as an ADT **with fields**: "what the product
@@ -114,20 +120,20 @@ pub struct TargetConfig {
 /// `"single-file"` → [`Artifact::SingleFile`], `"file-tree"` →
 /// [`Artifact::FileTree`].
 ///
-/// As with `cph-diag`'s `Severity`, there is no CI gate enforcing ADR↔
+/// As with `cph-diag`'s `Severity`, there is no CI gate enforcing this
-/// implementation alignment (see the repo constitution) — it is maintained by
+/// alignment (see the repo constitution) — it is maintained by review, which is
-/// review, which is why the decision is documented here.
+/// why the correspondence is documented here.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 pub enum Artifact {
     /// One bundled document landing at `filepath` (relative to the engineering
-    /// root). ADR-0011 `singleFile`. The default artifact shape.
+    /// root). Mirrors Lean `Artifact.singleFile`. The default artifact shape.
     SingleFile {
         /// Where the single product is written (relative to the engineering
         /// root), e.g. `build/student.pdf`.
         filepath: PathBuf,
     },
-    /// A set of files under `root` matching the `outputs` glob. ADR-0011
+    /// A set of files under `root` matching the `outputs` glob. Mirrors Lean
-    /// `fileTree`.
+    /// `Artifact.fileTree`.
     FileTree {
         /// The output directory (relative to the engineering root).
         root: PathBuf,
@@ -150,10 +156,14 @@ impl Artifact {
 
 /// One typed build step (ADR-0011).
 ///
-/// **Pinned by ADR-0011** as an ADT:
+/// **Mirrors `Spec.Courseware.Step`** in the Lean semantic master
+/// (`spec/Spec/Courseware/Export/Render.lean`), whose definition is exactly:
 ///
 /// ```text
-/// Step = typstCompile (template) | shell (run) | assembleMarkdown (field)
+/// inductive Step where
+///   | typstCompile (template : String)
+///   | shell (run : String)
+///   | assembleMarkdown (field : String)
 /// ```
 ///
 /// A step is a *typed* operation (extensible): `TypstCompile` compiles a
@@ -173,20 +183,20 @@ impl Artifact {
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 pub enum Step {
     /// Compile a template file (relative to the engineering root) into the
-    /// artifact; the framework injects the manifest. ADR-0011
+    /// artifact; the framework injects the manifest. Mirrors Lean
-    /// `typstCompile`.
+    /// `Step.typstCompile`.
     TypstCompile {
         /// The template file to compile as main, e.g. `exports/student.typ`.
         template: PathBuf,
     },
-    /// Run a shell command — the escape hatch. ADR-0011 `shell`.
+    /// Run a shell command — the escape hatch. Mirrors Lean `Step.shell`.
     Shell {
         /// The command line to run.
         run: String,
     },
     /// Assemble a single-file markdown deliverable by concatenating each
-    /// element's `field` markdown content file in `[[parts]]` order. ADR-0011
+    /// element's `field` markdown content file in `[[parts]]` order. Mirrors
-    /// `assembleMarkdown` (ADR-0015). Not a typst build — the
+    /// Lean `Step.assembleMarkdown` (ADR-0015). Not a typst build — the
     /// framework owns the read/concatenate/write itself.
     AssembleMarkdown {
         /// The per-element markdown content field to assemble (e.g. `slides`,
@@ -216,11 +226,12 @@ pub struct Project {
 
 /// `[info]` table (passed through to render targets verbatim).
 ///
-/// The *canonical* model whose
+/// **Mirrors `Spec.Courseware.Info`** in the Lean semantic master
+/// (`spec/Spec/Courseware/Model/Info.lean`): the *canonical* model whose
 /// `authors` is always a list. The authoring-surface form (string-or-array
 /// `author`) is the separate [`RawInfo`] / [`RawAuthor`], normalized into this
-/// at the load boundary. No
+/// at the load boundary — mirroring the Lean `RawInfo` / `RawAuthor` split. No
-/// CI gate enforces ADR↔implementation alignment (repo constitution); it is kept greppable.
+/// CI gate enforces this alignment (repo constitution); it is kept greppable.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 pub struct Info {
     /// Lesson title.
@@ -229,6 +240,7 @@ pub struct Info {
     /// so this is a list, not a single name. Empty when `[info]` declares no
     /// `author`. The on-disk `author` accepts either a bare string (one author)
     /// or an array of strings (see [`RawAuthor`]); both load into this `Vec`.
+    /// Mirrors Lean `Info.authors : List String`.
     pub authors: Vec<String>,
 }
 
@@ -278,7 +290,8 @@ struct RawProject {
     name: String,
 }
 
-/// The authoring-surface `[info]`: the raw form that exists for
+/// The authoring-surface `[info]` (mirrors Lean `RawInfo` in
+/// `spec/Spec/Courseware/Model/Info.lean`): the raw form that exists for
 /// fill-in convenience, normalized into the canonical [`Info`] at the load
 /// boundary. Not the form the rest of the model traffics in.
 #[derive(Debug, Deserialize)]
@@ -288,7 +301,7 @@ struct RawInfo {
 }
 
 /// On-disk `author`: either a single name (`author = "…"`) or a list
-/// (`author = ["…", "…"]`). A fill-in convenience whose
+/// (`author = ["…", "…"]`). Mirrors Lean `RawAuthor`: a fill-in convenience whose
 /// string-or-array union lives **only** at the load boundary — [`RawAuthor::into_vec`]
 /// folds it into the canonical [`Info::authors`] `Vec`, after which it never appears.
 #[derive(Debug, Deserialize)]
@@ -299,7 +312,7 @@ enum RawAuthor {
 }
 
 impl RawAuthor {
-    /// Flatten to the ordered author list: a single
+    /// Flatten to the ordered author list (Lean `RawAuthor.normalize`): a single
     /// name becomes a one-element list; a list passes through verbatim.
     fn into_vec(self) -> Vec<String> {
         match self {

docs/adr/0028-member-group-management-and-resolution.md

@@ -1,153 +0,0 @@
-# ADR 0028: Member Group Management And Resolution
-
-## Status
-
-Accepted.
-
-## Context
-
-ADR-0020 fixed `Organization` as the tenant root and ADR-0019 pinned the
-principal-set permission model. The file library (《文件库-接口契约.md》) computes
-effective permission over two principal kinds — `USER` and `GROUP` — and consumes
-the group side through a single read-only port, `GroupResolver`
-(`resolveMemberGroupIds(userId) → groupIds[]`, contract C2/G2).
-
-The contract's v0.1 proposal framed the Group system as a *separate HTTP service*
-owned by another team, consumed read-only. In practice the schema now carries the
-group tables directly in the hub database (`MemberGroup`, `MemberGroupMembership`,
-`MemberGroupClosure` — a global, unlimited-depth, closure-backed hierarchy), and
-the product requirement is to build **group management in the backend admin**, not
-to integrate a foreign service. Until this ADR, nothing read or wrote those tables:
-the live `GroupResolver` was a transitional implementation reading flat hub `Team`
-membership, and the admin "Group 管理" panel actually managed `Team`.
-
-This ADR settles the semantics needed to make the `MemberGroup` tables the real,
-in-hub group system.
-
-## Decision
-
-### Group system is in-hub, not a foreign service
-
-`MemberGroup` is the platform's global member-group principal. It lives in the hub
-database and is managed through the `/database` backend. The contract's "separate
-service" framing was an unfrozen v0.1 proposal; the implementation aligns to the
-tables that were actually built. The `GroupResolver` port stays — an external
-`HUB_GROUP_SERVICE_URL` HTTP implementation remains a supported override — but the
-default implementation reads the in-hub `MemberGroup` closure.
-
-### Authority: website administrator only
-
-Group create/delete and member add/remove are restricted to the **website
-administrator**, defined (consistently with the rest of the file library, D19/C4
-adaptation) as an `OWNER`/`ADMIN` of the silo Organization (`isWebsiteAdmin` in
-`filelib/guards.ts`). ADR-0023's `PlatformIdentity` is the future "true" platform
-control plane; the file library uniformly uses org OWNER/ADMIN today and this
-feature stays consistent with that. Reading groups for the authorization selector
-(`/groups/search`) is **not** admin-gated — picking a group to grant is a Manage
-holder's ability, not an administrator's.
-
-### Resolution semantics (the crux)
-
-`resolveMemberGroupIds(user)` returns the user's **active direct groups ∪ the
-active ancestors of those groups**, deduplicated (the closure's depth-0 self row
-makes each direct group its own ancestor). This is the single query the permission
-engine relies on; equivalently: a grant placed on group G applies to members of G
-and of every descendant of G (requirement 3.2 — permission flows down the tree, so
-resolution collects up the tree). It is computed **live, never cached** (contract
-D4/G4): a membership change is visible on the very next protected request.
-
-MemberGroup is global (no `organizationId`), so resolution is not org-scoped.
-
-### Soft delete via `archivedAt`, cascading the subtree
-
-Delete is soft: `MemberGroup.archivedAt` is a tag. Deleting a group
-cascade-soft-deletes its **whole subtree** (walk `MemberGroupClosure` where
-`ancestorId = G`, stamp `archivedAt` on each active descendant) — an application
-operation, not a DB constraint. Closure and membership rows are **retained**;
-resolution and listing filter by `archivedAt`, so an archived group and everything
-under it stop contributing to permission at once.
-
-### Closure maintenance
-
-The closure is maintained on **create**: insert `(G, G, 0)`, then for a parent `P`
-insert `(a.ancestorId, G, a.depth + 1)` for every `a` in
-`closure where descendantId = P`. v1 does **not** support reparenting a group
-(moving it under a new parent). The schema reserves reparent (closure rebuild plus
-the cycle guard "reject a new parent inside the moved subtree"); it is a follow-on.
-
-### Rename and description edits are in scope; reparent stays out
-
-A group's `name` and `description` are mutable by the website administrator
-(`PATCH /database/api/groups/:id`, audited as `group.update`). This is deliberately
-separated from reparent: renaming touches **no** closure row and cannot create a
-cycle, so it carries none of the invariant risk that keeps reparent out of v1. The
-endpoint therefore **rejects** a `parentId` field outright rather than ignoring it,
-so a future reparent cannot arrive silently through this route. Passing an empty
-`description` clears it; omitting a field leaves it unchanged.
-
-### Restore is deliberately asymmetric with delete
-
-Archived groups stay visible to the administrator (`GET
-/database/api/groups?includeArchived=1` returns them carrying `archivedAt`; the
-console tags and greys them) and can be restored (`POST
-/database/api/groups/:id/restore`, audited as `group.restore`).
-
-Restore is **not** the mirror image of delete. Delete cascades down the whole
-subtree; restore un-archives **the group plus every archived ancestor of it, and
-nothing below it**:
-
-- Restoring the ancestor chain is **mandatory**, not a convenience. An active group
-  whose parent is archived has no path in the tree, and the `depth` derivation
-  (closure row count) presumes "an active group's ancestors are active" — the
-  invariant that cascade-delete establishes. Restoring a node alone would break it.
-- The subtree is deliberately **left archived**. A group's descendants may have been
-  archived for reasons of their own, and one click should not silently re-grant
-  permission across a whole historical branch. Descendants remain visible in their
-  archived state and are each restored explicitly.
-
-Restore takes effect immediately, like every other membership change (D4/G4): the
-group resumes contributing permission on the next resolution.
-
-An archived group is **readable but not writable**. Its membership rows are never
-revoked by archiving, so `listMembers` succeeds on an archived group — the console
-must be able to show *who was in it* before deciding whether to restore it. Every
-mutation, by contrast, still requires an active group (`requireActiveGroup` → 404):
-rename, child creation, and member add/remove all reject. The group is inert for
-permission purposes and frozen for editing, but not hidden and not forgotten.
-
-### Member picker reads global users, admin-only
-
-`GET /database/api/users/search` backs the "add member" picker: it matches `User`
-by display name or Feishu open id and is gated to the website administrator, the
-same authority that may add members. It widens no existing capability — adding a
-member already accepts **any** global user (`resolveUser` does not require an org
-membership), so the endpoint only replaces blind id entry with search. It is
-deliberately **not** opened to the non-admin authorization-selector audience that
-`/groups/search` serves: choosing a group to grant is a Manage-holder action,
-whereas enumerating people is not. `excludeGroupId` filters out the target group's
-active members so the picker cannot surface a candidate that must 409.
-
-### Audit is written in-hub
-
-The contract (C3 §6.3) originally deferred group actions to the foreign Group
-service's own audit. With the group system in-hub, group mutations are audited
-through the existing file-library sink (`filelib/audit.ts`, same-transaction
-`AuditEntry`) under the silo Organization — `MemberGroup` has no `organizationId`,
-so the audit row is attributed to the silo org. New actions: `group.create`,
-`group.update`, `group.delete`, `group.restore`, `group.member_add`,
-`group.member_remove`; new audit object type `group`.
-
-## Consequences
-
-- The default `GroupResolver` becomes the in-hub `MemberGroup` closure reader.
-  `createTeamGroupResolver` is retained but deprecated (no longer wired); existing
-  flat-Team group grants no longer resolve for the file library.
-- Group grants take effect in real time through the existing `effectiveRole`
-  reducer (P6) with no change to the permission algebra — only the set of group ids
-  fed to it changes.
-- v1 omits reparent; the closure invariants above must hold whenever reparent is
-  added later (rebuild descendants' ancestor rows, reject cycles).
-- Group management is an admin-only surface; the authorization selector is not.
-- Numeric limits (max depth, max members) and a hard-delete/restore path remain
-  follow-on operational decisions; they must not weaken the archived-filter,
-  admin-authority, or live-resolution invariants fixed here.

docs/para-26071100-feishu-setup.md

@@ -32,7 +32,7 @@ App ID 通常以 `cli_` 开头，可以写入交付单。App Secret 必须通过
 | 接收群聊中 @ 机器人的消息 | `im:message.group_at_msg:readonly` |
 | 以应用身份发送消息 | `im:message:send_as_bot` |
 | 读取触发消息和线程上下文 | `im:message:readonly` |
-| 获取消息中的图片/文件，并向飞书上传图片或文件（含 Agent 回答中的图片发送） | `im:resource` |
+| 获取与上传图片或文件 | `im:resource` |
 | 添加、删除消息表情回复 | `im:message.reactions:write_only` |
 | 获取用户基本信息 | `contact:user.base:readonly` |
 | 获取用户基本资料 | `contact:user.basic_profile:readonly` |
@@ -66,9 +66,6 @@ Educraft 机器人以应用身份调用上述 API，因此这些 scope 全部放
 
 如果 API 调试台提示缺少更细粒度权限，请把错误提示和发生时间截图给部署人员。不要自行开通通讯录全量读取等超出本表的权限。
 
-说明：`im:resource` 既用于下载用户发来的图片/文件，也用于 Agent 回复时把本地或远程图片上传为飞书 `image_key` 后嵌入消息卡片。缺少该权限时，带图回答会发送失败或降级为无图文本。已开通该 scope 的存量应用一般无需新增权限，但若权限尚未随最新版本发布，请创建新版本并审核发布。
-
-
 ## 4. 配置事件与卡片回调
 
 进入“事件与回调”。

hub/.gitignore

@@ -5,10 +5,6 @@ dist/
 .env.*
 !.env.example
 .secrets/
-.dev-keyring.json
-.dev-workspaces/
-.dev-skills/
-.filelib-repos/
 admin-web/node_modules/
 admin-web/build/
 admin-web/.svelte-kit/

hub/database-admin/.gitignore

@@ -1,23 +0,0 @@
-node_modules
-
-# Output
-.output
-.vercel
-.netlify
-.wrangler
-/.svelte-kit
-/build
-
-# OS
-.DS_Store
-Thumbs.db
-
-# Env
-.env
-.env.*
-!.env.example
-!.env.test
-
-# Vite
-vite.config.js.timestamp-*
-vite.config.ts.timestamp-*

hub/database-admin/.npmrc

@@ -1 +0,0 @@
-engine-strict=true

hub/database-admin/.prettierignore

@@ -1,4 +0,0 @@
-build
-.svelte-kit
-node_modules
-package-lock.json

hub/database-admin/.prettierrc.json

@@ -1,9 +0,0 @@
-{
-	"useTabs": true,
-	"singleQuote": true,
-	"semi": true,
-	"trailingComma": "all",
-	"printWidth": 120,
-	"plugins": ["prettier-plugin-svelte"],
-	"overrides": [{ "files": "*.svelte", "options": { "parser": "svelte" } }]
-}

hub/database-admin/package.json

@@ -1,33 +0,0 @@
-{
-	"name": "database-admin",
-	"private": true,
-	"version": "0.0.1",
-	"type": "module",
-	"scripts": {
-		"dev": "vite dev",
-		"build": "vite build",
-		"preview": "vite preview",
-		"prepare": "svelte-kit sync || echo ''",
-		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
-		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
-		"format": "prettier --write .",
-		"format:check": "prettier --check ."
-	},
-	"devDependencies": {
-		"@skeletonlabs/skeleton": "^4.15.2",
-		"@skeletonlabs/skeleton-svelte": "^4.15.2",
-		"@sveltejs/adapter-auto": "^7.0.1",
-		"@sveltejs/adapter-static": "^3.0.10",
-		"@sveltejs/kit": "^2.63.0",
-		"@sveltejs/vite-plugin-svelte": "^7.1.2",
-		"@tailwindcss/vite": "^4.3.2",
-		"bits-ui": "^2.18.1",
-		"prettier": "^3.9.5",
-		"prettier-plugin-svelte": "^4.1.1",
-		"svelte": "^5.56.1",
-		"svelte-check": "^4.6.0",
-		"tailwindcss": "^4.3.2",
-		"typescript": "^6.0.3",
-		"vite": "^8.0.16"
-	}
-}

hub/database-admin/src/app.d.ts

@@ -1,13 +0,0 @@
-// See https://svelte.dev/docs/kit/types#app.d.ts
-// for information about these interfaces
-declare global {
-	namespace App {
-		// interface Error {}
-		// interface Locals {}
-		// interface PageData {}
-		// interface PageState {}
-		// interface Platform {}
-	}
-}
-
-export {};

hub/database-admin/src/app.html

@@ -1,29 +0,0 @@
-<!doctype html>
-<html lang="zh-CN">
-	<head>
-		<meta charset="utf-8" />
-		<meta name="viewport" content="width=device-width, initial-scale=1" />
-		<meta name="description" content="Curriculum Project Hub — 数据库管理后台" />
-		<link rel="icon" href="%sveltekit.assets%/favicon.svg" type="image/svg+xml" />
-		<link rel="preconnect" href="https://fonts.googleapis.com" />
-		<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-		<link
-			href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap"
-			rel="stylesheet"
-		/>
-		<style>
-			/* Fallback before CSS bundle */
-			html {
-				font-family: 'Inter', system-ui, 'Noto Sans SC', 'PingFang SC', sans-serif;
-			}
-		</style>
-		<title>Database Admin</title>
-		%sveltekit.head%
-	</head>
-	<body
-		data-sveltekit-preload-data="hover"
-		class="relative min-h-screen overflow-x-hidden bg-gradient-to-br from-slate-50 via-white to-indigo-50 text-slate-700"
-	>
-		<div style="display: contents">%sveltekit.body%</div>
-	</body>
-</html>

hub/database-admin/src/lib/api.ts

@@ -1,76 +0,0 @@
-/**
- * Thin API client for the database-admin backend. Same-origin cookie auth,
- * reusing the platform session (`cph_session`) and the admin plane's /api/me.
- */
-
-export class ApiError extends Error {
-	code: string;
-	status: number;
-	constructor(code: string, message: string, status: number) {
-		super(message);
-		this.name = 'ApiError';
-		this.code = code;
-		this.status = status;
-	}
-}
-
-async function request(method: string, url: string, body?: unknown): Promise<unknown> {
-	const init: RequestInit = {
-		method,
-		credentials: 'same-origin',
-		headers: body !== undefined ? { 'content-type': 'application/json' } : undefined,
-		body: body !== undefined ? JSON.stringify(body) : undefined,
-	};
-	const res = await fetch(url, init);
-	const text = await res.text();
-	let data: unknown = null;
-	if (text !== '') {
-		try {
-			data = JSON.parse(text);
-		} catch {
-			data = text;
-		}
-	}
-	if (!res.ok) {
-		const err = (data as { error?: { code?: string; message?: string } } | null)?.error;
-		throw new ApiError(err?.code ?? 'http_error', err?.message ?? `HTTP ${res.status}`, res.status);
-	}
-	return data;
-}
-
-const get = (u: string) => request('GET', u);
-const post = (u: string, b?: unknown) => request('POST', u, b);
-
-// --- Types ---
-
-export interface OrgMembership {
-	id: string;
-	slug: string;
-	name: string;
-	status: string;
-	role: 'OWNER' | 'ADMIN' | 'MEMBER';
-}
-
-export interface MeResponse {
-	user: {
-		id: string;
-		feishuOpenId: string;
-		displayName: string;
-		avatarUrl: string | null;
-	};
-	organizations: OrgMembership[];
-}
-
-/** Unauthenticated bootstrap the login page needs: which org to OAuth against + dev toggle. */
-export interface DatabaseConfig {
-	siloOrganizationSlug: string;
-	devLoginEnabled: boolean;
-}
-
-// --- API ---
-
-export const api = {
-	me: () => get('/api/me') as Promise<MeResponse>,
-	logout: () => post('/auth/logout'),
-	databaseConfig: () => get('/database/config') as Promise<DatabaseConfig>,
-};

hub/database-admin/src/lib/components/Aurora.svelte

@@ -1,6 +0,0 @@
-<!-- Animated aurora background blobs, shared by both pages (soft pastels on light). -->
-<div class="pointer-events-none fixed inset-0 overflow-hidden">
-	<div class="aurora absolute -left-32 -top-32 h-96 w-96 rounded-full bg-violet-300/50"></div>
-	<div class="aurora absolute right-0 top-1/4 h-96 w-96 rounded-full bg-cyan-300/40" style="animation-delay:-6s"></div>
-	<div class="aurora absolute bottom-0 left-1/3 h-96 w-96 rounded-full bg-indigo-300/40" style="animation-delay:-12s"></div>
-</div>

hub/database-admin/src/lib/org.ts

@@ -1,7 +0,0 @@
-import type { OrgMembership } from './api';
-
-export function isOrgAdmin(org: OrgMembership | null | undefined): boolean {
-	if (!org) return false;
-	const role = String(org.role ?? '').toUpperCase();
-	return role === 'OWNER' || role === 'ADMIN';
-}

hub/database-admin/src/lib/session.ts

@@ -1,58 +0,0 @@
-import { writable } from 'svelte/store';
-import { goto } from '$app/navigation';
-import { base } from '$app/paths';
-import { api, type MeResponse } from './api';
-
-interface SessionState {
-	loading: boolean;
-	me: MeResponse | null;
-	error: string | null;
-}
-
-export const session = writable<SessionState>({
-	loading: true,
-	me: null,
-	error: null,
-});
-
-export async function loadSession(): Promise<void> {
-	session.update((s) => ({ ...s, loading: true, error: null }));
-	try {
-		const me = await api.me();
-		session.set({ loading: false, me, error: null });
-	} catch (err) {
-		const status = (err as { status?: number }).status;
-		if (status === 401) {
-			session.set({ loading: false, me: null, error: null });
-			void redirectToLogin();
-			return;
-		}
-		session.set({
-			loading: false,
-			me: null,
-			error: err instanceof Error ? err.message : String(err),
-		});
-	}
-}
-
-/**
- * Send the browser to the login page (`/database/admin`). Unlike admin-web we
- * don't jump straight to Feishu OAuth: the login page reads /database/config
- * to build the org-scoped link and to show the dev bypass when enabled.
- */
-export async function redirectToLogin(): Promise<void> {
-	const loginPath = `${base}/admin`;
-	if (window.location.pathname === loginPath) return;
-	await goto(loginPath, { replaceState: true });
-}
-
-/** Build the org-scoped Feishu OAuth entry point (a backend route, not under base). */
-export function feishuLoginHref(orgSlug: string, returnTo: string = `${base}/dashboard`): string {
-	return `/auth/feishu/${encodeURIComponent(orgSlug)}?returnTo=${encodeURIComponent(returnTo)}`;
-}
-
-export async function logout(): Promise<void> {
-	await api.logout();
-	session.set({ loading: false, me: null, error: null });
-	await redirectToLogin();
-}

hub/database-admin/src/routes/+layout.svelte

@@ -1,7 +0,0 @@
-<script lang="ts">
-	import './app.css';
-
-	let { children } = $props();
-</script>
-
-{@render children()}

hub/database-admin/src/routes/+page.svelte

@@ -1,30 +0,0 @@
-<script lang="ts">
-	import { onMount } from 'svelte';
-	import { goto } from '$app/navigation';
-	import { base } from '$app/paths';
-	import { api } from '$lib/api';
-
-	onMount(async () => {
-		// /database entry — route to dashboard if signed in, else the login page.
-		try {
-			await api.me();
-			await goto(`${base}/dashboard`, { replaceState: true });
-		} catch {
-			await goto(`${base}/admin`, { replaceState: true });
-		}
-	});
-</script>
-
-<div class="flex min-h-screen items-center justify-center">
-	<div class="flex flex-col items-center gap-3 text-slate-400">
-		<svg class="h-7 w-7 animate-spin text-violet-500" viewBox="0 0 24 24" fill="none">
-			<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-			<path
-				class="opacity-90"
-				fill="currentColor"
-				d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
-			></path>
-		</svg>
-		<p class="text-sm">正在进入…</p>
-	</div>
-</div>

hub/database-admin/src/routes/admin/+page.svelte

@@ -1,78 +0,0 @@
-<script lang="ts">
-	import { onMount } from 'svelte';
-	import { goto } from '$app/navigation';
-	import { base } from '$app/paths';
-	import { api, type DatabaseConfig } from '$lib/api';
-	import { feishuLoginHref } from '$lib/session';
-	import Aurora from '$lib/components/Aurora.svelte';
-
-	let config = $state<DatabaseConfig | null>(null);
-	let error = $state<string | null>(null);
-
-	onMount(async () => {
-		// Already signed in → straight to the dashboard.
-		try {
-			await api.me();
-			await goto(`${base}/dashboard`, { replaceState: true });
-			return;
-		} catch {
-			// Not signed in (401) or backend unreachable — show the login card.
-		}
-		try {
-			config = await api.databaseConfig();
-		} catch (err) {
-			error = err instanceof Error ? err.message : String(err);
-		}
-	});
-
-	const feishuHref = $derived(config ? feishuLoginHref(config.siloOrganizationSlug) : '#');
-</script>
-
-<Aurora />
-
-<main class="flex min-h-screen items-center justify-center p-4">
-	<div class="rise glass relative w-full max-w-sm rounded-3xl border border-white/80 p-8 shadow-2xl shadow-indigo-200/50">
-		<div class="mb-7 text-center">
-			<div
-				class="mx-auto mb-5 flex h-14 w-14 items-center justify-center rounded-2xl bg-gradient-to-br from-violet-500 to-cyan-400 text-2xl font-bold text-white glow-btn"
-			>
-				D
-			</div>
-			<h1 class="text-2xl font-bold tracking-tight grad-text">Database Admin</h1>
-			<p class="mt-2 text-sm text-slate-500">使用飞书登录以管理数据库</p>
-		</div>
-
-		{#if error}
-			<div class="mb-4 rounded-xl border border-red-200 bg-red-50 px-4 py-3 text-sm text-red-600">
-				无法连接后端：{error}
-			</div>
-		{/if}
-
-		<a
-			href={feishuHref}
-			aria-disabled={config ? 'false' : 'true'}
-			class="rise-2 glow-btn group flex w-full items-center justify-center gap-2 rounded-xl bg-gradient-to-r from-violet-500 to-indigo-500 px-4 py-3.5 text-sm font-semibold text-white transition hover:from-violet-400 hover:to-indigo-400 aria-disabled:pointer-events-none aria-disabled:opacity-50"
-		>
-			<svg class="h-4 w-4" viewBox="0 0 24 24" fill="currentColor">
-				<path d="M12 2 3 7v10l9 5 9-5V7l-9-5Zm0 2.3 6.5 3.6L12 11.5 5.5 7.9 12 4.3Z" />
-			</svg>
-			使用飞书登录
-		</a>
-
-		{#if config?.devLoginEnabled}
-			<div class="relative my-6 rise-3">
-				<div class="absolute inset-0 flex items-center"><div class="w-full border-t border-slate-200"></div></div>
-				<div class="relative flex justify-center">
-					<span class="bg-white/70 px-3 text-[11px] font-medium uppercase tracking-[0.2em] text-slate-400">开发模式</span>
-				</div>
-			</div>
-			<a
-				href="/database/dev-login"
-				class="rise-3 group flex w-full items-center justify-center gap-2 rounded-xl border border-amber-300 bg-amber-50 px-4 py-3 text-sm font-semibold text-amber-700 transition hover:border-amber-400 hover:bg-amber-100"
-			>
-				<span>⚡</span> 一键登录管理员
-			</a>
-			<p class="rise-3 mt-2 text-center text-xs text-slate-400">仅开发环境可见 · 跳过飞书 OAuth</p>
-		{/if}
-	</div>
-</main>

hub/database-admin/src/routes/app.css

@@ -1,96 +0,0 @@
-@import 'tailwindcss';
-
-@source './**/*.{html,js,svelte,ts}';
-@source '../lib/**/*.{html,js,svelte,ts}';
-
-/*
- * Design system for the database-admin SPA. Migrated verbatim (in spirit) from
- * the previous server-rendered pages in hub/src/database/routes/databaseRoutes.ts:
- * a light aurora / glassmorphism look with violet→cyan gradients and soft rise-in
- * entrances. Distinct from admin-web's flat industrial theme on purpose.
- */
-
-@theme {
-	--font-sans: 'Inter', system-ui, -apple-system, 'Segoe UI', 'Noto Sans SC', 'PingFang SC', sans-serif;
-}
-
-@keyframes aurora {
-	0% {
-		transform: translate(0, 0) scale(1);
-	}
-	33% {
-		transform: translate(6%, -8%) scale(1.15);
-	}
-	66% {
-		transform: translate(-8%, 6%) scale(0.9);
-	}
-	100% {
-		transform: translate(0, 0) scale(1);
-	}
-}
-
-@keyframes rise {
-	from {
-		opacity: 0;
-		transform: translateY(16px);
-	}
-	to {
-		opacity: 1;
-		transform: translateY(0);
-	}
-}
-
-@keyframes shimmer {
-	0% {
-		background-position: -200% 0;
-	}
-	100% {
-		background-position: 200% 0;
-	}
-}
-
-@layer base {
-	:root {
-		font-family: var(--font-sans);
-	}
-	html {
-		height: 100%;
-		-webkit-font-smoothing: antialiased;
-		-moz-osx-font-smoothing: grayscale;
-	}
-}
-
-@layer components {
-	.aurora {
-		filter: blur(80px);
-		animation: aurora 18s ease-in-out infinite;
-	}
-	.rise {
-		animation: rise 0.7s cubic-bezier(0.16, 1, 0.3, 1) both;
-	}
-	.rise-1 {
-		animation: rise 0.7s cubic-bezier(0.16, 1, 0.3, 1) both;
-	}
-	.rise-2 {
-		animation: rise 0.7s cubic-bezier(0.16, 1, 0.3, 1) 0.1s both;
-	}
-	.rise-3 {
-		animation: rise 0.7s cubic-bezier(0.16, 1, 0.3, 1) 0.2s both;
-	}
-	.grad-text {
-		background: linear-gradient(120deg, #7c3aed, #0891b2, #4f46e5);
-		background-size: 200% auto;
-		-webkit-background-clip: text;
-		background-clip: text;
-		color: transparent;
-		animation: shimmer 6s linear infinite;
-	}
-	.glass {
-		background: rgba(255, 255, 255, 0.7);
-		backdrop-filter: blur(16px);
-		-webkit-backdrop-filter: blur(16px);
-	}
-	.glow-btn {
-		box-shadow: 0 12px 32px -10px rgba(124, 58, 237, 0.45);
-	}
-}

hub/database-admin/src/routes/dashboard/+page.svelte

@@ -1,160 +0,0 @@
-<script lang="ts">
-	import { onMount } from 'svelte';
-	import { base } from '$app/paths';
-	import { session, loadSession, logout } from '$lib/session';
-	import { isOrgAdmin } from '$lib/org';
-	import Aurora from '$lib/components/Aurora.svelte';
-
-	onMount(() => {
-		loadSession();
-	});
-
-	// The session is scoped to the silo org, so /api/me returns exactly that org's
-	// membership. Admin gate: only OWNER/ADMIN may use the database console.
-	const me = $derived($session.me);
-	const org = $derived(me?.organizations[0] ?? null);
-	const allowed = $derived(isOrgAdmin(org));
-	const displayName = $derived(me?.user.displayName ?? '');
-	const initial = $derived(displayName.slice(0, 1) || 'U');
-
-	const navItems = [
-		{ label: '概览', href: `${base}/dashboard`, active: true, icon: 'M4 13h6V4H4v9Zm0 7h6v-5H4v5Zm10 0h6V11h-6v9Zm0-16v5h6V4h-6Z' },
-		{ label: '数据表', href: '#', active: false, icon: 'M4 5h16v4H4V5Zm0 6h16v4H4v-4Zm0 6h16v2H4v-2Z' },
-		{ label: '查询', href: '#', active: false, icon: 'm21 21-4.3-4.3M11 18a7 7 0 1 0 0-14 7 7 0 0 0 0 14Z' },
-		{
-			label: '设置',
-			href: '#',
-			active: false,
-			icon: 'M12 15a3 3 0 1 0 0-6 3 3 0 0 0 0 6Zm7-3 2 1-2 3-2-1a7 7 0 0 1-2 1l-1 2h-4l-1-2a7 7 0 0 1-2-1l-2 1-2-3 2-1a7 7 0 0 1 0-2l-2-1 2-3 2 1a7 7 0 0 1 2-1l1-2h4l1 2a7 7 0 0 1 2 1l2-1 2 3-2 1a7 7 0 0 1 0 2Z',
-		},
-	];
-
-	const stats = [
-		{ label: '数据表', value: '—', accent: 'from-violet-200/60 to-transparent' },
-		{ label: '记录数', value: '—', accent: 'from-cyan-200/60 to-transparent' },
-		{ label: '最近查询', value: '—', accent: 'from-indigo-200/60 to-transparent' },
-	];
-</script>
-
-<Aurora />
-
-{#if $session.loading}
-	<div class="flex min-h-screen items-center justify-center">
-		<div class="flex flex-col items-center gap-3 text-slate-400">
-			<svg class="h-8 w-8 animate-spin text-violet-500" viewBox="0 0 24 24" fill="none">
-				<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-				<path
-					class="opacity-90"
-					fill="currentColor"
-					d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
-				></path>
-			</svg>
-			<p class="text-sm">加载中…</p>
-		</div>
-	</div>
-{:else if $session.error}
-	<div class="flex min-h-screen items-center justify-center p-4">
-		<div class="rise glass w-full max-w-sm rounded-3xl border border-white/80 p-8 text-center shadow-2xl shadow-indigo-200/50">
-			<h2 class="mb-2 text-lg font-bold text-slate-900">无法连接后端</h2>
-			<p class="mb-5 text-sm text-slate-500">{$session.error}</p>
-			<button
-				class="rounded-xl bg-gradient-to-r from-violet-500 to-indigo-500 px-4 py-2 text-sm font-semibold text-white"
-				onclick={() => loadSession()}>重试</button
-			>
-		</div>
-	</div>
-{:else if !allowed}
-	<div class="flex min-h-screen items-center justify-center p-4">
-		<div class="rise glass w-full max-w-md rounded-3xl border border-white/80 p-8 text-center shadow-2xl shadow-indigo-200/50">
-			<h2 class="mb-2 text-lg font-bold text-slate-900">无权访问</h2>
-			<p class="mb-5 text-sm text-slate-500">数据库管理台仅向组织所有者与管理员开放。</p>
-			<button
-				class="rounded-xl border border-slate-200 bg-white px-4 py-2 text-sm font-medium text-slate-600 transition hover:bg-slate-50"
-				onclick={() => logout()}>退出登录</button
-			>
-		</div>
-	</div>
-{:else}
-	<div class="relative flex min-h-screen">
-		<!-- 左侧菜单栏 -->
-		<aside class="flex w-64 shrink-0 flex-col border-r border-slate-200/80 glass">
-			<div class="flex items-center gap-3 px-5 py-6">
-				<div
-					class="flex h-10 w-10 items-center justify-center rounded-xl bg-gradient-to-br from-violet-500 to-cyan-400 text-lg font-bold text-white glow-btn"
-				>
-					D
-				</div>
-				<span class="text-base font-bold grad-text">Database Admin</span>
-			</div>
-			<nav class="flex flex-1 flex-col gap-1.5 px-3 py-2">
-				{#each navItems as item}
-					<a
-						href={item.href}
-						class={item.active
-							? 'group flex items-center gap-3 rounded-xl bg-gradient-to-r from-violet-500 to-indigo-500 px-3 py-2.5 text-sm font-semibold text-white shadow-lg shadow-indigo-300/50'
-							: 'group flex items-center gap-3 rounded-xl px-3 py-2.5 text-sm font-medium text-slate-500 transition hover:bg-slate-100 hover:text-slate-900'}
-					>
-						<svg
-							class="h-4 w-4 shrink-0"
-							viewBox="0 0 24 24"
-							fill="none"
-							stroke="currentColor"
-							stroke-width="1.8"
-							stroke-linecap="round"
-							stroke-linejoin="round"><path d={item.icon} /></svg
-						>
-						{item.label}
-					</a>
-				{/each}
-			</nav>
-			<div class="m-3 flex items-center gap-3 rounded-xl border border-slate-200 bg-white/60 px-3 py-3">
-				<div
-					class="flex h-9 w-9 items-center justify-center rounded-full bg-gradient-to-br from-violet-500 to-indigo-500 text-sm font-semibold text-white"
-				>
-					{initial}
-				</div>
-				<div class="min-w-0">
-					<p class="text-[11px] uppercase tracking-wider text-slate-400">已登录</p>
-					<p class="truncate text-sm font-medium text-slate-700">{displayName}</p>
-				</div>
-			</div>
-		</aside>
-
-		<!-- 右侧内容 -->
-		<div class="flex flex-1 flex-col">
-			<header class="flex items-center justify-between border-b border-slate-200/80 glass px-8 py-4">
-				<div>
-					<h1 class="text-lg font-bold text-slate-900">概览</h1>
-					<p class="text-xs text-slate-400">欢迎回来，这里是数据库管理台</p>
-				</div>
-				<button
-					onclick={() => logout()}
-					class="rounded-xl border border-slate-200 bg-white px-4 py-2 text-sm font-medium text-slate-600 transition hover:border-slate-300 hover:bg-slate-50 hover:text-slate-900"
-				>
-					退出登录
-				</button>
-			</header>
-
-			<main class="flex-1 p-8">
-				<div class="grid grid-cols-1 gap-5 sm:grid-cols-3">
-					{#each stats as s, i}
-						<div
-							class="rise-{i +
-								1} group relative overflow-hidden rounded-2xl border border-white/80 glass p-5 shadow-lg shadow-slate-200/50 transition hover:-translate-y-0.5 hover:shadow-xl hover:shadow-indigo-200/50"
-						>
-							<div class="absolute inset-0 bg-gradient-to-br {s.accent} opacity-0 transition group-hover:opacity-100"></div>
-							<p class="relative text-sm text-slate-500">{s.label}</p>
-							<p class="relative mt-2 text-3xl font-bold text-slate-900">{s.value}</p>
-						</div>
-					{/each}
-				</div>
-
-				<div
-					class="rise-3 mt-6 flex h-64 items-center justify-center rounded-2xl border border-dashed border-slate-300 glass text-sm text-slate-400"
-				>
-					内容区占位 · 后续数据端点挂在 /database/* 并加 guard
-				</div>
-			</main>
-		</div>
-	</div>
-{/if}

hub/database-admin/static/favicon.svg

@@ -1,5 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" fill="none">
-	<rect width="32" height="32" rx="8" fill="#4F46E5"/>
-	<path d="M8 10.5h7.5a3.5 3.5 0 0 1 0 7H11v4H8v-11Zm3 4.5h4.5a1.5 1.5 0 0 0 0-3H11v3Z" fill="white"/>
-	<path d="M20.5 21.5c1.93 0 3.5-1.34 3.5-3s-1.57-3-3.5-3S17 16.84 17 18.5s1.57 3 3.5 3Z" fill="white" opacity=".9"/>
-</svg>

hub/database-admin/static/robots.txt

@@ -1,3 +0,0 @@
-# allow crawling everything by default
-User-agent: *
-Disallow:

hub/database-admin/svelte.config.js

@@ -1,22 +0,0 @@
-import adapter from '@sveltejs/adapter-static';
-import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
-
-/** @type {import('@sveltejs/kit').Config} */
-const config = {
-	preprocess: vitePreprocess(),
-	kit: {
-		adapter: adapter({
-			pages: 'build',
-			assets: 'build',
-			fallback: 'index.html',
-			precompress: false,
-			strict: false,
-		}),
-		// This SPA is served under /database by the Hub. admin-web owns the
-		// root asset paths (/_app, /favicon.svg); a base path moves this app's
-		// assets to /database/_app/* so the two builds never collide.
-		paths: { base: '/database' },
-	},
-};
-
-export default config;

hub/database-admin/tsconfig.json

@@ -1,20 +0,0 @@
-{
-	"extends": "./.svelte-kit/tsconfig.json",
-	"compilerOptions": {
-		"rewriteRelativeImportExtensions": true,
-		"allowJs": true,
-		"checkJs": true,
-		"esModuleInterop": true,
-		"forceConsistentCasingInFileNames": true,
-		"resolveJsonModule": true,
-		"skipLibCheck": true,
-		"sourceMap": true,
-		"strict": true,
-		"moduleResolution": "bundler"
-	}
-	// Path aliases are handled by https://svelte.dev/docs/kit/configuration#alias
-	// except $lib which is handled by https://svelte.dev/docs/kit/configuration#files
-	//
-	// To make changes to top-level options such as include and exclude, we recommend extending
-	// the generated config; see https://svelte.dev/docs/kit/configuration#typescript
-}

hub/database-admin/vite.config.ts

@@ -1,17 +0,0 @@
-import { sveltekit } from '@sveltejs/kit/vite';
-import tailwindcss from '@tailwindcss/vite';
-import { defineConfig } from 'vite';
-
-export default defineConfig({
-	plugins: [tailwindcss(), sveltekit()],
-	server: {
-		proxy: {
-			'/api': 'http://127.0.0.1:8788',
-			'/auth': 'http://127.0.0.1:8788',
-			// Backend owns the /database/* HTTP surface (login page, dashboard,
-			// data routes). Proxy it in dev so those paths hit the real server
-			// instead of the SPA fallback.
-			'/database': 'http://127.0.0.1:8788',
-		},
-	},
-});

hub/deploy/deploy_fleet_release.sh

@@ -82,11 +82,10 @@ REMOTE
   rsync -az --delete \
     --exclude node_modules --exclude dist --exclude .env \
     --exclude admin-web/node_modules --exclude admin-web/build --exclude admin-web/.svelte-kit \
-    --exclude database-admin/node_modules --exclude database-admin/build --exclude database-admin/.svelte-kit \
     -e "ssh ${SSH_OPTS[*]}" \
     "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"
 
-  echo "[fleet] npm ci + build (tsc + admin-web & database-admin SPAs)"
+  echo "[fleet] npm ci + build (tsc + admin-web SPA)"
   ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" bash -s <<REMOTE
 set -euo pipefail
 flock /var/lock/cph-hub-release-publish bash -c '
@@ -98,11 +97,9 @@ flock /var/lock/cph-hub-release-publish bash -c '
   cd "$HUB_DIR"
   PUPPETEER_SKIP_DOWNLOAD=1 npm ci
   npm ci --prefix admin-web
-  npm ci --prefix database-admin
   npm run audit:production
   npm run build
   test -f admin-web/build/index.html
-  test -f database-admin/build/index.html
   touch "$RELEASE_DIR/.complete"
 '
 REMOTE

hub/deploy/deploy_platform.sh

@@ -60,11 +60,10 @@ if [ "$release_ready" = false ]; then
     -e "ssh ${SSH_OPTS[*]}" \
     "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"
 
-  # 2. Install deps (hub + both SPAs), audit hub prod, build tsc + SPAs, mark complete.
+  # 2. Install deps (hub + admin-web), audit hub prod, build tsc + SPA, mark complete.
-  # `npm run build` → tsc then admin:build + database:build → admin-web/build and
+  # `npm run build` → tsc then admin:build → admin-web/build for registerStaticSpa.
-  # database-admin/build for registerStaticSpa / registerDatabaseSpa.
   ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" \
-    "cd '$HUB_DIR' && PUPPETEER_SKIP_DOWNLOAD=1 npm ci && npm ci --prefix admin-web && npm ci --prefix database-admin && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
+    "cd '$HUB_DIR' && PUPPETEER_SKIP_DOWNLOAD=1 npm ci && npm ci --prefix admin-web && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
 fi
 
 # 3. Ensure the service is installed (idempotent), then restart.

hub/filelib-web/index.html

@@ -1,12 +0,0 @@
-<!doctype html>
-<html lang="zh-CN">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>文件库</title>
-  </head>
-  <body>
-    <div id="app"></div>
-    <script type="module" src="/src/main.ts"></script>
-  </body>
-</html>

hub/filelib-web/package.json

@@ -1,21 +0,0 @@
-{
-  "name": "filelib-web",
-  "private": true,
-  "version": "0.1.0",
-  "type": "module",
-  "scripts": {
-    "dev": "vite",
-    "build": "vite build",
-    "preview": "vite preview",
-    "check": "svelte-check --tsconfig ./tsconfig.json"
-  },
-  "devDependencies": {
-    "@sveltejs/vite-plugin-svelte": "^7.1.2",
-    "@tailwindcss/vite": "^4.3.2",
-    "svelte": "^5.56.1",
-    "svelte-check": "^4.6.0",
-    "tailwindcss": "^4.3.2",
-    "typescript": "^5.7.0",
-    "vite": "^8.0.16"
-  }
-}

hub/filelib-web/src/App.svelte

@@ -1,30 +0,0 @@
-<script lang="ts">
-  import { onMount } from "svelte";
-  import { api, UnauthenticatedError } from "./lib/api.js";
-  import { me, authChecked } from "./lib/stores.js";
-  import type { MeResponse } from "./lib/types.js";
-  import LoginView from "./lib/LoginView.svelte";
-  import BrowserShell from "./lib/BrowserShell.svelte";
-  import Toasts from "./lib/Toasts.svelte";
-
-  onMount(async () => {
-    try {
-      me.set(await api<MeResponse>("/database/api/me"));
-    } catch (e) {
-      if (!(e instanceof UnauthenticatedError)) console.error(e);
-      me.set(null);
-    } finally {
-      authChecked.set(true);
-    }
-  });
-</script>
-
-{#if !$authChecked}
-  <div class="flex h-full items-center justify-center text-ink-3">加载中…</div>
-{:else if $me}
-  <BrowserShell />
-{:else}
-  <LoginView />
-{/if}
-
-<Toasts />

hub/filelib-web/src/app.css

@@ -1,66 +0,0 @@
-@import "tailwindcss";
-
-/* 全局 UI 主题令牌(与 hub 端 uiTheme.ts 同源) */
-@theme {
-  --color-bg: #fcfcfb;
-  --color-panel: #ffffff;
-  --color-sidebar: #f7f7f5;
-  --color-ink: #1a1a18;
-  --color-ink-2: #6b6a66;
-  --color-ink-3: #9c9b96;
-  --color-line: #ecece8;
-  --color-line-soft: #f1f1ee;
-  --color-hover: #f4f4f1;
-  --color-selected: #ebebe7;
-  --color-accent: #1a1a18;
-  --color-accent-hover: #333330;
-  --color-danger: #a13a33;
-  --color-guide: #e9e9e5;
-  --color-diff-add-bg: #f3f6f2;
-  --color-diff-add-text: #4a6741;
-  --color-diff-del-bg: #f8f2f1;
-  --color-diff-del-text: #a13a33;
-}
-
-html,
-body,
-#app {
-  height: 100%;
-}
-
-body {
-  background: var(--color-bg);
-  color: var(--color-ink);
-  font-family:
-    "Inter",
-    -apple-system,
-    "Segoe UI",
-    "PingFang SC",
-    "Microsoft YaHei",
-    sans-serif;
-  font-size: 14px;
-  line-height: 1.65;
-  -webkit-font-smoothing: antialiased;
-}
-
-.font-mono {
-  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-}
-
-/* diff 渲染 */
-pre.diff {
-  white-space: pre-wrap;
-  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-  font-size: 12.5px;
-  line-height: 1.75;
-}
-pre.diff .add {
-  display: block;
-  color: var(--color-diff-add-text);
-  background: var(--color-diff-add-bg);
-}
-pre.diff .del {
-  display: block;
-  color: var(--color-diff-del-text);
-  background: var(--color-diff-del-bg);
-}

hub/filelib-web/src/lib/BrowserShell.svelte

@@ -1,171 +0,0 @@
-<script lang="ts">
-  import { onMount } from "svelte";
-  import { api } from "./api.js";
-  import { me, toastErr, toastOk } from "./stores.js";
-  import { treeVersion, bumpTree, currentNode, selectedFilePath, clearSelectedFile, bumpFiles } from "./browser.js";
-  import type { NodeChild } from "./types.js";
-  import TreeNode from "./TreeNode.svelte";
-  import NodeDetailPanel from "./NodeDetailPanel.svelte";
-  import FileEditor from "./FileEditor.svelte";
-  import GroupAdmin from "./GroupAdmin.svelte";
-  import Modal from "./Modal.svelte";
-
-  // 视图切换(仅管理员可见 Group 管理入口;非管理员恒为 library)。
-  let view = $state<"library" | "groups">("library");
-
-  let roots = $state<NodeChild[] | null>(null);
-  let treeError = $state<string | null>(null);
-  let showCreateRoot = $state(false);
-  let newName = $state("");
-  let newKind = $state<"FOLDER" | "PROJECT">("FOLDER");
-  let newDesc = $state("");
-
-  async function loadRoots(): Promise<void> {
-    try {
-      const r = await api<{ nodes: NodeChild[] }>("/database/api/nodes");
-      roots = r.nodes;
-      treeError = null;
-    } catch (e) {
-      treeError = e instanceof Error ? e.message : String(e);
-    }
-  }
-
-  onMount(loadRoots);
-  $effect(() => {
-    void $treeVersion;
-    void loadRoots();
-  });
-
-  async function createRoot(): Promise<void> {
-    const name = newName.trim();
-    if (name === "") return;
-    try {
-      await api("/database/api/nodes", {
-        method: "POST",
-        body: {
-          parentId: null,
-          kind: newKind,
-          name,
-          ...(newDesc.trim() !== "" ? { description: newDesc.trim() } : {}),
-        },
-      });
-      toastOk("已创建");
-      showCreateRoot = false;
-      newName = ""; newKind = "FOLDER"; newDesc = "";
-      bumpTree();
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function logout(): Promise<void> {
-    try { await fetch("/auth/logout", { method: "POST", credentials: "same-origin" }); } catch { /* ignore */ }
-    me.set(null);
-  }
-
-  const initial = $derived(($me?.userId ?? "U").slice(0, 1).toUpperCase());
-</script>
-
-<div class="flex h-full flex-col">
-  {#if $me?.isWebsiteAdmin}
-    <!-- 视图切换(仅管理员) -->
-    <div class="flex shrink-0 items-center gap-1 border-b border-line-soft bg-sidebar px-3 py-1.5">
-      <button
-        class="rounded-lg px-3 py-1 text-[12.5px] font-medium transition"
-        class:bg-selected={view === "library"}
-        class:text-ink={view === "library"}
-        class:text-ink-3={view !== "library"}
-        onclick={() => (view = "library")}
-      >文件库</button>
-      <button
-        class="rounded-lg px-3 py-1 text-[12.5px] font-medium transition"
-        class:bg-selected={view === "groups"}
-        class:text-ink={view === "groups"}
-        class:text-ink-3={view !== "groups"}
-        onclick={() => (view = "groups")}
-      >Group 管理</button>
-    </div>
-  {/if}
-
-  <div class="flex min-h-0 flex-1">
-  {#if $me?.isWebsiteAdmin && view === "groups"}
-    <GroupAdmin />
-  {:else}
-  <!-- 侧栏 -->
-  <aside class="flex w-[300px] shrink-0 flex-col border-r border-line-soft bg-sidebar">
-    <div class="flex items-center justify-between border-b border-line-soft px-4 py-3.5">
-      <span class="text-[15px] font-semibold text-ink">文件库</span>
-      {#if $me?.isWebsiteAdmin}
-        <button class="rounded-lg border border-line bg-panel px-2.5 py-1 text-[11.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreateRoot = true)}>
-          + 根目录
-        </button>
-      {/if}
-    </div>
-
-    <div class="flex-1 overflow-y-auto px-2 py-2 text-[13px]">
-      {#if roots === null}
-        <div class="px-3 py-6 text-center text-xs text-ink-3">加载中…</div>
-      {:else if treeError}
-        <div class="px-3 py-6 text-center text-xs text-danger">{treeError}</div>
-      {:else if roots.length === 0}
-        <div class="px-3 py-6 text-center text-xs text-ink-3">
-          {$me?.isWebsiteAdmin ? "空文件库 · 点上方「+ 根目录」开始" : "文件库为空,请联系管理员创建根目录"}
-        </div>
-      {:else}
-        {#each roots as node (node.id)}
-          <TreeNode {node} depth={0} />
-        {/each}
-      {/if}
-    </div>
-
-    <div class="flex items-center gap-2 border-t border-line-soft px-4 py-3 text-[12.5px]">
-      <div class="flex h-6 w-6 shrink-0 items-center justify-center rounded-full bg-accent text-[11px] font-semibold text-white">{initial}</div>
-      <span class="flex-1 truncate text-ink">{$me?.userId ?? ""}</span>
-      <button class="rounded-lg border border-line-soft px-2.5 py-1 text-[11.5px] text-ink-3 transition hover:bg-hover hover:text-ink" onclick={logout} title="退出登录">退出</button>
-    </div>
-  </aside>
-
-  <!-- 主区 -->
-  <main class="flex-1 overflow-y-auto">
-    <NodeDetailPanel />
-  </main>
-
-  <!-- 右侧:文件预览/编辑栏(选中文件时出现) -->
-  {#if $selectedFilePath && $currentNode?.kind === "PROJECT"}
-    <section class="flex w-[46%] min-w-[420px] shrink-0 flex-col overflow-y-auto border-l border-line-soft bg-bg p-4">
-      <FileEditor
-        projectId={$currentNode.id}
-        path={$selectedFilePath}
-        role={$currentNode.role}
-        onchanged={bumpFiles}
-        onclose={clearSelectedFile}
-      />
-    </section>
-  {/if}
-  {/if}
-  </div>
-</div>
-
-{#if showCreateRoot}
-  <Modal title="新建根目录" onclose={() => (showCreateRoot = false)}>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="root-name">名称</label>
-      <input id="root-name" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newName} placeholder="例如:物理教研" />
-    </div>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="root-kind">类型</label>
-      <select id="root-kind" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newKind}>
-        <option value="FOLDER">文件夹</option>
-        <option value="PROJECT">项目(课程资源库)</option>
-      </select>
-    </div>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="root-desc">简介(可选)</label>
-      <textarea id="root-desc" rows="3" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-xs outline-none focus:border-accent" bind:value={newDesc} placeholder="简要说明用途…"></textarea>
-    </div>
-    <div class="mt-4 flex justify-end gap-2">
-      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreateRoot = false)}>取消</button>
-      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={createRoot}>创建</button>
-    </div>
-  </Modal>
-{/if}

hub/filelib-web/src/lib/FileEditor.svelte

@@ -1,165 +0,0 @@
-<script lang="ts">
-  import { api, ApiError } from "./api.js";
-  import { toastOk, toastErr, toast } from "./stores.js";
-  import type { FileContent, VersionInfo, Role } from "./types.js";
-  import Modal from "./Modal.svelte";
-
-  let { projectId, path, role, onchanged, onclose }: { projectId: string; path: string; role: Role; onchanged: () => void; onclose?: () => void } = $props();
-
-  let file = $state<FileContent | null>(null);
-  let draft = $state("");
-  let loadError = $state<string | null>(null);
-  let conflict = $state<{ currentVersion: string; diff: string } | null>(null);
-  let showHistory = $state(false);
-  let history = $state<VersionInfo[]>([]);
-
-  const canEdit = $derived(role !== "VIEW");
-
-  async function load(): Promise<void> {
-    try {
-      file = await api<FileContent>(`/database/api/projects/${projectId}/file?path=${encodeURIComponent(path)}`);
-      draft = file.encoding === "utf8" ? file.content : "";
-      loadError = null;
-      conflict = null;
-    } catch (e) {
-      loadError = e instanceof Error ? e.message : String(e);
-    }
-  }
-
-  $effect(() => {
-    void projectId;
-    void path;
-    void load();
-  });
-
-  async function save(): Promise<void> {
-    if (file === null) return;
-    try {
-      const r = await api<{ version: string }>(`/database/api/projects/${projectId}/file/commits`, {
-        method: "POST",
-        body: { path: file.path, baseVersion: file.version, content: draft },
-      });
-      toastOk("已提交 " + r.version);
-      await load();
-      onchanged();
-    } catch (e) {
-      if (e instanceof ApiError && e.status === 409 && typeof e.details?.["currentVersion"] === "string") {
-        await showConflict(e.details["currentVersion"]);
-      } else {
-        toastErr(e instanceof Error ? e.message : String(e));
-      }
-    }
-  }
-
-  async function showConflict(currentVersion: string): Promise<void> {
-    if (file === null) return;
-    try {
-      const r = await api<{ diff: string }>(
-        `/database/api/projects/${projectId}/file/diff?path=${encodeURIComponent(file.path)}&from=${encodeURIComponent(file.version)}&to=${encodeURIComponent(currentVersion)}`,
-      );
-      conflict = { currentVersion, diff: r.diff };
-      file = { ...file, version: currentVersion };
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function acceptLatest(): Promise<void> {
-    conflict = null;
-    await load();
-    toast("已载入最新内容,请在此基础上合并", "info");
-  }
-
-  async function remove(): Promise<void> {
-    if (file === null || !confirm("删除文件 " + file.path + "?")) return;
-    try {
-      await api(`/database/api/projects/${projectId}/file?path=${encodeURIComponent(file.path)}`, {
-        method: "DELETE",
-        body: { baseVersion: file.version },
-      });
-      toastOk("已删除");
-      file = null;
-      onchanged();
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function openHistory(): Promise<void> {
-    try {
-      const r = await api<{ history: VersionInfo[] }>(`/database/api/projects/${projectId}/file/history?path=${encodeURIComponent(path)}`);
-      history = r.history;
-      showHistory = true;
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  function renderDiff(diff: string): string {
-    return diff
-      .replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")
-      .replace(/^\+(.*)$/gm, '<span class="add">+$1</span>')
-      .replace(/^-(.*)$/gm, '<span class="del">-$1</span>');
-  }
-</script>
-
-{#if loadError}
-  <div class="rounded-xl border border-line-soft bg-panel p-5 text-xs text-danger">{loadError}</div>
-{:else if file}
-  <div class="rounded-xl border border-line-soft bg-panel p-5">
-    <div class="mb-2.5 flex items-center justify-between">
-      <span class="font-mono text-[11px] text-ink-3">{file.path} @ {file.version}</span>
-      <div class="flex items-center gap-2">
-        <a class="rounded-lg border border-line bg-panel px-3 py-1 text-[12px] font-medium text-ink transition hover:bg-hover" href="/database/api/projects/{projectId}/file/raw?path={encodeURIComponent(file.path)}" download>下载</a>
-        <button class="rounded-lg border border-line bg-panel px-3 py-1 text-[12px] font-medium text-ink transition hover:bg-hover" onclick={openHistory}>历史</button>
-        {#if canEdit}
-          <button class="rounded-lg border border-transparent px-3 py-1 text-[12px] font-medium text-danger transition hover:bg-[#A13A3312]" onclick={remove}>删除文件</button>
-        {/if}
-        {#if onclose}
-          <button class="rounded-lg border border-line bg-panel px-2.5 py-1 text-[12px] font-medium text-ink-3 transition hover:bg-hover hover:text-ink" onclick={onclose} title="关闭预览">✕</button>
-        {/if}
-      </div>
-    </div>
-
-    {#if file.encoding === "base64"}
-      <div class="text-xs text-ink-3">二进制文件({file.size} B),不支持在线编辑</div>
-    {:else}
-      <textarea rows="14" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-xs leading-7 outline-none focus:border-accent" bind:value={draft} readonly={!canEdit}></textarea>
-    {/if}
-
-    {#if canEdit && file.encoding !== "base64"}
-      <div class="mt-3 flex justify-end">
-        <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={save}>提交修改</button>
-      </div>
-    {/if}
-
-    {#if conflict}
-      <div class="mt-3.5 rounded-xl border border-[#E8E2C8] bg-[#FCFBF4] p-4">
-        <div class="mb-2 text-[13px] font-semibold text-[#6E6329]">冲突:他人已提交 {conflict.currentVersion},差异如下(你的基版 → 最新版)</div>
-        <pre class="diff rounded-lg border border-line-soft bg-panel p-3">{@html renderDiff(conflict.diff)}</pre>
-        <div class="mt-2 text-[11.5px] text-[#8A8059]">请人工合并后,以最新内容为全文重新提交(基版将更新为 {conflict.currentVersion})</div>
-        <div class="mt-2 flex justify-end">
-          <button class="rounded-lg border border-line bg-panel px-3 py-1 text-[12px] font-medium text-ink transition hover:bg-hover" onclick={acceptLatest}>载入最新内容</button>
-        </div>
-      </div>
-    {/if}
-  </div>
-{:else}
-  <div class="rounded-xl border border-line-soft bg-panel p-5 text-xs text-ink-3">加载中…</div>
-{/if}
-
-{#if showHistory}
-  <Modal title="版本历史" onclose={() => (showHistory = false)}>
-    <div class="max-h-80 overflow-y-auto">
-      {#each history as v (v.version)}
-        <div class="border-t border-line-soft py-2 text-xs first:border-t-0">
-          <span class="font-mono text-accent">{v.version}</span> {v.message}
-          <div class="text-ink-3">{new Date(v.committedAt).toLocaleString("zh-CN")}{v.author ? " · " + v.author : ""}</div>
-        </div>
-      {/each}
-    </div>
-    <div class="mt-3 flex justify-end">
-      <button class="rounded-lg border border-line bg-panel px-3 py-1 text-[12px] font-medium text-ink transition hover:bg-hover" onclick={() => (showHistory = false)}>关闭</button>
-    </div>
-  </Modal>
-{/if}

hub/filelib-web/src/lib/FilesPanel.svelte

@@ -1,137 +0,0 @@
-<script lang="ts">
-  import { api } from "./api.js";
-  import { toastOk, toastErr } from "./stores.js";
-  import { selectedFilePath, filesVersion } from "./browser.js";
-  import type { FileEntry, NodeDetail } from "./types.js";
-  import Modal from "./Modal.svelte";
-
-  let { node }: { node: NodeDetail } = $props();
-
-  let files = $state<FileEntry[] | null>(null);
-  let loadError = $state<string | null>(null);
-  let showNewFile = $state(false);
-  let newPath = $state("");
-  let newContent = $state("");
-  let uploadInput: HTMLInputElement;
-
-  const canEdit = $derived(node.role !== "VIEW");
-
-  async function loadFiles(): Promise<void> {
-    try {
-      const r = await api<{ files: FileEntry[] }>(`/database/api/projects/${node.id}/files`);
-      files = r.files;
-      loadError = null;
-    } catch (e) {
-      loadError = e instanceof Error ? e.message : String(e);
-    }
-  }
-
-  $effect(() => {
-    void node.id;
-    void $filesVersion;
-    void loadFiles();
-  });
-
-  async function submitNewFile(): Promise<void> {
-    const path = newPath.trim();
-    if (path === "") return;
-    try {
-      await api(`/database/api/projects/${node.id}/file`, {
-        method: "PUT",
-        body: { path, content: newContent },
-      });
-      toastOk("已创建");
-      showNewFile = false;
-      newPath = ""; newContent = "";
-      await loadFiles();
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  function u8ToBase64(bytes: Uint8Array): string {
-    let bin = "";
-    const CHUNK = 0x8000;
-    for (let i = 0; i < bytes.length; i += CHUNK) {
-      bin += String.fromCharCode.apply(null, Array.from(bytes.subarray(i, i + CHUNK)) as unknown as number[]);
-    }
-    return btoa(bin);
-  }
-
-  async function doUpload(e: Event): Promise<void> {
-    const input = e.target as HTMLInputElement;
-    const file = input.files?.[0];
-    input.value = "";
-    if (!file) return;
-    if (file.size > 10 * 1024 * 1024) {
-      toastErr("文件超过 10MB 上限");
-      return;
-    }
-    const targetPath = prompt("保存到路径(可含目录):", "材料/" + file.name);
-    if (!targetPath) return;
-    const bytes = new Uint8Array(await file.arrayBuffer());
-    const isBinary = bytes.includes(0);
-    const body = isBinary
-      ? { path: targetPath, content: u8ToBase64(bytes), encoding: "base64" }
-      : { path: targetPath, content: new TextDecoder("utf-8").decode(bytes), encoding: "utf8" };
-    try {
-      await api(`/database/api/projects/${node.id}/file`, { method: "PUT", body });
-      toastOk("已上传 " + file.name);
-      await loadFiles();
-    } catch (err) {
-      toastErr(err instanceof Error ? err.message : String(err));
-    }
-  }
-</script>
-
-<div class="rounded-xl border border-line-soft bg-panel p-5">
-  <div class="mb-2 flex items-center justify-between">
-    <div class="text-[13px] font-semibold">项目文件({files?.length ?? 0})</div>
-    {#if canEdit}
-      <div class="flex gap-2">
-        <button class="rounded-lg border border-line bg-panel px-3 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showNewFile = true)}>+ 新建文件</button>
-        <button class="rounded-lg bg-accent px-3 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={() => uploadInput.click()}>上传文件</button>
-        <input bind:this={uploadInput} type="file" class="hidden" onchange={doUpload} />
-      </div>
-    {/if}
-  </div>
-
-  {#if files === null && loadError === null}
-    <div class="py-5 text-center text-xs text-ink-3">加载中…</div>
-  {:else if loadError}
-    <div class="py-5 text-center text-xs text-danger">{loadError}</div>
-  {:else if files && files.length === 0}
-    <div class="py-5 text-center text-xs text-ink-3">空仓库 · 可新建或上传文件</div>
-  {:else if files}
-    <table class="w-full border-collapse text-[13px]">
-      <tbody>
-        {#each files as f (f.path)}
-          <tr
-            class="cursor-pointer border-t border-line-soft first:border-t-0 {$selectedFilePath === f.path ? 'bg-selected' : 'hover:bg-hover'}"
-            onclick={() => selectedFilePath.set(f.path)}
-          >
-            <td class="py-2 font-mono text-[12.5px] text-ink">{f.path}</td>
-            <td class="py-2 text-right font-mono text-[11px] text-ink-3">{f.size} B</td>
-          </tr>
-        {/each}
-      </tbody>
-    </table>
-  {/if}
-</div>
-
-{#if showNewFile}
-  <Modal title="新建文件" onclose={() => (showNewFile = false)}>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="nf-path">路径</label>
-      <input id="nf-path" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-[13px] outline-none focus:border-accent" bind:value={newPath} placeholder="docs/intro.md" />
-    </div>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="nf-content">内容</label>
-      <textarea id="nf-content" rows="8" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-xs outline-none focus:border-accent" bind:value={newContent} placeholder="内容…"></textarea>
-    </div>
-    <div class="mt-4 flex justify-end gap-2">
-      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showNewFile = false)}>取消</button>
-      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={submitNewFile}>创建</button>
-    </div>
-  </Modal>
-{/if}

hub/filelib-web/src/lib/GroupAdmin.svelte

@@ -1,280 +0,0 @@
-<script lang="ts">
-  import { onMount } from "svelte";
-  import { api } from "./api.js";
-  import { toastErr, toastOk } from "./stores.js";
-  import type { MemberGroupNode, MemberGroupMember } from "./types.js";
-  import Modal from "./Modal.svelte";
-
-  // 后端返回活跃组扁平列表(ADR-0028);前端按 parentId/depth 拼成有序树。
-  let groups = $state<MemberGroupNode[] | null>(null);
-  let listError = $state<string | null>(null);
-  let selectedId = $state<string | null>(null);
-
-  let members = $state<MemberGroupMember[] | null>(null);
-  let membersError = $state<string | null>(null);
-
-  // 新建组弹窗:parentId=null 建根,否则建子。
-  let showCreate = $state(false);
-  let createParentId = $state<string | null>(null);
-  let createParentName = $state<string | null>(null);
-  let newName = $state("");
-  let newDesc = $state("");
-
-  let addValue = $state("");
-
-  const selected = $derived(groups?.find((g) => g.id === selectedId) ?? null);
-
-  /** 扁平列表按 parentId 排成先根遍历顺序(每项自带 depth,渲染时缩进)。 */
-  const ordered = $derived.by(() => {
-    if (groups === null) return [];
-    const byParent = new Map<string | null, MemberGroupNode[]>();
-    for (const g of groups) {
-      const arr = byParent.get(g.parentId) ?? [];
-      arr.push(g);
-      byParent.set(g.parentId, arr);
-    }
-    for (const arr of byParent.values()) arr.sort((a, b) => a.name.localeCompare(b.name));
-    const out: MemberGroupNode[] = [];
-    const walk = (parentId: string | null): void => {
-      for (const g of byParent.get(parentId) ?? []) {
-        out.push(g);
-        walk(g.id);
-      }
-    };
-    walk(null);
-    // 兜底:孤儿(父已不在活跃列表,理论上级联软删不会出现)也列出。
-    const seen = new Set(out.map((g) => g.id));
-    for (const g of groups) if (!seen.has(g.id)) out.push(g);
-    return out;
-  });
-
-  async function loadGroups(): Promise<void> {
-    try {
-      const r = await api<{ groups: MemberGroupNode[] }>("/database/api/groups");
-      groups = r.groups;
-      listError = null;
-      if (selectedId !== null && !groups.some((g) => g.id === selectedId)) {
-        selectedId = null;
-        members = null;
-      }
-    } catch (e) {
-      listError = e instanceof Error ? e.message : String(e);
-    }
-  }
-
-  async function loadMembers(): Promise<void> {
-    if (selectedId === null) return;
-    members = null;
-    membersError = null;
-    try {
-      const r = await api<{ members: MemberGroupMember[] }>(
-        `/database/api/groups/${encodeURIComponent(selectedId)}/members`,
-      );
-      members = r.members;
-    } catch (e) {
-      membersError = e instanceof Error ? e.message : String(e);
-    }
-  }
-
-  onMount(loadGroups);
-
-  function select(id: string): void {
-    selectedId = id;
-    void loadMembers();
-  }
-
-  function openCreate(parent: MemberGroupNode | null): void {
-    createParentId = parent?.id ?? null;
-    createParentName = parent?.name ?? null;
-    newName = "";
-    newDesc = "";
-    showCreate = true;
-  }
-
-  async function createGroup(): Promise<void> {
-    const name = newName.trim();
-    if (name === "") return;
-    try {
-      await api("/database/api/groups", {
-        method: "POST",
-        body: {
-          name,
-          parentId: createParentId,
-          ...(newDesc.trim() !== "" ? { description: newDesc.trim() } : {}),
-        },
-      });
-      toastOk("已创建成员组");
-      showCreate = false;
-      await loadGroups();
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function deleteGroup(g: MemberGroupNode): Promise<void> {
-    if (!confirm(`删除「${g.name}」?其整棵子树将一并归档,相关授权立即失效。`)) return;
-    try {
-      const r = await api<{ archivedCount: number }>(
-        `/database/api/groups/${encodeURIComponent(g.id)}`,
-        { method: "DELETE" },
-      );
-      toastOk(`已归档 ${r.archivedCount} 个组`);
-      if (selectedId === g.id) { selectedId = null; members = null; }
-      await loadGroups();
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function addMember(): Promise<void> {
-    const v = addValue.trim();
-    if (v === "" || selectedId === null) return;
-    try {
-      // ou_ 开头当飞书 openId,其余当 userId(与 hub 现有习惯一致)。
-      const body = v.startsWith("ou_") ? { feishuOpenId: v } : { userId: v };
-      await api(`/database/api/groups/${encodeURIComponent(selectedId)}/members`, {
-        method: "POST",
-        body,
-      });
-      addValue = "";
-      toastOk("已添加成员");
-      await Promise.all([loadMembers(), loadGroups()]);
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function removeMember(userId: string): Promise<void> {
-    if (selectedId === null) return;
-    try {
-      await api(
-        `/database/api/groups/${encodeURIComponent(selectedId)}/members/${encodeURIComponent(userId)}`,
-        { method: "DELETE" },
-      );
-      toastOk("已移除成员");
-      await Promise.all([loadMembers(), loadGroups()]);
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-</script>
-
-<div class="flex h-full">
-  <!-- 左栏:嵌套组树 -->
-  <aside class="flex w-[340px] shrink-0 flex-col border-r border-line-soft bg-sidebar">
-    <div class="flex items-center justify-between border-b border-line-soft px-4 py-3.5">
-      <span class="text-[15px] font-semibold text-ink">Group 管理</span>
-      <button
-        class="rounded-lg border border-line bg-panel px-2.5 py-1 text-[11.5px] font-medium text-ink transition hover:bg-hover"
-        onclick={() => openCreate(null)}
-      >
-        + 根 Group
-      </button>
-    </div>
-
-    <div class="flex-1 overflow-y-auto px-2 py-2 text-[13px]">
-      {#if groups === null}
-        <div class="px-3 py-6 text-center text-xs text-ink-3">加载中…</div>
-      {:else if listError}
-        <div class="px-3 py-6 text-center text-xs text-danger">{listError}</div>
-      {:else if ordered.length === 0}
-        <div class="px-3 py-6 text-center text-xs text-ink-3">暂无成员组 · 点上方「+ 根 Group」开始</div>
-      {:else}
-        {#each ordered as g (g.id)}
-          <div
-            class="group flex items-center gap-1.5 rounded-lg py-1.5 pr-1.5 transition hover:bg-hover"
-            class:bg-selected={selectedId === g.id}
-            style="padding-left: {8 + g.depth * 16}px"
-          >
-            <button class="flex min-w-0 flex-1 items-center gap-2 text-left" onclick={() => select(g.id)}>
-              <span class="truncate font-medium text-ink">{g.name}</span>
-              <span class="shrink-0 text-[11px] text-ink-3">{g.memberCount}</span>
-            </button>
-            <button
-              class="shrink-0 rounded px-1.5 py-0.5 text-[15px] leading-none text-ink-3 opacity-0 transition hover:bg-panel hover:text-ink group-hover:opacity-100"
-              title="在此下新建子 Group"
-              onclick={() => openCreate(g)}
-            >+</button>
-            <button
-              class="shrink-0 rounded px-1.5 py-0.5 text-[11px] leading-none text-ink-3 opacity-0 transition hover:text-danger group-hover:opacity-100"
-              title="删除(级联归档子树)"
-              onclick={() => deleteGroup(g)}
-            >删除</button>
-          </div>
-        {/each}
-      {/if}
-    </div>
-  </aside>
-
-  <!-- 右栏:成员管理 -->
-  <main class="flex-1 overflow-y-auto p-6">
-    {#if selected === null}
-      <div class="flex h-full items-center justify-center text-[13px] text-ink-3">从左侧选择一个 Group 查看成员</div>
-    {:else}
-      <div class="mb-1 text-[17px] font-semibold text-ink">{selected.name}</div>
-      {#if selected.description}
-        <p class="mb-4 text-[12.5px] text-ink-2">{selected.description}</p>
-      {:else}
-        <div class="mb-4"></div>
-      {/if}
-
-      <div class="mb-4 flex items-end gap-2">
-        <div class="flex-1">
-          <label class="mb-1 block text-[11.5px] text-ink-3" for="add-member">添加成员(userId 或飞书 openId)</label>
-          <input
-            id="add-member"
-            class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent"
-            bind:value={addValue}
-            placeholder="userId 或 ou_ 开头的 openId"
-            onkeydown={(e) => { if (e.key === "Enter") void addMember(); }}
-          />
-        </div>
-        <button
-          class="rounded-lg bg-accent px-3.5 py-2 text-[12.5px] font-medium text-white transition hover:bg-accent-hover"
-          onclick={addMember}
-        >添加</button>
-      </div>
-
-      <div class="rounded-xl border border-line-soft bg-panel">
-        <div class="border-b border-line-soft px-4 py-2.5 text-[12.5px] font-semibold text-ink">
-          成员 {members === null ? "" : `(${members.length})`}
-        </div>
-        {#if members === null}
-          <div class="px-4 py-6 text-center text-xs text-ink-3">加载中…</div>
-        {:else if membersError}
-          <div class="px-4 py-6 text-center text-xs text-danger">{membersError}</div>
-        {:else if members.length === 0}
-          <div class="px-4 py-6 text-center text-xs text-ink-3">暂无成员</div>
-        {:else}
-          {#each members as m (m.userId)}
-            <div class="flex items-center gap-3 border-b border-line-soft px-4 py-2.5 text-[13px] last:border-b-0">
-              <span class="text-ink">{m.displayName}</span>
-              <span class="truncate font-mono text-[11px] text-ink-3">{m.userId}</span>
-              <button
-                class="ml-auto shrink-0 rounded px-1.5 py-0.5 text-[11.5px] text-ink-3 transition hover:text-danger"
-                onclick={() => removeMember(m.userId)}
-              >移除</button>
-            </div>
-          {/each}
-        {/if}
-      </div>
-    {/if}
-  </main>
-</div>
-
-{#if showCreate}
-  <Modal title={createParentName === null ? "新建根 Group" : `在「${createParentName}」下新建子 Group`} onclose={() => (showCreate = false)}>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="g-name">名称</label>
-      <input id="g-name" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newName} placeholder="例如:物理教研组" />
-    </div>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="g-desc">描述(可选)</label>
-      <textarea id="g-desc" rows="2" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newDesc} placeholder="一句话说明…"></textarea>
-    </div>
-    <div class="mt-4 flex justify-end gap-2">
-      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreate = false)}>取消</button>
-      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={createGroup}>创建</button>
-    </div>
-  </Modal>
-{/if}

hub/filelib-web/src/lib/LoginView.svelte

@@ -1,47 +0,0 @@
-<script lang="ts">
-  import { onMount } from "svelte";
-  import { api } from "./api.js";
-
-  interface LoginInfo {
-    orgSlug: string;
-    devLoginEnabled: boolean;
-  }
-
-  let info = $state<LoginInfo | null>(null);
-  let loadFailed = $state(false);
-
-  onMount(async () => {
-    try {
-      info = await api<LoginInfo>("/database/api/login-info");
-    } catch {
-      loadFailed = true;
-    }
-  });
-</script>
-
-<div class="flex min-h-full items-center justify-center p-6">
-  <div class="w-full max-w-[380px] rounded-2xl border border-line-soft bg-panel p-9 shadow-[0_4px_20px_rgba(26,26,24,.07)]">
-    <div class="text-center text-[26px] font-semibold tracking-wide text-ink">文件库</div>
-    <p class="mt-2.5 mb-8 text-center text-[13px] text-ink-3">课程资源与教研文件,一处安放,随处可查</p>
-
-    {#if info}
-      <a
-        href="/auth/feishu/{encodeURIComponent(info.orgSlug)}"
-        class="flex w-full items-center justify-center rounded-lg bg-accent px-4 py-3 text-sm font-medium text-white transition hover:bg-accent-hover"
-      >使用飞书登录</a>
-
-      {#if info.devLoginEnabled}
-        <div class="my-5 flex items-center gap-2.5 text-[11px] text-ink-3">
-          <span class="flex-1 border-t border-line-soft"></span>开发模式
-          <span class="flex-1 border-t border-line-soft"></span>
-        </div>
-        <a href="/app/dev-login-teacher" class="flex w-full items-center justify-center rounded-lg border border-line bg-panel px-4 py-2 text-[12.5px] font-medium text-ink transition hover:bg-hover">⚡ 一键登录(老师)</a>
-        <p class="mt-2.5 text-center text-[11px] text-ink-3">仅开发环境可见 · 跳过飞书 OAuth</p>
-      {/if}
-    {:else if loadFailed}
-      <p class="text-center text-[12.5px] text-danger">无法加载登录配置,请稍后重试</p>
-    {:else}
-      <p class="text-center text-[12.5px] text-ink-3">加载中…</p>
-    {/if}
-  </div>
-</div>

hub/filelib-web/src/lib/Modal.svelte

@@ -1,16 +0,0 @@
-<script lang="ts">
-  import type { Snippet } from "svelte";
-
-  let { title, onclose, children }: { title: string; onclose: () => void; children: Snippet } = $props();
-</script>
-
-<div
-  class="fixed inset-0 z-40 flex items-center justify-center bg-black/30 p-4"
-  role="presentation"
-  onclick={(e) => { if (e.target === e.currentTarget) onclose(); }}
->
-  <div class="w-full max-w-[440px] rounded-2xl border border-line-soft bg-panel p-6 shadow-[0_4px_20px_rgba(26,26,24,.07)]">
-    <div class="mb-4 text-[15px] font-semibold">{title}</div>
-    {@render children()}
-  </div>
-</div>

hub/filelib-web/src/lib/NodeDetailPanel.svelte

@@ -1,144 +0,0 @@
-<script lang="ts">
-  import { api } from "./api.js";
-  import { currentNode, breadcrumb, bumpTree, clearSelectedFile } from "./browser.js";
-  import { toastOk, toastErr } from "./stores.js";
-  import OverviewPanel from "./OverviewPanel.svelte";
-  import FilesPanel from "./FilesPanel.svelte";
-  import Modal from "./Modal.svelte";
-
-  let tab = $state<"detail" | "files">("detail");
-  let showCreateChild = $state(false);
-  let newName = $state("");
-  let newKind = $state<"FOLDER" | "PROJECT">("FOLDER");
-  let newDesc = $state("");
-
-  const node = $derived($currentNode);
-  const crumbs = $derived($breadcrumb);
-  const canManage = $derived(node?.role === "MANAGE");
-  const canEdit = $derived(canManage || node?.role === "EDIT");
-
-  $effect(() => {
-    void node?.id;
-    tab = "detail";
-    clearSelectedFile();
-  });
-
-  async function createChild(): Promise<void> {
-    const name = newName.trim();
-    if (name === "" || node === null) return;
-    try {
-      await api("/database/api/nodes", {
-        method: "POST",
-        body: {
-          parentId: node.id,
-          kind: newKind,
-          name,
-          ...(newDesc.trim() !== "" ? { description: newDesc.trim() } : {}),
-        },
-      });
-      toastOk("已创建");
-      showCreateChild = false;
-      newName = ""; newKind = "FOLDER"; newDesc = "";
-      bumpTree();
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function renameNode(): Promise<void> {
-    if (node === null) return;
-    const name = prompt("新名称", node.name);
-    if (name === null) return;
-    try {
-      await api(`/database/api/nodes/${node.id}`, { method: "PATCH", body: { name } });
-      toastOk("已重命名");
-      bumpTree();
-      currentNode.update((n) => (n ? { ...n, name } : n));
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function deleteNode(): Promise<void> {
-    if (node === null || !confirm(`确认删除「${node.name}」?软删除后不可见。`)) return;
-    try {
-      await api(`/database/api/nodes/${node.id}`, { method: "DELETE" });
-      toastOk("已删除");
-      currentNode.set(null);
-      bumpTree();
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-</script>
-
-{#if node === null}
-  <div class="flex h-full items-center justify-center text-[13px] text-ink-3">从左侧选择一个文件夹或项目</div>
-{:else}
-  <div class="mx-auto max-w-[880px] px-9 py-9">
-    <div class="mb-2 text-[12.5px] text-ink-3">
-      {#each crumbs as c, i (i)}
-        {#if i > 0}<span class="mx-1 text-line">/</span>{/if}
-        <span>{c.name ?? "…"}</span>
-      {/each}
-    </div>
-
-    <div class="mb-5 flex items-center justify-between">
-      <div class="flex items-center gap-2.5 text-[19px] font-semibold text-ink">
-        {node.name}
-        <span class="rounded-full border border-line-soft bg-panel px-2 py-0.5 font-mono text-[10.5px] text-ink-3">{node.kind === "PROJECT" ? "项目" : "文件夹"}</span>
-      </div>
-      <div class="flex gap-2">
-        {#if canEdit && node.kind === "FOLDER"}
-          <button class="rounded-lg border border-line bg-panel px-3 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreateChild = true)}>+ 新建</button>
-        {/if}
-        {#if canManage}
-          <button class="rounded-lg border border-line bg-panel px-3 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={renameNode}>重命名</button>
-          <button class="rounded-lg border border-transparent px-3 py-1.5 text-[12.5px] font-medium text-danger transition hover:bg-[#A13A3312]" onclick={deleteNode}>删除</button>
-        {/if}
-      </div>
-    </div>
-
-    {#if node.kind === "FOLDER"}
-      <div class="py-7 text-[13px] text-ink-3">点击左侧树展开以浏览子内容</div>
-    {:else}
-      <div class="mb-5 flex gap-1 border-b border-line-soft">
-        {#each [["detail", "概览"], ["files", "文件"]] as [id, label] (id)}
-          <button
-            class="border-b-2 px-3.5 py-2 text-[13px] transition {tab === id ? 'border-accent font-semibold text-ink' : 'border-transparent text-ink-3 hover:text-ink'}"
-            onclick={() => (tab = id as "detail" | "files")}
-          >{label}</button>
-        {/each}
-      </div>
-      {#if tab === "detail"}
-        <OverviewPanel {node} />
-      {:else}
-        <FilesPanel {node} />
-      {/if}
-    {/if}
-  </div>
-{/if}
-
-{#if showCreateChild && node}
-  <Modal title="新建子节点" onclose={() => (showCreateChild = false)}>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="child-name">名称</label>
-      <input id="child-name" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newName} placeholder="例如:物理必修一" />
-    </div>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="child-kind">类型</label>
-      <select id="child-kind" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newKind}>
-        <option value="FOLDER">文件夹</option>
-        <option value="PROJECT">项目(课程资源库)</option>
-      </select>
-    </div>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="child-desc">简介(可选)</label>
-      <textarea id="child-desc" rows="3" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-xs outline-none focus:border-accent" bind:value={newDesc} placeholder="简要说明用途…"></textarea>
-    </div>
-    <div class="mt-4 flex justify-end gap-2">
-      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreateChild = false)}>取消</button>
-      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={createChild}>创建</button>
-    </div>
-  </Modal>
-{/if}

hub/filelib-web/src/lib/OverviewPanel.svelte

@@ -1,123 +0,0 @@
-<script lang="ts">
-  import { api } from "./api.js";
-  import { toastOk, toastErr } from "./stores.js";
-  import { currentNode } from "./browser.js";
-  import type { ExportJob, NodeDetail } from "./types.js";
-  import Modal from "./Modal.svelte";
-
-  let { node }: { node: NodeDetail } = $props();
-
-  let showEditDesc = $state(false);
-  let descDraft = $state("");
-  let exportJob = $state<ExportJob | null>(null);
-
-  const canEdit = $derived(node.role === "MANAGE" || node.role === "EDIT");
-  const roleLabel = $derived(node.role === "MANAGE" ? "可管理" : node.role === "EDIT" ? "可编辑" : "只读");
-
-  $effect(() => {
-    void node.id;
-    exportJob = null;
-  });
-
-  function openEditDesc(): void {
-    descDraft = node.description ?? "";
-    showEditDesc = true;
-  }
-
-  async function saveDesc(): Promise<void> {
-    const description = descDraft.trim();
-    try {
-      await api(`/database/api/nodes/${node.id}`, {
-        method: "PATCH",
-        body: { description: description === "" ? null : description },
-      });
-      toastOk("简介已保存");
-      showEditDesc = false;
-      const next = description === "" ? null : description;
-      currentNode.update((n) => (n && n.id === node.id ? { ...n, description: next } : n));
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function submitExport(): Promise<void> {
-    try {
-      const r = await api<{ jobId: string; status: string }>(`/database/api/projects/${node.id}/exports`, {
-        method: "POST",
-        body: { target: "manifest" },
-      });
-      toastOk("导出已提交");
-      void pollExport(r.jobId);
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function pollExport(jobId: string): Promise<void> {
-    for (;;) {
-      await new Promise((r) => setTimeout(r, 800));
-      try {
-        const job = await api<ExportJob>(`/database/api/exports/${jobId}`);
-        exportJob = job;
-        if (job.status === "DONE" || job.status === "FAILED") break;
-      } catch {
-        break;
-      }
-    }
-  }
-</script>
-
-<div class="rounded-xl border border-line-soft bg-panel p-5">
-  <div class="mb-4">
-    <div class="mb-1.5 text-[11.5px] text-ink-3">简介</div>
-    <div class="text-[13.5px] leading-7 text-ink">
-      {#if node.description}
-        {node.description}
-      {:else}
-        <span class="italic text-ink-3">暂无简介</span>
-      {/if}
-      {#if canEdit}
-        <button class="ml-2.5 rounded-lg border border-line bg-panel px-2.5 py-0.5 align-middle text-[11.5px] text-ink transition hover:bg-hover" onclick={openEditDesc}>编辑</button>
-      {/if}
-    </div>
-  </div>
-
-  <div class="my-4 border-t border-line-soft"></div>
-
-  <div class="flex flex-col gap-1.5 text-[13px] text-ink-2">
-    <div>我的角色 <b class="font-semibold text-ink">{roleLabel}</b></div>
-    <div>创建时间 <b class="font-semibold text-ink">{new Date(node.createdAt).toLocaleDateString("zh-CN", { year: "numeric", month: "long", day: "numeric" })}</b></div>
-    <div>最近修改 <b class="font-semibold text-ink">{new Date(node.updatedAt).toLocaleDateString("zh-CN", { year: "numeric", month: "long", day: "numeric" })}</b></div>
-  </div>
-
-  <div class="my-4 border-t border-line-soft"></div>
-
-  <div class="mb-2 text-[12.5px] font-semibold">导出</div>
-  <div class="flex items-center gap-2">
-    <button class="rounded-lg border border-line bg-panel px-3 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={submitExport}>开始导出</button>
-    {#if exportJob}
-      <span class="font-mono text-[11px] text-ink-3">
-        {#if exportJob.status === "DONE"}
-          完成 · <a class="text-accent underline" href="/database/api/exports/{exportJob.id}/download">下载</a>
-        {:else if exportJob.status === "FAILED"}
-          失败:{exportJob.error ?? ""}
-        {:else}
-          {exportJob.status}…
-        {/if}
-      </span>
-    {/if}
-  </div>
-</div>
-
-{#if showEditDesc}
-  <Modal title="编辑简介" onclose={() => (showEditDesc = false)}>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="desc-draft">简要说明这个项目的内容</label>
-      <textarea id="desc-draft" rows="5" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] leading-7 outline-none focus:border-accent" bind:value={descDraft} placeholder="例如:高中物理必修一第三章,表面张力相关内容……"></textarea>
-    </div>
-    <div class="mt-4 flex justify-end gap-2">
-      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showEditDesc = false)}>取消</button>
-      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={saveDesc}>保存</button>
-    </div>
-  </Modal>
-{/if}

hub/filelib-web/src/lib/Toasts.svelte

@@ -1,11 +0,0 @@
-<script lang="ts">
-  import { toasts } from "./stores.js";
-</script>
-
-<div class="fixed bottom-4 right-4 z-50 flex flex-col gap-2">
-  {#each $toasts as t (t.id)}
-    <div class="max-w-[340px] rounded-lg px-4 py-2 text-sm text-white {t.kind === 'err' ? 'bg-[#7E2C26]' : 'bg-[#333230]'}">
-      {t.message}
-    </div>
-  {/each}
-</div>

hub/filelib-web/src/lib/TreeNode.svelte

@@ -1,82 +0,0 @@
-<script lang="ts">
-  import TreeNode from "./TreeNode.svelte";
-  import { api } from "./api.js";
-  import { expanded, currentNode, breadcrumb, toggleExpanded, treeVersion } from "./browser.js";
-  import { toastErr } from "./stores.js";
-  import type { BreadcrumbEntry, NodeChild, NodeDetail } from "./types.js";
-
-  let { node, depth }: { node: NodeChild; depth: number } = $props();
-
-  let children = $state<NodeChild[] | null>(null);
-  const isOpen = $derived($expanded.has(node.id));
-  const isSelected = $derived($currentNode?.id === node.id);
-
-  // 树刷新信号(增/删/移/重命名)→ 失效子节点缓存,展开状态下随之重载
-  $effect(() => {
-    void $treeVersion;
-    children = null;
-  });
-
-  $effect(() => {
-    if (isOpen && node.kind === "FOLDER" && children === null) {
-      api<{ nodes: NodeChild[] }>(`/database/api/nodes?parentId=${encodeURIComponent(node.id)}`)
-        .then((r) => (children = r.nodes))
-        .catch((e) => toastErr(e instanceof Error ? e.message : String(e)));
-    }
-  });
-
-  async function select(): Promise<void> {
-    if (node.kind === "FOLDER") toggleExpanded(node.id);
-    try {
-      const [detail, crumb] = await Promise.all([
-        api<{ node: NodeDetail }>(`/database/api/nodes/${node.id}`),
-        api<{ breadcrumb: BreadcrumbEntry[] }>(`/database/api/nodes/${node.id}/breadcrumb`),
-      ]);
-      currentNode.set(detail.node);
-      breadcrumb.set(crumb.breadcrumb);
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-</script>
-
-<div>
-  <div
-    class="tree-item flex cursor-pointer items-center gap-1 rounded-lg px-1.5 py-1.5 select-none {isSelected ? 'bg-selected' : 'hover:bg-hover'}"
-    role="button"
-    tabindex="0"
-    onclick={select}
-    onkeydown={(e) => e.key === "Enter" && select()}
-  >
-    <span class="flex h-4 w-4 shrink-0 items-center justify-center text-ink-3">
-      {#if node.kind === "FOLDER"}
-        <svg width="9" height="9" viewBox="0 0 24 24" fill="currentColor">
-          {#if isOpen}<path d="M6 9l6 6 6-6z" />{:else}<path d="M9 6l6 6-6 6z" />{/if}
-        </svg>
-      {/if}
-    </span>
-    <span class="flex h-4 w-4 shrink-0 items-center justify-center {node.kind === 'PROJECT' ? 'text-ink' : 'text-ink-3'}">
-      {#if node.kind === "PROJECT"}
-        <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M20 7l-8-4-8 4m16 0l-8 4m8-4v10l-8 4m0-10L4 7m8 4v10M4 7v10l8 4" /></svg>
-      {:else}
-        <svg width="16" height="16" viewBox="0 0 24 24" fill="currentColor"><path d="M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V7Z" /></svg>
-      {/if}
-    </span>
-    <span class="truncate">{node.name}</span>
-    {#if node.role !== "MANAGE"}
-      <span class="ml-auto pr-1 font-mono text-[10px] text-ink-3">{node.role}</span>
-    {/if}
-  </div>
-
-  {#if node.kind === "FOLDER" && isOpen}
-    <div class="ml-[15px] border-l border-guide pl-1">
-      {#if children === null}
-        <div class="px-3 py-1.5 text-xs text-ink-3">…</div>
-      {:else}
-        {#each children as child (child.id)}
-          <TreeNode node={child} depth={depth + 1} />
-        {/each}
-      {/if}
-    </div>
-  {/if}
-</div>

hub/filelib-web/src/lib/api.ts

@@ -1,49 +0,0 @@
-/** 与 /database/api/* 的约定一致;401 时清空会话(回到登录视图)。 */
-
-import { me } from "./stores.js";
-
-export class ApiError extends Error {
-  constructor(
-    readonly status: number,
-    readonly code: string,
-    message: string,
-    readonly details?: Record<string, unknown>,
-  ) {
-    super(message);
-    this.name = "ApiError";
-  }
-}
-
-export class UnauthenticatedError extends Error {
-  constructor() {
-    super("unauthenticated");
-    this.name = "UnauthenticatedError";
-  }
-}
-
-interface RequestOpts {
-  readonly method?: string;
-  readonly body?: unknown;
-}
-
-export async function api<T = unknown>(path: string, opts: RequestOpts = {}): Promise<T> {
-  const res = await fetch(path, {
-    credentials: "same-origin",
-    method: opts.method ?? "GET",
-    ...(opts.body !== undefined
-      ? { headers: { "Content-Type": "application/json" }, body: JSON.stringify(opts.body) }
-      : {}),
-  });
-  if (res.status === 401) {
-    me.set(null);
-    throw new UnauthenticatedError();
-  }
-  if (res.status === 204) return null as T;
-  const text = await res.text();
-  const data = text === "" ? null : (JSON.parse(text) as unknown);
-  if (!res.ok) {
-    const err = (data as { error?: { code?: string; message?: string } } | null)?.error ?? {};
-    throw new ApiError(res.status, err.code ?? "unknown", err.message ?? res.statusText, err as Record<string, unknown>);
-  }
-  return data as T;
-}

hub/filelib-web/src/lib/browser.ts

@@ -1,34 +0,0 @@
-import { writable } from "svelte/store";
-import type { BreadcrumbEntry, NodeDetail } from "./types.js";
-
-/** 树展开集合 / 当前选中节点 / 面包屑 / 树刷新计数。 */
-export const expanded = writable<Set<string>>(new Set());
-export const currentNode = writable<NodeDetail | null>(null);
-export const breadcrumb = writable<BreadcrumbEntry[]>([]);
-export const treeVersion = writable(0);
-
-/** 右侧预览栏:当前选中文件路径(项目内);切换节点时清空。 */
-export const selectedFilePath = writable<string | null>(null);
-/** 文件列表刷新计数(编辑器保存/删除后 bump,列表随之重载)。 */
-export const filesVersion = writable(0);
-
-export function bumpTree(): void {
-  treeVersion.update((v) => v + 1);
-}
-
-export function bumpFiles(): void {
-  filesVersion.update((v) => v + 1);
-}
-
-export function clearSelectedFile(): void {
-  selectedFilePath.set(null);
-}
-
-export function toggleExpanded(id: string): void {
-  expanded.update((set) => {
-    const next = new Set(set);
-    if (next.has(id)) next.delete(id);
-    else next.add(id);
-    return next;
-  });
-}

hub/filelib-web/src/lib/stores.ts

@@ -1,26 +0,0 @@
-import { writable } from "svelte/store";
-import type { MeResponse } from "./types.js";
-
-/** 当前登录身份;null = 未登录(显示登录视图)。 */
-export const me = writable<MeResponse | null>(null);
-export const authChecked = writable(false);
-
-export interface ToastItem {
-  readonly id: number;
-  readonly message: string;
-  readonly kind: "info" | "err";
-}
-
-let nextToastId = 1;
-export const toasts = writable<ToastItem[]>([]);
-
-export function toast(message: string, kind: ToastItem["kind"] = "info"): void {
-  const id = nextToastId++;
-  toasts.update((list) => [...list, { id, message, kind }]);
-  setTimeout(() => {
-    toasts.update((list) => list.filter((t) => t.id !== id));
-  }, 3600);
-}
-
-export const toastOk = (m: string): void => toast(m, "info");
-export const toastErr = (m: string): void => toast(m, "err");

hub/filelib-web/src/lib/types.ts

@@ -1,100 +0,0 @@
-/** 与后端 /database/api/* 响应形状对齐。 */
-
-export type NodeKind = "FOLDER" | "PROJECT";
-export type Role = "VIEW" | "EDIT" | "MANAGE";
-
-export interface NodeChild {
-  readonly id: string;
-  readonly parentId: string | null;
-  readonly kind: NodeKind;
-  readonly name: string;
-  readonly role: Role;
-  readonly createdAt: string;
-  readonly updatedAt: string;
-}
-
-export interface BreadcrumbEntry {
-  readonly depth: number;
-  readonly id: string | null;
-  readonly name: string | null;
-  readonly kind: NodeKind;
-}
-
-export interface NodeDetail {
-  readonly id: string;
-  readonly parentId: string | null;
-  readonly kind: NodeKind;
-  readonly name: string;
-  readonly description: string | null;
-  readonly role: Role;
-  readonly provisionStatus: "PROVISIONING" | "READY" | "FAILED";
-  readonly independentPermission: boolean;
-  readonly createdAt: string;
-  readonly updatedAt: string;
-}
-
-export interface MeResponse {
-  readonly userId: string;
-  readonly isWebsiteAdmin: boolean;
-}
-
-export interface FileEntry {
-  readonly path: string;
-  readonly size: number;
-}
-
-export type FileContentEncoding = "utf8" | "base64";
-
-export interface FileContent {
-  readonly path: string;
-  readonly version: string;
-  readonly encoding: FileContentEncoding;
-  readonly content: string;
-  readonly size: number;
-}
-
-export interface VersionInfo {
-  readonly version: string;
-  readonly message: string;
-  readonly author?: string;
-  readonly committedAt: string;
-}
-
-export interface ExportJob {
-  readonly id: string;
-  readonly nodeId: string;
-  readonly target: string;
-  readonly status: "QUEUED" | "RUNNING" | "DONE" | "FAILED";
-  readonly error: string | null;
-  readonly createdAt: string;
-}
-
-export interface Grant {
-  readonly id: string;
-  readonly principalType: "USER" | "GROUP";
-  readonly principalId: string;
-  readonly role: Role;
-  readonly isCreatorGrant: boolean;
-  readonly createdAt: string;
-}
-
-export interface GroupSearchResult {
-  readonly id: string;
-  readonly name: string;
-  readonly breadcrumb: string;
-}
-
-/** 成员组(ADR-0028);后端返回扁平列表,前端按 parentId/depth 拼树。 */
-export interface MemberGroupNode {
-  readonly id: string;
-  readonly parentId: string | null;
-  readonly name: string;
-  readonly description: string | null;
-  readonly depth: number;
-  readonly memberCount: number;
-}
-
-export interface MemberGroupMember {
-  readonly userId: string;
-  readonly displayName: string;
-}

hub/filelib-web/src/main.ts

@@ -1,5 +0,0 @@
-import { mount } from "svelte";
-import App from "./App.svelte";
-import "./app.css";
-
-export default mount(App, { target: document.getElementById("app")! });

hub/filelib-web/tsconfig.json

@@ -1,17 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "strict": true,
-    "noUncheckedIndexedAccess": true,
-    "exactOptionalPropertyTypes": true,
-    "verbatimModuleSyntax": true,
-    "skipLibCheck": true,
-    "isolatedModules": true,
-    "resolveJsonModule": true,
-    "useDefineForClassFields": true,
-    "lib": ["ES2022", "DOM", "DOM.Iterable"]
-  },
-  "include": ["src/**/*.ts", "src/**/*.svelte"]
-}

hub/filelib-web/vite.config.ts

@@ -1,25 +0,0 @@
-import { defineConfig } from "vite";
-import { svelte } from "@sveltejs/vite-plugin-svelte";
-import tailwindcss from "@tailwindcss/vite";
-
-// 老师端独立 SPA:构建产物由 hub 后端静态托管于 /app;
-// 开发时 vite dev(:5173)把 API/认证请求代理到后端(:8788)。
-const backend = "http://127.0.0.1:8788";
-
-export default defineConfig({
-  plugins: [svelte(), tailwindcss()],
-  base: "/app/",
-  build: {
-    outDir: "dist",
-    emptyOutDir: true,
-  },
-  server: {
-    port: 5173,
-    proxy: {
-      "/database/api": backend,
-      "/auth": backend,
-      "/app/dev-login": backend,
-      "/app/dev-login-teacher": backend,
-    },
-  },
-});

hub/package-lock.json

@@ -1,19 +1,18 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.36",
+  "version": "0.0.35",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@paradigm/hub",
-      "version": "0.0.36",
+      "version": "0.0.35",
       "dependencies": {
         "@alicloud/credentials": "^2.4.5",
         "@alicloud/docmind-api20220711": "^1.4.15",
         "@alicloud/tea-util": "^1.4.11",
         "@anthropic-ai/claude-agent-sdk": "^0.3.202",
         "@fastify/cookie": "^11.0.2",
-        "@fastify/static": "^10.1.2",
         "@larksuiteoapi/node-sdk": "^1.70.0",
         "@prisma/client": "^6.19.3",
         "ai": "^7.0.16",
@@ -903,22 +902,6 @@
         "node": ">=18"
       }
     },
-    "node_modules/@fastify/accept-negotiator": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@fastify/accept-negotiator/-/accept-negotiator-2.0.1.tgz",
-      "integrity": "sha512-/c/TW2bO/v9JeEgoD/g1G5GxGeCF1Hafdf79WPmUlgYiBXummY0oX3VVq4yFkKKVBKDNlaDUYoab7g38RpPqCQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/@fastify/ajv-compiler": {
       "version": "4.0.5",
       "resolved": "https://registry.npmjs.org/@fastify/ajv-compiler/-/ajv-compiler-4.0.5.tgz",
@@ -1050,83 +1033,6 @@
         "ipaddr.js": "^2.1.0"
       }
     },
-    "node_modules/@fastify/send": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/@fastify/send/-/send-4.1.0.tgz",
-      "integrity": "sha512-TMYeQLCBSy2TOFmV95hQWkiTYgC/SEx7vMdV+wnZVX4tt8VBLKzmH8vV9OzJehV0+XBfg+WxPMt5wp+JBUKsVw==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "@lukeed/ms": "^2.0.2",
-        "escape-html": "~1.0.3",
-        "fast-decode-uri-component": "^1.0.1",
-        "http-errors": "^2.0.0",
-        "mime": "^3"
-      }
-    },
-    "node_modules/@fastify/static": {
-      "version": "10.1.2",
-      "resolved": "https://registry.npmjs.org/@fastify/static/-/static-10.1.2.tgz",
-      "integrity": "sha512-G/g18cG9tLutT/OVyN1AIsHIl9L1UwmJ+S3dkyhVpplIx0nEMicd7RGQ+uJLyhKKF4a3tTcQydccn3Mop1fX+Q==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "@fastify/accept-negotiator": "^2.0.0",
-        "@fastify/error": "^4.0.0",
-        "@fastify/send": "^4.0.0",
-        "content-disposition": "^2.0.1",
-        "fastify-plugin": "^6.0.0",
-        "fastq": "^1.17.1",
-        "glob": "^13.0.0"
-      }
-    },
-    "node_modules/@fastify/static/node_modules/content-disposition": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-2.0.1.tgz",
-      "integrity": "sha512-e+H0ZXHSWYrENhQzw1LPuP4oF5MzVKmDU6d3hxlvaPEYLLg62MxtQNPRx4SYSuYJSBUgnQIG4HIN2tEtNv7Dog==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/@fastify/static/node_modules/fastify-plugin": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz",
-      "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/@hono/node-server": {
       "version": "1.19.14",
       "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz",
@@ -1162,15 +1068,6 @@
         "ws": "^8.19.0"
       }
     },
-    "node_modules/@lukeed/ms": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@lukeed/ms/-/ms-2.0.2.tgz",
-      "integrity": "sha512-9I2Zn6+NJLfaGoz9jN3lpwDgAYvfGeNYdbAIjJOqzs4Tpc+VU3Jqq4IofSUBKajiDS8k9fZIg18/z13mpk1bsA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/@modelcontextprotocol/sdk": {
       "version": "1.29.0",
       "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.29.0.tgz",
@@ -2037,15 +1934,6 @@
         "proxy-from-env": "^2.1.0"
       }
     },
-    "node_modules/balanced-match": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
-      "license": "MIT",
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
     "node_modules/body-parser": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
@@ -2085,18 +1973,6 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/brace-expansion": {
-      "version": "5.0.7",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
-      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
     "node_modules/bytes": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
@@ -2378,6 +2254,7 @@
       "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
       "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -2570,7 +2447,8 @@
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
       "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/estree-walker": {
       "version": "3.0.3",
@@ -3069,23 +2947,6 @@
         "giget": "dist/cli.mjs"
       }
     },
-    "node_modules/glob": {
-      "version": "13.0.6",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
-      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "minimatch": "^10.2.2",
-        "minipass": "^7.1.3",
-        "path-scurry": "^2.0.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/gopd": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
@@ -3152,6 +3013,7 @@
       "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
       "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "depd": "~2.0.0",
         "inherits": "~2.0.4",
@@ -3234,7 +3096,8 @@
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "license": "ISC"
+      "license": "ISC",
+      "peer": true
     },
     "node_modules/ini": {
       "version": "1.3.8",
@@ -3683,15 +3546,6 @@
       "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
       "license": "Apache-2.0"
     },
-    "node_modules/lru-cache": {
-      "version": "11.5.2",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
-      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
     "node_modules/magic-string": {
       "version": "0.30.21",
       "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
@@ -3734,18 +3588,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/mime": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/mime/-/mime-3.0.0.tgz",
-      "integrity": "sha512-jSCU7/VB1loIWBZe14aEYHU/+1UMEHoaO7qxCOVJOw9GgH72VAWppxNcjU+x9a2k3GSIBXNKxXQFqRvvZ7vr3A==",
-      "license": "MIT",
-      "bin": {
-        "mime": "cli.js"
-      },
-      "engines": {
-        "node": ">=10.0.0"
-      }
-    },
     "node_modules/mime-db": {
       "version": "1.52.0",
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
@@ -3767,30 +3609,6 @@
         "node": ">= 0.6"
       }
     },
-    "node_modules/minimatch": {
-      "version": "10.2.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
-      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "brace-expansion": "^5.0.5"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/minipass": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
-      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
     "node_modules/moment": {
       "version": "2.30.1",
       "resolved": "https://registry.npmjs.org/moment/-/moment-2.30.1.tgz",
@@ -3974,22 +3792,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/path-scurry": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
-      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "lru-cache": "^11.0.0",
-        "minipass": "^7.1.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/path-to-regexp": {
       "version": "8.4.2",
       "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz",
@@ -4568,7 +4370,8 @@
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
       "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
-      "license": "ISC"
+      "license": "ISC",
+      "peer": true
     },
     "node_modules/shebang-command": {
       "version": "2.0.0",
@@ -4767,6 +4570,7 @@
       "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
       "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -4854,6 +4658,7 @@
       "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
       "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=0.6"
       }

hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.36",
+  "version": "0.0.35",
   "private": true,
   "type": "module",
   "engines": {
@@ -12,7 +12,6 @@
     "@alicloud/tea-util": "^1.4.11",
     "@anthropic-ai/claude-agent-sdk": "^0.3.202",
     "@fastify/cookie": "^11.0.2",
-    "@fastify/static": "^10.1.2",
     "@larksuiteoapi/node-sdk": "^1.70.0",
     "@prisma/client": "^6.19.3",
     "ai": "^7.0.16",
@@ -31,10 +30,10 @@
       "axios": "1.18.1"
     }
   },
-  "description": "Curriculum Project Hub — org-scoped Feishu collaboration and confined Agent runtime. Semantics pinned by docs/adr/ (ADR-0001 through ADR-0027).",
+  "description": "Curriculum Project Hub — org-scoped Feishu collaboration and confined Agent runtime. Aligns to spec/System through ADR-0024.",
   "scripts": {
     "dev": "npm run prisma:migrate && tsx watch src/server.ts",
-    "build": "tsc -p tsconfig.json && npm run admin:build && npm run filelib:build",
+    "build": "tsc -p tsconfig.json && npm run admin:build",
     "start": "npm run prisma:migrate && node dist/server.js",
     "check": "tsc -p tsconfig.json --noEmit",
     "audit:production": "npm audit --omit=dev --audit-level=high",
@@ -49,8 +48,6 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "admin:dev": "npm run dev --prefix admin-web",
-    "admin:build": "npm run build --prefix admin-web",
+    "admin:build": "npm run build --prefix admin-web"
-    "filelib:dev": "npm run dev --prefix filelib-web",
-    "filelib:build": "npm run build --prefix filelib-web"
   }
 }

hub/prisma/migrations/20260714120000_drop_legacy_platform_role_assignment/migration.sql

@@ -1,6 +1,6 @@
 -- ADR-0023 rejected the legacy `PlatformRoleAssignment` / `PlatformRole`{ADMIN,TEACHER}
 -- model: the platform administration control plane is a separate identity/session/
--- audit surface, intentionally not built
+-- audit surface (see `Spec.System.PlatformAdministration`), intentionally not built
 -- in alpha (ADR-0025, `hub/deploy/README.md`). The legacy table has no runtime
 -- reader — no guard, route, or service queries it for an authorization decision —
 -- and ADR-0023 requires it to be migrated/replaced before the platform panel ships.

hub/prisma/migrations/20260721120000_file_library/migration.sql

@@ -1,92 +0,0 @@
--- File library (文件库) — 语义锚定:仓库根《文件库-接口契约.md》、.omo/文件库-开工计划.md (D11–D19)。
--- 本地无 PG 时手写;有 PG 后可用 `prisma migrate diff` 核对与 schema 的一致性。
-
--- CreateEnum
-CREATE TYPE "FileLibNodeKind" AS ENUM ('FOLDER', 'PROJECT');
-CREATE TYPE "FileLibProvisionStatus" AS ENUM ('PROVISIONING', 'READY', 'FAILED');
-CREATE TYPE "FileLibRole" AS ENUM ('VIEW', 'EDIT', 'MANAGE');
-CREATE TYPE "FileLibPrincipalType" AS ENUM ('USER', 'GROUP');
-CREATE TYPE "FileLibExportStatus" AS ENUM ('QUEUED', 'RUNNING', 'DONE', 'FAILED');
-
--- CreateTable
-CREATE TABLE "FileLibNode" (
-    "id" TEXT NOT NULL,
-    "organizationId" TEXT NOT NULL,
-    "parentId" TEXT,
-    "kind" "FileLibNodeKind" NOT NULL,
-    "name" TEXT NOT NULL,
-    "nameLower" TEXT NOT NULL,
-    "pathIds" TEXT NOT NULL,
-    "creatorId" TEXT NOT NULL,
-    "provisionStatus" "FileLibProvisionStatus" NOT NULL DEFAULT 'READY',
-    "storageDir" TEXT,
-    "deletedAt" TIMESTAMP(3),
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "FileLibNode_pkey" PRIMARY KEY ("id")
-);
-
-CREATE TABLE "FileLibGrant" (
-    "id" TEXT NOT NULL,
-    "organizationId" TEXT NOT NULL,
-    "nodeId" TEXT NOT NULL,
-    "principalType" "FileLibPrincipalType" NOT NULL,
-    "principalId" TEXT NOT NULL,
-    "role" "FileLibRole" NOT NULL,
-    "isCreatorGrant" BOOLEAN NOT NULL DEFAULT false,
-    "createdByUserId" TEXT,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "revokedAt" TIMESTAMP(3),
-
-    CONSTRAINT "FileLibGrant_pkey" PRIMARY KEY ("id")
-);
-
-CREATE TABLE "FileLibProjectSettings" (
-    "nodeId" TEXT NOT NULL,
-    "independentPermissionsEnabled" BOOLEAN NOT NULL DEFAULT false,
-
-    CONSTRAINT "FileLibProjectSettings_pkey" PRIMARY KEY ("nodeId")
-);
-
-CREATE TABLE "FileLibExportJob" (
-    "id" TEXT NOT NULL,
-    "organizationId" TEXT NOT NULL,
-    "nodeId" TEXT NOT NULL,
-    "target" TEXT NOT NULL,
-    "params" JSONB NOT NULL,
-    "status" "FileLibExportStatus" NOT NULL DEFAULT 'QUEUED',
-    "downloadUrl" TEXT,
-    "error" TEXT,
-    "createdByUserId" TEXT NOT NULL,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "FileLibExportJob_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex (schema-declared)
-CREATE INDEX "FileLibNode_organizationId_parentId_deletedAt_idx" ON "FileLibNode"("organizationId", "parentId", "deletedAt");
-CREATE INDEX "FileLibNode_organizationId_pathIds_idx" ON "FileLibNode"("organizationId", "pathIds");
-CREATE INDEX "FileLibNode_creatorId_idx" ON "FileLibNode"("creatorId");
-CREATE INDEX "FileLibGrant_organizationId_revokedAt_idx" ON "FileLibGrant"("organizationId", "revokedAt");
-CREATE INDEX "FileLibGrant_principalType_principalId_revokedAt_idx" ON "FileLibGrant"("principalType", "principalId", "revokedAt");
-CREATE INDEX "FileLibGrant_nodeId_revokedAt_idx" ON "FileLibGrant"("nodeId", "revokedAt");
-CREATE INDEX "FileLibExportJob_organizationId_status_idx" ON "FileLibExportJob"("organizationId", "status");
-
--- D14:活跃兄弟节点大小写不敏感唯一。root 的 parentId 为 NULL,用 COALESCE 归入同一键空间。
-CREATE UNIQUE INDEX "FileLibNode_active_sibling_name_key"
-    ON "FileLibNode"("organizationId", COALESCE("parentId", ''), "nameLower")
-    WHERE "deletedAt" IS NULL;
-
--- 契约 2.3:同一节点上同一 principal 至多一条活跃授权(Postgres 原生 UNIQUE 无法约束 NULL revokedAt)。
-CREATE UNIQUE INDEX "FileLibGrant_active_unique"
-    ON "FileLibGrant"("nodeId", "principalType", "principalId")
-    WHERE "revokedAt" IS NULL;
-
--- AddForeignKey
-ALTER TABLE "FileLibNode" ADD CONSTRAINT "FileLibNode_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-ALTER TABLE "FileLibNode" ADD CONSTRAINT "FileLibNode_parentId_fkey" FOREIGN KEY ("parentId") REFERENCES "FileLibNode"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
-ALTER TABLE "FileLibGrant" ADD CONSTRAINT "FileLibGrant_nodeId_fkey" FOREIGN KEY ("nodeId") REFERENCES "FileLibNode"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-ALTER TABLE "FileLibProjectSettings" ADD CONSTRAINT "FileLibProjectSettings_nodeId_fkey" FOREIGN KEY ("nodeId") REFERENCES "FileLibNode"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-ALTER TABLE "FileLibExportJob" ADD CONSTRAINT "FileLibExportJob_nodeId_fkey" FOREIGN KEY ("nodeId") REFERENCES "FileLibNode"("id") ON DELETE CASCADE ON UPDATE CASCADE;

hub/prisma/migrations/20260723120000_member_group_hierarchy/migration.sql

@@ -1,70 +0,0 @@
--- Global, unlimited-depth member group hierarchy (requirement 3.1-3.3).
--- Managed only by the platform super administrator; deliberately NOT
--- org-scoped. Stores membership + nesting only, never permission data.
--- Deletion is soft (archivedAt / revokedAt markers); a group delete
--- cascade-soft-deletes its whole subtree as an application operation.
--- The permission side (GROUP principal, FOLDER resource, grant inheritance)
--- is intentionally deferred to a later migration.
-
--- CreateTable
-CREATE TABLE "MemberGroup" (
-    "id" TEXT NOT NULL,
-    "parentId" TEXT,
-    "name" TEXT NOT NULL,
-    "description" TEXT,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-    "archivedAt" TIMESTAMP(3),
-
-    CONSTRAINT "MemberGroup_pkey" PRIMARY KEY ("id")
-);
-
--- CreateTable
-CREATE TABLE "MemberGroupMembership" (
-    "id" TEXT NOT NULL,
-    "groupId" TEXT NOT NULL,
-    "userId" TEXT NOT NULL,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "revokedAt" TIMESTAMP(3),
-
-    CONSTRAINT "MemberGroupMembership_pkey" PRIMARY KEY ("id")
-);
-
--- CreateTable
-CREATE TABLE "MemberGroupClosure" (
-    "ancestorId" TEXT NOT NULL,
-    "descendantId" TEXT NOT NULL,
-    "depth" INTEGER NOT NULL,
-
-    CONSTRAINT "MemberGroupClosure_pkey" PRIMARY KEY ("ancestorId", "descendantId")
-);
-
--- CreateIndex
-CREATE INDEX "MemberGroup_parentId_archivedAt_idx" ON "MemberGroup"("parentId", "archivedAt");
-
--- CreateIndex
-CREATE INDEX "MemberGroupMembership_userId_revokedAt_idx" ON "MemberGroupMembership"("userId", "revokedAt");
-
--- CreateIndex
-CREATE INDEX "MemberGroupMembership_groupId_revokedAt_idx" ON "MemberGroupMembership"("groupId", "revokedAt");
-
--- CreateIndex
-CREATE UNIQUE INDEX "MemberGroupMembership_groupId_userId_revokedAt_key" ON "MemberGroupMembership"("groupId", "userId", "revokedAt");
-
--- CreateIndex
-CREATE INDEX "MemberGroupClosure_descendantId_idx" ON "MemberGroupClosure"("descendantId");
-
--- AddForeignKey
-ALTER TABLE "MemberGroup" ADD CONSTRAINT "MemberGroup_parentId_fkey" FOREIGN KEY ("parentId") REFERENCES "MemberGroup"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
-
--- AddForeignKey
-ALTER TABLE "MemberGroupMembership" ADD CONSTRAINT "MemberGroupMembership_groupId_fkey" FOREIGN KEY ("groupId") REFERENCES "MemberGroup"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
--- AddForeignKey
-ALTER TABLE "MemberGroupMembership" ADD CONSTRAINT "MemberGroupMembership_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
--- AddForeignKey
-ALTER TABLE "MemberGroupClosure" ADD CONSTRAINT "MemberGroupClosure_ancestorId_fkey" FOREIGN KEY ("ancestorId") REFERENCES "MemberGroup"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
--- AddForeignKey
-ALTER TABLE "MemberGroupClosure" ADD CONSTRAINT "MemberGroupClosure_descendantId_fkey" FOREIGN KEY ("descendantId") REFERENCES "MemberGroup"("id") ON DELETE CASCADE ON UPDATE CASCADE;

hub/prisma/migrations/20260723130000_filelib_description/migration.sql

@@ -1,2 +0,0 @@
--- 为 FileLibNode 加简介字段，老师在创建/概览页填写。
-ALTER TABLE "FileLibNode" ADD COLUMN "description" TEXT;

hub/prisma/schema.prisma

@@ -1,6 +1,6 @@
 // Prisma schema for Curriculum Project Hub.
 //
-// Aligns to ADR-0001..0004, 0017. Key divergences from the
+// Aligns to spec/System (ADR-0001..0004, 0017). Key divergences from the
 // legacy teaching-material-host-service schema, each deliberate:
 //
 //  - AgentSession is provider/model-bound. Provider runtime cursors such as
@@ -11,8 +11,8 @@
 //  - ProjectGroupBinding is project→chat only (ADR-0001 1:1); legacy mixed
 //    user/chat targets into one binding table.
 //  - PermissionGrant + PermissionSettings land (ADR-0004), missing in legacy.
-//  - AgentRunStatus adds WAITING_FOR_USER + TIMED_OUT (the run-state set is
+//  - AgentRunStatus adds WAITING_FOR_USER + TIMED_OUT (spec RunState; enum
-//    open — add states without a schema migration war).
+//    completeness OPEN — add states without a schema migration war).
 
 generator client {
   provider = "prisma-client-js"
@@ -50,7 +50,6 @@ model Organization {
   projectGroupBindings         ProjectGroupBinding[]
   auditEntries                 AuditEntry[]                             @relation("organizationAudit")
   projectSearchDocuments       ProjectSearchDocument[]
-  fileLibNodes                 FileLibNode[]
 
   @@index([status])
 }
@@ -62,7 +61,7 @@ enum OrganizationStatus {
 }
 
 /// Org-scoped membership role. Distinct from project PermissionRole and from
-/// the platform administrator surface (ADR-0023),
+/// the platform administrator surface (ADR-0023 / Spec.System.PlatformAdministration),
 /// which is a separate control plane not modeled in alpha (ADR-0025).
 model OrganizationMembership {
   id             String                 @id @default(cuid())
@@ -194,7 +193,6 @@ model User {
   heldLocks                    ProjectAgentLock[]                   @relation("lockHolder")
   feishuBindings               ProjectGroupBinding[]                @relation("bindingCreator")
   teamMemberships              TeamMembership[]
-  memberGroupMemberships       MemberGroupMembership[]
   externalPrincipalMemberships ExternalPrincipalMembership[]
   permissionGrants             PermissionGrant[]                    @relation("grantCreator")
   roleTriggerGrants            RoleTriggerGrant[]                   @relation("roleGrantCreator")
@@ -395,67 +393,6 @@ model TeamExternalBinding {
   @@index([teamId, revokedAt])
 }
 
-// --- Member groups (global, nestable authorization principal) ------------
-
-/// Global, unlimited-depth member group. Managed only by the platform super administrator (ADR-0023);
-/// Deletion is soft: `archivedAt` is a marker.
-/// Deleting a group cascade-soft-deletes its whole subtree — an application
-/// operation (walk the subtree, stamp archivedAt), not a DB constraint.
-model MemberGroup {
-  id          String    @id @default(cuid())
-  parentId    String?
-  name        String
-  description String?
-  createdAt   DateTime  @default(now())
-  updatedAt   DateTime  @updatedAt
-  archivedAt  DateTime?
-
-  parent       MemberGroup?            @relation("groupTree", fields: [parentId], references: [id], onDelete: Restrict)
-  children     MemberGroup[]           @relation("groupTree")
-  memberships  MemberGroupMembership[]
-  asAncestor   MemberGroupClosure[]    @relation("ancestor")
-  asDescendant MemberGroupClosure[]    @relation("descendant")
-
-  @@index([parentId, archivedAt])
-}
-
-/// User↔group many-to-many; a user may belong to multiple groups. Soft delete
-/// via `revokedAt` (same pattern as TeamMembership) allows re-adding a removed
-/// member. `userId, revokedAt` index is the resolution hot path: fetch a user's direct groups.
-model MemberGroupMembership {
-  id        String    @id @default(cuid())
-  groupId   String
-  userId    String
-  createdAt DateTime  @default(now())
-  revokedAt DateTime?
-
-  group MemberGroup @relation(fields: [groupId], references: [id], onDelete: Cascade)
-  user  User        @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@unique([groupId, userId, revokedAt])
-  @@index([userId, revokedAt])
-  @@index([groupId, revokedAt])
-}
-
-/// Transitive closure of the MemberGroup tree. Every group has a depth=0
-/// self row. Turns ancestor/descendant resolution into one indexed join
-/// instead of a recursive CTE; maintained only on create / reparent (rare
-/// super-admin ops, so the write cost is amortized against hot reads). On soft
-/// delete the closure rows are retained; resolution filters by
-/// MemberGroup.archivedAt. Reparent must reject a new parent inside the moved
-/// subtree (cycle guard).
-model MemberGroupClosure {
-  ancestorId   String
-  descendantId String
-  depth        Int
-
-  ancestor   MemberGroup @relation("ancestor", fields: [ancestorId], references: [id], onDelete: Cascade)
-  descendant MemberGroup @relation("descendant", fields: [descendantId], references: [id], onDelete: Cascade)
-
-  @@id([ancestorId, descendantId])
-  @@index([descendantId])
-}
-
 /// Locally synchronized Feishu external principal membership.
 model ExternalDirectoryConnection {
   id               String    @id @default(cuid())
@@ -986,127 +923,3 @@ model CapabilityCredentialVersion {
   @@index([keyId])
   @@index([createdByUserId])
 }
-
-// --- File library (文件库) -------------------------------------------------
-//
-// 独立模块,语义由仓库根《文件库-接口契约.md》(C/D 编号)与 .omo/文件库-开工计划.md
-// (D11–D19)锚定。与上面的 Folder/Project(hub 自己的 explorer,ADR-0021)是两套
-// 体系,不复用、不互相引用。
-
-/// 文件库目录树节点:文件夹(容器)或项目(叶子,关联 git 仓库)。
-/// parentId 是树的权威关系;pathIds 是 id 编码的物化路径(派生),随 create/move
-/// 在事务内维护(计划 D12;name 不入路径,rename 不重写后代)。
-model FileLibNode {
-  id              String                 @id
-  organizationId  String
-  parentId        String?
-  kind            FileLibNodeKind
-  name            String
-  /// D14:NFC+trim 的小写形式;活跃兄弟节点大小写不敏感唯一(部分唯一索引在迁移 SQL)。
-  nameLower       String
-  /// id 编码物化路径,形如 "/rootId/childId/selfId"。祖先展开与前缀查询都用它。
-  pathIds         String
-  /// D11:创建者不可变,自动持有 isCreatorGrant=true 的 MANAGE grant。
-  /// 故意不建 FK:这是不可变历史事实,不随 User 生命周期变化。
-  creatorId       String
-  /// 老师可填写的简介，创建/概览页展示，通俗易懂地说明这个节点的用途。
-  description     String?
-  /// 项目 provisioning 状态机(DB/git 双写协调,Metis 风险#1);文件夹恒 READY。
-  provisionStatus FileLibProvisionStatus @default(READY)
-  /// 项目仓库目录(绝对路径);文件夹为 null。
-  storageDir      String?
-  deletedAt       DateTime?
-  createdAt       DateTime               @default(now())
-  updatedAt       DateTime               @updatedAt
-
-  organization    Organization            @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  parent          FileLibNode?            @relation("fileLibTree", fields: [parentId], references: [id], onDelete: Restrict)
-  children        FileLibNode[]           @relation("fileLibTree")
-  grants          FileLibGrant[]
-  projectSettings FileLibProjectSettings?
-  exportJobs      FileLibExportJob[]
-
-  @@index([organizationId, parentId, deletedAt])
-  @@index([organizationId, pathIds])
-  @@index([creatorId])
-}
-
-enum FileLibNodeKind {
-  FOLDER
-  PROJECT
-}
-
-enum FileLibProvisionStatus {
-  PROVISIONING
-  READY
-  FAILED
-}
-
-/// 文件库权限级别:MANAGE > EDIT > VIEW(契约 2.2,只取最高、无降权)。
-enum FileLibRole {
-  VIEW
-  EDIT
-  MANAGE
-}
-
-enum FileLibPrincipalType {
-  USER
-  GROUP
-}
-
-/// 契约 2.3:grant 直接挂在节点上,最终权限 = max(个人, 递归 Group, 祖先继承)。
-/// 活跃授权唯一性由迁移里的部分唯一索引保证(revokedAt IS NULL)。
-model FileLibGrant {
-  id              String               @id @default(cuid())
-  organizationId  String
-  nodeId          String
-  principalType   FileLibPrincipalType
-  principalId     String
-  role            FileLibRole
-  /// D11:创建者自动 grant;独立权限开关关闭时,项目级 grant 里只有它仍生效。
-  isCreatorGrant  Boolean              @default(false)
-  createdByUserId String?
-  createdAt       DateTime             @default(now())
-  revokedAt       DateTime?
-
-  node FileLibNode @relation(fields: [nodeId], references: [id], onDelete: Cascade)
-
-  @@index([organizationId, revokedAt])
-  @@index([principalType, principalId, revokedAt])
-  @@index([nodeId, revokedAt])
-}
-
-/// 契约 P5/D11:项目独立权限开关。默认关闭(仅继承);关闭时项目级非创建者
-/// grant 冻结不删除,重新开启即恢复。
-model FileLibProjectSettings {
-  nodeId                        String  @id
-  independentPermissionsEnabled Boolean @default(false)
-
-  node FileLibNode @relation(fields: [nodeId], references: [id], onDelete: Cascade)
-}
-
-enum FileLibExportStatus {
-  QUEUED
-  RUNNING
-  DONE
-  FAILED
-}
-
-/// 契约 D10:导出为异步任务。外部导出工具参数 OPEN-6,adapter 就位前先建模型。
-model FileLibExportJob {
-  id              String             @id @default(cuid())
-  organizationId  String
-  nodeId          String
-  target          String
-  params          Json
-  status          FileLibExportStatus @default(QUEUED)
-  downloadUrl     String?
-  error           String?
-  createdByUserId String
-  createdAt       DateTime           @default(now())
-  updatedAt       DateTime           @updatedAt
-
-  node FileLibNode @relation(fields: [nodeId], references: [id], onDelete: Cascade)
-
-  @@index([organizationId, status])
-}

hub/src/agent/runner.ts

@@ -24,10 +24,10 @@
  * denied by default and re-opened only for the workspace plus named system
  * runtimes, and `failIfUnavailable` hard-fails if the sandbox can't start. The
  * subprocess gets a minimal environment and SDK credential protection removes
- * provider secrets from Bash. This upholds the workspace-bounded file-op
+ * provider secrets from Bash. This upholds `AgentFileOp.Authorized`
- * invariant (ADR-0018) without re-implementing the
+ * (ADR-0018 / `Spec.System.AgentSurface`) without re-implementing the
  * `workspace.ts` `confine()` path validator as a tool wrapper — the OS sandbox
- * is the mechanism, the ADR pins the invariant.
+ * is the mechanism, the contract pins the invariant.
  */
 import { query, type HookCallback, type McpServerConfig, type SDKMessage, type SDKAssistantMessage, type SDKUserMessage, type SDKResultMessage, type SDKPartialAssistantMessage, type SDKSystemMessage } from "@anthropic-ai/claude-agent-sdk";
 import type { PrismaClient } from "@prisma/client";

hub/src/capacity/dimensions.ts

@@ -1,6 +1,6 @@
 /**
- * ADR-0022 capacity dimensions.
+ * ADR-0022 capacity dimensions (spec `Spec.System.Capacity.CapacityDimension`).
- * The 23 pinned dimensions; exact numeric ceilings are open and calibrated by
+ * The 23 PINNED dimensions; exact numeric ceilings are `OPEN` and calibrated by
  * capacity testing. This module is the single source of the dimension set shared
  * by the platform-ceiling config and the org capacity-policy service.
  */

hub/src/database/README.md

@@ -1,146 +0,0 @@
-# src/database/
-
-`/database/*` HTTP 面。代码写在这个目录里，`hub.ts` 通过 `plugin.ts` 挂载它，
-所以服务器启动时能正确识别这些路由。
-
-**前后端分离**：页面已迁到独立的 SvelteKit 静态 SPA `hub/database-admin/`
-（与 `hub/admin-web/` 同一套框架）。本目录的后端只保留三件事：鉴权透传、一个
-免鉴权配置端点、以及把 SPA 构建产物托管出去。页面全部由 SPA 客户端渲染。
-
-后端路由：
-
-- `GET /database/config` —— 免鉴权。返回 `{ siloOrganizationSlug, devLoginEnabled }`，
-  给 SPA 登录页拼飞书链接、决定是否显示 dev 按钮用。不含任何敏感数据。
-- `GET /database/dev-login` —— 仅开发。见下。
-- `GET /database`、`GET /database/*` —— SPA shell / 客户端路由 fallback
-  （`static.ts` 的 `registerDatabaseSpa`）；资产在 `/database/_app/*`。
-
-SPA 页面（`database-admin`，`paths.base='/database'`）：
-
-- `/database/admin` —— 飞书登录页。按钮指向 `/auth/feishu/<orgSlug>`（slug 来自
-  `/database/config`），回调由 `src/admin/routes/authRoutes.ts` 处理并种 session cookie。
-- `/database/dashboard` —— 后台壳。未登录跳登录页；**登录但非 OWNER/ADMIN 显示无权提示**。
-
-> **注册顺序要点**：concrete 路由（`/database/config`、`/database/dev-login`）必须在
-> `registerDatabaseSpa` 的 `/database/*` fallback 之前注册（已在 `plugin.ts` 保证），
-> 否则通配会 shadow 它们。
-
-## 开发模式：用环境变量开启一键登录
-
-本地开发没有真实飞书 app 时，可以用环境变量开启一键登录，跳过飞书 OAuth，
-直接以现有 OWNER/ADMIN 身份登入后台。**仅限开发，不是生产登录路径。**
-
-### 怎么开
-
-在 `hub/.env` 里设：
-
-```sh
-HUB_DEV_LOGIN_BYPASS="true"
-```
-
-改完重启服务（`npm run dev`，或本地手动 `npx tsx src/server.ts`）。启动日志会
-打印一行 `DEV login bypass enabled: /database/dev-login ...` 作为确认。
-
-开启后：
-
-- `/database/config` 返回 `devLoginEnabled: true`，SPA 登录页据此显示
-  「⚡ 一键登录管理员」按钮
-- 后端注册 `/database/dev-login` 端点：按钮就是打它，它签发一个和飞书 OAuth
-  回调完全一样的 session，然后跳到 `/database/dashboard`
-
-### 怎么关
-
-把值设成 `false`（或 `0` / `no` / `off`），或删掉这一行。关闭后按钮消失、
-`/database/dev-login` 返回 404 —— 按钮和端点同进同退。
-
-### 双重门禁（重要）
-
-真正的开关是两个条件的**与**（判断在 `plugin.ts`）：
-
-```
-allowDevLoginBypass = (NODE_ENV !== "production") && HUB_DEV_LOGIN_BYPASS 为真
-```
-
-即：**只要 `NODE_ENV=production`，无论 `HUB_DEV_LOGIN_BYPASS` 设成什么，一键登录
-都强制关闭。** 生产始终只能走真实飞书 OAuth。
-
-> 提醒：`HUB_DEV_LOGIN_BYPASS` 是敏感开关，别把开着它的 `.env` 带到任何联网 /
-> 共享环境。整个旁路逻辑自包含在本目录（`plugin.ts` + `routes/databaseRoutes.ts`），
-> `src/admin` 的登录路由未受影响。
-
-## 文件
-
-| 文件 | 职责 |
-|------|------|
-| `plugin.ts` | 模块对外入口，`hub.ts` 调 `registerDatabasePlugin()` |
-| `routes/databaseRoutes.ts` | 登录页/dashboard + 各子路由装配点 |
-| `routes/filelibRoutes.ts` | 文件库 树/授权 API |
-| `routes/fileRoutes.ts` | 文件库 文件内容/导出 API |
-| `routes/memberGroupRoutes.ts` | 成员组管理 API + `/groups/search` + `/users/search`(ADR-0028) |
-| `routes/adminPanels.ts` | dashboard「用户管理」(org 成员)/「Group 管理」(MemberGroup 嵌套树)面板 |
-| `routes/libraryPage.ts` | `/database/library` 文件库浏览页 |
-| `filelib/` | 文件库领域层(见下) |
-
-新增一类**数据**端点时：要么直接往 `databaseRoutes.ts` 加 `app.get("/database/...")`，
-要么新建 `routes/xxxRoutes.ts` 并在 `databaseRoutes.ts` 里 `registerXxxRoutes(app, {...})`
-注册一次。
-
-## 文件库(filelib/)
-
-独立文件库模块,语义由仓库根《文件库-接口契约.md》(C/D 编号)与
-`.omo/文件库-开工计划.md`(D11–D19)锚定。**与 hub 自己的 Folder/Project
-(ADR-0021 explorer)是两套体系,不复用。**
-
-| 文件 | 职责 |
-|------|------|
-| `filelib/model.ts` | 角色秩(MANAGE>EDIT>VIEW)、D14 命名规则、FileLibError |
-| `filelib/permission.ts` | 纯权限 reducer(取最高/不降权/祖先继承/D11 冻结),不碰 IO |
-| `filelib/treeService.ts` | 树增删改查;每个写操作同事务落审计 |
-| `filelib/grantService.ts` | 授权管理 + 契约 8.1 矩阵强制 + force_adjust |
-| `filelib/fileService.ts` | 文件路径安全 + 版本化读写(先 git 后审计的顺序铁律) |
-| `filelib/exportService.ts` | 导出 job 状态机(D10 异步)+ ExportAdapter port |
-| `filelib/versionStore.ts` | 契约 C1 port + 内存实现(版本团队 npm 包到位后替换) |
-| `filelib/groupResolver.ts` | 契约 C2 port(+ 已弃用的 Team 过渡实现,ADR-0028) |
-| `filelib/memberGroupResolver.ts` | **默认** C2 实现:读 in-hub MemberGroup 闭包(ADR-0028) |
-| `filelib/memberGroupService.ts` | 成员组 CRUD(含改名)+ 成员增删 + 闭包维护 + 搜索(ADR-0028) |
-| `filelib/groupResolverHttp.ts` | C2 HTTP 实现(HUB_GROUP_SERVICE_URL 启用;失败 → 503) |
-| `filelib/audit.ts` | 审计动作词表(C3 §6.3)+ 同事务写入 |
-| `filelib/guards.ts` | session → FileLibActor;网站管理员 = org OWNER/ADMIN(D19) |
-| `filelib/routeShared.ts` | 路由共享件(依赖装配/错误映射/请求体校验) |
-
-环境变量:
-
-- `HUB_FILELIB_STORAGE_ROOT` — 项目 git 仓库根目录(默认 `./.filelib-repos`)
-- `HUB_GROUP_SERVICE_URL` — 外部 Group 服务地址(C2);**未配置时读 in-hub
-  MemberGroup 闭包**(ADR-0028 起的默认;此前是扁平 hub Team)
-
-> ⚠️ 开发期注意:当前 VersionStore 是**进程内存**实现,**服务重启后仓库全失**,
-> 此前创建的项目再访问文件会报 `repo_not_found`(需重建项目)。版本团队的
-> 持久化 git 包到位后此问题消失。
-
-关键语义速查:
-
-- **D8**:无权限 → 404(不泄露存在性);越权 → 403;Group 服务故障 → 503
-- **D11**:creator 不可变 + 自动 MANAGE;独立权限关闭时项目级非创建者 grant 冻结
-- **D12**:move = 本节点 MANAGE + 目标父 EDIT+,事务 + pg 咨询锁
-- **D15**:删除只打标本节点,"任一祖先已删"即整支不可见
-- **8.1**:MANAGE 仅创建者可授/收;creator grant 不可动
-- **审计**:一切写操作在业务事务内写 AuditEntry(同事务,失败即回滚);
-  文件内容写先 versionStore.commit 再审计(宁多版本,不造假审计)
-
-## 约定（与 admin 面一致）
-
-1. 路由用**绝对路径** `"/database/..."`，不用 Fastify prefix —— 每条路由 grep 得到。
-2. **guard 前置、fail closed**：凡碰数据的端点第一行先跑
-   `requireSession` / `requireOrgRole` / `requireProjectPermission`
-   （都在 `../admin/auth/guards.js`）。
-3. **租户隔离**（ADR-0020）：每个 Prisma 查询都 scope 到 `auth.organization.id`，
-   不得跨 org。禁止无鉴权的数据路由。
-4. 数据库通过传入的 `config.prisma` 访问（全进程单例，见 `../db.ts`）；
-   不要在这里 `new PrismaClient()`。
-
-## 为什么代码在 `src/` 下
-
-`tsconfig.json` 固定 `rootDir: "src"` 且 `include: ["src/**/*.ts"]`。只有
-`src/` 下的 `.ts` 会被 `tsc` 编译、被 `tsx watch`（`npm run dev`）加载。放在
-`src/` 之外的目录不会被构建，外部识别不到。

hub/src/database/filelib/audit.ts

@@ -1,79 +0,0 @@
-/**
- * 文件库审计 sink(契约 C3 的入驻适配)。
- *
- * 契约原文:本地 outbox 表(与业务同事务)→ 中继 POST 到独立审计服务。
- * 入驻 hub 后的适配:审计同事 = 本库 AuditEntry,与业务写在同一 Prisma 事务
- * 内落库 —— 同库同事务天然满足"操作成功则日志必存在",比 outbox+relay 更强。
- * 若审计团队日后独立成服务,只换本文件的实现,action 词汇表保持不变。
- */
-
-import type { Prisma } from "@prisma/client";
-
-/** C3 §6.3:文件库审计动作词汇表(与契约文档逐条对应,改词需升契约版本)。 */
-export const FILE_LIB_AUDIT_ACTIONS = {
-  folderCreate: "folder.create",
-  folderRename: "folder.rename",
-  folderMove: "folder.move",
-  folderDelete: "folder.delete",
-  projectCreate: "project.create",
-  projectRename: "project.rename",
-  projectMove: "project.move",
-  projectDelete: "project.delete",
-  permissionGrant: "permission.grant",
-  permissionUpdate: "permission.update",
-  permissionRevoke: "permission.revoke",
-  independentEnable: "project.independent_permission.enable",
-  independentDisable: "project.independent_permission.disable",
-  independentChange: "project.independent_permission.change",
-  fileUpload: "file.upload",
-  fileRename: "file.rename",
-  fileDelete: "file.delete",
-  fileCommit: "file.commit",
-  fileConflictDetected: "file.conflict_detected",
-  exportRun: "export.run",
-  adminForceAdjust: "admin.force_adjust",
-  // ADR-0028:成员组内置进 hub,组动作在本地审计(契约 C3 §6.3 原委托外部 Group 服务)。
-  groupCreate: "group.create",
-  groupUpdate: "group.update",
-  groupDelete: "group.delete",
-  groupRestore: "group.restore",
-  groupMemberAdd: "group.member_add",
-  groupMemberRemove: "group.member_remove",
-} as const;
-
-export type FileLibAuditObjectType = "folder" | "project" | "file" | "grant" | "export_job" | "group";
-
-export interface FileLibAuditEntry {
-  readonly action: string;
-  readonly actorUserId: string;
-  readonly organizationId: string;
-  readonly objectType: FileLibAuditObjectType;
-  readonly objectId: string;
-  /** 节点 id 路径(pathIds)或项目内文件路径,便于按路径检索。 */
-  readonly objectPath: string;
-  readonly detail?: Record<string, unknown> | undefined;
-}
-
-/**
- * 在调用方的事务里写一条审计。刻意不吞错:写不出来整个业务操作回滚
- * (需求 5.1"操作成功则日志必存在"的强保证)。
- */
-export async function writeFileLibAudit(
-  tx: Prisma.TransactionClient,
-  entry: FileLibAuditEntry,
-): Promise<void> {
-  const metadata: Record<string, unknown> = {
-    objectType: entry.objectType,
-    objectId: entry.objectId,
-    objectPath: entry.objectPath,
-    ...(entry.detail ?? {}),
-  };
-  await tx.auditEntry.create({
-    data: {
-      action: entry.action,
-      actorUserId: entry.actorUserId,
-      organizationId: entry.organizationId,
-      metadata: metadata as Prisma.InputJsonValue,
-    },
-  });
-}

hub/src/database/filelib/exportService.ts

@@ -1,195 +0,0 @@
-/**
- * 导出(契约 D10):异步任务 + 状态机 QUEUED → RUNNING → DONE/FAILED。
- *
- * ExportAdapter 是外部导出工具的 port(参数清单 OPEN-6,真身到位后替换)。
- * 当前 stub 适配器产出"文件清单 manifest"文本,证明状态机端到端可跑;
- * 产物存进程内存(v1 stub;生产应落对象存储/磁盘 —— 见 OPEN 清单)。
- */
-
-import { randomUUID } from "node:crypto";
-import { FileLibError } from "./model.js";
-import { FILE_LIB_AUDIT_ACTIONS, writeFileLibAudit } from "./audit.js";
-import { requireAccessInTx, type FileLibActor } from "./treeService.js";
-import type { FileDeps } from "./fileService.js";
-
-export interface ExportAdapterInput {
-  readonly storageDir: string;
-  readonly target: string;
-  readonly params: Record<string, unknown>;
-  readonly listFiles: (prefix?: string) => Promise<readonly { path: string; size: number }[]>;
-  readonly readFile: (path: string) => Promise<Buffer>;
-}
-
-export interface ExportArtifact {
-  readonly filename: string;
-  readonly content: Buffer;
-}
-
-export interface ExportAdapter {
-  readonly target: string;
-  run(input: ExportAdapterInput): Promise<ExportArtifact>;
-}
-
-/** stub 适配器:生成项目文件清单,端到端验证 job 状态机。OPEN-6 后换真导出工具。 */
-export function createManifestStubAdapter(versionStore: FileDeps["versionStore"]): ExportAdapter {
-  return {
-    target: "manifest",
-    async run(input) {
-      const files = await input.listFiles();
-      const lines = [
-        `# Export manifest (stub adapter)`,
-        `target: ${input.target}`,
-        `storageDir: ${input.storageDir}`,
-        `files: ${files.length}`,
-        ``,
-        ...files.map((f) => `${String(f.size).padStart(10)}  ${f.path}`),
-      ];
-      return { filename: "manifest.txt", content: Buffer.from(lines.join("\n"), "utf8") };
-    },
-  };
-}
-
-// v1 stub 产物存储(进程内存,重启即失;生产替换为持久存储)。
-const artifacts = new Map<string, ExportArtifact>();
-
-export interface ExportDeps extends FileDeps {
-  readonly adapters: readonly ExportAdapter[];
-}
-
-export interface ExportJobDto {
-  readonly id: string;
-  readonly nodeId: string;
-  readonly target: string;
-  readonly status: "QUEUED" | "RUNNING" | "DONE" | "FAILED";
-  readonly error: string | null;
-  readonly createdAt: Date;
-}
-
-/** 提交导出(需 VIEW):建行(QUEUED)+ export.run 审计,同事务;异步执行。 */
-export async function submitExport(
-  deps: ExportDeps,
-  actor: FileLibActor,
-  projectId: string,
-  target: string,
-  params: Record<string, unknown>,
-): Promise<ExportJobDto> {
-  const { node } = await deps.prisma.$transaction(async (tx) =>
-    requireAccessInTx(tx, deps, actor, projectId, "VIEW"),
-  );
-  if (node.kind !== "PROJECT") {
-    throw new FileLibError(400, "invalid_node_kind", "export applies to projects only");
-  }
-  const adapter = deps.adapters.find((a) => a.target === target);
-  if (adapter === undefined) {
-    throw new FileLibError(400, "unknown_target", `no export adapter for target "${target}"`);
-  }
-  if (node.storageDir === null) {
-    throw new FileLibError(409, "project_not_ready", "project repository is not ready");
-  }
-
-  const jobId = randomUUID();
-  const job = await deps.prisma.$transaction(async (tx) => {
-    const created = await tx.fileLibExportJob.create({
-      data: {
-        id: jobId,
-        organizationId: deps.organizationId,
-        nodeId: node.id,
-        target,
-        params: params as never,
-        status: "QUEUED",
-        createdByUserId: actor.userId,
-      },
-    });
-    await writeFileLibAudit(tx, {
-      action: FILE_LIB_AUDIT_ACTIONS.exportRun,
-      actorUserId: actor.userId,
-      organizationId: deps.organizationId,
-      objectType: "export_job",
-      objectId: jobId,
-      objectPath: node.pathIds,
-      detail: { target, params },
-    });
-    return created;
-  });
-
-  const storageDir = node.storageDir;
-  setImmediate(() => {
-    void runExportJob(deps, adapter, jobId, storageDir, target, params).catch(() => undefined);
-  });
-  return toDto(job);
-}
-
-async function runExportJob(
-  deps: ExportDeps,
-  adapter: ExportAdapter,
-  jobId: string,
-  storageDir: string,
-  target: string,
-  params: Record<string, unknown>,
-): Promise<void> {
-  await deps.prisma.fileLibExportJob.update({ where: { id: jobId }, data: { status: "RUNNING" } });
-  try {
-    const artifact = await adapter.run({
-      storageDir,
-      target,
-      params,
-      listFiles: (prefix) => deps.versionStore.list(storageDir, prefix),
-      readFile: (path) => deps.versionStore.read(storageDir, path),
-    });
-    artifacts.set(jobId, artifact);
-    await deps.prisma.fileLibExportJob.update({
-      where: { id: jobId },
-      data: { status: "DONE", downloadUrl: `/database/api/exports/${jobId}/download` },
-    });
-  } catch (error) {
-    await deps.prisma.fileLibExportJob.update({
-      where: { id: jobId },
-      data: { status: "FAILED", error: String(error) },
-    });
-  }
-}
-
-export async function getExportJob(
-  deps: ExportDeps,
-  actor: FileLibActor,
-  jobId: string,
-): Promise<ExportJobDto> {
-  const job = await deps.prisma.fileLibExportJob.findFirst({
-    where: { id: jobId, organizationId: deps.organizationId },
-  });
-  if (job === null) throw new FileLibError(404, "export_not_found", "export job not found");
-  // D8:对源项目无 View → 404(不泄露 job 存在性)。
-  await deps.prisma.$transaction(async (tx) => requireAccessInTx(tx, deps, actor, job.nodeId, "VIEW"));
-  return toDto(job);
-}
-
-export async function downloadExport(
-  deps: ExportDeps,
-  actor: FileLibActor,
-  jobId: string,
-): Promise<ExportArtifact> {
-  await getExportJob(deps, actor, jobId);
-  const artifact = artifacts.get(jobId);
-  if (artifact === undefined) {
-    throw new FileLibError(409, "export_not_ready", "export artifact is not available");
-  }
-  return artifact;
-}
-
-function toDto(job: {
-  id: string;
-  nodeId: string;
-  target: string;
-  status: "QUEUED" | "RUNNING" | "DONE" | "FAILED";
-  error: string | null;
-  createdAt: Date;
-}): ExportJobDto {
-  return {
-    id: job.id,
-    nodeId: job.nodeId,
-    target: job.target,
-    status: job.status,
-    error: job.error,
-    createdAt: job.createdAt,
-  };
-}

hub/src/database/filelib/fileService.ts

@@ -1,275 +0,0 @@
-/**
- * 文件内容服务(Phase 3):路径安全 + 版本化文件操作 + 审计。
- *
- * 顺序铁律(Metis 风险#1 的落地):
- *  - 内容写:先 versionStore.commit(业务事实本体)→ 再 DB 事务(审计)。
- *    宁多一个无审计的版本,不造一条假审计。
- *  - conflict:写 file.conflict_detected(冲突本身就是事件),再抛 409。
- *  - 读:随取随读,不写审计(需求 5.2 未列读操作)。
- */
-
-import { FileLibError } from "./model.js";
-import { FILE_LIB_AUDIT_ACTIONS, writeFileLibAudit } from "./audit.js";
-import type { CommitResult, FileEntry, VersionInfo, VersionStore } from "./versionStore.js";
-import type { AccessDeps, FileLibActor } from "./treeService.js";
-import { requireAccessInTx } from "./treeService.js";
-import type { FileLibNode, PrismaClient } from "@prisma/client";
-
-export const FILE_PATH_MAX_LENGTH = 512;
-export const FILE_PATH_MAX_DEPTH = 32;
-export const FILE_CONTENT_MAX_BYTES = 10 * 1024 * 1024; // OPEN-5 初值
-
-const CONTROL_CHARS = /[\p{C}]/u;
-const FORBIDDEN_SEGMENTS = new Set(["", ".", "..", ".git"]);
-
-/**
- * 路径安全(Metis 安全红线):NFC;拒绝反斜杠、控制字符、空段、
- * "." / ".." / ".git" 段、绝对路径、超长/超深。返回规范化相对路径。
- */
-export function validateFilePath(raw: string): string {
-  const normalized = raw.normalize("NFC");
-  if (normalized.length === 0 || normalized.length > FILE_PATH_MAX_LENGTH) {
-    throw new FileLibError(400, "invalid_path", `path must be 1..${FILE_PATH_MAX_LENGTH} characters`);
-  }
-  if (normalized.includes("\\")) {
-    throw new FileLibError(400, "invalid_path", "path must use '/' separators");
-  }
-  if (CONTROL_CHARS.test(normalized)) {
-    throw new FileLibError(400, "invalid_path", "path must not contain control characters");
-  }
-  const segments = normalized.split("/");
-  if (segments.length > FILE_PATH_MAX_DEPTH) {
-    throw new FileLibError(400, "invalid_path", `path depth exceeds ${FILE_PATH_MAX_DEPTH}`);
-  }
-  for (const segment of segments) {
-    if (FORBIDDEN_SEGMENTS.has(segment)) {
-      throw new FileLibError(400, "invalid_path", `forbidden path segment: "${segment}"`);
-    }
-  }
-  return normalized;
-}
-
-export interface FileDeps extends AccessDeps {
-  readonly prisma: PrismaClient;
-  readonly versionStore: VersionStore;
-}
-
-type ProjectChain = { readonly node: FileLibNode; readonly storageDir: string };
-
-async function requireProject(
-  deps: FileDeps,
-  actor: FileLibActor,
-  projectId: string,
-  minRole: "VIEW" | "EDIT",
-): Promise<ProjectChain> {
-  const { node } = await deps.prisma.$transaction(async (tx) =>
-    requireAccessInTx(tx, deps, actor, projectId, minRole),
-  );
-  if (node.kind !== "PROJECT") {
-    throw new FileLibError(400, "invalid_node_kind", "file operations apply to projects only");
-  }
-  if (node.provisionStatus === "PROVISIONING") {
-    throw new FileLibError(409, "project_not_ready", "project repository is still provisioning");
-  }
-  if (node.provisionStatus === "FAILED") {
-    throw new FileLibError(409, "project_not_ready", "project repository provisioning failed");
-  }
-  if (node.storageDir === null) {
-    throw new FileLibError(500, "storage_missing", "project has no storage directory");
-  }
-  return { node, storageDir: node.storageDir };
-}
-
-export type FileContentEncoding = "utf8" | "base64";
-
-export interface FileContentDto {
-  readonly path: string;
-  readonly version: string;
-  readonly encoding: FileContentEncoding;
-  readonly content: string;
-  readonly size: number;
-}
-
-export function decodeContent(content: string, encoding: FileContentEncoding): string | Buffer {
-  return encoding === "base64" ? Buffer.from(content, "base64") : content;
-}
-
-function encodeContent(buffer: Buffer): { readonly encoding: FileContentEncoding; readonly content: string } {
-  // 粗判二进制:含 NUL 字节即按 base64 返回(需求 2.5 在线编辑仅针对文本)。
-  return buffer.includes(0)
-    ? { encoding: "base64", content: buffer.toString("base64") }
-    : { encoding: "utf8", content: buffer.toString("utf8") };
-}
-
-function checkSize(content: string | Buffer): void {
-  const bytes = typeof content === "string" ? Buffer.byteLength(content, "utf8") : content.byteLength;
-  if (bytes > FILE_CONTENT_MAX_BYTES) {
-    throw new FileLibError(413, "file_too_large", `file exceeds ${FILE_CONTENT_MAX_BYTES} bytes`);
-  }
-}
-
-async function auditFile(
-  deps: FileDeps,
-  actor: FileLibActor,
-  action: string,
-  project: ProjectChain,
-  filePath: string,
-  detail: Record<string, unknown>,
-): Promise<void> {
-  await deps.prisma.$transaction(async (tx) => {
-    await writeFileLibAudit(tx, {
-      action,
-      actorUserId: actor.userId,
-      organizationId: deps.organizationId,
-      objectType: "file",
-      objectId: project.node.id,
-      objectPath: `${project.node.pathIds}:${filePath}`,
-      detail,
-    });
-  });
-}
-
-/* ---------------------------------------------------------------- 读操作 */
-
-export async function listFiles(
-  deps: FileDeps,
-  actor: FileLibActor,
-  projectId: string,
-  prefix?: string,
-): Promise<readonly FileEntry[]> {
-  const project = await requireProject(deps, actor, projectId, "VIEW");
-  return deps.versionStore.list(project.storageDir, prefix === undefined ? undefined : validateFilePath(prefix));
-}
-
-export async function readFile(
-  deps: FileDeps,
-  actor: FileLibActor,
-  projectId: string,
-  rawPath: string,
-): Promise<FileContentDto> {
-  const filePath = validateFilePath(rawPath);
-  const project = await requireProject(deps, actor, projectId, "VIEW");
-  const [version, buffer] = await Promise.all([
-    deps.versionStore.head(project.storageDir, filePath),
-    deps.versionStore.read(project.storageDir, filePath),
-  ]);
-  const { encoding, content } = encodeContent(buffer);
-  return { path: filePath, version, encoding, content, size: buffer.byteLength };
-}
-
-/** 原始字节下载(浏览器 save-as 用):JSON 之外的第二条读取通道,同样的 VIEW 门禁。 */
-export async function readFileRaw(
-  deps: FileDeps,
-  actor: FileLibActor,
-  projectId: string,
-  rawPath: string,
-): Promise<{ readonly buffer: Buffer; readonly version: string; readonly filename: string }> {
-  const filePath = validateFilePath(rawPath);
-  const project = await requireProject(deps, actor, projectId, "VIEW");
-  const [version, buffer] = await Promise.all([
-    deps.versionStore.head(project.storageDir, filePath),
-    deps.versionStore.read(project.storageDir, filePath),
-  ]);
-  return { buffer, version, filename: filePath.split("/").pop() ?? "download" };
-}
-
-export async function fileHistory(
-  deps: FileDeps,
-  actor: FileLibActor,
-  projectId: string,
-  rawPath: string,
-  limit?: number,
-): Promise<readonly VersionInfo[]> {
-  const filePath = validateFilePath(rawPath);
-  const project = await requireProject(deps, actor, projectId, "VIEW");
-  return deps.versionStore.history(project.storageDir, filePath, limit);
-}
-
-export async function diffFile(
-  deps: FileDeps,
-  actor: FileLibActor,
-  projectId: string,
-  rawPath: string,
-  from: string,
-  to: string,
-): Promise<{ readonly diff: string }> {
-  const filePath = validateFilePath(rawPath);
-  const project = await requireProject(deps, actor, projectId, "VIEW");
-  return { diff: await deps.versionStore.diff(project.storageDir, filePath, from, to) };
-}
-
-/* ---------------------------------------------------------------- 写操作 */
-
-export interface CommitInput {
-  readonly path: string;
-  /** null = 新建(已存在则 409);编辑时传 readFile 拿到的 version。 */
-  readonly baseVersion: string | null;
-  readonly content: string;
-  readonly encoding?: FileContentEncoding | undefined;
-  readonly message?: string | undefined;
-}
-
-/**
- * 统一写入口(上传/编辑共用):先 commit,成功写 file.commit / file.upload 审计;
- * 冲突写 file.conflict_detected 后抛 409(details 带 currentVersion,编辑 UI 用它拉 diff)。
- */
-export async function commitFile(
-  deps: FileDeps,
-  actor: FileLibActor,
-  projectId: string,
-  input: CommitInput,
-): Promise<{ readonly version: string }> {
-  const filePath = validateFilePath(input.path);
-  const content = decodeContent(input.content, input.encoding ?? "utf8");
-  checkSize(content);
-  const project = await requireProject(deps, actor, projectId, "EDIT");
-
-  const result: CommitResult = await deps.versionStore.commit(project.storageDir, filePath, {
-    baseVersion: input.baseVersion,
-    content,
-    message: input.message,
-    author: actor.userId,
-  });
-
-  if (result.status === "conflict") {
-    await auditFile(deps, actor, FILE_LIB_AUDIT_ACTIONS.fileConflictDetected, project, filePath, {
-      baseVersion: input.baseVersion,
-      currentVersion: result.currentVersion,
-    });
-    throw new FileLibError(409, "version_conflict", "file was modified since baseVersion", {
-      currentVersion: result.currentVersion,
-    });
-  }
-
-  await auditFile(
-    deps,
-    actor,
-    input.baseVersion === null ? FILE_LIB_AUDIT_ACTIONS.fileUpload : FILE_LIB_AUDIT_ACTIONS.fileCommit,
-    project,
-    filePath,
-    { version: result.version, message: input.message ?? null },
-  );
-  return { version: result.version };
-}
-
-export async function deleteFile(
-  deps: FileDeps,
-  actor: FileLibActor,
-  projectId: string,
-  rawPath: string,
-  baseVersion: string,
-): Promise<void> {
-  const filePath = validateFilePath(rawPath);
-  const project = await requireProject(deps, actor, projectId, "EDIT");
-  const result = await deps.versionStore.remove(project.storageDir, filePath, baseVersion);
-  if (result.status === "conflict") {
-    await auditFile(deps, actor, FILE_LIB_AUDIT_ACTIONS.fileConflictDetected, project, filePath, {
-      baseVersion,
-      currentVersion: result.currentVersion,
-    });
-    throw new FileLibError(409, "version_conflict", "file was modified since baseVersion", {
-      currentVersion: result.currentVersion,
-    });
-  }
-  await auditFile(deps, actor, FILE_LIB_AUDIT_ACTIONS.fileDelete, project, filePath, { baseVersion });
-}

hub/src/database/filelib/grantService.ts

@@ -1,319 +0,0 @@
-/**
- * 授权管理(契约 8.1 矩阵的服务端强制)。
- *
- * 矩阵:
- *  - 创建者(creatorId 不可变):可授/改/收 MANAGE、EDIT、VIEW;自身 creator grant 不可动
- *  - MANAGE 持有者:可授/改/收 EDIT、VIEW;不可碰 MANAGE;不可动创建者
- *  - EDIT/VIEW:无授权能力(requireAccess MANAGE 已挡)
- *  - 网站管理员:走 forceAdjustGrants(不查节点权限,D19),全部留 admin.force_adjust 审计
- *
- * D8:目标节点不可见/无权限 → 404;有权限但矩阵禁止 → 403。
- */
-
-import { Prisma } from "@prisma/client";
-import type { FileLibGrant, FileLibNode, PrismaClient } from "@prisma/client";
-import { FileLibError, type FileLibRole } from "./model.js";
-import { FILE_LIB_AUDIT_ACTIONS, writeFileLibAudit } from "./audit.js";
-import {
-  requireAccessInTx,
-  type AccessDeps,
-  type FileLibActor,
-  type InitialGrant,
-} from "./treeService.js";
-
-export interface GrantDto {
-  readonly id: string;
-  readonly principalType: "USER" | "GROUP";
-  readonly principalId: string;
-  readonly role: FileLibRole;
-  readonly isCreatorGrant: boolean;
-  readonly createdAt: Date;
-}
-
-function toDto(grant: FileLibGrant): GrantDto {
-  return {
-    id: grant.id,
-    principalType: grant.principalType,
-    principalId: grant.principalId,
-    role: grant.role,
-    isCreatorGrant: grant.isCreatorGrant,
-    createdAt: grant.createdAt,
-  };
-}
-
-type Tx = Prisma.TransactionClient;
-type Deps = AccessDeps & { readonly prisma: PrismaClient };
-
-/** MANAGE 门禁:带 tx 时用调用方事务(与后续写同绳),不带时自开一个。 */
-async function requireManage(
-  deps: Deps,
-  actor: FileLibActor,
-  nodeId: string,
-  tx?: Tx,
-): Promise<{ readonly node: FileLibNode; readonly role: FileLibRole }> {
-  if (tx !== undefined) return requireAccessInTx(tx, deps, actor, nodeId, "MANAGE");
-  return deps.prisma.$transaction(async (inner) => requireAccessInTx(inner, deps, actor, nodeId, "MANAGE"));
-}
-
-/** 列出节点活跃授权(需 MANAGE)。 */
-export async function listGrants(
-  deps: Deps,
-  actor: FileLibActor,
-  nodeId: string,
-): Promise<readonly GrantDto[]> {
-  await requireManage(deps, actor, nodeId);
-  const grants = await deps.prisma.fileLibGrant.findMany({
-    where: { organizationId: deps.organizationId, nodeId, revokedAt: null },
-    orderBy: [{ isCreatorGrant: "desc" }, { createdAt: "asc" }],
-  });
-  return grants.map(toDto);
-}
-
-export interface PutGrantsResult {
-  readonly granted: number;
-  readonly updated: number;
-  readonly grants: readonly GrantDto[];
-}
-
-/**
- * 批量授予/修改(upsert 语义):同 principal 已有活跃授权 → 改级别(permission.update);
- * 没有 → 新建(permission.grant)。8.1 矩阵在写之前整体校验。
- */
-export async function putGrants(
-  deps: Deps,
-  actor: FileLibActor,
-  nodeId: string,
-  items: readonly InitialGrant[],
-): Promise<PutGrantsResult> {
-  validateGrantItems(items);
-  return deps.prisma.$transaction(async (tx) => {
-    const { node } = await requireManage(deps, actor, nodeId, tx);
-    const isCreator = node.creatorId === actor.userId;
-    for (const item of items) {
-      if (item.role === "MANAGE" && !isCreator) {
-        throw new FileLibError(403, "only_creator_can_grant_manage", "only the creator can grant MANAGE");
-      }
-      if (item.principalType === "USER" && item.principalId === node.creatorId) {
-        throw new FileLibError(403, "cannot_touch_creator", "the creator's grant is immutable");
-      }
-    }
-
-    let granted = 0;
-    let updated = 0;
-    for (const item of items) {
-      const existing = await tx.fileLibGrant.findFirst({
-        where: {
-          nodeId: node.id,
-          principalType: item.principalType,
-          principalId: item.principalId,
-          revokedAt: null,
-        },
-      });
-      if (existing !== null) {
-        if (existing.isCreatorGrant) {
-          throw new FileLibError(403, "cannot_touch_creator", "the creator's grant is immutable");
-        }
-        if (existing.role !== item.role) {
-          await tx.fileLibGrant.update({ where: { id: existing.id }, data: { role: item.role } });
-          updated += 1;
-          await audit(tx, deps, actor, FILE_LIB_AUDIT_ACTIONS.permissionUpdate, node.id, node.pathIds, { ...item });
-        }
-      } else {
-        await tx.fileLibGrant.create({
-          data: {
-            organizationId: deps.organizationId,
-            nodeId: node.id,
-            principalType: item.principalType,
-            principalId: item.principalId,
-            role: item.role,
-            createdByUserId: actor.userId,
-          },
-        });
-        granted += 1;
-        await audit(tx, deps, actor, FILE_LIB_AUDIT_ACTIONS.permissionGrant, node.id, node.pathIds, { ...item });
-      }
-    }
-    const grants = await tx.fileLibGrant.findMany({
-      where: { organizationId: deps.organizationId, nodeId: node.id, revokedAt: null },
-      orderBy: [{ isCreatorGrant: "desc" }, { createdAt: "asc" }],
-    });
-    return { granted, updated, grants: grants.map(toDto) };
-  });
-}
-
-/** 收回授权(需 MANAGE;creator grant 与 MANAGE grant 有额外限制,见 8.1)。 */
-export async function revokeGrant(
-  deps: Deps,
-  actor: FileLibActor,
-  nodeId: string,
-  grantId: string,
-): Promise<void> {
-  await deps.prisma.$transaction(async (tx) => {
-    const { node } = await requireManage(deps, actor, nodeId, tx);
-    const grant = await tx.fileLibGrant.findFirst({
-      where: { id: grantId, nodeId: node.id, revokedAt: null },
-    });
-    if (grant === null) throw new FileLibError(404, "grant_not_found", "grant not found");
-    if (grant.isCreatorGrant) {
-      throw new FileLibError(403, "cannot_touch_creator", "the creator's grant is immutable");
-    }
-    if (grant.role === "MANAGE" && node.creatorId !== actor.userId) {
-      throw new FileLibError(403, "only_creator_can_revoke_manage", "only the creator can revoke MANAGE");
-    }
-    await tx.fileLibGrant.update({ where: { id: grant.id }, data: { revokedAt: new Date() } });
-    await audit(tx, deps, actor, FILE_LIB_AUDIT_ACTIONS.permissionRevoke, node.id, node.pathIds, {
-      principalType: grant.principalType,
-      principalId: grant.principalId,
-      role: grant.role,
-    });
-  });
-}
-
-/**
- * 网站管理员强制调整(D19):凭 node id 操作,不查操作者节点权限;矩阵豁免;
- * 每一条变更都落 admin.force_adjust 审计(高危留痕)。
- */
-export async function forceAdjustGrants(
-  deps: Deps,
-  actor: FileLibActor,
-  nodeId: string,
-  items: readonly InitialGrant[],
-): Promise<PutGrantsResult> {
-  if (!actor.isWebsiteAdmin) {
-    throw new FileLibError(403, "forbidden", "force adjust requires website administrator");
-  }
-  validateGrantItems(items);
-  return deps.prisma.$transaction(async (tx) => {
-    const node = await tx.fileLibNode.findFirst({
-      where: { id: nodeId, organizationId: deps.organizationId, deletedAt: null },
-    });
-    if (node === null) throw new FileLibError(404, "node_not_found", "node not found");
-
-    let granted = 0;
-    let updated = 0;
-    for (const item of items) {
-      const existing = await tx.fileLibGrant.findFirst({
-        where: {
-          nodeId: node.id,
-          principalType: item.principalType,
-          principalId: item.principalId,
-          revokedAt: null,
-        },
-      });
-      if (existing !== null) {
-        if (existing.role !== item.role) {
-          await tx.fileLibGrant.update({ where: { id: existing.id }, data: { role: item.role } });
-          updated += 1;
-          await audit(tx, deps, actor, FILE_LIB_AUDIT_ACTIONS.adminForceAdjust, node.id, node.pathIds, {
-            change: "update",
-            principalType: item.principalType,
-            principalId: item.principalId,
-            from: existing.role,
-            to: item.role,
-          });
-        }
-      } else {
-        await tx.fileLibGrant.create({
-          data: {
-            organizationId: deps.organizationId,
-            nodeId: node.id,
-            principalType: item.principalType,
-            principalId: item.principalId,
-            role: item.role,
-            createdByUserId: actor.userId,
-          },
-        });
-        granted += 1;
-        await audit(tx, deps, actor, FILE_LIB_AUDIT_ACTIONS.adminForceAdjust, node.id, node.pathIds, {
-          change: "grant",
-          principalType: item.principalType,
-          principalId: item.principalId,
-          role: item.role,
-        });
-      }
-    }
-    const grants = await tx.fileLibGrant.findMany({
-      where: { organizationId: deps.organizationId, nodeId: node.id, revokedAt: null },
-      orderBy: [{ isCreatorGrant: "desc" }, { createdAt: "asc" }],
-    });
-    return { granted, updated, grants: grants.map(toDto) };
-  });
-}
-
-/** 项目独立权限开关(P5/D11):需 MANAGE;状态不变则空操作。 */
-export async function setIndependentPermission(
-  deps: Deps,
-  actor: FileLibActor,
-  nodeId: string,
-  enabled: boolean,
-): Promise<{ readonly enabled: boolean }> {
-  return deps.prisma.$transaction(async (tx) => {
-    const { node } = await requireManage(deps, actor, nodeId, tx);
-    if (node.kind !== "PROJECT") {
-      throw new FileLibError(400, "invalid_node_kind", "independent permission applies to projects only");
-    }
-    const current = await tx.fileLibProjectSettings.findUnique({
-      where: { nodeId: node.id },
-      select: { independentPermissionsEnabled: true },
-    });
-    if ((current?.independentPermissionsEnabled ?? false) === enabled) {
-      return { enabled }; // 状态未变:空操作,不产生审计
-    }
-    await tx.fileLibProjectSettings.upsert({
-      where: { nodeId: node.id },
-      update: { independentPermissionsEnabled: enabled },
-      create: { nodeId: node.id, independentPermissionsEnabled: enabled },
-    });
-    await writeFileLibAudit(tx, {
-      action: enabled
-        ? FILE_LIB_AUDIT_ACTIONS.independentEnable
-        : FILE_LIB_AUDIT_ACTIONS.independentDisable,
-      actorUserId: actor.userId,
-      organizationId: deps.organizationId,
-      objectType: "project",
-      objectId: node.id,
-      objectPath: node.pathIds,
-      detail: { enabled },
-    });
-    return { enabled };
-  });
-}
-
-function validateGrantItems(items: readonly InitialGrant[]): void {
-  if (items.length === 0) throw new FileLibError(400, "invalid_request", "grants must not be empty");
-  const seen = new Set<string>();
-  for (const item of items) {
-    if (item.principalType !== "USER" && item.principalType !== "GROUP") {
-      throw new FileLibError(400, "invalid_request", `bad principalType: ${String(item.principalType)}`);
-    }
-    if (item.role !== "VIEW" && item.role !== "EDIT" && item.role !== "MANAGE") {
-      throw new FileLibError(400, "invalid_request", `bad role: ${String(item.role)}`);
-    }
-    if (item.principalId.trim() === "") {
-      throw new FileLibError(400, "invalid_request", "principalId must not be empty");
-    }
-    const key = `${item.principalType}:${item.principalId}`;
-    if (seen.has(key)) throw new FileLibError(400, "duplicate_principal", `duplicate principal: ${key}`);
-    seen.add(key);
-  }
-}
-
-async function audit(
-  tx: Prisma.TransactionClient,
-  deps: Deps,
-  actor: FileLibActor,
-  action: string,
-  nodeId: string,
-  pathIds: string,
-  detail: Record<string, unknown>,
-): Promise<void> {
-  await writeFileLibAudit(tx, {
-    action,
-    actorUserId: actor.userId,
-    organizationId: deps.organizationId,
-    objectType: "grant",
-    objectId: nodeId,
-    objectPath: pathIds,
-    detail,
-  });
-}

hub/src/database/filelib/groupResolver.ts

@@ -1,52 +0,0 @@
-/**
- * GroupResolver port(契约 C2)。
- *
- * 权限计算只依赖这一个查询:"用户 → 所属 Group(含全部祖先)"。
- * ADR-0028 起,默认实现是 in-hub 的 MemberGroup 闭包读取器
- * (`createMemberGroupResolver`,见 memberGroupResolver.ts);
- * `HUB_GROUP_SERVICE_URL` 配置后切外部 HTTP 实现(groupResolverHttp.ts)。
- * 调用方只依赖此 port,不换调用点。
- */
-
-import type { PrismaClient } from "@prisma/client";
-
-export interface GroupResolver {
-  resolveMemberGroupIds(userId: string): Promise<readonly string[]>;
-}
-
-/**
- * @deprecated ADR-0028:成员组已内置为 in-hub MemberGroup,默认 resolver 改为
- * `createMemberGroupResolver`。此扁平 Team 过渡实现不再接线,保留仅为历史参照
- * (以及潜在的迁移对照),新代码不要使用。
- *
- * 旧过渡实现:读 hub 既有 Team(org 内、扁平无嵌套 → "祖先即自身")。
- */
-export function createTeamGroupResolver(
-  prisma: PrismaClient,
-  organizationId: string,
-): GroupResolver {
-  return {
-    async resolveMemberGroupIds(userId) {
-      const memberships = await prisma.teamMembership.findMany({
-        where: {
-          userId,
-          revokedAt: null,
-          team: { organizationId, archivedAt: null },
-        },
-        select: { teamId: true },
-      });
-      return memberships.map((m) => m.teamId);
-    },
-  };
-}
-
-/** 单测 mock:静态 用户→组 映射。 */
-export function createStaticGroupResolver(
-  map: Readonly<Record<string, readonly string[]>>,
-): GroupResolver {
-  return {
-    async resolveMemberGroupIds(userId) {
-      return map[userId] ?? [];
-    },
-  };
-}

hub/src/database/filelib/groupResolverHttp.ts

@@ -1,49 +0,0 @@
-/**
- * GroupResolver 的 HTTP 实现(契约 C2,Group 团队服务到位后启用,
- * 经 HUB_GROUP_SERVICE_URL 配置)。
- *
- * 语义红线:
- *  - 失败 → FileLibError(503, group_unavailable)。依赖故障不是"无权限",
- *    绝不伪装成 404/403(计划 D13)。
- *  - 我方绝不自己推祖先:返回什么用什么,不在本地补逻辑。
- */
-
-import { FileLibError } from "./model.js";
-import type { GroupResolver } from "./groupResolver.js";
-
-export interface HttpGroupResolverConfig {
-  readonly baseUrl: string;
-  readonly timeoutMs?: number;
-  /** 测试可注入假 fetch;生产用全局 fetch。 */
-  readonly fetchFn?: typeof fetch;
-}
-
-export function createHttpGroupResolver(config: HttpGroupResolverConfig): GroupResolver {
-  const timeoutMs = config.timeoutMs ?? 2_000;
-  const fetchFn = config.fetchFn ?? fetch;
-  return {
-    async resolveMemberGroupIds(userId) {
-      const url = `${config.baseUrl.replace(/\/$/, "")}/groups/resolve-member-groups?userId=${encodeURIComponent(userId)}`;
-      let response: Response;
-      try {
-        response = await fetchFn(url, { signal: AbortSignal.timeout(timeoutMs) });
-      } catch (error) {
-        throw new FileLibError(503, "group_unavailable", `group service unreachable: ${String(error)}`);
-      }
-      if (!response.ok) {
-        throw new FileLibError(503, "group_unavailable", `group service returned ${response.status}`);
-      }
-      let body: unknown;
-      try {
-        body = await response.json();
-      } catch {
-        throw new FileLibError(503, "group_unavailable", "group service returned malformed JSON");
-      }
-      const groupIds = (body as { groupIds?: unknown }).groupIds;
-      if (!Array.isArray(groupIds) || groupIds.some((id) => typeof id !== "string")) {
-        throw new FileLibError(503, "group_unavailable", "group service returned malformed payload");
-      }
-      return groupIds as readonly string[];
-    },
-  };
-}

hub/src/database/filelib/guards.ts

@@ -1,47 +0,0 @@
-/**
- * 文件库 HTTP 门禁(契约 C4 的入驻适配)。
- *
- * 身份链:hub session(飞书 OAuth / dev bypass)→ silo org membership。
- * 网站管理员 = org 的 OWNER/ADMIN(D19:仅 root 创建与 force_adjust 特权,
- * 不给内容读旁路);普通成员 = 任何活跃 membership;非成员 = 403。
- */
-
-import type { FastifyReply, FastifyRequest } from "fastify";
-import type { OrganizationMemberRole, PrismaClient } from "@prisma/client";
-import { requireSession, sendError } from "../../admin/auth/guards.js";
-import type { FileLibActor } from "./treeService.js";
-
-export interface FileLibGuardDeps {
-  readonly prisma: PrismaClient;
-  readonly sessionSecret: string;
-  /** 文件库归属的 silo org(ADR-0020/0025)。 */
-  readonly organizationId: string;
-}
-
-const WEBSITE_ADMIN_ROLES: readonly OrganizationMemberRole[] = ["OWNER", "ADMIN"];
-
-/** 每个 /database/api/* 端点第一行调它;返回 null 时响应已发出,fail closed。 */
-export async function requireFileLibActor(
-  request: FastifyRequest,
-  reply: FastifyReply,
-  deps: FileLibGuardDeps,
-): Promise<FileLibActor | null> {
-  const auth = await requireSession(request, reply, {
-    prisma: deps.prisma,
-    sessionSecret: deps.sessionSecret,
-  });
-  if (auth === null) return null;
-
-  const membership = await deps.prisma.organizationMembership.findFirst({
-    where: { organizationId: deps.organizationId, userId: auth.user.id, revokedAt: null },
-    select: { role: true },
-  });
-  if (membership === null) {
-    await sendError(reply, 403, "forbidden", "not a member of this organization");
-    return null;
-  }
-  return {
-    userId: auth.user.id,
-    isWebsiteAdmin: WEBSITE_ADMIN_ROLES.includes(membership.role),
-  };
-}

hub/src/database/filelib/memberGroupResolver.ts

@@ -1,35 +0,0 @@
-/**
- * 默认 GroupResolver 实现:读 in-hub MemberGroup 闭包(ADR-0028)。
- *
- * resolveMemberGroupIds(user) = 用户**活跃直接组 ∪ 这些组的活跃祖先**,去重
- * (闭包 depth0 自身行令每个直接组也是自己的祖先)。等价于:授权放在组 G 上,
- * G 及其全部子孙的成员都命中(需求 3.2 权限沿树向下 → 解析沿树向上收集)。
- *
- * 实时、不缓存(契约 D4/G4):成员变更在下一次受保护请求即可见。
- * MemberGroup 全局(无 organizationId),解析不做 org scope。
- * 两条 Prisma 查询,不用裸 SQL(与 treeService 风格一致)。
- */
-
-import type { PrismaClient } from "@prisma/client";
-import type { GroupResolver } from "./groupResolver.js";
-
-export function createMemberGroupResolver(prisma: PrismaClient): GroupResolver {
-  return {
-    async resolveMemberGroupIds(userId) {
-      // 1) 活跃直接组:成员未撤销 + 组未归档。
-      const direct = await prisma.memberGroupMembership.findMany({
-        where: { userId, revokedAt: null, group: { archivedAt: null } },
-        select: { groupId: true },
-      });
-      if (direct.length === 0) return [];
-      const directIds = direct.map((m) => m.groupId);
-
-      // 2) 经闭包取活跃祖先(含 depth0 自身);祖先组须未归档。
-      const ancestors = await prisma.memberGroupClosure.findMany({
-        where: { descendantId: { in: directIds }, ancestor: { archivedAt: null } },
-        select: { ancestorId: true },
-      });
-      return [...new Set(ancestors.map((a) => a.ancestorId))];
-    },
-  };
-}

hub/src/database/filelib/memberGroupService.ts

@@ -1,607 +0,0 @@
-/**
- * 成员组(MemberGroup)管理服务(ADR-0028)。
- *
- * 语义锚定:
- *  - 全局主体:MemberGroup 无 organizationId,不做租户 scope;审计行挂 silo org
- *    (deps.organizationId)—— MemberGroup 无 orgId,审计沿用文件库 sink(决策4)。
- *  - 权限门禁:创建/删除/成员增删仅网站管理员(silo org OWNER/ADMIN);
- *    搜索(授权选择器)不限管理员 —— 选组授权是 Manage 持有者的能力(决策2)。
- *  - 软删除:archivedAt 打标;删组级联软删整棵子树(闭包 ancestorId=G);
- *    闭包/成员行保留,list/解析按 archivedAt 过滤(决策4)。
- *  - 闭包维护:仅 create —— 插 (G,G,0),再对 parent P 插
- *    (a.ancestorId, G, a.depth+1) for a in closure where descendantId=P。
- *    v1 不支持 reparent(决策5)。
- *
- * 与 hub Team 不同:成员是全局用户,不要求 org membership;按 userId 或
- * User.feishuOpenId(全局 @unique)解析。
- */
-
-import type { PrismaClient, Prisma } from "@prisma/client";
-import { FileLibError } from "./model.js";
-import type { FileLibActor } from "./treeService.js";
-import { FILE_LIB_AUDIT_ACTIONS, writeFileLibAudit } from "./audit.js";
-
-export interface MemberGroupServiceDeps {
-  readonly prisma: PrismaClient;
-  /** silo org id —— 仅用于审计归属(MemberGroup 全局无 orgId,决策4)。 */
-  readonly organizationId: string;
-}
-
-export interface MemberGroupDto {
-  readonly id: string;
-  readonly parentId: string | null;
-  readonly name: string;
-  readonly description: string | null;
-  /** 到根的边数(根 = 0);由闭包行数推导。 */
-  readonly depth: number;
-  readonly memberCount: number;
-  /** 软删标记(决策4)。null = 活跃;非 null = 已归档,不贡献任何权限。 */
-  readonly archivedAt: Date | null;
-}
-
-export interface MemberGroupMemberDto {
-  readonly userId: string;
-  readonly displayName: string;
-  readonly feishuOpenId: string;
-  readonly avatarUrl: string | null;
-  /** 加入本组时间(membership.createdAt),用于成员表排序/展示。 */
-  readonly joinedAt: Date;
-}
-
-/** 成员选择器候选(加成员弹窗搜索用)。 */
-export interface UserSearchResult {
-  readonly userId: string;
-  readonly displayName: string;
-  readonly feishuOpenId: string;
-  readonly avatarUrl: string | null;
-}
-
-export interface MemberGroupSearchResult {
-  readonly id: string;
-  readonly name: string;
-  /** 祖先链(根在前,自身在末),用 " / " 连接;无祖先时即自身名。 */
-  readonly breadcrumb: string;
-}
-
-export interface CreateMemberGroupInput {
-  readonly name: string;
-  readonly description?: string | undefined;
-  readonly parentId?: string | null | undefined;
-}
-
-export interface AddMemberInput {
-  readonly userId?: string | undefined;
-  readonly feishuOpenId?: string | undefined;
-}
-
-/** 改名/改描述(决策6)。字段缺省 = 不动;description 传空串 = 清空。 */
-export interface UpdateMemberGroupInput {
-  readonly name?: string | undefined;
-  readonly description?: string | undefined;
-}
-
-type Tx = Prisma.TransactionClient;
-
-/* ---------------------------------------------------------------- 内部工具 */
-
-/** 管理门禁:非网站管理员一律 403(决策2)。 */
-function requireAdmin(actor: FileLibActor): void {
-  if (!actor.isWebsiteAdmin) {
-    throw new FileLibError(403, "forbidden", "group management requires website administrator");
-  }
-}
-
-/** 组名校验(Group 域与节点域分开:轻量 trim/非空/长度,不套用节点命名规则)。 */
-function normalizeGroupName(raw: string): string {
-  const name = raw.trim();
-  if (name === "") throw new FileLibError(400, "invalid_request", "group name must not be empty");
-  if (name.length > 100) throw new FileLibError(400, "invalid_request", "group name too long (max 100)");
-  return name;
-}
-
-async function requireActiveGroup(
-  client: PrismaClient | Tx,
-  groupId: string,
-): Promise<{ readonly id: string; readonly name: string }> {
-  const group = await client.memberGroup.findFirst({
-    where: { id: groupId, archivedAt: null },
-    select: { id: true, name: true },
-  });
-  if (group === null) throw new FileLibError(404, "group_not_found", "group not found");
-  return group;
-}
-
-/** 全局用户解析:按 userId,或 User.feishuOpenId(全局 @unique)。不要求 org 成员。 */
-async function resolveUser(
-  tx: Tx,
-  input: AddMemberInput,
-): Promise<{
-  readonly id: string;
-  readonly displayName: string;
-  readonly feishuOpenId: string;
-  readonly avatarUrl: string | null;
-}> {
-  const select = { id: true, displayName: true, feishuOpenId: true, avatarUrl: true } as const;
-  if (input.userId !== undefined && input.userId !== "") {
-    const user = await tx.user.findUnique({ where: { id: input.userId }, select });
-    if (user === null) throw new FileLibError(404, "user_not_found", `user not found: ${input.userId}`);
-    return user;
-  }
-  if (input.feishuOpenId !== undefined && input.feishuOpenId !== "") {
-    const user = await tx.user.findUnique({
-      where: { feishuOpenId: input.feishuOpenId },
-      select,
-    });
-    if (user === null) throw new FileLibError(404, "user_not_found", `user not found: ${input.feishuOpenId}`);
-    return user;
-  }
-  throw new FileLibError(400, "invalid_request", "userId or feishuOpenId is required");
-}
-
-/* ---------------------------------------------------------------- 公共操作 */
-
-/**
- * 创建成员组(建根 / 建子)。仅网站管理员。事务内维护闭包。
- * parentId 给定时校验其活跃存在;闭包:插自身 depth0 + 继承 parent 的祖先。
- */
-export async function createMemberGroup(
-  deps: MemberGroupServiceDeps,
-  actor: FileLibActor,
-  input: CreateMemberGroupInput,
-): Promise<MemberGroupDto> {
-  requireAdmin(actor);
-  const name = normalizeGroupName(input.name);
-  const description = input.description?.trim() || null;
-  const parentId = input.parentId ?? null;
-
-  return deps.prisma.$transaction(async (tx) => {
-    let parentClosure: { ancestorId: string; depth: number }[] = [];
-    if (parentId !== null) {
-      const parent = await tx.memberGroup.findFirst({
-        where: { id: parentId, archivedAt: null },
-        select: { id: true },
-      });
-      if (parent === null) throw new FileLibError(404, "group_not_found", "parent group not found");
-      parentClosure = await tx.memberGroupClosure.findMany({
-        where: { descendantId: parentId },
-        select: { ancestorId: true, depth: true },
-      });
-    }
-
-    const group = await tx.memberGroup.create({
-      data: { name, parentId, ...(description !== null ? { description } : {}) },
-      select: { id: true, parentId: true, name: true, description: true },
-    });
-
-    // 闭包维护:自身 depth0,再继承 parent 的每个祖先(depth+1)。
-    await tx.memberGroupClosure.create({
-      data: { ancestorId: group.id, descendantId: group.id, depth: 0 },
-    });
-    if (parentClosure.length > 0) {
-      await tx.memberGroupClosure.createMany({
-        data: parentClosure.map((a) => ({
-          ancestorId: a.ancestorId,
-          descendantId: group.id,
-          depth: a.depth + 1,
-        })),
-      });
-    }
-    // parent 的闭包行数 = parent.depth + 1 = 新组 depth(闭包不变量)。
-    const depth = parentClosure.length;
-
-    await writeFileLibAudit(tx, {
-      action: FILE_LIB_AUDIT_ACTIONS.groupCreate,
-      actorUserId: actor.userId,
-      organizationId: deps.organizationId,
-      objectType: "group",
-      objectId: group.id,
-      objectPath: group.id,
-      detail: { name, parentId },
-    });
-
-    return {
-      id: group.id,
-      parentId: group.parentId,
-      name: group.name,
-      description: group.description,
-      depth,
-      memberCount: 0,
-      archivedAt: null,
-    };
-  });
-}
-
-/**
- * 改名 / 改描述(决策6)。仅网站管理员。**不动 parentId** —— reparent 仍属 v1
- * 范围外(决策5),闭包无需维护。字段缺省即不动;description 传 "" 清空。
- */
-export async function updateMemberGroup(
-  deps: MemberGroupServiceDeps,
-  actor: FileLibActor,
-  groupId: string,
-  input: UpdateMemberGroupInput,
-): Promise<MemberGroupDto> {
-  requireAdmin(actor);
-  if (input.name === undefined && input.description === undefined) {
-    throw new FileLibError(400, "invalid_request", "name or description is required");
-  }
-  const name = input.name === undefined ? undefined : normalizeGroupName(input.name);
-
-  return deps.prisma.$transaction(async (tx) => {
-    await requireActiveGroup(tx, groupId);
-    const group = await tx.memberGroup.update({
-      where: { id: groupId },
-      data: {
-        ...(name !== undefined ? { name } : {}),
-        ...(input.description !== undefined
-          ? { description: input.description.trim() || null }
-          : {}),
-      },
-      select: { id: true, parentId: true, name: true, description: true },
-    });
-
-    // depth 由闭包行数推导(与 listMemberGroups 同一不变量);update 不改闭包。
-    const closureCount = await tx.memberGroupClosure.count({ where: { descendantId: groupId } });
-    const memberCount = await tx.memberGroupMembership.count({
-      where: { groupId, revokedAt: null },
-    });
-
-    await writeFileLibAudit(tx, {
-      action: FILE_LIB_AUDIT_ACTIONS.groupUpdate,
-      actorUserId: actor.userId,
-      organizationId: deps.organizationId,
-      objectType: "group",
-      objectId: group.id,
-      objectPath: group.id,
-      detail: {
-        ...(name !== undefined ? { name } : {}),
-        ...(input.description !== undefined ? { description: group.description } : {}),
-      },
-    });
-
-    return {
-      id: group.id,
-      parentId: group.parentId,
-      name: group.name,
-      description: group.description,
-      depth: closureCount - 1,
-      memberCount,
-      archivedAt: null,   // requireActiveGroup 已保证是活跃组
-    };
-  });
-}
-
-/**
- * 软删除成员组:级联软删整棵子树(闭包 ancestorId=G 的全部活跃 descendant)。
- * 闭包/成员行保留;list/解析按 archivedAt 过滤,整支立即停止贡献权限。
- */
-export async function deleteMemberGroup(
-  deps: MemberGroupServiceDeps,
-  actor: FileLibActor,
-  groupId: string,
-): Promise<{ readonly archivedCount: number }> {
-  requireAdmin(actor);
-  return deps.prisma.$transaction(async (tx) => {
-    const group = await requireActiveGroup(tx, groupId);
-    const subtree = await tx.memberGroupClosure.findMany({
-      where: { ancestorId: groupId },
-      select: { descendantId: true },
-    });
-    const ids = subtree.map((r) => r.descendantId);
-    const now = new Date();
-    const result = await tx.memberGroup.updateMany({
-      where: { id: { in: ids }, archivedAt: null },
-      data: { archivedAt: now },
-    });
-    await writeFileLibAudit(tx, {
-      action: FILE_LIB_AUDIT_ACTIONS.groupDelete,
-      actorUserId: actor.userId,
-      organizationId: deps.organizationId,
-      objectType: "group",
-      objectId: group.id,
-      objectPath: group.id,
-      detail: { name: group.name, archivedCount: result.count },
-    });
-    return { archivedCount: result.count };
-  });
-}
-
-/**
- * 恢复(取消归档)。仅网站管理员。**与删除不对称**(决策7):
- *  - 删除级联整棵子树;恢复只恢复「该组 + 其全部已归档祖先」,**不动子树**。
- *  - 恢复祖先链是必须的:活跃组的祖先必须活跃,否则该组在树上无路径、
- *    depth 推导(闭包行数)与"祖先必活跃"的前提脱节。
- *  - 子树保持归档、仍可见(带标记),由管理员逐个决定是否恢复 —— 避免一次
- *    恢复意外把整支历史组全部重新授权。
- * 恢复即刻恢复该组贡献的权限(实时解析,不缓存)。
- */
-export async function restoreMemberGroup(
-  deps: MemberGroupServiceDeps,
-  actor: FileLibActor,
-  groupId: string,
-): Promise<{ readonly restoredCount: number }> {
-  requireAdmin(actor);
-  return deps.prisma.$transaction(async (tx) => {
-    const group = await tx.memberGroup.findUnique({
-      where: { id: groupId },
-      select: { id: true, name: true, archivedAt: true },
-    });
-    if (group === null) throw new FileLibError(404, "group_not_found", "group not found");
-    if (group.archivedAt === null) {
-      throw new FileLibError(409, "not_archived", "group is not archived");
-    }
-
-    // 自身 + 祖先(闭包 descendantId=G 含 depth0 自身),只挑已归档的解标。
-    const chain = await tx.memberGroupClosure.findMany({
-      where: { descendantId: groupId },
-      select: { ancestorId: true },
-    });
-    const ids = chain.map((r) => r.ancestorId);
-    const result = await tx.memberGroup.updateMany({
-      where: { id: { in: ids }, archivedAt: { not: null } },
-      data: { archivedAt: null },
-    });
-
-    await writeFileLibAudit(tx, {
-      action: FILE_LIB_AUDIT_ACTIONS.groupRestore,
-      actorUserId: actor.userId,
-      organizationId: deps.organizationId,
-      objectType: "group",
-      objectId: group.id,
-      objectPath: group.id,
-      detail: { name: group.name, restoredCount: result.count },
-    });
-    return { restoredCount: result.count };
-  });
-}
-
-/**
- * 组扁平列表(前端自行按 parentId/depth 拼树);仅网站管理员。
- * includeArchived=true 时连已归档组一并返回(带 archivedAt 标记),供后台展示/恢复;
- * 默认只返回活跃组 —— 权限相关的调用方一律走默认。
- */
-export async function listMemberGroups(
-  deps: MemberGroupServiceDeps,
-  actor: FileLibActor,
-  includeArchived = false,
-): Promise<readonly MemberGroupDto[]> {
-  requireAdmin(actor);
-  const groups = await deps.prisma.memberGroup.findMany({
-    where: includeArchived ? {} : { archivedAt: null },
-    orderBy: { name: "asc" },
-    select: { id: true, parentId: true, name: true, description: true, archivedAt: true },
-  });
-  if (groups.length === 0) return [];
-  const ids = groups.map((g) => g.id);
-
-  // depth:每个组的闭包行数(自身 + 祖先)- 1。级联软删保证活跃组的祖先必活跃。
-  const closure = await deps.prisma.memberGroupClosure.findMany({
-    where: { descendantId: { in: ids } },
-    select: { descendantId: true },
-  });
-  const closureCount = new Map<string, number>();
-  for (const row of closure) {
-    closureCount.set(row.descendantId, (closureCount.get(row.descendantId) ?? 0) + 1);
-  }
-
-  const counts = await deps.prisma.memberGroupMembership.groupBy({
-    by: ["groupId"],
-    where: { groupId: { in: ids }, revokedAt: null },
-    _count: { _all: true },
-  });
-  const countByGroup = new Map(counts.map((c) => [c.groupId, c._count._all]));
-
-  return groups.map((g) => ({
-    id: g.id,
-    parentId: g.parentId,
-    name: g.name,
-    description: g.description,
-    depth: (closureCount.get(g.id) ?? 1) - 1,
-    memberCount: countByGroup.get(g.id) ?? 0,
-    archivedAt: g.archivedAt,
-  }));
-}
-
-/**
- * 组成员列表(仅网站管理员)。**已归档组也可读**(决策7):软删是打标,成员行仍在,
- * 后台需要看得见「这个组曾经有谁」。写操作(add/remove)仍要求活跃组 —— 可读不可改。
- */
-export async function listMembers(
-  deps: MemberGroupServiceDeps,
-  actor: FileLibActor,
-  groupId: string,
-): Promise<readonly MemberGroupMemberDto[]> {
-  requireAdmin(actor);
-  const exists = await deps.prisma.memberGroup.findUnique({
-    where: { id: groupId },
-    select: { id: true },
-  });
-  if (exists === null) throw new FileLibError(404, "group_not_found", "group not found");
-  const rows = await deps.prisma.memberGroupMembership.findMany({
-    where: { groupId, revokedAt: null },
-    select: {
-      createdAt: true,
-      user: { select: { id: true, displayName: true, feishuOpenId: true, avatarUrl: true } },
-    },
-    orderBy: { createdAt: "asc" },
-  });
-  return rows.map((r) => ({
-    userId: r.user.id,
-    displayName: r.user.displayName,
-    feishuOpenId: r.user.feishuOpenId,
-    avatarUrl: r.user.avatarUrl,
-    joinedAt: r.createdAt,
-  }));
-}
-
-/** 加成员(userId 或 feishuOpenId 解析);已是活跃成员 → 409。仅网站管理员。 */
-export async function addMember(
-  deps: MemberGroupServiceDeps,
-  actor: FileLibActor,
-  groupId: string,
-  input: AddMemberInput,
-): Promise<MemberGroupMemberDto> {
-  requireAdmin(actor);
-  return deps.prisma.$transaction(async (tx) => {
-    const group = await requireActiveGroup(tx, groupId);
-    const user = await resolveUser(tx, input);
-    const existing = await tx.memberGroupMembership.findFirst({
-      where: { groupId: group.id, userId: user.id, revokedAt: null },
-      select: { id: true },
-    });
-    if (existing !== null) {
-      throw new FileLibError(409, "already_member", "user is already a member of this group");
-    }
-    const created = await tx.memberGroupMembership.create({
-      data: { groupId: group.id, userId: user.id },
-      select: { createdAt: true },
-    });
-    await writeFileLibAudit(tx, {
-      action: FILE_LIB_AUDIT_ACTIONS.groupMemberAdd,
-      actorUserId: actor.userId,
-      organizationId: deps.organizationId,
-      objectType: "group",
-      objectId: group.id,
-      objectPath: group.id,
-      detail: { userId: user.id },
-    });
-    return {
-      userId: user.id,
-      displayName: user.displayName,
-      feishuOpenId: user.feishuOpenId,
-      avatarUrl: user.avatarUrl,
-      joinedAt: created.createdAt,
-    };
-  });
-}
-
-/** 移成员(软删 revokedAt);不在组 → 404。仅网站管理员。 */
-export async function removeMember(
-  deps: MemberGroupServiceDeps,
-  actor: FileLibActor,
-  groupId: string,
-  userId: string,
-): Promise<void> {
-  requireAdmin(actor);
-  await deps.prisma.$transaction(async (tx) => {
-    const group = await requireActiveGroup(tx, groupId);
-    const membership = await tx.memberGroupMembership.findFirst({
-      where: { groupId: group.id, userId, revokedAt: null },
-      select: { id: true },
-    });
-    if (membership === null) throw new FileLibError(404, "member_not_found", "group member not found");
-    await tx.memberGroupMembership.update({
-      where: { id: membership.id },
-      data: { revokedAt: new Date() },
-    });
-    await writeFileLibAudit(tx, {
-      action: FILE_LIB_AUDIT_ACTIONS.groupMemberRemove,
-      actorUserId: actor.userId,
-      organizationId: deps.organizationId,
-      objectType: "group",
-      objectId: group.id,
-      objectPath: group.id,
-      detail: { userId },
-    });
-  });
-}
-
-/**
- * 成员选择器:按显示名/openId 搜全局用户。**仅网站管理员**(与加成员同权,决策2)
- * —— 加成员本就能指定任意全局用户(resolveUser 不要求 org 成员),故此端点不扩大
- * 已有能力面,只是把"盲敲 id"变成"搜索选择"。
- * excludeGroupId 给定时,过滤掉该组的活跃成员(避免选中必然 409 的人)。
- */
-export async function searchUsers(
-  deps: MemberGroupServiceDeps,
-  actor: FileLibActor,
-  q: string,
-  excludeGroupId?: string,
-  limit = 20,
-): Promise<readonly UserSearchResult[]> {
-  requireAdmin(actor);
-  const keyword = q.trim();
-
-  let excludeIds: string[] = [];
-  if (excludeGroupId !== undefined && excludeGroupId !== "") {
-    const rows = await deps.prisma.memberGroupMembership.findMany({
-      where: { groupId: excludeGroupId, revokedAt: null },
-      select: { userId: true },
-    });
-    excludeIds = rows.map((r) => r.userId);
-  }
-
-  const users = await deps.prisma.user.findMany({
-    where: {
-      ...(excludeIds.length > 0 ? { id: { notIn: excludeIds } } : {}),
-      ...(keyword === ""
-        ? {}
-        : {
-            OR: [
-              { displayName: { contains: keyword, mode: "insensitive" as const } },
-              { feishuOpenId: { contains: keyword, mode: "insensitive" as const } },
-            ],
-          }),
-    },
-    take: limit,
-    orderBy: { displayName: "asc" },
-    select: { id: true, displayName: true, feishuOpenId: true, avatarUrl: true },
-  });
-
-  return users.map((u) => ({
-    userId: u.id,
-    displayName: u.displayName,
-    feishuOpenId: u.feishuOpenId,
-    avatarUrl: u.avatarUrl,
-  }));
-}
-
-/**
- * 授权选择器搜索(契约 C2 /groups/search)。**不限管理员**(决策2)。
- * 活跃组按名过滤,breadcrumb 由活跃祖先链按 depth 排序拼成。
- */
-export async function searchMemberGroups(
-  deps: MemberGroupServiceDeps,
-  q: string,
-  limit = 20,
-): Promise<readonly MemberGroupSearchResult[]> {
-  const keyword = q.trim();
-  const groups = await deps.prisma.memberGroup.findMany({
-    where: {
-      archivedAt: null,
-      ...(keyword === "" ? {} : { name: { contains: keyword, mode: "insensitive" as const } }),
-    },
-    take: limit,
-    orderBy: { name: "asc" },
-    select: { id: true, name: true },
-  });
-  if (groups.length === 0) return [];
-  const ids = groups.map((g) => g.id);
-
-  // 祖先链(仅活跃祖先);depth 越大越靠根。
-  const closure = await deps.prisma.memberGroupClosure.findMany({
-    where: { descendantId: { in: ids }, ancestor: { archivedAt: null } },
-    select: { descendantId: true, ancestorId: true, depth: true },
-  });
-  const ancestorIds = [...new Set(closure.map((c) => c.ancestorId))];
-  const names = await deps.prisma.memberGroup.findMany({
-    where: { id: { in: ancestorIds } },
-    select: { id: true, name: true },
-  });
-  const nameById = new Map(names.map((n) => [n.id, n.name]));
-  const chainByGroup = new Map<string, { ancestorId: string; depth: number }[]>();
-  for (const row of closure) {
-    const arr = chainByGroup.get(row.descendantId) ?? [];
-    arr.push({ ancestorId: row.ancestorId, depth: row.depth });
-    chainByGroup.set(row.descendantId, arr);
-  }
-
-  return groups.map((g) => {
-    const chain = (chainByGroup.get(g.id) ?? []).slice().sort((a, b) => b.depth - a.depth);
-    const breadcrumb = chain
-      .map((c) => nameById.get(c.ancestorId) ?? "")
-      .filter((s) => s !== "")
-      .join(" / ");
-    return { id: g.id, name: g.name, breadcrumb: breadcrumb || g.name };
-  });
-}

hub/src/database/filelib/model.ts

@@ -1,59 +0,0 @@
-/**
- * 文件库领域基础:角色秩、命名规则(D14)、错误类型。
- *
- * 语义锚定:仓库根《文件库-接口契约.md》(2.2 权限等级 / D8 可见性 / D14 命名)
- * 与 .omo/文件库-开工计划.md。本模块是独立文件库,不复用 hub 的
- * Folder/Project/PermissionGrant 体系。
- */
-
-export const FILE_LIB_ROLES = ["VIEW", "EDIT", "MANAGE"] as const;
-export type FileLibRole = (typeof FILE_LIB_ROLES)[number];
-
-/** 契约 2.2:MANAGE > EDIT > VIEW,严格全序。 */
-export const ROLE_RANK: Record<FileLibRole, number> = { VIEW: 1, EDIT: 2, MANAGE: 3 };
-
-export function roleAtLeast(role: FileLibRole, min: FileLibRole): boolean {
-  return ROLE_RANK[role] >= ROLE_RANK[min];
-}
-
-/** 业务错误。statusCode 由路由层映射为 HTTP 响应(D8 语义在此层只表达为 code)。 */
-export class FileLibError extends Error {
-  constructor(
-    readonly statusCode: number,
-    readonly code: string,
-    message: string,
-    /** 结构化附加信息(如 409 时的 currentVersion),路由层并入错误响应。 */
-    readonly details?: Record<string, unknown>,
-  ) {
-    super(message);
-    this.name = "FileLibError";
-  }
-}
-
-export const NODE_NAME_MAX_LENGTH = 128;
-
-/** D14:禁 `/`;反斜杠同样禁止(它会变成存储路径的分隔符,且易用于伪装)。控制字符禁。 */
-const FORBIDDEN_NAME_CHARS = /[/\\\p{C}]/u;
-
-/**
- * D14:NFC 归一化 + trim,然后校验长度与字符集。
- * 违规抛 FileLibError(400, "invalid_name"),路由层原样透传。
- */
-export function normalizeNodeName(raw: string): string {
-  const name = raw.normalize("NFC").trim();
-  if (name.length === 0) {
-    throw new FileLibError(400, "invalid_name", "name must not be empty");
-  }
-  if (name.length > NODE_NAME_MAX_LENGTH) {
-    throw new FileLibError(400, "invalid_name", `name exceeds ${NODE_NAME_MAX_LENGTH} characters`);
-  }
-  if (FORBIDDEN_NAME_CHARS.test(name)) {
-    throw new FileLibError(400, "invalid_name", "name must not contain '/', '\\' or control characters");
-  }
-  return name;
-}
-
-/** D14:活跃兄弟节点大小写不敏感唯一的比较键(DB 层另有部分唯一索引兜底)。 */
-export function nameKey(normalizedName: string): string {
-  return normalizedName.toLowerCase();
-}

hub/src/database/filelib/permission.ts

@@ -1,74 +0,0 @@
-/**
- * 纯权限 reducer(契约 P6 / D11 / D8)。
- *
- * 设计约束(Metis 评审):本文件是纯函数层 —— 输入是"已解析好的" grant、祖先链
- * 与用户组集合,不碰 DB / 网络。数据获取在 treeService。这样权限代数可以脱离
- * 存储做密集单测与随机化不变量测试。
- */
-
-import type { FileLibRole } from "./model.js";
-import { ROLE_RANK } from "./model.js";
-
-export interface FileLibGrantFact {
-  readonly nodeId: string;
-  readonly principalType: "USER" | "GROUP";
-  readonly principalId: string;
-  readonly role: FileLibRole;
-  readonly isCreatorGrant: boolean;
-}
-
-export interface EffectiveRoleInput {
-  /** 目标节点(self)。 */
-  readonly nodeId: string;
-  readonly nodeKind: "FOLDER" | "PROJECT";
-  /** 目标的全部祖先 id(不含 self,顺序无关)。 */
-  readonly ancestorIds: readonly string[];
-  /** 项目独立权限开关(D11/P5);文件夹忽略此值。 */
-  readonly independentPermissionsEnabled: boolean;
-  readonly userId: string;
-  /** C2 resolve 结果:用户直接所属 + 全部祖先 group 的 id 集合。 */
-  readonly groupIds: readonly string[];
-  /** self ∪ ancestors 上的全部活跃 grant(revokedAt 已由获取层过滤)。 */
-  readonly grants: readonly FileLibGrantFact[];
-}
-
-/**
- * 契约 P6:effective(user, R) = max { grant.role | s ∈ {user} ∪ groups*(user),
- * r ∈ {R} ∪ ancestors(R) };无匹配 → null(无任何权限)。
- * "个人权限不能降权"在 max 语义下天然成立 —— 只取最高,不做减法。
- *
- * D11:目标为 PROJECT 且独立权限关闭时,项目级(挂在 self 上)非创建者 grant
- * 冻结不参与计算;创建者的自动 grant(isCreatorGrant)始终生效。祖先链上的
- * grant 不受开关影响。
- */
-export function effectiveRole(input: EffectiveRoleInput): FileLibRole | null {
-  const onChain = new Set<string>([input.nodeId, ...input.ancestorIds]);
-  const groups = new Set(input.groupIds);
-  const freezeProjectGrants =
-    input.nodeKind === "PROJECT" && !input.independentPermissionsEnabled;
-
-  let best: FileLibRole | null = null;
-  for (const grant of input.grants) {
-    if (!onChain.has(grant.nodeId)) continue;
-    if (freezeProjectGrants && grant.nodeId === input.nodeId && !grant.isCreatorGrant) continue;
-    if (grant.principalType === "USER" && grant.principalId !== input.userId) continue;
-    if (grant.principalType === "GROUP" && !groups.has(grant.principalId)) continue;
-    if (best === null || ROLE_RANK[grant.role] > ROLE_RANK[best]) best = grant.role;
-  }
-  return best;
-}
-
-/**
- * D8 可见性语义:
- *  - 完全无权限(effective === null)→ "not_found"(路由层映射 404,不泄露存在性);
- *  - 有权限但不足 → "forbidden"(路由层映射 403)。
- */
-export type AccessVerdict =
-  | { readonly allowed: true; readonly role: FileLibRole }
-  | { readonly allowed: false; readonly reason: "not_found" | "forbidden" };
-
-export function checkAccess(effective: FileLibRole | null, min: FileLibRole): AccessVerdict {
-  if (effective === null) return { allowed: false, reason: "not_found" };
-  if (ROLE_RANK[effective] < ROLE_RANK[min]) return { allowed: false, reason: "forbidden" };
-  return { allowed: true, role: effective };
-}

hub/src/database/filelib/routeShared.ts

@@ -1,89 +0,0 @@
-/**
- * /database/api/* 路由共享件:依赖装配、actor 门禁、统一错误映射。
- * 约定(与 admin 面一致):绝对路径;guard 前置 fail closed;查询 scope 到 silo org。
- */
-
-import type { FastifyReply, FastifyRequest } from "fastify";
-import { Prisma } from "@prisma/client";
-import type { PrismaClient } from "@prisma/client";
-import { FileLibError } from "./model.js";
-import { requireFileLibActor } from "./guards.js";
-import type { FileLibActor, TreeServiceDeps } from "./treeService.js";
-import type { GroupResolver } from "./groupResolver.js";
-import type { VersionStore } from "./versionStore.js";
-import type { ExportAdapter } from "./exportService.js";
-
-export interface FileLibRouteDeps {
-  readonly prisma: PrismaClient;
-  readonly sessionSecret: string;
-  readonly organizationId: string;
-  readonly storageRoot: string;
-  readonly groupResolver: GroupResolver;
-  readonly versionStore: VersionStore;
-  readonly exportAdapters: readonly ExportAdapter[];
-}
-
-/** 组装 treeService 依赖(路由处理内直接使用)。 */
-export function treeDeps(deps: FileLibRouteDeps): TreeServiceDeps {
-  return {
-    prisma: deps.prisma,
-    groupResolver: deps.groupResolver,
-    versionStore: deps.versionStore,
-    organizationId: deps.organizationId,
-    storageRoot: deps.storageRoot,
-  };
-}
-
-/** 端点第一行调用;null = 响应已发(401/403),fail closed。 */
-export async function actorOrNull(
-  request: FastifyRequest,
-  reply: FastifyReply,
-  deps: FileLibRouteDeps,
-): Promise<FileLibActor | null> {
-  return requireFileLibActor(request, reply, {
-    prisma: deps.prisma,
-    sessionSecret: deps.sessionSecret,
-    organizationId: deps.organizationId,
-  });
-}
-
-/** 统一错误出口:FileLibError → 语义码;P2002 → 409;其余 → 500(不泄露内部)。 */
-export async function sendRouteError(reply: FastifyReply, error: unknown): Promise<void> {
-  if (error instanceof FileLibError) {
-    await reply.status(error.statusCode).send({
-      error: { code: error.code, message: error.message, ...(error.details ?? {}) },
-    });
-    return;
-  }
-  if (error instanceof Prisma.PrismaClientKnownRequestError && error.code === "P2002") {
-    await reply.status(409).send({ error: { code: "conflict", message: "uniqueness conflict" } });
-    return;
-  }
-  reply.log.error({ err: error }, "filelib route: unexpected error");
-  await reply.status(500).send({ error: { code: "internal", message: "internal error" } });
-}
-
-/** 请求体轻量校验(抛 FileLibError 400)。 */
-export function bodyObject(body: unknown): Record<string, unknown> {
-  if (typeof body !== "object" || body === null || Array.isArray(body)) {
-    throw new FileLibError(400, "invalid_request", "request body must be a JSON object");
-  }
-  return body as Record<string, unknown>;
-}
-
-export function requireString(obj: Record<string, unknown>, key: string): string {
-  const value = obj[key];
-  if (typeof value !== "string" || value === "") {
-    throw new FileLibError(400, "invalid_request", `missing or invalid field: ${key}`);
-  }
-  return value;
-}
-
-export function optionalString(obj: Record<string, unknown>, key: string): string | undefined {
-  const value = obj[key];
-  if (value === undefined || value === null) return undefined;
-  if (typeof value !== "string") {
-    throw new FileLibError(400, "invalid_request", `invalid field: ${key}`);
-  }
-  return value;
-}