feat(hub): add SearchableSelectField component and update RoleCard to use it

Add a shared transparent OrganizationAgentConfigFolder tree for grouping
agent roles and skills in the admin UI without affecting identity, bindings,
run loading, or slash commands.

.gitea/workflows/checker-check.yml

@@ -1,12 +1,12 @@
 name: checker check
 
 # Builds and lints the Rust implementation crates under crates/ (the rule-based
-# lesson checker).
+# checker that "stands in Lean's position" at product runtime).
 #
-# This is an INTERNAL gate on the implementation's own health
+# Like spec-check, this is an INTERNAL gate on the implementation's own health
-# (does it build, pass its tests, satisfy clippy + rustfmt?). There is no
+# (does it build, pass its tests, satisfy clippy + rustfmt?). It is NOT a
-# decision-to-implementation conformance gate — implementations align to the
+# spec-to-implementation conformance gate — implementations align to the Lean
-# ADRs by human review, not by CI. See the repo README.
+# contract by human review, not by CI. See the repo README.
 
 on:
   push:

.gitea/workflows/hub-check.yml

@@ -1,8 +1,8 @@
 name: hub check
 
 # Builds, type-checks, and tests the Hub TS package under hub/.
-# The Hub is the Feishu-group collaboration + agent runtime half.
+# The Hub is the Feishu-group collaboration + agent runtime half
-# This is an INTERNAL gate on the Hub's own
+# (spec/System implementation). This is an INTERNAL gate on the Hub's own
 # health, like checker-check is for the Rust half.
 
 on:

.gitea/workflows/spec-check.yml

@@ -0,0 +1,20 @@
+name: spec check
+
+# Builds the Lean semantic master spec under spec/.
+# This is an INTERNAL well-formedness gate (does the contract type-check?),
+# NOT a spec-to-implementation conformance gate — implementations align to the
+# contract by human review, not by CI. See repo README.
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  spec-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: leanprover/lean-action@v1
+        with:
+          lake-package-directory: spec

.gitignore

@@ -1,3 +1,7 @@
+# Lean / Lake build artifacts (spec/ has its own .gitignore too)
+.lake/
+**/.lake/
+
 # Rust / Cargo build artifacts (repo-wide cargo workspace at root)
 /target
 **/*.pdf

.omo/run-continuation/ses_0705f8afbffePWIq7GrFfwfFwV.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_0705f8afbffePWIq7GrFfwfFwV",
-  "updatedAt": "2026-07-23T15:40:15.630Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-23T15:40:15.630Z"
-    }
-  }
-}

.omo/run-continuation/ses_07252990dffeRFmXnvdyynty2z.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_07252990dffeRFmXnvdyynty2z",
-  "updatedAt": "2026-07-23T06:33:33.086Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-23T06:33:33.086Z"
-    }
-  }
-}

.omo/run-continuation/ses_075d214a0ffe6mU8VNgukUfH5L.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_075d214a0ffe6mU8VNgukUfH5L",
-  "updatedAt": "2026-07-22T14:15:01.741Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-22T14:15:01.741Z"
-    }
-  }
-}

.omo/run-continuation/ses_075d3282bffejz0HFE00taOaGM.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_075d3282bffejz0HFE00taOaGM",
-  "updatedAt": "2026-07-22T14:13:54.785Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-22T14:13:54.785Z"
-    }
-  }
-}

.omo/run-continuation/ses_0781484caffeKJHXVKiD4BqEJw.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_0781484caffeKJHXVKiD4BqEJw",
-  "updatedAt": "2026-07-22T06:17:18.238Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-22T06:17:18.238Z"
-    }
-  }
-}

.omo/run-continuation/ses_07b163c13ffeudULxSfIfK986T.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_07b163c13ffeudULxSfIfK986T",
-  "updatedAt": "2026-07-21T13:55:58.878Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-21T13:55:58.878Z"
-    }
-  }
-}

.omo/run-continuation/ses_07b1e6c8effeq7bdmj6NgO0LqC.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_07b1e6c8effeq7bdmj6NgO0LqC",
-  "updatedAt": "2026-07-21T13:38:01.132Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-21T13:38:01.132Z"
-    }
-  }
-}

.omo/run-continuation/ses_07b932dddffecSipFLwlJOvoJ9.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_07b932dddffecSipFLwlJOvoJ9",
-  "updatedAt": "2026-07-21T11:27:10.420Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-21T11:27:10.420Z"
-    }
-  }
-}

.omo/run-continuation/ses_07b9c4268ffeic4mMXCPUt225j.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_07b9c4268ffeic4mMXCPUt225j",
-  "updatedAt": "2026-07-21T11:18:53.449Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-21T11:18:53.449Z"
-    }
-  }
-}

.omo/run-continuation/ses_07b9c4346ffeVBdV5pf4h6s9PW.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_07b9c4346ffeVBdV5pf4h6s9PW",
-  "updatedAt": "2026-07-21T11:18:29.979Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-21T11:18:29.979Z"
-    }
-  }
-}

.omo/run-continuation/ses_07b9c9a75ffeOyJ4ewp3DBvXhz.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_07b9c9a75ffeOyJ4ewp3DBvXhz",
-  "updatedAt": "2026-07-21T11:21:09.776Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-21T11:21:09.776Z"
-    }
-  }
-}

.omo/run-continuation/ses_07cdbac0effeiBrdcHLUUUfwuF.json

@@ -1,10 +0,0 @@
-{
-  "sessionID": "ses_07cdbac0effeiBrdcHLUUUfwuF",
-  "updatedAt": "2026-07-23T15:37:59.918Z",
-  "sources": {
-    "background-task": {
-      "state": "idle",
-      "updatedAt": "2026-07-23T15:37:59.918Z"
-    }
-  }
-}

.omo/文件库-开工计划.md

@@ -1,114 +0,0 @@
-# 文件库 · 开工计划（v1.0）
-
-> 配套文档：《文件库-接口契约.md》(v0.1，仓库根目录)。本计划已吸收规划顾问评审意见，包含开工前必须先冻结的**架构收口决策 D11–D19**（回写契约 v0.2 时并入）。
-> 工期按 1 人全栈估算；前端从 Phase 2 后可并行。
-
-## 开工判定
-
-**可以开工。** 四个外部依赖（版本包 / Group / 审计 / 平台身份）全部有契约可依、可 mock 并行开发；无阻塞项。唯一前置：本文件的 D11–D19 决策在写第一行 schema 前过一遍（半天，自查即可，有异议再升级）。
-
-## 架构收口决策（新增，先冻结再动工）
-
-| 编号 | 决策 | 理由 |
-|---|---|---|
-| D11 | `creator` 是 Node 的**不可变列**，创建时同时落一条 Manage grant；独立权限开关关闭时，**creator 的 Manage 仍生效**，其余项目级 grant 冻结不参与计算 | 否则 creator 可能被自己关掉的开关锁死 |
-| D12 | 移动节点授权 = **本节点 Manage + 目标父 Edit+**；移动在事务 + Postgres 咨询锁内完成，防并发成环 | 预检环检测在并发下不安全 |
-| D13 | Group resolve 失败返回 **503**（不伪装 404/403）；每次 HTTP 请求 fresh resolve，不跨请求缓存；单请求内多次校验合并为一次调用（此点与 Group 团队确认，OPEN-9） | 依赖故障 ≠ 无权限；契约 G4 要求实时 |
-| D14 | 命名规则：NFC 归一化、trim、≤128 字符、禁 `/` 与控制字符；**活跃兄弟节点大小写不敏感唯一**；根节点全局唯一 | 缺命名规则必有脏数据 |
-| D15 | 删除 = 只给被删节点打标，后代**不递归打标**，靠"任一祖先已删"过滤；所有查询链路强制此过滤（含递归 SQL，不只靠 Prisma middleware） | 递归打标的写放大与恢复复杂度不可控 |
-| D16 | `baseVersion` 为**文件级版本**（GET file 返回的 version）；无关文件的提交不产生冲突 | 与 C1 `head(dir, filePath)` 语义一致 |
-| D17 | breadcrumb 只暴露用户有 View 的祖先名称；无权限祖先显示占位符 `…`，不暴露名字 | 404 不泄露语义（D8）延伸到面包屑 |
-| D18 | v1 **单副本部署**（git 仓库在本地磁盘）；多副本需共享存储或分片，后置 | 不解决不存在的扩展问题 |
-| D19 | 网站管理员**不隐式读内容**；force_adjust 凭 node id 操作（id 从审计或用户上报获得） | C4 已定的最小权限原则 |
-
-## 阶段计划
-
-### Phase 0 · 骨架与身份先行（1–2 天）
-
-- [ ] 过 D11–D19，回写契约 v0.2
-- [ ] repo 骨架 `server/` + `web/`，Postgres docker-compose，CI（lint / typecheck / vitest / 集成测试用真实 Postgres service container）
-- [ ] **JWT 中间件 + 本地 JWKS 测试服务 + 签名 token fixtures**（有效/过期/错 issuer/错 audience/错算法/未知 kid/轮换）——身份先行，不做"宽松 mock 身份"
-- [ ] 4 个 port 接口定义 + mock：`VersionStore`、`GroupResolver`、`AuditSink`（直写 outbox 表的实现就是真的，mock 的是对端服务）、`ExportAdapter`
-- [ ] fastify-swagger 接入，OpenAPI 骨架——**OpenAPI 随每个端点同步产出，不留到最后**
-- **验收**：骨架可 `pnpm dev` 起服务；本地 JWKS 六类 token fixture（有效/过期/错 issuer/错 audience/错算法/未知 kid）中间件行为全对；CI 流水线绿
-
-### Phase 1 · 数据模型与权限引擎（2–3 天）⚑ 心脏
-
-- [ ] Prisma schema：`Node`（parentId **权威** + id 编码的 materialized path 派生列，name 不入 path）、`Grant`、`ProjectIndependentSettings`、`OutboxEvent`（含 attempts/nextAttemptAt/lease/lastError，relay 字段一次到位）、`ExportJob`
-- [ ] 数据库约束：kind 枚举、项目无子节点、活跃兄弟名唯一（部分唯一索引，root 的 NULL parent 特殊处理）、活跃 grant 按 (nodeId, principalType, principalId) 唯一、独立设置仅项目
-- [ ] **纯权限 reducer**：输入已解析的 grants + 祖先链 + 用户组集合，输出 role|null；不碰 DB/网络。fast-check 属性测试：max 单调、加 grant 只升不降、祖先继承、toggle 行为、顺序无关、软删过滤
-- [ ] 数据获取层 + `effective(user, node)` 组装
-- [ ] 树操作服务：create（creator 自动 Manage、root 仅管理员且必带 ≥1 Manage）、rename、move（D12 事务+咨询锁）、soft delete（D15）、breadcrumb（D17）
-- **验收**：并发对移（A→B 与 B→A）、移动+并发建子、property tests、删除祖先过滤，真实 Postgres 全绿
-
-### Phase 2 · 树与授权 API（1–2 天）
-
-- [ ] nodes 端点组 + grants 端点组 + independent-permission 开关 + effective-permission 自查
-- [ ] 授权矩阵校验（契约 8.1：creator-only 授 Manage、Manage 不可动 creator、force_adjust 独立通道）
-- [ ] 全部写操作落 outbox 事件（C3 词汇表）
-- **验收**：契约 8.1 矩阵逐格 API 测试；D8 的 404/403/503 三分语义测试
-
-### Phase 3 · 仓库生命周期与文件 API（2 天）
-
-- [ ] 项目 provisioning 状态机 `PROVISIONING → READY | FAILED`：先建 DB 行（PROVISIONING）→ 调 `VersionStore.init`（幂等）→ 置 READY；失败可重试；孤儿仓库对账 job
-- [ ] 每项目写锁（Postgres 咨询锁，跨进程安全）——不假设版本包能跨进程串行
-- [ ] 路径安全：canonical 后必须落在项目根内、拒绝 `.git`、禁 symlink 逃逸、路径长度上限
-- [ ] 上传限额（单文件 10MB / 单项目配额，数值 OPEN-5）+ 流式接收
-- [ ] files 端点组全量（list/read/upload/commits→409/diff/history/delete）+ 双客户端冲突 e2e
-- **验收**：DB/git 故障注入（init 失败、提交后崩溃）→ 对账能收敛；路径穿越语料库测试全拒
-
-### Phase 4 · 外部集成（1–2 天）
-
-- [ ] `GroupResolver` HTTP client：超时/5xx/429/畸形 JSON/万级 group 的故障注入测试；失败 → 503（D13）
-- [ ] Audit relay worker：租约领取、指数退避、eventId 幂等、重启恢复、积压告警
-- [ ] 导出 job：状态机 + 轮询 + 下载权限校验；`ExportAdapter` 桩（参数 OPEN-6 未定前**不计入完成标准**）
-- **验收**：relay 重启不丢不重（对端幂等）；group 故障时写操作 503、读操作按 D13
-
-### Phase 5 · 前端（3–5 天，Phase 2 后并行启动）
-
-- [ ] 登录（平台 SSO 占位 + 本地 JWKS 直通开关）
-- [ ] 树浏览（懒加载 + 分页）、breadcrumb（D17 占位符）、创建对话框（类型 + 批量授权选择器，Group search 接 C2）
-- [ ] 权限管理面板（按 8.1 矩阵控制可选项，creator 标识）
-- [ ] 文件页：查看/上传/下载/历史列表（编辑 UI 不归我方，留对接位）
-- [ ] 导出按钮 + job 轮询
-- **验收**：无权限节点全链路不可见；授权面板不会送出矩阵禁止的组合
-
-### Phase 6 · 硬化与交付（1–2 天）
-
-- [ ] 404/403/503 全端点核对；并发与重试幂等抽查
-- [ ] 备份脚本（DB + git 仓库一致性快照）、健康检查（DB/JWKS/磁盘/Group）、磁盘水位告警
-- [ ] OpenAPI 终稿 + 部署脚本 + 一页运维手册
-
-## 里程碑
-
-| 里程碑 | 内容 | 累计工期 |
-|---|---|---|
-| M1 | Phase 0–1：骨架 + 权限引擎 + 树操作可跑 | ~4 天 |
-| M2 | Phase 2–3：后端 API 全量（含文件冲突流） | ~7 天 |
-| M3 | Phase 4：外部集成（导出不计） | ~9 天 |
-| M4 | Phase 5–6：前端 + 硬化，可交付 | ~14–18 天 |
-
-## Mock 保真红线（mock 可以顶，但不许骗）
-
-| Mock | 不许掩盖的事 | 真身到位后的契约测试 |
-|---|---|---|
-| VersionStore | 磁盘延迟、半初始化、锁残留、跨进程并发 | 真包跑临时仓库：并发 commit/init 重试/遍历与 symlink 语料 |
-| GroupResolver | 超时、5xx、畸形响应、大规模组集 | 故障注入 HTTP 桩全过；我方绝不自己推祖先 |
-| GroupSearch（前端选择器） | 与 resolve 是**两个独立端点**，不可用 resolve mock 顶替 | C2 `/groups/search` 真身到位后跑分页/空结果/超时 |
-| Audit 对端 | 重复投递、乱序、长时间不可用 | relay 重启恢复 + 对端幂等 |
-| JWT | issuer/audience/算法/轮换 | 本地 JWKS 全用例 |
-| ExportAdapter | 参数、幂等、耗时 | 参数定了再写，之前不算完成 |
-
-## Top 5 风险
-
-1. **DB/git 分裂**（崩溃导致元数据、仓库、审计三边不一致）→ provisioning 状态机 + 对账 job，Phase 3 前置
-2. **移动子树改变整树权限** → D12 事务+锁+源目标双授权，并发测试
-3. **creator/独立权限开关交互** → D11 先冻结
-4. **外部契约缺口**（导出参数、请求内 resolve 合并）→ OPEN 清单跟踪，mock 保真红线不许掩盖
-5. **存储滥用/路径逃逸** → 路径安全 + 配额进 Phase 3 验收，不拖到硬化
-
-## OPEN 清单（在契约文档基础上增补）
-
-- OPEN-9：单请求内合并多次 resolve 是否符合 G4"实时"语义（找 Group 团队确认）
-- OPEN-10：恶意软件扫描归属（我方/平台/不做）
-- 其余 OPEN-1~8 见《文件库-接口契约.md》第 10 节

.scratch/saas-production-readiness/issues/05-define-abuse-capacity-controls.md

@@ -29,7 +29,7 @@ workload brakes.
 
 The full current-state inventory, accepted behavior, and release evidence are
 recorded in [Initial abuse and capacity controls](../assets/initial-abuse-capacity-controls.md),
-with the durable decision in ADR-0022. Numerical
+with the durable decision in ADR-0022 and `Spec.System.Capacity`. Numerical
 ceilings remain open until production-like calibration.
 
 The implementation frontier is:

.scratch/saas-production-readiness/issues/08-prove-production-release-gate.md

@@ -7,6 +7,6 @@ Blocked by: 01, 02, 03, 04, 05, 06, 07, 09, 10, 11, 12, 13, 14, 15, 16, 17, 18,
 ## Question
 
 After the readiness investigations and resulting fixes are resolved, can one
-repeatable release procedure prove build/test health, deploy a clean
+repeatable release procedure prove build/test/spec health, deploy a clean
 production-like environment, exercise critical tenant and agent journeys,
 verify observability and recovery, and either roll forward or roll back safely?

.scratch/saas-production-readiness/issues/27-reconcile-audit-history-contract.md

@@ -8,7 +8,7 @@ Blocked by: 04
 
 Separate or unify run-bound audit entries, pre-run security/permission events,
 structured messages, and operational recovery events without weakening
-the pinned AuditEntry-to-run relation. Decide durability,
+`Spec.System.Audit`'s pinned AuditEntry-to-run relation. Decide durability,
 failure, retention, and query semantics; then enforce referential integrity and
 observable/recoverable writes instead of silently swallowing lost evidence.
 Do not merge these customer Project/Run records with ADR-0023's already-decided

.scratch/saas-production-readiness/issues/42-decide-platform-admin-identity-audit.md

@@ -40,7 +40,9 @@ an off-host recovery key, an incident and reason, and issues only an expiring
 Emergency Platform Grant.
 
 The complete accepted decision and implementation divergences are in
-[ADR-0023](../../../docs/adr/0023-platform-administrator-identity-and-audit.md),
+[ADR-0023](../../../docs/adr/0023-platform-administrator-identity-and-audit.md).
+The pinned semantic invariants are in
+[`Spec.System.PlatformAdministration`](../../../spec/Spec/System/PlatformAdministration.lean),
 and the canonical terms are in [`CONTEXT.md`](../../../CONTEXT.md).
 
 Exact numeric session/invitation/step-up limits and browser mechanics remain

AGENTS.md

@@ -1,25 +1,29 @@
 # AGENTS.md —— agent 操作手册(全 repo)
 
-本 repo 是 monorepo。先读根 `README.md` 的"宪法"4 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
+本 repo 是 monorepo。先读根 `README.md` 的"宪法"5 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
 
 ## 这个 repo 是什么
 
-- `docs/adr/` 是系统级决策的唯一权威来源;`CONTEXT.md` 是平台语言词汇表;代码注释把关键不变量锚到 ADR 编号,可 grep。
+- `spec/` 是一份**人机共识的契约**(Lean 语义母本),是产品语义的上游参照。
+- 其余部件(将来的 `spec/` 外文件夹)是**向 `spec/` 对齐的实现**。
 - `hub/` 的平台层按 SaaS 形态演进:`Organization` 是 tenant root;`Project`/`Team`
-  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020)。
+  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020 / `Spec.System.Organization`)。
 - org 后台 project explorer 里 `Folder` 是透明组织节点,不是权限资源;project 仍是权限边界。
-  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021)。
+  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021 /
+  `Spec.System.ProjectWorkspace`)。
 - 每个 org 自选 BYOK 或平台托管 model provider connection;平台托管也必须是该 org
-  独享的 key/base URL,不得让无关 org 共用 process-global provider key(见 ADR-0021)。
+  独享的 key/base URL,不得让无关 org 共用 process-global provider key(见 ADR-0021 /
+  `Spec.System.Organization`)。
 - Feishu/provider secret 使用本地版本化 master-key keyring 的信封加密;生产由 systemd
   credential 注入,运行时只允许显式 org/project scope 的 fail-closed resolver,不得回退
   process-global credential;Agent child 只接收 run-scoped loopback proxy capability,
-  不接收 org provider credential(见 ADR-0024)。
+  不接收 org provider credential(见 ADR-0024 / `Spec.System.Organization`)。
 - 生产容量按不可突破的 platform ceiling 与 org 可下调 policy 分层;有效限制取两者较低值。
-  Agent admission 必须持久、有界、跨 org 公平且显式背压(见 ADR-0022)。
+  Agent admission 必须持久、有界、跨 org 公平且显式背压(见 ADR-0022 /
+  `Spec.System.Capacity`)。
 - 平台管理员只通过独立的 platform-owned 飞书应用与可撤销 Platform Session 认证,不复用
   客户 `User`/org membership;平台写操作与 append-only audit 同事务,break-glass 只走
-  双因子的离线恢复流程(见 ADR-0023)。
+  双因子的离线恢复流程(见 ADR-0023 / `Spec.System.PlatformAdministration`)。
 - 受控 alpha 暂采用一 Organization 一具名 systemd Silo:独立 database role/database、
   service identity、workspace、keyring 与 Feishu/provider connection；进程必须由
   `HUB_SILO_ORGANIZATION_ID` fail-closed 绑定唯一 org，平台后台不开放。共享 SaaS
@@ -32,6 +36,10 @@
   `/compact` 只能由卡片动作以未经包装的精确 prompt 转发。
   `settingSources: []` 继续禁用项目/用户配置加载，不得把任意 workspace `.claude` 配置变成
   运行时能力(见 ADR-0018)。
+  skill/role 的管理面分组由一棵 org 内共用、可嵌套的 folder 树承载：透明组织节点，
+  不进入身份、解析与授权——name/roleId 仍 org 内唯一，role→skill 绑定、run 加载与
+  slash 命令均不引用 folder;folder 归属变更是 label 类变更,不归档会话;仅空 folder
+  可删(见 ADR-0028 / `Spec.System.AgentRole`)。
 - 项目发现由 `ProjectDiscovery` 模块统一承载：PostgreSQL `pg_trgm` 搜索派生文档、项目编号
   归一化、完整 Folder breadcrumb、MANAGE 授权过滤与分页都在该模块内；飞书卡片只是 adapter。
   `Project`/`Folder` 仍是事实来源，搜索文档必须可重建且由数据库触发器同步，禁止调用方双写。
@@ -40,12 +48,12 @@
 
 ## 纪律
 
-1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。ADR 与 `CONTEXT.md` 是语义的唯一权威来源;没写的,就是没定的。
+1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。契约里 prose doc 注释是语义的唯一权威来源;契约没写的,就是没定的。
 
-2. **凡 ADR 未写明者,不得假设。** 遇到没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
+2. **凡契约未写明者,不得假设。** 遇到标了 `OPEN` 的地方,或契约根本没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
 
-3. **新语义决策进 ADR。** 跨部件的语义分歧点按编号顺延新增 `docs/adr/NNNN-*.md`;代码里的关键不变量用注释锚到 ADR 编号,保持可 grep。已有 ADR 正文不改写历史——推翻旧决策就写新 ADR 标记 supersede。
+3. **改 `spec/` 必须保持其 `lake build` 通过。** 在 `spec/` 目录下跑 `lake build`。新增声明必须带 `/-- … -/` doc 注释和恰当标签(`PINNED` / `OPEN` / `ADR-NNNN`)。规范见 `spec/README.md`。不准用 `sorry` 把 build 糊绿。
 
-4. **实现向 ADR 对齐;偏离必须 surface。** 没有 CI gate 替你把关 ADR↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与决策不一致时,报告它,不要默默让其中一边将就另一边。
+4. **实现向契约对齐;偏离必须 surface。** 没有 CI gate 替你把关 spec↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与契约不一致时,报告它,不要默默让其中一边将就另一边。
 
 5. **写操作谨慎。** 线上操作、git 写操作前与开发者确认(这是开发者的全局偏好)。

CLAUDE.md

@@ -1,23 +1,25 @@
 # CLAUDE.md —— agent 操作手册(全 repo)
 
-本 repo 是 monorepo。先读根 `README.md` 的"宪法"4 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
+本 repo 是 monorepo。先读根 `README.md` 的"宪法"5 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
 
 ## 这个 repo 是什么
 
-- `docs/adr/` 是系统级决策的唯一权威来源;`CONTEXT.md` 是平台语言词汇表;代码注释把关键不变量锚到 ADR 编号,可 grep。
+- `spec/` 是一份**人机共识的契约**(Lean 语义母本),是产品语义的上游参照。
+- 其余部件(将来的 `spec/` 外文件夹)是**向 `spec/` 对齐的实现**。
 - `hub/` 的平台层按 SaaS 形态演进:`Organization` 是 tenant root;`Project`/`Team`
-  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020)。
+  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020 / `Spec.System.Organization`)。
 - org 后台 project explorer 里 `Folder` 是透明组织节点,不是权限资源;project 仍是权限边界。
-  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021)。
+  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021 /
+  `Spec.System.ProjectWorkspace`)。
 
 ## 纪律
 
-1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。ADR 与 `CONTEXT.md` 是语义的唯一权威来源;没写的,就是没定的。
+1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。契约里 prose doc 注释是语义的唯一权威来源;契约没写的,就是没定的。
 
-2. **凡 ADR 未写明者,不得假设。** 遇到没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
+2. **凡契约未写明者,不得假设。** 遇到标了 `OPEN` 的地方,或契约根本没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
 
-3. **新语义决策进 ADR。** 跨部件的语义分歧点按编号顺延新增 `docs/adr/NNNN-*.md`;代码里的关键不变量用注释锚到 ADR 编号,保持可 grep。已有 ADR 正文不改写历史——推翻旧决策就写新 ADR 标记 supersede。
+3. **改 `spec/` 必须保持其 `lake build` 通过。** 在 `spec/` 目录下跑 `lake build`。新增声明必须带 `/-- … -/` doc 注释和恰当标签(`PINNED` / `OPEN` / `ADR-NNNN`)。规范见 `spec/README.md`。不准用 `sorry` 把 build 糊绿。
 
-4. **实现向 ADR 对齐;偏离必须 surface。** 没有 CI gate 替你把关 ADR↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与决策不一致时,报告它,不要默默让其中一边将就另一边。
+4. **实现向契约对齐;偏离必须 surface。** 没有 CI gate 替你把关 spec↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与契约不一致时,报告它,不要默默让其中一边将就另一边。
 
 5. **写操作谨慎。** 线上操作、git 写操作前与开发者确认(这是开发者的全局偏好)。

README.md

@@ -2,7 +2,7 @@
 
 教研生产的数字化解决方案。核心思路:课程像 DAW / 剪辑软件那样有一个**结构化的工程文件**;coding agent 协助编辑它;一个 rule-based checker(类编译器)校验其合法性并给出 helpful fix hint。目标是把教研从一次性的文档,沉淀成**可累积、可校验、可复用的资产**。
 
-这是一个 **monorepo**。它的组织方式本身就表达了一条原则:**`docs/adr/` 是系统级决策的唯一权威来源,代码注释把关键不变量锚到 ADR 编号,可 grep。**
+这是一个 **monorepo**。它的组织方式本身就表达了一条原则:**`spec/` 是上游的语义母本,其余部件是向它对齐的实现。**
 
 ## 安装 `cph` 命令行
 
@@ -33,40 +33,47 @@ cph completions zsh > ~/.zfunc/_cph        # 或 bash/fish/powershell/elvish
 ```
 README.md          ← 本文件:总览 + 宪法(下面 5 条)
 CLAUDE.md          ← 全局 agent 操作手册(管整个 repo)
-docs/adr/          ← 系统级架构决策记录(跨部件,决策的唯一权威来源)
+docs/adr/          ← 系统级架构决策记录(跨部件,被 spec 契约引用)
-CONTEXT.md         ← 平台语言词汇表(术语与禁用说法)
+spec/              ← Lean 语义母本(自包含的 Lean 工程)。见 spec/README.md
 Cargo.toml         ← 仓库级 cargo workspace(实现部件共用,便于跨部件复用 crate)
-crates/            ← 实现:rule-based checker(语义由 ADR 锚定)。见 crates/README.md
+crates/            ← 实现:rule-based checker(向 spec 对齐)。见 crates/README.md
   cph-diag / cph-model / cph-schema / cph-typst   ← 可复用基础(模型/校验/typst 引擎)
   cph-check / cph-cli                             ← checker 本体 + `cph` 命令行
-render/            ← typst 渲染包 cph-render(checker 的渲染后端,ADR-0005)
+render/            ← typst 渲染包 cph-render(母本的渲染后端之一,ADR-0005)
 examples/          ← 样例工程文件(如 TH-141),流水线的真实输入
 hub/              ← SaaS Hub:飞书协作、org 管理、agent runtime 与生产部署
-(exporter/ …)     ← 将来的其他部件,平级于 crates/
+(exporter/ …)     ← 将来的其他部件,平级于 spec/
 ```
 
+`spec/` 与实现部件**物理分离、平级共存**:谁是上游、谁向谁对齐,一眼可见。
 实现部件共用一个仓库根的 cargo workspace,使基础 crate(模型、typst 引擎)能被
 未来部件(如 exporter)复用,而非各自重造。
 
 ## 宪法
 
-这 4 条是本仓库的协作约定,是一切工作的前提。
+这 5 条是 `spec/` 这份语义母本的定位与约束,是本仓库一切工作的前提。
 
-1. **角色 —— ADR 是决策真相。**
+1. **角色 —— Lean 是研发侧的上游参照。**
-   跨部件的语义决策只记录在 `docs/adr/`,一份决策一份 ADR,编号顺延、正文不改写历史。代码里的关键不变量用注释锚到 ADR 编号,保持可 grep。没有第二份权威文档。
+   `spec/` 用 Lean 编写,是开发者(领域专家)与 coding agent **共用**的 spec 工具,用来沉淀产品各部件的**语义**。它**不进入产品运行时**——产品里"站在 Lean 这个位置"的那个 checker 用什么技术实现,尚未决定;但那个东西的语义,先在 `spec/` 里固定下来。
 
-2. **对齐机制 —— 人肉承载,无机器兜底。**
+2. **对齐机制 —— Lean 只做上游参照。**
-   CI 只验各部件自身良构(build / test / clippy),**没有**决策↔实现的一致性 gate。实现对齐 ADR,由"开发者 review + agent 巡逻 diff"这个人肉环节承载。发现漂移,报告它,不要默默让其中一边将就另一边。
+   不做 extract / codegen,不派生 conformance test,CI 里**没有** spec→实现的 gate。实现对齐 spec,由"开发者 review + agent 巡逻 diff"这个人肉环节承载。
+   (CI 里的 `spec check` 只验 spec **自身**能否 type-check,即契约内部良构,不是 spec↔实现的对齐检查。)
 
-3. **形态 —— 自包含。**
+3. **资产性 —— 由 review 纪律承载,无机器兜底。**
-   凡 ADR 未明文规定的,开发者与 agent 双方都不该假设;遇到没覆盖的地方,**显式 surface** 出来让开发者决定。
+   这份仓库给你的是"精确、自洽、机器验内部良构的语义共识",**不是**"实现正确性保证"。spec 与实现之间那道缝,是我们自愿用人来守的——清醒地守,它就是资产;放任实现漂移而不回头同步,它就退化成最贵的过期文档。
 
-4. **深度判据 —— 只收录分歧点。**
+4. **形态 —— 它是人机共识的契约。**
-   一条语义该不该写进 ADR,取决于一句话:**"不写明,开发者与 agent 会不会各自做出不同假设?"** 会 → 进 ADR;显然的东西 / 纯 plumbing / 普通 CRUD 字段 → 不进(写进去只稀释信噪比、增加维护面)。
+   契约必须**自包含**:凡契约未明文规定的,开发者与 agent 双方都不该假设。这比"文档"严格——type checker 会逼这份契约在结构上无洞。
-   深度上限是**你愿意在每次实现变更时手动回头同步的量**——写得比你能维护的更深,多出来的部分会率先过期、反过来误导实现。
+
+5. **深度判据 —— 只收录分歧点。**
+   一条语义该不该写进 Lean,取决于一句话:**"不写明,开发者与 agent 会不会各自做出不同假设?"** 会 → 进契约;显然的东西 / 纯 plumbing / 普通 CRUD 字段 → 不进(写进去只稀释信噪比、增加维护面)。
+   深度上限不是 Lean 的表达力,而是**你愿意在每次实现变更时手动回头同步的量**——写得比你能维护的更深,多出来的部分会率先过期、反过来误导实现。
 
 ## CI
 
+`.gitea/workflows/spec-check.yml` 在每次 push / PR 时于 `spec/` 下跑 `lake build`,确保契约始终 type-check 通过(从第一天起就是"绿"的)。这是良构 gate,见宪法第 2 条。
+
 Rust checker 的本地与 CI 工具链由根 `rust-toolchain.toml` 固定;`.gitea/workflows/checker-check.yml`
 必须安装同一精确版本并执行 `cargo fmt --all --check`、Clippy `-D warnings` 与 workspace
 全测试。升级 Rust 时这两处必须在同一提交更新并通过完整 checker gate。

crates/README.md

@@ -1,8 +1,7 @@
 # crates/
 
-These crates implement the rule-based lesson checker whose semantics are
+These crates implement the rule-based lesson checker that aligns to the
-pinned by the ADRs in `docs/adr/`: it reads an engineering-file (one lesson,
+semantic master in `spec/`: it reads an engineering-file (one lesson, ADR-0005)
-ADR-0005)
 laid out per ADR-0008 (declarative `manifest.toml` + per-element
 `element.toml`), validates structure and content, and emits diagnostics.
 `cph-diag` (the shared diagnostic vocabulary), `cph-model` (the ADR-0008 loader),

crates/cph-check/src/lib.rs

@@ -19,11 +19,13 @@ const DEFAULT_TARGET: &str = "student";
 
 /// Severity of the render-coverage ("element ignored under a target") diagnostic.
 ///
-/// **PINNED to `warning` by ADR-0005:** when a
+/// **PINNED to `warning` by the contract.** Mirrors the Lean master's
+/// `Spec.Courseware.renderIgnoredSeverity : Severity := .warning`
+/// (`spec/Spec/Courseware/Check/Diagnostic.lean`), itself citing ADR-0005: when a
 /// `(kind, target)` pair has no render rule the checker reports that the element
 /// is ignored under that target and **does not block the export**. Naming the
-/// severity as a const makes "it is a warning, not an error" a greppable
+/// severity as a const makes "it is a warning, not an error" a greppable,
-/// fact rather than an inline literal.
+/// alignable fact rather than an inline literal.
 const RENDER_IGNORED_SEVERITY: Severity = Severity::Warning;
 
 /// The result of running [`check`] (or the check phases of [`build`]).
@@ -55,12 +57,12 @@ impl CheckReport {
 
     /// Whether any collected diagnostic is `Error`-severity.
     ///
-    /// **Legality decision (ADR-0010).** `!has_errors()` decides lesson
+    /// **Legality decision (spec alignment).** `!has_errors()` is the
-    /// legality: a lesson is *legal* iff its diagnostics contain no error-level
+    /// implementation of `Spec.Courseware.Legal` (`spec/Spec/Courseware/Check/Diagnostic.lean`):
-    /// diagnostic (warnings are non-blocking — see `Severity`). There is no CI
+    /// a lesson is *legal* iff its diagnostics contain no error-level diagnostic
-    /// gate enforcing ADR↔implementation alignment (repo constitution); it is
+    /// (warnings are non-blocking — see `Severity` / ADR-0010). There is no CI
-    /// kept greppable here so a reviewer can tie the orchestrator's gate to
+    /// gate enforcing this alignment (repo constitution); it is kept greppable
-    /// the ADR.
+    /// here so a reviewer can tie the orchestrator's gate to the Lean master.
     pub fn has_errors(&self) -> bool {
         self.diagnostics
             .iter()

crates/cph-diag/src/lib.rs

@@ -2,7 +2,7 @@
 //!
 //! Every other crate in the workspace depends on these types to report
 //! problems. The vocabulary is intentionally small and stable: a [`Severity`]
-//! (two-valued, ADR-0010), a closed set of machine-stable [`DiagCode`]s, an
+//! (mirroring the Lean master), a closed set of machine-stable [`DiagCode`]s, an
 //! optional [`SourceSpan`] pointing back at the offending source, and a
 //! [`Diagnostic`] tying them together with a human message and a fix hint.
 //!
@@ -17,27 +17,32 @@ use serde::Serialize;
 
 /// Severity of a diagnostic.
 ///
-/// **Pinned by ADR-0005 / ADR-0010: exactly two values.**
+/// **Mirrors `Spec.Courseware.Diagnostic.Severity`** in the Lean semantic
+/// master (`spec/Spec/Courseware/Check/Diagnostic.lean`), whose definition is
+/// exactly:
 ///
 /// ```text
-/// warning | error
+/// inductive Severity where
+///   | warning
+///   | error
 /// ```
 ///
-/// This two-valued shape is a **contract decision**, not an accident: the
+/// This two-valued shape is a **contract decision**, not an accident: the Lean
-/// finer levels (`info` / `hint` / `note`) are deliberately undecided, so we
+/// module pins `Severity` to exactly `warning | error` and states the finer
+/// levels (`info` / `hint` / `note`) are deliberately undecided. We therefore
 /// do **not** add an info/note level here. `error` blocks (the artifact is
 /// invalid); `warning` does not block (the artifact still exports, but with
 /// loss / an ignored element — e.g. ADR-0005's "missing render ⇒ warning").
 ///
-/// There is no CI gate enforcing ADR↔implementation alignment (see the repo
+/// There is no CI gate enforcing this alignment (see the repo constitution);
-/// constitution); it is maintained by review, which is why the decision is
+/// it is maintained by review, which is why this correspondence is documented
-/// documented here rather than only in the ADR.
+/// here rather than only in the spec.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
 pub enum Severity {
     /// Non-blocking: the artifact still exports, but is lossy / has an ignored
-    /// element. ADR-0010 `warning`.
+    /// element. Mirrors Lean `Severity.warning`.
     Warning,
-    /// Blocking: the artifact is invalid. ADR-0010 `error`.
+    /// Blocking: the artifact is invalid. Mirrors Lean `Severity.error`.
     Error,
 }
 

crates/cph-model/src/lib.rs

@@ -3,7 +3,9 @@
 //! This crate is the **loader**, not the full checker. It reads
 //! `<root>/manifest.toml` (project / info / ordered `[[parts]]` / declared
 //! `[targets.*]`) and each part's `<root>/<path>/element.toml`, and produces an
-//! ordered [`Lesson`], where the order of `parts` carries teaching semantics.
+//! ordered [`Lesson`] — mirroring the Lean master's `Lesson = List (Element P)`
+//! (`spec/Spec/Courseware/Model/Lesson.lean`), where the order of `parts` carries
+//! teaching semantics.
 //!
 //! Scope boundaries (deliberately staying in lane):
 //! - It validates **structure** only: manifest shape, element.toml shape, and
@@ -21,7 +23,7 @@ use serde::{Deserialize, Serialize};
 
 /// An ordered, in-memory lesson loaded from an engineering file.
 ///
-/// `parts` is an ordered
+/// Mirrors the Lean master's `Lesson = List (Element P)`: `parts` is an ordered
 /// `Vec`, and that order is the lesson's order (ADR-0008 §"the lesson manifest
 /// is declarative" — the `[[parts]]` array order is the single source of truth).
 #[derive(Debug, Clone, PartialEq, Serialize)]
@@ -84,8 +86,9 @@ pub struct TargetConfig {
     /// with template `exports/<name>.typ` when no `[[steps]]` are given.
     pub steps: Vec<Step>,
     /// The **render-coverage declaration**: which element kinds this target
-    /// renders. Realizes ADR-0011's "render
+    /// renders. Realizes `Spec.Courseware.TargetSpec.covers : KindId → Prop`
-    /// coverage is a declaration, not a payload": the declaration keeps *which
+    /// (`spec/Spec/Courseware/Export/Render.lean`) and ADR-0011's "render
+    /// coverage is a declaration, not a payload": the contract keeps *which
     /// kinds a target renders* (used by the `renderIgnored` seed diagnostic),
     /// while the rendering "how" lives in the template/steps.
     ///
@@ -99,10 +102,13 @@ pub struct TargetConfig {
 
 /// The artifact an export target produces (ADR-0009/0011).
 ///
-/// **Pinned by ADR-0011** as an ADT with fields:
+/// **Mirrors `Spec.Courseware.Artifact`** in the Lean semantic master
+/// (`spec/Spec/Courseware/Export/Artifact.lean`), whose definition is exactly:
 ///
 /// ```text
-/// Artifact = singleFile (filepath) | fileTree (root, outputs)
+/// inductive Artifact where
+///   | singleFile (filepath : String)
+///   | fileTree (root : String) (outputs : String)
 /// ```
 ///
 /// ADR-0011 pinned the artifact as an ADT **with fields**: "what the product
@@ -114,20 +120,20 @@ pub struct TargetConfig {
 /// `"single-file"` → [`Artifact::SingleFile`], `"file-tree"` →
 /// [`Artifact::FileTree`].
 ///
-/// As with `cph-diag`'s `Severity`, there is no CI gate enforcing ADR↔
+/// As with `cph-diag`'s `Severity`, there is no CI gate enforcing this
-/// implementation alignment (see the repo constitution) — it is maintained by
+/// alignment (see the repo constitution) — it is maintained by review, which is
-/// review, which is why the decision is documented here.
+/// why the correspondence is documented here.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 pub enum Artifact {
     /// One bundled document landing at `filepath` (relative to the engineering
-    /// root). ADR-0011 `singleFile`. The default artifact shape.
+    /// root). Mirrors Lean `Artifact.singleFile`. The default artifact shape.
     SingleFile {
         /// Where the single product is written (relative to the engineering
         /// root), e.g. `build/student.pdf`.
         filepath: PathBuf,
     },
-    /// A set of files under `root` matching the `outputs` glob. ADR-0011
+    /// A set of files under `root` matching the `outputs` glob. Mirrors Lean
-    /// `fileTree`.
+    /// `Artifact.fileTree`.
     FileTree {
         /// The output directory (relative to the engineering root).
         root: PathBuf,
@@ -150,10 +156,14 @@ impl Artifact {
 
 /// One typed build step (ADR-0011).
 ///
-/// **Pinned by ADR-0011** as an ADT:
+/// **Mirrors `Spec.Courseware.Step`** in the Lean semantic master
+/// (`spec/Spec/Courseware/Export/Render.lean`), whose definition is exactly:
 ///
 /// ```text
-/// Step = typstCompile (template) | shell (run) | assembleMarkdown (field)
+/// inductive Step where
+///   | typstCompile (template : String)
+///   | shell (run : String)
+///   | assembleMarkdown (field : String)
 /// ```
 ///
 /// A step is a *typed* operation (extensible): `TypstCompile` compiles a
@@ -173,20 +183,20 @@ impl Artifact {
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 pub enum Step {
     /// Compile a template file (relative to the engineering root) into the
-    /// artifact; the framework injects the manifest. ADR-0011
+    /// artifact; the framework injects the manifest. Mirrors Lean
-    /// `typstCompile`.
+    /// `Step.typstCompile`.
     TypstCompile {
         /// The template file to compile as main, e.g. `exports/student.typ`.
         template: PathBuf,
     },
-    /// Run a shell command — the escape hatch. ADR-0011 `shell`.
+    /// Run a shell command — the escape hatch. Mirrors Lean `Step.shell`.
     Shell {
         /// The command line to run.
         run: String,
     },
     /// Assemble a single-file markdown deliverable by concatenating each
-    /// element's `field` markdown content file in `[[parts]]` order. ADR-0011
+    /// element's `field` markdown content file in `[[parts]]` order. Mirrors
-    /// `assembleMarkdown` (ADR-0015). Not a typst build — the
+    /// Lean `Step.assembleMarkdown` (ADR-0015). Not a typst build — the
     /// framework owns the read/concatenate/write itself.
     AssembleMarkdown {
         /// The per-element markdown content field to assemble (e.g. `slides`,
@@ -216,11 +226,12 @@ pub struct Project {
 
 /// `[info]` table (passed through to render targets verbatim).
 ///
-/// The *canonical* model whose
+/// **Mirrors `Spec.Courseware.Info`** in the Lean semantic master
+/// (`spec/Spec/Courseware/Model/Info.lean`): the *canonical* model whose
 /// `authors` is always a list. The authoring-surface form (string-or-array
 /// `author`) is the separate [`RawInfo`] / [`RawAuthor`], normalized into this
-/// at the load boundary. No
+/// at the load boundary — mirroring the Lean `RawInfo` / `RawAuthor` split. No
-/// CI gate enforces ADR↔implementation alignment (repo constitution); it is kept greppable.
+/// CI gate enforces this alignment (repo constitution); it is kept greppable.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 pub struct Info {
     /// Lesson title.
@@ -229,6 +240,7 @@ pub struct Info {
     /// so this is a list, not a single name. Empty when `[info]` declares no
     /// `author`. The on-disk `author` accepts either a bare string (one author)
     /// or an array of strings (see [`RawAuthor`]); both load into this `Vec`.
+    /// Mirrors Lean `Info.authors : List String`.
     pub authors: Vec<String>,
 }
 
@@ -278,7 +290,8 @@ struct RawProject {
     name: String,
 }
 
-/// The authoring-surface `[info]`: the raw form that exists for
+/// The authoring-surface `[info]` (mirrors Lean `RawInfo` in
+/// `spec/Spec/Courseware/Model/Info.lean`): the raw form that exists for
 /// fill-in convenience, normalized into the canonical [`Info`] at the load
 /// boundary. Not the form the rest of the model traffics in.
 #[derive(Debug, Deserialize)]
@@ -288,7 +301,7 @@ struct RawInfo {
 }
 
 /// On-disk `author`: either a single name (`author = "…"`) or a list
-/// (`author = ["…", "…"]`). A fill-in convenience whose
+/// (`author = ["…", "…"]`). Mirrors Lean `RawAuthor`: a fill-in convenience whose
 /// string-or-array union lives **only** at the load boundary — [`RawAuthor::into_vec`]
 /// folds it into the canonical [`Info::authors`] `Vec`, after which it never appears.
 #[derive(Debug, Deserialize)]
@@ -299,7 +312,7 @@ enum RawAuthor {
 }
 
 impl RawAuthor {
-    /// Flatten to the ordered author list: a single
+    /// Flatten to the ordered author list (Lean `RawAuthor.normalize`): a single
     /// name becomes a one-element list; a list passes through verbatim.
     fn into_vec(self) -> Vec<String> {
         match self {

docs/adr/0028-agent-config-folder-tree.md

@@ -0,0 +1,81 @@
+# ADR 0028: Agent Configuration Folder Tree
+
+## Status
+
+Accepted.
+
+## Context
+
+ADR-0017/0018 made Agent roles and skills Organization-scoped dynamic runtime
+configuration, managed without process restarts. The org admin surfaces for
+them (`/admin/roles` and `/admin/skills`) render every
+role/skill as one large editor card in a single flat list. As an Organization
+accumulates roles and skills, the management pages degrade into an endless
+scroll with no grouping affordance.
+
+The project explorer already solves the analogous problem for projects with
+transparent folders (ADR-0021): org-scoped navigation nodes that are not
+permission resources. Roles and skills need the same affordance, but their
+semantics differ from projects in one crucial way: skill names and role IDs
+are referenced by role→skill bindings, run-time skill snapshot loading, and
+Feishu slash commands. Any grouping mechanism must not leak into those
+resolution paths.
+
+## Decision
+
+Introduce an Organization-scoped folder tree shared by Agent roles and Agent
+skills:
+
+- One folder tree per Organization is shared by both roles and skills (e.g. a
+  "高三化学组" folder groups that team's roles and its skills together). It is
+  a distinct entity from the project explorer `Folder` of ADR-0021 — the two
+  trees are managed independently and never reference each other.
+- Folders are **transparent organization nodes**, following the ADR-0021
+  project-folder precedent: they exist for management-surface navigation and
+  grouping only, are not permission resources, and hold no grants.
+- Folder membership is **not part of role/skill identity or resolution**:
+  - skill `name` and role `roleId` remain unique per Organization regardless
+    of folder membership;
+  - role→skill bindings, run admission's frozen role snapshot, run-scoped
+    skill loading, and Feishu slash commands never reference folders.
+- Each role/skill sits in at most one folder; membership is optional
+  (unfiled items remain first-class). Folders nest arbitrarily.
+- Folder assignment is a label-class change in the ADR-0017 sense: it never
+  archives Agent sessions, because the execution surface (model, prompt,
+  tools, skill content) is untouched.
+- A folder can be deleted only when empty — no child folders, no roles, no
+  skills. Relocating items out of a folder is an explicit user action, so no
+  orphan-placement rule is needed yet.
+- Admin web renders both pages as a left folder tree plus the item list of
+  the selected folder ("all" and "unfiled" included). The host-console CLI is
+  unchanged: folder management lives in the web surface, and CLI
+  `upsert-role`/`install-skill` never touch folder assignment.
+
+## Consequences
+
+- New DB entity `OrganizationAgentConfigFolder` (org-scoped, self-nesting via
+  `parentId`, delete restricted while referenced) plus nullable `folderId` on
+  `OrganizationAgentRole` and `OrganizationAgentSkill` (SetNull on folder
+  delete, though the service refuses to delete non-empty folders).
+- The spec pins the transparency and single-membership semantics in
+  `Spec.System.AgentRole` (`AgentConfigFolder`), so future implementors do
+  not re-derive them differently (e.g. path-style names or per-folder
+  uniqueness).
+- Org admin APIs gain folder CRUD plus role/skill folder-assignment endpoints
+  that skip session archival by construction.
+- Moving a role/skill between folders changes nothing about authorization,
+  run resolution, or audit-visible configuration lineage beyond the folder
+  assignment event itself.
+
+## Open Questions / Deferred
+
+- Drag-and-drop assignment and bulk moves are deferred; assignment is a
+  per-item select for now.
+- Folder-level usage aggregation for roles/skills is deferred (project
+  folders already aggregate usage under ADR-0021; agent configuration has no
+  usage dimension yet).
+- CLI flags for folder assignment are deferred until a console workflow asks
+  for them.
+- Folder-scoped default-role policies (e.g. per-folder defaults) are rejected
+  for now: the Organization keeps exactly one active default role
+  (ADR-0017/0018 invariant) regardless of folder structure.

docs/para-26071100-feishu-setup.md

@@ -32,7 +32,7 @@ App ID 通常以 `cli_` 开头，可以写入交付单。App Secret 必须通过
 | 接收群聊中 @ 机器人的消息 | `im:message.group_at_msg:readonly` |
 | 以应用身份发送消息 | `im:message:send_as_bot` |
 | 读取触发消息和线程上下文 | `im:message:readonly` |
-| 获取消息中的图片/文件，并向飞书上传图片或文件（含 Agent 回答中的图片发送） | `im:resource` |
+| 获取与上传图片或文件 | `im:resource` |
 | 添加、删除消息表情回复 | `im:message.reactions:write_only` |
 | 获取用户基本信息 | `contact:user.base:readonly` |
 | 获取用户基本资料 | `contact:user.basic_profile:readonly` |
@@ -66,9 +66,6 @@ Educraft 机器人以应用身份调用上述 API，因此这些 scope 全部放
 
 如果 API 调试台提示缺少更细粒度权限，请把错误提示和发生时间截图给部署人员。不要自行开通通讯录全量读取等超出本表的权限。
 
-说明：`im:resource` 既用于下载用户发来的图片/文件，也用于 Agent 回复时把本地或远程图片上传为飞书 `image_key` 后嵌入消息卡片。缺少该权限时，带图回答会发送失败或降级为无图文本。已开通该 scope 的存量应用一般无需新增权限，但若权限尚未随最新版本发布，请创建新版本并审核发布。
-
-
 ## 4. 配置事件与卡片回调
 
 进入“事件与回调”。

hub/.gitignore

@@ -5,9 +5,6 @@ dist/
 .env.*
 !.env.example
 .secrets/
-.dev-keyring.json
-.dev-workspaces/
-.dev-skills/
 admin-web/node_modules/
 admin-web/build/
 admin-web/.svelte-kit/

hub/admin-web/src/lib/api.ts

@@ -317,6 +317,7 @@ export interface AgentRoleRow {
 	createdAt: string;
 	updatedAt: string;
 	skillNames: readonly string[];
+	folderId: string | null;
 }
 
 export interface AgentSkillRow {
@@ -329,6 +330,14 @@ export interface AgentSkillRow {
 	createdAt: string;
 	updatedAt: string;
 	boundRoleIds: readonly string[];
+	folderId: string | null;
+}
+
+/** ADR-0028 transparent folder node shared by agent roles and skills. */
+export interface AgentConfigFolderRow {
+	id: string;
+	name: string;
+	parentId: string | null;
 }
 
 export interface SkillFileEntry {
@@ -515,4 +524,21 @@ export const api = {
 	patchAgentSkill: (slug: string, name: string, body: { description?: string; disabled?: boolean }) =>
 		patch(`${orgBase(slug)}/agent-skills/${encodeURIComponent(name)}`, body) as Promise<{ disabled?: boolean; updated?: boolean }>,
 	agentModels: (slug: string) => get(`${orgBase(slug)}/agent-models`) as Promise<{ models: AgentModelRow[] }>,
+
+	agentConfigFolders: (slug: string) =>
+		get(`${orgBase(slug)}/agent-config-folders`) as Promise<{ folders: AgentConfigFolderRow[] }>,
+	createAgentConfigFolder: (slug: string, body: { name: string; parentId?: string }) =>
+		post(`${orgBase(slug)}/agent-config-folders`, body) as Promise<AgentConfigFolderRow>,
+	patchAgentConfigFolder: (slug: string, folderId: string, body: { name?: string; parentId?: string | null }) =>
+		patch(`${orgBase(slug)}/agent-config-folders/${encodeURIComponent(folderId)}`, body) as Promise<AgentConfigFolderRow>,
+	deleteAgentConfigFolder: (slug: string, folderId: string) =>
+		del(`${orgBase(slug)}/agent-config-folders/${encodeURIComponent(folderId)}`) as Promise<{ deleted: boolean }>,
+	setAgentRoleFolder: (slug: string, roleId: string, folderId: string | null) =>
+		patch(`${orgBase(slug)}/agent-roles/${encodeURIComponent(roleId)}/folder`, { folderId }) as Promise<{
+			folderId: string | null;
+		}>,
+	setAgentSkillFolder: (slug: string, name: string, folderId: string | null) =>
+		patch(`${orgBase(slug)}/agent-skills/${encodeURIComponent(name)}/folder`, { folderId }) as Promise<{
+			folderId: string | null;
+		}>,
 };

hub/admin-web/src/lib/components/AgentConfigFolderNav.svelte

@@ -0,0 +1,160 @@
+<script lang="ts">
+	import type { AgentConfigFolderRow } from '$lib/api';
+	import Icon from './Icon.svelte';
+
+	/**
+	 * ADR-0028 left folder-tree nav for the agent config pages (roles/skills).
+	 * Transparent grouping only: selection filters the item list, it never
+	 * affects role/skill identity or run resolution.
+	 */
+	let {
+		folders,
+		selected,
+		counts,
+		totalCount,
+		unfiledCount,
+		onselect,
+		oncreate,
+		onrename,
+		ondelete,
+	}: {
+		folders: AgentConfigFolderRow[];
+		/** 'all' | 'unfiled' | folder id */
+		selected: string;
+		/** item count per folder id (roles or skills, depending on the page) */
+		counts: Record<string, number>;
+		totalCount: number;
+		unfiledCount: number;
+		onselect: (id: string) => void;
+		oncreate: (parentId: string | null) => void;
+		onrename: (folder: AgentConfigFolderRow) => void;
+		ondelete: (folder: AgentConfigFolderRow) => void;
+	} = $props();
+
+	type Row = { folder: AgentConfigFolderRow; depth: number; hasChildren: boolean };
+
+	let collapsed = $state<ReadonlySet<string>>(new Set());
+
+	function flatten(list: AgentConfigFolderRow[], collapsedSet: ReadonlySet<string>): Row[] {
+		const rows: Row[] = [];
+		const walk = (parentId: string | null, depth: number) => {
+			const siblings = list
+				.filter((f) => f.parentId === parentId)
+				.sort((a, b) => a.name.localeCompare(b.name));
+			for (const folder of siblings) {
+				const hasChildren = list.some((f) => f.parentId === folder.id);
+				rows.push({ folder, depth, hasChildren });
+				if (hasChildren && !collapsedSet.has(folder.id)) walk(folder.id, depth + 1);
+			}
+		};
+		walk(null, 0);
+		return rows;
+	}
+
+	const rows = $derived(flatten(folders, collapsed));
+
+	function toggleCollapse(folderId: string) {
+		const next = new Set(collapsed);
+		if (next.has(folderId)) next.delete(folderId);
+		else next.add(folderId);
+		collapsed = next;
+	}
+
+	function childFolderCount(folderId: string): number {
+		return folders.filter((f) => f.parentId === folderId).length;
+	}
+
+	const rowClass = (active: boolean) =>
+		`group flex w-full items-center gap-1.5 px-2 py-1.5 text-left text-sm transition hover:bg-surface-100 ${
+			active ? 'bg-primary-100 font-medium text-primary-900' : 'text-surface-800'
+		}`;
+</script>
+
+<nav class="saas-card p-2" aria-label="文件夹导航">
+	<div class="flex items-center justify-between px-2 py-1.5">
+		<span class="text-xs font-semibold uppercase tracking-wide text-surface-600">文件夹</span>
+		<button
+			type="button"
+			class="text-xs text-primary-700 hover:text-primary-900"
+			onclick={() => oncreate(null)}
+		>
+			+ 新建
+		</button>
+	</div>
+
+	<button type="button" class={rowClass(selected === 'all')} onclick={() => onselect('all')}>
+		<span class="w-3.5"></span>
+		<span class="min-w-0 flex-1 truncate">全部</span>
+		<span class="saas-badge-neutral">{totalCount}</span>
+	</button>
+	<button type="button" class={rowClass(selected === 'unfiled')} onclick={() => onselect('unfiled')}>
+		<span class="w-3.5"></span>
+		<span class="min-w-0 flex-1 truncate">未分类</span>
+		<span class="saas-badge-neutral">{unfiledCount}</span>
+	</button>
+
+	{#each rows as row (row.folder.id)}
+		{@const itemCount = counts[row.folder.id] ?? 0}
+		{@const childCount = childFolderCount(row.folder.id)}
+		<div class={rowClass(selected === row.folder.id)} style:padding-left="{0.5 + row.depth * 1}rem">
+			{#if row.hasChildren}
+				<button
+					type="button"
+					class="w-3.5 shrink-0 text-center text-xs text-surface-600"
+					aria-label={collapsed.has(row.folder.id) ? '展开' : '折叠'}
+					onclick={(e) => {
+						e.stopPropagation();
+						toggleCollapse(row.folder.id);
+					}}
+				>
+					{collapsed.has(row.folder.id) ? '▸' : '▾'}
+				</button>
+			{:else}
+				<span class="w-3.5 shrink-0"></span>
+			{/if}
+			<button type="button" class="flex min-w-0 flex-1 items-center gap-1.5 text-left" onclick={() => onselect(row.folder.id)}>
+				<Icon name="folder" class="h-3.5 w-3.5 shrink-0 opacity-60" />
+				<span class="min-w-0 flex-1 truncate">{row.folder.name}</span>
+				{#if itemCount > 0}
+					<span class="saas-badge-neutral">{itemCount}</span>
+				{/if}
+			</button>
+			<span
+				class="flex shrink-0 items-center gap-0.5 opacity-0 transition group-hover:opacity-100 focus-within:opacity-100"
+			>
+				<button
+					type="button"
+					class="flex h-5 w-5 items-center justify-center text-surface-500 hover:text-primary-700"
+					title="在此新建子文件夹"
+					aria-label="在 {row.folder.name} 内新建子文件夹"
+					onclick={() => oncreate(row.folder.id)}
+				>
+					<Icon name="folder-plus" class="h-3.5 w-3.5" />
+				</button>
+				<button
+					type="button"
+					class="flex h-5 w-5 items-center justify-center text-surface-500 hover:text-primary-700"
+					title="重命名 / 移动"
+					aria-label="重命名或移动 {row.folder.name}"
+					onclick={() => onrename(row.folder)}
+				>
+					✎
+				</button>
+				<button
+					type="button"
+					class="flex h-5 w-5 items-center justify-center text-surface-500 hover:text-error-700 disabled:cursor-not-allowed disabled:opacity-30"
+					title={itemCount > 0 || childCount > 0 ? '仅可删除空文件夹' : '删除文件夹'}
+					aria-label="删除 {row.folder.name}"
+					disabled={itemCount > 0 || childCount > 0}
+					onclick={() => ondelete(row.folder)}
+				>
+					×
+				</button>
+			</span>
+		</div>
+	{/each}
+
+	{#if folders.length === 0}
+		<p class="px-2 py-3 text-xs text-surface-600">还没有文件夹。新建一个来分组管理。</p>
+	{/if}
+</nav>

hub/admin-web/src/lib/components/RoleCard.svelte

@@ -5,6 +5,7 @@
 	import { fmtDate } from '$lib/format';
 	import { TOOL_OPTIONS } from '$lib/constants';
 	import SelectField from '$lib/components/SelectField.svelte';
+	import SearchableSelectField from '$lib/components/SearchableSelectField.svelte';
 	import CheckboxControl from '$lib/components/CheckboxControl.svelte';
 	import Icon from '$lib/components/Icon.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
@@ -14,15 +15,20 @@
 		models,
 		skills,
 		slug,
+		folderItems,
 		onupdated,
 		onskillschanged,
+		onfolderchanged,
 	}: {
 		r: AgentRoleRow;
 		models: AgentModelRow[];
 		skills: AgentSkillRow[];
 		slug: string;
+		/** ADR-0028 folder choices ('' = 未分类); transparent grouping only */
+		folderItems: { value: string; label: string }[];
 		onupdated: (updated: AgentRoleRow) => void;
 		onskillschanged: (roleId: string, skillNames: string[]) => void;
+		onfolderchanged: (roleId: string, folderId: string | null) => void;
 	} = $props();
 
 	const initial = {
@@ -44,6 +50,8 @@
 	let isDefault = $state(initial.isDefault);
 	let selectedSkills = $state<string[]>([...initial.skillNames]);
 	let saving = $state(false);
+	let folderValue = $state(r.folderId ?? '');
+	let savingFolder = $state(false);
 
 	const groupedTools = TOOL_OPTIONS.reduce(
 		(acc, t) => {
@@ -53,10 +61,15 @@
 		{} as Record<string, typeof TOOL_OPTIONS>,
 	);
 
-	const modelItems = $derived([
+	const modelItems = $derived.by(() => {
-		{ value: '', label: '（使用平台默认模型）' },
+		const fromCatalog = models.map((m) => ({ value: m.id, label: `${m.label}（${m.id}）` }));
-		...models.map((m) => ({ value: m.id, label: `${m.label}（${m.id}）` })),
+		const items = [{ value: '', label: '（使用平台默认模型）' }, ...fromCatalog];
-	]);
+		// Keep a previously saved model selectable even if it left the live catalog.
+		if (defaultModel !== '' && !items.some((item) => item.value === defaultModel)) {
+			items.push({ value: defaultModel, label: `${defaultModel}（当前已存，不在目录中）` });
+		}
+		return items;
+	});
 
 	const skillItems = $derived(skills.map((s) => ({ value: s.name, label: s.name })));
 
@@ -105,6 +118,24 @@
 	function sortKeyDirty(): boolean {
 		return Number(sortOrder) !== r.sortOrder;
 	}
+
+	// ADR-0028: folder assignment is a label-class change — instant-apply, no
+	// session archival, independent of the configuration save button.
+	async function saveFolder(next: string) {
+		const folderId = next === '' ? null : next;
+		if (folderId === r.folderId) return;
+		savingFolder = true;
+		try {
+			await api.setAgentRoleFolder(slug, r.roleId, folderId);
+			onfolderchanged(r.roleId, folderId);
+			toastSuccess('已更新所属文件夹');
+		} catch (err) {
+			folderValue = r.folderId ?? '';
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			savingFolder = false;
+		}
+	}
 </script>
 
 <div class="saas-card-pad">
@@ -114,6 +145,12 @@
 		{#if r.isDefault}
 			<span class="saas-badge-success">默认</span>
 		{/if}
+		<div class="ml-auto flex items-center gap-2">
+			<span class="text-xs text-surface-600">文件夹</span>
+			<div class="w-44">
+				<SelectField items={folderItems} bind:value={folderValue} disabled={savingFolder} onchange={saveFolder} />
+			</div>
+		</div>
 	</div>
 
 	<div class="grid grid-cols-1 gap-4 md:grid-cols-2">
@@ -129,7 +166,13 @@
 
 	<div class="mt-4">
 		<p class="saas-label">默认模型</p>
-		<SelectField items={modelItems} bind:value={defaultModel} />
+		<SearchableSelectField
+			items={modelItems}
+			bind:value={defaultModel}
+			placeholder="选择模型…"
+			searchPlaceholder="搜索模型名称或 ID"
+			emptyText="无匹配模型"
+		/>
 	</div>
 
 	<div class="mt-4">

hub/admin-web/src/lib/components/SearchableSelectField.svelte

@@ -0,0 +1,102 @@
+<script lang="ts">
+	import { Combobox } from 'bits-ui';
+	import Icon from './Icon.svelte';
+	import type { SelectItem } from './SelectField.svelte';
+
+	let {
+		items,
+		value = $bindable(''),
+		class: className = '',
+		disabled = false,
+		placeholder = '请选择…',
+		searchPlaceholder = '搜索…',
+		emptyText = '无匹配项',
+		onchange,
+	}: {
+		items: SelectItem[];
+		value?: string;
+		class?: string;
+		disabled?: boolean;
+		placeholder?: string;
+		searchPlaceholder?: string;
+		emptyText?: string;
+		onchange?: (value: string) => void;
+	} = $props();
+
+	let searchValue = $state('');
+
+	const filteredItems = $derived.by(() => {
+		const q = searchValue.trim().toLowerCase();
+		if (q === '') return items;
+		return items.filter(
+			(item) => item.label.toLowerCase().includes(q) || item.value.toLowerCase().includes(q),
+		);
+	});
+</script>
+
+<Combobox.Root
+	type="single"
+	{items}
+	{disabled}
+	{value}
+	allowDeselect={false}
+	onValueChange={(next) => {
+		value = next;
+		onchange?.(next);
+	}}
+	onOpenChangeComplete={(open) => {
+		if (!open) searchValue = '';
+	}}
+>
+	<div class="relative {className}">
+		<Combobox.Input
+			class="saas-combobox-input"
+			{disabled}
+			{placeholder}
+			aria-label={searchPlaceholder}
+			oninput={(e) => {
+				searchValue = e.currentTarget.value;
+			}}
+		/>
+		<Combobox.Trigger
+			class="absolute inset-y-0 right-0 flex w-9 items-center justify-center text-surface-600 disabled:cursor-not-allowed disabled:opacity-55"
+			{disabled}
+			aria-label="展开选项"
+		>
+			<svg
+				class="h-4 w-4 shrink-0"
+				viewBox="0 0 24 24"
+				fill="none"
+				stroke="currentColor"
+				stroke-width="1.75"
+				aria-hidden="true"
+			>
+				<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 15l3.75 3.75L15.75 15" />
+				<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 9l3.75-3.75L15.75 9" />
+			</svg>
+		</Combobox.Trigger>
+	</div>
+	<Combobox.Portal>
+		<Combobox.Content class="saas-select-content" sideOffset={6} collisionPadding={8}>
+			<Combobox.Viewport class="max-h-72 overflow-y-auto p-1">
+				{#each filteredItems as item (item.value)}
+					<Combobox.Item
+						class="saas-select-item"
+						value={item.value}
+						label={item.label}
+						disabled={item.disabled}
+					>
+						{#snippet children({ selected })}
+							<span class="min-w-0 flex-1 truncate">{item.label}</span>
+							{#if selected}
+								<Icon name="check" class="ml-2 h-4 w-4 shrink-0 text-primary-600" />
+							{/if}
+						{/snippet}
+					</Combobox.Item>
+				{:else}
+					<div class="px-2 py-2 text-sm text-surface-600">{emptyText}</div>
+				{/each}
+			</Combobox.Viewport>
+		</Combobox.Content>
+	</Combobox.Portal>
+</Combobox.Root>

hub/admin-web/src/lib/components/SkillEditor.svelte

@@ -3,18 +3,24 @@
 	import { api } from '$lib/api';
 	import { fmtDate } from '$lib/format';
 	import Icon from '$lib/components/Icon.svelte';
+	import SelectField from '$lib/components/SelectField.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
 
 	let {
 		slug,
 		skill,
+		folderItems,
 		oninstalled,
 		ondisabled,
+		onfolderchanged,
 	}: {
 		slug: string;
 		skill: AgentSkillRow;
+		/** ADR-0028 folder choices ('' = 未分类); transparent grouping only */
+		folderItems: { value: string; label: string }[];
 		oninstalled: (result: { id: string; name: string; contentDigest: string }) => void;
 		ondisabled: (name: string) => void;
+		onfolderchanged: (name: string, folderId: string | null) => void;
 	} = $props();
 
 	type FileNode = { path: string; content: string };
@@ -28,6 +34,8 @@
 	let dirty = $state(false);
 	let newFilePath = $state('');
 	let showNewFile = $state(false);
+	let folderValue = $state(skill.folderId ?? '');
+	let savingFolder = $state(false);
 
 	const selectedFile = $derived(files.find((f) => f.path === selectedPath) ?? null);
 	const hasManifest = $derived(files.some((f) => f.path === 'SKILL.md'));
@@ -152,6 +160,24 @@
 		dirty = true;
 	}
 
+	// ADR-0028: folder assignment is a label-class change — instant-apply, no
+	// session archival, independent of the content save button.
+	async function saveFolder(next: string) {
+		const folderId = next === '' ? null : next;
+		if (folderId === skill.folderId) return;
+		savingFolder = true;
+		try {
+			await api.setAgentSkillFolder(slug, skill.name, folderId);
+			onfolderchanged(skill.name, folderId);
+			toastSuccess('已更新所属文件夹');
+		} catch (err) {
+			folderValue = skill.folderId ?? '';
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			savingFolder = false;
+		}
+	}
+
 	function updateFrontmatter(content: string, key: string, value: string): string {
 		const regex = new RegExp(`^(${key}:\\s*)(.*?)(\\s*)$`, 'm');
 		if (regex.test(content)) {
@@ -178,6 +204,12 @@
 		{#if skill.disabledAt}
 			<span class="saas-badge-error">已禁用</span>
 		{/if}
+		<div class="ml-auto flex items-center gap-2">
+			<span class="text-xs text-surface-600">文件夹</span>
+			<div class="w-44">
+				<SelectField items={folderItems} bind:value={folderValue} disabled={savingFolder} onchange={saveFolder} />
+			</div>
+		</div>
 	</div>
 
 	<div class="mb-4 grid grid-cols-1 gap-4 md:grid-cols-2">

hub/admin-web/src/routes/admin/roles/+page.svelte

@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
-	import { api, type AgentRoleRow, type AgentModelRow, type AgentSkillRow } from '$lib/api';
+	import { api, type AgentConfigFolderRow, type AgentModelRow, type AgentRoleRow, type AgentSkillRow } from '$lib/api';
 	import { session } from '$lib/session';
 	import { resolveOrg } from '$lib/org';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -8,6 +8,9 @@
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import EmptyState from '$lib/components/EmptyState.svelte';
 	import RoleCard from '$lib/components/RoleCard.svelte';
+	import AgentConfigFolderNav from '$lib/components/AgentConfigFolderNav.svelte';
+	import Modal from '$lib/components/Modal.svelte';
+	import SelectField from '$lib/components/SelectField.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
 
 	const org = $derived(resolveOrg($session.me, page.url.search));
@@ -16,20 +19,32 @@
 	let roles = $state<AgentRoleRow[]>([]);
 	let models = $state<AgentModelRow[]>([]);
 	let skills = $state<AgentSkillRow[]>([]);
+	let folders = $state<AgentConfigFolderRow[]>([]);
 	let loading = $state(true);
 	let error = $state<string | null>(null);
 
+	/** 'all' | 'unfiled' | folder id (ADR-0028: transparent grouping filter) */
+	let selectedFolder = $state<string>('all');
+
 	let newRoleId = $state('');
 	let newLabel = $state('');
 	let adding = $state(false);
 
+	let showFolderModal = $state(false);
+	let folderModalMode = $state<'create' | 'rename'>('create');
+	let folderModalId = $state<string | null>(null);
+	let folderName = $state('');
+	let folderParent = $state('');
+	let savingFolder = $state(false);
+
 	async function load() {
 		loading = true;
 		error = null;
 		try {
-			const [r, s] = await Promise.all([api.agentRoles(slug), api.agentSkills(slug)]);
+			const [r, s, f] = await Promise.all([api.agentRoles(slug), api.agentSkills(slug), api.agentConfigFolders(slug)]);
 			roles = r.roles;
 			skills = s.skills;
+			folders = f.folders;
 			// Model fetch hits the provider API and may fail or be slow; load it
 			// independently so roles remain editable even without a model list.
 			models = [];
@@ -43,6 +58,66 @@
 		}
 	}
 
+	const counts = $derived.by(() => {
+		const map: Record<string, number> = {};
+		for (const r of roles) {
+			if (r.folderId) map[r.folderId] = (map[r.folderId] ?? 0) + 1;
+		}
+		return map;
+	});
+	const unfiledCount = $derived(roles.filter((r) => !r.folderId).length);
+	const visibleRoles = $derived(
+		selectedFolder === 'all'
+			? roles
+			: selectedFolder === 'unfiled'
+				? roles.filter((r) => !r.folderId)
+				: roles.filter((r) => r.folderId === selectedFolder),
+	);
+
+	function folderPath(f: AgentConfigFolderRow): string {
+		const parts: string[] = [f.name];
+		let cur: AgentConfigFolderRow | undefined = f;
+		while (cur?.parentId) {
+			const parent = folders.find((x) => x.id === cur!.parentId);
+			if (!parent) break;
+			parts.unshift(parent.name);
+			cur = parent;
+		}
+		return parts.join(' / ');
+	}
+
+	/** Self + descendant ids of a folder — excluded as move targets in the rename modal. */
+	function subtreeIds(folderId: string): Set<string> {
+		const ids = new Set<string>([folderId]);
+		let grew = true;
+		while (grew) {
+			grew = false;
+			for (const f of folders) {
+				if (f.parentId && ids.has(f.parentId) && !ids.has(f.id)) {
+					ids.add(f.id);
+					grew = true;
+				}
+			}
+		}
+		return ids;
+	}
+
+	const folderItems = $derived([
+		{ value: '', label: '（未分类）' },
+		...folders.map((f) => ({ value: f.id, label: folderPath(f) })),
+	]);
+
+	const moveTargetItems = $derived.by(() => {
+		if (folderModalMode !== 'rename' || folderModalId === null) {
+			return [{ value: '', label: '（根）' }, ...folders.map((f) => ({ value: f.id, label: folderPath(f) }))];
+		}
+		const excluded = subtreeIds(folderModalId);
+		return [
+			{ value: '', label: '（根）' },
+			...folders.filter((f) => !excluded.has(f.id)).map((f) => ({ value: f.id, label: folderPath(f) })),
+		];
+	});
+
 	async function add() {
 		const roleId = newRoleId.trim();
 		const label = newLabel.trim();
@@ -57,7 +132,12 @@
 		adding = true;
 		try {
 			const created = await api.upsertAgentRole(slug, roleId, { label });
-			roles = [...roles, created];
+			let folderId: string | null = null;
+			if (selectedFolder !== 'all' && selectedFolder !== 'unfiled') {
+				await api.setAgentRoleFolder(slug, roleId, selectedFolder);
+				folderId = selectedFolder;
+			}
+			roles = [...roles, { ...created, folderId }];
 			newRoleId = '';
 			newLabel = '';
 			toastSuccess('角色已创建');
@@ -79,6 +159,68 @@
 		roles = roles.map((x) => (x.roleId === roleId ? { ...x, skillNames } : x));
 	}
 
+	function onRoleFolderChanged(roleId: string, folderId: string | null) {
+		roles = roles.map((x) => (x.roleId === roleId ? { ...x, folderId } : x));
+	}
+
+	function openCreateFolder(parentId: string | null) {
+		folderModalMode = 'create';
+		folderModalId = null;
+		folderName = '';
+		folderParent = parentId ?? '';
+		showFolderModal = true;
+	}
+
+	function openRenameFolder(folder: AgentConfigFolderRow) {
+		folderModalMode = 'rename';
+		folderModalId = folder.id;
+		folderName = folder.name;
+		folderParent = folder.parentId ?? '';
+		showFolderModal = true;
+	}
+
+	async function submitFolderModal() {
+		const name = folderName.trim();
+		if (name === '') {
+			toastError('文件夹名称不能为空');
+			return;
+		}
+		savingFolder = true;
+		try {
+			if (folderModalMode === 'create') {
+				await api.createAgentConfigFolder(slug, {
+					name,
+					...(folderParent !== '' ? { parentId: folderParent } : {}),
+				});
+				toastSuccess('文件夹已创建');
+			} else if (folderModalId !== null) {
+				await api.patchAgentConfigFolder(slug, folderModalId, {
+					name,
+					parentId: folderParent === '' ? null : folderParent,
+				});
+				toastSuccess('文件夹已更新');
+			}
+			showFolderModal = false;
+			await load();
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			savingFolder = false;
+		}
+	}
+
+	async function deleteFolder(folder: AgentConfigFolderRow) {
+		if (!confirm(`删除文件夹「${folder.name}」? 仅空文件夹可删除。`)) return;
+		try {
+			await api.deleteAgentConfigFolder(slug, folder.id);
+			if (selectedFolder === folder.id) selectedFolder = 'all';
+			toastSuccess('文件夹已删除');
+			await load();
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
 	$effect(() => {
 		if (slug) load();
 	});
@@ -86,7 +228,7 @@
 
 <PageHeader
 	title="角色"
-	description="角色是组织级数据：组合默认模型、系统提示词、工具白名单与已绑定技能。角色 ID 即飞书斜杠命令（如 /draft）。"
+	description="角色是组织级数据：组合默认模型、系统提示词、工具白名单与已绑定技能。文件夹仅作管理分组，不影响角色解析与默认角色约束。"
 />
 
 {#if loading}
@@ -94,39 +236,92 @@
 {:else if error}
 	<ErrorBanner message={error} onretry={load} />
 {:else}
-	<div class="saas-card-pad mb-6">
+	<div class="grid gap-4 lg:grid-cols-[15rem_1fr]">
-		<h2 class="saas-section-title mb-4">新建角色</h2>
+		<div class="h-fit lg:sticky lg:top-4">
-		<div class="grid gap-3 sm:grid-cols-[10rem_1fr_auto]">
+			<AgentConfigFolderNav
-			<input
+				{folders}
-				class="saas-input font-mono text-sm"
+				selected={selectedFolder}
-				placeholder="角色 ID（如 draft）"
+				{counts}
-				bind:value={newRoleId}
+				totalCount={roles.length}
-				onkeydown={(e) => {
+				{unfiledCount}
-					if (e.key === 'Enter') add();
+				onselect={(id) => (selectedFolder = id)}
-				}}
+				oncreate={openCreateFolder}
+				onrename={openRenameFolder}
+				ondelete={deleteFolder}
 			/>
-			<input
-				class="saas-input"
-				placeholder="显示名（如 草稿）"
-				bind:value={newLabel}
-				onkeydown={(e) => {
-					if (e.key === 'Enter') add();
-				}}
-			/>
-			<button class="saas-btn-primary" onclick={add} disabled={adding}>新建</button>
 		</div>
-		<p class="mt-2 text-xs text-surface-600">角色 ID 仅允许小写字母、数字、下划线与连字符，且以字母或数字开头。</p>
+
+		<div>
+			<div class="saas-card-pad mb-6">
+				<h2 class="saas-section-title mb-4">新建角色</h2>
+				<div class="grid gap-3 sm:grid-cols-[10rem_1fr_auto]">
+					<input
+						class="saas-input font-mono text-sm"
+						placeholder="角色 ID（如 draft）"
+						bind:value={newRoleId}
+						onkeydown={(e) => {
+							if (e.key === 'Enter') add();
+						}}
+					/>
+					<input
+						class="saas-input"
+						placeholder="显示名（如 草稿）"
+						bind:value={newLabel}
+						onkeydown={(e) => {
+							if (e.key === 'Enter') add();
+						}}
+					/>
+					<button class="saas-btn-primary" onclick={add} disabled={adding}>新建</button>
+				</div>
+				<p class="mt-2 text-xs text-surface-600">角色 ID 仅允许小写字母、数字、下划线与连字符，且以字母或数字开头；当前选中文件夹时新角色会自动归入其中。</p>
+			</div>
+
+			{#if roles.length === 0}
+				<div class="saas-card">
+					<EmptyState title="暂无角色" description="组织必须且只能有一个启用中的默认角色；新建第一个角色将自动成为默认。" />
+				</div>
+			{:else if visibleRoles.length === 0}
+				<div class="saas-card">
+					<EmptyState title="此分类下暂无角色" description="在角色卡片上可将其移入当前文件夹。" />
+				</div>
+			{:else}
+				<div class="space-y-4">
+					{#each visibleRoles as r (r.roleId)}
+						<RoleCard
+							{r}
+							{models}
+							{skills}
+							{slug}
+							{folderItems}
+							onupdated={onRoleUpdated}
+							onskillschanged={onRoleSkillsChanged}
+							onfolderchanged={onRoleFolderChanged}
+						/>
+					{/each}
+				</div>
+			{/if}
+		</div>
 	</div>
 
-	{#if roles.length === 0}
+	<Modal bind:open={showFolderModal} title={folderModalMode === 'create' ? '新建文件夹' : '重命名 / 移动文件夹'}>
-		<div class="saas-card">
+		<label class="saas-label" for="agent-folder-name">名称</label>
-			<EmptyState title="暂无角色" description="组织必须且只能有一个启用中的默认角色；新建第一个角色将自动成为默认。" />
+		<input
+			id="agent-folder-name"
+			class="saas-input mb-4"
+			bind:value={folderName}
+			onkeydown={(e) => {
+				if (e.key === 'Enter') submitFolderModal();
+			}}
+		/>
+		<p class="saas-label">父文件夹</p>
+		<div class="mb-4">
+			<SelectField items={moveTargetItems} bind:value={folderParent} />
 		</div>
-	{:else}
+		<div class="flex justify-end gap-2">
-		<div class="space-y-4">
+			<button class="saas-btn-ghost" onclick={() => (showFolderModal = false)}>取消</button>
-			{#each roles as r (r.roleId)}
+			<button class="saas-btn-primary" onclick={submitFolderModal} disabled={savingFolder}>
-				<RoleCard {r} {models} {skills} {slug} onupdated={onRoleUpdated} onskillschanged={onRoleSkillsChanged} />
+				{savingFolder ? '保存中…' : '保存'}
-			{/each}
+			</button>
 		</div>
-	{/if}
+	</Modal>
 {/if}

hub/admin-web/src/routes/admin/skills/+page.svelte

@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
-	import { api, type AgentSkillRow, type SkillFileEntry } from '$lib/api';
+	import { api, type AgentConfigFolderRow, type AgentSkillRow, type SkillFileEntry } from '$lib/api';
 	import { session } from '$lib/session';
 	import { resolveOrg } from '$lib/org';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -8,27 +8,42 @@
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import EmptyState from '$lib/components/EmptyState.svelte';
 	import SkillEditor from '$lib/components/SkillEditor.svelte';
+	import AgentConfigFolderNav from '$lib/components/AgentConfigFolderNav.svelte';
+	import Modal from '$lib/components/Modal.svelte';
+	import SelectField from '$lib/components/SelectField.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
 
 	const org = $derived(resolveOrg($session.me, page.url.search));
 	const slug = $derived(org?.slug ?? '');
 
 	let skills = $state<AgentSkillRow[]>([]);
+	let folders = $state<AgentConfigFolderRow[]>([]);
 	let loading = $state(true);
 	let error = $state<string | null>(null);
 
+	/** 'all' | 'unfiled' | folder id (ADR-0028: transparent grouping filter) */
+	let selectedFolder = $state<string>('all');
+
 	let showNewSkill = $state(false);
 	let newSkillName = $state('');
 	let newSkillVersion = $state('0.1.0');
 	let newSkillDescription = $state('');
 	let creating = $state(false);
 
+	let showFolderModal = $state(false);
+	let folderModalMode = $state<'create' | 'rename'>('create');
+	let folderModalId = $state<string | null>(null);
+	let folderName = $state('');
+	let folderParent = $state('');
+	let savingFolder = $state(false);
+
 	async function load() {
 		loading = true;
 		error = null;
 		try {
-			const res = await api.agentSkills(slug);
+			const [s, f] = await Promise.all([api.agentSkills(slug), api.agentConfigFolders(slug)]);
-			skills = res.skills;
+			skills = s.skills;
+			folders = f.folders;
 		} catch (err) {
 			error = err instanceof Error ? err.message : String(err);
 		} finally {
@@ -36,6 +51,66 @@
 		}
 	}
 
+	const counts = $derived.by(() => {
+		const map: Record<string, number> = {};
+		for (const s of skills) {
+			if (s.folderId) map[s.folderId] = (map[s.folderId] ?? 0) + 1;
+		}
+		return map;
+	});
+	const unfiledCount = $derived(skills.filter((s) => !s.folderId).length);
+	const visibleSkills = $derived(
+		selectedFolder === 'all'
+			? skills
+			: selectedFolder === 'unfiled'
+				? skills.filter((s) => !s.folderId)
+				: skills.filter((s) => s.folderId === selectedFolder),
+	);
+
+	function folderPath(f: AgentConfigFolderRow): string {
+		const parts: string[] = [f.name];
+		let cur: AgentConfigFolderRow | undefined = f;
+		while (cur?.parentId) {
+			const parent = folders.find((x) => x.id === cur!.parentId);
+			if (!parent) break;
+			parts.unshift(parent.name);
+			cur = parent;
+		}
+		return parts.join(' / ');
+	}
+
+	/** Self + descendant ids of a folder — excluded as move targets in the rename modal. */
+	function subtreeIds(folderId: string): Set<string> {
+		const ids = new Set<string>([folderId]);
+		let grew = true;
+		while (grew) {
+			grew = false;
+			for (const f of folders) {
+				if (f.parentId && ids.has(f.parentId) && !ids.has(f.id)) {
+					ids.add(f.id);
+					grew = true;
+				}
+			}
+		}
+		return ids;
+	}
+
+	const folderItems = $derived([
+		{ value: '', label: '（未分类）' },
+		...folders.map((f) => ({ value: f.id, label: folderPath(f) })),
+	]);
+
+	const moveTargetItems = $derived.by(() => {
+		if (folderModalMode !== 'rename' || folderModalId === null) {
+			return [{ value: '', label: '（根）' }, ...folders.map((f) => ({ value: f.id, label: folderPath(f) }))];
+		}
+		const excluded = subtreeIds(folderModalId);
+		return [
+			{ value: '', label: '（根）' },
+			...folders.filter((f) => !excluded.has(f.id)).map((f) => ({ value: f.id, label: folderPath(f) })),
+		];
+	});
+
 	async function createSkill() {
 		const name = newSkillName.trim();
 		if (name === '') {
@@ -56,6 +131,9 @@
 			const manifest = buildManifest(name, newSkillDescription.trim());
 			const files: SkillFileEntry[] = [{ path: 'SKILL.md', content: manifest }];
 			const result = await api.installAgentSkill(slug, name, { version, files });
+			if (selectedFolder !== 'all' && selectedFolder !== 'unfiled') {
+				await api.setAgentSkillFolder(slug, result.name, selectedFolder);
+			}
 			toastSuccess(`技能 ${result.name} 已创建`);
 			newSkillName = '';
 			newSkillDescription = '';
@@ -81,6 +159,68 @@
 		load();
 	}
 
+	function onSkillFolderChanged(name: string, folderId: string | null) {
+		skills = skills.map((s) => (s.name === name ? { ...s, folderId } : s));
+	}
+
+	function openCreateFolder(parentId: string | null) {
+		folderModalMode = 'create';
+		folderModalId = null;
+		folderName = '';
+		folderParent = parentId ?? '';
+		showFolderModal = true;
+	}
+
+	function openRenameFolder(folder: AgentConfigFolderRow) {
+		folderModalMode = 'rename';
+		folderModalId = folder.id;
+		folderName = folder.name;
+		folderParent = folder.parentId ?? '';
+		showFolderModal = true;
+	}
+
+	async function submitFolderModal() {
+		const name = folderName.trim();
+		if (name === '') {
+			toastError('文件夹名称不能为空');
+			return;
+		}
+		savingFolder = true;
+		try {
+			if (folderModalMode === 'create') {
+				await api.createAgentConfigFolder(slug, {
+					name,
+					...(folderParent !== '' ? { parentId: folderParent } : {}),
+				});
+				toastSuccess('文件夹已创建');
+			} else if (folderModalId !== null) {
+				await api.patchAgentConfigFolder(slug, folderModalId, {
+					name,
+					parentId: folderParent === '' ? null : folderParent,
+				});
+				toastSuccess('文件夹已更新');
+			}
+			showFolderModal = false;
+			await load();
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			savingFolder = false;
+		}
+	}
+
+	async function deleteFolder(folder: AgentConfigFolderRow) {
+		if (!confirm(`删除文件夹「${folder.name}」? 仅空文件夹可删除。`)) return;
+		try {
+			await api.deleteAgentConfigFolder(slug, folder.id);
+			if (selectedFolder === folder.id) selectedFolder = 'all';
+			toastSuccess('文件夹已删除');
+			await load();
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		}
+	}
+
 	$effect(() => {
 		if (slug) load();
 	});
@@ -88,7 +228,7 @@
 
 <PageHeader
 	title="技能"
-	description="技能是组织级 Agent 能力包：一个包含 SKILL.md manifest 的目录。技能内容按 SHA-256 content-addressed 存储，变更后绑定角色的活跃会话自动归档。"
+	description="技能是组织级 Agent 能力包：一个包含 SKILL.md manifest 的目录。文件夹仅作管理分组，不影响技能解析与绑定。"
 />
 
 {#if loading}
@@ -96,49 +236,100 @@
 {:else if error}
 	<ErrorBanner message={error} onretry={load} />
 {:else}
-	<div class="saas-card-pad mb-6">
+	<div class="grid gap-4 lg:grid-cols-[15rem_1fr]">
-		<div class="flex items-center justify-between">
+		<div class="h-fit lg:sticky lg:top-4">
-			<h2 class="saas-section-title">新建技能</h2>
+			<AgentConfigFolderNav
-			<button class="text-sm text-primary-700 hover:text-primary-900" onclick={() => (showNewSkill = !showNewSkill)}>
+				{folders}
-				{showNewSkill ? '取消' : '+ 新建'}
+				selected={selectedFolder}
-			</button>
+				{counts}
+				totalCount={skills.length}
+				{unfiledCount}
+				onselect={(id) => (selectedFolder = id)}
+				oncreate={openCreateFolder}
+				onrename={openRenameFolder}
+				ondelete={deleteFolder}
+			/>
 		</div>
-		{#if showNewSkill}
+
-			<div class="mt-4 grid gap-3 sm:grid-cols-[12rem_8rem_1fr_auto]">
+		<div>
-				<input
+			<div class="saas-card-pad mb-6">
-					class="saas-input font-mono text-sm"
+				<div class="flex items-center justify-between">
-					placeholder="技能名（如 typst-help）"
+					<h2 class="saas-section-title">新建技能</h2>
-					bind:value={newSkillName}
+					<button class="text-sm text-primary-700 hover:text-primary-900" onclick={() => (showNewSkill = !showNewSkill)}>
-				/>
+						{showNewSkill ? '取消' : '+ 新建'}
-				<input
+					</button>
-					class="saas-input text-sm"
+				</div>
-					placeholder="版本号"
+				{#if showNewSkill}
-					bind:value={newSkillVersion}
+					<div class="mt-4 grid gap-3 sm:grid-cols-[12rem_8rem_1fr_auto]">
-				/>
+						<input
-				<input
+							class="saas-input font-mono text-sm"
-					class="saas-input text-sm"
+							placeholder="技能名（如 typst-help）"
-					placeholder="描述"
+							bind:value={newSkillName}
-					bind:value={newSkillDescription}
+						/>
-				/>
+						<input
-				<button class="saas-btn-primary" onclick={createSkill} disabled={creating}>
+							class="saas-input text-sm"
-					{creating ? '创建中…' : '创建'}
+							placeholder="版本号"
-				</button>
+							bind:value={newSkillVersion}
+						/>
+						<input
+							class="saas-input text-sm"
+							placeholder="描述"
+							bind:value={newSkillDescription}
+						/>
+						<button class="saas-btn-primary" onclick={createSkill} disabled={creating}>
+							{creating ? '创建中…' : '创建'}
+						</button>
+					</div>
+					<p class="mt-2 text-xs text-surface-600">
+						技能名称仅允许小写字母、数字和连字符，且以字母或数字开头。创建后会生成 SKILL.md 模板；当前选中文件夹时新技能会自动归入其中。
+					</p>
+				{/if}
 			</div>
-			<p class="mt-2 text-xs text-surface-600">
+
-				技能名称仅允许小写字母、数字和连字符，且以字母或数字开头。创建后会生成 SKILL.md 模板。
+			{#if skills.length === 0}
-			</p>
+				<div class="saas-card">
-		{/if}
+					<EmptyState title="暂无技能" description="新建一个技能，然后在角色管理中绑定到角色。" />
+				</div>
+			{:else if visibleSkills.length === 0}
+				<div class="saas-card">
+					<EmptyState title="此分类下暂无技能" description="在技能卡片上可将其移入当前文件夹。" />
+				</div>
+			{:else}
+				<div class="space-y-4">
+					{#each visibleSkills as skill (skill.id)}
+						<SkillEditor
+							{slug}
+							{skill}
+							{folderItems}
+							oninstalled={onInstalled}
+							ondisabled={onDisabled}
+							onfolderchanged={onSkillFolderChanged}
+						/>
+					{/each}
+				</div>
+			{/if}
+		</div>
 	</div>
 
-	{#if skills.length === 0}
+	<Modal bind:open={showFolderModal} title={folderModalMode === 'create' ? '新建文件夹' : '重命名 / 移动文件夹'}>
-		<div class="saas-card">
+		<label class="saas-label" for="agent-folder-name">名称</label>
-			<EmptyState title="暂无技能" description="新建一个技能，然后在角色管理中绑定到角色。" />
+		<input
+			id="agent-folder-name"
+			class="saas-input mb-4"
+			bind:value={folderName}
+			onkeydown={(e) => {
+				if (e.key === 'Enter') submitFolderModal();
+			}}
+		/>
+		<p class="saas-label">父文件夹</p>
+		<div class="mb-4">
+			<SelectField items={moveTargetItems} bind:value={folderParent} />
 		</div>
-	{:else}
+		<div class="flex justify-end gap-2">
-		<div class="space-y-4">
+			<button class="saas-btn-ghost" onclick={() => (showFolderModal = false)}>取消</button>
-			{#each skills as skill (skill.id)}
+			<button class="saas-btn-primary" onclick={submitFolderModal} disabled={savingFolder}>
-				<SkillEditor {slug} {skill} oninstalled={onInstalled} ondisabled={onDisabled} />
+				{savingFolder ? '保存中…' : '保存'}
-			{/each}
+			</button>
 		</div>
-	{/if}
+	</Modal>
 {/if}

hub/admin-web/src/routes/app.css

@@ -406,7 +406,8 @@
 		resize: vertical;
 	}
 
-	.saas-select-trigger {
+	.saas-select-trigger,
+	.saas-combobox-input {
 		display: inline-flex;
 		width: 100%;
 		align-items: center;
@@ -425,14 +426,25 @@
 		text-align: left;
 	}
 
+	.saas-combobox-input {
+		cursor: text;
+		padding-right: 2.25rem;
+	}
+
+	.saas-combobox-input::placeholder {
+		color: var(--color-surface-500);
+	}
+
 	.saas-select-trigger:focus-visible,
-	.saas-select-trigger[data-state='open'] {
+	.saas-select-trigger[data-state='open'],
+	.saas-combobox-input:focus {
 		border-color: var(--color-primary-600);
 		box-shadow: inset 0 0 0 1px var(--color-primary-600);
 	}
 
 	.saas-select-trigger:disabled,
-	.saas-select-trigger[data-disabled] {
+	.saas-select-trigger[data-disabled],
+	.saas-combobox-input:disabled {
 		cursor: not-allowed;
 		opacity: 0.55;
 	}
@@ -443,9 +455,15 @@
 
 	.saas-select-content {
 		z-index: 70;
-		max-height: min(18rem, var(--bits-select-content-available-height, 18rem));
+		max-height: min(
-		width: var(--bits-select-anchor-width);
+			18rem,
-		min-width: var(--bits-select-anchor-width);
+			var(
+				--bits-combobox-content-available-height,
+				var(--bits-select-content-available-height, 18rem)
+			)
+		);
+		width: var(--bits-combobox-anchor-width, var(--bits-select-anchor-width));
+		min-width: var(--bits-combobox-anchor-width, var(--bits-select-anchor-width));
 		overflow: hidden;
 		border-radius: 0;
 		border: 1px solid var(--color-surface-400);

hub/filelib-web/index.html

@@ -1,12 +0,0 @@
-<!doctype html>
-<html lang="zh-CN">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>文件库</title>
-  </head>
-  <body>
-    <div id="app"></div>
-    <script type="module" src="/src/main.ts"></script>
-  </body>
-</html>

hub/filelib-web/package.json

@@ -1,21 +0,0 @@
-{
-  "name": "filelib-web",
-  "private": true,
-  "version": "0.1.0",
-  "type": "module",
-  "scripts": {
-    "dev": "vite",
-    "build": "vite build",
-    "preview": "vite preview",
-    "check": "svelte-check --tsconfig ./tsconfig.json"
-  },
-  "devDependencies": {
-    "@sveltejs/vite-plugin-svelte": "^7.1.2",
-    "@tailwindcss/vite": "^4.3.2",
-    "svelte": "^5.56.1",
-    "svelte-check": "^4.6.0",
-    "tailwindcss": "^4.3.2",
-    "typescript": "^5.7.0",
-    "vite": "^8.0.16"
-  }
-}

hub/filelib-web/src/App.svelte

@@ -1,30 +0,0 @@
-<script lang="ts">
-  import { onMount } from "svelte";
-  import { api, UnauthenticatedError } from "./lib/api.js";
-  import { me, authChecked } from "./lib/stores.js";
-  import type { MeResponse } from "./lib/types.js";
-  import LoginView from "./lib/LoginView.svelte";
-  import BrowserShell from "./lib/BrowserShell.svelte";
-  import Toasts from "./lib/Toasts.svelte";
-
-  onMount(async () => {
-    try {
-      me.set(await api<MeResponse>("/database/api/me"));
-    } catch (e) {
-      if (!(e instanceof UnauthenticatedError)) console.error(e);
-      me.set(null);
-    } finally {
-      authChecked.set(true);
-    }
-  });
-</script>
-
-{#if !$authChecked}
-  <div class="flex h-full items-center justify-center text-ink-3">加载中…</div>
-{:else if $me}
-  <BrowserShell />
-{:else}
-  <LoginView />
-{/if}
-
-<Toasts />

hub/filelib-web/src/app.css

@@ -1,66 +0,0 @@
-@import "tailwindcss";
-
-/* 全局 UI 主题令牌(与 hub 端 uiTheme.ts 同源) */
-@theme {
-  --color-bg: #fcfcfb;
-  --color-panel: #ffffff;
-  --color-sidebar: #f7f7f5;
-  --color-ink: #1a1a18;
-  --color-ink-2: #6b6a66;
-  --color-ink-3: #9c9b96;
-  --color-line: #ecece8;
-  --color-line-soft: #f1f1ee;
-  --color-hover: #f4f4f1;
-  --color-selected: #ebebe7;
-  --color-accent: #1a1a18;
-  --color-accent-hover: #333330;
-  --color-danger: #a13a33;
-  --color-guide: #e9e9e5;
-  --color-diff-add-bg: #f3f6f2;
-  --color-diff-add-text: #4a6741;
-  --color-diff-del-bg: #f8f2f1;
-  --color-diff-del-text: #a13a33;
-}
-
-html,
-body,
-#app {
-  height: 100%;
-}
-
-body {
-  background: var(--color-bg);
-  color: var(--color-ink);
-  font-family:
-    "Inter",
-    -apple-system,
-    "Segoe UI",
-    "PingFang SC",
-    "Microsoft YaHei",
-    sans-serif;
-  font-size: 14px;
-  line-height: 1.65;
-  -webkit-font-smoothing: antialiased;
-}
-
-.font-mono {
-  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-}
-
-/* diff 渲染 */
-pre.diff {
-  white-space: pre-wrap;
-  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-  font-size: 12.5px;
-  line-height: 1.75;
-}
-pre.diff .add {
-  display: block;
-  color: var(--color-diff-add-text);
-  background: var(--color-diff-add-bg);
-}
-pre.diff .del {
-  display: block;
-  color: var(--color-diff-del-text);
-  background: var(--color-diff-del-bg);
-}

hub/filelib-web/src/lib/BrowserShell.svelte

@@ -1,141 +0,0 @@
-<script lang="ts">
-  import { onMount } from "svelte";
-  import { api } from "./api.js";
-  import { me, toastErr, toastOk } from "./stores.js";
-  import { treeVersion, bumpTree, currentNode, selectedFilePath, clearSelectedFile, bumpFiles } from "./browser.js";
-  import type { NodeChild } from "./types.js";
-  import TreeNode from "./TreeNode.svelte";
-  import NodeDetailPanel from "./NodeDetailPanel.svelte";
-  import FileEditor from "./FileEditor.svelte";
-  import Modal from "./Modal.svelte";
-
-  let roots = $state<NodeChild[] | null>(null);
-  let treeError = $state<string | null>(null);
-  let showCreateRoot = $state(false);
-  let newName = $state("");
-  let newKind = $state<"FOLDER" | "PROJECT">("FOLDER");
-  let newDesc = $state("");
-
-  async function loadRoots(): Promise<void> {
-    try {
-      const r = await api<{ nodes: NodeChild[] }>("/database/api/nodes");
-      roots = r.nodes;
-      treeError = null;
-    } catch (e) {
-      treeError = e instanceof Error ? e.message : String(e);
-    }
-  }
-
-  onMount(loadRoots);
-  $effect(() => {
-    void $treeVersion;
-    void loadRoots();
-  });
-
-  async function createRoot(): Promise<void> {
-    const name = newName.trim();
-    if (name === "") return;
-    try {
-      await api("/database/api/nodes", {
-        method: "POST",
-        body: {
-          parentId: null,
-          kind: newKind,
-          name,
-          ...(newDesc.trim() !== "" ? { description: newDesc.trim() } : {}),
-        },
-      });
-      toastOk("已创建");
-      showCreateRoot = false;
-      newName = ""; newKind = "FOLDER"; newDesc = "";
-      bumpTree();
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function logout(): Promise<void> {
-    try { await fetch("/auth/logout", { method: "POST", credentials: "same-origin" }); } catch { /* ignore */ }
-    me.set(null);
-  }
-
-  const initial = $derived(($me?.userId ?? "U").slice(0, 1).toUpperCase());
-</script>
-
-<div class="flex h-full">
-  <!-- 侧栏 -->
-  <aside class="flex w-[300px] shrink-0 flex-col border-r border-line-soft bg-sidebar">
-    <div class="flex items-center justify-between border-b border-line-soft px-4 py-3.5">
-      <span class="text-[15px] font-semibold text-ink">文件库</span>
-      {#if $me?.isWebsiteAdmin}
-        <button class="rounded-lg border border-line bg-panel px-2.5 py-1 text-[11.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreateRoot = true)}>
-          + 根目录
-        </button>
-      {/if}
-    </div>
-
-    <div class="flex-1 overflow-y-auto px-2 py-2 text-[13px]">
-      {#if roots === null}
-        <div class="px-3 py-6 text-center text-xs text-ink-3">加载中…</div>
-      {:else if treeError}
-        <div class="px-3 py-6 text-center text-xs text-danger">{treeError}</div>
-      {:else if roots.length === 0}
-        <div class="px-3 py-6 text-center text-xs text-ink-3">
-          {$me?.isWebsiteAdmin ? "空文件库 · 点上方「+ 根目录」开始" : "文件库为空,请联系管理员创建根目录"}
-        </div>
-      {:else}
-        {#each roots as node (node.id)}
-          <TreeNode {node} depth={0} />
-        {/each}
-      {/if}
-    </div>
-
-    <div class="flex items-center gap-2 border-t border-line-soft px-4 py-3 text-[12.5px]">
-      <div class="flex h-6 w-6 shrink-0 items-center justify-center rounded-full bg-accent text-[11px] font-semibold text-white">{initial}</div>
-      <span class="flex-1 truncate text-ink">{$me?.userId ?? ""}</span>
-      <button class="rounded-lg border border-line-soft px-2.5 py-1 text-[11.5px] text-ink-3 transition hover:bg-hover hover:text-ink" onclick={logout} title="退出登录">退出</button>
-    </div>
-  </aside>
-
-  <!-- 主区 -->
-  <main class="flex-1 overflow-y-auto">
-    <NodeDetailPanel />
-  </main>
-
-  <!-- 右侧:文件预览/编辑栏(选中文件时出现) -->
-  {#if $selectedFilePath && $currentNode?.kind === "PROJECT"}
-    <section class="flex w-[46%] min-w-[420px] shrink-0 flex-col overflow-y-auto border-l border-line-soft bg-bg p-4">
-      <FileEditor
-        projectId={$currentNode.id}
-        path={$selectedFilePath}
-        role={$currentNode.role}
-        onchanged={bumpFiles}
-        onclose={clearSelectedFile}
-      />
-    </section>
-  {/if}
-</div>
-
-{#if showCreateRoot}
-  <Modal title="新建根目录" onclose={() => (showCreateRoot = false)}>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="root-name">名称</label>
-      <input id="root-name" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newName} placeholder="例如:物理教研" />
-    </div>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="root-kind">类型</label>
-      <select id="root-kind" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newKind}>
-        <option value="FOLDER">文件夹</option>
-        <option value="PROJECT">项目(课程资源库)</option>
-      </select>
-    </div>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="root-desc">简介(可选)</label>
-      <textarea id="root-desc" rows="3" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-xs outline-none focus:border-accent" bind:value={newDesc} placeholder="简要说明用途…"></textarea>
-    </div>
-    <div class="mt-4 flex justify-end gap-2">
-      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreateRoot = false)}>取消</button>
-      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={createRoot}>创建</button>
-    </div>
-  </Modal>
-{/if}

hub/filelib-web/src/lib/FileEditor.svelte

@@ -1,165 +0,0 @@
-<script lang="ts">
-  import { api, ApiError } from "./api.js";
-  import { toastOk, toastErr, toast } from "./stores.js";
-  import type { FileContent, VersionInfo, Role } from "./types.js";
-  import Modal from "./Modal.svelte";
-
-  let { projectId, path, role, onchanged, onclose }: { projectId: string; path: string; role: Role; onchanged: () => void; onclose?: () => void } = $props();
-
-  let file = $state<FileContent | null>(null);
-  let draft = $state("");
-  let loadError = $state<string | null>(null);
-  let conflict = $state<{ currentVersion: string; diff: string } | null>(null);
-  let showHistory = $state(false);
-  let history = $state<VersionInfo[]>([]);
-
-  const canEdit = $derived(role !== "VIEW");
-
-  async function load(): Promise<void> {
-    try {
-      file = await api<FileContent>(`/database/api/projects/${projectId}/file?path=${encodeURIComponent(path)}`);
-      draft = file.encoding === "utf8" ? file.content : "";
-      loadError = null;
-      conflict = null;
-    } catch (e) {
-      loadError = e instanceof Error ? e.message : String(e);
-    }
-  }
-
-  $effect(() => {
-    void projectId;
-    void path;
-    void load();
-  });
-
-  async function save(): Promise<void> {
-    if (file === null) return;
-    try {
-      const r = await api<{ version: string }>(`/database/api/projects/${projectId}/file/commits`, {
-        method: "POST",
-        body: { path: file.path, baseVersion: file.version, content: draft },
-      });
-      toastOk("已提交 " + r.version);
-      await load();
-      onchanged();
-    } catch (e) {
-      if (e instanceof ApiError && e.status === 409 && typeof e.details?.["currentVersion"] === "string") {
-        await showConflict(e.details["currentVersion"]);
-      } else {
-        toastErr(e instanceof Error ? e.message : String(e));
-      }
-    }
-  }
-
-  async function showConflict(currentVersion: string): Promise<void> {
-    if (file === null) return;
-    try {
-      const r = await api<{ diff: string }>(
-        `/database/api/projects/${projectId}/file/diff?path=${encodeURIComponent(file.path)}&from=${encodeURIComponent(file.version)}&to=${encodeURIComponent(currentVersion)}`,
-      );
-      conflict = { currentVersion, diff: r.diff };
-      file = { ...file, version: currentVersion };
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function acceptLatest(): Promise<void> {
-    conflict = null;
-    await load();
-    toast("已载入最新内容,请在此基础上合并", "info");
-  }
-
-  async function remove(): Promise<void> {
-    if (file === null || !confirm("删除文件 " + file.path + "?")) return;
-    try {
-      await api(`/database/api/projects/${projectId}/file?path=${encodeURIComponent(file.path)}`, {
-        method: "DELETE",
-        body: { baseVersion: file.version },
-      });
-      toastOk("已删除");
-      file = null;
-      onchanged();
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function openHistory(): Promise<void> {
-    try {
-      const r = await api<{ history: VersionInfo[] }>(`/database/api/projects/${projectId}/file/history?path=${encodeURIComponent(path)}`);
-      history = r.history;
-      showHistory = true;
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  function renderDiff(diff: string): string {
-    return diff
-      .replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")
-      .replace(/^\+(.*)$/gm, '<span class="add">+$1</span>')
-      .replace(/^-(.*)$/gm, '<span class="del">-$1</span>');
-  }
-</script>
-
-{#if loadError}
-  <div class="rounded-xl border border-line-soft bg-panel p-5 text-xs text-danger">{loadError}</div>
-{:else if file}
-  <div class="rounded-xl border border-line-soft bg-panel p-5">
-    <div class="mb-2.5 flex items-center justify-between">
-      <span class="font-mono text-[11px] text-ink-3">{file.path} @ {file.version}</span>
-      <div class="flex items-center gap-2">
-        <a class="rounded-lg border border-line bg-panel px-3 py-1 text-[12px] font-medium text-ink transition hover:bg-hover" href="/database/api/projects/{projectId}/file/raw?path={encodeURIComponent(file.path)}" download>下载</a>
-        <button class="rounded-lg border border-line bg-panel px-3 py-1 text-[12px] font-medium text-ink transition hover:bg-hover" onclick={openHistory}>历史</button>
-        {#if canEdit}
-          <button class="rounded-lg border border-transparent px-3 py-1 text-[12px] font-medium text-danger transition hover:bg-[#A13A3312]" onclick={remove}>删除文件</button>
-        {/if}
-        {#if onclose}
-          <button class="rounded-lg border border-line bg-panel px-2.5 py-1 text-[12px] font-medium text-ink-3 transition hover:bg-hover hover:text-ink" onclick={onclose} title="关闭预览">✕</button>
-        {/if}
-      </div>
-    </div>
-
-    {#if file.encoding === "base64"}
-      <div class="text-xs text-ink-3">二进制文件({file.size} B),不支持在线编辑</div>
-    {:else}
-      <textarea rows="14" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-xs leading-7 outline-none focus:border-accent" bind:value={draft} readonly={!canEdit}></textarea>
-    {/if}
-
-    {#if canEdit && file.encoding !== "base64"}
-      <div class="mt-3 flex justify-end">
-        <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={save}>提交修改</button>
-      </div>
-    {/if}
-
-    {#if conflict}
-      <div class="mt-3.5 rounded-xl border border-[#E8E2C8] bg-[#FCFBF4] p-4">
-        <div class="mb-2 text-[13px] font-semibold text-[#6E6329]">冲突:他人已提交 {conflict.currentVersion},差异如下(你的基版 → 最新版)</div>
-        <pre class="diff rounded-lg border border-line-soft bg-panel p-3">{@html renderDiff(conflict.diff)}</pre>
-        <div class="mt-2 text-[11.5px] text-[#8A8059]">请人工合并后,以最新内容为全文重新提交(基版将更新为 {conflict.currentVersion})</div>
-        <div class="mt-2 flex justify-end">
-          <button class="rounded-lg border border-line bg-panel px-3 py-1 text-[12px] font-medium text-ink transition hover:bg-hover" onclick={acceptLatest}>载入最新内容</button>
-        </div>
-      </div>
-    {/if}
-  </div>
-{:else}
-  <div class="rounded-xl border border-line-soft bg-panel p-5 text-xs text-ink-3">加载中…</div>
-{/if}
-
-{#if showHistory}
-  <Modal title="版本历史" onclose={() => (showHistory = false)}>
-    <div class="max-h-80 overflow-y-auto">
-      {#each history as v (v.version)}
-        <div class="border-t border-line-soft py-2 text-xs first:border-t-0">
-          <span class="font-mono text-accent">{v.version}</span> {v.message}
-          <div class="text-ink-3">{new Date(v.committedAt).toLocaleString("zh-CN")}{v.author ? " · " + v.author : ""}</div>
-        </div>
-      {/each}
-    </div>
-    <div class="mt-3 flex justify-end">
-      <button class="rounded-lg border border-line bg-panel px-3 py-1 text-[12px] font-medium text-ink transition hover:bg-hover" onclick={() => (showHistory = false)}>关闭</button>
-    </div>
-  </Modal>
-{/if}

hub/filelib-web/src/lib/FilesPanel.svelte

@@ -1,137 +0,0 @@
-<script lang="ts">
-  import { api } from "./api.js";
-  import { toastOk, toastErr } from "./stores.js";
-  import { selectedFilePath, filesVersion } from "./browser.js";
-  import type { FileEntry, NodeDetail } from "./types.js";
-  import Modal from "./Modal.svelte";
-
-  let { node }: { node: NodeDetail } = $props();
-
-  let files = $state<FileEntry[] | null>(null);
-  let loadError = $state<string | null>(null);
-  let showNewFile = $state(false);
-  let newPath = $state("");
-  let newContent = $state("");
-  let uploadInput: HTMLInputElement;
-
-  const canEdit = $derived(node.role !== "VIEW");
-
-  async function loadFiles(): Promise<void> {
-    try {
-      const r = await api<{ files: FileEntry[] }>(`/database/api/projects/${node.id}/files`);
-      files = r.files;
-      loadError = null;
-    } catch (e) {
-      loadError = e instanceof Error ? e.message : String(e);
-    }
-  }
-
-  $effect(() => {
-    void node.id;
-    void $filesVersion;
-    void loadFiles();
-  });
-
-  async function submitNewFile(): Promise<void> {
-    const path = newPath.trim();
-    if (path === "") return;
-    try {
-      await api(`/database/api/projects/${node.id}/file`, {
-        method: "PUT",
-        body: { path, content: newContent },
-      });
-      toastOk("已创建");
-      showNewFile = false;
-      newPath = ""; newContent = "";
-      await loadFiles();
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  function u8ToBase64(bytes: Uint8Array): string {
-    let bin = "";
-    const CHUNK = 0x8000;
-    for (let i = 0; i < bytes.length; i += CHUNK) {
-      bin += String.fromCharCode.apply(null, Array.from(bytes.subarray(i, i + CHUNK)) as unknown as number[]);
-    }
-    return btoa(bin);
-  }
-
-  async function doUpload(e: Event): Promise<void> {
-    const input = e.target as HTMLInputElement;
-    const file = input.files?.[0];
-    input.value = "";
-    if (!file) return;
-    if (file.size > 10 * 1024 * 1024) {
-      toastErr("文件超过 10MB 上限");
-      return;
-    }
-    const targetPath = prompt("保存到路径(可含目录):", "材料/" + file.name);
-    if (!targetPath) return;
-    const bytes = new Uint8Array(await file.arrayBuffer());
-    const isBinary = bytes.includes(0);
-    const body = isBinary
-      ? { path: targetPath, content: u8ToBase64(bytes), encoding: "base64" }
-      : { path: targetPath, content: new TextDecoder("utf-8").decode(bytes), encoding: "utf8" };
-    try {
-      await api(`/database/api/projects/${node.id}/file`, { method: "PUT", body });
-      toastOk("已上传 " + file.name);
-      await loadFiles();
-    } catch (err) {
-      toastErr(err instanceof Error ? err.message : String(err));
-    }
-  }
-</script>
-
-<div class="rounded-xl border border-line-soft bg-panel p-5">
-  <div class="mb-2 flex items-center justify-between">
-    <div class="text-[13px] font-semibold">项目文件({files?.length ?? 0})</div>
-    {#if canEdit}
-      <div class="flex gap-2">
-        <button class="rounded-lg border border-line bg-panel px-3 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showNewFile = true)}>+ 新建文件</button>
-        <button class="rounded-lg bg-accent px-3 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={() => uploadInput.click()}>上传文件</button>
-        <input bind:this={uploadInput} type="file" class="hidden" onchange={doUpload} />
-      </div>
-    {/if}
-  </div>
-
-  {#if files === null && loadError === null}
-    <div class="py-5 text-center text-xs text-ink-3">加载中…</div>
-  {:else if loadError}
-    <div class="py-5 text-center text-xs text-danger">{loadError}</div>
-  {:else if files && files.length === 0}
-    <div class="py-5 text-center text-xs text-ink-3">空仓库 · 可新建或上传文件</div>
-  {:else if files}
-    <table class="w-full border-collapse text-[13px]">
-      <tbody>
-        {#each files as f (f.path)}
-          <tr
-            class="cursor-pointer border-t border-line-soft first:border-t-0 {$selectedFilePath === f.path ? 'bg-selected' : 'hover:bg-hover'}"
-            onclick={() => selectedFilePath.set(f.path)}
-          >
-            <td class="py-2 font-mono text-[12.5px] text-ink">{f.path}</td>
-            <td class="py-2 text-right font-mono text-[11px] text-ink-3">{f.size} B</td>
-          </tr>
-        {/each}
-      </tbody>
-    </table>
-  {/if}
-</div>
-
-{#if showNewFile}
-  <Modal title="新建文件" onclose={() => (showNewFile = false)}>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="nf-path">路径</label>
-      <input id="nf-path" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-[13px] outline-none focus:border-accent" bind:value={newPath} placeholder="docs/intro.md" />
-    </div>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="nf-content">内容</label>
-      <textarea id="nf-content" rows="8" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-xs outline-none focus:border-accent" bind:value={newContent} placeholder="内容…"></textarea>
-    </div>
-    <div class="mt-4 flex justify-end gap-2">
-      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showNewFile = false)}>取消</button>
-      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={submitNewFile}>创建</button>
-    </div>
-  </Modal>
-{/if}

hub/filelib-web/src/lib/LoginView.svelte

@@ -1,47 +0,0 @@
-<script lang="ts">
-  import { onMount } from "svelte";
-  import { api } from "./api.js";
-
-  interface LoginInfo {
-    orgSlug: string;
-    devLoginEnabled: boolean;
-  }
-
-  let info = $state<LoginInfo | null>(null);
-  let loadFailed = $state(false);
-
-  onMount(async () => {
-    try {
-      info = await api<LoginInfo>("/database/api/login-info");
-    } catch {
-      loadFailed = true;
-    }
-  });
-</script>
-
-<div class="flex min-h-full items-center justify-center p-6">
-  <div class="w-full max-w-[380px] rounded-2xl border border-line-soft bg-panel p-9 shadow-[0_4px_20px_rgba(26,26,24,.07)]">
-    <div class="text-center text-[26px] font-semibold tracking-wide text-ink">文件库</div>
-    <p class="mt-2.5 mb-8 text-center text-[13px] text-ink-3">课程资源与教研文件,一处安放,随处可查</p>
-
-    {#if info}
-      <a
-        href="/auth/feishu/{encodeURIComponent(info.orgSlug)}"
-        class="flex w-full items-center justify-center rounded-lg bg-accent px-4 py-3 text-sm font-medium text-white transition hover:bg-accent-hover"
-      >使用飞书登录</a>
-
-      {#if info.devLoginEnabled}
-        <div class="my-5 flex items-center gap-2.5 text-[11px] text-ink-3">
-          <span class="flex-1 border-t border-line-soft"></span>开发模式
-          <span class="flex-1 border-t border-line-soft"></span>
-        </div>
-        <a href="/app/dev-login-teacher" class="flex w-full items-center justify-center rounded-lg border border-line bg-panel px-4 py-2 text-[12.5px] font-medium text-ink transition hover:bg-hover">⚡ 一键登录(老师)</a>
-        <p class="mt-2.5 text-center text-[11px] text-ink-3">仅开发环境可见 · 跳过飞书 OAuth</p>
-      {/if}
-    {:else if loadFailed}
-      <p class="text-center text-[12.5px] text-danger">无法加载登录配置,请稍后重试</p>
-    {:else}
-      <p class="text-center text-[12.5px] text-ink-3">加载中…</p>
-    {/if}
-  </div>
-</div>

hub/filelib-web/src/lib/Modal.svelte

@@ -1,16 +0,0 @@
-<script lang="ts">
-  import type { Snippet } from "svelte";
-
-  let { title, onclose, children }: { title: string; onclose: () => void; children: Snippet } = $props();
-</script>
-
-<div
-  class="fixed inset-0 z-40 flex items-center justify-center bg-black/30 p-4"
-  role="presentation"
-  onclick={(e) => { if (e.target === e.currentTarget) onclose(); }}
->
-  <div class="w-full max-w-[440px] rounded-2xl border border-line-soft bg-panel p-6 shadow-[0_4px_20px_rgba(26,26,24,.07)]">
-    <div class="mb-4 text-[15px] font-semibold">{title}</div>
-    {@render children()}
-  </div>
-</div>

hub/filelib-web/src/lib/NodeDetailPanel.svelte

@@ -1,144 +0,0 @@
-<script lang="ts">
-  import { api } from "./api.js";
-  import { currentNode, breadcrumb, bumpTree, clearSelectedFile } from "./browser.js";
-  import { toastOk, toastErr } from "./stores.js";
-  import OverviewPanel from "./OverviewPanel.svelte";
-  import FilesPanel from "./FilesPanel.svelte";
-  import Modal from "./Modal.svelte";
-
-  let tab = $state<"detail" | "files">("detail");
-  let showCreateChild = $state(false);
-  let newName = $state("");
-  let newKind = $state<"FOLDER" | "PROJECT">("FOLDER");
-  let newDesc = $state("");
-
-  const node = $derived($currentNode);
-  const crumbs = $derived($breadcrumb);
-  const canManage = $derived(node?.role === "MANAGE");
-  const canEdit = $derived(canManage || node?.role === "EDIT");
-
-  $effect(() => {
-    void node?.id;
-    tab = "detail";
-    clearSelectedFile();
-  });
-
-  async function createChild(): Promise<void> {
-    const name = newName.trim();
-    if (name === "" || node === null) return;
-    try {
-      await api("/database/api/nodes", {
-        method: "POST",
-        body: {
-          parentId: node.id,
-          kind: newKind,
-          name,
-          ...(newDesc.trim() !== "" ? { description: newDesc.trim() } : {}),
-        },
-      });
-      toastOk("已创建");
-      showCreateChild = false;
-      newName = ""; newKind = "FOLDER"; newDesc = "";
-      bumpTree();
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function renameNode(): Promise<void> {
-    if (node === null) return;
-    const name = prompt("新名称", node.name);
-    if (name === null) return;
-    try {
-      await api(`/database/api/nodes/${node.id}`, { method: "PATCH", body: { name } });
-      toastOk("已重命名");
-      bumpTree();
-      currentNode.update((n) => (n ? { ...n, name } : n));
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function deleteNode(): Promise<void> {
-    if (node === null || !confirm(`确认删除「${node.name}」?软删除后不可见。`)) return;
-    try {
-      await api(`/database/api/nodes/${node.id}`, { method: "DELETE" });
-      toastOk("已删除");
-      currentNode.set(null);
-      bumpTree();
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-</script>
-
-{#if node === null}
-  <div class="flex h-full items-center justify-center text-[13px] text-ink-3">从左侧选择一个文件夹或项目</div>
-{:else}
-  <div class="mx-auto max-w-[880px] px-9 py-9">
-    <div class="mb-2 text-[12.5px] text-ink-3">
-      {#each crumbs as c, i (i)}
-        {#if i > 0}<span class="mx-1 text-line">/</span>{/if}
-        <span>{c.name ?? "…"}</span>
-      {/each}
-    </div>
-
-    <div class="mb-5 flex items-center justify-between">
-      <div class="flex items-center gap-2.5 text-[19px] font-semibold text-ink">
-        {node.name}
-        <span class="rounded-full border border-line-soft bg-panel px-2 py-0.5 font-mono text-[10.5px] text-ink-3">{node.kind === "PROJECT" ? "项目" : "文件夹"}</span>
-      </div>
-      <div class="flex gap-2">
-        {#if canEdit && node.kind === "FOLDER"}
-          <button class="rounded-lg border border-line bg-panel px-3 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreateChild = true)}>+ 新建</button>
-        {/if}
-        {#if canManage}
-          <button class="rounded-lg border border-line bg-panel px-3 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={renameNode}>重命名</button>
-          <button class="rounded-lg border border-transparent px-3 py-1.5 text-[12.5px] font-medium text-danger transition hover:bg-[#A13A3312]" onclick={deleteNode}>删除</button>
-        {/if}
-      </div>
-    </div>
-
-    {#if node.kind === "FOLDER"}
-      <div class="py-7 text-[13px] text-ink-3">点击左侧树展开以浏览子内容</div>
-    {:else}
-      <div class="mb-5 flex gap-1 border-b border-line-soft">
-        {#each [["detail", "概览"], ["files", "文件"]] as [id, label] (id)}
-          <button
-            class="border-b-2 px-3.5 py-2 text-[13px] transition {tab === id ? 'border-accent font-semibold text-ink' : 'border-transparent text-ink-3 hover:text-ink'}"
-            onclick={() => (tab = id as "detail" | "files")}
-          >{label}</button>
-        {/each}
-      </div>
-      {#if tab === "detail"}
-        <OverviewPanel {node} />
-      {:else}
-        <FilesPanel {node} />
-      {/if}
-    {/if}
-  </div>
-{/if}
-
-{#if showCreateChild && node}
-  <Modal title="新建子节点" onclose={() => (showCreateChild = false)}>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="child-name">名称</label>
-      <input id="child-name" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newName} placeholder="例如:物理必修一" />
-    </div>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="child-kind">类型</label>
-      <select id="child-kind" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newKind}>
-        <option value="FOLDER">文件夹</option>
-        <option value="PROJECT">项目(课程资源库)</option>
-      </select>
-    </div>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="child-desc">简介(可选)</label>
-      <textarea id="child-desc" rows="3" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-xs outline-none focus:border-accent" bind:value={newDesc} placeholder="简要说明用途…"></textarea>
-    </div>
-    <div class="mt-4 flex justify-end gap-2">
-      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreateChild = false)}>取消</button>
-      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={createChild}>创建</button>
-    </div>
-  </Modal>
-{/if}

hub/filelib-web/src/lib/OverviewPanel.svelte

@@ -1,123 +0,0 @@
-<script lang="ts">
-  import { api } from "./api.js";
-  import { toastOk, toastErr } from "./stores.js";
-  import { currentNode } from "./browser.js";
-  import type { ExportJob, NodeDetail } from "./types.js";
-  import Modal from "./Modal.svelte";
-
-  let { node }: { node: NodeDetail } = $props();
-
-  let showEditDesc = $state(false);
-  let descDraft = $state("");
-  let exportJob = $state<ExportJob | null>(null);
-
-  const canEdit = $derived(node.role === "MANAGE" || node.role === "EDIT");
-  const roleLabel = $derived(node.role === "MANAGE" ? "可管理" : node.role === "EDIT" ? "可编辑" : "只读");
-
-  $effect(() => {
-    void node.id;
-    exportJob = null;
-  });
-
-  function openEditDesc(): void {
-    descDraft = node.description ?? "";
-    showEditDesc = true;
-  }
-
-  async function saveDesc(): Promise<void> {
-    const description = descDraft.trim();
-    try {
-      await api(`/database/api/nodes/${node.id}`, {
-        method: "PATCH",
-        body: { description: description === "" ? null : description },
-      });
-      toastOk("简介已保存");
-      showEditDesc = false;
-      const next = description === "" ? null : description;
-      currentNode.update((n) => (n && n.id === node.id ? { ...n, description: next } : n));
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function submitExport(): Promise<void> {
-    try {
-      const r = await api<{ jobId: string; status: string }>(`/database/api/projects/${node.id}/exports`, {
-        method: "POST",
-        body: { target: "manifest" },
-      });
-      toastOk("导出已提交");
-      void pollExport(r.jobId);
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-
-  async function pollExport(jobId: string): Promise<void> {
-    for (;;) {
-      await new Promise((r) => setTimeout(r, 800));
-      try {
-        const job = await api<ExportJob>(`/database/api/exports/${jobId}`);
-        exportJob = job;
-        if (job.status === "DONE" || job.status === "FAILED") break;
-      } catch {
-        break;
-      }
-    }
-  }
-</script>
-
-<div class="rounded-xl border border-line-soft bg-panel p-5">
-  <div class="mb-4">
-    <div class="mb-1.5 text-[11.5px] text-ink-3">简介</div>
-    <div class="text-[13.5px] leading-7 text-ink">
-      {#if node.description}
-        {node.description}
-      {:else}
-        <span class="italic text-ink-3">暂无简介</span>
-      {/if}
-      {#if canEdit}
-        <button class="ml-2.5 rounded-lg border border-line bg-panel px-2.5 py-0.5 align-middle text-[11.5px] text-ink transition hover:bg-hover" onclick={openEditDesc}>编辑</button>
-      {/if}
-    </div>
-  </div>
-
-  <div class="my-4 border-t border-line-soft"></div>
-
-  <div class="flex flex-col gap-1.5 text-[13px] text-ink-2">
-    <div>我的角色 <b class="font-semibold text-ink">{roleLabel}</b></div>
-    <div>创建时间 <b class="font-semibold text-ink">{new Date(node.createdAt).toLocaleDateString("zh-CN", { year: "numeric", month: "long", day: "numeric" })}</b></div>
-    <div>最近修改 <b class="font-semibold text-ink">{new Date(node.updatedAt).toLocaleDateString("zh-CN", { year: "numeric", month: "long", day: "numeric" })}</b></div>
-  </div>
-
-  <div class="my-4 border-t border-line-soft"></div>
-
-  <div class="mb-2 text-[12.5px] font-semibold">导出</div>
-  <div class="flex items-center gap-2">
-    <button class="rounded-lg border border-line bg-panel px-3 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={submitExport}>开始导出</button>
-    {#if exportJob}
-      <span class="font-mono text-[11px] text-ink-3">
-        {#if exportJob.status === "DONE"}
-          完成 · <a class="text-accent underline" href="/database/api/exports/{exportJob.id}/download">下载</a>
-        {:else if exportJob.status === "FAILED"}
-          失败:{exportJob.error ?? ""}
-        {:else}
-          {exportJob.status}…
-        {/if}
-      </span>
-    {/if}
-  </div>
-</div>
-
-{#if showEditDesc}
-  <Modal title="编辑简介" onclose={() => (showEditDesc = false)}>
-    <div class="mb-3">
-      <label class="mb-1 block text-[11.5px] text-ink-3" for="desc-draft">简要说明这个项目的内容</label>
-      <textarea id="desc-draft" rows="5" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] leading-7 outline-none focus:border-accent" bind:value={descDraft} placeholder="例如:高中物理必修一第三章,表面张力相关内容……"></textarea>
-    </div>
-    <div class="mt-4 flex justify-end gap-2">
-      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showEditDesc = false)}>取消</button>
-      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={saveDesc}>保存</button>
-    </div>
-  </Modal>
-{/if}

hub/filelib-web/src/lib/Toasts.svelte

@@ -1,11 +0,0 @@
-<script lang="ts">
-  import { toasts } from "./stores.js";
-</script>
-
-<div class="fixed bottom-4 right-4 z-50 flex flex-col gap-2">
-  {#each $toasts as t (t.id)}
-    <div class="max-w-[340px] rounded-lg px-4 py-2 text-sm text-white {t.kind === 'err' ? 'bg-[#7E2C26]' : 'bg-[#333230]'}">
-      {t.message}
-    </div>
-  {/each}
-</div>

hub/filelib-web/src/lib/TreeNode.svelte

@@ -1,82 +0,0 @@
-<script lang="ts">
-  import TreeNode from "./TreeNode.svelte";
-  import { api } from "./api.js";
-  import { expanded, currentNode, breadcrumb, toggleExpanded, treeVersion } from "./browser.js";
-  import { toastErr } from "./stores.js";
-  import type { BreadcrumbEntry, NodeChild, NodeDetail } from "./types.js";
-
-  let { node, depth }: { node: NodeChild; depth: number } = $props();
-
-  let children = $state<NodeChild[] | null>(null);
-  const isOpen = $derived($expanded.has(node.id));
-  const isSelected = $derived($currentNode?.id === node.id);
-
-  // 树刷新信号(增/删/移/重命名)→ 失效子节点缓存,展开状态下随之重载
-  $effect(() => {
-    void $treeVersion;
-    children = null;
-  });
-
-  $effect(() => {
-    if (isOpen && node.kind === "FOLDER" && children === null) {
-      api<{ nodes: NodeChild[] }>(`/database/api/nodes?parentId=${encodeURIComponent(node.id)}`)
-        .then((r) => (children = r.nodes))
-        .catch((e) => toastErr(e instanceof Error ? e.message : String(e)));
-    }
-  });
-
-  async function select(): Promise<void> {
-    if (node.kind === "FOLDER") toggleExpanded(node.id);
-    try {
-      const [detail, crumb] = await Promise.all([
-        api<{ node: NodeDetail }>(`/database/api/nodes/${node.id}`),
-        api<{ breadcrumb: BreadcrumbEntry[] }>(`/database/api/nodes/${node.id}/breadcrumb`),
-      ]);
-      currentNode.set(detail.node);
-      breadcrumb.set(crumb.breadcrumb);
-    } catch (e) {
-      toastErr(e instanceof Error ? e.message : String(e));
-    }
-  }
-</script>
-
-<div>
-  <div
-    class="tree-item flex cursor-pointer items-center gap-1 rounded-lg px-1.5 py-1.5 select-none {isSelected ? 'bg-selected' : 'hover:bg-hover'}"
-    role="button"
-    tabindex="0"
-    onclick={select}
-    onkeydown={(e) => e.key === "Enter" && select()}
-  >
-    <span class="flex h-4 w-4 shrink-0 items-center justify-center text-ink-3">
-      {#if node.kind === "FOLDER"}
-        <svg width="9" height="9" viewBox="0 0 24 24" fill="currentColor">
-          {#if isOpen}<path d="M6 9l6 6 6-6z" />{:else}<path d="M9 6l6 6-6 6z" />{/if}
-        </svg>
-      {/if}
-    </span>
-    <span class="flex h-4 w-4 shrink-0 items-center justify-center {node.kind === 'PROJECT' ? 'text-ink' : 'text-ink-3'}">
-      {#if node.kind === "PROJECT"}
-        <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M20 7l-8-4-8 4m16 0l-8 4m8-4v10l-8 4m0-10L4 7m8 4v10M4 7v10l8 4" /></svg>
-      {:else}
-        <svg width="16" height="16" viewBox="0 0 24 24" fill="currentColor"><path d="M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V7Z" /></svg>
-      {/if}
-    </span>
-    <span class="truncate">{node.name}</span>
-    {#if node.role !== "MANAGE"}
-      <span class="ml-auto pr-1 font-mono text-[10px] text-ink-3">{node.role}</span>
-    {/if}
-  </div>
-
-  {#if node.kind === "FOLDER" && isOpen}
-    <div class="ml-[15px] border-l border-guide pl-1">
-      {#if children === null}
-        <div class="px-3 py-1.5 text-xs text-ink-3">…</div>
-      {:else}
-        {#each children as child (child.id)}
-          <TreeNode node={child} depth={depth + 1} />
-        {/each}
-      {/if}
-    </div>
-  {/if}
-</div>

hub/filelib-web/src/lib/api.ts

@@ -1,49 +0,0 @@
-/** 与 /database/api/* 的约定一致;401 时清空会话(回到登录视图)。 */
-
-import { me } from "./stores.js";
-
-export class ApiError extends Error {
-  constructor(
-    readonly status: number,
-    readonly code: string,
-    message: string,
-    readonly details?: Record<string, unknown>,
-  ) {
-    super(message);
-    this.name = "ApiError";
-  }
-}
-
-export class UnauthenticatedError extends Error {
-  constructor() {
-    super("unauthenticated");
-    this.name = "UnauthenticatedError";
-  }
-}
-
-interface RequestOpts {
-  readonly method?: string;
-  readonly body?: unknown;
-}
-
-export async function api<T = unknown>(path: string, opts: RequestOpts = {}): Promise<T> {
-  const res = await fetch(path, {
-    credentials: "same-origin",
-    method: opts.method ?? "GET",
-    ...(opts.body !== undefined
-      ? { headers: { "Content-Type": "application/json" }, body: JSON.stringify(opts.body) }
-      : {}),
-  });
-  if (res.status === 401) {
-    me.set(null);
-    throw new UnauthenticatedError();
-  }
-  if (res.status === 204) return null as T;
-  const text = await res.text();
-  const data = text === "" ? null : (JSON.parse(text) as unknown);
-  if (!res.ok) {
-    const err = (data as { error?: { code?: string; message?: string } } | null)?.error ?? {};
-    throw new ApiError(res.status, err.code ?? "unknown", err.message ?? res.statusText, err as Record<string, unknown>);
-  }
-  return data as T;
-}

hub/filelib-web/src/lib/browser.ts

@@ -1,34 +0,0 @@
-import { writable } from "svelte/store";
-import type { BreadcrumbEntry, NodeDetail } from "./types.js";
-
-/** 树展开集合 / 当前选中节点 / 面包屑 / 树刷新计数。 */
-export const expanded = writable<Set<string>>(new Set());
-export const currentNode = writable<NodeDetail | null>(null);
-export const breadcrumb = writable<BreadcrumbEntry[]>([]);
-export const treeVersion = writable(0);
-
-/** 右侧预览栏:当前选中文件路径(项目内);切换节点时清空。 */
-export const selectedFilePath = writable<string | null>(null);
-/** 文件列表刷新计数(编辑器保存/删除后 bump,列表随之重载)。 */
-export const filesVersion = writable(0);
-
-export function bumpTree(): void {
-  treeVersion.update((v) => v + 1);
-}
-
-export function bumpFiles(): void {
-  filesVersion.update((v) => v + 1);
-}
-
-export function clearSelectedFile(): void {
-  selectedFilePath.set(null);
-}
-
-export function toggleExpanded(id: string): void {
-  expanded.update((set) => {
-    const next = new Set(set);
-    if (next.has(id)) next.delete(id);
-    else next.add(id);
-    return next;
-  });
-}

hub/filelib-web/src/lib/stores.ts

@@ -1,26 +0,0 @@
-import { writable } from "svelte/store";
-import type { MeResponse } from "./types.js";
-
-/** 当前登录身份;null = 未登录(显示登录视图)。 */
-export const me = writable<MeResponse | null>(null);
-export const authChecked = writable(false);
-
-export interface ToastItem {
-  readonly id: number;
-  readonly message: string;
-  readonly kind: "info" | "err";
-}
-
-let nextToastId = 1;
-export const toasts = writable<ToastItem[]>([]);
-
-export function toast(message: string, kind: ToastItem["kind"] = "info"): void {
-  const id = nextToastId++;
-  toasts.update((list) => [...list, { id, message, kind }]);
-  setTimeout(() => {
-    toasts.update((list) => list.filter((t) => t.id !== id));
-  }, 3600);
-}
-
-export const toastOk = (m: string): void => toast(m, "info");
-export const toastErr = (m: string): void => toast(m, "err");

hub/filelib-web/src/lib/types.ts

@@ -1,85 +0,0 @@
-/** 与后端 /database/api/* 响应形状对齐。 */
-
-export type NodeKind = "FOLDER" | "PROJECT";
-export type Role = "VIEW" | "EDIT" | "MANAGE";
-
-export interface NodeChild {
-  readonly id: string;
-  readonly parentId: string | null;
-  readonly kind: NodeKind;
-  readonly name: string;
-  readonly role: Role;
-  readonly createdAt: string;
-  readonly updatedAt: string;
-}
-
-export interface BreadcrumbEntry {
-  readonly depth: number;
-  readonly id: string | null;
-  readonly name: string | null;
-  readonly kind: NodeKind;
-}
-
-export interface NodeDetail {
-  readonly id: string;
-  readonly parentId: string | null;
-  readonly kind: NodeKind;
-  readonly name: string;
-  readonly description: string | null;
-  readonly role: Role;
-  readonly provisionStatus: "PROVISIONING" | "READY" | "FAILED";
-  readonly independentPermission: boolean;
-  readonly createdAt: string;
-  readonly updatedAt: string;
-}
-
-export interface MeResponse {
-  readonly userId: string;
-  readonly isWebsiteAdmin: boolean;
-}
-
-export interface FileEntry {
-  readonly path: string;
-  readonly size: number;
-}
-
-export type FileContentEncoding = "utf8" | "base64";
-
-export interface FileContent {
-  readonly path: string;
-  readonly version: string;
-  readonly encoding: FileContentEncoding;
-  readonly content: string;
-  readonly size: number;
-}
-
-export interface VersionInfo {
-  readonly version: string;
-  readonly message: string;
-  readonly author?: string;
-  readonly committedAt: string;
-}
-
-export interface ExportJob {
-  readonly id: string;
-  readonly nodeId: string;
-  readonly target: string;
-  readonly status: "QUEUED" | "RUNNING" | "DONE" | "FAILED";
-  readonly error: string | null;
-  readonly createdAt: string;
-}
-
-export interface Grant {
-  readonly id: string;
-  readonly principalType: "USER" | "GROUP";
-  readonly principalId: string;
-  readonly role: Role;
-  readonly isCreatorGrant: boolean;
-  readonly createdAt: string;
-}
-
-export interface GroupSearchResult {
-  readonly id: string;
-  readonly name: string;
-  readonly breadcrumb: string;
-}

hub/filelib-web/src/main.ts

@@ -1,5 +0,0 @@
-import { mount } from "svelte";
-import App from "./App.svelte";
-import "./app.css";
-
-export default mount(App, { target: document.getElementById("app")! });

hub/filelib-web/tsconfig.json

@@ -1,17 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "strict": true,
-    "noUncheckedIndexedAccess": true,
-    "exactOptionalPropertyTypes": true,
-    "verbatimModuleSyntax": true,
-    "skipLibCheck": true,
-    "isolatedModules": true,
-    "resolveJsonModule": true,
-    "useDefineForClassFields": true,
-    "lib": ["ES2022", "DOM", "DOM.Iterable"]
-  },
-  "include": ["src/**/*.ts", "src/**/*.svelte"]
-}

hub/filelib-web/vite.config.ts

@@ -1,25 +0,0 @@
-import { defineConfig } from "vite";
-import { svelte } from "@sveltejs/vite-plugin-svelte";
-import tailwindcss from "@tailwindcss/vite";
-
-// 老师端独立 SPA:构建产物由 hub 后端静态托管于 /app;
-// 开发时 vite dev(:5173)把 API/认证请求代理到后端(:8788)。
-const backend = "http://127.0.0.1:8788";
-
-export default defineConfig({
-  plugins: [svelte(), tailwindcss()],
-  base: "/app/",
-  build: {
-    outDir: "dist",
-    emptyOutDir: true,
-  },
-  server: {
-    port: 5173,
-    proxy: {
-      "/database/api": backend,
-      "/auth": backend,
-      "/app/dev-login": backend,
-      "/app/dev-login-teacher": backend,
-    },
-  },
-});

hub/package-lock.json

@@ -1,19 +1,18 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.36",
+  "version": "0.0.35",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@paradigm/hub",
-      "version": "0.0.36",
+      "version": "0.0.35",
       "dependencies": {
         "@alicloud/credentials": "^2.4.5",
         "@alicloud/docmind-api20220711": "^1.4.15",
         "@alicloud/tea-util": "^1.4.11",
         "@anthropic-ai/claude-agent-sdk": "^0.3.202",
         "@fastify/cookie": "^11.0.2",
-        "@fastify/static": "^10.1.2",
         "@larksuiteoapi/node-sdk": "^1.70.0",
         "@prisma/client": "^6.19.3",
         "ai": "^7.0.16",
@@ -402,7 +401,6 @@
       "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.7.tgz",
       "integrity": "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=6.9.0"
       }
@@ -425,31 +423,6 @@
         "xml2js": "^0.6.2"
       }
     },
-    "node_modules/@emnapi/core": {
-      "version": "1.11.2",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
-      "integrity": "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "@emnapi/wasi-threads": "1.2.2",
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@emnapi/runtime": {
-      "version": "1.11.2",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
-      "integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
     "node_modules/@emnapi/wasi-threads": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
@@ -903,22 +876,6 @@
         "node": ">=18"
       }
     },
-    "node_modules/@fastify/accept-negotiator": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@fastify/accept-negotiator/-/accept-negotiator-2.0.1.tgz",
-      "integrity": "sha512-/c/TW2bO/v9JeEgoD/g1G5GxGeCF1Hafdf79WPmUlgYiBXummY0oX3VVq4yFkKKVBKDNlaDUYoab7g38RpPqCQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/@fastify/ajv-compiler": {
       "version": "4.0.5",
       "resolved": "https://registry.npmjs.org/@fastify/ajv-compiler/-/ajv-compiler-4.0.5.tgz",
@@ -1050,89 +1007,11 @@
         "ipaddr.js": "^2.1.0"
       }
     },
-    "node_modules/@fastify/send": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/@fastify/send/-/send-4.1.0.tgz",
-      "integrity": "sha512-TMYeQLCBSy2TOFmV95hQWkiTYgC/SEx7vMdV+wnZVX4tt8VBLKzmH8vV9OzJehV0+XBfg+WxPMt5wp+JBUKsVw==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "@lukeed/ms": "^2.0.2",
-        "escape-html": "~1.0.3",
-        "fast-decode-uri-component": "^1.0.1",
-        "http-errors": "^2.0.0",
-        "mime": "^3"
-      }
-    },
-    "node_modules/@fastify/static": {
-      "version": "10.1.2",
-      "resolved": "https://registry.npmjs.org/@fastify/static/-/static-10.1.2.tgz",
-      "integrity": "sha512-G/g18cG9tLutT/OVyN1AIsHIl9L1UwmJ+S3dkyhVpplIx0nEMicd7RGQ+uJLyhKKF4a3tTcQydccn3Mop1fX+Q==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "@fastify/accept-negotiator": "^2.0.0",
-        "@fastify/error": "^4.0.0",
-        "@fastify/send": "^4.0.0",
-        "content-disposition": "^2.0.1",
-        "fastify-plugin": "^6.0.0",
-        "fastq": "^1.17.1",
-        "glob": "^13.0.0"
-      }
-    },
-    "node_modules/@fastify/static/node_modules/content-disposition": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-2.0.1.tgz",
-      "integrity": "sha512-e+H0ZXHSWYrENhQzw1LPuP4oF5MzVKmDU6d3hxlvaPEYLLg62MxtQNPRx4SYSuYJSBUgnQIG4HIN2tEtNv7Dog==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/@fastify/static/node_modules/fastify-plugin": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz",
-      "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/@hono/node-server": {
       "version": "1.19.14",
       "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz",
       "integrity": "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18.14.1"
       },
@@ -1162,15 +1041,6 @@
         "ws": "^8.19.0"
       }
     },
-    "node_modules/@lukeed/ms": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@lukeed/ms/-/ms-2.0.2.tgz",
-      "integrity": "sha512-9I2Zn6+NJLfaGoz9jN3lpwDgAYvfGeNYdbAIjJOqzs4Tpc+VU3Jqq4IofSUBKajiDS8k9fZIg18/z13mpk1bsA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/@modelcontextprotocol/sdk": {
       "version": "1.29.0",
       "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.29.0.tgz",
@@ -1680,8 +1550,7 @@
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@stablelib/base64/-/base64-1.0.1.tgz",
       "integrity": "sha512-1bnPQqSxSuc3Ii6MhBysoWCg58j97aUjuCSZrGSmDxNqtytIi0k8utUenAwTZN4V5mXXYGsVUI9zeBqy+jBOSQ==",
-      "license": "MIT",
+      "license": "MIT"
-      "peer": true
     },
     "node_modules/@standard-schema/spec": {
       "version": "1.1.0",
@@ -1882,7 +1751,6 @@
       "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
       "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "mime-types": "^3.0.0",
         "negotiator": "^1.0.0"
@@ -1896,7 +1764,6 @@
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
       "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -1906,7 +1773,6 @@
       "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
       "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "mime-db": "^1.54.0"
       },
@@ -2037,21 +1903,11 @@
         "proxy-from-env": "^2.1.0"
       }
     },
-    "node_modules/balanced-match": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
-      "license": "MIT",
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
     "node_modules/body-parser": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
       "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "bytes": "^3.1.2",
         "content-type": "^2.0.0",
@@ -2076,7 +1932,6 @@
       "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
       "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -2085,24 +1940,11 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/brace-expansion": {
-      "version": "5.0.7",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
-      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
     "node_modules/bytes": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
       "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -2248,7 +2090,6 @@
       "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz",
       "integrity": "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -2262,7 +2103,6 @@
       "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
       "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -2292,7 +2132,6 @@
       "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
       "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=6.6.0"
       }
@@ -2302,7 +2141,6 @@
       "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz",
       "integrity": "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "object-assign": "^4",
         "vary": "^1"
@@ -2320,7 +2158,6 @@
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
       "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "path-key": "^3.1.0",
         "shebang-command": "^2.0.0",
@@ -2438,8 +2275,7 @@
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
       "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
-      "license": "MIT",
+      "license": "MIT"
-      "peer": true
     },
     "node_modules/effect": {
       "version": "3.21.0",
@@ -2467,7 +2303,6 @@
       "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
       "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -2587,7 +2422,6 @@
       "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
       "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -2597,7 +2431,6 @@
       "resolved": "https://registry.npmjs.org/eventsource/-/eventsource-3.0.7.tgz",
       "integrity": "sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "eventsource-parser": "^3.0.1"
       },
@@ -2629,7 +2462,6 @@
       "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
       "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "accepts": "^2.0.0",
         "body-parser": "^2.2.1",
@@ -2673,7 +2505,6 @@
       "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.5.2.tgz",
       "integrity": "sha512-5Kb34ipNX694DH48vN9irak1Qx30nb0PLYHXfJgw4YEjiC3ZEmZJhwOp+VfiCYwFzvFTdB9QkArYS5kXa2cx2A==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "ip-address": "^10.2.0"
       },
@@ -2692,7 +2523,6 @@
       "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
       "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -2702,7 +2532,6 @@
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
       "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -2712,7 +2541,6 @@
       "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
       "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "mime-db": "^1.54.0"
       },
@@ -2803,8 +2631,7 @@
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/fast-sha256/-/fast-sha256-1.3.0.tgz",
       "integrity": "sha512-n11RGP/lrWEFI/bWdygLxhI+pVeo1ZYIVwvvPkW7azl/rOy+F3HYRZ2K5zeE9mmkhQppyv9sQFx0JM9UabnpPQ==",
-      "license": "Unlicense",
+      "license": "Unlicense"
-      "peer": true
     },
     "node_modules/fast-uri": {
       "version": "3.1.3",
@@ -2903,7 +2730,6 @@
       "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz",
       "integrity": "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "debug": "^4.4.0",
         "encodeurl": "^2.0.0",
@@ -2975,7 +2801,6 @@
       "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
       "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -2985,7 +2810,6 @@
       "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
       "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -3069,23 +2893,6 @@
         "giget": "dist/cli.mjs"
       }
     },
-    "node_modules/glob": {
-      "version": "13.0.6",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
-      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "minimatch": "^10.2.2",
-        "minipass": "^7.1.3",
-        "path-scurry": "^2.0.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/gopd": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
@@ -3218,7 +3025,6 @@
       "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
       "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
       },
@@ -3264,15 +3070,13 @@
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz",
       "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
-      "license": "MIT",
+      "license": "MIT"
-      "peer": true
     },
     "node_modules/isexe": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
       "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "license": "ISC",
+      "license": "ISC"
-      "peer": true
     },
     "node_modules/jiti": {
       "version": "2.7.0",
@@ -3289,7 +3093,6 @@
       "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.3.tgz",
       "integrity": "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw==",
       "license": "MIT",
-      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/panva"
       }
@@ -3324,7 +3127,6 @@
       "resolved": "https://registry.npmjs.org/json-schema-to-ts/-/json-schema-to-ts-3.1.1.tgz",
       "integrity": "sha512-+DWg8jCJG2TEnpy7kOm/7/AxaYoaRbjVB4LFZLySZlWn8exGs3A4OLJR966cVvU26N7X9TWxl+Jsw7dzAqKT6g==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/runtime": "^7.18.3",
         "ts-algebra": "^2.0.0"
@@ -3343,8 +3145,7 @@
       "version": "8.0.2",
       "resolved": "https://registry.npmjs.org/json-schema-typed/-/json-schema-typed-8.0.2.tgz",
       "integrity": "sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA==",
-      "license": "BSD-2-Clause",
+      "license": "BSD-2-Clause"
-      "peer": true
     },
     "node_modules/kitx": {
       "version": "2.2.0",
@@ -3683,15 +3484,6 @@
       "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
       "license": "Apache-2.0"
     },
-    "node_modules/lru-cache": {
-      "version": "11.5.2",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
-      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
     "node_modules/magic-string": {
       "version": "0.30.21",
       "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
@@ -3716,7 +3508,6 @@
       "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.0.tgz",
       "integrity": "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -3726,7 +3517,6 @@
       "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
       "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -3734,18 +3524,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/mime": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/mime/-/mime-3.0.0.tgz",
-      "integrity": "sha512-jSCU7/VB1loIWBZe14aEYHU/+1UMEHoaO7qxCOVJOw9GgH72VAWppxNcjU+x9a2k3GSIBXNKxXQFqRvvZ7vr3A==",
-      "license": "MIT",
-      "bin": {
-        "mime": "cli.js"
-      },
-      "engines": {
-        "node": ">=10.0.0"
-      }
-    },
     "node_modules/mime-db": {
       "version": "1.52.0",
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
@@ -3767,30 +3545,6 @@
         "node": ">= 0.6"
       }
     },
-    "node_modules/minimatch": {
-      "version": "10.2.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
-      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "brace-expansion": "^5.0.5"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/minipass": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
-      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
     "node_modules/moment": {
       "version": "2.30.1",
       "resolved": "https://registry.npmjs.org/moment/-/moment-2.30.1.tgz",
@@ -3842,7 +3596,6 @@
       "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
       "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -3884,7 +3637,6 @@
       "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
       "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -3936,7 +3688,6 @@
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
       "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "ee-first": "1.1.1"
       },
@@ -3949,7 +3700,6 @@
       "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
       "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
       "license": "ISC",
-      "peer": true,
       "dependencies": {
         "wrappy": "1"
       }
@@ -3959,7 +3709,6 @@
       "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
       "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -3969,33 +3718,15 @@
       "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
       "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=8"
       }
     },
-    "node_modules/path-scurry": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
-      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "lru-cache": "^11.0.0",
-        "minipass": "^7.1.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/path-to-regexp": {
       "version": "8.4.2",
       "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz",
       "integrity": "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==",
       "license": "MIT",
-      "peer": true,
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/express"
@@ -4028,6 +3759,7 @@
       "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -4077,7 +3809,6 @@
       "resolved": "https://registry.npmjs.org/pkce-challenge/-/pkce-challenge-5.0.1.tgz",
       "integrity": "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=16.20.0"
       }
@@ -4130,6 +3861,7 @@
       "devOptional": true,
       "hasInstallScript": true,
       "license": "Apache-2.0",
+      "peer": true,
       "dependencies": {
         "@prisma/config": "6.19.3",
         "@prisma/engines": "6.19.3"
@@ -4193,7 +3925,6 @@
       "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
       "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "forwarded": "0.2.0",
         "ipaddr.js": "1.9.1"
@@ -4207,7 +3938,6 @@
       "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
       "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.10"
       }
@@ -4265,7 +3995,6 @@
       "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz",
       "integrity": "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.6"
       },
@@ -4279,7 +4008,6 @@
       "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz",
       "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "bytes": "~3.1.2",
         "http-errors": "~2.0.1",
@@ -4397,7 +4125,6 @@
       "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
       "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "debug": "^4.4.0",
         "depd": "^2.0.0",
@@ -4444,8 +4171,7 @@
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "license": "MIT",
+      "license": "MIT"
-      "peer": true
     },
     "node_modules/sax": {
       "version": "1.6.0",
@@ -4489,7 +4215,6 @@
       "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz",
       "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "debug": "^4.4.3",
         "encodeurl": "^2.0.0",
@@ -4516,7 +4241,6 @@
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
       "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -4526,7 +4250,6 @@
       "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
       "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "mime-db": "^1.54.0"
       },
@@ -4543,7 +4266,6 @@
       "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz",
       "integrity": "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "encodeurl": "^2.0.0",
         "escape-html": "^1.0.3",
@@ -4575,7 +4297,6 @@
       "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
       "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "shebang-regex": "^3.0.0"
       },
@@ -4588,7 +4309,6 @@
       "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
       "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=8"
       }
@@ -4756,7 +4476,6 @@
       "resolved": "https://registry.npmjs.org/standardwebhooks/-/standardwebhooks-1.0.0.tgz",
       "integrity": "sha512-BbHGOQK9olHPMvQNHWul6MYlrRTAOKn03rOe4A8O3CLWhNf4YHBqq2HJKKC+sfqpxiBY52pNeesD6jIiLDz8jg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@stablelib/base64": "^1.0.0",
         "fast-sha256": "^1.3.0"
@@ -4862,8 +4581,7 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/ts-algebra/-/ts-algebra-2.0.0.tgz",
       "integrity": "sha512-FPAhNPFMrkwz76P7cdjdmiShwMynZYN6SgOujD1urY4oNm80Ou9oMdmbR45LotcKOXoy7wSmHkRFE6Mxbrhefw==",
-      "license": "MIT",
+      "license": "MIT"
-      "peer": true
     },
     "node_modules/tslib": {
       "version": "2.8.1",
@@ -4879,6 +4597,7 @@
       "integrity": "sha512-eUdUIaCr963q2h5u3+QwvYp0+eqPvn+egeqZUm0hwERCqqx1E3kK5ehbGCvqSE5MQAULr67ww0cA3jKc3YkM1w==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "esbuild": "~0.28.0"
       },
@@ -4897,7 +4616,6 @@
       "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
       "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "content-type": "^2.0.0",
         "media-typer": "^1.1.0",
@@ -4916,7 +4634,6 @@
       "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
       "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -4930,7 +4647,6 @@
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
       "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -4940,7 +4656,6 @@
       "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
       "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "mime-db": "^1.54.0"
       },
@@ -4958,6 +4673,7 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "devOptional": true,
       "license": "Apache-2.0",
+      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -4977,7 +4693,6 @@
       "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
       "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -4987,7 +4702,6 @@
       "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
       "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -4998,6 +4712,7 @@
       "integrity": "sha512-Ds+gBRbj0lwRO2Y5hwnUBdxSwlAve9LeRyU4sNnAr0ewW0gWF0n5bgXgUzbgZ49MV9BVUAQUFYVcDUcilUExMA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "lightningcss": "^1.32.0",
         "picomatch": "^4.0.4",
@@ -5165,7 +4880,6 @@
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
       "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
       "license": "ISC",
-      "peer": true,
       "dependencies": {
         "isexe": "^2.0.0"
       },
@@ -5197,8 +4911,7 @@
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
       "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
-      "license": "ISC",
+      "license": "ISC"
-      "peer": true
     },
     "node_modules/ws": {
       "version": "8.21.0",
@@ -5248,6 +4961,7 @@
       "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
       "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
       "license": "MIT",
+      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
@@ -5257,7 +4971,6 @@
       "resolved": "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.2.tgz",
       "integrity": "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==",
       "license": "ISC",
-      "peer": true,
       "peerDependencies": {
         "zod": "^3.25.28 || ^4"
       }

hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.36",
+  "version": "0.0.35",
   "private": true,
   "type": "module",
   "engines": {
@@ -12,7 +12,6 @@
     "@alicloud/tea-util": "^1.4.11",
     "@anthropic-ai/claude-agent-sdk": "^0.3.202",
     "@fastify/cookie": "^11.0.2",
-    "@fastify/static": "^10.1.2",
     "@larksuiteoapi/node-sdk": "^1.70.0",
     "@prisma/client": "^6.19.3",
     "ai": "^7.0.16",
@@ -31,10 +30,10 @@
       "axios": "1.18.1"
     }
   },
-  "description": "Curriculum Project Hub — org-scoped Feishu collaboration and confined Agent runtime. Semantics pinned by docs/adr/ (ADR-0001 through ADR-0027).",
+  "description": "Curriculum Project Hub — org-scoped Feishu collaboration and confined Agent runtime. Aligns to spec/System through ADR-0024.",
   "scripts": {
     "dev": "npm run prisma:migrate && tsx watch src/server.ts",
-    "build": "tsc -p tsconfig.json && npm run admin:build && npm run filelib:build",
+    "build": "tsc -p tsconfig.json && npm run admin:build",
     "start": "npm run prisma:migrate && node dist/server.js",
     "check": "tsc -p tsconfig.json --noEmit",
     "audit:production": "npm audit --omit=dev --audit-level=high",
@@ -49,8 +48,6 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "admin:dev": "npm run dev --prefix admin-web",
-    "admin:build": "npm run build --prefix admin-web",
+    "admin:build": "npm run build --prefix admin-web"
-    "filelib:dev": "npm run dev --prefix filelib-web",
-    "filelib:build": "npm run build --prefix filelib-web"
   }
 }

hub/prisma/migrations/20260714120000_drop_legacy_platform_role_assignment/migration.sql

@@ -1,6 +1,6 @@
 -- ADR-0023 rejected the legacy `PlatformRoleAssignment` / `PlatformRole`{ADMIN,TEACHER}
 -- model: the platform administration control plane is a separate identity/session/
--- audit surface, intentionally not built
+-- audit surface (see `Spec.System.PlatformAdministration`), intentionally not built
 -- in alpha (ADR-0025, `hub/deploy/README.md`). The legacy table has no runtime
 -- reader — no guard, route, or service queries it for an authorization decision —
 -- and ADR-0023 requires it to be migrated/replaced before the platform panel ships.

hub/prisma/migrations/20260719140000_agent_config_folder_tree/migration.sql

@@ -0,0 +1,33 @@
+-- ADR-0028 agent configuration folder tree. One org-scoped transparent folder
+-- tree shared by Agent roles and skills (management-surface grouping only);
+-- skill name / roleId uniqueness, role→skill bindings, run-time skill loading
+-- and Feishu slash commands never reference folders. A folder deletes only
+-- when empty (service-enforced); item `folderId` references are SetNull as
+-- backstop.
+
+-- CreateTable
+CREATE TABLE "OrganizationAgentConfigFolder" (
+    "id" TEXT NOT NULL,
+    "organizationId" TEXT NOT NULL,
+    "parentId" TEXT,
+    "name" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "OrganizationAgentConfigFolder_pkey" PRIMARY KEY ("id")
+);
+
+-- AlterTable
+ALTER TABLE "OrganizationAgentSkill" ADD COLUMN "folderId" TEXT;
+ALTER TABLE "OrganizationAgentRole" ADD COLUMN "folderId" TEXT;
+
+-- CreateIndex
+CREATE INDEX "OrganizationAgentConfigFolder_organizationId_parentId_idx" ON "OrganizationAgentConfigFolder"("organizationId", "parentId");
+CREATE INDEX "OrganizationAgentSkill_organizationId_folderId_idx" ON "OrganizationAgentSkill"("organizationId", "folderId");
+CREATE INDEX "OrganizationAgentRole_organizationId_folderId_idx" ON "OrganizationAgentRole"("organizationId", "folderId");
+
+-- AddForeignKey
+ALTER TABLE "OrganizationAgentConfigFolder" ADD CONSTRAINT "OrganizationAgentConfigFolder_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "OrganizationAgentConfigFolder" ADD CONSTRAINT "OrganizationAgentConfigFolder_parentId_fkey" FOREIGN KEY ("parentId") REFERENCES "OrganizationAgentConfigFolder"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "OrganizationAgentSkill" ADD CONSTRAINT "OrganizationAgentSkill_folderId_fkey" FOREIGN KEY ("folderId") REFERENCES "OrganizationAgentConfigFolder"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+ALTER TABLE "OrganizationAgentRole" ADD CONSTRAINT "OrganizationAgentRole_folderId_fkey" FOREIGN KEY ("folderId") REFERENCES "OrganizationAgentConfigFolder"("id") ON DELETE SET NULL ON UPDATE CASCADE;

hub/prisma/migrations/20260721120000_file_library/migration.sql

@@ -1,92 +0,0 @@
--- File library (文件库) — 语义锚定:仓库根《文件库-接口契约.md》、.omo/文件库-开工计划.md (D11–D19)。
--- 本地无 PG 时手写;有 PG 后可用 `prisma migrate diff` 核对与 schema 的一致性。
-
--- CreateEnum
-CREATE TYPE "FileLibNodeKind" AS ENUM ('FOLDER', 'PROJECT');
-CREATE TYPE "FileLibProvisionStatus" AS ENUM ('PROVISIONING', 'READY', 'FAILED');
-CREATE TYPE "FileLibRole" AS ENUM ('VIEW', 'EDIT', 'MANAGE');
-CREATE TYPE "FileLibPrincipalType" AS ENUM ('USER', 'GROUP');
-CREATE TYPE "FileLibExportStatus" AS ENUM ('QUEUED', 'RUNNING', 'DONE', 'FAILED');
-
--- CreateTable
-CREATE TABLE "FileLibNode" (
-    "id" TEXT NOT NULL,
-    "organizationId" TEXT NOT NULL,
-    "parentId" TEXT,
-    "kind" "FileLibNodeKind" NOT NULL,
-    "name" TEXT NOT NULL,
-    "nameLower" TEXT NOT NULL,
-    "pathIds" TEXT NOT NULL,
-    "creatorId" TEXT NOT NULL,
-    "provisionStatus" "FileLibProvisionStatus" NOT NULL DEFAULT 'READY',
-    "storageDir" TEXT,
-    "deletedAt" TIMESTAMP(3),
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "FileLibNode_pkey" PRIMARY KEY ("id")
-);
-
-CREATE TABLE "FileLibGrant" (
-    "id" TEXT NOT NULL,
-    "organizationId" TEXT NOT NULL,
-    "nodeId" TEXT NOT NULL,
-    "principalType" "FileLibPrincipalType" NOT NULL,
-    "principalId" TEXT NOT NULL,
-    "role" "FileLibRole" NOT NULL,
-    "isCreatorGrant" BOOLEAN NOT NULL DEFAULT false,
-    "createdByUserId" TEXT,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "revokedAt" TIMESTAMP(3),
-
-    CONSTRAINT "FileLibGrant_pkey" PRIMARY KEY ("id")
-);
-
-CREATE TABLE "FileLibProjectSettings" (
-    "nodeId" TEXT NOT NULL,
-    "independentPermissionsEnabled" BOOLEAN NOT NULL DEFAULT false,
-
-    CONSTRAINT "FileLibProjectSettings_pkey" PRIMARY KEY ("nodeId")
-);
-
-CREATE TABLE "FileLibExportJob" (
-    "id" TEXT NOT NULL,
-    "organizationId" TEXT NOT NULL,
-    "nodeId" TEXT NOT NULL,
-    "target" TEXT NOT NULL,
-    "params" JSONB NOT NULL,
-    "status" "FileLibExportStatus" NOT NULL DEFAULT 'QUEUED',
-    "downloadUrl" TEXT,
-    "error" TEXT,
-    "createdByUserId" TEXT NOT NULL,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "FileLibExportJob_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex (schema-declared)
-CREATE INDEX "FileLibNode_organizationId_parentId_deletedAt_idx" ON "FileLibNode"("organizationId", "parentId", "deletedAt");
-CREATE INDEX "FileLibNode_organizationId_pathIds_idx" ON "FileLibNode"("organizationId", "pathIds");
-CREATE INDEX "FileLibNode_creatorId_idx" ON "FileLibNode"("creatorId");
-CREATE INDEX "FileLibGrant_organizationId_revokedAt_idx" ON "FileLibGrant"("organizationId", "revokedAt");
-CREATE INDEX "FileLibGrant_principalType_principalId_revokedAt_idx" ON "FileLibGrant"("principalType", "principalId", "revokedAt");
-CREATE INDEX "FileLibGrant_nodeId_revokedAt_idx" ON "FileLibGrant"("nodeId", "revokedAt");
-CREATE INDEX "FileLibExportJob_organizationId_status_idx" ON "FileLibExportJob"("organizationId", "status");
-
--- D14:活跃兄弟节点大小写不敏感唯一。root 的 parentId 为 NULL,用 COALESCE 归入同一键空间。
-CREATE UNIQUE INDEX "FileLibNode_active_sibling_name_key"
-    ON "FileLibNode"("organizationId", COALESCE("parentId", ''), "nameLower")
-    WHERE "deletedAt" IS NULL;
-
--- 契约 2.3:同一节点上同一 principal 至多一条活跃授权(Postgres 原生 UNIQUE 无法约束 NULL revokedAt)。
-CREATE UNIQUE INDEX "FileLibGrant_active_unique"
-    ON "FileLibGrant"("nodeId", "principalType", "principalId")
-    WHERE "revokedAt" IS NULL;
-
--- AddForeignKey
-ALTER TABLE "FileLibNode" ADD CONSTRAINT "FileLibNode_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-ALTER TABLE "FileLibNode" ADD CONSTRAINT "FileLibNode_parentId_fkey" FOREIGN KEY ("parentId") REFERENCES "FileLibNode"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
-ALTER TABLE "FileLibGrant" ADD CONSTRAINT "FileLibGrant_nodeId_fkey" FOREIGN KEY ("nodeId") REFERENCES "FileLibNode"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-ALTER TABLE "FileLibProjectSettings" ADD CONSTRAINT "FileLibProjectSettings_nodeId_fkey" FOREIGN KEY ("nodeId") REFERENCES "FileLibNode"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-ALTER TABLE "FileLibExportJob" ADD CONSTRAINT "FileLibExportJob_nodeId_fkey" FOREIGN KEY ("nodeId") REFERENCES "FileLibNode"("id") ON DELETE CASCADE ON UPDATE CASCADE;

hub/prisma/migrations/20260723130000_filelib_description/migration.sql

@@ -1,2 +0,0 @@
--- 为 FileLibNode 加简介字段，老师在创建/概览页填写。
-ALTER TABLE "FileLibNode" ADD COLUMN "description" TEXT;

hub/prisma/schema.prisma

@@ -1,6 +1,6 @@
 // Prisma schema for Curriculum Project Hub.
 //
-// Aligns to ADR-0001..0004, 0017. Key divergences from the
+// Aligns to spec/System (ADR-0001..0004, 0017). Key divergences from the
 // legacy teaching-material-host-service schema, each deliberate:
 //
 //  - AgentSession is provider/model-bound. Provider runtime cursors such as
@@ -11,8 +11,8 @@
 //  - ProjectGroupBinding is project→chat only (ADR-0001 1:1); legacy mixed
 //    user/chat targets into one binding table.
 //  - PermissionGrant + PermissionSettings land (ADR-0004), missing in legacy.
-//  - AgentRunStatus adds WAITING_FOR_USER + TIMED_OUT (the run-state set is
+//  - AgentRunStatus adds WAITING_FOR_USER + TIMED_OUT (spec RunState; enum
-//    open — add states without a schema migration war).
+//    completeness OPEN — add states without a schema migration war).
 
 generator client {
   provider = "prisma-client-js"
@@ -47,10 +47,10 @@ model Organization {
   capabilityConnections        OrganizationCapabilityConnection[]
   agentSkills                  OrganizationAgentSkill[]
   agentRoles                   OrganizationAgentRole[]
+  agentConfigFolders           OrganizationAgentConfigFolder[]
   projectGroupBindings         ProjectGroupBinding[]
   auditEntries                 AuditEntry[]                             @relation("organizationAudit")
   projectSearchDocuments       ProjectSearchDocument[]
-  fileLibNodes                 FileLibNode[]
 
   @@index([status])
 }
@@ -62,7 +62,7 @@ enum OrganizationStatus {
 }
 
 /// Org-scoped membership role. Distinct from project PermissionRole and from
-/// the platform administrator surface (ADR-0023),
+/// the platform administrator surface (ADR-0023 / Spec.System.PlatformAdministration),
 /// which is a separate control plane not modeled in alpha (ADR-0025).
 model OrganizationMembership {
   id             String                 @id @default(cuid())
@@ -96,16 +96,19 @@ model OrganizationAgentSkill {
   version        String
   description    String?
   contentDigest  String
+  folderId       String?
   createdAt      DateTime  @default(now())
   updatedAt      DateTime  @updatedAt
   disabledAt     DateTime?
 
-  organization Organization                 @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  organization Organization                    @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  folder       OrganizationAgentConfigFolder?  @relation(fields: [folderId], references: [id], onDelete: SetNull)
   roleBindings OrganizationAgentRoleSkill[]
 
   @@unique([organizationId, name])
   @@unique([organizationId, id])
   @@index([organizationId, disabledAt])
+  @@index([organizationId, folderId])
   @@index([contentDigest])
 }
 
@@ -122,17 +125,20 @@ model OrganizationAgentRole {
   tools          Json?
   sortOrder      Int       @default(0)
   isDefault      Boolean   @default(false)
+  folderId       String?
   createdAt      DateTime  @default(now())
   updatedAt      DateTime  @updatedAt
   disabledAt     DateTime?
 
-  organization       Organization                 @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  organization       Organization                    @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  folder             OrganizationAgentConfigFolder?  @relation(fields: [folderId], references: [id], onDelete: SetNull)
   skillBindings      OrganizationAgentRoleSkill[]
   selectedByBindings ProjectGroupBinding[]        @relation("selectedAgentRole")
 
   @@unique([organizationId, roleId])
   @@unique([organizationId, id])
   @@index([organizationId, disabledAt, sortOrder])
+  @@index([organizationId, folderId])
 }
 
 /// Same-Organization join enforced by both composite foreign keys. `sortOrder`
@@ -152,6 +158,29 @@ model OrganizationAgentRoleSkill {
   @@index([organizationId, agentSkillId])
 }
 
+/// ADR-0028: org-scoped transparent folder tree shared by agent roles and
+/// skills. Management-surface navigation/grouping only — not a permission
+/// resource, and never referenced by role→skill bindings, run-time skill
+/// loading, or Feishu slash commands. Skill name and roleId stay unique per
+/// organization regardless of folder membership. A folder is deleted only
+/// when empty (service-enforced); item references are SetNull as backstop.
+model OrganizationAgentConfigFolder {
+  id             String    @id @default(cuid())
+  organizationId String
+  parentId       String?
+  name           String
+  createdAt      DateTime  @default(now())
+  updatedAt      DateTime  @updatedAt
+
+  organization Organization                    @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  parent       OrganizationAgentConfigFolder?  @relation("agentConfigFolderTree", fields: [parentId], references: [id], onDelete: Restrict)
+  children     OrganizationAgentConfigFolder[] @relation("agentConfigFolderTree")
+  skills       OrganizationAgentSkill[]
+  roles        OrganizationAgentRole[]
+
+  @@index([organizationId, parentId])
+}
+
 /// ADR-0021: org-level project onboarding policy. Ordinary Feishu users can
 /// create projects from unbound chats only when membersCanCreateProjects=true.
 model OrganizationProjectSettings {
@@ -924,127 +953,3 @@ model CapabilityCredentialVersion {
   @@index([keyId])
   @@index([createdByUserId])
 }
-
-// --- File library (文件库) -------------------------------------------------
-//
-// 独立模块,语义由仓库根《文件库-接口契约.md》(C/D 编号)与 .omo/文件库-开工计划.md
-// (D11–D19)锚定。与上面的 Folder/Project(hub 自己的 explorer,ADR-0021)是两套
-// 体系,不复用、不互相引用。
-
-/// 文件库目录树节点:文件夹(容器)或项目(叶子,关联 git 仓库)。
-/// parentId 是树的权威关系;pathIds 是 id 编码的物化路径(派生),随 create/move
-/// 在事务内维护(计划 D12;name 不入路径,rename 不重写后代)。
-model FileLibNode {
-  id              String                 @id
-  organizationId  String
-  parentId        String?
-  kind            FileLibNodeKind
-  name            String
-  /// D14:NFC+trim 的小写形式;活跃兄弟节点大小写不敏感唯一(部分唯一索引在迁移 SQL)。
-  nameLower       String
-  /// id 编码物化路径,形如 "/rootId/childId/selfId"。祖先展开与前缀查询都用它。
-  pathIds         String
-  /// D11:创建者不可变,自动持有 isCreatorGrant=true 的 MANAGE grant。
-  /// 故意不建 FK:这是不可变历史事实,不随 User 生命周期变化。
-  creatorId       String
-  /// 老师可填写的简介，创建/概览页展示，通俗易懂地说明这个节点的用途。
-  description     String?
-  /// 项目 provisioning 状态机(DB/git 双写协调,Metis 风险#1);文件夹恒 READY。
-  provisionStatus FileLibProvisionStatus @default(READY)
-  /// 项目仓库目录(绝对路径);文件夹为 null。
-  storageDir      String?
-  deletedAt       DateTime?
-  createdAt       DateTime               @default(now())
-  updatedAt       DateTime               @updatedAt
-
-  organization    Organization            @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  parent          FileLibNode?            @relation("fileLibTree", fields: [parentId], references: [id], onDelete: Restrict)
-  children        FileLibNode[]           @relation("fileLibTree")
-  grants          FileLibGrant[]
-  projectSettings FileLibProjectSettings?
-  exportJobs      FileLibExportJob[]
-
-  @@index([organizationId, parentId, deletedAt])
-  @@index([organizationId, pathIds])
-  @@index([creatorId])
-}
-
-enum FileLibNodeKind {
-  FOLDER
-  PROJECT
-}
-
-enum FileLibProvisionStatus {
-  PROVISIONING
-  READY
-  FAILED
-}
-
-/// 文件库权限级别:MANAGE > EDIT > VIEW(契约 2.2,只取最高、无降权)。
-enum FileLibRole {
-  VIEW
-  EDIT
-  MANAGE
-}
-
-enum FileLibPrincipalType {
-  USER
-  GROUP
-}
-
-/// 契约 2.3:grant 直接挂在节点上,最终权限 = max(个人, 递归 Group, 祖先继承)。
-/// 活跃授权唯一性由迁移里的部分唯一索引保证(revokedAt IS NULL)。
-model FileLibGrant {
-  id              String               @id @default(cuid())
-  organizationId  String
-  nodeId          String
-  principalType   FileLibPrincipalType
-  principalId     String
-  role            FileLibRole
-  /// D11:创建者自动 grant;独立权限开关关闭时,项目级 grant 里只有它仍生效。
-  isCreatorGrant  Boolean              @default(false)
-  createdByUserId String?
-  createdAt       DateTime             @default(now())
-  revokedAt       DateTime?
-
-  node FileLibNode @relation(fields: [nodeId], references: [id], onDelete: Cascade)
-
-  @@index([organizationId, revokedAt])
-  @@index([principalType, principalId, revokedAt])
-  @@index([nodeId, revokedAt])
-}
-
-/// 契约 P5/D11:项目独立权限开关。默认关闭(仅继承);关闭时项目级非创建者
-/// grant 冻结不删除,重新开启即恢复。
-model FileLibProjectSettings {
-  nodeId                        String  @id
-  independentPermissionsEnabled Boolean @default(false)
-
-  node FileLibNode @relation(fields: [nodeId], references: [id], onDelete: Cascade)
-}
-
-enum FileLibExportStatus {
-  QUEUED
-  RUNNING
-  DONE
-  FAILED
-}
-
-/// 契约 D10:导出为异步任务。外部导出工具参数 OPEN-6,adapter 就位前先建模型。
-model FileLibExportJob {
-  id              String             @id @default(cuid())
-  organizationId  String
-  nodeId          String
-  target          String
-  params          Json
-  status          FileLibExportStatus @default(QUEUED)
-  downloadUrl     String?
-  error           String?
-  createdByUserId String
-  createdAt       DateTime           @default(now())
-  updatedAt       DateTime           @updatedAt
-
-  node FileLibNode @relation(fields: [nodeId], references: [id], onDelete: Cascade)
-
-  @@index([organizationId, status])
-}

hub/src/admin/routes/agentConfigRoutes.ts

@@ -15,6 +15,10 @@
  * `commitSkillContent`, so the web path and CLI path share one ingestion
  * pipeline and one set of safety checks (SKILL.md manifest required, 512-file
  * / 16-byte limits, symlink rejection).
+ *
+ * Folder tree (ADR-0028): one org-scoped transparent folder tree shared by
+ * roles and skills for management-surface grouping. Folder endpoints never
+ * touch session state — assignment is a label-class change (ADR-0017).
  */
 import type { PrismaClient } from "@prisma/client";
 import type { FastifyInstance } from "fastify";
@@ -243,4 +247,121 @@ export async function registerAgentConfigRoutes(
       return handleRouteError(reply, err);
     }
   });
+
+  // --- ADR-0028 shared agent-config folder tree (transparent grouping) ---
+
+  app.get("/api/org/:orgSlug/agent-config-folders", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const folders = await agentConfig.listFolders({ organizationId: auth.organization.id });
+      return { folders };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.post("/api/org/:orgSlug/agent-config-folders", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const body = request.body as { name?: unknown; parentId?: unknown };
+      if (typeof body.name !== "string") {
+        return reply.status(400).send({
+          error: { code: "bad_request", message: "name is required" },
+        });
+      }
+      const folder = await agentConfig.createFolder({
+        organizationId: auth.organization.id,
+        name: body.name,
+        ...(typeof body.parentId === "string" ? { parentId: body.parentId } : {}),
+      });
+      return reply.status(201).send(folder);
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.patch("/api/org/:orgSlug/agent-config-folders/:folderId", async (request, reply) => {
+    try {
+      const { orgSlug, folderId } = request.params as { orgSlug: string; folderId: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const body = request.body as { name?: unknown; parentId?: unknown };
+      const folder = await agentConfig.updateFolder({
+        organizationId: auth.organization.id,
+        folderId,
+        ...(typeof body.name === "string" ? { name: body.name } : {}),
+        ...(body.parentId === null || typeof body.parentId === "string"
+          ? { parentId: body.parentId as string | null }
+          : {}),
+      });
+      return folder;
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.delete("/api/org/:orgSlug/agent-config-folders/:folderId", async (request, reply) => {
+    try {
+      const { orgSlug, folderId } = request.params as { orgSlug: string; folderId: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      await agentConfig.deleteFolder({
+        organizationId: auth.organization.id,
+        folderId,
+      });
+      return { deleted: true };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  // Folder assignment is a label-class change (ADR-0017): these endpoints
+  // never archive Agent sessions (ADR-0028).
+  app.patch("/api/org/:orgSlug/agent-roles/:roleId/folder", async (request, reply) => {
+    try {
+      const { orgSlug, roleId } = request.params as { orgSlug: string; roleId: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const body = request.body as { folderId?: unknown };
+      if (body.folderId !== null && typeof body.folderId !== "string") {
+        return reply.status(400).send({
+          error: { code: "bad_request", message: "folderId must be a string or null" },
+        });
+      }
+      await agentConfig.setRoleFolder({
+        organizationId: auth.organization.id,
+        roleId,
+        folderId: body.folderId as string | null,
+      });
+      return { folderId: body.folderId as string | null };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.patch("/api/org/:orgSlug/agent-skills/:name/folder", async (request, reply) => {
+    try {
+      const { orgSlug, name } = request.params as { orgSlug: string; name: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const body = request.body as { folderId?: unknown };
+      if (body.folderId !== null && typeof body.folderId !== "string") {
+        return reply.status(400).send({
+          error: { code: "bad_request", message: "folderId must be a string or null" },
+        });
+      }
+      await agentConfig.setSkillFolder({
+        organizationId: auth.organization.id,
+        name,
+        folderId: body.folderId as string | null,
+      });
+      return { folderId: body.folderId as string | null };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
 }

hub/src/agent/configuration.ts

@@ -18,6 +18,7 @@ export interface AgentRoleRow {
   readonly createdAt: string;
   readonly updatedAt: string;
   readonly skillNames: readonly string[];
+  readonly folderId: string | null;
 }
 
 export interface AgentSkillRow {
@@ -30,6 +31,17 @@ export interface AgentSkillRow {
   readonly createdAt: string;
   readonly updatedAt: string;
   readonly boundRoleIds: readonly string[];
+  readonly folderId: string | null;
+}
+
+/**
+ * ADR-0028 transparent folder node of the org's shared agent-config folder
+ * tree. Grouping only: never part of skill/role identity or run resolution.
+ */
+export interface AgentConfigFolderRow {
+  readonly id: string;
+  readonly name: string;
+  readonly parentId: string | null;
 }
 
 /**
@@ -80,9 +92,213 @@ export class OrganizationAgentConfiguration {
       createdAt: skill.createdAt.toISOString(),
       updatedAt: skill.updatedAt.toISOString(),
       boundRoleIds: skill.roleBindings.map((binding) => binding.role.roleId),
+      folderId: skill.folderId,
     }));
   }
 
+  async listFolders(input: { readonly organizationId: string }): Promise<readonly AgentConfigFolderRow[]> {
+    await this.requireActiveOrganization(input.organizationId);
+    const folders = await this.prisma.organizationAgentConfigFolder.findMany({
+      where: { organizationId: input.organizationId },
+      orderBy: [{ name: "asc" }, { id: "asc" }],
+      select: { id: true, name: true, parentId: true },
+    });
+    return folders;
+  }
+
+  async createFolder(input: {
+    readonly organizationId: string;
+    readonly name: string;
+    readonly parentId?: string | undefined;
+  }): Promise<AgentConfigFolderRow> {
+    await this.requireActiveOrganization(input.organizationId);
+    const name = nonEmpty(input.name, "folder name");
+    return this.prisma.$transaction(async (tx) => {
+      if (input.parentId !== undefined) {
+        await requireFolder(tx, input.organizationId, input.parentId);
+      }
+      const folder = await tx.organizationAgentConfigFolder.create({
+        data: {
+          organizationId: input.organizationId,
+          name,
+          ...(input.parentId !== undefined ? { parentId: input.parentId } : {}),
+        },
+        select: { id: true, name: true, parentId: true },
+      });
+      await tx.auditEntry.create({
+        data: {
+          organizationId: input.organizationId,
+          action: "agent_config_folder.created",
+          metadata: { folderId: folder.id, name: folder.name, parentId: folder.parentId },
+        },
+      });
+      return folder;
+    });
+  }
+
+  /**
+   * Rename and/or move a folder inside the same Organization tree. Moving is
+   * rejected when the target parent is the folder itself or one of its
+   * descendants (would create a cycle).
+   */
+  async updateFolder(input: {
+    readonly organizationId: string;
+    readonly folderId: string;
+    readonly name?: string | undefined;
+    readonly parentId?: string | null | undefined;
+  }): Promise<AgentConfigFolderRow> {
+    await this.requireActiveOrganization(input.organizationId);
+    return this.prisma.$transaction(async (tx) => {
+      const folder = await requireFolder(tx, input.organizationId, input.folderId);
+      if (input.parentId !== undefined && input.parentId !== null) {
+        if (input.parentId === folder.id) {
+          throw new Error("folder cannot be its own parent");
+        }
+        await requireFolder(tx, input.organizationId, input.parentId);
+        const descendant = await tx.$queryRaw<Array<{ found: boolean }>>(Prisma.sql`
+          WITH RECURSIVE descendants AS (
+            SELECT "id" FROM "OrganizationAgentConfigFolder" WHERE "parentId" = ${folder.id}
+            UNION ALL
+            SELECT child."id" FROM "OrganizationAgentConfigFolder" child
+            JOIN descendants parent ON child."parentId" = parent."id"
+          )
+          SELECT EXISTS(SELECT 1 FROM descendants WHERE "id" = ${input.parentId}) AS found
+        `);
+        if (descendant[0]?.found === true) throw new Error("folder cannot be moved below its descendant");
+      }
+      const name = input.name !== undefined ? nonEmpty(input.name, "folder name") : undefined;
+      const updated = await tx.organizationAgentConfigFolder.update({
+        where: { id: folder.id },
+        data: {
+          ...(name !== undefined ? { name } : {}),
+          ...(input.parentId !== undefined ? { parentId: input.parentId } : {}),
+        },
+        select: { id: true, name: true, parentId: true },
+      });
+      await tx.auditEntry.create({
+        data: {
+          organizationId: input.organizationId,
+          action: "agent_config_folder.updated",
+          metadata: {
+            folderId: folder.id,
+            ...(name !== undefined ? { name } : {}),
+            ...(input.parentId !== undefined ? { parentId: input.parentId } : {}),
+          },
+        },
+      });
+      return updated;
+    });
+  }
+
+  /**
+   * Delete a folder. Refused while the folder still has child folders, roles
+   * or skills (ADR-0028: items are relocated explicitly, so no orphan-placement
+   * rule is needed).
+   */
+  async deleteFolder(input: {
+    readonly organizationId: string;
+    readonly folderId: string;
+  }): Promise<void> {
+    await this.requireActiveOrganization(input.organizationId);
+    await this.prisma.$transaction(async (tx) => {
+      const folder = await requireFolder(tx, input.organizationId, input.folderId);
+      const childFolders = await tx.organizationAgentConfigFolder.count({
+        where: { parentId: folder.id },
+      });
+      if (childFolders > 0) {
+        throw new Error(`cannot delete folder: still has ${childFolders} child folder(s)`);
+      }
+      const skills = await tx.organizationAgentSkill.count({
+        where: { organizationId: input.organizationId, folderId: folder.id },
+      });
+      const roles = await tx.organizationAgentRole.count({
+        where: { organizationId: input.organizationId, folderId: folder.id },
+      });
+      if (skills > 0 || roles > 0) {
+        throw new Error(`cannot delete folder: still has ${roles} role(s) and ${skills} skill(s)`);
+      }
+      await tx.organizationAgentConfigFolder.delete({ where: { id: folder.id } });
+      await tx.auditEntry.create({
+        data: {
+          organizationId: input.organizationId,
+          action: "agent_config_folder.deleted",
+          metadata: { folderId: folder.id, name: folder.name },
+        },
+      });
+    });
+  }
+
+  /**
+   * Assign a skill to a folder (or unfile it with `folderId: null`). This is
+   * a label-class change in the ADR-0017 sense — the execution surface is
+   * untouched, so no session archival (ADR-0028).
+   */
+  async setSkillFolder(input: {
+    readonly organizationId: string;
+    readonly name: string;
+    readonly folderId: string | null;
+  }): Promise<void> {
+    await this.requireActiveOrganization(input.organizationId);
+    await this.prisma.$transaction(async (tx) => {
+      const skill = await tx.organizationAgentSkill.findUnique({
+        where: { organizationId_name: { organizationId: input.organizationId, name: input.name } },
+        select: { id: true, disabledAt: true },
+      });
+      if (skill === null || skill.disabledAt !== null) {
+        throw new Error(`active skill not found in organization: ${input.name}`);
+      }
+      if (input.folderId !== null) {
+        await requireFolder(tx, input.organizationId, input.folderId);
+      }
+      await tx.organizationAgentSkill.update({
+        where: { id: skill.id },
+        data: { folderId: input.folderId },
+      });
+      await tx.auditEntry.create({
+        data: {
+          organizationId: input.organizationId,
+          action: "agent_skill.folder_set",
+          metadata: { name: input.name, folderId: input.folderId },
+        },
+      });
+    });
+  }
+
+  /**
+   * Assign a role to a folder (or unfile it with `folderId: null`). Same
+   * label-class semantics as `setSkillFolder`: no session archival (ADR-0028).
+   */
+  async setRoleFolder(input: {
+    readonly organizationId: string;
+    readonly roleId: string;
+    readonly folderId: string | null;
+  }): Promise<void> {
+    await this.requireActiveOrganization(input.organizationId);
+    await this.prisma.$transaction(async (tx) => {
+      const role = await tx.organizationAgentRole.findUnique({
+        where: { organizationId_roleId: { organizationId: input.organizationId, roleId: input.roleId } },
+        select: { id: true, disabledAt: true },
+      });
+      if (role === null || role.disabledAt !== null) {
+        throw new Error(`active role not found in organization: ${input.roleId}`);
+      }
+      if (input.folderId !== null) {
+        await requireFolder(tx, input.organizationId, input.folderId);
+      }
+      await tx.organizationAgentRole.update({
+        where: { id: role.id },
+        data: { folderId: input.folderId },
+      });
+      await tx.auditEntry.create({
+        data: {
+          organizationId: input.organizationId,
+          action: "agent_role.folder_set",
+          metadata: { roleId: input.roleId, folderId: input.folderId },
+        },
+      });
+    });
+  }
+
   async installSkill(input: {
     readonly organizationId: string;
     readonly sourceDir: string;
@@ -472,6 +688,19 @@ export class OrganizationAgentConfiguration {
   }
 }
 
+async function requireFolder(
+  tx: Prisma.TransactionClient,
+  organizationId: string,
+  folderId: string,
+): Promise<{ readonly id: string; readonly name: string; readonly parentId: string | null }> {
+  const folder = await tx.organizationAgentConfigFolder.findFirst({
+    where: { id: folderId, organizationId },
+    select: { id: true, name: true, parentId: true },
+  });
+  if (folder === null) throw new Error(`folder not found in organization: ${folderId}`);
+  return folder;
+}
+
 async function archiveRoleSessions(
   tx: Prisma.TransactionClient,
   organizationId: string,
@@ -530,6 +759,7 @@ function toRoleRow(role: {
   readonly disabledAt: Date | null;
   readonly createdAt: Date;
   readonly updatedAt: Date;
+  readonly folderId: string | null;
   readonly skillBindings: ReadonlyArray<{
     readonly skill: { readonly name: string; readonly disabledAt: Date | null };
   }>;
@@ -549,5 +779,6 @@ function toRoleRow(role: {
     skillNames: role.skillBindings
       .filter((binding) => binding.skill.disabledAt === null)
       .map((binding) => binding.skill.name),
+    folderId: role.folderId,
   };
 }

hub/src/agent/runner.ts

@@ -24,10 +24,10 @@
  * denied by default and re-opened only for the workspace plus named system
  * runtimes, and `failIfUnavailable` hard-fails if the sandbox can't start. The
  * subprocess gets a minimal environment and SDK credential protection removes
- * provider secrets from Bash. This upholds the workspace-bounded file-op
+ * provider secrets from Bash. This upholds `AgentFileOp.Authorized`
- * invariant (ADR-0018) without re-implementing the
+ * (ADR-0018 / `Spec.System.AgentSurface`) without re-implementing the
  * `workspace.ts` `confine()` path validator as a tool wrapper — the OS sandbox
- * is the mechanism, the ADR pins the invariant.
+ * is the mechanism, the contract pins the invariant.
  */
 import { query, type HookCallback, type McpServerConfig, type SDKMessage, type SDKAssistantMessage, type SDKUserMessage, type SDKResultMessage, type SDKPartialAssistantMessage, type SDKSystemMessage } from "@anthropic-ai/claude-agent-sdk";
 import type { PrismaClient } from "@prisma/client";

hub/src/capacity/dimensions.ts

@@ -1,6 +1,6 @@
 /**
- * ADR-0022 capacity dimensions.
+ * ADR-0022 capacity dimensions (spec `Spec.System.Capacity.CapacityDimension`).
- * The 23 pinned dimensions; exact numeric ceilings are open and calibrated by
+ * The 23 PINNED dimensions; exact numeric ceilings are `OPEN` and calibrated by
  * capacity testing. This module is the single source of the dimension set shared
  * by the platform-ceiling config and the org capacity-policy service.
  */

hub/src/database/README.md

@@ -1,126 +0,0 @@
-# src/database/
-
-`/database/*` HTTP 面。代码写在这个目录里，`hub.ts` 通过 `plugin.ts` 挂载它，
-所以服务器启动时能正确识别这些路由。
-
-页面：
-
-- `/database/admin` —— 飞书登录页（唯一登录方式）
-- `/database/dashboard` —— 左菜单 + 右内容的后台，未登录会跳回 `/database/admin`
-
-登录走平台既有的飞书 OAuth：登录页的按钮指向 `/auth/feishu/<orgSlug>`，
-回调由 `src/admin/routes/authRoutes.ts` 处理并种下 session cookie。
-
-## 开发模式：用环境变量开启一键登录
-
-本地开发没有真实飞书 app 时，可以用环境变量开启一键登录，跳过飞书 OAuth，
-直接以现有 OWNER/ADMIN 身份登入后台。**仅限开发，不是生产登录路径。**
-
-### 怎么开
-
-在 `hub/.env` 里设：
-
-```sh
-HUB_DEV_LOGIN_BYPASS="true"
-```
-
-改完重启服务（`npm run dev`，或本地手动 `npx tsx src/server.ts`）。启动日志会
-打印一行 `DEV login bypass enabled: /database/dev-login ...` 作为确认。
-
-开启后：
-
-- `/database/admin` 登录页显示「⚡ 一键登录管理员」按钮
-- 后端注册 `/database/dev-login` 端点：按钮就是打它，它签发一个和飞书 OAuth
-  回调完全一样的 session，然后跳到 `/database/dashboard`
-
-### 怎么关
-
-把值设成 `false`（或 `0` / `no` / `off`），或删掉这一行。关闭后按钮消失、
-`/database/dev-login` 返回 404 —— 按钮和端点同进同退。
-
-### 双重门禁（重要）
-
-真正的开关是两个条件的**与**（判断在 `plugin.ts`）：
-
-```
-allowDevLoginBypass = (NODE_ENV !== "production") && HUB_DEV_LOGIN_BYPASS 为真
-```
-
-即：**只要 `NODE_ENV=production`，无论 `HUB_DEV_LOGIN_BYPASS` 设成什么，一键登录
-都强制关闭。** 生产始终只能走真实飞书 OAuth。
-
-> 提醒：`HUB_DEV_LOGIN_BYPASS` 是敏感开关，别把开着它的 `.env` 带到任何联网 /
-> 共享环境。整个旁路逻辑自包含在本目录（`plugin.ts` + `routes/databaseRoutes.ts`），
-> `src/admin` 的登录路由未受影响。
-
-## 文件
-
-| 文件 | 职责 |
-|------|------|
-| `plugin.ts` | 模块对外入口，`hub.ts` 调 `registerDatabasePlugin()` |
-| `routes/databaseRoutes.ts` | 登录页/dashboard + 各子路由装配点 |
-| `routes/filelibRoutes.ts` | 文件库 树/授权/搜索 API |
-| `routes/fileRoutes.ts` | 文件库 文件内容/导出 API |
-| `routes/libraryPage.ts` | `/database/library` 文件库浏览页 |
-| `filelib/` | 文件库领域层(见下) |
-
-新增一类端点时：要么直接往 `databaseRoutes.ts` 加 `app.get("/database/...")`，
-要么新建 `routes/xxxRoutes.ts` 并在 `databaseRoutes.ts` 里 `registerXxxRoutes(app, {...})`
-注册一次。
-
-## 文件库(filelib/)
-
-独立文件库模块,语义由仓库根《文件库-接口契约.md》(C/D 编号)与
-`.omo/文件库-开工计划.md`(D11–D19)锚定。**与 hub 自己的 Folder/Project
-(ADR-0021 explorer)是两套体系,不复用。**
-
-| 文件 | 职责 |
-|------|------|
-| `filelib/model.ts` | 角色秩(MANAGE>EDIT>VIEW)、D14 命名规则、FileLibError |
-| `filelib/permission.ts` | 纯权限 reducer(取最高/不降权/祖先继承/D11 冻结),不碰 IO |
-| `filelib/treeService.ts` | 树增删改查;每个写操作同事务落审计 |
-| `filelib/grantService.ts` | 授权管理 + 契约 8.1 矩阵强制 + force_adjust |
-| `filelib/fileService.ts` | 文件路径安全 + 版本化读写(先 git 后审计的顺序铁律) |
-| `filelib/exportService.ts` | 导出 job 状态机(D10 异步)+ ExportAdapter port |
-| `filelib/versionStore.ts` | 契约 C1 port + 内存实现(版本团队 npm 包到位后替换) |
-| `filelib/groupResolver.ts` | 契约 C2 port + Team 过渡实现 |
-| `filelib/groupResolverHttp.ts` | C2 HTTP 实现(HUB_GROUP_SERVICE_URL 启用;失败 → 503) |
-| `filelib/audit.ts` | 审计动作词表(C3 §6.3)+ 同事务写入 |
-| `filelib/guards.ts` | session → FileLibActor;网站管理员 = org OWNER/ADMIN(D19) |
-| `filelib/routeShared.ts` | 路由共享件(依赖装配/错误映射/请求体校验) |
-
-环境变量:
-
-- `HUB_FILELIB_STORAGE_ROOT` — 项目 git 仓库根目录(默认 `./.filelib-repos`)
-- `HUB_GROUP_SERVICE_URL` — Group 团队服务地址(C2);未配置时读 hub Team(扁平)
-
-> ⚠️ 开发期注意:当前 VersionStore 是**进程内存**实现,**服务重启后仓库全失**,
-> 此前创建的项目再访问文件会报 `repo_not_found`(需重建项目)。版本团队的
-> 持久化 git 包到位后此问题消失。
-
-关键语义速查:
-
-- **D8**:无权限 → 404(不泄露存在性);越权 → 403;Group 服务故障 → 503
-- **D11**:creator 不可变 + 自动 MANAGE;独立权限关闭时项目级非创建者 grant 冻结
-- **D12**:move = 本节点 MANAGE + 目标父 EDIT+,事务 + pg 咨询锁
-- **D15**:删除只打标本节点,"任一祖先已删"即整支不可见
-- **8.1**:MANAGE 仅创建者可授/收;creator grant 不可动
-- **审计**:一切写操作在业务事务内写 AuditEntry(同事务,失败即回滚);
-  文件内容写先 versionStore.commit 再审计(宁多版本,不造假审计)
-
-## 约定（与 admin 面一致）
-
-1. 路由用**绝对路径** `"/database/..."`，不用 Fastify prefix —— 每条路由 grep 得到。
-2. **guard 前置、fail closed**：凡碰数据的端点第一行先跑
-   `requireSession` / `requireOrgRole` / `requireProjectPermission`
-   （都在 `../admin/auth/guards.js`）。
-3. **租户隔离**（ADR-0020）：每个 Prisma 查询都 scope 到 `auth.organization.id`，
-   不得跨 org。禁止无鉴权的数据路由。
-4. 数据库通过传入的 `config.prisma` 访问（全进程单例，见 `../db.ts`）；
-   不要在这里 `new PrismaClient()`。
-
-## 为什么代码在 `src/` 下
-
-`tsconfig.json` 固定 `rootDir: "src"` 且 `include: ["src/**/*.ts"]`。只有
-`src/` 下的 `.ts` 会被 `tsc` 编译、被 `tsx watch`（`npm run dev`）加载。放在
-`src/` 之外的目录不会被构建，外部识别不到。

hub/src/database/filelib/audit.ts

@@ -1,72 +0,0 @@
-/**
- * 文件库审计 sink(契约 C3 的入驻适配)。
- *
- * 契约原文:本地 outbox 表(与业务同事务)→ 中继 POST 到独立审计服务。
- * 入驻 hub 后的适配:审计同事 = 本库 AuditEntry,与业务写在同一 Prisma 事务
- * 内落库 —— 同库同事务天然满足"操作成功则日志必存在",比 outbox+relay 更强。
- * 若审计团队日后独立成服务,只换本文件的实现,action 词汇表保持不变。
- */
-
-import type { Prisma } from "@prisma/client";
-
-/** C3 §6.3:文件库审计动作词汇表(与契约文档逐条对应,改词需升契约版本)。 */
-export const FILE_LIB_AUDIT_ACTIONS = {
-  folderCreate: "folder.create",
-  folderRename: "folder.rename",
-  folderMove: "folder.move",
-  folderDelete: "folder.delete",
-  projectCreate: "project.create",
-  projectRename: "project.rename",
-  projectMove: "project.move",
-  projectDelete: "project.delete",
-  permissionGrant: "permission.grant",
-  permissionUpdate: "permission.update",
-  permissionRevoke: "permission.revoke",
-  independentEnable: "project.independent_permission.enable",
-  independentDisable: "project.independent_permission.disable",
-  independentChange: "project.independent_permission.change",
-  fileUpload: "file.upload",
-  fileRename: "file.rename",
-  fileDelete: "file.delete",
-  fileCommit: "file.commit",
-  fileConflictDetected: "file.conflict_detected",
-  exportRun: "export.run",
-  adminForceAdjust: "admin.force_adjust",
-} as const;
-
-export type FileLibAuditObjectType = "folder" | "project" | "file" | "grant" | "export_job";
-
-export interface FileLibAuditEntry {
-  readonly action: string;
-  readonly actorUserId: string;
-  readonly organizationId: string;
-  readonly objectType: FileLibAuditObjectType;
-  readonly objectId: string;
-  /** 节点 id 路径(pathIds)或项目内文件路径,便于按路径检索。 */
-  readonly objectPath: string;
-  readonly detail?: Record<string, unknown> | undefined;
-}
-
-/**
- * 在调用方的事务里写一条审计。刻意不吞错:写不出来整个业务操作回滚
- * (需求 5.1"操作成功则日志必存在"的强保证)。
- */
-export async function writeFileLibAudit(
-  tx: Prisma.TransactionClient,
-  entry: FileLibAuditEntry,
-): Promise<void> {
-  const metadata: Record<string, unknown> = {
-    objectType: entry.objectType,
-    objectId: entry.objectId,
-    objectPath: entry.objectPath,
-    ...(entry.detail ?? {}),
-  };
-  await tx.auditEntry.create({
-    data: {
-      action: entry.action,
-      actorUserId: entry.actorUserId,
-      organizationId: entry.organizationId,
-      metadata: metadata as Prisma.InputJsonValue,
-    },
-  });
-}

hub/src/database/filelib/exportService.ts

@@ -1,195 +0,0 @@
-/**
- * 导出(契约 D10):异步任务 + 状态机 QUEUED → RUNNING → DONE/FAILED。
- *
- * ExportAdapter 是外部导出工具的 port(参数清单 OPEN-6,真身到位后替换)。
- * 当前 stub 适配器产出"文件清单 manifest"文本,证明状态机端到端可跑;
- * 产物存进程内存(v1 stub;生产应落对象存储/磁盘 —— 见 OPEN 清单)。
- */
-
-import { randomUUID } from "node:crypto";
-import { FileLibError } from "./model.js";
-import { FILE_LIB_AUDIT_ACTIONS, writeFileLibAudit } from "./audit.js";
-import { requireAccessInTx, type FileLibActor } from "./treeService.js";
-import type { FileDeps } from "./fileService.js";
-
-export interface ExportAdapterInput {
-  readonly storageDir: string;
-  readonly target: string;
-  readonly params: Record<string, unknown>;
-  readonly listFiles: (prefix?: string) => Promise<readonly { path: string; size: number }[]>;
-  readonly readFile: (path: string) => Promise<Buffer>;
-}
-
-export interface ExportArtifact {
-  readonly filename: string;
-  readonly content: Buffer;
-}
-
-export interface ExportAdapter {
-  readonly target: string;
-  run(input: ExportAdapterInput): Promise<ExportArtifact>;
-}
-
-/** stub 适配器:生成项目文件清单,端到端验证 job 状态机。OPEN-6 后换真导出工具。 */
-export function createManifestStubAdapter(versionStore: FileDeps["versionStore"]): ExportAdapter {
-  return {
-    target: "manifest",
-    async run(input) {
-      const files = await input.listFiles();
-      const lines = [
-        `# Export manifest (stub adapter)`,
-        `target: ${input.target}`,
-        `storageDir: ${input.storageDir}`,
-        `files: ${files.length}`,
-        ``,
-        ...files.map((f) => `${String(f.size).padStart(10)}  ${f.path}`),
-      ];
-      return { filename: "manifest.txt", content: Buffer.from(lines.join("\n"), "utf8") };
-    },
-  };
-}
-
-// v1 stub 产物存储(进程内存,重启即失;生产替换为持久存储)。
-const artifacts = new Map<string, ExportArtifact>();
-
-export interface ExportDeps extends FileDeps {
-  readonly adapters: readonly ExportAdapter[];
-}
-
-export interface ExportJobDto {
-  readonly id: string;
-  readonly nodeId: string;
-  readonly target: string;
-  readonly status: "QUEUED" | "RUNNING" | "DONE" | "FAILED";
-  readonly error: string | null;
-  readonly createdAt: Date;
-}
-
-/** 提交导出(需 VIEW):建行(QUEUED)+ export.run 审计,同事务;异步执行。 */
-export async function submitExport(
-  deps: ExportDeps,
-  actor: FileLibActor,
-  projectId: string,
-  target: string,
-  params: Record<string, unknown>,
-): Promise<ExportJobDto> {
-  const { node } = await deps.prisma.$transaction(async (tx) =>
-    requireAccessInTx(tx, deps, actor, projectId, "VIEW"),
-  );
-  if (node.kind !== "PROJECT") {
-    throw new FileLibError(400, "invalid_node_kind", "export applies to projects only");
-  }
-  const adapter = deps.adapters.find((a) => a.target === target);
-  if (adapter === undefined) {
-    throw new FileLibError(400, "unknown_target", `no export adapter for target "${target}"`);
-  }
-  if (node.storageDir === null) {
-    throw new FileLibError(409, "project_not_ready", "project repository is not ready");
-  }
-
-  const jobId = randomUUID();
-  const job = await deps.prisma.$transaction(async (tx) => {
-    const created = await tx.fileLibExportJob.create({
-      data: {
-        id: jobId,
-        organizationId: deps.organizationId,
-        nodeId: node.id,
-        target,
-        params: params as never,
-        status: "QUEUED",
-        createdByUserId: actor.userId,
-      },
-    });
-    await writeFileLibAudit(tx, {
-      action: FILE_LIB_AUDIT_ACTIONS.exportRun,
-      actorUserId: actor.userId,
-      organizationId: deps.organizationId,
-      objectType: "export_job",
-      objectId: jobId,
-      objectPath: node.pathIds,
-      detail: { target, params },
-    });
-    return created;
-  });
-
-  const storageDir = node.storageDir;
-  setImmediate(() => {
-    void runExportJob(deps, adapter, jobId, storageDir, target, params).catch(() => undefined);
-  });
-  return toDto(job);
-}
-
-async function runExportJob(
-  deps: ExportDeps,
-  adapter: ExportAdapter,
-  jobId: string,
-  storageDir: string,
-  target: string,
-  params: Record<string, unknown>,
-): Promise<void> {
-  await deps.prisma.fileLibExportJob.update({ where: { id: jobId }, data: { status: "RUNNING" } });
-  try {
-    const artifact = await adapter.run({
-      storageDir,
-      target,
-      params,
-      listFiles: (prefix) => deps.versionStore.list(storageDir, prefix),
-      readFile: (path) => deps.versionStore.read(storageDir, path),
-    });
-    artifacts.set(jobId, artifact);
-    await deps.prisma.fileLibExportJob.update({
-      where: { id: jobId },
-      data: { status: "DONE", downloadUrl: `/database/api/exports/${jobId}/download` },
-    });
-  } catch (error) {
-    await deps.prisma.fileLibExportJob.update({
-      where: { id: jobId },
-      data: { status: "FAILED", error: String(error) },
-    });
-  }
-}
-
-export async function getExportJob(
-  deps: ExportDeps,
-  actor: FileLibActor,
-  jobId: string,
-): Promise<ExportJobDto> {
-  const job = await deps.prisma.fileLibExportJob.findFirst({
-    where: { id: jobId, organizationId: deps.organizationId },
-  });
-  if (job === null) throw new FileLibError(404, "export_not_found", "export job not found");
-  // D8:对源项目无 View → 404(不泄露 job 存在性)。
-  await deps.prisma.$transaction(async (tx) => requireAccessInTx(tx, deps, actor, job.nodeId, "VIEW"));
-  return toDto(job);
-}
-
-export async function downloadExport(
-  deps: ExportDeps,
-  actor: FileLibActor,
-  jobId: string,
-): Promise<ExportArtifact> {
-  await getExportJob(deps, actor, jobId);
-  const artifact = artifacts.get(jobId);
-  if (artifact === undefined) {
-    throw new FileLibError(409, "export_not_ready", "export artifact is not available");
-  }
-  return artifact;
-}
-
-function toDto(job: {
-  id: string;
-  nodeId: string;
-  target: string;
-  status: "QUEUED" | "RUNNING" | "DONE" | "FAILED";
-  error: string | null;
-  createdAt: Date;
-}): ExportJobDto {
-  return {
-    id: job.id,
-    nodeId: job.nodeId,
-    target: job.target,
-    status: job.status,
-    error: job.error,
-    createdAt: job.createdAt,
-  };
-}

hub/src/database/filelib/fileService.ts

@@ -1,275 +0,0 @@
-/**
- * 文件内容服务(Phase 3):路径安全 + 版本化文件操作 + 审计。
- *
- * 顺序铁律(Metis 风险#1 的落地):
- *  - 内容写:先 versionStore.commit(业务事实本体)→ 再 DB 事务(审计)。
- *    宁多一个无审计的版本,不造一条假审计。
- *  - conflict:写 file.conflict_detected(冲突本身就是事件),再抛 409。
- *  - 读:随取随读,不写审计(需求 5.2 未列读操作)。
- */
-
-import { FileLibError } from "./model.js";
-import { FILE_LIB_AUDIT_ACTIONS, writeFileLibAudit } from "./audit.js";
-import type { CommitResult, FileEntry, VersionInfo, VersionStore } from "./versionStore.js";
-import type { AccessDeps, FileLibActor } from "./treeService.js";
-import { requireAccessInTx } from "./treeService.js";
-import type { FileLibNode, PrismaClient } from "@prisma/client";
-
-export const FILE_PATH_MAX_LENGTH = 512;
-export const FILE_PATH_MAX_DEPTH = 32;
-export const FILE_CONTENT_MAX_BYTES = 10 * 1024 * 1024; // OPEN-5 初值
-
-const CONTROL_CHARS = /[\p{C}]/u;
-const FORBIDDEN_SEGMENTS = new Set(["", ".", "..", ".git"]);
-
-/**
- * 路径安全(Metis 安全红线):NFC;拒绝反斜杠、控制字符、空段、
- * "." / ".." / ".git" 段、绝对路径、超长/超深。返回规范化相对路径。
- */
-export function validateFilePath(raw: string): string {
-  const normalized = raw.normalize("NFC");
-  if (normalized.length === 0 || normalized.length > FILE_PATH_MAX_LENGTH) {
-    throw new FileLibError(400, "invalid_path", `path must be 1..${FILE_PATH_MAX_LENGTH} characters`);
-  }
-  if (normalized.includes("\\")) {
-    throw new FileLibError(400, "invalid_path", "path must use '/' separators");
-  }
-  if (CONTROL_CHARS.test(normalized)) {
-    throw new FileLibError(400, "invalid_path", "path must not contain control characters");
-  }
-  const segments = normalized.split("/");
-  if (segments.length > FILE_PATH_MAX_DEPTH) {
-    throw new FileLibError(400, "invalid_path", `path depth exceeds ${FILE_PATH_MAX_DEPTH}`);
-  }
-  for (const segment of segments) {
-    if (FORBIDDEN_SEGMENTS.has(segment)) {
-      throw new FileLibError(400, "invalid_path", `forbidden path segment: "${segment}"`);
-    }
-  }
-  return normalized;
-}
-
-export interface FileDeps extends AccessDeps {
-  readonly prisma: PrismaClient;
-  readonly versionStore: VersionStore;
-}
-
-type ProjectChain = { readonly node: FileLibNode; readonly storageDir: string };
-
-async function requireProject(
-  deps: FileDeps,
-  actor: FileLibActor,
-  projectId: string,
-  minRole: "VIEW" | "EDIT",
-): Promise<ProjectChain> {
-  const { node } = await deps.prisma.$transaction(async (tx) =>
-    requireAccessInTx(tx, deps, actor, projectId, minRole),
-  );
-  if (node.kind !== "PROJECT") {
-    throw new FileLibError(400, "invalid_node_kind", "file operations apply to projects only");
-  }
-  if (node.provisionStatus === "PROVISIONING") {
-    throw new FileLibError(409, "project_not_ready", "project repository is still provisioning");
-  }
-  if (node.provisionStatus === "FAILED") {
-    throw new FileLibError(409, "project_not_ready", "project repository provisioning failed");
-  }
-  if (node.storageDir === null) {
-    throw new FileLibError(500, "storage_missing", "project has no storage directory");
-  }
-  return { node, storageDir: node.storageDir };
-}
-
-export type FileContentEncoding = "utf8" | "base64";
-
-export interface FileContentDto {
-  readonly path: string;
-  readonly version: string;
-  readonly encoding: FileContentEncoding;
-  readonly content: string;
-  readonly size: number;
-}
-
-export function decodeContent(content: string, encoding: FileContentEncoding): string | Buffer {
-  return encoding === "base64" ? Buffer.from(content, "base64") : content;
-}
-
-function encodeContent(buffer: Buffer): { readonly encoding: FileContentEncoding; readonly content: string } {
-  // 粗判二进制:含 NUL 字节即按 base64 返回(需求 2.5 在线编辑仅针对文本)。
-  return buffer.includes(0)
-    ? { encoding: "base64", content: buffer.toString("base64") }
-    : { encoding: "utf8", content: buffer.toString("utf8") };
-}
-
-function checkSize(content: string | Buffer): void {
-  const bytes = typeof content === "string" ? Buffer.byteLength(content, "utf8") : content.byteLength;
-  if (bytes > FILE_CONTENT_MAX_BYTES) {
-    throw new FileLibError(413, "file_too_large", `file exceeds ${FILE_CONTENT_MAX_BYTES} bytes`);
-  }
-}
-
-async function auditFile(
-  deps: FileDeps,
-  actor: FileLibActor,
-  action: string,
-  project: ProjectChain,
-  filePath: string,
-  detail: Record<string, unknown>,
-): Promise<void> {
-  await deps.prisma.$transaction(async (tx) => {
-    await writeFileLibAudit(tx, {
-      action,
-      actorUserId: actor.userId,
-      organizationId: deps.organizationId,
-      objectType: "file",
-      objectId: project.node.id,
-      objectPath: `${project.node.pathIds}:${filePath}`,
-      detail,
-    });
-  });
-}
-
-/* ---------------------------------------------------------------- 读操作 */
-
-export async function listFiles(
-  deps: FileDeps,
-  actor: FileLibActor,
-  projectId: string,
-  prefix?: string,
-): Promise<readonly FileEntry[]> {
-  const project = await requireProject(deps, actor, projectId, "VIEW");
-  return deps.versionStore.list(project.storageDir, prefix === undefined ? undefined : validateFilePath(prefix));
-}
-
-export async function readFile(
-  deps: FileDeps,
-  actor: FileLibActor,
-  projectId: string,
-  rawPath: string,
-): Promise<FileContentDto> {
-  const filePath = validateFilePath(rawPath);
-  const project = await requireProject(deps, actor, projectId, "VIEW");
-  const [version, buffer] = await Promise.all([
-    deps.versionStore.head(project.storageDir, filePath),
-    deps.versionStore.read(project.storageDir, filePath),
-  ]);
-  const { encoding, content } = encodeContent(buffer);
-  return { path: filePath, version, encoding, content, size: buffer.byteLength };
-}
-
-/** 原始字节下载(浏览器 save-as 用):JSON 之外的第二条读取通道,同样的 VIEW 门禁。 */
-export async function readFileRaw(
-  deps: FileDeps,
-  actor: FileLibActor,
-  projectId: string,
-  rawPath: string,
-): Promise<{ readonly buffer: Buffer; readonly version: string; readonly filename: string }> {
-  const filePath = validateFilePath(rawPath);
-  const project = await requireProject(deps, actor, projectId, "VIEW");
-  const [version, buffer] = await Promise.all([
-    deps.versionStore.head(project.storageDir, filePath),
-    deps.versionStore.read(project.storageDir, filePath),
-  ]);
-  return { buffer, version, filename: filePath.split("/").pop() ?? "download" };
-}
-
-export async function fileHistory(
-  deps: FileDeps,
-  actor: FileLibActor,
-  projectId: string,
-  rawPath: string,
-  limit?: number,
-): Promise<readonly VersionInfo[]> {
-  const filePath = validateFilePath(rawPath);
-  const project = await requireProject(deps, actor, projectId, "VIEW");
-  return deps.versionStore.history(project.storageDir, filePath, limit);
-}
-
-export async function diffFile(
-  deps: FileDeps,
-  actor: FileLibActor,
-  projectId: string,
-  rawPath: string,
-  from: string,
-  to: string,
-): Promise<{ readonly diff: string }> {
-  const filePath = validateFilePath(rawPath);
-  const project = await requireProject(deps, actor, projectId, "VIEW");
-  return { diff: await deps.versionStore.diff(project.storageDir, filePath, from, to) };
-}
-
-/* ---------------------------------------------------------------- 写操作 */
-
-export interface CommitInput {
-  readonly path: string;
-  /** null = 新建(已存在则 409);编辑时传 readFile 拿到的 version。 */
-  readonly baseVersion: string | null;
-  readonly content: string;
-  readonly encoding?: FileContentEncoding | undefined;
-  readonly message?: string | undefined;
-}
-
-/**
- * 统一写入口(上传/编辑共用):先 commit,成功写 file.commit / file.upload 审计;
- * 冲突写 file.conflict_detected 后抛 409(details 带 currentVersion,编辑 UI 用它拉 diff)。
- */
-export async function commitFile(
-  deps: FileDeps,
-  actor: FileLibActor,
-  projectId: string,
-  input: CommitInput,
-): Promise<{ readonly version: string }> {
-  const filePath = validateFilePath(input.path);
-  const content = decodeContent(input.content, input.encoding ?? "utf8");
-  checkSize(content);
-  const project = await requireProject(deps, actor, projectId, "EDIT");
-
-  const result: CommitResult = await deps.versionStore.commit(project.storageDir, filePath, {
-    baseVersion: input.baseVersion,
-    content,
-    message: input.message,
-    author: actor.userId,
-  });
-
-  if (result.status === "conflict") {
-    await auditFile(deps, actor, FILE_LIB_AUDIT_ACTIONS.fileConflictDetected, project, filePath, {
-      baseVersion: input.baseVersion,
-      currentVersion: result.currentVersion,
-    });
-    throw new FileLibError(409, "version_conflict", "file was modified since baseVersion", {
-      currentVersion: result.currentVersion,
-    });
-  }
-
-  await auditFile(
-    deps,
-    actor,
-    input.baseVersion === null ? FILE_LIB_AUDIT_ACTIONS.fileUpload : FILE_LIB_AUDIT_ACTIONS.fileCommit,
-    project,
-    filePath,
-    { version: result.version, message: input.message ?? null },
-  );
-  return { version: result.version };
-}
-
-export async function deleteFile(
-  deps: FileDeps,
-  actor: FileLibActor,
-  projectId: string,
-  rawPath: string,
-  baseVersion: string,
-): Promise<void> {
-  const filePath = validateFilePath(rawPath);
-  const project = await requireProject(deps, actor, projectId, "EDIT");
-  const result = await deps.versionStore.remove(project.storageDir, filePath, baseVersion);
-  if (result.status === "conflict") {
-    await auditFile(deps, actor, FILE_LIB_AUDIT_ACTIONS.fileConflictDetected, project, filePath, {
-      baseVersion,
-      currentVersion: result.currentVersion,
-    });
-    throw new FileLibError(409, "version_conflict", "file was modified since baseVersion", {
-      currentVersion: result.currentVersion,
-    });
-  }
-  await auditFile(deps, actor, FILE_LIB_AUDIT_ACTIONS.fileDelete, project, filePath, { baseVersion });
-}

hub/src/database/filelib/grantService.ts

@@ -1,319 +0,0 @@
-/**
- * 授权管理(契约 8.1 矩阵的服务端强制)。
- *
- * 矩阵:
- *  - 创建者(creatorId 不可变):可授/改/收 MANAGE、EDIT、VIEW;自身 creator grant 不可动
- *  - MANAGE 持有者:可授/改/收 EDIT、VIEW;不可碰 MANAGE;不可动创建者
- *  - EDIT/VIEW:无授权能力(requireAccess MANAGE 已挡)
- *  - 网站管理员:走 forceAdjustGrants(不查节点权限,D19),全部留 admin.force_adjust 审计
- *
- * D8:目标节点不可见/无权限 → 404;有权限但矩阵禁止 → 403。
- */
-
-import { Prisma } from "@prisma/client";
-import type { FileLibGrant, FileLibNode, PrismaClient } from "@prisma/client";
-import { FileLibError, type FileLibRole } from "./model.js";
-import { FILE_LIB_AUDIT_ACTIONS, writeFileLibAudit } from "./audit.js";
-import {
-  requireAccessInTx,
-  type AccessDeps,
-  type FileLibActor,
-  type InitialGrant,
-} from "./treeService.js";
-
-export interface GrantDto {
-  readonly id: string;
-  readonly principalType: "USER" | "GROUP";
-  readonly principalId: string;
-  readonly role: FileLibRole;
-  readonly isCreatorGrant: boolean;
-  readonly createdAt: Date;
-}
-
-function toDto(grant: FileLibGrant): GrantDto {
-  return {
-    id: grant.id,
-    principalType: grant.principalType,
-    principalId: grant.principalId,
-    role: grant.role,
-    isCreatorGrant: grant.isCreatorGrant,
-    createdAt: grant.createdAt,
-  };
-}
-
-type Tx = Prisma.TransactionClient;
-type Deps = AccessDeps & { readonly prisma: PrismaClient };
-
-/** MANAGE 门禁:带 tx 时用调用方事务(与后续写同绳),不带时自开一个。 */
-async function requireManage(
-  deps: Deps,
-  actor: FileLibActor,
-  nodeId: string,
-  tx?: Tx,
-): Promise<{ readonly node: FileLibNode; readonly role: FileLibRole }> {
-  if (tx !== undefined) return requireAccessInTx(tx, deps, actor, nodeId, "MANAGE");
-  return deps.prisma.$transaction(async (inner) => requireAccessInTx(inner, deps, actor, nodeId, "MANAGE"));
-}
-
-/** 列出节点活跃授权(需 MANAGE)。 */
-export async function listGrants(
-  deps: Deps,
-  actor: FileLibActor,
-  nodeId: string,
-): Promise<readonly GrantDto[]> {
-  await requireManage(deps, actor, nodeId);
-  const grants = await deps.prisma.fileLibGrant.findMany({
-    where: { organizationId: deps.organizationId, nodeId, revokedAt: null },
-    orderBy: [{ isCreatorGrant: "desc" }, { createdAt: "asc" }],
-  });
-  return grants.map(toDto);
-}
-
-export interface PutGrantsResult {
-  readonly granted: number;
-  readonly updated: number;
-  readonly grants: readonly GrantDto[];
-}
-
-/**
- * 批量授予/修改(upsert 语义):同 principal 已有活跃授权 → 改级别(permission.update);
- * 没有 → 新建(permission.grant)。8.1 矩阵在写之前整体校验。
- */
-export async function putGrants(
-  deps: Deps,
-  actor: FileLibActor,
-  nodeId: string,
-  items: readonly InitialGrant[],
-): Promise<PutGrantsResult> {
-  validateGrantItems(items);
-  return deps.prisma.$transaction(async (tx) => {
-    const { node } = await requireManage(deps, actor, nodeId, tx);
-    const isCreator = node.creatorId === actor.userId;
-    for (const item of items) {
-      if (item.role === "MANAGE" && !isCreator) {
-        throw new FileLibError(403, "only_creator_can_grant_manage", "only the creator can grant MANAGE");
-      }
-      if (item.principalType === "USER" && item.principalId === node.creatorId) {
-        throw new FileLibError(403, "cannot_touch_creator", "the creator's grant is immutable");
-      }
-    }
-
-    let granted = 0;
-    let updated = 0;
-    for (const item of items) {
-      const existing = await tx.fileLibGrant.findFirst({
-        where: {
-          nodeId: node.id,
-          principalType: item.principalType,
-          principalId: item.principalId,
-          revokedAt: null,
-        },
-      });
-      if (existing !== null) {
-        if (existing.isCreatorGrant) {
-          throw new FileLibError(403, "cannot_touch_creator", "the creator's grant is immutable");
-        }
-        if (existing.role !== item.role) {
-          await tx.fileLibGrant.update({ where: { id: existing.id }, data: { role: item.role } });
-          updated += 1;
-          await audit(tx, deps, actor, FILE_LIB_AUDIT_ACTIONS.permissionUpdate, node.id, node.pathIds, { ...item });
-        }
-      } else {
-        await tx.fileLibGrant.create({
-          data: {
-            organizationId: deps.organizationId,
-            nodeId: node.id,
-            principalType: item.principalType,
-            principalId: item.principalId,
-            role: item.role,
-            createdByUserId: actor.userId,
-          },
-        });
-        granted += 1;
-        await audit(tx, deps, actor, FILE_LIB_AUDIT_ACTIONS.permissionGrant, node.id, node.pathIds, { ...item });
-      }
-    }
-    const grants = await tx.fileLibGrant.findMany({
-      where: { organizationId: deps.organizationId, nodeId: node.id, revokedAt: null },
-      orderBy: [{ isCreatorGrant: "desc" }, { createdAt: "asc" }],
-    });
-    return { granted, updated, grants: grants.map(toDto) };
-  });
-}
-
-/** 收回授权(需 MANAGE;creator grant 与 MANAGE grant 有额外限制,见 8.1)。 */
-export async function revokeGrant(
-  deps: Deps,
-  actor: FileLibActor,
-  nodeId: string,
-  grantId: string,
-): Promise<void> {
-  await deps.prisma.$transaction(async (tx) => {
-    const { node } = await requireManage(deps, actor, nodeId, tx);
-    const grant = await tx.fileLibGrant.findFirst({
-      where: { id: grantId, nodeId: node.id, revokedAt: null },
-    });
-    if (grant === null) throw new FileLibError(404, "grant_not_found", "grant not found");
-    if (grant.isCreatorGrant) {
-      throw new FileLibError(403, "cannot_touch_creator", "the creator's grant is immutable");
-    }
-    if (grant.role === "MANAGE" && node.creatorId !== actor.userId) {
-      throw new FileLibError(403, "only_creator_can_revoke_manage", "only the creator can revoke MANAGE");
-    }
-    await tx.fileLibGrant.update({ where: { id: grant.id }, data: { revokedAt: new Date() } });
-    await audit(tx, deps, actor, FILE_LIB_AUDIT_ACTIONS.permissionRevoke, node.id, node.pathIds, {
-      principalType: grant.principalType,
-      principalId: grant.principalId,
-      role: grant.role,
-    });
-  });
-}
-
-/**
- * 网站管理员强制调整(D19):凭 node id 操作,不查操作者节点权限;矩阵豁免;
- * 每一条变更都落 admin.force_adjust 审计(高危留痕)。
- */
-export async function forceAdjustGrants(
-  deps: Deps,
-  actor: FileLibActor,
-  nodeId: string,
-  items: readonly InitialGrant[],
-): Promise<PutGrantsResult> {
-  if (!actor.isWebsiteAdmin) {
-    throw new FileLibError(403, "forbidden", "force adjust requires website administrator");
-  }
-  validateGrantItems(items);
-  return deps.prisma.$transaction(async (tx) => {
-    const node = await tx.fileLibNode.findFirst({
-      where: { id: nodeId, organizationId: deps.organizationId, deletedAt: null },
-    });
-    if (node === null) throw new FileLibError(404, "node_not_found", "node not found");
-
-    let granted = 0;
-    let updated = 0;
-    for (const item of items) {
-      const existing = await tx.fileLibGrant.findFirst({
-        where: {
-          nodeId: node.id,
-          principalType: item.principalType,
-          principalId: item.principalId,
-          revokedAt: null,
-        },
-      });
-      if (existing !== null) {
-        if (existing.role !== item.role) {
-          await tx.fileLibGrant.update({ where: { id: existing.id }, data: { role: item.role } });
-          updated += 1;
-          await audit(tx, deps, actor, FILE_LIB_AUDIT_ACTIONS.adminForceAdjust, node.id, node.pathIds, {
-            change: "update",
-            principalType: item.principalType,
-            principalId: item.principalId,
-            from: existing.role,
-            to: item.role,
-          });
-        }
-      } else {
-        await tx.fileLibGrant.create({
-          data: {
-            organizationId: deps.organizationId,
-            nodeId: node.id,
-            principalType: item.principalType,
-            principalId: item.principalId,
-            role: item.role,
-            createdByUserId: actor.userId,
-          },
-        });
-        granted += 1;
-        await audit(tx, deps, actor, FILE_LIB_AUDIT_ACTIONS.adminForceAdjust, node.id, node.pathIds, {
-          change: "grant",
-          principalType: item.principalType,
-          principalId: item.principalId,
-          role: item.role,
-        });
-      }
-    }
-    const grants = await tx.fileLibGrant.findMany({
-      where: { organizationId: deps.organizationId, nodeId: node.id, revokedAt: null },
-      orderBy: [{ isCreatorGrant: "desc" }, { createdAt: "asc" }],
-    });
-    return { granted, updated, grants: grants.map(toDto) };
-  });
-}
-
-/** 项目独立权限开关(P5/D11):需 MANAGE;状态不变则空操作。 */
-export async function setIndependentPermission(
-  deps: Deps,
-  actor: FileLibActor,
-  nodeId: string,
-  enabled: boolean,
-): Promise<{ readonly enabled: boolean }> {
-  return deps.prisma.$transaction(async (tx) => {
-    const { node } = await requireManage(deps, actor, nodeId, tx);
-    if (node.kind !== "PROJECT") {
-      throw new FileLibError(400, "invalid_node_kind", "independent permission applies to projects only");
-    }
-    const current = await tx.fileLibProjectSettings.findUnique({
-      where: { nodeId: node.id },
-      select: { independentPermissionsEnabled: true },
-    });
-    if ((current?.independentPermissionsEnabled ?? false) === enabled) {
-      return { enabled }; // 状态未变:空操作,不产生审计
-    }
-    await tx.fileLibProjectSettings.upsert({
-      where: { nodeId: node.id },
-      update: { independentPermissionsEnabled: enabled },
-      create: { nodeId: node.id, independentPermissionsEnabled: enabled },
-    });
-    await writeFileLibAudit(tx, {
-      action: enabled
-        ? FILE_LIB_AUDIT_ACTIONS.independentEnable
-        : FILE_LIB_AUDIT_ACTIONS.independentDisable,
-      actorUserId: actor.userId,
-      organizationId: deps.organizationId,
-      objectType: "project",
-      objectId: node.id,
-      objectPath: node.pathIds,
-      detail: { enabled },
-    });
-    return { enabled };
-  });
-}
-
-function validateGrantItems(items: readonly InitialGrant[]): void {
-  if (items.length === 0) throw new FileLibError(400, "invalid_request", "grants must not be empty");
-  const seen = new Set<string>();
-  for (const item of items) {
-    if (item.principalType !== "USER" && item.principalType !== "GROUP") {
-      throw new FileLibError(400, "invalid_request", `bad principalType: ${String(item.principalType)}`);
-    }
-    if (item.role !== "VIEW" && item.role !== "EDIT" && item.role !== "MANAGE") {
-      throw new FileLibError(400, "invalid_request", `bad role: ${String(item.role)}`);
-    }
-    if (item.principalId.trim() === "") {
-      throw new FileLibError(400, "invalid_request", "principalId must not be empty");
-    }
-    const key = `${item.principalType}:${item.principalId}`;
-    if (seen.has(key)) throw new FileLibError(400, "duplicate_principal", `duplicate principal: ${key}`);
-    seen.add(key);
-  }
-}
-
-async function audit(
-  tx: Prisma.TransactionClient,
-  deps: Deps,
-  actor: FileLibActor,
-  action: string,
-  nodeId: string,
-  pathIds: string,
-  detail: Record<string, unknown>,
-): Promise<void> {
-  await writeFileLibAudit(tx, {
-    action,
-    actorUserId: actor.userId,
-    organizationId: deps.organizationId,
-    objectType: "grant",
-    objectId: nodeId,
-    objectPath: pathIds,
-    detail,
-  });
-}

hub/src/database/filelib/groupResolver.ts

@@ -1,48 +0,0 @@
-/**
- * GroupResolver port(契约 C2)。
- *
- * 权限计算只依赖这一个查询:"用户 → 所属 Group(含全部祖先)"。
- * Group 系统(需求系统二:全局、无限嵌套)由别的团队交付;调用方只依赖此
- * port,真身到位后替换实现,不换调用点。
- */
-
-import type { PrismaClient } from "@prisma/client";
-
-export interface GroupResolver {
-  resolveMemberGroupIds(userId: string): Promise<readonly string[]>;
-}
-
-/**
- * 过渡实现:读 hub 既有 Team(org 内、扁平无嵌套 → "祖先即自身")。
- * 需求 3.2 的祖先递归语义在嵌套 Group 落地前无从谈起;此实现保证权限引擎
- * 的 Group 通路今天就是真的,而不是 mock。
- */
-export function createTeamGroupResolver(
-  prisma: PrismaClient,
-  organizationId: string,
-): GroupResolver {
-  return {
-    async resolveMemberGroupIds(userId) {
-      const memberships = await prisma.teamMembership.findMany({
-        where: {
-          userId,
-          revokedAt: null,
-          team: { organizationId, archivedAt: null },
-        },
-        select: { teamId: true },
-      });
-      return memberships.map((m) => m.teamId);
-    },
-  };
-}
-
-/** 单测 mock:静态 用户→组 映射。 */
-export function createStaticGroupResolver(
-  map: Readonly<Record<string, readonly string[]>>,
-): GroupResolver {
-  return {
-    async resolveMemberGroupIds(userId) {
-      return map[userId] ?? [];
-    },
-  };
-}

hub/src/database/filelib/groupResolverHttp.ts

@@ -1,49 +0,0 @@
-/**
- * GroupResolver 的 HTTP 实现(契约 C2,Group 团队服务到位后启用,
- * 经 HUB_GROUP_SERVICE_URL 配置)。
- *
- * 语义红线:
- *  - 失败 → FileLibError(503, group_unavailable)。依赖故障不是"无权限",
- *    绝不伪装成 404/403(计划 D13)。
- *  - 我方绝不自己推祖先:返回什么用什么,不在本地补逻辑。
- */
-
-import { FileLibError } from "./model.js";
-import type { GroupResolver } from "./groupResolver.js";
-
-export interface HttpGroupResolverConfig {
-  readonly baseUrl: string;
-  readonly timeoutMs?: number;
-  /** 测试可注入假 fetch;生产用全局 fetch。 */
-  readonly fetchFn?: typeof fetch;
-}
-
-export function createHttpGroupResolver(config: HttpGroupResolverConfig): GroupResolver {
-  const timeoutMs = config.timeoutMs ?? 2_000;
-  const fetchFn = config.fetchFn ?? fetch;
-  return {
-    async resolveMemberGroupIds(userId) {
-      const url = `${config.baseUrl.replace(/\/$/, "")}/groups/resolve-member-groups?userId=${encodeURIComponent(userId)}`;
-      let response: Response;
-      try {
-        response = await fetchFn(url, { signal: AbortSignal.timeout(timeoutMs) });
-      } catch (error) {
-        throw new FileLibError(503, "group_unavailable", `group service unreachable: ${String(error)}`);
-      }
-      if (!response.ok) {
-        throw new FileLibError(503, "group_unavailable", `group service returned ${response.status}`);
-      }
-      let body: unknown;
-      try {
-        body = await response.json();
-      } catch {
-        throw new FileLibError(503, "group_unavailable", "group service returned malformed JSON");
-      }
-      const groupIds = (body as { groupIds?: unknown }).groupIds;
-      if (!Array.isArray(groupIds) || groupIds.some((id) => typeof id !== "string")) {
-        throw new FileLibError(503, "group_unavailable", "group service returned malformed payload");
-      }
-      return groupIds as readonly string[];
-    },
-  };
-}

hub/src/database/filelib/guards.ts

@@ -1,47 +0,0 @@
-/**
- * 文件库 HTTP 门禁(契约 C4 的入驻适配)。
- *
- * 身份链:hub session(飞书 OAuth / dev bypass)→ silo org membership。
- * 网站管理员 = org 的 OWNER/ADMIN(D19:仅 root 创建与 force_adjust 特权,
- * 不给内容读旁路);普通成员 = 任何活跃 membership;非成员 = 403。
- */
-
-import type { FastifyReply, FastifyRequest } from "fastify";
-import type { OrganizationMemberRole, PrismaClient } from "@prisma/client";
-import { requireSession, sendError } from "../../admin/auth/guards.js";
-import type { FileLibActor } from "./treeService.js";
-
-export interface FileLibGuardDeps {
-  readonly prisma: PrismaClient;
-  readonly sessionSecret: string;
-  /** 文件库归属的 silo org(ADR-0020/0025)。 */
-  readonly organizationId: string;
-}
-
-const WEBSITE_ADMIN_ROLES: readonly OrganizationMemberRole[] = ["OWNER", "ADMIN"];
-
-/** 每个 /database/api/* 端点第一行调它;返回 null 时响应已发出,fail closed。 */
-export async function requireFileLibActor(
-  request: FastifyRequest,
-  reply: FastifyReply,
-  deps: FileLibGuardDeps,
-): Promise<FileLibActor | null> {
-  const auth = await requireSession(request, reply, {
-    prisma: deps.prisma,
-    sessionSecret: deps.sessionSecret,
-  });
-  if (auth === null) return null;
-
-  const membership = await deps.prisma.organizationMembership.findFirst({
-    where: { organizationId: deps.organizationId, userId: auth.user.id, revokedAt: null },
-    select: { role: true },
-  });
-  if (membership === null) {
-    await sendError(reply, 403, "forbidden", "not a member of this organization");
-    return null;
-  }
-  return {
-    userId: auth.user.id,
-    isWebsiteAdmin: WEBSITE_ADMIN_ROLES.includes(membership.role),
-  };
-}

hub/src/database/filelib/model.ts

@@ -1,59 +0,0 @@
-/**
- * 文件库领域基础:角色秩、命名规则(D14)、错误类型。
- *
- * 语义锚定:仓库根《文件库-接口契约.md》(2.2 权限等级 / D8 可见性 / D14 命名)
- * 与 .omo/文件库-开工计划.md。本模块是独立文件库,不复用 hub 的
- * Folder/Project/PermissionGrant 体系。
- */
-
-export const FILE_LIB_ROLES = ["VIEW", "EDIT", "MANAGE"] as const;
-export type FileLibRole = (typeof FILE_LIB_ROLES)[number];
-
-/** 契约 2.2:MANAGE > EDIT > VIEW,严格全序。 */
-export const ROLE_RANK: Record<FileLibRole, number> = { VIEW: 1, EDIT: 2, MANAGE: 3 };
-
-export function roleAtLeast(role: FileLibRole, min: FileLibRole): boolean {
-  return ROLE_RANK[role] >= ROLE_RANK[min];
-}
-
-/** 业务错误。statusCode 由路由层映射为 HTTP 响应(D8 语义在此层只表达为 code)。 */
-export class FileLibError extends Error {
-  constructor(
-    readonly statusCode: number,
-    readonly code: string,
-    message: string,
-    /** 结构化附加信息(如 409 时的 currentVersion),路由层并入错误响应。 */
-    readonly details?: Record<string, unknown>,
-  ) {
-    super(message);
-    this.name = "FileLibError";
-  }
-}
-
-export const NODE_NAME_MAX_LENGTH = 128;
-
-/** D14:禁 `/`;反斜杠同样禁止(它会变成存储路径的分隔符,且易用于伪装)。控制字符禁。 */
-const FORBIDDEN_NAME_CHARS = /[/\\\p{C}]/u;
-
-/**
- * D14:NFC 归一化 + trim,然后校验长度与字符集。
- * 违规抛 FileLibError(400, "invalid_name"),路由层原样透传。
- */
-export function normalizeNodeName(raw: string): string {
-  const name = raw.normalize("NFC").trim();
-  if (name.length === 0) {
-    throw new FileLibError(400, "invalid_name", "name must not be empty");
-  }
-  if (name.length > NODE_NAME_MAX_LENGTH) {
-    throw new FileLibError(400, "invalid_name", `name exceeds ${NODE_NAME_MAX_LENGTH} characters`);
-  }
-  if (FORBIDDEN_NAME_CHARS.test(name)) {
-    throw new FileLibError(400, "invalid_name", "name must not contain '/', '\\' or control characters");
-  }
-  return name;
-}
-
-/** D14:活跃兄弟节点大小写不敏感唯一的比较键(DB 层另有部分唯一索引兜底)。 */
-export function nameKey(normalizedName: string): string {
-  return normalizedName.toLowerCase();
-}

hub/src/database/filelib/permission.ts

@@ -1,74 +0,0 @@
-/**
- * 纯权限 reducer(契约 P6 / D11 / D8)。
- *
- * 设计约束(Metis 评审):本文件是纯函数层 —— 输入是"已解析好的" grant、祖先链
- * 与用户组集合,不碰 DB / 网络。数据获取在 treeService。这样权限代数可以脱离
- * 存储做密集单测与随机化不变量测试。
- */
-
-import type { FileLibRole } from "./model.js";
-import { ROLE_RANK } from "./model.js";
-
-export interface FileLibGrantFact {
-  readonly nodeId: string;
-  readonly principalType: "USER" | "GROUP";
-  readonly principalId: string;
-  readonly role: FileLibRole;
-  readonly isCreatorGrant: boolean;
-}
-
-export interface EffectiveRoleInput {
-  /** 目标节点(self)。 */
-  readonly nodeId: string;
-  readonly nodeKind: "FOLDER" | "PROJECT";
-  /** 目标的全部祖先 id(不含 self,顺序无关)。 */
-  readonly ancestorIds: readonly string[];
-  /** 项目独立权限开关(D11/P5);文件夹忽略此值。 */
-  readonly independentPermissionsEnabled: boolean;
-  readonly userId: string;
-  /** C2 resolve 结果:用户直接所属 + 全部祖先 group 的 id 集合。 */
-  readonly groupIds: readonly string[];
-  /** self ∪ ancestors 上的全部活跃 grant(revokedAt 已由获取层过滤)。 */
-  readonly grants: readonly FileLibGrantFact[];
-}
-
-/**
- * 契约 P6:effective(user, R) = max { grant.role | s ∈ {user} ∪ groups*(user),
- * r ∈ {R} ∪ ancestors(R) };无匹配 → null(无任何权限)。
- * "个人权限不能降权"在 max 语义下天然成立 —— 只取最高,不做减法。
- *
- * D11:目标为 PROJECT 且独立权限关闭时,项目级(挂在 self 上)非创建者 grant
- * 冻结不参与计算;创建者的自动 grant(isCreatorGrant)始终生效。祖先链上的
- * grant 不受开关影响。
- */
-export function effectiveRole(input: EffectiveRoleInput): FileLibRole | null {
-  const onChain = new Set<string>([input.nodeId, ...input.ancestorIds]);
-  const groups = new Set(input.groupIds);
-  const freezeProjectGrants =
-    input.nodeKind === "PROJECT" && !input.independentPermissionsEnabled;
-
-  let best: FileLibRole | null = null;
-  for (const grant of input.grants) {
-    if (!onChain.has(grant.nodeId)) continue;
-    if (freezeProjectGrants && grant.nodeId === input.nodeId && !grant.isCreatorGrant) continue;
-    if (grant.principalType === "USER" && grant.principalId !== input.userId) continue;
-    if (grant.principalType === "GROUP" && !groups.has(grant.principalId)) continue;
-    if (best === null || ROLE_RANK[grant.role] > ROLE_RANK[best]) best = grant.role;
-  }
-  return best;
-}
-
-/**
- * D8 可见性语义:
- *  - 完全无权限(effective === null)→ "not_found"(路由层映射 404,不泄露存在性);
- *  - 有权限但不足 → "forbidden"(路由层映射 403)。
- */
-export type AccessVerdict =
-  | { readonly allowed: true; readonly role: FileLibRole }
-  | { readonly allowed: false; readonly reason: "not_found" | "forbidden" };
-
-export function checkAccess(effective: FileLibRole | null, min: FileLibRole): AccessVerdict {
-  if (effective === null) return { allowed: false, reason: "not_found" };
-  if (ROLE_RANK[effective] < ROLE_RANK[min]) return { allowed: false, reason: "forbidden" };
-  return { allowed: true, role: effective };
-}

hub/src/database/filelib/routeShared.ts

@@ -1,89 +0,0 @@
-/**
- * /database/api/* 路由共享件:依赖装配、actor 门禁、统一错误映射。
- * 约定(与 admin 面一致):绝对路径;guard 前置 fail closed;查询 scope 到 silo org。
- */
-
-import type { FastifyReply, FastifyRequest } from "fastify";
-import { Prisma } from "@prisma/client";
-import type { PrismaClient } from "@prisma/client";
-import { FileLibError } from "./model.js";
-import { requireFileLibActor } from "./guards.js";
-import type { FileLibActor, TreeServiceDeps } from "./treeService.js";
-import type { GroupResolver } from "./groupResolver.js";
-import type { VersionStore } from "./versionStore.js";
-import type { ExportAdapter } from "./exportService.js";
-
-export interface FileLibRouteDeps {
-  readonly prisma: PrismaClient;
-  readonly sessionSecret: string;
-  readonly organizationId: string;
-  readonly storageRoot: string;
-  readonly groupResolver: GroupResolver;
-  readonly versionStore: VersionStore;
-  readonly exportAdapters: readonly ExportAdapter[];
-}
-
-/** 组装 treeService 依赖(路由处理内直接使用)。 */
-export function treeDeps(deps: FileLibRouteDeps): TreeServiceDeps {
-  return {
-    prisma: deps.prisma,
-    groupResolver: deps.groupResolver,
-    versionStore: deps.versionStore,
-    organizationId: deps.organizationId,
-    storageRoot: deps.storageRoot,
-  };
-}
-
-/** 端点第一行调用;null = 响应已发(401/403),fail closed。 */
-export async function actorOrNull(
-  request: FastifyRequest,
-  reply: FastifyReply,
-  deps: FileLibRouteDeps,
-): Promise<FileLibActor | null> {
-  return requireFileLibActor(request, reply, {
-    prisma: deps.prisma,
-    sessionSecret: deps.sessionSecret,
-    organizationId: deps.organizationId,
-  });
-}
-
-/** 统一错误出口:FileLibError → 语义码;P2002 → 409;其余 → 500(不泄露内部)。 */
-export async function sendRouteError(reply: FastifyReply, error: unknown): Promise<void> {
-  if (error instanceof FileLibError) {
-    await reply.status(error.statusCode).send({
-      error: { code: error.code, message: error.message, ...(error.details ?? {}) },
-    });
-    return;
-  }
-  if (error instanceof Prisma.PrismaClientKnownRequestError && error.code === "P2002") {
-    await reply.status(409).send({ error: { code: "conflict", message: "uniqueness conflict" } });
-    return;
-  }
-  reply.log.error({ err: error }, "filelib route: unexpected error");
-  await reply.status(500).send({ error: { code: "internal", message: "internal error" } });
-}
-
-/** 请求体轻量校验(抛 FileLibError 400)。 */
-export function bodyObject(body: unknown): Record<string, unknown> {
-  if (typeof body !== "object" || body === null || Array.isArray(body)) {
-    throw new FileLibError(400, "invalid_request", "request body must be a JSON object");
-  }
-  return body as Record<string, unknown>;
-}
-
-export function requireString(obj: Record<string, unknown>, key: string): string {
-  const value = obj[key];
-  if (typeof value !== "string" || value === "") {
-    throw new FileLibError(400, "invalid_request", `missing or invalid field: ${key}`);
-  }
-  return value;
-}
-
-export function optionalString(obj: Record<string, unknown>, key: string): string | undefined {
-  const value = obj[key];
-  if (value === undefined || value === null) return undefined;
-  if (typeof value !== "string") {
-    throw new FileLibError(400, "invalid_request", `invalid field: ${key}`);
-  }
-  return value;
-}

hub/src/database/filelib/treeService.ts

@@ -1,598 +0,0 @@
-/**
- * 文件库树服务(Phase 1 服务层,Phase 2 路由直接调用)。
- *
- * 语义锚定:
- *  - D8  无权限 → 404 不泄露;越权 → 403(loadChain / requireAccess)
- *  - D11 creator 不可变 + 自动 MANAGE grant;独立权限开关语义在 permission.ts
- *  - D12 move = 本节点 MANAGE + 目标父 EDIT+,事务 + pg 咨询锁防并发成环
- *  - D14 命名规则(model.ts)+ 活跃兄弟唯一(DB 部分唯一索引兜底)
- *  - D15 删除只打标本节点;"任一祖先已删"即整支不可见
- *  - D17 breadcrumb 无 View 的祖先只给占位,不泄露名字
- *  - 树表示:parentId 权威;pathIds 为 id 编码的派生物化路径(name 不入路径,
- *    rename 不重写后代;move 用一次前缀重写维护)
- *
- * 网站管理员(D19)= silo org 的 OWNER/ADMIN(契约 C4 的入驻适配):仅 root 创建
- * 与 force_adjust 特权,不隐式穿透内容权限 —— 本文件所有读路径对它同样走
- * effectiveRole,没有 admin 旁路。
- */
-
-import { randomUUID } from "node:crypto";
-import path from "node:path";
-import { Prisma } from "@prisma/client";
-import type { PrismaClient, FileLibNode } from "@prisma/client";
-import {
-  FileLibError,
-  nameKey,
-  normalizeNodeName,
-  type FileLibRole,
-} from "./model.js";
-import { checkAccess, effectiveRole } from "./permission.js";
-import type { GroupResolver } from "./groupResolver.js";
-import type { VersionStore } from "./versionStore.js";
-import { FILE_LIB_AUDIT_ACTIONS, writeFileLibAudit } from "./audit.js";
-
-export interface FileLibActor {
-  readonly userId: string;
-  /** silo org OWNER/ADMIN(契约 C4 适配)。仅 root 创建/force_adjust 用,不给读旁路。 */
-  readonly isWebsiteAdmin: boolean;
-}
-
-export interface TreeServiceDeps {
-  readonly prisma: PrismaClient;
-  readonly groupResolver: GroupResolver;
-  readonly versionStore: VersionStore;
-  /** 文件库归属的 silo org(ADR-0020 租户隔离,一切查询 scope 到它)。 */
-  readonly organizationId: string;
-  /** 项目 git 仓库的磁盘根目录;项目仓 = <storageRoot>/<nodeId>。 */
-  readonly storageRoot: string;
-}
-
-/** 权限判定实际需要的最小依赖(grantService 等兄弟模块复用)。 */
-export type AccessDeps = Pick<TreeServiceDeps, "organizationId" | "groupResolver">;
-
-export interface InitialGrant {
-  readonly principalType: "USER" | "GROUP";
-  readonly principalId: string;
-  readonly role: FileLibRole;
-}
-
-type Tx = Prisma.TransactionClient;
-
-interface Chain {
-  readonly node: FileLibNode;
-  /** 根在前、直接父在后;不含 node 自身。 */
-  readonly ancestors: readonly FileLibNode[];
-}
-
-/* ---------------------------------------------------------------- 内部工具 */
-
-/** pathIds = "/rootId/.../selfId";切出祖先 id(不含 self)。 */
-function ancestorIdsOf(node: FileLibNode): string[] {
-  return node.pathIds.split("/").filter((seg) => seg !== "").slice(0, -1);
-}
-
-/** 取节点 + 祖先链(org scope);D15:自身或任一祖先已删 → 404。 */
-async function loadVisibleChain(
-  tx: Tx,
-  organizationId: string,
-  nodeId: string,
-): Promise<Chain> {
-  const node = await tx.fileLibNode.findFirst({ where: { id: nodeId, organizationId } });
-  if (node === null) throw new FileLibError(404, "node_not_found", "node not found");
-  const ancestorIds = ancestorIdsOf(node);
-  const ancestors = ancestorIds.length === 0
-    ? []
-    : await tx.fileLibNode.findMany({ where: { organizationId, id: { in: ancestorIds } } });
-  if (node.deletedAt !== null || ancestors.some((a) => a.deletedAt !== null)) {
-    // D15:已删子树对外"不存在"(D8 不泄露)。
-    throw new FileLibError(404, "node_not_found", "node not found");
-  }
-  const byId = new Map(ancestors.map((a) => [a.id, a]));
-  const ordered = ancestorIds
-    .map((id) => byId.get(id))
-    .filter((a): a is FileLibNode => a !== undefined);
-  return { node, ancestors: ordered };
-}
-
-/** 数据获取层:把 chain、grants、groups、toggle 装配成纯 reducer 的输入。 */
-async function resolveRole(
-  tx: Tx,
-  deps: AccessDeps,
-  actor: FileLibActor,
-  chain: Chain,
-): Promise<FileLibRole | null> {
-  const chainIds = [...chain.ancestors.map((a) => a.id), chain.node.id];
-  const grants = await tx.fileLibGrant.findMany({
-    where: { organizationId: deps.organizationId, revokedAt: null, nodeId: { in: chainIds } },
-    select: { nodeId: true, principalType: true, principalId: true, role: true, isCreatorGrant: true },
-  });
-  let independentPermissionsEnabled = false;
-  if (chain.node.kind === "PROJECT") {
-    const settings = await tx.fileLibProjectSettings.findUnique({
-      where: { nodeId: chain.node.id },
-      select: { independentPermissionsEnabled: true },
-    });
-    independentPermissionsEnabled = settings?.independentPermissionsEnabled ?? false;
-  }
-  const groupIds = await deps.groupResolver.resolveMemberGroupIds(actor.userId);
-  return effectiveRole({
-    nodeId: chain.node.id,
-    nodeKind: chain.node.kind,
-    ancestorIds: chain.ancestors.map((a) => a.id),
-    independentPermissionsEnabled,
-    userId: actor.userId,
-    groupIds,
-    grants,
-  });
-}
-
-/** D8 门禁:loadVisibleChain + resolveRole + checkAccess,失败抛 FileLibError。 */
-async function requireAccess(
-  tx: Tx,
-  deps: AccessDeps,
-  actor: FileLibActor,
-  nodeId: string,
-  minRole: FileLibRole,
-): Promise<Chain & { readonly role: FileLibRole }> {
-  const chain = await loadVisibleChain(tx, deps.organizationId, nodeId);
-  const role = await resolveRole(tx, deps, actor, chain);
-  const verdict = checkAccess(role, minRole);
-  if (!verdict.allowed) {
-    throw verdict.reason === "not_found"
-      ? new FileLibError(404, "node_not_found", "node not found")
-      : new FileLibError(403, "forbidden", `requires ${minRole}`);
-  }
-  return { ...chain, role: verdict.role };
-}
-
-/**
- * 兄弟模块(grantService 等)共用的 tx 内门禁:在调用方自己的事务里做
- * 权限校验,校验与后续写同一根事务绳,避免 check-tx / write-tx 之间的竞态。
- */
-export async function requireAccessInTx(
-  tx: Tx,
-  deps: AccessDeps,
-  actor: FileLibActor,
-  nodeId: string,
-  minRole: FileLibRole,
-): Promise<Chain & { readonly role: FileLibRole }> {
-  return requireAccess(tx, deps, actor, nodeId, minRole);
-}
-
-/** P2002(活跃兄弟名部分唯一索引)→ 409。 */
-function rethrowNameConflict(error: unknown, name: string): never {
-  if (error instanceof Prisma.PrismaClientKnownRequestError && error.code === "P2002") {
-    throw new FileLibError(409, "name_conflict", `an active sibling named "${name}" already exists`);
-  }
-  throw error;
-}
-
-function nodeAction(kind: FileLibNode["kind"], verb: "Create" | "Rename" | "Move" | "Delete"): string {
-  const table = kind === "PROJECT"
-    ? { Create: FILE_LIB_AUDIT_ACTIONS.projectCreate, Rename: FILE_LIB_AUDIT_ACTIONS.projectRename, Move: FILE_LIB_AUDIT_ACTIONS.projectMove, Delete: FILE_LIB_AUDIT_ACTIONS.projectDelete }
-    : { Create: FILE_LIB_AUDIT_ACTIONS.folderCreate, Rename: FILE_LIB_AUDIT_ACTIONS.folderRename, Move: FILE_LIB_AUDIT_ACTIONS.folderMove, Delete: FILE_LIB_AUDIT_ACTIONS.folderDelete };
-  return table[verb];
-}
-
-function validateInitialGrants(actor: FileLibActor, grants: readonly InitialGrant[]): void {
-  const seen = new Set<string>();
-  for (const grant of grants) {
-    const key = `${grant.principalType}:${grant.principalId}`;
-    if (seen.has(key)) throw new FileLibError(400, "duplicate_principal", `duplicate grant principal: ${key}`);
-    seen.add(key);
-    if (grant.principalType === "USER" && grant.principalId === actor.userId) {
-      throw new FileLibError(400, "duplicate_principal", "creator already holds MANAGE via the creator grant");
-    }
-    // v1:不校验 group 存在性(C2 未提供批量校验口;给不存在 group 的授权天然无效,不危害)。
-  }
-}
-
-/* ---------------------------------------------------------------- 公共操作 */
-
-export interface CreateNodeInput {
-  readonly parentId: string | null;
-  readonly kind: "FOLDER" | "PROJECT";
-  readonly name: string;
-  readonly description?: string | undefined;
-  readonly grants?: readonly InitialGrant[] | undefined;
-}
-
-/**
- * 创建文件夹/项目。root 创建仅网站管理员(契约 2.1);非 root 需父节点 EDIT+。
- * creator 自动 MANAGE(D11);项目走 provisioning 状态机:PROVISIONING → init → READY。
- */
-export async function createNode(
-  deps: TreeServiceDeps,
-  actor: FileLibActor,
-  input: CreateNodeInput,
-): Promise<FileLibNode> {
-  const name = normalizeNodeName(input.name);
-  const initialGrants = input.grants ?? [];
-  validateInitialGrants(actor, initialGrants);
-
-  const id = randomUUID();
-  let pathIds: string;
-  let storageDir: string | null = null;
-
-  const created = await deps.prisma.$transaction(async (tx) => {
-    if (input.parentId === null) {
-      if (!actor.isWebsiteAdmin) {
-        throw new FileLibError(403, "forbidden", "root creation requires website administrator");
-      }
-      pathIds = `/${id}`;
-    } else {
-      const parent = await requireAccess(tx, deps, actor, input.parentId, "EDIT");
-      if (parent.node.kind !== "FOLDER") {
-        throw new FileLibError(400, "invalid_parent", "projects cannot have children");
-      }
-      pathIds = `${parent.node.pathIds}/${id}`;
-    }
-
-    if (input.kind === "PROJECT") {
-      storageDir = path.join(deps.storageRoot, id);
-    }
-
-    let node: FileLibNode;
-    try {
-      node = await tx.fileLibNode.create({
-        data: {
-          id,
-          organizationId: deps.organizationId,
-          parentId: input.parentId,
-          kind: input.kind,
-          name,
-          nameLower: nameKey(name),
-          pathIds,
-          creatorId: actor.userId,
-          provisionStatus: input.kind === "PROJECT" ? "PROVISIONING" : "READY",
-          storageDir,
-          ...(input.description !== undefined && input.description.trim() !== ""
-            ? { description: input.description.trim() }
-            : {}),
-        },
-      });
-    } catch (error) {
-      rethrowNameConflict(error, name);
-    }
-
-    await tx.fileLibGrant.create({
-      data: {
-        organizationId: deps.organizationId,
-        nodeId: id,
-        principalType: "USER",
-        principalId: actor.userId,
-        role: "MANAGE",
-        isCreatorGrant: true,
-        createdByUserId: actor.userId,
-      },
-    });
-    for (const grant of initialGrants) {
-      await tx.fileLibGrant.create({
-        data: {
-          organizationId: deps.organizationId,
-          nodeId: id,
-          principalType: grant.principalType,
-          principalId: grant.principalId,
-          role: grant.role,
-          createdByUserId: actor.userId,
-        },
-      });
-    }
-    if (input.kind === "PROJECT") {
-      await tx.fileLibProjectSettings.create({
-        data: { nodeId: id, independentPermissionsEnabled: false },
-      });
-    }
-
-    await writeFileLibAudit(tx, {
-      action: nodeAction(input.kind, "Create"),
-      actorUserId: actor.userId,
-      organizationId: deps.organizationId,
-      objectType: input.kind === "PROJECT" ? "project" : "folder",
-      objectId: id,
-      objectPath: pathIds,
-      detail: { name, parentId: input.parentId, initialGrants: initialGrants.length },
-    });
-    for (const grant of initialGrants) {
-      await writeFileLibAudit(tx, {
-        action: FILE_LIB_AUDIT_ACTIONS.permissionGrant,
-        actorUserId: actor.userId,
-        organizationId: deps.organizationId,
-        objectType: "grant",
-        objectId: id,
-        objectPath: pathIds,
-        detail: { principalType: grant.principalType, principalId: grant.principalId, role: grant.role },
-      });
-    }
-    return node;
-  });
-
-  // provisioning 状态机(Metis 风险#1):DB 行已持久,init 失败 → FAILED 可重试/对账。
-  if (input.kind === "PROJECT" && storageDir !== null) {
-    try {
-      await deps.versionStore.init(storageDir);
-      return await deps.prisma.fileLibNode.update({
-        where: { id: created.id },
-        data: { provisionStatus: "READY" },
-      });
-    } catch (error) {
-      await deps.prisma.fileLibNode
-        .update({ where: { id: created.id }, data: { provisionStatus: "FAILED" } })
-        .catch(() => undefined);
-      throw new FileLibError(500, "provision_failed", `repository initialization failed: ${String(error)}`);
-    }
-  }
-  return created;
-}
-
-/** 重命名(需本节点 MANAGE,契约 8.2)。id 路径不含 name,后代无需重写。 */
-export async function renameNode(
-  deps: TreeServiceDeps,
-  actor: FileLibActor,
-  nodeId: string,
-  rawName: string,
-): Promise<FileLibNode> {
-  const name = normalizeNodeName(rawName);
-  return deps.prisma.$transaction(async (tx) => {
-    const { node } = await requireAccess(tx, deps, actor, nodeId, "MANAGE");
-    let updated: FileLibNode;
-    try {
-      updated = await tx.fileLibNode.update({
-        where: { id: node.id },
-        data: { name, nameLower: nameKey(name) },
-      });
-    } catch (error) {
-      rethrowNameConflict(error, name);
-    }
-    await writeFileLibAudit(tx, {
-      action: nodeAction(node.kind, "Rename"),
-      actorUserId: actor.userId,
-      organizationId: deps.organizationId,
-      objectType: node.kind === "PROJECT" ? "project" : "folder",
-      objectId: node.id,
-      objectPath: node.pathIds,
-      detail: { from: node.name, to: name },
-    });
-    return updated;
-  });
-}
-
-/**
- * 移动(D12):本节点 MANAGE + 目标父 EDIT+(移到 root 需网站管理员);
- * 事务 + org 级咨询锁防并发成环;后代 pathIds 一次前缀重写。
- */
-export async function moveNode(
-  deps: TreeServiceDeps,
-  actor: FileLibActor,
-  nodeId: string,
-  newParentId: string | null,
-): Promise<FileLibNode> {
-  return deps.prisma.$transaction(async (tx) => {
-    await tx.$executeRaw`SELECT pg_advisory_xact_lock(hashtext(${"filelib:tree:" + deps.organizationId}))`;
-
-    const { node } = await requireAccess(tx, deps, actor, nodeId, "MANAGE");
-    if (node.parentId === newParentId) return node;
-
-    let newPathIds: string;
-    if (newParentId === null) {
-      if (!actor.isWebsiteAdmin) {
-        throw new FileLibError(403, "forbidden", "moving to root requires website administrator");
-      }
-      newPathIds = `/${node.id}`;
-    } else {
-      const parent = await requireAccess(tx, deps, actor, newParentId, "EDIT");
-      if (parent.node.kind !== "FOLDER") {
-        throw new FileLibError(400, "invalid_parent", "projects cannot have children");
-      }
-      if (parent.node.id === node.id || parent.node.pathIds.startsWith(`${node.pathIds}/`)) {
-        throw new FileLibError(400, "move_into_own_subtree", "cannot move a node into its own subtree");
-      }
-      newPathIds = `${parent.node.pathIds}/${node.id}`;
-    }
-
-    const oldPrefix = node.pathIds;
-    let updated: FileLibNode;
-    try {
-      updated = await tx.fileLibNode.update({
-        where: { id: node.id },
-        data: { parentId: newParentId, pathIds: newPathIds },
-      });
-      // 派生列维护:整支后代的前缀重写(id 编码,与 name 无关)。
-      await tx.$executeRaw`
-        UPDATE "FileLibNode"
-        SET "pathIds" = ${newPathIds} || substring("pathIds" from ${oldPrefix.length + 1}::int)
-        WHERE "organizationId" = ${deps.organizationId}
-          AND "pathIds" LIKE ${oldPrefix + "/%"}
-      `;
-    } catch (error) {
-      rethrowNameConflict(error, node.name);
-    }
-    await writeFileLibAudit(tx, {
-      action: nodeAction(node.kind, "Move"),
-      actorUserId: actor.userId,
-      organizationId: deps.organizationId,
-      objectType: node.kind === "PROJECT" ? "project" : "folder",
-      objectId: node.id,
-      objectPath: newPathIds,
-      detail: { fromParentId: node.parentId, toParentId: newParentId },
-    });
-    return updated;
-  });
-}
-
-/** 软删除(D15):只打标本节点,后代靠"任一祖先已删"过滤;需 MANAGE。 */
-export async function softDeleteNode(
-  deps: TreeServiceDeps,
-  actor: FileLibActor,
-  nodeId: string,
-): Promise<void> {
-  await deps.prisma.$transaction(async (tx) => {
-    const { node } = await requireAccess(tx, deps, actor, nodeId, "MANAGE");
-    await tx.fileLibNode.update({ where: { id: node.id }, data: { deletedAt: new Date() } });
-    await writeFileLibAudit(tx, {
-      action: nodeAction(node.kind, "Delete"),
-      actorUserId: actor.userId,
-      organizationId: deps.organizationId,
-      objectType: node.kind === "PROJECT" ? "project" : "folder",
-      objectId: node.id,
-      objectPath: node.pathIds,
-      detail: { name: node.name },
-    });
-  });
-}
-
-/** 自查生效权限(契约 9.2 effective-permission)。D8:null 角色即不可见,404。 */
-export async function getEffectiveRole(
-  deps: TreeServiceDeps,
-  actor: FileLibActor,
-  nodeId: string,
-): Promise<FileLibRole | null> {
-  return deps.prisma.$transaction(async (tx) => {
-    const chain = await loadVisibleChain(tx, deps.organizationId, nodeId);
-    const role = await resolveRole(tx, deps, actor, chain);
-    if (role === null) throw new FileLibError(404, "node_not_found", "node not found");
-    return role;
-  });
-}
-
-export interface BreadcrumbEntry {
-  readonly depth: number;
-  /** D17:无 View 的祖先 id/name 都为 null(不泄露)。 */
-  readonly id: string | null;
-  readonly name: string | null;
-  readonly kind: "FOLDER" | "PROJECT";
-}
-
-/** D17 面包屑:需 self VIEW;链上每个节点单独算权限,无 View 只留占位。 */
-export async function breadcrumb(
-  deps: TreeServiceDeps,
-  actor: FileLibActor,
-  nodeId: string,
-): Promise<readonly BreadcrumbEntry[]> {
-  return deps.prisma.$transaction(async (tx) => {
-    const chain = await loadVisibleChain(tx, deps.organizationId, nodeId);
-    const selfRole = await resolveRole(tx, deps, actor, chain);
-    if (checkAccess(selfRole, "VIEW").allowed !== true) {
-      throw new FileLibError(404, "node_not_found", "node not found");
-    }
-    const groupIds = await deps.groupResolver.resolveMemberGroupIds(actor.userId);
-    const chainNodes = [...chain.ancestors, chain.node];
-    const chainIds = chainNodes.map((n) => n.id);
-    const allGrants = await tx.fileLibGrant.findMany({
-      where: { organizationId: deps.organizationId, revokedAt: null, nodeId: { in: chainIds } },
-      select: { nodeId: true, principalType: true, principalId: true, role: true, isCreatorGrant: true },
-    });
-    const settings = chain.node.kind === "PROJECT"
-      ? await tx.fileLibProjectSettings.findUnique({
-          where: { nodeId: chain.node.id },
-          select: { independentPermissionsEnabled: true },
-        })
-      : null;
-
-    return chainNodes.map((current, depth) => {
-      const role = effectiveRole({
-        nodeId: current.id,
-        nodeKind: current.kind,
-        ancestorIds: chainNodes.slice(0, depth).map((n) => n.id),
-        independentPermissionsEnabled:
-          current.id === chain.node.id ? settings?.independentPermissionsEnabled ?? false : false,
-        userId: actor.userId,
-        groupIds,
-        grants: allGrants,
-      });
-      const visible = role !== null;
-      return {
-        depth,
-        id: visible ? current.id : null,
-        name: visible ? current.name : null,
-        kind: current.kind,
-      };
-    });
-  });
-}
-
-export interface ChildNodeDto {
-  readonly id: string;
-  readonly parentId: string | null;
-  readonly kind: "FOLDER" | "PROJECT";
-  readonly name: string;
-  readonly role: FileLibRole;
-  readonly createdAt: Date;
-  readonly updatedAt: Date;
-}
-
-/** 列子节点(parentId=null 列 root);只返回调用者有 View 的(D8/P7)。 */
-export async function listChildren(
-  deps: TreeServiceDeps,
-  actor: FileLibActor,
-  parentId: string | null,
-): Promise<readonly ChildNodeDto[]> {
-  return deps.prisma.$transaction(async (tx) => {
-    let parentAncestorIds: string[] = [];
-    if (parentId !== null) {
-      const parent = await requireAccess(tx, deps, actor, parentId, "VIEW");
-      parentAncestorIds = [...parent.ancestors.map((a) => a.id), parent.node.id];
-    }
-    const children = await tx.fileLibNode.findMany({
-      where: { organizationId: deps.organizationId, parentId, deletedAt: null },
-      orderBy: [{ kind: "asc" }, { nameLower: "asc" }],
-    });
-    if (children.length === 0) return [];
-
-    // D13:一次请求只 resolve 一次组、拉一次 grant 集,批量计算,不做 per-child 往返。
-    const idsToFetch = [...parentAncestorIds, ...children.map((c) => c.id)];
-    const allGrants = await tx.fileLibGrant.findMany({
-      where: { organizationId: deps.organizationId, revokedAt: null, nodeId: { in: idsToFetch } },
-      select: { nodeId: true, principalType: true, principalId: true, role: true, isCreatorGrant: true },
-    });
-    const projectIds = children.filter((c) => c.kind === "PROJECT").map((c) => c.id);
-    const settingsRows = projectIds.length === 0
-      ? []
-      : await tx.fileLibProjectSettings.findMany({
-          where: { nodeId: { in: projectIds } },
-          select: { nodeId: true, independentPermissionsEnabled: true },
-        });
-    const toggleByNode = new Map(settingsRows.map((s) => [s.nodeId, s.independentPermissionsEnabled]));
-    const groupIds = await deps.groupResolver.resolveMemberGroupIds(actor.userId);
-
-    const out: ChildNodeDto[] = [];
-    for (const child of children) {
-      const role = effectiveRole({
-        nodeId: child.id,
-        nodeKind: child.kind,
-        ancestorIds: parentAncestorIds,
-        independentPermissionsEnabled: toggleByNode.get(child.id) ?? false,
-        userId: actor.userId,
-        groupIds,
-        grants: allGrants,
-      });
-      if (role === null) continue;
-      out.push({
-        id: child.id,
-        parentId: child.parentId,
-        kind: child.kind,
-        name: child.name,
-        role,
-        createdAt: child.createdAt,
-        updatedAt: child.updatedAt,
-      });
-    }
-    return out;
-  });
-}
-
-/** 更新节点简介（需 EDIT+；不记审计，非权限敏感的内容字段）。 */
-export async function updateNodeDescription(
-  deps: TreeServiceDeps,
-  actor: FileLibActor,
-  nodeId: string,
-  description: string | null,
-): Promise<FileLibNode> {
-  return deps.prisma.$transaction(async (tx) => {
-    const { node } = await requireAccessInTx(tx, deps, actor, nodeId, "EDIT");
-    return tx.fileLibNode.update({
-      where: { id: node.id },
-      data: { description: description?.trim() || null },
-    });
-  });
-}

hub/src/database/filelib/versionStore.ts

@@ -1,280 +0,0 @@
-/**
- * VersionStore port(契约 C1)+ 开发用内存实现。
- *
- * 版本团队交付 npm 工具包后,用同一接口替换 createInMemoryVersionStore。
- * 语义红线(计划"Mock 保真红线"):冲突走返回值(S1)、baseVersion=null 表新建(S2)、
- * init 幂等(S7)、同 projectDir 写操作串行化(S4)、文件级版本(D16)。
- *
- * 持久化:传 persistPath 时把仓库快照落盘(JSON),重启后恢复 —— 纯粹为开发期
- * demo 稳定,不改变任何语义;生产由真包替换,此文件不参与。
- */
-
-import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import path from "node:path";
-import { FileLibError } from "./model.js";
-
-export type VersionId = string;
-
-export interface CommitRequest {
-  /** 编辑起始版本;null 表示新建文件(已存在则 conflict,S2)。 */
-  readonly baseVersion: VersionId | null;
-  readonly content: string | Buffer;
-  readonly message?: string | undefined;
-  readonly author?: string | undefined;
-}
-
-export type CommitResult =
-  | { readonly status: "ok"; readonly version: VersionId }
-  | { readonly status: "conflict"; readonly currentVersion: VersionId };
-
-export interface VersionInfo {
-  readonly version: VersionId;
-  readonly message: string;
-  readonly author: string | undefined;
-  readonly committedAt: string;
-}
-
-export interface FileEntry {
-  readonly path: string;
-  readonly size: number;
-}
-
-export interface VersionStore {
-  init(projectDir: string): Promise<void>;
-  list(projectDir: string, prefix?: string): Promise<FileEntry[]>;
-  head(projectDir: string, filePath: string): Promise<VersionId>;
-  read(projectDir: string, filePath: string, at?: VersionId): Promise<Buffer>;
-  commit(projectDir: string, filePath: string, req: CommitRequest): Promise<CommitResult>;
-  remove(projectDir: string, filePath: string, baseVersion: VersionId): Promise<CommitResult>;
-  diff(projectDir: string, filePath: string, from: VersionId, to: VersionId): Promise<string>;
-  history(projectDir: string, filePath: string, limit?: number): Promise<VersionInfo[]>;
-}
-
-interface StoredVersion {
-  readonly version: VersionId;
-  readonly content: Buffer;
-  readonly message: string;
-  readonly author: string | undefined;
-  readonly committedAt: string;
-  readonly deleted: boolean;
-}
-
-interface Repo {
-  /** 每文件一条版本链(D16:版本是文件级的,互不干扰)。 */
-  readonly files: Map<string, StoredVersion[]>;
-  counter: number;
-}
-
-/** S4:同 projectDir 的写操作经 per-repo promise 链串行化。 */
-function createKeySerializer(): <T>(key: string, fn: () => Promise<T>) => Promise<T> {
-  const tails = new Map<string, Promise<unknown>>();
-  return <T>(key: string, fn: () => Promise<T>): Promise<T> => {
-    const prev = tails.get(key) ?? Promise.resolve();
-    const next = prev.then(fn, fn);
-    tails.set(key, next.catch(() => undefined));
-    return next;
-  };
-}
-
-function toBuffer(content: string | Buffer): Buffer {
-  return typeof content === "string" ? Buffer.from(content, "utf8") : content;
-}
-
-/** 极简 unified-diff(mock 保真够用;真包的 diff 以版本团队为准)。 */
-function naiveDiff(fromText: string, toText: string): string {
-  const a = fromText.split("\n");
-  const b = toText.split("\n");
-  const out: string[] = ["--- a", "+++ b"];
-  const max = Math.max(a.length, b.length);
-  for (let i = 0; i < max; i += 1) {
-    const al = a[i];
-    const bl = b[i];
-    if (al === bl) {
-      if (al !== undefined) out.push(` ${al}`);
-    } else {
-      if (al !== undefined) out.push(`-${al}`);
-      if (bl !== undefined) out.push(`+${bl}`);
-    }
-  }
-  return out.join("\n");
-}
-
-export function createInMemoryVersionStore(persistPath?: string): VersionStore {
-  const repos = new Map<string, Repo>();
-  const serialize = createKeySerializer();
-
-  /* ---------------- 开发期快照持久化(语义不变,仅防重启丢失) ---------------- */
-  interface PersistedVersion extends Omit<StoredVersion, "content"> {
-    content: string; // base64
-  }
-  function loadPersisted(): void {
-    if (persistPath === undefined) return;
-    try {
-      const raw = JSON.parse(readFileSync(persistPath, "utf8")) as {
-        repos: Record<string, { counter: number; files: Record<string, PersistedVersion[]> }>;
-      };
-      for (const [dir, repo] of Object.entries(raw.repos)) {
-        const files = new Map<string, StoredVersion[]>();
-        for (const [filePath, versions] of Object.entries(repo.files)) {
-          files.set(filePath, versions.map((v) => ({ ...v, content: Buffer.from(v.content, "base64") })));
-        }
-        repos.set(dir, { files, counter: repo.counter });
-      }
-    } catch { /* 无快照或损坏 → 空库起步(开发语义) */ }
-  }
-  function savePersisted(): void {
-    if (persistPath === undefined) return;
-    const out: Record<string, { counter: number; files: Record<string, PersistedVersion[]> }> = {};
-    for (const [dir, repo] of repos) {
-      const files: Record<string, PersistedVersion[]> = {};
-      for (const [filePath, versions] of repo.files) {
-        files[filePath] = versions.map((v) => ({ ...v, content: v.content.toString("base64") }));
-      }
-      out[dir] = { counter: repo.counter, files };
-    }
-    try {
-      mkdirSync(path.dirname(persistPath), { recursive: true });
-      const tmp = `${persistPath}.tmp`;
-      writeFileSync(tmp, JSON.stringify({ repos: out }), "utf8");
-      renameSync(tmp, persistPath);
-    } catch { /* 快照失败不影响开发使用 */ }
-  }
-  loadPersisted();
-
-  function requireRepo(projectDir: string): Repo {
-    const repo = repos.get(projectDir);
-    if (repo === undefined) {
-      throw new FileLibError(404, "repo_not_found", `repository not initialized: ${projectDir}`);
-    }
-    return repo;
-  }
-
-  function liveVersion(repo: Repo, filePath: string): StoredVersion {
-    const chain = repo.files.get(filePath);
-    const latest = chain?.[chain.length - 1];
-    if (chain === undefined || latest === undefined || latest.deleted) {
-      throw new FileLibError(404, "file_not_found", `file not found: ${filePath}`);
-    }
-    return latest;
-  }
-
-  function findVersion(repo: Repo, filePath: string, version: VersionId): StoredVersion {
-    const found = repo.files.get(filePath)?.find((v) => v.version === version);
-    if (found === undefined) {
-      throw new FileLibError(404, "version_not_found", `version not found: ${filePath}@${version}`);
-    }
-    return found;
-  }
-
-  return {
-    async init(projectDir) {
-      await serialize(projectDir, async () => {
-        // S7:幂等,重复调用不报错、不重建。
-        const created = repos.get(projectDir) === undefined;
-        repos.set(projectDir, repos.get(projectDir) ?? { files: new Map(), counter: 0 });
-        if (created) savePersisted();
-      });
-    },
-
-    async list(projectDir, prefix) {
-      const repo = requireRepo(projectDir);
-      const out: FileEntry[] = [];
-      for (const [path, chain] of repo.files) {
-        const latest = chain[chain.length - 1];
-        if (latest === undefined || latest.deleted) continue;
-        if (prefix !== undefined && !path.startsWith(prefix)) continue;
-        out.push({ path, size: latest.content.byteLength });
-      }
-      return out.sort((a, b) => a.path.localeCompare(b.path));
-    },
-
-    async head(projectDir, filePath) {
-      return liveVersion(requireRepo(projectDir), filePath).version;
-    },
-
-    async read(projectDir, filePath, at) {
-      const repo = requireRepo(projectDir);
-      if (at !== undefined) return findVersion(repo, filePath, at).content;
-      return liveVersion(repo, filePath).content;
-    },
-
-    async commit(projectDir, filePath, req) {
-      return serialize(projectDir, async (): Promise<CommitResult> => {
-        const repo = requireRepo(projectDir);
-        const chain = repo.files.get(filePath) ?? [];
-        const latest = chain[chain.length - 1];
-        const currentVersion = latest !== undefined && !latest.deleted ? latest.version : null;
-
-        // S2:新建(baseVersion null)要求文件当前不存在;否则要求 baseVersion 精确等于当前版本(S1)。
-        if (req.baseVersion === null) {
-          if (currentVersion !== null) return { status: "conflict", currentVersion };
-        } else if (req.baseVersion !== currentVersion) {
-          return {
-            status: "conflict",
-            currentVersion: currentVersion ?? req.baseVersion,
-          };
-        }
-
-        repo.counter += 1;
-        const version = `v${repo.counter}`;
-        chain.push({
-          version,
-          content: toBuffer(req.content),
-          message: req.message ?? `commit ${version}`,
-          author: req.author,
-          committedAt: new Date().toISOString(),
-          deleted: false,
-        });
-        repo.files.set(filePath, chain);
-        savePersisted();
-        return { status: "ok", version };
-      });
-    },
-
-    async remove(projectDir, filePath, baseVersion) {
-      return serialize(projectDir, async (): Promise<CommitResult> => {
-        const repo = requireRepo(projectDir);
-        const chain = repo.files.get(filePath) ?? [];
-        const latest = chain[chain.length - 1];
-        const currentVersion = latest !== undefined && !latest.deleted ? latest.version : null;
-        if (currentVersion === null) {
-          throw new FileLibError(404, "file_not_found", `file not found: ${filePath}`);
-        }
-        if (baseVersion !== currentVersion) return { status: "conflict", currentVersion };
-        repo.counter += 1;
-        const version = `v${repo.counter}`;
-        chain.push({
-          version,
-          content: Buffer.alloc(0),
-          message: `remove ${filePath}`,
-          author: undefined,
-          committedAt: new Date().toISOString(),
-          deleted: true,
-        });
-        repo.files.set(filePath, chain);
-        savePersisted();
-        return { status: "ok", version };
-      });
-    },
-
-    async diff(projectDir, filePath, from, to) {
-      const repo = requireRepo(projectDir);
-      const a = findVersion(repo, filePath, from);
-      const b = findVersion(repo, filePath, to);
-      return naiveDiff(a.content.toString("utf8"), b.content.toString("utf8"));
-    },
-
-    async history(projectDir, filePath, limit) {
-      const repo = requireRepo(projectDir);
-      const chain = repo.files.get(filePath) ?? [];
-      const infos: VersionInfo[] = chain.map((v) => ({
-        version: v.version,
-        message: v.message,
-        author: v.author,
-        committedAt: v.committedAt,
-      }));
-      const ordered = infos.reverse();
-      return limit !== undefined ? ordered.slice(0, limit) : ordered;
-    },
-  };
-}

hub/src/database/plugin.ts

@@ -1,45 +0,0 @@
-/**
- * Registers the `/database/*` HTTP surface onto the Fastify app.
- *
- * Single public entry point (mirrors src/admin/plugin.ts). hub.ts calls
- * registerDatabasePlugin() so the routes are recognized at startup.
- *
- * Register AFTER registerAdminPlugin: it relies on the @fastify/cookie parser
- * and the /auth/feishu/* login routes that the admin plugin adds.
- *
- * The dev login bypass is self-contained in THIS module: the flag is read here
- * (not threaded from hub.ts) and only ever enables the `/database/dev-login`
- * route below. Double-gated: NODE_ENV must not be production AND
- * HUB_DEV_LOGIN_BYPASS must be truthy. Production always requires real Feishu
- * OAuth.
- */
-import type { FastifyInstance } from "fastify";
-import type { PrismaClient } from "@prisma/client";
-import { registerDatabaseRoutes } from "./routes/databaseRoutes.js";
-
-export interface DatabasePluginConfig {
-  readonly prisma: PrismaClient;
-  readonly sessionSecret: string;
-  readonly siloOrganizationSlug: string;
-}
-
-const FALSY = new Set(["", "0", "false", "no", "off"]);
-
-export async function registerDatabasePlugin(
-  app: FastifyInstance,
-  config: DatabasePluginConfig,
-): Promise<void> {
-  const allowDevLoginBypass =
-    process.env["NODE_ENV"] !== "production" &&
-    !FALSY.has((process.env["HUB_DEV_LOGIN_BYPASS"] ?? "").trim().toLowerCase());
-  if (allowDevLoginBypass) {
-    app.log.warn("DEV login bypass enabled: /database/dev-login mints a session without Feishu OAuth");
-  }
-
-  await registerDatabaseRoutes(app, {
-    prisma: config.prisma,
-    sessionSecret: config.sessionSecret,
-    siloOrganizationSlug: config.siloOrganizationSlug,
-    allowDevLoginBypass,
-  });
-}

hub/src/database/routes/adminPanels.ts

@@ -1,227 +0,0 @@
-/**
- * 管理员后台「用户管理」「Group 管理」面板(复用 hub 已有 org 管理 API)。
- *
- * 用户管理 = org 成员(/api/org/:orgSlug/members);
- * Group 管理 = Team(当前 Group 的过渡实现,/api/org/:orgSlug/teams),
- * 真 Group 系统落地后此面板改接新 API 即可,文件库授权侧不动。
- */
-
-function apiBase(orgSlug: string): string {
-  return `/api/org/${encodeURIComponent(orgSlug)}`;
-}
-
-/* ---------------------------------------------------------------- 用户管理 */
-
-export function renderUsersPanel(orgSlug: string): string {
-  return `
-<div id="users-root" style="max-width:880px">
-  <div class="panel" style="margin-bottom:14px">
-    <div class="section-title">添加成员</div>
-    <div class="inline-form">
-      <input id="u-openid" class="input" placeholder="用户 openId(飞书 ou_ 开头)" style="flex:2"/>
-      <input id="u-name" class="input" placeholder="显示名(可选)" style="flex:1"/>
-      <select id="u-role" class="select" style="width:130px">
-        <option value="MEMBER">普通老师</option>
-        <option value="ADMIN">管理员</option>
-        <option value="OWNER">所有者</option>
-      </select>
-      <button id="u-add" class="btn btn-primary">添加</button>
-    </div>
-  </div>
-  <div class="panel">
-    <div class="section-title">成员列表</div>
-    <table class="list">
-      <thead><tr><th>成员</th><th>userId</th><th>角色</th><th></th></tr></thead>
-      <tbody id="u-tbody"></tbody>
-    </table>
-  </div>
-</div>
-<script>
-(function () {
-  const BASE = "${apiBase(orgSlug)}";
-  const tbody = document.getElementById("u-tbody");
-  const esc = (s) => String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;");
-  const ROLE_LABEL = { OWNER: "所有者", ADMIN: "管理员", MEMBER: "普通老师" };
-  async function req(path, opts = {}) {
-    const res = await fetch(BASE + path, {
-      credentials: "same-origin",
-      headers: opts.body ? { "Content-Type": "application/json" } : undefined,
-      method: opts.method ?? "GET",
-      body: opts.body ? JSON.stringify(opts.body) : undefined,
-    });
-    if (res.status === 401) { location.href = "/database/admin"; throw new Error("unauthenticated"); }
-    const text = await res.text();
-    const data = text ? JSON.parse(text) : null;
-    if (!res.ok) throw new Error((data && data.error && data.error.message) || res.statusText);
-    return data;
-  }
-  async function load() {
-    const { members } = await req("/members");
-    tbody.innerHTML = members.length === 0
-      ? '<tr><td colspan="4" class="quiet" style="text-align:center;padding:18px">暂无成员</td></tr>'
-      : members.map((m) =>
-        "<tr>" +
-          "<td>" + esc(m.displayName || m.userId) + "</td>" +
-          '<td class="file-meta">' + esc(m.userId) + "</td>" +
-          '<td><select class="select" style="width:110px;padding:3px 8px;font-size:12px" data-user="' + esc(m.userId) + '">' +
-            ["OWNER","ADMIN","MEMBER"].map((r) =>
-              '<option value="' + r + '"' + (m.role === r ? " selected" : "") + ">" + ROLE_LABEL[r] + "</option>").join("") +
-          "</select></td>" +
-          '<td style="text-align:right"><button class="link-danger" data-revoke="' + esc(m.userId) + '">移除</button></td>' +
-        "</tr>").join("");
-    tbody.querySelectorAll("select[data-user]").forEach((sel) => {
-      sel.onchange = async () => {
-        try { await req("/members/" + encodeURIComponent(sel.dataset.user), { method: "PATCH", body: { role: sel.value } }); }
-        catch (e) { alert(e.message); load(); }
-      };
-    });
-    tbody.querySelectorAll("button[data-revoke]").forEach((btn) => {
-      btn.onclick = async () => {
-        if (!confirm("移除该成员?")) return;
-        try { await req("/members/" + encodeURIComponent(btn.dataset.revoke) + "/revoke", { method: "POST" }); load(); }
-        catch (e) { alert(e.message); }
-      };
-    });
-  }
-  document.getElementById("u-add").onclick = async () => {
-    const openId = document.getElementById("u-openid").value.trim();
-    if (!openId) return alert("请填写用户 openId");
-    const displayName = document.getElementById("u-name").value.trim();
-    try {
-      await req("/members", { method: "POST", body: {
-        feishuOpenId: openId,
-        role: document.getElementById("u-role").value,
-        ...(displayName ? { displayName } : {}),
-      }});
-      document.getElementById("u-openid").value = "";
-      document.getElementById("u-name").value = "";
-      load();
-    } catch (e) { alert(e.message); }
-  };
-  load().catch((e) => { tbody.innerHTML = '<tr><td colspan="4" style="color:var(--danger);padding:12px">' + esc(e.message) + "</td></tr>"; });
-})();
-</script>`;
-}
-
-/* ---------------------------------------------------------------- Group 管理 */
-
-export function renderGroupsPanel(orgSlug: string): string {
-  return `
-<div id="groups-root" style="display:flex;gap:14px;align-items:flex-start">
-  <div style="width:340px;flex-shrink:0">
-    <div class="panel" style="margin-bottom:14px">
-      <div class="section-title">新建 Group</div>
-      <div class="form-row"><label class="form-label">标识(slug)</label><input id="g-slug" class="input" placeholder="physics-dept"/></div>
-      <div class="form-row"><label class="form-label">名称</label><input id="g-name" class="input" placeholder="物理教研组"/></div>
-      <div class="form-row"><label class="form-label">描述(可选)</label><input id="g-desc" class="input" placeholder="一句话说明"/></div>
-      <div style="text-align:right"><button id="g-create" class="btn btn-primary">创建</button></div>
-    </div>
-    <div class="panel">
-      <div class="section-title">Group 列表</div>
-      <div id="g-list"></div>
-    </div>
-  </div>
-  <div class="panel" style="flex:1;min-height:200px">
-    <div id="g-detail" class="quiet" style="padding:18px;text-align:center">从左侧选择一个 Group 查看成员</div>
-  </div>
-</div>
-<script>
-(function () {
-  const BASE = "${apiBase(orgSlug)}";
-  const listEl = document.getElementById("g-list");
-  const detailEl = document.getElementById("g-detail");
-  const esc = (s) => String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;");
-  let selected = null;
-  async function req(path, opts = {}) {
-    const res = await fetch(BASE + path, {
-      credentials: "same-origin",
-      headers: opts.body ? { "Content-Type": "application/json" } : undefined,
-      method: opts.method ?? "GET",
-      body: opts.body ? JSON.stringify(opts.body) : undefined,
-    });
-    if (res.status === 401) { location.href = "/database/admin"; throw new Error("unauthenticated"); }
-    const text = await res.text();
-    const data = text ? JSON.parse(text) : null;
-    if (!res.ok) throw new Error((data && data.error && data.error.message) || res.statusText);
-    return data;
-  }
-  async function loadList() {
-    const { teams } = await req("/teams");
-    listEl.innerHTML = teams.length === 0
-      ? '<div class="quiet" style="text-align:center;padding:12px">暂无 Group</div>'
-      : teams.map((t) =>
-        '<div class="g-team" data-id="' + esc(t.id) + '" data-name="' + esc(t.name) + '" style="display:flex;align-items:center;gap:8px;padding:8px 6px;border-radius:8px;cursor:pointer">' +
-          '<span style="flex:1"><b>' + esc(t.name) + '</b> <span class="file-meta">' + esc(t.slug) + "</span></span>" +
-          '<button class="link-danger" data-archive="' + esc(t.id) + '" style="font-size:11px">归档</button>' +
-        "</div>").join("");
-    listEl.querySelectorAll(".g-team").forEach((el) => {
-      el.onclick = (e) => {
-        if (e.target.closest("button")) return;
-        selected = { id: el.dataset.id, name: el.dataset.name };
-        listEl.querySelectorAll(".g-team").forEach((x) => x.style.background = "");
-        el.style.background = "var(--selected)";
-        loadMembers();
-      };
-    });
-    listEl.querySelectorAll("button[data-archive]").forEach((btn) => {
-      btn.onclick = async () => {
-        if (!confirm("归档该 Group?其成员授权将失效。")) return;
-        try { await req("/teams/" + encodeURIComponent(btn.dataset.archive) + "/archive", { method: "POST" }); selected = null; detailEl.innerHTML = '<div class="quiet" style="padding:18px;text-align:center">从左侧选择一个 Group 查看成员</div>'; loadList(); }
-        catch (e) { alert(e.message); }
-      };
-    });
-  }
-  async function loadMembers() {
-    if (!selected) return;
-    detailEl.innerHTML = '<div class="quiet" style="padding:12px;text-align:center">加载中…</div>';
-    const { members } = await req("/teams/" + encodeURIComponent(selected.id) + "/members");
-    detailEl.innerHTML =
-      '<div class="section-title">' + esc(selected.name) + " · 成员(" + members.length + ")</div>" +
-      '<table class="list"><tbody>' +
-        (members.length === 0
-          ? '<tr><td class="quiet" style="text-align:center;padding:14px">暂无成员</td></tr>'
-          : members.map((m) =>
-            "<tr><td>" + esc(m.displayName || m.userId) + '</td><td class="file-meta">' + esc(m.userId) + "</td>" +
-            '<td style="text-align:right"><button class="link-danger" data-revoke="' + esc(m.userId) + '">移除</button></td></tr>').join("")) +
-      "</tbody></table>" +
-      '<div class="divider"></div>' +
-      '<div class="section-title">添加成员</div>' +
-      '<div class="inline-form">' +
-        '<input id="g-add-openid" class="input" placeholder="用户 openId 或 userId"/>' +
-        '<button id="g-add" class="btn btn-primary">添加</button>' +
-      "</div>";
-    detailEl.querySelectorAll("button[data-revoke]").forEach((btn) => {
-      btn.onclick = async () => {
-        try { await req("/teams/" + encodeURIComponent(selected.id) + "/members/" + encodeURIComponent(btn.dataset.revoke) + "/revoke", { method: "POST" }); loadMembers(); }
-        catch (e) { alert(e.message); }
-      };
-    });
-    detailEl.querySelector("#g-add").onclick = async () => {
-      const v = detailEl.querySelector("#g-add-openid").value.trim();
-      if (!v) return alert("请填写用户 id");
-      try {
-        await req("/teams/" + encodeURIComponent(selected.id) + "/members", {
-          method: "POST",
-          body: v.startsWith("ou_") ? { feishuOpenId: v } : { userId: v },
-        });
-        loadMembers();
-      } catch (e) { alert(e.message); }
-    };
-  }
-  document.getElementById("g-create").onclick = async () => {
-    const slug = document.getElementById("g-slug").value.trim();
-    const name = document.getElementById("g-name").value.trim();
-    const description = document.getElementById("g-desc").value.trim();
-    if (!slug || !name) return alert("slug 和名称必填");
-    try {
-      await req("/teams", { method: "POST", body: { slug, name, ...(description ? { description } : {}) } });
-      document.getElementById("g-slug").value = "";
-      document.getElementById("g-name").value = "";
-      document.getElementById("g-desc").value = "";
-      loadList();
-    } catch (e) { alert(e.message); }
-  };
-  loadList().catch((e) => { listEl.innerHTML = '<div style="color:var(--danger);padding:12px">' + esc(e.message) + "</div>"; });
-})();
-</script>`;
-}

hub/src/database/routes/databaseRoutes.ts

@@ -1,418 +0,0 @@
-/**
- * `/database/*` route aggregator.
- *
- * Owns the `/database` HTTP surface (single place new sub-routes get wired in).
- * Handlers use ABSOLUTE paths (no Fastify prefix) so every route greps as the
- * literal string it serves.
- *
- *   /database/admin      — Feishu-only login page (+ dev one-click button)
- *   /database/dashboard  — sidebar + content admin shell, session-gated
- *   /database/dev-login  — DEV ONLY bypass, registered only when the flag is on
- *
- * The dev bypass (button + /database/dev-login) is self-contained here and
- * gated by allowDevLoginBypass (computed in ./plugin.ts from HUB_DEV_LOGIN_BYPASS
- * + NODE_ENV). Production requires real Feishu OAuth.
- */
-import type { FastifyInstance } from "fastify";
-import type { PrismaClient } from "@prisma/client";
-import path from "node:path";
-import { SESSION_COOKIE_NAME, signSession, verifySession } from "../../admin/auth/session.js";
-import { registerFileLibRoutes } from "./filelibRoutes.js";
-import { registerFileRoutes } from "./fileRoutes.js";
-import { registerTeacherApp } from "./teacherApp.js";
-import { renderLibraryBrowser } from "./libraryBrowser.js";
-import { renderGroupsPanel, renderUsersPanel } from "./adminPanels.js";
-import { createInMemoryVersionStore } from "../filelib/versionStore.js";
-import { createTeamGroupResolver } from "../filelib/groupResolver.js";
-import { createHttpGroupResolver } from "../filelib/groupResolverHttp.js";
-import { createManifestStubAdapter } from "../filelib/exportService.js";
-import { FILE_LIB_AUDIT_ACTIONS } from "../filelib/audit.js";
-import { UI_HEAD_FONTS, UI_THEME_CSS } from "./uiTheme.js";
-import type { FileLibRouteDeps } from "../filelib/routeShared.js";
-
-export interface DatabaseRouteConfig {
-  readonly prisma: PrismaClient;
-  /** HMAC secret for the signed session cookie — reused from the admin plane. */
-  readonly sessionSecret: string;
-  /** Silo Organization slug — builds the org-scoped Feishu login link. */
-  readonly siloOrganizationSlug: string;
-  /** DEV ONLY. Enables the one-click button and the /database/dev-login route. */
-  readonly allowDevLoginBypass: boolean;
-}
-
-export async function registerDatabaseRoutes(
-  app: FastifyInstance,
-  config: DatabaseRouteConfig,
-): Promise<void> {
-  // 文件库依赖在下方装配;概览页统计在请求时经此引用读取(请求一定晚于装配完成)。
-  let filelibDepsForStats: FileLibRouteDeps | null = null;
-
-  app.get("/database/admin", async (request, reply) => {
-    // Already signed in → straight to the dashboard.
-    if ((await resolveUser(request.cookies[SESSION_COOKIE_NAME], config)) !== null) {
-      return reply.redirect("/database/dashboard");
-    }
-    return reply.type("text/html").send(renderLoginPage(config));
-  });
-
-  app.get("/database/dashboard", async (request, reply) => {
-    const user = await resolveUser(request.cookies[SESSION_COOKIE_NAME], config);
-    if (user === null) return reply.redirect("/database/admin");
-    const stats = await loadDashboardStats(config.prisma, filelibDepsForStats);
-    return reply.type("text/html").send(renderDashboard(user.displayName, stats, config.siloOrganizationSlug));
-  });
-
-  // DEV ONLY bypass — self-contained here, registered only when the flag is on
-  // (see ./plugin.ts). Mints a session for an existing OWNER/ADMIN, reusing the
-  // scoped SessionIdentity shape the Feishu OAuth callback produces so the
-  // session guard behaves identically. Never registered in production.
-  if (config.allowDevLoginBypass) {
-    app.get("/database/dev-login", async (_request, reply) => {
-      const membership = await config.prisma.organizationMembership.findFirst({
-        where: {
-          revokedAt: null,
-          role: { in: ["OWNER", "ADMIN"] },
-          organization: { status: "ACTIVE" },
-        },
-        select: { userId: true, organizationId: true },
-        orderBy: { createdAt: "asc" },
-      });
-      if (membership === null) {
-        return reply.status(404).send({ error: { code: "no_admin", message: "no active OWNER/ADMIN to impersonate" } });
-      }
-      const identity = await config.prisma.feishuUserIdentity.findFirst({
-        where: {
-          userId: membership.userId,
-          connection: { organizationId: membership.organizationId, status: "ACTIVE" },
-        },
-        select: { id: true, connectionId: true, connection: { select: { organizationId: true } } },
-      });
-      if (identity === null) {
-        return reply.status(404).send({ error: { code: "no_identity", message: "admin has no active scoped Feishu identity" } });
-      }
-      const token = signSession(
-        {
-          userId: membership.userId,
-          feishuIdentityId: identity.id,
-          feishuConnectionId: identity.connectionId,
-          feishuOrganizationId: identity.connection.organizationId,
-        },
-        config.sessionSecret,
-      );
-      // Local dev is http://127.0.0.1, so secure:false. This route only ever
-      // runs outside production (double-gated in ./plugin.ts).
-      reply.setCookie(SESSION_COOKIE_NAME, token, {
-        path: "/",
-        httpOnly: true,
-        sameSite: "lax",
-        secure: false,
-        maxAge: 7 * 24 * 60 * 60,
-      });
-      reply.log.warn({ userId: membership.userId, orgId: membership.organizationId }, "DEV database login bypass used");
-      return reply.redirect("/database/dashboard");
-    });
-  }
-
-  // 文件库(独立模块,《文件库-接口契约.md》):API + 浏览页 + 老师端 /app。
-  // 依赖装配:VersionStore 当前为内存+快照实现(版本团队 npm 包到位后替换);
-  // GroupResolver 默认读 hub Team,HUB_GROUP_SERVICE_URL 配置后切 HTTP(C2);
-  // 导出适配器当前为 manifest stub(OPEN-6,真导出工具到位后替换)。
-  const siloOrg = await config.prisma.organization.findUnique({
-    where: { slug: config.siloOrganizationSlug },
-    select: { id: true },
-  });
-  if (siloOrg === null) {
-    app.log.warn({ slug: config.siloOrganizationSlug }, "filelib: silo organization not found, routes not registered");
-    return;
-  }
-  const storageRoot = process.env["HUB_FILELIB_STORAGE_ROOT"] ?? path.resolve(".filelib-repos");
-  const versionStore = createInMemoryVersionStore(path.join(storageRoot, ".version-store.json"));
-  const groupServiceUrl = process.env["HUB_GROUP_SERVICE_URL"];
-  const filelibDeps: FileLibRouteDeps = {
-    prisma: config.prisma,
-    sessionSecret: config.sessionSecret,
-    organizationId: siloOrg.id,
-    storageRoot,
-    groupResolver: groupServiceUrl === undefined || groupServiceUrl.trim() === ""
-      ? createTeamGroupResolver(config.prisma, siloOrg.id)
-      : createHttpGroupResolver({ baseUrl: groupServiceUrl }),
-    versionStore,
-    exportAdapters: [createManifestStubAdapter(versionStore)],
-  };
-  await registerFileLibRoutes(app, filelibDeps);
-  await registerFileRoutes(app, filelibDeps);
-  await registerTeacherApp(app, {
-    prisma: config.prisma,
-    sessionSecret: config.sessionSecret,
-    siloOrganizationSlug: config.siloOrganizationSlug,
-    allowDevLoginBypass: config.allowDevLoginBypass,
-  });
-
-  // 独立文件库页已并入后台「文件库」tab(/database/dashboard#library),旧地址跳转保留兼容。
-  app.get("/database/library", async (_request, reply) =>
-    reply.redirect("/database/dashboard#library"),
-  );
-
-  filelibDepsForStats = filelibDeps;
-}
-
-/* ------------------------------------------------------------ 概览页统计 */
-
-interface DashboardStats {
-  readonly folders: number;
-  readonly projects: number;
-  readonly files: number;
-  readonly grants: number;
-  readonly recent: ReadonlyArray<{
-    readonly action: string;
-    readonly actor: string;
-    readonly label: string;
-    readonly when: Date;
-  }>;
-}
-
-/** 概览页统计:org 范围内的文件夹/项目/授权(DB)+ 文件(版本库)+ 最近活动(AuditEntry)。 */
-async function loadDashboardStats(
-  prisma: PrismaClient,
-  deps: FileLibRouteDeps | null,
-): Promise<DashboardStats | null> {
-  if (deps === null) return null;
-  const organizationId = deps.organizationId;
-  const [folders, projects, grants] = await Promise.all([
-    prisma.fileLibNode.count({ where: { organizationId, kind: "FOLDER", deletedAt: null } }),
-    prisma.fileLibNode.count({ where: { organizationId, kind: "PROJECT", deletedAt: null } }),
-    prisma.fileLibGrant.count({ where: { organizationId, revokedAt: null } }),
-  ]);
-  // 文件计数:遍历 READY 项目问版本库(demo 规模;真版本包到位后应换成存储侧统计)
-  const readyProjects = await prisma.fileLibNode.findMany({
-    where: {
-      organizationId, kind: "PROJECT", deletedAt: null,
-      provisionStatus: "READY", storageDir: { not: null },
-    },
-    select: { storageDir: true },
-  });
-  let files = 0;
-  for (const project of readyProjects) {
-    if (project.storageDir === null) continue;
-    try {
-      files += (await deps.versionStore.list(project.storageDir)).length;
-    } catch { /* repo 缺失(如重启未恢复)不计 */ }
-  }
-  const entries = await prisma.auditEntry.findMany({
-    where: { organizationId, action: { in: Object.values(FILE_LIB_AUDIT_ACTIONS) } },
-    orderBy: { createdAt: "desc" },
-    take: 8,
-  });
-  const actorIds = [...new Set(entries.map((e) => e.actorUserId).filter((x): x is string => x !== null))];
-  const users = actorIds.length === 0
-    ? []
-    : await prisma.user.findMany({ where: { id: { in: actorIds } }, select: { id: true, displayName: true } });
-  const nameById = new Map(users.map((u) => [u.id, u.displayName]));
-  const recent = entries.map((entry) => {
-    const meta = (entry.metadata ?? {}) as Record<string, unknown>;
-    const label =
-      (typeof meta["name"] === "string" ? meta["name"] : undefined) ??
-      (typeof meta["to"] === "string" ? meta["to"] : undefined) ??
-      (typeof meta["path"] === "string" ? meta["path"] : undefined) ??
-      (typeof meta["objectId"] === "string" ? meta["objectId"].slice(0, 8) : "");
-    return {
-      action: entry.action,
-      actor: nameById.get(entry.actorUserId ?? "") ?? entry.actorUserId ?? "unknown",
-      label,
-      when: entry.createdAt,
-    };
-  });
-  return { folders, projects, files, grants, recent };
-}
-
-/** Verify the session cookie and load the user, or null if not signed in. */
-async function resolveUser(
-  rawCookie: string | undefined,
-  config: DatabaseRouteConfig,
-): Promise<{ displayName: string } | null> {
-  if (rawCookie === undefined || rawCookie === "") return null;
-  const session = verifySession(rawCookie, config.sessionSecret);
-  if (session === null) return null;
-  const user = await config.prisma.user.findUnique({
-    where: { id: session.userId },
-    select: { displayName: true },
-  });
-  return user;
-}
-
-/** 管理后台共享 head(全局 UI 主题,与老师端 /app 同源)。 */
-function pageHead(title: string): string {
-  return `<head>
-  <meta charset="utf-8"/>
-  <meta name="viewport" content="width=device-width, initial-scale=1"/>
-  <title>${title}</title>
-  ${UI_HEAD_FONTS}
-  <style>${UI_THEME_CSS}</style>
-</head>`;
-}
-
-function renderLoginPage(config: DatabaseRouteConfig): string {
-  const feishuHref = `/auth/feishu/${encodeURIComponent(config.siloOrganizationSlug)}`;
-  const devButton = config.allowDevLoginBypass
-    ? `<div style="display:flex;align-items:center;gap:10px;margin:22px 0;color:var(--text-3);font-size:11px">
-         <span style="flex:1;border-top:1px solid var(--border-soft)"></span>开发模式
-         <span style="flex:1;border-top:1px solid var(--border-soft)"></span>
-       </div>
-       <a href="/database/dev-login" class="btn" style="width:100%;justify-content:center">⚡ 一键登录管理员</a>
-       <p style="margin:10px 0 0;text-align:center;font-size:11px;color:var(--text-3)">仅开发环境可见 · 跳过飞书 OAuth</p>`
-    : "";
-
-  return `<!doctype html>
-<html lang="zh-CN">
-${pageHead("Database Admin · 登录")}
-<body>
-  <div style="min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px">
-    <div style="width:100%;max-width:380px;background:var(--panel);border:1px solid var(--border-soft);border-radius:16px;padding:40px 36px;box-shadow:var(--shadow-pop)">
-      <div style="font-size:26px;font-weight:600;text-align:center">Database Admin</div>
-      <p style="margin:10px 0 30px;text-align:center;font-size:13px;color:var(--text-3)">使用飞书登录以管理数据库</p>
-      <a href="${feishuHref}" class="btn btn-primary" style="width:100%;justify-content:center;padding:11px 16px;font-size:14px">使用飞书登录</a>
-      ${devButton}
-    </div>
-  </div>
-</body>
-</html>`;
-}
-
-/** Sidebar nav items. `active` marks the current page. `href` "#" = placeholder. */
-const NAV_TABS: ReadonlyArray<{ id: string; label: string; icon: string }> = [
-  { id: "overview", label: "概览", icon: "M4 13h6V4H4v9Zm0 7h6v-5H4v5Zm10 0h6V11h-6v9Zm0-16v5h6V4h-6Z" },
-  { id: "library", label: "文件库", icon: "M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V7Z" },
-  { id: "users", label: "用户管理", icon: "M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2M9 11a4 4 0 1 0 0-8 4 4 0 0 0 0 8Zm13 10v-2a4 4 0 0 0-3-3.87M16 3.13a4 4 0 0 1 0 7.75" },
-  { id: "groups", label: "Group 管理", icon: "M17 21v-2a4 4 0 0 0-4-4H5a4 4 0 0 0-4 4v2M9 11a4 4 0 1 0 0-8 4 4 0 0 0 0 8Zm14 10v-2a4 4 0 0 0-3-3.87M16 3.13a4 4 0 0 1 0 7.75M23 21v-2a4 4 0 0 0-3-3.87" },
-  { id: "search", label: "查询", icon: "m21 21-4.3-4.3M11 18a7 7 0 1 0 0-14 7 7 0 0 0 0 14Z" },
-  { id: "settings", label: "设置", icon: "M12 15a3 3 0 1 0 0-6 3 3 0 0 0 0 6Zm7-3 2 1-2 3-2-1a7 7 0 0 1-2 1l-1 2h-4l-1-2a7 7 0 0 1-2-1l-2 1-2-3 2-1a7 7 0 0 1 0-2l-2-1 2-3 2 1a7 7 0 0 1 2 1l1-2h4l1 2a7 7 0 0 1 0 2l2-1 2 3-2 1a7 7 0 0 1 0 2Z" },
-];
-
-function renderDashboard(displayName: string, stats: DashboardStats | null, orgSlug: string): string {
-  const nav = NAV_TABS.map((t) => `
-    <button class="admin-tab" data-tab="${t.id}" style="display:flex;align-items:center;gap:10px;border-radius:10px;padding:9px 14px;font-size:13px;color:var(--text-3);background:none;border:none;cursor:pointer;text-align:left;width:100%">
-      <svg style="width:16px;height:16px;flex-shrink:0" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="${t.icon}"/></svg>
-      ${t.label}
-    </button>`).join("\n");
-
-  const cards = [
-    { label: "文件夹", value: stats?.folders ?? "—" },
-    { label: "项目", value: stats?.projects ?? "—" },
-    { label: "文件", value: stats?.files ?? "—" },
-    { label: "活跃授权", value: stats?.grants ?? "—" },
-  ].map((s) => `
-        <div class="panel" style="padding:18px 20px">
-          <p style="font-size:12.5px;color:var(--text-3)">${s.label}</p>
-          <p style="margin-top:6px;font-size:28px;font-weight:600;color:var(--text)">${s.value}</p>
-        </div>`).join("");
-
-  const recentRows = stats === null || stats.recent.length === 0
-    ? `<div style="padding:26px 0;text-align:center;font-size:12.5px;color:var(--text-3)">暂无文件库活动 · 到「文件库」里创建第一个文件夹吧</div>`
-    : stats.recent.map((r) => `
-          <div style="display:flex;align-items:center;gap:12px;border-top:1px solid var(--border-soft);padding:9px 0;font-size:13px">
-            <span class="tag">${escapeHtml(r.action)}</span>
-            <span style="overflow:hidden;text-overflow:ellipsis;white-space:nowrap;color:var(--text)">${escapeHtml(r.label)}</span>
-            <span style="margin-left:auto;flex-shrink:0;font-size:11.5px;color:var(--text-3)">${escapeHtml(r.actor)} · ${escapeHtml(r.when.toLocaleString("zh-CN"))}</span>
-          </div>`).join("");
-
-  const initial = escapeHtml(displayName.slice(0, 1) || "U");
-
-  return `<!doctype html>
-<html lang="zh-CN">
-${pageHead("Database Admin")}
-<body>
-  <div style="display:flex;height:100vh">
-    <aside style="width:240px;flex-shrink:0;background:var(--sidebar);border-right:1px solid var(--border-soft);display:flex;flex-direction:column">
-      <div style="padding:16px 16px 12px;border-bottom:1px solid var(--border-soft)">
-        <span style="font-size:15px;font-weight:600">Database Admin</span>
-      </div>
-      <nav style="flex:1;display:flex;flex-direction:column;gap:2px;padding:10px">
-        ${nav}
-      </nav>
-      <div style="margin:10px;padding:10px 12px;border-top:1px solid var(--border-soft);display:flex;align-items:center;gap:9px">
-        <div style="width:26px;height:26px;border-radius:50%;background:var(--accent);color:#fff;display:flex;align-items:center;justify-content:center;font-size:11px;font-weight:600;flex-shrink:0">${initial}</div>
-        <div style="min-width:0;flex:1">
-          <p style="font-size:10.5px;color:var(--text-3)">已登录</p>
-          <p style="overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:12.5px;color:var(--text)">${escapeHtml(displayName)}</p>
-        </div>
-        <button id="logout" class="btn" style="padding:3px 10px;font-size:11px">退出</button>
-      </div>
-    </aside>
-
-    <div style="flex:1;display:flex;flex-direction:column;min-width:0">
-      <section id="tab-overview" class="admin-tab-section" style="flex:1;overflow-y:auto;padding:28px">
-        <h1 style="font-size:18px;font-weight:600;margin-bottom:4px">概览</h1>
-        <p style="font-size:11.5px;color:var(--text-3);margin-bottom:20px">文件库实时数据</p>
-        <div style="display:grid;grid-template-columns:repeat(4,1fr);gap:16px">
-          ${cards}
-        </div>
-        <div class="panel" style="margin-top:18px">
-          <h2 style="font-size:13.5px;font-weight:600;margin-bottom:8px">最近活动</h2>
-          ${recentRows}
-        </div>
-      </section>
-
-      <section id="tab-library" class="admin-tab-section" style="display:none;flex:1;min-height:0">
-        ${renderLibraryBrowser()}
-      </section>
-
-      <section id="tab-users" class="admin-tab-section" style="display:none;flex:1;overflow-y:auto;padding:28px">
-        <h1 style="font-size:18px;font-weight:600;margin-bottom:16px">用户管理</h1>
-        ${renderUsersPanel(orgSlug)}
-      </section>
-
-      <section id="tab-groups" class="admin-tab-section" style="display:none;flex:1;overflow-y:auto;padding:28px">
-        <h1 style="font-size:18px;font-weight:600;margin-bottom:16px">Group 管理</h1>
-        ${renderGroupsPanel(orgSlug)}
-      </section>
-
-      <section id="tab-search" class="admin-tab-section" style="display:none;flex:1;overflow-y:auto;padding:28px">
-        <h1 style="font-size:18px;font-weight:600;margin-bottom:4px">查询</h1>
-        <p style="font-size:12.5px;color:var(--text-3)">查询功能建设中</p>
-      </section>
-
-      <section id="tab-settings" class="admin-tab-section" style="display:none;flex:1;overflow-y:auto;padding:28px">
-        <h1 style="font-size:18px;font-weight:600;margin-bottom:4px">设置</h1>
-        <p style="font-size:12.5px;color:var(--text-3)">设置功能建设中</p>
-      </section>
-    </div>
-  </div>
-
-  <script>
-    (function () {
-      const tabs = [...document.querySelectorAll(".admin-tab")];
-      const sections = Object.fromEntries(
-        [...document.querySelectorAll(".admin-tab-section")].map((s) => [s.id.replace("tab-", ""), s]),
-      );
-      function activate(id) {
-        tabs.forEach((t) => {
-          const on = t.dataset.tab === id;
-          t.style.background = on ? "var(--selected)" : "none";
-          t.style.color = on ? "var(--text)" : "var(--text-3)";
-          t.style.fontWeight = on ? "600" : "400";
-        });
-        Object.entries(sections).forEach(([key, s]) => {
-          s.style.display = key === id ? (key === "library" ? "block" : "block") : "none";
-        });
-        if (location.hash !== "#" + id) history.replaceState(null, "", "#" + id);
-      }
-      tabs.forEach((t) => t.addEventListener("click", () => activate(t.dataset.tab)));
-      document.getElementById("logout").addEventListener("click", async () => {
-        try { await fetch("/auth/logout", { method: "POST", credentials: "same-origin" }); } catch (e) {}
-        location.href = "/database/admin";
-      });
-      const fromHash = location.hash.replace(/^#/, "");
-      activate(tabs.some((t) => t.dataset.tab === fromHash) ? fromHash : "overview");
-    })();
-  </script>
-</body>
-</html>`;
-}
-
-function escapeHtml(value: string): string {
-  return value
-    .replaceAll("&", "&amp;")
-    .replaceAll("<", "&lt;")
-    .replaceAll(">", "&gt;")
-    .replaceAll('"', "&quot;");
-}

hub/src/database/routes/fileRoutes.ts

@@ -1,235 +0,0 @@
-/**
- * /database/api/* 文件内容与导出端点(契约 9.3/9.4)。
- * 冲突流:POST commits 返回 200 {version} 或 409 {currentVersion}(编辑 UI 拉 diff 后重提)。
- */
-
-import type { FastifyInstance, FastifyRequest } from "fastify";
-import {
-  commitFile,
-  deleteFile,
-  diffFile,
-  fileHistory,
-  listFiles,
-  readFile,
-  readFileRaw,
-  type FileContentEncoding,
-} from "../filelib/fileService.js";
-import {
-  createManifestStubAdapter,
-  downloadExport,
-  getExportJob,
-  submitExport,
-} from "../filelib/exportService.js";
-import { FileLibError } from "../filelib/model.js";
-import {
-  actorOrNull,
-  bodyObject,
-  optionalString,
-  requireString,
-  sendRouteError,
-  type FileLibRouteDeps,
-} from "../filelib/routeShared.js";
-
-export async function registerFileRoutes(
-  app: FastifyInstance,
-  deps: FileLibRouteDeps,
-): Promise<void> {
-  const fileDeps = {
-    prisma: deps.prisma,
-    organizationId: deps.organizationId,
-    groupResolver: deps.groupResolver,
-    versionStore: deps.versionStore,
-  };
-  const exportDeps = { ...fileDeps, adapters: deps.exportAdapters };
-
-  function pathParam(request: FastifyRequest): string {
-    const path = (request.query as { path?: string }).path;
-    if (path === undefined) throw new FileLibError(400, "invalid_request", "missing query: path");
-    return path;
-  }
-
-  function encodingParam(raw: unknown): FileContentEncoding {
-    if (raw === undefined || raw === "utf8") return "utf8";
-    if (raw === "base64") return "base64";
-    throw new FileLibError(400, "invalid_request", "encoding must be utf8 or base64");
-  }
-
-  app.get("/database/api/projects/:id/files", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      const prefix = (request.query as { prefix?: string }).prefix;
-      return { files: await listFiles(fileDeps, actor, id, prefix) };
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  app.get("/database/api/projects/:id/file", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      return await readFile(fileDeps, actor, id, pathParam(request));
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  // 原始字节下载(Content-Disposition: attachment;浏览器直接 save-as)
-  app.get("/database/api/projects/:id/file/raw", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      const raw = await readFileRaw(fileDeps, actor, id, pathParam(request));
-      return reply
-        .header("Content-Disposition",
-          `attachment; filename="${encodeURIComponent(raw.filename)}"; filename*=UTF-8''${encodeURIComponent(raw.filename)}`)
-        .header("X-Content-Version", raw.version)
-        .type("application/octet-stream")
-        .send(raw.buffer);
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  // 新建/上传(baseVersion 恒 null;已存在 → 409)
-  app.put("/database/api/projects/:id/file", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      const body = bodyObject(request.body);
-      const result = await commitFile(fileDeps, actor, id, {
-        path: requireString(body, "path"),
-        baseVersion: null,
-        content: requireString(body, "content"),
-        encoding: encodingParam(body["encoding"]),
-        message: optionalString(body, "message"),
-      });
-      return reply.status(201).send(result);
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  // 提交编辑(乐观并发;409 → details.currentVersion + file.conflict_detected 审计)
-  app.post("/database/api/projects/:id/file/commits", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      const body = bodyObject(request.body);
-      const baseVersion = body["baseVersion"];
-      if (typeof baseVersion !== "string" || baseVersion === "") {
-        throw new FileLibError(400, "invalid_request", "baseVersion must be a non-empty string");
-      }
-      return await commitFile(fileDeps, actor, id, {
-        path: requireString(body, "path"),
-        baseVersion,
-        content: requireString(body, "content"),
-        encoding: encodingParam(body["encoding"]),
-        message: optionalString(body, "message"),
-      });
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  app.delete("/database/api/projects/:id/file", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      const body = bodyObject(request.body);
-      await deleteFile(fileDeps, actor, id, pathParam(request), requireString(body, "baseVersion"));
-      return reply.status(204).send();
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  app.get("/database/api/projects/:id/file/diff", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      const query = request.query as { from?: string; to?: string };
-      if (query.from === undefined || query.to === undefined) {
-        throw new FileLibError(400, "invalid_request", "missing query: from / to");
-      }
-      return await diffFile(fileDeps, actor, id, pathParam(request), query.from, query.to);
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  app.get("/database/api/projects/:id/file/history", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      const rawLimit = (request.query as { limit?: string }).limit;
-      const limit = rawLimit === undefined ? undefined : Number.parseInt(rawLimit, 10);
-      if (limit !== undefined && (!Number.isSafeInteger(limit) || limit <= 0)) {
-        throw new FileLibError(400, "invalid_request", "limit must be a positive integer");
-      }
-      return { history: await fileHistory(fileDeps, actor, id, pathParam(request), limit) };
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  /* ------------------------------------------------------------ 导出(D10 异步) */
-
-  app.post("/database/api/projects/:id/exports", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      const body = bodyObject(request.body);
-      const params = body["params"];
-      if (params !== undefined && (typeof params !== "object" || params === null || Array.isArray(params))) {
-        throw new FileLibError(400, "invalid_request", "params must be an object");
-      }
-      const job = await submitExport(
-        exportDeps,
-        actor,
-        id,
-        requireString(body, "target"),
-        (params as Record<string, unknown> | undefined) ?? {},
-      );
-      return reply.status(202).send({ jobId: job.id, status: job.status });
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  app.get("/database/api/exports/:jobId", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { jobId } = request.params as { jobId: string };
-      return await getExportJob(exportDeps, actor, jobId);
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  app.get("/database/api/exports/:jobId/download", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { jobId } = request.params as { jobId: string };
-      const artifact = await downloadExport(exportDeps, actor, jobId);
-      return reply
-        .header("Content-Disposition", `attachment; filename="${artifact.filename}"`)
-        .type("application/octet-stream")
-        .send(artifact.content);
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-}

hub/src/database/routes/filelibRoutes.ts

@@ -1,310 +0,0 @@
-/**
- * /database/api/* 树与授权端点(契约 9.1/9.2 + C2 过渡搜索)。
- * 约定:绝对路径;actorOrNull 前置;业务全走 filelib 服务层;错误统一 sendRouteError。
- */
-
-import type { FastifyInstance } from "fastify";
-import {
-  breadcrumb,
-  createNode,
-  getEffectiveRole,
-  listChildren,
-  moveNode,
-  renameNode,
-  softDeleteNode,
-  updateNodeDescription,
-  type FileLibActor,
-  type InitialGrant,
-} from "../filelib/treeService.js";
-import {
-  forceAdjustGrants,
-  listGrants,
-  putGrants,
-  revokeGrant,
-  setIndependentPermission,
-} from "../filelib/grantService.js";
-import { FileLibError } from "../filelib/model.js";
-import {
-  actorOrNull,
-  bodyObject,
-  optionalString,
-  requireString,
-  sendRouteError,
-  treeDeps,
-  type FileLibRouteDeps,
-} from "../filelib/routeShared.js";
-
-export async function registerFileLibRoutes(
-  app: FastifyInstance,
-  deps: FileLibRouteDeps,
-): Promise<void> {
-  const tree = treeDeps(deps);
-  const grantDeps = { prisma: deps.prisma, organizationId: deps.organizationId, groupResolver: deps.groupResolver };
-
-  /* ------------------------------------------------------------ 身份 */
-
-  // 前端判断能力面用:是否网站管理员(root 创建按钮显隐)。
-  app.get("/database/api/me", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    return { userId: actor.userId, isWebsiteAdmin: actor.isWebsiteAdmin };
-  });
-
-  /* ------------------------------------------------------------ 树节点 */
-
-  app.get("/database/api/nodes", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const query = request.query as { parentId?: string };
-      const parentId = query.parentId === undefined || query.parentId === "" ? null : query.parentId;
-      return { nodes: await listChildren(tree, actor, parentId) };
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  app.post("/database/api/nodes", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const body = bodyObject(request.body);
-      const parentIdRaw = body["parentId"];
-      if (parentIdRaw !== null && typeof parentIdRaw !== "string") {
-        throw new FileLibError(400, "invalid_request", "parentId must be a string or null");
-      }
-      const kindRaw = requireString(body, "kind");
-      if (kindRaw !== "FOLDER" && kindRaw !== "PROJECT") {
-        throw new FileLibError(400, "invalid_request", "kind must be FOLDER or PROJECT");
-      }
-      const grants = parseGrants(body["grants"]);
-      const description = optionalString(body, "description");
-      const node = await createNode(tree, actor, {
-        parentId: parentIdRaw,
-        kind: kindRaw,
-        name: requireString(body, "name"),
-        description: description || undefined,
-        grants,
-      });
-      return reply.status(201).send({ node });
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  app.get("/database/api/nodes/:id", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      const role = await getEffectiveRole(tree, actor, id); // 无权限即 404(D8)
-      const node = await deps.prisma.fileLibNode.findFirst({
-        where: { id, organizationId: deps.organizationId },
-      });
-      if (node === null) throw new FileLibError(404, "node_not_found", "node not found");
-      const settings = node.kind === "PROJECT"
-        ? await deps.prisma.fileLibProjectSettings.findUnique({ where: { nodeId: node.id } })
-        : null;
-      return {
-        node: {
-          id: node.id,
-          parentId: node.parentId,
-          kind: node.kind,
-          name: node.name,
-          description: node.description,
-          role,
-          provisionStatus: node.provisionStatus,
-          independentPermission: settings?.independentPermissionsEnabled ?? false,
-          createdAt: node.createdAt,
-          updatedAt: node.updatedAt,
-        },
-      };
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  app.patch("/database/api/nodes/:id", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      const body = bodyObject(request.body);
-      const name = optionalString(body, "name");
-      const hasParent = Object.prototype.hasOwnProperty.call(body, "parentId");
-      const hasDesc = Object.prototype.hasOwnProperty.call(body, "description");
-      if (name === undefined && !hasParent && !hasDesc) {
-        throw new FileLibError(400, "invalid_request", "nothing to update (name? parentId? description?)");
-      }
-      let node;
-      if (name !== undefined) node = await renameNode(tree, actor, id, name);
-      if (hasParent) {
-        const parentId = body["parentId"];
-        if (parentId !== null && typeof parentId !== "string") {
-          throw new FileLibError(400, "invalid_request", "parentId must be a string or null");
-        }
-        node = await moveNode(tree, actor, id, parentId);
-      }
-      if (hasDesc) {
-        const d = body["description"];
-        if (d !== null && typeof d !== "string") {
-          throw new FileLibError(400, "invalid_request", "description must be a string or null");
-        }
-        node = await updateNodeDescription(tree, actor, id, typeof d === "string" ? d : null);
-      }
-      return { node };
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  app.delete("/database/api/nodes/:id", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      await softDeleteNode(tree, actor, id);
-      return reply.status(204).send();
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  app.get("/database/api/nodes/:id/breadcrumb", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      return { breadcrumb: await breadcrumb(tree, actor, id) };
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  app.get("/database/api/nodes/:id/effective-permission", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      return { role: await getEffectiveRole(tree, actor, id) };
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  /* ------------------------------------------------------------ 授权 */
-
-  app.get("/database/api/nodes/:id/grants", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      return { grants: await listGrants(grantDeps, actor, id) };
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  app.put("/database/api/nodes/:id/grants", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      const body = bodyObject(request.body);
-      const items = parseGrants(body["grants"]);
-      if (items === undefined) throw new FileLibError(400, "invalid_request", "missing field: grants");
-      return await putGrants(grantDeps, actor, id, items);
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  app.delete("/database/api/nodes/:id/grants/:grantId", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id, grantId } = request.params as { id: string; grantId: string };
-      await revokeGrant(grantDeps, actor, id, grantId);
-      return reply.status(204).send();
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  // D19 高危通道:网站管理员凭 id 强制调整,全部留 admin.force_adjust 审计。
-  app.put("/database/api/admin/nodes/:id/grants", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      const body = bodyObject(request.body);
-      const items = parseGrants(body["grants"]);
-      if (items === undefined) throw new FileLibError(400, "invalid_request", "missing field: grants");
-      return await forceAdjustGrants(grantDeps, actor, id, items);
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  app.put("/database/api/projects/:id/independent-permission", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const { id } = request.params as { id: string };
-      const body = bodyObject(request.body);
-      if (typeof body["enabled"] !== "boolean") {
-        throw new FileLibError(400, "invalid_request", "enabled must be a boolean");
-      }
-      return await setIndependentPermission(grantDeps, actor, id, body["enabled"]);
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-
-  /* ------------------------------------------------------------ Group 搜索(过渡) */
-
-  // 过渡实现:读 hub Team(C2 /groups/search 由 Group 团队交付后切换)。
-  app.get("/database/api/groups/search", async (request, reply) => {
-    const actor = await actorOrNull(request, reply, deps);
-    if (actor === null) return reply;
-    try {
-      const q = ((request.query as { q?: string }).q ?? "").trim();
-      const teams = await deps.prisma.team.findMany({
-        where: {
-          organizationId: deps.organizationId,
-          archivedAt: null,
-          ...(q === "" ? {} : { name: { contains: q, mode: "insensitive" as const } }),
-        },
-        take: 20,
-        orderBy: { name: "asc" },
-        select: { id: true, name: true },
-      });
-      return { groups: teams.map((t) => ({ id: t.id, name: t.name, breadcrumb: t.name })) };
-    } catch (error) {
-      return sendRouteError(reply, error);
-    }
-  });
-}
-
-function parseGrants(raw: unknown): InitialGrant[] | undefined {
-  if (raw === undefined) return undefined;
-  if (!Array.isArray(raw)) throw new FileLibError(400, "invalid_request", "grants must be an array");
-  return raw.map((item) => {
-    if (typeof item !== "object" || item === null) {
-      throw new FileLibError(400, "invalid_request", "grant entries must be objects");
-    }
-    const grant = item as Record<string, unknown>;
-    const principalType = grant["principalType"];
-    if (principalType !== "USER" && principalType !== "GROUP") {
-      throw new FileLibError(400, "invalid_request", "grant.principalType must be USER or GROUP");
-    }
-    const role = grant["role"];
-    if (role !== "VIEW" && role !== "EDIT" && role !== "MANAGE") {
-      throw new FileLibError(400, "invalid_request", "grant.role must be VIEW, EDIT or MANAGE");
-    }
-    if (typeof grant["principalId"] !== "string" || grant["principalId"] === "") {
-      throw new FileLibError(400, "invalid_request", "grant.principalId must be a non-empty string");
-    }
-    return { principalType, principalId: grant["principalId"], role };
-  });
-}

hub/src/database/routes/libraryBrowser.ts

@@ -1,596 +0,0 @@
-/**
- * 管理员后台「文件库」页内浏览器区块(树 | 内容 | 预览三栏,含授权管理)。
- *
- * renderLibraryBrowser() 返回可嵌入任意后台布局的 HTML+JS 片段:
- * 以 #lib-root 为根、内部用 q() 作用域选择器,不与宿主页其他元素冲突。
- * 与独立页版浏览器的区别:去掉了自己的 wordmark/用户栏(由后台外壳提供),
- * 保留管理员工具(根目录创建、授权面板、独立权限开关)。
- */
-
-export function renderLibraryBrowser(): string {
-  return `
-<div id="lib-root" style="display:flex;height:100%;min-height:0">
-  <!-- 左:目录树 -->
-  <div style="width:250px;flex-shrink:0;border-right:1px solid var(--border-soft);display:flex;flex-direction:column;background:var(--sidebar)">
-    <div style="display:flex;align-items:center;justify-content:space-between;padding:12px 14px;border-bottom:1px solid var(--border-soft)">
-      <span style="font-size:13px;font-weight:600;color:var(--text)">文件库</span>
-      <button id="lib-btn-new-root" class="btn hidden" style="padding:3px 10px;font-size:11px" title="新建根目录">+ 根目录</button>
-    </div>
-    <div id="lib-tree" style="flex:1;overflow-y:auto;padding:8px 8px 16px;font-size:13px"></div>
-  </div>
-
-  <!-- 中:节点内容 -->
-  <div id="lib-main" style="flex:1;overflow-y:auto;min-width:0">
-    <div class="lib-empty-hint">从左侧选择一个文件夹或项目</div>
-  </div>
-
-  <!-- 右:预览/编辑(选中文件时出现) -->
-  <div id="lib-preview" style="display:none;width:44%;min-width:380px;flex-shrink:0;overflow-y:auto;border-left:1px solid var(--border-soft);padding:16px"></div>
-
-  <div id="lib-modal-root"></div>
-  <div id="lib-toast-root" style="position:fixed;bottom:16px;right:16px;z-index:50;display:flex;flex-direction:column;gap:8px"></div>
-</div>
-
-<style>
-  #lib-root .lib-empty-hint { height:100%;display:flex;align-items:center;justify-content:center;color:var(--text-3);font-size:13px; }
-  #lib-root .tree-item { display:flex;align-items:center;gap:4px;padding:4px 6px;border-radius:6px;cursor:pointer;color:var(--text);transition:background 120ms ease;user-select:none; }
-  #lib-root .tree-item:hover { background:var(--hover); }
-  #lib-root .tree-item.selected { background:var(--selected); }
-  #lib-root .tree-children { border-left:1px solid var(--guide);margin-left:15px;padding-left:3px; }
-  #lib-root .tree-icon { width:16px;height:16px;flex-shrink:0;display:flex;align-items:center;justify-content:center; }
-  #lib-root .tree-caret { color:var(--text-3); }
-  #lib-root .tree-badge { margin-left:auto;padding-right:4px;font-size:10px;color:var(--text-3);font-family:var(--mono); }
-  #lib-root .tree-empty { padding:24px 12px;text-align:center;font-size:12px;color:var(--text-3); }
-  #lib-root .lib-toast { border-radius:8px;padding:8px 14px;font-size:12px;color:#fff;background:#333230;max-width:320px; }
-  #lib-root .lib-toast-err { background:#7E2C26; }
-  #lib-root .modal-mask { position:fixed;inset:0;z-index:40;background:rgba(26,26,24,.3);display:flex;align-items:center;justify-content:center;padding:16px; }
-  #lib-root .modal-card { width:100%;max-width:440px;background:var(--panel);border:1px solid var(--border);border-radius:12px;padding:22px; }
-  #lib-root pre.diff { white-space:pre-wrap;font-family:var(--mono);font-size:12px;line-height:1.7;background:var(--panel);border:1px solid var(--border);border-radius:8px;padding:10px;margin:0; }
-  #lib-root pre.diff .add { display:block;color:var(--diff-add-text);background:var(--diff-add-bg); }
-  #lib-root pre.diff .del { display:block;color:var(--diff-del-text);background:var(--diff-del-bg); }
-  #lib-root .meta-grid { display:grid;grid-template-columns:1fr 1fr;gap:10px 24px;font-size:13px;color:var(--text-2); }
-  #lib-root .meta-grid b { color:var(--text);font-weight:600; }
-  #lib-root .conflict-panel { margin-top:14px;border:1px solid #E8E2C8;background:#FCFBF4;border-radius:10px;padding:14px 16px; }
-  #lib-root .conflict-title { font-size:13px;font-weight:600;color:#6E6329;margin-bottom:8px; }
-  #lib-root .conflict-note { font-size:11px;color:#8A8059;margin-top:8px; }
-  #lib-root .export-status { font-size:11px;color:var(--text-3);font-family:var(--mono); }
-</style>
-
-<script>
-(function () {
-  const libRoot = document.getElementById("lib-root");
-  if (!libRoot) return;
-  const $ = (sel) => libRoot.querySelector(sel);
-  const $$ = (sel) => [...libRoot.querySelectorAll(sel)];
-  const esc = (s) => String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;");
-
-  async function api(path, opts = {}) {
-    const res = await fetch(path, {
-      credentials: "same-origin",
-      headers: opts.body ? { "Content-Type": "application/json" } : undefined,
-      ...opts,
-      body: opts.body ? JSON.stringify(opts.body) : undefined,
-    });
-    if (res.status === 401) { location.href = "/database/admin"; throw new Error("unauthenticated"); }
-    if (res.status === 204) return null;
-    const text = await res.text();
-    const data = text ? JSON.parse(text) : null;
-    if (!res.ok) {
-      const err = (data && data.error) || { code: "unknown", message: res.statusText };
-      const e = new Error(err.message); e.code = err.code; e.status = res.status; Object.assign(e, err);
-      throw e;
-    }
-    return data;
-  }
-
-  function toast(msg, kind = "info") {
-    const el = document.createElement("div");
-    el.className = "lib-toast" + (kind === "err" ? " lib-toast-err" : "");
-    el.textContent = msg;
-    $("#lib-toast-root").appendChild(el);
-    setTimeout(() => el.remove(), 3600);
-  }
-  const ok = (m) => toast(m, "ok");
-  const fail = (e) => toast(e.message || String(e), "err");
-
-  function modal(html) {
-    const root = $("#lib-modal-root");
-    root.innerHTML = '<div class="modal-mask"><div class="modal-card">' + html + "</div></div>";
-    root.firstElementChild.addEventListener("click", (e) => { if (e.target === e.currentTarget) closeModal(); });
-  }
-  function closeModal() { $("#lib-modal-root").innerHTML = ""; }
-
-  let me = { userId: null, isWebsiteAdmin: false };
-  let current = null;
-  const expanded = new Set();
-  let currentFile = null;
-
-  const ICONS = {
-    caretRight: '<svg width="10" height="10" viewBox="0 0 24 24" fill="currentColor"><path d="M9 6l6 6-6 6z"/></svg>',
-    caretDown: '<svg width="10" height="10" viewBox="0 0 24 24" fill="currentColor"><path d="M6 9l6 6 6-6z"/></svg>',
-    folder: '<svg width="16" height="16" viewBox="0 0 24 24" fill="currentColor"><path d="M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V7Z"/></svg>',
-    project: '<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M20 7l-8-4-8 4m16 0l-8 4m8-4v10l-8 4m0-10L4 7m8 4v10M4 7v10l8 4"/></svg>',
-  };
-
-  async function loadChildren(parentId) {
-    const q = parentId === null ? "" : "?parentId=" + encodeURIComponent(parentId);
-    return (await api("/database/api/nodes" + q)).nodes;
-  }
-
-  async function renderTree() {
-    const tree = $("#lib-tree");
-    tree.innerHTML = "";
-    try {
-      const roots = await loadChildren(null);
-      if (roots.length === 0) {
-        tree.innerHTML = '<div class="tree-empty">空文件库' +
-          (me.isWebsiteAdmin ? " · 点上方「+ 根目录」开始" : "") + "</div>";
-        return;
-      }
-      for (const node of roots) tree.appendChild(await treeItem(node, 0));
-    } catch (e) { tree.innerHTML = '<div class="tree-empty">' + esc(e.message) + "</div>"; }
-  }
-
-  async function treeItem(node, depth) {
-    const wrap = document.createElement("div");
-    const row = document.createElement("div");
-    row.className = "tree-item" + (current && current.id === node.id ? " selected" : "");
-    const caret = document.createElement("span");
-    caret.className = "tree-icon tree-caret";
-    if (node.kind === "FOLDER") {
-      caret.innerHTML = expanded.has(node.id) ? ICONS.caretDown : ICONS.caretRight;
-      caret.onclick = (e) => { e.stopPropagation(); toggleExpand(node.id); };
-    }
-    row.appendChild(caret);
-    const iconSpan = document.createElement("span");
-    iconSpan.className = "tree-icon";
-    iconSpan.style.color = node.kind === "PROJECT" ? "#1A1A18" : "#9C9B96";
-    iconSpan.innerHTML = node.kind === "PROJECT" ? ICONS.project : ICONS.folder;
-    row.appendChild(iconSpan);
-    const nameSpan = document.createElement("span");
-    nameSpan.className = "truncate";
-    nameSpan.textContent = node.name;
-    row.appendChild(nameSpan);
-    if (node.role !== "MANAGE") {
-      const badge = document.createElement("span");
-      badge.className = "tree-badge";
-      badge.textContent = node.role;
-      row.appendChild(badge);
-    }
-    row.onclick = () => {
-      if (node.kind === "FOLDER") {
-        if (expanded.has(node.id)) expanded.delete(node.id); else expanded.add(node.id);
-      }
-      selectNode(node.id);
-    };
-    wrap.appendChild(row);
-    if (node.kind === "FOLDER" && expanded.has(node.id)) {
-      wrap.appendChild(await childrenBlock(node.id, depth));
-    }
-    return wrap;
-  }
-
-  async function childrenBlock(parentId, depth) {
-    const block = document.createElement("div");
-    block.className = "tree-children";
-    const kids = await loadChildren(parentId);
-    for (const kid of kids) block.appendChild(await treeItem(kid, depth + 1));
-    return block;
-  }
-
-  async function toggleExpand(id) {
-    if (expanded.has(id)) expanded.delete(id); else expanded.add(id);
-    await renderTree();
-  }
-
-  async function selectNode(id) {
-    try {
-      const [{ node }, { breadcrumb }] = await Promise.all([
-        api("/database/api/nodes/" + id),
-        api("/database/api/nodes/" + id + "/breadcrumb"),
-      ]);
-      current = node; current.breadcrumb = breadcrumb;
-      closePreview();
-      await renderTree();
-      renderMain();
-    } catch (e) { fail(e); }
-  }
-
-  function crumbsHtml() {
-    return current.breadcrumb.map((c) =>
-      c.name === null ? "<span>…</span>" : "<span>" + esc(c.name) + "</span>"
-    ).join('<span style="margin:0 4px;color:var(--border)">/</span>');
-  }
-
-  function renderMain() {
-    const n = current;
-    const canManage = n.role === "MANAGE";
-    const canEdit = canManage || n.role === "EDIT";
-    const tabs = [];
-    tabs.push(["detail", "概览"]);
-    if (n.kind === "PROJECT") tabs.push(["files", "文件"]);
-    if (canManage) tabs.push(["grants", "授权"]);
-    current.tab = current.tab && tabs.some(t => t[0] === current.tab) ? current.tab : "detail";
-
-    $("#lib-main").innerHTML =
-      '<div style="max-width:860px;margin:0 auto;padding:28px 28px 56px">' +
-        '<div style="font-size:12px;color:var(--text-3);margin-bottom:6px">' + crumbsHtml() + "</div>" +
-        '<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:18px">' +
-          '<div style="font-size:17px;font-weight:600;color:var(--text);display:flex;align-items:center;gap:8px">' + esc(n.name) +
-            '<span class="tag">' + n.kind + "</span>" +
-            '<span class="tag tag-role">' + n.role + "</span>" +
-          "</div>" +
-          '<div style="display:flex;gap:6px">' +
-            (canEdit && n.kind === "FOLDER" ? '<button class="btn" onclick="window.__lib.createChild()">+ 新建子节点</button>' : "") +
-            (canManage ? '<button class="btn" onclick="window.__lib.renameCurrent()">重命名</button>' : "") +
-            (canManage ? '<button class="btn btn-danger" onclick="window.__lib.deleteCurrent()">删除</button>' : "") +
-          "</div>" +
-        "</div>" +
-        '<div class="tabs">' +
-          tabs.map(([id, label]) =>
-            '<button onclick="window.__lib.switchTab(\\'' + id + '\\')" class="tab' +
-            (current.tab === id ? " active" : "") + '">' + label + "</button>").join("") +
-        "</div>" +
-        '<div id="lib-tab-body"></div>' +
-      "</div>";
-    renderTab();
-  }
-
-  function renderTab() {
-    const body = $("#lib-tab-body");
-    if (current.tab === "files") return renderFilesTab(body);
-    if (current.tab === "grants") return renderGrantsTab(body);
-    let extra = "";
-    if (current.kind === "PROJECT") {
-      extra =
-        '<div class="divider"></div>' +
-        '<div class="inline-form" style="justify-content:flex-start">' +
-          '<span class="quiet">独立权限</span>' +
-          '<b style="font-size:13px">' + (current.independentPermission ? "开启" : "关闭") + "</b>" +
-          (current.role === "MANAGE"
-            ? '<button class="btn" onclick="window.__lib.toggleIndependent()">' + (current.independentPermission ? "关闭" : "开启") + "</button>"
-            : "") +
-          '<span class="quiet">关闭时仅继承父级权限(创建者除外)</span>' +
-        "</div>" +
-        '<div class="divider"></div>' +
-        '<div class="section-title">导出</div>' +
-        '<div class="inline-form">' +
-          '<select id="lib-x-target" class="select" style="width:auto"><option value="manifest">manifest(stub)</option></select>' +
-          '<button class="btn" onclick="window.__lib.submitExport()">开始导出</button>' +
-          '<span id="lib-x-status" class="export-status"></span>' +
-        "</div>";
-    }
-    body.innerHTML =
-      '<div class="panel">' +
-        '<div class="meta-grid">' +
-          "<div>类型 <b>" + current.kind + "</b></div>" +
-          "<div>我的权限 <b>" + current.role + "</b></div>" +
-          "<div>创建时间 " + new Date(current.createdAt).toLocaleString("zh-CN") + "</div>" +
-          "<div>更新时间 " + new Date(current.updatedAt).toLocaleString("zh-CN") + "</div>" +
-        "</div>" + extra +
-      "</div>";
-    pollExport();
-  }
-
-  /* ---------------- 节点操作 ---------------- */
-  function createDialog(parentId) {
-    modal(
-      '<div class="modal-title">' + (parentId ? "新建子节点" : "新建根目录") + "</div>" +
-      '<div class="form-row"><label class="form-label">名称</label>' +
-      '<input id="lib-f-name" class="input" placeholder="例如:物理必修一"/></div>' +
-      '<div class="form-row"><label class="form-label">类型</label>' +
-      '<select id="lib-f-kind" class="select">' +
-        '<option value="FOLDER">文件夹</option><option value="PROJECT">项目(Git 仓库)</option>' +
-      "</select></div>" +
-      '<div class="modal-actions">' +
-        '<button class="btn" onclick="window.__lib.closeModal()">取消</button>' +
-        '<button class="btn btn-primary" onclick="window.__lib.submitCreate(\\'' + (parentId ?? "") + '\\')">创建</button>' +
-      "</div>"
-    );
-  }
-  async function submitCreate(parentId) {
-    try {
-      await api("/database/api/nodes", { method: "POST", body: {
-        parentId: parentId === "" ? null : parentId,
-        kind: $("#lib-f-kind").value, name: $("#lib-f-name").value,
-      }});
-      closeModal(); ok("已创建");
-      if (parentId) expanded.add(parentId);
-      await renderTree();
-    } catch (e) { fail(e); }
-  }
-
-  /* ---------------- 授权 ---------------- */
-  async function renderGrantsTab(body) {
-    try {
-      const { grants } = await api("/database/api/nodes/" + current.id + "/grants");
-      const rows = grants.map((g) =>
-        "<tr>" +
-          "<td>" + (g.principalType === "USER" ? "👤" : "👥") + " " + esc(g.principalId) +
-            (g.isCreatorGrant ? ' <span class="quiet">(创建者)</span>' : "") + "</td>" +
-          '<td class="file-meta">' + g.role + "</td>" +
-          "<td style='text-align:right'>" + (g.isCreatorGrant ? "" :
-            '<button class="link-danger" onclick="window.__lib.revokeGrant(\\'' + g.id + '\\')">收回</button>') + "</td>" +
-        "</tr>").join("");
-      body.innerHTML =
-        '<div class="panel">' +
-          '<table class="list"><thead><tr><th>主体</th><th>级别</th><th></th></tr></thead>' +
-          "<tbody>" + rows + "</tbody></table>" +
-          '<div class="divider"></div>' +
-          '<div class="section-title">新增授权</div>' +
-          '<div class="inline-form">' +
-            '<select id="lib-g-type" class="select" style="width:110px" onchange="window.__lib.gTypeChanged()">' +
-              '<option value="USER">用户</option><option value="GROUP">Group</option></select>' +
-            '<input id="lib-g-principal" class="input" placeholder="用户 id"/>' +
-            '<select id="lib-g-group" class="select hidden"></select>' +
-            '<select id="lib-g-role" class="select" style="width:110px">' +
-              '<option value="VIEW">VIEW</option><option value="EDIT">EDIT</option><option value="MANAGE">MANAGE</option></select>' +
-            '<button class="btn btn-primary" onclick="window.__lib.addGrant()">授予</button>' +
-          "</div>" +
-          '<div class="section-note">MANAGE 仅创建者可授;创建者授权不可动(契约 8.1)</div>' +
-        "</div>";
-    } catch (e) { body.innerHTML = '<div class="panel quiet">' + esc(e.message) + "</div>"; }
-  }
-
-  /* ---------------- 文件 ---------------- */
-  async function renderFilesTab(body) {
-    try {
-      const { files } = await api("/database/api/projects/" + current.id + "/files");
-      const rows = files.map((f) =>
-        '<tr class="file-row" onclick="window.__lib.openFile(\\'' + esc(f.path) + '\\')">' +
-          '<td class="file-path">' + esc(f.path) + "</td>" +
-          '<td class="file-meta" style="text-align:right">' + f.size + " B</td></tr>").join("");
-      body.innerHTML =
-        '<div class="panel">' +
-          '<div class="inline-form" style="justify-content:space-between;margin-bottom:6px">' +
-            '<div class="section-title" style="margin:0">项目文件(' + files.length + ")</div>" +
-            (current.role !== "VIEW"
-              ? '<div class="inline-form" style="gap:6px">' +
-                '<button class="btn" onclick="window.__lib.newFileDialog()">+ 新建文件</button>' +
-                '<button class="btn btn-primary" onclick="document.getElementById(\\'lib-upload-input\\').click()">上传文件</button>' +
-                '<input id="lib-upload-input" type="file" class="hidden"/>' +
-                "</div>"
-              : "") +
-          "</div>" +
-          (files.length === 0 ? '<div class="quiet" style="padding:20px 0;text-align:center">空仓库 · 可新建或上传文件</div>'
-            : '<table class="list">' + rows + "</table>") +
-        "</div>";
-      const up = $("#lib-upload-input");
-      if (up) up.onchange = (e) => doUpload(e.target);
-    } catch (e) { body.innerHTML = '<div class="panel quiet">' + esc(e.message) + "</div>"; }
-  }
-
-  function newFileDialog() {
-    modal(
-      '<div class="modal-title">新建文件</div>' +
-      '<div class="form-row"><label class="form-label">路径</label>' +
-      '<input id="lib-nf-path" class="input" style="font-family:var(--mono)" placeholder="docs/intro.md"/></div>' +
-      '<div class="form-row"><label class="form-label">内容</label>' +
-      '<textarea id="lib-nf-content" rows="8" class="textarea" placeholder="内容…"></textarea></div>' +
-      '<div class="modal-actions"><button class="btn" onclick="window.__lib.closeModal()">取消</button>' +
-      '<button class="btn btn-primary" onclick="window.__lib.submitNewFile()">创建</button></div>'
-    );
-  }
-  async function submitNewFile() {
-    try {
-      await api("/database/api/projects/" + current.id + "/file", { method: "PUT", body: {
-        path: $("#lib-nf-path").value, content: $("#lib-nf-content").value,
-      }});
-      closeModal(); ok("已创建"); renderTab();
-    } catch (e) { fail(e); }
-  }
-
-  function u8ToBase64(bytes) {
-    let bin = "";
-    const CHUNK = 0x8000;
-    for (let i = 0; i < bytes.length; i += CHUNK) {
-      bin += String.fromCharCode.apply(null, bytes.subarray(i, i + CHUNK));
-    }
-    return btoa(bin);
-  }
-  async function doUpload(input) {
-    const file = input.files && input.files[0];
-    input.value = "";
-    if (!file) return;
-    if (file.size > 10 * 1024 * 1024) return toast("文件超过 10MB 上限", "err");
-    const targetPath = prompt("保存到路径(可含目录):", "材料/" + file.name);
-    if (!targetPath) return;
-    const bytes = new Uint8Array(await file.arrayBuffer());
-    const isBinary = bytes.includes(0);
-    const body = isBinary
-      ? { path: targetPath, content: u8ToBase64(bytes), encoding: "base64" }
-      : { path: targetPath, content: new TextDecoder("utf-8").decode(bytes), encoding: "utf8" };
-    try {
-      await api("/database/api/projects/" + current.id + "/file", { method: "PUT", body });
-      ok("已上传 " + file.name);
-      renderTab();
-    } catch (e) { fail(e); }
-  }
-
-  async function openFile(path) {
-    try {
-      const f = await api("/database/api/projects/" + current.id + "/file?path=" + encodeURIComponent(path));
-      currentFile = f;
-      const canEdit = current.role !== "VIEW";
-      const prev = $("#lib-preview");
-      prev.style.display = "block";
-      prev.innerHTML =
-        '<div class="panel">' +
-          '<div class="inline-form" style="justify-content:space-between;margin-bottom:10px">' +
-            '<span class="file-meta">' + esc(f.path) + " @ " + esc(f.version) + "</span>" +
-            '<div class="inline-form" style="gap:6px">' +
-              '<a class="btn" href="/database/api/projects/' + current.id + '/file/raw?path=' +
-                encodeURIComponent(f.path) + '" download>下载</a>' +
-              '<button class="btn" onclick="window.__lib.showHistory()">历史</button>' +
-              (canEdit ? '<button class="btn btn-danger" onclick="window.__lib.deleteFile()">删除文件</button>' : "") +
-              '<button class="btn" onclick="window.__lib.closePreview()" title="关闭预览">✕</button>' +
-            "</div>" +
-          "</div>" +
-          (f.encoding === "base64"
-            ? '<div class="quiet">二进制文件(' + f.size + " B),不支持在线编辑</div>"
-            : '<textarea id="lib-ef-content" rows="16" class="textarea" ' + (canEdit ? "" : "readonly") +
-              ">" + esc(f.content) + "</textarea>") +
-          (canEdit && f.encoding !== "base64"
-            ? '<div class="modal-actions"><button class="btn btn-primary" onclick="window.__lib.saveFile()">提交修改</button></div>'
-            : "") +
-          '<div id="lib-conflict-zone"></div>' +
-        "</div>";
-    } catch (e) { fail(e); }
-  }
-  function closePreview() {
-    const prev = $("#lib-preview");
-    if (prev) { prev.style.display = "none"; prev.innerHTML = ""; }
-    currentFile = null;
-  }
-  async function saveFile() {
-    try {
-      const r = await api("/database/api/projects/" + current.id + "/file/commits", { method: "POST", body: {
-        path: currentFile.path, baseVersion: currentFile.version, content: $("#lib-ef-content").value,
-      }});
-      ok("已提交 " + r.version); await openFile(currentFile.path);
-    } catch (e) {
-      if (e.status === 409 && e.currentVersion) return showConflict(e.currentVersion);
-      fail(e);
-    }
-  }
-  async function showConflict(currentVersion) {
-    const { diff } = await api("/database/api/projects/" + current.id + "/file/diff?path=" +
-      encodeURIComponent(currentFile.path) + "&from=" + encodeURIComponent(currentFile.version) +
-      "&to=" + encodeURIComponent(currentVersion));
-    $("#lib-conflict-zone").innerHTML =
-      '<div class="conflict-panel">' +
-        '<div class="conflict-title">冲突:他人已提交 ' + esc(currentVersion) + ",差异如下(你的基版 → 最新版)</div>" +
-        '<pre class="diff">' + esc(diff)
-          .replace(/^\\+(.*)$/gm, '<span class="add">+$1</span>')
-          .replace(/^-(.*)$/gm, '<span class="del">-$1</span>') + "</pre>" +
-        '<div class="conflict-note">请人工合并后,以最新内容为全文重新提交(基版将更新为 ' + esc(currentVersion) + ")</div>" +
-        '<div class="modal-actions"><button class="btn" onclick="window.__lib.acceptLatest()">载入最新内容</button></div>' +
-      "</div>";
-    currentFile.version = currentVersion;
-  }
-  async function deleteFile() {
-    if (!confirm("删除文件 " + currentFile.path + "?")) return;
-    try {
-      await api("/database/api/projects/" + current.id + "/file?path=" + encodeURIComponent(currentFile.path),
-        { method: "DELETE", body: { baseVersion: currentFile.version } });
-      ok("已删除"); closePreview(); renderTab();
-    } catch (e) { fail(e); }
-  }
-  async function showHistory() {
-    const { history } = await api("/database/api/projects/" + current.id + "/file/history?path=" +
-      encodeURIComponent(currentFile.path));
-    modal(
-      '<div class="modal-title">版本历史</div>' +
-      '<div style="max-height:320px;overflow-y:auto">' +
-        history.map((v) =>
-          '<div style="border-top:1px solid #F5F5F4;padding:8px 0;font-size:12px">' +
-            '<span class="file-meta" style="color:var(--accent)">' + esc(v.version) + "</span> " + esc(v.message) +
-            '<div class="quiet">' + new Date(v.committedAt).toLocaleString("zh-CN") +
-            (v.author ? " · " + esc(v.author) : "") + "</div></div>").join("") +
-      "</div>" +
-      '<div class="modal-actions"><button class="btn" onclick="window.__lib.closeModal()">关闭</button></div>'
-    );
-  }
-
-  /* ---------------- 导出 ---------------- */
-  let exportJobId = null;
-  async function submitExport() {
-    try {
-      const r = await api("/database/api/projects/" + current.id + "/exports", { method: "POST", body: { target: $("#lib-x-target").value } });
-      exportJobId = r.jobId;
-      $("#lib-x-status").textContent = "任务 " + r.jobId.slice(0, 8) + "… 排队中";
-      pollExport();
-    } catch (e) { fail(e); }
-  }
-  async function pollExport() {
-    if (!exportJobId) return;
-    try {
-      const job = await api("/database/api/exports/" + exportJobId);
-      const el = $("#lib-x-status");
-      if (!el) return;
-      if (job.status === "DONE") {
-        el.innerHTML = '完成 · <a href="/database/api/exports/' + exportJobId + '/download">下载</a>';
-      } else if (job.status === "FAILED") {
-        el.textContent = "失败:" + (job.error || "");
-      } else {
-        el.textContent = "状态:" + job.status + "…";
-        setTimeout(pollExport, 1000);
-      }
-    } catch { /* ignore */ }
-  }
-
-  /* ---------------- 暴露给内联 onclick 的操作表 ---------------- */
-  window.__lib = {
-    createChild() { createDialog(current.id); },
-    async renameCurrent() {
-      const name = prompt("新名称", current.name);
-      if (name === null) return;
-      try {
-        await api("/database/api/nodes/" + current.id, { method: "PATCH", body: { name } });
-        ok("已重命名"); await selectNode(current.id);
-      } catch (e) { fail(e); }
-    },
-    async deleteCurrent() {
-      if (!confirm("确认删除「" + current.name + "」?软删除后不可见。")) return;
-      try {
-        await api("/database/api/nodes/" + current.id, { method: "DELETE" });
-        ok("已删除"); current = null; await renderTree();
-        $("#lib-main").innerHTML = '<div class="lib-empty-hint">从左侧选择一个文件夹或项目</div>';
-        closePreview();
-      } catch (e) { fail(e); }
-    },
-    switchTab(id) { current.tab = id; renderMain(); },
-    async toggleIndependent() {
-      try {
-        await api("/database/api/projects/" + current.id + "/independent-permission", {
-          method: "PUT", body: { enabled: !current.independentPermission },
-        });
-        ok("已切换"); await selectNode(current.id);
-      } catch (e) { fail(e); }
-    },
-    async gTypeChanged() {
-      const isGroup = $("#lib-g-type").value === "GROUP";
-      $("#lib-g-principal").classList.toggle("hidden", isGroup);
-      $("#lib-g-group").classList.toggle("hidden", !isGroup);
-      if (isGroup && $("#lib-g-group").options.length === 0) {
-        const { groups } = await api("/database/api/groups/search?q=");
-        $("#lib-g-group").innerHTML = groups.map((g) => '<option value="' + esc(g.id) + '">' + esc(g.name) + "</option>").join("");
-      }
-    },
-    async addGrant() {
-      const type = $("#lib-g-type").value;
-      const principalId = type === "GROUP" ? $("#lib-g-group").value : $("#lib-g-principal").value.trim();
-      if (!principalId) return toast("请填写主体", "err");
-      try {
-        await api("/database/api/nodes/" + current.id + "/grants", { method: "PUT", body: {
-          grants: [{ principalType: type, principalId, role: $("#lib-g-role").value }],
-        }});
-        ok("已授予"); renderTab();
-      } catch (e) { fail(e); }
-    },
-    async revokeGrant(grantId) {
-      try {
-        await api("/database/api/nodes/" + current.id + "/grants/" + grantId, { method: "DELETE" });
-        ok("已收回"); renderTab();
-      } catch (e) { fail(e); }
-    },
-    newFileDialog, submitNewFile, openFile, closePreview, saveFile, deleteFile, showHistory,
-    acceptLatest() { openFile(currentFile.path); toast("已载入最新内容,请在此基础上合并", "info"); },
-    submitExport, closeModal,
-  };
-
-  /* ---------------- 初始化 ---------------- */
-  (async function init() {
-    try {
-      me = await api("/database/api/me");
-      if (me.isWebsiteAdmin) {
-        const btn = $("#lib-btn-new-root");
-        btn.classList.remove("hidden");
-        btn.onclick = () => createDialog(null);
-      }
-    } catch (e) { /* 401 已由 api 处理跳转 */ }
-    await renderTree();
-  })();
-})();
-</script>`;
-}

hub/src/database/routes/libraryPage.ts

@@ -1,801 +0,0 @@
-/**
- * /database/library —— 文件库浏览页(管理员后台的文件工具)。
- *
- * 服务端渲染外壳 + 浏览器端 JS 调 /database/api/*(同源 session cookie)。
- * 设计令牌与全局 UI 主题(uiTheme.ts)一致。能力面全部由 API 的 404/403 表达(D8)。
- */
-
-import type { FastifyInstance } from "fastify";
-import type { PrismaClient } from "@prisma/client";
-import { SESSION_COOKIE_NAME, verifySession } from "../../admin/auth/session.js";
-
-export interface LibraryPageConfig {
-  readonly prisma: PrismaClient;
-  readonly sessionSecret: string;
-}
-
-export async function registerLibraryPage(
-  app: FastifyInstance,
-  config: LibraryPageConfig,
-): Promise<void> {
-  app.get("/database/library", async (request, reply) => {
-    const raw = request.cookies[SESSION_COOKIE_NAME];
-    const session = raw === undefined || raw === "" ? null : verifySession(raw, config.sessionSecret);
-    if (session === null) return reply.redirect("/database/admin");
-    const user = await config.prisma.user.findUnique({
-      where: { id: session.userId },
-      select: { displayName: true },
-    });
-    if (user === null) return reply.redirect("/database/admin");
-    return reply.type("text/html").send(renderLibraryPage(user.displayName));
-  });
-}
-
-function renderLibraryPage(displayName: string): string {
-  const initial = displayName.slice(0, 1).replace(/[&<>"']/, "U");
-  return `<!doctype html>
-<html lang="zh-CN">
-<head>
-  <meta charset="utf-8"/>
-  <meta name="viewport" content="width=device-width, initial-scale=1"/>
-  <title>文件库</title>
-  <link rel="preconnect" href="https://fonts.googleapis.com"/>
-  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&display=swap" rel="stylesheet"/>
-  <style>
-    /* 设计令牌:与全局 UI 主题(uiTheme.ts)保持一致。 */
-    :root {
-      --bg: #FCFCFB;
-      --panel: #FFFFFF;
-      --sidebar: #F7F7F5;
-      --text: #1A1A18;
-      --text-2: #6B6A66;
-      --text-3: #9C9B96;
-      --border: #ECECE8;
-      --border-soft: #F1F1EE;
-      --accent: #1A1A18;
-      --accent-hover: #333330;
-      --selected: #EBEBE7;
-      --hover: #F4F4F1;
-      --danger: #A13A33;
-      --guide: #E9E9E5;
-      --diff-add-bg: #F3F6F2;
-      --diff-add-text: #4A6741;
-      --diff-del-bg: #F8F2F1;
-      --diff-del-text: #A13A33;
-      --mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-    }
-    * { box-sizing: border-box; }
-    html, body { margin: 0; height: 100%; }
-    body {
-      font-family: 'Inter', -apple-system, 'Segoe UI', 'PingFang SC', 'Microsoft YaHei', sans-serif;
-      background: var(--bg); color: var(--text);
-      font-size: 14px; line-height: 1.6;
-      -webkit-font-smoothing: antialiased;
-    }
-    .hidden { display: none !important; }
-
-    /* 布局 */
-    .shell { display: flex; height: 100vh; }
-    .sidebar {
-      width: 292px; flex-shrink: 0; background: var(--sidebar);
-      border-right: 1px solid var(--border);
-      display: flex; flex-direction: column;
-    }
-    .sidebar-head {
-      display: flex; align-items: center; justify-content: space-between;
-      padding: 14px 16px; border-bottom: 1px solid var(--border);
-    }
-    .wordmark { font-size: 14px; font-weight: 600; color: var(--text); }
-    .sidebar-actions { display: flex; gap: 6px; }
-    .tree { flex: 1; overflow-y: auto; padding: 8px 8px 16px; font-size: 13px; }
-    .sidebar-user {
-      margin: 0; padding: 10px 16px;
-      border-top: 1px solid var(--border);
-      display: flex; align-items: center; gap: 8px;
-      font-size: 12px; color: var(--text-2);
-    }
-    .avatar {
-      width: 24px; height: 24px; border-radius: 50%;
-      background: var(--accent); color: #fff;
-      display: flex; align-items: center; justify-content: center;
-      font-size: 11px; font-weight: 600; flex-shrink: 0;
-    }
-    .main { flex: 1; overflow-y: auto; }
-    .main-inner { max-width: 860px; margin: 0 auto; padding: 32px 32px 64px; }
-    .empty-hint {
-      height: 100%; display: flex; align-items: center; justify-content: center;
-      color: var(--text-3); font-size: 13px;
-    }
-
-    /* 树 */
-    .tree-item {
-      display: flex; align-items: center; gap: 4px;
-      padding: 4px 6px; border-radius: 6px; cursor: pointer;
-      color: var(--text); transition: background 120ms ease;
-      user-select: none;
-    }
-    .tree-item:hover { background: var(--hover); }
-    .tree-item.selected { background: var(--selected); color: #1C1917; }
-    .tree-children { border-left: 1px solid var(--guide); margin-left: 15px; padding-left: 3px; }
-    .tree-icon { width: 16px; height: 16px; flex-shrink: 0; display: flex; align-items: center; justify-content: center; }
-    .tree-caret { color: var(--text-3); }
-    .tree-badge { margin-left: auto; padding-right: 4px; font-size: 10px; color: var(--text-3); font-family: var(--mono); }
-    .tree-empty { padding: 24px 12px; text-align: center; font-size: 12px; color: var(--text-3); }
-
-    /* 按钮 */
-    .btn {
-      display: inline-flex; align-items: center; gap: 4px;
-      padding: 5px 12px; border-radius: 8px;
-      border: 1px solid var(--border); background: var(--panel);
-      color: var(--accent); font-size: 12px; font-weight: 500;
-      cursor: pointer; transition: all 120ms ease; text-decoration: none;
-    }
-    .btn:hover { background: var(--hover); border-color: #D6D3D1; }
-    .btn-primary {
-      background: var(--accent); border-color: var(--accent); color: #fff;
-    }
-    .btn-primary:hover { background: var(--accent-hover); border-color: var(--accent-hover); }
-    .btn-danger {
-      border-color: transparent; background: transparent; color: var(--danger);
-    }
-    .btn-danger:hover { background: var(--diff-del-bg); border-color: transparent; }
-
-    /* 内容区 */
-    .crumbs { font-size: 12px; color: var(--text-3); margin-bottom: 6px; }
-    .crumbs span + span::before { content: " / "; color: var(--border); }
-    .node-head { display: flex; align-items: center; justify-content: space-between; margin-bottom: 18px; }
-    .node-title { font-size: 17px; font-weight: 600; color: var(--text); display: flex; align-items: center; gap: 8px; }
-    .tag {
-      font-size: 10px; font-weight: 500; font-family: var(--mono);
-      padding: 2px 7px; border-radius: 999px;
-      border: 1px solid var(--border); color: var(--text-2); background: var(--panel);
-    }
-    .tag-role { color: var(--accent); border-color: #D6D3D1; }
-    .node-actions { display: flex; gap: 6px; }
-    .tabs { display: flex; gap: 2px; border-bottom: 1px solid var(--border); margin-bottom: 18px; }
-    .tab {
-      padding: 8px 14px; font-size: 13px; color: var(--text-2);
-      border: none; background: none; cursor: pointer;
-      border-bottom: 2px solid transparent; margin-bottom: -1px;
-      transition: color 120ms ease;
-    }
-    .tab:hover { color: var(--text); }
-    .tab.active { color: var(--text); font-weight: 600; border-bottom-color: var(--accent); }
-    .panel {
-      background: var(--panel); border: 1px solid var(--border);
-      border-radius: 10px; padding: 20px 22px;
-    }
-    .panel + .panel, .panel + #file-editor { margin-top: 14px; }
-    .meta-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 10px 24px; font-size: 13px; color: var(--text-2); }
-    .meta-grid b { color: var(--text); font-weight: 600; }
-    .section-title { font-size: 13px; font-weight: 600; color: var(--text); margin-bottom: 10px; }
-    .section-note { font-size: 11px; color: var(--text-3); margin-top: 6px; }
-
-    /* 表格 */
-    table.list { width: 100%; border-collapse: collapse; font-size: 13px; }
-    table.list th { text-align: left; font-size: 11px; font-weight: 500; color: var(--text-3); padding: 4px 0; }
-    table.list td { padding: 7px 0; border-top: 1px solid #F5F5F4; }
-    table.list tr:first-child td { border-top: none; }
-    .file-row { cursor: pointer; }
-    .file-row:hover td { background: var(--hover); }
-    .file-path { font-family: var(--mono); font-size: 12px; color: var(--text); }
-    .file-meta { font-size: 11px; color: var(--text-3); font-family: var(--mono); }
-    .link-danger { color: var(--danger); font-size: 12px; background: none; border: none; cursor: pointer; padding: 0; }
-    .link-danger:hover { text-decoration: underline; }
-
-    /* 表单 */
-    .input, .select, .textarea {
-      width: 100%; padding: 7px 10px; border-radius: 8px;
-      border: 1px solid var(--border); background: var(--panel);
-      font-size: 13px; color: var(--text); font-family: inherit;
-      outline: none; transition: border-color 120ms ease;
-    }
-    .input:focus, .select:focus, .textarea:focus { border-color: var(--accent); }
-    .textarea { font-family: var(--mono); font-size: 12px; line-height: 1.7; resize: vertical; }
-    .form-label { display: block; font-size: 11px; color: var(--text-2); margin-bottom: 4px; }
-    .form-row { margin-bottom: 12px; }
-    .inline-form { display: flex; gap: 8px; align-items: center; }
-    .inline-form .input { flex: 1; }
-
-    /* 弹层 */
-    .modal-mask {
-      position: fixed; inset: 0; z-index: 40;
-      background: rgba(26, 26, 24, .3);
-      display: flex; align-items: center; justify-content: center; padding: 16px;
-    }
-    .modal-card {
-      width: 100%; max-width: 440px; background: var(--panel);
-      border: 1px solid var(--border); border-radius: 12px; padding: 22px;
-    }
-    .modal-title { font-size: 15px; font-weight: 600; margin-bottom: 14px; }
-    .modal-actions { display: flex; justify-content: flex-end; gap: 8px; margin-top: 16px; }
-    .toast {
-      border-radius: 8px; padding: 8px 14px; font-size: 12px; color: #fff;
-      background: #333230; max-width: 320px;
-    }
-    .toast-ok { background: #333230; }
-    .toast-err { background: #7E2C26; }
-    #toast-root { position: fixed; bottom: 16px; right: 16px; z-index: 50; display: flex; flex-direction: column; gap: 8px; }
-
-    /* 冲突与 diff */
-    .conflict-panel {
-      margin-top: 14px; border: 1px solid #E8E2C8; background: #FCFBF4;
-      border-radius: 10px; padding: 14px 16px;
-    }
-    .conflict-title { font-size: 13px; font-weight: 600; color: #6E6329; margin-bottom: 8px; }
-    .conflict-note { font-size: 11px; color: #8A8059; margin-top: 8px; }
-    pre.diff {
-      white-space: pre-wrap; font-family: var(--mono); font-size: 12px; line-height: 1.7;
-      background: var(--panel); border: 1px solid var(--border); border-radius: 8px; padding: 10px;
-      margin: 0;
-    }
-    pre.diff .add { display: block; color: var(--diff-add-text); background: var(--diff-add-bg); }
-    pre.diff .del { display: block; color: var(--diff-del-text); background: var(--diff-del-bg); }
-
-    .divider { border-top: 1px solid var(--border); margin: 14px 0; }
-    .quiet { color: var(--text-3); font-size: 12px; }
-    .export-status { font-size: 11px; color: var(--text-3); font-family: var(--mono); }
-    .export-status a { color: var(--accent); }
-  </style>
-</head>
-<body>
-  <div class="shell">
-    <aside class="sidebar">
-      <div class="sidebar-head">
-        <span class="wordmark">文件库</span>
-        <div class="sidebar-actions">
-          <button id="btn-new-root" class="btn hidden" title="新建根目录">+ 根目录</button>
-          <a class="btn" href="/database/dashboard">后台</a>
-        </div>
-      </div>
-      <div id="tree" class="tree"></div>
-      <div class="sidebar-user">
-        <div class="avatar">${initial}</div>
-        <span style="flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;color:var(--text)">${displayName}</span>
-        <button id="btn-logout" class="btn" style="padding:3px 10px;font-size:11px" title="退出登录">退出</button>
-      </div>
-    </aside>
-    <main class="main" id="main">
-      <div class="empty-hint">从左侧选择一个文件夹或项目</div>
-    </main>
-  </div>
-
-  <div id="modal-root"></div>
-  <div id="toast-root"></div>
-
-<script>
-/* ---------------- 基础设施 ---------------- */
-const $ = (sel) => document.querySelector(sel);
-const esc = (s) => String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;");
-
-async function api(path, opts = {}) {
-  const res = await fetch(path, {
-    credentials: "same-origin",
-    headers: opts.body ? { "Content-Type": "application/json" } : undefined,
-    ...opts,
-    body: opts.body ? JSON.stringify(opts.body) : undefined,
-  });
-  if (res.status === 401) { location.href = "/database/admin"; throw new Error("unauthenticated"); }
-  if (res.status === 204) return null;
-  const text = await res.text();
-  const data = text ? JSON.parse(text) : null;
-  if (!res.ok) {
-    const err = (data && data.error) || { code: "unknown", message: res.statusText };
-    const e = new Error(err.message); e.code = err.code; e.status = res.status; Object.assign(e, err);
-    throw e;
-  }
-  return data;
-}
-
-function toast(msg, kind = "info") {
-  const el = document.createElement("div");
-  el.className = "toast " + (kind === "err" ? "toast-err" : "toast-ok");
-  el.textContent = msg;
-  $("#toast-root").appendChild(el);
-  setTimeout(() => el.remove(), 3600);
-}
-const ok = (m) => toast(m, "ok");
-const fail = (e) => toast(e.message || String(e), "err");
-
-function modal(html) {
-  const root = $("#modal-root");
-  root.innerHTML = '<div class="modal-mask"><div class="modal-card">' + html + "</div></div>";
-  root.firstElementChild.addEventListener("click", (e) => { if (e.target === e.currentTarget) closeModal(); });
-}
-function closeModal() { $("#modal-root").innerHTML = ""; }
-
-/* ---------------- 状态 ---------------- */
-let me = { userId: null, isWebsiteAdmin: false };
-let current = null;
-const expanded = new Set();
-
-/* ---------------- 目录树 ---------------- */
-/* 图标统一用固定尺寸的 inline SVG。每行几何一致:[16px 箭头槽][16px 图标槽][名称]。 */
-const ICONS = {
-  caretRight: '<svg width="10" height="10" viewBox="0 0 24 24" fill="currentColor"><path d="M9 6l6 6-6 6z"/></svg>',
-  caretDown: '<svg width="10" height="10" viewBox="0 0 24 24" fill="currentColor"><path d="M6 9l6 6 6-6z"/></svg>',
-  folder: '<svg width="16" height="16" viewBox="0 0 24 24" fill="currentColor"><path d="M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V7Z"/></svg>',
-  project: '<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M20 7l-8-4-8 4m16 0l-8 4m8-4v10l-8 4m0-10L4 7m8 4v10M4 7v10l8 4"/></svg>',
-};
-
-async function loadChildren(parentId) {
-  const q = parentId === null ? "" : "?parentId=" + encodeURIComponent(parentId);
-  return (await api("/database/api/nodes" + q)).nodes;
-}
-
-async function renderTree() {
-  const tree = $("#tree");
-  tree.innerHTML = "";
-  try {
-    const roots = await loadChildren(null);
-    if (roots.length === 0) {
-      tree.innerHTML = '<div class="tree-empty">空文件库' +
-        (me.isWebsiteAdmin ? " · 点上方「+ 根目录」开始" : "") + "</div>";
-      return;
-    }
-    for (const node of roots) tree.appendChild(await treeItem(node, 0));
-  } catch (e) { tree.innerHTML = '<div class="tree-empty">' + esc(e.message) + "</div>"; }
-}
-
-async function treeItem(node, depth) {
-  const wrap = document.createElement("div");
-  const row = document.createElement("div");
-  row.className = "tree-item" + (current && current.id === node.id ? " selected" : "");
-
-  const caret = document.createElement("span");
-  caret.className = "tree-icon tree-caret";
-  if (node.kind === "FOLDER") {
-    caret.innerHTML = expanded.has(node.id) ? ICONS.caretDown : ICONS.caretRight;
-    caret.onclick = (e) => { e.stopPropagation(); toggleExpand(node.id, wrap, depth); };
-  }
-  row.appendChild(caret);
-
-  const iconSpan = document.createElement("span");
-  iconSpan.className = "tree-icon";
-  iconSpan.style.color = node.kind === "PROJECT" ? "#1A1A18" : "#9C9B96";
-  iconSpan.innerHTML = node.kind === "PROJECT" ? ICONS.project : ICONS.folder;
-  row.appendChild(iconSpan);
-
-  const nameSpan = document.createElement("span");
-  nameSpan.className = "truncate";
-  nameSpan.textContent = node.name;
-  row.appendChild(nameSpan);
-  if (node.role !== "MANAGE") {
-    const badge = document.createElement("span");
-    badge.className = "tree-badge";
-    badge.textContent = node.role;
-    row.appendChild(badge);
-  }
-
-  row.onclick = () => {
-    if (node.kind === "FOLDER") {
-      if (expanded.has(node.id)) expanded.delete(node.id); else expanded.add(node.id);
-    }
-    selectNode(node.id);
-  };
-  wrap.appendChild(row);
-  if (node.kind === "FOLDER" && expanded.has(node.id)) {
-    wrap.appendChild(await childrenBlock(node.id, depth));
-  }
-  return wrap;
-}
-
-async function childrenBlock(parentId, depth) {
-  const block = document.createElement("div");
-  block.className = "tree-children";
-  const kids = await loadChildren(parentId);
-  for (const kid of kids) block.appendChild(await treeItem(kid, depth + 1));
-  return block;
-}
-
-async function toggleExpand(id, wrap, depth) {
-  if (expanded.has(id)) expanded.delete(id); else expanded.add(id);
-  await renderTree();
-}
-
-/* ---------------- 节点详情 ---------------- */
-async function selectNode(id) {
-  try {
-    const [{ node }, { breadcrumb }] = await Promise.all([
-      api("/database/api/nodes/" + id),
-      api("/database/api/nodes/" + id + "/breadcrumb"),
-    ]);
-    current = node; current.breadcrumb = breadcrumb;
-    await renderTree();
-    renderMain();
-  } catch (e) { fail(e); }
-}
-
-function crumbsHtml() {
-  return current.breadcrumb.map((c) =>
-    c.name === null ? "<span>…</span>" : "<span>" + esc(c.name) + "</span>"
-  ).join("");
-}
-
-function renderMain() {
-  const n = current;
-  const canManage = n.role === "MANAGE";
-  const canEdit = canManage || n.role === "EDIT";
-  const tabs = [];
-  tabs.push(["detail", "概览"]);
-  if (n.kind === "PROJECT") tabs.push(["files", "文件"]);
-  if (canManage) tabs.push(["grants", "授权"]);
-  current.tab = current.tab && tabs.some(t => t[0] === current.tab) ? current.tab : "detail";
-
-  $("#main").innerHTML =
-    '<div class="main-inner">' +
-      '<div class="crumbs">' + crumbsHtml() + "</div>" +
-      '<div class="node-head">' +
-        '<div class="node-title">' + esc(n.name) +
-          '<span class="tag">' + n.kind + "</span>" +
-          '<span class="tag tag-role">' + n.role + "</span>" +
-        "</div>" +
-        '<div class="node-actions">' +
-          (canEdit && n.kind === "FOLDER" ? '<button class="btn" onclick="createChild()">+ 新建子节点</button>' : "") +
-          (canManage ? '<button class="btn" onclick="renameCurrent()">重命名</button>' : "") +
-          (canManage ? '<button class="btn btn-danger" onclick="deleteCurrent()">删除</button>' : "") +
-        "</div>" +
-      "</div>" +
-      '<div class="tabs">' +
-        tabs.map(([id, label]) =>
-          '<button onclick="switchTab(\\'' + id + '\\')" class="tab' +
-          (current.tab === id ? " active" : "") + '">' + label + "</button>").join("") +
-      "</div>" +
-      '<div id="tab-body"></div>' +
-    "</div>";
-  renderTab();
-}
-
-function switchTab(id) { current.tab = id; renderMain(); }
-
-async function renderTab() {
-  const body = $("#tab-body");
-  if (current.tab === "files") return renderFilesTab(body);
-  if (current.tab === "grants") return renderGrantsTab(body);
-  let extra = "";
-  if (current.kind === "PROJECT") {
-    extra =
-      '<div class="divider"></div>' +
-      '<div class="inline-form" style="justify-content:flex-start">' +
-        '<span class="quiet">独立权限</span>' +
-        '<b style="font-size:13px">' + (current.independentPermission ? "开启" : "关闭") + "</b>" +
-        (current.role === "MANAGE"
-          ? '<button class="btn" onclick="toggleIndependent()">' + (current.independentPermission ? "关闭" : "开启") + "</button>"
-          : "") +
-        '<span class="quiet">关闭时仅继承父级权限(创建者除外)</span>' +
-      "</div>" +
-      '<div class="divider"></div>' +
-      '<div class="section-title">导出</div>' +
-      '<div class="inline-form">' +
-        '<select id="x-target" class="select" style="width:auto"><option value="manifest">manifest(stub)</option></select>' +
-        '<button class="btn" onclick="submitExport()">开始导出</button>' +
-        '<span id="x-status" class="export-status"></span>' +
-      "</div>";
-  }
-  body.innerHTML =
-    '<div class="panel">' +
-      '<div class="meta-grid">' +
-        "<div>类型 <b>" + current.kind + "</b></div>" +
-        "<div>我的权限 <b>" + current.role + "</b></div>" +
-        "<div>创建时间 " + new Date(current.createdAt).toLocaleString("zh-CN") + "</div>" +
-        "<div>更新时间 " + new Date(current.updatedAt).toLocaleString("zh-CN") + "</div>" +
-      "</div>" + extra +
-    "</div>";
-  pollExport();
-}
-
-/* ---------------- 节点操作 ---------------- */
-async function createChild() {
-  createDialog(current.id);
-}
-function createDialog(parentId) {
-  modal(
-    '<div class="modal-title">' + (parentId ? "新建子节点" : "新建根目录") + "</div>" +
-    '<div class="form-row"><label class="form-label">名称</label>' +
-    '<input id="f-name" class="input" placeholder="例如:物理必修一"/></div>' +
-    '<div class="form-row"><label class="form-label">类型</label>' +
-    '<select id="f-kind" class="select">' +
-      '<option value="FOLDER">文件夹</option><option value="PROJECT">项目(Git 仓库)</option>' +
-    "</select></div>" +
-    '<div class="modal-actions">' +
-      '<button class="btn" onclick="closeModal()">取消</button>' +
-      '<button class="btn btn-primary" onclick="submitCreate(\\'' + (parentId ?? "") + '\\')">创建</button>' +
-    "</div>"
-  );
-}
-async function submitCreate(parentId) {
-  try {
-    await api("/database/api/nodes", { method: "POST", body: {
-      parentId: parentId === "" ? null : parentId,
-      kind: $("#f-kind").value, name: $("#f-name").value,
-    }});
-    closeModal(); ok("已创建");
-    if (parentId) expanded.add(parentId);
-    await renderTree();
-  } catch (e) { fail(e); }
-}
-async function renameCurrent() {
-  const name = prompt("新名称", current.name);
-  if (name === null) return;
-  try {
-    await api("/database/api/nodes/" + current.id, { method: "PATCH", body: { name } });
-    ok("已重命名"); await selectNode(current.id);
-  } catch (e) { fail(e); }
-}
-async function deleteCurrent() {
-  if (!confirm("确认删除「" + current.name + "」?软删除后不可见。")) return;
-  try {
-    await api("/database/api/nodes/" + current.id, { method: "DELETE" });
-    ok("已删除"); current = null; await renderTree();
-    $("#main").innerHTML = '<div class="empty-hint">从左侧选择一个文件夹或项目</div>';
-  } catch (e) { fail(e); }
-}
-async function toggleIndependent() {
-  try {
-    await api("/database/api/projects/" + current.id + "/independent-permission", {
-      method: "PUT", body: { enabled: !current.independentPermission },
-    });
-    ok("已切换"); await selectNode(current.id);
-  } catch (e) { fail(e); }
-}
-
-/* ---------------- 授权 ---------------- */
-async function renderGrantsTab(body) {
-  try {
-    const { grants } = await api("/database/api/nodes/" + current.id + "/grants");
-    const rows = grants.map((g) =>
-      "<tr>" +
-        "<td>" + (g.principalType === "USER" ? "👤" : "👥") + " " + esc(g.principalId) +
-          (g.isCreatorGrant ? ' <span class="quiet">(创建者)</span>' : "") + "</td>" +
-        '<td class="file-meta">' + g.role + "</td>" +
-        "<td style='text-align:right'>" + (g.isCreatorGrant ? "" :
-          '<button class="link-danger" onclick="revokeGrant(\\'' + g.id + '\\')">收回</button>') + "</td>" +
-      "</tr>").join("");
-    body.innerHTML =
-      '<div class="panel">' +
-        '<table class="list"><thead><tr><th>主体</th><th>级别</th><th></th></tr></thead>' +
-        "<tbody>" + rows + "</tbody></table>" +
-        '<div class="divider"></div>' +
-        '<div class="section-title">新增授权</div>' +
-        '<div class="inline-form">' +
-          '<select id="g-type" class="select" style="width:110px" onchange="gTypeChanged()">' +
-            '<option value="USER">用户</option><option value="GROUP">Group</option></select>' +
-          '<input id="g-principal" class="input" placeholder="用户 id"/>' +
-          '<select id="g-group" class="select hidden"></select>' +
-          '<select id="g-role" class="select" style="width:110px">' +
-            '<option value="VIEW">VIEW</option><option value="EDIT">EDIT</option><option value="MANAGE">MANAGE</option></select>' +
-          '<button class="btn btn-primary" onclick="addGrant()">授予</button>' +
-        "</div>" +
-        '<div class="section-note">MANAGE 仅创建者可授;创建者授权不可动(契约 8.1)</div>' +
-      "</div>";
-  } catch (e) { body.innerHTML = '<div class="panel quiet">' + esc(e.message) + "</div>"; }
-}
-async function gTypeChanged() {
-  const isGroup = $("#g-type").value === "GROUP";
-  $("#g-principal").classList.toggle("hidden", isGroup);
-  $("#g-group").classList.toggle("hidden", !isGroup);
-  if (isGroup && $("#g-group").options.length === 0) {
-    const { groups } = await api("/database/api/groups/search?q=");
-    $("#g-group").innerHTML = groups.map((g) => '<option value="' + esc(g.id) + '">' + esc(g.name) + "</option>").join("");
-  }
-}
-async function addGrant() {
-  const type = $("#g-type").value;
-  const principalId = type === "GROUP" ? $("#g-group").value : $("#g-principal").value.trim();
-  if (!principalId) return toast("请填写主体", "err");
-  try {
-    await api("/database/api/nodes/" + current.id + "/grants", { method: "PUT", body: {
-      grants: [{ principalType: type, principalId, role: $("#g-role").value }],
-    }});
-    ok("已授予"); renderTab();
-  } catch (e) { fail(e); }
-}
-async function revokeGrant(grantId) {
-  try {
-    await api("/database/api/nodes/" + current.id + "/grants/" + grantId, { method: "DELETE" });
-    ok("已收回"); renderTab();
-  } catch (e) { fail(e); }
-}
-
-/* ---------------- 文件 ---------------- */
-let currentFile = null;
-async function renderFilesTab(body) {
-  try {
-    const { files } = await api("/database/api/projects/" + current.id + "/files");
-    const rows = files.map((f) =>
-      '<tr class="file-row" onclick=\\'openFile("' + esc(f.path) + '")\\'>' +
-        '<td class="file-path">' + esc(f.path) + "</td>" +
-        '<td class="file-meta" style="text-align:right">' + f.size + " B</td></tr>").join("");
-    body.innerHTML =
-      '<div class="panel">' +
-        '<div class="inline-form" style="justify-content:space-between;margin-bottom:6px">' +
-          '<div class="section-title" style="margin:0">项目文件(' + files.length + ")</div>" +
-          (current.role !== "VIEW"
-            ? '<div class="inline-form" style="gap:6px">' +
-              '<button class="btn" onclick="newFileDialog()">+ 新建文件</button>' +
-              '<button class="btn btn-primary" onclick="document.getElementById(\\'upload-input\\').click()">上传文件</button>' +
-              '<input id="upload-input" type="file" class="hidden" onchange="doUpload(this)"/>' +
-              "</div>"
-            : "") +
-        "</div>" +
-        (files.length === 0 ? '<div class="quiet" style="padding:20px 0;text-align:center">空仓库 · 可新建或上传文件</div>'
-          : '<table class="list">' + rows + "</table>") +
-      "</div>" +
-      '<div id="file-editor"></div>';
-  } catch (e) { body.innerHTML = '<div class="panel quiet">' + esc(e.message) + "</div>"; }
-}
-async function newFileDialog() {
-  modal(
-    '<div class="modal-title">新建文件</div>' +
-    '<div class="form-row"><label class="form-label">路径</label>' +
-    '<input id="nf-path" class="input" style="font-family:var(--mono)" placeholder="docs/intro.md"/></div>' +
-    '<div class="form-row"><label class="form-label">内容</label>' +
-    '<textarea id="nf-content" rows="8" class="textarea" placeholder="内容…"></textarea></div>' +
-    '<div class="modal-actions"><button class="btn" onclick="closeModal()">取消</button>' +
-    '<button class="btn btn-primary" onclick="submitNewFile()">创建</button></div>'
-  );
-}
-
-/* 磁盘文件上传:文本走 utf8,含 NUL 字节判为二进制走 base64(与服务端一致)。 */
-function u8ToBase64(bytes) {
-  let bin = "";
-  const CHUNK = 0x8000;
-  for (let i = 0; i < bytes.length; i += CHUNK) {
-    bin += String.fromCharCode.apply(null, bytes.subarray(i, i + CHUNK));
-  }
-  return btoa(bin);
-}
-async function doUpload(input) {
-  const file = input.files && input.files[0];
-  input.value = "";
-  if (!file) return;
-  if (file.size > 10 * 1024 * 1024) return toast("文件超过 10MB 上限", "err");
-  const targetPath = prompt("保存到路径(可含目录):", "材料/" + file.name);
-  if (!targetPath) return;
-  const bytes = new Uint8Array(await file.arrayBuffer());
-  const isBinary = bytes.includes(0);
-  const body = isBinary
-    ? { path: targetPath, content: u8ToBase64(bytes), encoding: "base64" }
-    : { path: targetPath, content: new TextDecoder("utf-8").decode(bytes), encoding: "utf8" };
-  try {
-    await api("/database/api/projects/" + current.id + "/file", { method: "PUT", body });
-    ok("已上传 " + file.name);
-    renderTab();
-  } catch (e) { fail(e); }
-}
-async function submitNewFile() {
-  try {
-    await api("/database/api/projects/" + current.id + "/file", { method: "PUT", body: {
-      path: $("#nf-path").value, content: $("#nf-content").value,
-    }});
-    closeModal(); ok("已创建"); renderTab();
-  } catch (e) { fail(e); }
-}
-async function openFile(path) {
-  try {
-    const f = await api("/database/api/projects/" + current.id + "/file?path=" + encodeURIComponent(path));
-    currentFile = f;
-    const canEdit = current.role !== "VIEW";
-    $("#file-editor").innerHTML =
-      '<div class="panel">' +
-        '<div class="inline-form" style="justify-content:space-between;margin-bottom:10px">' +
-          '<span class="file-meta">' + esc(f.path) + " @ " + esc(f.version) + "</span>" +
-          '<div class="inline-form" style="gap:6px">' +
-            '<a class="btn" href="/database/api/projects/' + current.id + '/file/raw?path=' +
-              encodeURIComponent(f.path) + '" download>下载</a>' +
-            '<button class="btn" onclick="showHistory()">历史</button>' +
-            (canEdit ? '<button class="btn btn-danger" onclick="deleteFile()">删除文件</button>' : "") +
-          "</div>" +
-        "</div>" +
-        (f.encoding === "base64"
-          ? '<div class="quiet">二进制文件(' + f.size + " B),不支持在线编辑</div>"
-          : '<textarea id="ef-content" rows="14" class="textarea" ' + (canEdit ? "" : "readonly") +
-            ">" + esc(f.content) + "</textarea>") +
-        (canEdit && f.encoding !== "base64"
-          ? '<div class="modal-actions"><button class="btn btn-primary" onclick="saveFile()">提交修改</button></div>'
-          : "") +
-        '<div id="conflict-zone"></div>' +
-      "</div>";
-  } catch (e) { fail(e); }
-}
-async function saveFile() {
-  try {
-    const r = await api("/database/api/projects/" + current.id + "/file/commits", { method: "POST", body: {
-      path: currentFile.path, baseVersion: currentFile.version, content: $("#ef-content").value,
-    }});
-    ok("已提交 " + r.version); await openFile(currentFile.path);
-  } catch (e) {
-    if (e.status === 409 && e.currentVersion) return showConflict(e.currentVersion);
-    fail(e);
-  }
-}
-async function showConflict(currentVersion) {
-  const { diff } = await api("/database/api/projects/" + current.id + "/file/diff?path=" +
-    encodeURIComponent(currentFile.path) + "&from=" + encodeURIComponent(currentFile.version) +
-    "&to=" + encodeURIComponent(currentVersion));
-  $("#conflict-zone").innerHTML =
-    '<div class="conflict-panel">' +
-      '<div class="conflict-title">冲突:他人已提交 ' + esc(currentVersion) + ",差异如下(你的基版 → 最新版)</div>" +
-      '<pre class="diff">' + esc(diff)
-        .replace(/^\\+(.*)$/gm, '<span class="add">+$1</span>')
-        .replace(/^-(.*)$/gm, '<span class="del">-$1</span>') + "</pre>" +
-      '<div class="conflict-note">请人工合并后,以最新内容为全文重新提交(基版将更新为 ' + esc(currentVersion) + ")</div>" +
-      '<div class="modal-actions"><button class="btn" onclick="acceptLatest(\\'' + esc(currentVersion) + '\\')">载入最新内容</button></div>' +
-    "</div>";
-  currentFile.version = currentVersion;
-}
-async function acceptLatest() { await openFile(currentFile.path); toast("已载入最新内容,请在此基础上合并", "info"); }
-async function deleteFile() {
-  if (!confirm("删除文件 " + currentFile.path + "?")) return;
-  try {
-    await api("/database/api/projects/" + current.id + "/file?path=" + encodeURIComponent(currentFile.path),
-      { method: "DELETE", body: { baseVersion: currentFile.version } });
-    ok("已删除"); currentFile = null; renderTab();
-  } catch (e) { fail(e); }
-}
-async function showHistory() {
-  const { history } = await api("/database/api/projects/" + current.id + "/file/history?path=" +
-    encodeURIComponent(currentFile.path));
-  modal(
-    '<div class="modal-title">版本历史</div>' +
-    '<div style="max-height:320px;overflow-y:auto">' +
-      history.map((v) =>
-        '<div style="border-top:1px solid #F5F5F4;padding:8px 0;font-size:12px">' +
-          '<span class="file-meta" style="color:var(--accent)">' + esc(v.version) + "</span> " + esc(v.message) +
-          '<div class="quiet">' + new Date(v.committedAt).toLocaleString("zh-CN") +
-          (v.author ? " · " + esc(v.author) : "") + "</div></div>").join("") +
-    "</div>" +
-    '<div class="modal-actions"><button class="btn" onclick="closeModal()">关闭</button></div>'
-  );
-}
-
-/* ---------------- 导出 ---------------- */
-let exportJobId = null;
-async function submitExport() {
-  try {
-    const r = await api("/database/api/projects/" + current.id + "/exports", { method: "POST", body: { target: $("#x-target").value } });
-    exportJobId = r.jobId;
-    $("#x-status").textContent = "任务 " + r.jobId.slice(0, 8) + "… 排队中";
-    pollExport();
-  } catch (e) { fail(e); }
-}
-async function pollExport() {
-  if (!exportJobId) return;
-  try {
-    const job = await api("/database/api/exports/" + exportJobId);
-    const el = $("#x-status");
-    if (!el) return;
-    if (job.status === "DONE") {
-      el.innerHTML = '完成 · <a href="/database/api/exports/' + exportJobId + '/download">下载</a>';
-    } else if (job.status === "FAILED") {
-      el.textContent = "失败:" + (job.error || "");
-    } else {
-      el.textContent = "状态:" + job.status + "…";
-      setTimeout(pollExport, 1000);
-    }
-  } catch { /* job 可能属于别的项目 */ }
-}
-
-/* ---------------- 启动 ---------------- */
-(async function init() {
-  const logoutBtn = $("#btn-logout");
-  if (logoutBtn) {
-    logoutBtn.addEventListener("click", async () => {
-      try { await fetch("/auth/logout", { method: "POST", credentials: "same-origin" }); } catch {}
-      location.href = "/database/admin";
-    });
-  }
-  try {
-    me = await api("/database/api/me");
-    if (me.isWebsiteAdmin) {
-      const btn = $("#btn-new-root");
-      btn.classList.remove("hidden");
-      btn.onclick = () => createDialog(null);
-    }
-  } catch (e) { /* 401 已由 api 处理跳转 */ }
-  await renderTree();
-})();
-</script>
-</body>
-</html>`;
-}

hub/src/database/routes/teacherApp.ts

@@ -1,129 +0,0 @@
-/**
- * 老师端用户前端托管(标准前后端分离):
- *   GET /app/*                  — filelib-web(Svelte SPA)构建产物静态托管 + SPA 回退
- *   GET /database/api/login-info — 登录页配置(org slug / dev 开关)
- *   GET /app/dev-login{,-teacher} — DEV ONLY 一键登录(管理员 / 普通老师)
- *
- * 服务端不再渲染老师端页面;页面由独立前端工程 hub/filelib-web 产出。
- */
-
-import fs from "node:fs";
-import path from "node:path";
-import fastifyStatic from "@fastify/static";
-import type { FastifyInstance } from "fastify";
-import type { PrismaClient } from "@prisma/client";
-import { SESSION_COOKIE_NAME, signSession } from "../../admin/auth/session.js";
-
-export interface TeacherAppConfig {
-  readonly prisma: PrismaClient;
-  readonly sessionSecret: string;
-  /** 飞书 OAuth 链接按 silo org slug 构造。 */
-  readonly siloOrganizationSlug: string;
-  /** DEV ONLY(双重门禁,见 database/plugin.ts):一键登录端点与按钮同进同退。 */
-  readonly allowDevLoginBypass: boolean;
-}
-
-export async function registerTeacherApp(
-  app: FastifyInstance,
-  config: TeacherAppConfig,
-): Promise<void> {
-  // 登录页配置(公开;org slug 本就在 OAuth URL 中,不构成敏感信息)。
-  app.get("/database/api/login-info", async () => ({
-    orgSlug: config.siloOrganizationSlug,
-    devLoginEnabled: config.allowDevLoginBypass,
-  }));
-
-  // 标准分离:静态托管 SPA 构建产物;非文件路径回退 index.html 交给前端。
-  const distDir = path.resolve(import.meta.dirname, "../../../filelib-web/dist");
-  if (fs.existsSync(path.join(distDir, "index.html"))) {
-    await app.register(fastifyStatic, { root: distDir, prefix: "/app/", decorateReply: true });
-    app.setNotFoundHandler((request, reply) => {
-      if (request.url.startsWith("/app")) {
-        return reply.sendFile("index.html", distDir);
-      }
-      return reply.status(404).send({ error: { code: "not_found", message: "not found" } });
-    });
-  } else {
-    app.log.warn({ distDir }, "filelib-web dist not found; build it with `npm run build --prefix filelib-web`");
-    app.get("/app", async (_request, reply) =>
-      reply
-        .status(503)
-        .type("text/plain")
-        .send("filelib-web 未构建。请先运行 npm run build --prefix hub/filelib-web"),
-    );
-  }
-
-  if (!config.allowDevLoginBypass) return;
-  registerDevLogins(app, config);
-}
-
-/** DEV ONLY:普通老师一键登录端点(双重门禁见 plugin.ts)。
- *  老师端不提供管理员登录 —— 管理员从 /database/admin 进。 */
-function registerDevLogins(app: FastifyInstance, config: TeacherAppConfig): void {
-  app.get("/app/dev-login-teacher", async (_request, reply) => {
-    const prisma = config.prisma;
-    const organization = await prisma.organization.findFirst({
-      where: { status: "ACTIVE" },
-      select: { id: true },
-    });
-    if (organization === null) {
-      return reply.status(404).send({ error: { code: "no_org", message: "no active organization" } });
-    }
-
-    let membership = await prisma.organizationMembership.findFirst({
-      where: { organizationId: organization.id, role: "MEMBER", revokedAt: null },
-      select: { userId: true, organizationId: true },
-    });
-    if (membership === null) {
-      const teacher = await prisma.user.upsert({
-        where: { feishuOpenId: "ou_dev_teacher" },
-        update: {},
-        create: { feishuOpenId: "ou_dev_teacher", displayName: "测试老师" },
-      });
-      await prisma.organizationMembership.create({
-        data: { organizationId: organization.id, userId: teacher.id, role: "MEMBER" },
-      });
-      membership = { userId: teacher.id, organizationId: organization.id };
-    }
-
-    const connection = await prisma.organizationFeishuApplicationConnection.findFirst({
-      where: { organizationId: membership.organizationId, status: "ACTIVE" },
-      select: { id: true, organizationId: true },
-    });
-    if (connection === null) {
-      return reply.status(404).send({ error: { code: "no_connection", message: "no active Feishu connection for org" } });
-    }
-    let identity = await prisma.feishuUserIdentity.findFirst({
-      where: { userId: membership.userId, connectionId: connection.id },
-      select: { id: true, connectionId: true },
-    });
-    if (identity === null) {
-      identity = await prisma.feishuUserIdentity.create({
-        data: { connectionId: connection.id, userId: membership.userId, openId: "ou_dev_teacher" },
-        select: { id: true, connectionId: true },
-      });
-    }
-
-    setSessionCookie(reply, config.sessionSecret, membership.userId, identity.id, identity.connectionId, connection.organizationId);
-    reply.log.warn({ userId: membership.userId }, "DEV teacher-app login bypass (regular teacher) used");
-    return reply.redirect("/app");
-  });
-}
-
-function setSessionCookie(
-  reply: { setCookie: (name: string, value: string, opts: Record<string, unknown>) => void },
-  secret: string,
-  userId: string,
-  feishuIdentityId: string,
-  feishuConnectionId: string,
-  feishuOrganizationId: string,
-): void {
-  const token = signSession({ userId, feishuIdentityId, feishuConnectionId, feishuOrganizationId }, secret);
-  reply.setCookie(SESSION_COOKIE_NAME, token, {
-    path: "/",
-    httpOnly: true,
-    sameSite: "lax",
-    secure: false,
-    maxAge: 7 * 24 * 60 * 60,
-  });
-}

hub/src/database/routes/uiTheme.ts

@@ -1,138 +0,0 @@
-/**
- * 全局共享 UI 主题(老师端 /app、管理员后台 /database、文件页 /database/library)。
- *
- * 方向:高级简约、零视觉疲劳 —— 暖白底、发丝边框、近黑主按钮(唯一强调色)、
- * 无渐变、无彩色、无阴影(弹层仅一丝)、Inter 全界面、克制的动效。
- * 所有页面的设计令牌收敛于此,调色只改这里。
- */
-
-export const UI_HEAD_FONTS = `
-  <link rel="preconnect" href="https://fonts.googleapis.com"/>
-  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&display=swap" rel="stylesheet"/>
-`;
-
-export const UI_THEME_CSS = `
-  :root {
-    --bg: #FCFCFB;
-    --panel: #FFFFFF;
-    --sidebar: #F7F7F5;
-    --text: #1A1A18;
-    --text-2: #6B6A66;
-    --text-3: #9C9B96;
-    --border: #ECECE8;
-    --border-soft: #F1F1EE;
-    --hover: #F4F4F1;
-    --selected: #EBEBE7;
-    --accent: #1A1A18;
-    --accent-hover: #333330;
-    --danger: #A13A33;
-    --guide: #E9E9E5;
-    --diff-add-bg: #F3F6F2;
-    --diff-add-text: #4A6741;
-    --diff-del-bg: #F8F2F1;
-    --diff-del-text: #A13A33;
-    --sans: 'Inter', -apple-system, 'Segoe UI', 'PingFang SC', 'Microsoft YaHei', sans-serif;
-    --mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-    --shadow-pop: 0 4px 20px rgba(26,26,24,.07);
-  }
-  * { box-sizing: border-box; }
-  html, body { margin: 0; height: 100%; }
-  body {
-    font-family: var(--sans);
-    background: var(--bg); color: var(--text);
-    font-size: 14px; line-height: 1.65;
-    -webkit-font-smoothing: antialiased;
-  }
-  .hidden { display: none !important; }
-  h1, h2, h3 { margin: 0; }
-  a { color: var(--text); text-decoration: none; }
-  a:hover { text-decoration: underline; }
-
-  /* 按钮:近黑实心(主)/ 发丝边幽灵(次)/ 文字型(危险) */
-  .btn {
-    display: inline-flex; align-items: center; gap: 5px;
-    padding: 6px 14px; border-radius: 8px;
-    border: 1px solid var(--border); background: var(--panel);
-    color: var(--text); font-size: 12.5px; font-weight: 500;
-    cursor: pointer; transition: all 120ms ease; text-decoration: none;
-  }
-  .btn:hover { background: var(--hover); text-decoration: none; }
-  .btn-primary {
-    background: var(--accent); border-color: var(--accent); color: #fff;
-  }
-  .btn-primary:hover { background: var(--accent-hover); border-color: var(--accent-hover); }
-  .btn-danger { border-color: transparent; background: transparent; color: var(--danger); }
-  .btn-danger:hover { background: #A13A3312; }
-
-  /* 面板与标签 */
-  .panel {
-    background: var(--panel); border: 1px solid var(--border-soft);
-    border-radius: 10px; padding: 20px 22px;
-  }
-  .tag {
-    font-size: 10.5px; font-weight: 500; font-family: var(--mono);
-    padding: 2px 8px; border-radius: 999px;
-    border: 1px solid var(--border-soft); color: var(--text-3); background: var(--panel);
-  }
-  .tag-role { color: var(--text-2); border-color: var(--border); }
-
-  /* 页签 */
-  .tabs { display: flex; gap: 2px; border-bottom: 1px solid var(--border-soft); margin-bottom: 18px; }
-  .tab {
-    padding: 8px 14px; font-size: 13px; color: var(--text-3);
-    border: none; background: none; cursor: pointer;
-    border-bottom: 2px solid transparent; margin-bottom: -1px;
-    transition: color 120ms ease;
-  }
-  .tab:hover { color: var(--text); }
-  .tab.active { color: var(--text); font-weight: 600; border-bottom-color: var(--accent); }
-
-  /* 表单 */
-  .input, .select, .textarea {
-    width: 100%; padding: 7px 11px; border-radius: 8px;
-    border: 1px solid var(--border); background: var(--panel);
-    font-size: 13px; color: var(--text); font-family: inherit;
-    outline: none; transition: border-color 120ms ease;
-  }
-  .input:focus, .select:focus, .textarea:focus { border-color: var(--accent); }
-  .textarea { font-family: var(--mono); font-size: 12.5px; line-height: 1.75; resize: vertical; }
-  .form-label { display: block; font-size: 11.5px; color: var(--text-3); margin-bottom: 4px; }
-  .form-row { margin-bottom: 12px; }
-  .inline-form { display: flex; gap: 8px; align-items: center; }
-  .inline-form .input { flex: 1; }
-
-  /* 表格 */
-  table.list { width: 100%; border-collapse: collapse; font-size: 13px; }
-  table.list th { text-align: left; font-size: 11.5px; font-weight: 500; color: var(--text-3); padding: 4px 0; }
-  table.list td { padding: 8px 0; border-top: 1px solid var(--border-soft); }
-  table.list tr:first-child td { border-top: none; }
-
-  /* 弹层 */
-  .modal-mask {
-    position: fixed; inset: 0; z-index: 40;
-    background: rgba(26,26,24,.3);
-    display: flex; align-items: center; justify-content: center; padding: 16px;
-  }
-  .modal-card {
-    width: 100%; max-width: 430px; background: var(--panel);
-    border: 1px solid var(--border-soft); border-radius: 14px; padding: 22px;
-    box-shadow: var(--shadow-pop);
-  }
-  .modal-title { font-size: 15px; font-weight: 600; margin-bottom: 14px; }
-  .modal-actions { display: flex; justify-content: flex-end; gap: 8px; margin-top: 16px; }
-  .toast {
-    border-radius: 8px; padding: 8px 16px; font-size: 12.5px; color: #fff;
-    background: #333230; max-width: 330px;
-  }
-  .toast-err { background: #7E2C26; }
-  #toast-root { position: fixed; bottom: 18px; right: 18px; z-index: 50; display: flex; flex-direction: column; gap: 8px; }
-
-  .quiet { color: var(--text-3); font-size: 12.5px; }
-  .divider { border-top: 1px solid var(--border-soft); margin: 14px 0; }
-  .section-title { font-size: 13px; font-weight: 600; margin-bottom: 10px; }
-  .section-note { font-size: 11.5px; color: var(--text-3); margin-top: 6px; }
-  .file-path { font-family: var(--mono); font-size: 12.5px; color: var(--text); }
-  .file-meta { font-size: 11px; color: var(--text-3); font-family: var(--mono); }
-  .link-danger { color: var(--danger); font-size: 12.5px; background: none; border: none; cursor: pointer; padding: 0; }
-  .link-danger:hover { text-decoration: underline; }
-`;

hub/src/deployment/bootstrap-silo.ts

@@ -250,7 +250,6 @@ async function initializeSilo(
       data: {
         organizationId: input.organization.id,
         name: "Inbox",
-        kind: "SYSTEM_INBOX",
         sortKey: "000000",
       },
     });

hub/src/feishu/card/builder.ts

@@ -12,7 +12,6 @@
  */
 
 import type { ToolUseTraceStep } from "./trace-store.js";
-import type { CardContentSegment } from "../outboundImages.js";
 
 // ---------------------------------------------------------------------------
 // Types
@@ -59,7 +58,6 @@ function toolIcon(toolName: string): string {
 export function buildAgentCard(params: {
   phase: CardPhase;
   text: string;
-  contentSegments?: readonly CardContentSegment[] | undefined;
   reasoningText: string | undefined;
   toolUseSteps: ToolUseTraceStep[];
   toolUseElapsedMs: number | undefined;
@@ -67,19 +65,19 @@ export function buildAgentCard(params: {
   interrupted: boolean | undefined;
   runId: string | undefined;
 }): Record<string, unknown> {
-  const { phase, text, contentSegments, reasoningText, toolUseSteps, toolUseElapsedMs, isError, interrupted } = params;
+  const { phase, text, reasoningText, toolUseSteps, toolUseElapsedMs, isError, interrupted } = params;
   const elements: unknown[] = [];
 
   // Tool-use panel (always present if there are steps)
   if (toolUseSteps.length > 0) {
     elements.push(buildToolUsePanel(toolUseSteps, toolUseElapsedMs, phase !== "complete"));
-  } else if (phase === "thinking" || (phase === "streaming" && text === "" && (contentSegments === undefined || contentSegments.length === 0))) {
+  } else if (phase === "thinking" || (phase === "streaming" && text === "")) {
     elements.push(buildPendingToolUsePanel());
   }
 
   // Reasoning panel
   if (reasoningText !== undefined && reasoningText !== "") {
-    if (phase === "streaming" && text === "" && (contentSegments === undefined || contentSegments.length === 0)) {
+    if (phase === "streaming" && text === "") {
       // Still thinking: show reasoning inline
       elements.push({
         tag: "markdown",
@@ -92,11 +90,12 @@ export function buildAgentCard(params: {
     }
   }
 
-  // Main answer: either materialized segments (markdown + Feishu-hosted images)
+  // Main text content
-  // or a single markdown block.
+  if (text !== "") {
-  const answerElements = buildAnswerElements(text, contentSegments);
+    elements.push({
-  if (answerElements.length > 0) {
+      tag: "markdown",
-    elements.push(...answerElements);
+      content: truncateText(text, MAX_TEXT_LENGTH),
+    });
   } else if (phase === "thinking" && toolUseSteps.length === 0 && (reasoningText === undefined || reasoningText === "")) {
     elements.push({
       tag: "markdown",
@@ -402,43 +401,6 @@ function escapeMarkdown(value: string): string {
   return value.replace(/\\/g, "\\\\").replace(/([`*_{}[\]<>])/g, "\\$1");
 }
 
-function buildAnswerElements(
-  text: string,
-  contentSegments: readonly CardContentSegment[] | undefined,
-): unknown[] {
-  if (contentSegments !== undefined && contentSegments.length > 0) {
-    const elements: unknown[] = [];
-    let remaining = MAX_TEXT_LENGTH;
-    for (const segment of contentSegments) {
-      if (segment.type === "image") {
-        elements.push({
-          tag: "img",
-          img_key: segment.imgKey,
-          alt: { tag: "plain_text", content: segment.alt },
-          mode: "fit_horizontal",
-          preview: true,
-        });
-        continue;
-      }
-      if (segment.content === "" || remaining <= 0) continue;
-      const slice = segment.content.length <= remaining
-        ? segment.content
-        : truncateText(segment.content, remaining);
-      remaining -= slice.length;
-      elements.push({
-        tag: "markdown",
-        content: slice,
-      });
-    }
-    return elements;
-  }
-  if (text === "") return [];
-  return [{
-    tag: "markdown",
-    content: truncateText(text, MAX_TEXT_LENGTH),
-  }];
-}
-
 function truncateText(value: string, maxLength: number): string {
   return value.length <= maxLength ? value : `${value.slice(0, maxLength - 3)}...`;
 }

hub/src/feishu/card/streaming-card.ts

@@ -18,13 +18,10 @@
  *   4. onToolEnd(name, id, input, result?, error?) — complete a tool step
  *   5. finish(finalText)    — flush + transition to complete card
  *   6. fail(errorText)      — flush + transition to error card
- *
- * On finish, markdown image references (`![](url|path)`) are downloaded /
- * read, uploaded to Feishu as message images, and embedded as native card
- * `img` elements so external URLs never hit Feishu content-security checks.
  */
+
 import type { FeishuRuntime, SendMessageOptions } from "../client.js";
-import { sendCard, patchCard, sendText, sendLongText } from "../client.js";
+import { sendCard, patchCard, sendText } from "../client.js";
 import { DEFAULT_MAX_MESSAGE_LENGTH, splitAtBoundary } from "../textStream.js";
 import {
   startToolUseTraceRun,
@@ -34,12 +31,6 @@ import {
   getToolUseTraceSteps,
 } from "./trace-store.js";
 import { buildAgentCard, type CardPhase } from "./builder.js";
-import {
-  type CardContentSegment,
-  maskMarkdownImagesForStreaming,
-  materializeAnswerSegments,
-  sendImageMessage,
-} from "../outboundImages.js";
 
 export interface StreamingCardSink {
   readonly create: (card: Record<string, unknown>) => Promise<string | null>;
@@ -53,11 +44,6 @@ export interface StreamingCardOptions {
   readonly sendOptions?: SendMessageOptions | undefined;
   readonly patchIntervalMs: number | undefined;
   readonly maxMessageLength: number | undefined;
-  /** Project workspace root; required to resolve local image paths. */
-  readonly workspaceRoot?: string | undefined;
-  /** Project workspace directory; required to resolve local image paths. */
-  readonly workspaceDir?: string | undefined;
-  readonly maxImageBytes?: number | undefined;
 }
 
 const DEFAULT_PATCH_INTERVAL_MS = 400;
@@ -79,9 +65,6 @@ export class StreamingAgentCard {
   private readonly sendOptions: SendMessageOptions | undefined;
   private readonly patchIntervalMs: number;
   private readonly maxMessageLength: number;
-  private readonly workspaceRoot: string | undefined;
-  private readonly workspaceDir: string | undefined;
-  private readonly maxImageBytes: number | undefined;
 
   constructor(options: StreamingCardOptions) {
     this.runId = options.runId;
@@ -90,9 +73,6 @@ export class StreamingAgentCard {
     this.sendOptions = options.sendOptions;
     this.patchIntervalMs = options.patchIntervalMs ?? DEFAULT_PATCH_INTERVAL_MS;
     this.maxMessageLength = options.maxMessageLength ?? DEFAULT_MAX_MESSAGE_LENGTH;
-    this.workspaceRoot = options.workspaceRoot;
-    this.workspaceDir = options.workspaceDir;
-    this.maxImageBytes = options.maxImageBytes;
     startToolUseTraceRun(this.runId);
   }
 
@@ -126,43 +106,23 @@ export class StreamingAgentCard {
     recordToolUseEnd({ runId: this.runId, ...params });
     this.scheduleFlush();
   }
-
+  async finish(fallbackText: string, options: { readonly interrupted?: boolean; readonly footerText?: string | undefined } = {}): Promise<void> {
-  async finish(
-    fallbackText: string,
-    options: { readonly interrupted?: boolean; readonly footerText?: string | undefined } = {},
-  ): Promise<void> {
     await this.flushChain;
     this.interrupted = options.interrupted === true;
     const footerText = options.footerText ?? "";
     const fallbackWithFooter = appendFooter(fallbackText, footerText);
     try {
-      let answerText =
-        this.text.length > 0 ? appendFooter(this.text, footerText) : fallbackWithFooter;
-      this.text = answerText;
-
-      const { segments, unresolved } = await materializeAnswerSegments(answerText, {
-        rt: this.rt,
-        workspaceRoot: this.workspaceRoot,
-        workspaceDir: this.workspaceDir,
-        maxImageBytes: this.maxImageBytes,
-      });
-      if (unresolved.length > 0) {
-        this.rt.logger.warn(
-          { runId: this.runId, unresolvedCount: unresolved.length, unresolved: unresolved.slice(0, 5) },
-          "some answer images could not be uploaded to Feishu",
-        );
-      }
-
       let updated = true;
-      if (answerText.length > 0 || segments.length > 0) {
+      if (this.text.length > 0) {
-        updated = await this.flushCard("complete", answerText, false, segments);
+        this.text = appendFooter(this.text, footerText);
+        updated = await this.flushCard("complete", this.text);
+      } else if (this.currentMessageId === null && fallbackWithFooter.length > 0) {
+        // No streaming text was sent. If we never created a card, send one now.
+        this.text = fallbackWithFooter;
+        updated = await this.flushCard("complete", this.text);
       } else if (this.currentMessageId !== null) {
-        updated = await this.flushCard("complete", "", false, []);
+        // Patch the existing card with the final text.
-      }
+        updated = await this.flushCard("complete", fallbackWithFooter);
-
-      if (!updated) {
-        // Card path failed (e.g. residual content policy). Deliver text + standalone images.
-        updated = await this.deliverPlainFallback(segments, answerText);
       }
       if (!updated && this.interrupted) {
         await sendText(this.rt, this.chatId, "\u5DF2\u4E2D\u65AD\u5F53\u524D\u8FD0\u884C\u3002", this.sendOptions);
@@ -206,30 +166,15 @@ export class StreamingAgentCard {
     return this.flushCard(this.currentPhase(), this.text);
   }
 
-  private async flushCard(
+  private async flushCard(phase: CardPhase, text: string, isError = false): Promise<boolean> {
-    phase: CardPhase,
+    const chunks = splitAtBoundary(text, this.maxMessageLength);
-    text: string,
+    const firstChunk = chunks[0];
-    isError = false,
+    if (firstChunk === undefined) return true;
-    contentSegments?: readonly CardContentSegment[],
-  ): Promise<boolean> {
-    // During live streaming, strip image URLs so Feishu never fetches remote
-    // ranks mid-run. Materialized segments are only used on the complete pass.
-    const displayText =
-      phase === "complete" && contentSegments !== undefined
-        ? text
-        : maskMarkdownImagesForStreaming(text);
 
-    const chunks = splitAtBoundary(displayText, this.maxMessageLength);
-    const firstChunk = chunks[0] ?? "";
-    // When we have segments (complete+images), keep first-card complete content
-    // on segments only; overflow text (rare) falls back to plain chunked cards.
     const toolUseSteps = getToolUseTraceSteps(this.runId);
     const card = buildAgentCard({
       phase,
-      text: contentSegments !== undefined && contentSegments.length > 0 ? "" : firstChunk,
+      text: firstChunk,
-      contentSegments: contentSegments !== undefined && contentSegments.length > 0
-        ? contentSegments
-        : undefined,
       reasoningText: this.reasoningText || undefined,
       toolUseSteps,
       toolUseElapsedMs: this.toolUseElapsedMs,
@@ -241,30 +186,7 @@ export class StreamingAgentCard {
     if (this.currentMessageId === null) {
       this.currentMessageId = await sendCard(this.rt, this.chatId, card, this.sendOptions);
       let updated = this.currentMessageId !== null;
-      // Send overflow chunks as new messages (rare for agent output). Segments
+      // Send overflow chunks as new messages (rare for agent output)
-      // already include the whole answer; only plain text overflows.
-      if (contentSegments === undefined || contentSegments.length === 0) {
-        for (const chunk of chunks.slice(1)) {
-          const overflowCard = buildAgentCard({
-            phase,
-            text: chunk,
-            reasoningText: undefined,
-            toolUseSteps: [],
-            toolUseElapsedMs: undefined,
-            isError,
-            interrupted: this.interrupted,
-            runId: undefined,
-          });
-          const overflowMessageId = await sendCard(this.rt, this.chatId, overflowCard, this.sendOptions);
-          updated = updated && overflowMessageId !== null;
-          this.currentMessageId = overflowMessageId;
-        }
-      }
-      return updated;
-    }
-
-    let updated = await patchCard(this.rt, this.currentMessageId, card);
-    if (contentSegments === undefined || contentSegments.length === 0) {
       for (const chunk of chunks.slice(1)) {
         const overflowCard = buildAgentCard({
           phase,
@@ -280,50 +202,27 @@ export class StreamingAgentCard {
         updated = updated && overflowMessageId !== null;
         this.currentMessageId = overflowMessageId;
       }
-    }
+      return updated;
-    return updated;
+    } else {
-  }
+      let updated = await patchCard(this.rt, this.currentMessageId, card);
-
+      // For overflow, create new messages
-  private async deliverPlainFallback(
+      for (const chunk of chunks.slice(1)) {
-    segments: readonly CardContentSegment[],
+        const overflowCard = buildAgentCard({
-    answerText: string,
+          phase,
-  ): Promise<boolean> {
+          text: chunk,
-    const textParts: string[] = [];
+          reasoningText: undefined,
-    const imageKeys: string[] = [];
+          toolUseSteps: [],
-    if (segments.length > 0) {
+          toolUseElapsedMs: undefined,
-      for (const segment of segments) {
+          isError,
-        if (segment.type === "markdown") {
+          interrupted: this.interrupted,
-          if (segment.content.trim() !== "") textParts.push(segment.content);
+          runId: undefined,
-        } else {
+        });
-          imageKeys.push(segment.imgKey);
+        const overflowMessageId = await sendCard(this.rt, this.chatId, overflowCard, this.sendOptions);
-        }
+        updated = updated && overflowMessageId !== null;
+        this.currentMessageId = overflowMessageId;
       }
-    } else if (answerText.trim() !== "") {
+      return updated;
-      textParts.push(maskMarkdownImagesForStreaming(answerText));
     }
-
-    let any = false;
-    if (textParts.length > 0) {
-      const messageId = await sendLongText(
-        this.rt,
-        this.chatId,
-        textParts.join("\n\n"),
-        this.sendOptions,
-      );
-      any = messageId !== null;
-    }
-    for (const imageKey of imageKeys) {
-      try {
-        const messageId = await sendImageMessage(this.rt, this.chatId, imageKey, this.sendOptions);
-        any = any || messageId !== null;
-      } catch (error) {
-        this.rt.logger.warn(
-          { runId: this.runId, err: error instanceof Error ? error.message : String(error) },
-          "standalone image fallback failed",
-        );
-      }
-    }
-    return any;
   }
 
   private currentPhase(): CardPhase {
@@ -336,5 +235,5 @@ export class StreamingAgentCard {
 function appendFooter(text: string, footerText: string): string {
   if (footerText === "") return text;
   if (text === "") return footerText;
-  return `${text}\n\n${footerText}`;
+  return `${text.trimEnd()}\n\n${footerText}`;
 }

hub/src/feishu/client.ts

@@ -316,8 +316,7 @@ export async function sendCard(
       { msgType: "interactive", content: JSON.stringify(card) },
       options,
     );
-  } catch (e) {
+  } catch {
-    rt.logger.warn({ chatId, err: errorText(e) }, "sendCard failed");
     return null;
   }
 }
@@ -335,7 +334,7 @@ export async function patchCard(rt: FeishuRuntime, messageId: string, card: Reco
     });
     return true;
   } catch (e) {
-    rt.logger.warn({ messageId, err: errorText(e) }, "patchCard failed");
+    rt.logger.warn({ messageId, err: e instanceof Error ? e.message : String(e) }, "patchCard failed");
     return false;
   }
 }

hub/src/feishu/outboundImages.ts

@@ -1,389 +0,0 @@
-/**
- * Resolve markdown image references in agent answers into Feishu-hosted
- * image_keys so cards can embed them without remote URLs (which trip Feishu
- * content-security controls).
- */
-import { isIP } from "node:net";
-import type { FeishuRuntime } from "./client.js";
-import { withRetry } from "./client.js";
-import {
-  WorkspaceFileBoundaryError,
-  readWorkspaceFileNoFollow,
-} from "../security/workspaceFiles.js";
-
-export const FEISHU_MAX_IMAGE_BYTES = 10 * 1024 * 1024;
-export const DEFAULT_MAX_OUTBOUND_IMAGES = 10;
-
-const IMAGE_MARKDOWN_RE = /!\[([^\]\n]*)\]\(([^)\n]+)\)/g;
-const FENCED_CODE_RE = /```[\s\S]*?```/g;
-
-export type CardContentSegment =
-  | { readonly type: "markdown"; readonly content: string }
-  | { readonly type: "image"; readonly imgKey: string; readonly alt: string };
-
-export interface MarkdownImageRef {
-  readonly fullMatch: string;
-  readonly alt: string;
-  readonly src: string;
-  readonly index: number;
-  readonly length: number;
-}
-
-export interface OutboundImageContext {
-  readonly rt: FeishuRuntime;
-  readonly workspaceRoot?: string | undefined;
-  readonly workspaceDir?: string | undefined;
-  readonly maxImageBytes?: number | undefined;
-  readonly maxImages?: number | undefined;
-  readonly fetchImpl?: typeof fetch | undefined;
-}
-
-type ImageCreateResponse = {
-  image_key?: string;
-  data?: { image_key?: string };
-} | null;
-
-type MessageCreateResponse = {
-  message_id?: string;
-  data?: { message_id?: string };
-} | null;
-
-/** Streaming-safe view: drop markdown image URLs so partial cards do not hit Feishu URL checks. */
-export function maskMarkdownImagesForStreaming(text: string): string {
-  return rewriteMarkdownImagesOutsideCode(text, (ref) => {
-    const alt = ref.alt.trim();
-    return alt === "" ? "\u3010\u56fe\u7247\u3011" : alt;
-  });
-}
-
-export function findMarkdownImagesOutsideCode(text: string): MarkdownImageRef[] {
-  const blocked = blockedRanges(text);
-  const refs: MarkdownImageRef[] = [];
-  IMAGE_MARKDOWN_RE.lastIndex = 0;
-  let match: RegExpExecArray | null;
-  while ((match = IMAGE_MARKDOWN_RE.exec(text)) !== null) {
-    const index = match.index;
-    if (blocked.some((range) => index >= range.start && index < range.end)) continue;
-    const fullMatch = match[0];
-    const alt = match[1] ?? "";
-    const rawSrc = (match[2] ?? "").trim();
-    const src = stripUrlTitle(rawSrc);
-    if (src === "") continue;
-    refs.push({ fullMatch, alt, src, index, length: fullMatch.length });
-  }
-  return refs;
-}
-
-/**
- * Upload reachable markdown images and split the answer into card segments
- * (markdown + Feishu img elements). Unresolved images become visible alt text.
- */
-export async function materializeAnswerSegments(
-  text: string,
-  ctx: OutboundImageContext,
-): Promise<{ segments: CardContentSegment[]; unresolved: string[] }> {
-  const refs = findMarkdownImagesOutsideCode(text);
-  if (refs.length === 0) {
-    return {
-      segments: text === "" ? [] : [{ type: "markdown", content: text }],
-      unresolved: [],
-    };
-  }
-
-  const maxImages = ctx.maxImages ?? DEFAULT_MAX_OUTBOUND_IMAGES;
-  const maxBytes = ctx.maxImageBytes ?? FEISHU_MAX_IMAGE_BYTES;
-  const keyBySrc = new Map<string, string>();
-  const unresolved: string[] = [];
-  const uniqueSrcs: string[] = [];
-  for (const ref of refs) {
-    if (!uniqueSrcs.includes(ref.src)) uniqueSrcs.push(ref.src);
-  }
-
-  for (const src of uniqueSrcs.slice(0, maxImages)) {
-    try {
-      const bytes = await resolveOutboundImageBytes(src, ctx, maxBytes);
-      if (bytes === null) {
-        unresolved.push(src);
-        continue;
-      }
-      const imageKey = await uploadMessageImage(ctx.rt, bytes);
-      keyBySrc.set(src, imageKey);
-    } catch (error) {
-      ctx.rt.logger.warn(
-        { src, err: error instanceof Error ? error.message : String(error) },
-        "outbound image materialize failed",
-      );
-      unresolved.push(src);
-    }
-  }
-  for (const src of uniqueSrcs.slice(maxImages)) {
-    unresolved.push(src);
-  }
-
-  const segments: CardContentSegment[] = [];
-  let cursor = 0;
-  for (const ref of refs) {
-    if (ref.index > cursor) {
-      pushMarkdown(segments, text.slice(cursor, ref.index));
-    }
-    const imageKey = keyBySrc.get(ref.src);
-    if (imageKey !== undefined) {
-      segments.push({
-        type: "image",
-        imgKey: imageKey,
-        alt: ref.alt.trim() === "" ? "\u56fe\u7247" : ref.alt.trim(),
-      });
-    } else {
-      const alt = ref.alt.trim();
-      pushMarkdown(segments, alt === "" ? "\u3010\u56fe\u7247\u3011" : alt);
-    }
-    cursor = ref.index + ref.length;
-  }
-  if (cursor < text.length) {
-    pushMarkdown(segments, text.slice(cursor));
-  }
-  return { segments, unresolved };
-}
-
-export async function uploadMessageImage(rt: FeishuRuntime, image: Buffer): Promise<string> {
-  if (image.byteLength === 0) {
-    throw new Error("image is empty");
-  }
-  if (image.byteLength > FEISHU_MAX_IMAGE_BYTES) {
-    throw new Error(`image exceeds Feishu limit of ${FEISHU_MAX_IMAGE_BYTES} bytes`);
-  }
-  const client = rt.client as unknown as {
-    im: { v1: { image: { create: (p: unknown) => Promise<ImageCreateResponse> } } };
-  };
-  const res = await withRetry(async () =>
-    client.im.v1.image.create({
-      data: { image_type: "message", image },
-    }),
-  );
-  const imageKey = res?.image_key ?? res?.data?.image_key;
-  if (imageKey === undefined || imageKey === "") {
-    throw new Error("Feishu image upload response is missing image_key");
-  }
-  return imageKey;
-}
-
-/** Send a standalone image message (fallback if card embed is unavailable). */
-export async function sendImageMessage(
-  rt: FeishuRuntime,
-  chatId: string,
-  imageKey: string,
-  options?: { readonly replyToMessageId?: string | undefined },
-): Promise<string | null> {
-  const client = rt.client as unknown as {
-    im: {
-      v1: {
-        message: {
-          create: (p: unknown) => Promise<MessageCreateResponse>;
-          reply: (p: unknown) => Promise<MessageCreateResponse>;
-        };
-      };
-    };
-  };
-  const replyTo = options?.replyToMessageId;
-  if (replyTo !== undefined && replyTo !== "") {
-    const res = await client.im.v1.message.reply({
-      path: { message_id: replyTo },
-      data: { msg_type: "image", content: JSON.stringify({ image_key: imageKey }) },
-    });
-    return res?.data?.message_id ?? res?.message_id ?? null;
-  }
-  const res = await client.im.v1.message.create({
-    params: { receive_id_type: "chat_id" },
-    data: {
-      receive_id: chatId,
-      msg_type: "image",
-      content: JSON.stringify({ image_key: imageKey }),
-    },
-  });
-  return res?.data?.message_id ?? res?.message_id ?? null;
-}
-
-export async function resolveOutboundImageBytes(
-  src: string,
-  ctx: OutboundImageContext,
-  maxBytes: number,
-): Promise<Buffer | null> {
-  if (isRemoteUrl(src)) {
-    return fetchRemoteImage(src, ctx.fetchImpl ?? fetch, maxBytes);
-  }
-  const root = ctx.workspaceRoot?.trim();
-  const dir = ctx.workspaceDir?.trim();
-  if (root === undefined || root === "" || dir === undefined || dir === "") {
-    return null;
-  }
-  try {
-    const file = await readWorkspaceFileNoFollow(root, dir, src, maxBytes);
-    return file.data;
-  } catch (error) {
-    if (error instanceof WorkspaceFileBoundaryError && error.reason === "not_found") {
-      return null;
-    }
-    throw error;
-  }
-}
-
-function rewriteMarkdownImagesOutsideCode(
-  text: string,
-  replace: (ref: MarkdownImageRef) => string,
-): string {
-  const refs = findMarkdownImagesOutsideCode(text);
-  if (refs.length === 0) return text;
-  let out = "";
-  let cursor = 0;
-  for (const ref of refs) {
-    out += text.slice(cursor, ref.index);
-    out += replace(ref);
-    cursor = ref.index + ref.length;
-  }
-  out += text.slice(cursor);
-  return out;
-}
-
-function pushMarkdown(segments: CardContentSegment[], content: string): void {
-  if (content === "") return;
-  const last = segments[segments.length - 1];
-  if (last !== undefined && last.type === "markdown") {
-    segments[segments.length - 1] = { type: "markdown", content: last.content + content };
-    return;
-  }
-  segments.push({ type: "markdown", content });
-}
-
-function blockedRanges(text: string): Array<{ start: number; end: number }> {
-  const ranges: Array<{ start: number; end: number }> = [];
-  FENCED_CODE_RE.lastIndex = 0;
-  let match: RegExpExecArray | null;
-  while ((match = FENCED_CODE_RE.exec(text)) !== null) {
-    ranges.push({ start: match.index, end: match.index + match[0].length });
-  }
-  return ranges;
-}
-
-function stripUrlTitle(raw: string): string {
-  const trimmed = raw.trim();
-  // Markdown optional title: url "title" or url 'title'
-  const titled = /^(\S+)\s+(".*"|'.*')$/.exec(trimmed);
-  return (titled?.[1] ?? trimmed).trim();
-}
-
-function isRemoteUrl(src: string): boolean {
-  try {
-    const url = new URL(src);
-    return url.protocol === "http:" || url.protocol === "https:";
-  } catch {
-    return false;
-  }
-}
-
-async function fetchRemoteImage(
-  src: string,
-  fetchImpl: typeof fetch,
-  maxBytes: number,
-): Promise<Buffer | null> {
-  let url: URL;
-  try {
-    url = new URL(src);
-  } catch {
-    return null;
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-  if (!isPublicHttpHost(url.hostname)) return null;
-
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), 15_000);
-  try {
-    const response = await fetchImpl(url, {
-      method: "GET",
-      redirect: "manual",
-      signal: controller.signal,
-      headers: { accept: "image/*,*/*;q=0.8" },
-    });
-    // One safe redirect hop to another public http(s) host.
-    if (response.status >= 300 && response.status < 400) {
-      const location = response.headers.get("location");
-      if (location === null || location === "") return null;
-      let redirected: URL;
-      try {
-        redirected = new URL(location, url);
-      } catch {
-        return null;
-      }
-      if (redirected.protocol !== "http:" && redirected.protocol !== "https:") return null;
-      if (!isPublicHttpHost(redirected.hostname)) return null;
-      const second = await fetchImpl(redirected, {
-        method: "GET",
-        redirect: "manual",
-        signal: controller.signal,
-        headers: { accept: "image/*,*/*;q=0.8" },
-      });
-      return readImageBody(second, maxBytes);
-    }
-    return readImageBody(response, maxBytes);
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-async function readImageBody(response: Response, maxBytes: number): Promise<Buffer | null> {
-  if (!response.ok) return null;
-  const contentType = (response.headers.get("content-type") ?? "").toLowerCase();
-  if (
-    contentType !== "" &&
-    !contentType.startsWith("image/") &&
-    !contentType.includes("octet-stream") &&
-    (contentType.startsWith("text/") || contentType.includes("json") || contentType.includes("html"))
-  ) {
-    return null;
-  }
-  const contentLength = Number(response.headers.get("content-length") ?? "NaN");
-  if (Number.isFinite(contentLength) && contentLength > maxBytes) return null;
-  const buf = Buffer.from(await response.arrayBuffer());
-  if (buf.byteLength === 0 || buf.byteLength > maxBytes) return null;
-  return buf;
-}
-
-function isPublicHttpHost(hostname: string): boolean {
-  const host = hostname.trim().toLowerCase().replace(/\.$/, "");
-  if (host === "" || host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local")) {
-    return false;
-  }
-  if (host === "0.0.0.0" || host === "::" || host === "[::]" || host === "::1" || host === "[::1]") {
-    return false;
-  }
-  const unbracketed = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-  const ipVersion = isIP(unbracketed);
-  if (ipVersion === 4) return !isPrivateIPv4(unbracketed);
-  if (ipVersion === 6) return !isPrivateIPv6(unbracketed);
-  return true;
-}
-
-function isPrivateIPv4(ip: string): boolean {
-  const parts = ip.split(".").map((part) => Number(part));
-  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
-    return true;
-  }
-  const a = parts[0]!;
-  const b = parts[1]!;
-  if (a === 10 || a === 127 || a === 0) return true;
-  if (a === 169 && b === 254) return true;
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  if (a === 192 && b === 168) return true;
-  if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT
-  if (a >= 224) return true; // multicast / reserved
-  return false;
-}
-
-function isPrivateIPv6(ip: string): boolean {
-  const normalized = ip.toLowerCase();
-  if (normalized === "::1") return true;
-  if (normalized.startsWith("fc") || normalized.startsWith("fd")) return true; // unique local
-  if (normalized.startsWith("fe80:")) return true; // link-local
-  const mapped = /^:ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(normalized);
-  if (mapped?.[1] !== undefined) return isPrivateIPv4(mapped[1]);
-  return false;
-}

hub/src/feishu/trigger.ts

@@ -496,9 +496,6 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       sendOptions,
       patchIntervalMs: undefined,
       maxMessageLength: undefined,
-      workspaceRoot: projectWorkspaceRoot,
-      workspaceDir: project.workspaceDir,
-      maxImageBytes: deps.resourceLimits?.maxBytesPerFile,
     });
     const fileDeliveryMcpServer = createFileDeliveryMcpServer({
       rt,

hub/src/hub.ts

@@ -1,6 +1,5 @@
 import Fastify from "fastify";
 import { registerAdminPlugin } from "./admin/plugin.js";
-import { registerDatabasePlugin } from "./database/plugin.js";
 import { prisma } from "./db.js";
 import { createLarkClient, startFeishuListenerWithClient } from "./feishu/client.js";
 import { archiveFeishuBindingForLifecycleEvent } from "./feishu/bindingLifecycle.js";
@@ -144,14 +143,6 @@ export async function startHub(): Promise<void> {
     secretEnvelope,
   });
 
-  // `/database/*` surface. Registered after the admin plugin so the
-  // @fastify/cookie parser and /auth/* login routes are already available.
-  await registerDatabasePlugin(app, {
-    prisma,
-    sessionSecret,
-    siloOrganizationSlug: siloOrganization.slug,
-  });
-
   const feishuListenerEnabled = booleanEnv("HUB_FEISHU_LISTENER_ENABLED", true);
   if (feishuListenerEnabled) {
     const feishuConfig = {