feat(database): 后台成员组(MemberGroup)管理与嵌套解析

新建根目录/子节点弹窗的「创建」按钮 onclick 调 window.__lib.submitCreate,
但该函数虽已定义却漏挂到 __lib 导出表,导致点击报 "submitCreate is not
a function"。补挂即可。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/checker-check.yml

@@ -1,12 +1,12 @@
 name: checker check
 
 # Builds and lints the Rust implementation crates under crates/ (the rule-based
-# checker that "stands in Lean's position" at product runtime).
+# lesson checker).
 #
-# Like spec-check, this is an INTERNAL gate on the implementation's own health
-# (does it build, pass its tests, satisfy clippy + rustfmt?). It is NOT a
-# spec-to-implementation conformance gate — implementations align to the Lean
-# contract by human review, not by CI. See the repo README.
+# This is an INTERNAL gate on the implementation's own health
+# (does it build, pass its tests, satisfy clippy + rustfmt?). There is no
+# decision-to-implementation conformance gate — implementations align to the
+# ADRs by human review, not by CI. See the repo README.
 
 on:
   push:

.gitea/workflows/hub-check.yml

@@ -1,8 +1,8 @@
 name: hub check
 
 # Builds, type-checks, and tests the Hub TS package under hub/.
-# The Hub is the Feishu-group collaboration + agent runtime half
-# (spec/System implementation). This is an INTERNAL gate on the Hub's own
+# The Hub is the Feishu-group collaboration + agent runtime half.
+# This is an INTERNAL gate on the Hub's own
 # health, like checker-check is for the Rust half.
 
 on:

.gitea/workflows/spec-check.yml

@@ -1,20 +0,0 @@
-name: spec check
-
-# Builds the Lean semantic master spec under spec/.
-# This is an INTERNAL well-formedness gate (does the contract type-check?),
-# NOT a spec-to-implementation conformance gate — implementations align to the
-# contract by human review, not by CI. See repo README.
-
-on:
-  push:
-  pull_request:
-  workflow_dispatch:
-
-jobs:
-  spec-check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      - uses: leanprover/lean-action@v1
-        with:
-          lake-package-directory: spec

.gitignore

@@ -1,7 +1,3 @@
-# Lean / Lake build artifacts (spec/ has its own .gitignore too)
-.lake/
-**/.lake/
-
 # Rust / Cargo build artifacts (repo-wide cargo workspace at root)
 /target
 **/*.pdf

.omo/run-continuation/ses_0705f8afbffePWIq7GrFfwfFwV.json

@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_0705f8afbffePWIq7GrFfwfFwV",
+  "updatedAt": "2026-07-23T15:40:15.630Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-23T15:40:15.630Z"
+    }
+  }
+}

.omo/run-continuation/ses_07252990dffeRFmXnvdyynty2z.json

@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_07252990dffeRFmXnvdyynty2z",
+  "updatedAt": "2026-07-23T06:33:33.086Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-23T06:33:33.086Z"
+    }
+  }
+}

.omo/run-continuation/ses_075d214a0ffe6mU8VNgukUfH5L.json

@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_075d214a0ffe6mU8VNgukUfH5L",
+  "updatedAt": "2026-07-22T14:15:01.741Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-22T14:15:01.741Z"
+    }
+  }
+}

.omo/run-continuation/ses_075d3282bffejz0HFE00taOaGM.json

@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_075d3282bffejz0HFE00taOaGM",
+  "updatedAt": "2026-07-22T14:13:54.785Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-22T14:13:54.785Z"
+    }
+  }
+}

.omo/run-continuation/ses_0781484caffeKJHXVKiD4BqEJw.json

@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_0781484caffeKJHXVKiD4BqEJw",
+  "updatedAt": "2026-07-22T06:17:18.238Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-22T06:17:18.238Z"
+    }
+  }
+}

.omo/run-continuation/ses_07b163c13ffeudULxSfIfK986T.json

@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_07b163c13ffeudULxSfIfK986T",
+  "updatedAt": "2026-07-21T13:55:58.878Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-21T13:55:58.878Z"
+    }
+  }
+}

.omo/run-continuation/ses_07b1e6c8effeq7bdmj6NgO0LqC.json

@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_07b1e6c8effeq7bdmj6NgO0LqC",
+  "updatedAt": "2026-07-21T13:38:01.132Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-21T13:38:01.132Z"
+    }
+  }
+}

.omo/run-continuation/ses_07b932dddffecSipFLwlJOvoJ9.json

@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_07b932dddffecSipFLwlJOvoJ9",
+  "updatedAt": "2026-07-21T11:27:10.420Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-21T11:27:10.420Z"
+    }
+  }
+}

.omo/run-continuation/ses_07b9c4268ffeic4mMXCPUt225j.json

@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_07b9c4268ffeic4mMXCPUt225j",
+  "updatedAt": "2026-07-21T11:18:53.449Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-21T11:18:53.449Z"
+    }
+  }
+}

.omo/run-continuation/ses_07b9c4346ffeVBdV5pf4h6s9PW.json

@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_07b9c4346ffeVBdV5pf4h6s9PW",
+  "updatedAt": "2026-07-21T11:18:29.979Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-21T11:18:29.979Z"
+    }
+  }
+}

.omo/run-continuation/ses_07b9c9a75ffeOyJ4ewp3DBvXhz.json

@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_07b9c9a75ffeOyJ4ewp3DBvXhz",
+  "updatedAt": "2026-07-21T11:21:09.776Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-21T11:21:09.776Z"
+    }
+  }
+}

.omo/run-continuation/ses_07cdbac0effeiBrdcHLUUUfwuF.json

@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_07cdbac0effeiBrdcHLUUUfwuF",
+  "updatedAt": "2026-07-23T15:37:59.918Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-23T15:37:59.918Z"
+    }
+  }
+}

.omo/文件库-开工计划.md

@@ -0,0 +1,114 @@
+# 文件库 · 开工计划（v1.0）
+
+> 配套文档：《文件库-接口契约.md》(v0.1，仓库根目录)。本计划已吸收规划顾问评审意见，包含开工前必须先冻结的**架构收口决策 D11–D19**（回写契约 v0.2 时并入）。
+> 工期按 1 人全栈估算；前端从 Phase 2 后可并行。
+
+## 开工判定
+
+**可以开工。** 四个外部依赖（版本包 / Group / 审计 / 平台身份）全部有契约可依、可 mock 并行开发；无阻塞项。唯一前置：本文件的 D11–D19 决策在写第一行 schema 前过一遍（半天，自查即可，有异议再升级）。
+
+## 架构收口决策（新增，先冻结再动工）
+
+| 编号 | 决策 | 理由 |
+|---|---|---|
+| D11 | `creator` 是 Node 的**不可变列**，创建时同时落一条 Manage grant；独立权限开关关闭时，**creator 的 Manage 仍生效**，其余项目级 grant 冻结不参与计算 | 否则 creator 可能被自己关掉的开关锁死 |
+| D12 | 移动节点授权 = **本节点 Manage + 目标父 Edit+**；移动在事务 + Postgres 咨询锁内完成，防并发成环 | 预检环检测在并发下不安全 |
+| D13 | Group resolve 失败返回 **503**（不伪装 404/403）；每次 HTTP 请求 fresh resolve，不跨请求缓存；单请求内多次校验合并为一次调用（此点与 Group 团队确认，OPEN-9） | 依赖故障 ≠ 无权限；契约 G4 要求实时 |
+| D14 | 命名规则：NFC 归一化、trim、≤128 字符、禁 `/` 与控制字符；**活跃兄弟节点大小写不敏感唯一**；根节点全局唯一 | 缺命名规则必有脏数据 |
+| D15 | 删除 = 只给被删节点打标，后代**不递归打标**，靠"任一祖先已删"过滤；所有查询链路强制此过滤（含递归 SQL，不只靠 Prisma middleware） | 递归打标的写放大与恢复复杂度不可控 |
+| D16 | `baseVersion` 为**文件级版本**（GET file 返回的 version）；无关文件的提交不产生冲突 | 与 C1 `head(dir, filePath)` 语义一致 |
+| D17 | breadcrumb 只暴露用户有 View 的祖先名称；无权限祖先显示占位符 `…`，不暴露名字 | 404 不泄露语义（D8）延伸到面包屑 |
+| D18 | v1 **单副本部署**（git 仓库在本地磁盘）；多副本需共享存储或分片，后置 | 不解决不存在的扩展问题 |
+| D19 | 网站管理员**不隐式读内容**；force_adjust 凭 node id 操作（id 从审计或用户上报获得） | C4 已定的最小权限原则 |
+
+## 阶段计划
+
+### Phase 0 · 骨架与身份先行（1–2 天）
+
+- [ ] 过 D11–D19，回写契约 v0.2
+- [ ] repo 骨架 `server/` + `web/`，Postgres docker-compose，CI（lint / typecheck / vitest / 集成测试用真实 Postgres service container）
+- [ ] **JWT 中间件 + 本地 JWKS 测试服务 + 签名 token fixtures**（有效/过期/错 issuer/错 audience/错算法/未知 kid/轮换）——身份先行，不做"宽松 mock 身份"
+- [ ] 4 个 port 接口定义 + mock：`VersionStore`、`GroupResolver`、`AuditSink`（直写 outbox 表的实现就是真的，mock 的是对端服务）、`ExportAdapter`
+- [ ] fastify-swagger 接入，OpenAPI 骨架——**OpenAPI 随每个端点同步产出，不留到最后**
+- **验收**：骨架可 `pnpm dev` 起服务；本地 JWKS 六类 token fixture（有效/过期/错 issuer/错 audience/错算法/未知 kid）中间件行为全对；CI 流水线绿
+
+### Phase 1 · 数据模型与权限引擎（2–3 天）⚑ 心脏
+
+- [ ] Prisma schema：`Node`（parentId **权威** + id 编码的 materialized path 派生列，name 不入 path）、`Grant`、`ProjectIndependentSettings`、`OutboxEvent`（含 attempts/nextAttemptAt/lease/lastError，relay 字段一次到位）、`ExportJob`
+- [ ] 数据库约束：kind 枚举、项目无子节点、活跃兄弟名唯一（部分唯一索引，root 的 NULL parent 特殊处理）、活跃 grant 按 (nodeId, principalType, principalId) 唯一、独立设置仅项目
+- [ ] **纯权限 reducer**：输入已解析的 grants + 祖先链 + 用户组集合，输出 role|null；不碰 DB/网络。fast-check 属性测试：max 单调、加 grant 只升不降、祖先继承、toggle 行为、顺序无关、软删过滤
+- [ ] 数据获取层 + `effective(user, node)` 组装
+- [ ] 树操作服务：create（creator 自动 Manage、root 仅管理员且必带 ≥1 Manage）、rename、move（D12 事务+咨询锁）、soft delete（D15）、breadcrumb（D17）
+- **验收**：并发对移（A→B 与 B→A）、移动+并发建子、property tests、删除祖先过滤，真实 Postgres 全绿
+
+### Phase 2 · 树与授权 API（1–2 天）
+
+- [ ] nodes 端点组 + grants 端点组 + independent-permission 开关 + effective-permission 自查
+- [ ] 授权矩阵校验（契约 8.1：creator-only 授 Manage、Manage 不可动 creator、force_adjust 独立通道）
+- [ ] 全部写操作落 outbox 事件（C3 词汇表）
+- **验收**：契约 8.1 矩阵逐格 API 测试；D8 的 404/403/503 三分语义测试
+
+### Phase 3 · 仓库生命周期与文件 API（2 天）
+
+- [ ] 项目 provisioning 状态机 `PROVISIONING → READY | FAILED`：先建 DB 行（PROVISIONING）→ 调 `VersionStore.init`（幂等）→ 置 READY；失败可重试；孤儿仓库对账 job
+- [ ] 每项目写锁（Postgres 咨询锁，跨进程安全）——不假设版本包能跨进程串行
+- [ ] 路径安全：canonical 后必须落在项目根内、拒绝 `.git`、禁 symlink 逃逸、路径长度上限
+- [ ] 上传限额（单文件 10MB / 单项目配额，数值 OPEN-5）+ 流式接收
+- [ ] files 端点组全量（list/read/upload/commits→409/diff/history/delete）+ 双客户端冲突 e2e
+- **验收**：DB/git 故障注入（init 失败、提交后崩溃）→ 对账能收敛；路径穿越语料库测试全拒
+
+### Phase 4 · 外部集成（1–2 天）
+
+- [ ] `GroupResolver` HTTP client：超时/5xx/429/畸形 JSON/万级 group 的故障注入测试；失败 → 503（D13）
+- [ ] Audit relay worker：租约领取、指数退避、eventId 幂等、重启恢复、积压告警
+- [ ] 导出 job：状态机 + 轮询 + 下载权限校验；`ExportAdapter` 桩（参数 OPEN-6 未定前**不计入完成标准**）
+- **验收**：relay 重启不丢不重（对端幂等）；group 故障时写操作 503、读操作按 D13
+
+### Phase 5 · 前端（3–5 天，Phase 2 后并行启动）
+
+- [ ] 登录（平台 SSO 占位 + 本地 JWKS 直通开关）
+- [ ] 树浏览（懒加载 + 分页）、breadcrumb（D17 占位符）、创建对话框（类型 + 批量授权选择器，Group search 接 C2）
+- [ ] 权限管理面板（按 8.1 矩阵控制可选项，creator 标识）
+- [ ] 文件页：查看/上传/下载/历史列表（编辑 UI 不归我方，留对接位）
+- [ ] 导出按钮 + job 轮询
+- **验收**：无权限节点全链路不可见；授权面板不会送出矩阵禁止的组合
+
+### Phase 6 · 硬化与交付（1–2 天）
+
+- [ ] 404/403/503 全端点核对；并发与重试幂等抽查
+- [ ] 备份脚本（DB + git 仓库一致性快照）、健康检查（DB/JWKS/磁盘/Group）、磁盘水位告警
+- [ ] OpenAPI 终稿 + 部署脚本 + 一页运维手册
+
+## 里程碑
+
+| 里程碑 | 内容 | 累计工期 |
+|---|---|---|
+| M1 | Phase 0–1：骨架 + 权限引擎 + 树操作可跑 | ~4 天 |
+| M2 | Phase 2–3：后端 API 全量（含文件冲突流） | ~7 天 |
+| M3 | Phase 4：外部集成（导出不计） | ~9 天 |
+| M4 | Phase 5–6：前端 + 硬化，可交付 | ~14–18 天 |
+
+## Mock 保真红线（mock 可以顶，但不许骗）
+
+| Mock | 不许掩盖的事 | 真身到位后的契约测试 |
+|---|---|---|
+| VersionStore | 磁盘延迟、半初始化、锁残留、跨进程并发 | 真包跑临时仓库：并发 commit/init 重试/遍历与 symlink 语料 |
+| GroupResolver | 超时、5xx、畸形响应、大规模组集 | 故障注入 HTTP 桩全过；我方绝不自己推祖先 |
+| GroupSearch（前端选择器） | 与 resolve 是**两个独立端点**，不可用 resolve mock 顶替 | C2 `/groups/search` 真身到位后跑分页/空结果/超时 |
+| Audit 对端 | 重复投递、乱序、长时间不可用 | relay 重启恢复 + 对端幂等 |
+| JWT | issuer/audience/算法/轮换 | 本地 JWKS 全用例 |
+| ExportAdapter | 参数、幂等、耗时 | 参数定了再写，之前不算完成 |
+
+## Top 5 风险
+
+1. **DB/git 分裂**（崩溃导致元数据、仓库、审计三边不一致）→ provisioning 状态机 + 对账 job，Phase 3 前置
+2. **移动子树改变整树权限** → D12 事务+锁+源目标双授权，并发测试
+3. **creator/独立权限开关交互** → D11 先冻结
+4. **外部契约缺口**（导出参数、请求内 resolve 合并）→ OPEN 清单跟踪，mock 保真红线不许掩盖
+5. **存储滥用/路径逃逸** → 路径安全 + 配额进 Phase 3 验收，不拖到硬化
+
+## OPEN 清单（在契约文档基础上增补）
+
+- OPEN-9：单请求内合并多次 resolve 是否符合 G4"实时"语义（找 Group 团队确认）
+- OPEN-10：恶意软件扫描归属（我方/平台/不做）
+- 其余 OPEN-1~8 见《文件库-接口契约.md》第 10 节

.scratch/saas-production-readiness/issues/05-define-abuse-capacity-controls.md

@@ -29,7 +29,7 @@ workload brakes.
 
 The full current-state inventory, accepted behavior, and release evidence are
 recorded in [Initial abuse and capacity controls](../assets/initial-abuse-capacity-controls.md),
-with the durable decision in ADR-0022 and `Spec.System.Capacity`. Numerical
+with the durable decision in ADR-0022. Numerical
 ceilings remain open until production-like calibration.
 
 The implementation frontier is:

.scratch/saas-production-readiness/issues/08-prove-production-release-gate.md

@@ -7,6 +7,6 @@ Blocked by: 01, 02, 03, 04, 05, 06, 07, 09, 10, 11, 12, 13, 14, 15, 16, 17, 18,
 ## Question
 
 After the readiness investigations and resulting fixes are resolved, can one
-repeatable release procedure prove build/test/spec health, deploy a clean
+repeatable release procedure prove build/test health, deploy a clean
 production-like environment, exercise critical tenant and agent journeys,
 verify observability and recovery, and either roll forward or roll back safely?

.scratch/saas-production-readiness/issues/27-reconcile-audit-history-contract.md

@@ -8,7 +8,7 @@ Blocked by: 04
 
 Separate or unify run-bound audit entries, pre-run security/permission events,
 structured messages, and operational recovery events without weakening
-`Spec.System.Audit`'s pinned AuditEntry-to-run relation. Decide durability,
+the pinned AuditEntry-to-run relation. Decide durability,
 failure, retention, and query semantics; then enforce referential integrity and
 observable/recoverable writes instead of silently swallowing lost evidence.
 Do not merge these customer Project/Run records with ADR-0023's already-decided

.scratch/saas-production-readiness/issues/42-decide-platform-admin-identity-audit.md

@@ -40,9 +40,7 @@ an off-host recovery key, an incident and reason, and issues only an expiring
 Emergency Platform Grant.
 
 The complete accepted decision and implementation divergences are in
-[ADR-0023](../../../docs/adr/0023-platform-administrator-identity-and-audit.md).
-The pinned semantic invariants are in
-[`Spec.System.PlatformAdministration`](../../../spec/Spec/System/PlatformAdministration.lean),
+[ADR-0023](../../../docs/adr/0023-platform-administrator-identity-and-audit.md),
 and the canonical terms are in [`CONTEXT.md`](../../../CONTEXT.md).
 
 Exact numeric session/invitation/step-up limits and browser mechanics remain

AGENTS.md

@@ -1,29 +1,25 @@
 # AGENTS.md —— agent 操作手册(全 repo)
 
-本 repo 是 monorepo。先读根 `README.md` 的"宪法"5 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
+本 repo 是 monorepo。先读根 `README.md` 的"宪法"4 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
 
 ## 这个 repo 是什么
 
-- `spec/` 是一份**人机共识的契约**(Lean 语义母本),是产品语义的上游参照。
-- 其余部件(将来的 `spec/` 外文件夹)是**向 `spec/` 对齐的实现**。
+- `docs/adr/` 是系统级决策的唯一权威来源;`CONTEXT.md` 是平台语言词汇表;代码注释把关键不变量锚到 ADR 编号,可 grep。
 - `hub/` 的平台层按 SaaS 形态演进:`Organization` 是 tenant root;`Project`/`Team`
-  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020 / `Spec.System.Organization`)。
+  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020)。
 - org 后台 project explorer 里 `Folder` 是透明组织节点,不是权限资源;project 仍是权限边界。
-  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021 /
-  `Spec.System.ProjectWorkspace`)。
+  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021)。
 - 每个 org 自选 BYOK 或平台托管 model provider connection;平台托管也必须是该 org
-  独享的 key/base URL,不得让无关 org 共用 process-global provider key(见 ADR-0021 /
-  `Spec.System.Organization`)。
+  独享的 key/base URL,不得让无关 org 共用 process-global provider key(见 ADR-0021)。
 - Feishu/provider secret 使用本地版本化 master-key keyring 的信封加密;生产由 systemd
   credential 注入,运行时只允许显式 org/project scope 的 fail-closed resolver,不得回退
   process-global credential;Agent child 只接收 run-scoped loopback proxy capability,
-  不接收 org provider credential(见 ADR-0024 / `Spec.System.Organization`)。
+  不接收 org provider credential(见 ADR-0024)。
 - 生产容量按不可突破的 platform ceiling 与 org 可下调 policy 分层;有效限制取两者较低值。
-  Agent admission 必须持久、有界、跨 org 公平且显式背压(见 ADR-0022 /
-  `Spec.System.Capacity`)。
+  Agent admission 必须持久、有界、跨 org 公平且显式背压(见 ADR-0022)。
 - 平台管理员只通过独立的 platform-owned 飞书应用与可撤销 Platform Session 认证,不复用
   客户 `User`/org membership;平台写操作与 append-only audit 同事务,break-glass 只走
-  双因子的离线恢复流程(见 ADR-0023 / `Spec.System.PlatformAdministration`)。
+  双因子的离线恢复流程(见 ADR-0023)。
 - 受控 alpha 暂采用一 Organization 一具名 systemd Silo:独立 database role/database、
   service identity、workspace、keyring 与 Feishu/provider connection；进程必须由
   `HUB_SILO_ORGANIZATION_ID` fail-closed 绑定唯一 org，平台后台不开放。共享 SaaS
@@ -36,10 +32,6 @@
   `/compact` 只能由卡片动作以未经包装的精确 prompt 转发。
   `settingSources: []` 继续禁用项目/用户配置加载，不得把任意 workspace `.claude` 配置变成
   运行时能力(见 ADR-0018)。
-  skill/role 的管理面分组由一棵 org 内共用、可嵌套的 folder 树承载：透明组织节点，
-  不进入身份、解析与授权——name/roleId 仍 org 内唯一，role→skill 绑定、run 加载与
-  slash 命令均不引用 folder;folder 归属变更是 label 类变更,不归档会话;仅空 folder
-  可删(见 ADR-0028 / `Spec.System.AgentRole`)。
 - 项目发现由 `ProjectDiscovery` 模块统一承载：PostgreSQL `pg_trgm` 搜索派生文档、项目编号
   归一化、完整 Folder breadcrumb、MANAGE 授权过滤与分页都在该模块内；飞书卡片只是 adapter。
   `Project`/`Folder` 仍是事实来源，搜索文档必须可重建且由数据库触发器同步，禁止调用方双写。
@@ -48,12 +40,12 @@
 
 ## 纪律
 
-1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。契约里 prose doc 注释是语义的唯一权威来源;契约没写的,就是没定的。
+1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。ADR 与 `CONTEXT.md` 是语义的唯一权威来源;没写的,就是没定的。
 
-2. **凡契约未写明者,不得假设。** 遇到标了 `OPEN` 的地方,或契约根本没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
+2. **凡 ADR 未写明者,不得假设。** 遇到没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
 
-3. **改 `spec/` 必须保持其 `lake build` 通过。** 在 `spec/` 目录下跑 `lake build`。新增声明必须带 `/-- … -/` doc 注释和恰当标签(`PINNED` / `OPEN` / `ADR-NNNN`)。规范见 `spec/README.md`。不准用 `sorry` 把 build 糊绿。
+3. **新语义决策进 ADR。** 跨部件的语义分歧点按编号顺延新增 `docs/adr/NNNN-*.md`;代码里的关键不变量用注释锚到 ADR 编号,保持可 grep。已有 ADR 正文不改写历史——推翻旧决策就写新 ADR 标记 supersede。
 
-4. **实现向契约对齐;偏离必须 surface。** 没有 CI gate 替你把关 spec↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与契约不一致时,报告它,不要默默让其中一边将就另一边。
+4. **实现向 ADR 对齐;偏离必须 surface。** 没有 CI gate 替你把关 ADR↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与决策不一致时,报告它,不要默默让其中一边将就另一边。
 
 5. **写操作谨慎。** 线上操作、git 写操作前与开发者确认(这是开发者的全局偏好)。

CLAUDE.md

@@ -1,25 +1,23 @@
 # CLAUDE.md —— agent 操作手册(全 repo)
 
-本 repo 是 monorepo。先读根 `README.md` 的"宪法"5 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
+本 repo 是 monorepo。先读根 `README.md` 的"宪法"4 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
 
 ## 这个 repo 是什么
 
-- `spec/` 是一份**人机共识的契约**(Lean 语义母本),是产品语义的上游参照。
-- 其余部件(将来的 `spec/` 外文件夹)是**向 `spec/` 对齐的实现**。
+- `docs/adr/` 是系统级决策的唯一权威来源;`CONTEXT.md` 是平台语言词汇表;代码注释把关键不变量锚到 ADR 编号,可 grep。
 - `hub/` 的平台层按 SaaS 形态演进:`Organization` 是 tenant root;`Project`/`Team`
-  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020 / `Spec.System.Organization`)。
+  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020)。
 - org 后台 project explorer 里 `Folder` 是透明组织节点,不是权限资源;project 仍是权限边界。
-  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021 /
-  `Spec.System.ProjectWorkspace`)。
+  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021)。
 
 ## 纪律
 
-1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。契约里 prose doc 注释是语义的唯一权威来源;契约没写的,就是没定的。
+1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。ADR 与 `CONTEXT.md` 是语义的唯一权威来源;没写的,就是没定的。
 
-2. **凡契约未写明者,不得假设。** 遇到标了 `OPEN` 的地方,或契约根本没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
+2. **凡 ADR 未写明者,不得假设。** 遇到没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
 
-3. **改 `spec/` 必须保持其 `lake build` 通过。** 在 `spec/` 目录下跑 `lake build`。新增声明必须带 `/-- … -/` doc 注释和恰当标签(`PINNED` / `OPEN` / `ADR-NNNN`)。规范见 `spec/README.md`。不准用 `sorry` 把 build 糊绿。
+3. **新语义决策进 ADR。** 跨部件的语义分歧点按编号顺延新增 `docs/adr/NNNN-*.md`;代码里的关键不变量用注释锚到 ADR 编号,保持可 grep。已有 ADR 正文不改写历史——推翻旧决策就写新 ADR 标记 supersede。
 
-4. **实现向契约对齐;偏离必须 surface。** 没有 CI gate 替你把关 spec↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与契约不一致时,报告它,不要默默让其中一边将就另一边。
+4. **实现向 ADR 对齐;偏离必须 surface。** 没有 CI gate 替你把关 ADR↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与决策不一致时,报告它,不要默默让其中一边将就另一边。
 
 5. **写操作谨慎。** 线上操作、git 写操作前与开发者确认(这是开发者的全局偏好)。

CONTEXT.md

@@ -99,3 +99,7 @@ _Avoid_: Cost budget, unlimited run
 **Emergency Workload Brake**:
 An audited Platform Administrator control that prevents new agent work for one Organization or the whole platform and may explicitly stop active work during an incident.
 _Avoid_: Organization deletion, service restart
+
+**Member Group**:
+A global, unlimited-depth, nestable authorization principal managed by the website administrator; a file-library grant on a group applies to that group and its whole descendant subtree, and a user's effective permission collects every group they belong to plus those groups' ancestors (ADR-0028). It stores no folder/project permission itself — only the user→group membership. Global: not owned by any Organization.
+_Avoid_: Team (the org-scoped flat grouping), Feishu department

README.md

@@ -2,7 +2,7 @@
 
 教研生产的数字化解决方案。核心思路:课程像 DAW / 剪辑软件那样有一个**结构化的工程文件**;coding agent 协助编辑它;一个 rule-based checker(类编译器)校验其合法性并给出 helpful fix hint。目标是把教研从一次性的文档,沉淀成**可累积、可校验、可复用的资产**。
 
-这是一个 **monorepo**。它的组织方式本身就表达了一条原则:**`spec/` 是上游的语义母本,其余部件是向它对齐的实现。**
+这是一个 **monorepo**。它的组织方式本身就表达了一条原则:**`docs/adr/` 是系统级决策的唯一权威来源,代码注释把关键不变量锚到 ADR 编号,可 grep。**
 
 ## 安装 `cph` 命令行
 
@@ -33,47 +33,40 @@ cph completions zsh > ~/.zfunc/_cph        # 或 bash/fish/powershell/elvish
 ```
 README.md          ← 本文件:总览 + 宪法(下面 5 条)
 CLAUDE.md          ← 全局 agent 操作手册(管整个 repo)
-docs/adr/          ← 系统级架构决策记录(跨部件,被 spec 契约引用)
-spec/              ← Lean 语义母本(自包含的 Lean 工程)。见 spec/README.md
+docs/adr/          ← 系统级架构决策记录(跨部件,决策的唯一权威来源)
+CONTEXT.md         ← 平台语言词汇表(术语与禁用说法)
 Cargo.toml         ← 仓库级 cargo workspace(实现部件共用,便于跨部件复用 crate)
-crates/            ← 实现:rule-based checker(向 spec 对齐)。见 crates/README.md
+crates/            ← 实现:rule-based checker(语义由 ADR 锚定)。见 crates/README.md
   cph-diag / cph-model / cph-schema / cph-typst   ← 可复用基础(模型/校验/typst 引擎)
   cph-check / cph-cli                             ← checker 本体 + `cph` 命令行
-render/            ← typst 渲染包 cph-render(母本的渲染后端之一,ADR-0005)
+render/            ← typst 渲染包 cph-render(checker 的渲染后端,ADR-0005)
 examples/          ← 样例工程文件(如 TH-141),流水线的真实输入
 hub/              ← SaaS Hub:飞书协作、org 管理、agent runtime 与生产部署
-(exporter/ …)     ← 将来的其他部件,平级于 spec/
+(exporter/ …)     ← 将来的其他部件,平级于 crates/
 ```
 
-`spec/` 与实现部件**物理分离、平级共存**:谁是上游、谁向谁对齐,一眼可见。
 实现部件共用一个仓库根的 cargo workspace,使基础 crate(模型、typst 引擎)能被
 未来部件(如 exporter)复用,而非各自重造。
 
 ## 宪法
 
-这 5 条是 `spec/` 这份语义母本的定位与约束,是本仓库一切工作的前提。
+这 4 条是本仓库的协作约定,是一切工作的前提。
 
-1. **角色 —— Lean 是研发侧的上游参照。**
-   `spec/` 用 Lean 编写,是开发者(领域专家)与 coding agent **共用**的 spec 工具,用来沉淀产品各部件的**语义**。它**不进入产品运行时**——产品里"站在 Lean 这个位置"的那个 checker 用什么技术实现,尚未决定;但那个东西的语义,先在 `spec/` 里固定下来。
+1. **角色 —— ADR 是决策真相。**
+   跨部件的语义决策只记录在 `docs/adr/`,一份决策一份 ADR,编号顺延、正文不改写历史。代码里的关键不变量用注释锚到 ADR 编号,保持可 grep。没有第二份权威文档。
 
-2. **对齐机制 —— Lean 只做上游参照。**
-   不做 extract / codegen,不派生 conformance test,CI 里**没有** spec→实现的 gate。实现对齐 spec,由"开发者 review + agent 巡逻 diff"这个人肉环节承载。
-   (CI 里的 `spec check` 只验 spec **自身**能否 type-check,即契约内部良构,不是 spec↔实现的对齐检查。)
+2. **对齐机制 —— 人肉承载,无机器兜底。**
+   CI 只验各部件自身良构(build / test / clippy),**没有**决策↔实现的一致性 gate。实现对齐 ADR,由"开发者 review + agent 巡逻 diff"这个人肉环节承载。发现漂移,报告它,不要默默让其中一边将就另一边。
 
-3. **资产性 —— 由 review 纪律承载,无机器兜底。**
-   这份仓库给你的是"精确、自洽、机器验内部良构的语义共识",**不是**"实现正确性保证"。spec 与实现之间那道缝,是我们自愿用人来守的——清醒地守,它就是资产;放任实现漂移而不回头同步,它就退化成最贵的过期文档。
+3. **形态 —— 自包含。**
+   凡 ADR 未明文规定的,开发者与 agent 双方都不该假设;遇到没覆盖的地方,**显式 surface** 出来让开发者决定。
 
-4. **形态 —— 它是人机共识的契约。**
-   契约必须**自包含**:凡契约未明文规定的,开发者与 agent 双方都不该假设。这比"文档"严格——type checker 会逼这份契约在结构上无洞。
-
-5. **深度判据 —— 只收录分歧点。**
-   一条语义该不该写进 Lean,取决于一句话:**"不写明,开发者与 agent 会不会各自做出不同假设?"** 会 → 进契约;显然的东西 / 纯 plumbing / 普通 CRUD 字段 → 不进(写进去只稀释信噪比、增加维护面)。
-   深度上限不是 Lean 的表达力,而是**你愿意在每次实现变更时手动回头同步的量**——写得比你能维护的更深,多出来的部分会率先过期、反过来误导实现。
+4. **深度判据 —— 只收录分歧点。**
+   一条语义该不该写进 ADR,取决于一句话:**"不写明,开发者与 agent 会不会各自做出不同假设?"** 会 → 进 ADR;显然的东西 / 纯 plumbing / 普通 CRUD 字段 → 不进(写进去只稀释信噪比、增加维护面)。
+   深度上限是**你愿意在每次实现变更时手动回头同步的量**——写得比你能维护的更深,多出来的部分会率先过期、反过来误导实现。
 
 ## CI
 
-`.gitea/workflows/spec-check.yml` 在每次 push / PR 时于 `spec/` 下跑 `lake build`,确保契约始终 type-check 通过(从第一天起就是"绿"的)。这是良构 gate,见宪法第 2 条。
-
 Rust checker 的本地与 CI 工具链由根 `rust-toolchain.toml` 固定;`.gitea/workflows/checker-check.yml`
 必须安装同一精确版本并执行 `cargo fmt --all --check`、Clippy `-D warnings` 与 workspace
 全测试。升级 Rust 时这两处必须在同一提交更新并通过完整 checker gate。

crates/README.md

@@ -1,7 +1,8 @@
 # crates/
 
-These crates implement the rule-based lesson checker that aligns to the
-semantic master in `spec/`: it reads an engineering-file (one lesson, ADR-0005)
+These crates implement the rule-based lesson checker whose semantics are
+pinned by the ADRs in `docs/adr/`: it reads an engineering-file (one lesson,
+ADR-0005)
 laid out per ADR-0008 (declarative `manifest.toml` + per-element
 `element.toml`), validates structure and content, and emits diagnostics.
 `cph-diag` (the shared diagnostic vocabulary), `cph-model` (the ADR-0008 loader),

crates/cph-check/src/lib.rs

@@ -19,13 +19,11 @@ const DEFAULT_TARGET: &str = "student";
 
 /// Severity of the render-coverage ("element ignored under a target") diagnostic.
 ///
-/// **PINNED to `warning` by the contract.** Mirrors the Lean master's
-/// `Spec.Courseware.renderIgnoredSeverity : Severity := .warning`
-/// (`spec/Spec/Courseware/Check/Diagnostic.lean`), itself citing ADR-0005: when a
+/// **PINNED to `warning` by ADR-0005:** when a
 /// `(kind, target)` pair has no render rule the checker reports that the element
 /// is ignored under that target and **does not block the export**. Naming the
-/// severity as a const makes "it is a warning, not an error" a greppable,
-/// alignable fact rather than an inline literal.
+/// severity as a const makes "it is a warning, not an error" a greppable
+/// fact rather than an inline literal.
 const RENDER_IGNORED_SEVERITY: Severity = Severity::Warning;
 
 /// The result of running [`check`] (or the check phases of [`build`]).
@@ -57,12 +55,12 @@ impl CheckReport {
 
     /// Whether any collected diagnostic is `Error`-severity.
     ///
-    /// **Legality decision (spec alignment).** `!has_errors()` is the
-    /// implementation of `Spec.Courseware.Legal` (`spec/Spec/Courseware/Check/Diagnostic.lean`):
-    /// a lesson is *legal* iff its diagnostics contain no error-level diagnostic
-    /// (warnings are non-blocking — see `Severity` / ADR-0010). There is no CI
-    /// gate enforcing this alignment (repo constitution); it is kept greppable
-    /// here so a reviewer can tie the orchestrator's gate to the Lean master.
+    /// **Legality decision (ADR-0010).** `!has_errors()` decides lesson
+    /// legality: a lesson is *legal* iff its diagnostics contain no error-level
+    /// diagnostic (warnings are non-blocking — see `Severity`). There is no CI
+    /// gate enforcing ADR↔implementation alignment (repo constitution); it is
+    /// kept greppable here so a reviewer can tie the orchestrator's gate to
+    /// the ADR.
     pub fn has_errors(&self) -> bool {
         self.diagnostics
             .iter()

crates/cph-diag/src/lib.rs

@@ -2,7 +2,7 @@
 //!
 //! Every other crate in the workspace depends on these types to report
 //! problems. The vocabulary is intentionally small and stable: a [`Severity`]
-//! (mirroring the Lean master), a closed set of machine-stable [`DiagCode`]s, an
+//! (two-valued, ADR-0010), a closed set of machine-stable [`DiagCode`]s, an
 //! optional [`SourceSpan`] pointing back at the offending source, and a
 //! [`Diagnostic`] tying them together with a human message and a fix hint.
 //!
@@ -17,32 +17,27 @@ use serde::Serialize;
 
 /// Severity of a diagnostic.
 ///
-/// **Mirrors `Spec.Courseware.Diagnostic.Severity`** in the Lean semantic
-/// master (`spec/Spec/Courseware/Check/Diagnostic.lean`), whose definition is
-/// exactly:
+/// **Pinned by ADR-0005 / ADR-0010: exactly two values.**
 ///
 /// ```text
-/// inductive Severity where
-///   | warning
-///   | error
+/// warning | error
 /// ```
 ///
-/// This two-valued shape is a **contract decision**, not an accident: the Lean
-/// module pins `Severity` to exactly `warning | error` and states the finer
-/// levels (`info` / `hint` / `note`) are deliberately undecided. We therefore
+/// This two-valued shape is a **contract decision**, not an accident: the
+/// finer levels (`info` / `hint` / `note`) are deliberately undecided, so we
 /// do **not** add an info/note level here. `error` blocks (the artifact is
 /// invalid); `warning` does not block (the artifact still exports, but with
 /// loss / an ignored element — e.g. ADR-0005's "missing render ⇒ warning").
 ///
-/// There is no CI gate enforcing this alignment (see the repo constitution);
-/// it is maintained by review, which is why this correspondence is documented
-/// here rather than only in the spec.
+/// There is no CI gate enforcing ADR↔implementation alignment (see the repo
+/// constitution); it is maintained by review, which is why the decision is
+/// documented here rather than only in the ADR.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
 pub enum Severity {
     /// Non-blocking: the artifact still exports, but is lossy / has an ignored
-    /// element. Mirrors Lean `Severity.warning`.
+    /// element. ADR-0010 `warning`.
     Warning,
-    /// Blocking: the artifact is invalid. Mirrors Lean `Severity.error`.
+    /// Blocking: the artifact is invalid. ADR-0010 `error`.
     Error,
 }
 

crates/cph-model/src/lib.rs

@@ -3,9 +3,7 @@
 //! This crate is the **loader**, not the full checker. It reads
 //! `<root>/manifest.toml` (project / info / ordered `[[parts]]` / declared
 //! `[targets.*]`) and each part's `<root>/<path>/element.toml`, and produces an
-//! ordered [`Lesson`] — mirroring the Lean master's `Lesson = List (Element P)`
-//! (`spec/Spec/Courseware/Model/Lesson.lean`), where the order of `parts` carries
-//! teaching semantics.
+//! ordered [`Lesson`], where the order of `parts` carries teaching semantics.
 //!
 //! Scope boundaries (deliberately staying in lane):
 //! - It validates **structure** only: manifest shape, element.toml shape, and
@@ -23,7 +21,7 @@ use serde::{Deserialize, Serialize};
 
 /// An ordered, in-memory lesson loaded from an engineering file.
 ///
-/// Mirrors the Lean master's `Lesson = List (Element P)`: `parts` is an ordered
+/// `parts` is an ordered
 /// `Vec`, and that order is the lesson's order (ADR-0008 §"the lesson manifest
 /// is declarative" — the `[[parts]]` array order is the single source of truth).
 #[derive(Debug, Clone, PartialEq, Serialize)]
@@ -86,9 +84,8 @@ pub struct TargetConfig {
     /// with template `exports/<name>.typ` when no `[[steps]]` are given.
     pub steps: Vec<Step>,
     /// The **render-coverage declaration**: which element kinds this target
-    /// renders. Realizes `Spec.Courseware.TargetSpec.covers : KindId → Prop`
-    /// (`spec/Spec/Courseware/Export/Render.lean`) and ADR-0011's "render
-    /// coverage is a declaration, not a payload": the contract keeps *which
+    /// renders. Realizes ADR-0011's "render
+    /// coverage is a declaration, not a payload": the declaration keeps *which
     /// kinds a target renders* (used by the `renderIgnored` seed diagnostic),
     /// while the rendering "how" lives in the template/steps.
     ///
@@ -102,13 +99,10 @@ pub struct TargetConfig {
 
 /// The artifact an export target produces (ADR-0009/0011).
 ///
-/// **Mirrors `Spec.Courseware.Artifact`** in the Lean semantic master
-/// (`spec/Spec/Courseware/Export/Artifact.lean`), whose definition is exactly:
+/// **Pinned by ADR-0011** as an ADT with fields:
 ///
 /// ```text
-/// inductive Artifact where
-///   | singleFile (filepath : String)
-///   | fileTree (root : String) (outputs : String)
+/// Artifact = singleFile (filepath) | fileTree (root, outputs)
 /// ```
 ///
 /// ADR-0011 pinned the artifact as an ADT **with fields**: "what the product
@@ -120,20 +114,20 @@ pub struct TargetConfig {
 /// `"single-file"` → [`Artifact::SingleFile`], `"file-tree"` →
 /// [`Artifact::FileTree`].
 ///
-/// As with `cph-diag`'s `Severity`, there is no CI gate enforcing this
-/// alignment (see the repo constitution) — it is maintained by review, which is
-/// why the correspondence is documented here.
+/// As with `cph-diag`'s `Severity`, there is no CI gate enforcing ADR↔
+/// implementation alignment (see the repo constitution) — it is maintained by
+/// review, which is why the decision is documented here.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 pub enum Artifact {
     /// One bundled document landing at `filepath` (relative to the engineering
-    /// root). Mirrors Lean `Artifact.singleFile`. The default artifact shape.
+    /// root). ADR-0011 `singleFile`. The default artifact shape.
     SingleFile {
         /// Where the single product is written (relative to the engineering
         /// root), e.g. `build/student.pdf`.
         filepath: PathBuf,
     },
-    /// A set of files under `root` matching the `outputs` glob. Mirrors Lean
-    /// `Artifact.fileTree`.
+    /// A set of files under `root` matching the `outputs` glob. ADR-0011
+    /// `fileTree`.
     FileTree {
         /// The output directory (relative to the engineering root).
         root: PathBuf,
@@ -156,14 +150,10 @@ impl Artifact {
 
 /// One typed build step (ADR-0011).
 ///
-/// **Mirrors `Spec.Courseware.Step`** in the Lean semantic master
-/// (`spec/Spec/Courseware/Export/Render.lean`), whose definition is exactly:
+/// **Pinned by ADR-0011** as an ADT:
 ///
 /// ```text
-/// inductive Step where
-///   | typstCompile (template : String)
-///   | shell (run : String)
-///   | assembleMarkdown (field : String)
+/// Step = typstCompile (template) | shell (run) | assembleMarkdown (field)
 /// ```
 ///
 /// A step is a *typed* operation (extensible): `TypstCompile` compiles a
@@ -183,20 +173,20 @@ impl Artifact {
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 pub enum Step {
     /// Compile a template file (relative to the engineering root) into the
-    /// artifact; the framework injects the manifest. Mirrors Lean
-    /// `Step.typstCompile`.
+    /// artifact; the framework injects the manifest. ADR-0011
+    /// `typstCompile`.
     TypstCompile {
         /// The template file to compile as main, e.g. `exports/student.typ`.
         template: PathBuf,
     },
-    /// Run a shell command — the escape hatch. Mirrors Lean `Step.shell`.
+    /// Run a shell command — the escape hatch. ADR-0011 `shell`.
     Shell {
         /// The command line to run.
         run: String,
     },
     /// Assemble a single-file markdown deliverable by concatenating each
-    /// element's `field` markdown content file in `[[parts]]` order. Mirrors
-    /// Lean `Step.assembleMarkdown` (ADR-0015). Not a typst build — the
+    /// element's `field` markdown content file in `[[parts]]` order. ADR-0011
+    /// `assembleMarkdown` (ADR-0015). Not a typst build — the
     /// framework owns the read/concatenate/write itself.
     AssembleMarkdown {
         /// The per-element markdown content field to assemble (e.g. `slides`,
@@ -226,12 +216,11 @@ pub struct Project {
 
 /// `[info]` table (passed through to render targets verbatim).
 ///
-/// **Mirrors `Spec.Courseware.Info`** in the Lean semantic master
-/// (`spec/Spec/Courseware/Model/Info.lean`): the *canonical* model whose
+/// The *canonical* model whose
 /// `authors` is always a list. The authoring-surface form (string-or-array
 /// `author`) is the separate [`RawInfo`] / [`RawAuthor`], normalized into this
-/// at the load boundary — mirroring the Lean `RawInfo` / `RawAuthor` split. No
-/// CI gate enforces this alignment (repo constitution); it is kept greppable.
+/// at the load boundary. No
+/// CI gate enforces ADR↔implementation alignment (repo constitution); it is kept greppable.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 pub struct Info {
     /// Lesson title.
@@ -240,7 +229,6 @@ pub struct Info {
     /// so this is a list, not a single name. Empty when `[info]` declares no
     /// `author`. The on-disk `author` accepts either a bare string (one author)
     /// or an array of strings (see [`RawAuthor`]); both load into this `Vec`.
-    /// Mirrors Lean `Info.authors : List String`.
     pub authors: Vec<String>,
 }
 
@@ -290,8 +278,7 @@ struct RawProject {
     name: String,
 }
 
-/// The authoring-surface `[info]` (mirrors Lean `RawInfo` in
-/// `spec/Spec/Courseware/Model/Info.lean`): the raw form that exists for
+/// The authoring-surface `[info]`: the raw form that exists for
 /// fill-in convenience, normalized into the canonical [`Info`] at the load
 /// boundary. Not the form the rest of the model traffics in.
 #[derive(Debug, Deserialize)]
@@ -301,7 +288,7 @@ struct RawInfo {
 }
 
 /// On-disk `author`: either a single name (`author = "…"`) or a list
-/// (`author = ["…", "…"]`). Mirrors Lean `RawAuthor`: a fill-in convenience whose
+/// (`author = ["…", "…"]`). A fill-in convenience whose
 /// string-or-array union lives **only** at the load boundary — [`RawAuthor::into_vec`]
 /// folds it into the canonical [`Info::authors`] `Vec`, after which it never appears.
 #[derive(Debug, Deserialize)]
@@ -312,7 +299,7 @@ enum RawAuthor {
 }
 
 impl RawAuthor {
-    /// Flatten to the ordered author list (Lean `RawAuthor.normalize`): a single
+    /// Flatten to the ordered author list: a single
     /// name becomes a one-element list; a list passes through verbatim.
     fn into_vec(self) -> Vec<String> {
         match self {

docs/adr/0028-agent-config-folder-tree.md

@@ -1,81 +0,0 @@
-# ADR 0028: Agent Configuration Folder Tree
-
-## Status
-
-Accepted.
-
-## Context
-
-ADR-0017/0018 made Agent roles and skills Organization-scoped dynamic runtime
-configuration, managed without process restarts. The org admin surfaces for
-them (`/admin/roles` and `/admin/skills`) render every
-role/skill as one large editor card in a single flat list. As an Organization
-accumulates roles and skills, the management pages degrade into an endless
-scroll with no grouping affordance.
-
-The project explorer already solves the analogous problem for projects with
-transparent folders (ADR-0021): org-scoped navigation nodes that are not
-permission resources. Roles and skills need the same affordance, but their
-semantics differ from projects in one crucial way: skill names and role IDs
-are referenced by role→skill bindings, run-time skill snapshot loading, and
-Feishu slash commands. Any grouping mechanism must not leak into those
-resolution paths.
-
-## Decision
-
-Introduce an Organization-scoped folder tree shared by Agent roles and Agent
-skills:
-
-- One folder tree per Organization is shared by both roles and skills (e.g. a
-  "高三化学组" folder groups that team's roles and its skills together). It is
-  a distinct entity from the project explorer `Folder` of ADR-0021 — the two
-  trees are managed independently and never reference each other.
-- Folders are **transparent organization nodes**, following the ADR-0021
-  project-folder precedent: they exist for management-surface navigation and
-  grouping only, are not permission resources, and hold no grants.
-- Folder membership is **not part of role/skill identity or resolution**:
-  - skill `name` and role `roleId` remain unique per Organization regardless
-    of folder membership;
-  - role→skill bindings, run admission's frozen role snapshot, run-scoped
-    skill loading, and Feishu slash commands never reference folders.
-- Each role/skill sits in at most one folder; membership is optional
-  (unfiled items remain first-class). Folders nest arbitrarily.
-- Folder assignment is a label-class change in the ADR-0017 sense: it never
-  archives Agent sessions, because the execution surface (model, prompt,
-  tools, skill content) is untouched.
-- A folder can be deleted only when empty — no child folders, no roles, no
-  skills. Relocating items out of a folder is an explicit user action, so no
-  orphan-placement rule is needed yet.
-- Admin web renders both pages as a left folder tree plus the item list of
-  the selected folder ("all" and "unfiled" included). The host-console CLI is
-  unchanged: folder management lives in the web surface, and CLI
-  `upsert-role`/`install-skill` never touch folder assignment.
-
-## Consequences
-
-- New DB entity `OrganizationAgentConfigFolder` (org-scoped, self-nesting via
-  `parentId`, delete restricted while referenced) plus nullable `folderId` on
-  `OrganizationAgentRole` and `OrganizationAgentSkill` (SetNull on folder
-  delete, though the service refuses to delete non-empty folders).
-- The spec pins the transparency and single-membership semantics in
-  `Spec.System.AgentRole` (`AgentConfigFolder`), so future implementors do
-  not re-derive them differently (e.g. path-style names or per-folder
-  uniqueness).
-- Org admin APIs gain folder CRUD plus role/skill folder-assignment endpoints
-  that skip session archival by construction.
-- Moving a role/skill between folders changes nothing about authorization,
-  run resolution, or audit-visible configuration lineage beyond the folder
-  assignment event itself.
-
-## Open Questions / Deferred
-
-- Drag-and-drop assignment and bulk moves are deferred; assignment is a
-  per-item select for now.
-- Folder-level usage aggregation for roles/skills is deferred (project
-  folders already aggregate usage under ADR-0021; agent configuration has no
-  usage dimension yet).
-- CLI flags for folder assignment are deferred until a console workflow asks
-  for them.
-- Folder-scoped default-role policies (e.g. per-folder defaults) are rejected
-  for now: the Organization keeps exactly one active default role
-  (ADR-0017/0018 invariant) regardless of folder structure.

docs/adr/0028-member-group-management-and-resolution.md

@@ -0,0 +1,153 @@
+# ADR 0028: Member Group Management And Resolution
+
+## Status
+
+Accepted.
+
+## Context
+
+ADR-0020 fixed `Organization` as the tenant root and ADR-0019 pinned the
+principal-set permission model. The file library (《文件库-接口契约.md》) computes
+effective permission over two principal kinds — `USER` and `GROUP` — and consumes
+the group side through a single read-only port, `GroupResolver`
+(`resolveMemberGroupIds(userId) → groupIds[]`, contract C2/G2).
+
+The contract's v0.1 proposal framed the Group system as a *separate HTTP service*
+owned by another team, consumed read-only. In practice the schema now carries the
+group tables directly in the hub database (`MemberGroup`, `MemberGroupMembership`,
+`MemberGroupClosure` — a global, unlimited-depth, closure-backed hierarchy), and
+the product requirement is to build **group management in the backend admin**, not
+to integrate a foreign service. Until this ADR, nothing read or wrote those tables:
+the live `GroupResolver` was a transitional implementation reading flat hub `Team`
+membership, and the admin "Group 管理" panel actually managed `Team`.
+
+This ADR settles the semantics needed to make the `MemberGroup` tables the real,
+in-hub group system.
+
+## Decision
+
+### Group system is in-hub, not a foreign service
+
+`MemberGroup` is the platform's global member-group principal. It lives in the hub
+database and is managed through the `/database` backend. The contract's "separate
+service" framing was an unfrozen v0.1 proposal; the implementation aligns to the
+tables that were actually built. The `GroupResolver` port stays — an external
+`HUB_GROUP_SERVICE_URL` HTTP implementation remains a supported override — but the
+default implementation reads the in-hub `MemberGroup` closure.
+
+### Authority: website administrator only
+
+Group create/delete and member add/remove are restricted to the **website
+administrator**, defined (consistently with the rest of the file library, D19/C4
+adaptation) as an `OWNER`/`ADMIN` of the silo Organization (`isWebsiteAdmin` in
+`filelib/guards.ts`). ADR-0023's `PlatformIdentity` is the future "true" platform
+control plane; the file library uniformly uses org OWNER/ADMIN today and this
+feature stays consistent with that. Reading groups for the authorization selector
+(`/groups/search`) is **not** admin-gated — picking a group to grant is a Manage
+holder's ability, not an administrator's.
+
+### Resolution semantics (the crux)
+
+`resolveMemberGroupIds(user)` returns the user's **active direct groups ∪ the
+active ancestors of those groups**, deduplicated (the closure's depth-0 self row
+makes each direct group its own ancestor). This is the single query the permission
+engine relies on; equivalently: a grant placed on group G applies to members of G
+and of every descendant of G (requirement 3.2 — permission flows down the tree, so
+resolution collects up the tree). It is computed **live, never cached** (contract
+D4/G4): a membership change is visible on the very next protected request.
+
+MemberGroup is global (no `organizationId`), so resolution is not org-scoped.
+
+### Soft delete via `archivedAt`, cascading the subtree
+
+Delete is soft: `MemberGroup.archivedAt` is a tag. Deleting a group
+cascade-soft-deletes its **whole subtree** (walk `MemberGroupClosure` where
+`ancestorId = G`, stamp `archivedAt` on each active descendant) — an application
+operation, not a DB constraint. Closure and membership rows are **retained**;
+resolution and listing filter by `archivedAt`, so an archived group and everything
+under it stop contributing to permission at once.
+
+### Closure maintenance
+
+The closure is maintained on **create**: insert `(G, G, 0)`, then for a parent `P`
+insert `(a.ancestorId, G, a.depth + 1)` for every `a` in
+`closure where descendantId = P`. v1 does **not** support reparenting a group
+(moving it under a new parent). The schema reserves reparent (closure rebuild plus
+the cycle guard "reject a new parent inside the moved subtree"); it is a follow-on.
+
+### Rename and description edits are in scope; reparent stays out
+
+A group's `name` and `description` are mutable by the website administrator
+(`PATCH /database/api/groups/:id`, audited as `group.update`). This is deliberately
+separated from reparent: renaming touches **no** closure row and cannot create a
+cycle, so it carries none of the invariant risk that keeps reparent out of v1. The
+endpoint therefore **rejects** a `parentId` field outright rather than ignoring it,
+so a future reparent cannot arrive silently through this route. Passing an empty
+`description` clears it; omitting a field leaves it unchanged.
+
+### Restore is deliberately asymmetric with delete
+
+Archived groups stay visible to the administrator (`GET
+/database/api/groups?includeArchived=1` returns them carrying `archivedAt`; the
+console tags and greys them) and can be restored (`POST
+/database/api/groups/:id/restore`, audited as `group.restore`).
+
+Restore is **not** the mirror image of delete. Delete cascades down the whole
+subtree; restore un-archives **the group plus every archived ancestor of it, and
+nothing below it**:
+
+- Restoring the ancestor chain is **mandatory**, not a convenience. An active group
+  whose parent is archived has no path in the tree, and the `depth` derivation
+  (closure row count) presumes "an active group's ancestors are active" — the
+  invariant that cascade-delete establishes. Restoring a node alone would break it.
+- The subtree is deliberately **left archived**. A group's descendants may have been
+  archived for reasons of their own, and one click should not silently re-grant
+  permission across a whole historical branch. Descendants remain visible in their
+  archived state and are each restored explicitly.
+
+Restore takes effect immediately, like every other membership change (D4/G4): the
+group resumes contributing permission on the next resolution.
+
+An archived group is **readable but not writable**. Its membership rows are never
+revoked by archiving, so `listMembers` succeeds on an archived group — the console
+must be able to show *who was in it* before deciding whether to restore it. Every
+mutation, by contrast, still requires an active group (`requireActiveGroup` → 404):
+rename, child creation, and member add/remove all reject. The group is inert for
+permission purposes and frozen for editing, but not hidden and not forgotten.
+
+### Member picker reads global users, admin-only
+
+`GET /database/api/users/search` backs the "add member" picker: it matches `User`
+by display name or Feishu open id and is gated to the website administrator, the
+same authority that may add members. It widens no existing capability — adding a
+member already accepts **any** global user (`resolveUser` does not require an org
+membership), so the endpoint only replaces blind id entry with search. It is
+deliberately **not** opened to the non-admin authorization-selector audience that
+`/groups/search` serves: choosing a group to grant is a Manage-holder action,
+whereas enumerating people is not. `excludeGroupId` filters out the target group's
+active members so the picker cannot surface a candidate that must 409.
+
+### Audit is written in-hub
+
+The contract (C3 §6.3) originally deferred group actions to the foreign Group
+service's own audit. With the group system in-hub, group mutations are audited
+through the existing file-library sink (`filelib/audit.ts`, same-transaction
+`AuditEntry`) under the silo Organization — `MemberGroup` has no `organizationId`,
+so the audit row is attributed to the silo org. New actions: `group.create`,
+`group.update`, `group.delete`, `group.restore`, `group.member_add`,
+`group.member_remove`; new audit object type `group`.
+
+## Consequences
+
+- The default `GroupResolver` becomes the in-hub `MemberGroup` closure reader.
+  `createTeamGroupResolver` is retained but deprecated (no longer wired); existing
+  flat-Team group grants no longer resolve for the file library.
+- Group grants take effect in real time through the existing `effectiveRole`
+  reducer (P6) with no change to the permission algebra — only the set of group ids
+  fed to it changes.
+- v1 omits reparent; the closure invariants above must hold whenever reparent is
+  added later (rebuild descendants' ancestor rows, reject cycles).
+- Group management is an admin-only surface; the authorization selector is not.
+- Numeric limits (max depth, max members) and a hard-delete/restore path remain
+  follow-on operational decisions; they must not weaken the archived-filter,
+  admin-authority, or live-resolution invariants fixed here.

docs/para-26071100-feishu-setup.md

@@ -32,7 +32,7 @@ App ID 通常以 `cli_` 开头，可以写入交付单。App Secret 必须通过
 | 接收群聊中 @ 机器人的消息 | `im:message.group_at_msg:readonly` |
 | 以应用身份发送消息 | `im:message:send_as_bot` |
 | 读取触发消息和线程上下文 | `im:message:readonly` |
-| 获取与上传图片或文件 | `im:resource` |
+| 获取消息中的图片/文件，并向飞书上传图片或文件（含 Agent 回答中的图片发送） | `im:resource` |
 | 添加、删除消息表情回复 | `im:message.reactions:write_only` |
 | 获取用户基本信息 | `contact:user.base:readonly` |
 | 获取用户基本资料 | `contact:user.basic_profile:readonly` |
@@ -66,6 +66,9 @@ Educraft 机器人以应用身份调用上述 API，因此这些 scope 全部放
 
 如果 API 调试台提示缺少更细粒度权限，请把错误提示和发生时间截图给部署人员。不要自行开通通讯录全量读取等超出本表的权限。
 
+说明：`im:resource` 既用于下载用户发来的图片/文件，也用于 Agent 回复时把本地或远程图片上传为飞书 `image_key` 后嵌入消息卡片。缺少该权限时，带图回答会发送失败或降级为无图文本。已开通该 scope 的存量应用一般无需新增权限，但若权限尚未随最新版本发布，请创建新版本并审核发布。
+
+
 ## 4. 配置事件与卡片回调
 
 进入“事件与回调”。

hub/.gitignore

@@ -5,6 +5,10 @@ dist/
 .env.*
 !.env.example
 .secrets/
+.dev-keyring.json
+.dev-workspaces/
+.dev-skills/
+.filelib-repos/
 admin-web/node_modules/
 admin-web/build/
 admin-web/.svelte-kit/

hub/admin-web/src/lib/api.ts

@@ -317,7 +317,6 @@ export interface AgentRoleRow {
 	createdAt: string;
 	updatedAt: string;
 	skillNames: readonly string[];
-	folderId: string | null;
 }
 
 export interface AgentSkillRow {
@@ -330,14 +329,6 @@ export interface AgentSkillRow {
 	createdAt: string;
 	updatedAt: string;
 	boundRoleIds: readonly string[];
-	folderId: string | null;
-}
-
-/** ADR-0028 transparent folder node shared by agent roles and skills. */
-export interface AgentConfigFolderRow {
-	id: string;
-	name: string;
-	parentId: string | null;
 }
 
 export interface SkillFileEntry {
@@ -524,21 +515,4 @@ export const api = {
 	patchAgentSkill: (slug: string, name: string, body: { description?: string; disabled?: boolean }) =>
 		patch(`${orgBase(slug)}/agent-skills/${encodeURIComponent(name)}`, body) as Promise<{ disabled?: boolean; updated?: boolean }>,
 	agentModels: (slug: string) => get(`${orgBase(slug)}/agent-models`) as Promise<{ models: AgentModelRow[] }>,
-
-	agentConfigFolders: (slug: string) =>
-		get(`${orgBase(slug)}/agent-config-folders`) as Promise<{ folders: AgentConfigFolderRow[] }>,
-	createAgentConfigFolder: (slug: string, body: { name: string; parentId?: string }) =>
-		post(`${orgBase(slug)}/agent-config-folders`, body) as Promise<AgentConfigFolderRow>,
-	patchAgentConfigFolder: (slug: string, folderId: string, body: { name?: string; parentId?: string | null }) =>
-		patch(`${orgBase(slug)}/agent-config-folders/${encodeURIComponent(folderId)}`, body) as Promise<AgentConfigFolderRow>,
-	deleteAgentConfigFolder: (slug: string, folderId: string) =>
-		del(`${orgBase(slug)}/agent-config-folders/${encodeURIComponent(folderId)}`) as Promise<{ deleted: boolean }>,
-	setAgentRoleFolder: (slug: string, roleId: string, folderId: string | null) =>
-		patch(`${orgBase(slug)}/agent-roles/${encodeURIComponent(roleId)}/folder`, { folderId }) as Promise<{
-			folderId: string | null;
-		}>,
-	setAgentSkillFolder: (slug: string, name: string, folderId: string | null) =>
-		patch(`${orgBase(slug)}/agent-skills/${encodeURIComponent(name)}/folder`, { folderId }) as Promise<{
-			folderId: string | null;
-		}>,
 };

hub/admin-web/src/lib/components/AgentConfigFolderNav.svelte

@@ -1,160 +0,0 @@
-<script lang="ts">
-	import type { AgentConfigFolderRow } from '$lib/api';
-	import Icon from './Icon.svelte';
-
-	/**
-	 * ADR-0028 left folder-tree nav for the agent config pages (roles/skills).
-	 * Transparent grouping only: selection filters the item list, it never
-	 * affects role/skill identity or run resolution.
-	 */
-	let {
-		folders,
-		selected,
-		counts,
-		totalCount,
-		unfiledCount,
-		onselect,
-		oncreate,
-		onrename,
-		ondelete,
-	}: {
-		folders: AgentConfigFolderRow[];
-		/** 'all' | 'unfiled' | folder id */
-		selected: string;
-		/** item count per folder id (roles or skills, depending on the page) */
-		counts: Record<string, number>;
-		totalCount: number;
-		unfiledCount: number;
-		onselect: (id: string) => void;
-		oncreate: (parentId: string | null) => void;
-		onrename: (folder: AgentConfigFolderRow) => void;
-		ondelete: (folder: AgentConfigFolderRow) => void;
-	} = $props();
-
-	type Row = { folder: AgentConfigFolderRow; depth: number; hasChildren: boolean };
-
-	let collapsed = $state<ReadonlySet<string>>(new Set());
-
-	function flatten(list: AgentConfigFolderRow[], collapsedSet: ReadonlySet<string>): Row[] {
-		const rows: Row[] = [];
-		const walk = (parentId: string | null, depth: number) => {
-			const siblings = list
-				.filter((f) => f.parentId === parentId)
-				.sort((a, b) => a.name.localeCompare(b.name));
-			for (const folder of siblings) {
-				const hasChildren = list.some((f) => f.parentId === folder.id);
-				rows.push({ folder, depth, hasChildren });
-				if (hasChildren && !collapsedSet.has(folder.id)) walk(folder.id, depth + 1);
-			}
-		};
-		walk(null, 0);
-		return rows;
-	}
-
-	const rows = $derived(flatten(folders, collapsed));
-
-	function toggleCollapse(folderId: string) {
-		const next = new Set(collapsed);
-		if (next.has(folderId)) next.delete(folderId);
-		else next.add(folderId);
-		collapsed = next;
-	}
-
-	function childFolderCount(folderId: string): number {
-		return folders.filter((f) => f.parentId === folderId).length;
-	}
-
-	const rowClass = (active: boolean) =>
-		`group flex w-full items-center gap-1.5 px-2 py-1.5 text-left text-sm transition hover:bg-surface-100 ${
-			active ? 'bg-primary-100 font-medium text-primary-900' : 'text-surface-800'
-		}`;
-</script>
-
-<nav class="saas-card p-2" aria-label="文件夹导航">
-	<div class="flex items-center justify-between px-2 py-1.5">
-		<span class="text-xs font-semibold uppercase tracking-wide text-surface-600">文件夹</span>
-		<button
-			type="button"
-			class="text-xs text-primary-700 hover:text-primary-900"
-			onclick={() => oncreate(null)}
-		>
-			+ 新建
-		</button>
-	</div>
-
-	<button type="button" class={rowClass(selected === 'all')} onclick={() => onselect('all')}>
-		<span class="w-3.5"></span>
-		<span class="min-w-0 flex-1 truncate">全部</span>
-		<span class="saas-badge-neutral">{totalCount}</span>
-	</button>
-	<button type="button" class={rowClass(selected === 'unfiled')} onclick={() => onselect('unfiled')}>
-		<span class="w-3.5"></span>
-		<span class="min-w-0 flex-1 truncate">未分类</span>
-		<span class="saas-badge-neutral">{unfiledCount}</span>
-	</button>
-
-	{#each rows as row (row.folder.id)}
-		{@const itemCount = counts[row.folder.id] ?? 0}
-		{@const childCount = childFolderCount(row.folder.id)}
-		<div class={rowClass(selected === row.folder.id)} style:padding-left="{0.5 + row.depth * 1}rem">
-			{#if row.hasChildren}
-				<button
-					type="button"
-					class="w-3.5 shrink-0 text-center text-xs text-surface-600"
-					aria-label={collapsed.has(row.folder.id) ? '展开' : '折叠'}
-					onclick={(e) => {
-						e.stopPropagation();
-						toggleCollapse(row.folder.id);
-					}}
-				>
-					{collapsed.has(row.folder.id) ? '▸' : '▾'}
-				</button>
-			{:else}
-				<span class="w-3.5 shrink-0"></span>
-			{/if}
-			<button type="button" class="flex min-w-0 flex-1 items-center gap-1.5 text-left" onclick={() => onselect(row.folder.id)}>
-				<Icon name="folder" class="h-3.5 w-3.5 shrink-0 opacity-60" />
-				<span class="min-w-0 flex-1 truncate">{row.folder.name}</span>
-				{#if itemCount > 0}
-					<span class="saas-badge-neutral">{itemCount}</span>
-				{/if}
-			</button>
-			<span
-				class="flex shrink-0 items-center gap-0.5 opacity-0 transition group-hover:opacity-100 focus-within:opacity-100"
-			>
-				<button
-					type="button"
-					class="flex h-5 w-5 items-center justify-center text-surface-500 hover:text-primary-700"
-					title="在此新建子文件夹"
-					aria-label="在 {row.folder.name} 内新建子文件夹"
-					onclick={() => oncreate(row.folder.id)}
-				>
-					<Icon name="folder-plus" class="h-3.5 w-3.5" />
-				</button>
-				<button
-					type="button"
-					class="flex h-5 w-5 items-center justify-center text-surface-500 hover:text-primary-700"
-					title="重命名 / 移动"
-					aria-label="重命名或移动 {row.folder.name}"
-					onclick={() => onrename(row.folder)}
-				>
-					✎
-				</button>
-				<button
-					type="button"
-					class="flex h-5 w-5 items-center justify-center text-surface-500 hover:text-error-700 disabled:cursor-not-allowed disabled:opacity-30"
-					title={itemCount > 0 || childCount > 0 ? '仅可删除空文件夹' : '删除文件夹'}
-					aria-label="删除 {row.folder.name}"
-					disabled={itemCount > 0 || childCount > 0}
-					onclick={() => ondelete(row.folder)}
-				>
-					×
-				</button>
-			</span>
-		</div>
-	{/each}
-
-	{#if folders.length === 0}
-		<p class="px-2 py-3 text-xs text-surface-600">还没有文件夹。新建一个来分组管理。</p>
-	{/if}
-</nav>

hub/admin-web/src/lib/components/RoleCard.svelte

@@ -5,7 +5,6 @@
 	import { fmtDate } from '$lib/format';
 	import { TOOL_OPTIONS } from '$lib/constants';
 	import SelectField from '$lib/components/SelectField.svelte';
-	import SearchableSelectField from '$lib/components/SearchableSelectField.svelte';
 	import CheckboxControl from '$lib/components/CheckboxControl.svelte';
 	import Icon from '$lib/components/Icon.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
@@ -15,20 +14,15 @@
 		models,
 		skills,
 		slug,
-		folderItems,
 		onupdated,
 		onskillschanged,
-		onfolderchanged,
 	}: {
 		r: AgentRoleRow;
 		models: AgentModelRow[];
 		skills: AgentSkillRow[];
 		slug: string;
-		/** ADR-0028 folder choices ('' = 未分类); transparent grouping only */
-		folderItems: { value: string; label: string }[];
 		onupdated: (updated: AgentRoleRow) => void;
 		onskillschanged: (roleId: string, skillNames: string[]) => void;
-		onfolderchanged: (roleId: string, folderId: string | null) => void;
 	} = $props();
 
 	const initial = {
@@ -50,8 +44,6 @@
 	let isDefault = $state(initial.isDefault);
 	let selectedSkills = $state<string[]>([...initial.skillNames]);
 	let saving = $state(false);
-	let folderValue = $state(r.folderId ?? '');
-	let savingFolder = $state(false);
 
 	const groupedTools = TOOL_OPTIONS.reduce(
 		(acc, t) => {
@@ -61,15 +53,10 @@
 		{} as Record<string, typeof TOOL_OPTIONS>,
 	);
 
-	const modelItems = $derived.by(() => {
-		const fromCatalog = models.map((m) => ({ value: m.id, label: `${m.label}（${m.id}）` }));
-		const items = [{ value: '', label: '（使用平台默认模型）' }, ...fromCatalog];
-		// Keep a previously saved model selectable even if it left the live catalog.
-		if (defaultModel !== '' && !items.some((item) => item.value === defaultModel)) {
-			items.push({ value: defaultModel, label: `${defaultModel}（当前已存，不在目录中）` });
-		}
-		return items;
-	});
+	const modelItems = $derived([
+		{ value: '', label: '（使用平台默认模型）' },
+		...models.map((m) => ({ value: m.id, label: `${m.label}（${m.id}）` })),
+	]);
 
 	const skillItems = $derived(skills.map((s) => ({ value: s.name, label: s.name })));
 
@@ -118,24 +105,6 @@
 	function sortKeyDirty(): boolean {
 		return Number(sortOrder) !== r.sortOrder;
 	}
-
-	// ADR-0028: folder assignment is a label-class change — instant-apply, no
-	// session archival, independent of the configuration save button.
-	async function saveFolder(next: string) {
-		const folderId = next === '' ? null : next;
-		if (folderId === r.folderId) return;
-		savingFolder = true;
-		try {
-			await api.setAgentRoleFolder(slug, r.roleId, folderId);
-			onfolderchanged(r.roleId, folderId);
-			toastSuccess('已更新所属文件夹');
-		} catch (err) {
-			folderValue = r.folderId ?? '';
-			toastError(err instanceof Error ? err.message : String(err));
-		} finally {
-			savingFolder = false;
-		}
-	}
 </script>
 
 <div class="saas-card-pad">
@@ -145,12 +114,6 @@
 		{#if r.isDefault}
 			<span class="saas-badge-success">默认</span>
 		{/if}
-		<div class="ml-auto flex items-center gap-2">
-			<span class="text-xs text-surface-600">文件夹</span>
-			<div class="w-44">
-				<SelectField items={folderItems} bind:value={folderValue} disabled={savingFolder} onchange={saveFolder} />
-			</div>
-		</div>
 	</div>
 
 	<div class="grid grid-cols-1 gap-4 md:grid-cols-2">
@@ -166,13 +129,7 @@
 
 	<div class="mt-4">
 		<p class="saas-label">默认模型</p>
-		<SearchableSelectField
-			items={modelItems}
-			bind:value={defaultModel}
-			placeholder="选择模型…"
-			searchPlaceholder="搜索模型名称或 ID"
-			emptyText="无匹配模型"
-		/>
+		<SelectField items={modelItems} bind:value={defaultModel} />
 	</div>
 
 	<div class="mt-4">

hub/admin-web/src/lib/components/SearchableSelectField.svelte

@@ -1,102 +0,0 @@
-<script lang="ts">
-	import { Combobox } from 'bits-ui';
-	import Icon from './Icon.svelte';
-	import type { SelectItem } from './SelectField.svelte';
-
-	let {
-		items,
-		value = $bindable(''),
-		class: className = '',
-		disabled = false,
-		placeholder = '请选择…',
-		searchPlaceholder = '搜索…',
-		emptyText = '无匹配项',
-		onchange,
-	}: {
-		items: SelectItem[];
-		value?: string;
-		class?: string;
-		disabled?: boolean;
-		placeholder?: string;
-		searchPlaceholder?: string;
-		emptyText?: string;
-		onchange?: (value: string) => void;
-	} = $props();
-
-	let searchValue = $state('');
-
-	const filteredItems = $derived.by(() => {
-		const q = searchValue.trim().toLowerCase();
-		if (q === '') return items;
-		return items.filter(
-			(item) => item.label.toLowerCase().includes(q) || item.value.toLowerCase().includes(q),
-		);
-	});
-</script>
-
-<Combobox.Root
-	type="single"
-	{items}
-	{disabled}
-	{value}
-	allowDeselect={false}
-	onValueChange={(next) => {
-		value = next;
-		onchange?.(next);
-	}}
-	onOpenChangeComplete={(open) => {
-		if (!open) searchValue = '';
-	}}
->
-	<div class="relative {className}">
-		<Combobox.Input
-			class="saas-combobox-input"
-			{disabled}
-			{placeholder}
-			aria-label={searchPlaceholder}
-			oninput={(e) => {
-				searchValue = e.currentTarget.value;
-			}}
-		/>
-		<Combobox.Trigger
-			class="absolute inset-y-0 right-0 flex w-9 items-center justify-center text-surface-600 disabled:cursor-not-allowed disabled:opacity-55"
-			{disabled}
-			aria-label="展开选项"
-		>
-			<svg
-				class="h-4 w-4 shrink-0"
-				viewBox="0 0 24 24"
-				fill="none"
-				stroke="currentColor"
-				stroke-width="1.75"
-				aria-hidden="true"
-			>
-				<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 15l3.75 3.75L15.75 15" />
-				<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 9l3.75-3.75L15.75 9" />
-			</svg>
-		</Combobox.Trigger>
-	</div>
-	<Combobox.Portal>
-		<Combobox.Content class="saas-select-content" sideOffset={6} collisionPadding={8}>
-			<Combobox.Viewport class="max-h-72 overflow-y-auto p-1">
-				{#each filteredItems as item (item.value)}
-					<Combobox.Item
-						class="saas-select-item"
-						value={item.value}
-						label={item.label}
-						disabled={item.disabled}
-					>
-						{#snippet children({ selected })}
-							<span class="min-w-0 flex-1 truncate">{item.label}</span>
-							{#if selected}
-								<Icon name="check" class="ml-2 h-4 w-4 shrink-0 text-primary-600" />
-							{/if}
-						{/snippet}
-					</Combobox.Item>
-				{:else}
-					<div class="px-2 py-2 text-sm text-surface-600">{emptyText}</div>
-				{/each}
-			</Combobox.Viewport>
-		</Combobox.Content>
-	</Combobox.Portal>
-</Combobox.Root>

hub/admin-web/src/lib/components/SkillEditor.svelte

@@ -3,24 +3,18 @@
 	import { api } from '$lib/api';
 	import { fmtDate } from '$lib/format';
 	import Icon from '$lib/components/Icon.svelte';
-	import SelectField from '$lib/components/SelectField.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
 
 	let {
 		slug,
 		skill,
-		folderItems,
 		oninstalled,
 		ondisabled,
-		onfolderchanged,
 	}: {
 		slug: string;
 		skill: AgentSkillRow;
-		/** ADR-0028 folder choices ('' = 未分类); transparent grouping only */
-		folderItems: { value: string; label: string }[];
 		oninstalled: (result: { id: string; name: string; contentDigest: string }) => void;
 		ondisabled: (name: string) => void;
-		onfolderchanged: (name: string, folderId: string | null) => void;
 	} = $props();
 
 	type FileNode = { path: string; content: string };
@@ -34,8 +28,6 @@
 	let dirty = $state(false);
 	let newFilePath = $state('');
 	let showNewFile = $state(false);
-	let folderValue = $state(skill.folderId ?? '');
-	let savingFolder = $state(false);
 
 	const selectedFile = $derived(files.find((f) => f.path === selectedPath) ?? null);
 	const hasManifest = $derived(files.some((f) => f.path === 'SKILL.md'));
@@ -160,24 +152,6 @@
 		dirty = true;
 	}
 
-	// ADR-0028: folder assignment is a label-class change — instant-apply, no
-	// session archival, independent of the content save button.
-	async function saveFolder(next: string) {
-		const folderId = next === '' ? null : next;
-		if (folderId === skill.folderId) return;
-		savingFolder = true;
-		try {
-			await api.setAgentSkillFolder(slug, skill.name, folderId);
-			onfolderchanged(skill.name, folderId);
-			toastSuccess('已更新所属文件夹');
-		} catch (err) {
-			folderValue = skill.folderId ?? '';
-			toastError(err instanceof Error ? err.message : String(err));
-		} finally {
-			savingFolder = false;
-		}
-	}
-
 	function updateFrontmatter(content: string, key: string, value: string): string {
 		const regex = new RegExp(`^(${key}:\\s*)(.*?)(\\s*)$`, 'm');
 		if (regex.test(content)) {
@@ -204,12 +178,6 @@
 		{#if skill.disabledAt}
 			<span class="saas-badge-error">已禁用</span>
 		{/if}
-		<div class="ml-auto flex items-center gap-2">
-			<span class="text-xs text-surface-600">文件夹</span>
-			<div class="w-44">
-				<SelectField items={folderItems} bind:value={folderValue} disabled={savingFolder} onchange={saveFolder} />
-			</div>
-		</div>
 	</div>
 
 	<div class="mb-4 grid grid-cols-1 gap-4 md:grid-cols-2">

hub/admin-web/src/routes/admin/roles/+page.svelte

@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
-	import { api, type AgentConfigFolderRow, type AgentModelRow, type AgentRoleRow, type AgentSkillRow } from '$lib/api';
+	import { api, type AgentRoleRow, type AgentModelRow, type AgentSkillRow } from '$lib/api';
 	import { session } from '$lib/session';
 	import { resolveOrg } from '$lib/org';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -8,9 +8,6 @@
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import EmptyState from '$lib/components/EmptyState.svelte';
 	import RoleCard from '$lib/components/RoleCard.svelte';
-	import AgentConfigFolderNav from '$lib/components/AgentConfigFolderNav.svelte';
-	import Modal from '$lib/components/Modal.svelte';
-	import SelectField from '$lib/components/SelectField.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
 
 	const org = $derived(resolveOrg($session.me, page.url.search));
@@ -19,32 +16,20 @@
 	let roles = $state<AgentRoleRow[]>([]);
 	let models = $state<AgentModelRow[]>([]);
 	let skills = $state<AgentSkillRow[]>([]);
-	let folders = $state<AgentConfigFolderRow[]>([]);
 	let loading = $state(true);
 	let error = $state<string | null>(null);
 
-	/** 'all' | 'unfiled' | folder id (ADR-0028: transparent grouping filter) */
-	let selectedFolder = $state<string>('all');
-
 	let newRoleId = $state('');
 	let newLabel = $state('');
 	let adding = $state(false);
 
-	let showFolderModal = $state(false);
-	let folderModalMode = $state<'create' | 'rename'>('create');
-	let folderModalId = $state<string | null>(null);
-	let folderName = $state('');
-	let folderParent = $state('');
-	let savingFolder = $state(false);
-
 	async function load() {
 		loading = true;
 		error = null;
 		try {
-			const [r, s, f] = await Promise.all([api.agentRoles(slug), api.agentSkills(slug), api.agentConfigFolders(slug)]);
+			const [r, s] = await Promise.all([api.agentRoles(slug), api.agentSkills(slug)]);
 			roles = r.roles;
 			skills = s.skills;
-			folders = f.folders;
 			// Model fetch hits the provider API and may fail or be slow; load it
 			// independently so roles remain editable even without a model list.
 			models = [];
@@ -58,66 +43,6 @@
 		}
 	}
 
-	const counts = $derived.by(() => {
-		const map: Record<string, number> = {};
-		for (const r of roles) {
-			if (r.folderId) map[r.folderId] = (map[r.folderId] ?? 0) + 1;
-		}
-		return map;
-	});
-	const unfiledCount = $derived(roles.filter((r) => !r.folderId).length);
-	const visibleRoles = $derived(
-		selectedFolder === 'all'
-			? roles
-			: selectedFolder === 'unfiled'
-				? roles.filter((r) => !r.folderId)
-				: roles.filter((r) => r.folderId === selectedFolder),
-	);
-
-	function folderPath(f: AgentConfigFolderRow): string {
-		const parts: string[] = [f.name];
-		let cur: AgentConfigFolderRow | undefined = f;
-		while (cur?.parentId) {
-			const parent = folders.find((x) => x.id === cur!.parentId);
-			if (!parent) break;
-			parts.unshift(parent.name);
-			cur = parent;
-		}
-		return parts.join(' / ');
-	}
-
-	/** Self + descendant ids of a folder — excluded as move targets in the rename modal. */
-	function subtreeIds(folderId: string): Set<string> {
-		const ids = new Set<string>([folderId]);
-		let grew = true;
-		while (grew) {
-			grew = false;
-			for (const f of folders) {
-				if (f.parentId && ids.has(f.parentId) && !ids.has(f.id)) {
-					ids.add(f.id);
-					grew = true;
-				}
-			}
-		}
-		return ids;
-	}
-
-	const folderItems = $derived([
-		{ value: '', label: '（未分类）' },
-		...folders.map((f) => ({ value: f.id, label: folderPath(f) })),
-	]);
-
-	const moveTargetItems = $derived.by(() => {
-		if (folderModalMode !== 'rename' || folderModalId === null) {
-			return [{ value: '', label: '（根）' }, ...folders.map((f) => ({ value: f.id, label: folderPath(f) }))];
-		}
-		const excluded = subtreeIds(folderModalId);
-		return [
-			{ value: '', label: '（根）' },
-			...folders.filter((f) => !excluded.has(f.id)).map((f) => ({ value: f.id, label: folderPath(f) })),
-		];
-	});
-
 	async function add() {
 		const roleId = newRoleId.trim();
 		const label = newLabel.trim();
@@ -132,12 +57,7 @@
 		adding = true;
 		try {
 			const created = await api.upsertAgentRole(slug, roleId, { label });
-			let folderId: string | null = null;
-			if (selectedFolder !== 'all' && selectedFolder !== 'unfiled') {
-				await api.setAgentRoleFolder(slug, roleId, selectedFolder);
-				folderId = selectedFolder;
-			}
-			roles = [...roles, { ...created, folderId }];
+			roles = [...roles, created];
 			newRoleId = '';
 			newLabel = '';
 			toastSuccess('角色已创建');
@@ -159,68 +79,6 @@
 		roles = roles.map((x) => (x.roleId === roleId ? { ...x, skillNames } : x));
 	}
 
-	function onRoleFolderChanged(roleId: string, folderId: string | null) {
-		roles = roles.map((x) => (x.roleId === roleId ? { ...x, folderId } : x));
-	}
-
-	function openCreateFolder(parentId: string | null) {
-		folderModalMode = 'create';
-		folderModalId = null;
-		folderName = '';
-		folderParent = parentId ?? '';
-		showFolderModal = true;
-	}
-
-	function openRenameFolder(folder: AgentConfigFolderRow) {
-		folderModalMode = 'rename';
-		folderModalId = folder.id;
-		folderName = folder.name;
-		folderParent = folder.parentId ?? '';
-		showFolderModal = true;
-	}
-
-	async function submitFolderModal() {
-		const name = folderName.trim();
-		if (name === '') {
-			toastError('文件夹名称不能为空');
-			return;
-		}
-		savingFolder = true;
-		try {
-			if (folderModalMode === 'create') {
-				await api.createAgentConfigFolder(slug, {
-					name,
-					...(folderParent !== '' ? { parentId: folderParent } : {}),
-				});
-				toastSuccess('文件夹已创建');
-			} else if (folderModalId !== null) {
-				await api.patchAgentConfigFolder(slug, folderModalId, {
-					name,
-					parentId: folderParent === '' ? null : folderParent,
-				});
-				toastSuccess('文件夹已更新');
-			}
-			showFolderModal = false;
-			await load();
-		} catch (err) {
-			toastError(err instanceof Error ? err.message : String(err));
-		} finally {
-			savingFolder = false;
-		}
-	}
-
-	async function deleteFolder(folder: AgentConfigFolderRow) {
-		if (!confirm(`删除文件夹「${folder.name}」? 仅空文件夹可删除。`)) return;
-		try {
-			await api.deleteAgentConfigFolder(slug, folder.id);
-			if (selectedFolder === folder.id) selectedFolder = 'all';
-			toastSuccess('文件夹已删除');
-			await load();
-		} catch (err) {
-			toastError(err instanceof Error ? err.message : String(err));
-		}
-	}
-
 	$effect(() => {
 		if (slug) load();
 	});
@@ -228,7 +86,7 @@
 
 <PageHeader
 	title="角色"
-	description="角色是组织级数据：组合默认模型、系统提示词、工具白名单与已绑定技能。文件夹仅作管理分组，不影响角色解析与默认角色约束。"
+	description="角色是组织级数据：组合默认模型、系统提示词、工具白名单与已绑定技能。角色 ID 即飞书斜杠命令（如 /draft）。"
 />
 
 {#if loading}
@@ -236,92 +94,39 @@
 {:else if error}
 	<ErrorBanner message={error} onretry={load} />
 {:else}
-	<div class="grid gap-4 lg:grid-cols-[15rem_1fr]">
-		<div class="h-fit lg:sticky lg:top-4">
-			<AgentConfigFolderNav
-				{folders}
-				selected={selectedFolder}
-				{counts}
-				totalCount={roles.length}
-				{unfiledCount}
-				onselect={(id) => (selectedFolder = id)}
-				oncreate={openCreateFolder}
-				onrename={openRenameFolder}
-				ondelete={deleteFolder}
+	<div class="saas-card-pad mb-6">
+		<h2 class="saas-section-title mb-4">新建角色</h2>
+		<div class="grid gap-3 sm:grid-cols-[10rem_1fr_auto]">
+			<input
+				class="saas-input font-mono text-sm"
+				placeholder="角色 ID（如 draft）"
+				bind:value={newRoleId}
+				onkeydown={(e) => {
+					if (e.key === 'Enter') add();
+				}}
 			/>
+			<input
+				class="saas-input"
+				placeholder="显示名（如 草稿）"
+				bind:value={newLabel}
+				onkeydown={(e) => {
+					if (e.key === 'Enter') add();
+				}}
+			/>
+			<button class="saas-btn-primary" onclick={add} disabled={adding}>新建</button>
 		</div>
-
-		<div>
-			<div class="saas-card-pad mb-6">
-				<h2 class="saas-section-title mb-4">新建角色</h2>
-				<div class="grid gap-3 sm:grid-cols-[10rem_1fr_auto]">
-					<input
-						class="saas-input font-mono text-sm"
-						placeholder="角色 ID（如 draft）"
-						bind:value={newRoleId}
-						onkeydown={(e) => {
-							if (e.key === 'Enter') add();
-						}}
-					/>
-					<input
-						class="saas-input"
-						placeholder="显示名（如 草稿）"
-						bind:value={newLabel}
-						onkeydown={(e) => {
-							if (e.key === 'Enter') add();
-						}}
-					/>
-					<button class="saas-btn-primary" onclick={add} disabled={adding}>新建</button>
-				</div>
-				<p class="mt-2 text-xs text-surface-600">角色 ID 仅允许小写字母、数字、下划线与连字符，且以字母或数字开头；当前选中文件夹时新角色会自动归入其中。</p>
-			</div>
-
-			{#if roles.length === 0}
-				<div class="saas-card">
-					<EmptyState title="暂无角色" description="组织必须且只能有一个启用中的默认角色；新建第一个角色将自动成为默认。" />
-				</div>
-			{:else if visibleRoles.length === 0}
-				<div class="saas-card">
-					<EmptyState title="此分类下暂无角色" description="在角色卡片上可将其移入当前文件夹。" />
-				</div>
-			{:else}
-				<div class="space-y-4">
-					{#each visibleRoles as r (r.roleId)}
-						<RoleCard
-							{r}
-							{models}
-							{skills}
-							{slug}
-							{folderItems}
-							onupdated={onRoleUpdated}
-							onskillschanged={onRoleSkillsChanged}
-							onfolderchanged={onRoleFolderChanged}
-						/>
-					{/each}
-				</div>
-			{/if}
-		</div>
+		<p class="mt-2 text-xs text-surface-600">角色 ID 仅允许小写字母、数字、下划线与连字符，且以字母或数字开头。</p>
 	</div>
 
-	<Modal bind:open={showFolderModal} title={folderModalMode === 'create' ? '新建文件夹' : '重命名 / 移动文件夹'}>
-		<label class="saas-label" for="agent-folder-name">名称</label>
-		<input
-			id="agent-folder-name"
-			class="saas-input mb-4"
-			bind:value={folderName}
-			onkeydown={(e) => {
-				if (e.key === 'Enter') submitFolderModal();
-			}}
-		/>
-		<p class="saas-label">父文件夹</p>
-		<div class="mb-4">
-			<SelectField items={moveTargetItems} bind:value={folderParent} />
+	{#if roles.length === 0}
+		<div class="saas-card">
+			<EmptyState title="暂无角色" description="组织必须且只能有一个启用中的默认角色；新建第一个角色将自动成为默认。" />
 		</div>
-		<div class="flex justify-end gap-2">
-			<button class="saas-btn-ghost" onclick={() => (showFolderModal = false)}>取消</button>
-			<button class="saas-btn-primary" onclick={submitFolderModal} disabled={savingFolder}>
-				{savingFolder ? '保存中…' : '保存'}
-			</button>
+	{:else}
+		<div class="space-y-4">
+			{#each roles as r (r.roleId)}
+				<RoleCard {r} {models} {skills} {slug} onupdated={onRoleUpdated} onskillschanged={onRoleSkillsChanged} />
+			{/each}
 		</div>
-	</Modal>
+	{/if}
 {/if}

hub/admin-web/src/routes/admin/skills/+page.svelte

@@ -1,6 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
-	import { api, type AgentConfigFolderRow, type AgentSkillRow, type SkillFileEntry } from '$lib/api';
+	import { api, type AgentSkillRow, type SkillFileEntry } from '$lib/api';
 	import { session } from '$lib/session';
 	import { resolveOrg } from '$lib/org';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -8,42 +8,27 @@
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import EmptyState from '$lib/components/EmptyState.svelte';
 	import SkillEditor from '$lib/components/SkillEditor.svelte';
-	import AgentConfigFolderNav from '$lib/components/AgentConfigFolderNav.svelte';
-	import Modal from '$lib/components/Modal.svelte';
-	import SelectField from '$lib/components/SelectField.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
 
 	const org = $derived(resolveOrg($session.me, page.url.search));
 	const slug = $derived(org?.slug ?? '');
 
 	let skills = $state<AgentSkillRow[]>([]);
-	let folders = $state<AgentConfigFolderRow[]>([]);
 	let loading = $state(true);
 	let error = $state<string | null>(null);
 
-	/** 'all' | 'unfiled' | folder id (ADR-0028: transparent grouping filter) */
-	let selectedFolder = $state<string>('all');
-
 	let showNewSkill = $state(false);
 	let newSkillName = $state('');
 	let newSkillVersion = $state('0.1.0');
 	let newSkillDescription = $state('');
 	let creating = $state(false);
 
-	let showFolderModal = $state(false);
-	let folderModalMode = $state<'create' | 'rename'>('create');
-	let folderModalId = $state<string | null>(null);
-	let folderName = $state('');
-	let folderParent = $state('');
-	let savingFolder = $state(false);
-
 	async function load() {
 		loading = true;
 		error = null;
 		try {
-			const [s, f] = await Promise.all([api.agentSkills(slug), api.agentConfigFolders(slug)]);
-			skills = s.skills;
-			folders = f.folders;
+			const res = await api.agentSkills(slug);
+			skills = res.skills;
 		} catch (err) {
 			error = err instanceof Error ? err.message : String(err);
 		} finally {
@@ -51,66 +36,6 @@
 		}
 	}
 
-	const counts = $derived.by(() => {
-		const map: Record<string, number> = {};
-		for (const s of skills) {
-			if (s.folderId) map[s.folderId] = (map[s.folderId] ?? 0) + 1;
-		}
-		return map;
-	});
-	const unfiledCount = $derived(skills.filter((s) => !s.folderId).length);
-	const visibleSkills = $derived(
-		selectedFolder === 'all'
-			? skills
-			: selectedFolder === 'unfiled'
-				? skills.filter((s) => !s.folderId)
-				: skills.filter((s) => s.folderId === selectedFolder),
-	);
-
-	function folderPath(f: AgentConfigFolderRow): string {
-		const parts: string[] = [f.name];
-		let cur: AgentConfigFolderRow | undefined = f;
-		while (cur?.parentId) {
-			const parent = folders.find((x) => x.id === cur!.parentId);
-			if (!parent) break;
-			parts.unshift(parent.name);
-			cur = parent;
-		}
-		return parts.join(' / ');
-	}
-
-	/** Self + descendant ids of a folder — excluded as move targets in the rename modal. */
-	function subtreeIds(folderId: string): Set<string> {
-		const ids = new Set<string>([folderId]);
-		let grew = true;
-		while (grew) {
-			grew = false;
-			for (const f of folders) {
-				if (f.parentId && ids.has(f.parentId) && !ids.has(f.id)) {
-					ids.add(f.id);
-					grew = true;
-				}
-			}
-		}
-		return ids;
-	}
-
-	const folderItems = $derived([
-		{ value: '', label: '（未分类）' },
-		...folders.map((f) => ({ value: f.id, label: folderPath(f) })),
-	]);
-
-	const moveTargetItems = $derived.by(() => {
-		if (folderModalMode !== 'rename' || folderModalId === null) {
-			return [{ value: '', label: '（根）' }, ...folders.map((f) => ({ value: f.id, label: folderPath(f) }))];
-		}
-		const excluded = subtreeIds(folderModalId);
-		return [
-			{ value: '', label: '（根）' },
-			...folders.filter((f) => !excluded.has(f.id)).map((f) => ({ value: f.id, label: folderPath(f) })),
-		];
-	});
-
 	async function createSkill() {
 		const name = newSkillName.trim();
 		if (name === '') {
@@ -131,9 +56,6 @@
 			const manifest = buildManifest(name, newSkillDescription.trim());
 			const files: SkillFileEntry[] = [{ path: 'SKILL.md', content: manifest }];
 			const result = await api.installAgentSkill(slug, name, { version, files });
-			if (selectedFolder !== 'all' && selectedFolder !== 'unfiled') {
-				await api.setAgentSkillFolder(slug, result.name, selectedFolder);
-			}
 			toastSuccess(`技能 ${result.name} 已创建`);
 			newSkillName = '';
 			newSkillDescription = '';
@@ -159,68 +81,6 @@
 		load();
 	}
 
-	function onSkillFolderChanged(name: string, folderId: string | null) {
-		skills = skills.map((s) => (s.name === name ? { ...s, folderId } : s));
-	}
-
-	function openCreateFolder(parentId: string | null) {
-		folderModalMode = 'create';
-		folderModalId = null;
-		folderName = '';
-		folderParent = parentId ?? '';
-		showFolderModal = true;
-	}
-
-	function openRenameFolder(folder: AgentConfigFolderRow) {
-		folderModalMode = 'rename';
-		folderModalId = folder.id;
-		folderName = folder.name;
-		folderParent = folder.parentId ?? '';
-		showFolderModal = true;
-	}
-
-	async function submitFolderModal() {
-		const name = folderName.trim();
-		if (name === '') {
-			toastError('文件夹名称不能为空');
-			return;
-		}
-		savingFolder = true;
-		try {
-			if (folderModalMode === 'create') {
-				await api.createAgentConfigFolder(slug, {
-					name,
-					...(folderParent !== '' ? { parentId: folderParent } : {}),
-				});
-				toastSuccess('文件夹已创建');
-			} else if (folderModalId !== null) {
-				await api.patchAgentConfigFolder(slug, folderModalId, {
-					name,
-					parentId: folderParent === '' ? null : folderParent,
-				});
-				toastSuccess('文件夹已更新');
-			}
-			showFolderModal = false;
-			await load();
-		} catch (err) {
-			toastError(err instanceof Error ? err.message : String(err));
-		} finally {
-			savingFolder = false;
-		}
-	}
-
-	async function deleteFolder(folder: AgentConfigFolderRow) {
-		if (!confirm(`删除文件夹「${folder.name}」? 仅空文件夹可删除。`)) return;
-		try {
-			await api.deleteAgentConfigFolder(slug, folder.id);
-			if (selectedFolder === folder.id) selectedFolder = 'all';
-			toastSuccess('文件夹已删除');
-			await load();
-		} catch (err) {
-			toastError(err instanceof Error ? err.message : String(err));
-		}
-	}
-
 	$effect(() => {
 		if (slug) load();
 	});
@@ -228,7 +88,7 @@
 
 <PageHeader
 	title="技能"
-	description="技能是组织级 Agent 能力包：一个包含 SKILL.md manifest 的目录。文件夹仅作管理分组，不影响技能解析与绑定。"
+	description="技能是组织级 Agent 能力包：一个包含 SKILL.md manifest 的目录。技能内容按 SHA-256 content-addressed 存储，变更后绑定角色的活跃会话自动归档。"
 />
 
 {#if loading}
@@ -236,100 +96,49 @@
 {:else if error}
 	<ErrorBanner message={error} onretry={load} />
 {:else}
-	<div class="grid gap-4 lg:grid-cols-[15rem_1fr]">
-		<div class="h-fit lg:sticky lg:top-4">
-			<AgentConfigFolderNav
-				{folders}
-				selected={selectedFolder}
-				{counts}
-				totalCount={skills.length}
-				{unfiledCount}
-				onselect={(id) => (selectedFolder = id)}
-				oncreate={openCreateFolder}
-				onrename={openRenameFolder}
-				ondelete={deleteFolder}
-			/>
-		</div>
-
-		<div>
-			<div class="saas-card-pad mb-6">
-				<div class="flex items-center justify-between">
-					<h2 class="saas-section-title">新建技能</h2>
-					<button class="text-sm text-primary-700 hover:text-primary-900" onclick={() => (showNewSkill = !showNewSkill)}>
-						{showNewSkill ? '取消' : '+ 新建'}
-					</button>
-				</div>
-				{#if showNewSkill}
-					<div class="mt-4 grid gap-3 sm:grid-cols-[12rem_8rem_1fr_auto]">
-						<input
-							class="saas-input font-mono text-sm"
-							placeholder="技能名（如 typst-help）"
-							bind:value={newSkillName}
-						/>
-						<input
-							class="saas-input text-sm"
-							placeholder="版本号"
-							bind:value={newSkillVersion}
-						/>
-						<input
-							class="saas-input text-sm"
-							placeholder="描述"
-							bind:value={newSkillDescription}
-						/>
-						<button class="saas-btn-primary" onclick={createSkill} disabled={creating}>
-							{creating ? '创建中…' : '创建'}
-						</button>
-					</div>
-					<p class="mt-2 text-xs text-surface-600">
-						技能名称仅允许小写字母、数字和连字符，且以字母或数字开头。创建后会生成 SKILL.md 模板；当前选中文件夹时新技能会自动归入其中。
-					</p>
-				{/if}
-			</div>
-
-			{#if skills.length === 0}
-				<div class="saas-card">
-					<EmptyState title="暂无技能" description="新建一个技能，然后在角色管理中绑定到角色。" />
-				</div>
-			{:else if visibleSkills.length === 0}
-				<div class="saas-card">
-					<EmptyState title="此分类下暂无技能" description="在技能卡片上可将其移入当前文件夹。" />
-				</div>
-			{:else}
-				<div class="space-y-4">
-					{#each visibleSkills as skill (skill.id)}
-						<SkillEditor
-							{slug}
-							{skill}
-							{folderItems}
-							oninstalled={onInstalled}
-							ondisabled={onDisabled}
-							onfolderchanged={onSkillFolderChanged}
-						/>
-					{/each}
-				</div>
-			{/if}
-		</div>
-	</div>
-
-	<Modal bind:open={showFolderModal} title={folderModalMode === 'create' ? '新建文件夹' : '重命名 / 移动文件夹'}>
-		<label class="saas-label" for="agent-folder-name">名称</label>
-		<input
-			id="agent-folder-name"
-			class="saas-input mb-4"
-			bind:value={folderName}
-			onkeydown={(e) => {
-				if (e.key === 'Enter') submitFolderModal();
-			}}
-		/>
-		<p class="saas-label">父文件夹</p>
-		<div class="mb-4">
-			<SelectField items={moveTargetItems} bind:value={folderParent} />
-		</div>
-		<div class="flex justify-end gap-2">
-			<button class="saas-btn-ghost" onclick={() => (showFolderModal = false)}>取消</button>
-			<button class="saas-btn-primary" onclick={submitFolderModal} disabled={savingFolder}>
-				{savingFolder ? '保存中…' : '保存'}
+	<div class="saas-card-pad mb-6">
+		<div class="flex items-center justify-between">
+			<h2 class="saas-section-title">新建技能</h2>
+			<button class="text-sm text-primary-700 hover:text-primary-900" onclick={() => (showNewSkill = !showNewSkill)}>
+				{showNewSkill ? '取消' : '+ 新建'}
 			</button>
 		</div>
-	</Modal>
+		{#if showNewSkill}
+			<div class="mt-4 grid gap-3 sm:grid-cols-[12rem_8rem_1fr_auto]">
+				<input
+					class="saas-input font-mono text-sm"
+					placeholder="技能名（如 typst-help）"
+					bind:value={newSkillName}
+				/>
+				<input
+					class="saas-input text-sm"
+					placeholder="版本号"
+					bind:value={newSkillVersion}
+				/>
+				<input
+					class="saas-input text-sm"
+					placeholder="描述"
+					bind:value={newSkillDescription}
+				/>
+				<button class="saas-btn-primary" onclick={createSkill} disabled={creating}>
+					{creating ? '创建中…' : '创建'}
+				</button>
+			</div>
+			<p class="mt-2 text-xs text-surface-600">
+				技能名称仅允许小写字母、数字和连字符，且以字母或数字开头。创建后会生成 SKILL.md 模板。
+			</p>
+		{/if}
+	</div>
+
+	{#if skills.length === 0}
+		<div class="saas-card">
+			<EmptyState title="暂无技能" description="新建一个技能，然后在角色管理中绑定到角色。" />
+		</div>
+	{:else}
+		<div class="space-y-4">
+			{#each skills as skill (skill.id)}
+				<SkillEditor {slug} {skill} oninstalled={onInstalled} ondisabled={onDisabled} />
+			{/each}
+		</div>
+	{/if}
 {/if}

hub/admin-web/src/routes/app.css

@@ -406,8 +406,7 @@
 		resize: vertical;
 	}
 
-	.saas-select-trigger,
-	.saas-combobox-input {
+	.saas-select-trigger {
 		display: inline-flex;
 		width: 100%;
 		align-items: center;
@@ -426,25 +425,14 @@
 		text-align: left;
 	}
 
-	.saas-combobox-input {
-		cursor: text;
-		padding-right: 2.25rem;
-	}
-
-	.saas-combobox-input::placeholder {
-		color: var(--color-surface-500);
-	}
-
 	.saas-select-trigger:focus-visible,
-	.saas-select-trigger[data-state='open'],
-	.saas-combobox-input:focus {
+	.saas-select-trigger[data-state='open'] {
 		border-color: var(--color-primary-600);
 		box-shadow: inset 0 0 0 1px var(--color-primary-600);
 	}
 
 	.saas-select-trigger:disabled,
-	.saas-select-trigger[data-disabled],
-	.saas-combobox-input:disabled {
+	.saas-select-trigger[data-disabled] {
 		cursor: not-allowed;
 		opacity: 0.55;
 	}
@@ -455,15 +443,9 @@
 
 	.saas-select-content {
 		z-index: 70;
-		max-height: min(
-			18rem,
-			var(
-				--bits-combobox-content-available-height,
-				var(--bits-select-content-available-height, 18rem)
-			)
-		);
-		width: var(--bits-combobox-anchor-width, var(--bits-select-anchor-width));
-		min-width: var(--bits-combobox-anchor-width, var(--bits-select-anchor-width));
+		max-height: min(18rem, var(--bits-select-content-available-height, 18rem));
+		width: var(--bits-select-anchor-width);
+		min-width: var(--bits-select-anchor-width);
 		overflow: hidden;
 		border-radius: 0;
 		border: 1px solid var(--color-surface-400);

hub/database-admin/.gitignore

@@ -0,0 +1,23 @@
+node_modules
+
+# Output
+.output
+.vercel
+.netlify
+.wrangler
+/.svelte-kit
+/build
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Env
+.env
+.env.*
+!.env.example
+!.env.test
+
+# Vite
+vite.config.js.timestamp-*
+vite.config.ts.timestamp-*

hub/database-admin/.npmrc

@@ -0,0 +1 @@
+engine-strict=true

hub/database-admin/.prettierignore

@@ -0,0 +1,4 @@
+build
+.svelte-kit
+node_modules
+package-lock.json

hub/database-admin/.prettierrc.json

@@ -0,0 +1,9 @@
+{
+	"useTabs": true,
+	"singleQuote": true,
+	"semi": true,
+	"trailingComma": "all",
+	"printWidth": 120,
+	"plugins": ["prettier-plugin-svelte"],
+	"overrides": [{ "files": "*.svelte", "options": { "parser": "svelte" } }]
+}

hub/database-admin/package.json

@@ -0,0 +1,33 @@
+{
+	"name": "database-admin",
+	"private": true,
+	"version": "0.0.1",
+	"type": "module",
+	"scripts": {
+		"dev": "vite dev",
+		"build": "vite build",
+		"preview": "vite preview",
+		"prepare": "svelte-kit sync || echo ''",
+		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
+		"format": "prettier --write .",
+		"format:check": "prettier --check ."
+	},
+	"devDependencies": {
+		"@skeletonlabs/skeleton": "^4.15.2",
+		"@skeletonlabs/skeleton-svelte": "^4.15.2",
+		"@sveltejs/adapter-auto": "^7.0.1",
+		"@sveltejs/adapter-static": "^3.0.10",
+		"@sveltejs/kit": "^2.63.0",
+		"@sveltejs/vite-plugin-svelte": "^7.1.2",
+		"@tailwindcss/vite": "^4.3.2",
+		"bits-ui": "^2.18.1",
+		"prettier": "^3.9.5",
+		"prettier-plugin-svelte": "^4.1.1",
+		"svelte": "^5.56.1",
+		"svelte-check": "^4.6.0",
+		"tailwindcss": "^4.3.2",
+		"typescript": "^6.0.3",
+		"vite": "^8.0.16"
+	}
+}

hub/database-admin/src/app.d.ts

@@ -0,0 +1,13 @@
+// See https://svelte.dev/docs/kit/types#app.d.ts
+// for information about these interfaces
+declare global {
+	namespace App {
+		// interface Error {}
+		// interface Locals {}
+		// interface PageData {}
+		// interface PageState {}
+		// interface Platform {}
+	}
+}
+
+export {};

hub/database-admin/src/app.html

@@ -0,0 +1,29 @@
+<!doctype html>
+<html lang="zh-CN">
+	<head>
+		<meta charset="utf-8" />
+		<meta name="viewport" content="width=device-width, initial-scale=1" />
+		<meta name="description" content="Curriculum Project Hub — 数据库管理后台" />
+		<link rel="icon" href="%sveltekit.assets%/favicon.svg" type="image/svg+xml" />
+		<link rel="preconnect" href="https://fonts.googleapis.com" />
+		<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+		<link
+			href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap"
+			rel="stylesheet"
+		/>
+		<style>
+			/* Fallback before CSS bundle */
+			html {
+				font-family: 'Inter', system-ui, 'Noto Sans SC', 'PingFang SC', sans-serif;
+			}
+		</style>
+		<title>Database Admin</title>
+		%sveltekit.head%
+	</head>
+	<body
+		data-sveltekit-preload-data="hover"
+		class="relative min-h-screen overflow-x-hidden bg-gradient-to-br from-slate-50 via-white to-indigo-50 text-slate-700"
+	>
+		<div style="display: contents">%sveltekit.body%</div>
+	</body>
+</html>

hub/database-admin/src/lib/api.ts

@@ -0,0 +1,76 @@
+/**
+ * Thin API client for the database-admin backend. Same-origin cookie auth,
+ * reusing the platform session (`cph_session`) and the admin plane's /api/me.
+ */
+
+export class ApiError extends Error {
+	code: string;
+	status: number;
+	constructor(code: string, message: string, status: number) {
+		super(message);
+		this.name = 'ApiError';
+		this.code = code;
+		this.status = status;
+	}
+}
+
+async function request(method: string, url: string, body?: unknown): Promise<unknown> {
+	const init: RequestInit = {
+		method,
+		credentials: 'same-origin',
+		headers: body !== undefined ? { 'content-type': 'application/json' } : undefined,
+		body: body !== undefined ? JSON.stringify(body) : undefined,
+	};
+	const res = await fetch(url, init);
+	const text = await res.text();
+	let data: unknown = null;
+	if (text !== '') {
+		try {
+			data = JSON.parse(text);
+		} catch {
+			data = text;
+		}
+	}
+	if (!res.ok) {
+		const err = (data as { error?: { code?: string; message?: string } } | null)?.error;
+		throw new ApiError(err?.code ?? 'http_error', err?.message ?? `HTTP ${res.status}`, res.status);
+	}
+	return data;
+}
+
+const get = (u: string) => request('GET', u);
+const post = (u: string, b?: unknown) => request('POST', u, b);
+
+// --- Types ---
+
+export interface OrgMembership {
+	id: string;
+	slug: string;
+	name: string;
+	status: string;
+	role: 'OWNER' | 'ADMIN' | 'MEMBER';
+}
+
+export interface MeResponse {
+	user: {
+		id: string;
+		feishuOpenId: string;
+		displayName: string;
+		avatarUrl: string | null;
+	};
+	organizations: OrgMembership[];
+}
+
+/** Unauthenticated bootstrap the login page needs: which org to OAuth against + dev toggle. */
+export interface DatabaseConfig {
+	siloOrganizationSlug: string;
+	devLoginEnabled: boolean;
+}
+
+// --- API ---
+
+export const api = {
+	me: () => get('/api/me') as Promise<MeResponse>,
+	logout: () => post('/auth/logout'),
+	databaseConfig: () => get('/database/config') as Promise<DatabaseConfig>,
+};

hub/database-admin/src/lib/components/Aurora.svelte

@@ -0,0 +1,6 @@
+<!-- Animated aurora background blobs, shared by both pages (soft pastels on light). -->
+<div class="pointer-events-none fixed inset-0 overflow-hidden">
+	<div class="aurora absolute -left-32 -top-32 h-96 w-96 rounded-full bg-violet-300/50"></div>
+	<div class="aurora absolute right-0 top-1/4 h-96 w-96 rounded-full bg-cyan-300/40" style="animation-delay:-6s"></div>
+	<div class="aurora absolute bottom-0 left-1/3 h-96 w-96 rounded-full bg-indigo-300/40" style="animation-delay:-12s"></div>
+</div>

hub/database-admin/src/lib/org.ts

@@ -0,0 +1,7 @@
+import type { OrgMembership } from './api';
+
+export function isOrgAdmin(org: OrgMembership | null | undefined): boolean {
+	if (!org) return false;
+	const role = String(org.role ?? '').toUpperCase();
+	return role === 'OWNER' || role === 'ADMIN';
+}

hub/database-admin/src/lib/session.ts

@@ -0,0 +1,58 @@
+import { writable } from 'svelte/store';
+import { goto } from '$app/navigation';
+import { base } from '$app/paths';
+import { api, type MeResponse } from './api';
+
+interface SessionState {
+	loading: boolean;
+	me: MeResponse | null;
+	error: string | null;
+}
+
+export const session = writable<SessionState>({
+	loading: true,
+	me: null,
+	error: null,
+});
+
+export async function loadSession(): Promise<void> {
+	session.update((s) => ({ ...s, loading: true, error: null }));
+	try {
+		const me = await api.me();
+		session.set({ loading: false, me, error: null });
+	} catch (err) {
+		const status = (err as { status?: number }).status;
+		if (status === 401) {
+			session.set({ loading: false, me: null, error: null });
+			void redirectToLogin();
+			return;
+		}
+		session.set({
+			loading: false,
+			me: null,
+			error: err instanceof Error ? err.message : String(err),
+		});
+	}
+}
+
+/**
+ * Send the browser to the login page (`/database/admin`). Unlike admin-web we
+ * don't jump straight to Feishu OAuth: the login page reads /database/config
+ * to build the org-scoped link and to show the dev bypass when enabled.
+ */
+export async function redirectToLogin(): Promise<void> {
+	const loginPath = `${base}/admin`;
+	if (window.location.pathname === loginPath) return;
+	await goto(loginPath, { replaceState: true });
+}
+
+/** Build the org-scoped Feishu OAuth entry point (a backend route, not under base). */
+export function feishuLoginHref(orgSlug: string, returnTo: string = `${base}/dashboard`): string {
+	return `/auth/feishu/${encodeURIComponent(orgSlug)}?returnTo=${encodeURIComponent(returnTo)}`;
+}
+
+export async function logout(): Promise<void> {
+	await api.logout();
+	session.set({ loading: false, me: null, error: null });
+	await redirectToLogin();
+}

hub/database-admin/src/routes/+layout.svelte

@@ -0,0 +1,7 @@
+<script lang="ts">
+	import './app.css';
+
+	let { children } = $props();
+</script>
+
+{@render children()}

hub/database-admin/src/routes/+page.svelte

@@ -0,0 +1,30 @@
+<script lang="ts">
+	import { onMount } from 'svelte';
+	import { goto } from '$app/navigation';
+	import { base } from '$app/paths';
+	import { api } from '$lib/api';
+
+	onMount(async () => {
+		// /database entry — route to dashboard if signed in, else the login page.
+		try {
+			await api.me();
+			await goto(`${base}/dashboard`, { replaceState: true });
+		} catch {
+			await goto(`${base}/admin`, { replaceState: true });
+		}
+	});
+</script>
+
+<div class="flex min-h-screen items-center justify-center">
+	<div class="flex flex-col items-center gap-3 text-slate-400">
+		<svg class="h-7 w-7 animate-spin text-violet-500" viewBox="0 0 24 24" fill="none">
+			<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+			<path
+				class="opacity-90"
+				fill="currentColor"
+				d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+			></path>
+		</svg>
+		<p class="text-sm">正在进入…</p>
+	</div>
+</div>

hub/database-admin/src/routes/admin/+page.svelte

@@ -0,0 +1,78 @@
+<script lang="ts">
+	import { onMount } from 'svelte';
+	import { goto } from '$app/navigation';
+	import { base } from '$app/paths';
+	import { api, type DatabaseConfig } from '$lib/api';
+	import { feishuLoginHref } from '$lib/session';
+	import Aurora from '$lib/components/Aurora.svelte';
+
+	let config = $state<DatabaseConfig | null>(null);
+	let error = $state<string | null>(null);
+
+	onMount(async () => {
+		// Already signed in → straight to the dashboard.
+		try {
+			await api.me();
+			await goto(`${base}/dashboard`, { replaceState: true });
+			return;
+		} catch {
+			// Not signed in (401) or backend unreachable — show the login card.
+		}
+		try {
+			config = await api.databaseConfig();
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		}
+	});
+
+	const feishuHref = $derived(config ? feishuLoginHref(config.siloOrganizationSlug) : '#');
+</script>
+
+<Aurora />
+
+<main class="flex min-h-screen items-center justify-center p-4">
+	<div class="rise glass relative w-full max-w-sm rounded-3xl border border-white/80 p-8 shadow-2xl shadow-indigo-200/50">
+		<div class="mb-7 text-center">
+			<div
+				class="mx-auto mb-5 flex h-14 w-14 items-center justify-center rounded-2xl bg-gradient-to-br from-violet-500 to-cyan-400 text-2xl font-bold text-white glow-btn"
+			>
+				D
+			</div>
+			<h1 class="text-2xl font-bold tracking-tight grad-text">Database Admin</h1>
+			<p class="mt-2 text-sm text-slate-500">使用飞书登录以管理数据库</p>
+		</div>
+
+		{#if error}
+			<div class="mb-4 rounded-xl border border-red-200 bg-red-50 px-4 py-3 text-sm text-red-600">
+				无法连接后端：{error}
+			</div>
+		{/if}
+
+		<a
+			href={feishuHref}
+			aria-disabled={config ? 'false' : 'true'}
+			class="rise-2 glow-btn group flex w-full items-center justify-center gap-2 rounded-xl bg-gradient-to-r from-violet-500 to-indigo-500 px-4 py-3.5 text-sm font-semibold text-white transition hover:from-violet-400 hover:to-indigo-400 aria-disabled:pointer-events-none aria-disabled:opacity-50"
+		>
+			<svg class="h-4 w-4" viewBox="0 0 24 24" fill="currentColor">
+				<path d="M12 2 3 7v10l9 5 9-5V7l-9-5Zm0 2.3 6.5 3.6L12 11.5 5.5 7.9 12 4.3Z" />
+			</svg>
+			使用飞书登录
+		</a>
+
+		{#if config?.devLoginEnabled}
+			<div class="relative my-6 rise-3">
+				<div class="absolute inset-0 flex items-center"><div class="w-full border-t border-slate-200"></div></div>
+				<div class="relative flex justify-center">
+					<span class="bg-white/70 px-3 text-[11px] font-medium uppercase tracking-[0.2em] text-slate-400">开发模式</span>
+				</div>
+			</div>
+			<a
+				href="/database/dev-login"
+				class="rise-3 group flex w-full items-center justify-center gap-2 rounded-xl border border-amber-300 bg-amber-50 px-4 py-3 text-sm font-semibold text-amber-700 transition hover:border-amber-400 hover:bg-amber-100"
+			>
+				<span>⚡</span> 一键登录管理员
+			</a>
+			<p class="rise-3 mt-2 text-center text-xs text-slate-400">仅开发环境可见 · 跳过飞书 OAuth</p>
+		{/if}
+	</div>
+</main>

hub/database-admin/src/routes/app.css

@@ -0,0 +1,96 @@
+@import 'tailwindcss';
+
+@source './**/*.{html,js,svelte,ts}';
+@source '../lib/**/*.{html,js,svelte,ts}';
+
+/*
+ * Design system for the database-admin SPA. Migrated verbatim (in spirit) from
+ * the previous server-rendered pages in hub/src/database/routes/databaseRoutes.ts:
+ * a light aurora / glassmorphism look with violet→cyan gradients and soft rise-in
+ * entrances. Distinct from admin-web's flat industrial theme on purpose.
+ */
+
+@theme {
+	--font-sans: 'Inter', system-ui, -apple-system, 'Segoe UI', 'Noto Sans SC', 'PingFang SC', sans-serif;
+}
+
+@keyframes aurora {
+	0% {
+		transform: translate(0, 0) scale(1);
+	}
+	33% {
+		transform: translate(6%, -8%) scale(1.15);
+	}
+	66% {
+		transform: translate(-8%, 6%) scale(0.9);
+	}
+	100% {
+		transform: translate(0, 0) scale(1);
+	}
+}
+
+@keyframes rise {
+	from {
+		opacity: 0;
+		transform: translateY(16px);
+	}
+	to {
+		opacity: 1;
+		transform: translateY(0);
+	}
+}
+
+@keyframes shimmer {
+	0% {
+		background-position: -200% 0;
+	}
+	100% {
+		background-position: 200% 0;
+	}
+}
+
+@layer base {
+	:root {
+		font-family: var(--font-sans);
+	}
+	html {
+		height: 100%;
+		-webkit-font-smoothing: antialiased;
+		-moz-osx-font-smoothing: grayscale;
+	}
+}
+
+@layer components {
+	.aurora {
+		filter: blur(80px);
+		animation: aurora 18s ease-in-out infinite;
+	}
+	.rise {
+		animation: rise 0.7s cubic-bezier(0.16, 1, 0.3, 1) both;
+	}
+	.rise-1 {
+		animation: rise 0.7s cubic-bezier(0.16, 1, 0.3, 1) both;
+	}
+	.rise-2 {
+		animation: rise 0.7s cubic-bezier(0.16, 1, 0.3, 1) 0.1s both;
+	}
+	.rise-3 {
+		animation: rise 0.7s cubic-bezier(0.16, 1, 0.3, 1) 0.2s both;
+	}
+	.grad-text {
+		background: linear-gradient(120deg, #7c3aed, #0891b2, #4f46e5);
+		background-size: 200% auto;
+		-webkit-background-clip: text;
+		background-clip: text;
+		color: transparent;
+		animation: shimmer 6s linear infinite;
+	}
+	.glass {
+		background: rgba(255, 255, 255, 0.7);
+		backdrop-filter: blur(16px);
+		-webkit-backdrop-filter: blur(16px);
+	}
+	.glow-btn {
+		box-shadow: 0 12px 32px -10px rgba(124, 58, 237, 0.45);
+	}
+}

hub/database-admin/src/routes/dashboard/+page.svelte

@@ -0,0 +1,160 @@
+<script lang="ts">
+	import { onMount } from 'svelte';
+	import { base } from '$app/paths';
+	import { session, loadSession, logout } from '$lib/session';
+	import { isOrgAdmin } from '$lib/org';
+	import Aurora from '$lib/components/Aurora.svelte';
+
+	onMount(() => {
+		loadSession();
+	});
+
+	// The session is scoped to the silo org, so /api/me returns exactly that org's
+	// membership. Admin gate: only OWNER/ADMIN may use the database console.
+	const me = $derived($session.me);
+	const org = $derived(me?.organizations[0] ?? null);
+	const allowed = $derived(isOrgAdmin(org));
+	const displayName = $derived(me?.user.displayName ?? '');
+	const initial = $derived(displayName.slice(0, 1) || 'U');
+
+	const navItems = [
+		{ label: '概览', href: `${base}/dashboard`, active: true, icon: 'M4 13h6V4H4v9Zm0 7h6v-5H4v5Zm10 0h6V11h-6v9Zm0-16v5h6V4h-6Z' },
+		{ label: '数据表', href: '#', active: false, icon: 'M4 5h16v4H4V5Zm0 6h16v4H4v-4Zm0 6h16v2H4v-2Z' },
+		{ label: '查询', href: '#', active: false, icon: 'm21 21-4.3-4.3M11 18a7 7 0 1 0 0-14 7 7 0 0 0 0 14Z' },
+		{
+			label: '设置',
+			href: '#',
+			active: false,
+			icon: 'M12 15a3 3 0 1 0 0-6 3 3 0 0 0 0 6Zm7-3 2 1-2 3-2-1a7 7 0 0 1-2 1l-1 2h-4l-1-2a7 7 0 0 1-2-1l-2 1-2-3 2-1a7 7 0 0 1 0-2l-2-1 2-3 2 1a7 7 0 0 1 2-1l1-2h4l1 2a7 7 0 0 1 2 1l2-1 2 3-2 1a7 7 0 0 1 0 2Z',
+		},
+	];
+
+	const stats = [
+		{ label: '数据表', value: '—', accent: 'from-violet-200/60 to-transparent' },
+		{ label: '记录数', value: '—', accent: 'from-cyan-200/60 to-transparent' },
+		{ label: '最近查询', value: '—', accent: 'from-indigo-200/60 to-transparent' },
+	];
+</script>
+
+<Aurora />
+
+{#if $session.loading}
+	<div class="flex min-h-screen items-center justify-center">
+		<div class="flex flex-col items-center gap-3 text-slate-400">
+			<svg class="h-8 w-8 animate-spin text-violet-500" viewBox="0 0 24 24" fill="none">
+				<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+				<path
+					class="opacity-90"
+					fill="currentColor"
+					d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+				></path>
+			</svg>
+			<p class="text-sm">加载中…</p>
+		</div>
+	</div>
+{:else if $session.error}
+	<div class="flex min-h-screen items-center justify-center p-4">
+		<div class="rise glass w-full max-w-sm rounded-3xl border border-white/80 p-8 text-center shadow-2xl shadow-indigo-200/50">
+			<h2 class="mb-2 text-lg font-bold text-slate-900">无法连接后端</h2>
+			<p class="mb-5 text-sm text-slate-500">{$session.error}</p>
+			<button
+				class="rounded-xl bg-gradient-to-r from-violet-500 to-indigo-500 px-4 py-2 text-sm font-semibold text-white"
+				onclick={() => loadSession()}>重试</button
+			>
+		</div>
+	</div>
+{:else if !allowed}
+	<div class="flex min-h-screen items-center justify-center p-4">
+		<div class="rise glass w-full max-w-md rounded-3xl border border-white/80 p-8 text-center shadow-2xl shadow-indigo-200/50">
+			<h2 class="mb-2 text-lg font-bold text-slate-900">无权访问</h2>
+			<p class="mb-5 text-sm text-slate-500">数据库管理台仅向组织所有者与管理员开放。</p>
+			<button
+				class="rounded-xl border border-slate-200 bg-white px-4 py-2 text-sm font-medium text-slate-600 transition hover:bg-slate-50"
+				onclick={() => logout()}>退出登录</button
+			>
+		</div>
+	</div>
+{:else}
+	<div class="relative flex min-h-screen">
+		<!-- 左侧菜单栏 -->
+		<aside class="flex w-64 shrink-0 flex-col border-r border-slate-200/80 glass">
+			<div class="flex items-center gap-3 px-5 py-6">
+				<div
+					class="flex h-10 w-10 items-center justify-center rounded-xl bg-gradient-to-br from-violet-500 to-cyan-400 text-lg font-bold text-white glow-btn"
+				>
+					D
+				</div>
+				<span class="text-base font-bold grad-text">Database Admin</span>
+			</div>
+			<nav class="flex flex-1 flex-col gap-1.5 px-3 py-2">
+				{#each navItems as item}
+					<a
+						href={item.href}
+						class={item.active
+							? 'group flex items-center gap-3 rounded-xl bg-gradient-to-r from-violet-500 to-indigo-500 px-3 py-2.5 text-sm font-semibold text-white shadow-lg shadow-indigo-300/50'
+							: 'group flex items-center gap-3 rounded-xl px-3 py-2.5 text-sm font-medium text-slate-500 transition hover:bg-slate-100 hover:text-slate-900'}
+					>
+						<svg
+							class="h-4 w-4 shrink-0"
+							viewBox="0 0 24 24"
+							fill="none"
+							stroke="currentColor"
+							stroke-width="1.8"
+							stroke-linecap="round"
+							stroke-linejoin="round"><path d={item.icon} /></svg
+						>
+						{item.label}
+					</a>
+				{/each}
+			</nav>
+			<div class="m-3 flex items-center gap-3 rounded-xl border border-slate-200 bg-white/60 px-3 py-3">
+				<div
+					class="flex h-9 w-9 items-center justify-center rounded-full bg-gradient-to-br from-violet-500 to-indigo-500 text-sm font-semibold text-white"
+				>
+					{initial}
+				</div>
+				<div class="min-w-0">
+					<p class="text-[11px] uppercase tracking-wider text-slate-400">已登录</p>
+					<p class="truncate text-sm font-medium text-slate-700">{displayName}</p>
+				</div>
+			</div>
+		</aside>
+
+		<!-- 右侧内容 -->
+		<div class="flex flex-1 flex-col">
+			<header class="flex items-center justify-between border-b border-slate-200/80 glass px-8 py-4">
+				<div>
+					<h1 class="text-lg font-bold text-slate-900">概览</h1>
+					<p class="text-xs text-slate-400">欢迎回来，这里是数据库管理台</p>
+				</div>
+				<button
+					onclick={() => logout()}
+					class="rounded-xl border border-slate-200 bg-white px-4 py-2 text-sm font-medium text-slate-600 transition hover:border-slate-300 hover:bg-slate-50 hover:text-slate-900"
+				>
+					退出登录
+				</button>
+			</header>
+
+			<main class="flex-1 p-8">
+				<div class="grid grid-cols-1 gap-5 sm:grid-cols-3">
+					{#each stats as s, i}
+						<div
+							class="rise-{i +
+								1} group relative overflow-hidden rounded-2xl border border-white/80 glass p-5 shadow-lg shadow-slate-200/50 transition hover:-translate-y-0.5 hover:shadow-xl hover:shadow-indigo-200/50"
+						>
+							<div class="absolute inset-0 bg-gradient-to-br {s.accent} opacity-0 transition group-hover:opacity-100"></div>
+							<p class="relative text-sm text-slate-500">{s.label}</p>
+							<p class="relative mt-2 text-3xl font-bold text-slate-900">{s.value}</p>
+						</div>
+					{/each}
+				</div>
+
+				<div
+					class="rise-3 mt-6 flex h-64 items-center justify-center rounded-2xl border border-dashed border-slate-300 glass text-sm text-slate-400"
+				>
+					内容区占位 · 后续数据端点挂在 /database/* 并加 guard
+				</div>
+			</main>
+		</div>
+	</div>
+{/if}

hub/database-admin/static/favicon.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" fill="none">
+	<rect width="32" height="32" rx="8" fill="#4F46E5"/>
+	<path d="M8 10.5h7.5a3.5 3.5 0 0 1 0 7H11v4H8v-11Zm3 4.5h4.5a1.5 1.5 0 0 0 0-3H11v3Z" fill="white"/>
+	<path d="M20.5 21.5c1.93 0 3.5-1.34 3.5-3s-1.57-3-3.5-3S17 16.84 17 18.5s1.57 3 3.5 3Z" fill="white" opacity=".9"/>
+</svg>

hub/database-admin/static/robots.txt

@@ -0,0 +1,3 @@
+# allow crawling everything by default
+User-agent: *
+Disallow:

hub/database-admin/svelte.config.js

@@ -0,0 +1,22 @@
+import adapter from '@sveltejs/adapter-static';
+import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
+
+/** @type {import('@sveltejs/kit').Config} */
+const config = {
+	preprocess: vitePreprocess(),
+	kit: {
+		adapter: adapter({
+			pages: 'build',
+			assets: 'build',
+			fallback: 'index.html',
+			precompress: false,
+			strict: false,
+		}),
+		// This SPA is served under /database by the Hub. admin-web owns the
+		// root asset paths (/_app, /favicon.svg); a base path moves this app's
+		// assets to /database/_app/* so the two builds never collide.
+		paths: { base: '/database' },
+	},
+};
+
+export default config;

hub/database-admin/tsconfig.json

@@ -0,0 +1,20 @@
+{
+	"extends": "./.svelte-kit/tsconfig.json",
+	"compilerOptions": {
+		"rewriteRelativeImportExtensions": true,
+		"allowJs": true,
+		"checkJs": true,
+		"esModuleInterop": true,
+		"forceConsistentCasingInFileNames": true,
+		"resolveJsonModule": true,
+		"skipLibCheck": true,
+		"sourceMap": true,
+		"strict": true,
+		"moduleResolution": "bundler"
+	}
+	// Path aliases are handled by https://svelte.dev/docs/kit/configuration#alias
+	// except $lib which is handled by https://svelte.dev/docs/kit/configuration#files
+	//
+	// To make changes to top-level options such as include and exclude, we recommend extending
+	// the generated config; see https://svelte.dev/docs/kit/configuration#typescript
+}

hub/database-admin/vite.config.ts

@@ -0,0 +1,17 @@
+import { sveltekit } from '@sveltejs/kit/vite';
+import tailwindcss from '@tailwindcss/vite';
+import { defineConfig } from 'vite';
+
+export default defineConfig({
+	plugins: [tailwindcss(), sveltekit()],
+	server: {
+		proxy: {
+			'/api': 'http://127.0.0.1:8788',
+			'/auth': 'http://127.0.0.1:8788',
+			// Backend owns the /database/* HTTP surface (login page, dashboard,
+			// data routes). Proxy it in dev so those paths hit the real server
+			// instead of the SPA fallback.
+			'/database': 'http://127.0.0.1:8788',
+		},
+	},
+});

hub/deploy/deploy_fleet_release.sh

@@ -82,10 +82,11 @@ REMOTE
   rsync -az --delete \
     --exclude node_modules --exclude dist --exclude .env \
     --exclude admin-web/node_modules --exclude admin-web/build --exclude admin-web/.svelte-kit \
+    --exclude database-admin/node_modules --exclude database-admin/build --exclude database-admin/.svelte-kit \
     -e "ssh ${SSH_OPTS[*]}" \
     "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"
 
-  echo "[fleet] npm ci + build (tsc + admin-web SPA)"
+  echo "[fleet] npm ci + build (tsc + admin-web & database-admin SPAs)"
   ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" bash -s <<REMOTE
 set -euo pipefail
 flock /var/lock/cph-hub-release-publish bash -c '
@@ -97,9 +98,11 @@ flock /var/lock/cph-hub-release-publish bash -c '
   cd "$HUB_DIR"
   PUPPETEER_SKIP_DOWNLOAD=1 npm ci
   npm ci --prefix admin-web
+  npm ci --prefix database-admin
   npm run audit:production
   npm run build
   test -f admin-web/build/index.html
+  test -f database-admin/build/index.html
   touch "$RELEASE_DIR/.complete"
 '
 REMOTE

hub/deploy/deploy_platform.sh

@@ -60,10 +60,11 @@ if [ "$release_ready" = false ]; then
     -e "ssh ${SSH_OPTS[*]}" \
     "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"
 
-  # 2. Install deps (hub + admin-web), audit hub prod, build tsc + SPA, mark complete.
-  # `npm run build` → tsc then admin:build → admin-web/build for registerStaticSpa.
+  # 2. Install deps (hub + both SPAs), audit hub prod, build tsc + SPAs, mark complete.
+  # `npm run build` → tsc then admin:build + database:build → admin-web/build and
+  # database-admin/build for registerStaticSpa / registerDatabaseSpa.
   ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" \
-    "cd '$HUB_DIR' && PUPPETEER_SKIP_DOWNLOAD=1 npm ci && npm ci --prefix admin-web && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
+    "cd '$HUB_DIR' && PUPPETEER_SKIP_DOWNLOAD=1 npm ci && npm ci --prefix admin-web && npm ci --prefix database-admin && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
 fi
 
 # 3. Ensure the service is installed (idempotent), then restart.

hub/filelib-web/index.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>文件库</title>
+  </head>
+  <body>
+    <div id="app"></div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>

hub/filelib-web/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "filelib-web",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build",
+    "preview": "vite preview",
+    "check": "svelte-check --tsconfig ./tsconfig.json"
+  },
+  "devDependencies": {
+    "@sveltejs/vite-plugin-svelte": "^7.1.2",
+    "@tailwindcss/vite": "^4.3.2",
+    "svelte": "^5.56.1",
+    "svelte-check": "^4.6.0",
+    "tailwindcss": "^4.3.2",
+    "typescript": "^5.7.0",
+    "vite": "^8.0.16"
+  }
+}

hub/filelib-web/src/App.svelte

@@ -0,0 +1,30 @@
+<script lang="ts">
+  import { onMount } from "svelte";
+  import { api, UnauthenticatedError } from "./lib/api.js";
+  import { me, authChecked } from "./lib/stores.js";
+  import type { MeResponse } from "./lib/types.js";
+  import LoginView from "./lib/LoginView.svelte";
+  import BrowserShell from "./lib/BrowserShell.svelte";
+  import Toasts from "./lib/Toasts.svelte";
+
+  onMount(async () => {
+    try {
+      me.set(await api<MeResponse>("/database/api/me"));
+    } catch (e) {
+      if (!(e instanceof UnauthenticatedError)) console.error(e);
+      me.set(null);
+    } finally {
+      authChecked.set(true);
+    }
+  });
+</script>
+
+{#if !$authChecked}
+  <div class="flex h-full items-center justify-center text-ink-3">加载中…</div>
+{:else if $me}
+  <BrowserShell />
+{:else}
+  <LoginView />
+{/if}
+
+<Toasts />

hub/filelib-web/src/app.css

@@ -0,0 +1,66 @@
+@import "tailwindcss";
+
+/* 全局 UI 主题令牌(与 hub 端 uiTheme.ts 同源) */
+@theme {
+  --color-bg: #fcfcfb;
+  --color-panel: #ffffff;
+  --color-sidebar: #f7f7f5;
+  --color-ink: #1a1a18;
+  --color-ink-2: #6b6a66;
+  --color-ink-3: #9c9b96;
+  --color-line: #ecece8;
+  --color-line-soft: #f1f1ee;
+  --color-hover: #f4f4f1;
+  --color-selected: #ebebe7;
+  --color-accent: #1a1a18;
+  --color-accent-hover: #333330;
+  --color-danger: #a13a33;
+  --color-guide: #e9e9e5;
+  --color-diff-add-bg: #f3f6f2;
+  --color-diff-add-text: #4a6741;
+  --color-diff-del-bg: #f8f2f1;
+  --color-diff-del-text: #a13a33;
+}
+
+html,
+body,
+#app {
+  height: 100%;
+}
+
+body {
+  background: var(--color-bg);
+  color: var(--color-ink);
+  font-family:
+    "Inter",
+    -apple-system,
+    "Segoe UI",
+    "PingFang SC",
+    "Microsoft YaHei",
+    sans-serif;
+  font-size: 14px;
+  line-height: 1.65;
+  -webkit-font-smoothing: antialiased;
+}
+
+.font-mono {
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+}
+
+/* diff 渲染 */
+pre.diff {
+  white-space: pre-wrap;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 12.5px;
+  line-height: 1.75;
+}
+pre.diff .add {
+  display: block;
+  color: var(--color-diff-add-text);
+  background: var(--color-diff-add-bg);
+}
+pre.diff .del {
+  display: block;
+  color: var(--color-diff-del-text);
+  background: var(--color-diff-del-bg);
+}

hub/filelib-web/src/lib/BrowserShell.svelte

@@ -0,0 +1,171 @@
+<script lang="ts">
+  import { onMount } from "svelte";
+  import { api } from "./api.js";
+  import { me, toastErr, toastOk } from "./stores.js";
+  import { treeVersion, bumpTree, currentNode, selectedFilePath, clearSelectedFile, bumpFiles } from "./browser.js";
+  import type { NodeChild } from "./types.js";
+  import TreeNode from "./TreeNode.svelte";
+  import NodeDetailPanel from "./NodeDetailPanel.svelte";
+  import FileEditor from "./FileEditor.svelte";
+  import GroupAdmin from "./GroupAdmin.svelte";
+  import Modal from "./Modal.svelte";
+
+  // 视图切换(仅管理员可见 Group 管理入口;非管理员恒为 library)。
+  let view = $state<"library" | "groups">("library");
+
+  let roots = $state<NodeChild[] | null>(null);
+  let treeError = $state<string | null>(null);
+  let showCreateRoot = $state(false);
+  let newName = $state("");
+  let newKind = $state<"FOLDER" | "PROJECT">("FOLDER");
+  let newDesc = $state("");
+
+  async function loadRoots(): Promise<void> {
+    try {
+      const r = await api<{ nodes: NodeChild[] }>("/database/api/nodes");
+      roots = r.nodes;
+      treeError = null;
+    } catch (e) {
+      treeError = e instanceof Error ? e.message : String(e);
+    }
+  }
+
+  onMount(loadRoots);
+  $effect(() => {
+    void $treeVersion;
+    void loadRoots();
+  });
+
+  async function createRoot(): Promise<void> {
+    const name = newName.trim();
+    if (name === "") return;
+    try {
+      await api("/database/api/nodes", {
+        method: "POST",
+        body: {
+          parentId: null,
+          kind: newKind,
+          name,
+          ...(newDesc.trim() !== "" ? { description: newDesc.trim() } : {}),
+        },
+      });
+      toastOk("已创建");
+      showCreateRoot = false;
+      newName = ""; newKind = "FOLDER"; newDesc = "";
+      bumpTree();
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function logout(): Promise<void> {
+    try { await fetch("/auth/logout", { method: "POST", credentials: "same-origin" }); } catch { /* ignore */ }
+    me.set(null);
+  }
+
+  const initial = $derived(($me?.userId ?? "U").slice(0, 1).toUpperCase());
+</script>
+
+<div class="flex h-full flex-col">
+  {#if $me?.isWebsiteAdmin}
+    <!-- 视图切换(仅管理员) -->
+    <div class="flex shrink-0 items-center gap-1 border-b border-line-soft bg-sidebar px-3 py-1.5">
+      <button
+        class="rounded-lg px-3 py-1 text-[12.5px] font-medium transition"
+        class:bg-selected={view === "library"}
+        class:text-ink={view === "library"}
+        class:text-ink-3={view !== "library"}
+        onclick={() => (view = "library")}
+      >文件库</button>
+      <button
+        class="rounded-lg px-3 py-1 text-[12.5px] font-medium transition"
+        class:bg-selected={view === "groups"}
+        class:text-ink={view === "groups"}
+        class:text-ink-3={view !== "groups"}
+        onclick={() => (view = "groups")}
+      >Group 管理</button>
+    </div>
+  {/if}
+
+  <div class="flex min-h-0 flex-1">
+  {#if $me?.isWebsiteAdmin && view === "groups"}
+    <GroupAdmin />
+  {:else}
+  <!-- 侧栏 -->
+  <aside class="flex w-[300px] shrink-0 flex-col border-r border-line-soft bg-sidebar">
+    <div class="flex items-center justify-between border-b border-line-soft px-4 py-3.5">
+      <span class="text-[15px] font-semibold text-ink">文件库</span>
+      {#if $me?.isWebsiteAdmin}
+        <button class="rounded-lg border border-line bg-panel px-2.5 py-1 text-[11.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreateRoot = true)}>
+          + 根目录
+        </button>
+      {/if}
+    </div>
+
+    <div class="flex-1 overflow-y-auto px-2 py-2 text-[13px]">
+      {#if roots === null}
+        <div class="px-3 py-6 text-center text-xs text-ink-3">加载中…</div>
+      {:else if treeError}
+        <div class="px-3 py-6 text-center text-xs text-danger">{treeError}</div>
+      {:else if roots.length === 0}
+        <div class="px-3 py-6 text-center text-xs text-ink-3">
+          {$me?.isWebsiteAdmin ? "空文件库 · 点上方「+ 根目录」开始" : "文件库为空,请联系管理员创建根目录"}
+        </div>
+      {:else}
+        {#each roots as node (node.id)}
+          <TreeNode {node} depth={0} />
+        {/each}
+      {/if}
+    </div>
+
+    <div class="flex items-center gap-2 border-t border-line-soft px-4 py-3 text-[12.5px]">
+      <div class="flex h-6 w-6 shrink-0 items-center justify-center rounded-full bg-accent text-[11px] font-semibold text-white">{initial}</div>
+      <span class="flex-1 truncate text-ink">{$me?.userId ?? ""}</span>
+      <button class="rounded-lg border border-line-soft px-2.5 py-1 text-[11.5px] text-ink-3 transition hover:bg-hover hover:text-ink" onclick={logout} title="退出登录">退出</button>
+    </div>
+  </aside>
+
+  <!-- 主区 -->
+  <main class="flex-1 overflow-y-auto">
+    <NodeDetailPanel />
+  </main>
+
+  <!-- 右侧:文件预览/编辑栏(选中文件时出现) -->
+  {#if $selectedFilePath && $currentNode?.kind === "PROJECT"}
+    <section class="flex w-[46%] min-w-[420px] shrink-0 flex-col overflow-y-auto border-l border-line-soft bg-bg p-4">
+      <FileEditor
+        projectId={$currentNode.id}
+        path={$selectedFilePath}
+        role={$currentNode.role}
+        onchanged={bumpFiles}
+        onclose={clearSelectedFile}
+      />
+    </section>
+  {/if}
+  {/if}
+  </div>
+</div>
+
+{#if showCreateRoot}
+  <Modal title="新建根目录" onclose={() => (showCreateRoot = false)}>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="root-name">名称</label>
+      <input id="root-name" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newName} placeholder="例如:物理教研" />
+    </div>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="root-kind">类型</label>
+      <select id="root-kind" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newKind}>
+        <option value="FOLDER">文件夹</option>
+        <option value="PROJECT">项目(课程资源库)</option>
+      </select>
+    </div>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="root-desc">简介(可选)</label>
+      <textarea id="root-desc" rows="3" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-xs outline-none focus:border-accent" bind:value={newDesc} placeholder="简要说明用途…"></textarea>
+    </div>
+    <div class="mt-4 flex justify-end gap-2">
+      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreateRoot = false)}>取消</button>
+      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={createRoot}>创建</button>
+    </div>
+  </Modal>
+{/if}

hub/filelib-web/src/lib/FileEditor.svelte

@@ -0,0 +1,165 @@
+<script lang="ts">
+  import { api, ApiError } from "./api.js";
+  import { toastOk, toastErr, toast } from "./stores.js";
+  import type { FileContent, VersionInfo, Role } from "./types.js";
+  import Modal from "./Modal.svelte";
+
+  let { projectId, path, role, onchanged, onclose }: { projectId: string; path: string; role: Role; onchanged: () => void; onclose?: () => void } = $props();
+
+  let file = $state<FileContent | null>(null);
+  let draft = $state("");
+  let loadError = $state<string | null>(null);
+  let conflict = $state<{ currentVersion: string; diff: string } | null>(null);
+  let showHistory = $state(false);
+  let history = $state<VersionInfo[]>([]);
+
+  const canEdit = $derived(role !== "VIEW");
+
+  async function load(): Promise<void> {
+    try {
+      file = await api<FileContent>(`/database/api/projects/${projectId}/file?path=${encodeURIComponent(path)}`);
+      draft = file.encoding === "utf8" ? file.content : "";
+      loadError = null;
+      conflict = null;
+    } catch (e) {
+      loadError = e instanceof Error ? e.message : String(e);
+    }
+  }
+
+  $effect(() => {
+    void projectId;
+    void path;
+    void load();
+  });
+
+  async function save(): Promise<void> {
+    if (file === null) return;
+    try {
+      const r = await api<{ version: string }>(`/database/api/projects/${projectId}/file/commits`, {
+        method: "POST",
+        body: { path: file.path, baseVersion: file.version, content: draft },
+      });
+      toastOk("已提交 " + r.version);
+      await load();
+      onchanged();
+    } catch (e) {
+      if (e instanceof ApiError && e.status === 409 && typeof e.details?.["currentVersion"] === "string") {
+        await showConflict(e.details["currentVersion"]);
+      } else {
+        toastErr(e instanceof Error ? e.message : String(e));
+      }
+    }
+  }
+
+  async function showConflict(currentVersion: string): Promise<void> {
+    if (file === null) return;
+    try {
+      const r = await api<{ diff: string }>(
+        `/database/api/projects/${projectId}/file/diff?path=${encodeURIComponent(file.path)}&from=${encodeURIComponent(file.version)}&to=${encodeURIComponent(currentVersion)}`,
+      );
+      conflict = { currentVersion, diff: r.diff };
+      file = { ...file, version: currentVersion };
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function acceptLatest(): Promise<void> {
+    conflict = null;
+    await load();
+    toast("已载入最新内容,请在此基础上合并", "info");
+  }
+
+  async function remove(): Promise<void> {
+    if (file === null || !confirm("删除文件 " + file.path + "?")) return;
+    try {
+      await api(`/database/api/projects/${projectId}/file?path=${encodeURIComponent(file.path)}`, {
+        method: "DELETE",
+        body: { baseVersion: file.version },
+      });
+      toastOk("已删除");
+      file = null;
+      onchanged();
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function openHistory(): Promise<void> {
+    try {
+      const r = await api<{ history: VersionInfo[] }>(`/database/api/projects/${projectId}/file/history?path=${encodeURIComponent(path)}`);
+      history = r.history;
+      showHistory = true;
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  function renderDiff(diff: string): string {
+    return diff
+      .replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")
+      .replace(/^\+(.*)$/gm, '<span class="add">+$1</span>')
+      .replace(/^-(.*)$/gm, '<span class="del">-$1</span>');
+  }
+</script>
+
+{#if loadError}
+  <div class="rounded-xl border border-line-soft bg-panel p-5 text-xs text-danger">{loadError}</div>
+{:else if file}
+  <div class="rounded-xl border border-line-soft bg-panel p-5">
+    <div class="mb-2.5 flex items-center justify-between">
+      <span class="font-mono text-[11px] text-ink-3">{file.path} @ {file.version}</span>
+      <div class="flex items-center gap-2">
+        <a class="rounded-lg border border-line bg-panel px-3 py-1 text-[12px] font-medium text-ink transition hover:bg-hover" href="/database/api/projects/{projectId}/file/raw?path={encodeURIComponent(file.path)}" download>下载</a>
+        <button class="rounded-lg border border-line bg-panel px-3 py-1 text-[12px] font-medium text-ink transition hover:bg-hover" onclick={openHistory}>历史</button>
+        {#if canEdit}
+          <button class="rounded-lg border border-transparent px-3 py-1 text-[12px] font-medium text-danger transition hover:bg-[#A13A3312]" onclick={remove}>删除文件</button>
+        {/if}
+        {#if onclose}
+          <button class="rounded-lg border border-line bg-panel px-2.5 py-1 text-[12px] font-medium text-ink-3 transition hover:bg-hover hover:text-ink" onclick={onclose} title="关闭预览">✕</button>
+        {/if}
+      </div>
+    </div>
+
+    {#if file.encoding === "base64"}
+      <div class="text-xs text-ink-3">二进制文件({file.size} B),不支持在线编辑</div>
+    {:else}
+      <textarea rows="14" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-xs leading-7 outline-none focus:border-accent" bind:value={draft} readonly={!canEdit}></textarea>
+    {/if}
+
+    {#if canEdit && file.encoding !== "base64"}
+      <div class="mt-3 flex justify-end">
+        <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={save}>提交修改</button>
+      </div>
+    {/if}
+
+    {#if conflict}
+      <div class="mt-3.5 rounded-xl border border-[#E8E2C8] bg-[#FCFBF4] p-4">
+        <div class="mb-2 text-[13px] font-semibold text-[#6E6329]">冲突:他人已提交 {conflict.currentVersion},差异如下(你的基版 → 最新版)</div>
+        <pre class="diff rounded-lg border border-line-soft bg-panel p-3">{@html renderDiff(conflict.diff)}</pre>
+        <div class="mt-2 text-[11.5px] text-[#8A8059]">请人工合并后,以最新内容为全文重新提交(基版将更新为 {conflict.currentVersion})</div>
+        <div class="mt-2 flex justify-end">
+          <button class="rounded-lg border border-line bg-panel px-3 py-1 text-[12px] font-medium text-ink transition hover:bg-hover" onclick={acceptLatest}>载入最新内容</button>
+        </div>
+      </div>
+    {/if}
+  </div>
+{:else}
+  <div class="rounded-xl border border-line-soft bg-panel p-5 text-xs text-ink-3">加载中…</div>
+{/if}
+
+{#if showHistory}
+  <Modal title="版本历史" onclose={() => (showHistory = false)}>
+    <div class="max-h-80 overflow-y-auto">
+      {#each history as v (v.version)}
+        <div class="border-t border-line-soft py-2 text-xs first:border-t-0">
+          <span class="font-mono text-accent">{v.version}</span> {v.message}
+          <div class="text-ink-3">{new Date(v.committedAt).toLocaleString("zh-CN")}{v.author ? " · " + v.author : ""}</div>
+        </div>
+      {/each}
+    </div>
+    <div class="mt-3 flex justify-end">
+      <button class="rounded-lg border border-line bg-panel px-3 py-1 text-[12px] font-medium text-ink transition hover:bg-hover" onclick={() => (showHistory = false)}>关闭</button>
+    </div>
+  </Modal>
+{/if}

hub/filelib-web/src/lib/FilesPanel.svelte

@@ -0,0 +1,137 @@
+<script lang="ts">
+  import { api } from "./api.js";
+  import { toastOk, toastErr } from "./stores.js";
+  import { selectedFilePath, filesVersion } from "./browser.js";
+  import type { FileEntry, NodeDetail } from "./types.js";
+  import Modal from "./Modal.svelte";
+
+  let { node }: { node: NodeDetail } = $props();
+
+  let files = $state<FileEntry[] | null>(null);
+  let loadError = $state<string | null>(null);
+  let showNewFile = $state(false);
+  let newPath = $state("");
+  let newContent = $state("");
+  let uploadInput: HTMLInputElement;
+
+  const canEdit = $derived(node.role !== "VIEW");
+
+  async function loadFiles(): Promise<void> {
+    try {
+      const r = await api<{ files: FileEntry[] }>(`/database/api/projects/${node.id}/files`);
+      files = r.files;
+      loadError = null;
+    } catch (e) {
+      loadError = e instanceof Error ? e.message : String(e);
+    }
+  }
+
+  $effect(() => {
+    void node.id;
+    void $filesVersion;
+    void loadFiles();
+  });
+
+  async function submitNewFile(): Promise<void> {
+    const path = newPath.trim();
+    if (path === "") return;
+    try {
+      await api(`/database/api/projects/${node.id}/file`, {
+        method: "PUT",
+        body: { path, content: newContent },
+      });
+      toastOk("已创建");
+      showNewFile = false;
+      newPath = ""; newContent = "";
+      await loadFiles();
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  function u8ToBase64(bytes: Uint8Array): string {
+    let bin = "";
+    const CHUNK = 0x8000;
+    for (let i = 0; i < bytes.length; i += CHUNK) {
+      bin += String.fromCharCode.apply(null, Array.from(bytes.subarray(i, i + CHUNK)) as unknown as number[]);
+    }
+    return btoa(bin);
+  }
+
+  async function doUpload(e: Event): Promise<void> {
+    const input = e.target as HTMLInputElement;
+    const file = input.files?.[0];
+    input.value = "";
+    if (!file) return;
+    if (file.size > 10 * 1024 * 1024) {
+      toastErr("文件超过 10MB 上限");
+      return;
+    }
+    const targetPath = prompt("保存到路径(可含目录):", "材料/" + file.name);
+    if (!targetPath) return;
+    const bytes = new Uint8Array(await file.arrayBuffer());
+    const isBinary = bytes.includes(0);
+    const body = isBinary
+      ? { path: targetPath, content: u8ToBase64(bytes), encoding: "base64" }
+      : { path: targetPath, content: new TextDecoder("utf-8").decode(bytes), encoding: "utf8" };
+    try {
+      await api(`/database/api/projects/${node.id}/file`, { method: "PUT", body });
+      toastOk("已上传 " + file.name);
+      await loadFiles();
+    } catch (err) {
+      toastErr(err instanceof Error ? err.message : String(err));
+    }
+  }
+</script>
+
+<div class="rounded-xl border border-line-soft bg-panel p-5">
+  <div class="mb-2 flex items-center justify-between">
+    <div class="text-[13px] font-semibold">项目文件({files?.length ?? 0})</div>
+    {#if canEdit}
+      <div class="flex gap-2">
+        <button class="rounded-lg border border-line bg-panel px-3 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showNewFile = true)}>+ 新建文件</button>
+        <button class="rounded-lg bg-accent px-3 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={() => uploadInput.click()}>上传文件</button>
+        <input bind:this={uploadInput} type="file" class="hidden" onchange={doUpload} />
+      </div>
+    {/if}
+  </div>
+
+  {#if files === null && loadError === null}
+    <div class="py-5 text-center text-xs text-ink-3">加载中…</div>
+  {:else if loadError}
+    <div class="py-5 text-center text-xs text-danger">{loadError}</div>
+  {:else if files && files.length === 0}
+    <div class="py-5 text-center text-xs text-ink-3">空仓库 · 可新建或上传文件</div>
+  {:else if files}
+    <table class="w-full border-collapse text-[13px]">
+      <tbody>
+        {#each files as f (f.path)}
+          <tr
+            class="cursor-pointer border-t border-line-soft first:border-t-0 {$selectedFilePath === f.path ? 'bg-selected' : 'hover:bg-hover'}"
+            onclick={() => selectedFilePath.set(f.path)}
+          >
+            <td class="py-2 font-mono text-[12.5px] text-ink">{f.path}</td>
+            <td class="py-2 text-right font-mono text-[11px] text-ink-3">{f.size} B</td>
+          </tr>
+        {/each}
+      </tbody>
+    </table>
+  {/if}
+</div>
+
+{#if showNewFile}
+  <Modal title="新建文件" onclose={() => (showNewFile = false)}>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="nf-path">路径</label>
+      <input id="nf-path" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-[13px] outline-none focus:border-accent" bind:value={newPath} placeholder="docs/intro.md" />
+    </div>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="nf-content">内容</label>
+      <textarea id="nf-content" rows="8" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-xs outline-none focus:border-accent" bind:value={newContent} placeholder="内容…"></textarea>
+    </div>
+    <div class="mt-4 flex justify-end gap-2">
+      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showNewFile = false)}>取消</button>
+      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={submitNewFile}>创建</button>
+    </div>
+  </Modal>
+{/if}

hub/filelib-web/src/lib/GroupAdmin.svelte

@@ -0,0 +1,280 @@
+<script lang="ts">
+  import { onMount } from "svelte";
+  import { api } from "./api.js";
+  import { toastErr, toastOk } from "./stores.js";
+  import type { MemberGroupNode, MemberGroupMember } from "./types.js";
+  import Modal from "./Modal.svelte";
+
+  // 后端返回活跃组扁平列表(ADR-0028);前端按 parentId/depth 拼成有序树。
+  let groups = $state<MemberGroupNode[] | null>(null);
+  let listError = $state<string | null>(null);
+  let selectedId = $state<string | null>(null);
+
+  let members = $state<MemberGroupMember[] | null>(null);
+  let membersError = $state<string | null>(null);
+
+  // 新建组弹窗:parentId=null 建根,否则建子。
+  let showCreate = $state(false);
+  let createParentId = $state<string | null>(null);
+  let createParentName = $state<string | null>(null);
+  let newName = $state("");
+  let newDesc = $state("");
+
+  let addValue = $state("");
+
+  const selected = $derived(groups?.find((g) => g.id === selectedId) ?? null);
+
+  /** 扁平列表按 parentId 排成先根遍历顺序(每项自带 depth,渲染时缩进)。 */
+  const ordered = $derived.by(() => {
+    if (groups === null) return [];
+    const byParent = new Map<string | null, MemberGroupNode[]>();
+    for (const g of groups) {
+      const arr = byParent.get(g.parentId) ?? [];
+      arr.push(g);
+      byParent.set(g.parentId, arr);
+    }
+    for (const arr of byParent.values()) arr.sort((a, b) => a.name.localeCompare(b.name));
+    const out: MemberGroupNode[] = [];
+    const walk = (parentId: string | null): void => {
+      for (const g of byParent.get(parentId) ?? []) {
+        out.push(g);
+        walk(g.id);
+      }
+    };
+    walk(null);
+    // 兜底:孤儿(父已不在活跃列表,理论上级联软删不会出现)也列出。
+    const seen = new Set(out.map((g) => g.id));
+    for (const g of groups) if (!seen.has(g.id)) out.push(g);
+    return out;
+  });
+
+  async function loadGroups(): Promise<void> {
+    try {
+      const r = await api<{ groups: MemberGroupNode[] }>("/database/api/groups");
+      groups = r.groups;
+      listError = null;
+      if (selectedId !== null && !groups.some((g) => g.id === selectedId)) {
+        selectedId = null;
+        members = null;
+      }
+    } catch (e) {
+      listError = e instanceof Error ? e.message : String(e);
+    }
+  }
+
+  async function loadMembers(): Promise<void> {
+    if (selectedId === null) return;
+    members = null;
+    membersError = null;
+    try {
+      const r = await api<{ members: MemberGroupMember[] }>(
+        `/database/api/groups/${encodeURIComponent(selectedId)}/members`,
+      );
+      members = r.members;
+    } catch (e) {
+      membersError = e instanceof Error ? e.message : String(e);
+    }
+  }
+
+  onMount(loadGroups);
+
+  function select(id: string): void {
+    selectedId = id;
+    void loadMembers();
+  }
+
+  function openCreate(parent: MemberGroupNode | null): void {
+    createParentId = parent?.id ?? null;
+    createParentName = parent?.name ?? null;
+    newName = "";
+    newDesc = "";
+    showCreate = true;
+  }
+
+  async function createGroup(): Promise<void> {
+    const name = newName.trim();
+    if (name === "") return;
+    try {
+      await api("/database/api/groups", {
+        method: "POST",
+        body: {
+          name,
+          parentId: createParentId,
+          ...(newDesc.trim() !== "" ? { description: newDesc.trim() } : {}),
+        },
+      });
+      toastOk("已创建成员组");
+      showCreate = false;
+      await loadGroups();
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function deleteGroup(g: MemberGroupNode): Promise<void> {
+    if (!confirm(`删除「${g.name}」?其整棵子树将一并归档,相关授权立即失效。`)) return;
+    try {
+      const r = await api<{ archivedCount: number }>(
+        `/database/api/groups/${encodeURIComponent(g.id)}`,
+        { method: "DELETE" },
+      );
+      toastOk(`已归档 ${r.archivedCount} 个组`);
+      if (selectedId === g.id) { selectedId = null; members = null; }
+      await loadGroups();
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function addMember(): Promise<void> {
+    const v = addValue.trim();
+    if (v === "" || selectedId === null) return;
+    try {
+      // ou_ 开头当飞书 openId,其余当 userId(与 hub 现有习惯一致)。
+      const body = v.startsWith("ou_") ? { feishuOpenId: v } : { userId: v };
+      await api(`/database/api/groups/${encodeURIComponent(selectedId)}/members`, {
+        method: "POST",
+        body,
+      });
+      addValue = "";
+      toastOk("已添加成员");
+      await Promise.all([loadMembers(), loadGroups()]);
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function removeMember(userId: string): Promise<void> {
+    if (selectedId === null) return;
+    try {
+      await api(
+        `/database/api/groups/${encodeURIComponent(selectedId)}/members/${encodeURIComponent(userId)}`,
+        { method: "DELETE" },
+      );
+      toastOk("已移除成员");
+      await Promise.all([loadMembers(), loadGroups()]);
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+</script>
+
+<div class="flex h-full">
+  <!-- 左栏:嵌套组树 -->
+  <aside class="flex w-[340px] shrink-0 flex-col border-r border-line-soft bg-sidebar">
+    <div class="flex items-center justify-between border-b border-line-soft px-4 py-3.5">
+      <span class="text-[15px] font-semibold text-ink">Group 管理</span>
+      <button
+        class="rounded-lg border border-line bg-panel px-2.5 py-1 text-[11.5px] font-medium text-ink transition hover:bg-hover"
+        onclick={() => openCreate(null)}
+      >
+        + 根 Group
+      </button>
+    </div>
+
+    <div class="flex-1 overflow-y-auto px-2 py-2 text-[13px]">
+      {#if groups === null}
+        <div class="px-3 py-6 text-center text-xs text-ink-3">加载中…</div>
+      {:else if listError}
+        <div class="px-3 py-6 text-center text-xs text-danger">{listError}</div>
+      {:else if ordered.length === 0}
+        <div class="px-3 py-6 text-center text-xs text-ink-3">暂无成员组 · 点上方「+ 根 Group」开始</div>
+      {:else}
+        {#each ordered as g (g.id)}
+          <div
+            class="group flex items-center gap-1.5 rounded-lg py-1.5 pr-1.5 transition hover:bg-hover"
+            class:bg-selected={selectedId === g.id}
+            style="padding-left: {8 + g.depth * 16}px"
+          >
+            <button class="flex min-w-0 flex-1 items-center gap-2 text-left" onclick={() => select(g.id)}>
+              <span class="truncate font-medium text-ink">{g.name}</span>
+              <span class="shrink-0 text-[11px] text-ink-3">{g.memberCount}</span>
+            </button>
+            <button
+              class="shrink-0 rounded px-1.5 py-0.5 text-[15px] leading-none text-ink-3 opacity-0 transition hover:bg-panel hover:text-ink group-hover:opacity-100"
+              title="在此下新建子 Group"
+              onclick={() => openCreate(g)}
+            >+</button>
+            <button
+              class="shrink-0 rounded px-1.5 py-0.5 text-[11px] leading-none text-ink-3 opacity-0 transition hover:text-danger group-hover:opacity-100"
+              title="删除(级联归档子树)"
+              onclick={() => deleteGroup(g)}
+            >删除</button>
+          </div>
+        {/each}
+      {/if}
+    </div>
+  </aside>
+
+  <!-- 右栏:成员管理 -->
+  <main class="flex-1 overflow-y-auto p-6">
+    {#if selected === null}
+      <div class="flex h-full items-center justify-center text-[13px] text-ink-3">从左侧选择一个 Group 查看成员</div>
+    {:else}
+      <div class="mb-1 text-[17px] font-semibold text-ink">{selected.name}</div>
+      {#if selected.description}
+        <p class="mb-4 text-[12.5px] text-ink-2">{selected.description}</p>
+      {:else}
+        <div class="mb-4"></div>
+      {/if}
+
+      <div class="mb-4 flex items-end gap-2">
+        <div class="flex-1">
+          <label class="mb-1 block text-[11.5px] text-ink-3" for="add-member">添加成员(userId 或飞书 openId)</label>
+          <input
+            id="add-member"
+            class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent"
+            bind:value={addValue}
+            placeholder="userId 或 ou_ 开头的 openId"
+            onkeydown={(e) => { if (e.key === "Enter") void addMember(); }}
+          />
+        </div>
+        <button
+          class="rounded-lg bg-accent px-3.5 py-2 text-[12.5px] font-medium text-white transition hover:bg-accent-hover"
+          onclick={addMember}
+        >添加</button>
+      </div>
+
+      <div class="rounded-xl border border-line-soft bg-panel">
+        <div class="border-b border-line-soft px-4 py-2.5 text-[12.5px] font-semibold text-ink">
+          成员 {members === null ? "" : `(${members.length})`}
+        </div>
+        {#if members === null}
+          <div class="px-4 py-6 text-center text-xs text-ink-3">加载中…</div>
+        {:else if membersError}
+          <div class="px-4 py-6 text-center text-xs text-danger">{membersError}</div>
+        {:else if members.length === 0}
+          <div class="px-4 py-6 text-center text-xs text-ink-3">暂无成员</div>
+        {:else}
+          {#each members as m (m.userId)}
+            <div class="flex items-center gap-3 border-b border-line-soft px-4 py-2.5 text-[13px] last:border-b-0">
+              <span class="text-ink">{m.displayName}</span>
+              <span class="truncate font-mono text-[11px] text-ink-3">{m.userId}</span>
+              <button
+                class="ml-auto shrink-0 rounded px-1.5 py-0.5 text-[11.5px] text-ink-3 transition hover:text-danger"
+                onclick={() => removeMember(m.userId)}
+              >移除</button>
+            </div>
+          {/each}
+        {/if}
+      </div>
+    {/if}
+  </main>
+</div>
+
+{#if showCreate}
+  <Modal title={createParentName === null ? "新建根 Group" : `在「${createParentName}」下新建子 Group`} onclose={() => (showCreate = false)}>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="g-name">名称</label>
+      <input id="g-name" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newName} placeholder="例如:物理教研组" />
+    </div>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="g-desc">描述(可选)</label>
+      <textarea id="g-desc" rows="2" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newDesc} placeholder="一句话说明…"></textarea>
+    </div>
+    <div class="mt-4 flex justify-end gap-2">
+      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreate = false)}>取消</button>
+      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={createGroup}>创建</button>
+    </div>
+  </Modal>
+{/if}

hub/filelib-web/src/lib/LoginView.svelte

@@ -0,0 +1,47 @@
+<script lang="ts">
+  import { onMount } from "svelte";
+  import { api } from "./api.js";
+
+  interface LoginInfo {
+    orgSlug: string;
+    devLoginEnabled: boolean;
+  }
+
+  let info = $state<LoginInfo | null>(null);
+  let loadFailed = $state(false);
+
+  onMount(async () => {
+    try {
+      info = await api<LoginInfo>("/database/api/login-info");
+    } catch {
+      loadFailed = true;
+    }
+  });
+</script>
+
+<div class="flex min-h-full items-center justify-center p-6">
+  <div class="w-full max-w-[380px] rounded-2xl border border-line-soft bg-panel p-9 shadow-[0_4px_20px_rgba(26,26,24,.07)]">
+    <div class="text-center text-[26px] font-semibold tracking-wide text-ink">文件库</div>
+    <p class="mt-2.5 mb-8 text-center text-[13px] text-ink-3">课程资源与教研文件,一处安放,随处可查</p>
+
+    {#if info}
+      <a
+        href="/auth/feishu/{encodeURIComponent(info.orgSlug)}"
+        class="flex w-full items-center justify-center rounded-lg bg-accent px-4 py-3 text-sm font-medium text-white transition hover:bg-accent-hover"
+      >使用飞书登录</a>
+
+      {#if info.devLoginEnabled}
+        <div class="my-5 flex items-center gap-2.5 text-[11px] text-ink-3">
+          <span class="flex-1 border-t border-line-soft"></span>开发模式
+          <span class="flex-1 border-t border-line-soft"></span>
+        </div>
+        <a href="/app/dev-login-teacher" class="flex w-full items-center justify-center rounded-lg border border-line bg-panel px-4 py-2 text-[12.5px] font-medium text-ink transition hover:bg-hover">⚡ 一键登录(老师)</a>
+        <p class="mt-2.5 text-center text-[11px] text-ink-3">仅开发环境可见 · 跳过飞书 OAuth</p>
+      {/if}
+    {:else if loadFailed}
+      <p class="text-center text-[12.5px] text-danger">无法加载登录配置,请稍后重试</p>
+    {:else}
+      <p class="text-center text-[12.5px] text-ink-3">加载中…</p>
+    {/if}
+  </div>
+</div>

hub/filelib-web/src/lib/Modal.svelte

@@ -0,0 +1,16 @@
+<script lang="ts">
+  import type { Snippet } from "svelte";
+
+  let { title, onclose, children }: { title: string; onclose: () => void; children: Snippet } = $props();
+</script>
+
+<div
+  class="fixed inset-0 z-40 flex items-center justify-center bg-black/30 p-4"
+  role="presentation"
+  onclick={(e) => { if (e.target === e.currentTarget) onclose(); }}
+>
+  <div class="w-full max-w-[440px] rounded-2xl border border-line-soft bg-panel p-6 shadow-[0_4px_20px_rgba(26,26,24,.07)]">
+    <div class="mb-4 text-[15px] font-semibold">{title}</div>
+    {@render children()}
+  </div>
+</div>

hub/filelib-web/src/lib/NodeDetailPanel.svelte

@@ -0,0 +1,144 @@
+<script lang="ts">
+  import { api } from "./api.js";
+  import { currentNode, breadcrumb, bumpTree, clearSelectedFile } from "./browser.js";
+  import { toastOk, toastErr } from "./stores.js";
+  import OverviewPanel from "./OverviewPanel.svelte";
+  import FilesPanel from "./FilesPanel.svelte";
+  import Modal from "./Modal.svelte";
+
+  let tab = $state<"detail" | "files">("detail");
+  let showCreateChild = $state(false);
+  let newName = $state("");
+  let newKind = $state<"FOLDER" | "PROJECT">("FOLDER");
+  let newDesc = $state("");
+
+  const node = $derived($currentNode);
+  const crumbs = $derived($breadcrumb);
+  const canManage = $derived(node?.role === "MANAGE");
+  const canEdit = $derived(canManage || node?.role === "EDIT");
+
+  $effect(() => {
+    void node?.id;
+    tab = "detail";
+    clearSelectedFile();
+  });
+
+  async function createChild(): Promise<void> {
+    const name = newName.trim();
+    if (name === "" || node === null) return;
+    try {
+      await api("/database/api/nodes", {
+        method: "POST",
+        body: {
+          parentId: node.id,
+          kind: newKind,
+          name,
+          ...(newDesc.trim() !== "" ? { description: newDesc.trim() } : {}),
+        },
+      });
+      toastOk("已创建");
+      showCreateChild = false;
+      newName = ""; newKind = "FOLDER"; newDesc = "";
+      bumpTree();
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function renameNode(): Promise<void> {
+    if (node === null) return;
+    const name = prompt("新名称", node.name);
+    if (name === null) return;
+    try {
+      await api(`/database/api/nodes/${node.id}`, { method: "PATCH", body: { name } });
+      toastOk("已重命名");
+      bumpTree();
+      currentNode.update((n) => (n ? { ...n, name } : n));
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function deleteNode(): Promise<void> {
+    if (node === null || !confirm(`确认删除「${node.name}」?软删除后不可见。`)) return;
+    try {
+      await api(`/database/api/nodes/${node.id}`, { method: "DELETE" });
+      toastOk("已删除");
+      currentNode.set(null);
+      bumpTree();
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+</script>
+
+{#if node === null}
+  <div class="flex h-full items-center justify-center text-[13px] text-ink-3">从左侧选择一个文件夹或项目</div>
+{:else}
+  <div class="mx-auto max-w-[880px] px-9 py-9">
+    <div class="mb-2 text-[12.5px] text-ink-3">
+      {#each crumbs as c, i (i)}
+        {#if i > 0}<span class="mx-1 text-line">/</span>{/if}
+        <span>{c.name ?? "…"}</span>
+      {/each}
+    </div>
+
+    <div class="mb-5 flex items-center justify-between">
+      <div class="flex items-center gap-2.5 text-[19px] font-semibold text-ink">
+        {node.name}
+        <span class="rounded-full border border-line-soft bg-panel px-2 py-0.5 font-mono text-[10.5px] text-ink-3">{node.kind === "PROJECT" ? "项目" : "文件夹"}</span>
+      </div>
+      <div class="flex gap-2">
+        {#if canEdit && node.kind === "FOLDER"}
+          <button class="rounded-lg border border-line bg-panel px-3 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreateChild = true)}>+ 新建</button>
+        {/if}
+        {#if canManage}
+          <button class="rounded-lg border border-line bg-panel px-3 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={renameNode}>重命名</button>
+          <button class="rounded-lg border border-transparent px-3 py-1.5 text-[12.5px] font-medium text-danger transition hover:bg-[#A13A3312]" onclick={deleteNode}>删除</button>
+        {/if}
+      </div>
+    </div>
+
+    {#if node.kind === "FOLDER"}
+      <div class="py-7 text-[13px] text-ink-3">点击左侧树展开以浏览子内容</div>
+    {:else}
+      <div class="mb-5 flex gap-1 border-b border-line-soft">
+        {#each [["detail", "概览"], ["files", "文件"]] as [id, label] (id)}
+          <button
+            class="border-b-2 px-3.5 py-2 text-[13px] transition {tab === id ? 'border-accent font-semibold text-ink' : 'border-transparent text-ink-3 hover:text-ink'}"
+            onclick={() => (tab = id as "detail" | "files")}
+          >{label}</button>
+        {/each}
+      </div>
+      {#if tab === "detail"}
+        <OverviewPanel {node} />
+      {:else}
+        <FilesPanel {node} />
+      {/if}
+    {/if}
+  </div>
+{/if}
+
+{#if showCreateChild && node}
+  <Modal title="新建子节点" onclose={() => (showCreateChild = false)}>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="child-name">名称</label>
+      <input id="child-name" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newName} placeholder="例如:物理必修一" />
+    </div>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="child-kind">类型</label>
+      <select id="child-kind" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newKind}>
+        <option value="FOLDER">文件夹</option>
+        <option value="PROJECT">项目(课程资源库)</option>
+      </select>
+    </div>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="child-desc">简介(可选)</label>
+      <textarea id="child-desc" rows="3" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-xs outline-none focus:border-accent" bind:value={newDesc} placeholder="简要说明用途…"></textarea>
+    </div>
+    <div class="mt-4 flex justify-end gap-2">
+      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreateChild = false)}>取消</button>
+      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={createChild}>创建</button>
+    </div>
+  </Modal>
+{/if}

hub/filelib-web/src/lib/OverviewPanel.svelte

@@ -0,0 +1,123 @@
+<script lang="ts">
+  import { api } from "./api.js";
+  import { toastOk, toastErr } from "./stores.js";
+  import { currentNode } from "./browser.js";
+  import type { ExportJob, NodeDetail } from "./types.js";
+  import Modal from "./Modal.svelte";
+
+  let { node }: { node: NodeDetail } = $props();
+
+  let showEditDesc = $state(false);
+  let descDraft = $state("");
+  let exportJob = $state<ExportJob | null>(null);
+
+  const canEdit = $derived(node.role === "MANAGE" || node.role === "EDIT");
+  const roleLabel = $derived(node.role === "MANAGE" ? "可管理" : node.role === "EDIT" ? "可编辑" : "只读");
+
+  $effect(() => {
+    void node.id;
+    exportJob = null;
+  });
+
+  function openEditDesc(): void {
+    descDraft = node.description ?? "";
+    showEditDesc = true;
+  }
+
+  async function saveDesc(): Promise<void> {
+    const description = descDraft.trim();
+    try {
+      await api(`/database/api/nodes/${node.id}`, {
+        method: "PATCH",
+        body: { description: description === "" ? null : description },
+      });
+      toastOk("简介已保存");
+      showEditDesc = false;
+      const next = description === "" ? null : description;
+      currentNode.update((n) => (n && n.id === node.id ? { ...n, description: next } : n));
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function submitExport(): Promise<void> {
+    try {
+      const r = await api<{ jobId: string; status: string }>(`/database/api/projects/${node.id}/exports`, {
+        method: "POST",
+        body: { target: "manifest" },
+      });
+      toastOk("导出已提交");
+      void pollExport(r.jobId);
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function pollExport(jobId: string): Promise<void> {
+    for (;;) {
+      await new Promise((r) => setTimeout(r, 800));
+      try {
+        const job = await api<ExportJob>(`/database/api/exports/${jobId}`);
+        exportJob = job;
+        if (job.status === "DONE" || job.status === "FAILED") break;
+      } catch {
+        break;
+      }
+    }
+  }
+</script>
+
+<div class="rounded-xl border border-line-soft bg-panel p-5">
+  <div class="mb-4">
+    <div class="mb-1.5 text-[11.5px] text-ink-3">简介</div>
+    <div class="text-[13.5px] leading-7 text-ink">
+      {#if node.description}
+        {node.description}
+      {:else}
+        <span class="italic text-ink-3">暂无简介</span>
+      {/if}
+      {#if canEdit}
+        <button class="ml-2.5 rounded-lg border border-line bg-panel px-2.5 py-0.5 align-middle text-[11.5px] text-ink transition hover:bg-hover" onclick={openEditDesc}>编辑</button>
+      {/if}
+    </div>
+  </div>
+
+  <div class="my-4 border-t border-line-soft"></div>
+
+  <div class="flex flex-col gap-1.5 text-[13px] text-ink-2">
+    <div>我的角色 <b class="font-semibold text-ink">{roleLabel}</b></div>
+    <div>创建时间 <b class="font-semibold text-ink">{new Date(node.createdAt).toLocaleDateString("zh-CN", { year: "numeric", month: "long", day: "numeric" })}</b></div>
+    <div>最近修改 <b class="font-semibold text-ink">{new Date(node.updatedAt).toLocaleDateString("zh-CN", { year: "numeric", month: "long", day: "numeric" })}</b></div>
+  </div>
+
+  <div class="my-4 border-t border-line-soft"></div>
+
+  <div class="mb-2 text-[12.5px] font-semibold">导出</div>
+  <div class="flex items-center gap-2">
+    <button class="rounded-lg border border-line bg-panel px-3 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={submitExport}>开始导出</button>
+    {#if exportJob}
+      <span class="font-mono text-[11px] text-ink-3">
+        {#if exportJob.status === "DONE"}
+          完成 · <a class="text-accent underline" href="/database/api/exports/{exportJob.id}/download">下载</a>
+        {:else if exportJob.status === "FAILED"}
+          失败:{exportJob.error ?? ""}
+        {:else}
+          {exportJob.status}…
+        {/if}
+      </span>
+    {/if}
+  </div>
+</div>
+
+{#if showEditDesc}
+  <Modal title="编辑简介" onclose={() => (showEditDesc = false)}>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="desc-draft">简要说明这个项目的内容</label>
+      <textarea id="desc-draft" rows="5" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] leading-7 outline-none focus:border-accent" bind:value={descDraft} placeholder="例如:高中物理必修一第三章,表面张力相关内容……"></textarea>
+    </div>
+    <div class="mt-4 flex justify-end gap-2">
+      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showEditDesc = false)}>取消</button>
+      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={saveDesc}>保存</button>
+    </div>
+  </Modal>
+{/if}

hub/filelib-web/src/lib/Toasts.svelte

@@ -0,0 +1,11 @@
+<script lang="ts">
+  import { toasts } from "./stores.js";
+</script>
+
+<div class="fixed bottom-4 right-4 z-50 flex flex-col gap-2">
+  {#each $toasts as t (t.id)}
+    <div class="max-w-[340px] rounded-lg px-4 py-2 text-sm text-white {t.kind === 'err' ? 'bg-[#7E2C26]' : 'bg-[#333230]'}">
+      {t.message}
+    </div>
+  {/each}
+</div>

hub/filelib-web/src/lib/TreeNode.svelte

@@ -0,0 +1,82 @@
+<script lang="ts">
+  import TreeNode from "./TreeNode.svelte";
+  import { api } from "./api.js";
+  import { expanded, currentNode, breadcrumb, toggleExpanded, treeVersion } from "./browser.js";
+  import { toastErr } from "./stores.js";
+  import type { BreadcrumbEntry, NodeChild, NodeDetail } from "./types.js";
+
+  let { node, depth }: { node: NodeChild; depth: number } = $props();
+
+  let children = $state<NodeChild[] | null>(null);
+  const isOpen = $derived($expanded.has(node.id));
+  const isSelected = $derived($currentNode?.id === node.id);
+
+  // 树刷新信号(增/删/移/重命名)→ 失效子节点缓存,展开状态下随之重载
+  $effect(() => {
+    void $treeVersion;
+    children = null;
+  });
+
+  $effect(() => {
+    if (isOpen && node.kind === "FOLDER" && children === null) {
+      api<{ nodes: NodeChild[] }>(`/database/api/nodes?parentId=${encodeURIComponent(node.id)}`)
+        .then((r) => (children = r.nodes))
+        .catch((e) => toastErr(e instanceof Error ? e.message : String(e)));
+    }
+  });
+
+  async function select(): Promise<void> {
+    if (node.kind === "FOLDER") toggleExpanded(node.id);
+    try {
+      const [detail, crumb] = await Promise.all([
+        api<{ node: NodeDetail }>(`/database/api/nodes/${node.id}`),
+        api<{ breadcrumb: BreadcrumbEntry[] }>(`/database/api/nodes/${node.id}/breadcrumb`),
+      ]);
+      currentNode.set(detail.node);
+      breadcrumb.set(crumb.breadcrumb);
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+</script>
+
+<div>
+  <div
+    class="tree-item flex cursor-pointer items-center gap-1 rounded-lg px-1.5 py-1.5 select-none {isSelected ? 'bg-selected' : 'hover:bg-hover'}"
+    role="button"
+    tabindex="0"
+    onclick={select}
+    onkeydown={(e) => e.key === "Enter" && select()}
+  >
+    <span class="flex h-4 w-4 shrink-0 items-center justify-center text-ink-3">
+      {#if node.kind === "FOLDER"}
+        <svg width="9" height="9" viewBox="0 0 24 24" fill="currentColor">
+          {#if isOpen}<path d="M6 9l6 6 6-6z" />{:else}<path d="M9 6l6 6-6 6z" />{/if}
+        </svg>
+      {/if}
+    </span>
+    <span class="flex h-4 w-4 shrink-0 items-center justify-center {node.kind === 'PROJECT' ? 'text-ink' : 'text-ink-3'}">
+      {#if node.kind === "PROJECT"}
+        <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M20 7l-8-4-8 4m16 0l-8 4m8-4v10l-8 4m0-10L4 7m8 4v10M4 7v10l8 4" /></svg>
+      {:else}
+        <svg width="16" height="16" viewBox="0 0 24 24" fill="currentColor"><path d="M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V7Z" /></svg>
+      {/if}
+    </span>
+    <span class="truncate">{node.name}</span>
+    {#if node.role !== "MANAGE"}
+      <span class="ml-auto pr-1 font-mono text-[10px] text-ink-3">{node.role}</span>
+    {/if}
+  </div>
+
+  {#if node.kind === "FOLDER" && isOpen}
+    <div class="ml-[15px] border-l border-guide pl-1">
+      {#if children === null}
+        <div class="px-3 py-1.5 text-xs text-ink-3">…</div>
+      {:else}
+        {#each children as child (child.id)}
+          <TreeNode node={child} depth={depth + 1} />
+        {/each}
+      {/if}
+    </div>
+  {/if}
+</div>

hub/filelib-web/src/lib/api.ts

@@ -0,0 +1,49 @@
+/** 与 /database/api/* 的约定一致;401 时清空会话(回到登录视图)。 */
+
+import { me } from "./stores.js";
+
+export class ApiError extends Error {
+  constructor(
+    readonly status: number,
+    readonly code: string,
+    message: string,
+    readonly details?: Record<string, unknown>,
+  ) {
+    super(message);
+    this.name = "ApiError";
+  }
+}
+
+export class UnauthenticatedError extends Error {
+  constructor() {
+    super("unauthenticated");
+    this.name = "UnauthenticatedError";
+  }
+}
+
+interface RequestOpts {
+  readonly method?: string;
+  readonly body?: unknown;
+}
+
+export async function api<T = unknown>(path: string, opts: RequestOpts = {}): Promise<T> {
+  const res = await fetch(path, {
+    credentials: "same-origin",
+    method: opts.method ?? "GET",
+    ...(opts.body !== undefined
+      ? { headers: { "Content-Type": "application/json" }, body: JSON.stringify(opts.body) }
+      : {}),
+  });
+  if (res.status === 401) {
+    me.set(null);
+    throw new UnauthenticatedError();
+  }
+  if (res.status === 204) return null as T;
+  const text = await res.text();
+  const data = text === "" ? null : (JSON.parse(text) as unknown);
+  if (!res.ok) {
+    const err = (data as { error?: { code?: string; message?: string } } | null)?.error ?? {};
+    throw new ApiError(res.status, err.code ?? "unknown", err.message ?? res.statusText, err as Record<string, unknown>);
+  }
+  return data as T;
+}

hub/filelib-web/src/lib/browser.ts

@@ -0,0 +1,34 @@
+import { writable } from "svelte/store";
+import type { BreadcrumbEntry, NodeDetail } from "./types.js";
+
+/** 树展开集合 / 当前选中节点 / 面包屑 / 树刷新计数。 */
+export const expanded = writable<Set<string>>(new Set());
+export const currentNode = writable<NodeDetail | null>(null);
+export const breadcrumb = writable<BreadcrumbEntry[]>([]);
+export const treeVersion = writable(0);
+
+/** 右侧预览栏:当前选中文件路径(项目内);切换节点时清空。 */
+export const selectedFilePath = writable<string | null>(null);
+/** 文件列表刷新计数(编辑器保存/删除后 bump,列表随之重载)。 */
+export const filesVersion = writable(0);
+
+export function bumpTree(): void {
+  treeVersion.update((v) => v + 1);
+}
+
+export function bumpFiles(): void {
+  filesVersion.update((v) => v + 1);
+}
+
+export function clearSelectedFile(): void {
+  selectedFilePath.set(null);
+}
+
+export function toggleExpanded(id: string): void {
+  expanded.update((set) => {
+    const next = new Set(set);
+    if (next.has(id)) next.delete(id);
+    else next.add(id);
+    return next;
+  });
+}

hub/filelib-web/src/lib/stores.ts

@@ -0,0 +1,26 @@
+import { writable } from "svelte/store";
+import type { MeResponse } from "./types.js";
+
+/** 当前登录身份;null = 未登录(显示登录视图)。 */
+export const me = writable<MeResponse | null>(null);
+export const authChecked = writable(false);
+
+export interface ToastItem {
+  readonly id: number;
+  readonly message: string;
+  readonly kind: "info" | "err";
+}
+
+let nextToastId = 1;
+export const toasts = writable<ToastItem[]>([]);
+
+export function toast(message: string, kind: ToastItem["kind"] = "info"): void {
+  const id = nextToastId++;
+  toasts.update((list) => [...list, { id, message, kind }]);
+  setTimeout(() => {
+    toasts.update((list) => list.filter((t) => t.id !== id));
+  }, 3600);
+}
+
+export const toastOk = (m: string): void => toast(m, "info");
+export const toastErr = (m: string): void => toast(m, "err");

hub/filelib-web/src/lib/types.ts

@@ -0,0 +1,100 @@
+/** 与后端 /database/api/* 响应形状对齐。 */
+
+export type NodeKind = "FOLDER" | "PROJECT";
+export type Role = "VIEW" | "EDIT" | "MANAGE";
+
+export interface NodeChild {
+  readonly id: string;
+  readonly parentId: string | null;
+  readonly kind: NodeKind;
+  readonly name: string;
+  readonly role: Role;
+  readonly createdAt: string;
+  readonly updatedAt: string;
+}
+
+export interface BreadcrumbEntry {
+  readonly depth: number;
+  readonly id: string | null;
+  readonly name: string | null;
+  readonly kind: NodeKind;
+}
+
+export interface NodeDetail {
+  readonly id: string;
+  readonly parentId: string | null;
+  readonly kind: NodeKind;
+  readonly name: string;
+  readonly description: string | null;
+  readonly role: Role;
+  readonly provisionStatus: "PROVISIONING" | "READY" | "FAILED";
+  readonly independentPermission: boolean;
+  readonly createdAt: string;
+  readonly updatedAt: string;
+}
+
+export interface MeResponse {
+  readonly userId: string;
+  readonly isWebsiteAdmin: boolean;
+}
+
+export interface FileEntry {
+  readonly path: string;
+  readonly size: number;
+}
+
+export type FileContentEncoding = "utf8" | "base64";
+
+export interface FileContent {
+  readonly path: string;
+  readonly version: string;
+  readonly encoding: FileContentEncoding;
+  readonly content: string;
+  readonly size: number;
+}
+
+export interface VersionInfo {
+  readonly version: string;
+  readonly message: string;
+  readonly author?: string;
+  readonly committedAt: string;
+}
+
+export interface ExportJob {
+  readonly id: string;
+  readonly nodeId: string;
+  readonly target: string;
+  readonly status: "QUEUED" | "RUNNING" | "DONE" | "FAILED";
+  readonly error: string | null;
+  readonly createdAt: string;
+}
+
+export interface Grant {
+  readonly id: string;
+  readonly principalType: "USER" | "GROUP";
+  readonly principalId: string;
+  readonly role: Role;
+  readonly isCreatorGrant: boolean;
+  readonly createdAt: string;
+}
+
+export interface GroupSearchResult {
+  readonly id: string;
+  readonly name: string;
+  readonly breadcrumb: string;
+}
+
+/** 成员组(ADR-0028);后端返回扁平列表,前端按 parentId/depth 拼树。 */
+export interface MemberGroupNode {
+  readonly id: string;
+  readonly parentId: string | null;
+  readonly name: string;
+  readonly description: string | null;
+  readonly depth: number;
+  readonly memberCount: number;
+}
+
+export interface MemberGroupMember {
+  readonly userId: string;
+  readonly displayName: string;
+}

hub/filelib-web/src/main.ts

@@ -0,0 +1,5 @@
+import { mount } from "svelte";
+import App from "./App.svelte";
+import "./app.css";
+
+export default mount(App, { target: document.getElementById("app")! });

hub/filelib-web/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "exactOptionalPropertyTypes": true,
+    "verbatimModuleSyntax": true,
+    "skipLibCheck": true,
+    "isolatedModules": true,
+    "resolveJsonModule": true,
+    "useDefineForClassFields": true,
+    "lib": ["ES2022", "DOM", "DOM.Iterable"]
+  },
+  "include": ["src/**/*.ts", "src/**/*.svelte"]
+}

hub/filelib-web/vite.config.ts

@@ -0,0 +1,25 @@
+import { defineConfig } from "vite";
+import { svelte } from "@sveltejs/vite-plugin-svelte";
+import tailwindcss from "@tailwindcss/vite";
+
+// 老师端独立 SPA:构建产物由 hub 后端静态托管于 /app;
+// 开发时 vite dev(:5173)把 API/认证请求代理到后端(:8788)。
+const backend = "http://127.0.0.1:8788";
+
+export default defineConfig({
+  plugins: [svelte(), tailwindcss()],
+  base: "/app/",
+  build: {
+    outDir: "dist",
+    emptyOutDir: true,
+  },
+  server: {
+    port: 5173,
+    proxy: {
+      "/database/api": backend,
+      "/auth": backend,
+      "/app/dev-login": backend,
+      "/app/dev-login-teacher": backend,
+    },
+  },
+});

hub/package-lock.json

@@ -1,18 +1,19 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.35",
+  "version": "0.0.36",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@paradigm/hub",
-      "version": "0.0.35",
+      "version": "0.0.36",
       "dependencies": {
         "@alicloud/credentials": "^2.4.5",
         "@alicloud/docmind-api20220711": "^1.4.15",
         "@alicloud/tea-util": "^1.4.11",
         "@anthropic-ai/claude-agent-sdk": "^0.3.202",
         "@fastify/cookie": "^11.0.2",
+        "@fastify/static": "^10.1.2",
         "@larksuiteoapi/node-sdk": "^1.70.0",
         "@prisma/client": "^6.19.3",
         "ai": "^7.0.16",
@@ -401,6 +402,7 @@
       "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.7.tgz",
       "integrity": "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=6.9.0"
       }
@@ -423,6 +425,31 @@
         "xml2js": "^0.6.2"
       }
     },
+    "node_modules/@emnapi/core": {
+      "version": "1.11.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
+      "integrity": "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.2",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@emnapi/runtime": {
+      "version": "1.11.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
+      "integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
     "node_modules/@emnapi/wasi-threads": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
@@ -876,6 +903,22 @@
         "node": ">=18"
       }
     },
+    "node_modules/@fastify/accept-negotiator": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/@fastify/accept-negotiator/-/accept-negotiator-2.0.1.tgz",
+      "integrity": "sha512-/c/TW2bO/v9JeEgoD/g1G5GxGeCF1Hafdf79WPmUlgYiBXummY0oX3VVq4yFkKKVBKDNlaDUYoab7g38RpPqCQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/@fastify/ajv-compiler": {
       "version": "4.0.5",
       "resolved": "https://registry.npmjs.org/@fastify/ajv-compiler/-/ajv-compiler-4.0.5.tgz",
@@ -1007,11 +1050,89 @@
         "ipaddr.js": "^2.1.0"
       }
     },
+    "node_modules/@fastify/send": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/@fastify/send/-/send-4.1.0.tgz",
+      "integrity": "sha512-TMYeQLCBSy2TOFmV95hQWkiTYgC/SEx7vMdV+wnZVX4tt8VBLKzmH8vV9OzJehV0+XBfg+WxPMt5wp+JBUKsVw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@lukeed/ms": "^2.0.2",
+        "escape-html": "~1.0.3",
+        "fast-decode-uri-component": "^1.0.1",
+        "http-errors": "^2.0.0",
+        "mime": "^3"
+      }
+    },
+    "node_modules/@fastify/static": {
+      "version": "10.1.2",
+      "resolved": "https://registry.npmjs.org/@fastify/static/-/static-10.1.2.tgz",
+      "integrity": "sha512-G/g18cG9tLutT/OVyN1AIsHIl9L1UwmJ+S3dkyhVpplIx0nEMicd7RGQ+uJLyhKKF4a3tTcQydccn3Mop1fX+Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@fastify/accept-negotiator": "^2.0.0",
+        "@fastify/error": "^4.0.0",
+        "@fastify/send": "^4.0.0",
+        "content-disposition": "^2.0.1",
+        "fastify-plugin": "^6.0.0",
+        "fastq": "^1.17.1",
+        "glob": "^13.0.0"
+      }
+    },
+    "node_modules/@fastify/static/node_modules/content-disposition": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-2.0.1.tgz",
+      "integrity": "sha512-e+H0ZXHSWYrENhQzw1LPuP4oF5MzVKmDU6d3hxlvaPEYLLg62MxtQNPRx4SYSuYJSBUgnQIG4HIN2tEtNv7Dog==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/@fastify/static/node_modules/fastify-plugin": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz",
+      "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/@hono/node-server": {
       "version": "1.19.14",
       "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz",
       "integrity": "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=18.14.1"
       },
@@ -1041,6 +1162,15 @@
         "ws": "^8.19.0"
       }
     },
+    "node_modules/@lukeed/ms": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@lukeed/ms/-/ms-2.0.2.tgz",
+      "integrity": "sha512-9I2Zn6+NJLfaGoz9jN3lpwDgAYvfGeNYdbAIjJOqzs4Tpc+VU3Jqq4IofSUBKajiDS8k9fZIg18/z13mpk1bsA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/@modelcontextprotocol/sdk": {
       "version": "1.29.0",
       "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.29.0.tgz",
@@ -1550,7 +1680,8 @@
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@stablelib/base64/-/base64-1.0.1.tgz",
       "integrity": "sha512-1bnPQqSxSuc3Ii6MhBysoWCg58j97aUjuCSZrGSmDxNqtytIi0k8utUenAwTZN4V5mXXYGsVUI9zeBqy+jBOSQ==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@standard-schema/spec": {
       "version": "1.1.0",
@@ -1751,6 +1882,7 @@
       "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
       "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "mime-types": "^3.0.0",
         "negotiator": "^1.0.0"
@@ -1764,6 +1896,7 @@
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
       "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -1773,6 +1906,7 @@
       "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
       "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "mime-db": "^1.54.0"
       },
@@ -1903,11 +2037,21 @@
         "proxy-from-env": "^2.1.0"
       }
     },
+    "node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
     "node_modules/body-parser": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
       "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "bytes": "^3.1.2",
         "content-type": "^2.0.0",
@@ -1932,6 +2076,7 @@
       "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
       "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -1940,11 +2085,24 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/brace-expansion": {
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
     "node_modules/bytes": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
       "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -2090,6 +2248,7 @@
       "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz",
       "integrity": "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -2103,6 +2262,7 @@
       "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
       "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -2132,6 +2292,7 @@
       "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
       "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=6.6.0"
       }
@@ -2141,6 +2302,7 @@
       "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz",
       "integrity": "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "object-assign": "^4",
         "vary": "^1"
@@ -2158,6 +2320,7 @@
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
       "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "path-key": "^3.1.0",
         "shebang-command": "^2.0.0",
@@ -2275,7 +2438,8 @@
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
       "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/effect": {
       "version": "3.21.0",
@@ -2303,6 +2467,7 @@
       "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
       "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -2422,6 +2587,7 @@
       "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
       "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -2431,6 +2597,7 @@
       "resolved": "https://registry.npmjs.org/eventsource/-/eventsource-3.0.7.tgz",
       "integrity": "sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "eventsource-parser": "^3.0.1"
       },
@@ -2462,6 +2629,7 @@
       "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
       "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "accepts": "^2.0.0",
         "body-parser": "^2.2.1",
@@ -2505,6 +2673,7 @@
       "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.5.2.tgz",
       "integrity": "sha512-5Kb34ipNX694DH48vN9irak1Qx30nb0PLYHXfJgw4YEjiC3ZEmZJhwOp+VfiCYwFzvFTdB9QkArYS5kXa2cx2A==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "ip-address": "^10.2.0"
       },
@@ -2523,6 +2692,7 @@
       "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
       "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -2532,6 +2702,7 @@
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
       "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -2541,6 +2712,7 @@
       "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
       "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "mime-db": "^1.54.0"
       },
@@ -2631,7 +2803,8 @@
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/fast-sha256/-/fast-sha256-1.3.0.tgz",
       "integrity": "sha512-n11RGP/lrWEFI/bWdygLxhI+pVeo1ZYIVwvvPkW7azl/rOy+F3HYRZ2K5zeE9mmkhQppyv9sQFx0JM9UabnpPQ==",
-      "license": "Unlicense"
+      "license": "Unlicense",
+      "peer": true
     },
     "node_modules/fast-uri": {
       "version": "3.1.3",
@@ -2730,6 +2903,7 @@
       "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz",
       "integrity": "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "debug": "^4.4.0",
         "encodeurl": "^2.0.0",
@@ -2801,6 +2975,7 @@
       "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
       "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -2810,6 +2985,7 @@
       "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
       "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -2893,6 +3069,23 @@
         "giget": "dist/cli.mjs"
       }
     },
+    "node_modules/glob": {
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/gopd": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
@@ -3025,6 +3218,7 @@
       "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
       "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
       },
@@ -3070,13 +3264,15 @@
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz",
       "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/isexe": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
       "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "license": "ISC"
+      "license": "ISC",
+      "peer": true
     },
     "node_modules/jiti": {
       "version": "2.7.0",
@@ -3093,6 +3289,7 @@
       "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.3.tgz",
       "integrity": "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw==",
       "license": "MIT",
+      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/panva"
       }
@@ -3127,6 +3324,7 @@
       "resolved": "https://registry.npmjs.org/json-schema-to-ts/-/json-schema-to-ts-3.1.1.tgz",
       "integrity": "sha512-+DWg8jCJG2TEnpy7kOm/7/AxaYoaRbjVB4LFZLySZlWn8exGs3A4OLJR966cVvU26N7X9TWxl+Jsw7dzAqKT6g==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/runtime": "^7.18.3",
         "ts-algebra": "^2.0.0"
@@ -3145,7 +3343,8 @@
       "version": "8.0.2",
       "resolved": "https://registry.npmjs.org/json-schema-typed/-/json-schema-typed-8.0.2.tgz",
       "integrity": "sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA==",
-      "license": "BSD-2-Clause"
+      "license": "BSD-2-Clause",
+      "peer": true
     },
     "node_modules/kitx": {
       "version": "2.2.0",
@@ -3484,6 +3683,15 @@
       "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
       "license": "Apache-2.0"
     },
+    "node_modules/lru-cache": {
+      "version": "11.5.2",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
+      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
     "node_modules/magic-string": {
       "version": "0.30.21",
       "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
@@ -3508,6 +3716,7 @@
       "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.0.tgz",
       "integrity": "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -3517,6 +3726,7 @@
       "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
       "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -3524,6 +3734,18 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/mime": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-3.0.0.tgz",
+      "integrity": "sha512-jSCU7/VB1loIWBZe14aEYHU/+1UMEHoaO7qxCOVJOw9GgH72VAWppxNcjU+x9a2k3GSIBXNKxXQFqRvvZ7vr3A==",
+      "license": "MIT",
+      "bin": {
+        "mime": "cli.js"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
     "node_modules/mime-db": {
       "version": "1.52.0",
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
@@ -3545,6 +3767,30 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/minimatch": {
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.5"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
     "node_modules/moment": {
       "version": "2.30.1",
       "resolved": "https://registry.npmjs.org/moment/-/moment-2.30.1.tgz",
@@ -3596,6 +3842,7 @@
       "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
       "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -3637,6 +3884,7 @@
       "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
       "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -3688,6 +3936,7 @@
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
       "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "ee-first": "1.1.1"
       },
@@ -3700,6 +3949,7 @@
       "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
       "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
       "license": "ISC",
+      "peer": true,
       "dependencies": {
         "wrappy": "1"
       }
@@ -3709,6 +3959,7 @@
       "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
       "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -3718,15 +3969,33 @@
       "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
       "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=8"
       }
     },
+    "node_modules/path-scurry": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/path-to-regexp": {
       "version": "8.4.2",
       "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz",
       "integrity": "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==",
       "license": "MIT",
+      "peer": true,
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/express"
@@ -3759,7 +4028,6 @@
       "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -3809,6 +4077,7 @@
       "resolved": "https://registry.npmjs.org/pkce-challenge/-/pkce-challenge-5.0.1.tgz",
       "integrity": "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=16.20.0"
       }
@@ -3861,7 +4130,6 @@
       "devOptional": true,
       "hasInstallScript": true,
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
         "@prisma/config": "6.19.3",
         "@prisma/engines": "6.19.3"
@@ -3925,6 +4193,7 @@
       "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
       "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "forwarded": "0.2.0",
         "ipaddr.js": "1.9.1"
@@ -3938,6 +4207,7 @@
       "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
       "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.10"
       }
@@ -3995,6 +4265,7 @@
       "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz",
       "integrity": "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       },
@@ -4008,6 +4279,7 @@
       "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz",
       "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "bytes": "~3.1.2",
         "http-errors": "~2.0.1",
@@ -4125,6 +4397,7 @@
       "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
       "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "debug": "^4.4.0",
         "depd": "^2.0.0",
@@ -4171,7 +4444,8 @@
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/sax": {
       "version": "1.6.0",
@@ -4215,6 +4489,7 @@
       "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz",
       "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "debug": "^4.4.3",
         "encodeurl": "^2.0.0",
@@ -4241,6 +4516,7 @@
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
       "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -4250,6 +4526,7 @@
       "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
       "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "mime-db": "^1.54.0"
       },
@@ -4266,6 +4543,7 @@
       "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz",
       "integrity": "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "encodeurl": "^2.0.0",
         "escape-html": "^1.0.3",
@@ -4297,6 +4575,7 @@
       "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
       "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "shebang-regex": "^3.0.0"
       },
@@ -4309,6 +4588,7 @@
       "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
       "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=8"
       }
@@ -4476,6 +4756,7 @@
       "resolved": "https://registry.npmjs.org/standardwebhooks/-/standardwebhooks-1.0.0.tgz",
       "integrity": "sha512-BbHGOQK9olHPMvQNHWul6MYlrRTAOKn03rOe4A8O3CLWhNf4YHBqq2HJKKC+sfqpxiBY52pNeesD6jIiLDz8jg==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@stablelib/base64": "^1.0.0",
         "fast-sha256": "^1.3.0"
@@ -4581,7 +4862,8 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/ts-algebra/-/ts-algebra-2.0.0.tgz",
       "integrity": "sha512-FPAhNPFMrkwz76P7cdjdmiShwMynZYN6SgOujD1urY4oNm80Ou9oMdmbR45LotcKOXoy7wSmHkRFE6Mxbrhefw==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/tslib": {
       "version": "2.8.1",
@@ -4597,7 +4879,6 @@
       "integrity": "sha512-eUdUIaCr963q2h5u3+QwvYp0+eqPvn+egeqZUm0hwERCqqx1E3kK5ehbGCvqSE5MQAULr67ww0cA3jKc3YkM1w==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "~0.28.0"
       },
@@ -4616,6 +4897,7 @@
       "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
       "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "content-type": "^2.0.0",
         "media-typer": "^1.1.0",
@@ -4634,6 +4916,7 @@
       "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
       "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -4647,6 +4930,7 @@
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
       "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -4656,6 +4940,7 @@
       "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
       "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "mime-db": "^1.54.0"
       },
@@ -4673,7 +4958,6 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "devOptional": true,
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -4693,6 +4977,7 @@
       "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
       "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -4702,6 +4987,7 @@
       "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
       "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -4712,7 +4998,6 @@
       "integrity": "sha512-Ds+gBRbj0lwRO2Y5hwnUBdxSwlAve9LeRyU4sNnAr0ewW0gWF0n5bgXgUzbgZ49MV9BVUAQUFYVcDUcilUExMA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "lightningcss": "^1.32.0",
         "picomatch": "^4.0.4",
@@ -4880,6 +5165,7 @@
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
       "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
       "license": "ISC",
+      "peer": true,
       "dependencies": {
         "isexe": "^2.0.0"
       },
@@ -4911,7 +5197,8 @@
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
       "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
-      "license": "ISC"
+      "license": "ISC",
+      "peer": true
     },
     "node_modules/ws": {
       "version": "8.21.0",
@@ -4961,7 +5248,6 @@
       "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
       "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
       "license": "MIT",
-      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
@@ -4971,6 +5257,7 @@
       "resolved": "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.2.tgz",
       "integrity": "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==",
       "license": "ISC",
+      "peer": true,
       "peerDependencies": {
         "zod": "^3.25.28 || ^4"
       }

hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.35",
+  "version": "0.0.36",
   "private": true,
   "type": "module",
   "engines": {
@@ -12,6 +12,7 @@
     "@alicloud/tea-util": "^1.4.11",
     "@anthropic-ai/claude-agent-sdk": "^0.3.202",
     "@fastify/cookie": "^11.0.2",
+    "@fastify/static": "^10.1.2",
     "@larksuiteoapi/node-sdk": "^1.70.0",
     "@prisma/client": "^6.19.3",
     "ai": "^7.0.16",
@@ -30,10 +31,10 @@
       "axios": "1.18.1"
     }
   },
-  "description": "Curriculum Project Hub — org-scoped Feishu collaboration and confined Agent runtime. Aligns to spec/System through ADR-0024.",
+  "description": "Curriculum Project Hub — org-scoped Feishu collaboration and confined Agent runtime. Semantics pinned by docs/adr/ (ADR-0001 through ADR-0027).",
   "scripts": {
     "dev": "npm run prisma:migrate && tsx watch src/server.ts",
-    "build": "tsc -p tsconfig.json && npm run admin:build",
+    "build": "tsc -p tsconfig.json && npm run admin:build && npm run filelib:build",
     "start": "npm run prisma:migrate && node dist/server.js",
     "check": "tsc -p tsconfig.json --noEmit",
     "audit:production": "npm audit --omit=dev --audit-level=high",
@@ -48,6 +49,8 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "admin:dev": "npm run dev --prefix admin-web",
-    "admin:build": "npm run build --prefix admin-web"
+    "admin:build": "npm run build --prefix admin-web",
+    "filelib:dev": "npm run dev --prefix filelib-web",
+    "filelib:build": "npm run build --prefix filelib-web"
   }
 }

hub/prisma/migrations/20260714120000_drop_legacy_platform_role_assignment/migration.sql

@@ -1,6 +1,6 @@
 -- ADR-0023 rejected the legacy `PlatformRoleAssignment` / `PlatformRole`{ADMIN,TEACHER}
 -- model: the platform administration control plane is a separate identity/session/
--- audit surface (see `Spec.System.PlatformAdministration`), intentionally not built
+-- audit surface, intentionally not built
 -- in alpha (ADR-0025, `hub/deploy/README.md`). The legacy table has no runtime
 -- reader — no guard, route, or service queries it for an authorization decision —
 -- and ADR-0023 requires it to be migrated/replaced before the platform panel ships.

hub/prisma/migrations/20260719140000_agent_config_folder_tree/migration.sql

@@ -1,33 +0,0 @@
--- ADR-0028 agent configuration folder tree. One org-scoped transparent folder
--- tree shared by Agent roles and skills (management-surface grouping only);
--- skill name / roleId uniqueness, role→skill bindings, run-time skill loading
--- and Feishu slash commands never reference folders. A folder deletes only
--- when empty (service-enforced); item `folderId` references are SetNull as
--- backstop.
-
--- CreateTable
-CREATE TABLE "OrganizationAgentConfigFolder" (
-    "id" TEXT NOT NULL,
-    "organizationId" TEXT NOT NULL,
-    "parentId" TEXT,
-    "name" TEXT NOT NULL,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "OrganizationAgentConfigFolder_pkey" PRIMARY KEY ("id")
-);
-
--- AlterTable
-ALTER TABLE "OrganizationAgentSkill" ADD COLUMN "folderId" TEXT;
-ALTER TABLE "OrganizationAgentRole" ADD COLUMN "folderId" TEXT;
-
--- CreateIndex
-CREATE INDEX "OrganizationAgentConfigFolder_organizationId_parentId_idx" ON "OrganizationAgentConfigFolder"("organizationId", "parentId");
-CREATE INDEX "OrganizationAgentSkill_organizationId_folderId_idx" ON "OrganizationAgentSkill"("organizationId", "folderId");
-CREATE INDEX "OrganizationAgentRole_organizationId_folderId_idx" ON "OrganizationAgentRole"("organizationId", "folderId");
-
--- AddForeignKey
-ALTER TABLE "OrganizationAgentConfigFolder" ADD CONSTRAINT "OrganizationAgentConfigFolder_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-ALTER TABLE "OrganizationAgentConfigFolder" ADD CONSTRAINT "OrganizationAgentConfigFolder_parentId_fkey" FOREIGN KEY ("parentId") REFERENCES "OrganizationAgentConfigFolder"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
-ALTER TABLE "OrganizationAgentSkill" ADD CONSTRAINT "OrganizationAgentSkill_folderId_fkey" FOREIGN KEY ("folderId") REFERENCES "OrganizationAgentConfigFolder"("id") ON DELETE SET NULL ON UPDATE CASCADE;
-ALTER TABLE "OrganizationAgentRole" ADD CONSTRAINT "OrganizationAgentRole_folderId_fkey" FOREIGN KEY ("folderId") REFERENCES "OrganizationAgentConfigFolder"("id") ON DELETE SET NULL ON UPDATE CASCADE;

hub/prisma/migrations/20260721120000_file_library/migration.sql

@@ -0,0 +1,92 @@
+-- File library (文件库) — 语义锚定:仓库根《文件库-接口契约.md》、.omo/文件库-开工计划.md (D11–D19)。
+-- 本地无 PG 时手写;有 PG 后可用 `prisma migrate diff` 核对与 schema 的一致性。
+
+-- CreateEnum
+CREATE TYPE "FileLibNodeKind" AS ENUM ('FOLDER', 'PROJECT');
+CREATE TYPE "FileLibProvisionStatus" AS ENUM ('PROVISIONING', 'READY', 'FAILED');
+CREATE TYPE "FileLibRole" AS ENUM ('VIEW', 'EDIT', 'MANAGE');
+CREATE TYPE "FileLibPrincipalType" AS ENUM ('USER', 'GROUP');
+CREATE TYPE "FileLibExportStatus" AS ENUM ('QUEUED', 'RUNNING', 'DONE', 'FAILED');
+
+-- CreateTable
+CREATE TABLE "FileLibNode" (
+    "id" TEXT NOT NULL,
+    "organizationId" TEXT NOT NULL,
+    "parentId" TEXT,
+    "kind" "FileLibNodeKind" NOT NULL,
+    "name" TEXT NOT NULL,
+    "nameLower" TEXT NOT NULL,
+    "pathIds" TEXT NOT NULL,
+    "creatorId" TEXT NOT NULL,
+    "provisionStatus" "FileLibProvisionStatus" NOT NULL DEFAULT 'READY',
+    "storageDir" TEXT,
+    "deletedAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "FileLibNode_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "FileLibGrant" (
+    "id" TEXT NOT NULL,
+    "organizationId" TEXT NOT NULL,
+    "nodeId" TEXT NOT NULL,
+    "principalType" "FileLibPrincipalType" NOT NULL,
+    "principalId" TEXT NOT NULL,
+    "role" "FileLibRole" NOT NULL,
+    "isCreatorGrant" BOOLEAN NOT NULL DEFAULT false,
+    "createdByUserId" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "revokedAt" TIMESTAMP(3),
+
+    CONSTRAINT "FileLibGrant_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "FileLibProjectSettings" (
+    "nodeId" TEXT NOT NULL,
+    "independentPermissionsEnabled" BOOLEAN NOT NULL DEFAULT false,
+
+    CONSTRAINT "FileLibProjectSettings_pkey" PRIMARY KEY ("nodeId")
+);
+
+CREATE TABLE "FileLibExportJob" (
+    "id" TEXT NOT NULL,
+    "organizationId" TEXT NOT NULL,
+    "nodeId" TEXT NOT NULL,
+    "target" TEXT NOT NULL,
+    "params" JSONB NOT NULL,
+    "status" "FileLibExportStatus" NOT NULL DEFAULT 'QUEUED',
+    "downloadUrl" TEXT,
+    "error" TEXT,
+    "createdByUserId" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "FileLibExportJob_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex (schema-declared)
+CREATE INDEX "FileLibNode_organizationId_parentId_deletedAt_idx" ON "FileLibNode"("organizationId", "parentId", "deletedAt");
+CREATE INDEX "FileLibNode_organizationId_pathIds_idx" ON "FileLibNode"("organizationId", "pathIds");
+CREATE INDEX "FileLibNode_creatorId_idx" ON "FileLibNode"("creatorId");
+CREATE INDEX "FileLibGrant_organizationId_revokedAt_idx" ON "FileLibGrant"("organizationId", "revokedAt");
+CREATE INDEX "FileLibGrant_principalType_principalId_revokedAt_idx" ON "FileLibGrant"("principalType", "principalId", "revokedAt");
+CREATE INDEX "FileLibGrant_nodeId_revokedAt_idx" ON "FileLibGrant"("nodeId", "revokedAt");
+CREATE INDEX "FileLibExportJob_organizationId_status_idx" ON "FileLibExportJob"("organizationId", "status");
+
+-- D14:活跃兄弟节点大小写不敏感唯一。root 的 parentId 为 NULL,用 COALESCE 归入同一键空间。
+CREATE UNIQUE INDEX "FileLibNode_active_sibling_name_key"
+    ON "FileLibNode"("organizationId", COALESCE("parentId", ''), "nameLower")
+    WHERE "deletedAt" IS NULL;
+
+-- 契约 2.3:同一节点上同一 principal 至多一条活跃授权(Postgres 原生 UNIQUE 无法约束 NULL revokedAt)。
+CREATE UNIQUE INDEX "FileLibGrant_active_unique"
+    ON "FileLibGrant"("nodeId", "principalType", "principalId")
+    WHERE "revokedAt" IS NULL;
+
+-- AddForeignKey
+ALTER TABLE "FileLibNode" ADD CONSTRAINT "FileLibNode_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "FileLibNode" ADD CONSTRAINT "FileLibNode_parentId_fkey" FOREIGN KEY ("parentId") REFERENCES "FileLibNode"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "FileLibGrant" ADD CONSTRAINT "FileLibGrant_nodeId_fkey" FOREIGN KEY ("nodeId") REFERENCES "FileLibNode"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "FileLibProjectSettings" ADD CONSTRAINT "FileLibProjectSettings_nodeId_fkey" FOREIGN KEY ("nodeId") REFERENCES "FileLibNode"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "FileLibExportJob" ADD CONSTRAINT "FileLibExportJob_nodeId_fkey" FOREIGN KEY ("nodeId") REFERENCES "FileLibNode"("id") ON DELETE CASCADE ON UPDATE CASCADE;

hub/prisma/migrations/20260723120000_member_group_hierarchy/migration.sql

@@ -0,0 +1,70 @@
+-- Global, unlimited-depth member group hierarchy (requirement 3.1-3.3).
+-- Managed only by the platform super administrator; deliberately NOT
+-- org-scoped. Stores membership + nesting only, never permission data.
+-- Deletion is soft (archivedAt / revokedAt markers); a group delete
+-- cascade-soft-deletes its whole subtree as an application operation.
+-- The permission side (GROUP principal, FOLDER resource, grant inheritance)
+-- is intentionally deferred to a later migration.
+
+-- CreateTable
+CREATE TABLE "MemberGroup" (
+    "id" TEXT NOT NULL,
+    "parentId" TEXT,
+    "name" TEXT NOT NULL,
+    "description" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    "archivedAt" TIMESTAMP(3),
+
+    CONSTRAINT "MemberGroup_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "MemberGroupMembership" (
+    "id" TEXT NOT NULL,
+    "groupId" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "revokedAt" TIMESTAMP(3),
+
+    CONSTRAINT "MemberGroupMembership_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "MemberGroupClosure" (
+    "ancestorId" TEXT NOT NULL,
+    "descendantId" TEXT NOT NULL,
+    "depth" INTEGER NOT NULL,
+
+    CONSTRAINT "MemberGroupClosure_pkey" PRIMARY KEY ("ancestorId", "descendantId")
+);
+
+-- CreateIndex
+CREATE INDEX "MemberGroup_parentId_archivedAt_idx" ON "MemberGroup"("parentId", "archivedAt");
+
+-- CreateIndex
+CREATE INDEX "MemberGroupMembership_userId_revokedAt_idx" ON "MemberGroupMembership"("userId", "revokedAt");
+
+-- CreateIndex
+CREATE INDEX "MemberGroupMembership_groupId_revokedAt_idx" ON "MemberGroupMembership"("groupId", "revokedAt");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "MemberGroupMembership_groupId_userId_revokedAt_key" ON "MemberGroupMembership"("groupId", "userId", "revokedAt");
+
+-- CreateIndex
+CREATE INDEX "MemberGroupClosure_descendantId_idx" ON "MemberGroupClosure"("descendantId");
+
+-- AddForeignKey
+ALTER TABLE "MemberGroup" ADD CONSTRAINT "MemberGroup_parentId_fkey" FOREIGN KEY ("parentId") REFERENCES "MemberGroup"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "MemberGroupMembership" ADD CONSTRAINT "MemberGroupMembership_groupId_fkey" FOREIGN KEY ("groupId") REFERENCES "MemberGroup"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "MemberGroupMembership" ADD CONSTRAINT "MemberGroupMembership_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "MemberGroupClosure" ADD CONSTRAINT "MemberGroupClosure_ancestorId_fkey" FOREIGN KEY ("ancestorId") REFERENCES "MemberGroup"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "MemberGroupClosure" ADD CONSTRAINT "MemberGroupClosure_descendantId_fkey" FOREIGN KEY ("descendantId") REFERENCES "MemberGroup"("id") ON DELETE CASCADE ON UPDATE CASCADE;

hub/prisma/migrations/20260723130000_filelib_description/migration.sql

@@ -0,0 +1,2 @@
+-- 为 FileLibNode 加简介字段，老师在创建/概览页填写。
+ALTER TABLE "FileLibNode" ADD COLUMN "description" TEXT;

hub/prisma/schema.prisma

@@ -1,6 +1,6 @@
 // Prisma schema for Curriculum Project Hub.
 //
-// Aligns to spec/System (ADR-0001..0004, 0017). Key divergences from the
+// Aligns to ADR-0001..0004, 0017. Key divergences from the
 // legacy teaching-material-host-service schema, each deliberate:
 //
 //  - AgentSession is provider/model-bound. Provider runtime cursors such as
@@ -11,8 +11,8 @@
 //  - ProjectGroupBinding is project→chat only (ADR-0001 1:1); legacy mixed
 //    user/chat targets into one binding table.
 //  - PermissionGrant + PermissionSettings land (ADR-0004), missing in legacy.
-//  - AgentRunStatus adds WAITING_FOR_USER + TIMED_OUT (spec RunState; enum
-//    completeness OPEN — add states without a schema migration war).
+//  - AgentRunStatus adds WAITING_FOR_USER + TIMED_OUT (the run-state set is
+//    open — add states without a schema migration war).
 
 generator client {
   provider = "prisma-client-js"
@@ -47,10 +47,10 @@ model Organization {
   capabilityConnections        OrganizationCapabilityConnection[]
   agentSkills                  OrganizationAgentSkill[]
   agentRoles                   OrganizationAgentRole[]
-  agentConfigFolders           OrganizationAgentConfigFolder[]
   projectGroupBindings         ProjectGroupBinding[]
   auditEntries                 AuditEntry[]                             @relation("organizationAudit")
   projectSearchDocuments       ProjectSearchDocument[]
+  fileLibNodes                 FileLibNode[]
 
   @@index([status])
 }
@@ -62,7 +62,7 @@ enum OrganizationStatus {
 }
 
 /// Org-scoped membership role. Distinct from project PermissionRole and from
-/// the platform administrator surface (ADR-0023 / Spec.System.PlatformAdministration),
+/// the platform administrator surface (ADR-0023),
 /// which is a separate control plane not modeled in alpha (ADR-0025).
 model OrganizationMembership {
   id             String                 @id @default(cuid())
@@ -96,19 +96,16 @@ model OrganizationAgentSkill {
   version        String
   description    String?
   contentDigest  String
-  folderId       String?
   createdAt      DateTime  @default(now())
   updatedAt      DateTime  @updatedAt
   disabledAt     DateTime?
 
-  organization Organization                    @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  folder       OrganizationAgentConfigFolder?  @relation(fields: [folderId], references: [id], onDelete: SetNull)
+  organization Organization                 @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   roleBindings OrganizationAgentRoleSkill[]
 
   @@unique([organizationId, name])
   @@unique([organizationId, id])
   @@index([organizationId, disabledAt])
-  @@index([organizationId, folderId])
   @@index([contentDigest])
 }
 
@@ -125,20 +122,17 @@ model OrganizationAgentRole {
   tools          Json?
   sortOrder      Int       @default(0)
   isDefault      Boolean   @default(false)
-  folderId       String?
   createdAt      DateTime  @default(now())
   updatedAt      DateTime  @updatedAt
   disabledAt     DateTime?
 
-  organization       Organization                    @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  folder             OrganizationAgentConfigFolder?  @relation(fields: [folderId], references: [id], onDelete: SetNull)
+  organization       Organization                 @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   skillBindings      OrganizationAgentRoleSkill[]
   selectedByBindings ProjectGroupBinding[]        @relation("selectedAgentRole")
 
   @@unique([organizationId, roleId])
   @@unique([organizationId, id])
   @@index([organizationId, disabledAt, sortOrder])
-  @@index([organizationId, folderId])
 }
 
 /// Same-Organization join enforced by both composite foreign keys. `sortOrder`
@@ -158,29 +152,6 @@ model OrganizationAgentRoleSkill {
   @@index([organizationId, agentSkillId])
 }
 
-/// ADR-0028: org-scoped transparent folder tree shared by agent roles and
-/// skills. Management-surface navigation/grouping only — not a permission
-/// resource, and never referenced by role→skill bindings, run-time skill
-/// loading, or Feishu slash commands. Skill name and roleId stay unique per
-/// organization regardless of folder membership. A folder is deleted only
-/// when empty (service-enforced); item references are SetNull as backstop.
-model OrganizationAgentConfigFolder {
-  id             String    @id @default(cuid())
-  organizationId String
-  parentId       String?
-  name           String
-  createdAt      DateTime  @default(now())
-  updatedAt      DateTime  @updatedAt
-
-  organization Organization                    @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  parent       OrganizationAgentConfigFolder?  @relation("agentConfigFolderTree", fields: [parentId], references: [id], onDelete: Restrict)
-  children     OrganizationAgentConfigFolder[] @relation("agentConfigFolderTree")
-  skills       OrganizationAgentSkill[]
-  roles        OrganizationAgentRole[]
-
-  @@index([organizationId, parentId])
-}
-
 /// ADR-0021: org-level project onboarding policy. Ordinary Feishu users can
 /// create projects from unbound chats only when membersCanCreateProjects=true.
 model OrganizationProjectSettings {
@@ -223,6 +194,7 @@ model User {
   heldLocks                    ProjectAgentLock[]                   @relation("lockHolder")
   feishuBindings               ProjectGroupBinding[]                @relation("bindingCreator")
   teamMemberships              TeamMembership[]
+  memberGroupMemberships       MemberGroupMembership[]
   externalPrincipalMemberships ExternalPrincipalMembership[]
   permissionGrants             PermissionGrant[]                    @relation("grantCreator")
   roleTriggerGrants            RoleTriggerGrant[]                   @relation("roleGrantCreator")
@@ -423,6 +395,67 @@ model TeamExternalBinding {
   @@index([teamId, revokedAt])
 }
 
+// --- Member groups (global, nestable authorization principal) ------------
+
+/// Global, unlimited-depth member group. Managed only by the platform super administrator (ADR-0023);
+/// Deletion is soft: `archivedAt` is a marker.
+/// Deleting a group cascade-soft-deletes its whole subtree — an application
+/// operation (walk the subtree, stamp archivedAt), not a DB constraint.
+model MemberGroup {
+  id          String    @id @default(cuid())
+  parentId    String?
+  name        String
+  description String?
+  createdAt   DateTime  @default(now())
+  updatedAt   DateTime  @updatedAt
+  archivedAt  DateTime?
+
+  parent       MemberGroup?            @relation("groupTree", fields: [parentId], references: [id], onDelete: Restrict)
+  children     MemberGroup[]           @relation("groupTree")
+  memberships  MemberGroupMembership[]
+  asAncestor   MemberGroupClosure[]    @relation("ancestor")
+  asDescendant MemberGroupClosure[]    @relation("descendant")
+
+  @@index([parentId, archivedAt])
+}
+
+/// User↔group many-to-many; a user may belong to multiple groups. Soft delete
+/// via `revokedAt` (same pattern as TeamMembership) allows re-adding a removed
+/// member. `userId, revokedAt` index is the resolution hot path: fetch a user's direct groups.
+model MemberGroupMembership {
+  id        String    @id @default(cuid())
+  groupId   String
+  userId    String
+  createdAt DateTime  @default(now())
+  revokedAt DateTime?
+
+  group MemberGroup @relation(fields: [groupId], references: [id], onDelete: Cascade)
+  user  User        @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([groupId, userId, revokedAt])
+  @@index([userId, revokedAt])
+  @@index([groupId, revokedAt])
+}
+
+/// Transitive closure of the MemberGroup tree. Every group has a depth=0
+/// self row. Turns ancestor/descendant resolution into one indexed join
+/// instead of a recursive CTE; maintained only on create / reparent (rare
+/// super-admin ops, so the write cost is amortized against hot reads). On soft
+/// delete the closure rows are retained; resolution filters by
+/// MemberGroup.archivedAt. Reparent must reject a new parent inside the moved
+/// subtree (cycle guard).
+model MemberGroupClosure {
+  ancestorId   String
+  descendantId String
+  depth        Int
+
+  ancestor   MemberGroup @relation("ancestor", fields: [ancestorId], references: [id], onDelete: Cascade)
+  descendant MemberGroup @relation("descendant", fields: [descendantId], references: [id], onDelete: Cascade)
+
+  @@id([ancestorId, descendantId])
+  @@index([descendantId])
+}
+
 /// Locally synchronized Feishu external principal membership.
 model ExternalDirectoryConnection {
   id               String    @id @default(cuid())
@@ -953,3 +986,127 @@ model CapabilityCredentialVersion {
   @@index([keyId])
   @@index([createdByUserId])
 }
+
+// --- File library (文件库) -------------------------------------------------
+//
+// 独立模块,语义由仓库根《文件库-接口契约.md》(C/D 编号)与 .omo/文件库-开工计划.md
+// (D11–D19)锚定。与上面的 Folder/Project(hub 自己的 explorer,ADR-0021)是两套
+// 体系,不复用、不互相引用。
+
+/// 文件库目录树节点:文件夹(容器)或项目(叶子,关联 git 仓库)。
+/// parentId 是树的权威关系;pathIds 是 id 编码的物化路径(派生),随 create/move
+/// 在事务内维护(计划 D12;name 不入路径,rename 不重写后代)。
+model FileLibNode {
+  id              String                 @id
+  organizationId  String
+  parentId        String?
+  kind            FileLibNodeKind
+  name            String
+  /// D14:NFC+trim 的小写形式;活跃兄弟节点大小写不敏感唯一(部分唯一索引在迁移 SQL)。
+  nameLower       String
+  /// id 编码物化路径,形如 "/rootId/childId/selfId"。祖先展开与前缀查询都用它。
+  pathIds         String
+  /// D11:创建者不可变,自动持有 isCreatorGrant=true 的 MANAGE grant。
+  /// 故意不建 FK:这是不可变历史事实,不随 User 生命周期变化。
+  creatorId       String
+  /// 老师可填写的简介，创建/概览页展示，通俗易懂地说明这个节点的用途。
+  description     String?
+  /// 项目 provisioning 状态机(DB/git 双写协调,Metis 风险#1);文件夹恒 READY。
+  provisionStatus FileLibProvisionStatus @default(READY)
+  /// 项目仓库目录(绝对路径);文件夹为 null。
+  storageDir      String?
+  deletedAt       DateTime?
+  createdAt       DateTime               @default(now())
+  updatedAt       DateTime               @updatedAt
+
+  organization    Organization            @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  parent          FileLibNode?            @relation("fileLibTree", fields: [parentId], references: [id], onDelete: Restrict)
+  children        FileLibNode[]           @relation("fileLibTree")
+  grants          FileLibGrant[]
+  projectSettings FileLibProjectSettings?
+  exportJobs      FileLibExportJob[]
+
+  @@index([organizationId, parentId, deletedAt])
+  @@index([organizationId, pathIds])
+  @@index([creatorId])
+}
+
+enum FileLibNodeKind {
+  FOLDER
+  PROJECT
+}
+
+enum FileLibProvisionStatus {
+  PROVISIONING
+  READY
+  FAILED
+}
+
+/// 文件库权限级别:MANAGE > EDIT > VIEW(契约 2.2,只取最高、无降权)。
+enum FileLibRole {
+  VIEW
+  EDIT
+  MANAGE
+}
+
+enum FileLibPrincipalType {
+  USER
+  GROUP
+}
+
+/// 契约 2.3:grant 直接挂在节点上,最终权限 = max(个人, 递归 Group, 祖先继承)。
+/// 活跃授权唯一性由迁移里的部分唯一索引保证(revokedAt IS NULL)。
+model FileLibGrant {
+  id              String               @id @default(cuid())
+  organizationId  String
+  nodeId          String
+  principalType   FileLibPrincipalType
+  principalId     String
+  role            FileLibRole
+  /// D11:创建者自动 grant;独立权限开关关闭时,项目级 grant 里只有它仍生效。
+  isCreatorGrant  Boolean              @default(false)
+  createdByUserId String?
+  createdAt       DateTime             @default(now())
+  revokedAt       DateTime?
+
+  node FileLibNode @relation(fields: [nodeId], references: [id], onDelete: Cascade)
+
+  @@index([organizationId, revokedAt])
+  @@index([principalType, principalId, revokedAt])
+  @@index([nodeId, revokedAt])
+}
+
+/// 契约 P5/D11:项目独立权限开关。默认关闭(仅继承);关闭时项目级非创建者
+/// grant 冻结不删除,重新开启即恢复。
+model FileLibProjectSettings {
+  nodeId                        String  @id
+  independentPermissionsEnabled Boolean @default(false)
+
+  node FileLibNode @relation(fields: [nodeId], references: [id], onDelete: Cascade)
+}
+
+enum FileLibExportStatus {
+  QUEUED
+  RUNNING
+  DONE
+  FAILED
+}
+
+/// 契约 D10:导出为异步任务。外部导出工具参数 OPEN-6,adapter 就位前先建模型。
+model FileLibExportJob {
+  id              String             @id @default(cuid())
+  organizationId  String
+  nodeId          String
+  target          String
+  params          Json
+  status          FileLibExportStatus @default(QUEUED)
+  downloadUrl     String?
+  error           String?
+  createdByUserId String
+  createdAt       DateTime           @default(now())
+  updatedAt       DateTime           @updatedAt
+
+  node FileLibNode @relation(fields: [nodeId], references: [id], onDelete: Cascade)
+
+  @@index([organizationId, status])
+}

hub/src/admin/routes/agentConfigRoutes.ts

@@ -15,10 +15,6 @@
  * `commitSkillContent`, so the web path and CLI path share one ingestion
  * pipeline and one set of safety checks (SKILL.md manifest required, 512-file
  * / 16-byte limits, symlink rejection).
- *
- * Folder tree (ADR-0028): one org-scoped transparent folder tree shared by
- * roles and skills for management-surface grouping. Folder endpoints never
- * touch session state — assignment is a label-class change (ADR-0017).
  */
 import type { PrismaClient } from "@prisma/client";
 import type { FastifyInstance } from "fastify";
@@ -247,121 +243,4 @@ export async function registerAgentConfigRoutes(
       return handleRouteError(reply, err);
     }
   });
-
-  // --- ADR-0028 shared agent-config folder tree (transparent grouping) ---
-
-  app.get("/api/org/:orgSlug/agent-config-folders", async (request, reply) => {
-    try {
-      const { orgSlug } = request.params as { orgSlug: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
-      if (auth === null) return;
-      const folders = await agentConfig.listFolders({ organizationId: auth.organization.id });
-      return { folders };
-    } catch (err) {
-      return handleRouteError(reply, err);
-    }
-  });
-
-  app.post("/api/org/:orgSlug/agent-config-folders", async (request, reply) => {
-    try {
-      const { orgSlug } = request.params as { orgSlug: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
-      if (auth === null) return;
-      const body = request.body as { name?: unknown; parentId?: unknown };
-      if (typeof body.name !== "string") {
-        return reply.status(400).send({
-          error: { code: "bad_request", message: "name is required" },
-        });
-      }
-      const folder = await agentConfig.createFolder({
-        organizationId: auth.organization.id,
-        name: body.name,
-        ...(typeof body.parentId === "string" ? { parentId: body.parentId } : {}),
-      });
-      return reply.status(201).send(folder);
-    } catch (err) {
-      return handleRouteError(reply, err);
-    }
-  });
-
-  app.patch("/api/org/:orgSlug/agent-config-folders/:folderId", async (request, reply) => {
-    try {
-      const { orgSlug, folderId } = request.params as { orgSlug: string; folderId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
-      if (auth === null) return;
-      const body = request.body as { name?: unknown; parentId?: unknown };
-      const folder = await agentConfig.updateFolder({
-        organizationId: auth.organization.id,
-        folderId,
-        ...(typeof body.name === "string" ? { name: body.name } : {}),
-        ...(body.parentId === null || typeof body.parentId === "string"
-          ? { parentId: body.parentId as string | null }
-          : {}),
-      });
-      return folder;
-    } catch (err) {
-      return handleRouteError(reply, err);
-    }
-  });
-
-  app.delete("/api/org/:orgSlug/agent-config-folders/:folderId", async (request, reply) => {
-    try {
-      const { orgSlug, folderId } = request.params as { orgSlug: string; folderId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
-      if (auth === null) return;
-      await agentConfig.deleteFolder({
-        organizationId: auth.organization.id,
-        folderId,
-      });
-      return { deleted: true };
-    } catch (err) {
-      return handleRouteError(reply, err);
-    }
-  });
-
-  // Folder assignment is a label-class change (ADR-0017): these endpoints
-  // never archive Agent sessions (ADR-0028).
-  app.patch("/api/org/:orgSlug/agent-roles/:roleId/folder", async (request, reply) => {
-    try {
-      const { orgSlug, roleId } = request.params as { orgSlug: string; roleId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
-      if (auth === null) return;
-      const body = request.body as { folderId?: unknown };
-      if (body.folderId !== null && typeof body.folderId !== "string") {
-        return reply.status(400).send({
-          error: { code: "bad_request", message: "folderId must be a string or null" },
-        });
-      }
-      await agentConfig.setRoleFolder({
-        organizationId: auth.organization.id,
-        roleId,
-        folderId: body.folderId as string | null,
-      });
-      return { folderId: body.folderId as string | null };
-    } catch (err) {
-      return handleRouteError(reply, err);
-    }
-  });
-
-  app.patch("/api/org/:orgSlug/agent-skills/:name/folder", async (request, reply) => {
-    try {
-      const { orgSlug, name } = request.params as { orgSlug: string; name: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
-      if (auth === null) return;
-      const body = request.body as { folderId?: unknown };
-      if (body.folderId !== null && typeof body.folderId !== "string") {
-        return reply.status(400).send({
-          error: { code: "bad_request", message: "folderId must be a string or null" },
-        });
-      }
-      await agentConfig.setSkillFolder({
-        organizationId: auth.organization.id,
-        name,
-        folderId: body.folderId as string | null,
-      });
-      return { folderId: body.folderId as string | null };
-    } catch (err) {
-      return handleRouteError(reply, err);
-    }
-  });
 }

hub/src/agent/configuration.ts

@@ -18,7 +18,6 @@ export interface AgentRoleRow {
   readonly createdAt: string;
   readonly updatedAt: string;
   readonly skillNames: readonly string[];
-  readonly folderId: string | null;
 }
 
 export interface AgentSkillRow {
@@ -31,17 +30,6 @@ export interface AgentSkillRow {
   readonly createdAt: string;
   readonly updatedAt: string;
   readonly boundRoleIds: readonly string[];
-  readonly folderId: string | null;
-}
-
-/**
- * ADR-0028 transparent folder node of the org's shared agent-config folder
- * tree. Grouping only: never part of skill/role identity or run resolution.
- */
-export interface AgentConfigFolderRow {
-  readonly id: string;
-  readonly name: string;
-  readonly parentId: string | null;
 }
 
 /**
@@ -92,213 +80,9 @@ export class OrganizationAgentConfiguration {
       createdAt: skill.createdAt.toISOString(),
       updatedAt: skill.updatedAt.toISOString(),
       boundRoleIds: skill.roleBindings.map((binding) => binding.role.roleId),
-      folderId: skill.folderId,
     }));
   }
 
-  async listFolders(input: { readonly organizationId: string }): Promise<readonly AgentConfigFolderRow[]> {
-    await this.requireActiveOrganization(input.organizationId);
-    const folders = await this.prisma.organizationAgentConfigFolder.findMany({
-      where: { organizationId: input.organizationId },
-      orderBy: [{ name: "asc" }, { id: "asc" }],
-      select: { id: true, name: true, parentId: true },
-    });
-    return folders;
-  }
-
-  async createFolder(input: {
-    readonly organizationId: string;
-    readonly name: string;
-    readonly parentId?: string | undefined;
-  }): Promise<AgentConfigFolderRow> {
-    await this.requireActiveOrganization(input.organizationId);
-    const name = nonEmpty(input.name, "folder name");
-    return this.prisma.$transaction(async (tx) => {
-      if (input.parentId !== undefined) {
-        await requireFolder(tx, input.organizationId, input.parentId);
-      }
-      const folder = await tx.organizationAgentConfigFolder.create({
-        data: {
-          organizationId: input.organizationId,
-          name,
-          ...(input.parentId !== undefined ? { parentId: input.parentId } : {}),
-        },
-        select: { id: true, name: true, parentId: true },
-      });
-      await tx.auditEntry.create({
-        data: {
-          organizationId: input.organizationId,
-          action: "agent_config_folder.created",
-          metadata: { folderId: folder.id, name: folder.name, parentId: folder.parentId },
-        },
-      });
-      return folder;
-    });
-  }
-
-  /**
-   * Rename and/or move a folder inside the same Organization tree. Moving is
-   * rejected when the target parent is the folder itself or one of its
-   * descendants (would create a cycle).
-   */
-  async updateFolder(input: {
-    readonly organizationId: string;
-    readonly folderId: string;
-    readonly name?: string | undefined;
-    readonly parentId?: string | null | undefined;
-  }): Promise<AgentConfigFolderRow> {
-    await this.requireActiveOrganization(input.organizationId);
-    return this.prisma.$transaction(async (tx) => {
-      const folder = await requireFolder(tx, input.organizationId, input.folderId);
-      if (input.parentId !== undefined && input.parentId !== null) {
-        if (input.parentId === folder.id) {
-          throw new Error("folder cannot be its own parent");
-        }
-        await requireFolder(tx, input.organizationId, input.parentId);
-        const descendant = await tx.$queryRaw<Array<{ found: boolean }>>(Prisma.sql`
-          WITH RECURSIVE descendants AS (
-            SELECT "id" FROM "OrganizationAgentConfigFolder" WHERE "parentId" = ${folder.id}
-            UNION ALL
-            SELECT child."id" FROM "OrganizationAgentConfigFolder" child
-            JOIN descendants parent ON child."parentId" = parent."id"
-          )
-          SELECT EXISTS(SELECT 1 FROM descendants WHERE "id" = ${input.parentId}) AS found
-        `);
-        if (descendant[0]?.found === true) throw new Error("folder cannot be moved below its descendant");
-      }
-      const name = input.name !== undefined ? nonEmpty(input.name, "folder name") : undefined;
-      const updated = await tx.organizationAgentConfigFolder.update({
-        where: { id: folder.id },
-        data: {
-          ...(name !== undefined ? { name } : {}),
-          ...(input.parentId !== undefined ? { parentId: input.parentId } : {}),
-        },
-        select: { id: true, name: true, parentId: true },
-      });
-      await tx.auditEntry.create({
-        data: {
-          organizationId: input.organizationId,
-          action: "agent_config_folder.updated",
-          metadata: {
-            folderId: folder.id,
-            ...(name !== undefined ? { name } : {}),
-            ...(input.parentId !== undefined ? { parentId: input.parentId } : {}),
-          },
-        },
-      });
-      return updated;
-    });
-  }
-
-  /**
-   * Delete a folder. Refused while the folder still has child folders, roles
-   * or skills (ADR-0028: items are relocated explicitly, so no orphan-placement
-   * rule is needed).
-   */
-  async deleteFolder(input: {
-    readonly organizationId: string;
-    readonly folderId: string;
-  }): Promise<void> {
-    await this.requireActiveOrganization(input.organizationId);
-    await this.prisma.$transaction(async (tx) => {
-      const folder = await requireFolder(tx, input.organizationId, input.folderId);
-      const childFolders = await tx.organizationAgentConfigFolder.count({
-        where: { parentId: folder.id },
-      });
-      if (childFolders > 0) {
-        throw new Error(`cannot delete folder: still has ${childFolders} child folder(s)`);
-      }
-      const skills = await tx.organizationAgentSkill.count({
-        where: { organizationId: input.organizationId, folderId: folder.id },
-      });
-      const roles = await tx.organizationAgentRole.count({
-        where: { organizationId: input.organizationId, folderId: folder.id },
-      });
-      if (skills > 0 || roles > 0) {
-        throw new Error(`cannot delete folder: still has ${roles} role(s) and ${skills} skill(s)`);
-      }
-      await tx.organizationAgentConfigFolder.delete({ where: { id: folder.id } });
-      await tx.auditEntry.create({
-        data: {
-          organizationId: input.organizationId,
-          action: "agent_config_folder.deleted",
-          metadata: { folderId: folder.id, name: folder.name },
-        },
-      });
-    });
-  }
-
-  /**
-   * Assign a skill to a folder (or unfile it with `folderId: null`). This is
-   * a label-class change in the ADR-0017 sense — the execution surface is
-   * untouched, so no session archival (ADR-0028).
-   */
-  async setSkillFolder(input: {
-    readonly organizationId: string;
-    readonly name: string;
-    readonly folderId: string | null;
-  }): Promise<void> {
-    await this.requireActiveOrganization(input.organizationId);
-    await this.prisma.$transaction(async (tx) => {
-      const skill = await tx.organizationAgentSkill.findUnique({
-        where: { organizationId_name: { organizationId: input.organizationId, name: input.name } },
-        select: { id: true, disabledAt: true },
-      });
-      if (skill === null || skill.disabledAt !== null) {
-        throw new Error(`active skill not found in organization: ${input.name}`);
-      }
-      if (input.folderId !== null) {
-        await requireFolder(tx, input.organizationId, input.folderId);
-      }
-      await tx.organizationAgentSkill.update({
-        where: { id: skill.id },
-        data: { folderId: input.folderId },
-      });
-      await tx.auditEntry.create({
-        data: {
-          organizationId: input.organizationId,
-          action: "agent_skill.folder_set",
-          metadata: { name: input.name, folderId: input.folderId },
-        },
-      });
-    });
-  }
-
-  /**
-   * Assign a role to a folder (or unfile it with `folderId: null`). Same
-   * label-class semantics as `setSkillFolder`: no session archival (ADR-0028).
-   */
-  async setRoleFolder(input: {
-    readonly organizationId: string;
-    readonly roleId: string;
-    readonly folderId: string | null;
-  }): Promise<void> {
-    await this.requireActiveOrganization(input.organizationId);
-    await this.prisma.$transaction(async (tx) => {
-      const role = await tx.organizationAgentRole.findUnique({
-        where: { organizationId_roleId: { organizationId: input.organizationId, roleId: input.roleId } },
-        select: { id: true, disabledAt: true },
-      });
-      if (role === null || role.disabledAt !== null) {
-        throw new Error(`active role not found in organization: ${input.roleId}`);
-      }
-      if (input.folderId !== null) {
-        await requireFolder(tx, input.organizationId, input.folderId);
-      }
-      await tx.organizationAgentRole.update({
-        where: { id: role.id },
-        data: { folderId: input.folderId },
-      });
-      await tx.auditEntry.create({
-        data: {
-          organizationId: input.organizationId,
-          action: "agent_role.folder_set",
-          metadata: { roleId: input.roleId, folderId: input.folderId },
-        },
-      });
-    });
-  }
-
   async installSkill(input: {
     readonly organizationId: string;
     readonly sourceDir: string;
@@ -688,19 +472,6 @@ export class OrganizationAgentConfiguration {
   }
 }
 
-async function requireFolder(
-  tx: Prisma.TransactionClient,
-  organizationId: string,
-  folderId: string,
-): Promise<{ readonly id: string; readonly name: string; readonly parentId: string | null }> {
-  const folder = await tx.organizationAgentConfigFolder.findFirst({
-    where: { id: folderId, organizationId },
-    select: { id: true, name: true, parentId: true },
-  });
-  if (folder === null) throw new Error(`folder not found in organization: ${folderId}`);
-  return folder;
-}
-
 async function archiveRoleSessions(
   tx: Prisma.TransactionClient,
   organizationId: string,
@@ -759,7 +530,6 @@ function toRoleRow(role: {
   readonly disabledAt: Date | null;
   readonly createdAt: Date;
   readonly updatedAt: Date;
-  readonly folderId: string | null;
   readonly skillBindings: ReadonlyArray<{
     readonly skill: { readonly name: string; readonly disabledAt: Date | null };
   }>;
@@ -779,6 +549,5 @@ function toRoleRow(role: {
     skillNames: role.skillBindings
       .filter((binding) => binding.skill.disabledAt === null)
       .map((binding) => binding.skill.name),
-    folderId: role.folderId,
   };
 }

hub/src/agent/runner.ts

@@ -24,10 +24,10 @@
  * denied by default and re-opened only for the workspace plus named system
  * runtimes, and `failIfUnavailable` hard-fails if the sandbox can't start. The
  * subprocess gets a minimal environment and SDK credential protection removes
- * provider secrets from Bash. This upholds `AgentFileOp.Authorized`
- * (ADR-0018 / `Spec.System.AgentSurface`) without re-implementing the
+ * provider secrets from Bash. This upholds the workspace-bounded file-op
+ * invariant (ADR-0018) without re-implementing the
  * `workspace.ts` `confine()` path validator as a tool wrapper — the OS sandbox
- * is the mechanism, the contract pins the invariant.
+ * is the mechanism, the ADR pins the invariant.
  */
 import { query, type HookCallback, type McpServerConfig, type SDKMessage, type SDKAssistantMessage, type SDKUserMessage, type SDKResultMessage, type SDKPartialAssistantMessage, type SDKSystemMessage } from "@anthropic-ai/claude-agent-sdk";
 import type { PrismaClient } from "@prisma/client";

hub/src/capacity/dimensions.ts

@@ -1,6 +1,6 @@
 /**
- * ADR-0022 capacity dimensions (spec `Spec.System.Capacity.CapacityDimension`).
- * The 23 PINNED dimensions; exact numeric ceilings are `OPEN` and calibrated by
+ * ADR-0022 capacity dimensions.
+ * The 23 pinned dimensions; exact numeric ceilings are open and calibrated by
  * capacity testing. This module is the single source of the dimension set shared
  * by the platform-ceiling config and the org capacity-policy service.
  */

hub/src/database/README.md

@@ -0,0 +1,146 @@
+# src/database/
+
+`/database/*` HTTP 面。代码写在这个目录里，`hub.ts` 通过 `plugin.ts` 挂载它，
+所以服务器启动时能正确识别这些路由。
+
+**前后端分离**：页面已迁到独立的 SvelteKit 静态 SPA `hub/database-admin/`
+（与 `hub/admin-web/` 同一套框架）。本目录的后端只保留三件事：鉴权透传、一个
+免鉴权配置端点、以及把 SPA 构建产物托管出去。页面全部由 SPA 客户端渲染。
+
+后端路由：
+
+- `GET /database/config` —— 免鉴权。返回 `{ siloOrganizationSlug, devLoginEnabled }`，
+  给 SPA 登录页拼飞书链接、决定是否显示 dev 按钮用。不含任何敏感数据。
+- `GET /database/dev-login` —— 仅开发。见下。
+- `GET /database`、`GET /database/*` —— SPA shell / 客户端路由 fallback
+  （`static.ts` 的 `registerDatabaseSpa`）；资产在 `/database/_app/*`。
+
+SPA 页面（`database-admin`，`paths.base='/database'`）：
+
+- `/database/admin` —— 飞书登录页。按钮指向 `/auth/feishu/<orgSlug>`（slug 来自
+  `/database/config`），回调由 `src/admin/routes/authRoutes.ts` 处理并种 session cookie。
+- `/database/dashboard` —— 后台壳。未登录跳登录页；**登录但非 OWNER/ADMIN 显示无权提示**。
+
+> **注册顺序要点**：concrete 路由（`/database/config`、`/database/dev-login`）必须在
+> `registerDatabaseSpa` 的 `/database/*` fallback 之前注册（已在 `plugin.ts` 保证），
+> 否则通配会 shadow 它们。
+
+## 开发模式：用环境变量开启一键登录
+
+本地开发没有真实飞书 app 时，可以用环境变量开启一键登录，跳过飞书 OAuth，
+直接以现有 OWNER/ADMIN 身份登入后台。**仅限开发，不是生产登录路径。**
+
+### 怎么开
+
+在 `hub/.env` 里设：
+
+```sh
+HUB_DEV_LOGIN_BYPASS="true"
+```
+
+改完重启服务（`npm run dev`，或本地手动 `npx tsx src/server.ts`）。启动日志会
+打印一行 `DEV login bypass enabled: /database/dev-login ...` 作为确认。
+
+开启后：
+
+- `/database/config` 返回 `devLoginEnabled: true`，SPA 登录页据此显示
+  「⚡ 一键登录管理员」按钮
+- 后端注册 `/database/dev-login` 端点：按钮就是打它，它签发一个和飞书 OAuth
+  回调完全一样的 session，然后跳到 `/database/dashboard`
+
+### 怎么关
+
+把值设成 `false`（或 `0` / `no` / `off`），或删掉这一行。关闭后按钮消失、
+`/database/dev-login` 返回 404 —— 按钮和端点同进同退。
+
+### 双重门禁（重要）
+
+真正的开关是两个条件的**与**（判断在 `plugin.ts`）：
+
+```
+allowDevLoginBypass = (NODE_ENV !== "production") && HUB_DEV_LOGIN_BYPASS 为真
+```
+
+即：**只要 `NODE_ENV=production`，无论 `HUB_DEV_LOGIN_BYPASS` 设成什么，一键登录
+都强制关闭。** 生产始终只能走真实飞书 OAuth。
+
+> 提醒：`HUB_DEV_LOGIN_BYPASS` 是敏感开关，别把开着它的 `.env` 带到任何联网 /
+> 共享环境。整个旁路逻辑自包含在本目录（`plugin.ts` + `routes/databaseRoutes.ts`），
+> `src/admin` 的登录路由未受影响。
+
+## 文件
+
+| 文件 | 职责 |
+|------|------|
+| `plugin.ts` | 模块对外入口，`hub.ts` 调 `registerDatabasePlugin()` |
+| `routes/databaseRoutes.ts` | 登录页/dashboard + 各子路由装配点 |
+| `routes/filelibRoutes.ts` | 文件库 树/授权 API |
+| `routes/fileRoutes.ts` | 文件库 文件内容/导出 API |
+| `routes/memberGroupRoutes.ts` | 成员组管理 API + `/groups/search` + `/users/search`(ADR-0028) |
+| `routes/adminPanels.ts` | dashboard「用户管理」(org 成员)/「Group 管理」(MemberGroup 嵌套树)面板 |
+| `routes/libraryPage.ts` | `/database/library` 文件库浏览页 |
+| `filelib/` | 文件库领域层(见下) |
+
+新增一类**数据**端点时：要么直接往 `databaseRoutes.ts` 加 `app.get("/database/...")`，
+要么新建 `routes/xxxRoutes.ts` 并在 `databaseRoutes.ts` 里 `registerXxxRoutes(app, {...})`
+注册一次。
+
+## 文件库(filelib/)
+
+独立文件库模块,语义由仓库根《文件库-接口契约.md》(C/D 编号)与
+`.omo/文件库-开工计划.md`(D11–D19)锚定。**与 hub 自己的 Folder/Project
+(ADR-0021 explorer)是两套体系,不复用。**
+
+| 文件 | 职责 |
+|------|------|
+| `filelib/model.ts` | 角色秩(MANAGE>EDIT>VIEW)、D14 命名规则、FileLibError |
+| `filelib/permission.ts` | 纯权限 reducer(取最高/不降权/祖先继承/D11 冻结),不碰 IO |
+| `filelib/treeService.ts` | 树增删改查;每个写操作同事务落审计 |
+| `filelib/grantService.ts` | 授权管理 + 契约 8.1 矩阵强制 + force_adjust |
+| `filelib/fileService.ts` | 文件路径安全 + 版本化读写(先 git 后审计的顺序铁律) |
+| `filelib/exportService.ts` | 导出 job 状态机(D10 异步)+ ExportAdapter port |
+| `filelib/versionStore.ts` | 契约 C1 port + 内存实现(版本团队 npm 包到位后替换) |
+| `filelib/groupResolver.ts` | 契约 C2 port(+ 已弃用的 Team 过渡实现,ADR-0028) |
+| `filelib/memberGroupResolver.ts` | **默认** C2 实现:读 in-hub MemberGroup 闭包(ADR-0028) |
+| `filelib/memberGroupService.ts` | 成员组 CRUD(含改名)+ 成员增删 + 闭包维护 + 搜索(ADR-0028) |
+| `filelib/groupResolverHttp.ts` | C2 HTTP 实现(HUB_GROUP_SERVICE_URL 启用;失败 → 503) |
+| `filelib/audit.ts` | 审计动作词表(C3 §6.3)+ 同事务写入 |
+| `filelib/guards.ts` | session → FileLibActor;网站管理员 = org OWNER/ADMIN(D19) |
+| `filelib/routeShared.ts` | 路由共享件(依赖装配/错误映射/请求体校验) |
+
+环境变量:
+
+- `HUB_FILELIB_STORAGE_ROOT` — 项目 git 仓库根目录(默认 `./.filelib-repos`)
+- `HUB_GROUP_SERVICE_URL` — 外部 Group 服务地址(C2);**未配置时读 in-hub
+  MemberGroup 闭包**(ADR-0028 起的默认;此前是扁平 hub Team)
+
+> ⚠️ 开发期注意:当前 VersionStore 是**进程内存**实现,**服务重启后仓库全失**,
+> 此前创建的项目再访问文件会报 `repo_not_found`(需重建项目)。版本团队的
+> 持久化 git 包到位后此问题消失。
+
+关键语义速查:
+
+- **D8**:无权限 → 404(不泄露存在性);越权 → 403;Group 服务故障 → 503
+- **D11**:creator 不可变 + 自动 MANAGE;独立权限关闭时项目级非创建者 grant 冻结
+- **D12**:move = 本节点 MANAGE + 目标父 EDIT+,事务 + pg 咨询锁
+- **D15**:删除只打标本节点,"任一祖先已删"即整支不可见
+- **8.1**:MANAGE 仅创建者可授/收;creator grant 不可动
+- **审计**:一切写操作在业务事务内写 AuditEntry(同事务,失败即回滚);
+  文件内容写先 versionStore.commit 再审计(宁多版本,不造假审计)
+
+## 约定（与 admin 面一致）
+
+1. 路由用**绝对路径** `"/database/..."`，不用 Fastify prefix —— 每条路由 grep 得到。
+2. **guard 前置、fail closed**：凡碰数据的端点第一行先跑
+   `requireSession` / `requireOrgRole` / `requireProjectPermission`
+   （都在 `../admin/auth/guards.js`）。
+3. **租户隔离**（ADR-0020）：每个 Prisma 查询都 scope 到 `auth.organization.id`，
+   不得跨 org。禁止无鉴权的数据路由。
+4. 数据库通过传入的 `config.prisma` 访问（全进程单例，见 `../db.ts`）；
+   不要在这里 `new PrismaClient()`。
+
+## 为什么代码在 `src/` 下
+
+`tsconfig.json` 固定 `rootDir: "src"` 且 `include: ["src/**/*.ts"]`。只有
+`src/` 下的 `.ts` 会被 `tsc` 编译、被 `tsx watch`（`npm run dev`）加载。放在
+`src/` 之外的目录不会被构建，外部识别不到。