feat(database): 后台成员组(MemberGroup)管理与嵌套解析

fix(database): expose submitCreate on window.__lib in library browser
新建根目录/子节点弹窗的「创建」按钮 onclick 调 window.__lib.submitCreate, 但该函数虽已定义却漏挂到 __lib 导出表,导致点击报 "submitCreate is not a function"。补挂即可。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-26 18:06:18 +08:00 · 2026-07-26 16:39:38 +08:00 · 2026-07-24 00:00:50 +08:00 · 2026-07-23 23:44:17 +08:00 · 2026-07-23 23:41:11 +08:00 · 2026-07-23 22:31:26 +08:00
202 changed files with 16700 additions and 2367 deletions
@@ -1,12 +1,12 @@
 name: checker check

 # Builds and lints the Rust implementation crates under crates/ (the rule-based
-# checker that "stands in Lean's position" at product runtime).
+# lesson checker).
 #
-# Like spec-check, this is an INTERNAL gate on the implementation's own health
-# (does it build, pass its tests, satisfy clippy + rustfmt?). It is NOT a
-# spec-to-implementation conformance gate — implementations align to the Lean
-# contract by human review, not by CI. See the repo README.
+# This is an INTERNAL gate on the implementation's own health
+# (does it build, pass its tests, satisfy clippy + rustfmt?). There is no
+# decision-to-implementation conformance gate — implementations align to the
+# ADRs by human review, not by CI. See the repo README.

 on:
  push:
@@ -1,8 +1,8 @@
 name: hub check

 # Builds, type-checks, and tests the Hub TS package under hub/.
-# The Hub is the Feishu-group collaboration + agent runtime half
-# (spec/System implementation). This is an INTERNAL gate on the Hub's own
+# The Hub is the Feishu-group collaboration + agent runtime half.
+# This is an INTERNAL gate on the Hub's own
 # health, like checker-check is for the Rust half.

 on:
@@ -1,20 +0,0 @@
-name: spec check
-
-# Builds the Lean semantic master spec under spec/.
-# This is an INTERNAL well-formedness gate (does the contract type-check?),
-# NOT a spec-to-implementation conformance gate — implementations align to the
-# contract by human review, not by CI. See repo README.
-
-on:
-  push:
-  pull_request:
-  workflow_dispatch:
-
-jobs:
-  spec-check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      - uses: leanprover/lean-action@v1
-        with:
-          lake-package-directory: spec
@@ -1,7 +1,3 @@
-# Lean / Lake build artifacts (spec/ has its own .gitignore too)
-.lake/
-**/.lake/
-
 # Rust / Cargo build artifacts (repo-wide cargo workspace at root)
 /target
 **/*.pdf
@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_0705f8afbffePWIq7GrFfwfFwV",
+  "updatedAt": "2026-07-23T15:40:15.630Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-23T15:40:15.630Z"
+    }
+  }
+}
@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_07252990dffeRFmXnvdyynty2z",
+  "updatedAt": "2026-07-23T06:33:33.086Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-23T06:33:33.086Z"
+    }
+  }
+}
@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_075d214a0ffe6mU8VNgukUfH5L",
+  "updatedAt": "2026-07-22T14:15:01.741Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-22T14:15:01.741Z"
+    }
+  }
+}
@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_075d3282bffejz0HFE00taOaGM",
+  "updatedAt": "2026-07-22T14:13:54.785Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-22T14:13:54.785Z"
+    }
+  }
+}
@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_0781484caffeKJHXVKiD4BqEJw",
+  "updatedAt": "2026-07-22T06:17:18.238Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-22T06:17:18.238Z"
+    }
+  }
+}
@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_07b163c13ffeudULxSfIfK986T",
+  "updatedAt": "2026-07-21T13:55:58.878Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-21T13:55:58.878Z"
+    }
+  }
+}
@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_07b1e6c8effeq7bdmj6NgO0LqC",
+  "updatedAt": "2026-07-21T13:38:01.132Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-21T13:38:01.132Z"
+    }
+  }
+}
@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_07b932dddffecSipFLwlJOvoJ9",
+  "updatedAt": "2026-07-21T11:27:10.420Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-21T11:27:10.420Z"
+    }
+  }
+}
@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_07b9c4268ffeic4mMXCPUt225j",
+  "updatedAt": "2026-07-21T11:18:53.449Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-21T11:18:53.449Z"
+    }
+  }
+}
@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_07b9c4346ffeVBdV5pf4h6s9PW",
+  "updatedAt": "2026-07-21T11:18:29.979Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-21T11:18:29.979Z"
+    }
+  }
+}
@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_07b9c9a75ffeOyJ4ewp3DBvXhz",
+  "updatedAt": "2026-07-21T11:21:09.776Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-21T11:21:09.776Z"
+    }
+  }
+}
@@ -0,0 +1,10 @@
+{
+  "sessionID": "ses_07cdbac0effeiBrdcHLUUUfwuF",
+  "updatedAt": "2026-07-23T15:37:59.918Z",
+  "sources": {
+    "background-task": {
+      "state": "idle",
+      "updatedAt": "2026-07-23T15:37:59.918Z"
+    }
+  }
+}
@@ -0,0 +1,114 @@
+# 文件库 · 开工计划（v1.0）
+
+> 配套文档：《文件库-接口契约.md》(v0.1，仓库根目录)。本计划已吸收规划顾问评审意见，包含开工前必须先冻结的**架构收口决策 D11–D19**（回写契约 v0.2 时并入）。
+> 工期按 1 人全栈估算；前端从 Phase 2 后可并行。
+
+## 开工判定
+
+**可以开工。** 四个外部依赖（版本包 / Group / 审计 / 平台身份）全部有契约可依、可 mock 并行开发；无阻塞项。唯一前置：本文件的 D11–D19 决策在写第一行 schema 前过一遍（半天，自查即可，有异议再升级）。
+
+## 架构收口决策（新增，先冻结再动工）
+
+| 编号 | 决策 | 理由 |
+|---|---|---|
+| D11 | `creator` 是 Node 的**不可变列**，创建时同时落一条 Manage grant；独立权限开关关闭时，**creator 的 Manage 仍生效**，其余项目级 grant 冻结不参与计算 | 否则 creator 可能被自己关掉的开关锁死 |
+| D12 | 移动节点授权 = **本节点 Manage + 目标父 Edit+**；移动在事务 + Postgres 咨询锁内完成，防并发成环 | 预检环检测在并发下不安全 |
+| D13 | Group resolve 失败返回 **503**（不伪装 404/403）；每次 HTTP 请求 fresh resolve，不跨请求缓存；单请求内多次校验合并为一次调用（此点与 Group 团队确认，OPEN-9） | 依赖故障 ≠ 无权限；契约 G4 要求实时 |
+| D14 | 命名规则：NFC 归一化、trim、≤128 字符、禁 `/` 与控制字符；**活跃兄弟节点大小写不敏感唯一**；根节点全局唯一 | 缺命名规则必有脏数据 |
+| D15 | 删除 = 只给被删节点打标，后代**不递归打标**，靠"任一祖先已删"过滤；所有查询链路强制此过滤（含递归 SQL，不只靠 Prisma middleware） | 递归打标的写放大与恢复复杂度不可控 |
+| D16 | `baseVersion` 为**文件级版本**（GET file 返回的 version）；无关文件的提交不产生冲突 | 与 C1 `head(dir, filePath)` 语义一致 |
+| D17 | breadcrumb 只暴露用户有 View 的祖先名称；无权限祖先显示占位符 `…`，不暴露名字 | 404 不泄露语义（D8）延伸到面包屑 |
+| D18 | v1 **单副本部署**（git 仓库在本地磁盘）；多副本需共享存储或分片，后置 | 不解决不存在的扩展问题 |
+| D19 | 网站管理员**不隐式读内容**；force_adjust 凭 node id 操作（id 从审计或用户上报获得） | C4 已定的最小权限原则 |
+
+## 阶段计划
+
+### Phase 0 · 骨架与身份先行（1–2 天）
+
+- [ ] 过 D11–D19，回写契约 v0.2
+- [ ] repo 骨架 `server/` + `web/`，Postgres docker-compose，CI（lint / typecheck / vitest / 集成测试用真实 Postgres service container）
+- [ ] **JWT 中间件 + 本地 JWKS 测试服务 + 签名 token fixtures**（有效/过期/错 issuer/错 audience/错算法/未知 kid/轮换）——身份先行，不做"宽松 mock 身份"
+- [ ] 4 个 port 接口定义 + mock：`VersionStore`、`GroupResolver`、`AuditSink`（直写 outbox 表的实现就是真的，mock 的是对端服务）、`ExportAdapter`
+- [ ] fastify-swagger 接入，OpenAPI 骨架——**OpenAPI 随每个端点同步产出，不留到最后**
+- **验收**：骨架可 `pnpm dev` 起服务；本地 JWKS 六类 token fixture（有效/过期/错 issuer/错 audience/错算法/未知 kid）中间件行为全对；CI 流水线绿
+
+### Phase 1 · 数据模型与权限引擎（2–3 天）⚑ 心脏
+
+- [ ] Prisma schema：`Node`（parentId **权威** + id 编码的 materialized path 派生列，name 不入 path）、`Grant`、`ProjectIndependentSettings`、`OutboxEvent`（含 attempts/nextAttemptAt/lease/lastError，relay 字段一次到位）、`ExportJob`
+- [ ] 数据库约束：kind 枚举、项目无子节点、活跃兄弟名唯一（部分唯一索引，root 的 NULL parent 特殊处理）、活跃 grant 按 (nodeId, principalType, principalId) 唯一、独立设置仅项目
+- [ ] **纯权限 reducer**：输入已解析的 grants + 祖先链 + 用户组集合，输出 role|null；不碰 DB/网络。fast-check 属性测试：max 单调、加 grant 只升不降、祖先继承、toggle 行为、顺序无关、软删过滤
+- [ ] 数据获取层 + `effective(user, node)` 组装
+- [ ] 树操作服务：create（creator 自动 Manage、root 仅管理员且必带 ≥1 Manage）、rename、move（D12 事务+咨询锁）、soft delete（D15）、breadcrumb（D17）
+- **验收**：并发对移（A→B 与 B→A）、移动+并发建子、property tests、删除祖先过滤，真实 Postgres 全绿
+
+### Phase 2 · 树与授权 API（1–2 天）
+
+- [ ] nodes 端点组 + grants 端点组 + independent-permission 开关 + effective-permission 自查
+- [ ] 授权矩阵校验（契约 8.1：creator-only 授 Manage、Manage 不可动 creator、force_adjust 独立通道）
+- [ ] 全部写操作落 outbox 事件（C3 词汇表）
+- **验收**：契约 8.1 矩阵逐格 API 测试；D8 的 404/403/503 三分语义测试
+
+### Phase 3 · 仓库生命周期与文件 API（2 天）
+
+- [ ] 项目 provisioning 状态机 `PROVISIONING → READY | FAILED`：先建 DB 行（PROVISIONING）→ 调 `VersionStore.init`（幂等）→ 置 READY；失败可重试；孤儿仓库对账 job
+- [ ] 每项目写锁（Postgres 咨询锁，跨进程安全）——不假设版本包能跨进程串行
+- [ ] 路径安全：canonical 后必须落在项目根内、拒绝 `.git`、禁 symlink 逃逸、路径长度上限
+- [ ] 上传限额（单文件 10MB / 单项目配额，数值 OPEN-5）+ 流式接收
+- [ ] files 端点组全量（list/read/upload/commits→409/diff/history/delete）+ 双客户端冲突 e2e
+- **验收**：DB/git 故障注入（init 失败、提交后崩溃）→ 对账能收敛；路径穿越语料库测试全拒
+
+### Phase 4 · 外部集成（1–2 天）
+
+- [ ] `GroupResolver` HTTP client：超时/5xx/429/畸形 JSON/万级 group 的故障注入测试；失败 → 503（D13）
+- [ ] Audit relay worker：租约领取、指数退避、eventId 幂等、重启恢复、积压告警
+- [ ] 导出 job：状态机 + 轮询 + 下载权限校验；`ExportAdapter` 桩（参数 OPEN-6 未定前**不计入完成标准**）
+- **验收**：relay 重启不丢不重（对端幂等）；group 故障时写操作 503、读操作按 D13
+
+### Phase 5 · 前端（3–5 天，Phase 2 后并行启动）
+
+- [ ] 登录（平台 SSO 占位 + 本地 JWKS 直通开关）
+- [ ] 树浏览（懒加载 + 分页）、breadcrumb（D17 占位符）、创建对话框（类型 + 批量授权选择器，Group search 接 C2）
+- [ ] 权限管理面板（按 8.1 矩阵控制可选项，creator 标识）
+- [ ] 文件页：查看/上传/下载/历史列表（编辑 UI 不归我方，留对接位）
+- [ ] 导出按钮 + job 轮询
+- **验收**：无权限节点全链路不可见；授权面板不会送出矩阵禁止的组合
+
+### Phase 6 · 硬化与交付（1–2 天）
+
+- [ ] 404/403/503 全端点核对；并发与重试幂等抽查
+- [ ] 备份脚本（DB + git 仓库一致性快照）、健康检查（DB/JWKS/磁盘/Group）、磁盘水位告警
+- [ ] OpenAPI 终稿 + 部署脚本 + 一页运维手册
+
+## 里程碑
+
+| 里程碑 | 内容 | 累计工期 |
+|---|---|---|
+| M1 | Phase 0–1：骨架 + 权限引擎 + 树操作可跑 | ~4 天 |
+| M2 | Phase 2–3：后端 API 全量（含文件冲突流） | ~7 天 |
+| M3 | Phase 4：外部集成（导出不计） | ~9 天 |
+| M4 | Phase 5–6：前端 + 硬化，可交付 | ~14–18 天 |
+
+## Mock 保真红线（mock 可以顶，但不许骗）
+
+| Mock | 不许掩盖的事 | 真身到位后的契约测试 |
+|---|---|---|
+| VersionStore | 磁盘延迟、半初始化、锁残留、跨进程并发 | 真包跑临时仓库：并发 commit/init 重试/遍历与 symlink 语料 |
+| GroupResolver | 超时、5xx、畸形响应、大规模组集 | 故障注入 HTTP 桩全过；我方绝不自己推祖先 |
+| GroupSearch（前端选择器） | 与 resolve 是**两个独立端点**，不可用 resolve mock 顶替 | C2 `/groups/search` 真身到位后跑分页/空结果/超时 |
+| Audit 对端 | 重复投递、乱序、长时间不可用 | relay 重启恢复 + 对端幂等 |
+| JWT | issuer/audience/算法/轮换 | 本地 JWKS 全用例 |
+| ExportAdapter | 参数、幂等、耗时 | 参数定了再写，之前不算完成 |
+
+## Top 5 风险
+
+1. **DB/git 分裂**（崩溃导致元数据、仓库、审计三边不一致）→ provisioning 状态机 + 对账 job，Phase 3 前置
+2. **移动子树改变整树权限** → D12 事务+锁+源目标双授权，并发测试
+3. **creator/独立权限开关交互** → D11 先冻结
+4. **外部契约缺口**（导出参数、请求内 resolve 合并）→ OPEN 清单跟踪，mock 保真红线不许掩盖
+5. **存储滥用/路径逃逸** → 路径安全 + 配额进 Phase 3 验收，不拖到硬化
+
+## OPEN 清单（在契约文档基础上增补）
+
+- OPEN-9：单请求内合并多次 resolve 是否符合 G4"实时"语义（找 Group 团队确认）
+- OPEN-10：恶意软件扫描归属（我方/平台/不做）
+- 其余 OPEN-1~8 见《文件库-接口契约.md》第 10 节
@@ -29,7 +29,7 @@ workload brakes.

 The full current-state inventory, accepted behavior, and release evidence are
 recorded in [Initial abuse and capacity controls](../assets/initial-abuse-capacity-controls.md),
-with the durable decision in ADR-0022 and `Spec.System.Capacity`. Numerical
+with the durable decision in ADR-0022. Numerical
 ceilings remain open until production-like calibration.

 The implementation frontier is:
@@ -7,6 +7,6 @@ Blocked by: 01, 02, 03, 04, 05, 06, 07, 09, 10, 11, 12, 13, 14, 15, 16, 17, 18,
 ## Question

 After the readiness investigations and resulting fixes are resolved, can one
-repeatable release procedure prove build/test/spec health, deploy a clean
+repeatable release procedure prove build/test health, deploy a clean
 production-like environment, exercise critical tenant and agent journeys,
 verify observability and recovery, and either roll forward or roll back safely?
@@ -8,7 +8,7 @@ Blocked by: 04

 Separate or unify run-bound audit entries, pre-run security/permission events,
 structured messages, and operational recovery events without weakening
-`Spec.System.Audit`'s pinned AuditEntry-to-run relation. Decide durability,
+the pinned AuditEntry-to-run relation. Decide durability,
 failure, retention, and query semantics; then enforce referential integrity and
 observable/recoverable writes instead of silently swallowing lost evidence.
 Do not merge these customer Project/Run records with ADR-0023's already-decided
@@ -40,9 +40,7 @@ an off-host recovery key, an incident and reason, and issues only an expiring
 Emergency Platform Grant.

 The complete accepted decision and implementation divergences are in
-[ADR-0023](../../../docs/adr/0023-platform-administrator-identity-and-audit.md).
-The pinned semantic invariants are in
-[`Spec.System.PlatformAdministration`](../../../spec/Spec/System/PlatformAdministration.lean),
+[ADR-0023](../../../docs/adr/0023-platform-administrator-identity-and-audit.md),
 and the canonical terms are in [`CONTEXT.md`](../../../CONTEXT.md).

 Exact numeric session/invitation/step-up limits and browser mechanics remain
@@ -1,29 +1,25 @@
 # AGENTS.md —— agent 操作手册(全 repo)

-本 repo 是 monorepo。先读根 `README.md` 的"宪法"5 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
+本 repo 是 monorepo。先读根 `README.md` 的"宪法"4 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。

 ## 这个 repo 是什么

- `spec/` 是一份**人机共识的契约**(Lean 语义母本),是产品语义的上游参照。
- 其余部件(将来的 `spec/` 外文件夹)是**向 `spec/` 对齐的实现**。
+- `docs/adr/` 是系统级决策的唯一权威来源;`CONTEXT.md` 是平台语言词汇表;代码注释把关键不变量锚到 ADR 编号,可 grep。
 - `hub/` 的平台层按 SaaS 形态演进:`Organization` 是 tenant root;`Project`/`Team`
-  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020 / `Spec.System.Organization`)。
+  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020)。
 - org 后台 project explorer 里 `Folder` 是透明组织节点,不是权限资源;project 仍是权限边界。
-  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021 /
-  `Spec.System.ProjectWorkspace`)。
+  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021)。
 - 每个 org 自选 BYOK 或平台托管 model provider connection;平台托管也必须是该 org
-  独享的 key/base URL,不得让无关 org 共用 process-global provider key(见 ADR-0021 /
-  `Spec.System.Organization`)。
+  独享的 key/base URL,不得让无关 org 共用 process-global provider key(见 ADR-0021)。
 - Feishu/provider secret 使用本地版本化 master-key keyring 的信封加密;生产由 systemd
  credential 注入,运行时只允许显式 org/project scope 的 fail-closed resolver,不得回退
  process-global credential;Agent child 只接收 run-scoped loopback proxy capability,
-  不接收 org provider credential(见 ADR-0024 / `Spec.System.Organization`)。
+  不接收 org provider credential(见 ADR-0024)。
 - 生产容量按不可突破的 platform ceiling 与 org 可下调 policy 分层;有效限制取两者较低值。
-  Agent admission 必须持久、有界、跨 org 公平且显式背压(见 ADR-0022 /
-  `Spec.System.Capacity`)。
+  Agent admission 必须持久、有界、跨 org 公平且显式背压(见 ADR-0022)。
 - 平台管理员只通过独立的 platform-owned 飞书应用与可撤销 Platform Session 认证,不复用
  客户 `User`/org membership;平台写操作与 append-only audit 同事务,break-glass 只走
-  双因子的离线恢复流程(见 ADR-0023 / `Spec.System.PlatformAdministration`)。
+  双因子的离线恢复流程(见 ADR-0023)。
 - 受控 alpha 暂采用一 Organization 一具名 systemd Silo:独立 database role/database、
  service identity、workspace、keyring 与 Feishu/provider connection；进程必须由
  `HUB_SILO_ORGANIZATION_ID` fail-closed 绑定唯一 org，平台后台不开放。共享 SaaS
@@ -44,12 +40,12 @@

 ## 纪律

-1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。契约里 prose doc 注释是语义的唯一权威来源;契约没写的,就是没定的。
+1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。ADR 与 `CONTEXT.md` 是语义的唯一权威来源;没写的,就是没定的。

-2. **凡契约未写明者,不得假设。** 遇到标了 `OPEN` 的地方,或契约根本没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
+2. **凡 ADR 未写明者,不得假设。** 遇到没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。

-3. **改 `spec/` 必须保持其 `lake build` 通过。** 在 `spec/` 目录下跑 `lake build`。新增声明必须带 `/-- … -/` doc 注释和恰当标签(`PINNED` / `OPEN` / `ADR-NNNN`)。规范见 `spec/README.md`。不准用 `sorry` 把 build 糊绿。
+3. **新语义决策进 ADR。** 跨部件的语义分歧点按编号顺延新增 `docs/adr/NNNN-*.md`;代码里的关键不变量用注释锚到 ADR 编号,保持可 grep。已有 ADR 正文不改写历史——推翻旧决策就写新 ADR 标记 supersede。

-4. **实现向契约对齐;偏离必须 surface。** 没有 CI gate 替你把关 spec↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与契约不一致时,报告它,不要默默让其中一边将就另一边。
+4. **实现向 ADR 对齐;偏离必须 surface。** 没有 CI gate 替你把关 ADR↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与决策不一致时,报告它,不要默默让其中一边将就另一边。

 5. **写操作谨慎。** 线上操作、git 写操作前与开发者确认(这是开发者的全局偏好)。
@@ -1,25 +1,23 @@
 # CLAUDE.md —— agent 操作手册(全 repo)

-本 repo 是 monorepo。先读根 `README.md` 的"宪法"5 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
+本 repo 是 monorepo。先读根 `README.md` 的"宪法"4 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。

 ## 这个 repo 是什么

- `spec/` 是一份**人机共识的契约**(Lean 语义母本),是产品语义的上游参照。
- 其余部件(将来的 `spec/` 外文件夹)是**向 `spec/` 对齐的实现**。
+- `docs/adr/` 是系统级决策的唯一权威来源;`CONTEXT.md` 是平台语言词汇表;代码注释把关键不变量锚到 ADR 编号,可 grep。
 - `hub/` 的平台层按 SaaS 形态演进:`Organization` 是 tenant root;`Project`/`Team`
-  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020 / `Spec.System.Organization`)。
+  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020)。
 - org 后台 project explorer 里 `Folder` 是透明组织节点,不是权限资源;project 仍是权限边界。
-  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021 /
-  `Spec.System.ProjectWorkspace`)。
+  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021)。

 ## 纪律

-1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。契约里 prose doc 注释是语义的唯一权威来源;契约没写的,就是没定的。
+1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。ADR 与 `CONTEXT.md` 是语义的唯一权威来源;没写的,就是没定的。

-2. **凡契约未写明者,不得假设。** 遇到标了 `OPEN` 的地方,或契约根本没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
+2. **凡 ADR 未写明者,不得假设。** 遇到没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。

-3. **改 `spec/` 必须保持其 `lake build` 通过。** 在 `spec/` 目录下跑 `lake build`。新增声明必须带 `/-- … -/` doc 注释和恰当标签(`PINNED` / `OPEN` / `ADR-NNNN`)。规范见 `spec/README.md`。不准用 `sorry` 把 build 糊绿。
+3. **新语义决策进 ADR。** 跨部件的语义分歧点按编号顺延新增 `docs/adr/NNNN-*.md`;代码里的关键不变量用注释锚到 ADR 编号,保持可 grep。已有 ADR 正文不改写历史——推翻旧决策就写新 ADR 标记 supersede。

-4. **实现向契约对齐;偏离必须 surface。** 没有 CI gate 替你把关 spec↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与契约不一致时,报告它,不要默默让其中一边将就另一边。
+4. **实现向 ADR 对齐;偏离必须 surface。** 没有 CI gate 替你把关 ADR↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与决策不一致时,报告它,不要默默让其中一边将就另一边。

 5. **写操作谨慎。** 线上操作、git 写操作前与开发者确认(这是开发者的全局偏好)。
@@ -99,3 +99,7 @@ _Avoid_: Cost budget, unlimited run
 **Emergency Workload Brake**:
 An audited Platform Administrator control that prevents new agent work for one Organization or the whole platform and may explicitly stop active work during an incident.
 _Avoid_: Organization deletion, service restart
+
+**Member Group**:
+A global, unlimited-depth, nestable authorization principal managed by the website administrator; a file-library grant on a group applies to that group and its whole descendant subtree, and a user's effective permission collects every group they belong to plus those groups' ancestors (ADR-0028). It stores no folder/project permission itself — only the user→group membership. Global: not owned by any Organization.
+_Avoid_: Team (the org-scoped flat grouping), Feishu department
@@ -2,7 +2,7 @@

 教研生产的数字化解决方案。核心思路:课程像 DAW / 剪辑软件那样有一个**结构化的工程文件**;coding agent 协助编辑它;一个 rule-based checker(类编译器)校验其合法性并给出 helpful fix hint。目标是把教研从一次性的文档,沉淀成**可累积、可校验、可复用的资产**。

-这是一个 **monorepo**。它的组织方式本身就表达了一条原则:**`spec/` 是上游的语义母本,其余部件是向它对齐的实现。**
+这是一个 **monorepo**。它的组织方式本身就表达了一条原则:**`docs/adr/` 是系统级决策的唯一权威来源,代码注释把关键不变量锚到 ADR 编号,可 grep。**

 ## 安装 `cph` 命令行

@@ -33,47 +33,40 @@ cph completions zsh > ~/.zfunc/_cph        # 或 bash/fish/powershell/elvish
 ```
 README.md          ← 本文件:总览 + 宪法(下面 5 条)
 CLAUDE.md          ← 全局 agent 操作手册(管整个 repo)
-docs/adr/          ← 系统级架构决策记录(跨部件,被 spec 契约引用)
-spec/              ← Lean 语义母本(自包含的 Lean 工程)。见 spec/README.md
+docs/adr/          ← 系统级架构决策记录(跨部件,决策的唯一权威来源)
+CONTEXT.md         ← 平台语言词汇表(术语与禁用说法)
 Cargo.toml         ← 仓库级 cargo workspace(实现部件共用,便于跨部件复用 crate)
-crates/            ← 实现:rule-based checker(向 spec 对齐)。见 crates/README.md
+crates/            ← 实现:rule-based checker(语义由 ADR 锚定)。见 crates/README.md
  cph-diag / cph-model / cph-schema / cph-typst   ← 可复用基础(模型/校验/typst 引擎)
  cph-check / cph-cli                             ← checker 本体 + `cph` 命令行
-render/            ← typst 渲染包 cph-render(母本的渲染后端之一,ADR-0005)
+render/            ← typst 渲染包 cph-render(checker 的渲染后端,ADR-0005)
 examples/          ← 样例工程文件(如 TH-141),流水线的真实输入
 hub/              ← SaaS Hub:飞书协作、org 管理、agent runtime 与生产部署
-(exporter/ …)     ← 将来的其他部件,平级于 spec/
+(exporter/ …)     ← 将来的其他部件,平级于 crates/
 ```

-`spec/` 与实现部件**物理分离、平级共存**:谁是上游、谁向谁对齐,一眼可见。
 实现部件共用一个仓库根的 cargo workspace,使基础 crate(模型、typst 引擎)能被
 未来部件(如 exporter)复用,而非各自重造。

 ## 宪法

-这 5 条是 `spec/` 这份语义母本的定位与约束,是本仓库一切工作的前提。
+这 4 条是本仓库的协作约定,是一切工作的前提。

-1. **角色 —— Lean 是研发侧的上游参照。**
-   `spec/` 用 Lean 编写,是开发者(领域专家)与 coding agent **共用**的 spec 工具,用来沉淀产品各部件的**语义**。它**不进入产品运行时**——产品里"站在 Lean 这个位置"的那个 checker 用什么技术实现,尚未决定;但那个东西的语义,先在 `spec/` 里固定下来。
+1. **角色 —— ADR 是决策真相。**
+   跨部件的语义决策只记录在 `docs/adr/`,一份决策一份 ADR,编号顺延、正文不改写历史。代码里的关键不变量用注释锚到 ADR 编号,保持可 grep。没有第二份权威文档。

-2. **对齐机制 —— Lean 只做上游参照。**
-   不做 extract / codegen,不派生 conformance test,CI 里**没有** spec→实现的 gate。实现对齐 spec,由"开发者 review + agent 巡逻 diff"这个人肉环节承载。
-   (CI 里的 `spec check` 只验 spec **自身**能否 type-check,即契约内部良构,不是 spec↔实现的对齐检查。)
+2. **对齐机制 —— 人肉承载,无机器兜底。**
+   CI 只验各部件自身良构(build / test / clippy),**没有**决策↔实现的一致性 gate。实现对齐 ADR,由"开发者 review + agent 巡逻 diff"这个人肉环节承载。发现漂移,报告它,不要默默让其中一边将就另一边。

-3. **资产性 —— 由 review 纪律承载,无机器兜底。**
-   这份仓库给你的是"精确、自洽、机器验内部良构的语义共识",**不是**"实现正确性保证"。spec 与实现之间那道缝,是我们自愿用人来守的——清醒地守,它就是资产;放任实现漂移而不回头同步,它就退化成最贵的过期文档。
+3. **形态 —— 自包含。**
+   凡 ADR 未明文规定的,开发者与 agent 双方都不该假设;遇到没覆盖的地方,**显式 surface** 出来让开发者决定。

-4. **形态 —— 它是人机共识的契约。**
-   契约必须**自包含**:凡契约未明文规定的,开发者与 agent 双方都不该假设。这比"文档"严格——type checker 会逼这份契约在结构上无洞。
-
-5. **深度判据 —— 只收录分歧点。**
-   一条语义该不该写进 Lean,取决于一句话:**"不写明,开发者与 agent 会不会各自做出不同假设?"** 会 → 进契约;显然的东西 / 纯 plumbing / 普通 CRUD 字段 → 不进(写进去只稀释信噪比、增加维护面)。
-   深度上限不是 Lean 的表达力,而是**你愿意在每次实现变更时手动回头同步的量**——写得比你能维护的更深,多出来的部分会率先过期、反过来误导实现。
+4. **深度判据 —— 只收录分歧点。**
+   一条语义该不该写进 ADR,取决于一句话:**"不写明,开发者与 agent 会不会各自做出不同假设?"** 会 → 进 ADR;显然的东西 / 纯 plumbing / 普通 CRUD 字段 → 不进(写进去只稀释信噪比、增加维护面)。
+   深度上限是**你愿意在每次实现变更时手动回头同步的量**——写得比你能维护的更深,多出来的部分会率先过期、反过来误导实现。

 ## CI

-`.gitea/workflows/spec-check.yml` 在每次 push / PR 时于 `spec/` 下跑 `lake build`,确保契约始终 type-check 通过(从第一天起就是"绿"的)。这是良构 gate,见宪法第 2 条。
-
 Rust checker 的本地与 CI 工具链由根 `rust-toolchain.toml` 固定;`.gitea/workflows/checker-check.yml`
 必须安装同一精确版本并执行 `cargo fmt --all --check`、Clippy `-D warnings` 与 workspace
 全测试。升级 Rust 时这两处必须在同一提交更新并通过完整 checker gate。
@@ -1,7 +1,8 @@
 # crates/

-These crates implement the rule-based lesson checker that aligns to the
-semantic master in `spec/`: it reads an engineering-file (one lesson, ADR-0005)
+These crates implement the rule-based lesson checker whose semantics are
+pinned by the ADRs in `docs/adr/`: it reads an engineering-file (one lesson,
+ADR-0005)
 laid out per ADR-0008 (declarative `manifest.toml` + per-element
 `element.toml`), validates structure and content, and emits diagnostics.
 `cph-diag` (the shared diagnostic vocabulary), `cph-model` (the ADR-0008 loader),
@@ -19,13 +19,11 @@ const DEFAULT_TARGET: &str = "student";

 /// Severity of the render-coverage ("element ignored under a target") diagnostic.
 ///
-/// **PINNED to `warning` by the contract.** Mirrors the Lean master's
-/// `Spec.Courseware.renderIgnoredSeverity : Severity := .warning`
-/// (`spec/Spec/Courseware/Check/Diagnostic.lean`), itself citing ADR-0005: when a
+/// **PINNED to `warning` by ADR-0005:** when a
 /// `(kind, target)` pair has no render rule the checker reports that the element
 /// is ignored under that target and **does not block the export**. Naming the
-/// severity as a const makes "it is a warning, not an error" a greppable,
-/// alignable fact rather than an inline literal.
+/// severity as a const makes "it is a warning, not an error" a greppable
+/// fact rather than an inline literal.
 const RENDER_IGNORED_SEVERITY: Severity = Severity::Warning;

 /// The result of running [`check`] (or the check phases of [`build`]).
@@ -57,12 +55,12 @@ impl CheckReport {

    /// Whether any collected diagnostic is `Error`-severity.
    ///
-    /// **Legality decision (spec alignment).** `!has_errors()` is the
-    /// implementation of `Spec.Courseware.Legal` (`spec/Spec/Courseware/Check/Diagnostic.lean`):
-    /// a lesson is *legal* iff its diagnostics contain no error-level diagnostic
-    /// (warnings are non-blocking — see `Severity` / ADR-0010). There is no CI
-    /// gate enforcing this alignment (repo constitution); it is kept greppable
-    /// here so a reviewer can tie the orchestrator's gate to the Lean master.
+    /// **Legality decision (ADR-0010).** `!has_errors()` decides lesson
+    /// legality: a lesson is *legal* iff its diagnostics contain no error-level
+    /// diagnostic (warnings are non-blocking — see `Severity`). There is no CI
+    /// gate enforcing ADR↔implementation alignment (repo constitution); it is
+    /// kept greppable here so a reviewer can tie the orchestrator's gate to
+    /// the ADR.
    pub fn has_errors(&self) -> bool {
        self.diagnostics
            .iter()
@@ -2,7 +2,7 @@
 //!
 //! Every other crate in the workspace depends on these types to report
 //! problems. The vocabulary is intentionally small and stable: a [`Severity`]
-//! (mirroring the Lean master), a closed set of machine-stable [`DiagCode`]s, an
+//! (two-valued, ADR-0010), a closed set of machine-stable [`DiagCode`]s, an
 //! optional [`SourceSpan`] pointing back at the offending source, and a
 //! [`Diagnostic`] tying them together with a human message and a fix hint.
 //!
@@ -17,32 +17,27 @@ use serde::Serialize;

 /// Severity of a diagnostic.
 ///
-/// **Mirrors `Spec.Courseware.Diagnostic.Severity`** in the Lean semantic
-/// master (`spec/Spec/Courseware/Check/Diagnostic.lean`), whose definition is
-/// exactly:
+/// **Pinned by ADR-0005 / ADR-0010: exactly two values.**
 ///
 /// ```text
-/// inductive Severity where
-///   | warning
-///   | error
+/// warning | error
 /// ```
 ///
-/// This two-valued shape is a **contract decision**, not an accident: the Lean
-/// module pins `Severity` to exactly `warning | error` and states the finer
-/// levels (`info` / `hint` / `note`) are deliberately undecided. We therefore
+/// This two-valued shape is a **contract decision**, not an accident: the
+/// finer levels (`info` / `hint` / `note`) are deliberately undecided, so we
 /// do **not** add an info/note level here. `error` blocks (the artifact is
 /// invalid); `warning` does not block (the artifact still exports, but with
 /// loss / an ignored element — e.g. ADR-0005's "missing render ⇒ warning").
 ///
-/// There is no CI gate enforcing this alignment (see the repo constitution);
-/// it is maintained by review, which is why this correspondence is documented
-/// here rather than only in the spec.
+/// There is no CI gate enforcing ADR↔implementation alignment (see the repo
+/// constitution); it is maintained by review, which is why the decision is
+/// documented here rather than only in the ADR.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
 pub enum Severity {
    /// Non-blocking: the artifact still exports, but is lossy / has an ignored
-    /// element. Mirrors Lean `Severity.warning`.
+    /// element. ADR-0010 `warning`.
    Warning,
-    /// Blocking: the artifact is invalid. Mirrors Lean `Severity.error`.
+    /// Blocking: the artifact is invalid. ADR-0010 `error`.
    Error,
 }

@@ -3,9 +3,7 @@
 //! This crate is the **loader**, not the full checker. It reads
 //! `<root>/manifest.toml` (project / info / ordered `[[parts]]` / declared
 //! `[targets.*]`) and each part's `<root>/<path>/element.toml`, and produces an
-//! ordered [`Lesson`] — mirroring the Lean master's `Lesson = List (Element P)`
-//! (`spec/Spec/Courseware/Model/Lesson.lean`), where the order of `parts` carries
-//! teaching semantics.
+//! ordered [`Lesson`], where the order of `parts` carries teaching semantics.
 //!
 //! Scope boundaries (deliberately staying in lane):
 //! - It validates **structure** only: manifest shape, element.toml shape, and
@@ -23,7 +21,7 @@ use serde::{Deserialize, Serialize};

 /// An ordered, in-memory lesson loaded from an engineering file.
 ///
-/// Mirrors the Lean master's `Lesson = List (Element P)`: `parts` is an ordered
+/// `parts` is an ordered
 /// `Vec`, and that order is the lesson's order (ADR-0008 §"the lesson manifest
 /// is declarative" — the `[[parts]]` array order is the single source of truth).
 #[derive(Debug, Clone, PartialEq, Serialize)]
@@ -86,9 +84,8 @@ pub struct TargetConfig {
    /// with template `exports/<name>.typ` when no `[[steps]]` are given.
    pub steps: Vec<Step>,
    /// The **render-coverage declaration**: which element kinds this target
-    /// renders. Realizes `Spec.Courseware.TargetSpec.covers : KindId → Prop`
-    /// (`spec/Spec/Courseware/Export/Render.lean`) and ADR-0011's "render
-    /// coverage is a declaration, not a payload": the contract keeps *which
+    /// renders. Realizes ADR-0011's "render
+    /// coverage is a declaration, not a payload": the declaration keeps *which
    /// kinds a target renders* (used by the `renderIgnored` seed diagnostic),
    /// while the rendering "how" lives in the template/steps.
    ///
@@ -102,13 +99,10 @@ pub struct TargetConfig {

 /// The artifact an export target produces (ADR-0009/0011).
 ///
-/// **Mirrors `Spec.Courseware.Artifact`** in the Lean semantic master
-/// (`spec/Spec/Courseware/Export/Artifact.lean`), whose definition is exactly:
+/// **Pinned by ADR-0011** as an ADT with fields:
 ///
 /// ```text
-/// inductive Artifact where
-///   | singleFile (filepath : String)
-///   | fileTree (root : String) (outputs : String)
+/// Artifact = singleFile (filepath) | fileTree (root, outputs)
 /// ```
 ///
 /// ADR-0011 pinned the artifact as an ADT **with fields**: "what the product
@@ -120,20 +114,20 @@ pub struct TargetConfig {
 /// `"single-file"` → [`Artifact::SingleFile`], `"file-tree"` →
 /// [`Artifact::FileTree`].
 ///
-/// As with `cph-diag`'s `Severity`, there is no CI gate enforcing this
-/// alignment (see the repo constitution) — it is maintained by review, which is
-/// why the correspondence is documented here.
+/// As with `cph-diag`'s `Severity`, there is no CI gate enforcing ADR↔
+/// implementation alignment (see the repo constitution) — it is maintained by
+/// review, which is why the decision is documented here.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 pub enum Artifact {
    /// One bundled document landing at `filepath` (relative to the engineering
-    /// root). Mirrors Lean `Artifact.singleFile`. The default artifact shape.
+    /// root). ADR-0011 `singleFile`. The default artifact shape.
    SingleFile {
        /// Where the single product is written (relative to the engineering
        /// root), e.g. `build/student.pdf`.
        filepath: PathBuf,
    },
-    /// A set of files under `root` matching the `outputs` glob. Mirrors Lean
-    /// `Artifact.fileTree`.
+    /// A set of files under `root` matching the `outputs` glob. ADR-0011
+    /// `fileTree`.
    FileTree {
        /// The output directory (relative to the engineering root).
        root: PathBuf,
@@ -156,14 +150,10 @@ impl Artifact {

 /// One typed build step (ADR-0011).
 ///
-/// **Mirrors `Spec.Courseware.Step`** in the Lean semantic master
-/// (`spec/Spec/Courseware/Export/Render.lean`), whose definition is exactly:
+/// **Pinned by ADR-0011** as an ADT:
 ///
 /// ```text
-/// inductive Step where
-///   | typstCompile (template : String)
-///   | shell (run : String)
-///   | assembleMarkdown (field : String)
+/// Step = typstCompile (template) | shell (run) | assembleMarkdown (field)
 /// ```
 ///
 /// A step is a *typed* operation (extensible): `TypstCompile` compiles a
@@ -183,20 +173,20 @@ impl Artifact {
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 pub enum Step {
    /// Compile a template file (relative to the engineering root) into the
-    /// artifact; the framework injects the manifest. Mirrors Lean
-    /// `Step.typstCompile`.
+    /// artifact; the framework injects the manifest. ADR-0011
+    /// `typstCompile`.
    TypstCompile {
        /// The template file to compile as main, e.g. `exports/student.typ`.
        template: PathBuf,
    },
-    /// Run a shell command — the escape hatch. Mirrors Lean `Step.shell`.
+    /// Run a shell command — the escape hatch. ADR-0011 `shell`.
    Shell {
        /// The command line to run.
        run: String,
    },
    /// Assemble a single-file markdown deliverable by concatenating each
-    /// element's `field` markdown content file in `[[parts]]` order. Mirrors
-    /// Lean `Step.assembleMarkdown` (ADR-0015). Not a typst build — the
+    /// element's `field` markdown content file in `[[parts]]` order. ADR-0011
+    /// `assembleMarkdown` (ADR-0015). Not a typst build — the
    /// framework owns the read/concatenate/write itself.
    AssembleMarkdown {
        /// The per-element markdown content field to assemble (e.g. `slides`,
@@ -226,12 +216,11 @@ pub struct Project {

 /// `[info]` table (passed through to render targets verbatim).
 ///
-/// **Mirrors `Spec.Courseware.Info`** in the Lean semantic master
-/// (`spec/Spec/Courseware/Model/Info.lean`): the *canonical* model whose
+/// The *canonical* model whose
 /// `authors` is always a list. The authoring-surface form (string-or-array
 /// `author`) is the separate [`RawInfo`] / [`RawAuthor`], normalized into this
-/// at the load boundary — mirroring the Lean `RawInfo` / `RawAuthor` split. No
-/// CI gate enforces this alignment (repo constitution); it is kept greppable.
+/// at the load boundary. No
+/// CI gate enforces ADR↔implementation alignment (repo constitution); it is kept greppable.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 pub struct Info {
    /// Lesson title.
@@ -240,7 +229,6 @@ pub struct Info {
    /// so this is a list, not a single name. Empty when `[info]` declares no
    /// `author`. The on-disk `author` accepts either a bare string (one author)
    /// or an array of strings (see [`RawAuthor`]); both load into this `Vec`.
-    /// Mirrors Lean `Info.authors : List String`.
    pub authors: Vec<String>,
 }

@@ -290,8 +278,7 @@ struct RawProject {
    name: String,
 }

-/// The authoring-surface `[info]` (mirrors Lean `RawInfo` in
-/// `spec/Spec/Courseware/Model/Info.lean`): the raw form that exists for
+/// The authoring-surface `[info]`: the raw form that exists for
 /// fill-in convenience, normalized into the canonical [`Info`] at the load
 /// boundary. Not the form the rest of the model traffics in.
 #[derive(Debug, Deserialize)]
@@ -301,7 +288,7 @@ struct RawInfo {
 }

 /// On-disk `author`: either a single name (`author = "…"`) or a list
-/// (`author = ["…", "…"]`). Mirrors Lean `RawAuthor`: a fill-in convenience whose
+/// (`author = ["…", "…"]`). A fill-in convenience whose
 /// string-or-array union lives **only** at the load boundary — [`RawAuthor::into_vec`]
 /// folds it into the canonical [`Info::authors`] `Vec`, after which it never appears.
 #[derive(Debug, Deserialize)]
@@ -312,7 +299,7 @@ enum RawAuthor {
 }

 impl RawAuthor {
-    /// Flatten to the ordered author list (Lean `RawAuthor.normalize`): a single
+    /// Flatten to the ordered author list: a single
    /// name becomes a one-element list; a list passes through verbatim.
    fn into_vec(self) -> Vec<String> {
        match self {
@@ -0,0 +1,153 @@
+# ADR 0028: Member Group Management And Resolution
+
+## Status
+
+Accepted.
+
+## Context
+
+ADR-0020 fixed `Organization` as the tenant root and ADR-0019 pinned the
+principal-set permission model. The file library (《文件库-接口契约.md》) computes
+effective permission over two principal kinds — `USER` and `GROUP` — and consumes
+the group side through a single read-only port, `GroupResolver`
+(`resolveMemberGroupIds(userId) → groupIds[]`, contract C2/G2).
+
+The contract's v0.1 proposal framed the Group system as a *separate HTTP service*
+owned by another team, consumed read-only. In practice the schema now carries the
+group tables directly in the hub database (`MemberGroup`, `MemberGroupMembership`,
+`MemberGroupClosure` — a global, unlimited-depth, closure-backed hierarchy), and
+the product requirement is to build **group management in the backend admin**, not
+to integrate a foreign service. Until this ADR, nothing read or wrote those tables:
+the live `GroupResolver` was a transitional implementation reading flat hub `Team`
+membership, and the admin "Group 管理" panel actually managed `Team`.
+
+This ADR settles the semantics needed to make the `MemberGroup` tables the real,
+in-hub group system.
+
+## Decision
+
+### Group system is in-hub, not a foreign service
+
+`MemberGroup` is the platform's global member-group principal. It lives in the hub
+database and is managed through the `/database` backend. The contract's "separate
+service" framing was an unfrozen v0.1 proposal; the implementation aligns to the
+tables that were actually built. The `GroupResolver` port stays — an external
+`HUB_GROUP_SERVICE_URL` HTTP implementation remains a supported override — but the
+default implementation reads the in-hub `MemberGroup` closure.
+
+### Authority: website administrator only
+
+Group create/delete and member add/remove are restricted to the **website
+administrator**, defined (consistently with the rest of the file library, D19/C4
+adaptation) as an `OWNER`/`ADMIN` of the silo Organization (`isWebsiteAdmin` in
+`filelib/guards.ts`). ADR-0023's `PlatformIdentity` is the future "true" platform
+control plane; the file library uniformly uses org OWNER/ADMIN today and this
+feature stays consistent with that. Reading groups for the authorization selector
+(`/groups/search`) is **not** admin-gated — picking a group to grant is a Manage
+holder's ability, not an administrator's.
+
+### Resolution semantics (the crux)
+
+`resolveMemberGroupIds(user)` returns the user's **active direct groups ∪ the
+active ancestors of those groups**, deduplicated (the closure's depth-0 self row
+makes each direct group its own ancestor). This is the single query the permission
+engine relies on; equivalently: a grant placed on group G applies to members of G
+and of every descendant of G (requirement 3.2 — permission flows down the tree, so
+resolution collects up the tree). It is computed **live, never cached** (contract
+D4/G4): a membership change is visible on the very next protected request.
+
+MemberGroup is global (no `organizationId`), so resolution is not org-scoped.
+
+### Soft delete via `archivedAt`, cascading the subtree
+
+Delete is soft: `MemberGroup.archivedAt` is a tag. Deleting a group
+cascade-soft-deletes its **whole subtree** (walk `MemberGroupClosure` where
+`ancestorId = G`, stamp `archivedAt` on each active descendant) — an application
+operation, not a DB constraint. Closure and membership rows are **retained**;
+resolution and listing filter by `archivedAt`, so an archived group and everything
+under it stop contributing to permission at once.
+
+### Closure maintenance
+
+The closure is maintained on **create**: insert `(G, G, 0)`, then for a parent `P`
+insert `(a.ancestorId, G, a.depth + 1)` for every `a` in
+`closure where descendantId = P`. v1 does **not** support reparenting a group
+(moving it under a new parent). The schema reserves reparent (closure rebuild plus
+the cycle guard "reject a new parent inside the moved subtree"); it is a follow-on.
+
+### Rename and description edits are in scope; reparent stays out
+
+A group's `name` and `description` are mutable by the website administrator
+(`PATCH /database/api/groups/:id`, audited as `group.update`). This is deliberately
+separated from reparent: renaming touches **no** closure row and cannot create a
+cycle, so it carries none of the invariant risk that keeps reparent out of v1. The
+endpoint therefore **rejects** a `parentId` field outright rather than ignoring it,
+so a future reparent cannot arrive silently through this route. Passing an empty
+`description` clears it; omitting a field leaves it unchanged.
+
+### Restore is deliberately asymmetric with delete
+
+Archived groups stay visible to the administrator (`GET
+/database/api/groups?includeArchived=1` returns them carrying `archivedAt`; the
+console tags and greys them) and can be restored (`POST
+/database/api/groups/:id/restore`, audited as `group.restore`).
+
+Restore is **not** the mirror image of delete. Delete cascades down the whole
+subtree; restore un-archives **the group plus every archived ancestor of it, and
+nothing below it**:
+
+- Restoring the ancestor chain is **mandatory**, not a convenience. An active group
+  whose parent is archived has no path in the tree, and the `depth` derivation
+  (closure row count) presumes "an active group's ancestors are active" — the
+  invariant that cascade-delete establishes. Restoring a node alone would break it.
+- The subtree is deliberately **left archived**. A group's descendants may have been
+  archived for reasons of their own, and one click should not silently re-grant
+  permission across a whole historical branch. Descendants remain visible in their
+  archived state and are each restored explicitly.
+
+Restore takes effect immediately, like every other membership change (D4/G4): the
+group resumes contributing permission on the next resolution.
+
+An archived group is **readable but not writable**. Its membership rows are never
+revoked by archiving, so `listMembers` succeeds on an archived group — the console
+must be able to show *who was in it* before deciding whether to restore it. Every
+mutation, by contrast, still requires an active group (`requireActiveGroup` → 404):
+rename, child creation, and member add/remove all reject. The group is inert for
+permission purposes and frozen for editing, but not hidden and not forgotten.
+
+### Member picker reads global users, admin-only
+
+`GET /database/api/users/search` backs the "add member" picker: it matches `User`
+by display name or Feishu open id and is gated to the website administrator, the
+same authority that may add members. It widens no existing capability — adding a
+member already accepts **any** global user (`resolveUser` does not require an org
+membership), so the endpoint only replaces blind id entry with search. It is
+deliberately **not** opened to the non-admin authorization-selector audience that
+`/groups/search` serves: choosing a group to grant is a Manage-holder action,
+whereas enumerating people is not. `excludeGroupId` filters out the target group's
+active members so the picker cannot surface a candidate that must 409.
+
+### Audit is written in-hub
+
+The contract (C3 §6.3) originally deferred group actions to the foreign Group
+service's own audit. With the group system in-hub, group mutations are audited
+through the existing file-library sink (`filelib/audit.ts`, same-transaction
+`AuditEntry`) under the silo Organization — `MemberGroup` has no `organizationId`,
+so the audit row is attributed to the silo org. New actions: `group.create`,
+`group.update`, `group.delete`, `group.restore`, `group.member_add`,
+`group.member_remove`; new audit object type `group`.
+
+## Consequences
+
+- The default `GroupResolver` becomes the in-hub `MemberGroup` closure reader.
+  `createTeamGroupResolver` is retained but deprecated (no longer wired); existing
+  flat-Team group grants no longer resolve for the file library.
+- Group grants take effect in real time through the existing `effectiveRole`
+  reducer (P6) with no change to the permission algebra — only the set of group ids
+  fed to it changes.
+- v1 omits reparent; the closure invariants above must hold whenever reparent is
+  added later (rebuild descendants' ancestor rows, reject cycles).
+- Group management is an admin-only surface; the authorization selector is not.
+- Numeric limits (max depth, max members) and a hard-delete/restore path remain
+  follow-on operational decisions; they must not weaken the archived-filter,
+  admin-authority, or live-resolution invariants fixed here.
@@ -32,7 +32,7 @@ App ID 通常以 `cli_` 开头，可以写入交付单。App Secret 必须通过
 | 接收群聊中 @ 机器人的消息 | `im:message.group_at_msg:readonly` |
 | 以应用身份发送消息 | `im:message:send_as_bot` |
 | 读取触发消息和线程上下文 | `im:message:readonly` |
-| 获取与上传图片或文件 | `im:resource` |
+| 获取消息中的图片/文件，并向飞书上传图片或文件（含 Agent 回答中的图片发送） | `im:resource` |
 | 添加、删除消息表情回复 | `im:message.reactions:write_only` |
 | 获取用户基本信息 | `contact:user.base:readonly` |
 | 获取用户基本资料 | `contact:user.basic_profile:readonly` |
@@ -66,6 +66,9 @@ Educraft 机器人以应用身份调用上述 API，因此这些 scope 全部放

 如果 API 调试台提示缺少更细粒度权限，请把错误提示和发生时间截图给部署人员。不要自行开通通讯录全量读取等超出本表的权限。

+说明：`im:resource` 既用于下载用户发来的图片/文件，也用于 Agent 回复时把本地或远程图片上传为飞书 `image_key` 后嵌入消息卡片。缺少该权限时，带图回答会发送失败或降级为无图文本。已开通该 scope 的存量应用一般无需新增权限，但若权限尚未随最新版本发布，请创建新版本并审核发布。
+
+
 ## 4. 配置事件与卡片回调

 进入“事件与回调”。
@@ -5,6 +5,10 @@ dist/
 .env.*
 !.env.example
 .secrets/
+.dev-keyring.json
+.dev-workspaces/
+.dev-skills/
+.filelib-repos/
 admin-web/node_modules/
 admin-web/build/
 admin-web/.svelte-kit/
@@ -33,7 +33,7 @@
 <div class="space-y-0.5">
 	{#each childProjects as p (p.id)}
 		<a
-			href={`/admin/org/${slug}/projects/${p.id}`}
+			href={`/admin/projects/${p.id}`}
 			class="flex items-center gap-2.5 px-3 py-2.5 text-sm transition hover:bg-surface-100"
 		>
 			<span class="flex h-7 w-7 items-center justify-center border border-primary-200 bg-primary-50 text-primary-700">
@@ -0,0 +1,40 @@
+import type { MeResponse, OrgMembership } from './api';
+
+/** Alpha Silo host prefix: <slug>.educraft[.dev].… */
+export function hostOrgSlug(hostname: string = typeof window !== 'undefined' ? window.location.hostname : ''): string | null {
+	const host = hostname.toLowerCase();
+	const m = host.match(/^([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.educraft(?:-dev)?\./);
+	return m?.[1] ?? null;
+}
+
+export function isOrgAdmin(org: OrgMembership | null | undefined): boolean {
+	if (!org) return false;
+	const role = String(org.role ?? '').toUpperCase();
+	return role === 'OWNER' || role === 'ADMIN';
+}
+
+/**
+ * Resolve the tenancy for this browser session.
+ * Prefers hostname slug (silo), then ?org=, then first admin membership, then first membership.
+ */
+export function resolveOrg(me: MeResponse | null | undefined, search: string = ''): OrgMembership | null {
+	if (!me || me.organizations.length === 0) return null;
+	const host = hostOrgSlug();
+	if (host) {
+		const byHost = me.organizations.find((o) => o.slug === host);
+		if (byHost) return byHost;
+	}
+	const q = new URLSearchParams(search).get('org')?.trim();
+	if (q) {
+		const byQuery = me.organizations.find((o) => o.slug === q);
+		if (byQuery) return byQuery;
+	}
+	const admin = me.organizations.find((o) => isOrgAdmin(o));
+	return admin ?? me.organizations[0] ?? null;
+}
+
+/** SPA paths no longer embed org slug (subdomain carries tenancy). */
+export function adminPath(rest: string = ''): string {
+	const cleaned = rest.replace(/^\/+/, '');
+	return cleaned === '' ? '/admin' : `/admin/${cleaned}`;
+}
@@ -35,12 +35,9 @@ export async function loadSession(): Promise<void> {
 /**
 * Resolve org slug for org-scoped Feishu OAuth (`GET /auth/feishu/:orgSlug`).
 * Unscoped `/auth/feishu` is disabled unless allowLegacyFeishuOAuth is on.
+ * Path no longer carries tenancy: prefer hostname silo slug, then ?org=.
 */
 export function resolveLoginOrgSlug(): string | null {
-	const path = window.location.pathname.split('/').filter(Boolean);
-	if (path[0] === 'admin' && path[1] === 'org' && path[2]) {
-		return decodeURIComponent(path[2]);
-	}
 	const q = new URLSearchParams(window.location.search).get('org');
 	if (q && q.trim() !== '') return q.trim();

@@ -48,6 +45,12 @@ export function resolveLoginOrgSlug(): string | null {
 	const host = window.location.hostname.toLowerCase();
 	const m = host.match(/^([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.educraft(?:-dev)?\./);
 	if (m?.[1]) return m[1];
+
+	// Legacy path while old bookmarks still land briefly before redirect.
+	const path = window.location.pathname.split('/').filter(Boolean);
+	if (path[0] === 'admin' && path[1] === 'org' && path[2]) {
+		return decodeURIComponent(path[2]);
+	}
 	return null;
 }

@@ -5,6 +5,7 @@
 	import { page } from '$app/state';
 	import { session, loadSession, logout, redirectToLogin } from '$lib/session';
 	import type { OrgMembership } from '$lib/api';
+	import { adminPath, isOrgAdmin, resolveOrg } from '$lib/org';
 	import { orgRoleLabel } from '$lib/format';
 	import Icon from '$lib/components/Icon.svelte';
 	import ToastHost from '$lib/components/ToastHost.svelte';
@@ -32,56 +33,36 @@
 		{ key: 'capabilities', label: '能力', icon: 'provider' as const },
 	];

-	function isAdmin(org: OrgMembership): boolean {
-		const role = String(org.role ?? '').toUpperCase();
-		return role === 'OWNER' || role === 'ADMIN';
-	}
-
-	function orgSlugFromPath(): string | null {
-		const parts = page.url.pathname.split('/').filter(Boolean);
-		if (parts[0] === 'admin' && parts[1] === 'org' && parts[2]) {
-			return decodeURIComponent(parts[2]);
-		}
-		return null;
-	}
-
-	function isOnProjectRoute(): boolean {
-		const parts = page.url.pathname.split('/').filter(Boolean);
-		return parts[0] === 'admin' && parts[1] === 'org' && parts[3] === 'projects';
-	}
-
 	function memberships(): OrgMembership[] {
 		return $session.me?.organizations ?? [];
 	}

 	function adminOrgs(): OrgMembership[] {
-		return memberships().filter(isAdmin);
+		return memberships().filter((o) => isOrgAdmin(o));
 	}

 	function currentOrg(): OrgMembership | null {
-		const slug = orgSlugFromPath();
-		if (!slug) return null;
-		return memberships().find((o) => o.slug === slug) ?? null;
+		return resolveOrg($session.me, page.url.search);
 	}

-	function pickHomeOrg(): OrgMembership | null {
-		const admin = adminOrgs()[0];
-		if (admin) return admin;
-		return memberships()[0] ?? null;
+	function isOnProjectRoute(): boolean {
+		const parts = page.url.pathname.split('/').filter(Boolean);
+		// /admin/projects or /admin/projects/:id
+		return parts[0] === 'admin' && parts[1] === 'projects';
 	}

 	function activeKey(): string {
 		const parts = page.url.pathname.split('/').filter(Boolean);
-		if (parts[0] !== 'admin' || parts[1] !== 'org' || !parts[2]) return '';
-		return parts[3] ?? 'overview';
+		if (parts[0] !== 'admin') return '';
+		// /admin → overview; /admin/usage → usage; /admin/projects/x → projects
+		return parts[1] ?? 'overview';
 	}

 	function navHref(key: string): string {
-		const slug = currentOrg()?.slug ?? pickHomeOrg()?.slug;
-		if (!slug) return '/';
-		if (key === 'overview') return `/admin/org/${slug}`;
-		return `/admin/org/${slug}/${key}`;
+		if (key === 'overview') return adminPath();
+		return adminPath(key);
 	}
+
 	function pageTitle(): string {
 		const key = activeKey();
 		if (key === 'overview' || key === '') return '概览';
@@ -91,7 +72,10 @@

 	function switchOrg(nextSlug: string) {
 		if (!nextSlug || nextSlug === currentOrg()?.slug) return;
-		void goto(`/admin/org/${nextSlug}`);
+		// Path is tenancy-free; keep optional ?org= for local multi-membership debugging.
+		const url = new URL(page.url.href);
+		url.searchParams.set('org', nextSlug);
+		void goto(`${url.pathname}${url.search}`, { replaceState: true });
 	}

 	function handleLogout(e: Event) {
@@ -114,33 +98,23 @@
 	$effect(() => {
 		if ($session.loading || !$session.me) return;

-		const slug = orgSlugFromPath();
-		const matched = slug ? memberships().find((o) => o.slug === slug) : null;
+		const path = page.url.pathname;
+		// Legacy /admin/org/:slug… is handled by admin/org/[...path] page.

-		// Org admins: route to their first admin org if none matched as admin.
+		const org = currentOrg();
 		const admins = adminOrgs();
-		if (matched && isAdmin(matched)) {
+
+		if (org && isOrgAdmin(org)) {
 			redirecting = false;
 			return;
 		}
-		if (!matched && admins.length > 0) {
-			const target = `/admin/org/${admins[0].slug}`;
-			if (page.url.pathname !== target && !page.url.pathname.startsWith(`${target}/`)) {
-				redirecting = true;
-				void goto(target, { replaceState: true });
-			}
-			return;
-		}

-		// Members (non-admin): project pages are open to project MANAGE holders;
-		// the org overview and other admin-only surfaces are not for them.
-		if (matched && !isAdmin(matched)) {
+		// Member only: allow project routes; bounce admin-only surfaces to projects.
+		if (org && !isOrgAdmin(org)) {
 			redirecting = false;
-			const parts = page.url.pathname.split('/').filter(Boolean);
-			const onOverview = parts.length === 3; // /admin/org/:slug
-			if (onOverview) {
-				const target = `/admin/org/${matched.slug}/projects`;
-				if (page.url.pathname !== target) {
+			if (!isOnProjectRoute()) {
+				const target = adminPath('projects');
+				if (path !== target) {
 					redirecting = true;
 					void goto(target, { replaceState: true });
 				}
@@ -148,12 +122,11 @@
 			return;
 		}

-		// No matched org and no admin orgs: route a member to their first org's
-		// projects page so they can reach project MANAGE surfaces.
-		if (!matched && memberships().length > 0) {
-			const home = memberships()[0];
-			const target = `/admin/org/${home.slug}/projects`;
-			if (page.url.pathname !== target && !page.url.pathname.startsWith(`${target}/`)) {
+		// No org resolved but user has memberships → land on first org's projects/overview via resolveOrg next tick
+		if (!org && memberships().length > 0) {
+			const home = admins[0] ?? memberships()[0]!;
+			const target = isOrgAdmin(home) ? adminPath() : adminPath('projects');
+			if (path !== target && !path.startsWith(`${target}/`)) {
 				redirecting = true;
 				void goto(target, { replaceState: true });
 			}
@@ -174,14 +147,14 @@
 					d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
 				></path>
 			</svg>
-			<p class="text-sm">{redirecting ? '正在进入组织…' : '正在加载会话…'}</p>
+			<p class="text-sm">加载中…</p>
 		</div>
 	</div>
 {:else if $session.error}
 	<div class="saas-status-panel">
 		<div class="saas-status-card">
 			<div
-				class="mx-auto mb-4 flex h-12 w-12 items-center justify-center border border-error-300 bg-error-100 text-error-700 font-bold"
+				class="mx-auto mb-3 flex h-12 w-12 items-center justify-center border border-error-200 bg-error-50 text-error-700"
 			>
 				!
 			</div>
@@ -194,7 +167,7 @@
 	<div class="saas-status-panel">
 		<div class="saas-status-card">
 			<div
-				class="mx-auto mb-5 flex h-12 w-12 items-center justify-center border border-primary-700 bg-primary-600 text-white font-bold"
+				class="mx-auto mb-4 flex h-12 w-12 items-center justify-center border border-primary-700 bg-primary-600 text-sm font-bold text-white"
 			>
 				CPH
 			</div>
@@ -203,7 +176,7 @@
 			<button class="saas-btn-primary w-full" onclick={() => redirectToLogin()}>使用飞书登录</button>
 		</div>
 	</div>
-{:else if currentOrg() && isAdmin(currentOrg()!)}
+{:else if currentOrg() && isOrgAdmin(currentOrg()!)}
 	{@const org = currentOrg()!}
 	{@const me = $session.me!}
 	<div class="saas-shell">
@@ -228,17 +201,19 @@
 				</div>
 				<div class="min-w-0">
 					<div class="truncate text-sm font-semibold text-surface-900">组织后台</div>
-					<div class="truncate text-xs text-surface-600">Curriculum Hub</div>
+					<div class="truncate text-xs text-surface-600">{org.name}</div>
 				</div>
 			</div>

-			<div class="px-3 pb-3">
-				<div class="mb-1.5 flex items-center gap-1.5 text-xs font-medium text-surface-700">
-					<Icon name="org" class="h-3.5 w-3.5" />
-					组织
+			{#if me.organizations.length > 1}
+				<div class="px-3 pb-3">
+					<div class="mb-1.5 flex items-center gap-1.5 text-xs font-medium text-surface-700">
+						<Icon name="org" class="h-3.5 w-3.5" />
+						组织
+					</div>
+					<SelectField items={orgSelectItems(me.organizations)} value={org.slug} onchange={switchOrg} />
 				</div>
-				<SelectField items={orgSelectItems(me.organizations)} value={org.slug} onchange={switchOrg} />
-			</div>
+			{/if}

 			<nav class="flex-1 space-y-0.5 overflow-y-auto px-2 pb-3">
 				<p class="px-3 pb-1 pt-2 text-[11px] font-semibold uppercase tracking-wider text-surface-600">工作台</p>
@@ -308,13 +283,13 @@
 			</main>
 		</div>
 	</div>
-{:else if currentOrg() && !isAdmin(currentOrg()!) && isOnProjectRoute()}
+{:else if currentOrg() && !isOrgAdmin(currentOrg()!) && isOnProjectRoute()}
 	{@const org = currentOrg()!}
 	{@const me = $session.me!}
 	<div class="saas-shell">
 		<div class="saas-main">
 			<header class="saas-topbar">
-				<a href={`/admin/org/${org.slug}/projects`} class="saas-btn-ghost px-2!" aria-label="返回项目列表">
+				<a href={adminPath('projects')} class="saas-btn-ghost px-2!" aria-label="返回项目列表">
 					<Icon name="menu" class="h-5 w-5" />
 				</a>
 				<div class="min-w-0">
@@ -343,7 +318,7 @@
 			</main>
 		</div>
 	</div>
-{:else if currentOrg() && !isAdmin(currentOrg()!)}
+{:else if currentOrg() && !isOrgAdmin(currentOrg()!)}
 	{@const denied = currentOrg()!}
 	<div class="saas-status-panel">
 		<div class="saas-status-card">
@@ -352,7 +327,7 @@
 				组织 <strong>{denied.name}</strong>（/{denied.slug}）中你的角色是
 				<span class="saas-badge-neutral mx-1">{orgRoleLabel(denied.role)}</span>。普通成员仅可访问自己有授权的项目。
 			</p>
-			<a class="saas-btn-primary" href={`/admin/org/${denied.slug}/projects`}>查看我的项目</a>
+			<a class="saas-btn-primary" href={adminPath('projects')}>查看我的项目</a>
 			{#if memberships().length > 1}
 				<p class="saas-label text-left mb-1.5 mt-3">切换到其他组织</p>
 				<div class="mb-4">
@@ -363,14 +338,14 @@
 		</div>
 	</div>
 {:else if memberships().length > 0}
-	{@const denied = pickHomeOrg()!}
+	{@const denied = resolveOrg($session.me) ?? memberships()[0]!}
 	<div class="saas-status-panel">
 		<div class="saas-status-card">
 			<h2 class="mb-2 text-lg font-semibold">正在跳转…</h2>
 			<p class="mb-5 text-sm text-surface-700">
 				即将进入 <strong>{denied.name}</strong>（/{denied.slug}）的项目。
 			</p>
-			<a class="saas-btn-primary" href={`/admin/org/${denied.slug}/projects`}>立即进入</a>
+			<a class="saas-btn-primary" href={adminPath('projects')}>立即进入</a>
 			<button class="saas-btn-ghost mt-3" onclick={handleLogout}>退出登录</button>
 		</div>
 	</div>
@@ -11,7 +11,7 @@
 			return r === 'OWNER' || r === 'ADMIN';
 		});
 		const target = admin ?? me.organizations[0];
-		return target ? `/admin/org/${target.slug}` : null;
+		return target ? `/admin` : null;
 	}

 	onMount(() => {
@@ -2,6 +2,7 @@
 	import { page } from '$app/state';
 	import { api, type OrgMembership } from '$lib/api';
 	import { session } from '$lib/session';
+	import { resolveOrg } from '$lib/org';
 	import { fmtCost, fmtNum, orgRoleLabel } from '$lib/format';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import StatCard from '$lib/components/StatCard.svelte';
@@ -10,7 +11,8 @@
 	import SwitchControl from '$lib/components/SwitchControl.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	let orgSlug = $derived(page.params.slug ?? '');
+	const orgFromSession = $derived(resolveOrg($session.me, page.url.search));
+	let orgSlug = $derived(orgFromSession?.slug ?? '');
 	let org = $derived($session.me?.organizations.find((o) => o.slug === orgSlug) as OrgMembership | undefined);

 	let settings = $state<{ membersCanCreateProjects: boolean } | null>(null);
@@ -96,7 +98,7 @@
 			<h2 class="saas-section-title">用量概览</h2>
 			<p class="saas-muted">totals 含全部 UsageFact；分账明细见用量页。</p>
 		</div>
-		<a class="saas-btn-secondary py-1.5! text-sm" href={`/admin/org/${orgSlug}/usage`}>完整用量报告</a>
+		<a class="saas-btn-secondary py-1.5! text-sm" href={`/admin/usage`}>完整用量报告</a>
 	</div>

 	<div class="mb-6 grid gap-3 sm:grid-cols-2 lg:grid-cols-3">
@@ -115,7 +117,7 @@
 					<h3 class="text-sm font-semibold text-surface-800">消费来源（Top）</h3>
 					<p class="saas-muted text-xs">模型完成 vs 外部能力，按成本降序前 5</p>
 				</div>
-				<a class="text-sm text-primary-700 hover:underline" href={`/admin/org/${orgSlug}/usage`}>查看全部分账</a>
+				<a class="text-sm text-primary-700 hover:underline" href={`/admin/usage`}>查看全部分账</a>
 			</div>
 			<div class="overflow-x-auto">
 				<table class="data-table">
@@ -167,7 +169,7 @@
 						{#each usage.projects as p}
 							<tr>
 								<td class="font-medium">
-									<a class="hover:text-primary-700 hover:underline" href={`/admin/org/${orgSlug}/projects/${p.projectId}`}>
+									<a class="hover:text-primary-700 hover:underline" href={`/admin/projects/${p.projectId}`}>
 										{p.projectName}
 									</a>
 								</td>
@@ -1,6 +1,8 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type CapabilityConnection } from '$lib/api';
+	import { session } from '$lib/session';
+	import { resolveOrg } from '$lib/org';
 	import { fmtDate } from '$lib/format';
 	import { Label } from 'bits-ui';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -8,7 +10,8 @@
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const slug = $derived(page.params.slug ?? '');
+	const org = $derived(resolveOrg($session.me, page.url.search));
+	const slug = $derived(org?.slug ?? '');

 	const KNOWN_CAPABILITIES = [
 		{ id: 'pdf_to_md_bundle', label: 'PDF → Markdown', description: '将 PDF 转换为带图片的 Markdown bundle（阿里云文档智能，含公式 LaTeX 识别）' },
@@ -1,13 +1,16 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type CapacityDimension, type CapacityDimensionRow, type CapacityPolicyView } from '$lib/api';
+	import { session } from '$lib/session';
+	import { resolveOrg } from '$lib/org';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import LoadingState from '$lib/components/LoadingState.svelte';
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import EmptyState from '$lib/components/EmptyState.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const slug = $derived(page.params.slug ?? '');
+	const org = $derived(resolveOrg($session.me, page.url.search));
+	const slug = $derived(org?.slug ?? '');

 	// Friendlier, user-facing labels. No spec jargon (墙钟 → 运行时长, etc.).
 	const DIMENSION_LABELS: Record<CapacityDimension, string> = {
@@ -1,6 +1,8 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type FeishuApplicationConnection } from '$lib/api';
+	import { session } from '$lib/session';
+	import { resolveOrg } from '$lib/org';
 	import { fmtDate } from '$lib/format';
 	import { Label } from 'bits-ui';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -8,7 +10,8 @@
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const slug = $derived(page.params.slug ?? '');
+	const org = $derived(resolveOrg($session.me, page.url.search));
+	const slug = $derived(org?.slug ?? '');

 	let connection = $state<FeishuApplicationConnection | null>(null);
 	let loading = $state(true);
@@ -1,6 +1,8 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type OrgMember } from '$lib/api';
+	import { session } from '$lib/session';
+	import { resolveOrg } from '$lib/org';
 	import { fmtDate } from '$lib/format';
 	import { ORG_ROLES, ORG_ROLE_LABELS, PERMISSION_ROLE_LABELS } from '$lib/constants';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -10,7 +12,8 @@
 	import SelectField from '$lib/components/SelectField.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const slug = $derived(page.params.slug ?? '');
+	const org = $derived(resolveOrg($session.me, page.url.search));
+	const slug = $derived(org?.slug ?? '');
 	const roleItems = ORG_ROLES.map((r) => ({ value: r, label: ORG_ROLE_LABELS[r] }));
 	const permHint = Object.values(PERMISSION_ROLE_LABELS).join(' / ');

@@ -0,0 +1,23 @@
+<script lang="ts">
+	/**
+	 * Legacy bookmarks: /admin/org/:slug[/...] → /admin[/...]
+	 * Tenancy lives on the silo host, not the path.
+	 */
+	import { onMount } from 'svelte';
+	import { goto } from '$app/navigation';
+	import { page } from '$app/state';
+
+	onMount(() => {
+		const raw = page.params.path ?? '';
+		const segments = raw.split('/').filter(Boolean);
+		// Drop the old org slug (first segment) when present.
+		const rest = segments.length > 0 ? segments.slice(1).join('/') : '';
+		const target = rest === '' ? '/admin' : `/admin/${rest}`;
+		const q = page.url.search;
+		void goto(`${target}${q}`, { replaceState: true });
+	});
+</script>
+
+<div class="saas-status-panel">
+	<p class="text-sm text-surface-600">正在重定向到新地址…</p>
+</div>
@@ -2,6 +2,7 @@
 	import { page } from '$app/state';
 	import { api, type ExplorerData, type ExplorerFolder, type ExplorerProject, type OrgMembership } from '$lib/api';
 	import { session } from '$lib/session';
+	import { resolveOrg } from '$lib/org';
 	import FolderTree from '$lib/components/FolderTree.svelte';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import LoadingState from '$lib/components/LoadingState.svelte';
@@ -13,8 +14,8 @@
 	import { fmtDate } from '$lib/format';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const slug = $derived(page.params.slug ?? '');
-	const org = $derived(($session.me?.organizations.find((o) => o.slug === slug) as OrgMembership | undefined) ?? null);
+	const org = $derived(resolveOrg($session.me, page.url.search));
+	const slug = $derived(org?.slug ?? '');
 	const isAdmin = $derived(!!org && (org.role === 'OWNER' || org.role === 'ADMIN'));

 	let data = $state<ExplorerData | null>(null);
@@ -87,7 +88,7 @@
 			projectName = '';
 			projectFolder = '';
 			showProjectModal = false;
-			window.location.href = `/admin/org/${slug}/projects/${res.id}`;
+			window.location.href = `/admin/projects/${res.id}`;
 		} catch (err) {
 			toastError(err instanceof Error ? err.message : String(err));
 		}
@@ -207,7 +208,7 @@
 				</thead>
 				<tbody>
 					{#each myProjects as p}
-						<tr class="cursor-pointer" onclick={() => (window.location.href = `/admin/org/${slug}/projects/${p.id}`)}>
+						<tr class="cursor-pointer" onclick={() => (window.location.href = `/admin/projects/${p.id}`)}>
 							<td class="font-medium">{p.name}</td>
 							<td class="font-mono text-xs">{p.binding ? `群 ${p.binding.chatId}` : '—'}</td>
 							<td class="text-surface-700">{fmtDate(p.createdAt)}</td>
@@ -9,6 +9,8 @@
 		type ExplorerData,
 		type ProjectUsageReport,
 	} from '$lib/api';
+	import { session } from '$lib/session';
+	import { resolveOrg } from '$lib/org';
 	import {
 		fmtCost,
 		fmtDate,
@@ -27,7 +29,8 @@
 	import Icon from '$lib/components/Icon.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const slug = $derived(page.params.slug ?? '');
+	const org = $derived(resolveOrg($session.me, page.url.search));
+	const slug = $derived(org?.slug ?? '');
 	const projectId = $derived(page.params.projectId ?? '');
 	const roleItems = PERMISSION_ROLES.map((r) => ({ value: r, label: PERMISSION_ROLE_LABELS[r] }));
 	const roleChain = `${PERMISSION_ROLE_LABELS.READ} ⊂ ${PERMISSION_ROLE_LABELS.EDIT} ⊂ ${PERMISSION_ROLE_LABELS.MANAGE}`;
@@ -109,7 +112,7 @@
 		if (!confirm(`归档项目 ${proj?.name}?`)) return;
 		try {
 			await api.archiveProject(slug, projectId);
-			window.location.href = `/admin/org/${slug}/projects`;
+			window.location.href = `/admin/projects`;
 		} catch (err) {
 			toastError(err instanceof Error ? err.message : String(err));
 		}
@@ -170,7 +173,7 @@
 {:else if proj}
 	<div class="mb-2">
 		<a
-			href={`/admin/org/${slug}/projects`}
+			href={`/admin/projects`}
 			class="inline-flex items-center gap-1 text-sm text-surface-700 hover:text-primary-600"
 		>
 			<Icon name="arrow-left" class="h-4 w-4" />
@@ -293,7 +296,7 @@
 							{fmtTokens(projectUsage.inputTokens, projectUsage.outputTokens)}
 						</p>
 					</div>
-					<a class="text-sm text-primary-700 hover:underline" href={`/admin/org/${slug}/usage`}>组织报告</a>
+					<a class="text-sm text-primary-700 hover:underline" href={`/admin/usage`}>组织报告</a>
 				</div>
 				{#if projectUsage.breakdown.length === 0}
 					<div class="px-5 py-4 text-sm text-surface-600">尚无 UsageFact。</div>
@@ -368,7 +371,7 @@
 								<td class="text-right">
 									<a
 										class="text-sm text-primary-700 hover:underline"
-										href={`/admin/org/${slug}/sessions/${s.id}`}
+										href={`/admin/sessions/${s.id}`}
 									>
 										详情
 									</a>
@@ -1,6 +1,8 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type ProviderConnectionRow } from '$lib/api';
+	import { session } from '$lib/session';
+	import { resolveOrg } from '$lib/org';
 	import { fmtDate, providerModeLabel } from '$lib/format';
 	import { Label } from 'bits-ui';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -8,7 +10,8 @@
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const slug = $derived(page.params.slug ?? '');
+	const org = $derived(resolveOrg($session.me, page.url.search));
+	const slug = $derived(org?.slug ?? '');

 	let connections = $state<ProviderConnectionRow[]>([]);
 	let loading = $state(true);
@@ -1,6 +1,8 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type AgentRoleRow, type AgentModelRow, type AgentSkillRow } from '$lib/api';
+	import { session } from '$lib/session';
+	import { resolveOrg } from '$lib/org';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import LoadingState from '$lib/components/LoadingState.svelte';
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
@@ -8,7 +10,8 @@
 	import RoleCard from '$lib/components/RoleCard.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const slug = $derived(page.params.slug ?? '');
+	const org = $derived(resolveOrg($session.me, page.url.search));
+	const slug = $derived(org?.slug ?? '');

 	let roles = $state<AgentRoleRow[]>([]);
 	let models = $state<AgentModelRow[]>([]);
@@ -1,6 +1,8 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type SessionDetail, type SessionRunRow, type UsageFactRow } from '$lib/api';
+	import { session } from '$lib/session';
+	import { resolveOrg } from '$lib/org';
 	import {
 		fmtCost,
 		fmtDate,
@@ -16,7 +18,8 @@
 	import EmptyState from '$lib/components/EmptyState.svelte';
 	import Icon from '$lib/components/Icon.svelte';

-	const slug = $derived(page.params.slug ?? '');
+	const org = $derived(resolveOrg($session.me, page.url.search));
+	const slug = $derived(org?.slug ?? '');
 	const sessionId = $derived(page.params.sessionId ?? '');

 	let detail = $state<SessionDetail | null>(null);
@@ -92,7 +95,7 @@
 	<div class="mb-2">
 		<a
 			class="inline-flex items-center gap-1 text-sm text-surface-700 hover:text-primary-700"
-			href={`/admin/org/${slug}/projects/${detail.project.id}`}
+			href={`/admin/projects/${detail.project.id}`}
 		>
 			<Icon name="arrow-left" class="h-4 w-4" />
 			返回项目 {detail.project.name}
@@ -113,7 +116,7 @@
 			<div>
 				<dt class="text-surface-600">项目</dt>
 				<dd class="mt-0.5">
-					<a class="text-primary-700 hover:underline" href={`/admin/org/${slug}/projects/${detail.project.id}`}>
+					<a class="text-primary-700 hover:underline" href={`/admin/projects/${detail.project.id}`}>
 						{detail.project.name}
 					</a>
 				</dd>
@@ -1,6 +1,8 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type AgentSkillRow, type SkillFileEntry } from '$lib/api';
+	import { session } from '$lib/session';
+	import { resolveOrg } from '$lib/org';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import LoadingState from '$lib/components/LoadingState.svelte';
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
@@ -8,7 +10,8 @@
 	import SkillEditor from '$lib/components/SkillEditor.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const slug = $derived(page.params.slug ?? '');
+	const org = $derived(resolveOrg($session.me, page.url.search));
+	const slug = $derived(org?.slug ?? '');

 	let skills = $state<AgentSkillRow[]>([]);
 	let loading = $state(true);
@@ -2,6 +2,8 @@
 	import { Collapsible } from 'bits-ui';
 	import { page } from '$app/state';
 	import { api, type TeamRow, type TeamMemberRow } from '$lib/api';
+	import { session } from '$lib/session';
+	import { resolveOrg } from '$lib/org';
 	import { fmtDate } from '$lib/format';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import LoadingState from '$lib/components/LoadingState.svelte';
@@ -9,7 +11,8 @@
 	import EmptyState from '$lib/components/EmptyState.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const slug = $derived(page.params.slug ?? '');
+	const org = $derived(resolveOrg($session.me, page.url.search));
+	const slug = $derived(org?.slug ?? '');

 	let teams = $state<TeamRow[]>([]);
 	let loading = $state(true);
@@ -1,6 +1,8 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type UsageReport, type UsageBreakdownRow } from '$lib/api';
+	import { session } from '$lib/session';
+	import { resolveOrg } from '$lib/org';
 	import {
 		fmtCost,
 		fmtDateOnly,
@@ -15,7 +17,8 @@
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import EmptyState from '$lib/components/EmptyState.svelte';

-	const slug = $derived(page.params.slug ?? '');
+	const org = $derived(resolveOrg($session.me, page.url.search));
+	const slug = $derived(org?.slug ?? '');

 	let usage = $state<UsageReport | null>(null);
 	let loading = $state(true);
@@ -224,7 +227,7 @@
 								<td class="tabular-nums text-surface-600">{fmtTokens(p.inputTokens, p.outputTokens)}</td>
 								<td class="tabular-nums">{fmtCost(p.costUsd)}</td>
 								<td class="text-right">
-									<a class="text-sm text-primary-700 hover:underline" href={`/admin/org/${slug}/projects/${p.projectId}`}>
+									<a class="text-sm text-primary-700 hover:underline" href={`/admin/projects/${p.projectId}`}>
 										查看项目
 									</a>
 								</td>
@@ -0,0 +1,23 @@
+node_modules
+
+# Output
+.output
+.vercel
+.netlify
+.wrangler
+/.svelte-kit
+/build
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Env
+.env
+.env.*
+!.env.example
+!.env.test
+
+# Vite
+vite.config.js.timestamp-*
+vite.config.ts.timestamp-*
@@ -0,0 +1 @@
+engine-strict=true
@@ -0,0 +1,4 @@
+build
+.svelte-kit
+node_modules
+package-lock.json
@@ -0,0 +1,9 @@
+{
+	"useTabs": true,
+	"singleQuote": true,
+	"semi": true,
+	"trailingComma": "all",
+	"printWidth": 120,
+	"plugins": ["prettier-plugin-svelte"],
+	"overrides": [{ "files": "*.svelte", "options": { "parser": "svelte" } }]
+}
@@ -0,0 +1,33 @@
+{
+	"name": "database-admin",
+	"private": true,
+	"version": "0.0.1",
+	"type": "module",
+	"scripts": {
+		"dev": "vite dev",
+		"build": "vite build",
+		"preview": "vite preview",
+		"prepare": "svelte-kit sync || echo ''",
+		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
+		"format": "prettier --write .",
+		"format:check": "prettier --check ."
+	},
+	"devDependencies": {
+		"@skeletonlabs/skeleton": "^4.15.2",
+		"@skeletonlabs/skeleton-svelte": "^4.15.2",
+		"@sveltejs/adapter-auto": "^7.0.1",
+		"@sveltejs/adapter-static": "^3.0.10",
+		"@sveltejs/kit": "^2.63.0",
+		"@sveltejs/vite-plugin-svelte": "^7.1.2",
+		"@tailwindcss/vite": "^4.3.2",
+		"bits-ui": "^2.18.1",
+		"prettier": "^3.9.5",
+		"prettier-plugin-svelte": "^4.1.1",
+		"svelte": "^5.56.1",
+		"svelte-check": "^4.6.0",
+		"tailwindcss": "^4.3.2",
+		"typescript": "^6.0.3",
+		"vite": "^8.0.16"
+	}
+}
@@ -0,0 +1,13 @@
+// See https://svelte.dev/docs/kit/types#app.d.ts
+// for information about these interfaces
+declare global {
+	namespace App {
+		// interface Error {}
+		// interface Locals {}
+		// interface PageData {}
+		// interface PageState {}
+		// interface Platform {}
+	}
+}
+
+export {};
@@ -0,0 +1,29 @@
+<!doctype html>
+<html lang="zh-CN">
+	<head>
+		<meta charset="utf-8" />
+		<meta name="viewport" content="width=device-width, initial-scale=1" />
+		<meta name="description" content="Curriculum Project Hub — 数据库管理后台" />
+		<link rel="icon" href="%sveltekit.assets%/favicon.svg" type="image/svg+xml" />
+		<link rel="preconnect" href="https://fonts.googleapis.com" />
+		<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+		<link
+			href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap"
+			rel="stylesheet"
+		/>
+		<style>
+			/* Fallback before CSS bundle */
+			html {
+				font-family: 'Inter', system-ui, 'Noto Sans SC', 'PingFang SC', sans-serif;
+			}
+		</style>
+		<title>Database Admin</title>
+		%sveltekit.head%
+	</head>
+	<body
+		data-sveltekit-preload-data="hover"
+		class="relative min-h-screen overflow-x-hidden bg-gradient-to-br from-slate-50 via-white to-indigo-50 text-slate-700"
+	>
+		<div style="display: contents">%sveltekit.body%</div>
+	</body>
+</html>
@@ -0,0 +1,76 @@
+/**
+ * Thin API client for the database-admin backend. Same-origin cookie auth,
+ * reusing the platform session (`cph_session`) and the admin plane's /api/me.
+ */
+
+export class ApiError extends Error {
+	code: string;
+	status: number;
+	constructor(code: string, message: string, status: number) {
+		super(message);
+		this.name = 'ApiError';
+		this.code = code;
+		this.status = status;
+	}
+}
+
+async function request(method: string, url: string, body?: unknown): Promise<unknown> {
+	const init: RequestInit = {
+		method,
+		credentials: 'same-origin',
+		headers: body !== undefined ? { 'content-type': 'application/json' } : undefined,
+		body: body !== undefined ? JSON.stringify(body) : undefined,
+	};
+	const res = await fetch(url, init);
+	const text = await res.text();
+	let data: unknown = null;
+	if (text !== '') {
+		try {
+			data = JSON.parse(text);
+		} catch {
+			data = text;
+		}
+	}
+	if (!res.ok) {
+		const err = (data as { error?: { code?: string; message?: string } } | null)?.error;
+		throw new ApiError(err?.code ?? 'http_error', err?.message ?? `HTTP ${res.status}`, res.status);
+	}
+	return data;
+}
+
+const get = (u: string) => request('GET', u);
+const post = (u: string, b?: unknown) => request('POST', u, b);
+
+// --- Types ---
+
+export interface OrgMembership {
+	id: string;
+	slug: string;
+	name: string;
+	status: string;
+	role: 'OWNER' | 'ADMIN' | 'MEMBER';
+}
+
+export interface MeResponse {
+	user: {
+		id: string;
+		feishuOpenId: string;
+		displayName: string;
+		avatarUrl: string | null;
+	};
+	organizations: OrgMembership[];
+}
+
+/** Unauthenticated bootstrap the login page needs: which org to OAuth against + dev toggle. */
+export interface DatabaseConfig {
+	siloOrganizationSlug: string;
+	devLoginEnabled: boolean;
+}
+
+// --- API ---
+
+export const api = {
+	me: () => get('/api/me') as Promise<MeResponse>,
+	logout: () => post('/auth/logout'),
+	databaseConfig: () => get('/database/config') as Promise<DatabaseConfig>,
+};
@@ -0,0 +1,6 @@
+<!-- Animated aurora background blobs, shared by both pages (soft pastels on light). -->
+<div class="pointer-events-none fixed inset-0 overflow-hidden">
+	<div class="aurora absolute -left-32 -top-32 h-96 w-96 rounded-full bg-violet-300/50"></div>
+	<div class="aurora absolute right-0 top-1/4 h-96 w-96 rounded-full bg-cyan-300/40" style="animation-delay:-6s"></div>
+	<div class="aurora absolute bottom-0 left-1/3 h-96 w-96 rounded-full bg-indigo-300/40" style="animation-delay:-12s"></div>
+</div>
@@ -0,0 +1,7 @@
+import type { OrgMembership } from './api';
+
+export function isOrgAdmin(org: OrgMembership | null | undefined): boolean {
+	if (!org) return false;
+	const role = String(org.role ?? '').toUpperCase();
+	return role === 'OWNER' || role === 'ADMIN';
+}
@@ -0,0 +1,58 @@
+import { writable } from 'svelte/store';
+import { goto } from '$app/navigation';
+import { base } from '$app/paths';
+import { api, type MeResponse } from './api';
+
+interface SessionState {
+	loading: boolean;
+	me: MeResponse | null;
+	error: string | null;
+}
+
+export const session = writable<SessionState>({
+	loading: true,
+	me: null,
+	error: null,
+});
+
+export async function loadSession(): Promise<void> {
+	session.update((s) => ({ ...s, loading: true, error: null }));
+	try {
+		const me = await api.me();
+		session.set({ loading: false, me, error: null });
+	} catch (err) {
+		const status = (err as { status?: number }).status;
+		if (status === 401) {
+			session.set({ loading: false, me: null, error: null });
+			void redirectToLogin();
+			return;
+		}
+		session.set({
+			loading: false,
+			me: null,
+			error: err instanceof Error ? err.message : String(err),
+		});
+	}
+}
+
+/**
+ * Send the browser to the login page (`/database/admin`). Unlike admin-web we
+ * don't jump straight to Feishu OAuth: the login page reads /database/config
+ * to build the org-scoped link and to show the dev bypass when enabled.
+ */
+export async function redirectToLogin(): Promise<void> {
+	const loginPath = `${base}/admin`;
+	if (window.location.pathname === loginPath) return;
+	await goto(loginPath, { replaceState: true });
+}
+
+/** Build the org-scoped Feishu OAuth entry point (a backend route, not under base). */
+export function feishuLoginHref(orgSlug: string, returnTo: string = `${base}/dashboard`): string {
+	return `/auth/feishu/${encodeURIComponent(orgSlug)}?returnTo=${encodeURIComponent(returnTo)}`;
+}
+
+export async function logout(): Promise<void> {
+	await api.logout();
+	session.set({ loading: false, me: null, error: null });
+	await redirectToLogin();
+}
@@ -0,0 +1,7 @@
+<script lang="ts">
+	import './app.css';
+
+	let { children } = $props();
+</script>
+
+{@render children()}
@@ -0,0 +1,30 @@
+<script lang="ts">
+	import { onMount } from 'svelte';
+	import { goto } from '$app/navigation';
+	import { base } from '$app/paths';
+	import { api } from '$lib/api';
+
+	onMount(async () => {
+		// /database entry — route to dashboard if signed in, else the login page.
+		try {
+			await api.me();
+			await goto(`${base}/dashboard`, { replaceState: true });
+		} catch {
+			await goto(`${base}/admin`, { replaceState: true });
+		}
+	});
+</script>
+
+<div class="flex min-h-screen items-center justify-center">
+	<div class="flex flex-col items-center gap-3 text-slate-400">
+		<svg class="h-7 w-7 animate-spin text-violet-500" viewBox="0 0 24 24" fill="none">
+			<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+			<path
+				class="opacity-90"
+				fill="currentColor"
+				d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+			></path>
+		</svg>
+		<p class="text-sm">正在进入…</p>
+	</div>
+</div>
@@ -0,0 +1,78 @@
+<script lang="ts">
+	import { onMount } from 'svelte';
+	import { goto } from '$app/navigation';
+	import { base } from '$app/paths';
+	import { api, type DatabaseConfig } from '$lib/api';
+	import { feishuLoginHref } from '$lib/session';
+	import Aurora from '$lib/components/Aurora.svelte';
+
+	let config = $state<DatabaseConfig | null>(null);
+	let error = $state<string | null>(null);
+
+	onMount(async () => {
+		// Already signed in → straight to the dashboard.
+		try {
+			await api.me();
+			await goto(`${base}/dashboard`, { replaceState: true });
+			return;
+		} catch {
+			// Not signed in (401) or backend unreachable — show the login card.
+		}
+		try {
+			config = await api.databaseConfig();
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		}
+	});
+
+	const feishuHref = $derived(config ? feishuLoginHref(config.siloOrganizationSlug) : '#');
+</script>
+
+<Aurora />
+
+<main class="flex min-h-screen items-center justify-center p-4">
+	<div class="rise glass relative w-full max-w-sm rounded-3xl border border-white/80 p-8 shadow-2xl shadow-indigo-200/50">
+		<div class="mb-7 text-center">
+			<div
+				class="mx-auto mb-5 flex h-14 w-14 items-center justify-center rounded-2xl bg-gradient-to-br from-violet-500 to-cyan-400 text-2xl font-bold text-white glow-btn"
+			>
+				D
+			</div>
+			<h1 class="text-2xl font-bold tracking-tight grad-text">Database Admin</h1>
+			<p class="mt-2 text-sm text-slate-500">使用飞书登录以管理数据库</p>
+		</div>
+
+		{#if error}
+			<div class="mb-4 rounded-xl border border-red-200 bg-red-50 px-4 py-3 text-sm text-red-600">
+				无法连接后端：{error}
+			</div>
+		{/if}
+
+		<a
+			href={feishuHref}
+			aria-disabled={config ? 'false' : 'true'}
+			class="rise-2 glow-btn group flex w-full items-center justify-center gap-2 rounded-xl bg-gradient-to-r from-violet-500 to-indigo-500 px-4 py-3.5 text-sm font-semibold text-white transition hover:from-violet-400 hover:to-indigo-400 aria-disabled:pointer-events-none aria-disabled:opacity-50"
+		>
+			<svg class="h-4 w-4" viewBox="0 0 24 24" fill="currentColor">
+				<path d="M12 2 3 7v10l9 5 9-5V7l-9-5Zm0 2.3 6.5 3.6L12 11.5 5.5 7.9 12 4.3Z" />
+			</svg>
+			使用飞书登录
+		</a>
+
+		{#if config?.devLoginEnabled}
+			<div class="relative my-6 rise-3">
+				<div class="absolute inset-0 flex items-center"><div class="w-full border-t border-slate-200"></div></div>
+				<div class="relative flex justify-center">
+					<span class="bg-white/70 px-3 text-[11px] font-medium uppercase tracking-[0.2em] text-slate-400">开发模式</span>
+				</div>
+			</div>
+			<a
+				href="/database/dev-login"
+				class="rise-3 group flex w-full items-center justify-center gap-2 rounded-xl border border-amber-300 bg-amber-50 px-4 py-3 text-sm font-semibold text-amber-700 transition hover:border-amber-400 hover:bg-amber-100"
+			>
+				<span>⚡</span> 一键登录管理员
+			</a>
+			<p class="rise-3 mt-2 text-center text-xs text-slate-400">仅开发环境可见 · 跳过飞书 OAuth</p>
+		{/if}
+	</div>
+</main>
@@ -0,0 +1,96 @@
+@import 'tailwindcss';
+
+@source './**/*.{html,js,svelte,ts}';
+@source '../lib/**/*.{html,js,svelte,ts}';
+
+/*
+ * Design system for the database-admin SPA. Migrated verbatim (in spirit) from
+ * the previous server-rendered pages in hub/src/database/routes/databaseRoutes.ts:
+ * a light aurora / glassmorphism look with violet→cyan gradients and soft rise-in
+ * entrances. Distinct from admin-web's flat industrial theme on purpose.
+ */
+
+@theme {
+	--font-sans: 'Inter', system-ui, -apple-system, 'Segoe UI', 'Noto Sans SC', 'PingFang SC', sans-serif;
+}
+
+@keyframes aurora {
+	0% {
+		transform: translate(0, 0) scale(1);
+	}
+	33% {
+		transform: translate(6%, -8%) scale(1.15);
+	}
+	66% {
+		transform: translate(-8%, 6%) scale(0.9);
+	}
+	100% {
+		transform: translate(0, 0) scale(1);
+	}
+}
+
+@keyframes rise {
+	from {
+		opacity: 0;
+		transform: translateY(16px);
+	}
+	to {
+		opacity: 1;
+		transform: translateY(0);
+	}
+}
+
+@keyframes shimmer {
+	0% {
+		background-position: -200% 0;
+	}
+	100% {
+		background-position: 200% 0;
+	}
+}
+
+@layer base {
+	:root {
+		font-family: var(--font-sans);
+	}
+	html {
+		height: 100%;
+		-webkit-font-smoothing: antialiased;
+		-moz-osx-font-smoothing: grayscale;
+	}
+}
+
+@layer components {
+	.aurora {
+		filter: blur(80px);
+		animation: aurora 18s ease-in-out infinite;
+	}
+	.rise {
+		animation: rise 0.7s cubic-bezier(0.16, 1, 0.3, 1) both;
+	}
+	.rise-1 {
+		animation: rise 0.7s cubic-bezier(0.16, 1, 0.3, 1) both;
+	}
+	.rise-2 {
+		animation: rise 0.7s cubic-bezier(0.16, 1, 0.3, 1) 0.1s both;
+	}
+	.rise-3 {
+		animation: rise 0.7s cubic-bezier(0.16, 1, 0.3, 1) 0.2s both;
+	}
+	.grad-text {
+		background: linear-gradient(120deg, #7c3aed, #0891b2, #4f46e5);
+		background-size: 200% auto;
+		-webkit-background-clip: text;
+		background-clip: text;
+		color: transparent;
+		animation: shimmer 6s linear infinite;
+	}
+	.glass {
+		background: rgba(255, 255, 255, 0.7);
+		backdrop-filter: blur(16px);
+		-webkit-backdrop-filter: blur(16px);
+	}
+	.glow-btn {
+		box-shadow: 0 12px 32px -10px rgba(124, 58, 237, 0.45);
+	}
+}
@@ -0,0 +1,160 @@
+<script lang="ts">
+	import { onMount } from 'svelte';
+	import { base } from '$app/paths';
+	import { session, loadSession, logout } from '$lib/session';
+	import { isOrgAdmin } from '$lib/org';
+	import Aurora from '$lib/components/Aurora.svelte';
+
+	onMount(() => {
+		loadSession();
+	});
+
+	// The session is scoped to the silo org, so /api/me returns exactly that org's
+	// membership. Admin gate: only OWNER/ADMIN may use the database console.
+	const me = $derived($session.me);
+	const org = $derived(me?.organizations[0] ?? null);
+	const allowed = $derived(isOrgAdmin(org));
+	const displayName = $derived(me?.user.displayName ?? '');
+	const initial = $derived(displayName.slice(0, 1) || 'U');
+
+	const navItems = [
+		{ label: '概览', href: `${base}/dashboard`, active: true, icon: 'M4 13h6V4H4v9Zm0 7h6v-5H4v5Zm10 0h6V11h-6v9Zm0-16v5h6V4h-6Z' },
+		{ label: '数据表', href: '#', active: false, icon: 'M4 5h16v4H4V5Zm0 6h16v4H4v-4Zm0 6h16v2H4v-2Z' },
+		{ label: '查询', href: '#', active: false, icon: 'm21 21-4.3-4.3M11 18a7 7 0 1 0 0-14 7 7 0 0 0 0 14Z' },
+		{
+			label: '设置',
+			href: '#',
+			active: false,
+			icon: 'M12 15a3 3 0 1 0 0-6 3 3 0 0 0 0 6Zm7-3 2 1-2 3-2-1a7 7 0 0 1-2 1l-1 2h-4l-1-2a7 7 0 0 1-2-1l-2 1-2-3 2-1a7 7 0 0 1 0-2l-2-1 2-3 2 1a7 7 0 0 1 2-1l1-2h4l1 2a7 7 0 0 1 2 1l2-1 2 3-2 1a7 7 0 0 1 0 2Z',
+		},
+	];
+
+	const stats = [
+		{ label: '数据表', value: '—', accent: 'from-violet-200/60 to-transparent' },
+		{ label: '记录数', value: '—', accent: 'from-cyan-200/60 to-transparent' },
+		{ label: '最近查询', value: '—', accent: 'from-indigo-200/60 to-transparent' },
+	];
+</script>
+
+<Aurora />
+
+{#if $session.loading}
+	<div class="flex min-h-screen items-center justify-center">
+		<div class="flex flex-col items-center gap-3 text-slate-400">
+			<svg class="h-8 w-8 animate-spin text-violet-500" viewBox="0 0 24 24" fill="none">
+				<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+				<path
+					class="opacity-90"
+					fill="currentColor"
+					d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+				></path>
+			</svg>
+			<p class="text-sm">加载中…</p>
+		</div>
+	</div>
+{:else if $session.error}
+	<div class="flex min-h-screen items-center justify-center p-4">
+		<div class="rise glass w-full max-w-sm rounded-3xl border border-white/80 p-8 text-center shadow-2xl shadow-indigo-200/50">
+			<h2 class="mb-2 text-lg font-bold text-slate-900">无法连接后端</h2>
+			<p class="mb-5 text-sm text-slate-500">{$session.error}</p>
+			<button
+				class="rounded-xl bg-gradient-to-r from-violet-500 to-indigo-500 px-4 py-2 text-sm font-semibold text-white"
+				onclick={() => loadSession()}>重试</button
+			>
+		</div>
+	</div>
+{:else if !allowed}
+	<div class="flex min-h-screen items-center justify-center p-4">
+		<div class="rise glass w-full max-w-md rounded-3xl border border-white/80 p-8 text-center shadow-2xl shadow-indigo-200/50">
+			<h2 class="mb-2 text-lg font-bold text-slate-900">无权访问</h2>
+			<p class="mb-5 text-sm text-slate-500">数据库管理台仅向组织所有者与管理员开放。</p>
+			<button
+				class="rounded-xl border border-slate-200 bg-white px-4 py-2 text-sm font-medium text-slate-600 transition hover:bg-slate-50"
+				onclick={() => logout()}>退出登录</button
+			>
+		</div>
+	</div>
+{:else}
+	<div class="relative flex min-h-screen">
+		<!-- 左侧菜单栏 -->
+		<aside class="flex w-64 shrink-0 flex-col border-r border-slate-200/80 glass">
+			<div class="flex items-center gap-3 px-5 py-6">
+				<div
+					class="flex h-10 w-10 items-center justify-center rounded-xl bg-gradient-to-br from-violet-500 to-cyan-400 text-lg font-bold text-white glow-btn"
+				>
+					D
+				</div>
+				<span class="text-base font-bold grad-text">Database Admin</span>
+			</div>
+			<nav class="flex flex-1 flex-col gap-1.5 px-3 py-2">
+				{#each navItems as item}
+					<a
+						href={item.href}
+						class={item.active
+							? 'group flex items-center gap-3 rounded-xl bg-gradient-to-r from-violet-500 to-indigo-500 px-3 py-2.5 text-sm font-semibold text-white shadow-lg shadow-indigo-300/50'
+							: 'group flex items-center gap-3 rounded-xl px-3 py-2.5 text-sm font-medium text-slate-500 transition hover:bg-slate-100 hover:text-slate-900'}
+					>
+						<svg
+							class="h-4 w-4 shrink-0"
+							viewBox="0 0 24 24"
+							fill="none"
+							stroke="currentColor"
+							stroke-width="1.8"
+							stroke-linecap="round"
+							stroke-linejoin="round"><path d={item.icon} /></svg
+						>
+						{item.label}
+					</a>
+				{/each}
+			</nav>
+			<div class="m-3 flex items-center gap-3 rounded-xl border border-slate-200 bg-white/60 px-3 py-3">
+				<div
+					class="flex h-9 w-9 items-center justify-center rounded-full bg-gradient-to-br from-violet-500 to-indigo-500 text-sm font-semibold text-white"
+				>
+					{initial}
+				</div>
+				<div class="min-w-0">
+					<p class="text-[11px] uppercase tracking-wider text-slate-400">已登录</p>
+					<p class="truncate text-sm font-medium text-slate-700">{displayName}</p>
+				</div>
+			</div>
+		</aside>
+
+		<!-- 右侧内容 -->
+		<div class="flex flex-1 flex-col">
+			<header class="flex items-center justify-between border-b border-slate-200/80 glass px-8 py-4">
+				<div>
+					<h1 class="text-lg font-bold text-slate-900">概览</h1>
+					<p class="text-xs text-slate-400">欢迎回来，这里是数据库管理台</p>
+				</div>
+				<button
+					onclick={() => logout()}
+					class="rounded-xl border border-slate-200 bg-white px-4 py-2 text-sm font-medium text-slate-600 transition hover:border-slate-300 hover:bg-slate-50 hover:text-slate-900"
+				>
+					退出登录
+				</button>
+			</header>
+
+			<main class="flex-1 p-8">
+				<div class="grid grid-cols-1 gap-5 sm:grid-cols-3">
+					{#each stats as s, i}
+						<div
+							class="rise-{i +
+								1} group relative overflow-hidden rounded-2xl border border-white/80 glass p-5 shadow-lg shadow-slate-200/50 transition hover:-translate-y-0.5 hover:shadow-xl hover:shadow-indigo-200/50"
+						>
+							<div class="absolute inset-0 bg-gradient-to-br {s.accent} opacity-0 transition group-hover:opacity-100"></div>
+							<p class="relative text-sm text-slate-500">{s.label}</p>
+							<p class="relative mt-2 text-3xl font-bold text-slate-900">{s.value}</p>
+						</div>
+					{/each}
+				</div>
+
+				<div
+					class="rise-3 mt-6 flex h-64 items-center justify-center rounded-2xl border border-dashed border-slate-300 glass text-sm text-slate-400"
+				>
+					内容区占位 · 后续数据端点挂在 /database/* 并加 guard
+				</div>
+			</main>
+		</div>
+	</div>
+{/if}
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" fill="none">
+	<rect width="32" height="32" rx="8" fill="#4F46E5"/>
+	<path d="M8 10.5h7.5a3.5 3.5 0 0 1 0 7H11v4H8v-11Zm3 4.5h4.5a1.5 1.5 0 0 0 0-3H11v3Z" fill="white"/>
+	<path d="M20.5 21.5c1.93 0 3.5-1.34 3.5-3s-1.57-3-3.5-3S17 16.84 17 18.5s1.57 3 3.5 3Z" fill="white" opacity=".9"/>
+</svg>
@@ -0,0 +1,3 @@
+# allow crawling everything by default
+User-agent: *
+Disallow:
@@ -0,0 +1,22 @@
+import adapter from '@sveltejs/adapter-static';
+import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
+
+/** @type {import('@sveltejs/kit').Config} */
+const config = {
+	preprocess: vitePreprocess(),
+	kit: {
+		adapter: adapter({
+			pages: 'build',
+			assets: 'build',
+			fallback: 'index.html',
+			precompress: false,
+			strict: false,
+		}),
+		// This SPA is served under /database by the Hub. admin-web owns the
+		// root asset paths (/_app, /favicon.svg); a base path moves this app's
+		// assets to /database/_app/* so the two builds never collide.
+		paths: { base: '/database' },
+	},
+};
+
+export default config;
@@ -0,0 +1,20 @@
+{
+	"extends": "./.svelte-kit/tsconfig.json",
+	"compilerOptions": {
+		"rewriteRelativeImportExtensions": true,
+		"allowJs": true,
+		"checkJs": true,
+		"esModuleInterop": true,
+		"forceConsistentCasingInFileNames": true,
+		"resolveJsonModule": true,
+		"skipLibCheck": true,
+		"sourceMap": true,
+		"strict": true,
+		"moduleResolution": "bundler"
+	}
+	// Path aliases are handled by https://svelte.dev/docs/kit/configuration#alias
+	// except $lib which is handled by https://svelte.dev/docs/kit/configuration#files
+	//
+	// To make changes to top-level options such as include and exclude, we recommend extending
+	// the generated config; see https://svelte.dev/docs/kit/configuration#typescript
+}
@@ -0,0 +1,17 @@
+import { sveltekit } from '@sveltejs/kit/vite';
+import tailwindcss from '@tailwindcss/vite';
+import { defineConfig } from 'vite';
+
+export default defineConfig({
+	plugins: [tailwindcss(), sveltekit()],
+	server: {
+		proxy: {
+			'/api': 'http://127.0.0.1:8788',
+			'/auth': 'http://127.0.0.1:8788',
+			// Backend owns the /database/* HTTP surface (login page, dashboard,
+			// data routes). Proxy it in dev so those paths hit the real server
+			// instead of the SPA fallback.
+			'/database': 'http://127.0.0.1:8788',
+		},
+	},
+});
@@ -82,10 +82,11 @@ REMOTE
  rsync -az --delete \
    --exclude node_modules --exclude dist --exclude .env \
    --exclude admin-web/node_modules --exclude admin-web/build --exclude admin-web/.svelte-kit \
+    --exclude database-admin/node_modules --exclude database-admin/build --exclude database-admin/.svelte-kit \
    -e "ssh ${SSH_OPTS[*]}" \
    "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"

-  echo "[fleet] npm ci + build (tsc + admin-web SPA)"
+  echo "[fleet] npm ci + build (tsc + admin-web & database-admin SPAs)"
  ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" bash -s <<REMOTE
 set -euo pipefail
 flock /var/lock/cph-hub-release-publish bash -c '
@@ -97,9 +98,11 @@ flock /var/lock/cph-hub-release-publish bash -c '
  cd "$HUB_DIR"
  PUPPETEER_SKIP_DOWNLOAD=1 npm ci
  npm ci --prefix admin-web
+  npm ci --prefix database-admin
  npm run audit:production
  npm run build
  test -f admin-web/build/index.html
+  test -f database-admin/build/index.html
  touch "$RELEASE_DIR/.complete"
 '
 REMOTE
@@ -60,10 +60,11 @@ if [ "$release_ready" = false ]; then
    -e "ssh ${SSH_OPTS[*]}" \
    "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"

-  # 2. Install deps (hub + admin-web), audit hub prod, build tsc + SPA, mark complete.
-  # `npm run build` → tsc then admin:build → admin-web/build for registerStaticSpa.
+  # 2. Install deps (hub + both SPAs), audit hub prod, build tsc + SPAs, mark complete.
+  # `npm run build` → tsc then admin:build + database:build → admin-web/build and
+  # database-admin/build for registerStaticSpa / registerDatabaseSpa.
  ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" \
-    "cd '$HUB_DIR' && PUPPETEER_SKIP_DOWNLOAD=1 npm ci && npm ci --prefix admin-web && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
+    "cd '$HUB_DIR' && PUPPETEER_SKIP_DOWNLOAD=1 npm ci && npm ci --prefix admin-web && npm ci --prefix database-admin && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
 fi

 # 3. Ensure the service is installed (idempotent), then restart.
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>文件库</title>
+  </head>
+  <body>
+    <div id="app"></div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>
@@ -0,0 +1,21 @@
+{
+  "name": "filelib-web",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build",
+    "preview": "vite preview",
+    "check": "svelte-check --tsconfig ./tsconfig.json"
+  },
+  "devDependencies": {
+    "@sveltejs/vite-plugin-svelte": "^7.1.2",
+    "@tailwindcss/vite": "^4.3.2",
+    "svelte": "^5.56.1",
+    "svelte-check": "^4.6.0",
+    "tailwindcss": "^4.3.2",
+    "typescript": "^5.7.0",
+    "vite": "^8.0.16"
+  }
+}
@@ -0,0 +1,30 @@
+<script lang="ts">
+  import { onMount } from "svelte";
+  import { api, UnauthenticatedError } from "./lib/api.js";
+  import { me, authChecked } from "./lib/stores.js";
+  import type { MeResponse } from "./lib/types.js";
+  import LoginView from "./lib/LoginView.svelte";
+  import BrowserShell from "./lib/BrowserShell.svelte";
+  import Toasts from "./lib/Toasts.svelte";
+
+  onMount(async () => {
+    try {
+      me.set(await api<MeResponse>("/database/api/me"));
+    } catch (e) {
+      if (!(e instanceof UnauthenticatedError)) console.error(e);
+      me.set(null);
+    } finally {
+      authChecked.set(true);
+    }
+  });
+</script>
+
+{#if !$authChecked}
+  <div class="flex h-full items-center justify-center text-ink-3">加载中…</div>
+{:else if $me}
+  <BrowserShell />
+{:else}
+  <LoginView />
+{/if}
+
+<Toasts />
@@ -0,0 +1,66 @@
+@import "tailwindcss";
+
+/* 全局 UI 主题令牌(与 hub 端 uiTheme.ts 同源) */
+@theme {
+  --color-bg: #fcfcfb;
+  --color-panel: #ffffff;
+  --color-sidebar: #f7f7f5;
+  --color-ink: #1a1a18;
+  --color-ink-2: #6b6a66;
+  --color-ink-3: #9c9b96;
+  --color-line: #ecece8;
+  --color-line-soft: #f1f1ee;
+  --color-hover: #f4f4f1;
+  --color-selected: #ebebe7;
+  --color-accent: #1a1a18;
+  --color-accent-hover: #333330;
+  --color-danger: #a13a33;
+  --color-guide: #e9e9e5;
+  --color-diff-add-bg: #f3f6f2;
+  --color-diff-add-text: #4a6741;
+  --color-diff-del-bg: #f8f2f1;
+  --color-diff-del-text: #a13a33;
+}
+
+html,
+body,
+#app {
+  height: 100%;
+}
+
+body {
+  background: var(--color-bg);
+  color: var(--color-ink);
+  font-family:
+    "Inter",
+    -apple-system,
+    "Segoe UI",
+    "PingFang SC",
+    "Microsoft YaHei",
+    sans-serif;
+  font-size: 14px;
+  line-height: 1.65;
+  -webkit-font-smoothing: antialiased;
+}
+
+.font-mono {
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+}
+
+/* diff 渲染 */
+pre.diff {
+  white-space: pre-wrap;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 12.5px;
+  line-height: 1.75;
+}
+pre.diff .add {
+  display: block;
+  color: var(--color-diff-add-text);
+  background: var(--color-diff-add-bg);
+}
+pre.diff .del {
+  display: block;
+  color: var(--color-diff-del-text);
+  background: var(--color-diff-del-bg);
+}
@@ -0,0 +1,171 @@
+<script lang="ts">
+  import { onMount } from "svelte";
+  import { api } from "./api.js";
+  import { me, toastErr, toastOk } from "./stores.js";
+  import { treeVersion, bumpTree, currentNode, selectedFilePath, clearSelectedFile, bumpFiles } from "./browser.js";
+  import type { NodeChild } from "./types.js";
+  import TreeNode from "./TreeNode.svelte";
+  import NodeDetailPanel from "./NodeDetailPanel.svelte";
+  import FileEditor from "./FileEditor.svelte";
+  import GroupAdmin from "./GroupAdmin.svelte";
+  import Modal from "./Modal.svelte";
+
+  // 视图切换(仅管理员可见 Group 管理入口;非管理员恒为 library)。
+  let view = $state<"library" | "groups">("library");
+
+  let roots = $state<NodeChild[] | null>(null);
+  let treeError = $state<string | null>(null);
+  let showCreateRoot = $state(false);
+  let newName = $state("");
+  let newKind = $state<"FOLDER" | "PROJECT">("FOLDER");
+  let newDesc = $state("");
+
+  async function loadRoots(): Promise<void> {
+    try {
+      const r = await api<{ nodes: NodeChild[] }>("/database/api/nodes");
+      roots = r.nodes;
+      treeError = null;
+    } catch (e) {
+      treeError = e instanceof Error ? e.message : String(e);
+    }
+  }
+
+  onMount(loadRoots);
+  $effect(() => {
+    void $treeVersion;
+    void loadRoots();
+  });
+
+  async function createRoot(): Promise<void> {
+    const name = newName.trim();
+    if (name === "") return;
+    try {
+      await api("/database/api/nodes", {
+        method: "POST",
+        body: {
+          parentId: null,
+          kind: newKind,
+          name,
+          ...(newDesc.trim() !== "" ? { description: newDesc.trim() } : {}),
+        },
+      });
+      toastOk("已创建");
+      showCreateRoot = false;
+      newName = ""; newKind = "FOLDER"; newDesc = "";
+      bumpTree();
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function logout(): Promise<void> {
+    try { await fetch("/auth/logout", { method: "POST", credentials: "same-origin" }); } catch { /* ignore */ }
+    me.set(null);
+  }
+
+  const initial = $derived(($me?.userId ?? "U").slice(0, 1).toUpperCase());
+</script>
+
+<div class="flex h-full flex-col">
+  {#if $me?.isWebsiteAdmin}
+    <!-- 视图切换(仅管理员) -->
+    <div class="flex shrink-0 items-center gap-1 border-b border-line-soft bg-sidebar px-3 py-1.5">
+      <button
+        class="rounded-lg px-3 py-1 text-[12.5px] font-medium transition"
+        class:bg-selected={view === "library"}
+        class:text-ink={view === "library"}
+        class:text-ink-3={view !== "library"}
+        onclick={() => (view = "library")}
+      >文件库</button>
+      <button
+        class="rounded-lg px-3 py-1 text-[12.5px] font-medium transition"
+        class:bg-selected={view === "groups"}
+        class:text-ink={view === "groups"}
+        class:text-ink-3={view !== "groups"}
+        onclick={() => (view = "groups")}
+      >Group 管理</button>
+    </div>
+  {/if}
+
+  <div class="flex min-h-0 flex-1">
+  {#if $me?.isWebsiteAdmin && view === "groups"}
+    <GroupAdmin />
+  {:else}
+  <!-- 侧栏 -->
+  <aside class="flex w-[300px] shrink-0 flex-col border-r border-line-soft bg-sidebar">
+    <div class="flex items-center justify-between border-b border-line-soft px-4 py-3.5">
+      <span class="text-[15px] font-semibold text-ink">文件库</span>
+      {#if $me?.isWebsiteAdmin}
+        <button class="rounded-lg border border-line bg-panel px-2.5 py-1 text-[11.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreateRoot = true)}>
+          + 根目录
+        </button>
+      {/if}
+    </div>
+
+    <div class="flex-1 overflow-y-auto px-2 py-2 text-[13px]">
+      {#if roots === null}
+        <div class="px-3 py-6 text-center text-xs text-ink-3">加载中…</div>
+      {:else if treeError}
+        <div class="px-3 py-6 text-center text-xs text-danger">{treeError}</div>
+      {:else if roots.length === 0}
+        <div class="px-3 py-6 text-center text-xs text-ink-3">
+          {$me?.isWebsiteAdmin ? "空文件库 · 点上方「+ 根目录」开始" : "文件库为空,请联系管理员创建根目录"}
+        </div>
+      {:else}
+        {#each roots as node (node.id)}
+          <TreeNode {node} depth={0} />
+        {/each}
+      {/if}
+    </div>
+
+    <div class="flex items-center gap-2 border-t border-line-soft px-4 py-3 text-[12.5px]">
+      <div class="flex h-6 w-6 shrink-0 items-center justify-center rounded-full bg-accent text-[11px] font-semibold text-white">{initial}</div>
+      <span class="flex-1 truncate text-ink">{$me?.userId ?? ""}</span>
+      <button class="rounded-lg border border-line-soft px-2.5 py-1 text-[11.5px] text-ink-3 transition hover:bg-hover hover:text-ink" onclick={logout} title="退出登录">退出</button>
+    </div>
+  </aside>
+
+  <!-- 主区 -->
+  <main class="flex-1 overflow-y-auto">
+    <NodeDetailPanel />
+  </main>
+
+  <!-- 右侧:文件预览/编辑栏(选中文件时出现) -->
+  {#if $selectedFilePath && $currentNode?.kind === "PROJECT"}
+    <section class="flex w-[46%] min-w-[420px] shrink-0 flex-col overflow-y-auto border-l border-line-soft bg-bg p-4">
+      <FileEditor
+        projectId={$currentNode.id}
+        path={$selectedFilePath}
+        role={$currentNode.role}
+        onchanged={bumpFiles}
+        onclose={clearSelectedFile}
+      />
+    </section>
+  {/if}
+  {/if}
+  </div>
+</div>
+
+{#if showCreateRoot}
+  <Modal title="新建根目录" onclose={() => (showCreateRoot = false)}>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="root-name">名称</label>
+      <input id="root-name" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newName} placeholder="例如:物理教研" />
+    </div>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="root-kind">类型</label>
+      <select id="root-kind" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newKind}>
+        <option value="FOLDER">文件夹</option>
+        <option value="PROJECT">项目(课程资源库)</option>
+      </select>
+    </div>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="root-desc">简介(可选)</label>
+      <textarea id="root-desc" rows="3" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-xs outline-none focus:border-accent" bind:value={newDesc} placeholder="简要说明用途…"></textarea>
+    </div>
+    <div class="mt-4 flex justify-end gap-2">
+      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreateRoot = false)}>取消</button>
+      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={createRoot}>创建</button>
+    </div>
+  </Modal>
+{/if}
@@ -0,0 +1,165 @@
+<script lang="ts">
+  import { api, ApiError } from "./api.js";
+  import { toastOk, toastErr, toast } from "./stores.js";
+  import type { FileContent, VersionInfo, Role } from "./types.js";
+  import Modal from "./Modal.svelte";
+
+  let { projectId, path, role, onchanged, onclose }: { projectId: string; path: string; role: Role; onchanged: () => void; onclose?: () => void } = $props();
+
+  let file = $state<FileContent | null>(null);
+  let draft = $state("");
+  let loadError = $state<string | null>(null);
+  let conflict = $state<{ currentVersion: string; diff: string } | null>(null);
+  let showHistory = $state(false);
+  let history = $state<VersionInfo[]>([]);
+
+  const canEdit = $derived(role !== "VIEW");
+
+  async function load(): Promise<void> {
+    try {
+      file = await api<FileContent>(`/database/api/projects/${projectId}/file?path=${encodeURIComponent(path)}`);
+      draft = file.encoding === "utf8" ? file.content : "";
+      loadError = null;
+      conflict = null;
+    } catch (e) {
+      loadError = e instanceof Error ? e.message : String(e);
+    }
+  }
+
+  $effect(() => {
+    void projectId;
+    void path;
+    void load();
+  });
+
+  async function save(): Promise<void> {
+    if (file === null) return;
+    try {
+      const r = await api<{ version: string }>(`/database/api/projects/${projectId}/file/commits`, {
+        method: "POST",
+        body: { path: file.path, baseVersion: file.version, content: draft },
+      });
+      toastOk("已提交 " + r.version);
+      await load();
+      onchanged();
+    } catch (e) {
+      if (e instanceof ApiError && e.status === 409 && typeof e.details?.["currentVersion"] === "string") {
+        await showConflict(e.details["currentVersion"]);
+      } else {
+        toastErr(e instanceof Error ? e.message : String(e));
+      }
+    }
+  }
+
+  async function showConflict(currentVersion: string): Promise<void> {
+    if (file === null) return;
+    try {
+      const r = await api<{ diff: string }>(
+        `/database/api/projects/${projectId}/file/diff?path=${encodeURIComponent(file.path)}&from=${encodeURIComponent(file.version)}&to=${encodeURIComponent(currentVersion)}`,
+      );
+      conflict = { currentVersion, diff: r.diff };
+      file = { ...file, version: currentVersion };
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function acceptLatest(): Promise<void> {
+    conflict = null;
+    await load();
+    toast("已载入最新内容,请在此基础上合并", "info");
+  }
+
+  async function remove(): Promise<void> {
+    if (file === null || !confirm("删除文件 " + file.path + "?")) return;
+    try {
+      await api(`/database/api/projects/${projectId}/file?path=${encodeURIComponent(file.path)}`, {
+        method: "DELETE",
+        body: { baseVersion: file.version },
+      });
+      toastOk("已删除");
+      file = null;
+      onchanged();
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function openHistory(): Promise<void> {
+    try {
+      const r = await api<{ history: VersionInfo[] }>(`/database/api/projects/${projectId}/file/history?path=${encodeURIComponent(path)}`);
+      history = r.history;
+      showHistory = true;
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  function renderDiff(diff: string): string {
+    return diff
+      .replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")
+      .replace(/^\+(.*)$/gm, '<span class="add">+$1</span>')
+      .replace(/^-(.*)$/gm, '<span class="del">-$1</span>');
+  }
+</script>
+
+{#if loadError}
+  <div class="rounded-xl border border-line-soft bg-panel p-5 text-xs text-danger">{loadError}</div>
+{:else if file}
+  <div class="rounded-xl border border-line-soft bg-panel p-5">
+    <div class="mb-2.5 flex items-center justify-between">
+      <span class="font-mono text-[11px] text-ink-3">{file.path} @ {file.version}</span>
+      <div class="flex items-center gap-2">
+        <a class="rounded-lg border border-line bg-panel px-3 py-1 text-[12px] font-medium text-ink transition hover:bg-hover" href="/database/api/projects/{projectId}/file/raw?path={encodeURIComponent(file.path)}" download>下载</a>
+        <button class="rounded-lg border border-line bg-panel px-3 py-1 text-[12px] font-medium text-ink transition hover:bg-hover" onclick={openHistory}>历史</button>
+        {#if canEdit}
+          <button class="rounded-lg border border-transparent px-3 py-1 text-[12px] font-medium text-danger transition hover:bg-[#A13A3312]" onclick={remove}>删除文件</button>
+        {/if}
+        {#if onclose}
+          <button class="rounded-lg border border-line bg-panel px-2.5 py-1 text-[12px] font-medium text-ink-3 transition hover:bg-hover hover:text-ink" onclick={onclose} title="关闭预览">✕</button>
+        {/if}
+      </div>
+    </div>
+
+    {#if file.encoding === "base64"}
+      <div class="text-xs text-ink-3">二进制文件({file.size} B),不支持在线编辑</div>
+    {:else}
+      <textarea rows="14" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-xs leading-7 outline-none focus:border-accent" bind:value={draft} readonly={!canEdit}></textarea>
+    {/if}
+
+    {#if canEdit && file.encoding !== "base64"}
+      <div class="mt-3 flex justify-end">
+        <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={save}>提交修改</button>
+      </div>
+    {/if}
+
+    {#if conflict}
+      <div class="mt-3.5 rounded-xl border border-[#E8E2C8] bg-[#FCFBF4] p-4">
+        <div class="mb-2 text-[13px] font-semibold text-[#6E6329]">冲突:他人已提交 {conflict.currentVersion},差异如下(你的基版 → 最新版)</div>
+        <pre class="diff rounded-lg border border-line-soft bg-panel p-3">{@html renderDiff(conflict.diff)}</pre>
+        <div class="mt-2 text-[11.5px] text-[#8A8059]">请人工合并后,以最新内容为全文重新提交(基版将更新为 {conflict.currentVersion})</div>
+        <div class="mt-2 flex justify-end">
+          <button class="rounded-lg border border-line bg-panel px-3 py-1 text-[12px] font-medium text-ink transition hover:bg-hover" onclick={acceptLatest}>载入最新内容</button>
+        </div>
+      </div>
+    {/if}
+  </div>
+{:else}
+  <div class="rounded-xl border border-line-soft bg-panel p-5 text-xs text-ink-3">加载中…</div>
+{/if}
+
+{#if showHistory}
+  <Modal title="版本历史" onclose={() => (showHistory = false)}>
+    <div class="max-h-80 overflow-y-auto">
+      {#each history as v (v.version)}
+        <div class="border-t border-line-soft py-2 text-xs first:border-t-0">
+          <span class="font-mono text-accent">{v.version}</span> {v.message}
+          <div class="text-ink-3">{new Date(v.committedAt).toLocaleString("zh-CN")}{v.author ? " · " + v.author : ""}</div>
+        </div>
+      {/each}
+    </div>
+    <div class="mt-3 flex justify-end">
+      <button class="rounded-lg border border-line bg-panel px-3 py-1 text-[12px] font-medium text-ink transition hover:bg-hover" onclick={() => (showHistory = false)}>关闭</button>
+    </div>
+  </Modal>
+{/if}
@@ -0,0 +1,137 @@
+<script lang="ts">
+  import { api } from "./api.js";
+  import { toastOk, toastErr } from "./stores.js";
+  import { selectedFilePath, filesVersion } from "./browser.js";
+  import type { FileEntry, NodeDetail } from "./types.js";
+  import Modal from "./Modal.svelte";
+
+  let { node }: { node: NodeDetail } = $props();
+
+  let files = $state<FileEntry[] | null>(null);
+  let loadError = $state<string | null>(null);
+  let showNewFile = $state(false);
+  let newPath = $state("");
+  let newContent = $state("");
+  let uploadInput: HTMLInputElement;
+
+  const canEdit = $derived(node.role !== "VIEW");
+
+  async function loadFiles(): Promise<void> {
+    try {
+      const r = await api<{ files: FileEntry[] }>(`/database/api/projects/${node.id}/files`);
+      files = r.files;
+      loadError = null;
+    } catch (e) {
+      loadError = e instanceof Error ? e.message : String(e);
+    }
+  }
+
+  $effect(() => {
+    void node.id;
+    void $filesVersion;
+    void loadFiles();
+  });
+
+  async function submitNewFile(): Promise<void> {
+    const path = newPath.trim();
+    if (path === "") return;
+    try {
+      await api(`/database/api/projects/${node.id}/file`, {
+        method: "PUT",
+        body: { path, content: newContent },
+      });
+      toastOk("已创建");
+      showNewFile = false;
+      newPath = ""; newContent = "";
+      await loadFiles();
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  function u8ToBase64(bytes: Uint8Array): string {
+    let bin = "";
+    const CHUNK = 0x8000;
+    for (let i = 0; i < bytes.length; i += CHUNK) {
+      bin += String.fromCharCode.apply(null, Array.from(bytes.subarray(i, i + CHUNK)) as unknown as number[]);
+    }
+    return btoa(bin);
+  }
+
+  async function doUpload(e: Event): Promise<void> {
+    const input = e.target as HTMLInputElement;
+    const file = input.files?.[0];
+    input.value = "";
+    if (!file) return;
+    if (file.size > 10 * 1024 * 1024) {
+      toastErr("文件超过 10MB 上限");
+      return;
+    }
+    const targetPath = prompt("保存到路径(可含目录):", "材料/" + file.name);
+    if (!targetPath) return;
+    const bytes = new Uint8Array(await file.arrayBuffer());
+    const isBinary = bytes.includes(0);
+    const body = isBinary
+      ? { path: targetPath, content: u8ToBase64(bytes), encoding: "base64" }
+      : { path: targetPath, content: new TextDecoder("utf-8").decode(bytes), encoding: "utf8" };
+    try {
+      await api(`/database/api/projects/${node.id}/file`, { method: "PUT", body });
+      toastOk("已上传 " + file.name);
+      await loadFiles();
+    } catch (err) {
+      toastErr(err instanceof Error ? err.message : String(err));
+    }
+  }
+</script>
+
+<div class="rounded-xl border border-line-soft bg-panel p-5">
+  <div class="mb-2 flex items-center justify-between">
+    <div class="text-[13px] font-semibold">项目文件({files?.length ?? 0})</div>
+    {#if canEdit}
+      <div class="flex gap-2">
+        <button class="rounded-lg border border-line bg-panel px-3 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showNewFile = true)}>+ 新建文件</button>
+        <button class="rounded-lg bg-accent px-3 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={() => uploadInput.click()}>上传文件</button>
+        <input bind:this={uploadInput} type="file" class="hidden" onchange={doUpload} />
+      </div>
+    {/if}
+  </div>
+
+  {#if files === null && loadError === null}
+    <div class="py-5 text-center text-xs text-ink-3">加载中…</div>
+  {:else if loadError}
+    <div class="py-5 text-center text-xs text-danger">{loadError}</div>
+  {:else if files && files.length === 0}
+    <div class="py-5 text-center text-xs text-ink-3">空仓库 · 可新建或上传文件</div>
+  {:else if files}
+    <table class="w-full border-collapse text-[13px]">
+      <tbody>
+        {#each files as f (f.path)}
+          <tr
+            class="cursor-pointer border-t border-line-soft first:border-t-0 {$selectedFilePath === f.path ? 'bg-selected' : 'hover:bg-hover'}"
+            onclick={() => selectedFilePath.set(f.path)}
+          >
+            <td class="py-2 font-mono text-[12.5px] text-ink">{f.path}</td>
+            <td class="py-2 text-right font-mono text-[11px] text-ink-3">{f.size} B</td>
+          </tr>
+        {/each}
+      </tbody>
+    </table>
+  {/if}
+</div>
+
+{#if showNewFile}
+  <Modal title="新建文件" onclose={() => (showNewFile = false)}>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="nf-path">路径</label>
+      <input id="nf-path" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-[13px] outline-none focus:border-accent" bind:value={newPath} placeholder="docs/intro.md" />
+    </div>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="nf-content">内容</label>
+      <textarea id="nf-content" rows="8" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-xs outline-none focus:border-accent" bind:value={newContent} placeholder="内容…"></textarea>
+    </div>
+    <div class="mt-4 flex justify-end gap-2">
+      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showNewFile = false)}>取消</button>
+      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={submitNewFile}>创建</button>
+    </div>
+  </Modal>
+{/if}
@@ -0,0 +1,280 @@
+<script lang="ts">
+  import { onMount } from "svelte";
+  import { api } from "./api.js";
+  import { toastErr, toastOk } from "./stores.js";
+  import type { MemberGroupNode, MemberGroupMember } from "./types.js";
+  import Modal from "./Modal.svelte";
+
+  // 后端返回活跃组扁平列表(ADR-0028);前端按 parentId/depth 拼成有序树。
+  let groups = $state<MemberGroupNode[] | null>(null);
+  let listError = $state<string | null>(null);
+  let selectedId = $state<string | null>(null);
+
+  let members = $state<MemberGroupMember[] | null>(null);
+  let membersError = $state<string | null>(null);
+
+  // 新建组弹窗:parentId=null 建根,否则建子。
+  let showCreate = $state(false);
+  let createParentId = $state<string | null>(null);
+  let createParentName = $state<string | null>(null);
+  let newName = $state("");
+  let newDesc = $state("");
+
+  let addValue = $state("");
+
+  const selected = $derived(groups?.find((g) => g.id === selectedId) ?? null);
+
+  /** 扁平列表按 parentId 排成先根遍历顺序(每项自带 depth,渲染时缩进)。 */
+  const ordered = $derived.by(() => {
+    if (groups === null) return [];
+    const byParent = new Map<string | null, MemberGroupNode[]>();
+    for (const g of groups) {
+      const arr = byParent.get(g.parentId) ?? [];
+      arr.push(g);
+      byParent.set(g.parentId, arr);
+    }
+    for (const arr of byParent.values()) arr.sort((a, b) => a.name.localeCompare(b.name));
+    const out: MemberGroupNode[] = [];
+    const walk = (parentId: string | null): void => {
+      for (const g of byParent.get(parentId) ?? []) {
+        out.push(g);
+        walk(g.id);
+      }
+    };
+    walk(null);
+    // 兜底:孤儿(父已不在活跃列表,理论上级联软删不会出现)也列出。
+    const seen = new Set(out.map((g) => g.id));
+    for (const g of groups) if (!seen.has(g.id)) out.push(g);
+    return out;
+  });
+
+  async function loadGroups(): Promise<void> {
+    try {
+      const r = await api<{ groups: MemberGroupNode[] }>("/database/api/groups");
+      groups = r.groups;
+      listError = null;
+      if (selectedId !== null && !groups.some((g) => g.id === selectedId)) {
+        selectedId = null;
+        members = null;
+      }
+    } catch (e) {
+      listError = e instanceof Error ? e.message : String(e);
+    }
+  }
+
+  async function loadMembers(): Promise<void> {
+    if (selectedId === null) return;
+    members = null;
+    membersError = null;
+    try {
+      const r = await api<{ members: MemberGroupMember[] }>(
+        `/database/api/groups/${encodeURIComponent(selectedId)}/members`,
+      );
+      members = r.members;
+    } catch (e) {
+      membersError = e instanceof Error ? e.message : String(e);
+    }
+  }
+
+  onMount(loadGroups);
+
+  function select(id: string): void {
+    selectedId = id;
+    void loadMembers();
+  }
+
+  function openCreate(parent: MemberGroupNode | null): void {
+    createParentId = parent?.id ?? null;
+    createParentName = parent?.name ?? null;
+    newName = "";
+    newDesc = "";
+    showCreate = true;
+  }
+
+  async function createGroup(): Promise<void> {
+    const name = newName.trim();
+    if (name === "") return;
+    try {
+      await api("/database/api/groups", {
+        method: "POST",
+        body: {
+          name,
+          parentId: createParentId,
+          ...(newDesc.trim() !== "" ? { description: newDesc.trim() } : {}),
+        },
+      });
+      toastOk("已创建成员组");
+      showCreate = false;
+      await loadGroups();
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function deleteGroup(g: MemberGroupNode): Promise<void> {
+    if (!confirm(`删除「${g.name}」?其整棵子树将一并归档,相关授权立即失效。`)) return;
+    try {
+      const r = await api<{ archivedCount: number }>(
+        `/database/api/groups/${encodeURIComponent(g.id)}`,
+        { method: "DELETE" },
+      );
+      toastOk(`已归档 ${r.archivedCount} 个组`);
+      if (selectedId === g.id) { selectedId = null; members = null; }
+      await loadGroups();
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function addMember(): Promise<void> {
+    const v = addValue.trim();
+    if (v === "" || selectedId === null) return;
+    try {
+      // ou_ 开头当飞书 openId,其余当 userId(与 hub 现有习惯一致)。
+      const body = v.startsWith("ou_") ? { feishuOpenId: v } : { userId: v };
+      await api(`/database/api/groups/${encodeURIComponent(selectedId)}/members`, {
+        method: "POST",
+        body,
+      });
+      addValue = "";
+      toastOk("已添加成员");
+      await Promise.all([loadMembers(), loadGroups()]);
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function removeMember(userId: string): Promise<void> {
+    if (selectedId === null) return;
+    try {
+      await api(
+        `/database/api/groups/${encodeURIComponent(selectedId)}/members/${encodeURIComponent(userId)}`,
+        { method: "DELETE" },
+      );
+      toastOk("已移除成员");
+      await Promise.all([loadMembers(), loadGroups()]);
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+</script>
+
+<div class="flex h-full">
+  <!-- 左栏:嵌套组树 -->
+  <aside class="flex w-[340px] shrink-0 flex-col border-r border-line-soft bg-sidebar">
+    <div class="flex items-center justify-between border-b border-line-soft px-4 py-3.5">
+      <span class="text-[15px] font-semibold text-ink">Group 管理</span>
+      <button
+        class="rounded-lg border border-line bg-panel px-2.5 py-1 text-[11.5px] font-medium text-ink transition hover:bg-hover"
+        onclick={() => openCreate(null)}
+      >
+        + 根 Group
+      </button>
+    </div>
+
+    <div class="flex-1 overflow-y-auto px-2 py-2 text-[13px]">
+      {#if groups === null}
+        <div class="px-3 py-6 text-center text-xs text-ink-3">加载中…</div>
+      {:else if listError}
+        <div class="px-3 py-6 text-center text-xs text-danger">{listError}</div>
+      {:else if ordered.length === 0}
+        <div class="px-3 py-6 text-center text-xs text-ink-3">暂无成员组 · 点上方「+ 根 Group」开始</div>
+      {:else}
+        {#each ordered as g (g.id)}
+          <div
+            class="group flex items-center gap-1.5 rounded-lg py-1.5 pr-1.5 transition hover:bg-hover"
+            class:bg-selected={selectedId === g.id}
+            style="padding-left: {8 + g.depth * 16}px"
+          >
+            <button class="flex min-w-0 flex-1 items-center gap-2 text-left" onclick={() => select(g.id)}>
+              <span class="truncate font-medium text-ink">{g.name}</span>
+              <span class="shrink-0 text-[11px] text-ink-3">{g.memberCount}</span>
+            </button>
+            <button
+              class="shrink-0 rounded px-1.5 py-0.5 text-[15px] leading-none text-ink-3 opacity-0 transition hover:bg-panel hover:text-ink group-hover:opacity-100"
+              title="在此下新建子 Group"
+              onclick={() => openCreate(g)}
+            >+</button>
+            <button
+              class="shrink-0 rounded px-1.5 py-0.5 text-[11px] leading-none text-ink-3 opacity-0 transition hover:text-danger group-hover:opacity-100"
+              title="删除(级联归档子树)"
+              onclick={() => deleteGroup(g)}
+            >删除</button>
+          </div>
+        {/each}
+      {/if}
+    </div>
+  </aside>
+
+  <!-- 右栏:成员管理 -->
+  <main class="flex-1 overflow-y-auto p-6">
+    {#if selected === null}
+      <div class="flex h-full items-center justify-center text-[13px] text-ink-3">从左侧选择一个 Group 查看成员</div>
+    {:else}
+      <div class="mb-1 text-[17px] font-semibold text-ink">{selected.name}</div>
+      {#if selected.description}
+        <p class="mb-4 text-[12.5px] text-ink-2">{selected.description}</p>
+      {:else}
+        <div class="mb-4"></div>
+      {/if}
+
+      <div class="mb-4 flex items-end gap-2">
+        <div class="flex-1">
+          <label class="mb-1 block text-[11.5px] text-ink-3" for="add-member">添加成员(userId 或飞书 openId)</label>
+          <input
+            id="add-member"
+            class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent"
+            bind:value={addValue}
+            placeholder="userId 或 ou_ 开头的 openId"
+            onkeydown={(e) => { if (e.key === "Enter") void addMember(); }}
+          />
+        </div>
+        <button
+          class="rounded-lg bg-accent px-3.5 py-2 text-[12.5px] font-medium text-white transition hover:bg-accent-hover"
+          onclick={addMember}
+        >添加</button>
+      </div>
+
+      <div class="rounded-xl border border-line-soft bg-panel">
+        <div class="border-b border-line-soft px-4 py-2.5 text-[12.5px] font-semibold text-ink">
+          成员 {members === null ? "" : `(${members.length})`}
+        </div>
+        {#if members === null}
+          <div class="px-4 py-6 text-center text-xs text-ink-3">加载中…</div>
+        {:else if membersError}
+          <div class="px-4 py-6 text-center text-xs text-danger">{membersError}</div>
+        {:else if members.length === 0}
+          <div class="px-4 py-6 text-center text-xs text-ink-3">暂无成员</div>
+        {:else}
+          {#each members as m (m.userId)}
+            <div class="flex items-center gap-3 border-b border-line-soft px-4 py-2.5 text-[13px] last:border-b-0">
+              <span class="text-ink">{m.displayName}</span>
+              <span class="truncate font-mono text-[11px] text-ink-3">{m.userId}</span>
+              <button
+                class="ml-auto shrink-0 rounded px-1.5 py-0.5 text-[11.5px] text-ink-3 transition hover:text-danger"
+                onclick={() => removeMember(m.userId)}
+              >移除</button>
+            </div>
+          {/each}
+        {/if}
+      </div>
+    {/if}
+  </main>
+</div>
+
+{#if showCreate}
+  <Modal title={createParentName === null ? "新建根 Group" : `在「${createParentName}」下新建子 Group`} onclose={() => (showCreate = false)}>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="g-name">名称</label>
+      <input id="g-name" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newName} placeholder="例如:物理教研组" />
+    </div>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="g-desc">描述(可选)</label>
+      <textarea id="g-desc" rows="2" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newDesc} placeholder="一句话说明…"></textarea>
+    </div>
+    <div class="mt-4 flex justify-end gap-2">
+      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreate = false)}>取消</button>
+      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={createGroup}>创建</button>
+    </div>
+  </Modal>
+{/if}
@@ -0,0 +1,47 @@
+<script lang="ts">
+  import { onMount } from "svelte";
+  import { api } from "./api.js";
+
+  interface LoginInfo {
+    orgSlug: string;
+    devLoginEnabled: boolean;
+  }
+
+  let info = $state<LoginInfo | null>(null);
+  let loadFailed = $state(false);
+
+  onMount(async () => {
+    try {
+      info = await api<LoginInfo>("/database/api/login-info");
+    } catch {
+      loadFailed = true;
+    }
+  });
+</script>
+
+<div class="flex min-h-full items-center justify-center p-6">
+  <div class="w-full max-w-[380px] rounded-2xl border border-line-soft bg-panel p-9 shadow-[0_4px_20px_rgba(26,26,24,.07)]">
+    <div class="text-center text-[26px] font-semibold tracking-wide text-ink">文件库</div>
+    <p class="mt-2.5 mb-8 text-center text-[13px] text-ink-3">课程资源与教研文件,一处安放,随处可查</p>
+
+    {#if info}
+      <a
+        href="/auth/feishu/{encodeURIComponent(info.orgSlug)}"
+        class="flex w-full items-center justify-center rounded-lg bg-accent px-4 py-3 text-sm font-medium text-white transition hover:bg-accent-hover"
+      >使用飞书登录</a>
+
+      {#if info.devLoginEnabled}
+        <div class="my-5 flex items-center gap-2.5 text-[11px] text-ink-3">
+          <span class="flex-1 border-t border-line-soft"></span>开发模式
+          <span class="flex-1 border-t border-line-soft"></span>
+        </div>
+        <a href="/app/dev-login-teacher" class="flex w-full items-center justify-center rounded-lg border border-line bg-panel px-4 py-2 text-[12.5px] font-medium text-ink transition hover:bg-hover">⚡ 一键登录(老师)</a>
+        <p class="mt-2.5 text-center text-[11px] text-ink-3">仅开发环境可见 · 跳过飞书 OAuth</p>
+      {/if}
+    {:else if loadFailed}
+      <p class="text-center text-[12.5px] text-danger">无法加载登录配置,请稍后重试</p>
+    {:else}
+      <p class="text-center text-[12.5px] text-ink-3">加载中…</p>
+    {/if}
+  </div>
+</div>
@@ -0,0 +1,16 @@
+<script lang="ts">
+  import type { Snippet } from "svelte";
+
+  let { title, onclose, children }: { title: string; onclose: () => void; children: Snippet } = $props();
+</script>
+
+<div
+  class="fixed inset-0 z-40 flex items-center justify-center bg-black/30 p-4"
+  role="presentation"
+  onclick={(e) => { if (e.target === e.currentTarget) onclose(); }}
+>
+  <div class="w-full max-w-[440px] rounded-2xl border border-line-soft bg-panel p-6 shadow-[0_4px_20px_rgba(26,26,24,.07)]">
+    <div class="mb-4 text-[15px] font-semibold">{title}</div>
+    {@render children()}
+  </div>
+</div>
@@ -0,0 +1,144 @@
+<script lang="ts">
+  import { api } from "./api.js";
+  import { currentNode, breadcrumb, bumpTree, clearSelectedFile } from "./browser.js";
+  import { toastOk, toastErr } from "./stores.js";
+  import OverviewPanel from "./OverviewPanel.svelte";
+  import FilesPanel from "./FilesPanel.svelte";
+  import Modal from "./Modal.svelte";
+
+  let tab = $state<"detail" | "files">("detail");
+  let showCreateChild = $state(false);
+  let newName = $state("");
+  let newKind = $state<"FOLDER" | "PROJECT">("FOLDER");
+  let newDesc = $state("");
+
+  const node = $derived($currentNode);
+  const crumbs = $derived($breadcrumb);
+  const canManage = $derived(node?.role === "MANAGE");
+  const canEdit = $derived(canManage || node?.role === "EDIT");
+
+  $effect(() => {
+    void node?.id;
+    tab = "detail";
+    clearSelectedFile();
+  });
+
+  async function createChild(): Promise<void> {
+    const name = newName.trim();
+    if (name === "" || node === null) return;
+    try {
+      await api("/database/api/nodes", {
+        method: "POST",
+        body: {
+          parentId: node.id,
+          kind: newKind,
+          name,
+          ...(newDesc.trim() !== "" ? { description: newDesc.trim() } : {}),
+        },
+      });
+      toastOk("已创建");
+      showCreateChild = false;
+      newName = ""; newKind = "FOLDER"; newDesc = "";
+      bumpTree();
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function renameNode(): Promise<void> {
+    if (node === null) return;
+    const name = prompt("新名称", node.name);
+    if (name === null) return;
+    try {
+      await api(`/database/api/nodes/${node.id}`, { method: "PATCH", body: { name } });
+      toastOk("已重命名");
+      bumpTree();
+      currentNode.update((n) => (n ? { ...n, name } : n));
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function deleteNode(): Promise<void> {
+    if (node === null || !confirm(`确认删除「${node.name}」?软删除后不可见。`)) return;
+    try {
+      await api(`/database/api/nodes/${node.id}`, { method: "DELETE" });
+      toastOk("已删除");
+      currentNode.set(null);
+      bumpTree();
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+</script>
+
+{#if node === null}
+  <div class="flex h-full items-center justify-center text-[13px] text-ink-3">从左侧选择一个文件夹或项目</div>
+{:else}
+  <div class="mx-auto max-w-[880px] px-9 py-9">
+    <div class="mb-2 text-[12.5px] text-ink-3">
+      {#each crumbs as c, i (i)}
+        {#if i > 0}<span class="mx-1 text-line">/</span>{/if}
+        <span>{c.name ?? "…"}</span>
+      {/each}
+    </div>
+
+    <div class="mb-5 flex items-center justify-between">
+      <div class="flex items-center gap-2.5 text-[19px] font-semibold text-ink">
+        {node.name}
+        <span class="rounded-full border border-line-soft bg-panel px-2 py-0.5 font-mono text-[10.5px] text-ink-3">{node.kind === "PROJECT" ? "项目" : "文件夹"}</span>
+      </div>
+      <div class="flex gap-2">
+        {#if canEdit && node.kind === "FOLDER"}
+          <button class="rounded-lg border border-line bg-panel px-3 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreateChild = true)}>+ 新建</button>
+        {/if}
+        {#if canManage}
+          <button class="rounded-lg border border-line bg-panel px-3 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={renameNode}>重命名</button>
+          <button class="rounded-lg border border-transparent px-3 py-1.5 text-[12.5px] font-medium text-danger transition hover:bg-[#A13A3312]" onclick={deleteNode}>删除</button>
+        {/if}
+      </div>
+    </div>
+
+    {#if node.kind === "FOLDER"}
+      <div class="py-7 text-[13px] text-ink-3">点击左侧树展开以浏览子内容</div>
+    {:else}
+      <div class="mb-5 flex gap-1 border-b border-line-soft">
+        {#each [["detail", "概览"], ["files", "文件"]] as [id, label] (id)}
+          <button
+            class="border-b-2 px-3.5 py-2 text-[13px] transition {tab === id ? 'border-accent font-semibold text-ink' : 'border-transparent text-ink-3 hover:text-ink'}"
+            onclick={() => (tab = id as "detail" | "files")}
+          >{label}</button>
+        {/each}
+      </div>
+      {#if tab === "detail"}
+        <OverviewPanel {node} />
+      {:else}
+        <FilesPanel {node} />
+      {/if}
+    {/if}
+  </div>
+{/if}
+
+{#if showCreateChild && node}
+  <Modal title="新建子节点" onclose={() => (showCreateChild = false)}>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="child-name">名称</label>
+      <input id="child-name" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newName} placeholder="例如:物理必修一" />
+    </div>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="child-kind">类型</label>
+      <select id="child-kind" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] outline-none focus:border-accent" bind:value={newKind}>
+        <option value="FOLDER">文件夹</option>
+        <option value="PROJECT">项目(课程资源库)</option>
+      </select>
+    </div>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="child-desc">简介(可选)</label>
+      <textarea id="child-desc" rows="3" class="w-full rounded-lg border border-line bg-panel px-3 py-2 font-mono text-xs outline-none focus:border-accent" bind:value={newDesc} placeholder="简要说明用途…"></textarea>
+    </div>
+    <div class="mt-4 flex justify-end gap-2">
+      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showCreateChild = false)}>取消</button>
+      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={createChild}>创建</button>
+    </div>
+  </Modal>
+{/if}
@@ -0,0 +1,123 @@
+<script lang="ts">
+  import { api } from "./api.js";
+  import { toastOk, toastErr } from "./stores.js";
+  import { currentNode } from "./browser.js";
+  import type { ExportJob, NodeDetail } from "./types.js";
+  import Modal from "./Modal.svelte";
+
+  let { node }: { node: NodeDetail } = $props();
+
+  let showEditDesc = $state(false);
+  let descDraft = $state("");
+  let exportJob = $state<ExportJob | null>(null);
+
+  const canEdit = $derived(node.role === "MANAGE" || node.role === "EDIT");
+  const roleLabel = $derived(node.role === "MANAGE" ? "可管理" : node.role === "EDIT" ? "可编辑" : "只读");
+
+  $effect(() => {
+    void node.id;
+    exportJob = null;
+  });
+
+  function openEditDesc(): void {
+    descDraft = node.description ?? "";
+    showEditDesc = true;
+  }
+
+  async function saveDesc(): Promise<void> {
+    const description = descDraft.trim();
+    try {
+      await api(`/database/api/nodes/${node.id}`, {
+        method: "PATCH",
+        body: { description: description === "" ? null : description },
+      });
+      toastOk("简介已保存");
+      showEditDesc = false;
+      const next = description === "" ? null : description;
+      currentNode.update((n) => (n && n.id === node.id ? { ...n, description: next } : n));
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function submitExport(): Promise<void> {
+    try {
+      const r = await api<{ jobId: string; status: string }>(`/database/api/projects/${node.id}/exports`, {
+        method: "POST",
+        body: { target: "manifest" },
+      });
+      toastOk("导出已提交");
+      void pollExport(r.jobId);
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+
+  async function pollExport(jobId: string): Promise<void> {
+    for (;;) {
+      await new Promise((r) => setTimeout(r, 800));
+      try {
+        const job = await api<ExportJob>(`/database/api/exports/${jobId}`);
+        exportJob = job;
+        if (job.status === "DONE" || job.status === "FAILED") break;
+      } catch {
+        break;
+      }
+    }
+  }
+</script>
+
+<div class="rounded-xl border border-line-soft bg-panel p-5">
+  <div class="mb-4">
+    <div class="mb-1.5 text-[11.5px] text-ink-3">简介</div>
+    <div class="text-[13.5px] leading-7 text-ink">
+      {#if node.description}
+        {node.description}
+      {:else}
+        <span class="italic text-ink-3">暂无简介</span>
+      {/if}
+      {#if canEdit}
+        <button class="ml-2.5 rounded-lg border border-line bg-panel px-2.5 py-0.5 align-middle text-[11.5px] text-ink transition hover:bg-hover" onclick={openEditDesc}>编辑</button>
+      {/if}
+    </div>
+  </div>
+
+  <div class="my-4 border-t border-line-soft"></div>
+
+  <div class="flex flex-col gap-1.5 text-[13px] text-ink-2">
+    <div>我的角色 <b class="font-semibold text-ink">{roleLabel}</b></div>
+    <div>创建时间 <b class="font-semibold text-ink">{new Date(node.createdAt).toLocaleDateString("zh-CN", { year: "numeric", month: "long", day: "numeric" })}</b></div>
+    <div>最近修改 <b class="font-semibold text-ink">{new Date(node.updatedAt).toLocaleDateString("zh-CN", { year: "numeric", month: "long", day: "numeric" })}</b></div>
+  </div>
+
+  <div class="my-4 border-t border-line-soft"></div>
+
+  <div class="mb-2 text-[12.5px] font-semibold">导出</div>
+  <div class="flex items-center gap-2">
+    <button class="rounded-lg border border-line bg-panel px-3 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={submitExport}>开始导出</button>
+    {#if exportJob}
+      <span class="font-mono text-[11px] text-ink-3">
+        {#if exportJob.status === "DONE"}
+          完成 · <a class="text-accent underline" href="/database/api/exports/{exportJob.id}/download">下载</a>
+        {:else if exportJob.status === "FAILED"}
+          失败:{exportJob.error ?? ""}
+        {:else}
+          {exportJob.status}…
+        {/if}
+      </span>
+    {/if}
+  </div>
+</div>
+
+{#if showEditDesc}
+  <Modal title="编辑简介" onclose={() => (showEditDesc = false)}>
+    <div class="mb-3">
+      <label class="mb-1 block text-[11.5px] text-ink-3" for="desc-draft">简要说明这个项目的内容</label>
+      <textarea id="desc-draft" rows="5" class="w-full rounded-lg border border-line bg-panel px-3 py-2 text-[13px] leading-7 outline-none focus:border-accent" bind:value={descDraft} placeholder="例如:高中物理必修一第三章,表面张力相关内容……"></textarea>
+    </div>
+    <div class="mt-4 flex justify-end gap-2">
+      <button class="rounded-lg border border-line bg-panel px-3.5 py-1.5 text-[12.5px] font-medium text-ink transition hover:bg-hover" onclick={() => (showEditDesc = false)}>取消</button>
+      <button class="rounded-lg bg-accent px-3.5 py-1.5 text-[12.5px] font-medium text-white transition hover:bg-accent-hover" onclick={saveDesc}>保存</button>
+    </div>
+  </Modal>
+{/if}
@@ -0,0 +1,11 @@
+<script lang="ts">
+  import { toasts } from "./stores.js";
+</script>
+
+<div class="fixed bottom-4 right-4 z-50 flex flex-col gap-2">
+  {#each $toasts as t (t.id)}
+    <div class="max-w-[340px] rounded-lg px-4 py-2 text-sm text-white {t.kind === 'err' ? 'bg-[#7E2C26]' : 'bg-[#333230]'}">
+      {t.message}
+    </div>
+  {/each}
+</div>
@@ -0,0 +1,82 @@
+<script lang="ts">
+  import TreeNode from "./TreeNode.svelte";
+  import { api } from "./api.js";
+  import { expanded, currentNode, breadcrumb, toggleExpanded, treeVersion } from "./browser.js";
+  import { toastErr } from "./stores.js";
+  import type { BreadcrumbEntry, NodeChild, NodeDetail } from "./types.js";
+
+  let { node, depth }: { node: NodeChild; depth: number } = $props();
+
+  let children = $state<NodeChild[] | null>(null);
+  const isOpen = $derived($expanded.has(node.id));
+  const isSelected = $derived($currentNode?.id === node.id);
+
+  // 树刷新信号(增/删/移/重命名)→ 失效子节点缓存,展开状态下随之重载
+  $effect(() => {
+    void $treeVersion;
+    children = null;
+  });
+
+  $effect(() => {
+    if (isOpen && node.kind === "FOLDER" && children === null) {
+      api<{ nodes: NodeChild[] }>(`/database/api/nodes?parentId=${encodeURIComponent(node.id)}`)
+        .then((r) => (children = r.nodes))
+        .catch((e) => toastErr(e instanceof Error ? e.message : String(e)));
+    }
+  });
+
+  async function select(): Promise<void> {
+    if (node.kind === "FOLDER") toggleExpanded(node.id);
+    try {
+      const [detail, crumb] = await Promise.all([
+        api<{ node: NodeDetail }>(`/database/api/nodes/${node.id}`),
+        api<{ breadcrumb: BreadcrumbEntry[] }>(`/database/api/nodes/${node.id}/breadcrumb`),
+      ]);
+      currentNode.set(detail.node);
+      breadcrumb.set(crumb.breadcrumb);
+    } catch (e) {
+      toastErr(e instanceof Error ? e.message : String(e));
+    }
+  }
+</script>
+
+<div>
+  <div
+    class="tree-item flex cursor-pointer items-center gap-1 rounded-lg px-1.5 py-1.5 select-none {isSelected ? 'bg-selected' : 'hover:bg-hover'}"
+    role="button"
+    tabindex="0"
+    onclick={select}
+    onkeydown={(e) => e.key === "Enter" && select()}
+  >
+    <span class="flex h-4 w-4 shrink-0 items-center justify-center text-ink-3">
+      {#if node.kind === "FOLDER"}
+        <svg width="9" height="9" viewBox="0 0 24 24" fill="currentColor">
+          {#if isOpen}<path d="M6 9l6 6 6-6z" />{:else}<path d="M9 6l6 6-6 6z" />{/if}
+        </svg>
+      {/if}
+    </span>
+    <span class="flex h-4 w-4 shrink-0 items-center justify-center {node.kind === 'PROJECT' ? 'text-ink' : 'text-ink-3'}">
+      {#if node.kind === "PROJECT"}
+        <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M20 7l-8-4-8 4m16 0l-8 4m8-4v10l-8 4m0-10L4 7m8 4v10M4 7v10l8 4" /></svg>
+      {:else}
+        <svg width="16" height="16" viewBox="0 0 24 24" fill="currentColor"><path d="M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V7Z" /></svg>
+      {/if}
+    </span>
+    <span class="truncate">{node.name}</span>
+    {#if node.role !== "MANAGE"}
+      <span class="ml-auto pr-1 font-mono text-[10px] text-ink-3">{node.role}</span>
+    {/if}
+  </div>
+
+  {#if node.kind === "FOLDER" && isOpen}
+    <div class="ml-[15px] border-l border-guide pl-1">
+      {#if children === null}
+        <div class="px-3 py-1.5 text-xs text-ink-3">…</div>
+      {:else}
+        {#each children as child (child.id)}
+          <TreeNode node={child} depth={depth + 1} />
+        {/each}
+      {/if}
+    </div>
+  {/if}
+</div>
@@ -0,0 +1,49 @@
+/** 与 /database/api/* 的约定一致;401 时清空会话(回到登录视图)。 */
+
+import { me } from "./stores.js";
+
+export class ApiError extends Error {
+  constructor(
+    readonly status: number,
+    readonly code: string,
+    message: string,
+    readonly details?: Record<string, unknown>,
+  ) {
+    super(message);
+    this.name = "ApiError";
+  }
+}
+
+export class UnauthenticatedError extends Error {
+  constructor() {
+    super("unauthenticated");
+    this.name = "UnauthenticatedError";
+  }
+}
+
+interface RequestOpts {
+  readonly method?: string;
+  readonly body?: unknown;
+}
+
+export async function api<T = unknown>(path: string, opts: RequestOpts = {}): Promise<T> {
+  const res = await fetch(path, {
+    credentials: "same-origin",
+    method: opts.method ?? "GET",
+    ...(opts.body !== undefined
+      ? { headers: { "Content-Type": "application/json" }, body: JSON.stringify(opts.body) }
+      : {}),
+  });
+  if (res.status === 401) {
+    me.set(null);
+    throw new UnauthenticatedError();
+  }
+  if (res.status === 204) return null as T;
+  const text = await res.text();
+  const data = text === "" ? null : (JSON.parse(text) as unknown);
+  if (!res.ok) {
+    const err = (data as { error?: { code?: string; message?: string } } | null)?.error ?? {};
+    throw new ApiError(res.status, err.code ?? "unknown", err.message ?? res.statusText, err as Record<string, unknown>);
+  }
+  return data as T;
+}
@@ -0,0 +1,34 @@
+import { writable } from "svelte/store";
+import type { BreadcrumbEntry, NodeDetail } from "./types.js";
+
+/** 树展开集合 / 当前选中节点 / 面包屑 / 树刷新计数。 */
+export const expanded = writable<Set<string>>(new Set());
+export const currentNode = writable<NodeDetail | null>(null);
+export const breadcrumb = writable<BreadcrumbEntry[]>([]);
+export const treeVersion = writable(0);
+
+/** 右侧预览栏:当前选中文件路径(项目内);切换节点时清空。 */
+export const selectedFilePath = writable<string | null>(null);
+/** 文件列表刷新计数(编辑器保存/删除后 bump,列表随之重载)。 */
+export const filesVersion = writable(0);
+
+export function bumpTree(): void {
+  treeVersion.update((v) => v + 1);
+}
+
+export function bumpFiles(): void {
+  filesVersion.update((v) => v + 1);
+}
+
+export function clearSelectedFile(): void {
+  selectedFilePath.set(null);
+}
+
+export function toggleExpanded(id: string): void {
+  expanded.update((set) => {
+    const next = new Set(set);
+    if (next.has(id)) next.delete(id);
+    else next.add(id);
+    return next;
+  });
+}
@@ -0,0 +1,26 @@
+import { writable } from "svelte/store";
+import type { MeResponse } from "./types.js";
+
+/** 当前登录身份;null = 未登录(显示登录视图)。 */
+export const me = writable<MeResponse | null>(null);
+export const authChecked = writable(false);
+
+export interface ToastItem {
+  readonly id: number;
+  readonly message: string;
+  readonly kind: "info" | "err";
+}
+
+let nextToastId = 1;
+export const toasts = writable<ToastItem[]>([]);
+
+export function toast(message: string, kind: ToastItem["kind"] = "info"): void {
+  const id = nextToastId++;
+  toasts.update((list) => [...list, { id, message, kind }]);
+  setTimeout(() => {
+    toasts.update((list) => list.filter((t) => t.id !== id));
+  }, 3600);
+}
+
+export const toastOk = (m: string): void => toast(m, "info");
+export const toastErr = (m: string): void => toast(m, "err");
@@ -0,0 +1,100 @@
+/** 与后端 /database/api/* 响应形状对齐。 */
+
+export type NodeKind = "FOLDER" | "PROJECT";
+export type Role = "VIEW" | "EDIT" | "MANAGE";
+
+export interface NodeChild {
+  readonly id: string;
+  readonly parentId: string | null;
+  readonly kind: NodeKind;
+  readonly name: string;
+  readonly role: Role;
+  readonly createdAt: string;
+  readonly updatedAt: string;
+}
+
+export interface BreadcrumbEntry {
+  readonly depth: number;
+  readonly id: string | null;
+  readonly name: string | null;
+  readonly kind: NodeKind;
+}
+
+export interface NodeDetail {
+  readonly id: string;
+  readonly parentId: string | null;
+  readonly kind: NodeKind;
+  readonly name: string;
+  readonly description: string | null;
+  readonly role: Role;
+  readonly provisionStatus: "PROVISIONING" | "READY" | "FAILED";
+  readonly independentPermission: boolean;
+  readonly createdAt: string;
+  readonly updatedAt: string;
+}
+
+export interface MeResponse {
+  readonly userId: string;
+  readonly isWebsiteAdmin: boolean;
+}
+
+export interface FileEntry {
+  readonly path: string;
+  readonly size: number;
+}
+
+export type FileContentEncoding = "utf8" | "base64";
+
+export interface FileContent {
+  readonly path: string;
+  readonly version: string;
+  readonly encoding: FileContentEncoding;
+  readonly content: string;
+  readonly size: number;
+}
+
+export interface VersionInfo {
+  readonly version: string;
+  readonly message: string;
+  readonly author?: string;
+  readonly committedAt: string;
+}
+
+export interface ExportJob {
+  readonly id: string;
+  readonly nodeId: string;
+  readonly target: string;
+  readonly status: "QUEUED" | "RUNNING" | "DONE" | "FAILED";
+  readonly error: string | null;
+  readonly createdAt: string;
+}
+
+export interface Grant {
+  readonly id: string;
+  readonly principalType: "USER" | "GROUP";
+  readonly principalId: string;
+  readonly role: Role;
+  readonly isCreatorGrant: boolean;
+  readonly createdAt: string;
+}
+
+export interface GroupSearchResult {
+  readonly id: string;
+  readonly name: string;
+  readonly breadcrumb: string;
+}
+
+/** 成员组(ADR-0028);后端返回扁平列表,前端按 parentId/depth 拼树。 */
+export interface MemberGroupNode {
+  readonly id: string;
+  readonly parentId: string | null;
+  readonly name: string;
+  readonly description: string | null;
+  readonly depth: number;
+  readonly memberCount: number;
+}
+
+export interface MemberGroupMember {
+  readonly userId: string;
+  readonly displayName: string;
+}
@@ -0,0 +1,5 @@
+import { mount } from "svelte";
+import App from "./App.svelte";
+import "./app.css";
+
+export default mount(App, { target: document.getElementById("app")! });
@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "exactOptionalPropertyTypes": true,
+    "verbatimModuleSyntax": true,
+    "skipLibCheck": true,
+    "isolatedModules": true,
+    "resolveJsonModule": true,
+    "useDefineForClassFields": true,
+    "lib": ["ES2022", "DOM", "DOM.Iterable"]
+  },
+  "include": ["src/**/*.ts", "src/**/*.svelte"]
+}
@@ -0,0 +1,25 @@
+import { defineConfig } from "vite";
+import { svelte } from "@sveltejs/vite-plugin-svelte";
+import tailwindcss from "@tailwindcss/vite";
+
+// 老师端独立 SPA:构建产物由 hub 后端静态托管于 /app;
+// 开发时 vite dev(:5173)把 API/认证请求代理到后端(:8788)。
+const backend = "http://127.0.0.1:8788";
+
+export default defineConfig({
+  plugins: [svelte(), tailwindcss()],
+  base: "/app/",
+  build: {
+    outDir: "dist",
+    emptyOutDir: true,
+  },
+  server: {
+    port: 5173,
+    proxy: {
+      "/database/api": backend,
+      "/auth": backend,
+      "/app/dev-login": backend,
+      "/app/dev-login-teacher": backend,
+    },
+  },
+});
@@ -1,18 +1,19 @@
 {
  "name": "@paradigm/hub",
-  "version": "0.0.34",
+  "version": "0.0.36",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@paradigm/hub",
-      "version": "0.0.34",
+      "version": "0.0.36",
      "dependencies": {
        "@alicloud/credentials": "^2.4.5",
        "@alicloud/docmind-api20220711": "^1.4.15",
        "@alicloud/tea-util": "^1.4.11",
        "@anthropic-ai/claude-agent-sdk": "^0.3.202",
        "@fastify/cookie": "^11.0.2",
+        "@fastify/static": "^10.1.2",
        "@larksuiteoapi/node-sdk": "^1.70.0",
        "@prisma/client": "^6.19.3",
        "ai": "^7.0.16",
@@ -902,6 +903,22 @@
        "node": ">=18"
      }
    },
+    "node_modules/@fastify/accept-negotiator": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/@fastify/accept-negotiator/-/accept-negotiator-2.0.1.tgz",
+      "integrity": "sha512-/c/TW2bO/v9JeEgoD/g1G5GxGeCF1Hafdf79WPmUlgYiBXummY0oX3VVq4yFkKKVBKDNlaDUYoab7g38RpPqCQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
    "node_modules/@fastify/ajv-compiler": {
      "version": "4.0.5",
      "resolved": "https://registry.npmjs.org/@fastify/ajv-compiler/-/ajv-compiler-4.0.5.tgz",
@@ -1033,6 +1050,83 @@
        "ipaddr.js": "^2.1.0"
      }
    },
+    "node_modules/@fastify/send": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/@fastify/send/-/send-4.1.0.tgz",
+      "integrity": "sha512-TMYeQLCBSy2TOFmV95hQWkiTYgC/SEx7vMdV+wnZVX4tt8VBLKzmH8vV9OzJehV0+XBfg+WxPMt5wp+JBUKsVw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@lukeed/ms": "^2.0.2",
+        "escape-html": "~1.0.3",
+        "fast-decode-uri-component": "^1.0.1",
+        "http-errors": "^2.0.0",
+        "mime": "^3"
+      }
+    },
+    "node_modules/@fastify/static": {
+      "version": "10.1.2",
+      "resolved": "https://registry.npmjs.org/@fastify/static/-/static-10.1.2.tgz",
+      "integrity": "sha512-G/g18cG9tLutT/OVyN1AIsHIl9L1UwmJ+S3dkyhVpplIx0nEMicd7RGQ+uJLyhKKF4a3tTcQydccn3Mop1fX+Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@fastify/accept-negotiator": "^2.0.0",
+        "@fastify/error": "^4.0.0",
+        "@fastify/send": "^4.0.0",
+        "content-disposition": "^2.0.1",
+        "fastify-plugin": "^6.0.0",
+        "fastq": "^1.17.1",
+        "glob": "^13.0.0"
+      }
+    },
+    "node_modules/@fastify/static/node_modules/content-disposition": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-2.0.1.tgz",
+      "integrity": "sha512-e+H0ZXHSWYrENhQzw1LPuP4oF5MzVKmDU6d3hxlvaPEYLLg62MxtQNPRx4SYSuYJSBUgnQIG4HIN2tEtNv7Dog==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/@fastify/static/node_modules/fastify-plugin": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz",
+      "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
    "node_modules/@hono/node-server": {
      "version": "1.19.14",
      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz",
@@ -1068,6 +1162,15 @@
        "ws": "^8.19.0"
      }
    },
+    "node_modules/@lukeed/ms": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@lukeed/ms/-/ms-2.0.2.tgz",
+      "integrity": "sha512-9I2Zn6+NJLfaGoz9jN3lpwDgAYvfGeNYdbAIjJOqzs4Tpc+VU3Jqq4IofSUBKajiDS8k9fZIg18/z13mpk1bsA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
    "node_modules/@modelcontextprotocol/sdk": {
      "version": "1.29.0",
      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.29.0.tgz",
@@ -1934,6 +2037,15 @@
        "proxy-from-env": "^2.1.0"
      }
    },
+    "node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
    "node_modules/body-parser": {
      "version": "2.3.0",
      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
@@ -1973,6 +2085,18 @@
        "url": "https://opencollective.com/express"
      }
    },
+    "node_modules/brace-expansion": {
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
    "node_modules/bytes": {
      "version": "3.1.2",
      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
@@ -2254,7 +2378,6 @@
      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
      "license": "MIT",
-      "peer": true,
      "engines": {
        "node": ">= 0.8"
      }
@@ -2447,8 +2570,7 @@
      "version": "1.0.3",
      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
    },
    "node_modules/estree-walker": {
      "version": "3.0.3",
@@ -2947,6 +3069,23 @@
        "giget": "dist/cli.mjs"
      }
    },
+    "node_modules/glob": {
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
    "node_modules/gopd": {
      "version": "1.2.0",
      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
@@ -3013,7 +3152,6 @@
      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "depd": "~2.0.0",
        "inherits": "~2.0.4",
@@ -3096,8 +3234,7 @@
      "version": "2.0.4",
      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "license": "ISC",
-      "peer": true
+      "license": "ISC"
    },
    "node_modules/ini": {
      "version": "1.3.8",
@@ -3546,6 +3683,15 @@
      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
      "license": "Apache-2.0"
    },
+    "node_modules/lru-cache": {
+      "version": "11.5.2",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
+      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
    "node_modules/magic-string": {
      "version": "0.30.21",
      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
@@ -3588,6 +3734,18 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
+    "node_modules/mime": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-3.0.0.tgz",
+      "integrity": "sha512-jSCU7/VB1loIWBZe14aEYHU/+1UMEHoaO7qxCOVJOw9GgH72VAWppxNcjU+x9a2k3GSIBXNKxXQFqRvvZ7vr3A==",
+      "license": "MIT",
+      "bin": {
+        "mime": "cli.js"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
    "node_modules/mime-db": {
      "version": "1.52.0",
      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
@@ -3609,6 +3767,30 @@
        "node": ">= 0.6"
      }
    },
+    "node_modules/minimatch": {
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.5"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
    "node_modules/moment": {
      "version": "2.30.1",
      "resolved": "https://registry.npmjs.org/moment/-/moment-2.30.1.tgz",
@@ -3792,6 +3974,22 @@
        "node": ">=8"
      }
    },
+    "node_modules/path-scurry": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
    "node_modules/path-to-regexp": {
      "version": "8.4.2",
      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz",
@@ -4370,8 +4568,7 @@
      "version": "1.2.0",
      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
-      "license": "ISC",
-      "peer": true
+      "license": "ISC"
    },
    "node_modules/shebang-command": {
      "version": "2.0.0",
@@ -4570,7 +4767,6 @@
      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
      "license": "MIT",
-      "peer": true,
      "engines": {
        "node": ">= 0.8"
      }
@@ -4658,7 +4854,6 @@
      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
      "license": "MIT",
-      "peer": true,
      "engines": {
        "node": ">=0.6"
      }
@@ -1,6 +1,6 @@
 {
  "name": "@paradigm/hub",
-  "version": "0.0.34",
+  "version": "0.0.36",
  "private": true,
  "type": "module",
  "engines": {
@@ -12,6 +12,7 @@
    "@alicloud/tea-util": "^1.4.11",
    "@anthropic-ai/claude-agent-sdk": "^0.3.202",
    "@fastify/cookie": "^11.0.2",
+    "@fastify/static": "^10.1.2",
    "@larksuiteoapi/node-sdk": "^1.70.0",
    "@prisma/client": "^6.19.3",
    "ai": "^7.0.16",
@@ -30,10 +31,10 @@
      "axios": "1.18.1"
    }
  },
-  "description": "Curriculum Project Hub — org-scoped Feishu collaboration and confined Agent runtime. Aligns to spec/System through ADR-0024.",
+  "description": "Curriculum Project Hub — org-scoped Feishu collaboration and confined Agent runtime. Semantics pinned by docs/adr/ (ADR-0001 through ADR-0027).",
  "scripts": {
    "dev": "npm run prisma:migrate && tsx watch src/server.ts",
-    "build": "tsc -p tsconfig.json && npm run admin:build",
+    "build": "tsc -p tsconfig.json && npm run admin:build && npm run filelib:build",
    "start": "npm run prisma:migrate && node dist/server.js",
    "check": "tsc -p tsconfig.json --noEmit",
    "audit:production": "npm audit --omit=dev --audit-level=high",
@@ -48,6 +49,8 @@
    "test": "vitest run",
    "test:watch": "vitest",
    "admin:dev": "npm run dev --prefix admin-web",
-    "admin:build": "npm run build --prefix admin-web"
+    "admin:build": "npm run build --prefix admin-web",
+    "filelib:dev": "npm run dev --prefix filelib-web",
+    "filelib:build": "npm run build --prefix filelib-web"
  }
 }
@@ -1,6 +1,6 @@
 -- ADR-0023 rejected the legacy `PlatformRoleAssignment` / `PlatformRole`{ADMIN,TEACHER}
 -- model: the platform administration control plane is a separate identity/session/
-- audit surface (see `Spec.System.PlatformAdministration`), intentionally not built
+-- audit surface, intentionally not built
 -- in alpha (ADR-0025, `hub/deploy/README.md`). The legacy table has no runtime
 -- reader — no guard, route, or service queries it for an authorization decision —
 -- and ADR-0023 requires it to be migrated/replaced before the platform panel ships.
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
白	11a7ec8004	feat(database): 后台成员组(MemberGroup)管理与嵌套解析	2026-07-26 18:06:18 +08:00
白	2f2ece1a3a	fix(database): expose submitCreate on window.__lib in library browser 新建根目录/子节点弹窗的「创建」按钮 onclick 调 window.__lib.submitCreate, 但该函数虽已定义却漏挂到 __lib 导出表,导致点击报 "submitCreate is not a function"。补挂即可。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-26 16:39:38 +08:00
白	58c81d4379	Merge remote-tracking branch 'origin/main' into feat/member-group-hierarchy	2026-07-24 00:00:50 +08:00
bai	d16bd4899d	Merge pull request 'feat(database): init database folder frontend and permission' (#1 ) from maoyuanyang/curriculum-project-hub:main into main Reviewed-on: #1	2026-07-23 23:44:17 +08:00
ymy	4021e58d5d	feat(database): init database folder frontend and permission	2026-07-23 23:41:11 +08:00
白	192cd43245	feat(hub): add global nestable member group hierarchy Global, unlimited-depth member groups managed by the platform super admin (requirement 3.1-3.3). Stores membership + nesting only, never permission data; exposes user -> ancestor-closed group set. - MemberGroup: soft delete via archivedAt; parentId FK RESTRICT. Deleting a group cascade-soft-deletes its whole subtree as an application operation, not a DB cascade. - MemberGroupMembership: user<->group many-to-many, revokedAt soft delete, user/group indexed for resolution hot path. - MemberGroupClosure: transitive closure (depth-0 self rows) for one-join ancestor/descendant resolution; maintained on create/reparent with a cycle guard. Permission side (GROUP principal, FOLDER resource, grant inheritance) is deferred. This principal is deliberately not org-scoped and will need ADR-0028 to supersede the ADR-0020 cross-org invariant before the GROUP principal ships. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-23 22:31:26 +08:00
白	12628c9233	feat(hub): migrate database admin pages to SPA (database-admin) - scaffold hub/database-admin as SvelteKit 2 + Svelte 5 static SPA with aurora/glass visual style (paths.base='/database') - add lib/{api,session,org}.ts + Aurora.svelte component - add routes: root redirect, /admin login page, /dashboard (OWNER/ADMIN only) - backend: replace server-rendered HTML routes with /database/config JSON endpoint - add hub/src/database/static.ts to serve SPA under /database/* - wire registerDatabaseSpa into plugin.ts - exempt /database/* from silo rate-limit (same treatment as /admin/*) - add database:dev + database:build npm scripts; update deploy scripts - update hub/src/database/README.md Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-23 21:51:53 +08:00
白	5df1900ca8	docs(hub): document HUB_DEV_LOGIN_BYPASS dev login in database README Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-20 21:09:14 +08:00
白	df66691d24	feat(hub): add /database admin surface with Feishu login Adds a self-contained `/database/` HTTP surface under hub/src/database: - /database/admin: Feishu-only login page (Tailwind, light theme) - /database/dashboard: session-gated sidebar + content shell - /database/dev-login: DEV ONLY session bypass, double-gated by NODE_ENV != production AND HUB_DEV_LOGIN_BYPASS; never active in prod hub.ts mounts the plugin after the admin plugin so the cookie parser and /auth/feishu/ routes are available. The dev bypass logic is fully contained in the database module; admin auth routes are untouched. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-20 21:02:04 +08:00
hongjr03	73cb0e5b47	feat(hub): embed agent images via Feishu upload + release v0.0.36 (#14 ) feat(hub): embed agent images via Feishu upload + release v0.0.36 Merge pull request #14	2026-07-20 18:42:38 +08:00
hongjr03	e21096c642	feat(hub): embed agent images via Feishu upload + release v0.0.36 Materialize markdown image refs on agent finish: fetch/read bytes, upload im.v1.image, and render native card img elements so remote image URLs no longer trip Feishu content-security. Stream masks image URLs mid-run; card failure falls back to plain text plus standalone image messages. Docs: clarify im:resource covers outbound Agent image send.	2026-07-20 10:40:03 +00:00
hongjr03	dc2d1c2f9e	Merge pull request 'chore: remove Lean spec; ADRs are the single source of truth' (#13 ) from chore/remove-lean-spec into main Reviewed-on: EduCraft/curriculum-project-hub#13	2026-07-20 17:21:14 +08:00
hongjr03	3f9b60f692	chore: remove Lean spec; ADRs are the single source of truth The spec/ Lean semantic master had no conformance gate, no codegen, and no CI tie to implementations — alignment was carried entirely by human review, the same mechanism that carries the ADRs. In practice the ADRs plus greppable code comments were already the load-bearing artifacts, so spec/ was the most expensive kind of stale documentation. - delete spec/ and the spec-check CI workflow - README: constitution rewritten around ADRs as decision truth - AGENTS.md/CLAUDE.md: discipline re-anchored (new decisions -> new ADR, never rewrite ADR history; supersede instead) - code comments: re-anchor 'Mirrors Spec.X' invariants to ADR numbers (cph-diag, cph-check, cph-model, hub runner/capacity/org, prisma) - leave ADR bodies and .scratch audit snapshots untouched (history); fix live references in open readiness tickets	2026-07-20 09:07:26 +00:00
hongjr03	4234ba4c96	Merge pull request 'fix(hub): mark bootstrap Inbox as SYSTEM_INBOX' (#12 ) from fix/hub-bootstrap-system-inbox into main	2026-07-19 20:16:09 +08:00
hongjr03	15f9443d3d	fix(hub): mark bootstrap Inbox as SYSTEM_INBOX Alpha silo bootstrap created the root Inbox without kind=SYSTEM_INBOX, so Feishu card project creation tried to insert a second Inbox and hit the sibling-name unique index. Tag the bootstrap folder correctly and promote any legacy root Inbox on ensure.	2026-07-19 20:08:44 +08:00
hongjr03	7f09fb1f13	feat(hub): drop redundant /admin/org/:slug path + release v0.0.35 (#11 ) Silo hostname already carries tenancy. Admin SPA routes become /admin/..., legacy bookmarks redirect, login lands on /admin. Co-authored-by: Hong Jiarong <me@jrhim.com> Co-committed-by: Hong Jiarong <me@jrhim.com>	2026-07-19 01:36:10 +08:00