@givolt/i3-composer-agent 2.2.3 → 2.3.0

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/pbc/managementStore.js

@@ -0,0 +1,49 @@
+import { useDeliveryView } from "../shared/deliveryView.js";
+import { computed } from '../../runtime/state.js';
+import { defineStore } from "../../runtime/state.js";
+import { usePbcs } from "./store.js";
+import { useSession } from "../shared/session.js";
+import { useSpecs } from "../specs/store.js";
+import { useIntents } from "../intents/store.js";
+import { taskRecords } from "../tasks/registry.js";
+import { agentRecords } from "../agents/registry.js";
+import { flowRecords, flowUses } from "../workflows/registry.js";
+import { assertBatch } from "../shared/listBatch.js";
+import { stateOf, assertPbcRemovable, assertServiceRemovable, revisePbc, reviseService, requireReason } from "./management.js";
+export const usePbcManagement = defineStore('pbc-management', () => {
+    const pbcs = usePbcs(), session = useSession(), specs = useSpecs(), intents = useIntents();
+    const records = computed(() => pbcs.items), item = (id) => records.value.find(p => p.id === id);
+    const { candidates } = useDeliveryView();
+    const newSources = computed(() => candidates.value.filter(s => s.guide.create));
+    function references(p) {
+        return [
+            ...pbcs.jobs.filter(j => j.pbc.id === p.id).map(() => '需求归属'),
+            ...taskRecords.value.filter(t => !t.isDeleted && t.binding.pbcId === p.id).map(() => '交付任务'),
+            ...agentRecords.value.filter(a => !a.isDeleted && a.pbcId === p.id).map(() => 'Agent'),
+            ...flowRecords.value.filter(f => !f.isDeleted && f.pbcId === p.id).map(() => '流程模板'),
+            ...flowUses.value.filter(f => f.pbcId === p.id).map(() => '模板交接记录'),
+        ];
+    }
+    function current(id, action, version, fresh = false) { if (fresh)
+        pbcs.refreshLatest(); const p = item(id); if (!p)
+        throw Error('PBC 不存在或无权访问。'); session.require('pbc:view', p.tenantId, p.id); session.require(action, p.tenantId, p.id); if (version !== undefined && version !== p.recordVersion)
+        throw Error('PBC 记录已更新，请重新打开核对。'); return p; }
+    function event(p, action, reason, before, after) { return { id: crypto.randomUUID(), pbcId: p.id, tenantId: p.tenantId, actor: session.actor.name, at: new Date().toISOString(), action, reason, before: JSON.stringify(before, null, 2), after: JSON.stringify(after, null, 2) }; }
+    function persist(next, e) { session.writeCheck(); pbcs.saveManagement(pbcs.catalog.map(p => p.id === next.id ? next : p), [e]); return next; }
+    function save(id, version, input, reason) { requireReason(reason); const p = current(id, 'pbc:edit', version, true); if (pbcs.catalog.some(q => !q.isDeleted && q.id !== id && q.tenantId === p.tenantId && q.name === input.name.trim()))
+        throw Error('同一租户下 PBC 名称不能重复。'); const n = revisePbc(p, input, session.actor, new Date().toISOString()); const fields = (x) => ({ name: x.name, ebc: x.ebc, owner: x.owner, description: x.description || '', recordVersion: x.recordVersion }); return persist(n, event(p, '修改基础资料', reason, fields(p), fields(n))); }
+    function archive(id, version, reason) { requireReason(reason); const p = current(id, 'pbc:archive', version, true), active = stateOf(p) === 'active'; if (active && (taskRecords.value.some(t => !t.isDeleted && t.binding.pbcId === id) || pbcs.jobs.some(j => j.pbc.id === id && j.status !== 'done') || agentRecords.value.some(a => !a.isDeleted && a.pbcId === id && a.enabled) || flowRecords.value.some(f => !f.isDeleted && f.pbcId === id && f.enabled)))
+        throw Error('仍有交付任务、在途创建或启用资源，请处理后再归档。'); const n = { ...p, state: active ? 'archived' : 'active', recordVersion: p.recordVersion + 1, updatedAt: new Date().toISOString(), updatedBy: session.actor.name }; return persist(n, event(p, active ? '归档 PBC' : '恢复 PBC', reason, { state: stateOf(p), version: p.recordVersion }, { state: n.state, version: n.recordVersion })); }
+    function checkRemove(t) { const p = current(t.id, 'pbc:delete', t.recordVersion); assertPbcRemovable(p, references(p)); }
+    function removeMany(targets) { pbcs.refreshLatest(); const selected = assertBatch(pbcs.catalog, targets, p => { session.require('pbc:view', p.tenantId, p.id); session.require('pbc:delete', p.tenantId, p.id); assertPbcRemovable(p, references(p)); }), ids = new Set(selected.map(p => p.id)), at = new Date().toISOString(); session.writeCheck(); pbcs.saveManagement(pbcs.catalog.map(p => ids.has(p.id) ? { ...p, isDeleted: true, recordVersion: p.recordVersion + 1, updatedBy: session.actor.name, updatedAt: at } : p), selected.map(p => event(p, '删除 PBC', '已核对归档状态及无工程/引用；批量 ' + ids.size + ' 项', { deleted: false }, { deleted: true }))); }
+    function serviceSave(id, version, serviceId, input, reason) { requireReason(reason); const p = current(id, 'pbc:service', version, true), old = serviceId ? p.services.find(s => s.id === serviceId && !s.isDeleted) : undefined; if (serviceId && !old)
+        throw Error('服务记录已不存在。'); if (input.sourceIntentId && !pbcs.jobs.some(j => j.intentId === input.sourceIntentId && j.pbc.id === id && j.status === 'done' && session.can('spec:view', j.tenantId)))
+        throw Error('需求依据不可访问或不属于当前 PBC。'); const s = reviseService(p, old, input, session.actor, new Date().toISOString()), n = { ...p, services: old ? p.services.map(x => x.id === s.id ? s : x) : [s, ...p.services], recordVersion: p.recordVersion + 1, updatedBy: session.actor.name, updatedAt: new Date().toISOString() }; return persist(n, event(p, old ? '修改服务资料' : '新增服务方案', reason, old || {}, s)); }
+    function serviceCheck(id, t) { const p = current(id, 'pbc:service'), s = p.services.find(s => !s.isDeleted && s.id === t.id); if (!s)
+        throw Error('服务已不存在。'); if (s.recordVersion !== t.recordVersion)
+        throw Error('服务已更新，请重新核对。'); assertServiceRemovable(p, s); }
+    function serviceRemove(id, version, targets) { const p = current(id, 'pbc:service', version, true); const selected = assertBatch(p.services, targets, s => assertServiceRemovable(p, s)); const ids = new Set(selected.map(s => s.id)), at = new Date().toISOString(), n = { ...p, services: p.services.map(s => ids.has(s.id) ? { ...s, isDeleted: true, recordVersion: s.recordVersion + 1, updatedAt: at, updatedBy: session.actor.name } : s), recordVersion: p.recordVersion + 1, updatedAt: at, updatedBy: session.actor.name }; session.writeCheck(); pbcs.saveManagement(pbcs.catalog.map(x => x.id === id ? n : x), selected.map(s => event(p, '删除服务方案', '已核对未登记工程；批量 ' + ids.size + ' 项', s, { id: s.id, isDeleted: true }))); }
+    const jobsFor = (id) => pbcs.jobs.filter(j => j.pbc.id === id && item(id) && session.can('intent:view', j.tenantId) && session.can('spec:view', j.tenantId));
+    const eventsFor = (id) => { const p = item(id); return p && session.can('pbc:audit', p.tenantId, id) ? pbcs.managementAudit.filter(e => e.pbcId === id && e.tenantId === p.tenantId) : []; };
+    return { records, item, newSources, save, archive, checkRemove, removeMany, serviceSave, serviceCheck, serviceRemove, jobsFor, eventsFor };
+});

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/pbc/store.js

@@ -0,0 +1,132 @@
+import { computed, ref } from '../../runtime/state.js';
+import { seedTaskJobs } from "../tasks/exampleSource.js";
+import { defineStore } from "../../runtime/state.js";
+import { useSession } from "../shared/session.js";
+import { useIntents } from "../intents/store.js";
+import { useSpecs } from "../specs/store.js";
+import { clone } from "../specs/domain.js";
+import { seedPbcs } from "./data.js";
+import { activeStep, makeJob, newDraft, queryReceipt, validateDraft, assertBinding } from "./domain.js";
+import { assertActive } from "./management.js";
+const key = 'i3-prototype-antdv-pbc-v010', now = () => new Date().toISOString();
+export const usePbcs = defineStore('pbcs', () => {
+    const session = useSession(), intents = useIntents(), specs = useSpecs(), catalog = ref(seedPbcs()), drafts = ref([]), jobs = ref(seedTaskJobs()), notice = ref(''), mode = ref('success'), scene = ref('normal');
+    const managementAudit = ref([]);
+    let epoch = 0;
+    try {
+        const saved = JSON.parse(localStorage.getItem(key) || 'null');
+        if (saved) {
+            catalog.value = saved.catalog;
+            drafts.value = saved.drafts;
+            managementAudit.value = saved.audit || [];
+            jobs.value = saved.jobs.map((j) => ({ ...j, status: j.status === 'running' ? 'unknown' : j.status, steps: j.steps.map(s => ({ ...s, state: s.state === 'running' ? 'unknown' : s.state })) }));
+        }
+    }
+    catch {
+        notice.value = '本地归属数据无法读取，已加载初始目录。';
+    }
+    const items = computed(() => catalog.value.filter(p => !p.isDeleted && session.readable('pbc:view', p.tenantId, p.id)));
+    const job = (id) => jobs.value.find(j => j.intentId === id && session.readable('pbc:view', j.tenantId, j.pbc.id));
+    function persist(nextCatalog = catalog.value, nextDrafts = drafts.value, nextJobs = jobs.value, nextAudit = managementAudit.value) { try {
+        localStorage.setItem(key, JSON.stringify({ catalog: nextCatalog, drafts: nextDrafts, jobs: nextJobs, audit: nextAudit }));
+    }
+    catch {
+        throw Error('浏览器保存失败，操作未提交，请重试。');
+    } catalog.value = nextCatalog; drafts.value = nextDrafts; jobs.value = nextJobs; managementAudit.value = nextAudit; }
+    function update(j, text) { const next = { ...clone(j), recordVersion: j.recordVersion + 1, updatedAt: now(), updatedBy: session.actor.name, events: [...j.events, { at: now(), actor: session.actor.name, text }] }; persist(catalog.value, drafts.value, jobs.value.map(old => old.id === j.id ? next : old)); return next; }
+    function draft(id) { const i = intents.get(id); if (!i)
+        throw Error('没有来源意图权限。'); session.require('pbc:create', i.tenantId); return clone(drafts.value.find(d => d.intentId === id) || newDraft(i, session.actor, now())); }
+    function saveDraft(d) { session.require('pbc:create', d.tenantId); if (jobs.value.some(j => j.intentId === d.intentId))
+        throw Error('该意图已提交归属；已提交内容只读。'); session.writeCheck(); const old = drafts.value.find(v => v.id === d.id); if (old && old.recordVersion !== d.recordVersion)
+        throw Error('草稿已更新，请重新打开核对。'); const next = { ...clone(d), recordVersion: d.recordVersion + 1, updatedAt: now(), updatedBy: session.actor.name }; persist(catalog.value, [next, ...drafts.value.filter(v => v.id !== d.id)]); return clone(next); }
+    function sources(id, binding) { const i = intents.get(id), s = specs.get(id); if (!i || !s)
+        throw Error('意图或规格不可访问。'); if (jobs.value.some(j => j.intentId === id))
+        throw Error('此意图已有归属请求，请查看原请求结果，避免重复创建。'); assertBinding(i, s, binding); return { i, s }; }
+    async function start(id, target, d, binding) { const { i, s } = sources(id, binding); session.require(d ? 'pbc:create' : 'pbc:link', i.tenantId, d ? undefined : target.id); if (d)
+        validateDraft(d, catalog.value); session.writeCheck(); const j = makeJob(i, s, session.actor, target, d); persist(catalog.value, drafts.value, [j, ...jobs.value]); await run(j.id); }
+    async function link(id, pbcId, binding) { const p = items.value.find(p => p.id === pbcId); if (!p)
+        throw Error('PBC 不可访问。'); assertActive(p); await start(id, p, undefined, binding); }
+    async function create(id, d, binding) { const p = { ...clone(d), id: 'pbc-' + d.slug, state: 'active', provisioned: true, resourceKey: d.name, services: d.services.filter(s => !s.isDeleted).map(s => ({ ...clone(s), id: d.prefix + '-' + s.name, registered: true })) }; await start(id, p, d, binding); }
+    const current = (id) => jobs.value.find(j => j.id === id);
+    function complete(j) { const list = j.kind === 'create' && !catalog.value.some(p => p.id === j.pbc.id) ? [j.pbc, ...catalog.value] : catalog.value; persist(list, drafts.value, jobs.value.map(x => x.id === j.id ? { ...j, status: 'done' } : x)); }
+    async function run(id) {
+        let j = current(id);
+        if (j.status === 'done' || j.status === 'unknown')
+            return;
+        const permission = j.kind === 'create' ? 'pbc:create' : 'pbc:link';
+        session.require(permission, j.tenantId, j.kind === 'link' ? j.pbc.id : undefined);
+        if (j.steps.some(s => s.state === 'running'))
+            throw Error('该请求正在执行。');
+        const runEpoch = epoch, result = mode.value, actorId = session.actor.id;
+        mode.value = 'success';
+        for (let index = activeStep(j); index < j.steps.length && index >= 0; index++) {
+            j = current(id);
+            const next = clone(j);
+            next.status = 'running';
+            next.steps[index].state = 'running';
+            next.steps[index].detail = '正在处理（模拟）';
+            update(next, '开始：' + next.steps[index].name);
+            await new Promise(resolve => setTimeout(resolve, 450));
+            if (runEpoch !== epoch)
+                return;
+            j = clone(current(id));
+            let allowed = session.actor.id === actorId && session.can(permission, j.tenantId, j.kind === 'link' ? j.pbc.id : undefined);
+            const step = j.steps[index];
+            if (!allowed) {
+                step.state = 'failed';
+                step.detail = '身份、权限或登录状态变化；本步尚未执行。';
+                j.status = 'paused';
+                update(j, '暂停执行：' + step.detail);
+                return;
+            }
+            if (result === 'failure' && index === (j.kind === 'create' ? 2 : 0)) {
+                step.state = 'failed';
+                step.detail = '模拟服务不可用，已完成步骤保留。';
+                j.status = 'failed';
+                update(j, '步骤失败：' + step.name);
+                return;
+            }
+            step.receipt = j.id + ':' + index;
+            if (result === 'unknown' && index === 0) {
+                step.state = 'unknown';
+                step.detail = '响应未收到，先核实原操作。';
+                j.status = 'unknown';
+                update(j, '步骤结果待核实：' + step.name);
+                return;
+            }
+            step.state = 'done';
+            step.detail = '已完成（模拟）；操作回执 ' + step.receipt;
+            j = update(j, '完成：' + step.name);
+        }
+        complete(current(id));
+    }
+    async function resume(id) { const j = job(id); if (!j)
+        throw Error('没有可访问的归属请求。'); await run(j.id); }
+    function reconcile(id) { const j = job(id); if (!j)
+        throw Error('没有可访问的归属请求。'); session.require('pbc:view', j.tenantId, j.pbc.id); const next = update(queryReceipt(j), '查询原操作结果'); if (next.status === 'done')
+        complete(next); }
+    function reset() { epoch++; localStorage.removeItem(key); catalog.value = seedPbcs(); drafts.value = []; jobs.value = seedTaskJobs(); notice.value = ''; mode.value = 'success'; scene.value = 'normal'; managementAudit.value = []; }
+    function refreshLatest() { try {
+        const raw = JSON.parse(localStorage.getItem(key) || 'null');
+        if (raw) {
+            catalog.value = raw.catalog;
+            drafts.value = raw.drafts;
+            jobs.value = raw.jobs;
+            managementAudit.value = raw.audit || [];
+        }
+    }
+    catch {
+        throw Error('本地数据无法读取，请保留输入并重新加载。');
+    } }
+    function saveManagement(next, events) { persist(next, drafts.value, jobs.value, [...events, ...managementAudit.value]); }
+    if (typeof window !== 'undefined')
+        window.addEventListener('storage', e => { if (e.key === key && e.newValue) {
+            try {
+                refreshLatest();
+            }
+            catch {
+                notice.value = '本地数据刷新失败，请重新加载。';
+            }
+        } });
+    return { catalog, jobs, managementAudit, refreshLatest, saveManagement, items, notice, mode, scene, job, draft, saveDraft, link, create, resume, reconcile, reset };
+});

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/permissions/AdminList.html

@@ -0,0 +1,2 @@
+<!-- 来源：src/permissions/AdminList.vue；HTML / 原生 DOM 绑定，不含 Vue 运行时。 -->
+<div class="page-heading"><div><h1>{{ (title) }}</h1><p>{{ (description) }}</p></div><template data-component="Button" data-if="(!readonly)" type="primary" data-bind-disabled="(!session.can(createAction))" data-on-click="(emit('create'))">{{ (kind === 'roles' ? '新增角色' : '添加成员') }}</template></div><section class="auth-list"><div class="auth-filters"><template data-component="Input" data-model-value="(query)" aria-label="查找权限记录" placeholder="搜索名称、编码或说明" allow-clear=""></template><template data-component="Select" data-model-value="(scope)" aria-label="所属范围筛选" data-bind-options="(scopeOptions)"></template><template data-component="Select" data-if="(kind === 'roles')" data-model-value="(status)" aria-label="角色状态筛选" data-bind-options="([{ label: '全部状态', value: 'all' }, { label: '启用', value: '启用' }, { label: '停用', value: '停用' }])"></template><template data-component="Button" data-on-click="(reset)">重置</template></div><div class="auth-tools"><template data-component="ListBatchBar" data-if="(!readonly)" data-bind-count="(selection.selected.value.length)" data-bind-allowed="(canDelete)" data-on-remove="(emit('remove', selection.selected.value))" data-on-clear="(selection.clear)"></template><p data-else="" class="muted">授权记录只读，保留变更前后内容；删除不适用。</p><template data-component="Space" wrap=""><template data-component="Button" data-on-click="(desc = !desc)">时间{{ (desc ? '倒序' : '正序') }}</template><template data-component="Button" data-bind-loading="(refreshing)" data-on-click="(refresh)">刷新</template><template data-component="ColumnSettings" data-bind-preferences="(prefs)"></template></template></div><template data-component="Alert" data-if="(kind === 'members')" class="page-alert" type="info" show-icon="" title="此处管理业务关联与角色授权" description="账号、姓名和部门来自 MaxKey 身份目录；移除业务关联会撤去该范围的角色授权，账号保留。"></template><template data-component="Alert" data-if="(store.scene === 'error')" type="error" title="权限数据加载失败" description="请刷新重试；现有授权未改变。" show-icon=""><template data-slot="action"><template data-component="Button" data-on-click="(refresh)">重试</template></template></template><template data-component="ProTable" data-else="" data-bind-table="(table)" data-bind-search="(async () =&gt; { })" data-bind-control="(false)" data-bind-table-container="(false)" row-key="id" data-bind-loading="(refreshing)" data-bind-row-selection="(readonly ? undefined : selection.rowSelection.value)" data-bind-scroll="({ x: 'max-content' })" data-bind-pagination="({ showTotal: (n) =&gt; '共 ' + n + ' 项', showSizeChanger: true, pageSizeOptions: [5, 10, 20] })"></template></section>

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/permissions/AdminList.js

@@ -0,0 +1,38 @@
+import { computed, ref, watch } from '../../runtime/state.js';
+import { h } from '../../runtime/dom.js';
+import { Alert, Button, Input, Select, Space, Tag } from "../../runtime/widgets.js";
+import { ProTable, useTable } from "../../runtime/widgets.js";
+import { useSession } from "../shared/session.js";
+import { tenantLabel, tenants, formatDate } from "../shared/policy.js";
+import { useColumns } from "../shared/columns.js";
+import { useListSelection } from "../shared/listSelection.js";
+import ColumnSettings from "../shared/ColumnSettings.js";
+import ListMore from "../shared/ListMore.js";
+import ListBatchBar from "../shared/ListBatchBar.js";
+import { useAuthority } from "./store.js";
+import { createComponent } from '../../runtime/dom.js';
+export default createComponent({ name: 'AdminList', propKeys: ["rows", "kind", "title", "description", "initialQuery"], template: new URL('./AdminList.html', import.meta.url).href, setup(__props, __emit) {
+        const props = __props;
+        const emit = __emit;
+        const session = useSession(), store = useAuthority(), query = ref(props.initialQuery || ''), scope = ref('all'), status = ref('all'), desc = ref(true), refreshing = ref(false);
+        const readonly = computed(() => props.kind === 'records'), createAction = computed(() => props.kind === 'roles' ? 'permission:roles' : 'permission:members');
+        const canDelete = computed(() => !readonly.value && session.can('permission:delete') && (props.kind !== 'members' || session.can('permission:members')));
+        const scopeOptions = computed(() => [{ value: 'all', label: '全部可见范围' }, ...[{ value: 'platform', label: '平台统一管理' }, ...tenants].filter(t => session.can(readonly.value ? 'permission:audit' : 'permission:view', t.value))]);
+        const prefs = useColumns('permission-' + props.kind, [{ key: 'name', label: props.kind === 'roles' ? '角色名称' : props.kind === 'members' ? '成员' : '操作对象', locked: true }, { key: 'code', label: props.kind === 'roles' ? '角色编码' : props.kind === 'members' ? '已关联角色' : '操作类型', defaultVisible: true }, { key: 'tenantId', label: '所属范围', defaultVisible: true }, { key: 'status', label: '状态', defaultVisible: true }, { key: 'extra', label: readonly.value ? '变更原因' : '用途 / 说明', defaultVisible: false }, { key: 'createdBy', label: readonly.value ? '操作者' : '创建人', defaultVisible: true }, { key: 'createdAt', label: readonly.value ? '操作时间' : '创建时间', defaultVisible: true }, { key: 'createdDept', label: '创建部门' }, { key: 'updatedBy', label: '修改人' }, { key: 'updatedAt', label: '修改时间' }, { key: 'actions', label: '操作', locked: true }]);
+        function actionButtons(r) {
+            const disabled = r.protected || !session.can(createAction.value, r.tenantId);
+            const items = [{ key: 'detail', label: readonly.value ? '查看变更详情' : '查看详情' }, ...(!readonly.value ? [{ key: 'edit', label: props.kind === 'roles' ? '编辑角色' : '修改成员授权', disabled }, ...(props.kind === 'roles' ? [{ key: 'toggle', label: r.status === '启用' ? '停用角色' : '启用角色', disabled }] : []), { key: 'history', label: '授权记录', disabled: !session.can('permission:audit', r.tenantId) }, { key: 'delete', label: props.kind === 'members' ? '移除业务关联' : '删除角色', danger: true, disabled: !canDelete.value || !session.can('permission:delete', r.tenantId) }] : [])];
+            return h('div', { class: 'row-actions' }, [h(Button, { type: 'link', disabled: readonly.value ? false : props.kind === 'roles' ? (!!r.protected || !session.can('permission:grant', r.tenantId)) : disabled, onClick: () => emit('action', readonly.value ? 'detail' : props.kind === 'roles' ? 'grant' : 'edit', r) }, () => readonly.value ? '详情' : props.kind === 'roles' ? '配置权限' : '配置角色'), h(ListMore, { name: r.name, items, onAction: (key) => emit('action', key, r) })]);
+        }
+        const table = useTable({ pageParam: { current: 1, pageSize: 5, total: 0 }, columns: prefs.choices.map(c => ({ key: c.key, title: c.label, dataIndex: c.key, fixed: c.key === 'actions' ? 'right' : undefined, width: c.key === 'name' ? 180 : c.key === 'code' ? 240 : c.key === 'actions' ? 190 : 160, ...(c.key === 'actions' ? { render: (_, r) => actionButtons(r) } : c.key === 'tenantId' ? { render: (v) => tenantLabel(String(v)) } : c.key.endsWith('At') ? { render: (v) => formatDate(String(v)) } : c.key === 'status' ? { render: (v) => h(Tag, { color: v === '停用' ? 'default' : 'green' }, () => String(v)) } : {}) })) });
+        const columns = new Map(table.columns.value.map(c => [c.key, c]));
+        watch(prefs.keys, keys => table.columns.value = keys.map(k => columns.get(k)).filter(Boolean), { immediate: true });
+        const filtered = computed(() => store.scene === 'empty' ? [] : props.rows.filter(r => (r.name + r.code + r.extra).toLowerCase().includes(query.value.trim().toLowerCase()) && (scope.value === 'all' || r.tenantId === scope.value) && (status.value === 'all' || r.status === status.value)).sort((a, b) => desc.value ? b.createdAt.localeCompare(a.createdAt) : a.createdAt.localeCompare(b.createdAt)));
+        watch([filtered, () => table.pageParam.current, () => table.pageParam.pageSize], () => { const size = table.pageParam.pageSize || 5, max = Math.max(1, Math.ceil(filtered.value.length / size)); if ((table.pageParam.current || 1) > max)
+            table.setPageParam({ current: max }); const start = ((table.pageParam.current || 1) - 1) * size; table.dataSource.value = filtered.value.slice(start, start + size); table.setPageParam({ total: filtered.value.length }); }, { immediate: true });
+        const selection = useListSelection(table.dataSource, computed(() => JSON.stringify([session.key, query.value, scope.value, status.value, desc.value, table.pageParam.current, table.pageParam.pageSize])), canDelete, r => r.name);
+        watch([query, scope, status], () => table.setPageParam({ current: 1 }));
+        async function refresh() { selection.clear(); refreshing.value = true; await new Promise(r => setTimeout(r, 250)); store.scene = 'normal'; refreshing.value = false; }
+        function reset() { query.value = ''; scope.value = 'all'; status.value = 'all'; }
+        return { computed, ref, watch, h, Alert, Button, Input, Select, Space, Tag, ProTable, useTable, useSession, tenantLabel, tenants, formatDate, useColumns, useListSelection, ColumnSettings, ListMore, ListBatchBar, useAuthority, props, emit, session, store, query, scope, status, desc, refreshing, readonly, createAction, canDelete, scopeOptions, prefs, actionButtons, table, columns, filtered, selection, refresh, reset };
+    } });

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/permissions/EffectiveGrants.html

@@ -0,0 +1,2 @@
+<!-- 来源：src/permissions/EffectiveGrants.vue；HTML / 原生 DOM 绑定，不含 Vue 运行时。 -->
+<template data-component="Empty" data-if="(!grants.length)" description="当前没有生效的业务权限"></template><section data-each="grant in (grants)" data-bind-key="(grant.id)" class="auth-grant"><h3>{{ (grant.name) }}</h3><p><strong>范围：</strong>{{ (grant.tenantIds.map(t =&gt; t === '*' ? '全部范围' : tenantLabel(t)).join('、')) }}</p><p><strong>PBC：</strong>{{ ((grant.pbcIds || ['*']).map(pbc).join('、')) }}</p><div class="auth-tags"><template data-component="Tag" data-each="code in (grant.actions)" data-bind-key="(code)">{{ (label(code)) }}</template></div></section>

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/permissions/EffectiveGrants.js

@@ -0,0 +1,11 @@
+import { Empty, Tag } from "../../runtime/widgets.js";
+import { usePbcs } from "../pbc/store.js";
+import { actionGroups, tenantLabel } from "../shared/policy.js";
+import { createComponent } from '../../runtime/dom.js';
+export default createComponent({ name: 'EffectiveGrants', propKeys: ["grants"], template: new URL('./EffectiveGrants.html', import.meta.url).href, setup(__props, __emit) {
+        __props;
+        const label = (code) => actionGroups.flatMap(g => g.items).find(i => i.value === code)?.label || code;
+        const directory = usePbcs();
+        const pbc = (id) => id === '*' ? '全部 PBC（含新建）' : directory.items.find(p => p.id === id)?.name || id;
+        return { Empty, Tag, usePbcs, actionGroups, tenantLabel, label, directory, pbc };
+    } });

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/permissions/GrantEditor.html

@@ -0,0 +1,2 @@
+<!-- 来源：src/permissions/GrantEditor.vue；HTML / 原生 DOM 绑定，不含 Vue 运行时。 -->
+<template data-component="Drawer" data-bind-open="(true)" data-bind-title="('配置权限 · ' + role.name)" data-bind-size="(780)" data-bind-mask="({ closable: false })" data-on-close="(close)"><template data-component="Alert" type="info" show-icon="" data-bind-title="('本次变更影响 ' + affected.length + ' 条成员关联')" data-bind-description="(affected.join('、') || '当前尚无成员使用此角色。')" class="page-alert"></template><template data-component="Alert" data-if="(error)" type="error" show-icon="" data-bind-title="(error)" class="page-alert"></template><template data-component="Tabs" data-model-active-key="(tab)" data-bind-items="([{ key: 'features', label: '功能与数据范围' }, { key: 'explain', label: '授权规则' }])"></template><div data-if="(tab === 'features')"><section data-each="(grant,index) in (value.grants)" data-bind-key="(grant.id)" class="auth-grant"><div class="section-heading"><h2>授权组 {{ (index + 1) }}</h2><template data-component="Button" danger="" type="text" data-bind-disabled="(!allowed)" data-on-click="(value.grants.splice(index, 1))">移除此组</template></div><label data-bind-for="('auth-group-' + index)">授权组名称</label><template data-component="Input" data-bind-id="('auth-group-' + index)" data-model-value="(grant.name)" data-bind-disabled="(!allowed)"></template><div class="auth-grant-columns"><div><h3>菜单与功能</h3><template data-component="Tree" checkable="" default-expand-all="" data-bind-tree-data="(tree)" data-bind-checked-keys="(grant.actions)" data-bind-disabled="(!allowed)" data-on-check="((keys) =&gt; update(index, keys))"></template></div><div><h3>数据与资源范围</h3><label data-bind-for="('auth-tenants-' + index)">租户 / 平台范围</label><template data-component="Select" data-bind-id="('auth-tenants-' + index)" data-model-value="(grant.tenantIds)" mode="multiple" data-bind-options="(scopeOptions)" data-bind-disabled="(!allowed)"></template><label data-bind-for="('auth-pbc-' + index)">PBC 范围</label><template data-component="Select" data-bind-id="('auth-pbc-' + index)" data-model-value="(grant.pbcIds)" mode="multiple" data-bind-options="(pbcOptions)" data-bind-disabled="(!allowed)"></template><template data-if="(grant.actions.some(a =&gt; a.startsWith('release:')))"><label data-bind-for="('auth-env-' + index)">发布目标环境</label><template data-component="Select" data-bind-id="('auth-env-' + index)" data-model-value="(grant.environmentIds)" mode="multiple" data-bind-options="([{ value: '*', label: '全部环境' }, { value: 'staging', label: '预发布环境' }, { value: 'production', label: '生产环境' }])" data-bind-disabled="(!allowed)" placeholder="未限定时适用全部环境"></template></template><p class="muted">此范围只约束本组所选功能。意图与规格在立项前按租户控制；PBC 查看、关联和结果还核对具体资源。</p></div></div></section><template data-component="Button" block="" data-bind-disabled="(!allowed)" data-on-click="(add)">新增授权组</template><p data-if="(!value.grants.length)" class="muted">角色将没有功能权限；保存后关联成员失去此角色提供的授权。</p></div><div data-else="" class="auth-explanation"><h2>统一配置，业务页面按权限开放</h2><p>同一人可以关联多个角色；角色名称仅用于识别，实际按每组功能和资源范围判定。</p><h3>菜单、按钮与接口</h3><p>查看权限控制页面入口，操作权限控制按钮与业务动作。正式后端必须独立校验对应接口，不能仅依赖按钮隐藏。</p><p class="muted">本原型沿用现有业务动作标识。正式领域权限码及 OpenAPI 映射尚待 spec/design，本页不虚构已接通的接口清单。</p><h3>授权范围与变更生效</h3><p>管理员只能授出受管范围内的权限；转授管理能力还需专门授权。生产人工确认、独立评审和版本检查继续有效。</p></div><template data-component="ProForm" name="role-grant-reason" data-bind-form="(form)" layout="vertical" data-bind-disabled="(!allowed || busy)" class="auth-reason"></template><template data-slot="footer"><template data-component="Space" class="auth-footer"><template data-component="Button" data-bind-disabled="(busy)" data-on-click="(close)">取消</template><template data-component="Button" type="primary" data-bind-disabled="(!allowed)" data-bind-loading="(busy)" data-on-click="(save)">保存权限</template></template></template></template>

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/permissions/GrantEditor.js

@@ -0,0 +1,45 @@
+import { computed, ref } from '../../runtime/state.js';
+import { Alert, Button, Drawer, Input, Select, Space, Tabs, Tree, message } from "../../runtime/widgets.js";
+import { ProForm, useForm } from "../../runtime/widgets.js";
+import { actionGroups, allActions, tenants } from "../shared/policy.js";
+import { useSession } from "../shared/session.js";
+import { clone } from "./domain.js";
+import { usePbcs } from "../pbc/store.js";
+import { useAuthority } from "./store.js";
+import { confirmAction } from "../shell/confirmation.js";
+import { createComponent } from '../../runtime/dom.js';
+export default createComponent({ name: 'GrantEditor', propKeys: ["role"], template: new URL('./GrantEditor.html', import.meta.url).href, setup(__props, __emit) {
+        const props = __props, emit = __emit, session = useSession(), store = useAuthority(), value = ref(clone(props.role)), tab = ref('features'), error = ref(''), busy = ref(false);
+        const form = useForm({ reason: '' }, [{ path: 'reason', label: '变更原因', component: 'textarea', span: 24, rules: [{ required: true, whitespace: true, message: '请填写变更原因' }] }]);
+        const allowed = computed(() => !props.role.protected && session.can('permission:grant', props.role.tenantId));
+        const affected = computed(() => store.members.filter(m => m.roleIds.includes(props.role.id)).map(m => store.actorName(m.actorId)));
+        const scopeOptions = computed(() => props.role.tenantId === 'platform' ? [{ value: '*', label: '全部范围（含后续新增）' }, { value: 'platform', label: '平台统一管理' }, ...tenants] : tenants.filter(t => t.value === props.role.tenantId));
+        const pbcDirectory = usePbcs();
+        const pbcOptions = computed(() => [{ value: '*', label: '授权租户内全部 PBC（含新建）' }, ...pbcDirectory.items.filter(p => props.role.tenantId === 'platform' || p.tenantId === props.role.tenantId).map(p => ({ value: p.id, label: p.name })), ...[...new Set(value.value.grants.flatMap(g => g.pbcIds || []))].filter(id => id !== '*' && !pbcDirectory.items.some(p => p.id === id)).map(id => ({ value: id, label: id + '（保留的范围引用）' }))]);
+        const tree = computed(() => actionGroups.map((g, i) => ({ key: 'group-' + i, title: g.name, children: g.items.map(a => ({ key: a.value, title: a.label, disabled: !allowed.value || (a.value.startsWith('permission:') && !session.can('permission:delegate', props.role.tenantId)) })) })));
+        function update(index, keys) { const list = Array.isArray(keys) ? keys : keys.checked; value.value.grants[index].actions = list.filter((v) => allActions.includes(v)); if (value.value.grants[index].actions.some(a => a.startsWith('release:')) && !value.value.grants[index].environmentIds)
+            value.value.grants[index].environmentIds = ['*']; }
+        function add() { value.value.grants.push({ id: crypto.randomUUID(), name: '授权组 ' + (value.value.grants.length + 1), actions: [], tenantIds: [props.role.tenantId], pbcIds: ['*'], environmentIds: ['*'] }); }
+        function close() { if (busy.value)
+            return; if (JSON.stringify(value.value) !== JSON.stringify(props.role) || form.formData.reason)
+            confirmAction({ title: '放弃未保存的授权？', content: '当前角色权限不会改变。', okText: '放弃修改', cancelText: '继续编辑', onOk: () => emit('close') });
+        else
+            emit('close'); }
+        async function save() { try {
+            await form.formRef.value?.validate();
+        }
+        catch {
+            return;
+        } busy.value = true; error.value = ''; try {
+            store.saveGrants(value.value, form.formData.reason);
+            message.success('角色权限已更新，关联成员同步生效');
+            emit('saved');
+        }
+        catch (e) {
+            error.value = e.message;
+        }
+        finally {
+            busy.value = false;
+        } }
+        return { computed, ref, Alert, Button, Drawer, Input, Select, Space, Tabs, Tree, message, ProForm, useForm, actionGroups, allActions, tenants, useSession, clone, usePbcs, useAuthority, confirmAction, props, emit, session, store, value, tab, error, busy, form, allowed, affected, scopeOptions, pbcDirectory, pbcOptions, tree, update, add, close, save };
+    } });

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/permissions/MemberEditor.html

@@ -0,0 +1,2 @@
+<!-- 来源：src/permissions/MemberEditor.vue；HTML / 原生 DOM 绑定，不含 Vue 运行时。 -->
+<template data-component="Drawer" data-bind-open="(true)" data-bind-title="(member ? '修改成员授权' : '添加成员')" data-bind-size="(640)" data-bind-mask="({ closable: false })" data-on-close="(close)"><template data-component="Alert" type="info" show-icon="" title="关联已有身份，不创建新账号" description="姓名、部门、账号状态由 MaxKey 管理；本页仅维护 EASEL 业务角色关联。" class="page-alert"></template><template data-component="Alert" data-if="(error)" type="error" data-bind-title="(error)" show-icon="" class="page-alert"></template><template data-component="ProForm" name="business-member" data-bind-form="(form)" layout="vertical" data-bind-disabled="(!allowed || busy)"></template><template data-component="RecordMetadata" data-if="(member)" data-bind-record="(member)"></template><template data-slot="footer"><template data-component="Space" class="auth-footer"><template data-component="Button" data-bind-disabled="(busy)" data-on-click="(close)">取消</template><template data-component="Button" type="primary" data-bind-disabled="(!allowed)" data-bind-loading="(busy)" data-on-click="(save)">保存成员授权</template></template></template></template>

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/permissions/MemberEditor.js

@@ -0,0 +1,54 @@
+import { computed, ref, watch } from '../../runtime/state.js';
+import { Alert, Button, Drawer, Space, message } from "../../runtime/widgets.js";
+import { ProForm, useForm } from "../../runtime/widgets.js";
+import { actors, metadata, tenants } from "../shared/policy.js";
+import { useSession } from "../shared/session.js";
+import { clone, checkDelegation } from "./domain.js";
+import { useAuthority } from "./store.js";
+import { confirmAction } from "../shell/confirmation.js";
+import RecordMetadata from "../shared/RecordMetadata.js";
+import { createComponent } from '../../runtime/dom.js';
+export default createComponent({ name: 'MemberEditor', propKeys: ["member"], template: new URL('./MemberEditor.html', import.meta.url).href, setup(__props, __emit) {
+        const props = __props, emit = __emit, session = useSession(), store = useAuthority(), busy = ref(false), error = ref('');
+        const scopes = [{ value: 'platform', label: '平台统一管理' }, ...tenants].filter(t => session.can('permission:members', t.value));
+        const initial = props.member ? clone(props.member) : { ...metadata(session.actor, '', scopes[0]?.value || session.actor.tenantId), id: crypto.randomUUID(), actorId: '', roleIds: [] };
+        const form = useForm({ ...initial, reason: '' });
+        const people = computed(() => actors.filter(a => session.can('permission:members', 'platform') || a.tenantId === form.formData.tenantId).map(a => ({ value: a.id, label: a.name + ' · ' + a.department + (a.id === 'complete' ? '（全程演示身份）' : '') })));
+        const roles = computed(() => store.roles.filter(r => r.tenantId === form.formData.tenantId).map(r => { let disabled = !r.enabled; try {
+            checkDelegation(session.actor, r);
+        }
+        catch {
+            disabled = true;
+        } return { value: r.id, label: r.name + (r.enabled ? '' : '（已停用）'), disabled }; }));
+        form.fields.value = [
+            { path: 'tenantId', label: '所属范围', component: 'select', span: 24, disabled: !!props.member, options: scopes, rules: [{ required: true, message: '请选择所属范围' }] },
+            { path: 'actorId', label: '身份目录成员', component: 'select', span: 24, disabled: !!props.member, options: people, showSearch: true, optionFilterProp: 'label', rules: [{ required: true, message: '请选择已有成员' }] },
+            { path: 'roleIds', label: '关联业务角色', component: 'select', span: 24, mode: 'multiple', options: roles, extra: '同一范围内可关联多个角色；停用或不可转授的角色不可新分配。', rules: [{ required: true, type: 'array', min: 1, message: '请选择至少一个角色' }] },
+            { path: 'reason', label: '变更原因', component: 'textarea', span: 24, rules: [{ required: true, whitespace: true, message: '请填写变更原因' }] },
+        ];
+        watch(() => form.formData.tenantId, () => { form.formData.roleIds = []; if (!props.member)
+            form.formData.actorId = ''; });
+        const allowed = computed(() => session.can('permission:members', form.formData.tenantId));
+        function close() { if (busy.value)
+            return; if (JSON.stringify(form.formData) !== JSON.stringify({ ...initial, reason: '' }))
+            confirmAction({ title: '放弃未保存的成员授权？', content: '现有成员关联和权限保持不变。', okText: '放弃修改', cancelText: '继续编辑', onOk: () => emit('close') });
+        else
+            emit('close'); }
+        async function save() { try {
+            await form.formRef.value?.validate();
+        }
+        catch {
+            return;
+        } busy.value = true; error.value = ''; try {
+            store.saveMember(form.formData, form.formData.reason);
+            message.success('成员授权已保存');
+            emit('saved');
+        }
+        catch (e) {
+            error.value = e.message;
+        }
+        finally {
+            busy.value = false;
+        } }
+        return { computed, ref, watch, Alert, Button, Drawer, Space, message, ProForm, useForm, actors, metadata, tenants, useSession, clone, checkDelegation, useAuthority, confirmAction, RecordMetadata, props, emit, session, store, busy, error, scopes, initial, form, people, roles, allowed, close, save };
+    } });

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/permissions/MembersPage.html

@@ -0,0 +1,3 @@
+<!-- 来源：src/permissions/MembersPage.vue；HTML / 原生 DOM 绑定，不含 Vue 运行时。 -->
+<template data-component="AdminList" kind="members" title="成员授权" description="关联已有成员，按角色统一分配功能和资源权限。" data-bind-rows="(rows)" data-on-create="selected = undefined;
+overlay = 'edit';" data-on-action="(action)" data-on-remove="(remove)"></template><template data-component="MemberEditor" data-if="(overlay === 'edit')" data-bind-member="(selected)" data-on-close="(close)" data-on-saved="(close)"></template><template data-component="Drawer" data-bind-open="(overlay === 'detail')" title="成员有效权限" data-bind-size="(720)" data-on-close="(close)"><template data-if="(current)"><h2>{{ (store.actorName(current.actorId)) }}</h2><p>关联角色：{{ (current.roleIds.map(store.roleName).join('、')) }}</p><p class="muted">以下显示本条业务关联范围内各角色的生效权限；停用角色不参与授权。账号由 MaxKey 管理。</p><template data-component="EffectiveGrants" data-bind-grants="(store.effective(current.actorId, current.tenantId).grants)"></template><template data-component="RecordMetadata" data-bind-record="(current)"></template></template></template><template data-component="ListDeleteDialog" data-if="(targets.length)" data-model-targets="(targets)" label="业务关联（账号保留）" data-bind-check="(store.checkDeleteMember)" data-bind-submit="(store.deleteMembers)" data-on-close="(targets = [])" data-on-deleted="(targets = [])"></template>

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/permissions/MembersPage.js

@@ -0,0 +1,27 @@
+import { computed, ref } from '../../runtime/state.js';
+import { useRouter } from "../../runtime/router.js";
+import { Drawer } from "../../runtime/widgets.js";
+import { useAuthority } from "./store.js";
+import { clone } from "./domain.js";
+import AdminList from "./AdminList.js";
+import MemberEditor from "./MemberEditor.js";
+import EffectiveGrants from "./EffectiveGrants.js";
+import RecordMetadata from "../shared/RecordMetadata.js";
+import ListDeleteDialog from "../shared/ListDeleteDialog.js";
+import { createComponent } from '../../runtime/dom.js';
+export default createComponent({ name: 'MembersPage', propKeys: [], template: new URL('./MembersPage.html', import.meta.url).href, setup(__props, __emit) {
+        const store = useAuthority(), router = useRouter(), overlay = ref(''), selected = ref(), targets = ref([]);
+        const rows = computed(() => store.members.map(m => ({ ...m, name: store.actorName(m.actorId), code: m.roleIds.map(store.roleName).join('、'), status: store.effective(m.actorId, m.tenantId).grants.length ? '有生效权限' : '无生效权限', extra: '仅业务角色关联；身份账号归 MaxKey。' })));
+        const current = computed(() => store.members.find(m => m.id === selected.value?.id));
+        function close() { overlay.value = ''; selected.value = undefined; }
+        function remove(rows) { targets.value = rows.map(r => ({ id: r.id, name: r.name, recordVersion: r.recordVersion })); }
+        function action(key, row) { const m = store.members.find(m => m.id === row.id); if (!m)
+            return; if (key === 'history') {
+            router.push({ path: '/permissions/records', query: { target: row.name } });
+            return;
+        } if (key === 'delete') {
+            remove([row]);
+            return;
+        } selected.value = clone(m); overlay.value = key; }
+        return { computed, ref, useRouter, Drawer, useAuthority, clone, AdminList, MemberEditor, EffectiveGrants, RecordMetadata, ListDeleteDialog, store, router, overlay, selected, targets, rows, current, close, remove, action };
+    } });

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/permissions/RecordsPage.html

@@ -0,0 +1,2 @@
+<!-- 来源：src/permissions/RecordsPage.vue；HTML / 原生 DOM 绑定，不含 Vue 运行时。 -->
+<template data-component="AdminList" data-bind-key="(route.fullPath)" kind="records" title="授权记录" description="按对象和时间追溯角色及成员授权变更。" data-bind-initial-query="(String(route.query.target || ''))" data-bind-rows="(rows)" data-on-action="((_key, row) =&gt; selected = row.id)"></template><template data-component="Drawer" data-bind-open="(!!record)" title="授权变更详情" data-bind-size="(780)" data-on-close="(selected = '')"><template data-if="(record)"><h2>{{ (record.operation) }} · {{ (record.target) }}</h2><p>{{ (record.actorName) }} · {{ (new Date(record.at).toLocaleString('zh-CN')) }}</p><p><strong>变更原因：</strong>{{ (record.reason) }}</p><div class="auth-diff"><section><h3>变更前</h3><pre>{{ (record.before) }}</pre></section><section><h3>变更后</h3><pre>{{ (record.after) }}</pre></section></div><p class="muted">本地原型记录；真实后端审计和不可篡改存储尚未接入。</p></template></template>

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/permissions/RecordsPage.js

@@ -0,0 +1,12 @@
+import { computed, ref } from '../../runtime/state.js';
+import { useRoute } from "../../runtime/router.js";
+import { Drawer } from "../../runtime/widgets.js";
+import { useAuthority } from "./store.js";
+import AdminList from "./AdminList.js";
+import { createComponent } from '../../runtime/dom.js';
+export default createComponent({ name: 'RecordsPage', propKeys: [], template: new URL('./RecordsPage.html', import.meta.url).href, setup(__props, __emit) {
+        const store = useAuthority(), route = useRoute(), selected = ref('');
+        const rows = computed(() => store.records.map(r => ({ id: r.id, name: r.target, code: r.operation, status: '已生效', extra: r.reason, createdById: r.actorId, createdBy: r.actorName, createdDept: '—', createdAt: r.at, updatedBy: r.actorName, updatedAt: r.at, tenantId: r.tenantId, recordVersion: 1, isDeleted: false })));
+        const record = computed(() => store.records.find(r => r.id === selected.value));
+        return { computed, ref, useRoute, Drawer, useAuthority, AdminList, store, route, selected, rows, record };
+    } });

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/permissions/RoleEditor.html

@@ -0,0 +1,2 @@
+<!-- 来源：src/permissions/RoleEditor.vue；HTML / 原生 DOM 绑定，不含 Vue 运行时。 -->
+<template data-component="Drawer" data-bind-open="(true)" data-bind-title="(role ? '编辑角色' : '新增角色')" data-bind-size="(600)" data-bind-mask="({ closable: false })" data-on-close="(close)"><template data-component="Alert" data-if="(error)" class="page-alert" type="error" show-icon="" data-bind-title="(error)"></template><template data-component="ProForm" name="business-role" data-bind-form="(form)" layout="vertical" data-bind-disabled="(busy || !allowed)"></template><p class="muted">新增角色初始没有功能权限，保存后通过「配置权限」授予。</p><template data-component="RecordMetadata" data-if="(role)" data-bind-record="(role)"></template><template data-slot="footer"><template data-component="Space" class="auth-footer"><template data-component="Button" data-bind-disabled="(busy)" data-on-click="(close)">取消</template><template data-component="Button" type="primary" data-bind-disabled="(!allowed)" data-bind-loading="(busy)" data-on-click="(save)">保存角色</template></template></template></template>

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/permissions/RoleEditor.js

@@ -0,0 +1,45 @@
+import { computed, ref } from '../../runtime/state.js';
+import { Alert, Button, Drawer, Space, message } from "../../runtime/widgets.js";
+import { ProForm, useForm } from "../../runtime/widgets.js";
+import { useSession } from "../shared/session.js";
+import { metadata, tenants } from "../shared/policy.js";
+import { clone } from "./domain.js";
+import { useAuthority } from "./store.js";
+import { confirmAction } from "../shell/confirmation.js";
+import RecordMetadata from "../shared/RecordMetadata.js";
+import { createComponent } from '../../runtime/dom.js';
+export default createComponent({ name: 'RoleEditor', propKeys: ["role"], template: new URL('./RoleEditor.html', import.meta.url).href, setup(__props, __emit) {
+        const props = __props, emit = __emit, session = useSession(), store = useAuthority(), busy = ref(false), error = ref('');
+        const scopes = [{ value: 'platform', label: '平台统一管理' }, ...tenants].filter(t => session.can('permission:roles', t.value));
+        const initial = props.role ? clone(props.role) : { ...metadata(session.actor, '', scopes[0]?.value || session.actor.tenantId), id: crypto.randomUUID(), name: '', code: '', description: '', enabled: true, protected: false, grants: [] };
+        const form = useForm({ ...initial, reason: '' }, [
+            { path: 'name', label: '角色名称', component: 'input', span: 24, rules: [{ required: true, whitespace: true, message: '请输入角色名称' }] },
+            { path: 'code', label: '角色编码', component: 'input', span: 24, disabled: !!props.role, extra: '创建后编码不可修改；角色名称可以调整。', rules: [{ required: true, message: '请输入角色编码' }] },
+            { path: 'tenantId', label: '所属范围', component: 'select', span: 24, disabled: !!props.role, options: scopes, rules: [{ required: true, message: '请选择所属范围' }] },
+            { path: 'description', label: '用途说明', component: 'textarea', span: 24, rules: [{ required: true, whitespace: true, message: '请填写用途说明' }] },
+            { path: 'reason', label: '变更原因', component: 'textarea', span: 24, rules: [{ required: true, whitespace: true, message: '请填写变更原因' }] },
+        ]);
+        const allowed = computed(() => session.can('permission:roles', form.formData.tenantId));
+        function close() { if (busy.value)
+            return; if (JSON.stringify(form.formData) !== JSON.stringify({ ...initial, reason: '' }))
+            confirmAction({ title: '放弃未保存的修改？', content: '本次输入将不保存，现有角色保持不变。', okText: '放弃修改', cancelText: '继续编辑', onOk: () => emit('close') });
+        else
+            emit('close'); }
+        async function save() { try {
+            await form.formRef.value?.validate();
+        }
+        catch {
+            return;
+        } busy.value = true; error.value = ''; try {
+            store.saveRole(form.formData, form.formData.reason);
+            message.success('角色已保存');
+            emit('saved');
+        }
+        catch (e) {
+            error.value = e.message;
+        }
+        finally {
+            busy.value = false;
+        } }
+        return { computed, ref, Alert, Button, Drawer, Space, message, ProForm, useForm, useSession, metadata, tenants, clone, useAuthority, confirmAction, RecordMetadata, props, emit, session, store, busy, error, scopes, initial, form, allowed, close, save };
+    } });

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/permissions/RolesPage.html

@@ -0,0 +1,3 @@
+<!-- 来源：src/permissions/RolesPage.vue；HTML / 原生 DOM 绑定，不含 Vue 运行时。 -->
+<template data-component="AdminList" kind="roles" title="角色管理" description="配置角色的功能与资源范围，按需关联成员。" data-bind-rows="(rows)" data-on-create="selected = undefined;
+overlay = 'edit';" data-on-action="(action)" data-on-remove="(remove)"></template><template data-component="RoleEditor" data-if="(overlay === 'edit')" data-bind-role="(selected)" data-on-close="(close)" data-on-saved="(close)"></template><template data-component="GrantEditor" data-if="(overlay === 'grant' &amp;&amp; selected)" data-bind-role="(selected)" data-on-close="(close)" data-on-saved="(close)"></template><template data-component="Drawer" data-bind-open="(overlay === 'detail')" title="角色详情" data-bind-size="(720)" data-on-close="(close)"><template data-if="(current)"><h2>{{ (current.name) }} <template data-component="Tag">{{ (current.enabled ? '启用' : '停用') }}</template></h2><p>{{ (current.code) }} · {{ (current.description) }}</p><p>关联成员 {{ (affected.length) }} 条：{{ (affected.join('、') || '暂无') }}</p><template data-component="Alert" data-if="(!current.enabled)" type="warning" title="角色已停用，以下配置暂不生效。"></template><template data-component="EffectiveGrants" data-bind-grants="(current.grants)"></template><template data-component="RecordMetadata" data-bind-record="(current)"></template></template></template><template data-component="Drawer" data-bind-open="(overlay === 'toggle')" data-bind-title="(selected?.enabled ? '停用角色' : '启用角色')" data-bind-size="(560)" data-bind-mask="({ closable: false })" data-on-close="(close)"><template data-if="(selected)"><template data-component="Alert" show-icon="" data-bind-type="(selected.enabled ? 'warning' : 'info')" data-bind-title="(selected.name)" data-bind-description="('影响 ' + affected.length + ' 条成员关联：' + (affected.join('、') || '暂无'))"></template><p>保存后按新状态计算业务权限；其他角色提供的权限仍保留。</p><label for="role-status-reason">变更原因</label><template data-component="Input.TextArea" id="role-status-reason" data-model-value="(reason)"></template><template data-component="Alert" data-if="(error)" type="error" data-bind-title="(error)"></template><template data-if="(selected.protected)"><p>系统引导角色受保护。</p></template></template><template data-slot="footer"><template data-component="Space" class="auth-footer"><template data-component="Button" data-on-click="(close)">取消</template><template data-component="Button" type="primary" data-bind-danger="(selected?.enabled)" data-bind-disabled="(!selected || selected.protected || !session.can('permission:roles', selected.tenantId))" data-on-click="(toggle)">{{ (selected?.enabled ? '确认停用' : '确认启用') }}</template></template></template></template><template data-component="ListDeleteDialog" data-if="(targets.length)" data-model-targets="(targets)" label="角色" data-bind-check="(store.checkDeleteRole)" data-bind-submit="(store.deleteRoles)" data-on-close="(targets = [])" data-on-deleted="(targets = [])"></template>

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/reference/src/permissions/RolesPage.js

@@ -0,0 +1,38 @@
+import { computed, ref } from '../../runtime/state.js';
+import { useRouter } from "../../runtime/router.js";
+import { Alert, Button, Drawer, Space, Tag, Input, message } from "../../runtime/widgets.js";
+import { useAuthority } from "./store.js";
+import { useSession } from "../shared/session.js";
+import { clone } from "./domain.js";
+import AdminList from "./AdminList.js";
+import RoleEditor from "./RoleEditor.js";
+import GrantEditor from "./GrantEditor.js";
+import EffectiveGrants from "./EffectiveGrants.js";
+import RecordMetadata from "../shared/RecordMetadata.js";
+import ListDeleteDialog from "../shared/ListDeleteDialog.js";
+import { createComponent } from '../../runtime/dom.js';
+export default createComponent({ name: 'RolesPage', propKeys: [], template: new URL('./RolesPage.html', import.meta.url).href, setup(__props, __emit) {
+        const store = useAuthority(), session = useSession(), router = useRouter(), overlay = ref(''), selected = ref(), targets = ref([]), reason = ref(''), error = ref('');
+        const rows = computed(() => store.roles.map(r => ({ ...r, status: r.enabled ? '启用' : '停用', extra: r.description })));
+        const current = computed(() => store.roles.find(r => r.id === selected.value?.id));
+        const affected = computed(() => store.members.filter(m => m.roleIds.includes(selected.value?.id || '')).map(m => store.actorName(m.actorId)));
+        function close() { overlay.value = ''; selected.value = undefined; reason.value = ''; error.value = ''; }
+        function action(key, row) { const r = store.roles.find(r => r.id === row.id); if (!r)
+            return; if (key === 'history') {
+            router.push({ path: '/permissions/records', query: { target: r.name } });
+            return;
+        } if (key === 'delete') {
+            remove([row]);
+            return;
+        } selected.value = clone(r); overlay.value = key; reason.value = ''; error.value = ''; }
+        function remove(rs) { targets.value = rs.map(r => ({ id: r.id, name: r.name, recordVersion: r.recordVersion })); }
+        function toggle() { try {
+            store.toggleRole(selected.value, reason.value);
+            message.success('角色状态已更新');
+            close();
+        }
+        catch (e) {
+            error.value = e.message;
+        } }
+        return { computed, ref, useRouter, Alert, Button, Drawer, Space, Tag, Input, message, useAuthority, useSession, clone, AdminList, RoleEditor, GrantEditor, EffectiveGrants, RecordMetadata, ListDeleteDialog, store, session, router, overlay, selected, targets, reason, error, rows, current, affected, close, action, remove, toggle };
+    } });