@oj-module/cli 0.2.50 → 0.2.54

package/templates/src/{system/web → app/web/system}/__client/api.ts

@@ -17,6 +17,9 @@ export const API_PREFIX = "/system";
 /** 认领身份前缀（契约 apiPrefix，字面等于模块目录名）：跨模块认领护栏对比基准 */
 export const MODULE_PREFIX = "/system";
 
+/** 认领方模块（web.config clientOwners 指定）：跨模块认领护栏对比基准 */
+export const MODULE_OWNER = "/app";
+
 /**
  * 模块 entry 的 onInit 里一行创建（构造即 install）：完成 apiPrefix 登记 +
  * scoped request 绑定，返回绑好前缀的端点函数集合。一模块一 client；
@@ -28,12 +31,12 @@ export function createSystemClient(ctx: ModuleContext) {
 	// 单槽、卸载互相耦合；跨模块需求应由本模块创建后经 provider 暴露。
 	// 注意对比基准是 MODULE_PREFIX（目录名）而非 API_PREFIX——D-M8 映射时线上前缀
 	// 属于别的命名空间，认领身份仍按目录名。
-	if (import.meta.env.DEV && ctx.module.name !== MODULE_PREFIX.slice(1)) {
-		console.warn(`[ojm-api] 模块 "${ctx.module.name}" 正在认领 ${MODULE_PREFIX} 的 client——跨模块认领会共享 request 单槽、卸载互相耦合；应由 "${MODULE_PREFIX.slice(1)}" 模块在自身 onInit 创建，跨模块需求经 provider 暴露。`);
+	if (import.meta.env.DEV && ctx.module.name !== MODULE_OWNER.slice(1)) {
+		console.warn(`[ojm-api] 模块 "${ctx.module.name}" 正在认领 ${MODULE_PREFIX} 的 client——跨模块认领会共享 request 单槽、卸载互相耦合；应由 "${MODULE_OWNER.slice(1)}" 模块在自身 onInit 创建，跨模块需求经 provider 暴露。`);
 	}
 	ctx.register.apiPrefix(API_PREFIX);
 	bindRequest(ctx.utils.request);
-	return { systemDepartmentsGet, systemDepartmentsPost, systemDepartmentsPut, systemDepartmentsDelete, systemDepartmentsMovePut, systemDepartmentsDetachPost, systemDepartmentsMembersGet, systemDepartmentsMembersPost, systemDepartmentsMembersPut, systemDepartmentsMembersDelete, systemLoginMethodsGet, systemOplogGet, systemOplogPost, systemPermissionsGet, systemRolesGet, systemRolesPost, systemRolesDelete, systemRolesBindingsPut, systemSettingsGet, systemSettingsPut, systemUsersGet, systemUsersPost, systemUsersDelete, systemUsersProfilePut, systemUsersForbiddenPut, systemUsersPasswordPut, systemUsersRolesPut };
+	return { systemDepartmentsGet, systemDepartmentsPost, systemDepartmentsPut, systemDepartmentsDelete, systemDepartmentsDetachPost, systemDepartmentsMembersGet, systemDepartmentsMembersPost, systemDepartmentsMembersPut, systemDepartmentsMembersDelete, systemDepartmentsMovePut, systemLoginMethodsGet, systemOplogGet, systemOplogPost, systemPermissionsGet, systemRolesGet, systemRolesPost, systemRolesDelete, systemRolesBindingsPut, systemSettingsGet, systemSettingsPut, systemUsersGet, systemUsersPost, systemUsersDelete, systemUsersForbiddenPut, systemUsersPasswordPut, systemUsersProfilePut, systemUsersRolesPut };
 }
 
 /**
@@ -160,31 +163,6 @@ export async function systemDepartmentsDelete(query: SystemDepartmentsDeleteQuer
 	}
 }
 
-export type SystemDepartmentsMovePutQuery = z.input<(typeof schemas)["systemDepartmentsMovePut"]["query"]>;
-export type SystemDepartmentsMovePutBody = z.input<(typeof schemas)["systemDepartmentsMovePut"]["body"]>;
-export type SystemDepartmentsMovePutData = z.infer<(typeof schemas)["systemDepartmentsMovePut"]["data"]>;
-
-export async function systemDepartmentsMovePut(input: { query: SystemDepartmentsMovePutQuery, body: SystemDepartmentsMovePutBody }): Promise<SystemDepartmentsMovePutData> {
-	const client = ensureReq();
-	try {
-		const env = await client.put(`system/departments/move`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<SystemDepartmentsMovePutData>>();
-		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
-		if (typeof env.code === "number" && env.code !== 0)
-			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
-		const data = env.data as SystemDepartmentsMovePutData;
-		if (import.meta.env.DEV) {
-			const { schemas } = await import("./api.schemas");
-			const r = schemas["systemDepartmentsMovePut"].data.safeParse(data);
-			if (!r.success)
-				throw new ContractApiError(-1, `[契约违例] systemDepartmentsMovePut 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
-		}
-		return data;
-	}
-	catch (e) {
-		throw await toApiError(e);
-	}
-}
-
 export type SystemDepartmentsDetachPostQuery = z.input<(typeof schemas)["systemDepartmentsDetachPost"]["query"]>;
 export type SystemDepartmentsDetachPostData = z.infer<(typeof schemas)["systemDepartmentsDetachPost"]["data"]>;
 
@@ -307,6 +285,31 @@ export async function systemDepartmentsMembersDelete(query: SystemDepartmentsMem
 	}
 }
 
+export type SystemDepartmentsMovePutQuery = z.input<(typeof schemas)["systemDepartmentsMovePut"]["query"]>;
+export type SystemDepartmentsMovePutBody = z.input<(typeof schemas)["systemDepartmentsMovePut"]["body"]>;
+export type SystemDepartmentsMovePutData = z.infer<(typeof schemas)["systemDepartmentsMovePut"]["data"]>;
+
+export async function systemDepartmentsMovePut(input: { query: SystemDepartmentsMovePutQuery, body: SystemDepartmentsMovePutBody }): Promise<SystemDepartmentsMovePutData> {
+	const client = ensureReq();
+	try {
+		const env = await client.put(`system/departments/move`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<SystemDepartmentsMovePutData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemDepartmentsMovePutData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemDepartmentsMovePut"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemDepartmentsMovePut 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
 export type SystemLoginMethodsGetData = z.infer<(typeof schemas)["systemLoginMethodsGet"]["data"]>;
 
 export async function systemLoginMethodsGet(): Promise<SystemLoginMethodsGetData> {
@@ -449,15 +452,22 @@ export async function systemRolesPost(body: SystemRolesPostBody): Promise<System
 }
 
 export type SystemRolesDeleteQuery = z.input<(typeof schemas)["systemRolesDelete"]["query"]>;
+export type SystemRolesDeleteData = z.infer<(typeof schemas)["systemRolesDelete"]["data"]>;
 
-export async function systemRolesDelete(query: SystemRolesDeleteQuery): Promise<unknown> {
+export async function systemRolesDelete(query: SystemRolesDeleteQuery): Promise<SystemRolesDeleteData> {
 	const client = ensureReq();
 	try {
-		const env = await client.delete(`system/roles`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<unknown>>();
+		const env = await client.delete(`system/roles`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<SystemRolesDeleteData>>();
 		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
 		if (typeof env.code === "number" && env.code !== 0)
 			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
-		const data = env.data as unknown;
+		const data = env.data as SystemRolesDeleteData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemRolesDelete"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemRolesDelete 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
 		return data;
 	}
 	catch (e) {
@@ -467,15 +477,22 @@ export async function systemRolesDelete(query: SystemRolesDeleteQuery): Promise<
 
 export type SystemRolesBindingsPutQuery = z.input<(typeof schemas)["systemRolesBindingsPut"]["query"]>;
 export type SystemRolesBindingsPutBody = z.input<(typeof schemas)["systemRolesBindingsPut"]["body"]>;
+export type SystemRolesBindingsPutData = z.infer<(typeof schemas)["systemRolesBindingsPut"]["data"]>;
 
-export async function systemRolesBindingsPut(input: { query: SystemRolesBindingsPutQuery, body: SystemRolesBindingsPutBody }): Promise<unknown> {
+export async function systemRolesBindingsPut(input: { query: SystemRolesBindingsPutQuery, body: SystemRolesBindingsPutBody }): Promise<SystemRolesBindingsPutData> {
 	const client = ensureReq();
 	try {
-		const env = await client.put(`system/roles/bindings`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<unknown>>();
+		const env = await client.put(`system/roles/bindings`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<SystemRolesBindingsPutData>>();
 		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
 		if (typeof env.code === "number" && env.code !== 0)
 			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
-		const data = env.data as unknown;
+		const data = env.data as SystemRolesBindingsPutData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemRolesBindingsPut"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemRolesBindingsPut 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
 		return data;
 	}
 	catch (e) {
@@ -507,15 +524,22 @@ export async function systemSettingsGet(): Promise<SystemSettingsGetData> {
 }
 
 export type SystemSettingsPutBody = z.input<(typeof schemas)["systemSettingsPut"]["body"]>;
+export type SystemSettingsPutData = z.infer<(typeof schemas)["systemSettingsPut"]["data"]>;
 
-export async function systemSettingsPut(body: SystemSettingsPutBody): Promise<unknown> {
+export async function systemSettingsPut(body: SystemSettingsPutBody): Promise<SystemSettingsPutData> {
 	const client = ensureReq();
 	try {
-		const env = await client.put(`system/settings`, { json: body }).json<OjEnvelope<unknown>>();
+		const env = await client.put(`system/settings`, { json: body }).json<OjEnvelope<SystemSettingsPutData>>();
 		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
 		if (typeof env.code === "number" && env.code !== 0)
 			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
-		const data = env.data as unknown;
+		const data = env.data as SystemSettingsPutData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemSettingsPut"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemSettingsPut 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
 		return data;
 	}
 	catch (e) {
@@ -594,23 +618,23 @@ export async function systemUsersDelete(query: SystemUsersDeleteQuery): Promise<
 	}
 }
 
-export type SystemUsersProfilePutQuery = z.input<(typeof schemas)["systemUsersProfilePut"]["query"]>;
-export type SystemUsersProfilePutBody = z.input<(typeof schemas)["systemUsersProfilePut"]["body"]>;
-export type SystemUsersProfilePutData = z.infer<(typeof schemas)["systemUsersProfilePut"]["data"]>;
+export type SystemUsersForbiddenPutQuery = z.input<(typeof schemas)["systemUsersForbiddenPut"]["query"]>;
+export type SystemUsersForbiddenPutBody = z.input<(typeof schemas)["systemUsersForbiddenPut"]["body"]>;
+export type SystemUsersForbiddenPutData = z.infer<(typeof schemas)["systemUsersForbiddenPut"]["data"]>;
 
-export async function systemUsersProfilePut(input: { query: SystemUsersProfilePutQuery, body: SystemUsersProfilePutBody }): Promise<SystemUsersProfilePutData> {
+export async function systemUsersForbiddenPut(input: { query: SystemUsersForbiddenPutQuery, body: SystemUsersForbiddenPutBody }): Promise<SystemUsersForbiddenPutData> {
 	const client = ensureReq();
 	try {
-		const env = await client.put(`system/users/profile`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<SystemUsersProfilePutData>>();
+		const env = await client.put(`system/users/forbidden`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<SystemUsersForbiddenPutData>>();
 		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
 		if (typeof env.code === "number" && env.code !== 0)
 			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
-		const data = env.data as SystemUsersProfilePutData;
+		const data = env.data as SystemUsersForbiddenPutData;
 		if (import.meta.env.DEV) {
 			const { schemas } = await import("./api.schemas");
-			const r = schemas["systemUsersProfilePut"].data.safeParse(data);
+			const r = schemas["systemUsersForbiddenPut"].data.safeParse(data);
 			if (!r.success)
-				throw new ContractApiError(-1, `[契约违例] systemUsersProfilePut 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+				throw new ContractApiError(-1, `[契约违例] systemUsersForbiddenPut 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
 		}
 		return data;
 	}
@@ -619,17 +643,24 @@ export async function systemUsersProfilePut(input: { query: SystemUsersProfilePu
 	}
 }
 
-export type SystemUsersForbiddenPutQuery = z.input<(typeof schemas)["systemUsersForbiddenPut"]["query"]>;
-export type SystemUsersForbiddenPutBody = z.input<(typeof schemas)["systemUsersForbiddenPut"]["body"]>;
+export type SystemUsersPasswordPutQuery = z.input<(typeof schemas)["systemUsersPasswordPut"]["query"]>;
+export type SystemUsersPasswordPutBody = z.input<(typeof schemas)["systemUsersPasswordPut"]["body"]>;
+export type SystemUsersPasswordPutData = z.infer<(typeof schemas)["systemUsersPasswordPut"]["data"]>;
 
-export async function systemUsersForbiddenPut(input: { query: SystemUsersForbiddenPutQuery, body: SystemUsersForbiddenPutBody }): Promise<unknown> {
+export async function systemUsersPasswordPut(input: { query: SystemUsersPasswordPutQuery, body: SystemUsersPasswordPutBody }): Promise<SystemUsersPasswordPutData> {
 	const client = ensureReq();
 	try {
-		const env = await client.put(`system/users/forbidden`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<unknown>>();
+		const env = await client.put(`system/users/password`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<SystemUsersPasswordPutData>>();
 		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
 		if (typeof env.code === "number" && env.code !== 0)
 			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
-		const data = env.data as unknown;
+		const data = env.data as SystemUsersPasswordPutData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemUsersPasswordPut"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemUsersPasswordPut 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
 		return data;
 	}
 	catch (e) {
@@ -637,17 +668,24 @@ export async function systemUsersForbiddenPut(input: { query: SystemUsersForbidd
 	}
 }
 
-export type SystemUsersPasswordPutQuery = z.input<(typeof schemas)["systemUsersPasswordPut"]["query"]>;
-export type SystemUsersPasswordPutBody = z.input<(typeof schemas)["systemUsersPasswordPut"]["body"]>;
+export type SystemUsersProfilePutQuery = z.input<(typeof schemas)["systemUsersProfilePut"]["query"]>;
+export type SystemUsersProfilePutBody = z.input<(typeof schemas)["systemUsersProfilePut"]["body"]>;
+export type SystemUsersProfilePutData = z.infer<(typeof schemas)["systemUsersProfilePut"]["data"]>;
 
-export async function systemUsersPasswordPut(input: { query: SystemUsersPasswordPutQuery, body: SystemUsersPasswordPutBody }): Promise<unknown> {
+export async function systemUsersProfilePut(input: { query: SystemUsersProfilePutQuery, body: SystemUsersProfilePutBody }): Promise<SystemUsersProfilePutData> {
 	const client = ensureReq();
 	try {
-		const env = await client.put(`system/users/password`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<unknown>>();
+		const env = await client.put(`system/users/profile`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<SystemUsersProfilePutData>>();
 		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
 		if (typeof env.code === "number" && env.code !== 0)
 			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
-		const data = env.data as unknown;
+		const data = env.data as SystemUsersProfilePutData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemUsersProfilePut"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemUsersProfilePut 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
 		return data;
 	}
 	catch (e) {
@@ -657,15 +695,22 @@ export async function systemUsersPasswordPut(input: { query: SystemUsersPassword
 
 export type SystemUsersRolesPutQuery = z.input<(typeof schemas)["systemUsersRolesPut"]["query"]>;
 export type SystemUsersRolesPutBody = z.input<(typeof schemas)["systemUsersRolesPut"]["body"]>;
+export type SystemUsersRolesPutData = z.infer<(typeof schemas)["systemUsersRolesPut"]["data"]>;
 
-export async function systemUsersRolesPut(input: { query: SystemUsersRolesPutQuery, body: SystemUsersRolesPutBody }): Promise<unknown> {
+export async function systemUsersRolesPut(input: { query: SystemUsersRolesPutQuery, body: SystemUsersRolesPutBody }): Promise<SystemUsersRolesPutData> {
 	const client = ensureReq();
 	try {
-		const env = await client.put(`system/users/roles`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<unknown>>();
+		const env = await client.put(`system/users/roles`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<SystemUsersRolesPutData>>();
 		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
 		if (typeof env.code === "number" && env.code !== 0)
 			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
-		const data = env.data as unknown;
+		const data = env.data as SystemUsersRolesPutData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemUsersRolesPut"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemUsersRolesPut 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
 		return data;
 	}
 	catch (e) {

package/templates/src/{system/web → app/web/system}/locales/en-US.json

@@ -228,6 +228,20 @@
 			"connectConfirm": "Connect checks: whether the app Secret can fetch a token, whether contacts are readable, and whether any member is visible. Re-run it whenever the Corporation ID / AgentId changed or the Secret was rotated.",
 			"connectOk": "Connected: {{depts}} departments visible, {{members}} members in the sample department",
 			"connectHint": "After rotating the app Secret you must click \"Verify and connect\" again, otherwise every call fails with 40001. How many people get synced depends on the app's visible scope — set it to the whole company for a full sync."
+		},
+		"tenantAdmin": {
+			"title": "Tenant administrators",
+			"hint": "Each enterprise tenant (tenant key = corp ID) gets an admin account automatically on provisioning, used to manage that tenant's org chart, members and roles. It is a tenant-level admin and cannot see other enterprises. The initial password is random and known to no one — to take over, reset a password you know here, hand it to the tenant admin, and they will be forced to change it on first login.",
+			"username": "Admin account",
+			"state": "State",
+			"exists": "Provisioned",
+			"missing": "Not provisioned",
+			"action": "Action",
+			"reset": "Reset password",
+			"resetTitle": "Reset tenant admin password",
+			"resetHint": "This resets the tenant admin password of enterprise {{corpId}}. Choose the new password yourself and deliver it out-of-band — only a bcrypt hash is stored, so no existing password can ever be shown. The admin must change it on first login, and their existing sessions are revoked immediately.",
+			"resetPlaceholder": "New password (at least 6 chars)",
+			"resetOk": "Tenant admin password reset"
 		}
 	},
 	"err": {

package/templates/src/{system/web → app/web/system}/locales/zh-CN.json

@@ -228,6 +228,20 @@
 			"connectConfirm": "接入会依次校验：应用 Secret 能否换 token、能否读通讯录、可见范围内能否读到人。改过企业ID / AgentId 或换过 Secret 都必须重新点一次。",
 			"connectOk": "接入成功：可见范围内 {{depts}} 个部门，示例部门 {{members}} 人",
 			"connectHint": "换过应用 Secret 后必须重新「验证并接入」，否则所有调用都会 40001；同步到多少人取决于「应用可见范围」，要全量请设为全公司。"
+		},
+		"tenantAdmin": {
+			"title": "租户管理员",
+			"hint": "每个企业租户（租户键＝企业ID）在开通时会自动建一个 admin 账号，用于管理本租户的组织架构、成员与角色。它是**租户级**管理员，看不到别家企业。初始口令随机且无人知晓——需要接管时由你在这里重设一个已知口令，交给对方后对方首次登录会被强制改密。",
+			"username": "管理员账号",
+			"state": "状态",
+			"exists": "已开通",
+			"missing": "未开通",
+			"action": "操作",
+			"reset": "重设口令",
+			"resetTitle": "重设租户管理员口令",
+			"resetHint": "将重设企业 {{corpId}} 的租户管理员口令。新口令请自行设定并线下告知对方——系统只存 bcrypt，不会也无法回显任何已有口令。重设后对方首次登录必须改密，其旧会话立即失效。",
+			"resetPlaceholder": "新口令（至少 6 位）",
+			"resetOk": "租户管理员口令已重设"
 		}
 	},
 	"err": {

package/templates/src/{system/web → app/web/system}/pages/users/index.tsx

@@ -19,7 +19,8 @@ type UserRow = SystemUsersGetData[number];
 /**
  * 用户管理（C1）：GET /system/users 列表 + 建号 / 禁用切换 / 重置口令。
  * 本人行禁用一切自操作（后端 assertNotSelf 400 兜底，前端不给会失败的按钮，R3）；
- * 成员资格入口仅 superadmin 可见（成员资格写是 superadmin-only，规格 §4）。
+ * 成员资格入口：superadmin 与 **本租户 admin** 均可见（授予 admin 已下放到租户内，
+ * 但授予 superadmin 仍只许 superadmin——见 domain/users.ts::assertMembershipAllowed）。
  * 部门列标出主部门，顶部可按部门筛选（含子部门）——筛选在前端做，名单本来就是一页全量。
  */
 export default function UsersPage() {
@@ -30,6 +31,8 @@ export default function UsersPage() {
 	const me = useUserStore(s => s.id);
 	const myRoles = useUserStore(s => s.roles);
 	const isSuper = myRoles.includes("superadmin");
+	// 任命本租户管理员已下放到租户内的 admin（提权到 superadmin 仍只许 superadmin）
+	const canManageMembership = isSuper || myRoles.includes("admin");
 
 	const [createOpen, setCreateOpen] = useState(false);
 	const [createForm] = Form.useForm<{ username: string, password: string, displayName?: string, email?: string }>();
@@ -129,7 +132,7 @@ export default function UsersPage() {
 					<Button size="small" disabled={String(row.id) === me} onClick={() => setPwdTarget(row)}>
 						{t("system:users.resetPwd")}
 					</Button>
-					{isSuper
+					{canManageMembership
 						? (
 							<Button size="small" type="link" onClick={() => navigate(`/system/users/${row.id}/roles`)}>
 								{t("system:users.membership")}

package/templates/src/{system/web → app/web/system}/pages/users/roles.tsx

@@ -11,9 +11,13 @@ import { explainError, isForbidden } from "../errors";
 import { ForbiddenPanel } from "../forbidden";
 
 /**
- * 成员资格（AC1-7，superadmin-only）：整集替换某用户角色。后端无 GET 单用户端点，
+ * 成员资格（AC1-7）：整集替换某用户角色。后端无 GET 单用户端点，
  * 当前角色从 GET /system/users 列表按 uid 回显；写走 PUT /system/users/roles?uid=。
- * admin（非 superadmin）手输 URL 进入后提交会被 service 层 403 → 页面渲染无权限（§3.2）。
+ *
+ * 可见性已从「superadmin-only」放宽到「本租户 admin 也可以」（见 users/index.tsx 的入口）：
+ * 授予 admin 已下放到租户内，否则企业租户永远配不出管理员（平台 superadmin 因租户
+ * 隔离查不到企业租户的用户）。但 **superadmin 仍只许 superadmin 授**——它握着跨租户
+ * 权限，故这里对非 superadmin 直接把该选项置灰，比让他提交后吃 403 清楚。
  */
 export default function UserRolesPage() {
 	const { t } = useTranslation();
@@ -22,6 +26,8 @@ export default function UserRolesPage() {
 	const { uid } = useParams();
 	const queryClient = useQueryClient();
 	const me = useUserStore(s => s.id);
+	const myRoles = useUserStore(s => s.roles);
+	const isSuper = myRoles.includes("superadmin");
 
 	// null = 尚未改动，回显服务端值；一旦勾选即持本地整集
 	const [selected, setSelected] = useState<string[] | null>(null);
@@ -51,7 +57,12 @@ export default function UserRolesPage() {
 		<Card title={`${t("system:userRoles.title")}: ${user?.username ?? `#${uid}`}`}>
 			<Space direction="vertical">
 				<Checkbox.Group
-					options={(rolesQuery.data ?? []).map(r => ({ label: `${r.name}${r.deprecated ? "（已废弃）" : ""}`, value: r.name }))}
+					options={(rolesQuery.data ?? []).map(r => ({
+						label: `${r.name}${r.deprecated ? "（已废弃）" : ""}`,
+						value: r.name,
+						// 非 superadmin 授不了平台级角色：置灰，提交后 403 太晚也太含糊
+						disabled: r.name === "superadmin" && !isSuper,
+					}))}
 					value={value}
 					onChange={v => setSelected(v)}
 				/>

package/templates/src/{system/web → app/web/system}/pages/wecom/index.tsx

@@ -1,6 +1,6 @@
 import { request, useUserStore } from "@oj-module/runtime";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { Alert, App, Button, Card, Descriptions, Popconfirm, QRCode, Space, Table, Tag, Typography } from "antd";
+import { Alert, App, Button, Card, Descriptions, Input, Modal, Popconfirm, QRCode, Space, Table, Tag, Typography } from "antd";
 import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 
@@ -47,6 +47,16 @@ interface ConnectResult {
 	members: number
 }
 
+/** GET /auth/wecom/admin/tenant-admin：某企业的租户管理员状态 */
+interface TenantAdminState {
+	corpId: string
+	username: string
+	/** 该租户是否已有一个握着 admin 角色的账号 */
+	exists: boolean
+	/** 是否须改密（开通后恒 true，直到本人改过一次） */
+	mustChange: boolean
+}
+
 /**
  * 端点不在本模块的生成 client 里（`__client` 按模块切分），故直接用 runtime 的 ky 出口。
  * 路径不带前导 `/`：与 request 的 baseURL 拼接口径一致（fetchLogin 同款）。
@@ -80,6 +90,24 @@ async function connectCorp(): Promise<ConnectResult> {
 	return env.data;
 }
 
+async function fetchTenantAdmin(corpId: string): Promise<TenantAdminState> {
+	const env = await request.get("auth/wecom/admin/tenant-admin", { searchParams: { corpId } }).json<{ code: number, data?: TenantAdminState }>();
+	return env.data ?? { corpId, username: "admin", exists: false, mustChange: false };
+}
+
+/**
+ * 重设租户管理员口令。
+ *
+ * 口令**不由系统生成**：让 superadmin 自己输入，他知道这个值 → 直接告知对方即可。
+ * 后端只存 bcrypt，没有任何可逆副本，所以「系统生成后回显」这条路本来也走不通。
+ */
+async function resetTenantAdminPassword(input: { corpId: string, password: string }): Promise<TenantAdminState> {
+	const env = await request.post("auth/wecom/admin/tenant-admin/password", { json: input }).json<{ code: number, data?: TenantAdminState }>();
+	if (!env.data)
+		throw new Error("企业微信未返回重设结果");
+	return env.data;
+}
+
 /**
  * 企微后台（superadmin 独占），两块卡片按「本部署配了哪套凭据」决定显不显示：
  *   · 代开发：已授权企业 × 应用清单、启停、开通入口（点「生成开通链接」→ 后端调
@@ -155,6 +183,80 @@ export default function WecomAdminPage() {
 		onError: e => message.error(explainError(e, t)),
 	});
 
+	// 企业清单按 corp_id 去重：租户键就是 corp_id，同一企业的多个应用共用一个租户管理员
+	const corps = [...new Map((appsQuery.data ?? []).map(r => [r.corp_id, { corpId: r.corp_id, name: r.corp_name }])).values()];
+
+	// 租户管理员状态：一个企业一条查询并并发取（企业数量级很小，不值得为它加批量端点）
+	const tenantAdminQuery = useQuery({
+		queryKey: ["system", "wecom-tenant-admin", corps.map(c => c.corpId).join(",")],
+		queryFn: async () => {
+			const out: Record<string, TenantAdminState> = {};
+			await Promise.all(corps.map(async (c) => {
+				out[c.corpId] = await fetchTenantAdmin(c.corpId);
+			}));
+			return out;
+		},
+		enabled: isSuper && corps.length > 0,
+		retry: false,
+	});
+
+	const [resetTarget, setResetTarget] = useState<{ corpId: string, name: string | null } | null>(null);
+	const [resetPwd, setResetPwd] = useState("");
+
+	const resetMut = useMutation({
+		mutationFn: resetTenantAdminPassword,
+		onSuccess: () => {
+			message.success(t("system:wecom.tenantAdmin.resetOk"));
+			setResetTarget(null);
+			setResetPwd("");
+			queryClient.invalidateQueries({ queryKey: ["system", "wecom-tenant-admin"] });
+		},
+		onError: e => message.error(explainError(e, t)),
+	});
+
+	const tenantAdminColumns = [
+		{
+			title: t("system:wecom.col.corp"),
+			dataIndex: "corpId",
+			render: (_: string, row: { corpId: string, name: string | null }) => (
+				<div>
+					<div>{row.corpId}</div>
+					{row.name && <Typography.Text type="secondary">{row.name}</Typography.Text>}
+				</div>
+			),
+		},
+		{
+			title: t("system:wecom.tenantAdmin.username"),
+			dataIndex: "username",
+			render: (_: unknown, row: { corpId: string }) => tenantAdminQuery.data?.[row.corpId]?.username ?? "-",
+		},
+		{
+			title: t("system:wecom.tenantAdmin.state"),
+			dataIndex: "exists",
+			render: (_: unknown, row: { corpId: string }) => {
+				const s = tenantAdminQuery.data?.[row.corpId];
+				return s?.exists
+					? <Tag color="green">{t("system:wecom.tenantAdmin.exists")}</Tag>
+					: <Tag color="orange">{t("system:wecom.tenantAdmin.missing")}</Tag>;
+			},
+		},
+		{
+			title: t("system:wecom.tenantAdmin.action"),
+			key: "action",
+			render: (_: unknown, row: { corpId: string, name: string | null }) => (
+				<Button
+					size="small"
+					onClick={() => {
+						setResetTarget(row);
+						setResetPwd("");
+					}}
+				>
+					{t("system:wecom.tenantAdmin.reset")}
+				</Button>
+			),
+		},
+	];
+
 	if (!isSuper)
 		return <ForbiddenPanel t={t} />;
 
@@ -319,6 +421,42 @@ export default function WecomAdminPage() {
 					</Typography.Paragraph>
 				</Card>
 			)}
+			{corps.length > 0 && (
+				<Card title={t("system:wecom.tenantAdmin.title")}>
+					<Typography.Paragraph type="secondary">
+						{t("system:wecom.tenantAdmin.hint")}
+					</Typography.Paragraph>
+					<Table
+						rowKey={row => row.corpId}
+						size="small"
+						loading={tenantAdminQuery.isLoading}
+						dataSource={corps}
+						columns={tenantAdminColumns}
+						pagination={false}
+					/>
+				</Card>
+			)}
+			<Modal
+				open={resetTarget != null}
+				title={t("system:wecom.tenantAdmin.resetTitle")}
+				onCancel={() => {
+					setResetTarget(null);
+					setResetPwd("");
+				}}
+				onOk={() => resetMut.mutate({ corpId: resetTarget!.corpId, password: resetPwd })}
+				confirmLoading={resetMut.isPending}
+				okButtonProps={{ disabled: resetPwd.length < 6 }}
+				destroyOnHidden
+			>
+				<Typography.Paragraph type="secondary">
+					{t("system:wecom.tenantAdmin.resetHint", { corpId: resetTarget?.corpId ?? "" })}
+				</Typography.Paragraph>
+				<Input.Password
+					value={resetPwd}
+					onChange={e => setResetPwd(e.target.value)}
+					placeholder={t("system:wecom.tenantAdmin.resetPlaceholder")}
+				/>
+			</Modal>
 			<Card title={t("system:wecom.appsTitle")}>
 				<Typography.Paragraph type="secondary" style={{ marginBottom: 12 }}>
 					{t("system:wecom.authModeHint")}