@robot-admin/naive-ui-components 0.13.5 → 0.13.7

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @robot-admin/naive-ui-components
 
+## 0.13.7
+
+- `C_Form` 正式集成 `@robot-admin/form-validate@3.4.2`，统一消费原生规则、验证库规则和 `RuleSpec`，并通过表单入口导出已适配的 `PRESET_RULES`、`NAIVE_COMBOS` 与 `SPEC_RULES`。
+- 提供默认步骤提交按钮和 `action-extra` 业务操作插槽，复用组件内部的校验、防重复提交、加载与错误反馈；成功/重置提示由业务按需配置。
+- 修复规则回调异常后提交跳过校验的问题；提交支持取消信号，组件卸载后不继续触发提交事件或成功提示，禁用/只读状态不能通过实例方法绕过。
+
+## 0.13.6
+
+### Patch Changes
+
+- 新增 `C_Loading`：内置机器人数据扫描 SVG，随 Naive UI 主色变化，支持尺寸、文案和颜色配置，无在线图标、定时器或新增依赖。动画尊重系统减少动态效果设置，提供读屏状态说明。
+- `C_Table` 默认使用新的加载态，并开放 `loading` 插槽；全量、按需及 base 样式入口均包含加载组件样式。加载过程继续保留已有表格内容，不改变请求或交互锁定逻辑。
+
 ## 0.13.5
 
 ### Patch Changes

package/README.md

@@ -4,7 +4,7 @@
 
 **基于 Naive UI 的 Vue 3 企业级组件库**
 
-从 Robot Admin 中提炼的 53 个高质量业务组件，支持全量注册、按需导入（Tree-Shaking）和子路径独立导入。
+从 Robot Admin 中提炼的 54 个高质量业务组件，支持全量注册、按需导入（Tree-Shaking）和子路径独立导入。
 
 [![NPM Version](https://img.shields.io/npm/v/@robot-admin/naive-ui-components)](https://www.npmjs.com/package/@robot-admin/naive-ui-components)
 [![License](https://img.shields.io/npm/l/@robot-admin/naive-ui-components)](./LICENSE)
@@ -198,7 +198,42 @@ import '@robot-admin/naive-ui-components/C_Table/base.css'
 </template>
 ```
 
-自定义操作栏应调用 `action` 插槽的 `submit()`，不要用 `validate()` 代替提交。步骤布局的 `step-actions` 插槽同时提供 `isLastStep`、`submit()` 和 `submitting`，可在最后一步直接放置提交按钮。异步保存放在 `config.onSubmit` 中并等待完成；`@submit` 是保存成功后的通知事件，不承诺等待监听器返回的 Promise。
+表单已内置 `@robot-admin/form-validate`，使用侧无需另写类型适配，也不用重复安装验证依赖。`rules` / `rulesWhen` 直接接受 Naive UI 原生规则、验证库的 `NaiveRule` 和框架无关的 `RuleSpec`，可以混用；`required: true` 同样复用验证库的空值判断，`0` 和 `false` 不会被误判为空。
+
+```ts
+import {
+  defineFormOptions,
+  PRESET_RULES,
+  NAIVE_COMBOS,
+  SPEC_RULES,
+} from '@robot-admin/naive-ui-components/C_Form'
+
+const fields = defineFormOptions([
+  {
+    type: 'input',
+    prop: 'name',
+    label: '名称',
+    required: true,
+    rules: [SPEC_RULES.length('名称', 2, 20)],
+  },
+  {
+    type: 'input',
+    prop: 'email',
+    label: '邮箱',
+    rules: NAIVE_COMBOS.email('邮箱'),
+  },
+  {
+    type: 'input',
+    prop: 'mobile',
+    label: '手机号',
+    rules: [PRESET_RULES.mobile('手机号')],
+  },
+])
+```
+
+普通表单默认提供提交与重置，步骤表单最后一步默认提供提交按钮。只需配置 `submitText`、`resetText` 和 `onSubmit`；要增加预览等业务操作，使用 `action-extra` 插槽即可保留默认按钮和加载管理。需要完全定制时仍可覆盖 `action` / `step-actions`，并调用插槽的 `submit()`，不要用 `validate()` 代替提交。
+
+异步保存放在 `config.onSubmit` 中并等待完成；`@submit` 是完成后的通知事件，不等待监听器返回的 Promise。第二参数提供 `context?.signal`，可直接传给支持取消的请求；组件卸载会发出取消信号，并停止晚到的提交事件和提示。`submitSuccessText` / `resetSuccessText` 为可选反馈文案，默认不显示成功提示，也不代表数据已持久化。
 
 新增/编辑场景推荐用 `C_FormModal` 直接消费 Headless CRUD 的结构化 `editor`。字段、校验和布局继续由 `C_Form` 配置驱动，页面不再重复编写 Modal、按钮、loading 和草稿状态；默认采用紧凑小尺寸表单和右下角带图标操作按钮，宽度、表单尺寸与动作文案仍可覆盖：
 
@@ -433,7 +468,18 @@ const config = defineTableConfig({
 
 `C_Login` 的“记住我”只保存用户名，不保存密码。短信验证码仅对格式正确的手机号触发事件；组件会立即开始本地倒计时，发送结果和服务端限流仍由宿主处理。`C_City` 在首次打开时才加载城市索引，字母跳转只作用于当前实例；默认触发器、字母和城市项均可用键盘操作。
 
-### 📋 组件清单（53 个）
+### 表格加载态
+
+`C_Table` 默认显示跟随主题主色的机器人 SVG 加载动画，保留已有数据，并遵循系统减少动态效果设置，无需页面配置。可通过 `loading` 插槽替换默认内容。独立的 `C_Loading` 支持 `size`（16–120，默认 48）、`label`（可选说明）和 `color`（可选颜色）；原生 `NSpin` 使用时请关闭旋转，避免 SVG 整体转动：
+
+```vue
+<NSpin :show="loading" :size="48" :rotate="false">
+  <template #icon><C_Loading /></template>
+  <section>页面内容</section>
+</NSpin>
+```
+
+### 📋 组件清单（54 个）
 
 > 💡 所有组件均提供 **在线交互演示**，访问 [组件文档](https://www.tzagileteam.com/robot/components/preface) 可直接在页面中体验真实效果（通过 iframe 嵌入 Robot Admin 生产环境）。
 
@@ -442,6 +488,7 @@ const config = defineTableConfig({
 | 组件             | 说明                    | 外部依赖                      |
 | ---------------- | ----------------------- | ----------------------------- |
 | `C_Icon`         | Iconify 图标封装        | `@iconify/vue`                |
+| `C_Loading`      | 主题化 SVG 加载态       | -                             |
 | `C_Code`         | 代码高亮显示            | `highlight.js`                |
 | `C_Barcode`      | 条形码生成器            | `@chenfengyuan/vue-barcode`   |
 | `C_Captcha`      | 拼图/ALTCHA 人机验证    | `vue3-puzzle-vcode`、`altcha` |
@@ -554,7 +601,7 @@ bun add vue naive-ui
 
 ```
 bun run build
-  ├── 1. tsdown          → 多入口打包（53 组件 ESM/CJS/DTS）
+  ├── 1. tsdown          → 多入口打包（54 组件 ESM/CJS/DTS）
   ├── 2. sass CLI        → 编译共享变量入口 → global-scss.css
   ├── 3. merge-css.js    → 合并 Vue 编译后的 SFC CSS + 全局变量 → style.css
   ├── 4. gen-exports.js  → 自动生成 package.json exports 映射
@@ -564,7 +611,7 @@ bun run build
 
 #### 技术要点
 
-- **构建引擎**：[tsdown](https://github.com/rolldown/tsdown)（基于 Rolldown），53 个独立入口并行编译
+- **构建引擎**：[tsdown](https://github.com/rolldown/tsdown)（基于 Rolldown），54 个独立入口并行编译
 - **SCSS 处理**：自定义 `scssTransformPlugin` 在 Rolldown 管线内编译 SFC SCSS，独立 Sass CLI 仅编译共享变量入口
 - **CSS 合并**：构建后将 Vue 已完成 scoped 转换的 per-chunk CSS 与共享变量合并为单一 `style.css`，避免重复样式和原始 `:deep()` 选择器泄漏
 - **类型导出**：统一 `export *` barrel 模式，自动生成完整 `.d.ts`
@@ -579,7 +626,7 @@ bun run build
 ```
 dist/
 ├── index.js / index.cjs / index.d.ts     # 主入口
-├── C_Form.js / C_Form.cjs / C_Form.d.ts  # 子路径入口（53 组件）
+├── C_Form.js / C_Form.cjs / C_Form.d.ts  # 子路径入口（54 组件）
 ├── C_Form.base.css / C_Form.full.css      # 基础/完整样式层级
 ├── C_Table.base.css / C_Table.full.css    # 基础/完整样式层级
 ├── style.css                              # 合并后的全量样式
@@ -663,6 +710,14 @@ bun run release         # 发布 Changesets 中待发布版本
 
 本仓库的 GitHub 变更日志生成器要求在执行 `bun run version` 时提供 `GITHUB_TOKEN`，不要将令牌写入仓库。Windows 下如果 `bun run release` 在 npm 的 `prepublishOnly` 重复验证阶段停滞，可先单独确认 `bun run verify` 成功，再在 PowerShell 中用 `$env:npm_config_ignore_scripts='true'; bun run release` 发布；该设置仅跳过已手动完成的重复生命周期验证，不应省略前一步。
 
+## 发布后的安全扫描记录（2026-10-06）
+
+`0.13.5` 的 npm 产物与已验证产物内容一致。随后安全扫描更新了开发工具和解析依赖的锁文件，并将仓库 overrides 中的 `@xmldom/xmldom`、`fast-uri` 固定到 `0.8.15`、`3.1.8`；这部分仓库维护不覆盖已经发布的 npm 产物。
+
+当前扫描仍报告 [braces](https://github.com/advisories/GHSA-vfj7-8cjw-p6xm) 和 [sprintf-js](https://github.com/advisories/GHSA-hp3w-g68c-fv3c) 两项上游尚无发布修复版本的告警，`bun run check:audit` 仍非零退出。保留 CI 安全门禁和真实扫描结果；待上游发布修复后更新锁文件并复验。
+
+本机完整 `verify` 通过。同步后的 [GitHub CI](https://github.com/ChenyCHENYU/naive-ui-components/actions/runs/37463121552) 因账号 billing issue 未启动，不能将其写成远端验证通过；账号恢复后需重新运行。
+
 ## 📄 许可证
 
 MIT License

package/README_EN.md

@@ -4,7 +4,7 @@
 
 **Enterprise-grade Vue 3 component library built on Naive UI**
 
-53 production-ready business components extracted from Robot Admin, supporting global registration, on-demand imports (Tree-Shaking), and subpath imports.
+54 production-ready business components extracted from Robot Admin, supporting global registration, on-demand imports (Tree-Shaking), and subpath imports.
 
 [![NPM Version](https://img.shields.io/npm/v/@robot-admin/naive-ui-components)](https://www.npmjs.com/package/@robot-admin/naive-ui-components)
 [![License](https://img.shields.io/npm/l/@robot-admin/naive-ui-components)](./LICENSE)
@@ -166,7 +166,42 @@ const { model, formRef, bindings } = useCForm({
 })
 ```
 
-Custom action bars should call the `action` slot's `submit()` rather than treating `validate()` as submission. The step-layout `step-actions` slot also provides `isLastStep`, `submit()`, and `submitting`. Put asynchronous persistence in `config.onSubmit`; the `@submit` event is a post-success notification and does not await an event listener's promise.
+`C_Form` includes `@robot-admin/form-validate`; consumers need no local type adapter or separate validation installation. `rules` and `rulesWhen` accept native Naive UI rules, the package's `NaiveRule`, and framework-independent `RuleSpec` objects, including mixed lists. `required: true` uses the same empty-value rules and preserves valid `0` and `false` values.
+
+```ts
+import {
+  defineFormOptions,
+  PRESET_RULES,
+  NAIVE_COMBOS,
+  SPEC_RULES,
+} from '@robot-admin/naive-ui-components/C_Form'
+
+const fields = defineFormOptions([
+  {
+    type: 'input',
+    prop: 'name',
+    label: 'Name',
+    required: true,
+    rules: [SPEC_RULES.length('Name', 2, 20)],
+  },
+  {
+    type: 'input',
+    prop: 'email',
+    label: 'Email',
+    rules: NAIVE_COMBOS.email('Email'),
+  },
+  {
+    type: 'input',
+    prop: 'mobile',
+    label: 'Mobile',
+    rules: [PRESET_RULES.mobile('Mobile')],
+  },
+])
+```
+
+Normal forms provide submit/reset controls; step forms provide a submit button on their last step. Configure `submitText`, `resetText`, and `onSubmit`. Use `action-extra` for business controls such as previews while retaining the built-in buttons and loading state. Full customization remains available through `action` and `step-actions`; call the slot's `submit()` rather than treating `validate()` as submission.
+
+Put asynchronous work in `config.onSubmit`; `@submit` is a completion notification and does not await an event listener's promise. The second argument provides `context?.signal` for cancellable requests. Unmount aborts that signal and suppresses late submit events and feedback. `submitSuccessText` and `resetSuccessText` opt in to feedback; no success message is shown by default, and validation alone does not imply persistence.
 
 For create/edit flows, `C_FormModal` consumes a structural headless `editor` directly. Fields, validation, and layout remain data-driven by `C_Form`, while pages no longer own duplicate modal, draft, or loading state:
 
@@ -374,7 +409,18 @@ With `require-server-verification`, a successful response must include a server
 
 `C_Login` remembers only the username, never the password. SMS events require a valid phone number; the local countdown starts immediately, while delivery results and server-side rate limits remain the host's responsibility. `C_City` loads its city index on first open and scopes letter navigation to its own instance; the default trigger, letters, and city items are keyboard-operable.
 
-### 📋 Component List (53 Components)
+### Table loading
+
+`C_Table` uses a robot SVG loading indicator in the theme's primary color by default, retains existing data, and respects reduced-motion preferences. No page configuration is required. Override the `loading` slot for custom content. The standalone `C_Loading` accepts `size` (16–120, default 48), optional `label`, and optional `color`. Disable rotation when using it with native `NSpin`:
+
+```vue
+<NSpin :show="loading" :size="48" :rotate="false">
+  <template #icon><C_Loading /></template>
+  <section>Page content</section>
+</NSpin>
+```
+
+### 📋 Component List (54 Components)
 
 > 💡 All components provide **interactive live demos**. Visit the [Component Docs](https://www.tzagileteam.com/robot/components/preface) to try them out in real-time (rendered via iframe from Robot Admin production).
 
@@ -383,6 +429,7 @@ With `require-server-verification`, a successful response must include a server
 | Component        | Description               | External Deps                 |
 | ---------------- | ------------------------- | ----------------------------- |
 | `C_Icon`         | Iconify icon wrapper      | `@iconify/vue`                |
+| `C_Loading`      | Theme-aware SVG loading   | -                             |
 | `C_Code`         | Code highlighting         | `highlight.js`                |
 | `C_Barcode`      | Barcode generator         | `@chenfengyuan/vue-barcode`   |
 | `C_Captcha`      | Puzzle / ALTCHA captcha   | `vue3-puzzle-vcode`, `altcha` |
@@ -495,7 +542,7 @@ Install optional peers per feature: `vue-router` for `C_Breadcrumb`/`C_TagsView`
 
 ```
 bun run build
-  ├── 1. tsdown          → Multi-entry bundling (53 components ESM/CJS/DTS)
+  ├── 1. tsdown          → Multi-entry bundling (54 components ESM/CJS/DTS)
   ├── 2. sass CLI        → Compile the shared-variable entry → global-scss.css
   ├── 3. merge-css.js    → Merge Vue-compiled SFC CSS + global variables → style.css
   ├── 4. gen-exports.js  → Auto-generate package.json exports map
@@ -505,7 +552,7 @@ bun run build
 
 #### Key Technical Details
 
-- **Build engine**: [tsdown](https://github.com/rolldown/tsdown) (Rolldown-based), 53 independent entries compiled in parallel
+- **Build engine**: [tsdown](https://github.com/rolldown/tsdown) (Rolldown-based), 54 independent entries compiled in parallel
 - **SCSS processing**: Custom `scssTransformPlugin` compiles SFC SCSS within the Rolldown pipeline; standalone Sass CLI only compiles the shared-variable entry
 - **CSS merging**: Post-build merges Vue scoped-compiled per-chunk CSS with shared variables into a single `style.css`, avoiding duplicate styles and leaked raw `:deep()` selectors
 - **Type exports**: Unified `export *` barrel pattern with auto-generated `.d.ts`
@@ -520,7 +567,7 @@ bun run build
 ```
 dist/
 ├── index.js / index.cjs / index.d.ts     # Main entry
-├── C_Form.js / C_Form.cjs / C_Form.d.ts  # Subpath entries (53 components)
+├── C_Form.js / C_Form.cjs / C_Form.d.ts  # Subpath entries (54 components)
 ├── C_Form.base.css / C_Form.full.css      # Base/full style tiers
 ├── C_Table.base.css / C_Table.full.css    # Base/full style tiers
 ├── style.css                              # Merged full styles