@robot-admin/naive-ui-components 0.20.0 → 0.21.0

package/docs/architecture.md

@@ -25,7 +25,9 @@
 - ESM 使用 `.d.ts`，CJS 使用 `.d.cts`；条件类型入口与相应 JavaScript 格式对应。
 - 公共可达声明同时检查 ESM / CJS，不能引用 `naive-ui/es/*` 或 `naive-ui/lib/*` 内部路径。
 
-新增消费者契约验证使用真实 tarball，在临时目录解包并接入仓库已解析的依赖；覆盖 Node16 / NodeNext 的 ESM / CJS 类型与缺失可选 peer 的子路径运行行为。它不联网重新安装依赖，因此不能代替最低／最新依赖版本矩阵或真实应用验收。
+消费者契约验证使用真实 tarball，覆盖 Node16 / NodeNext 的 ESM / CJS 类型、轻量配置入口的注入键一致性和缺失可选 peer 的子路径运行行为。默认检查复用本地安装；`bun run check:consumer-contracts minimum` / `latest` 在临时目录联网全新安装依赖并渲染表单、表格、原生数字键菜单。CI 分别运行两种组合。类型检查保留 `skipLibCheck`，不将第三方声明内部检查冒充业务消费验证。
+
+`/config` 是独立公共配置入口，只包含注入键和协议类型，不引入呈现层。组件注册、样式与反馈适配仍由各自入口负责。
 
 ## 高亮实例
 

package/docs/guides/usage.en.md

@@ -677,3 +677,19 @@ For a concrete business model, enable dynamic insertion with the existing `dynam
 `C_Breadcrumb` keeps automatic route and manual `items` modes. Optional `menus` accepts the host's authorized menu tree directly (`path/key`, `label/meta.title`, `children`); the component emits `select(path)` and leaves authorization and navigation to the application. Supplying an empty menu explicitly exposes no route-derived shortcuts. Hidden entries and unresolved parameterized leaves are omitted from shortcuts, while the active detail page remains visible unless explicitly excluded with `meta.breadcrumb: false`.
 
 Parent buttons open a themed directory panel with page counts and current-page feedback. Narrow containers collapse intermediate path segments. Arrow keys, Home/End, Enter/Space and Escape are supported. Readonly inputs remain unchanged, disabled directories disable their descendants, and route/query/menu/size changes close stale panels. Generic text uses the existing component locale service. Existing `items`, `showIcon`, `iconSize`, `labelFormatter` and `select` remain available; manual labels are not translated again.
+
+## Configuration and behavior contracts (0.21)
+
+Use `@robot-admin/naive-ui-components/config` to import `COMPONENT_LOCALE_KEY`, `COMPONENT_FEEDBACK_KEY` and their protocol types. This entry shares injection identities with the root entry without importing components, router or the Naive feedback adapter. Provide a reactive configuration or locale getter for language changes. Built-in `zh-CN`/`en-US` text now also covers Tree, Transfer, SplitPane, Chat, NotificationCenter, Theme, Language, Skeleton and Timeline. Explicit labels remain application-owned.
+
+Form action slots receive the current model, including a normal business field named `value`. Collapsed search fields remain mounted and validated; errors expand the form. `show: false` excludes a field. Table expansion discards stale completions after dataset changes, and nested selection honors eligibility, parent limits and consistent events. Native Menu options preserve string/number keys; route-mode callbacks remain string paths. Chat drafts belong to the contact and retain at most 50 nonempty inactive drafts. ER and Workflow emit user-completed canvas edits without echoing parent updates. Human verification gates password login; SMS uses its own validation.
+
+Upload `concurrency` applies across normal and chunk upload requests. Cancellation stops subsequent hash reads; a Blob read already in progress is discarded on completion. Application-provided check/merge callbacks retain responsibility for their own network lifecycle.
+
+Excel previews preserve raw values, cell types and workbook display formatting. Sheets expand on demand. Defaults are 32 MiB per file and 100000 cells per sheet; `previewLimits: { maxBytes, maxCells }` accepts finite safe positive integers. Over-budget previews report an error and retain download access. These limits do not guarantee a bound on decompressed archive memory.
+
+WaterFall fills a visible sentinel for at most five consecutive pages, then exposes a manual continuation. Custom `footer` slots receive `paused` and `loadMore`. Continue updating `loading` and `noMore` in the host. Draggable instances sort independently by default; cross-list transfers require an explicitly shared `group`.
+
+Video supports MP4/HLS by default. DASH/FLV require a `sourceAdapters` loader returning a compatible xgplayer constructor; missing adapters enter the error state and emit `error`. Protocol SDK installation remains opt-in.
+
+Notification `categoryOptions` customizes labels/order of existing `all/system/business/alarm` categories. It does not add domain enums. The `filters` slot receives `{ controller }`; `item` and `item-actions` receive `{ message, index, busy, select, read, remove }`. Use supplied callbacks to retain busy/error handling. Approval commands, tenancy, authorization and backend contracts remain application-owned; Robot_Admin's enterprise notification store is not bundled into this preview component.

package/docs/guides/usage.md

@@ -64,6 +64,25 @@ app.mount('#app')
 
 > 子路径导入提供完整的 TypeScript 类型支持（`.d.ts`），IDE 可自动补全 props / emits / slots。组件相关工具函数（如 `createMenuOptions`）也从对应组件子路径导出，避免为了单个工具加载组件库根入口。
 
+### 按需配置语言与反馈
+
+独立 `/config` 入口只导出注入键和协议类型，不加载组件、路由或 Naive UI 适配器。与根入口使用相同的注入键，可以直接配置按需使用的组件：
+
+```ts
+import {
+  COMPONENT_LOCALE_KEY,
+  COMPONENT_FEEDBACK_KEY,
+} from '@robot-admin/naive-ui-components/config'
+
+app.provide(COMPONENT_LOCALE_KEY, { locale: 'en-US' })
+app.provide(COMPONENT_FEEDBACK_KEY, {
+  success: message.success,
+  error: text => message.error(text),
+})
+```
+
+默认中文，内置支持 `zh-CN` / `en-US`，自定义 `messages` 或 `t` 沿用现有协议。需要动态切换时提供响应式对象或 `locale` getter。Tree、Transfer、SplitPane、Chat、NotificationCenter、Theme、Language、Skeleton、Timeline 的内置文案与已有 Form/Table/Search/Breadcrumb 一起使用该上下文；业务标题、菜单名称和显式传入的文案由宿主管理。
+
 ### Composables 单独使用
 
 ```typescript
@@ -771,3 +790,40 @@ CRUD 控制器只需满足结构契约；`@robot-admin/request-core` 0.6.3 起
 组件只发出 `select(path)`，不执行路由跳转或权限请求。传入 `menus`（包括空数组）后，目录仅使用这份数据；隐藏项、无标题占位和不可直接跳转的动态参数叶页不进入快捷导航。隐藏详情页仍保留当前路径，显式 `meta.breadcrumb: false` 可隐藏对应层级。未传 `menus` 时继续使用路由子项；原生路由表并非权限边界，业务项目应传入与侧栏同源的授权菜单。
 
 已有 `items` 手动路径继续优先，标签沿用传入值并接受只读嵌套数据，`disabled` 对目录整支生效。完整路径在窄容器中自动收拢，保留当前页；目录支持方向键、Home/End、Enter/Space 和 Escape。颜色跟随 Naive 主题，浮层中的通用文案使用既有组件国际化服务。组件不保存菜单快照、不读取应用 Store，也不改写传入数据。
+
+## 状态一致性与资源边界（0.21）
+
+- 表单 `action` / `action-extra` 插槽直接提供当前业务模型，字段名 `value` 没有特殊含义。
+- 搜索折叠仅隐藏字段，字段保持挂载及校验；失败自动展开。`show: false` 才移除该字段的渲染与校验注册。大型自定义控件会在折叠状态初始化，应按业务配置实际需要的字段。
+- 表格全部展开在换数据或卸载后失效；子表禁选、父级数量上限、strict 联动与选择事件保持同一约束。
+- Menu 的路由模式事件仍为字符串路径；原生 `options` 支持字符串和数字 key，`0` 有效，`1` 与 `'1'` 不合并。
+- Chat 按会话保留草稿，发送后清空当前草稿；移除联系人清理旧草稿，最多缓存最近 50 个非空会话。
+- ER 的节点拖动与 Workflow 的拖动、连接、删除会同步外部快照；父级回填不再次触发用户变更事件。
+- Login 的人机验证门禁适用于密码模式；短信模式使用自己的字段规则及验证码提交事件。
+
+### 上传、文档和长列表
+
+`C_Upload.concurrency` 统一限制普通上传与分片上传请求。取消、移除和卸载会停止后续哈希读取并释放排队任务；已经开始的单次 Blob 读取完成后不再处理结果。业务自行提供的校验、合并回调仍由业务负责其网络生命周期。
+
+Excel 保留原始值、单元格类型和工作簿格式，不把文本编号转换为数值，也不自行舍入小数。工作表数据在首次打开时展开，默认文件预算 32 MiB、每表 100000 格；超限明确提示下载原文件，不静默截断。可使用一个配置调整预算：
+
+```vue
+<C_FilePreview
+  :file="file"
+  :preview-limits="{ maxBytes: 64 * 1024 * 1024, maxCells: 200000 }"
+/>
+```
+
+预算必须是有限安全正整数；这是预览资源限制，不是压缩文件解压后内存的绝对保证。
+
+WaterFall 会在哨兵持续可见时继续补页，每轮最多自动请求 5 页，避免空响应循环。达到上限后可点击“继续加载”；自定义 `footer` 插槽获得 `paused` 和 `loadMore`。使用侧继续维护 `loading` 和 `noMore`。
+
+Draggable 默认只在自身排序。需要跨列表拖动时，在相关实例上显式设置相同 `group`；此前依赖隐式 `default` 分组的页面应补上该属性。
+
+### 视频协议与通知预览
+
+视频默认支持 MP4/HLS。DASH/FLV 需要通过 `sourceAdapters` 提供按需加载、兼容 xgplayer 接口的播放器构造器；缺少适配器会进入错误状态并发出 `error`，不再尝试当作普通 MP4 播放。协议 SDK 的依赖与授权由使用该协议的项目管理。
+
+`C_NotificationCenter.categoryOptions` 只定制已有 `all/system/business/alarm` 分类的标签和顺序，不扩展消息领域协议。`filters` 插槽提供 `{ controller }`，`item` / `item-actions` 提供 `{ message, index, busy, select, read, remove }`，可组合独立筛选和业务操作。异步操作应沿用提供的回调以保留 busy/错误处理。
+
+审批命令、租户、权限和后端协议由宿主管理。Robot_Admin 的企业消息使用领域 Store 与自己的通知铃铛；本包提供可复用的通知展示与交互，二者的能力边界不同。

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "基于 Naive UI 的 Vue 3 组件库",
   "packageManager": "bun@1.3.14",
   "engines": {
@@ -25,6 +25,16 @@
         "default": "./dist/index.cjs"
       }
     },
+    "./config": {
+      "import": {
+        "types": "./dist/config.d.ts",
+        "default": "./dist/config.js"
+      },
+      "require": {
+        "types": "./dist/config.d.cts",
+        "default": "./dist/config.cjs"
+      }
+    },
     "./style.css": "./dist/style.css",
     "./resolver": {
       "import": {
@@ -96,7 +106,7 @@
     "check:dist": "node scripts/check-dist-entries.js",
     "check:size": "node scripts/check-size-budget.js",
     "check:consumer-size": "node scripts/check-consumer-size.js",
-    "check:audit": "bun audit",
+    "check:audit": "node scripts/check-dependency-security.js",
     "check:package": "node scripts/check-package-contract.js",
     "check:quality": "node scripts/check-source-quality.js",
     "check:consumer-types": "vue-tsc --noEmit -p tests/consumer/tsconfig.json",
@@ -115,12 +125,13 @@
     "commitlint": "commitlint",
     "format": "prettier --write src/",
     "test:components": "vitest run --config vitest.config.ts",
-    "type-check:components": "vue-tsc --noEmit -p tests/components/tsconfig.json"
+    "type-check:components": "vue-tsc --noEmit -p tests/components/tsconfig.json",
+    "check:audit:raw": "bun audit --json"
   },
   "peerDependencies": {
-    "vue": "^3.5.0",
+    "vue": "^3.5.3",
     "naive-ui": "^2.35.0",
-    "vue-router": "^4.6.4",
+    "vue-router": "^4.6.4 || ^5.3.1",
     "sortablejs": "^1.15.7"
   },
   "peerDependenciesMeta": {
@@ -150,7 +161,7 @@
     "@wangeditor-next/editor": "6.2.0",
     "@wangeditor-next/editor-for-vue": "6.2.0",
     "altcha": "3.2.2",
-    "dompurify": "^3.4.14",
+    "dompurify": "^3.4.17",
     "driver.js": "^1.8.0",
     "highlight.js": "^11.12.0",
     "html2canvas": "^1.4.1",
@@ -209,10 +220,12 @@
     "unocss": "66.10.5",
     "unplugin-vue": "^7.2.0",
     "unplugin-vue-components": "^31.1.0",
-    "vite": "^8.2.2",
-    "vitest": "^4.1.11",
+    "vite": "8.2.4",
+    "vitest": "4.1.12",
     "vue": "^3.5.42",
-    "vue-tsc": "^3.3.11"
+    "vue-tsc": "^3.3.11",
+    "vue-router": "^5.3.1",
+    "sortablejs": "1.15.7"
   },
   "overrides": {
     "@xmldom/xmldom": "0.8.15",
@@ -224,7 +237,8 @@
     "minimist": "1.2.8",
     "protocol-buffers-schema": "3.6.1",
     "tmp": "0.2.7",
-    "yaml": "2.9.0"
+    "yaml": "2.9.0",
+    "markdown-it": "14.3.3"
   },
   "config": {
     "commitizen": {
@@ -243,5 +257,8 @@
     "*.{json,md,yml,yaml}": [
       "prettier --write"
     ]
+  },
+  "patchedDependencies": {
+    "braces@3.0.3": "patches/braces@3.0.3.patch"
   }
 }

package/dist/context.cjs

@@ -1 +0,0 @@
-const e=Symbol(`robot-component-feedback`),t=Symbol(`robot-component-locale`);Object.defineProperty(exports,`n`,{enumerable:!0,get:function(){return t}}),Object.defineProperty(exports,`t`,{enumerable:!0,get:function(){return e}});

package/dist/context.js

@@ -1 +0,0 @@
-const e=Symbol(`robot-component-feedback`),t=Symbol(`robot-component-locale`);export{t as n,e as t};