@robot-admin/naive-ui-components 0.21.0 → 0.22.0

package/docs/architecture.en.md

@@ -22,6 +22,7 @@ The core is currently an internal boundary, not a separately published package.
 - Full installation registers the public `C_*` names, avoiding collisions between inferred `index.vue` names or a host application's `index` component.
 - The root entry aggregates all components, including navigation, and preserves full installation. Runtime root imports require the optional `vue-router` peer, even for a non-routing named export. Applications without a router should use component subpaths.
 - `sortablejs` is needed only for the corresponding drag features. Selective JS loading does not mean ordinary runtime dependencies are selectively installed.
+- SheetJS 0.20.3 is built from the unchanged official archive, verified against its SHA-512, installed build inputs and license. Its runtime ships in separate chunks, removing the consumer's CDN installation requirement. FilePreview loads it with the component; table XLSX export loads it on demand. Base form/table entry budgets remain enforced. See [third-party notices](../THIRD_PARTY_NOTICES.md).
 - ESM resolves `.d.ts`; CJS resolves `.d.cts`. Each declaration condition matches its JavaScript format.
 - All public reachable declarations are checked for `naive-ui/es/*` and `naive-ui/lib/*` internal imports, in both formats.
 

package/docs/architecture.md

@@ -22,6 +22,7 @@
 - 全量插件使用公开的 `C_*` 名称注册组件，不以 SFC 的编译推断名注册，避免多个 `index.vue` 互相覆盖或覆盖宿主的 `index` 组件。
 - 根入口聚合全部组件并保留全量安装语义，包含导航组件；运行时导入根入口需要安装可选 peer `vue-router`，即使只使用根入口中的非路由组件。无需路由的项目优先使用组件子路径。
 - `sortablejs` 只在启用对应拖拽功能时需要。可选 peer 与 JS 按需加载不意味着普通运行依赖也按需安装。
+- SheetJS 0.20.3 的官方原始归档作为本地构建依赖锁定，经过 SHA-512、构建输入和许可证校验；运行时代码随独立产物分发。消费者安装本库不再访问 SheetJS CDN，基础表单／表格首屏仍不提前加载该代码。`C_FilePreview` 加载时需要它，表格 XLSX 导出按动作加载；不将所有文件预览描述为动作级懒加载。来源与许可证见 [THIRD_PARTY_NOTICES](../THIRD_PARTY_NOTICES.md)。
 - ESM 使用 `.d.ts`，CJS 使用 `.d.cts`；条件类型入口与相应 JavaScript 格式对应。
 - 公共可达声明同时检查 ESM / CJS，不能引用 `naive-ui/es/*` 或 `naive-ui/lib/*` 内部路径。
 

package/docs/guides/api-migration.md

@@ -0,0 +1,111 @@
+# 兼容 API 迁移
+
+现有兼容入口继续工作，本轮不移除属性、事件或导出。新代码使用下表主 API；旧项目按页面逐步迁移，不需要增加业务类型包装或批量重写。
+
+| 兼容写法                                                                                   | 主 API                                                               | 迁移要点                                                         |
+| ------------------------------------------------------------------------------------------ | -------------------------------------------------------------------- | ---------------------------------------------------------------- |
+| `C_Date` 的 `singleDate` / `singleDateTime` / `dateRange` / `dateTimeRange` / `smartRange` | `v-model` 与 `mode`                                                  | 同步迁移对应 `update:*` 监听；保持原日期格式和模式               |
+| `C_FormSearch :form-params`                                                                | `v-model` 或 `:model-value`                                          | 单向输入用 `:model-value`；需要父状态同步才用 `v-model`          |
+| `C_Menu :value` / `v-model:value`                                                          | `:model-value` / `v-model`                                           | 路由决定的选中值继续单向传入；`@select` 导航逻辑保留             |
+| 全局 `registerRenderer` / `unregisterRenderer`                                             | 应用自己的 `createFormRendererRegistry()`                            | 安装时传 `formRenderers`，或子路径接入时 `provide`               |
+| `TableEditProps` / `TableExpandProps` / `TableSelectionProps`                              | `defineTableConfig<Row>()` 与 `config.edit` / `expand` / `selection` | 旧类型不代表组件当前 props；按现行配置字段迁移，不做类型断言强转 |
+
+## 日期与查询
+
+日期的模式和值保持对应关系，不要在一个组件上同时传新旧两份模型。`modelValue` 优先于兼容属性；重复监听新旧更新事件会让应用回调执行两次。
+
+| 旧模型           | `mode`          |
+| ---------------- | --------------- |
+| `singleDate`     | `date`，可省略  |
+| `singleDateTime` | `datetime`      |
+| `dateRange`      | `daterange`     |
+| `dateTimeRange`  | `datetimerange` |
+| `smartRange`     | `smart-range`   |
+
+```vue
+<script setup lang="ts">
+  import { ref } from 'vue'
+  import { C_Date } from '@robot-admin/naive-ui-components/C_Date'
+  import { C_FormSearch } from '@robot-admin/naive-ui-components/C_FormSearch'
+
+  const period = ref<[string, string] | null>(null)
+  const query = ref({ keyword: '' })
+</script>
+
+<template>
+  <C_Date
+    v-model="period"
+    mode="daterange"
+  />
+  <C_FormSearch
+    v-model="query"
+    :form-item-list="[{ type: 'input', prop: 'keyword' }]"
+    :config="{ onSearch: params => loadRows(params.keyword) }"
+  />
+</template>
+```
+
+`loadRows` 代表应用自己的请求函数。`params` 从初始模型推导，业务不需要手写索引签名。原来仅用于同步父值的 `@change-params` 可在使用 `v-model` 后移除；其中的业务副作用要按原语义保留。请求只由 `config.onSearch` 或 `@search` 中的一处发起。
+
+`searchRef.formParams` 是仍受支持的实例读取能力，**不是**被弃用的 `formParams` 输入属性。`C_Time` 的 `defaultStartTime` 等初始值与变更事件也没有被本轮废弃。
+
+## 菜单
+
+受路由控制的菜单只替换输入属性，保持原来的导航归属：
+
+```vue
+<C_Menu :model-value="route.name" :options="menus" @select="navigate" />
+```
+
+普通本地选择使用 `v-model="selected"`；显式监听则将 `@update:value` 改为 `@update:model-value`。不要为了改用 `v-model` 而给只读的路由计算值添加无意义 setter。
+
+## 应用级表单渲染器
+
+在每次创建应用时创建 registry。SSR、多应用或测试隔离场景不要在共享模块顶层创建同一份可变 registry，除非有意共享。
+
+```ts
+import type { App } from 'vue'
+import {
+  createFormRendererRegistry,
+  FORM_RENDERER_REGISTRY_KEY,
+  type FormRenderer,
+} from '@robot-admin/naive-ui-components/C_Form'
+
+export function setupFormRenderer(app: App, inputRenderer: FormRenderer) {
+  const registry = createFormRendererRegistry()
+  const unregister = registry.register('input', inputRenderer)
+  app.provide(FORM_RENDERER_REGISTRY_KEY, registry)
+  app.onUnmount(() => {
+    unregister()
+  })
+  return registry
+}
+```
+
+全量插件接入则使用 `app.use(ComponentLib, { formRenderers: registry })`。旧的全局注册表不会自动复制到应用 registry。动态替换时优先调用 `register` 返回的注销函数：旧注册的注销函数不会误删后续新注册。只有一个表单需要定制时，继续使用组件的 `renderers` 属性即可。
+
+## 检查真实消费代码
+
+工具在**组件库源码仓库**运行，使用该仓库已安装的 TypeScript 与 Vue SFC 编译器，不加载目标项目的构建配置、不执行业务代码、不修改文件，也不新增运行时依赖。它不是已发布 npm 包的 CLI。
+
+```sh
+# 在组件库根目录，先查看报告
+bun scripts/check-legacy-usage.js /path/to/app/src --global-components
+
+# CI：出现确定的旧入口时退出 1
+bun scripts/check-legacy-usage.js /path/to/app/src --global-components --strict --json
+
+# 只检查显式 import 的项目不加 --global-components
+bun scripts/check-legacy-usage.js /path/to/app/src --strict
+
+# 本仓库持续验证主 API 示例，旧兼容测试另行保留
+bun scripts/check-legacy-usage.js tests/consumer/C_CurrentApi.vue --strict
+```
+
+- `--global-components` 仅用于已配置组件库 resolver 或全量注册的项目，同时允许自动导入的 `h`。本地同名声明和其他来源的 import 优先，不按名字硬判。
+- 检查 Vue 模板属性、旧模型/更新事件、静态 `v-bind` 对象、`h` / `createVNode`、JSX、直接旧导出/类型导入；支持包根与组件子入口的命名别名和 namespace。普通业务对象、注释、字符串、实例 `formParams` 不会被当成违规。
+- 动态 props、对象展开/动态键、动态组件、动态 import/require、外部 SFC script 和非 HTML 模板列入 `unverified`。工具不做跨模块转导出追踪、变量别名传播或运行时数据流分析；包装组件、Options API 的注册别名、模板表达式里的函数调用需人工核对。
+- 默认有旧入口时只报告；`--strict` 阻断确定的旧入口。`unverified` 不被伪装为已验证，也不会被自动改写；需要结合报告人工处理。解析错误、无有效源码或无效参数始终退出 2。
+- 默认忽略声明文件、依赖、构建产物和目录中的符号链接。传入实际源码目录；不要把整个兼容回归测试集当成必须零旧入口的消费目录。
+
+迁移后运行应用自己的类型、构建和行为验证，检查清空值、路由选择、请求次数与渲染器隔离。静态零违规不能替代这些验证。

package/docs/guides/runtime-performance.md

@@ -9,6 +9,7 @@
 | `C_Transfer`     | 左右面板分别按筛选后项数，100 项起 | 完整数据筛选、全选、禁用项、移动顺序、v-model                |
 | `C_Chat`         | 消息 200 条起；联系人 100 条起     | 图片、文件、系统消息、重发、联系人事件；实际测量变高行       |
 | `C_GlobalSearch` | 搜索结果列表                       | 完整匹配结果、上下键跨视口定位、Enter 选择、输入法与历史记录 |
+| `C_WaterFall`    | 100 项起                           | 页面／嵌套滚动、变高测量、原始索引、键盘与 KeepAlive         |
 
 ```vue
 <C_Transfer v-model="selectedKeys" :data="people" filterable />
@@ -16,7 +17,7 @@
 <C_GlobalSearch :options="searchOptions" />
 ```
 
-窗口化复用 `vueuc` 的公开 `VVirtualList`，兼容本包声明的 Naive UI 2.35；不依赖 Naive 内部导入，也不提高 Naive peer 下限。只减少渲染的 DOM，数据仍完整保存在内存中，搜索仍检查完整索引。
+聊天、穿梭框和搜索复用 `vueuc` 的公开 `VVirtualList`，瀑布流使用自己的按列区间索引；均兼容本包声明的 Naive UI 2.35，不依赖 Naive 内部导入。只减少渲染的 DOM，数据仍完整保存在内存中，搜索仍检查完整索引。瀑布流接入、键盘操作与完整 DOM 逃生见[瀑布流指南](./waterfall.md)。
 
 穿梭框的三档行高和自定义方式见[穿梭框指南](./transfer.md)。聊天会实测文本、图片和文件行高度，无需调用方预先计算高度。业务 ID 应唯一、稳定；聊天容器应有确定高度，例如外层 `height: 600px`。
 
@@ -36,3 +37,17 @@
 - 二维码渲染及每次导出分别保存配置快照。新渲染取消旧 Logo 加载，导出相互独立；卸载取消所有任务并释放 Image 事件。组件销毁期间尚未完成的导出会以 `AbortError` 拒绝，调用方按普通异步错误处理即可。
 
 这些改进不代表列表、瀑布流和编辑器可以无限增加数据。大规模业务仍应按实际场景分段加载、回收历史，并测量内存、交互延迟与目标浏览器表现。
+
+## 大表单的脏检查
+
+响应式模型按字段缓存比较结果。修改一个字段后，其他未变字段不重复遍历嵌套内容；总脏状态和完整变更报告共享比较结果。动态字段清理对应缓存，重置／`markAsClean()` 更新干净快照。
+
+Date、raw 或浅响应式路径没有完整失效信号，显式字段检查与变更报告继续实时比较。普通值的 Map／Set 保留线性查找；对象键或对象成员按结构匹配，最坏需要平方级候选查找，避免将复杂对象集合用于巨型表单热路径。
+
+完整模型同步、初始快照、提交快照仍有与数据量相关的成本。单个表单承载大量文档、文件或未编辑业务对象时，应按业务区域拆分模型；不能用脏检查优化推导整页渲染或深层监听已无成本。
+
+## 编辑器实例的释放
+
+Markdown 卸载时通过 md-editor 的公开 `getEditorView().destroy()` 释放 CodeMirror 的观察器、测量帧与实例资源；已发起的保存和图片上传晚返回时不再写入卸载后的编辑器。富文本通过官方 `createEditor()` 同步持有实例，创建通知尚未发出也能在卸载时销毁，工具栏继续使用官方 Vue 适配器。
+
+这些清理由组件负责，使用侧无需额外获取 SDK 实例或增加卸载代码。宿主自己创建的 Blob URL 仍由宿主撤销；编辑器模块与样式首次加载后的浏览器缓存不属于组件实例清理范围。

package/docs/guides/waterfall.md

@@ -0,0 +1,113 @@
+# 瀑布流与长列表
+
+`C_WaterFall` 同时负责瀑布流排布、图片懒加载、卡片测量和长列表窗口化。使用侧提供稳定的数据与加载状态即可，不需要计算可见范围或维护滚动监听。
+
+## 最小接入
+
+```vue
+<script setup lang="ts">
+  import { ref } from 'vue'
+  import {
+    C_WaterFall,
+    type WaterFallItem,
+  } from '@robot-admin/naive-ui-components/C_WaterFall'
+  import '@robot-admin/naive-ui-components/C_WaterFall/style.css'
+
+  const photos = ref<WaterFallItem[]>([
+    {
+      id: 'photo-1',
+      src: '/photos/1.jpg',
+      width: 1200,
+      height: 800,
+      title: '城市风景',
+    },
+    {
+      id: 'photo-2',
+      src: '/photos/2.jpg',
+      width: 800,
+      height: 1200,
+      title: '山间小路',
+    },
+  ])
+
+  function openPhoto(item: WaterFallItem, index: number) {
+    console.log(item.id, index)
+  }
+</script>
+
+<template>
+  <C_WaterFall
+    :items="photos"
+    @item-click="openPhoto"
+  />
+</template>
+```
+
+- `id` 必须唯一、稳定；追加和排序时保留同一业务项的标识。
+- `width`、`height` 描述图片的原始比例，用于图片未加载、卡片未挂载时估算布局。提供准确比例能减少图片加载后的位移。
+- 默认按容器宽度选择列数；需要固定列数时设置 `:columns="4"`，间距通过 `gap` 调整。
+- 列表不足 100 项时保留完整 DOM；达到 100 项后自动只挂载视口附近的卡片，并保留整列占位高度。
+
+## 页面滚动和局部滚动
+
+不需要传入滚动容器。组件自动监听窗口及上层实际裁剪容器，计算它们的交集；嵌套滚动、窗口滚动和容器尺寸变化都会更新可见范围。
+
+```vue
+<template>
+  <div style="height: 560px; overflow-y: auto">
+    <C_WaterFall
+      :items="photos"
+      :columns="3"
+    />
+  </div>
+</template>
+```
+
+暴露方法 `scrollToTop()` 将最近具有实际滚动范围的祖先滚动到本组件顶部；没有局部滚动容器时使用页面窗口。没有滚动范围的 `overflow: auto` 内容壳会被跳过；`overflow: clip/hidden` 参与视口裁剪，但不会被当作这个方法的滚动目标。组件卸载或进入 `KeepAlive` 缓存时会释放滚动监听、观察器和待执行帧，重新激活后按当前尺寸与位置恢复。
+
+## 自定义卡片与键盘
+
+```vue
+<C_WaterFall :items="photos">
+  <template #item="{ item, index, width, height }">
+    <article>
+      <img :src="item.src" :alt="item.title" :width="width" :height="height" loading="lazy" />
+      <p>{{ index + 1 }}. {{ item.title }}</p>
+    </article>
+  </template>
+</C_WaterFall>
+```
+
+卡片实际高度由 `ResizeObserver` 测量，标题换行、自定义内容变高会触发布局更新。同一帧内的图片和卡片测量会合并处理。容器宽度或图片地址变化后，组件不会继续沿用不适配的旧卡片高度。
+
+插槽的 `index` 与 `item-click` 的序号始终对应完整 `items` 数组，滚动裁剪不会将它重置为当前可见列表的序号。
+
+卡片支持 Enter/空格激活、方向键按数据顺序移动、Home/End 到首末项。窗口化时 Tab 会衔接尚未挂载的下一项，卡片内部按钮和输入框保留原生焦点顺序；正在聚焦的卡片不会因滚出视口而被卸载。
+
+窗口外的其他卡片会卸载。编辑草稿、勾选值等业务状态应放在父级数据中，以稳定 `id` 管理。确实依赖每张卡片长期保留内部 DOM 状态、浏览器全文查找或打印时，可以显式关闭窗口化：
+
+```vue
+<C_WaterFall :items="photos" :virtual-scroll="false" />
+```
+
+## 分页加载
+
+```vue
+<C_WaterFall
+  :items="photos"
+  infinite
+  :loading="loading"
+  :no-more="noMore"
+  @load-more="loadNextPage"
+/>
+```
+
+`loadNextPage` 开始时将 `loading` 设为 `true`，成功后追加数据，最后恢复为 `false`。服务端确认没有后续数据时设置 `noMore`。组件不会替使用侧发请求或推断接口总数。
+
+首屏内容不足以填满视口时，组件可以连续补页；每次连续补页最多 5 次。达到上限仍未填满时会显示“继续加载”，避免空响应或错误分页持续请求；用户也可以滚出、重新进入加载区域继续触发。自定义 footer 插槽可使用 `status`、`paused` 和 `loadMore` 保留同一交互。
+
+## 性能边界
+
+滚动时使用按列索引和二分查找，不逐项扫描完整列表；DOM 数量随可见范围、预渲染缓冲与聚焦项变化，不随总数据量持续增长。布局、数据更新和测量后的重新排布仍需处理数据集，窗口化不会替代服务端分页，也不会降低业务数据本身的内存占用。
+
+回归用固定规模数据校验了 10,000 项下的 DOM 范围，以及 100,000 项下单次范围查询少于 150 次几何字段读取；这些是确定性的复杂度与 DOM 断言，并非对不同设备帧率的承诺。

package/docs/runtime-review-20261019.md

@@ -2,6 +2,8 @@
 
 日期：2026-10-19。本轮接续[表格与组件复查](./component-review-20261019.md)，并合并远端 `fdffe29` 中已提交的地图、组织图、预览、上传、甘特及瀑布流修复。功能变更通过 Changeset 登记，源码合入不等于发布新的 npm 版本。
 
+后续更新（2026-10-24，0.22.0）：下文保留的是当时的验证记录。瀑布流窗口化已补齐，见[当前指南](./guides/waterfall.md)；表单增加按字段比较缓存及结构集合快照修复。无锁消费者安装已去除本库的 SheetJS CDN 依赖，并验证最低／最新 peer 组合；普通业务与长期性能边界仍需按真实场景评估。
+
 ## 修改及可验证收益
 
 | 路径          | 实际改进                                                                            | 验证方式                                                                                                       |

package/licenses/SheetJS.txt

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright (C) 2012-present   SheetJS LLC
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "基于 Naive UI 的 Vue 3 组件库",
   "packageManager": "bun@1.3.14",
   "engines": {
@@ -73,7 +73,9 @@
     "README.md",
     "README_EN.md",
     "CHANGELOG.md",
-    "SECURITY.md"
+    "SECURITY.md",
+    "THIRD_PARTY_NOTICES.md",
+    "licenses"
   ],
   "keywords": [
     "vue",
@@ -111,7 +113,7 @@
     "check:quality": "node scripts/check-source-quality.js",
     "check:consumer-types": "vue-tsc --noEmit -p tests/consumer/tsconfig.json",
     "check:consumer-contracts": "node scripts/check-consumer-contracts.js",
-    "verify": "bun run lint:check && bun run type-check && bun run type-check:vue && bun run test && bun run test:components && bun run type-check:components && bun run check:exports && bun run check:package && bun run check:quality && bun run build && bun run check:consumer-size && bun run check:consumer-types && bun run check:consumer-contracts",
+    "verify": "bun run lint:check && bun run type-check && bun run type-check:vue && bun run test && bun run test:components && bun run type-check:components && bun run check:exports && bun run check:vendor && bun run check:legacy && bun run check:package && bun run check:quality && bun run build && bun run check:consumer-size && bun run check:consumer-types && bun run check:consumer-contracts",
     "prepublishOnly": "bun run verify",
     "release": "changeset publish",
     "changeset": "changeset",
@@ -126,7 +128,9 @@
     "format": "prettier --write src/",
     "test:components": "vitest run --config vitest.config.ts",
     "type-check:components": "vue-tsc --noEmit -p tests/components/tsconfig.json",
-    "check:audit:raw": "bun audit --json"
+    "check:audit:raw": "bun audit --json",
+    "check:vendor": "node scripts/check-vendored-dependencies.js",
+    "check:legacy": "bun scripts/check-legacy-usage.js tests/consumer/C_CurrentApi.vue --strict"
   },
   "peerDependencies": {
     "vue": "^3.5.3",
@@ -176,8 +180,7 @@
     "vue3-puzzle-vcode": "^1.1.7",
     "vueuc": "^0.4.66",
     "xgplayer": "3.0.26",
-    "xgplayer-hls": "3.0.26",
-    "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz"
+    "xgplayer-hls": "3.0.26"
   },
   "devDependencies": {
     "@changesets/changelog-github": "^0.7.0",
@@ -207,7 +210,7 @@
     "eslint-plugin-jsdoc": "^62.9.0",
     "eslint-plugin-oxlint": "^1.80.0",
     "eslint-plugin-vue": "^10.10.0",
-    "happy-dom": "^20.14.5",
+    "happy-dom": "21.0.4",
     "husky": "^9.1.7",
     "lint-staged": "^16.4.0",
     "naive-ui": "^2.45.3",
@@ -225,12 +228,13 @@
     "vue": "^3.5.42",
     "vue-tsc": "^3.3.11",
     "vue-router": "^5.3.1",
-    "sortablejs": "1.15.7"
+    "sortablejs": "1.15.7",
+    "xlsx": "file:vendor/xlsx-0.20.3.tgz"
   },
   "overrides": {
     "@xmldom/xmldom": "0.8.15",
     "defu": "6.1.7",
-    "fast-uri": "3.1.8",
+    "fast-uri": "3.1.9",
     "flatted": "3.4.2",
     "lodash": "4.18.1",
     "lodash-es": "4.18.1",