@sparkelf/dsh-dataops-managed 0.3.19 → 0.3.21

package/lib/client.js

@@ -4,6 +4,26 @@ window.__ModuleLoader__.load({
 		var module = { exports: {} };
 		var exports = module.exports;
 		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+		//#region \0rolldown/runtime.js
+		var __defProp = Object.defineProperty;
+		var __esmMin = (fn, res, err) => () => {
+			if (err) throw err[0];
+			try {
+				return fn && (res = fn(fn = 0)), res;
+			} catch (e) {
+				throw err = [e], e;
+			}
+		};
+		var __exportAll = (all, no_symbols) => {
+			let target = {};
+			for (var name in all) __defProp(target, name, {
+				get: all[name],
+				enumerable: true
+			});
+			if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+			return target;
+		};
+		//#endregion
 		let react = require("react");
 		let _deepseek_ai_dsh_client_ui_primitives = require("@deepseek-ai/dsh-client-ui-primitives");
 		let react_jsx_runtime = require("react/jsx-runtime");
@@ -20,14 +40,14 @@ window.__ModuleLoader__.load({
 			}
 		}
 		let preference = initialPreference();
-		const listeners = /* @__PURE__ */ new Set();
+		const listeners$1 = /* @__PURE__ */ new Set();
 		/** Observable preference compatible with React's useSyncExternalStore. */
 		const wanxiangBrandPreference = {
 			getSnapshot: () => preference,
 			subscribe: (listener) => {
-				listeners.add(listener);
+				listeners$1.add(listener);
 				return () => {
-					listeners.delete(listener);
+					listeners$1.delete(listener);
 				};
 			}
 		};
@@ -38,7 +58,7 @@ window.__ModuleLoader__.load({
 			if (typeof localStorage !== "undefined") try {
 				localStorage.setItem(WANXIANG_BRAND_PREFERENCE_KEY, JSON.stringify(preference));
 			} catch {}
-			for (const listener of listeners) listener();
+			for (const listener of listeners$1) listener();
 		}
 		//#endregion
 		//#region src/client/model-sync-client.ts
@@ -46,7 +66,7 @@ window.__ModuleLoader__.load({
 		/** Route the plugin's Host half serves for model sharing. */
 		const MODEL_SYNC_PATH = "/integrations/dataops/model-sync";
 		/** Narrow a response body to the status shape, rejecting anything else. */
-		function asStatus$1(value) {
+		function asStatus$2(value) {
 			if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
 			const record = value;
 			if (record.followState !== "following" && record.followState !== "detached") return null;
@@ -86,7 +106,7 @@ window.__ModuleLoader__.load({
 			const response = await fetch(MODEL_SYNC_PATH, { headers: { accept: "application/json" } });
 			if (response.status === 503) return null;
 			if (!response.ok) throw new Error("model sync status failed with HTTP " + String(response.status));
-			return asStatus$1(await response.json());
+			return asStatus$2(await response.json());
 		}
 		/**
 		* Change what this workspace shares.
@@ -104,7 +124,7 @@ window.__ModuleLoader__.load({
 			});
 			if (response.status === 503) return null;
 			if (!response.ok) throw new Error("model sync action failed with HTTP " + String(response.status));
-			return asStatus$1(await response.json());
+			return asStatus$2(await response.json());
 		}
 		//#endregion
 		//#region src/client/workspace-limits-client.ts
@@ -112,7 +132,7 @@ window.__ModuleLoader__.load({
 		/** Route the plugin's Host half serves for workspace limits. */
 		const WORKSPACE_LIMITS_PATH = "/integrations/dataops/workspace-limits";
 		/** Narrow a response body to the status, rejecting anything else. */
-		function asStatus(value) {
+		function asStatus$1(value) {
 			if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
 			const record = value;
 			const limits = record.limits;
@@ -129,7 +149,7 @@ window.__ModuleLoader__.load({
 				readOnlyReason: typeof record.readOnlyReason === "string" ? record.readOnlyReason : null
 			};
 		}
-		function readJson(value) {
+		function readJson$1(value) {
 			return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 		}
 		/**
@@ -147,7 +167,7 @@ window.__ModuleLoader__.load({
 		/** Read the reason from a refused response, falling back to the status line. */
 		async function refusalReason$1(response, fallback) {
 			try {
-				const error = readJson(await response.json())?.error;
+				const error = readJson$1(await response.json())?.error;
 				if (typeof error === "string" && error.trim() !== "") return error;
 			} catch {}
 			return `${fallback} with HTTP ${String(response.status)}`;
@@ -160,7 +180,7 @@ window.__ModuleLoader__.load({
 			const response = await fetch(WORKSPACE_LIMITS_PATH, { credentials: "same-origin" });
 			if (response.status === 503) return null;
 			if (!response.ok) throw new Error(`Workspace limits read failed with HTTP ${String(response.status)}`);
-			return asStatus(await response.json());
+			return asStatus$1(await response.json());
 		}
 		/**
 		* Store new workspace limits.
@@ -177,8 +197,8 @@ window.__ModuleLoader__.load({
 			if (response.status === 503) return null;
 			if (response.status === 400) throw new WorkspaceLimitsRejection(await refusalReason$1(response, "Workspace limits write refused"));
 			if (!response.ok) throw new Error(await refusalReason$1(response, "Workspace limits write failed"));
-			const body = readJson(await response.json());
-			return body === null ? null : asStatus(body);
+			const body = readJson$1(await response.json());
+			return body === null ? null : asStatus$1(body);
 		}
 		//#endregion
 		//#region src/client/tool-timeout-client.ts
@@ -230,31 +250,643 @@ window.__ModuleLoader__.load({
 			return asTimeout(await response.json());
 		}
 		//#endregion
-		//#region \0dsh-css:/tmp/wt-rebase/packages/dataops-managed/src/client/ManagedDataOpsSection.module.css.mjs
-		const css$2 = ".dcEWUa_section{max-width:720px;color:var(--dsw-alias-label-primary);flex-direction:column;gap:12px;display:flex}.dcEWUa_title{margin:0;font-size:18px;font-weight:600;line-height:28px}.dcEWUa_status{color:var(--dsw-alias-label-secondary);align-items:center;gap:8px;font-size:13px;line-height:22px;display:flex}.dcEWUa_card{border:.5px solid var(--dsw-alias-settings-card-stroke);border-radius:var(--dsw-radius-xl);background:var(--dsw-alias-settings-card-fill);flex-direction:column;gap:12px;padding:12px 16px;display:flex}.dcEWUa_heading{margin:0;font-size:13px;font-weight:600;line-height:22px}.dcEWUa_row{justify-content:space-between;align-items:center;gap:16px;display:flex}.dcEWUa_copy{flex-direction:column;min-width:0;display:flex}.dcEWUa_label{font-size:13px;line-height:22px}.dcEWUa_meta{color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:18px}.dcEWUa_fields{grid-template-columns:repeat(auto-fit,minmax(min(200px,100%),1fr));gap:0 16px;display:grid}.dcEWUa_fields>div{min-width:0}.dcEWUa_fields input{font-variant-numeric:tabular-nums;min-width:0}.dcEWUa_actions{justify-content:flex-end;align-items:center;gap:12px;display:flex}.dcEWUa_refusal{color:var(--dsw-alias-state-error-primary);align-items:flex-start;gap:6px;margin-right:auto;font-size:12px;line-height:18px;display:flex}";
-		const tagId$2 = "@sparkelf/dsh-dataops-managed/ManagedDataOpsSection.module.css";
-		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId$2) + "]") === null) {
+		//#region src/client/review-demo.ts
+		var review_demo_exports = /* @__PURE__ */ __exportAll({
+			demoPlazaSkills: () => demoPlazaSkills,
+			demoRbacOverview: () => demoRbacOverview
+		});
+		/** A pending skill with an AI report, an approved global skill, and a rejected private one. */
+		function demoPlazaSkills() {
+			return [
+				{
+					id: 9101,
+					name: "SQL 取数助手",
+					description: "把自然语言问题改写成只读 SQL，并解释每个过滤条件。",
+					instruction: "你是数据分析助手。只生成只读 SELECT，不要写 UPDATE/DELETE。",
+					tags: ["数据", "SQL"],
+					sharedByMe: false,
+					updatedAt: "2026-10-23T04:40:00.000Z",
+					reviewStatus: "pending",
+					visibility: "department",
+					departmentCode: "dept-rd",
+					departmentName: "研发部",
+					departmentPath: [{
+						code: "dept-root",
+						name: "万相"
+					}, {
+						code: "dept-rd",
+						name: "研发部"
+					}],
+					ownerName: "林工",
+					riskReport: {
+						score: 62,
+						severity: "medium",
+						summary: "指令包含数据库读取，需确认连接凭据的最小权限。",
+						findings: [{
+							category: "credential_access",
+							severity: "medium",
+							evidence: "提示词要求读取 DATABASE_URL 以连接数据库。",
+							recommendation: "改为由平台注入只读连接，不要在提示词中出现凭据。"
+						}, {
+							category: "destructive_action",
+							severity: "low",
+							evidence: "明确禁止写操作，但未限制 DDL。",
+							recommendation: "补充「禁止 CREATE/ALTER/DROP」。"
+						}],
+						scannedAt: "2026-10-23T04:41:00.000Z"
+					},
+					reviewNote: null,
+					submittedAt: "2026-10-23T04:40:00.000Z"
+				},
+				{
+					id: 9102,
+					name: "经营日报生成",
+					description: "按日汇总营收、订单与退款，输出 Markdown 日报。",
+					instruction: "读取昨日指标，生成经营日报。",
+					tags: ["经营", "日报"],
+					sharedByMe: true,
+					updatedAt: "2026-10-21T02:00:00.000Z",
+					reviewStatus: "approved",
+					visibility: "global",
+					departmentCode: null,
+					ownerName: "admin",
+					riskReport: null
+				},
+				{
+					id: 9103,
+					name: "私域名单清洗",
+					description: "按内部规则去重并标记高价值客户。",
+					instruction: "清洗名单并输出 CSV。",
+					tags: ["客户"],
+					sharedByMe: false,
+					updatedAt: "2026-10-20T06:00:00.000Z",
+					reviewStatus: "rejected",
+					visibility: "private",
+					departmentCode: "dept-rd",
+					departmentName: "研发部",
+					ownerName: "周工",
+					reviewNote: "包含真实手机号样例，请脱敏后重新提交。"
+				}
+			];
+		}
+		/** Four roles, the permission catalog, three members, two departments, and three resources. */
+		function demoRbacOverview() {
+			return {
+				matrix: {
+					permissions: [
+						{
+							key: "skill.review",
+							name: "审核技能",
+							group: "技能广场"
+						},
+						{
+							key: "workflow.review",
+							name: "审核工作流",
+							group: "工作流广场"
+						},
+						{
+							key: "rbac.manage",
+							name: "管理权限",
+							group: "系统"
+						},
+						{
+							key: "kb.write",
+							name: "写入知识库",
+							group: "知识库"
+						}
+					],
+					roles: [
+						{
+							code: "SUPER_ADMIN",
+							name: "超级管理员",
+							systemKey: "SUPER_ADMIN",
+							dataScope: "ALL",
+							permissions: [
+								"skill.review",
+								"workflow.review",
+								"rbac.manage",
+								"kb.write"
+							]
+						},
+						{
+							code: "ADMIN",
+							name: "管理员",
+							systemKey: "ADMIN",
+							dataScope: "ALL",
+							permissions: [
+								"skill.review",
+								"workflow.review",
+								"kb.write"
+							]
+						},
+						{
+							code: "DEPT_ADMIN",
+							name: "部门管理员",
+							systemKey: "DEPT_ADMIN",
+							dataScope: "DEPARTMENT_TREE",
+							permissions: ["skill.review", "workflow.review"]
+						},
+						{
+							code: "APP_USER",
+							name: "应用人员",
+							systemKey: "APP_USER",
+							dataScope: "SELF",
+							permissions: []
+						}
+					]
+				},
+				members: [
+					{
+						userId: "u1",
+						username: "admin",
+						displayName: "超级管理员",
+						roleCodes: ["SUPER_ADMIN"],
+						departmentCode: "dept-root",
+						departmentPath: [{
+							code: "dept-root",
+							name: "万相"
+						}]
+					},
+					{
+						userId: "u2",
+						username: "lin",
+						displayName: "林工",
+						roleCodes: ["DEPT_ADMIN"],
+						departmentCode: "dept-rd",
+						departmentPath: [{
+							code: "dept-root",
+							name: "万相"
+						}, {
+							code: "dept-rd",
+							name: "研发部"
+						}]
+					},
+					{
+						userId: "u3",
+						username: "zhou",
+						displayName: "周工",
+						roleCodes: ["APP_USER"],
+						departmentCode: "dept-rd",
+						departmentPath: [{
+							code: "dept-root",
+							name: "万相"
+						}, {
+							code: "dept-rd",
+							name: "研发部"
+						}]
+					}
+				],
+				departments: [{
+					code: "dept-root",
+					name: "万相",
+					path: [{
+						code: "dept-root",
+						name: "万相"
+					}],
+					memberCount: 3,
+					deptAdmins: []
+				}, {
+					code: "dept-rd",
+					name: "研发部",
+					parentCode: "dept-root",
+					path: [{
+						code: "dept-root",
+						name: "万相"
+					}, {
+						code: "dept-rd",
+						name: "研发部"
+					}],
+					memberCount: 2,
+					deptAdmins: [{
+						userId: "u2",
+						username: "lin",
+						displayName: "林工"
+					}]
+				}],
+				resources: [
+					{
+						kind: "skill",
+						id: 9101,
+						name: "SQL 取数助手",
+						ownerName: "林工",
+						departmentCode: "dept-rd",
+						visibility: "department",
+						reviewStatus: "pending"
+					},
+					{
+						kind: "skill",
+						id: 9102,
+						name: "经营日报生成",
+						ownerName: "admin",
+						departmentCode: null,
+						visibility: "global",
+						reviewStatus: "approved"
+					},
+					{
+						kind: "workflow",
+						id: "wf-1",
+						name: "每日经营日报",
+						ownerName: "admin",
+						departmentCode: null,
+						visibility: "global",
+						reviewStatus: "approved"
+					}
+				]
+			};
+		}
+		var init_review_demo = __esmMin((() => {}));
+		//#endregion
+		//#region src/client/review-client.ts
+		/** Caller identity and review capability. */
+		const REVIEW_CONTEXT_PATH = "/integrations/dataops/review-context";
+		/** Notification list and read receipts. */
+		const NOTIFICATIONS_PATH = "/integrations/dataops/review-notifications";
+		/** AI scan and the human decision. */
+		const REVIEW_ACTION_PATH = "/integrations/dataops/review";
+		/** Role matrix, members, departments, and resource scopes. */
+		const RBAC_PATH = "/integrations/dataops/rbac";
+		/** The three plaza-review switches in the DataOps settings panel. */
+		const REVIEW_SETTINGS_PATH = "/integrations/dataops/review-settings";
+		/** Department CRUD bridge (task-67). */
+		const DEPARTMENTS_PATH = "/integrations/dataops/departments";
+		/** The product defaults, used until DataOps returns its own value. */
+		const DEFAULT_REVIEW_SETTINGS = {
+			skillPlaza: true,
+			workflowPlaza: true,
+			knowledgeBase: true
+		};
+		/**
+		* Whether the page was opened with the demo fixture.
+		*
+		* The fixture exists so the review dialog and the permission matrix can be reviewed before the
+		* backend contract is deployed; every fixture row is labelled and the mode is never the default.
+		*/
+		function reviewDemoMode() {
+			if (typeof window === "undefined") return false;
+			try {
+				return new URLSearchParams(window.location.search).get("dataopsReviewDemo") === "1" || window.localStorage.getItem("dataopsReviewDemo") === "1";
+			} catch {
+				return false;
+			}
+		}
+		/** Read JSON, mapping "not active" and "backend not ready" answers to null. */
+		async function readJson(path, init = {}) {
+			const response = await fetch(path, {
+				...init,
+				headers: {
+					accept: "application/json",
+					...init.body === void 0 ? {} : { "content-type": "application/json" },
+					...init.headers
+				}
+			});
+			if (response.status === 503 || response.status === 404 || response.status === 501) return null;
+			if (!response.ok) throw new Error("DataOps review request failed with HTTP " + String(response.status));
+			return await response.json();
+		}
+		/** Read the caller's role and review capability. */
+		async function fetchReviewContext() {
+			if (reviewDemoMode()) return {
+				role: "ADMIN",
+				departmentCode: "dept-rd",
+				departmentPath: ["万相", "研发部"],
+				canReview: true,
+				canManagePermissions: true
+			};
+			const body = await readJson(REVIEW_CONTEXT_PATH);
+			if (body === null) return null;
+			const codes = Array.isArray(body.roleCodes) ? body.roleCodes : [];
+			const primaryKey = body.roles?.find((role) => role.code === body.primaryRole)?.systemKey ?? body.roles?.find((role) => role.code !== void 0 && codes.includes(role.code))?.systemKey;
+			const role = primaryKey === "SUPER_ADMIN" || codes.includes("超级管理员") ? "SUPER_ADMIN" : primaryKey === "ADMIN" || codes.includes("管理员") ? "ADMIN" : primaryKey === "DEPT_ADMIN" || codes.includes("部门管理员") ? "DEPT_ADMIN" : "APP_USER";
+			return {
+				userId: body.userId,
+				role,
+				departmentCode: body.departmentCode ?? void 0,
+				departmentPath: body.departmentPath?.map((entry) => entry.name),
+				canReview: body.review?.canReview === true || role === "SUPER_ADMIN" || role === "ADMIN" || role === "DEPT_ADMIN",
+				canManagePermissions: body.review?.canManagePermissions === true || role === "SUPER_ADMIN" || role === "ADMIN"
+			};
+		}
+		/** Read the current user's notifications. */
+		async function fetchNotifications() {
+			const body = await readJson(NOTIFICATIONS_PATH);
+			if (body === null || !Array.isArray(body.items)) return null;
+			return {
+				items: body.items,
+				unread: typeof body.unread === "number" ? body.unread : body.items.filter((item) => !item.read).length
+			};
+		}
+		/** Mark some notifications, or every one, as read. */
+		async function markNotificationsRead(ids) {
+			const response = await fetch(NOTIFICATIONS_PATH, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					accept: "application/json"
+				},
+				body: JSON.stringify(ids === "all" ? { all: true } : { ids })
+			});
+			return response.ok && response.status !== 503;
+		}
+		/** Run the AI review for one or more resources. */
+		async function scanReview(kind, ids) {
+			const report = (await readJson(REVIEW_ACTION_PATH, {
+				method: "POST",
+				body: JSON.stringify({
+					action: "scan",
+					skills: kind === "skill" ? ids : [],
+					workflows: kind === "workflow" ? ids : []
+				})
+			}))?.reports?.[0];
+			return report !== void 0 && Array.isArray(report.findings) ? report : null;
+		}
+		/** Record the administrator's decision. The backend enforces the authorization flag too. */
+		async function decideReview(kind, ids, decision, note) {
+			const response = await fetch(REVIEW_ACTION_PATH, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					accept: "application/json"
+				},
+				body: JSON.stringify({
+					action: "decide",
+					skills: kind === "skill" ? ids : [],
+					workflows: kind === "workflow" ? ids : [],
+					decision,
+					note,
+					authorization: {
+						confirmed: true,
+						reason: "permission-center"
+					}
+				})
+			});
+			return response.ok && response.status !== 503;
+		}
+		/** Read the permission centre. */
+		async function fetchRbacOverview() {
+			if (reviewDemoMode()) {
+				const { demoRbacOverview } = await Promise.resolve().then(() => (init_review_demo(), review_demo_exports));
+				return demoRbacOverview();
+			}
+			const [matrix, members, departments, resources] = await Promise.all([
+				readJson(RBAC_PATH + "?section=matrix&scope=dsh"),
+				readJson(RBAC_PATH + "?section=members"),
+				readJson(RBAC_PATH + "?section=departments"),
+				readJson(RBAC_PATH + "?section=resources")
+			]);
+			if (matrix === null || members === null || departments === null || resources === null) return null;
+			return {
+				matrix: {
+					roles: matrix.roles ?? [],
+					permissions: matrix.permissions ?? []
+				},
+				members: members.items ?? [],
+				departments: departments.items ?? [],
+				resources: resources.items ?? []
+			};
+		}
+		/** Persist one permission-centre section. */
+		async function saveRbacSection(section, value) {
+			if (reviewDemoMode()) return { ok: true };
+			const response = await fetch(RBAC_PATH, {
+				method: "PUT",
+				headers: {
+					"content-type": "application/json",
+					accept: "application/json"
+				},
+				body: JSON.stringify({
+					section,
+					value
+				})
+			});
+			if (response.ok && response.status !== 503) return { ok: true };
+			try {
+				const body = await response.json();
+				const reason = body.details?.reason ?? body.message;
+				return {
+					ok: false,
+					...typeof reason === "string" ? { reason } : {}
+				};
+			} catch {
+				return { ok: false };
+			}
+		}
+		/** Read the three plaza-review switches. */
+		async function fetchReviewSettings() {
+			if (reviewDemoMode()) return DEFAULT_REVIEW_SETTINGS;
+			return await readJson(REVIEW_SETTINGS_PATH);
+		}
+		/** Persist the three plaza-review switches. */
+		async function saveReviewSettings(settings) {
+			if (reviewDemoMode()) return true;
+			const response = await fetch(REVIEW_SETTINGS_PATH, {
+				method: "PUT",
+				headers: {
+					"content-type": "application/json",
+					accept: "application/json"
+				},
+				body: JSON.stringify(settings)
+			});
+			return response.ok && response.status !== 503;
+		}
+		/** Create one department through the same-origin bridge. */
+		async function createDepartment(input) {
+			return await resultOf(await fetch(DEPARTMENTS_PATH, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					accept: "application/json"
+				},
+				body: JSON.stringify(input)
+			}));
+		}
+		/** Update one department; the Host fills `updatedAt` from the current row when omitted. */
+		async function updateDepartment(input) {
+			return await resultOf(await fetch(DEPARTMENTS_PATH, {
+				method: "PATCH",
+				headers: {
+					"content-type": "application/json",
+					accept: "application/json"
+				},
+				body: JSON.stringify(input)
+			}));
+		}
+		/** Delete one department after the confirmation dialog. */
+		async function deleteDepartment(code) {
+			return await resultOf(await fetch(DEPARTMENTS_PATH, {
+				method: "DELETE",
+				headers: {
+					"content-type": "application/json",
+					accept: "application/json"
+				},
+				body: JSON.stringify({ code })
+			}));
+		}
+		/** Map one bridge response to `{ok, reason}` so callers can show the backend text. */
+		async function resultOf(response) {
+			if (response.ok && response.status !== 503) return { ok: true };
+			try {
+				const body = await response.json();
+				const reason = body.details?.reason ?? body.message;
+				return {
+					ok: false,
+					...typeof reason === "string" ? { reason } : {}
+				};
+			} catch {
+				return { ok: false };
+			}
+		}
+		//#endregion
+		//#region \0dsh-css:/root/projects/dsh-plugins-plus/packages/dataops-managed/src/client/ManagedDataOpsSection.module.css.mjs
+		const css$5 = "._2dqzjG_section{max-width:720px;color:var(--dsw-alias-label-primary);flex-direction:column;gap:12px;display:flex}._2dqzjG_title{margin:0;font-size:18px;font-weight:600;line-height:28px}._2dqzjG_status{color:var(--dsw-alias-label-secondary);align-items:center;gap:8px;font-size:13px;line-height:22px;display:flex}._2dqzjG_card{border:.5px solid var(--dsw-alias-settings-card-stroke);border-radius:var(--dsw-radius-xl);background:var(--dsw-alias-settings-card-fill);flex-direction:column;gap:12px;padding:12px 16px;display:flex}._2dqzjG_heading{margin:0;font-size:13px;font-weight:600;line-height:22px}._2dqzjG_row{justify-content:space-between;align-items:center;gap:16px;display:flex}._2dqzjG_copy{flex-direction:column;min-width:0;display:flex}._2dqzjG_label{font-size:13px;line-height:22px}._2dqzjG_meta{color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:18px}._2dqzjG_fields{grid-template-columns:repeat(auto-fit,minmax(min(200px,100%),1fr));gap:0 16px;display:grid}._2dqzjG_fields>div{min-width:0}._2dqzjG_fields input{font-variant-numeric:tabular-nums;min-width:0}._2dqzjG_actions{justify-content:flex-end;align-items:center;gap:12px;display:flex}._2dqzjG_refusal{color:var(--dsw-alias-state-error-primary);align-items:flex-start;gap:6px;margin-right:auto;font-size:12px;line-height:18px;display:flex}._2dqzjG_reviewHint{color:var(--dsw-alias-label-tertiary);margin:0;font-size:11px;line-height:17px}._2dqzjG_reviewRows{flex-direction:column;gap:2px;display:flex}._2dqzjG_reviewRow{justify-content:space-between;align-items:center;gap:12px;min-height:30px;display:flex}._2dqzjG_reviewActions{justify-content:flex-end;display:flex}";
+		const tagId$5 = "@sparkelf/dsh-dataops-managed/ManagedDataOpsSection.module.css";
+		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId$5) + "]") === null) {
 			const tag = document.createElement("style");
 			tag.dataset.plugin = "@sparkelf/dsh-dataops-managed";
-			tag.dataset.pluginCss = tagId$2;
-			tag.textContent = css$2;
+			tag.dataset.pluginCss = tagId$5;
+			tag.textContent = css$5;
 			document.head.appendChild(tag);
 		}
 		var ManagedDataOpsSection_module_css_default = {
-			"status": "dcEWUa_status",
-			"card": "dcEWUa_card",
-			"copy": "dcEWUa_copy",
-			"actions": "dcEWUa_actions",
-			"refusal": "dcEWUa_refusal",
-			"title": "dcEWUa_title",
-			"row": "dcEWUa_row",
-			"heading": "dcEWUa_heading",
-			"label": "dcEWUa_label",
-			"meta": "dcEWUa_meta",
-			"section": "dcEWUa_section",
-			"fields": "dcEWUa_fields"
+			"refusal": "_2dqzjG_refusal",
+			"heading": "_2dqzjG_heading",
+			"section": "_2dqzjG_section",
+			"status": "_2dqzjG_status",
+			"card": "_2dqzjG_card",
+			"meta": "_2dqzjG_meta",
+			"title": "_2dqzjG_title",
+			"reviewActions": "_2dqzjG_reviewActions",
+			"reviewRows": "_2dqzjG_reviewRows",
+			"reviewHint": "_2dqzjG_reviewHint",
+			"row": "_2dqzjG_row",
+			"label": "_2dqzjG_label",
+			"fields": "_2dqzjG_fields",
+			"actions": "_2dqzjG_actions",
+			"reviewRow": "_2dqzjG_reviewRow",
+			"copy": "_2dqzjG_copy"
 		};
 		//#endregion
+		//#region src/client/ReviewSettingsCard.tsx
+		/**
+		* The three plaza-review switches.
+		*
+		* The card is independent of the review queue so the settings page owns the switches while the
+		* plaza owns the rows. Defaults are on; a 503 keeps the switches usable and says the API is
+		* waiting rather than pretending the save happened.
+		*/
+		function ReviewSettingsCard({ t }) {
+			const [settings, setSettings] = (0, react.useState)(DEFAULT_REVIEW_SETTINGS);
+			const [saved, setSaved] = (0, react.useState)(DEFAULT_REVIEW_SETTINGS);
+			const [loading, setLoading] = (0, react.useState)(true);
+			const [unavailable, setUnavailable] = (0, react.useState)(false);
+			const [busy, setBusy] = (0, react.useState)(false);
+			const [message, setMessage] = (0, react.useState)(null);
+			(0, react.useEffect)(() => {
+				let live = true;
+				fetchReviewSettings().then((value) => {
+					if (!live) return;
+					if (value === null) setUnavailable(true);
+					else {
+						setSettings(value);
+						setSaved(value);
+					}
+				}).catch(() => {
+					if (live) setUnavailable(true);
+				}).finally(() => {
+					if (live) setLoading(false);
+				});
+				return () => {
+					live = false;
+				};
+			}, []);
+			const changed = settings.skillPlaza !== saved.skillPlaza || settings.workflowPlaza !== saved.workflowPlaza || settings.knowledgeBase !== saved.knowledgeBase;
+			const save = async () => {
+				setBusy(true);
+				setMessage(null);
+				try {
+					if (await saveReviewSettings(settings)) {
+						setSaved(settings);
+						setMessage(t("reviewSettingsSaved"));
+					} else setMessage(t("reviewSettingsWaiting"));
+				} catch {
+					setMessage(t("reviewSettingsFailed"));
+				} finally {
+					setBusy(false);
+				}
+			};
+			const rows = [
+				{
+					key: "skillPlaza",
+					label: t("reviewSettingsSkill")
+				},
+				{
+					key: "workflowPlaza",
+					label: t("reviewSettingsWorkflow")
+				},
+				{
+					key: "knowledgeBase",
+					label: t("reviewSettingsKb")
+				}
+			];
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+				className: ManagedDataOpsSection_module_css_default.card,
+				"data-review-settings-card": "",
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", {
+						className: ManagedDataOpsSection_module_css_default.heading,
+						children: t("reviewSettingsTitle")
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: ManagedDataOpsSection_module_css_default.reviewHint,
+						children: t("reviewSettingsHint")
+					}),
+					loading ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: ManagedDataOpsSection_module_css_default.status,
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: "…" })
+					}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: ManagedDataOpsSection_module_css_default.reviewRows,
+						children: rows.map((row) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: ManagedDataOpsSection_module_css_default.reviewRow,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: ManagedDataOpsSection_module_css_default.label,
+								children: row.label
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Switch, {
+								checked: settings[row.key],
+								label: row.label,
+								onChange: (next) => {
+									setSettings((current) => ({
+										...current,
+										[row.key]: next
+									}));
+								}
+							})]
+						}, row.key))
+					}),
+					unavailable ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: ManagedDataOpsSection_module_css_default.reviewHint,
+						role: "status",
+						children: t("reviewSettingsWaiting")
+					}) : null,
+					message === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: ManagedDataOpsSection_module_css_default.reviewHint,
+						role: "status",
+						children: message
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: ManagedDataOpsSection_module_css_default.reviewActions,
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+							variant: "primary",
+							size: "sm",
+							disabled: !changed || busy || loading,
+							onClick: () => {
+								save();
+							},
+							children: busy ? t("limitsSaving") : t("reviewSettingsSave")
+						})
+					})
+				]
+			});
+		}
+		//#endregion
 		//#region src/client/ManagedDataOpsSection.tsx
 		/** The panel's unit, so a stored byte count survives a round trip through the input. */
 		const BYTES_PER_MIB = 1048576;
@@ -302,6 +934,7 @@ window.__ModuleLoader__.load({
 					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(LimitsCard, { t }),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(TimeoutCard, { t }),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ReviewSettingsCard, { t }),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(DefaultsCard, { t })
 				]
 			});
@@ -667,8 +1300,102 @@ window.__ModuleLoader__.load({
 			});
 		}
 		//#endregion
+		//#region src/client/review-types.ts
+		/** Treat a missing status as approved: rows written before the review state existed were live. */
+		function normalizeReviewStatus(value) {
+			return value === "pending" || value === "rejected" || value === "approved" ? value : "approved";
+		}
+		/** Treat a missing visibility as global: a shared row with no scope was visible to everyone. */
+		function normalizeVisibility(value) {
+			return value === "department" || value === "private" ? value : "global";
+		}
+		/** Whether the caller may see and act on the review queue. */
+		function canReview(context) {
+			if (context === null || context === void 0) return false;
+			return context.canReview || context.role === "SUPER_ADMIN" || context.role === "ADMIN" || context.role === "DEPT_ADMIN";
+		}
+		/** Whether the caller may open the permission centre's write controls. */
+		function canManagePermissions(context) {
+			if (context === null || context === void 0) return false;
+			return context.canManagePermissions || context.role === "SUPER_ADMIN" || context.role === "ADMIN";
+		}
+		/**
+		* The tabs this caller may see.
+		*
+		* A department administrator sees the queue too, but the Host narrows it to their subtree;
+		* an ordinary user gets only the approved list, and no tab strip at all when there is one tab.
+		*/
+		function reviewTabsFor(context) {
+			if (!canReview(context)) return ["approved"];
+			return [
+				"approved",
+				"pending",
+				"all"
+			];
+		}
+		/** Filter rows by the selected review tab. */
+		function filterByReview(rows, tab) {
+			if (tab === "all") return rows;
+			return rows.filter((row) => normalizeReviewStatus(row.reviewStatus) === tab);
+		}
+		/** Counts for the tab labels. */
+		function reviewCounts(rows) {
+			const counts = {
+				approved: 0,
+				pending: 0,
+				all: rows.length
+			};
+			for (const row of rows) {
+				const status = normalizeReviewStatus(row.reviewStatus);
+				if (status === "pending") counts.pending += 1;
+				else if (status === "rejected") counts.all += 0;
+				else counts.approved += 1;
+			}
+			return counts;
+		}
+		/**
+		* The visibility tag in a card's top-right corner.
+		*
+		* A department tag names the department and keeps the full path in the tooltip; a global tag
+		* is one word because it is the default and should not compete with the skill name.
+		*/
+		/** Read a department path from either the legacy string form or the backend object form. */
+		function departmentPathNames(path) {
+			if (path === void 0) return [];
+			return path.map((entry) => typeof entry === "string" ? entry : entry.name);
+		}
+		function visibilityTag(row) {
+			const visibility = normalizeVisibility(row.visibility);
+			if (visibility === "private") return {
+				label: "私有",
+				detail: "仅自己可见"
+			};
+			if (visibility === "global") return {
+				label: "全局",
+				detail: "所有已登录用户可见"
+			};
+			const path = departmentPathNames(row.departmentPath);
+			const name = row.departmentName ?? path.at(-1) ?? row.departmentCode ?? "部门";
+			return {
+				label: name + "部门专属",
+				detail: path.length === 0 ? name : path.join(" / ")
+			};
+		}
+		/** Unread count for a bell badge. */
+		function unreadCount(items) {
+			return items.reduce((total, item) => total + (item.read ? 0 : 1), 0);
+		}
+		/** Newest first. Read state never reorders rows, so marking one read cannot move it to another page. */
+		function sortNotifications(items) {
+			return [...items].sort((left, right) => right.createdAt.localeCompare(left.createdAt));
+		}
+		/** The tab a notification should open, when its resource has one. */
+		function notificationTab(item) {
+			if (item.type === "submitted" || item.type === "review_pending" || item.type === "ai_report_ready" || item.type === "ai_report") return "pending";
+			if (item.type === "approved" || item.type === "published" || item.type === "shared") return "approved";
+		}
+		//#endregion
 		//#region src/client/skill-plaza-client.ts
-		/** Same-origin skill plaza calls from the DataOps skill center section. */
 		/** Route the plugin's Host half serves for the plaza. */
 		const SKILL_PLAZA_PATH = "/integrations/dataops/skill-plaza";
 		/** Narrow an unknown value to a plaza entry. */
@@ -683,16 +1410,37 @@ window.__ModuleLoader__.load({
 				instruction: typeof row.instruction === "string" ? row.instruction : "",
 				tags: Array.isArray(row.tags) ? row.tags.filter((tag) => typeof tag === "string") : [],
 				sharedByMe: row.sharedByMe === true,
-				updatedAt: typeof row.updatedAt === "string" ? row.updatedAt : ""
+				updatedAt: typeof row.updatedAt === "string" ? row.updatedAt : "",
+				reviewStatus: normalizeReviewStatus(row.reviewStatus),
+				visibility: normalizeVisibility(row.visibility),
+				departmentCode: typeof row.departmentCode === "string" ? row.departmentCode : null,
+				departmentName: typeof row.departmentName === "string" ? row.departmentName : void 0,
+				departmentPath: Array.isArray(row.departmentPath) ? row.departmentPath.flatMap((entry) => typeof entry === "object" && entry !== null && typeof entry.name === "string" ? [{
+					code: String(entry.code ?? ""),
+					name: String(entry.name)
+				}] : []) : void 0,
+				ownerName: typeof row.ownerName === "string" ? row.ownerName : void 0,
+				riskReport: typeof row.riskReport === "object" && row.riskReport !== null ? row.riskReport : null,
+				reviewNote: typeof row.reviewNote === "string" ? row.reviewNote : null,
+				submittedAt: typeof row.submittedAt === "string" ? row.submittedAt : void 0
 			};
 		}
 		/** Narrow an unknown value to the listing. */
 		function asListing(value) {
 			if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
 			const row = value;
+			const skills = (Array.isArray(row.skills) ? row.skills : Array.isArray(row.items) ? row.items : []).flatMap((entry) => asSkill(entry) ?? []);
+			const tags = Array.isArray(row.tags) ? row.tags.filter((tag) => typeof tag === "string") : [];
+			const rawCounts = typeof row.counts === "object" && row.counts !== null ? row.counts : {};
 			return {
-				skills: Array.isArray(row.skills) ? row.skills.flatMap((entry) => asSkill(entry) ?? []) : [],
-				tags: Array.isArray(row.tags) ? row.tags.filter((tag) => typeof tag === "string") : []
+				skills,
+				tags,
+				counts: Object.keys(rawCounts).length === 0 ? void 0 : {
+					pending: Number(rawCounts.pending ?? 0),
+					approved: Number(rawCounts.approved ?? 0),
+					rejected: Number(rawCounts.rejected ?? 0),
+					total: Number(rawCounts.total ?? skills.length)
+				}
 			};
 		}
 		/**
@@ -704,6 +1452,8 @@ window.__ModuleLoader__.load({
 			const params = new URLSearchParams();
 			if (filter.tag !== void 0 && filter.tag !== "") params.set("tag", filter.tag);
 			if (filter.query !== void 0 && filter.query !== "") params.set("q", filter.query);
+			if (filter.status !== void 0) params.set("status", filter.status);
+			if (filter.scope !== void 0) params.set("scope", filter.scope);
 			const suffix = params.size === 0 ? "" : "?" + params.toString();
 			const response = await fetch(SKILL_PLAZA_PATH + suffix, { headers: { accept: "application/json" } });
 			if (response.status === 503) return null;
@@ -729,95 +1479,587 @@ window.__ModuleLoader__.load({
 			return await response.json();
 		}
 		//#endregion
-		//#region \0dsh-css:/tmp/wt-rebase/packages/dataops-managed/src/client/SkillPlazaSection.module.css.mjs
-		const css$1 = ".pN-avG_section{box-sizing:border-box;flex-direction:column;width:100%;max-width:960px;margin:0 auto;display:flex}.pN-avG_head{flex-direction:column;margin-bottom:8px;display:flex}.pN-avG_title{color:var(--dsw-alias-label-primary);align-items:baseline;gap:8px;margin:0;font-size:14px;font-weight:500;line-height:20px;display:flex}.pN-avG_titleCount{color:var(--dsw-alias-label-tertiary);font-size:12px;font-weight:400}.pN-avG_status{text-align:center;color:var(--dsw-alias-label-tertiary);margin:0;padding:20px 0;font-size:13px;line-height:20px}.pN-avG_tagBar{flex-wrap:wrap;gap:6px;margin-bottom:8px;display:flex}.pN-avG_chip{background:var(--dsw-alias-bg-module-platform);height:24px;color:var(--dsw-alias-label-secondary);cursor:pointer;border:0;border-radius:12px;align-items:center;padding:0 10px;font-size:12px;line-height:18px;transition:background .12s;display:inline-flex}.pN-avG_chip:hover{background:var(--dsw-alias-interactive-bg-hover)}.pN-avG_chip:focus-visible{outline:2px solid var(--dsw-alias-brand-primary);outline-offset:1px}.pN-avG_chipOn{color:var(--dsw-alias-state-business-primary);background:#ecf1fc;font-weight:500}.pN-avG_notice{color:var(--dsw-alias-state-business-primary);margin:4px 0 0;font-size:12px;line-height:18px}.pN-avG_cards{grid-template-columns:repeat(auto-fill,minmax(272px,1fr));align-items:start;gap:12px;margin:0;padding:0;list-style:none;display:grid}.pN-avG_card{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-1);border-radius:10px;flex-direction:column;align-self:start;gap:10px;min-width:0;padding:12px;display:flex}.pN-avG_cardTop{justify-content:space-between;align-items:flex-start;gap:10px;display:flex}.pN-avG_cardIcon{background:var(--dsw-alias-bg-layer-2);width:28px;height:28px;color:var(--dsw-alias-label-secondary);border-radius:50%;flex:none;place-items:center;display:grid}.pN-avG_cardTitle{text-overflow:ellipsis;white-space:nowrap;flex:1;min-width:0;font-size:14px;font-weight:600;line-height:20px;overflow:hidden}.pN-avG_mine{flex:none}.pN-avG_cardDesc{color:var(--dsw-alias-label-secondary);-webkit-line-clamp:2;-webkit-box-orient:vertical;font-size:12px;line-height:18px;display:-webkit-box;overflow:hidden}.pN-avG_cardMarks{flex-wrap:wrap;gap:6px;display:flex}.pN-avG_mark{color:var(--dsw-alias-state-business-primary);white-space:nowrap;background:#ecf1fc;border:0;border-radius:4px;padding:2px 7px;font-size:11px;font-weight:500;line-height:16px}.pN-avG_cardEnd{flex:none;align-items:center;gap:4px;margin-top:auto;padding-top:4px;display:flex}.pN-avG_detailButton{margin-left:auto}.pN-avG_detail{flex-direction:column;gap:12px;margin:0;display:flex}.pN-avG_dialog{width:min(560px,100%)}.pN-avG_detailRow{flex-direction:column;gap:2px;display:flex}.pN-avG_detailLabel{color:var(--dsw-alias-label-caption);font-size:11px;line-height:16px}.pN-avG_detailValue{max-height:160px;color:var(--dsw-alias-label-secondary);white-space:pre-wrap;overflow-wrap:anywhere;margin:0;font-size:12px;line-height:18px;overflow:auto}.pN-avG_empty{text-align:center;flex-direction:column;align-items:center;gap:10px;padding:28px 16px 32px;display:flex}.pN-avG_emptyIcon{border:.5px solid var(--dsw-alias-border-l3);width:56px;height:56px;color:var(--dsw-alias-label-tertiary);border-radius:14px;justify-content:center;align-items:center;display:inline-flex}.pN-avG_emptyText{color:var(--dsw-alias-label-tertiary);margin:0;font-size:13px;line-height:20px}";
-		const tagId$1 = "@sparkelf/dsh-dataops-managed/SkillPlazaSection.module.css";
-		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId$1) + "]") === null) {
+		//#region src/client/review-notification-store.ts
+		init_review_demo();
+		/**
+		* One process-wide notification store shared by every bell.
+		*
+		* The skill plaza and the workflow plaza are separate React trees, but they show the same
+		* inbox; keeping the read state in one store is what stops a badge in one place from staying
+		* unread after the other opened the row.
+		*/
+		const DEMO_ITEMS = [
+			{
+				id: "demo-1",
+				type: "review_pending",
+				title: "技能「SQL 取数助手」等待审核",
+				body: "来自研发部 · 提交于 10 分钟前",
+				resourceKind: "skill",
+				resourceId: 101,
+				read: false,
+				createdAt: "2026-10-23T04:50:00.000Z"
+			},
+			{
+				id: "demo-2",
+				type: "ai_report",
+				title: "AI 风险报告已生成",
+				body: "风险等级：中 · 2 条建议",
+				resourceKind: "skill",
+				resourceId: 101,
+				read: false,
+				createdAt: "2026-10-23T04:49:00.000Z"
+			},
+			{
+				id: "demo-3",
+				type: "approved",
+				title: "工作流「每日经营日报」已通过",
+				body: "审核人：admin",
+				resourceKind: "workflow",
+				resourceId: "wf-1",
+				read: true,
+				createdAt: "2026-10-22T09:10:00.000Z"
+			}
+		];
+		let state = {
+			status: "idle",
+			items: [],
+			unread: 0
+		};
+		const listeners = /* @__PURE__ */ new Set();
+		function publish(next) {
+			state = next;
+			for (const listener of listeners) listener();
+		}
+		/** Current snapshot for `useSyncExternalStore`. */
+		function notificationSnapshot() {
+			return state;
+		}
+		/** Subscribe to store changes. */
+		function subscribeNotifications(listener) {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		}
+		/** Load the inbox once; a second caller joins the first request. */
+		let inflight;
+		function loadNotifications() {
+			if (inflight !== void 0) return inflight;
+			publish({
+				...state,
+				status: "loading"
+			});
+			inflight = (async () => {
+				try {
+					if (reviewDemoMode()) {
+						publish({
+							status: "ready",
+							items: sortNotifications(DEMO_ITEMS),
+							unread: unreadCount(DEMO_ITEMS)
+						});
+						return;
+					}
+					const result = await fetchNotifications();
+					if (result === null) {
+						publish({
+							status: "unavailable",
+							items: [],
+							unread: 0
+						});
+						return;
+					}
+					publish({
+						status: "ready",
+						items: sortNotifications(result.items),
+						unread: unreadCount(result.items)
+					});
+				} catch {
+					publish({
+						status: "unavailable",
+						items: [],
+						unread: 0
+					});
+				} finally {
+					inflight = void 0;
+				}
+			})();
+			return inflight;
+		}
+		/** Mark one row or the whole inbox read, optimistically. */
+		async function markRead(ids) {
+			const items = ids === "all" ? state.items.map((item) => ({
+				...item,
+				read: true
+			})) : state.items.map((item) => ids.includes(item.id) ? {
+				...item,
+				read: true
+			} : item);
+			publish({
+				...state,
+				items,
+				unread: unreadCount(items)
+			});
+			try {
+				if (!await markNotificationsRead(ids)) await loadNotifications();
+			} catch {
+				await loadNotifications();
+			}
+		}
+		//#endregion
+		//#region \0dsh-css:/root/projects/dsh-plugins-plus/packages/dataops-managed/src/client/NotificationBell.module.css.mjs
+		const css$4 = ".tE0trG_bell{width:26px;height:26px;color:var(--dsw-alias-label-secondary);cursor:pointer;background:0 0;border:0;border-radius:6px;flex:none;justify-content:center;align-items:center;padding:0;display:inline-flex;position:relative}.tE0trG_bell:hover{background:var(--dsw-alias-interactive-bg-hover);color:var(--dsw-alias-label-primary)}.tE0trG_bell:focus-visible{outline:2px solid var(--dsw-alias-brand-primary);outline-offset:1px}.tE0trG_badge{background:var(--dsw-alias-state-error-primary);color:#fff;text-align:center;border-radius:7px;min-width:14px;height:14px;padding:0 3px;font-size:9px;font-weight:600;line-height:14px;position:absolute;top:0;right:-2px}.tE0trG_dialog{flex-direction:column;width:min(520px,100vw - 32px);height:70vh;max-height:70vh;display:flex;overflow:hidden}.tE0trG_demo{background:var(--dsw-alias-state-warn-secondary);color:var(--dsw-alias-state-warn-primary);border-radius:4px;margin:0 0 8px;padding:5px 8px;font-size:11px}.tE0trG_empty{color:var(--dsw-alias-label-tertiary);text-align:center;margin:0;padding:18px 0;font-size:12px;line-height:18px}.tE0trG_list{flex-direction:column;flex:none;gap:6px;max-height:calc(70vh - 210px);margin:0;padding:0;list-style:none;display:flex;overflow-y:auto}.tE0trG_row{width:100%;color:var(--dsw-alias-label-secondary);text-align:left;cursor:pointer;background:0 0;border:0;border-radius:0;align-items:flex-start;gap:9px;padding:4px 2px;display:flex}.tE0trG_row:hover .tE0trG_rowTitle{color:var(--dsw-alias-state-business-primary)}.tE0trG_rowIcon{width:18px;height:18px;color:var(--dsw-alias-label-secondary);flex:none;justify-content:center;align-items:center;margin-top:1px;display:inline-flex}.tE0trG_rowIcon[data-tone=success]{color:var(--dsw-alias-state-success-primary)}.tE0trG_rowIcon[data-tone=danger]{color:var(--dsw-alias-state-error-primary)}.tE0trG_rowIcon[data-tone=warn]{color:var(--dsw-alias-state-warn-primary)}.tE0trG_rowIcon[data-tone=info]{color:var(--dsw-alias-state-business-primary)}.tE0trG_dot{background:var(--dsw-alias-state-business-primary);border-radius:50%;flex:none;width:6px;height:6px}.tE0trG_rowBody{flex-direction:column;flex:1;gap:2px;min-width:0;display:flex}.tE0trG_rowTitle{color:var(--dsw-alias-label-primary);font-size:12px;font-weight:500;line-height:18px}.tE0trG_rowText{color:var(--dsw-alias-label-secondary);font-size:11px;line-height:16px}.tE0trG_rowMeta{flex:none;align-items:center;gap:6px;margin-top:2px;display:flex}.tE0trG_rowTime{color:var(--dsw-alias-label-tertiary);flex:none;font-size:10px;line-height:16px}.tE0trG_actions{justify-content:flex-end;gap:6px;display:flex}.tE0trG_button,.tE0trG_linkButton{cursor:pointer;border-radius:5px;height:28px;padding:0 10px;font-size:12px}.tE0trG_button{border:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-primary);background:0 0}.tE0trG_linkButton{color:var(--dsw-alias-state-business-primary);background:0 0;border:0}.tE0trG_pager{color:var(--dsw-alias-label-secondary);justify-content:flex-end;align-items:center;gap:8px;padding-top:8px;font-size:11px;display:flex}.tE0trG_pager button{border:1px solid var(--dsw-alias-border-l2);height:24px;color:var(--dsw-alias-label-secondary);cursor:pointer;background:0 0;border-radius:4px;padding:0 8px;font-size:11px}.tE0trG_pager button:disabled{opacity:.4;cursor:default}";
+		const tagId$4 = "@sparkelf/dsh-dataops-managed/NotificationBell.module.css";
+		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId$4) + "]") === null) {
 			const tag = document.createElement("style");
 			tag.dataset.plugin = "@sparkelf/dsh-dataops-managed";
-			tag.dataset.pluginCss = tagId$1;
-			tag.textContent = css$1;
+			tag.dataset.pluginCss = tagId$4;
+			tag.textContent = css$4;
 			document.head.appendChild(tag);
 		}
-		var SkillPlazaSection_module_css_default = {
-			"mark": "pN-avG_mark",
-			"titleCount": "pN-avG_titleCount",
-			"detailButton": "pN-avG_detailButton",
-			"cardIcon": "pN-avG_cardIcon",
-			"mine": "pN-avG_mine",
-			"status": "pN-avG_status",
-			"head": "pN-avG_head",
-			"cardTop": "pN-avG_cardTop",
-			"cardTitle": "pN-avG_cardTitle",
-			"emptyIcon": "pN-avG_emptyIcon",
-			"detailValue": "pN-avG_detailValue",
-			"cards": "pN-avG_cards",
-			"notice": "pN-avG_notice",
-			"dialog": "pN-avG_dialog",
-			"tagBar": "pN-avG_tagBar",
-			"cardEnd": "pN-avG_cardEnd",
-			"detail": "pN-avG_detail",
-			"card": "pN-avG_card",
-			"detailRow": "pN-avG_detailRow",
-			"chip": "pN-avG_chip",
-			"section": "pN-avG_section",
-			"cardMarks": "pN-avG_cardMarks",
-			"detailLabel": "pN-avG_detailLabel",
-			"chipOn": "pN-avG_chipOn",
-			"cardDesc": "pN-avG_cardDesc",
-			"empty": "pN-avG_empty",
-			"title": "pN-avG_title",
-			"emptyText": "pN-avG_emptyText"
+		var NotificationBell_module_css_default = {
+			"empty": "tE0trG_empty",
+			"button": "tE0trG_button",
+			"rowTime": "tE0trG_rowTime",
+			"pager": "tE0trG_pager",
+			"rowText": "tE0trG_rowText",
+			"demo": "tE0trG_demo",
+			"row": "tE0trG_row",
+			"rowTitle": "tE0trG_rowTitle",
+			"actions": "tE0trG_actions",
+			"dialog": "tE0trG_dialog",
+			"rowMeta": "tE0trG_rowMeta",
+			"dot": "tE0trG_dot",
+			"rowIcon": "tE0trG_rowIcon",
+			"list": "tE0trG_list",
+			"badge": "tE0trG_badge",
+			"bell": "tE0trG_bell",
+			"rowBody": "tE0trG_rowBody",
+			"linkButton": "tE0trG_linkButton"
 		};
 		//#endregion
-		//#region src/client/SkillPlazaSection.tsx
-		/**
-		* One skill as a card in the plaza grid.
-		*
-		* A plaza entry carries a name, a description, tags, and its own actions; a full-width row left
-		* most of that width empty and forced every entry onto its own line. The card stacks the same
-		* parts vertically, so a grid column count can change without the content reflowing into a
-		* different shape.
-		*
-		* @param props - the card's skill, its actions, and the dictionary resolver.
-		* @returns the rendered card.
-		*/
-		function PlazaCard({ skill, busy, onInstall, onUnshare, t }) {
-			const [open, setOpen] = (0, react.useState)(false);
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
-				className: SkillPlazaSection_module_css_default.card,
+		//#region src/client/NotificationBell.tsx
+		/** Colour tone and glyph for one notification type, matching the automation-task rows. */
+		function notificationTone(type) {
+			if (type === "approved" || type === "published" || type === "success") return "success";
+			if (type === "rejected") return "danger";
+			if (type === "unpublished") return "warn";
+			return "info";
+		}
+		function NotificationIcon({ tone }) {
+			if (tone === "success") return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("svg", {
+				width: "14",
+				height: "14",
+				viewBox: "0 0 16 16",
+				fill: "none",
+				"aria-hidden": "true",
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("circle", {
+					cx: "8",
+					cy: "8",
+					r: "6.2",
+					stroke: "currentColor",
+					strokeWidth: "1.3"
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+					d: "m5.3 8.1 1.8 1.8 3.6-3.8",
+					stroke: "currentColor",
+					strokeWidth: "1.3",
+					strokeLinecap: "round",
+					strokeLinejoin: "round"
+				})]
+			});
+			if (tone === "danger") return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("svg", {
+				width: "14",
+				height: "14",
+				viewBox: "0 0 16 16",
+				fill: "none",
+				"aria-hidden": "true",
 				children: [
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-						className: SkillPlazaSection_module_css_default.cardTop,
-						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								className: SkillPlazaSection_module_css_default.cardIcon,
-								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconSkillOutlineRegular, { size: 16 })
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-								className: SkillPlazaSection_module_css_default.cardTitle,
-								children: skill.name
-							}),
-							skill.sharedByMe ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+						d: "M8 2.3 14 13H2L8 2.3Z",
+						stroke: "currentColor",
+						strokeWidth: "1.3",
+						strokeLinejoin: "round"
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+						d: "M8 6v3.1",
+						stroke: "currentColor",
+						strokeWidth: "1.3",
+						strokeLinecap: "round"
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("circle", {
+						cx: "8",
+						cy: "11.2",
+						r: ".7",
+						fill: "currentColor"
+					})
+				]
+			});
+			if (tone === "warn") return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("svg", {
+				width: "14",
+				height: "14",
+				viewBox: "0 0 16 16",
+				fill: "none",
+				"aria-hidden": "true",
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("circle", {
+						cx: "8",
+						cy: "8",
+						r: "6.2",
+						stroke: "currentColor",
+						strokeWidth: "1.3"
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+						d: "M8 4.8v3.6",
+						stroke: "currentColor",
+						strokeWidth: "1.3",
+						strokeLinecap: "round"
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("circle", {
+						cx: "8",
+						cy: "11.1",
+						r: ".7",
+						fill: "currentColor"
+					})
+				]
+			});
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("svg", {
+				width: "14",
+				height: "14",
+				viewBox: "0 0 16 16",
+				fill: "none",
+				"aria-hidden": "true",
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+					d: "M4 2.5h5l3 3v8H4v-11Z",
+					stroke: "currentColor",
+					strokeWidth: "1.2",
+					strokeLinejoin: "round"
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+					d: "M9 2.5v3h3M6 8h4M6 10.5h3",
+					stroke: "currentColor",
+					strokeWidth: "1.2",
+					strokeLinecap: "round"
+				})]
+			});
+		}
+		/**
+		* A bell with an unread badge and the shared inbox.
+		*
+		* The bell is a button rather than a menu so keyboard focus and Escape follow the dialog
+		* conventions the rest of the page already uses. Rows mark themselves read when opened;
+		* "全部已读" is the one bulk action.
+		*/
+		function NotificationBell({ label, onOpen }) {
+			const state = (0, react.useSyncExternalStore)(subscribeNotifications, notificationSnapshot, notificationSnapshot);
+			const [open, setOpen] = (0, react.useState)(false);
+			const [page, setPage] = (0, react.useState)(0);
+			const items = sortNotifications(state.items);
+			const unread = unreadCount(items);
+			const pages = Math.max(1, Math.ceil(items.length / 20));
+			const visible = items.slice(page * 20, page * 20 + 20);
+			(0, react.useEffect)(() => {
+				if (page >= pages) setPage(pages - 1);
+			}, [page, pages]);
+			(0, react.useEffect)(() => {
+				loadNotifications();
+			}, []);
+			const openOne = (item) => {
+				markRead([item.id]);
+				setOpen(false);
+				onOpen?.(item);
+			};
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+				type: "button",
+				className: NotificationBell_module_css_default.bell,
+				"aria-label": unread === 0 ? label : label + "，" + String(unread) + " 条未读",
+				title: label,
+				"data-notification-bell": "",
+				"data-unread": unread,
+				onClick: () => {
+					setOpen(true);
+					setPage(0);
+					loadNotifications();
+				},
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("svg", {
+					width: "16",
+					height: "16",
+					viewBox: "0 0 16 16",
+					fill: "none",
+					"aria-hidden": "true",
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+						d: "M8 2.2a4.1 4.1 0 0 0-4.1 4.1v2.3L2.7 10.8a.6.6 0 0 0 .5.9h9.6a.6.6 0 0 0 .5-.9L12.1 8.6V6.3A4.1 4.1 0 0 0 8 2.2Z",
+						stroke: "currentColor",
+						strokeWidth: "1.2",
+						strokeLinejoin: "round"
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+						d: "M6.4 13.2a1.7 1.7 0 0 0 3.2 0",
+						stroke: "currentColor",
+						strokeWidth: "1.2",
+						strokeLinecap: "round"
+					})]
+				}), unread === 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+					className: NotificationBell_module_css_default.badge,
+					children: unread > 99 ? "99+" : unread
+				})]
+			}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(_deepseek_ai_dsh_client_ui_primitives.Modal, {
+				open,
+				onClose: () => {
+					setOpen(false);
+				},
+				title: label,
+				closeLabel: "关闭",
+				className: NotificationBell_module_css_default.dialog,
+				footer: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: NotificationBell_module_css_default.actions,
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						className: NotificationBell_module_css_default.linkButton,
+						onClick: () => {
+							markRead("all");
+						},
+						children: "全部已读"
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						className: NotificationBell_module_css_default.button,
+						onClick: () => {
+							setOpen(false);
+						},
+						children: "关闭"
+					})]
+				}),
+				children: [
+					reviewDemoMode() ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: NotificationBell_module_css_default.demo,
+						children: "演示数据 · 后端契约到达后自动切换"
+					}) : null,
+					state.status === "unavailable" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: NotificationBell_module_css_default.empty,
+						children: "通知服务待后端联调（task-35）；上线后这里会显示审核、上架与 AI 报告事件。"
+					}) : null,
+					state.status !== "unavailable" && items.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: NotificationBell_module_css_default.empty,
+						children: "暂无通知。"
+					}) : null,
+					items.length === 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+						className: NotificationBell_module_css_default.list,
+						children: visible.map((item) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+							type: "button",
+							className: NotificationBell_module_css_default.row,
+							onClick: () => {
+								openOne(item);
+							},
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: NotificationBell_module_css_default.rowIcon,
+									"data-tone": notificationTone(item.type),
+									"aria-hidden": "true",
+									children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(NotificationIcon, { tone: notificationTone(item.type) })
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+									className: NotificationBell_module_css_default.rowBody,
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: NotificationBell_module_css_default.rowTitle,
+										children: item.title
+									}), item.body === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: NotificationBell_module_css_default.rowText,
+										children: item.body
+									})]
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+									className: NotificationBell_module_css_default.rowMeta,
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: NotificationBell_module_css_default.rowTime,
+										children: item.createdAt.slice(0, 16).replace("T", " ")
+									}), item.read ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: NotificationBell_module_css_default.dot,
+										"aria-hidden": "true"
+									})]
+								})
+							]
+						}) }, item.id))
+					}),
+					items.length === 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: NotificationBell_module_css_default.pager,
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								disabled: page === 0,
+								onClick: () => {
+									setPage((current) => Math.max(0, current - 1));
+								},
+								children: "上一页"
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", { children: [
+								"第 ",
+								page + 1,
+								" / ",
+								pages,
+								" 页 · 共 ",
+								items.length,
+								" 条"
+							] }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								disabled: page >= pages - 1,
+								onClick: () => {
+									setPage((current) => Math.min(pages - 1, current + 1));
+								},
+								children: "下一页"
+							})
+						]
+					})
+				]
+			})] });
+		}
+		/** The automation page's seat: the same inbox under the workflow plaza's heading. */
+		function WorkflowPlazaBell() {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(NotificationBell, { label: "自动化任务通知" });
+		}
+		//#endregion
+		//#region \0dsh-css:/root/projects/dsh-plugins-plus/packages/dataops-managed/src/client/SkillPlazaSection.module.css.mjs
+		const css$3 = "._9FdZvq_section{box-sizing:border-box;flex-direction:column;width:100%;max-width:960px;margin:0 auto;display:flex}._9FdZvq_head{flex-direction:column;margin-bottom:8px;display:flex}._9FdZvq_title{color:var(--dsw-alias-label-primary);align-items:baseline;gap:8px;margin:0;font-size:14px;font-weight:500;line-height:20px;display:flex}._9FdZvq_titleCount{color:var(--dsw-alias-label-tertiary);font-size:12px;font-weight:400}._9FdZvq_status{text-align:center;color:var(--dsw-alias-label-tertiary);margin:0;padding:20px 0;font-size:13px;line-height:20px}._9FdZvq_tagBar{flex-wrap:wrap;gap:6px;margin-bottom:8px;display:flex}._9FdZvq_chip{background:var(--dsw-alias-bg-module-platform);height:24px;color:var(--dsw-alias-label-secondary);cursor:pointer;border:0;border-radius:12px;align-items:center;padding:0 10px;font-size:12px;line-height:18px;transition:background .12s;display:inline-flex}._9FdZvq_chip:hover{background:var(--dsw-alias-interactive-bg-hover)}._9FdZvq_chip:focus-visible{outline:2px solid var(--dsw-alias-brand-primary);outline-offset:1px}._9FdZvq_chipOn{background:color-mix(in srgb, var(--dsw-alias-state-business-primary) 14%, var(--dsw-alias-bg-layer-1));color:var(--dsw-alias-state-business-primary);font-weight:500}._9FdZvq_notice{color:var(--dsw-alias-state-business-primary);margin:4px 0 0;font-size:12px;line-height:18px}._9FdZvq_cards{grid-template-columns:repeat(auto-fill,minmax(272px,1fr));grid-auto-rows:max-content;align-content:start;align-items:stretch;gap:12px;margin:0;padding:0;list-style:none;display:grid}._9FdZvq_card{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-1);border-radius:10px;flex-direction:column;align-self:stretch;gap:10px;min-width:0;height:auto;padding:12px;display:flex}._9FdZvq_cardTop{justify-content:space-between;align-items:center;gap:10px;min-height:28px;display:flex}._9FdZvq_cardIcon{background:var(--dsw-alias-bg-layer-2);width:28px;height:28px;color:var(--dsw-alias-label-secondary);border-radius:50%;flex:none;place-items:center;display:grid}._9FdZvq_cardTitle{text-overflow:ellipsis;white-space:nowrap;flex:1;min-width:0;font-size:14px;font-weight:600;line-height:20px;overflow:hidden}._9FdZvq_mine{flex:none}._9FdZvq_cardDesc{min-height:36px;color:var(--dsw-alias-label-secondary);-webkit-line-clamp:2;-webkit-box-orient:vertical;font-size:12px;line-height:18px;display:-webkit-box;overflow:hidden}._9FdZvq_cardMarks{flex-wrap:wrap;align-content:flex-start;gap:6px;min-height:20px;display:flex}._9FdZvq_mark{background:color-mix(in srgb, var(--dsw-alias-state-business-primary) 14%, var(--dsw-alias-bg-layer-1));color:var(--dsw-alias-state-business-primary);white-space:nowrap;border:0;border-radius:4px;padding:2px 7px;font-size:11px;font-weight:500;line-height:16px}._9FdZvq_cardEnd{flex:none;align-items:center;gap:4px;margin-top:auto;padding-top:4px;display:flex}._9FdZvq_detailButton{margin-left:auto}._9FdZvq_detail{flex-direction:column;gap:12px;margin:0;display:flex}._9FdZvq_dialog{width:min(560px,100%)}._9FdZvq_detailRow{flex-direction:column;gap:2px;display:flex}._9FdZvq_detailLabel{color:var(--dsw-alias-label-caption);font-size:11px;line-height:16px}._9FdZvq_detailValue{max-height:160px;color:var(--dsw-alias-label-secondary);white-space:pre-wrap;overflow-wrap:anywhere;margin:0;font-size:12px;line-height:18px;overflow:auto}._9FdZvq_empty{text-align:center;flex-direction:column;align-items:center;gap:10px;padding:28px 16px 32px;display:flex}._9FdZvq_emptyIcon{border:.5px solid var(--dsw-alias-border-l3);width:56px;height:56px;color:var(--dsw-alias-label-tertiary);border-radius:14px;justify-content:center;align-items:center;display:inline-flex}._9FdZvq_emptyText{color:var(--dsw-alias-label-tertiary);margin:0;font-size:13px;line-height:20px}._9FdZvq_headRow{align-items:center;gap:6px;display:flex}._9FdZvq_headRow ._9FdZvq_title{flex:none}._9FdZvq_demoTag{background:var(--dsw-alias-state-warn-secondary);color:var(--dsw-alias-state-warn-primary);border-radius:4px;padding:1px 6px;font-size:10px;line-height:16px}._9FdZvq_tabs{border-bottom:1px solid var(--dsw-alias-border-l1);align-items:center;gap:2px;margin-bottom:8px;display:flex}._9FdZvq_tab{height:30px;color:var(--dsw-alias-label-secondary);cursor:pointer;background:0 0;border:0;border-bottom:2px solid #0000;align-items:center;gap:5px;padding:0 9px;font-size:12px;display:inline-flex}._9FdZvq_tab:hover{color:var(--dsw-alias-label-primary)}._9FdZvq_tabActive{color:var(--dsw-alias-state-business-primary);border-bottom-color:var(--dsw-alias-state-business-primary);font-weight:500}._9FdZvq_tabCount{background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-tertiary);border-radius:7px;padding:0 4px;font-size:10px;line-height:14px}._9FdZvq_tagTop{text-overflow:ellipsis;white-space:nowrap;border:1px solid var(--dsw-alias-border-l2);max-width:40%;color:var(--dsw-alias-label-secondary);border-radius:4px;flex:none;padding:1px 6px;font-size:10px;line-height:16px;overflow:hidden}._9FdZvq_sharedTag{color:#fff;background:#0e6b3a;border-radius:4px;padding:2px 7px;font-size:11px;font-weight:600;line-height:16px}._9FdZvq_pendingTag{color:#fff;background:#7a4a00;border-radius:4px;padding:2px 7px;font-size:11px;font-weight:600;line-height:16px}._9FdZvq_rejectedTag{color:#fff;background:#a8231b;border-radius:4px;padding:2px 7px;font-size:11px;font-weight:600;line-height:16px}._9FdZvq_reviewButton{margin-left:auto}._9FdZvq_reviewNote{border-left:3px solid var(--dsw-alias-state-error-primary);background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, var(--dsw-alias-bg-layer-1));color:var(--dsw-alias-label-primary);margin:0;padding:6px 8px;font-size:11px;line-height:16px}._9FdZvq_auditDialog{width:min(640px,100vw - 32px)}._9FdZvq_audit{flex-direction:column;gap:14px;display:flex}._9FdZvq_auditFooter{justify-content:flex-end;gap:6px;display:flex}._9FdZvq_risk{border:1px solid var(--dsw-alias-border-l1);background:var(--dsw-alias-bg-layer-1);border-radius:6px;flex-direction:column;gap:8px;padding:10px;display:flex}._9FdZvq_riskHead{justify-content:space-between;align-items:center;gap:8px;font-size:12px;display:flex}._9FdZvq_riskEmpty,._9FdZvq_riskFailed{color:var(--dsw-alias-label-tertiary);margin:0;font-size:11px;line-height:16px}._9FdZvq_riskFailed{color:var(--dsw-alias-state-error-primary)}._9FdZvq_riskSummary{color:var(--dsw-alias-label-secondary);flex-wrap:wrap;align-items:center;gap:6px;font-size:12px;line-height:18px;display:flex}._9FdZvq_riskScore{color:var(--dsw-alias-label-primary);font-weight:600}._9FdZvq_severity{background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-secondary);text-transform:uppercase;border-radius:3px;padding:0 5px;font-size:10px;line-height:16px}._9FdZvq_severity[data-severity=high],._9FdZvq_severity[data-severity=critical]{background:var(--dsw-alias-state-error-secondary);color:var(--dsw-alias-state-error-primary)}._9FdZvq_severity[data-severity=medium]{background:var(--dsw-alias-state-warn-secondary);color:var(--dsw-alias-state-warn-primary)}._9FdZvq_findings{flex-direction:column;gap:6px;margin:0;padding:0;list-style:none;display:flex}._9FdZvq_finding{flex-wrap:wrap;align-items:baseline;gap:5px;font-size:11px;line-height:16px;display:flex}._9FdZvq_findingText{color:var(--dsw-alias-label-secondary);flex-basis:100%}._9FdZvq_findingHint{color:var(--dsw-alias-label-tertiary);flex-basis:100%}._9FdZvq_noteField{color:var(--dsw-alias-label-secondary);flex-direction:column;gap:5px;font-size:12px;display:flex}._9FdZvq_noteField textarea{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-base);min-height:64px;color:var(--dsw-alias-label-primary);font:inherit;resize:vertical;border-radius:5px;padding:7px 9px}._9FdZvq_reviewError{color:var(--dsw-alias-state-error-primary);margin:0;font-size:11px}";
+		const tagId$3 = "@sparkelf/dsh-dataops-managed/SkillPlazaSection.module.css";
+		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId$3) + "]") === null) {
+			const tag = document.createElement("style");
+			tag.dataset.plugin = "@sparkelf/dsh-dataops-managed";
+			tag.dataset.pluginCss = tagId$3;
+			tag.textContent = css$3;
+			document.head.appendChild(tag);
+		}
+		var SkillPlazaSection_module_css_default = {
+			"reviewError": "_9FdZvq_reviewError",
+			"chipOn": "_9FdZvq_chipOn",
+			"tabs": "_9FdZvq_tabs",
+			"sharedTag": "_9FdZvq_sharedTag",
+			"noteField": "_9FdZvq_noteField",
+			"mark": "_9FdZvq_mark",
+			"severity": "_9FdZvq_severity",
+			"findingText": "_9FdZvq_findingText",
+			"section": "_9FdZvq_section",
+			"head": "_9FdZvq_head",
+			"cardMarks": "_9FdZvq_cardMarks",
+			"cardTop": "_9FdZvq_cardTop",
+			"cardTitle": "_9FdZvq_cardTitle",
+			"detailLabel": "_9FdZvq_detailLabel",
+			"riskHead": "_9FdZvq_riskHead",
+			"riskSummary": "_9FdZvq_riskSummary",
+			"tab": "_9FdZvq_tab",
+			"reviewButton": "_9FdZvq_reviewButton",
+			"headRow": "_9FdZvq_headRow",
+			"risk": "_9FdZvq_risk",
+			"tagBar": "_9FdZvq_tagBar",
+			"riskEmpty": "_9FdZvq_riskEmpty",
+			"emptyText": "_9FdZvq_emptyText",
+			"cards": "_9FdZvq_cards",
+			"cardEnd": "_9FdZvq_cardEnd",
+			"chip": "_9FdZvq_chip",
+			"notice": "_9FdZvq_notice",
+			"cardIcon": "_9FdZvq_cardIcon",
+			"detailButton": "_9FdZvq_detailButton",
+			"status": "_9FdZvq_status",
+			"tagTop": "_9FdZvq_tagTop",
+			"title": "_9FdZvq_title",
+			"detailRow": "_9FdZvq_detailRow",
+			"detailValue": "_9FdZvq_detailValue",
+			"card": "_9FdZvq_card",
+			"detail": "_9FdZvq_detail",
+			"tabActive": "_9FdZvq_tabActive",
+			"tabCount": "_9FdZvq_tabCount",
+			"pendingTag": "_9FdZvq_pendingTag",
+			"rejectedTag": "_9FdZvq_rejectedTag",
+			"demoTag": "_9FdZvq_demoTag",
+			"empty": "_9FdZvq_empty",
+			"auditDialog": "_9FdZvq_auditDialog",
+			"audit": "_9FdZvq_audit",
+			"auditFooter": "_9FdZvq_auditFooter",
+			"riskScore": "_9FdZvq_riskScore",
+			"finding": "_9FdZvq_finding",
+			"findingHint": "_9FdZvq_findingHint",
+			"riskFailed": "_9FdZvq_riskFailed",
+			"emptyIcon": "_9FdZvq_emptyIcon",
+			"reviewNote": "_9FdZvq_reviewNote",
+			"cardDesc": "_9FdZvq_cardDesc",
+			"dialog": "_9FdZvq_dialog",
+			"findings": "_9FdZvq_findings",
+			"titleCount": "_9FdZvq_titleCount",
+			"mine": "_9FdZvq_mine"
+		};
+		//#endregion
+		//#region src/client/SkillPlazaSection.tsx
+		/** Tab counts from the same visible rows the cards render. */
+		function countsOf(skills) {
+			const counted = reviewCounts(skills);
+			return {
+				approved: counted.approved,
+				pending: counted.pending,
+				rejected: skills.filter((row) => row.reviewStatus === "rejected").length,
+				total: counted.all
+			};
+		}
+		/** One skill as a card in the plaza grid. */
+		function PlazaCard({ skill, busy, canAudit, onInstall, onUnshare, onReview, t }) {
+			const [open, setOpen] = (0, react.useState)(false);
+			const status = normalizeReviewStatus(skill.reviewStatus);
+			const tag = visibilityTag(skill);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
+				className: SkillPlazaSection_module_css_default.card,
+				"data-review-status": status,
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: SkillPlazaSection_module_css_default.cardTop,
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: SkillPlazaSection_module_css_default.cardIcon,
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconSkillOutlineRegular, { size: 16 })
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+								className: SkillPlazaSection_module_css_default.cardTitle,
+								children: skill.name
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: SkillPlazaSection_module_css_default.tagTop,
+								title: tag.detail,
+								children: tag.label
+							})
+						]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: SkillPlazaSection_module_css_default.cardMarks,
+						children: [
+							skill.sharedByMe ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: SkillPlazaSection_module_css_default.sharedTag,
+								children: t("plazaSharedTag")
+							}) : null,
+							status === "pending" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: SkillPlazaSection_module_css_default.pendingTag,
+								children: t("plazaTabPending")
+							}) : null,
+							status === "rejected" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: SkillPlazaSection_module_css_default.rejectedTag,
+								children: t("plazaReject")
+							}) : null,
+							skill.tags.map((item) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 								className: SkillPlazaSection_module_css_default.mark,
-								children: t("plazaMine")
-							}) : null
+								children: item
+							}, item))
 						]
 					}),
-					skill.description === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: SkillPlazaSection_module_css_default.cardDesc,
-						children: skill.description
-					}),
-					skill.tags.length === 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						className: SkillPlazaSection_module_css_default.cardMarks,
-						children: skill.tags.map((item) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-							className: SkillPlazaSection_module_css_default.mark,
-							children: item
-						}, item))
+						children: skill.description ?? ""
 					}),
+					status === "rejected" && skill.reviewNote !== null && skill.reviewNote !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: SkillPlazaSection_module_css_default.reviewNote,
+						children: skill.reviewNote
+					}) : null,
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: SkillPlazaSection_module_css_default.cardEnd,
 						children: [
+							canAudit && status === "pending" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+								variant: "outline",
+								size: "sm",
+								className: SkillPlazaSection_module_css_default.reviewButton,
+								onClick: onReview,
+								children: t("plazaReview")
+							}) : null,
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
 								variant: "outline",
 								size: "sm",
@@ -886,43 +2128,171 @@ window.__ModuleLoader__.load({
 				]
 			});
 		}
+		/** The AI report block inside the audit dialog. */
+		function RiskReportView({ report, busy, failed, onScan, t }) {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+				className: SkillPlazaSection_module_css_default.risk,
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: SkillPlazaSection_module_css_default.riskHead,
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: t("plazaRiskTitle") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+							variant: "outline",
+							size: "sm",
+							disabled: busy,
+							onClick: onScan,
+							children: busy ? t("plazaRiskScanning") : t("plazaRiskScan")
+						})]
+					}),
+					failed ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: SkillPlazaSection_module_css_default.riskFailed,
+						children: t("plazaRiskFailed")
+					}) : null,
+					report === null ? busy ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: SkillPlazaSection_module_css_default.riskEmpty,
+						children: t("plazaRiskNone")
+					}) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: SkillPlazaSection_module_css_default.riskSummary,
+						children: [
+							report.score === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: SkillPlazaSection_module_css_default.riskScore,
+								children: [
+									t("plazaRiskScore"),
+									" ",
+									report.score
+								]
+							}),
+							report.severity === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: SkillPlazaSection_module_css_default.severity,
+								"data-severity": report.severity,
+								children: report.severity
+							}),
+							report.summary === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: report.summary })
+						]
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+						className: SkillPlazaSection_module_css_default.findings,
+						children: report.findings.map((finding, index) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
+							className: SkillPlazaSection_module_css_default.finding,
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: SkillPlazaSection_module_css_default.severity,
+									"data-severity": finding.severity,
+									children: finding.severity
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: finding.category }),
+								finding.evidence === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: SkillPlazaSection_module_css_default.findingText,
+									children: finding.evidence
+								}),
+								finding.recommendation === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: SkillPlazaSection_module_css_default.findingHint,
+									children: finding.recommendation
+								})
+							]
+						}, String(index)))
+					})] })
+				]
+			});
+		}
 		/**
 		* Browse, share, and install skills other users published.
 		*
-		* The section appears only where this plugin is installed: the skill center renders the slot,
-		* and an empty slot renders nothing. Every action goes through this plugin's Host route, so a
-		* workspace without DataOps never reaches these calls.
-		* @param props - Skill center injection values.
-		* @returns The plaza section, or nothing before injection.
+		* Review is a permissioned overlay on the same plaza: the tab strip and the audit dialog only
+		* appear when the Host says the caller may review, and the Host additionally narrows the pending
+		* list to the caller's department subtree.
 		*/
 		function SkillPlazaSection(props) {
 			const { t } = props;
 			const [state, setState] = (0, react.useState)({ kind: "loading" });
+			const [context, setContext] = (0, react.useState)(void 0);
+			const [tab, setTab] = (0, react.useState)("approved");
 			const [tag, setTag] = (0, react.useState)("");
 			const [busy, setBusy] = (0, react.useState)(false);
-			const query = props.query ?? "";
 			const [notice, setNotice] = (0, react.useState)(null);
+			const [audit, setAudit] = (0, react.useState)(null);
+			const [risk, setRisk] = (0, react.useState)(null);
+			const [riskBusy, setRiskBusy] = (0, react.useState)(false);
+			const [riskFailed, setRiskFailed] = (0, react.useState)(false);
+			const [reviewNote, setReviewNote] = (0, react.useState)("");
+			const [reviewBusy, setReviewBusy] = (0, react.useState)(false);
+			const [reviewError, setReviewError] = (0, react.useState)(null);
+			const query = props.query ?? "";
+			const allowed = canReview(context);
+			(0, react.useEffect)(() => {
+				let live = true;
+				fetchReviewContext().then((next) => {
+					if (live) setContext(next);
+				}).catch(() => {
+					if (live) setContext(null);
+				});
+				return () => {
+					live = false;
+				};
+			}, []);
 			const load = (0, react.useCallback)(async (filter) => {
 				try {
-					const listing = await fetchPlaza(filter);
-					setState(listing === null ? { kind: "unavailable" } : {
+					if (reviewDemoMode()) {
+						const demo = demoPlazaSkills();
+						setState({
+							kind: "ready",
+							listing: {
+								skills: [...filterByReview(demo, filter.tab)],
+								tags: [
+									"性能",
+									"数据",
+									"数据库",
+									"质量",
+									"经营",
+									"日报",
+									"客户"
+								],
+								counts: countsOf(demo)
+							}
+						});
+						return;
+					}
+					const listing = await fetchPlaza({
+						tag: filter.tag,
+						query: filter.query,
+						status: allowed ? "all" : "approved"
+					});
+					if (listing === null) {
+						setState({ kind: "unavailable" });
+						return;
+					}
+					const visible = allowed ? listing.skills : listing.skills.filter((row) => normalizeReviewStatus(row.reviewStatus) === "approved");
+					setState({
 						kind: "ready",
-						listing
+						listing: {
+							...listing,
+							skills: [...filterByReview(visible, filter.tab)],
+							counts: countsOf(visible)
+						}
 					});
 				} catch {
 					setState({ kind: "failed" });
 				}
-			}, []);
+			}, [allowed]);
 			(0, react.useEffect)(() => {
-				load({ query });
-			}, [load, query]);
-			const refresh = (0, react.useCallback)(async (nextTag = tag, nextQuery = query) => {
+				load({
+					tab,
+					tag,
+					query
+				});
+			}, [
+				load,
+				tab,
+				tag,
+				query
+			]);
+			const refresh = (0, react.useCallback)(async (nextTab = tab, nextTag = tag) => {
 				await load({
+					tab: nextTab,
 					tag: nextTag,
-					query: nextQuery
+					query
 				});
 			}, [
 				load,
+				tab,
 				tag,
 				query
 			]);
@@ -939,16 +2309,75 @@ window.__ModuleLoader__.load({
 					setBusy(false);
 				}
 			}, [refresh, t]);
+			const runScan = async (skill) => {
+				setRiskBusy(true);
+				setRiskFailed(false);
+				try {
+					const report = await scanReview("skill", [skill.id]);
+					if (report === null) setRiskFailed(true);
+					else setRisk(report);
+				} catch {
+					setRiskFailed(true);
+				} finally {
+					setRiskBusy(false);
+				}
+			};
+			const openAudit = (skill) => {
+				setAudit(skill);
+				setRisk(skill.riskReport ?? null);
+				setRiskFailed(false);
+				setReviewNote("");
+				setReviewError(null);
+				if (skill.riskReport === null || skill.riskReport === void 0) runScan(skill);
+			};
+			const submitReview = async (decision) => {
+				if (audit === null || reviewBusy) return;
+				if (decision === "reject" && reviewNote.trim() === "") {
+					setReviewError(t === void 0 ? null : t("plazaReviewNote"));
+					return;
+				}
+				setReviewBusy(true);
+				setReviewError(null);
+				try {
+					if (!await decideReview("skill", [audit.id], decision, reviewNote.trim())) {
+						setReviewError(t === void 0 ? null : t("plazaReviewFailed"));
+						return;
+					}
+					setAudit(null);
+					setNotice(t === void 0 ? null : t("plazaReviewDone"));
+					await refresh("pending");
+				} catch {
+					setReviewError(t === void 0 ? null : t("plazaReviewFailed"));
+				} finally {
+					setReviewBusy(false);
+				}
+			};
 			if (t === void 0) return null;
 			if (state.kind === "loading") return null;
 			const head = (count) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 				className: SkillPlazaSection_module_css_default.head,
-				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("h2", {
-					className: SkillPlazaSection_module_css_default.title,
-					children: [t("plazaTitle"), count === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						className: SkillPlazaSection_module_css_default.titleCount,
-						children: count
-					})]
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: SkillPlazaSection_module_css_default.headRow,
+					children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("h2", {
+							className: SkillPlazaSection_module_css_default.title,
+							children: [t("plazaTitle"), count === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: SkillPlazaSection_module_css_default.titleCount,
+								children: count
+							})]
+						}),
+						reviewDemoMode() ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: SkillPlazaSection_module_css_default.demoTag,
+							children: t("plazaDemo")
+						}) : null,
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(NotificationBell, {
+							label: t("plazaTitle") + "通知",
+							onOpen: (item) => {
+								const next = notificationTab(item);
+								if (next !== void 0) setTab(next);
+							}
+						})
+					]
 				})
 			});
 			if (state.kind === "unavailable") return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
@@ -985,10 +2414,40 @@ window.__ModuleLoader__.load({
 				})]
 			});
 			const { listing } = state;
+			const counts = listing.counts === void 0 ? reviewCounts(listing.skills) : {
+				approved: listing.counts.approved,
+				pending: listing.counts.pending,
+				all: listing.counts.total
+			};
+			const tabs = reviewTabsFor(context);
+			const tabLabel = (item) => item === "approved" ? t("plazaTabApproved") : item === "pending" ? t("plazaTabPending") : t("plazaTabAll");
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 				className: SkillPlazaSection_module_css_default.section,
 				children: [
-					head(listing.skills.length),
+					head(counts[tab]),
+					tabs.length > 1 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: SkillPlazaSection_module_css_default.tabs,
+						role: "tablist",
+						"aria-label": t("plazaTitle"),
+						children: tabs.map((item) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+							type: "button",
+							role: "tab",
+							"aria-selected": tab === item,
+							className: tab === item ? SkillPlazaSection_module_css_default.tab + " " + SkillPlazaSection_module_css_default.tabActive : SkillPlazaSection_module_css_default.tab,
+							onClick: () => {
+								setTab(item);
+								load({
+									tab: item,
+									tag,
+									query
+								});
+							},
+							children: [tabLabel(item), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: SkillPlazaSection_module_css_default.tabCount,
+								children: counts[item]
+							})]
+						}, item))
+					}) : null,
 					listing.tags.length === 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: SkillPlazaSection_module_css_default.tagBar,
 						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
@@ -996,7 +2455,7 @@ window.__ModuleLoader__.load({
 							className: tag === "" ? SkillPlazaSection_module_css_default.chip + " " + SkillPlazaSection_module_css_default.chipOn : SkillPlazaSection_module_css_default.chip,
 							onClick: () => {
 								setTag("");
-								refresh("", query);
+								refresh(tab, "");
 							},
 							children: t("plazaAllTags")
 						}), listing.tags.map((item) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
@@ -1004,7 +2463,7 @@ window.__ModuleLoader__.load({
 							className: tag === item ? SkillPlazaSection_module_css_default.chip + " " + SkillPlazaSection_module_css_default.chipOn : SkillPlazaSection_module_css_default.chip,
 							onClick: () => {
 								setTag(item);
-								refresh(item, query);
+								refresh(tab, item);
 							},
 							children: item
 						}, item))]
@@ -1020,7 +2479,7 @@ window.__ModuleLoader__.load({
 							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconShareOutlineRegular, { size: 28 })
 						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 							className: SkillPlazaSection_module_css_default.emptyText,
-							children: t("plazaEmpty")
+							children: tab === "pending" ? t("plazaPendingEmpty") : t("plazaEmpty")
 						})]
 					}) : null,
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
@@ -1028,6 +2487,7 @@ window.__ModuleLoader__.load({
 						children: listing.skills.map((skill) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PlazaCard, {
 							skill,
 							busy,
+							canAudit: allowed,
 							t,
 							onInstall: () => {
 								act({
@@ -1040,67 +2500,151 @@ window.__ModuleLoader__.load({
 									action: "unshare",
 									id: skill.id
 								}, t("plazaUnshared"));
+							},
+							onReview: () => {
+								openAudit(skill);
 							}
 						}, skill.id))
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Modal, {
+						open: audit !== null,
+						onClose: () => {
+							if (!reviewBusy) setAudit(null);
+						},
+						title: t("plazaAuditTitle"),
+						closeLabel: t("plazaClose"),
+						className: SkillPlazaSection_module_css_default.auditDialog,
+						footer: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: SkillPlazaSection_module_css_default.auditFooter,
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+									variant: "outline",
+									disabled: reviewBusy,
+									onClick: () => {
+										setAudit(null);
+									},
+									children: t("plazaClose")
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+									variant: "outline",
+									disabled: reviewBusy,
+									onClick: () => {
+										submitReview("reject");
+									},
+									children: t("plazaReject")
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+									variant: "primary",
+									disabled: reviewBusy,
+									onClick: () => {
+										submitReview("approve");
+									},
+									children: t("plazaApprove")
+								})
+							]
+						}),
+						children: audit === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: SkillPlazaSection_module_css_default.audit,
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("dl", {
+									className: SkillPlazaSection_module_css_default.detail,
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+											className: SkillPlazaSection_module_css_default.detailRow,
+											children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dt", {
+												className: SkillPlazaSection_module_css_default.detailLabel,
+												children: t("plazaAuditSource")
+											}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("dd", {
+												className: SkillPlazaSection_module_css_default.detailValue,
+												children: [
+													audit.ownerName ?? "—",
+													" · ",
+													visibilityTag(audit).detail
+												]
+											})]
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+											className: SkillPlazaSection_module_css_default.detailRow,
+											children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dt", {
+												className: SkillPlazaSection_module_css_default.detailLabel,
+												children: t("plazaAuditVisibility")
+											}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("dd", {
+												className: SkillPlazaSection_module_css_default.detailValue,
+												children: visibilityTag(audit).label
+											})]
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+											className: SkillPlazaSection_module_css_default.detailRow,
+											children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dt", {
+												className: SkillPlazaSection_module_css_default.detailLabel,
+												children: t("plazaShowDetail")
+											}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("dd", {
+												className: SkillPlazaSection_module_css_default.detailValue,
+												children: audit.description ?? "—"
+											})]
+										})
+									]
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(RiskReportView, {
+									report: risk,
+									busy: riskBusy,
+									failed: riskFailed,
+									onScan: () => {
+										runScan(audit);
+									},
+									t
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+									className: SkillPlazaSection_module_css_default.noteField,
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("plazaReviewNote") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("textarea", {
+										value: reviewNote,
+										placeholder: t("plazaReviewNotePlaceholder"),
+										onChange: (event) => {
+											setReviewNote(event.target.value);
+										}
+									})]
+								}),
+								reviewError === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									className: SkillPlazaSection_module_css_default.reviewError,
+									role: "alert",
+									children: reviewError
+								})
+							]
+						})
 					})
 				]
 			});
 		}
 		//#endregion
-		//#region \0dsh-css:/tmp/wt-rebase/packages/dataops-managed/src/client/WanxiangBrand.module.css.mjs
-		const css = ".kO6bEq_mark{color:inherit;flex:none;display:block;overflow:visible}.kO6bEq_animatedMark{cursor:pointer}.kO6bEq_mark g{transform-box:fill-box;transform-origin:50%}.kO6bEq_sidebarName{min-width:0;height:24px;color:inherit;align-items:center;gap:6px;display:inline-flex}.kO6bEq_sidebarName>svg:first-child{flex:0 auto;min-width:0;max-width:102px}.kO6bEq_harness{flex:none;display:block;overflow:visible}@keyframes kO6bEq_unit-top{0%,to{transform:translate(0)}50%{transform:translateY(-2px)}}@keyframes kO6bEq_unit-left{0%,to{transform:translate(0)}50%{transform:translate(-2px,1px)}}@keyframes kO6bEq_unit-right{0%,to{transform:translate(0)}50%{transform:translate(2px,1px)}}@keyframes kO6bEq_unit-core{0%,to{transform:translate(0)}50%{transform:translateY(2px)}}@media (hover:hover) and (prefers-reduced-motion:no-preference){.kO6bEq_animatedMark:hover .kO6bEq_unitTop{animation:1.6s ease-in-out infinite kO6bEq_unit-top}.kO6bEq_animatedMark:hover .kO6bEq_unitLeft{animation:1.6s ease-in-out infinite kO6bEq_unit-left}.kO6bEq_animatedMark:hover .kO6bEq_unitRight{animation:1.6s ease-in-out infinite kO6bEq_unit-right}.kO6bEq_animatedMark:hover .kO6bEq_unitCore{animation:1.6s ease-in-out infinite kO6bEq_unit-core}}@media (prefers-reduced-motion:reduce){.kO6bEq_animatedMark,.kO6bEq_animatedMark g{animation:none!important;transform:none!important}}";
-		const tagId = "@sparkelf/dsh-dataops-managed/WanxiangBrand.module.css";
-		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId) + "]") === null) {
+		//#region \0dsh-css:/root/projects/dsh-plugins-plus/packages/dataops-managed/src/client/WanxiangBrand.module.css.mjs
+		const css$2 = ".s0HPxG_mark{color:inherit;flex:none;display:block;overflow:visible}.s0HPxG_animatedMark{cursor:pointer}.s0HPxG_mark g{transform-box:fill-box;transform-origin:50%}.s0HPxG_sidebarName{min-width:0;height:24px;color:inherit;align-items:center;gap:6px;display:inline-flex}.s0HPxG_sidebarName>:first-child{flex:0 auto;min-width:0;max-width:102px}.s0HPxG_wordmark{letter-spacing:.01em;white-space:nowrap;text-overflow:ellipsis;font-family:PingFang SC,HarmonyOS Sans SC,Microsoft YaHei,Noto Sans CJK SC,Source Han Sans SC,sans-serif;font-weight:600;line-height:1;display:block;overflow:hidden}.s0HPxG_harness{flex:none;display:block;overflow:visible}@keyframes s0HPxG_unit-top{0%,to{transform:translate(0)}50%{transform:translateY(-2px)}}@keyframes s0HPxG_unit-left{0%,to{transform:translate(0)}50%{transform:translate(-2px,1px)}}@keyframes s0HPxG_unit-right{0%,to{transform:translate(0)}50%{transform:translate(2px,1px)}}@keyframes s0HPxG_unit-core{0%,to{transform:translate(0)}50%{transform:translateY(2px)}}@media (hover:hover) and (prefers-reduced-motion:no-preference){.s0HPxG_animatedMark:hover .s0HPxG_unitTop{animation:1.6s ease-in-out infinite s0HPxG_unit-top}.s0HPxG_animatedMark:hover .s0HPxG_unitLeft{animation:1.6s ease-in-out infinite s0HPxG_unit-left}.s0HPxG_animatedMark:hover .s0HPxG_unitRight{animation:1.6s ease-in-out infinite s0HPxG_unit-right}.s0HPxG_animatedMark:hover .s0HPxG_unitCore{animation:1.6s ease-in-out infinite s0HPxG_unit-core}}@media (prefers-reduced-motion:reduce){.s0HPxG_animatedMark,.s0HPxG_animatedMark g{animation:none!important;transform:none!important}}";
+		const tagId$2 = "@sparkelf/dsh-dataops-managed/WanxiangBrand.module.css";
+		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId$2) + "]") === null) {
 			const tag = document.createElement("style");
 			tag.dataset.plugin = "@sparkelf/dsh-dataops-managed";
-			tag.dataset.pluginCss = tagId;
-			tag.textContent = css;
+			tag.dataset.pluginCss = tagId$2;
+			tag.textContent = css$2;
 			document.head.appendChild(tag);
 		}
 		var WanxiangBrand_module_css_default = {
-			"sidebarName": "kO6bEq_sidebarName",
-			"mark": "kO6bEq_mark",
-			"unit-right": "kO6bEq_unit-right",
-			"harness": "kO6bEq_harness",
-			"unit-top": "kO6bEq_unit-top",
-			"unit-core": "kO6bEq_unit-core",
-			"unitLeft": "kO6bEq_unitLeft",
-			"unit-left": "kO6bEq_unit-left",
-			"unitTop": "kO6bEq_unitTop",
-			"unitCore": "kO6bEq_unitCore",
-			"animatedMark": "kO6bEq_animatedMark",
-			"unitRight": "kO6bEq_unitRight"
+			"unitRight": "s0HPxG_unitRight",
+			"unitCore": "s0HPxG_unitCore",
+			"animatedMark": "s0HPxG_animatedMark",
+			"wordmark": "s0HPxG_wordmark",
+			"unit-left": "s0HPxG_unit-left",
+			"unitLeft": "s0HPxG_unitLeft",
+			"unit-top": "s0HPxG_unit-top",
+			"unit-core": "s0HPxG_unit-core",
+			"sidebarName": "s0HPxG_sidebarName",
+			"mark": "s0HPxG_mark",
+			"unitTop": "s0HPxG_unitTop",
+			"harness": "s0HPxG_harness",
+			"unit-right": "s0HPxG_unit-right"
 		};
 		//#endregion
 		//#region src/client/WanxiangBrand.tsx
-		const WORDMARK_VIEWBOX = "1.64 115.64 5927.36 933.38";
-		const WORDMARK_RATIO = 5927.36 / 933.38;
-		const WORDMARK_PATHS = [
-			{
-				"d": "M62 765V691H333C326 434 312 123 34 -24C53 -38 77 -62 89 -82C287 28 361 217 390 414H767C752 147 735 37 705 9C693 -2 681 -4 657 -3C631 -3 558 -3 483 4C498 -17 508 -48 509 -70C578 -74 648 -75 686 -72C724 -70 749 -62 772 -36C811 5 829 126 846 450C847 460 847 487 847 487H399C406 556 409 625 411 691H939V765Z",
-				"transform": "translate(0.00 940.00) scale(0.96000 -0.94000)"
-			},
-			{
-				"d": "M546 474H850V300H546ZM546 542V710H850V542ZM546 231H850V57H546ZM473 781V-73H546V-12H850V-70H926V781ZM214 840V626H52V554H205C170 416 99 258 29 175C41 157 60 127 68 107C122 176 175 287 214 402V-79H287V378C325 329 370 267 389 234L435 295C413 322 322 429 287 464V554H430V626H287V840Z",
-				"transform": "translate(1002.00 940.00) scale(0.96000 -0.94000)"
-			},
-			{
-				"d": "M443 821C425 782 393 723 368 688L417 664C443 697 477 747 506 793ZM88 793C114 751 141 696 150 661L207 686C198 722 171 776 143 815ZM410 260C387 208 355 164 317 126C279 145 240 164 203 180C217 204 233 231 247 260ZM110 153C159 134 214 109 264 83C200 37 123 5 41 -14C54 -28 70 -54 77 -72C169 -47 254 -8 326 50C359 30 389 11 412 -6L460 43C437 59 408 77 375 95C428 152 470 222 495 309L454 326L442 323H278L300 375L233 387C226 367 216 345 206 323H70V260H175C154 220 131 183 110 153ZM257 841V654H50V592H234C186 527 109 465 39 435C54 421 71 395 80 378C141 411 207 467 257 526V404H327V540C375 505 436 458 461 435L503 489C479 506 391 562 342 592H531V654H327V841ZM629 832C604 656 559 488 481 383C497 373 526 349 538 337C564 374 586 418 606 467C628 369 657 278 694 199C638 104 560 31 451 -22C465 -37 486 -67 493 -83C595 -28 672 41 731 129C781 44 843 -24 921 -71C933 -52 955 -26 972 -12C888 33 822 106 771 198C824 301 858 426 880 576H948V646H663C677 702 689 761 698 821ZM809 576C793 461 769 361 733 276C695 366 667 468 648 576Z",
-				"transform": "translate(2004.00 940.00) scale(0.96000 -0.94000)"
-			},
-			{
-				"d": "M484 238V-81H550V-40H858V-77H927V238H734V362H958V427H734V537H923V796H395V494C395 335 386 117 282 -37C299 -45 330 -67 344 -79C427 43 455 213 464 362H663V238ZM468 731H851V603H468ZM468 537H663V427H467L468 494ZM550 22V174H858V22ZM167 839V638H42V568H167V349C115 333 67 319 29 309L49 235L167 273V14C167 0 162 -4 150 -4C138 -5 99 -5 56 -4C65 -24 75 -55 77 -73C140 -74 179 -71 203 -59C228 -48 237 -27 237 14V296L352 334L341 403L237 370V568H350V638H237V839Z",
-				"transform": "translate(3006.00 940.00) scale(0.96000 -0.94000)"
-			},
-			{
-				"d": "M174 630C213 556 252 459 266 399L337 424C323 482 282 578 242 650ZM755 655C730 582 684 480 646 417L711 396C750 456 797 552 834 633ZM52 348V273H459V-79H537V273H949V348H537V698H893V773H105V698H459V348Z",
-				"transform": "translate(4008.00 940.00) scale(0.96000 -0.94000)"
-			},
-			{
-				"d": "M179 342V-79H255V-25H741V-77H821V342ZM255 48V270H741V48ZM126 426C165 441 224 443 800 474C825 443 846 414 861 388L925 434C873 518 756 641 658 727L599 687C647 644 699 591 745 540L231 516C320 598 410 701 490 811L415 844C336 720 219 593 183 559C149 526 124 505 101 500C110 480 122 442 126 426Z",
-				"transform": "translate(5010.00 940.00) scale(0.96000 -0.94000)"
-			}
-		];
+		/** User-visible platform name shared by the header wordmark and its accessible name. */
+		const BRAND_NAME = "万相AI中台";
 		const HARNESS_PATHS = [
 			{
 				"d": "M132.848 8.93205H134.08V16.137H132.848V8.93205ZM136.5 8.93205H137.732V16.137H136.5V8.93205ZM133.365 13.024V11.99H137.193V13.024H133.365Z",
@@ -1189,30 +2733,22 @@ window.__ModuleLoader__.load({
 				]
 			});
 		}
-		/** Approved rounded-Heiti artwork, stored as paths with no runtime font dependency. */
+		/**
+		* Platform wordmark rendered as text.
+		*
+		* It used to be glyph artwork for the previous platform name, which cannot express the new
+		* name without redrawing every path. Text keeps the visible header, the accessible name, and
+		* the browser title on one string, and inherits the host's CJK font stack through `font-family`.
+		*/
 		function WanxiangWordmark({ height, accessible = false, className }) {
-			const accessibility = accessible ? {
-				role: "img",
-				"aria-label": "万相数据平台"
-			} : { "aria-hidden": true };
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("svg", {
-				width: height * WORDMARK_RATIO,
-				height,
-				className,
-				viewBox: WORDMARK_VIEWBOX,
-				...accessibility,
-				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("g", {
-					fill: "currentColor",
-					stroke: "currentColor",
-					strokeWidth: "42",
-					strokeLinejoin: "round",
-					strokeLinecap: "round",
-					paintOrder: "stroke fill",
-					children: WORDMARK_PATHS.map((path) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
-						d: path.d,
-						transform: path.transform
-					}, path.transform))
-				})
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+				className: classes(WanxiangBrand_module_css_default.wordmark, className),
+				style: { fontSize: height },
+				...accessible ? {
+					role: "img",
+					"aria-label": BRAND_NAME
+				} : {},
+				children: BRAND_NAME
 			});
 		}
 		/** Exact HARNESS badge artwork extracted from the current DSH BrandWordmark. */
@@ -1254,7 +2790,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region src/client/install-branding.tsx
-		const BRAND_TITLE = "万相数据平台 Harness";
+		const BRAND_TITLE = "万相AI中台 Harness";
 		const SLOT_PRIORITY = -100;
 		const FAVICON_ID = "dataops-wanxiang-favicon";
 		const FAVICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 54 58"><style>:root{color:#1b1b1d}@media(prefers-color-scheme:dark){:root{color:#f7f7f8}}</style><g transform="translate(15 0)" stroke="currentColor" stroke-width="1.7" stroke-linejoin="round"><path d="M12 0 24 7 12 14 0 7Z" fill="none"/><path d="M0 7 12 14v16L0 23Z" fill="currentColor"/><path d="M12 14 24 7v16L12 30Z" fill="currentColor" fill-opacity=".18"/></g><g transform="translate(0 16)" stroke="currentColor" stroke-width="1.7" stroke-linejoin="round"><path d="M12 0 24 7 12 14 0 7Z" fill="none"/><path d="M0 7 12 14v16L0 23Z" fill="currentColor"/><path d="M12 14 24 7v16L12 30Z" fill="currentColor" fill-opacity=".18"/></g><g transform="translate(30 16)" stroke="currentColor" stroke-width="1.7" stroke-linejoin="round"><path d="M12 0 24 7 12 14 0 7Z" fill="none"/><path d="M0 7 12 14v16L0 23Z" fill="currentColor"/><path d="M12 14 24 7v16L12 30Z" fill="currentColor" fill-opacity=".18"/></g><g transform="translate(15 27)" stroke="currentColor" stroke-width="1.7" stroke-linejoin="round"><path d="M12 0 24 7 12 14 0 7Z" fill="none"/><path d="M0 7 12 14v16L0 23Z" fill="currentColor"/><path d="M12 14 24 7v16L12 30Z" fill="currentColor" fill-opacity=".18"/></g></svg>`;
@@ -1340,50 +2876,2004 @@ window.__ModuleLoader__.load({
 			}, "dataops-managed: Wanxiang shell branding");
 		}
 		//#endregion
-		//#region src/client/locales.ts
-		/** English managed DataOps Settings copy. */
-		const en = {
-			nav: "DataOps",
-			title: "DataOps",
-			managed: "Connected to DataOps",
-			unavailable: "DataOps is not connected.",
-			loadFailed: "Loading failed. Try again.",
-			brandingTitle: "Wanxiang branding",
-			brandingToggle: "Wanxiang branding",
-			limitsTitle: "File size limits",
-			limitsFileReadLabel: "Largest file to read (MiB)",
-			limitsUploadLabel: "Largest file to upload (MiB)",
-			limitsInvalid: "Enter a size in MiB.",
-			limitsSave: "Save",
-			limitsSaving: "Saving…",
-			timeoutTitle: "DataOps query timeout",
-			timeoutLabel: "Longest single query (seconds)",
-			timeoutInvalid: "Enter 1 to 3600 seconds.",
-			defaultsTitle: "Default configuration",
-			defaultsPublish: "Publish",
-			defaultsPublishing: "Publishing…",
-			defaultsPublishedAt: "Last published",
-			defaultsNeverPublished: "Not published yet",
-			defaultsNotAdmin: "Administrators only",
-			plazaTitle: "Skill plaza",
-			plazaAllTags: "All tags",
-			plazaMine: "Shared by me",
-			plazaShowDetail: "Details",
-			plazaClose: "Close",
-			plazaDetailUpdated: "Updated",
-			plazaDetailBody: "Skill body",
-			plazaInstall: "Install",
-			plazaInstalled: "Installed. It is now in your skill list.",
-			plazaUnshare: "Stop sharing",
-			plazaUnshared: "Removed from the plaza. Users who installed it keep their copy.",
-			plazaEmpty: "No skills have been shared yet.",
-			plazaUnavailable: "The skill plaza is available once this workspace is connected to DataOps.",
-			plazaLoadFailed: "The skill plaza could not be loaded. Try again.",
-			plazaActionFailed: "The action could not be completed. Try again.",
-			plazaRetry: "Try again"
+		//#region src/client/ReloginPrompt.tsx
+		/**
+		* The "sign in again" prompt shown when this workspace's DataOps session has ended.
+		*
+		* The failure it reports used to be invisible. Every DataOps call handles a 401 by degrading to
+		* an empty result, which is right for one panel but wrong for the operator: settings, shared
+		* models and the skill plaza all render as "nothing here" while the real cause is that nobody is
+		* signed in any more. This prompt names that state once, with the one action that clears it.
+		*
+		* It reports and nothing more. It does not retry, expire, or re-authenticate — the portal owns
+		* the login form and is the only thing that can issue a session. It also cannot navigate the
+		* operator there: the portal is a different origin, so this frame cannot read or drive its
+		* window, and the gateway does not forward the browser's origin to the workspace. Guessing a
+		* URL from inside here would open the wrong page on some deployments, so the dialog tells the
+		* operator which window to switch to instead of pretending it can take them.
+		*
+		* @module ReloginPrompt
+		*/
+		/** How often to re-read the observed auth state. */
+		const POLL_MS$1 = 15e3;
+		/**
+		* Read the observed credential state from the Host.
+		*
+		* A failed read says nothing about the credential: this route is served by the same process that
+		* serves the page, so an unreachable route means the Web server is busy or restarting, not that
+		* anyone was signed out. Returning `undefined` keeps a transient error from raising a sign-in
+		* prompt, which would be a lie the operator cannot act on.
+		*
+		* @returns the reported state, or `undefined` when it could not be read.
+		*/
+		const readAuthState = async () => {
+			try {
+				const response = await fetch(new URL("/integrations/dataops/auth-state", window.location.origin), { credentials: "same-origin" });
+				if (!response.ok) return void 0;
+				const state = (await response.json()).state;
+				return state === "expired" || state === "valid" || state === "unknown" ? state : void 0;
+			} catch {
+				return;
+			}
 		};
-		/** Chinese managed DataOps Settings copy. */
-		const zh = {
+		/**
+		* Watch for an ended DataOps session and say so.
+		*
+		* @param props.t - localized copy resolver.
+		* @returns the dialog while the session is known to have ended, otherwise `null`.
+		*/
+		function ReloginPrompt(props) {
+			const { t } = props;
+			const [expired, setExpired] = (0, react.useState)(false);
+			const [dismissed, setDismissed] = (0, react.useState)(false);
+			(0, react.useEffect)(() => {
+				let cancelled = false;
+				const tick = async () => {
+					const state = await readAuthState();
+					if (cancelled || state === void 0) return;
+					setExpired(state === "expired");
+					if (state !== "expired") setDismissed(false);
+				};
+				tick();
+				const timer = setInterval(() => {
+					tick();
+				}, POLL_MS$1);
+				return () => {
+					cancelled = true;
+					clearInterval(timer);
+				};
+			}, []);
+			const dismiss = (0, react.useCallback)(() => {
+				setDismissed(true);
+			}, []);
+			if (!expired || dismissed) return null;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Modal, {
+				open: true,
+				onClose: dismiss,
+				title: t("reloginTitle"),
+				closeLabel: t("reloginDismiss"),
+				description: t("reloginBody"),
+				footer: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+					onClick: dismiss,
+					children: t("reloginDismiss")
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+					variant: "primary",
+					onClick: () => {
+						window.location.reload();
+					},
+					children: t("reloginAction")
+				})] })
+			});
+		}
+		//#endregion
+		//#region src/client/settings-gate.ts
+		/**
+		* Whether the managed DataOps settings section may be registered at all.
+		*
+		* Registration is the gate, not a CSS class: an ordinary user's profile should not contain a
+		* section whose controls they may not use. The identity record is presentation-only and arrives
+		* from the portal after the iframe loads, so the registration follows it instead of reading it
+		* once at startup. Authorization still lives in DataOps; this only keeps a forbidden panel out of
+		* the interface.
+		*/
+		/** The two DataOps role labels allowed to see the managed settings panel. */
+		const MANAGED_SETTINGS_ROLES = /* @__PURE__ */ new Set(["超级管理员", "管理员"]);
+		/** The account launcher's visible label, which is painted before the window record settles. */
+		function domAccountName() {
+			if (typeof document === "undefined") return null;
+			return [...document.querySelectorAll("[data-dataops-account-name]")].map((element) => element.textContent?.trim() ?? "").filter((text) => text !== "" && text.length <= 30).sort((left, right) => left.length - right.length)[0] ?? null;
+		}
+		/** Read the current role label without trusting any other field. */
+		function currentManagedSettingsRole() {
+			if (typeof window === "undefined") return null;
+			const domName = domAccountName();
+			if (domName !== null) return domName;
+			const name = window.__DATAOPS_USER__?.name;
+			return typeof name === "string" && name.trim() !== "" ? name.trim() : null;
+		}
+		/** Whether the current identity may see the managed DataOps settings section. */
+		function canSeeManagedSettings() {
+			const role = currentManagedSettingsRole();
+			return role !== null && MANAGED_SETTINGS_ROLES.has(role);
+		}
+		/**
+		* Observe identity changes.
+		*
+		* The account plugin keeps one store on `window`; subscribing to its listener set catches the
+		* in-page update even before the portal's DOM event. The event is kept as a second signal because
+		* a future portal may publish the event without touching the store this plugin reads.
+		*/
+		function subscribeManagedSettingsVisibility(listener) {
+			if (typeof window === "undefined") return () => {};
+			const store = window.__DATAOPS_ACCOUNT_STORE__;
+			store?.listeners?.add(listener);
+			window.addEventListener("dataops-account:changed", listener);
+			/**
+			* The first identity can arrive before this module subscribes (or replace the account store
+			* object), which is why the sidebar used to show only the sections whose gate happened to run
+			* later. The launcher's label is a DOM fact either way, so watch it as the fallback signal.
+			*/
+			let observed = domAccountName();
+			const observer = typeof MutationObserver === "undefined" || typeof document === "undefined" ? void 0 : new MutationObserver(() => {
+				const next = domAccountName();
+				if (next === observed) return;
+				observed = next;
+				listener();
+			});
+			observer?.observe(document.documentElement, {
+				subtree: true,
+				childList: true,
+				characterData: true,
+				attributes: true,
+				attributeFilter: ["data-dataops-account-name"]
+			});
+			if (observed !== null) queueMicrotask(listener);
+			return () => {
+				store?.listeners?.delete(listener);
+				window.removeEventListener("dataops-account:changed", listener);
+				observer?.disconnect();
+			};
+		}
+		//#endregion
+		//#region \0dsh-css:/root/projects/dsh-plugins-plus/packages/dataops-managed/src/client/PermissionCenterSection.module.css.mjs
+		const css$1 = ".PNbOqW_page{box-sizing:border-box;flex-direction:column;gap:14px;width:100%;max-width:clamp(1000px,60vw,1200px);min-height:0;margin:0 auto;padding:24px;display:flex}.PNbOqW_head{justify-content:space-between;align-items:flex-start;gap:12px;display:flex}.PNbOqW_title{color:var(--dsw-alias-label-primary);margin:0;font-size:18px;font-weight:600;line-height:26px}.PNbOqW_subtitle{color:var(--dsw-alias-label-tertiary);align-items:center;gap:6px;margin:3px 0 0;font-size:12px;display:flex}.PNbOqW_demo{color:#9a5b00;background:#fff3e0;border-radius:4px;padding:1px 6px;font-size:10px;line-height:16px}.PNbOqW_tabs{border-bottom:1px solid var(--dsw-alias-border-l1);gap:2px;display:flex}.PNbOqW_tab{height:32px;color:var(--dsw-alias-label-secondary);cursor:pointer;background:0 0;border:0;border-bottom:2px solid #0000;padding:0 12px;font-size:13px}.PNbOqW_tabActive{color:var(--dsw-alias-state-business-primary);border-bottom-color:var(--dsw-alias-state-business-primary);font-weight:500}.PNbOqW_notice,.PNbOqW_waiting{background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-secondary);border-radius:5px;margin:0;padding:8px 10px;font-size:12px}.PNbOqW_waiting{border:1px dashed var(--dsw-alias-border-l2);color:var(--dsw-alias-label-tertiary)}.PNbOqW_panel{border:1px solid var(--dsw-alias-border-l1);background:var(--dsw-alias-bg-layer-1);border-radius:8px;flex-direction:column;gap:10px;min-height:0;padding:14px;display:flex}.PNbOqW_sectionTitle{margin:0;font-size:13px;font-weight:600}.PNbOqW_matrixScroll,.PNbOqW_tableScroll{overscroll-behavior:contain;scrollbar-gutter:stable;max-height:clamp(280px,100dvh - 340px,520px);overflow:auto}.PNbOqW_matrix,.PNbOqW_table{border-collapse:collapse;width:100%;font-size:12px}.PNbOqW_matrix th,.PNbOqW_matrix td,.PNbOqW_table th,.PNbOqW_table td{border-bottom:1px solid var(--dsw-alias-border-l1);text-align:left;vertical-align:top;padding:7px 9px}.PNbOqW_matrix th,.PNbOqW_table th{background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-secondary);white-space:nowrap;font-weight:600}.PNbOqW_permission{white-space:nowrap;color:var(--dsw-alias-label-secondary);align-items:center;gap:5px;font-size:11px;line-height:20px;display:flex}.PNbOqW_panelFoot{flex-wrap:wrap;justify-content:flex-end;align-items:center;gap:6px;display:flex}.PNbOqW_readOnly{color:var(--dsw-alias-label-tertiary);margin-right:auto;font-size:11px}.PNbOqW_muted{color:var(--dsw-alias-label-tertiary);font-size:11px}.PNbOqW_departments{flex-direction:column;gap:4px;margin:0;padding:0;list-style:none;display:flex}.PNbOqW_department{border-bottom:1px solid var(--dsw-alias-border-l1);justify-content:space-between;align-items:center;gap:12px;padding:9px 8px;font-size:12px;display:flex}.PNbOqW_deptAdmins{align-items:center;gap:5px;display:flex}.PNbOqW_adminTag{color:var(--dsw-alias-state-business-primary);background:#ecf1fc;border-radius:4px;padding:1px 6px;font-size:11px}.PNbOqW_empty{text-align:center;color:var(--dsw-alias-label-tertiary);margin:0;padding:40px 0}.PNbOqW_matrixScroll{overscroll-behavior:contain;scrollbar-gutter:stable;max-height:clamp(280px,100dvh - 340px,520px);overflow:auto}.PNbOqW_matrix thead th{z-index:2;position:sticky;top:0}.PNbOqW_matrix thead th:first-child,.PNbOqW_matrix tbody th{background:var(--dsw-alias-bg-layer-2);min-width:132px;position:sticky;left:0}.PNbOqW_matrix thead th:first-child{z-index:3}.PNbOqW_matrix tbody th{z-index:1;background:var(--dsw-alias-bg-layer-1)}.PNbOqW_protected{background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-tertiary);white-space:nowrap;border-radius:3px;margin-left:5px;padding:0 5px;font-size:10px;font-weight:500;line-height:16px;display:inline-block}tr[data-locked=true] td{opacity:.62}.PNbOqW_pager{justify-content:flex-end;align-items:center;gap:8px;padding-top:8px;display:flex}.PNbOqW_dialog{width:min(560px,100vw - 32px)}.PNbOqW_dialogBody{flex-direction:column;gap:10px;display:flex}.PNbOqW_dialogHint{color:var(--dsw-alias-label-secondary);margin:0;font-size:12px;line-height:18px}.PNbOqW_search{box-sizing:border-box;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-base);width:100%;height:30px;color:var(--dsw-alias-label-primary);font:var(--dsw-font-xs-13);border-radius:5px;padding:0 9px}.PNbOqW_candidates{flex-direction:column;gap:2px;max-height:260px;margin:0;padding:0;list-style:none;display:flex;overflow:auto}.PNbOqW_candidate{cursor:pointer;border-radius:5px;align-items:center;gap:7px;padding:6px 7px;font-size:12px;display:flex}.PNbOqW_candidate:hover{background:var(--dsw-alias-interactive-bg-hover)}.PNbOqW_error{color:var(--dsw-alias-state-error-primary);margin:0;font-size:11px;line-height:16px}.PNbOqW_dialogFooter{justify-content:flex-end;gap:6px;display:flex}.PNbOqW_matrixNote{color:var(--dsw-alias-label-tertiary);margin:6px 0 0;font-size:11px;line-height:16px}.PNbOqW_panelHead{justify-content:space-between;align-items:center;gap:10px;display:flex}.PNbOqW_treeRoot,.PNbOqW_treeChildren{margin:0;padding:0;list-style:none}.PNbOqW_treeChildren{border-left:1px solid var(--dsw-alias-border-l1);margin-left:18px}.PNbOqW_treeRow{border-bottom:1px solid var(--dsw-alias-border-l1);align-items:center;gap:7px;min-height:34px;font-size:12px;display:flex}.PNbOqW_treeToggle,.PNbOqW_treeSpacer{flex:none;justify-content:center;align-items:center;width:18px;height:18px;display:inline-flex}.PNbOqW_treeToggle{color:var(--dsw-alias-label-tertiary);cursor:pointer;background:0 0;border:0;border-radius:3px;font-size:11px}.PNbOqW_treeToggle:hover{background:var(--dsw-alias-interactive-bg-hover)}.PNbOqW_treeName{color:var(--dsw-alias-label-primary);white-space:nowrap;font-weight:600}.PNbOqW_treeActions{align-items:center;gap:2px;margin-left:auto;display:flex}.PNbOqW_field{color:var(--dsw-alias-label-secondary);flex-direction:column;gap:5px;font-size:12px;display:flex}.PNbOqW_field input,.PNbOqW_field select{box-sizing:border-box;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-base);width:100%;height:30px;color:var(--dsw-alias-label-primary);font:var(--dsw-font-xs-13);border-radius:5px;padding:0 9px}.PNbOqW_field input:disabled{opacity:.65}.PNbOqW_matrixModule{vertical-align:top;background:var(--dsw-alias-bg-layer-2);min-width:96px;color:var(--dsw-alias-label-secondary);text-align:left;border-right:1px solid var(--dsw-alias-border-l1);padding:10px 9px;font-size:12px;font-weight:600}.PNbOqW_matrixGroup th{background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-secondary);text-align:left;padding:7px 9px;font-size:12px;font-weight:600}.PNbOqW_matrixPermission{white-space:nowrap;min-width:230px}.PNbOqW_scopeBadge{border-radius:3px;margin-left:6px;padding:0 5px;font-size:10px;font-weight:500;line-height:16px;display:inline-block}.PNbOqW_scopeBadge[data-scope=department]{background:color-mix(in srgb, var(--dsw-alias-state-business-primary) 14%, var(--dsw-alias-bg-layer-1));color:var(--dsw-alias-state-business-primary)}.PNbOqW_scopeBadge[data-scope=global]{background:color-mix(in srgb, var(--dsw-alias-state-warn-primary) 16%, var(--dsw-alias-bg-layer-1));color:var(--dsw-alias-state-warn-primary)}.PNbOqW_onlyAdmin{color:var(--dsw-alias-label-tertiary);white-space:nowrap;margin-left:4px;font-size:10px}.PNbOqW_permCopy{max-width:100%;color:var(--dsw-alias-label-primary);font:inherit;text-align:left;cursor:pointer;background:0 0;border:0;align-items:center;gap:2px;padding:0;display:inline-flex}.PNbOqW_permCopy:hover span:first-child{color:var(--dsw-alias-state-business-primary);text-decoration:underline dotted}.PNbOqW_permDescription{color:var(--dsw-alias-label-tertiary);white-space:normal;margin-top:2px;font-size:10px;font-weight:400;line-height:15px;display:block}.PNbOqW_copied{color:var(--dsw-alias-state-success-primary);margin-left:4px;font-size:10px}.PNbOqW_combobox{min-width:132px;position:relative}.PNbOqW_comboboxTrigger{box-sizing:border-box;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-base);width:100%;height:28px;color:var(--dsw-alias-label-primary);font:var(--dsw-font-xs-13);text-align:left;cursor:pointer;border-radius:5px;justify-content:space-between;align-items:center;gap:8px;padding:0 8px;display:flex}.PNbOqW_comboboxTrigger:hover:not(:disabled){border-color:var(--dsw-alias-state-business-primary)}.PNbOqW_comboboxTrigger:focus-visible{outline:2px solid var(--dsw-alias-state-business-primary);outline-offset:1px}.PNbOqW_comboboxTrigger:disabled{opacity:.55;cursor:default}.PNbOqW_comboboxPlaceholder{color:var(--dsw-alias-label-tertiary)}.PNbOqW_comboboxMenu{z-index:30;box-sizing:border-box;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-1);border-radius:7px;width:max(100%,220px);padding:5px;position:absolute;top:calc(100% + 4px);left:0;box-shadow:0 8px 24px #00000038}.PNbOqW_comboboxSearch{box-sizing:border-box;border:1px solid var(--dsw-alias-border-l1);background:var(--dsw-alias-bg-base);width:100%;height:28px;color:var(--dsw-alias-label-primary);font:var(--dsw-font-xs-13);border-radius:4px;padding:0 7px}.PNbOqW_comboboxList{max-height:210px;margin:4px 0 0;padding:0;list-style:none;overflow:auto}.PNbOqW_comboboxOption{width:100%;color:var(--dsw-alias-label-primary);text-align:left;cursor:pointer;background:0 0;border:0;border-radius:4px;align-items:center;gap:5px;padding:6px;font-size:12px;line-height:18px;display:flex}.PNbOqW_comboboxOptionActive,.PNbOqW_comboboxOption:hover{background:var(--dsw-alias-interactive-bg-hover)}.PNbOqW_comboboxCheck{width:13px;color:var(--dsw-alias-state-business-primary);flex:none;font-size:11px}.PNbOqW_comboboxHint{color:var(--dsw-alias-label-tertiary);margin-left:auto;font-size:10px}.PNbOqW_comboboxEmpty{color:var(--dsw-alias-label-tertiary);padding:9px 7px;font-size:11px}.PNbOqW_rowActions{white-space:nowrap;align-items:center;gap:4px;display:flex}.PNbOqW_detailGrid{grid-template-columns:92px minmax(0,1fr);gap:8px 12px;margin:0;font-size:12px;line-height:18px;display:grid}.PNbOqW_detailGrid dt{color:var(--dsw-alias-label-tertiary)}.PNbOqW_detailGrid dd{color:var(--dsw-alias-label-primary);overflow-wrap:anywhere;margin:0}";
+		const tagId$1 = "@sparkelf/dsh-dataops-managed/PermissionCenterSection.module.css";
+		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId$1) + "]") === null) {
+			const tag = document.createElement("style");
+			tag.dataset.plugin = "@sparkelf/dsh-dataops-managed";
+			tag.dataset.pluginCss = tagId$1;
+			tag.textContent = css$1;
+			document.head.appendChild(tag);
+		}
+		var PermissionCenterSection_module_css_default = {
+			"panelFoot": "PNbOqW_panelFoot",
+			"comboboxHint": "PNbOqW_comboboxHint",
+			"matrixGroup": "PNbOqW_matrixGroup",
+			"permDescription": "PNbOqW_permDescription",
+			"protected": "PNbOqW_protected",
+			"matrixNote": "PNbOqW_matrixNote",
+			"dialogHint": "PNbOqW_dialogHint",
+			"pager": "PNbOqW_pager",
+			"tabs": "PNbOqW_tabs",
+			"permCopy": "PNbOqW_permCopy",
+			"comboboxSearch": "PNbOqW_comboboxSearch",
+			"error": "PNbOqW_error",
+			"dialog": "PNbOqW_dialog",
+			"treeSpacer": "PNbOqW_treeSpacer",
+			"matrixPermission": "PNbOqW_matrixPermission",
+			"treeActions": "PNbOqW_treeActions",
+			"panel": "PNbOqW_panel",
+			"tab": "PNbOqW_tab",
+			"adminTag": "PNbOqW_adminTag",
+			"candidates": "PNbOqW_candidates",
+			"department": "PNbOqW_department",
+			"copied": "PNbOqW_copied",
+			"tabActive": "PNbOqW_tabActive",
+			"treeRoot": "PNbOqW_treeRoot",
+			"comboboxOption": "PNbOqW_comboboxOption",
+			"table": "PNbOqW_table",
+			"onlyAdmin": "PNbOqW_onlyAdmin",
+			"permission": "PNbOqW_permission",
+			"combobox": "PNbOqW_combobox",
+			"treeToggle": "PNbOqW_treeToggle",
+			"dialogFooter": "PNbOqW_dialogFooter",
+			"candidate": "PNbOqW_candidate",
+			"empty": "PNbOqW_empty",
+			"comboboxList": "PNbOqW_comboboxList",
+			"sectionTitle": "PNbOqW_sectionTitle",
+			"readOnly": "PNbOqW_readOnly",
+			"treeRow": "PNbOqW_treeRow",
+			"detailGrid": "PNbOqW_detailGrid",
+			"matrix": "PNbOqW_matrix",
+			"field": "PNbOqW_field",
+			"subtitle": "PNbOqW_subtitle",
+			"demo": "PNbOqW_demo",
+			"title": "PNbOqW_title",
+			"treeChildren": "PNbOqW_treeChildren",
+			"matrixModule": "PNbOqW_matrixModule",
+			"comboboxPlaceholder": "PNbOqW_comboboxPlaceholder",
+			"comboboxMenu": "PNbOqW_comboboxMenu",
+			"comboboxCheck": "PNbOqW_comboboxCheck",
+			"scopeBadge": "PNbOqW_scopeBadge",
+			"comboboxEmpty": "PNbOqW_comboboxEmpty",
+			"treeName": "PNbOqW_treeName",
+			"panelHead": "PNbOqW_panelHead",
+			"rowActions": "PNbOqW_rowActions",
+			"deptAdmins": "PNbOqW_deptAdmins",
+			"comboboxTrigger": "PNbOqW_comboboxTrigger",
+			"waiting": "PNbOqW_waiting",
+			"tableScroll": "PNbOqW_tableScroll",
+			"muted": "PNbOqW_muted",
+			"search": "PNbOqW_search",
+			"page": "PNbOqW_page",
+			"departments": "PNbOqW_departments",
+			"notice": "PNbOqW_notice",
+			"dialogBody": "PNbOqW_dialogBody",
+			"head": "PNbOqW_head",
+			"matrixScroll": "PNbOqW_matrixScroll",
+			"comboboxOptionActive": "PNbOqW_comboboxOptionActive"
+		};
+		//#endregion
+		//#region src/client/combobox.ts
+		/**
+		* Filter options by display label or code hint, case-insensitively.
+		* @param options - all options.
+		* @param query - typed search text.
+		*/
+		function filterComboboxOptions(options, query) {
+			const needle = query.trim().toLowerCase();
+			if (needle === "") return [...options];
+			return options.filter((option) => option.label.toLowerCase().includes(needle) || (option.hint ?? "").toLowerCase().includes(needle));
+		}
+		/** Keep an active index inside a possibly empty result list. */
+		function clampActiveIndex(index, length) {
+			if (length <= 0) return 0;
+			return Math.max(0, Math.min(length - 1, index));
+		}
+		/** Owner cell face: a real display name, or a dash; never the raw id. */
+		function ownerDisplay(ownerName) {
+			const name = ownerName?.trim();
+			return name === void 0 || name === "" ? "—" : name;
+		}
+		//#endregion
+		//#region src/client/PermissionCenterSection.tsx
+		init_review_demo();
+		/** How many rows one page of the members/resources tables shows. */
+		const PAGE_SIZE = 10;
+		/**
+		* The permission centre.
+		*
+		* Every write goes through `saveRbacSection`; the backend enforces the same role/scope rules
+		* the disabled controls represent. The page keeps target-aware state explicitly (actor role,
+		* actor department) so an ADMIN cannot edit a SUPER_ADMIN row and a DEPT_ADMIN cannot reach
+		* another department, even if a list payload is wider than expected.
+		*/
+		function PermissionCenterSection({ t }) {
+			const [context, setContext] = (0, react.useState)(void 0);
+			const [overview, setOverview] = (0, react.useState)(void 0);
+			const [tab, setTab] = (0, react.useState)("roles");
+			const [notice, setNotice] = (0, react.useState)(null);
+			const [busy, setBusy] = (0, react.useState)(false);
+			const [deptDialog, setDeptDialog] = (0, react.useState)(null);
+			const [deptSearch, setDeptSearch] = (0, react.useState)("");
+			const [deptSelected, setDeptSelected] = (0, react.useState)([]);
+			const [deptSaving, setDeptSaving] = (0, react.useState)(false);
+			const [deptError, setDeptError] = (0, react.useState)(null);
+			const [deptForm, setDeptForm] = (0, react.useState)(null);
+			const demo = reviewDemoMode();
+			const load = (0, react.useCallback)(async () => {
+				const nextContext = await fetchReviewContext();
+				setContext(nextContext);
+				if (nextContext === null && !demo) {
+					setOverview(null);
+					return;
+				}
+				try {
+					setOverview(demo ? demoRbacOverview() : await fetchRbacOverview());
+				} catch {
+					setOverview(null);
+				}
+			}, [demo]);
+			(0, react.useEffect)(() => {
+				load();
+			}, [load]);
+			if (t === void 0) return null;
+			if (context === void 0 || overview === void 0) return null;
+			const knownAdmin = canSeeManagedSettings();
+			if (context !== null ? context.role !== "SUPER_ADMIN" && context.role !== "ADMIN" && context.role !== "DEPT_ADMIN" && !knownAdmin : !knownAdmin) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("section", {
+				className: PermissionCenterSection_module_css_default.page,
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+					className: PermissionCenterSection_module_css_default.empty,
+					children: t("permNoAccess")
+				})
+			});
+			const roleName = context === null ? currentManagedSettingsRole() ?? "—" : roleLabel(context.role);
+			const departmentName = context?.departmentPath?.join(" / ") ?? "—";
+			const actorRole = context?.role ?? (knownAdmin ? "ADMIN" : "APP_USER");
+			const writable = context === null ? knownAdmin : canManagePermissions(context) || demo;
+			const superAdmin = context === null ? knownAdmin : context.role === "SUPER_ADMIN" || demo;
+			const canAssignDepartment = writable && (superAdmin || actorRole === "ADMIN");
+			const labels = [
+				{
+					key: "roles",
+					label: t("permTabRoles")
+				},
+				{
+					key: "members",
+					label: t("permTabMembers")
+				},
+				{
+					key: "departments",
+					label: t("permTabDepartments")
+				},
+				{
+					key: "resources",
+					label: t("permTabResources")
+				}
+			];
+			const save = async (section, value) => {
+				setBusy(true);
+				setNotice(null);
+				try {
+					const result = await saveRbacSection(section, value);
+					setNotice(result.ok ? t("permSaved") : result.reason ?? t("permWaiting"));
+					if (result.ok) await load();
+					return result;
+				} catch {
+					setNotice(t("permSaveFailed"));
+					return {
+						ok: false,
+						reason: t("permSaveFailed")
+					};
+				} finally {
+					setBusy(false);
+				}
+			};
+			const saveRoleChanges = async (changes) => {
+				setBusy(true);
+				setNotice(null);
+				try {
+					for (const change of changes) {
+						const result = await saveRbacSection("roles", {
+							roleCode: change.roleCode,
+							permissionKeys: change.permissionKeys
+						});
+						if (!result.ok) {
+							setNotice(result.reason ?? t("permSaveFailed"));
+							await load();
+							return result;
+						}
+					}
+					setNotice(t("permSaved"));
+					await load();
+					return { ok: true };
+				} catch {
+					setNotice(t("permSaveFailed"));
+					return {
+						ok: false,
+						reason: t("permSaveFailed")
+					};
+				} finally {
+					setBusy(false);
+				}
+			};
+			const openDepartment = (department) => {
+				setDeptDialog(department);
+				setDeptSelected(department.deptAdmins?.map((admin) => admin.userId) ?? []);
+				setDeptSearch("");
+				setDeptError(null);
+			};
+			const assignDepartment = async (userIds) => {
+				if (deptDialog === null || deptSaving) return;
+				setDeptSaving(true);
+				setDeptError(null);
+				try {
+					const result = await saveRbacSection("departments", {
+						code: deptDialog.code,
+						userIds
+					});
+					if (!result.ok) {
+						setDeptError(result.reason ?? "保存失败：后端拒绝或无权限（403）。");
+						return;
+					}
+					setDeptDialog(null);
+					setNotice("部门管理员已更新。");
+					await load();
+				} catch {
+					setDeptError("保存失败：后端拒绝或无权限（403）。");
+				} finally {
+					setDeptSaving(false);
+				}
+			};
+			const removeDepartment = async (department) => {
+				const children = overview?.departments.filter((row) => row.parentCode === department.code).length ?? 0;
+				const members = department.memberCount ?? 0;
+				if (!window.confirm("确认删除部门「" + department.name + "」？\n成员 " + String(members) + " 人，子部门 " + String(children) + " 个；删除后不可恢复。")) return;
+				const result = await deleteDepartment(department.code);
+				if (!result.ok) {
+					setNotice(result.reason ?? "删除失败：后端拒绝或无权限（403）。");
+					return;
+				}
+				setNotice("部门已删除。");
+				await load();
+			};
+			const candidates = deptDialog === null || overview === null ? [] : overview.members.filter((member) => {
+				const pathCodes = member.departmentPath?.map((entry) => entry.code) ?? [];
+				return member.departmentCode === deptDialog.code || pathCodes.includes(deptDialog.code);
+			}).filter((member) => {
+				const needle = deptSearch.trim().toLowerCase();
+				return needle === "" || member.displayName.toLowerCase().includes(needle) || member.username.toLowerCase().includes(needle);
+			});
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+				className: PermissionCenterSection_module_css_default.page,
+				"data-permission-center": "",
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("header", {
+						className: PermissionCenterSection_module_css_default.head,
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h1", {
+							className: PermissionCenterSection_module_css_default.title,
+							children: t("permTitle")
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+							className: PermissionCenterSection_module_css_default.subtitle,
+							children: [
+								roleName,
+								" · ",
+								departmentName,
+								demo ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: PermissionCenterSection_module_css_default.demo,
+									children: t("permDemo")
+								}) : null
+							]
+						})] }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+							variant: "outline",
+							size: "sm",
+							icon: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconRefreshOutlineRegular, { size: 16 }),
+							onClick: () => {
+								load();
+							},
+							children: "刷新"
+						})]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: PermissionCenterSection_module_css_default.tabs,
+						role: "tablist",
+						"aria-label": t("permTitle"),
+						children: labels.map((item) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							role: "tab",
+							"aria-selected": tab === item.key,
+							className: tab === item.key ? PermissionCenterSection_module_css_default.tab + " " + PermissionCenterSection_module_css_default.tabActive : PermissionCenterSection_module_css_default.tab,
+							onClick: () => {
+								setTab(item.key);
+							},
+							children: item.label
+						}, item.key))
+					}),
+					notice === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: PermissionCenterSection_module_css_default.notice,
+						children: notice
+					}),
+					overview === null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: PermissionCenterSection_module_css_default.waiting,
+						children: t("permWaiting")
+					}) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+						tab === "roles" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(RoleMatrix, {
+							roles: overview.matrix.roles,
+							permissions: overview.matrix.permissions,
+							writable,
+							actorRole,
+							busy,
+							t,
+							onSaveAll: saveRoleChanges
+						}) : null,
+						tab === "members" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Members, {
+							members: overview.members,
+							writable,
+							actorRole,
+							actorUserId: context?.userId,
+							actorDepartmentCode: context?.departmentCode,
+							busy,
+							t,
+							onSave: (userId, roleCodes) => {
+								save("members", {
+									userId,
+									roleCodes
+								});
+							}
+						}) : null,
+						tab === "departments" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Departments, {
+							departments: overview.departments,
+							writable,
+							canAssign: canAssignDepartment,
+							canWrite: writable && (superAdmin || actorRole === "ADMIN"),
+							t,
+							onAssign: openDepartment,
+							onAdd: (parentCode) => {
+								setDeptForm({
+									mode: "create",
+									parentCode
+								});
+							},
+							onEdit: (department) => {
+								setDeptForm({
+									mode: "edit",
+									department
+								});
+							},
+							onDelete: (department) => {
+								removeDepartment(department);
+							}
+						}) : null,
+						tab === "resources" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Resources, {
+							resources: overview.resources,
+							departments: overview.departments,
+							writable,
+							actorRole,
+							actorDepartmentCode: context?.departmentCode,
+							busy,
+							t,
+							onSave: (row, visibility, departmentCode) => save("resources", {
+								kind: row.kind,
+								id: row.id,
+								visibility,
+								departmentCode
+							})
+						}) : null
+					] }),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Modal, {
+						open: deptDialog !== null,
+						onClose: () => {
+							if (!deptSaving) setDeptDialog(null);
+						},
+						title: deptDialog === null ? "分配部门管理员" : "分配管理员 · " + deptDialog.name,
+						closeLabel: "取消",
+						className: PermissionCenterSection_module_css_default.dialog,
+						footer: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: PermissionCenterSection_module_css_default.dialogFooter,
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+									variant: "outline",
+									disabled: deptSaving,
+									onClick: () => {
+										if (deptDialog !== null) assignDepartment([]);
+									},
+									children: "清空"
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+									variant: "outline",
+									disabled: deptSaving,
+									onClick: () => {
+										setDeptDialog(null);
+									},
+									children: "取消"
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+									variant: "primary",
+									disabled: deptSaving,
+									onClick: () => {
+										assignDepartment(deptSelected);
+									},
+									children: "保存"
+								})
+							]
+						}),
+						children: deptDialog === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: PermissionCenterSection_module_css_default.dialogBody,
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+									className: PermissionCenterSection_module_css_default.dialogHint,
+									children: ["当前管理员：", deptDialog.deptAdmins?.length === 0 || deptDialog.deptAdmins === void 0 ? "未设置" : deptDialog.deptAdmins.map((admin) => admin.displayName).join("、")]
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									className: PermissionCenterSection_module_css_default.search,
+									value: deptSearch,
+									placeholder: "搜索本部门成员…",
+									onChange: (event) => {
+										setDeptSearch(event.target.value);
+									}
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+									className: PermissionCenterSection_module_css_default.candidates,
+									children: candidates.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", {
+										className: PermissionCenterSection_module_css_default.muted,
+										children: "没有可选成员（后端可能只允许本部门/未分配用户）。"
+									}) : candidates.map((member) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+										className: PermissionCenterSection_module_css_default.candidate,
+										children: [
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+												type: "checkbox",
+												checked: deptSelected.includes(member.userId),
+												onChange: (event) => {
+													setDeptSelected((current) => event.target.checked ? [...current, member.userId] : current.filter((id) => id !== member.userId));
+												}
+											}),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: member.displayName }),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+												className: PermissionCenterSection_module_css_default.muted,
+												children: [
+													"@",
+													member.username,
+													" · ",
+													member.departmentPath?.map((entry) => entry.name).join(" / ") ?? "—"
+												]
+											})
+										]
+									}) }, member.userId))
+								}),
+								deptError === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									className: PermissionCenterSection_module_css_default.error,
+									role: "alert",
+									children: deptError
+								})
+							]
+						})
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(DepartmentFormDialog, {
+						state: deptForm,
+						departments: overview?.departments ?? [],
+						t,
+						onClose: () => {
+							setDeptForm(null);
+						},
+						onSaved: async () => {
+							setDeptForm(null);
+							setNotice("部门已保存。");
+							await load();
+						}
+					})
+				]
+			});
+		}
+		function RoleMatrix({ roles, permissions, writable, actorRole, busy, t, onSaveAll }) {
+			const visibleRoles = (0, react.useMemo)(() => roles.filter((role) => role.systemKey === "SUPER_ADMIN" || role.systemKey === "ADMIN" || role.systemKey === "DEPT_ADMIN" || role.systemKey === "APP_USER" || role.code === "超级管理员" || role.code === "管理员" || role.code === "部门管理员" || role.code === "应用人员" || role.code === "普通用户").map((role) => role.systemKey === "APP_USER" || role.code === "应用人员" || role.code === "普通用户" ? {
+				...role,
+				name: "普通用户"
+			} : role), [roles]);
+			const groups = (0, react.useMemo)(() => {
+				const hasSkill = permissions.some((point) => point.group === "skill" || point.group === "技能中心");
+				const keyOf = (group) => {
+					const raw = group.trim().toLowerCase();
+					if (raw === "kb" || raw === "knowledge" || group === "知识库") return "kb";
+					if (raw === "skill" || group === "技能中心") return "skill";
+					if (raw === "workflow" || group === "工作流广场") return "workflow";
+					if (raw === "automation" || group === "自动化任务") return "automation";
+					if (raw === "ai" && !hasSkill) return "skill";
+					return null;
+				};
+				return [
+					{
+						key: "kb",
+						label: "知识库"
+					},
+					{
+						key: "skill",
+						label: "技能中心"
+					},
+					{
+						key: "workflow",
+						label: "工作流广场"
+					},
+					{
+						key: "automation",
+						label: "自动化任务"
+					}
+				].map((def) => ({
+					...def,
+					points: permissions.filter((point) => keyOf(point.group) === def.key)
+				})).filter((group) => group.points.length > 0);
+			}, [permissions]);
+			(0, react.useMemo)(() => groups.flatMap((group) => group.points), [groups]);
+			const [draft, setDraft] = (0, react.useState)(() => Object.fromEntries(visibleRoles.map((role) => [role.code, new Set(role.permissions)])));
+			const [dirty, setDirty] = (0, react.useState)(() => /* @__PURE__ */ new Set());
+			const [saving, setSaving] = (0, react.useState)(false);
+			const [error, setError] = (0, react.useState)(null);
+			const [copiedKey, setCopiedKey] = (0, react.useState)(null);
+			const copyKey = async (key) => {
+				try {
+					await navigator.clipboard.writeText(key);
+				} catch {}
+				setCopiedKey(key);
+				window.setTimeout(() => {
+					setCopiedKey((current) => current === key ? null : current);
+				}, 1600);
+			};
+			(0, react.useEffect)(() => {
+				setDraft(Object.fromEntries(visibleRoles.map((role) => [role.code, new Set(role.permissions)])));
+				setDirty(/* @__PURE__ */ new Set());
+			}, [visibleRoles]);
+			const isDepartmentRole = (code) => code === "DEPT_ADMIN" || code === "部门管理员";
+			const isAppRole = (code) => code === "APP_USER" || code === "应用人员" || code === "普通用户";
+			const globalScope = (point) => point.scope === "global" || point.scope === "GLOBAL" || point.key === "skill:review:global" || point.key === "workflow:review:global";
+			const locked = (roleCode, point) => {
+				if (!writable || actorRole !== "SUPER_ADMIN") return true;
+				return globalScope(point) && (isDepartmentRole(roleCode) || isAppRole(roleCode));
+			};
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: PermissionCenterSection_module_css_default.panel,
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h2", {
+						className: PermissionCenterSection_module_css_default.sectionTitle,
+						children: t("permRoleMatrix")
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: PermissionCenterSection_module_css_default.matrixScroll,
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("table", {
+							className: PermissionCenterSection_module_css_default.matrix,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("thead", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("tr", { children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: t("permPermissionModule") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: t("permPermissionPoint") }),
+								visibleRoles.map((role) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: role.name }, role.code))
+							] }) }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("tbody", { children: groups.map((group) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(react.Fragment, { children: group.points.map((point, pointIndex) => {
+								const global = globalScope(point);
+								return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("tr", { children: [
+									pointIndex === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", {
+										scope: "rowgroup",
+										rowSpan: group.points.length,
+										className: PermissionCenterSection_module_css_default.matrixModule,
+										children: group.label
+									}) : null,
+									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("th", {
+										scope: "row",
+										className: PermissionCenterSection_module_css_default.matrixPermission,
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+											type: "button",
+											className: PermissionCenterSection_module_css_default.permCopy,
+											title: point.key,
+											onClick: () => {
+												copyKey(point.key);
+											},
+											children: [
+												/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: point.name }),
+												/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+													className: PermissionCenterSection_module_css_default.scopeBadge,
+													"data-scope": global ? "global" : "department",
+													children: global ? "全局" : "部门级"
+												}),
+												copiedKey === point.key ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+													className: PermissionCenterSection_module_css_default.copied,
+													children: "已复制"
+												}) : null
+											]
+										}), point.description === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: PermissionCenterSection_module_css_default.permDescription,
+											children: point.description
+										})]
+									}),
+									visibleRoles.map((role) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+										className: PermissionCenterSection_module_css_default.permission,
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+											type: "checkbox",
+											checked: draft[role.code]?.has(point.key) === true,
+											disabled: locked(role.code, point) || busy,
+											onChange: (event) => {
+												setDraft((current) => {
+													const next = new Set(current[role.code] ?? []);
+													if (event.target.checked) next.add(point.key);
+													else next.delete(point.key);
+													return {
+														...current,
+														[role.code]: next
+													};
+												});
+												setDirty((current) => new Set(current).add(role.code));
+											}
+										}), global && (isDepartmentRole(role.code) || isAppRole(role.code)) ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: PermissionCenterSection_module_css_default.onlyAdmin,
+											children: "仅管理员"
+										}) : null]
+									}) }, role.code))
+								] }, point.key);
+							}) }, group.key)) })]
+						})
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: PermissionCenterSection_module_css_default.panelFoot,
+						children: [
+							error === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: PermissionCenterSection_module_css_default.error,
+								children: error
+							}),
+							actorRole !== "SUPER_ADMIN" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: PermissionCenterSection_module_css_default.readOnly,
+								children: t("permSuperAdminOnly")
+							}) : null,
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+								variant: "primary",
+								size: "sm",
+								disabled: dirty.size === 0 || busy || saving,
+								onClick: () => {
+									setSaving(true);
+									setError(null);
+									onSaveAll(visibleRoles.filter((role) => dirty.has(role.code)).map((role) => ({
+										roleCode: role.code,
+										permissionKeys: [...draft[role.code] ?? []]
+									}))).then((result) => {
+										if (result.ok) {
+											setDirty(/* @__PURE__ */ new Set());
+											setError(null);
+										} else setError(result.reason ?? t("permSaveFailed"));
+									}).finally(() => {
+										setSaving(false);
+									});
+								},
+								children: [t("permSave"), dirty.size === 0 ? "" : " (" + String(dirty.size) + ")"]
+							})
+						]
+					})
+				]
+			});
+		}
+		function Members({ members, writable, actorRole, actorUserId, actorDepartmentCode, busy, t, onSave }) {
+			const [page, setPage] = (0, react.useState)(0);
+			const protectedMember = (member) => member.roleCodes.some((code) => {
+				if (code === "SUPER_ADMIN" || code === "超级管理员" || code === "ADMIN" || code === "管理员") return true;
+				return actorRole === "DEPT_ADMIN" && (code === "DEPT_ADMIN" || code === "部门管理员");
+			});
+			const superCount = members.filter((member) => member.roleCodes.some((code) => code === "SUPER_ADMIN" || code === "超级管理员")).length;
+			const inScope = (member) => actorRole === "SUPER_ADMIN" || actorRole === "ADMIN" || member.departmentCode === actorDepartmentCode || member.departmentPath?.some((entry) => entry.code === actorDepartmentCode) === true;
+			const pages = Math.max(1, Math.ceil(members.length / PAGE_SIZE));
+			const visible = members.slice(page * PAGE_SIZE, page * PAGE_SIZE + PAGE_SIZE);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: PermissionCenterSection_module_css_default.panel,
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					className: PermissionCenterSection_module_css_default.tableScroll,
+					children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("table", {
+						className: PermissionCenterSection_module_css_default.table,
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("thead", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("tr", { children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: t("permMember") }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: t("permDepartment") }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: t("permRole") })
+						] }) }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("tbody", { children: visible.map((member) => {
+							const isProtected = protectedMember(member);
+							const scoped = inScope(member);
+							const isSelf = actorUserId !== void 0 && member.userId === actorUserId;
+							const lastSuper = superCount <= 1 && member.roleCodes.some((code) => code === "SUPER_ADMIN" || code === "超级管理员");
+							const locked = !writable || !scoped || isSelf || lastSuper || actorRole !== "SUPER_ADMIN" && isProtected;
+							return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("tr", {
+								"data-locked": locked,
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("td", { children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: member.displayName }),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+											className: PermissionCenterSection_module_css_default.muted,
+											children: [" @", member.username]
+										}),
+										isProtected && actorRole !== "SUPER_ADMIN" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: PermissionCenterSection_module_css_default.protected,
+											children: "受保护"
+										}) : null,
+										isSelf ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: PermissionCenterSection_module_css_default.protected,
+											children: "本人"
+										}) : null,
+										lastSuper ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: PermissionCenterSection_module_css_default.protected,
+											children: "最后一个超管"
+										}) : null,
+										!scoped ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: PermissionCenterSection_module_css_default.protected,
+											children: "越界"
+										}) : null
+									] }),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: member.departmentPath?.map((entry) => entry.name).join(" / ") ?? "—" }),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("select", {
+										value: member.roleCodes[0] ?? "APP_USER",
+										disabled: locked || busy,
+										onChange: (event) => {
+											if (window.confirm("确认修改该成员的角色？")) onSave(member.userId, [event.target.value]);
+										},
+										children: (actorRole === "SUPER_ADMIN" ? [
+											"超级管理员",
+											"管理员",
+											"部门管理员",
+											"运营人员",
+											"应用人员"
+										] : [
+											"部门管理员",
+											"运营人员",
+											"应用人员"
+										]).map((role) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+											value: role,
+											children: role
+										}, role))
+									}) })
+								]
+							}, member.userId);
+						}) })]
+					})
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Pager, {
+					page,
+					pages,
+					onChange: setPage
+				})]
+			});
+		}
+		function Departments({ departments, writable, canAssign, canWrite, t, onAssign, onAdd, onEdit, onDelete }) {
+			const [expanded, setExpanded] = (0, react.useState)(() => new Set(departments.map((department) => department.code)));
+			const byParent = (0, react.useMemo)(() => {
+				const map = /* @__PURE__ */ new Map();
+				const codes = new Set(departments.map((department) => department.code));
+				for (const department of departments) {
+					const parent = department.parentCode !== void 0 && department.parentCode !== null && codes.has(department.parentCode) ? department.parentCode : null;
+					map.set(parent, [...map.get(parent) ?? [], department]);
+				}
+				for (const list of map.values()) list.sort((left, right) => left.name.localeCompare(right.name, "zh-CN") || left.code.localeCompare(right.code));
+				return map;
+			}, [departments]);
+			const node = (department, depth) => {
+				const children = byParent.get(department.code) ?? [];
+				const open = expanded.has(department.code);
+				return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
+					className: PermissionCenterSection_module_css_default.treeNode,
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: PermissionCenterSection_module_css_default.treeRow,
+						style: { paddingLeft: String(8 + depth * 18) + "px" },
+						children: [
+							children.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: PermissionCenterSection_module_css_default.treeSpacer }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: PermissionCenterSection_module_css_default.treeToggle,
+								"aria-label": open ? "折叠" : "展开",
+								onClick: () => {
+									setExpanded((current) => {
+										const next = new Set(current);
+										if (next.has(department.code)) next.delete(department.code);
+										else next.add(department.code);
+										return next;
+									});
+								},
+								children: open ? "▾" : "▸"
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", {
+								className: PermissionCenterSection_module_css_default.treeName,
+								children: department.name
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: PermissionCenterSection_module_css_default.muted,
+								children: [
+									department.code,
+									" · ",
+									department.memberCount ?? 0,
+									" 人"
+								]
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: PermissionCenterSection_module_css_default.deptAdmins,
+								children: department.deptAdmins?.length === 0 || department.deptAdmins === void 0 ? null : department.deptAdmins.map((admin) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: PermissionCenterSection_module_css_default.adminTag,
+									children: admin.displayName
+								}, admin.userId))
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: PermissionCenterSection_module_css_default.treeActions,
+								children: [
+									canAssign ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+										variant: "ghost",
+										size: "sm",
+										disabled: !writable,
+										onClick: () => {
+											onAssign(department);
+										},
+										children: "分配管理员"
+									}) : null,
+									canWrite ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+										variant: "ghost",
+										size: "sm",
+										onClick: () => {
+											onAdd(department.code);
+										},
+										children: "+ 子部门"
+									}) : null,
+									canWrite ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+										variant: "ghost",
+										size: "sm",
+										onClick: () => {
+											onEdit(department);
+										},
+										children: "编辑"
+									}) : null,
+									canWrite ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+										variant: "ghost",
+										size: "sm",
+										onClick: () => {
+											onDelete(department);
+										},
+										children: "删除"
+									}) : null
+								]
+							})
+						]
+					}), children.length > 0 && open ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+						className: PermissionCenterSection_module_css_default.treeChildren,
+						children: children.map((child) => node(child, depth + 1))
+					}) : null]
+				}, department.code);
+			};
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: PermissionCenterSection_module_css_default.panel,
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: PermissionCenterSection_module_css_default.panelHead,
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h2", {
+							className: PermissionCenterSection_module_css_default.sectionTitle,
+							children: t("permTabDepartments")
+						}), canWrite ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+							variant: "outline",
+							size: "sm",
+							onClick: () => {
+								onAdd(null);
+							},
+							children: "新增部门"
+						}) : null]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+						className: PermissionCenterSection_module_css_default.treeRoot,
+						children: (byParent.get(null) ?? []).map((department) => node(department, 0))
+					}),
+					departments.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: PermissionCenterSection_module_css_default.muted,
+						children: "暂无部门。"
+					}) : null
+				]
+			});
+		}
+		/** Create/edit dialog for one department. */
+		function DepartmentFormDialog({ state, departments, t, onClose, onSaved }) {
+			const [code, setCode] = (0, react.useState)("");
+			const [name, setName] = (0, react.useState)("");
+			const [parentCode, setParentCode] = (0, react.useState)("");
+			const [description, setDescription] = (0, react.useState)("");
+			const [owner, setOwner] = (0, react.useState)("");
+			const [enabled, setEnabled] = (0, react.useState)(true);
+			const [saving, setSaving] = (0, react.useState)(false);
+			const [error, setError] = (0, react.useState)(null);
+			(0, react.useEffect)(() => {
+				if (state === null) return;
+				setCode(state.department?.code ?? "");
+				setName(state.department?.name ?? "");
+				setParentCode(state.parentCode ?? state.department?.parentCode ?? "");
+				setDescription(state.department?.description ?? "");
+				setOwner(state.department?.owner ?? "");
+				setEnabled(state.department?.enabled !== false);
+				setError(null);
+			}, [state]);
+			if (state === null) return null;
+			const editing = state.mode === "edit";
+			const blocked = /* @__PURE__ */ new Set();
+			if (editing && state.department !== void 0) {
+				blocked.add(state.department.code);
+				let changed = true;
+				while (changed) {
+					changed = false;
+					for (const department of departments) if (department.parentCode !== void 0 && department.parentCode !== null && blocked.has(department.parentCode) && !blocked.has(department.code)) {
+						blocked.add(department.code);
+						changed = true;
+					}
+				}
+			}
+			const submit = async () => {
+				if (saving) return;
+				setSaving(true);
+				setError(null);
+				try {
+					const result = editing && state.department !== void 0 ? await updateDepartment({
+						code: state.department.code,
+						name,
+						parentCode: parentCode === "" ? null : parentCode,
+						description,
+						owner,
+						enabled,
+						updatedAt: state.department.updatedAt
+					}) : await createDepartment({
+						code: code.trim(),
+						name: name.trim(),
+						parentCode: parentCode === "" ? null : parentCode,
+						description,
+						owner,
+						enabled
+					});
+					if (!result.ok) {
+						setError(result.reason ?? "保存失败：后端拒绝或无权限（403）。");
+						return;
+					}
+					await onSaved();
+				} catch {
+					setError("保存失败：网络或后端异常。");
+				} finally {
+					setSaving(false);
+				}
+			};
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Modal, {
+				open: true,
+				onClose: () => {
+					if (!saving) onClose();
+				},
+				title: editing ? "编辑部门" : "新增部门",
+				closeLabel: "取消",
+				className: PermissionCenterSection_module_css_default.dialog,
+				footer: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: PermissionCenterSection_module_css_default.dialogFooter,
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+						variant: "outline",
+						disabled: saving,
+						onClick: onClose,
+						children: "取消"
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+						variant: "primary",
+						disabled: saving,
+						onClick: () => {
+							submit();
+						},
+						children: "保存"
+					})]
+				}),
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: PermissionCenterSection_module_css_default.dialogBody,
+					children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+							className: PermissionCenterSection_module_css_default.field,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: "部门编码" }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+								value: code,
+								disabled: editing,
+								placeholder: "例如 marketing",
+								onChange: (event) => {
+									setCode(event.target.value);
+								}
+							})]
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+							className: PermissionCenterSection_module_css_default.field,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: "部门名称" }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+								value: name,
+								placeholder: "例如 市场部",
+								onChange: (event) => {
+									setName(event.target.value);
+								}
+							})]
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+							className: PermissionCenterSection_module_css_default.field,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: "上级部门" }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SearchCombobox, {
+								t,
+								value: parentCode,
+								ariaLabel: "上级部门",
+								placeholder: t("permNone"),
+								options: [{
+									value: "",
+									label: t("permNone")
+								}, ...departments.filter((department) => !blocked.has(department.code)).map((department) => ({
+									value: department.code,
+									label: department.name,
+									hint: department.code
+								}))],
+								onChange: setParentCode
+							})]
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+							className: PermissionCenterSection_module_css_default.field,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: "描述" }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+								value: description,
+								onChange: (event) => {
+									setDescription(event.target.value);
+								}
+							})]
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+							className: PermissionCenterSection_module_css_default.field,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: "负责人" }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+								value: owner,
+								onChange: (event) => {
+									setOwner(event.target.value);
+								}
+							})]
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+							className: PermissionCenterSection_module_css_default.candidate,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+								type: "checkbox",
+								checked: enabled,
+								onChange: (event) => {
+									setEnabled(event.target.checked);
+								}
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: "启用" })]
+						}),
+						error === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: PermissionCenterSection_module_css_default.error,
+							role: "alert",
+							children: error
+						})
+					]
+				})
+			});
+		}
+		function Resources({ resources, departments, writable, actorRole, actorDepartmentCode, busy, t, onSave }) {
+			const [page, setPage] = (0, react.useState)(0);
+			const [draft, setDraft] = (0, react.useState)({});
+			const [error, setError] = (0, react.useState)(null);
+			const [detail, setDetail] = (0, react.useState)(null);
+			const pages = Math.max(1, Math.ceil(resources.length / PAGE_SIZE));
+			const visible = resources.slice(page * PAGE_SIZE, page * PAGE_SIZE + PAGE_SIZE);
+			const departmentOptions = actorRole === "DEPT_ADMIN" ? departments.filter((department) => department.code === actorDepartmentCode || department.path?.some((entry) => entry.code === actorDepartmentCode) === true) : departments;
+			const keyOf = (row) => row.kind + ":" + String(row.id);
+			const valueOf = (row) => draft[keyOf(row)] ?? {
+				visibility: row.visibility,
+				departmentCode: row.departmentCode ?? null
+			};
+			const visibilityLabel = (visibility) => visibility === "global" ? t("permGlobal") : visibility === "department" ? t("permDepartmentScope") : t("permPrivate");
+			const statusLabel = (status) => status === "pending" ? t("permStatusPending") : status === "approved" ? t("permStatusApproved") : status === "rejected" ? t("permStatusRejected") : "—";
+			const departmentName = (code) => code === null || code === void 0 ? "—" : departments.find((department) => department.code === code)?.name ?? code;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: PermissionCenterSection_module_css_default.panel,
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: PermissionCenterSection_module_css_default.tableScroll,
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("table", {
+							className: PermissionCenterSection_module_css_default.table,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("thead", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("tr", { children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: t("permType") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: t("permName") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: t("permOwner") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: t("permScope") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: t("permDepartment") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: t("permOperations") })
+							] }) }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("tbody", { children: visible.map((row) => {
+								const key = keyOf(row);
+								const value = valueOf(row);
+								const visibilityOptions = actorRole === "DEPT_ADMIN" ? ["department", "private"] : [
+									"global",
+									"department",
+									"private"
+								];
+								return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("tr", { children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: row.kind === "skill" ? t("permResourceSkill") : t("permResourceWorkflow") }),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: row.name }) }),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: ownerDisplay(row.ownerName) }),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SearchCombobox, {
+										t,
+										value: value.visibility,
+										ariaLabel: t("permScope"),
+										placeholder: t("permSelect"),
+										disabled: !writable || busy,
+										options: visibilityOptions.map((option) => ({
+											value: option,
+											label: visibilityLabel(option)
+										})),
+										onChange: (next) => {
+											const visibility = next;
+											setDraft((current) => ({
+												...current,
+												[key]: {
+													visibility,
+													departmentCode: visibility === "department" ? current[key]?.departmentCode ?? row.departmentCode ?? actorDepartmentCode ?? null : null
+												}
+											}));
+										}
+									}) }),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SearchCombobox, {
+										t,
+										value: value.departmentCode ?? "",
+										ariaLabel: t("permDepartment"),
+										placeholder: t("permNone"),
+										disabled: !writable || busy || value.visibility !== "department" || actorRole === "DEPT_ADMIN",
+										options: [{
+											value: "",
+											label: t("permNone")
+										}, ...departmentOptions.map((department) => ({
+											value: department.code,
+											label: department.name,
+											hint: department.code
+										}))],
+										onChange: (next) => {
+											setDraft((current) => ({
+												...current,
+												[key]: {
+													...valueOf(row),
+													departmentCode: next === "" ? null : next
+												}
+											}));
+										}
+									}) }),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+										className: PermissionCenterSection_module_css_default.rowActions,
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+											variant: "ghost",
+											size: "sm",
+											onClick: () => {
+												setDetail(row);
+											},
+											children: t("permViewDetails")
+										}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+											variant: "outline",
+											size: "sm",
+											disabled: !writable || busy,
+											onClick: () => {
+												setError(null);
+												if (window.confirm(t("permSave") + "？")) onSave(row, value.visibility, value.departmentCode).then((result) => {
+													if (!result.ok) setError(result.reason ?? t("permSaveFailed"));
+												});
+											},
+											children: t("permSave")
+										})]
+									}) })
+								] }, key);
+							}) })]
+						})
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Pager, {
+						page,
+						pages,
+						onChange: setPage
+					}),
+					error === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: PermissionCenterSection_module_css_default.error,
+						role: "alert",
+						children: error
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Modal, {
+						open: detail !== null,
+						onClose: () => {
+							setDetail(null);
+						},
+						title: t("permDetailTitle"),
+						closeLabel: t("permClose"),
+						className: PermissionCenterSection_module_css_default.dialog,
+						footer: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: PermissionCenterSection_module_css_default.dialogFooter,
+							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+								variant: "outline",
+								onClick: () => {
+									setDetail(null);
+								},
+								children: t("permClose")
+							})
+						}),
+						children: detail === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("dl", {
+							className: PermissionCenterSection_module_css_default.detailGrid,
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dt", { children: t("permDetailType") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dd", { children: detail.kind === "skill" ? t("permResourceSkill") : t("permResourceWorkflow") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dt", { children: t("permDetailName") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dd", { children: detail.name }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dt", { children: t("permDetailOwner") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dd", { children: ownerDisplay(detail.ownerName) }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dt", { children: t("permDetailScope") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dd", { children: visibilityLabel(detail.visibility) }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dt", { children: t("permDetailDepartment") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dd", { children: departmentName(detail.departmentCode) }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dt", { children: t("permDetailStatus") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dd", { children: statusLabel(detail.reviewStatus) }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dt", { children: t("permDetailUpdated") }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dd", { children: detail.updatedAt === void 0 ? "—" : new Date(detail.updatedAt).toLocaleString() })
+							]
+						})
+					})
+				]
+			});
+		}
+		/** Accessible searchable combobox used for visibility and department pickers. */
+		function SearchCombobox({ t, value, options, onChange, placeholder, ariaLabel, disabled = false }) {
+			const [open, setOpen] = (0, react.useState)(false);
+			const [query, setQuery] = (0, react.useState)("");
+			const [active, setActive] = (0, react.useState)(0);
+			const rootRef = (0, react.useRef)(null);
+			const inputRef = (0, react.useRef)(null);
+			const selected = options.find((option) => option.value === value);
+			const filtered = (0, react.useMemo)(() => filterComboboxOptions(options, query), [options, query]);
+			(0, react.useEffect)(() => {
+				if (!open) return;
+				const close = (event) => {
+					if (rootRef.current !== null && !rootRef.current.contains(event.target)) setOpen(false);
+				};
+				document.addEventListener("mousedown", close);
+				inputRef.current?.focus();
+				return () => {
+					document.removeEventListener("mousedown", close);
+				};
+			}, [open]);
+			(0, react.useEffect)(() => {
+				if (!open) return;
+				const index = filtered.findIndex((option) => option.value === value);
+				setActive(index >= 0 ? index : 0);
+			}, [
+				open,
+				filtered,
+				value
+			]);
+			const choose = (next) => {
+				onChange(next);
+				setOpen(false);
+				setQuery("");
+			};
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: PermissionCenterSection_module_css_default.combobox,
+				ref: rootRef,
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+					type: "button",
+					className: PermissionCenterSection_module_css_default.comboboxTrigger,
+					"aria-label": ariaLabel,
+					"aria-haspopup": "listbox",
+					"aria-expanded": open,
+					disabled,
+					onClick: () => {
+						setOpen((current) => !current);
+					},
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: selected === void 0 ? PermissionCenterSection_module_css_default.comboboxPlaceholder : void 0,
+						children: selected?.label ?? placeholder
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						"aria-hidden": "true",
+						children: "⌄"
+					})]
+				}), open ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: PermissionCenterSection_module_css_default.comboboxMenu,
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+						ref: inputRef,
+						className: PermissionCenterSection_module_css_default.comboboxSearch,
+						value: query,
+						placeholder: t("permSearch"),
+						"aria-label": t("permSearch"),
+						onChange: (event) => {
+							setQuery(event.target.value);
+							setActive(0);
+						},
+						onKeyDown: (event) => {
+							if (event.key === "Escape") {
+								setOpen(false);
+								return;
+							}
+							if (event.key === "ArrowDown") {
+								event.preventDefault();
+								setActive((current) => clampActiveIndex(current + 1, filtered.length));
+							}
+							if (event.key === "ArrowUp") {
+								event.preventDefault();
+								setActive((current) => clampActiveIndex(current - 1, filtered.length));
+							}
+							if (event.key === "Enter") {
+								event.preventDefault();
+								const option = filtered[active];
+								if (option !== void 0) choose(option.value);
+							}
+						}
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+						className: PermissionCenterSection_module_css_default.comboboxList,
+						role: "listbox",
+						"aria-label": ariaLabel,
+						children: filtered.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", {
+							className: PermissionCenterSection_module_css_default.comboboxEmpty,
+							children: t("permNoMatches")
+						}) : filtered.map((option, index) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", {
+							role: "option",
+							"aria-selected": option.value === value,
+							children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+								type: "button",
+								className: index === active ? PermissionCenterSection_module_css_default.comboboxOption + " " + PermissionCenterSection_module_css_default.comboboxOptionActive : PermissionCenterSection_module_css_default.comboboxOption,
+								onMouseEnter: () => {
+									setActive(index);
+								},
+								onClick: () => {
+									choose(option.value);
+								},
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: PermissionCenterSection_module_css_default.comboboxCheck,
+										children: option.value === value ? "✓" : ""
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: option.label }),
+									option.hint === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: PermissionCenterSection_module_css_default.comboboxHint,
+										children: option.hint
+									})
+								]
+							})
+						}, option.value))
+					})]
+				}) : null]
+			});
+		}
+		function Pager({ page, pages, onChange }) {
+			if (pages <= 1) return null;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: PermissionCenterSection_module_css_default.pager,
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+						variant: "outline",
+						size: "sm",
+						disabled: page === 0,
+						onClick: () => {
+							onChange(page - 1);
+						},
+						children: "上一页"
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+						className: PermissionCenterSection_module_css_default.muted,
+						children: [
+							page + 1,
+							" / ",
+							pages
+						]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+						variant: "outline",
+						size: "sm",
+						disabled: page >= pages - 1,
+						onClick: () => {
+							onChange(page + 1);
+						},
+						children: "下一页"
+					})
+				]
+			});
+		}
+		/** The four role labels, so the header does not show a backend code. */
+		function roleLabel(role) {
+			switch (role) {
+				case "SUPER_ADMIN": return "超级管理员";
+				case "ADMIN": return "管理员";
+				case "DEPT_ADMIN": return "部门管理员";
+				default: return "应用人员";
+			}
+		}
+		//#endregion
+		//#region src/client/PermissionCenterIcon.tsx
+		/**
+		* The sidebar glyph for the permission centre.
+		*
+		* The entry is hidden for a caller the Host reports as an ordinary user. This is a navigation
+		* affordance, not the authorization decision: every permission-centre endpoint re-checks the
+		* caller, and the page itself refuses to render without a management role.
+		*/
+		function PermissionCenterIcon() {
+			const [allowed, setAllowed] = (0, react.useState)(() => canSeeManagedSettings() ? true : void 0);
+			(0, react.useEffect)(() => {
+				let live = true;
+				if (reviewDemoMode() || canSeeManagedSettings()) {
+					setAllowed(true);
+					return () => {
+						live = false;
+					};
+				}
+				fetchReviewContext().then((context) => {
+					if (!live) return;
+					setAllowed(context !== null && context.role !== "APP_USER");
+				}).catch(() => {
+					if (live) setAllowed(false);
+				});
+				return () => {
+					live = false;
+				};
+			}, []);
+			if (allowed !== true) return null;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("svg", {
+				width: "18",
+				height: "18",
+				viewBox: "0 0 18 18",
+				fill: "none",
+				"aria-hidden": "true",
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+					d: "M9 2.2 14.5 4v4.4c0 3.1-2.1 5.6-5.5 7.4-3.4-1.8-5.5-4.3-5.5-7.4V4L9 2.2Z",
+					stroke: "currentColor",
+					strokeWidth: "1.2",
+					strokeLinejoin: "round"
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+					d: "m6.7 8.8 1.6 1.6 3-3.1",
+					stroke: "currentColor",
+					strokeWidth: "1.2",
+					strokeLinecap: "round",
+					strokeLinejoin: "round"
+				})]
+			});
+		}
+		//#endregion
+		//#region src/client/workspace-upgrade-client.ts
+		/** Same-origin calls for the workspace image upgrade banner. */
+		/** Route the plugin's Host half serves for upgrade detection and start. */
+		const WORKSPACE_UPGRADE_PATH = "/integrations/dataops/workspace-upgrade";
+		/** Narrow an unknown response into the status contract. */
+		function asStatus(value) {
+			if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+			const record = value;
+			const imageStatus = record.imageStatus;
+			if (imageStatus !== "CURRENT" && imageStatus !== "UPDATE_AVAILABLE" && imageStatus !== "NOT_RUNNING" && imageStatus !== "UNKNOWN") return null;
+			const sessions = Array.isArray(record.activeSessions) ? record.activeSessions.flatMap((entry) => {
+				if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return [];
+				const session = entry;
+				if (typeof session.sessionId !== "string" || session.sessionId.trim() === "") return [];
+				return [{
+					sessionId: session.sessionId.trim(),
+					...typeof session.title === "string" && session.title.trim() !== "" ? { title: session.title.trim() } : {},
+					...typeof session.cwd === "string" && session.cwd.trim() !== "" ? { cwd: session.cwd.trim() } : {}
+				}];
+			}) : [];
+			return {
+				imageStatus,
+				configuredImage: typeof record.configuredImage === "string" ? record.configuredImage : "",
+				activeSessions: sessions
+			};
+		}
+		/**
+		* Read the workspace upgrade preview.
+		* @returns the status, or null when the Host route is not ready or not connected.
+		*/
+		async function fetchWorkspaceUpgrade() {
+			const response = await fetch(WORKSPACE_UPGRADE_PATH, {
+				credentials: "same-origin",
+				headers: { accept: "application/json" }
+			});
+			if (response.status === 503 || response.status === 401) return null;
+			if (!response.ok) throw new Error(`workspace upgrade preview failed with HTTP ${String(response.status)}`);
+			return asStatus(await response.json());
+		}
+		/**
+		* Ask the Host to snapshot sessions and recreate the workspace container.
+		* @returns the accepted hand-off summary.
+		*/
+		async function requestWorkspaceUpgrade() {
+			const response = await fetch(WORKSPACE_UPGRADE_PATH, {
+				method: "POST",
+				credentials: "same-origin",
+				headers: {
+					"content-type": "application/json",
+					accept: "application/json"
+				},
+				body: JSON.stringify({ force: true })
+			});
+			const body = await response.json().catch(() => null);
+			if (!response.ok) {
+				const message = typeof body?.error === "string" ? body.error : `workspace upgrade failed with HTTP ${String(response.status)}`;
+				throw new Error(message);
+			}
+			return {
+				accepted: body?.accepted === true,
+				upgradeId: typeof body?.upgradeId === "string" ? body.upgradeId : "",
+				sessions: typeof body?.sessions === "number" ? body.sessions : 0
+			};
+		}
+		//#endregion
+		//#region \0dsh-css:/root/projects/dsh-plugins-plus/packages/dataops-managed/src/client/WorkspaceUpgradePrompt.module.css.mjs
+		const css = ".razUfG_banner{z-index:40;border:.5px solid var(--dsw-alias-settings-card-stroke);border-radius:var(--dsw-radius-xl);background:var(--dsw-alias-settings-card-fill);width:min(680px,100vw - 32px);color:var(--dsw-alias-label-primary);justify-content:space-between;align-items:center;gap:20px;padding:10px 12px 10px 16px;display:flex;position:fixed;top:16px;left:50%;transform:translate(-50%);box-shadow:0 8px 28px #0000001f}.razUfG_copy{flex-direction:column;gap:2px;min-width:0;display:flex}.razUfG_title{font-size:13px;font-weight:600;line-height:22px}.razUfG_body{color:var(--dsw-alias-label-secondary);font-size:12px;line-height:18px}.razUfG_actions{flex:none;align-items:center;gap:4px;display:flex}.razUfG_dialogBody{flex-direction:column;gap:12px;min-width:min(420px,70vw);display:flex}.razUfG_dialogText{color:var(--dsw-alias-label-secondary);margin:0;font-size:13px;line-height:22px}.razUfG_sessionList{border-radius:var(--dsw-radius-lg);background:var(--dsw-alias-bg-layer-1);flex-direction:column;gap:4px;max-height:220px;margin:0;padding:8px 10px;list-style:none;display:flex;overflow:auto}.razUfG_sessionRow{flex-direction:column;gap:1px;min-width:0;display:flex}.razUfG_sessionTitle{color:var(--dsw-alias-label-primary);text-overflow:ellipsis;white-space:nowrap;font-size:12px;line-height:18px;overflow:hidden}.razUfG_sessionPath{color:var(--dsw-alias-label-tertiary);text-overflow:ellipsis;white-space:nowrap;font-size:11px;line-height:16px;overflow:hidden}.razUfG_error{color:var(--dsw-alias-state-error-primary);margin:0;font-size:12px;line-height:18px}";
+		const tagId = "@sparkelf/dsh-dataops-managed/WorkspaceUpgradePrompt.module.css";
+		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId) + "]") === null) {
+			const tag = document.createElement("style");
+			tag.dataset.plugin = "@sparkelf/dsh-dataops-managed";
+			tag.dataset.pluginCss = tagId;
+			tag.textContent = css;
+			document.head.appendChild(tag);
+		}
+		var WorkspaceUpgradePrompt_module_css_default = {
+			"sessionPath": "razUfG_sessionPath",
+			"banner": "razUfG_banner",
+			"copy": "razUfG_copy",
+			"actions": "razUfG_actions",
+			"sessionRow": "razUfG_sessionRow",
+			"dialogText": "razUfG_dialogText",
+			"sessionTitle": "razUfG_sessionTitle",
+			"title": "razUfG_title",
+			"sessionList": "razUfG_sessionList",
+			"error": "razUfG_error",
+			"dialogBody": "razUfG_dialogBody",
+			"body": "razUfG_body"
+		};
+		//#endregion
+		//#region src/client/WorkspaceUpgradePrompt.tsx
+		/**
+		* Workspace image upgrade banner and confirmation dialog.
+		*
+		* The banner is deliberately quiet: it tells the user a newer workspace image exists and
+		* leaves the current session usable. Only the explicit upgrade action opens the dialog
+		* that can interrupt running sessions.
+		*
+		* @module WorkspaceUpgradePrompt
+		*/
+		/** How often to re-read the image status while the page is open. */
+		const POLL_MS = 3e4;
+		/** Wait before a reload so the restarted workspace has a chance to come back. */
+		const RELOAD_DELAY_MS = 12e3;
+		/**
+		* Render the banner and its upgrade dialog.
+		* @param props.t - localized copy resolver.
+		* @returns the banner while an image update is available, otherwise null.
+		*/
+		function WorkspaceUpgradePrompt(props) {
+			const { t } = props;
+			const [status, setStatus] = (0, react.useState)(null);
+			const [dismissed, setDismissed] = (0, react.useState)(false);
+			const [dialogOpen, setDialogOpen] = (0, react.useState)(false);
+			const [busy, setBusy] = (0, react.useState)(false);
+			const [notice, setNotice] = (0, react.useState)("");
+			const [error, setError] = (0, react.useState)("");
+			const refresh = (0, react.useCallback)(async () => {
+				try {
+					const next = await fetchWorkspaceUpgrade();
+					if (next !== null) setStatus(next);
+				} catch {}
+			}, []);
+			(0, react.useEffect)(() => {
+				let cancelled = false;
+				const tick = async () => {
+					if (cancelled) return;
+					await refresh();
+				};
+				tick();
+				const timer = setInterval(() => {
+					tick();
+				}, POLL_MS);
+				return () => {
+					cancelled = true;
+					clearInterval(timer);
+				};
+			}, [refresh]);
+			const available = status?.imageStatus === "UPDATE_AVAILABLE";
+			const sessionCount = status?.activeSessions.length ?? 0;
+			const warning = (0, react.useMemo)(() => t("upgradeSessionsWarning").replace("{count}", String(sessionCount)), [sessionCount, t]);
+			const openDialog = (0, react.useCallback)(() => {
+				setError("");
+				setDialogOpen(true);
+			}, []);
+			const closeDialog = (0, react.useCallback)(() => {
+				if (busy) return;
+				setDialogOpen(false);
+			}, [busy]);
+			const upgrade = (0, react.useCallback)(async () => {
+				setBusy(true);
+				setError("");
+				try {
+					await requestWorkspaceUpgrade();
+					setDialogOpen(false);
+					setNotice(t("upgradeStarted"));
+					setDismissed(true);
+					window.setTimeout(() => {
+						window.location.reload();
+					}, RELOAD_DELAY_MS);
+				} catch (cause) {
+					if (cause instanceof TypeError) {
+						setDialogOpen(false);
+						setNotice(t("upgradeStarted"));
+						setDismissed(true);
+						window.setTimeout(() => {
+							window.location.reload();
+						}, RELOAD_DELAY_MS);
+						return;
+					}
+					setError(cause instanceof Error ? cause.message : t("upgradeFailed"));
+				} finally {
+					setBusy(false);
+				}
+			}, [t]);
+			if (notice !== "") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+				className: WorkspaceUpgradePrompt_module_css_default.banner,
+				role: "status",
+				"aria-live": "polite",
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+					className: WorkspaceUpgradePrompt_module_css_default.title,
+					children: notice
+				})
+			});
+			if (!available || dismissed) return null;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: WorkspaceUpgradePrompt_module_css_default.banner,
+				role: "status",
+				"aria-live": "polite",
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: WorkspaceUpgradePrompt_module_css_default.copy,
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", {
+						className: WorkspaceUpgradePrompt_module_css_default.title,
+						children: t("upgradeAvailableTitle")
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: WorkspaceUpgradePrompt_module_css_default.body,
+						children: t("upgradeAvailableBody")
+					})]
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: WorkspaceUpgradePrompt_module_css_default.actions,
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+						variant: "primary",
+						size: "sm",
+						onClick: openDialog,
+						children: t("upgradeAction")
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+						variant: "ghost",
+						size: "sm",
+						onClick: () => {
+							setDismissed(true);
+						},
+						children: t("upgradeLater")
+					})]
+				})]
+			}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Modal, {
+				open: dialogOpen,
+				onClose: closeDialog,
+				title: t("upgradeDialogTitle"),
+				description: t("upgradeDialogBody"),
+				closeLabel: t("upgradeCancel"),
+				footer: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+					variant: "ghost",
+					onClick: closeDialog,
+					disabled: busy,
+					children: t("upgradeCancel")
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+					variant: "primary",
+					onClick: () => {
+						upgrade();
+					},
+					disabled: busy,
+					children: busy ? t("upgradeBusy") : sessionCount === 0 ? t("upgradeAction") : t("upgradeConfirm")
+				})] }),
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: WorkspaceUpgradePrompt_module_css_default.dialogBody,
+					children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: WorkspaceUpgradePrompt_module_css_default.dialogText,
+							children: sessionCount === 0 ? t("upgradeNoSessions") : warning
+						}),
+						sessionCount > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+							className: WorkspaceUpgradePrompt_module_css_default.sessionList,
+							children: status?.activeSessions.map((session) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
+								className: WorkspaceUpgradePrompt_module_css_default.sessionRow,
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: WorkspaceUpgradePrompt_module_css_default.sessionTitle,
+									children: session.title ?? session.sessionId
+								}), session.cwd ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: WorkspaceUpgradePrompt_module_css_default.sessionPath,
+									children: session.cwd
+								}) : null]
+							}, session.sessionId))
+						}) : null,
+						error !== "" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: WorkspaceUpgradePrompt_module_css_default.error,
+							role: "alert",
+							children: error
+						}) : null
+					]
+				})
+			})] });
+		}
+		//#endregion
+		//#region src/client/locales.ts
+		/** English managed DataOps Settings copy. */
+		const en = {
+			nav: "DataOps",
+			title: "DataOps",
+			managed: "Connected to DataOps",
+			unavailable: "DataOps is not connected.",
+			loadFailed: "Loading failed. Try again.",
+			brandingTitle: "Wanxiang branding",
+			brandingToggle: "Wanxiang branding",
+			limitsTitle: "File size limits",
+			limitsFileReadLabel: "Largest file to read (MiB)",
+			limitsUploadLabel: "Largest file to upload (MiB)",
+			limitsInvalid: "Enter a size in MiB.",
+			limitsSave: "Save",
+			limitsSaving: "Saving…",
+			timeoutTitle: "DataOps query timeout",
+			timeoutLabel: "Longest single query (seconds)",
+			timeoutInvalid: "Enter 1 to 3600 seconds.",
+			defaultsTitle: "Default configuration",
+			defaultsPublish: "Publish",
+			defaultsPublishing: "Publishing…",
+			defaultsPublishedAt: "Last published",
+			defaultsNeverPublished: "Not published yet",
+			defaultsNotAdmin: "Administrators only",
+			plazaTitle: "Skill plaza",
+			plazaAllTags: "All tags",
+			plazaMine: "Shared by me",
+			plazaShowDetail: "Details",
+			plazaClose: "Close",
+			plazaDetailUpdated: "Updated",
+			plazaDetailBody: "Skill body",
+			plazaInstall: "Install",
+			plazaInstalled: "Installed. It is now in your skill list.",
+			plazaUnshare: "Stop sharing",
+			plazaUnshared: "Removed from the plaza. Users who installed it keep their copy.",
+			plazaEmpty: "No skills have been shared yet.",
+			plazaUnavailable: "The skill plaza is available once this workspace is connected to DataOps.",
+			plazaLoadFailed: "The skill plaza could not be loaded. Try again.",
+			plazaActionFailed: "The action could not be completed. Try again.",
+			plazaRetry: "Try again",
+			plazaRefresh: "Refresh",
+			plazaTabApproved: "Approved",
+			plazaTabPending: "Pending",
+			plazaTabAll: "All",
+			plazaSharedTag: "Shared",
+			plazaReview: "Review",
+			plazaPendingEmpty: "No skills are waiting for review.",
+			plazaAuditTitle: "Review skill",
+			plazaAuditSource: "Source",
+			plazaAuditVisibility: "Visibility",
+			plazaRiskTitle: "AI risk report",
+			plazaRiskScan: "Run AI scan",
+			plazaRiskScanning: "Scanning…",
+			plazaRiskNone: "No AI risk report yet.",
+			plazaRiskScore: "Risk score",
+			plazaRiskFindings: "Findings",
+			plazaRiskFailed: "The AI scan failed; review manually.",
+			plazaApprove: "Approve",
+			plazaReject: "Reject",
+			plazaReviewNote: "Review note (required to reject)",
+			plazaReviewNotePlaceholder: "Explain the reason or what to change…",
+			plazaReviewDone: "Review saved.",
+			plazaReviewFailed: "The review could not be saved. Try again.",
+			plazaDemo: "Demo data",
+			plazaGlobal: "Global",
+			plazaPrivate: "Private",
+			plazaDeptSuffix: " department",
+			reviewSettingsTitle: "Review settings",
+			reviewSettingsSkill: "Skill plaza review",
+			reviewSettingsWorkflow: "Workflow plaza review",
+			reviewSettingsKb: "Knowledge base review",
+			reviewSettingsHint: "When on, submitted content stays private until an administrator approves it.",
+			reviewSettingsSave: "Save",
+			reviewSettingsSaved: "Review settings saved.",
+			reviewSettingsFailed: "Could not save. Try again.",
+			reviewSettingsWaiting: "Review settings API is waiting for the backend (task-39).",
+			permNav: "Permissions",
+			permTitle: "Permission centre",
+			permTabRoles: "Role permissions",
+			permTabMembers: "Member roles",
+			permTabDepartments: "Departments",
+			permTabResources: "Resource scope",
+			permRoleMatrix: "Role permission matrix",
+			permPermissionModule: "Module",
+			permPermissionPoint: "Permission",
+			permReadOnly: "Read only",
+			permSave: "Save",
+			permSaved: "Saved.",
+			permSaveFailed: "Could not save. Try again.",
+			permSuperAdminOnly: "Only a super administrator can change this.",
+			permMember: "Member",
+			permDepartment: "Department",
+			permRole: "Role",
+			permDeptAdmin: "Department administrator",
+			permScope: "Visibility",
+			permGlobal: "Global",
+			permDepartmentScope: "Department",
+			permPrivate: "Private",
+			permNoAccess: "You do not have access to the permission centre.",
+			permWaiting: "The permission-centre API is waiting for the backend (task-37).",
+			permResourceSkill: "Skill",
+			permResourceWorkflow: "Workflow",
+			permResourceKb: "Knowledge base",
+			permType: "Type",
+			permName: "Name",
+			permOwner: "Owner",
+			permOperations: "Actions",
+			permViewDetails: "View details",
+			permDetailTitle: "Resource details",
+			permDetailType: "Type",
+			permDetailName: "Name",
+			permDetailOwner: "Owner",
+			permDetailScope: "Visibility",
+			permDetailDepartment: "Department",
+			permDetailStatus: "Review status",
+			permDetailUpdated: "Updated",
+			permNone: "None",
+			permSearch: "Search…",
+			permNoMatches: "No matches",
+			permClose: "Close",
+			permSelect: "Select…",
+			permStatusPending: "Pending review",
+			permStatusApproved: "Approved",
+			permStatusRejected: "Rejected",
+			permDemo: "Demo data",
+			reloginTitle: "Sign in to DataOps again",
+			reloginBody: "This workspace can no longer reach DataOps: the sign-in for this session has ended, so settings, shared models and the skill plaza cannot load. Sign in again in the DataOps window, then reload this page.",
+			reloginAction: "Reload",
+			reloginDismiss: "Later",
+			upgradeAvailableTitle: "A new workspace version is available",
+			upgradeAvailableBody: "Restart the workspace to apply it.",
+			upgradeAction: "Upgrade",
+			upgradeLater: "Later",
+			upgradeDialogTitle: "Upgrade workspace",
+			upgradeDialogBody: "The workspace will restart and briefly disconnect. Your files and sessions are kept.",
+			upgradeNoSessions: "No sessions are running. The workspace will restart now.",
+			upgradeSessionsWarning: "{count} running session(s) will be interrupted. After the upgrade, each one is resumed and sent “继续”.",
+			upgradeCancel: "Cancel",
+			upgradeConfirm: "Stop tasks and upgrade",
+			upgradeBusy: "Upgrading workspace…",
+			upgradeStarted: "Upgrade started. Reload this page when the workspace reconnects.",
+			upgradeFailed: "The workspace upgrade could not be started. Try again.",
+			upgradeRetry: "Retry"
+		};
+		/** Chinese managed DataOps Settings copy. */
+		const zh = {
 			nav: "DataOps",
 			title: "DataOps",
 			managed: "已连接 DataOps",
@@ -1421,18 +4911,142 @@ window.__ModuleLoader__.load({
 			plazaUnavailable: "工作区接入 DataOps 后即可使用技能广场。",
 			plazaLoadFailed: "技能广场加载失败，请重试。",
 			plazaActionFailed: "操作未完成，请重试。",
-			plazaRetry: "重试"
+			plazaRetry: "重试",
+			plazaRefresh: "刷新",
+			plazaTabApproved: "已审核",
+			plazaTabPending: "未审核",
+			plazaTabAll: "全部",
+			plazaSharedTag: "已共享",
+			plazaReview: "审核",
+			plazaPendingEmpty: "没有待审核的技能。",
+			plazaAuditTitle: "审核技能",
+			plazaAuditSource: "来源",
+			plazaAuditVisibility: "可见范围",
+			plazaRiskTitle: "AI 风险报告",
+			plazaRiskScan: "生成风险报告",
+			plazaRiskScanning: "分析中…",
+			plazaRiskNone: "尚未生成 AI 风险报告。",
+			plazaRiskScore: "风险分",
+			plazaRiskFindings: "发现",
+			plazaRiskFailed: "风险报告生成失败，可人工审核。",
+			plazaApprove: "通过",
+			plazaReject: "驳回",
+			plazaReviewNote: "审核意见（驳回必填）",
+			plazaReviewNotePlaceholder: "说明原因或修改建议…",
+			plazaReviewDone: "审核结果已保存。",
+			plazaReviewFailed: "审核未完成，请重试。",
+			plazaDemo: "演示数据",
+			plazaGlobal: "全局",
+			plazaPrivate: "私有",
+			plazaDeptSuffix: "部门专属",
+			reviewSettingsTitle: "审核设置",
+			reviewSettingsSkill: "技能广场审核",
+			reviewSettingsWorkflow: "工作流广场审核",
+			reviewSettingsKb: "知识库审核",
+			reviewSettingsHint: "开启后，提交内容需管理员审核通过才公开展示。",
+			reviewSettingsSave: "保存",
+			reviewSettingsSaved: "审核设置已保存。",
+			reviewSettingsFailed: "保存失败，请重试。",
+			reviewSettingsWaiting: "审核设置 API 待后端联调（task-39）。",
+			permNav: "权限",
+			permTitle: "权限中心",
+			permTabRoles: "角色权限",
+			permTabMembers: "成员角色",
+			permTabDepartments: "部门",
+			permTabResources: "资源范围",
+			permRoleMatrix: "角色权限矩阵",
+			permPermissionModule: "模块",
+			permPermissionPoint: "权限点",
+			permReadOnly: "只读",
+			permSave: "保存",
+			permSaved: "已保存。",
+			permSaveFailed: "保存失败，请重试。",
+			permSuperAdminOnly: "仅超级管理员可修改。",
+			permMember: "成员",
+			permDepartment: "部门",
+			permRole: "角色",
+			permDeptAdmin: "部门管理员",
+			permScope: "可见范围",
+			permGlobal: "全局",
+			permDepartmentScope: "部门专属",
+			permPrivate: "私有",
+			permNoAccess: "无权限访问权限中心。",
+			permWaiting: "权限中心 API 待后端联调（task-37）。",
+			permResourceSkill: "技能",
+			permResourceWorkflow: "工作流",
+			permResourceKb: "知识库",
+			permType: "类型",
+			permName: "名称",
+			permOwner: "所有者",
+			permOperations: "操作",
+			permViewDetails: "查看详情",
+			permDetailTitle: "资源详情",
+			permDetailType: "类型",
+			permDetailName: "名称",
+			permDetailOwner: "所有者",
+			permDetailScope: "可见范围",
+			permDetailDepartment: "部门",
+			permDetailStatus: "审核状态",
+			permDetailUpdated: "更新时间",
+			permNone: "无",
+			permSearch: "搜索…",
+			permNoMatches: "无匹配项",
+			permClose: "关闭",
+			permSelect: "请选择…",
+			permStatusPending: "待审核",
+			permStatusApproved: "已审核",
+			permStatusRejected: "已拒绝",
+			permDemo: "演示数据",
+			reloginTitle: "请重新登录 DataOps",
+			reloginBody: "该工作区已无法访问 DataOps：本次登录会话已过期，因此设置、共享模型与技能广场都无法加载。请在 DataOps 页面重新登录，然后重新加载本页。",
+			reloginAction: "重新加载",
+			reloginDismiss: "稍后再说",
+			upgradeAvailableTitle: "工作区有新版本可用",
+			upgradeAvailableBody: "重启工作区后生效。",
+			upgradeAction: "立即升级",
+			upgradeLater: "稍后",
+			upgradeDialogTitle: "升级工作区",
+			upgradeDialogBody: "工作区会重启并短暂断开。文件和历史会话会保留。",
+			upgradeNoSessions: "当前没有运行中的会话，工作区将立即重启。",
+			upgradeSessionsWarning: "有 {count} 个正在运行的会话会被中断。升级完成后会自动恢复这些会话并发送“继续”。",
+			upgradeCancel: "取消",
+			upgradeConfirm: "停止任务并升级",
+			upgradeBusy: "正在升级工作区…",
+			upgradeStarted: "升级已开始。工作区重新连接后请刷新页面。",
+			upgradeFailed: "工作区升级启动失败，请重试。",
+			upgradeRetry: "重试"
 		};
 		//#endregion
 		//#region src/client/index.ts
 		const NS = "settings.dataops-managed";
 		const AUTH_UPDATED_MESSAGE = "dataops-auth-updated";
 		const MANAGED_AUTH_PATH = "/integrations/dataops/managed-auth";
+		/** Sidebar entry and main page id for the permission centre. */
+		const PERMISSION_PANEL_ID = "dataops-permissions";
 		/** Required client services for the managed DataOps Settings section. */
 		const inject = ["slots", "locale"];
 		/**
-		* Register localized managed DataOps Settings navigation and content.
-		* @param ctx - DSH client context with locale and settings slots.
+		* Bind the four strings the sign-in prompt needs.
+		*
+		* Narrowed to exactly those keys rather than reusing the settings-section resolver: the prompt
+		* asks its own small copy, and a wider type would let a typo pass as a valid key.
+		*
+		* @param ctx - client context carrying the registered namespace.
+		* @returns a resolver for the prompt's own keys.
+		*/
+		const bindReloginCopy = (ctx) => {
+			const translate = ctx.locale.bind(NS);
+			return (key) => translate(key);
+		};
+		/**
+		* Register the managed DataOps surfaces and the sign-in prompt.
+		*
+		* The prompt rides a sidebar seat because the client needs *some* always-mounted surface for a
+		* dialog that is about the whole workspace rather than one panel. The seat is a container: the
+		* dialog itself portals to `document.body`, so this contributes no visible element to the
+		* sidebar at rest and cannot disturb the regions that already live there.
+		*
+		* @param ctx - DSH client context with locale, slots and the sidebar foot.
 		*/
 		function apply(ctx) {
 			ctx.effect(() => ctx.locale.register(NS, {
@@ -1441,13 +5055,113 @@ window.__ModuleLoader__.load({
 			}), "dataops-managed: settings copy");
 			installWanxiangBranding(ctx);
 			const t = ctx.locale.bind(NS);
-			ctx.slots.inject("settings.section", () => ctx.slots.register({
-				name: "settings.section",
-				id: "dataops",
-				order: 25,
-				label: () => t("nav"),
+			/**
+			* Register the settings section only for the two administrator role labels.
+			*
+			* The identity record arrives after the iframe loads and can change when the portal account is
+			* switched, so the registration is reconciled whenever the shared account store publishes. An
+			* ordinary user's profile therefore has no section, no configuration form, and no publish
+			* control at all — not a hidden one.
+			*/
+			ctx.effect(() => {
+				let disposeSection;
+				const reconcile = () => {
+					const allowed = canSeeManagedSettings();
+					if (allowed && disposeSection === void 0) disposeSection = ctx.slots.inject("settings.section", () => ctx.slots.register({
+						name: "settings.section",
+						id: "dataops",
+						order: 25,
+						label: () => t("nav"),
+						inject: () => ({ t })
+					}, ManagedDataOpsSection));
+					else if (!allowed && disposeSection !== void 0) {
+						disposeSection();
+						disposeSection = void 0;
+					}
+				};
+				reconcile();
+				const unsubscribe = subscribeManagedSettingsVisibility(reconcile);
+				return () => {
+					unsubscribe();
+					disposeSection?.();
+					disposeSection = void 0;
+				};
+			}, "dataops-managed: settings section role gate");
+			/**
+			* The re-authentication prompt, mounted where it is always alive.
+			*
+			* A dialog needs a component that stays mounted whether or not the operator has the settings
+			* panel open, and the sidebar foot is the one seat this plugin already owns. The component
+			* renders nothing until DataOps reports the session has ended, so at rest it adds no element.
+			*/
+			ctx.slots.inject("sidebar.footer.action", () => ctx.slots.register({
+				name: "sidebar.footer.action",
+				id: "dataops-relogin",
+				order: 90,
+				inject: () => ({ t: bindReloginCopy(ctx) })
+			}, ReloginPrompt));
+			/**
+			* The workspace image upgrade notice. It lives in the shell overlay so it can sit
+			* above the page without taking a sidebar or conversation seat; the component renders
+			* nothing until DataOps reports a newer image.
+			*/
+			ctx.slots.inject("shell.overlay", () => ctx.slots.register({
+				name: "shell.overlay",
+				id: "dataops-workspace-upgrade",
+				order: 20,
 				inject: () => ({ t })
-			}, ManagedDataOpsSection));
+			}, WorkspaceUpgradePrompt));
+			/**
+			* The permission centre, a sidebar entry plus the page it opens.
+			*
+			* The entry's glyph hides itself for an ordinary user; the page and every backend endpoint
+			* re-check the caller, so hiding is navigation, not authorization.
+			*/
+			ctx.effect(() => ctx.slots.inject("main", () => ctx.slots.register({
+				name: "main",
+				key: PERMISSION_PANEL_ID
+			}, (() => PermissionCenterSection({ t })))), "dataops-managed: permission centre page");
+			ctx.effect(() => {
+				let disposeEntry;
+				let live = true;
+				const allowed = async () => {
+					if (typeof window !== "undefined" && reviewDemoMode()) return true;
+					if (canSeeManagedSettings()) return true;
+					try {
+						const response = await fetch(REVIEW_CONTEXT_PATH);
+						if (!response.ok) return false;
+						const body = await response.json();
+						return body.primaryRole === "DEPT_ADMIN" || body.review?.canReview === true;
+					} catch {
+						return false;
+					}
+				};
+				const sync = async () => {
+					const next = await allowed();
+					if (!live) return;
+					if (next && disposeEntry === void 0) disposeEntry = ctx.slots.inject("sidebar.panellist", () => ctx.slots.register({
+						name: "sidebar.panellist",
+						id: PERMISSION_PANEL_ID,
+						order: 20,
+						label: () => t("permNav"),
+						locale: NS
+					}, PermissionCenterIcon));
+					else if (!next && disposeEntry !== void 0) {
+						disposeEntry();
+						disposeEntry = void 0;
+					}
+				};
+				sync();
+				const off = subscribeManagedSettingsVisibility(() => {
+					sync();
+				});
+				return () => {
+					live = false;
+					off();
+					disposeEntry?.();
+					disposeEntry = void 0;
+				};
+			}, "dataops-managed: permission centre entry gate");
 			/**
 			* The skill plaza, contributed to the skill center page.
 			*
@@ -1461,6 +5175,11 @@ window.__ModuleLoader__.load({
 				order: 10,
 				inject: () => ({ t })
 			}, SkillPlazaSection));
+			/**
+			* The workflow plaza's header seat, declared by the knowledge-base plugin. It renders a slot
+			* rather than importing this plugin; the bell therefore joins only when both are installed.
+			*/
+			ctx.slots.inject("workflow-plaza.actions", () => ctx.slots.register({ name: "workflow-plaza.actions" }, WorkflowPlazaBell));
 			const synchronizeJwt = async () => {
 				const response = await fetch(new URL(MANAGED_AUTH_PATH, window.location.origin), {
 					method: "POST",