agentworkshop 0.7.9 → 0.7.11

package/scripts/_dbg-final-visual.mjs

@@ -0,0 +1,29 @@
+// home 生产实例:workspace 会话页 + permissions + town 截图
+import puppeteer from 'puppeteer-core'
+const BASE = 'http://127.0.0.1:3001'
+const CHANNEL_ID = process.argv[2] ?? '8515751a-e250-4d53-9f5b-97ed8c48e7a9'
+const browser = await puppeteer.launch({ executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', headless: 'new', args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'] })
+const page = await browser.newPage()
+await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+const login = await fetch(`${BASE}/api/users/login`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email: 'admin@awshop.local', password: 'admin123' }) }).then(r => r.json())
+await page.setCookie({ name: 'token', value: login.data.token, domain: '127.0.0.1', path: '/' })
+const api = async (p, opts) => fetch(`${BASE}${p}`, { ...opts, headers: { authorization: `Bearer ${login.data.token}`, ...(opts?.headers ?? {}) } }).then(r => r.json())
+let wsId = (await api('/api/workshop/workspaces')).data?.[0]?.id
+if (!wsId) {
+  const created = await api('/api/workshop/workspaces', { method: 'POST', body: JSON.stringify({ name: '验收空间' }) })
+  wsId = created.data.id
+  await api(`/api/workshop/workspaces/${wsId}/channels/${CHANNEL_ID}`, { method: 'POST' })
+}
+await page.goto(`${BASE}/workshop/w/${wsId}`, { waitUntil: 'networkidle2', timeout: 90000 })
+await new Promise(r => setTimeout(r, 6000))
+await page.screenshot({ path: '.e2e-shots/final-workshop-channel.png' })
+console.log('📷 workshop-channel')
+await page.goto(`${BASE}/permissions`, { waitUntil: 'networkidle2', timeout: 60000 })
+await new Promise(r => setTimeout(r, 2500))
+await page.screenshot({ path: '.e2e-shots/final-permissions.png' })
+console.log('📷 permissions')
+await page.goto(`${BASE}/town`, { waitUntil: 'domcontentloaded', timeout: 60000 })
+await new Promise(r => setTimeout(r, 14000))
+await page.screenshot({ path: '.e2e-shots/final-town.png' })
+console.log('📷 town')
+await browser.close()

package/scripts/_dbg-perms-e2e.mjs

@@ -0,0 +1,102 @@
+// ============================================================
+// 产线权限 E2E:_dbg-perms-e2e.mjs <base> <adminPass>
+// 链路:admin 总览 → 建 plain 用户 → 默认全无权 → admin 授
+// 产线1=readonly / 产线2=operate → 可见性/写控/绑定逐项断言。
+// ============================================================
+const BASE = process.argv[2] ?? 'http://127.0.0.1:3021'
+const ADMIN_PASS = process.argv[3] ?? 'admin123'
+let step = 0
+const ok = (name, cond, detail = '') => {
+  step++
+  console.log(`${cond ? '✔' : '✖'} ${name}${detail ? ` — ${detail}` : ''}`)
+  if (!cond) process.exitCode = 1
+}
+const api = async (path, opts = {}, tok) => {
+  const res = await fetch(`${BASE}${path}`, {
+    ...opts,
+    headers: { 'content-type': 'application/json', ...(tok ? { authorization: `Bearer ${tok}` } : {}), ...opts.headers },
+  })
+  return { status: res.status, body: await res.json().catch(() => null) }
+}
+const login = async (email, password) => (await api('/api/users/login', { method: 'POST', body: JSON.stringify({ email, password }) })).body?.data?.token
+
+// ---- admin 登录 + 总览 ----
+const adminTok = await login('admin@awshop.local', ADMIN_PASS)
+ok('admin 登录', Boolean(adminTok))
+const ov = await api('/api/workshop/permissions', {}, adminTok)
+ok('admin 权限总览(lines+users)', ov.status === 200 && ov.body?.data?.lines?.length > 0 && ov.body?.data?.users?.length > 0, `lines=${ov.body?.data?.lines?.length} users=${ov.body?.data?.users?.length}`)
+const LINE1 = ov.body.data.lines.find(l => l.name.includes('1号'))?.id
+const LINE2 = ov.body.data.lines.find(l => l.name.includes('2号'))?.id
+ok('找到 1号/2号产线', Boolean(LINE1 && LINE2), `${LINE1} / ${LINE2}`)
+
+// ---- plain 用户(注册即 user 角色) ----
+const stamp = Date.now().toString(36)
+const plain = { name: `p-${stamp}`, email: `p-${stamp}@awshop.local`, password: 'Plain2026' }
+const reg = await api('/api/users/register', { method: 'POST', body: JSON.stringify(plain) })
+const plainTok = reg.body?.data?.token
+ok('plain 用户注册(user 角色)', reg.body?.data?.user?.role === 'user')
+
+// ---- 授权前:全无权 ----
+const d0 = await api('/api/workshop/dcw', {}, plainTok)
+const q0 = await api('/api/workshop/daq', {}, plainTok)
+ok('默认 dcw 产线不可见', d0.body?.data?.lines?.length === 0, `lines=${d0.body?.data?.lines?.length}`)
+ok('默认 dcw 节点不可见', d0.body?.data?.nodes?.length === 0, `nodes=${d0.body?.data?.nodes?.length}`)
+ok('默认 daq 节点不可见', q0.body?.data?.nodes?.length === 0, `nodes=${q0.body?.data?.nodes?.length}`)
+
+// ---- admin 授权:产线1=readonly, 产线2=operate ----
+const ov2 = await api('/api/workshop/permissions', {}, adminTok)
+const plainId = ov2.body.data.users.find(u => u.email === plain.email)?.id
+ok('总览含 plain 用户及其空 channels', Boolean(plainId))
+const put = await api('/api/workshop/permissions', { method: 'PUT', body: JSON.stringify({ userId: plainId, grants: [{ lineId: LINE1, mode: 'readonly' }, { lineId: LINE2, mode: 'operate' }] }) }, adminTok)
+ok('admin 批量授权(readonly+operate)', put.body?.data?.grants?.length === 2, JSON.stringify(put.body?.data?.grants?.map(g => `${g.lineId.slice(0, 6)}:${g.mode}`)))
+
+// ---- 授权后:仅授权产线可见 ----
+const d1 = await api('/api/workshop/dcw', {}, plainTok)
+const q1 = await api('/api/workshop/daq', {}, plainTok)
+const visLines = (d1.body?.data?.lines ?? []).map(l => l.id)
+ok('dcw 仅见 2 条授权产线', visLines.length === 2 && visLines.includes(LINE1) && visLines.includes(LINE2), visLines.join(','))
+ok('daq 仅含授权产线节点', (q1.body?.data?.nodes ?? []).length > 0 && (q1.body?.data?.nodes ?? []).every(n => [LINE1, LINE2].includes(n.lineId)), `nodes=${q1.body?.data?.nodes?.length}`)
+
+// 找两线的写控节点
+const dcwNodes = d1.body.data.nodes
+const w1 = dcwNodes.find(n => n.lineId === LINE1)
+const w2 = dcwNodes.find(n => n.lineId === LINE2) ?? dcwNodes.find(n => n.lineId === LINE2)
+ok('两线均有可见写控节点', Boolean(w1 && w2), `${w1?.id} / ${w2?.id}`)
+
+// ---- 写控校验 ----
+const wr1 = await api(`/api/workshop/dcw/${w1.id}/write`, { method: 'POST', body: JSON.stringify({ value: 170 }) }, plainTok)
+ok('readonly 产线写控被拒(403 人话)', wr1.status === 403 && /仅查看/.test(wr1.body?.message ?? ''), wr1.body?.message)
+const wr2 = await api(`/api/workshop/dcw/${w2.id}/write`, { method: 'POST', body: JSON.stringify({ value: 170 }) }, plainTok)
+ok('operate 产线写控放行', wr2.status === 200 && wr2.body?.data?.outcome != null, `ack=${JSON.stringify(wr2.body?.data?.outcome)?.slice(0, 60)}`)
+
+// ---- 绑定校验(daq 需 readonly+,dcw 需 operate) ----
+const daqNodes = q1.body.data.nodes
+const dq1 = daqNodes.find(n => n.lineId === LINE1)
+const bindD = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: 'e2e-perms-agent', nodeId: dq1.id, kind: 'daq' }) }, plainTok)
+ok('绑定 daq 节点(readonly 线)放行', bindD.status === 200, JSON.stringify(bindD.body?.message ?? ''))
+const bindW1 = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: 'e2e-perms-agent', nodeId: w1.id, kind: 'dcw' }) }, plainTok)
+ok('绑定 dcw 节点(readonly 线)被拒', bindW1.status === 403, bindW1.body?.message)
+const bindW2 = await api('/api/workshop/agent-tools/bindings', { method: 'POST', body: JSON.stringify({ agentId: 'e2e-perms-agent', nodeId: w2.id, kind: 'dcw' }) }, plainTok)
+ok('绑定 dcw 节点(operate 线)放行', bindW2.status === 200)
+
+// ---- 越权访问无权产线节点(直接按 id 打,数据面不因列表隐藏而放行) ----
+const other = ov.body.data.lines.find(l => l.id !== LINE1 && l.id !== LINE2)
+if (other) {
+  const otherNodes = (await api('/api/workshop/dcw', {}, adminTok)).body.data.nodes.filter(n => n.lineId === other.id)
+  if (otherNodes.length) {
+    const wOther = await api(`/api/workshop/dcw/${otherNodes[0].id}/write`, { method: 'POST', body: JSON.stringify({ value: 170 }) }, plainTok)
+    ok('直接写无权产线节点被拒(403)', wOther.status === 403, wOther.body?.message)
+  }
+}
+
+// ---- 撤销产线1 → 立即不可见 ----
+const revoke = await api('/api/workshop/permissions', { method: 'PUT', body: JSON.stringify({ userId: plainId, grants: [{ lineId: LINE1, mode: null }] }) }, adminTok)
+ok('撤销产线1授权', revoke.status === 200 && revoke.body.data.grants.length === 1)
+const d2 = await api('/api/workshop/dcw', {}, plainTok)
+ok('撤销后产线1不可见', !(d2.body?.data?.lines ?? []).some(l => l.id === LINE1), `lines=${(d2.body?.data?.lines ?? []).map(l => l.id.slice(0, 6))}`)
+
+// ---- 非 admin 不能用管理面 ----
+const forbidden = await api('/api/workshop/permissions', {}, plainTok)
+ok('plain 访问权限管理面被拒(403)', forbidden.status === 403)
+
+console.log(`\n===== permissions E2E: ${step} 项 =====`)

package/scripts/_dbg-perms-visual.mjs

@@ -0,0 +1,36 @@
+// 权限页浏览器目视:admin 管理矩阵 + plain 用户受限视图
+import puppeteer from 'puppeteer-core'
+const BASE = 'http://127.0.0.1:3021'
+const browser = await puppeteer.launch({ executablePath: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', headless: 'new', args: ['--no-sandbox', '--disable-gpu', '--no-proxy-server', '--window-size=1600,1000'] })
+
+const loginTok = async (email, password) => (await fetch(`${BASE}/api/users/login`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email, password }) }).then(r => r.json())).data?.token
+
+const shoot = async (path, name, token, wait = 3500) => {
+  const page = await browser.newPage()
+  await page.setViewport({ width: 1600, height: 1000, deviceScaleFactor: 1.25 })
+  await page.setCookie({ name: 'token', value: token, domain: '127.0.0.1', path: '/' })
+  await page.goto(`${BASE}${path}`, { waitUntil: 'networkidle2', timeout: 60000 })
+  await new Promise(r => setTimeout(r, wait))
+  await page.screenshot({ path: `.e2e-shots/perm-${name}.png` })
+  console.log(`📷 perm-${name}`)
+  await page.close()
+}
+
+// 1) admin:权限管理页
+const adminTok = await loginTok('admin@awshop.local', 'admin123')
+await shoot('/permissions', 'admin-page', adminTok)
+
+// 2) plain 用户(产线2=operate 授权还在):侧栏无权限管理入口 + /dcw 仅见授权产线
+// 取 E2E 里那个 plain(重新注册一个新的拿授权?简化:直接注册 per-shot 用户并经 API 给产线2 operate)
+const ov = await fetch(`${BASE}/api/workshop/permissions`, { headers: { authorization: `Bearer ${adminTok}` } }).then(r => r.json())
+const stamp = Date.now().toString(36)
+const pu = { name: `v-${stamp}`, email: `v-${stamp}@awshop.local`, password: 'Plain2026' }
+const reg = await fetch(`${BASE}/api/users/register`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(pu) }).then(r => r.json())
+const plainTok = reg.data.token
+const uid = (await fetch(`${BASE}/api/workshop/permissions`, { headers: { authorization: `Bearer ${plainTok}` } }).then(r => r.json())).status // 403 expected
+console.log('plain 拉管理面:', uid === 403 ? '403 ✔' : `异常 ${uid}`)
+const pid = ov.data.users.find(u => u.email === pu.email)?.id
+await fetch(`${BASE}/api/workshop/permissions`, { method: 'PUT', headers: { authorization: `Bearer ${adminTok}`, 'content-type': 'application/json' }, body: JSON.stringify({ userId: pid, grants: [{ lineId: ov.data.lines.find(l => l.name.includes('2号')).id, mode: 'operate' }] }) })
+await shoot('/dcw', 'plain-dcw', plainTok)
+await shoot('/daq', 'plain-daq', plainTok)
+await browser.close()

package/scripts/_dbg-protocol-matrix.mjs

@@ -161,6 +161,22 @@ async function main() {
   const line = (await api('POST', '/api/workshop/dcw/lines', { body: { name: `全协议产线-${TAG}` }, token })).data?.line
   check('0.1', '建产线', Boolean(line?.id))
 
+  // ── 0.2 产线级权限(新版权限模型:普通用户默认无权,admin 逐线授 operate) ──
+  const ADMIN_PASS = process.env.AW_ADMIN_PASS ?? 'admin123'
+  const adminLogin = await api('POST', '/api/users/login', {
+    body: { email: 'admin@awshop.local', password: ADMIN_PASS },
+  }).catch(() => null)
+  const adminTok = adminLogin?.data?.token
+  if (adminTok) {
+    const granted = await api('PUT', '/api/workshop/permissions', {
+      body: { userId: reg.data?.user?.id, grants: [{ lineId: line.id, mode: 'operate' }] }, token: adminTok,
+    }).catch(() => null)
+    check('0.2', 'admin 授予测试用户产线 operate 权限', Boolean(granted?.data?.userId), granted?.message ?? '')
+  }
+  else {
+    console.log('  [skip] admin 登录失败(可设 AW_ADMIN_PASS),以普通用户无权态继续(写入段将按权限模型拒绝)')
+  }
+
   // ── 1. DAQ 五协议节点(配置连接 + 连接测试) ──
   const daqDefs = [
     { id: 'mqtt', driver: 'mqtt', templateRef: 'daq-temp-tc', name: `MQTT温度-${TAG}`, expect: [30, 75],

package/sdk/api.mjs

@@ -1,101 +1,117 @@
-// ============================================================
-// AgentWorkShop SDK — 平台 REST 客户端
-// ------------------------------------------------------------
-// SDK 作为项目服务的 client:对平台 REST 面(/api/**)的类型化轻封装。
-// 三个使用形态:
-//   1) 插件内:   ctx.api.lines.list()          —— 宿主注入(自环 origin)
-//   2) 外部脚本: createPlatformClient({ baseUrl, token }).daq.nodes()
-//   3) 浏览器:   createPlatformClient({ baseUrl: '' })  同源相对路径
-// 资源方法返回原始 JSON body(data 字段已解包);4xx/5xx 抛错(含 status)。
-// ============================================================
-
-export function createPlatformClient({ baseUrl = '', token, logger, timeoutMs = 10000 } = {}) {
-  // baseUrl 支持函数(延迟解析):插件宿主的监听端口在 nitro listen 钩子后才确定
-  const resolveBase = () => String(typeof baseUrl === 'function' ? baseUrl() : (baseUrl ?? '')).replace(/\/+$/, '')
-  let authToken = token ?? null
-
-  async function call(method, path, body, opt = {}) {
-    const base = resolveBase()
-    const headers = { accept: 'application/json', ...(opt.headers ?? {}) }
-    if (authToken) headers.authorization = `Bearer ${authToken}`
-    if (body !== undefined) headers['content-type'] = 'application/json'
-    const res = await fetch(`${base}${path}`, {
-      method,
-      headers,
-      body: body !== undefined ? JSON.stringify(body) : undefined,
-      signal: AbortSignal.timeout(opt.timeoutMs ?? timeoutMs),
-    })
-    const json = await res.json().catch(() => null)
-    if (!res.ok) {
-      const err = new Error(json?.message ?? `HTTP ${res.status} ${path}`)
-      err.status = res.status
-      err.body = json
-      if (logger) logger.warn(`API ${method} ${path} → ${res.status}`)
-      throw err
-    }
-    // 平台统一信封 { code, message, data } → 解包 data;非信封原样返回
-    return json && typeof json === 'object' && 'data' in json ? json.data : json
-  }
-
-  const resource = root => ({
-    list: (query = {}) => call('GET', `${root}${toQuery(query)}`),
-    get: id => call('GET', `${root}/${id}`),
-    create: body => call('POST', root, body),
-    update: (id, patch) => call('PATCH', `${root}/${id}`, patch),
-    remove: id => call('DELETE', `${root}/${id}`),
-  })
-
-  const client = {
-    /** 底层调用(任意平台路径;自动带 token 与信封解包) */
-    call,
-    get: (path, query = {}) => call('GET', `${path}${toQuery(query)}`),
-    post: (path, body) => call('POST', path, body),
-    patch: (path, body) => call('PATCH', path, body),
-    delete: path => call('DELETE', path),
-    setToken: (t) => {
-      authToken = t ?? null
-      return client
-    },
-    /** 平台健康(免鉴权) */
-    ping: () => call('GET', '/api/plugins/manifest'),
-
-    // ---- 业务资源面 ----
-    users: {
-      ...resource('/api/users'),
-      login: (email, password) => call('POST', '/api/users/login', { email, password }),
-      me: () => call('GET', '/api/users/me'),
-    },
-    lines: {
-      ...resource('/api/workshop/dcw/lines'),
-      start: (id, recipeId = '') => call('POST', `/api/workshop/dcw/lines/${id}/start`, { recipeId }),
-      stop: id => call('POST', `/api/workshop/dcw/lines/${id}/stop`),
-    },
-    products: resource('/api/workshop/dcw/products'),
-    recipes: resource('/api/workshop/dcw/recipes'),
-    dcwNodes: resource('/api/workshop/dcw'),
-    daqNodes: {
-      ...resource('/api/workshop/daq'),
-      alarms: () => call('GET', '/api/workshop/daq/alarms'),
-    },
-    templates: {
-      daq: () => call('GET', '/api/workshop/daq').then(d => d?.templates ?? []),
-      dcw: () => call('GET', '/api/workshop/dcw').then(d => d?.templates ?? []),
-    },
-    twins: resource('/api/workshop/device-twins'),
-    teams: resource('/api/workshop/teams'),
-    agents: resource('/api/workshop/agents'),
-    channels: resource('/api/workshop/channels'),
-    plugins: {
-      manifest: () => call('GET', '/api/plugins/manifest'),
-    },
-  }
-  return client
-}
-
-function toQuery(query) {
-  const entries = Object.entries(query ?? {}).filter(([, v]) => v !== undefined && v !== null && v !== '')
-  if (!entries.length) return ''
-  return `?${new URLSearchParams(Object.fromEntries(entries.map(([k, v]) => [k, String(v)]))).toString()}`
-}
-
-export default createPlatformClient
+// ============================================================
+// AgentWorkShop SDK — 平台 REST 客户端
+// ------------------------------------------------------------
+// SDK 作为项目服务的 client:对平台 REST 面(/api/**)的类型化轻封装。
+// 三个使用形态:
+//   1) 插件内:   ctx.api.lines.list()          —— 宿主注入(自环 origin)
+//   2) 外部脚本: createPlatformClient({ baseUrl, token }).daq.nodes()
+//   3) 浏览器:   createPlatformClient({ baseUrl: '' })  同源相对路径
+// 资源方法返回原始 JSON body(data 字段已解包);4xx/5xx 抛错(含 status)。
+// ============================================================
+
+export function createPlatformClient({ baseUrl = '', token, logger, timeoutMs = 10000 } = {}) {
+  // baseUrl 支持函数(延迟解析):插件宿主的监听端口在 nitro listen 钩子后才确定
+  const resolveBase = () => String(typeof baseUrl === 'function' ? baseUrl() : (baseUrl ?? '')).replace(/\/+$/, '')
+  let authToken = token ?? null
+
+  async function call(method, path, body, opt = {}) {
+    const base = resolveBase()
+    const headers = { accept: 'application/json', ...(opt.headers ?? {}) }
+    if (authToken) headers.authorization = `Bearer ${authToken}`
+    if (body !== undefined) headers['content-type'] = 'application/json'
+    const res = await fetch(`${base}${path}`, {
+      method,
+      headers,
+      body: body !== undefined ? JSON.stringify(body) : undefined,
+      signal: AbortSignal.timeout(opt.timeoutMs ?? timeoutMs),
+    })
+    const json = await res.json().catch(() => null)
+    if (!res.ok) {
+      const err = new Error(json?.message ?? `HTTP ${res.status} ${path}`)
+      err.status = res.status
+      err.body = json
+      if (logger) logger.warn(`API ${method} ${path} → ${res.status}`)
+      throw err
+    }
+    // 平台统一信封 { code, message, data }:HTTP 200 但业务 code 非 0 也是错误
+    // (不做此检查插件会把 error 信封解包成 null 当成功用)
+    if (json && typeof json === 'object' && 'code' in json && json.code !== 0) {
+      const err = new Error(json.message ?? `业务错误 ${json.code} ${path}`)
+      err.status = res.status
+      err.code = json.code
+      err.body = json
+      if (logger) logger.warn(`API ${method} ${path} → code ${json.code}`)
+      throw err
+    }
+    // 非信封原样返回
+    return json && typeof json === 'object' && 'data' in json && 'code' in json ? json.data : json
+  }
+
+  const resource = root => ({
+    list: (query = {}) => call('GET', `${root}${toQuery(query)}`),
+    get: id => call('GET', `${root}/${id}`),
+    create: body => call('POST', root, body),
+    update: (id, patch) => call('PATCH', `${root}/${id}`, patch),
+    remove: id => call('DELETE', `${root}/${id}`),
+  })
+
+  const client = {
+    /** 底层调用(任意平台路径;自动带 token 与信封解包) */
+    call,
+    get: (path, query = {}) => call('GET', `${path}${toQuery(query)}`),
+    post: (path, body) => call('POST', path, body),
+    patch: (path, body) => call('PATCH', path, body),
+    delete: path => call('DELETE', path),
+    setToken: (t) => {
+      authToken = t ?? null
+      return client
+    },
+    /** 平台健康(免鉴权) */
+    ping: () => call('GET', '/api/plugins/manifest'),
+
+    // ---- 业务资源面 ----
+    users: {
+      ...resource('/api/users'),
+      login: (email, password) => call('POST', '/api/users/login', { email, password }),
+      me: () => call('GET', '/api/users/me'),
+    },
+    lines: {
+      ...resource('/api/workshop/dcw/lines'),
+      start: (id, recipeId = '') => call('POST', `/api/workshop/dcw/lines/${id}/start`, { recipeId }),
+      stop: id => call('POST', `/api/workshop/dcw/lines/${id}/stop`),
+    },
+    products: resource('/api/workshop/dcw/products'),
+    recipes: resource('/api/workshop/dcw/recipes'),
+    dcwNodes: resource('/api/workshop/dcw'),
+    daqNodes: {
+      ...resource('/api/workshop/daq'),
+      alarms: () => call('GET', '/api/workshop/daq/alarms'),
+    },
+    templates: {
+      daq: () => call('GET', '/api/workshop/daq').then(d => d?.templates ?? []),
+      dcw: () => call('GET', '/api/workshop/dcw').then(d => d?.templates ?? []),
+    },
+    twins: resource('/api/workshop/device-twins'),
+    teams: resource('/api/workshop/teams'),
+    agents: resource('/api/workshop/agents'),
+    channels: resource('/api/workshop/channels'),
+    permissions: {
+      /** admin:全量产线 + 用户(含 channels/grants)总览 */
+      overview: () => call('GET', '/api/workshop/permissions'),
+      /** admin:批量设置用户产线授权 { userId, grants: [{ lineId, mode: 'readonly'|'operate'|null }] } */
+      set: payload => call('PUT', '/api/workshop/permissions', payload),
+    },
+    plugins: {
+      manifest: () => call('GET', '/api/plugins/manifest'),
+    },
+  }
+  return client
+}
+
+function toQuery(query) {
+  const entries = Object.entries(query ?? {}).filter(([, v]) => v !== undefined && v !== null && v !== '')
+  if (!entries.length) return ''
+  return `?${new URLSearchParams(Object.fromEntries(entries.map(([k, v]) => [k, String(v)]))).toString()}`
+}
+
+export default createPlatformClient