w-web-perm 1.1.11 → 1.1.13

package/server/procLang.mjs

@@ -146,6 +146,221 @@ let kpLang = {
         eng: `Duplicate field value in saved data`,
         cht: `儲存資料的欄位值重複`,
     },
+    nameDuplicate: { //後台整表寫入: 群組／權限之名稱重複(本次造成或觸及者; 歷史既有重複原樣送回不拒), 整次拒存、資料未變更(規則帳本 R-NAME-UNIQ-02, ADR-034)
+        eng: `Not saved: the name is duplicated. Group names and permission names must be unique. Nothing was changed.`,
+        cht: `未儲存：名稱重複。群組名稱與權限名稱不得重複。資料未變更。`,
+    },
+    authLossyBlocked: { //編輯器對「物件形式無法無損表示」之授權資料拒存(規則帳本 R-AUTH-LOSSY-01, 主控複審 R4; run04 起「同名同時 OR 與 AND」, 順序部分隨 ADR-033 移除; run05 起另含「啟用而無字串名稱之項目」, R-PRINCIPLE-00 f; run06 起「啟用的項目其合併模式皆缺漏或不合法」一格放寬為可存〔方案 A 原樣寫回, ADR-035 Update 2026-10-22〕, 文字去掉該項); {names} 為受影響之名稱
+        eng: `Not saved: the authorization settings for {names} contain entries the editor cannot write without changing access (the same name set to both OR and AND, or an entry without a usable name). Nothing was changed. Please correct the source data first.`,
+        cht: `未儲存：{names} 的授權設定含有編輯器無法在不改變授權下寫出的項目（同一名稱同時以 OR 與 AND 設定，或項目沒有可用的名稱）。資料未變更，請先修正資料來源。`,
+    },
+    //授權資料衝突之頁面提示(規則帳本 R-PRINCIPLE-00 原則 3「遇衝突:收嚴＋提示」、R-AUTH-WARN-01): 警告圖示(三角形驚嘆號)之 tooltip; 偵測與代入見 src/js/getAuthWarn.mjs; {names} 為受影響之名稱、{kind} 為被引用者種類(warnKindGrup／warnKindPemi)、{n} 為筆數
+    warnKindGrup: {
+        eng: `permission group`,
+        cht: `權限群組`,
+    },
+    warnKindPemi: {
+        eng: `permission`,
+        cht: `權限`,
+    },
+    warnRefDangling: { //c: 引用之名稱查無實體
+        eng: `Not found in the {kind} list: {names}. Each is still counted as an entry with no authorization (an OR entry adds nothing; an AND entry leaves nothing granted). Restore it or remove it.`,
+        cht: `在{kind}清單中找不到：{names}。仍視為一個沒有任何授權的項目（OR 項目不增加授權；AND 項目使結果為空）。請還原或移除。`,
+    },
+    warnRefAmbiguous: { //d: 引用之名稱對到多筆(歷史同名)
+        eng: `Matches several {kind}s with the same name: {names}. Only the authorization they all share is used (intersection). Rename or delete the duplicates.`,
+        cht: `對到多筆同名的{kind}：{names}。僅採用它們共同擁有的授權（交集）。請將同名項目改名或刪除。`,
+    },
+    warnRefModeInvalid: { //e: mode 缺或非 OR／AND
+        eng: `The merge mode is missing or invalid: {names}. It is treated as AND, but only as a restriction: it never grants access on its own.`,
+        cht: `合併模式缺漏或不合法：{names}。系統視為 AND，且僅作為限制，不會單獨授予任何授權。`,
+    },
+    warnRefBothModes: { //b: 同名同時有 OR 與 AND
+        eng: `Set as both OR and AND: {names}. The editor cannot save this without changing access, so saving is refused until the source data is fixed.`,
+        cht: `同時以 OR 與 AND 設定：{names}。編輯器無法在不改變授權下儲存，於資料來源修正前將拒絕儲存。`,
+    },
+    warnRefEmptyName: { //f: 名稱為空字串
+        eng: `An entry has an empty name. It is kept as it is and matches only a {kind} whose name is empty.`,
+        cht: `有項目的名稱為空字串。照原樣保留，且僅與名稱為空字串的{kind}相符。`,
+    },
+    warnRefNoName: { //f: 名稱不是字串
+        eng: `An entry has no usable name ({names}). The editor cannot keep it, so saving is refused until the source data is fixed.`,
+        cht: `有項目沒有可用的名稱（{names}）。編輯器無法保留，於資料來源修正前將拒絕儲存。`,
+    },
+    warnDataUnparsable: { //格式無法判讀(JSON5 解析失敗或非物件／陣列): 伺服端視為沒有任何授權(收嚴)
+        eng: `The authorization data cannot be parsed (invalid format). It is treated as granting nothing. Correct the source data or set it again and save.`,
+        cht: `授權資料的格式無法解析，系統視為沒有任何授權。請修正資料來源，或重新設定後儲存。`,
+    },
+    warnRuleConflict: { //a: crules 同一管理對象重複列且有勾與沒勾並存
+        eng: `Listed more than once, with both checked and unchecked: {names}. It is treated as unchecked (n).`,
+        cht: `重複列出且有勾與沒勾並存：{names}。系統視為沒勾選（n）。`,
+    },
+    warnNameHistDup: { //g: 歷史同名列(非本次編輯造成)
+        eng: `This name is shared by {n} rows (existing duplicates, not caused by this edit). Anything that refers to it by name uses only what the rows share. Rename or delete the extra rows.`,
+        cht: `此名稱由 {n} 筆資料共用（既有的重複，並非本次編輯造成）。以名稱引用它的授權僅採用各筆共同的部分。請將多餘的資料改名或刪除。`,
+    },
+    warnDupRowsInconsistent: { //編輯器: 同名之列設定不一致而拒存
+        eng: `Not saved: rows with the same name have different settings ({names}). Nothing was changed. Please make them identical, or fix the duplicate names first.`,
+        cht: `未儲存：同名的列設定不一致（{names}）。資料未變更，請先使其一致，或先修正同名資料。`,
+    },
+    //@@U1-KEYS
+    //使用者清單頁: 歷史既有(庫內原樣、非本次編輯造成)之同名／同 email／空值／格式不符不擋存, 僅於該儲存格顯示警告圖示(規則帳本 R-PRINCIPLE-00 g、h); 本次造成者仍擋存並顯示 userNameEmpty／userNameDuplicate／userEmail* 既有文字. {n} 為共用該值之使用者數
+    warnUserNameHistDup: {
+        eng: `This name is shared by {n} users (existing duplicates, not caused by this edit). This does not block saving. If name is the sign-in key, signing in with it is refused until the duplicates are fixed.`,
+        cht: `此名稱由 {n} 位使用者共用（既有的重複，並非本次編輯造成），不影響儲存。若以名稱作為登入對應鍵，在重複修正前該名稱將無法登入。`,
+    },
+    warnUserEmailHistDup: {
+        eng: `This email is shared by {n} users (existing duplicates, not caused by this edit). This does not block saving. If email is the sign-in key, signing in with it is refused until the duplicates are fixed.`,
+        cht: `此 Email 由 {n} 位使用者共用（既有的重複，並非本次編輯造成），不影響儲存。若以 Email 作為登入對應鍵，在重複修正前該 Email 將無法登入。`,
+    },
+    warnUserNameHistEmpty: {
+        eng: `This user has no valid name (existing data, not caused by this edit). This does not block saving.`,
+        cht: `此使用者尚未給予有效名稱（既有資料，並非本次編輯造成），不影響儲存。`,
+    },
+    warnUserEmailHistEmpty: {
+        eng: `This user has no email (existing data, not caused by this edit). This does not block saving. If email is the sign-in key, this user cannot sign in.`,
+        cht: `此使用者尚未給予 Email（既有資料，並非本次編輯造成），不影響儲存。若以 Email 作為登入對應鍵，此使用者將無法登入。`,
+    },
+    warnUserEmailHistInvalid: {
+        eng: `The email format of this user is invalid (existing data, not caused by this edit). This does not block saving.`,
+        cht: `此使用者的 Email 格式錯誤（既有資料，並非本次編輯造成），不影響儲存。`,
+    },
+    //刪除群組／權限前之確認(規則帳本 R-PRINCIPLE-00 c、d、原則 6、適用表 n; ADR-036; src/js/getDelRefCount.mjs:getDelConfirmText): 刪除時引用它之引用端(群組頁為使用者 cgrups、權限頁為群組 cpemis)於同一次寫入內被連帶清理(移除該引用),
+    //故不再是「授權被收回」: 其中以 AND 引用者, 引用被移除後其 AND 限制解除, 授權可能變多. 單一框、單一問句, 依下列三個數量組合選鍵:
+    //  {n} 為將被移除引用之引用端數(任何 mode、含停用項目); {m} 為其中以 AND 引用者(限制解除); {w} 為引用的名稱有多筆同名(歷史同名)而只刪其一(各候選之交集變寬)之引用端數(名稱仍有實體, 不清理, 不計入 {n})
+    //  confirmDelRefs(n)、confirmDelRefsAnd(n、m)、confirmDelRefsDup(n、w)、confirmDelRefsAndDup(n、m、w); confirmDelDupRefs 僅有 w, 其 {n} 即 w 之數量
+    confirmDelRefsGrup: {
+        eng: `The reference to the selected group(s) will be removed from {n} user(s). Delete anyway?`,
+        cht: `將自 {n} 位使用者移除對所選群組的引用。確定刪除？`,
+    },
+    confirmDelRefsPemi: {
+        eng: `The reference to the selected permission(s) will be removed from {n} group(s). Delete anyway?`,
+        cht: `將自 {n} 個群組移除對所選權限的引用。確定刪除？`,
+    },
+    confirmDelRefsAndGrup: {
+        eng: `The reference to the selected group(s) will be removed from {n} user(s). For the {m} user(s) that refer to it with AND, the restriction will be lifted and their authorization may increase. Delete anyway?`,
+        cht: `將自 {n} 位使用者移除對所選群組的引用；其中 {m} 位以 AND 引用，移除後其限制解除，授權可能變多。確定刪除？`,
+    },
+    confirmDelRefsAndPemi: {
+        eng: `The reference to the selected permission(s) will be removed from {n} group(s). For the {m} group(s) that refer to it with AND, the restriction will be lifted and their authorization may increase. Delete anyway?`,
+        cht: `將自 {n} 個群組移除對所選權限的引用；其中 {m} 個以 AND 引用，移除後其限制解除，授權可能變多。確定刪除？`,
+    },
+    confirmDelDupRefsGrup: {
+        eng: `{n} user(s) refer to a group name that is shared by several groups. If you delete one of them, those users' authorization may increase. Delete anyway?`,
+        cht: `有 {n} 位使用者引用的群組名稱有多筆同名資料，刪除其中一筆後，其授權可能變多。確定刪除？`,
+    },
+    confirmDelDupRefsPemi: {
+        eng: `{n} group(s) refer to a permission name that is shared by several permissions. If you delete one of them, the authorization of those groups may increase. Delete anyway?`,
+        cht: `有 {n} 個群組引用的權限名稱有多筆同名資料，刪除其中一筆後，其授權可能變多。確定刪除？`,
+    },
+    confirmDelRefsDupGrup: {
+        eng: `The reference to the selected group(s) will be removed from {n} user(s). Also, {w} user(s) refer to a group name that is shared by several groups; if you delete one of them, those users' authorization may increase. Delete anyway?`,
+        cht: `將自 {n} 位使用者移除對所選群組的引用；另有 {w} 位使用者引用的群組名稱有多筆同名資料，刪除其中一筆後，其授權可能變多。確定刪除？`,
+    },
+    confirmDelRefsDupPemi: {
+        eng: `The reference to the selected permission(s) will be removed from {n} group(s). Also, {w} group(s) refer to a permission name that is shared by several permissions; if you delete one of them, the authorization of those groups may increase. Delete anyway?`,
+        cht: `將自 {n} 個群組移除對所選權限的引用；另有 {w} 個群組引用的權限名稱有多筆同名資料，刪除其中一筆後，其授權可能變多。確定刪除？`,
+    },
+    confirmDelRefsAndDupGrup: {
+        eng: `The reference to the selected group(s) will be removed from {n} user(s). For the {m} user(s) that refer to it with AND, the restriction will be lifted and their authorization may increase. Also, {w} user(s) refer to a group name that is shared by several groups; if you delete one of them, those users' authorization may increase. Delete anyway?`,
+        cht: `將自 {n} 位使用者移除對所選群組的引用，其中 {m} 位以 AND 引用，移除後其限制解除，授權可能變多；另有 {w} 位使用者引用的群組名稱有多筆同名資料，刪除其中一筆後，其授權可能變多。確定刪除？`,
+    },
+    confirmDelRefsAndDupPemi: {
+        eng: `The reference to the selected permission(s) will be removed from {n} group(s). For the {m} group(s) that refer to it with AND, the restriction will be lifted and their authorization may increase. Also, {w} group(s) refer to a permission name that is shared by several permissions; if you delete one of them, the authorization of those groups may increase. Delete anyway?`,
+        cht: `將自 {n} 個群組移除對所選權限的引用，其中 {m} 個以 AND 引用，移除後其限制解除，授權可能變多；另有 {w} 個群組引用的權限名稱有多筆同名資料，刪除其中一筆後，其授權可能變多。確定刪除？`,
+    },
+    //儲存前之引用連帶預覽(ADR-036; src/js/getCascadePreview.mjs): 群組／權限改名時, 引用它之引用端(使用者 cgrups／群組 cpemis)於同一次寫入內連帶改名; 標的頁刪除或改 id 時, 引用它之權限 crules 項目被連帶清理(標的 id 即名稱, 改 id 不級聯).
+    //{n} 為受影響之引用端數、{list} 為名單(改名為「舊→新」, 至多 5 個, 其餘以 cascadeListMore 帶總數)、{e} 為其中來源為外部應用(from 非空)者
+    confirmSaveRenameRefsGrup: {
+        eng: `After saving, the group references of {n} user(s) will be updated to the new names of these renamed group(s): {list}. Continue?`,
+        cht: `儲存後將一併更新 {n} 位使用者對下列已改名群組的引用：{list}。是否繼續？`,
+    },
+    confirmSaveRenameRefsExtGrup: {
+        eng: `After saving, the group references of {n} user(s) will be updated to the new names of these renamed group(s): {list}. The source of {e} of them is an external application; their references may be overwritten by external data at the next external sync. Continue?`,
+        cht: `儲存後將一併更新 {n} 位使用者對下列已改名群組的引用：{list}。其中 {e} 位來源為外部應用，下次外部同步時可能被外部資料覆寫。是否繼續？`,
+    },
+    confirmSaveRenameRefsPemi: {
+        eng: `After saving, the permission references of {n} group(s) will be updated to the new names of these renamed permission(s): {list}. Continue?`,
+        cht: `儲存後將一併更新 {n} 個群組對下列已改名權限的引用：{list}。是否繼續？`,
+    },
+    confirmSaveRenameRefsExtPemi: {
+        eng: `After saving, the permission references of {n} group(s) will be updated to the new names of these renamed permission(s): {list}. The source of {e} of them is an external application; their references may be overwritten by external data at the next external sync. Continue?`,
+        cht: `儲存後將一併更新 {n} 個群組對下列已改名權限的引用：{list}。其中 {e} 個來源為外部應用，下次外部同步時可能被外部資料覆寫。是否繼續？`,
+    },
+    confirmSaveDelRefsTarget: {
+        eng: `The settings for the following target(s) (deleted or renamed) will be removed from the rules of {n} permission(s): {list}. Save anyway?`,
+        cht: `將自 {n} 個權限的規則移除對下列管控對象的設定（已刪除或已改名）：{list}。確定儲存？`,
+    },
+    cascadeListMore: { //名單超過 5 個時附於其後, {n} 為總數
+        eng: `… ({n} in total)`,
+        cht: `…等 {n} 個`,
+    },
+    //儲存成功且有引用端因改名被連帶更新時之成功訊息(只描述改名; 群組頁／權限頁): {n} 為前端 store 之預覽筆數(nRenameHolders, 伺服端以實際為準);
+    //無改名連帶時、刪除所致之連帶清理(筆數已於刪除確認框告知)與標的頁, 一律維持原成功訊息(grupSaveGrupsSuccess／pemiSavePemisSuccess／targetSaveTargetsSuccess)
+    grupSaveGrupsSuccessCascade: {
+        eng: `Save permission groups successfully. The group references of {n} user(s) were updated to the new name(s).`,
+        cht: `儲存權限群組數據成功，已將 {n} 位使用者對已改名群組的引用一併更新為新名稱。`,
+    },
+    pemiSavePemisSuccessCascade: {
+        eng: `Save permissions successfully. The permission references of {n} group(s) were updated to the new name(s).`,
+        cht: `儲存權限數據成功，已將 {n} 個群組對已改名權限的引用一併更新為新名稱。`,
+    },
+    //@@U2-KEYS
+    //@@S-KEYS
+    //@@M-KEYS
+    relationRowsStale: { //反向關聯對話框存檔時, 對話框內有列所對應的使用者／群組已被刪除或改名而整次拒存(規則帳本 R-REL-PAIR-01, ADR-032); {names} 為受影響之名稱
+        eng: `Not saved: the list changed while this dialog was open (removed or renamed: {names}). Nothing was changed. Please close this dialog, reload the page and try again.`,
+        cht: `未儲存：此對話框開啟期間清單已有異動（已刪除或改名：{names}）。資料未變更，請關閉對話框並重新整理頁面後再操作。`,
+    },
+    //@@UI1-KEYS
+    //F-23／F-26 清單頁(標的／權限／群組／使用者)之外部列與外部同步提示(R-PRINCIPLE-00 原則 3「收嚴＋提示」、原則 5; R-EXT-OWN-01; ADR-037; src/js/externalUi.mjs、src/js/getAddImpact.mjs):
+    //  externalRowLocked 外部列首欄鎖頭圖示之 tooltip({from} 為來源); externalRowsNotice／externalRowsNoticeTarget 清單上方提示({n} 為外部列數; 標的無指派欄故另一鍵);
+    //  syncWarnIdRenumber 外部同步疑似 id 重編之警示({from} 來源、{n} 筆數); externalRowDelBlocked 勾選含外部列而被略過之提示({n}); nameUsedByExternal 後台列與外部列撞名之儲存前提示({name}、{from});
+    //  confirmAddRefs* 新增撞「懸空名」(仍被啟用中之引用指向、查無實體)之確認: {list} 新名稱(至多 5 個)、{n} 受影響之引用端數、{m} 其中以 AND 引用者(標的之 crules 項目無 mode, 無 AND 句)
+    externalRowLocked: {
+        eng: `Synchronized from external source "{from}". Read-only here.`,
+        cht: `由外部來源「{from}」同步，於此為唯讀。`,
+    },
+    externalRowsNotice: {
+        eng: `{n} row(s) are synchronized from an external source. Their identity fields are read-only and they cannot be deleted here; only their assignment settings can be changed.`,
+        cht: `有 {n} 筆資料由外部來源同步。其身分欄位於此為唯讀且不可刪除，僅可修改其授權指派設定。`,
+    },
+    externalRowsNoticeTarget: {
+        eng: `{n} row(s) are synchronized from an external source. They are read-only and cannot be deleted here.`,
+        cht: `有 {n} 筆資料由外部來源同步，於此為唯讀且不可刪除。`,
+    },
+    syncWarnIdRenumber: {
+        eng: `The external source "{from}" appears to have renumbered ids ({n} item(s) now carry a name that previously belonged to an item with a different id). Each synchronization removes the old items and cleans up the references to them, which may erase the assignments made here. Please ask the source to keep ids stable or to omit ids.`,
+        cht: `外部來源「{from}」疑似重編 id（有 {n} 筆項目的名稱，先前屬於不同 id 之項目）。每次同步會移除舊項目並連帶清理其引用，可能抹掉在此做的指派。請來源端保持 id 穩定或不帶 id。`,
+    },
+    externalRowDelBlocked: {
+        eng: `{n} selected row(s) are synchronized from an external source and cannot be deleted here. They were skipped.`,
+        cht: `所選資料中有 {n} 筆由外部來源同步，無法在此刪除，已略過。`,
+    },
+    nameUsedByExternal: {
+        eng: `External source "{from}" already uses the name "{name}".`,
+        cht: `外部來源「{from}」已使用此名稱「{name}」。`,
+    },
+    confirmAddRefsGrup: {
+        eng: `Adding the group(s) "{list}": {n} user(s) already refer to the name, so after saving they will get (or be limited by) the permissions of the new group(s). Add anyway?`,
+        cht: `新增群組「{list}」後，將有 {n} 位使用者取得或受此群組限制（其授權設定原已引用此名稱）。確定新增？`,
+    },
+    confirmAddRefsAndGrup: {
+        eng: `Adding the group(s) "{list}": {n} user(s) already refer to the name, so after saving they will get (or be limited by) the permissions of the new group(s); {m} of them refer to it with AND. Add anyway?`,
+        cht: `新增群組「{list}」後，將有 {n} 位使用者（其中 {m} 位以 AND 引用）取得或受此群組限制（其授權設定原已引用此名稱）。確定新增？`,
+    },
+    confirmAddRefsPemi: {
+        eng: `Adding the permission(s) "{list}": {n} group(s) already refer to the name, so after saving they will get (or be limited by) the new permission(s). Add anyway?`,
+        cht: `新增權限「{list}」後，將有 {n} 個群組取得或受此權限限制（其授權設定原已引用此名稱）。確定新增？`,
+    },
+    confirmAddRefsAndPemi: {
+        eng: `Adding the permission(s) "{list}": {n} group(s) already refer to the name, so after saving they will get (or be limited by) the new permission(s); {m} of them refer to it with AND. Add anyway?`,
+        cht: `新增權限「{list}」後，將有 {n} 個群組（其中 {m} 個以 AND 引用）取得或受此權限限制（其授權設定原已引用此名稱）。確定新增？`,
+    },
+    confirmAddRefsTarget: {
+        eng: `Adding the target(s) "{list}": the rules of {n} permission(s) already contain settings for the name, so after saving those settings will take effect for the new target(s). Add anyway?`,
+        cht: `新增管控對象「{list}」後，將有 {n} 個權限的規則取得此管控對象的設定（其規則原已寫有此名稱）。確定新增？`,
+    },
     saveInProgress: { //同一操作者之同表儲存處理中再送出 (ADR-025)
         eng: `The previous save is still in progress. Please do not submit again.`,
         cht: `上一次儲存仍在處理中，請勿重複送出`,
@@ -168,6 +383,58 @@ let kpLang = {
         eng: `Not all changes were written, and some may have taken effect. Please reload the page and check before making changes.`,
         cht: `資料寫入未全部完成，部分變更可能已生效，請重新整理頁面確認後再操作`,
     },
+    //引用連帶(改名級聯／刪除連帶清理; R-PRINCIPLE-00 原則 6、適用表 m／n; R-REF-CASCADE-01): 伺服端預檢被拒(零變更)之固定訊息, 動態細節只入 srLog
+    renameCascadeDupGroup: {
+        eng: `Not saved: a renamed item shares its old name with other existing items, so the references to it cannot be updated safely. Nothing was changed. Please delete or rename the duplicates first (save them separately), then rename it.`,
+        cht: `未儲存：被改名的項目與其他既有項目同名，無法安全地連帶更新引用。資料未變更。請先清理同名項目（分次儲存）後再改名。`,
+    },
+    renameCascadeNameInUse: {
+        eng: `Not saved: a new name is still referenced by settings of items that no longer exist, so the renamed item would take over those references. Nothing was changed. Please clean up the dangling references first, or choose another name.`,
+        cht: `未儲存：新名稱仍被已不存在之項目的授權設定引用，改名後會被這些引用接管。資料未變更。請先清理懸空引用，或改用其他名稱。`,
+    },
+    renameCascadeConflict: {
+        eng: `Not saved: a setting contains both the old and the new name, so its references cannot be updated automatically. Nothing was changed.`,
+        cht: `未儲存：有授權設定同時含有舊名稱與新名稱，無法自動更新引用。資料未變更。`,
+    },
+    renameCascadeUnsupported: {
+        eng: `Not saved: a setting that refers to the renamed or deleted item contains a value that cannot be safely rewritten (such as a non-finite number), so its references cannot be updated automatically. Nothing was changed. Please fix that setting first.`,
+        cht: `未儲存：引用此項目之授權設定含有無法安全改寫的內容（如非有限數值），無法自動更新引用。資料未變更，請先修正該授權設定。`,
+    },
+    saveCascadePartial: {
+        eng: `The related references may be out of sync with this change (the automatic restore failed). Please do not make further changes and contact the system administrator to run the reference audit.`,
+        cht: `相關的授權引用可能與本次變更不一致（自動還原失敗）。請勿再變更資料，並通知系統管理者執行引用稽核。`,
+    },
+    //F-23／F-26(外部列保護與過期快照; R-PRINCIPLE-00 原則 3、5; R-EXT-OWN-01、R-BASELINE-01, ADR-037): 後台整表寫入被拒(零變更)之固定訊息, 動態細節(來源、筆數、原因)只入 srLog
+    saveFromNotAllowed: {
+        eng: `Not saved: rows saved here must have an empty "From" value (rows with a source are managed by the external source). Nothing was changed.`,
+        cht: `未儲存：於此儲存之列其「來源」須為空白（有來源之列由外部來源管理）。資料未變更。`,
+    },
+    saveExternalRowChanged: {
+        eng: `Not saved: rows synchronized from an external source cannot be deleted here, and only their assignment settings can be changed. Nothing was changed. Please change them at the external source.`,
+        cht: `未儲存：由外部來源同步之列不可在此刪除，且僅能修改其授權指派設定。資料未變更，請至外部來源端處理。`,
+    },
+    saveStale: {
+        eng: `Not saved: the data changed (by someone else or by an external synchronization) after this page was loaded. Nothing was changed. Please reload the page and try again.`,
+        cht: `未儲存：載入此頁面後資料已被他人或外部同步更新。資料未變更，請重新整理頁面後再操作。`,
+    },
+    //R-PRINCIPLE-00 原則 7(多人同時編輯, 2026-10-22; ADR-037 Update run11): 有未存編輯時他人或外部同步改了本表 → 清單頁保留草稿並顯示 staleDraftNotice(附「重新載入」鈕 staleDraftReload);
+    //反向關聯對話框(開框後資料已被更新)顯示 staleDraftNoticeDialog. 存檔時由伺服端以表雜湊比對拒收, 訊息仍為 saveStale(不改其文字)
+    staleDraftNotice: {
+        eng: `The data was updated by someone else or by an external synchronization after you started editing. Your unsaved edits are kept here, but saving now will be rejected. Click "Reload" to get the latest data (your unsaved edits will be discarded).`,
+        cht: `資料已被他人或外部同步更新。您尚未儲存的編輯仍保留於此，但現在儲存將被拒絕。請按「重新載入」取得最新資料（未儲存的編輯將被捨棄）。`,
+    },
+    staleDraftReload: {
+        eng: `Reload`,
+        cht: `重新載入`,
+    },
+    staleDraftNoticeDialog: {
+        eng: `The data was updated by someone else or by an external synchronization after this window was opened. Saving from this window will be rejected. Please close this window and open it again to get the latest data.`,
+        cht: `資料已被他人或外部同步更新，本視窗內的資料已過期，儲存將被拒絕。請關閉本視窗後重新開啟，以取得最新資料。`,
+    },
+    saveBaselineRequired: {
+        eng: `Not saved: changing the assignment settings of rows synchronized from an external source requires the latest loaded data, which this request did not carry. Nothing was changed. Please reload the page and try again.`,
+        cht: `未儲存：修改外部來源同步列之授權指派設定須附載入時之資料版本，此次請求未附。資料未變更，請重新整理頁面後再操作。`,
+    },
     cannotGetUserId: {
         eng: `Cannot get the user id`,
         cht: `無法取得使用者 Id`,
@@ -196,6 +463,10 @@ let kpLang = {
         eng: `Cannot find the user in permission system`,
         cht: `無法於權限系統取得使用者`,
     },
+    ambiguousUserFromPerm: { //登入查找: 以對應鍵(mappingBy)查 perm users(isActive='y')命中多於 1 筆, 拒絕而不取首筆(規則帳本 R-MAPKEY-02, ADR-034); 訊息不含使用者之對應值
+        eng: `Cannot identify the user in permission system: more than one active user matches`,
+        cht: `無法於權限系統確認使用者：有多位有效使用者符合`,
+    },
     userNoPermission: {
         eng: `User does not have permission`,
         cht: `使用者權限不足`,

package/server/syncKeep.mjs

@@ -0,0 +1,239 @@
+//外部同步(WWebPerm.mjs:syncAndReplaceTabs)之三個純函數(F-23; R-PRINCIPLE-00 原則 3、5; 規則帳本 R-EXT-OWN-01; ADR-037), 不依賴 ORM／Vue, 供單元測試:
+//  keepAssignOnMissing: users 列「payload 缺 cgrups 鍵」時保留庫內指派(指派欄屬後台, Lv1; 含該鍵則以外部為準)——修正前 ltdtmapping 缺鍵補 ''、delAll＋insert 即清掉後台已指派之群組(run06 已知限制④);
+//  keepAssignByEntity: grups 列缺 cpemis 鍵、pemis 列缺 crules 鍵時同樣保留(run08; 同為後台可寫之指派欄)——群組／權限無登入對應鍵, 實體身分依 id(無 id 者依名稱), 見該函數說明;
+//  countIdRenumber: 同一 from 同一批內出現「同名異 id」(疑似外部 id 重編)之筆數, 供 warn log 與頁面提示(外部 id 不穩定時, id 消失＝刪除會每次清理引用而抹掉後台指派, 不加開關, 以提示處理)
+
+
+let isStr = (v) => typeof v === 'string'
+let isObj = (v) => v !== null && typeof v === 'object'
+let hasOwn = (o, k) => Object.prototype.hasOwnProperty.call(o, k)
+
+
+//toId: 列之 id 取字串形式(非空字串; 有限數字取其字串), 否則 null(同 refCascade.fillIdlessIds)
+let toId = (v) => {
+    let id = isObj(v) ? v.id : undefined
+    if (isStr(id) && id !== '') {
+        return id
+    }
+    return (typeof id === 'number' && Number.isFinite(id)) ? String(id) : null
+}
+
+
+/**
+ * 記錄 payload 各列是否自帶指定鍵(須於 ltdtmapping 補鍵之前呼叫; ltdtmapping 為 1:1 同序, 故可依索引對應)
+ *
+ * @param {Array} rowsRaw 輸入 payload 原始列(皆為物件)
+ * @param {String} key 輸入鍵名(如 'cgrups')
+ * @returns {Array} 回傳布林陣列, 第 k 項為第 k 列是否自帶該鍵(自有屬性)
+ */
+function markHasKey(rowsRaw, key) {
+    return rowsRaw.map((v) => isObj(v) && hasOwn(v, key))
+}
+
+
+/**
+ * users 列缺 cgrups 鍵者, 以庫內同一 from 之對應列之值取代(對應: 先依 id; 無 id 者在 mappingBy 為 email／name 時依該欄位, 須恰命中 1 筆; 對不到則不保留, 即新使用者/無從對應者維持 '')
+ *
+ * @param {Object} p 輸入參數物件
+ * @param {Array} p.rows 輸入已 ltdtmapping 並帶 from 之本批列
+ * @param {Array} p.hasKey 輸入 markHasKey 之結果(與 rows 同序同長)
+ * @param {Array} p.rowsOldSameFrom 輸入庫內同一 from 之既有 users 列
+ * @param {String} [p.mappingBy='id'] 輸入使用者對應鍵('id'｜'email'｜'name')
+ * @param {String} [p.key='cgrups'] 輸入指派欄名稱
+ * @param {Function} [p.isKeepable] 輸入判斷庫內值是否可保留之函數(收庫內值, 回布林), 預設恆可; 不可保留者(如無法原樣通過寫入前驗證)不保留並計入 nSkip
+ * @returns {Object} 回傳 { rows, nKeep, nSkip, nConflict }: rows 為新陣列(被保留值之列為複本, 其餘同一參考), nKeep 為保留筆數, nSkip 為因 isKeepable 為假而未保留之筆數,
+ *   nConflict 為因身分矛盾而未保留之筆數;
+ *   mappingBy 為 email／name 時, 以 id 對到之舊列其對應鍵值須與本批列相同、且庫內同一來源不得另有別列持有同值(舊登入擁有者矛盾), 否則不保留(同來源 id 重用／重編之矛盾)
+ */
+function keepAssignOnMissing({ rows, hasKey, rowsOldSameFrom, mappingBy = 'id', key = 'cgrups', isKeepable = () => true }) {
+    let oldById = new Map()
+    let oldByMap = new Map() //mappingBy 欄位值 → 同值之既有列陣列
+    rowsOldSameFrom.forEach((o) => {
+        if (!isObj(o)) {
+            return
+        }
+        if (isStr(o.id)) {
+            oldById.set(o.id, o)
+        }
+        if ((mappingBy === 'email' || mappingBy === 'name') && isStr(o[mappingBy]) && o[mappingBy] !== '') {
+            if (!oldByMap.has(o[mappingBy])) {
+                oldByMap.set(o[mappingBy], [])
+            }
+            oldByMap.get(o[mappingBy]).push(o)
+        }
+    })
+    let byMap = mappingBy === 'email' || mappingBy === 'name'
+    let nKeep = 0
+    let nSkip = 0
+    let nConflict = 0
+    let out = rows.map((v, k) => {
+        if (hasKey[k] === true || !isObj(v)) {
+            return v
+        }
+        let id = toId(v)
+        let o = null
+        if (id !== null) {
+            o = oldById.has(id) ? oldById.get(id) : null
+
+            //對應鍵矛盾(外審 sol R3): mappingBy 為 email／name 時, 登入以對應鍵找使用者; 本批列以 id 對到之舊列, 其對應鍵值須與本批列相同, 否則為同來源 id 重用／重編(id 指向 A、對應鍵卻是 B),
+            //自動把 A 之後台指派移轉給 B 屬靜默擇一(R-PRINCIPLE-00 原則 3), 一律不保留(cgrups 維持空字串, 收嚴); 不保留者計入 nConflict 供呼叫端提示(原則 3: 收嚴須附提示, 增量外審 N2)
+            if (o !== null && byMap && (v[mappingBy] === undefined ? '' : v[mappingBy]) !== (o[mappingBy] === undefined ? '' : o[mappingBy])) {
+                o = null
+                nConflict++
+            }
+
+            //舊登入擁有者矛盾(增量外審 N1): 對應鍵值非空時, 庫內同一來源須只有該列自己持有此值; 若另有別列(如舊 active 擁有者為另一個 id, 本列為停用列被本批改為啟用)持有同值,
+            //登入查找(以對應鍵＋isActive)原指向別列, 保留本列之指派會使該登入值改取得本列之授權(移轉), 同樣不保留
+            if (o !== null && byMap && isStr(v[mappingBy]) && v[mappingBy] !== '') {
+                let cands = oldByMap.get(v[mappingBy])
+                if (cands !== undefined && cands.some((c) => c !== o)) {
+                    o = null
+                    nConflict++
+                }
+            }
+        }
+        else if (byMap && isStr(v[mappingBy]) && v[mappingBy] !== '') {
+            let cands = oldByMap.get(v[mappingBy])
+            o = (cands !== undefined && cands.length === 1) ? cands[0] : null
+
+            //對應鍵命中多筆(如同值之啟用與停用列)無從判定歸屬, 不取首筆而不保留; 須附提示, 計入 nConflict(收嚴＋提示, run08 外審 sol #3; 與 keepAssignByEntity 之無 id 同名多筆一致)
+            if (cands !== undefined && cands.length > 1) {
+                nConflict++
+            }
+        }
+        if (o === null || !hasOwn(o, key)) {
+            return v
+        }
+
+        //保留值須能通過與外部寫入同一套寫入前驗證(外審 sol R4): 保留之歷史值若含會被 clearXSS 改寫之標記或非純量, 入庫時被改寫而使引用改指他名(增權), 一律不保留(視為空, 收嚴)
+        if (!isKeepable(o[key])) {
+            nSkip++
+            return v
+        }
+        nKeep++
+        return { ...v, [key]: o[key] }
+    })
+    return { rows: out, nKeep, nSkip, nConflict }
+}
+
+
+/**
+ * grups 列缺 cpemis 鍵、pemis 列缺 crules 鍵者, 以庫內同一 from 之同一實體之值取代(run08; 與 keepAssignOnMissing 同一精神: 指派欄屬後台, 同步不得靜默清掉; 含該鍵則以外部為準)
+ *
+ * 實體身分(群組／權限無登入對應鍵, 不適用 mappingBy 之矛盾檢查): 有 id 者依 id 對到庫內同一 from 之列; 無 id 者(寫入時 ORM 補隨機主鍵, 身分不穩定)依名稱, 與引用連帶(refCascade.fillIdlessIds)同一口徑:
+ * 對庫內同一 from 中 id 未被本批帶用、名稱相同之列, 須恰 1 筆(同名多筆為歷史同名, 不取首筆); 對不到者視為新實體, 維持缺鍵之預設('').
+ * 收嚴(原則 3, 不保留並計入 nConflict, 供呼叫端記 warn): ①無 id 而同名命中多筆; ②同 id 但名稱不同(改名)且 cascadeRename 為假——引用不跟著改時名稱即授權身分,
+ * 把舊名之指派移轉給新名, 會使原引用新名之使用者(懸空)取得該授權; ③同 id 改名而新舊名稱有一方非字串(歷史資料)——級聯無從處理(缺欄視 '', 同 refCascade.entName), 保留同樣會增權(run08 外審 sol #1).
+ *
+ * @param {Object} p 輸入參數物件
+ * @param {Array} p.rows 輸入已 ltdtmapping 並帶 from 之本批列
+ * @param {Array} p.hasKey 輸入 markHasKey 之結果(與 rows 同序同長)
+ * @param {Array} p.rowsOldSameFrom 輸入庫內同一 from 之既有列
+ * @param {String} p.key 輸入指派欄名稱('cpemis'｜'crules')
+ * @param {Boolean} [p.cascadeRename=true] 輸入改名是否連帶更新引用(opt.cascadeRename), 預設 true
+ * @param {Function} [p.isKeepable] 輸入判斷庫內值是否可保留之函數(收庫內值, 回布林), 預設恆可; 不可保留者不保留並計入 nSkip
+ * @returns {Object} 回傳 { rows, nKeep, nSkip, nConflict }: rows 為新陣列(被保留值之列為複本, 其餘同一參考), nKeep 為保留筆數, nSkip 為因 isKeepable 為假而未保留之筆數, nConflict 為因身分不確定而未保留之筆數
+ */
+function keepAssignByEntity({ rows, hasKey, rowsOldSameFrom, key, cascadeRename = true, isKeepable = () => true }) {
+    let nameOf = (r) => (r.name === undefined ? '' : r.name) //同 refCascade.entName: 缺欄視 ''
+    let idsBatch = new Set()
+    rows.forEach((v) => {
+        let id = toId(v)
+        if (id !== null) {
+            idsBatch.add(id)
+        }
+    })
+    let oldById = new Map()
+    let oldByName = new Map() //名稱 → 本批未帶用其 id 之既有列陣列(無 id 者之對應池)
+    rowsOldSameFrom.forEach((o) => {
+        if (!isObj(o) || !isStr(o.id)) {
+            return
+        }
+        oldById.set(o.id, o)
+        if (isStr(o.name) && !idsBatch.has(o.id)) {
+            if (!oldByName.has(o.name)) {
+                oldByName.set(o.name, [])
+            }
+            oldByName.get(o.name).push(o)
+        }
+    })
+    let nKeep = 0
+    let nSkip = 0
+    let nConflict = 0
+    let out = rows.map((v, k) => {
+        if (hasKey[k] === true || !isObj(v)) {
+            return v
+        }
+        let id = toId(v)
+        let o = null
+        if (id !== null) {
+            o = oldById.has(id) ? oldById.get(id) : null
+
+            //改名(同 id 異名)須「引用跟著改」才算同一實體: cascadeRename 為假時引用不跟著改; 為真時級聯只處理新舊名稱皆為字串之改名(refCascade.diffRefTargets: 缺欄視 '', 非字串不成實體),
+            //舊名稱為歷史非字串者無從級聯, 新名稱撞懸空名之檢查(renameCascadeNameInUse)亦不會觸發, 保留會把舊列之指派帶給原指向新名之懸空引用者, 同樣不保留(run08 外審 sol #1)
+            if (o !== null && nameOf(o) !== nameOf(v) && (cascadeRename === false || !isStr(nameOf(o)) || !isStr(nameOf(v)))) {
+                o = null
+                nConflict++
+            }
+        }
+        else if (isStr(v.name) && oldByName.has(v.name)) {
+            let cands = oldByName.get(v.name)
+            if (cands.length === 1) {
+                o = cands[0]
+            }
+            else {
+                nConflict++
+            }
+        }
+        if (o === null || !hasOwn(o, key)) {
+            return v
+        }
+
+        //保留值須能通過與外部寫入同一套寫入前驗證(同 keepAssignOnMissing): 不通過者不保留(視為空, 收嚴)
+        if (!isKeepable(o[key])) {
+            nSkip++
+            return v
+        }
+        nKeep++
+        return { ...v, [key]: o[key] }
+    })
+    return { rows: out, nKeep, nSkip, nConflict }
+}
+
+
+/**
+ * 同一 from 同一批內「同名異 id」之筆數(疑似外部 id 重編): 本批列帶 id 與其名稱, 而庫內同一 from 有另一列同名、不同 id、且該舊 id 不在本批
+ *
+ * @param {Array} rowsOldSameFrom 輸入庫內同一 from 之既有列(grups／pemis; users 之 name 可重複故不適用)
+ * @param {Array} rows 輸入本批列(帶 id 者才計)
+ * @returns {Number} 回傳筆數
+ */
+function countIdRenumber(rowsOldSameFrom, rows) {
+    let idsBatch = new Set()
+    rows.forEach((v) => {
+        let id = toId(v)
+        if (id !== null) {
+            idsBatch.add(id)
+        }
+    })
+    let oldByName = new Map() //名稱 → 本批未沿用之舊 id 集合
+    rowsOldSameFrom.forEach((o) => {
+        if (isObj(o) && isStr(o.id) && isStr(o.name) && !idsBatch.has(o.id)) {
+            if (!oldByName.has(o.name)) {
+                oldByName.set(o.name, new Set())
+            }
+            oldByName.get(o.name).add(o.id)
+        }
+    })
+    let n = 0
+    rows.forEach((v) => {
+        let id = toId(v)
+        if (id !== null && isObj(v) && isStr(v.name) && oldByName.has(v.name)) {
+            n++
+        }
+    })
+    return n
+}
+
+
+export { markHasKey, keepAssignOnMissing, keepAssignByEntity, countIdRenumber }