weaver-e10-builder 1.6.13 → 1.6.15

package/dist/commands/form-permission.js

@@ -1,8 +1,10 @@
+import { readFileSync } from 'node:fs';
 import { AuthSession } from '../core/auth.js';
 import { ApiClient } from '../core/client.js';
 import { resolveFormId } from '../services/form-id.js';
 import { ARCHIVE_ORG_TYPES, ARCHIVE_TARGETS, ARCHIVE_TARGET_ALIASES, FIELD_ORG_TYPE_LABELS, archiveFileRightsIncludeView, archiveRightsIncludeView, archiveRowKey, buildArchiveRow, buildMatrixValueRelation, ebFormValueFields, matrixValueFields, normalizeArchiveRow, parseArchiveFileRights, parseArchiveRights, resolveFieldOrgType, verifyArchiveRow, } from '../services/form-permission-archive.js';
 import { MATRIX_COND_FUNC_HINT, buildMatrixConditionData, ebFormCondColumns, matrixCondColumns, parseMatrixConditionArgs, pickCondFields, } from '../services/matrix-condition.js';
+import { PERMISSION_CODE_TYPES, PERMISSION_ORG_TYPES, PERMISSION_TARGETS, PERMISSION_TARGET_ALIASES, addPermissionRow, applyPermissionSettings, buildPermissionRow, buildSyncPermissionList, findRightRow, matrixValueCandidates, parseOnOff, parsePermissionFileRights, parsePermissionRights, permissionRightLabels, normalizeFileRightType, readPermissionDetail, resolvePermissionEbForm, resolvePermissionField, resolvePermissionMatrix, targetOfCodeType, updatePermissionDetail, verifyAddedRow, } from '../services/form-permission-edit.js';
 import { fetchFields } from './form-list-utils.js';
 /**
  * Form permission management.
@@ -41,6 +43,7 @@ const RIGHT_TYPES = {
     '1': '查看',
     '2': '编辑',
     '3': '删除',
+    '4': '评论',
     '5': '归档查看',
     '6': '归档编辑',
     '7': '归档删除',
@@ -48,11 +51,6 @@ const RIGHT_TYPES = {
     '9': '数据导入',
     '93': '删除导入数据',
 };
-const DATA_RIGHT_ALIASES = {
-    '1': '1', view: '1', read: '1',
-    '2': '2', edit: '2', update: '2',
-    '3': '3', delete: '3', remove: '3',
-};
 // 导入导出权限（codeType=data_imp_exp，独立分类——不在共享 dataRightList 里）：
 // rightType 8=导出、9=导入(追加)、93=删除导入数据；93 必须与 9 同选（只勾"删除导入数据"平台语义为更新导入的一部分）。
 // importType "0,1"：0=追加导入、1=更新导入（勾 93 时须带 1）。
@@ -61,10 +59,6 @@ const IMP_EXP_RIGHT_ALIASES = {
     '9': '9', import: '9',
     '93': '93', 'delete-import': '93', 'del-import': '93',
 };
-const FILE_RIGHT_ALIASES = {
-    '401': '401', view: '401', read: '401',
-    '402': '402', download: '402',
-};
 function parseRightValues(values, aliases, label) {
     const tokens = values.flatMap((value) => value.split(',')).map((value) => value.trim().toLowerCase()).filter(Boolean);
     const invalid = tokens.filter((value) => !aliases[value]);
@@ -73,7 +67,112 @@ function parseRightValues(values, aliases, label) {
     return [...new Set(tokens.map((value) => aliases[value]))].sort((a, b) => Number(a) - Number(b)).join(',');
 }
 function rightTypeLabel(value) {
-    return String(value).split(',').map((item) => RIGHT_TYPES[item] || item).join('、');
+    return String(value).split(',').map((v) => v.trim()).filter(Boolean)
+        .sort((a, b) => Number(a) - Number(b))
+        .map((item) => RIGHT_TYPES[item] || item).join('、');
+}
+/** 解析 JSON 参数；`@file` 读文件。 */
+function jsonArg(value, label) {
+    if (value === undefined)
+        return undefined;
+    let text = String(value);
+    if (text.startsWith('@'))
+        text = readFileSync(text.slice(1), 'utf-8');
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error(`${label} 不是合法 JSON`);
+    }
+}
+/** 取已注册的子命令（commander 重复调用 .command(name) 会抛错）。 */
+function subCommand(parent, name) {
+    const found = parent.commands.find((cmd) => cmd.name() === name);
+    if (!found)
+        throw new Error(`内部错误: 找不到子命令 ${name}`);
+    return found;
+}
+/** 权限「通用设置」选项（创建/共享权限共用）。 */
+function addPermissionSettingOptions(cmd) {
+    return cmd
+        .option('--same-layout <on|off>', 'PC移动统一布局（开=移动端沿用 PC 布局）')
+        .option('--layout <layoutId>', '关联 PC 布局 ID')
+        .option('--edit-layout <layoutId>', '编辑布局 ID')
+        .option('--mobile-layout <layoutId>', '关联移动布局 ID')
+        .option('--mobile-edit-layout <layoutId>', '移动端编辑布局 ID')
+        .option('--layout-order <n>', '布局优先级（0 最高）')
+        .option('--desc <text>', '权限描述')
+        .option('--desc-label-id <id>', '权限描述的多语言标签 ID（纯文本描述留空）')
+        .option('--condition <json>', '权限条件（条件树 JSON，或 @文件）')
+        .option('--clear-condition', '清空权限条件')
+        .option('--org-virtual-type <type>', '组织维度类型')
+        .option('--contain-extra <on|off>', '含兼职人员（岗位/角色等授权时）')
+        .option('--min-seclevel <n>', '最小安全级别（0~100）')
+        .option('--max-seclevel <n>', '最大安全级别（0~100）')
+        .option('--exclude-obj <json>', '排除项（排除对象 JSON，或 @文件）')
+        .option('--sync-forms <objId...>', '同步至其他表单（表单 objId，可多个）');
+}
+/** 从 commander 的 raw 选项收集设置；未传的键不出现在结果里。 */
+function collectPermissionSettings(raw) {
+    const settings = {};
+    if (raw.layout !== undefined)
+        settings.layoutId = raw.layout;
+    if (raw.editLayout !== undefined)
+        settings.editLayoutId = raw.editLayout;
+    if (raw.mobileLayout !== undefined)
+        settings.mobileLayoutId = raw.mobileLayout;
+    if (raw.mobileEditLayout !== undefined)
+        settings.mobileEditLayoutId = raw.mobileEditLayout;
+    if (raw.sameLayout !== undefined)
+        settings.sameLayout = raw.sameLayout;
+    if (raw.layoutOrder !== undefined)
+        settings.layoutOrder = raw.layoutOrder;
+    if (raw.desc !== undefined)
+        settings.desc = raw.desc;
+    if (raw.descLabelId !== undefined)
+        settings.descLabelId = raw.descLabelId;
+    if (raw.condition !== undefined) {
+        const text = String(raw.condition);
+        settings.condition = text.startsWith('@') ? readFileSync(text.slice(1), 'utf-8') : text;
+    }
+    if (raw.clearCondition)
+        settings.clearCondition = '1';
+    if (raw.orgVirtualType !== undefined)
+        settings.orgVirtualType = raw.orgVirtualType;
+    if (raw.containExtra !== undefined)
+        settings.containExtra = raw.containExtra;
+    if (raw.minSeclevel !== undefined)
+        settings.minShowlevel = raw.minSeclevel;
+    if (raw.maxSeclevel !== undefined)
+        settings.maxShowlevel = raw.maxSeclevel;
+    if (raw.excludeObj !== undefined) {
+        const text = String(raw.excludeObj);
+        settings.excludeObj = text.startsWith('@') ? readFileSync(text.slice(1), 'utf-8') : text;
+    }
+    return settings;
+}
+function resolveTarget(value) {
+    const raw = String(value ?? 'general').trim();
+    const target = PERMISSION_TARGET_ALIASES[raw] ?? PERMISSION_TARGET_ALIASES[raw.toLowerCase()];
+    if (!target)
+        throw new Error(`不支持的 --target: ${raw}，可选: ${Object.keys(PERMISSION_TARGETS).join(' / ')}`);
+    return target;
+}
+function normalizeExportFieldRange(value) {
+    const v = String(value).trim();
+    if (v === 'all' || v === 'allField')
+        return 'allField';
+    if (v === 'listShowField')
+        return 'listShowField';
+    throw new Error('--export-field-range 只支持 listShowField（列表显示字段）/ allField（全部字段）');
+}
+function requireOrgId(orgType, orgId) {
+    if (orgType === 'all' || orgType === 'externalAll')
+        return '0';
+    const id = String(orgId ?? '').trim();
+    if (!id)
+        throw new Error(`--org-type ${orgType} 需要 --org-id（组织对象的 ID）`);
+    return id;
 }
 export function registerFormPermissionCommands(form, program) {
     const permCmd = form.command('permission').description('表单权限管理（增删查）');
@@ -123,63 +222,460 @@ export function registerFormPermissionCommands(form, program) {
         console.log(`\n共 ${total} 条权限`);
     });
     // ─── ADD ────────────────────────────────────────────────
-    const dataCmd = permCmd.command('data').description('表单数据权限（查看/编辑/删除，可组合）');
+    const dataCmd = permCmd.command('data').description('表单数据权限（共享权限：通用对象 / 创建人 / 字段 / 矩阵 / 政务单位）');
+    /**
+     * 解析授权对象，产出写进 permission 的字段补丁。
+     *
+     * `baseCodeType` 用于「通用对象」：创建权限是 obj、共享权限是 obj_data_admin；
+     * 改已有行时传入原 codeType，避免 update 把创建权限改成共享权限。
+     */
+    async function resolveTargetPatch(client, baseUrl, appId, objId, raw, mode, baseCodeType) {
+        const target = resolveTarget(raw.target);
+        if (mode === 'create' && target !== 'general') {
+            throw new Error('创建权限只支持通用对象；创建人/字段/矩阵/政务单位相关请用 `form permission data`');
+        }
+        switch (target) {
+            case 'general': {
+                const orgType = String(raw.orgType ?? '');
+                if (!PERMISSION_ORG_TYPES[orgType]) {
+                    throw new Error(`不支持的 --org-type: ${orgType || '(空)'}，可选: ${Object.keys(PERMISSION_ORG_TYPES).join(' / ')}`);
+                }
+                const orgId = requireOrgId(orgType, raw.orgId);
+                if (raw.creatorRelated !== undefined && !/^[0-7]$/.test(String(raw.creatorRelated))) {
+                    throw new Error('--creator-related 需是 0~7');
+                }
+                return {
+                    target,
+                    patch: {
+                        codeType: baseCodeType || (mode === 'create' ? PERMISSION_CODE_TYPES.create : PERMISSION_CODE_TYPES.share),
+                        orgType, orgId,
+                        orgName: raw.orgName || PERMISSION_ORG_TYPES[orgType],
+                        orgTypeName: PERMISSION_ORG_TYPES[orgType],
+                        ...(raw.creatorRelated !== undefined ? { creatorRelated: String(raw.creatorRelated) } : {}),
+                    },
+                };
+            }
+            case 'creator': {
+                const level = String(raw.creatorRelated ?? '0');
+                if (!/^[0-7]$/.test(level))
+                    throw new Error('--creator-related 需是 0~7');
+                return {
+                    target,
+                    patch: {
+                        codeType: PERMISSION_CODE_TYPES.creator, orgType: 'creatorRelated', orgId: '',
+                        orgName: '', orgTypeName: PERMISSION_TARGETS.creator, creatorRelated: level,
+                    },
+                };
+            }
+            case 'field': {
+                if (!raw.field)
+                    throw new Error('--target field 需要 --field（字段 id 或字段名）');
+                const record = await resolvePermissionField(client, baseUrl, appId, objId, String(raw.field), raw.subFormId);
+                const explicit = String(raw.orgType ?? '');
+                let mapped;
+                if (explicit) {
+                    if (!FIELD_ORG_TYPE_LABELS[explicit]) {
+                        throw new Error(`未知的字段相关类型: ${explicit}，可选: ${Object.keys(FIELD_ORG_TYPE_LABELS).join(' / ')}`);
+                    }
+                    mapped = { orgType: explicit, label: FIELD_ORG_TYPE_LABELS[explicit] };
+                }
+                else {
+                    mapped = resolveFieldOrgType(record.type, record.title);
+                }
+                return {
+                    target,
+                    patch: {
+                        codeType: PERMISSION_CODE_TYPES.field, orgType: mapped.orgType, orgId: record.fieldId,
+                        orgName: record.title, orgTypeName: mapped.label, creatorRelated: String(raw.creatorRelated ?? '0'),
+                    },
+                };
+            }
+            case 'matrix': {
+                const useEbForm = Boolean(raw.ebForm);
+                const spec = String(raw.ebForm ?? raw.matrix ?? '');
+                if (!spec)
+                    throw new Error('--target matrix 需要 --matrix（真矩阵）或 --eb-form（e-Builder 表单）');
+                const source = useEbForm
+                    ? await resolvePermissionEbForm(client, baseUrl, appId, spec)
+                    : await resolvePermissionMatrix(client, baseUrl, appId, spec);
+                let relation;
+                if (raw.matrixValueRaw) {
+                    const parsed = jsonArg(String(raw.matrixValueRaw), '--matrix-value-raw');
+                    if (!Array.isArray(parsed) || !parsed.length)
+                        throw new Error('--matrix-value-raw 需是非空 JSON 数组');
+                    relation = buildMatrixValueRelation(parsed.map((v) => ({
+                        valueId: String(v?.valueId ?? ''), valueName: String(v?.valueName ?? ''), valueType: String(v?.valueType ?? ''),
+                    })));
+                }
+                else {
+                    const candidates = await matrixValueCandidates(client, baseUrl, appId, source);
+                    const fallback = useEbForm
+                        ? (candidates.find((c) => c.valueType === 'system_creator') ?? candidates[0])
+                        : candidates[0];
+                    const tokens = raw.matrixValue?.length ? raw.matrixValue : (fallback ? [fallback.valueName] : []);
+                    if (!tokens.length)
+                        throw new Error('该来源没有可用取值字段，请用 --matrix-value-raw 明写');
+                    relation = buildMatrixValueRelation(tokens.map((t) => parseMatrixValueToken(t, candidates)));
+                }
+                let matrixConditionData = '';
+                if (raw.matrixConditionRaw !== undefined) {
+                    const parsed = jsonArg(String(raw.matrixConditionRaw), '--matrix-condition-raw');
+                    matrixConditionData = typeof parsed === 'string' ? parsed : JSON.stringify(parsed);
+                }
+                return {
+                    target,
+                    patch: {
+                        codeType: source.codeType, orgType: source.codeType, orgId: source.id,
+                        orgName: source.name, orgTypeName: source.orgTypeName,
+                        matrixValueRelation: relation, matrixConditionData,
+                    },
+                };
+            }
+            case 'govern': {
+                if (!raw.governJson)
+                    throw new Error('--target govern 需要 --govern-json（政务单位关系 JSON）');
+                const parsed = jsonArg(String(raw.governJson), '--govern-json');
+                if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                    throw new Error('--govern-json 需要是 JSON 对象');
+                }
+                return {
+                    target,
+                    patch: {
+                        codeType: PERMISSION_CODE_TYPES.govern, orgType: 'govern', orgId: '1',
+                        orgName: '', orgTypeName: PERMISSION_TARGETS.govern,
+                        governDataRelation: JSON.stringify(parsed),
+                    },
+                };
+            }
+        }
+    }
+    function printPermission(result, raw, json) {
+        const label = result.rights || permissionRightLabels(result.rightType);
+        if (json) {
+            console.log(JSON.stringify({ success: true, changed: true, ...result }, null, 2));
+            return;
+        }
+        console.log(`${result.action || '权限'}已保存: [${result.id}] ${result.subject || result.orgName || ''} ${label}`);
+        if (result.fileRight)
+            console.log(`  附件权限: ${result.fileRight}`);
+        if (result.syncCount !== undefined)
+            console.log(`  同步至其他表单: ${result.syncCount} 个`);
+        if (result.needsRebuild) {
+            console.error(`  注意: 该权限需要重构，执行: e10-cli form permission rebuild ${raw.objId} ${raw.appId} ${result.id}`);
+        }
+    }
     dataCmd.command('add')
-        .description('添加组合数据权限并回读')
+        .description('添加共享权限（通用对象 / 创建人相关 / 字段相关 / 矩阵相关 / 政务单位相关）并回读')
         .argument('<objId>', '表单 objId')
         .argument('<appId>', '应用 ID')
-        .requiredOption('--org-type <type>', `授权对象类型: ${Object.keys(ORG_TYPES).join(' / ')}`)
-        .option('--org-id <id>', '授权对象 ID（all 类型时自动为 0）')
-        .option('--org-name <name>', '授权对象名称（all 类型时自动为 所有人）', '')
-        .requiredOption('--rights <rights...>', '数据权限，可组合: view/edit/delete 或 1/2/3')
-        .option('--file-rights <rights...>', '附件权限，可组合: view/download 或 401/402')
-        .option('--creator-related <level>', '权限关系: 0 本人 / 1 上级 / 5 本岗位', '0')
-        .action(async (objId, appId, cmdOpts) => {
+        .option('--target <type>', `授权对象类别: ${Object.keys(PERMISSION_TARGETS).join(' / ')}`, 'general')
+        .option('--org-type <type>', `通用对象类型: ${Object.keys(PERMISSION_ORG_TYPES).join(' / ')}`)
+        .option('--org-id <id>', '授权对象 ID（all / externalAll 自动为 0）')
+        .option('--org-name <name>', '授权对象名称（缺省用类型名）')
+        .requiredOption('--rights <rights...>', '数据权限，可组合: view/edit/delete/comment 或 1/2/3/4')
+        .option('--file-rights <rights...>', '附件权限，可组合: view/download/edit 或 401/402/403')
+        .option('--file-right-type <type>', '附件赋权类型: temporary 临时赋权 / insert 插入赋权', 'temporary')
+        .option('--creator-related <level>', '创建人关系: 0~7（--target creator 用）', '0')
+        .option('--field <fieldIdOrName>', '字段相关：字段 id 或字段名')
+        .option('--sub-form-id <id>', '字段相关：明细字段所属子表 id')
+        .option('--matrix <idOrName>', '矩阵相关：矩阵 id 或名称')
+        .option('--eb-form <idOrName>', '矩阵相关：e-Builder 表单 id 或名称')
+        .option('--matrix-value <spec...>', '矩阵相关：取值字段（名称或 id:名称:valueType）')
+        .option('--matrix-value-raw <json>', '矩阵相关：取值字段原始 JSON 数组')
+        .option('--matrix-condition-raw <json>', '矩阵相关：条件树原始 JSON')
+        .option('--govern-json <json>', '政务单位相关：governDataRelation JSON')
+        .action(async (objId, appId, raw) => {
         try {
             const opts = program.opts();
             const auth = await AuthSession.fromOptions(opts);
             if (!auth)
                 throw new Error('无法加载认证');
-            if (!ORG_TYPES[cmdOpts.orgType])
-                throw new Error(`不支持的 --org-type: ${cmdOpts.orgType}`);
-            const orgId = cmdOpts.orgType === 'all' ? '0' : (cmdOpts.orgId || '');
-            if (cmdOpts.orgType !== 'all' && !orgId)
-                throw new Error('--org-id 不能为空（all 类型除外）');
-            const orgName = cmdOpts.orgName || ORG_TYPES[cmdOpts.orgType];
-            const rightType = parseRightValues(cmdOpts.rights, DATA_RIGHT_ALIASES, '数据权限');
-            const fileRight = cmdOpts.fileRights?.length
-                ? parseRightValues(cmdOpts.fileRights, FILE_RIGHT_ALIASES, '附件权限') : '';
             const client = new ApiClient(auth);
             const baseUrl = auth.getBaseUrl();
-            const perm = {
-                belong: 'obj', belongId: objId, codeType: 'obj_data_admin', rightType,
-                orgType: cmdOpts.orgType, orgId, orgName, orgTypeName: ORG_TYPES[cmdOpts.orgType],
-                layoutOrder: 0, isPcMobileSameLayout: '0', creatorRelated: cmdOpts.creatorRelated,
-                orgVirtualType: '', excludeObj: '', exportDetails: 0,
-                ...(fileRight ? { fileRight, fileRightType: 'temporary' } : {}),
-            };
-            const added = await client.post(`${baseUrl}/api/bs/ebuilder/form/permission/addRight?objId=${objId}&apid=${appId}`, [perm], { ebbusinessid: appId });
-            if (added?.code !== 200 || !added?.status)
-                throw new Error(added?.msg || '添加失败');
-            const id = String(added?.data?.[0]?.id || '');
-            if (!id)
-                throw new Error('添加响应未返回权限 ID');
-            const listed = await client.get(`${baseUrl}/api/bs/ebuilder/form/permission/getRightList?objId=${objId}&apid=${appId}&belongId=${objId}&type=dataRight`, { ebbusinessid: appId });
-            if (listed?.code !== 200 || !listed?.status)
-                throw new Error(listed?.msg || '权限回读失败');
-            const saved = (listed?.data?.rightList?.dataRightList || []).find((item) => String(item.id) === id);
-            if (!saved || String(saved.rightType) !== rightType || String(saved.orgType) !== cmdOpts.orgType
-                || (fileRight && String(saved.fileRight || '') !== fileRight))
-                throw new Error('数据权限保存后回读不一致');
-            const result = { id, orgType: cmdOpts.orgType, orgId, orgName, rightType, rights: rightTypeLabel(rightType), fileRight };
-            console.log(opts.json ? JSON.stringify({ success: true, ...result }, null, 2)
-                : `数据权限已添加: [${id}] ${orgName} ${result.rights}${fileRight ? `；附件=${fileRight}` : ''}`);
-            if (added?.data?.[0]?.isShowRebuild === 2) {
-                console.error(`  注意: 该权限需要重构，执行: e10-cli form permission rebuild ${objId} ${appId} ${id}`);
+            const { target, patch } = await resolveTargetPatch(client, baseUrl, appId, objId, raw, 'share');
+            const rightType = parsePermissionRights(raw.rights, 'share');
+            const fileRight = raw.fileRights?.length ? parsePermissionFileRights(raw.fileRights) : '401,402';
+            const fileRightType = normalizeFileRightType(raw.fileRightType || 'temporary');
+            const row = buildPermissionRow({
+                objId, appId, mode: 'share', target, rightType, fileRight, fileRightType, ...patch,
+            });
+            applyPermissionSettings(row, collectPermissionSettings(raw));
+            const id = await addPermissionRow(client, baseUrl, appId, objId, row);
+            await verifyAddedRow(client, baseUrl, appId, objId, id, row);
+            let syncCount;
+            if (raw.syncForms?.length) {
+                const detail = await readPermissionDetail(client, baseUrl, appId, objId, id);
+                const after = await updatePermissionDetail(client, baseUrl, appId, objId, { ...detail.permission, id }, buildSyncPermissionList(raw.syncForms));
+                syncCount = after.syncPermissionList.length;
             }
+            const subject = row.orgName || row.orgTypeName || '';
+            printPermission({
+                action: '共享权限', id, target, orgType: row.orgType, orgId: row.orgId, orgName: row.orgName,
+                subject, rightType, rights: permissionRightLabels(rightType), fileRight,
+                ...(syncCount !== undefined ? { syncCount } : {}),
+            }, { objId, appId }, Boolean(opts.json));
         }
         catch (error) {
-            console.error(`添加数据权限失败: ${error.message}`);
+            console.error(`添加共享权限失败: ${error.message}`);
+            process.exitCode = 1;
+        }
+    });
+    addPermissionSettingOptions(subCommand(dataCmd, 'add'));
+    async function runDataUpdate(mode, objId, appId, raw) {
+        const opts = program.opts();
+        const auth = await AuthSession.fromOptions(opts);
+        if (!auth)
+            throw new Error('无法加载认证');
+        const client = new ApiClient(auth);
+        const baseUrl = auth.getBaseUrl();
+        const rightId = String(raw.rightId);
+        const located = await findRightRow(client, baseUrl, appId, objId, rightId);
+        if (mode === 'share' && located.bucket !== 'share') {
+            throw new Error(`权限 ${rightId} 是创建权限，请用 form permission create update`);
+        }
+        if (mode === 'create' && located.bucket !== 'create') {
+            throw new Error(`权限 ${rightId} 是共享权限，请用 form permission data update`);
+        }
+        const detail = await readPermissionDetail(client, baseUrl, appId, objId, rightId);
+        const permission = { ...detail.permission };
+        const changed = [];
+        const touchesTarget = ['target', 'orgType', 'orgId', 'orgName', 'field', 'subFormId',
+            'matrix', 'ebForm', 'matrixValue', 'matrixValueRaw', 'matrixConditionRaw', 'governJson']
+            .some((key) => raw[key] !== undefined);
+        if (touchesTarget) {
+            const target = raw.target ? resolveTarget(raw.target) : targetOfCodeType(permission.codeType);
+            const { patch } = await resolveTargetPatch(client, baseUrl, appId, objId, { ...raw, target }, mode, target === 'general' ? String(permission.codeType) : undefined);
+            Object.assign(permission, patch);
+            // orgName/orgTypeName 只是回显名，getPermissionAndSyncList 不回传；实际值以 getRightList 为准
+            changed.push(...Object.keys(patch).filter((key) => key !== 'orgName' && key !== 'orgTypeName'));
+        }
+        if (raw.creatorRelated !== undefined && !touchesTarget) {
+            const level = String(raw.creatorRelated);
+            if (!/^[0-7]$/.test(level))
+                throw new Error('--creator-related 需是 0~7');
+            permission.creatorRelated = level;
+            changed.push('creatorRelated');
+        }
+        if (raw.rights?.length) {
+            permission.rightType = parsePermissionRights(raw.rights, mode);
+            changed.push('rightType');
+        }
+        if (raw.fileRights?.length) {
+            permission.fileRight = parsePermissionFileRights(raw.fileRights);
+            changed.push('fileRight');
+        }
+        if (raw.fileRightType !== undefined) {
+            permission.fileRightType = normalizeFileRightType(raw.fileRightType);
+            changed.push('fileRightType');
+        }
+        changed.push(...applyPermissionSettings(permission, collectPermissionSettings(raw)));
+        const syncList = raw.syncForms?.length
+            ? buildSyncPermissionList(raw.syncForms)
+            : detail.syncPermissionList;
+        if (!changed.length && !raw.syncForms?.length) {
+            throw new Error('未指定任何要修改的项');
+        }
+        const after = await updatePermissionDetail(client, baseUrl, appId, objId, permission, syncList, {
+            changedKeys: [...new Set(changed)],
+        });
+        if (raw.syncForms?.length) {
+            const want = new Set(syncList.map((s) => String(s.objId)));
+            const got = new Set(after.syncPermissionList.map((s) => String(s.objId)));
+            const missing = [...want].filter((id) => !got.has(id));
+            if (missing.length)
+                throw new Error(`同步至其他表单未生效: ${missing.join(', ')}`);
+        }
+        const subject = permission.orgName || permission.orgTypeName || '';
+        printPermission({
+            action: '权限', id: rightId, target: targetOfCodeType(permission.codeType),
+            orgType: permission.orgType, orgId: permission.orgId, orgName: permission.orgName,
+            subject, rightType: permission.rightType, rights: permissionRightLabels(permission.rightType),
+            fileRight: permission.fileRight,
+            ...(raw.syncForms?.length ? { syncCount: after.syncPermissionList.length } : {}),
+            ...(Number(after.permission.isShowRebuild) === 2 ? { needsRebuild: true } : {}),
+        }, { objId, appId }, Boolean(opts.json));
+    }
+    dataCmd.command('update')
+        .description('修改共享权限（整行回写，只改点名项；可改授权对象/权限/附件/布局/优先级/描述/条件/同步表单）')
+        .argument('<objId>', '表单 objId')
+        .argument('<appId>', '应用 ID')
+        .requiredOption('--right-id <id>', '权限 ID（form permission list 里的 [id]）')
+        .option('--target <type>', `改成哪类授权对象: ${Object.keys(PERMISSION_TARGETS).join(' / ')}`)
+        .option('--org-type <type>', `通用对象类型: ${Object.keys(PERMISSION_ORG_TYPES).join(' / ')}`)
+        .option('--org-id <id>', '授权对象 ID（all / externalAll 自动为 0）')
+        .option('--org-name <name>', '授权对象名称')
+        .option('--rights <rights...>', '数据权限，可组合: view/edit/delete/comment 或 1/2/3/4')
+        .option('--file-rights <rights...>', '附件权限，可组合: view/download/edit 或 401/402/403')
+        .option('--file-right-type <type>', '附件赋权类型: temporary / insert')
+        .option('--creator-related <level>', '创建人关系: 0~7')
+        .option('--field <fieldIdOrName>', '字段相关：字段 id 或字段名')
+        .option('--sub-form-id <id>', '字段相关：明细字段所属子表 id')
+        .option('--matrix <idOrName>', '矩阵相关：矩阵 id 或名称')
+        .option('--eb-form <idOrName>', '矩阵相关：e-Builder 表单 id 或名称')
+        .option('--matrix-value <spec...>', '矩阵相关：取值字段（名称或 id:名称:valueType）')
+        .option('--matrix-value-raw <json>', '矩阵相关：取值字段原始 JSON 数组')
+        .option('--matrix-condition-raw <json>', '矩阵相关：条件树原始 JSON')
+        .option('--govern-json <json>', '政务单位相关：governDataRelation JSON')
+        .action(async (objId, appId, raw) => {
+        try {
+            await runDataUpdate('share', objId, appId, raw);
+        }
+        catch (error) {
+            console.error(`修改共享权限失败: ${error.message}`);
+            process.exitCode = 1;
+        }
+    });
+    addPermissionSettingOptions(subCommand(dataCmd, 'update'));
+    dataCmd.command('show')
+        .description('查看一条共享权限的完整配置（含同步列表）')
+        .argument('<objId>', '表单 objId')
+        .argument('<appId>', '应用 ID')
+        .requiredOption('--right-id <id>', '权限 ID')
+        .action(async (objId, appId, raw) => {
+        try {
+            const opts = program.opts();
+            const auth = await AuthSession.fromOptions(opts);
+            if (!auth)
+                throw new Error('无法加载认证');
+            const detail = await readPermissionDetail(new ApiClient(auth), auth.getBaseUrl(), appId, objId, String(raw.rightId));
+            if (opts.json) {
+                console.log(JSON.stringify(detail, null, 2));
+                return;
+            }
+            const p = detail.permission;
+            console.log(`[${p.id}] ${p.orgName || p.orgTypeName || ''}  ${permissionRightLabels(p.rightType)}  (${p.codeType}/${p.orgType})`);
+            const extras = [];
+            if (p.fileRight)
+                extras.push(`附件=${p.fileRight}(${p.fileRightType || ''})`);
+            if (p.layoutId)
+                extras.push(`PC布局=${p.layoutId}`);
+            if (p.mobileLayoutId)
+                extras.push(`移动布局=${p.mobileLayoutId}`);
+            if (p.editLayoutId)
+                extras.push(`编辑布局=${p.editLayoutId}`);
+            if (p.mobileEditLayoutId)
+                extras.push(`移动编辑布局=${p.mobileEditLayoutId}`);
+            if (String(p.isPcMobileSameLayout) === '1')
+                extras.push('PC移动统一布局');
+            if (p.layoutOrder !== undefined)
+                extras.push(`优先级=${p.layoutOrder}`);
+            if (p.rightDesc)
+                extras.push(`描述=${p.rightDesc}`);
+            if (p.conditionData)
+                extras.push('有权限条件');
+            if (extras.length)
+                console.log(`  ${extras.join('  ')}`);
+            for (const s of detail.syncPermissionList) {
+                console.log(`  同步至: ${s.objId} ${s.tableName || ''} ${s.tableType || ''}`);
+            }
+        }
+        catch (error) {
+            console.error(`读取权限失败: ${error.message}`);
+            process.exitCode = 1;
+        }
+    });
+    // ─── CREATE（创建权限：谁能新建记录）─────────────────────
+    const createCmd = permCmd.command('create')
+        .description('创建权限（谁能新建记录；共享数据权限请用 `form permission data`）');
+    createCmd.command('add')
+        .description('添加创建权限并回读')
+        .argument('<objId>', '表单 objId')
+        .argument('<appId>', '应用 ID')
+        .requiredOption('--org-type <type>', `授权对象类型: ${Object.keys(PERMISSION_ORG_TYPES).join(' / ')}`)
+        .option('--org-id <id>', '授权对象 ID（all / externalAll 自动为 0）')
+        .option('--org-name <name>', '授权对象名称（缺省用类型名）')
+        .option('--creator-related <level>', '上下级关系: 0~7（人员/部门/分部授权时）', '0')
+        .option('--rights <rights...>', '创建权限（目前只有 create / 0）', ['create'])
+        .action(async (objId, appId, raw) => {
+        try {
+            const opts = program.opts();
+            const auth = await AuthSession.fromOptions(opts);
+            if (!auth)
+                throw new Error('无法加载认证');
+            const client = new ApiClient(auth);
+            const baseUrl = auth.getBaseUrl();
+            const { patch } = await resolveTargetPatch(client, baseUrl, appId, objId, raw, 'create');
+            const rightType = parsePermissionRights(raw.rights, 'create');
+            const row = buildPermissionRow({ objId, appId, mode: 'create', target: 'general', rightType, ...patch });
+            applyPermissionSettings(row, collectPermissionSettings(raw));
+            const id = await addPermissionRow(client, baseUrl, appId, objId, row);
+            await verifyAddedRow(client, baseUrl, appId, objId, id, row);
+            let syncCount;
+            if (raw.syncForms?.length) {
+                const detail = await readPermissionDetail(client, baseUrl, appId, objId, id);
+                const after = await updatePermissionDetail(client, baseUrl, appId, objId, { ...detail.permission, id }, buildSyncPermissionList(raw.syncForms));
+                syncCount = after.syncPermissionList.length;
+            }
+            printPermission({
+                action: '创建权限', id, target: 'general', orgType: row.orgType, orgId: row.orgId, orgName: row.orgName,
+                subject: row.orgName || row.orgTypeName, rightType, rights: permissionRightLabels(rightType),
+                ...(syncCount !== undefined ? { syncCount } : {}),
+            }, { objId, appId }, Boolean(opts.json));
+        }
+        catch (error) {
+            console.error(`添加创建权限失败: ${error.message}`);
+            process.exitCode = 1;
+        }
+    });
+    addPermissionSettingOptions(subCommand(createCmd, 'add'));
+    createCmd.command('update')
+        .description('修改创建权限（整行回写，只改点名项）')
+        .argument('<objId>', '表单 objId')
+        .argument('<appId>', '应用 ID')
+        .requiredOption('--right-id <id>', '权限 ID（form permission list 里的 [id]）')
+        .option('--org-type <type>', `授权对象类型: ${Object.keys(PERMISSION_ORG_TYPES).join(' / ')}`)
+        .option('--org-id <id>', '授权对象 ID（all / externalAll 自动为 0）')
+        .option('--org-name <name>', '授权对象名称')
+        .option('--creator-related <level>', '上下级关系: 0~7（人员/部门/分部授权时）')
+        .option('--rights <rights...>', '创建权限（目前只有 create / 0）')
+        .action(async (objId, appId, raw) => {
+        try {
+            await runDataUpdate('create', objId, appId, raw);
+        }
+        catch (error) {
+            console.error(`修改创建权限失败: ${error.message}`);
+            process.exitCode = 1;
+        }
+    });
+    addPermissionSettingOptions(subCommand(createCmd, 'update'));
+    createCmd.command('show')
+        .description('查看一条创建权限的完整配置（含同步列表）')
+        .argument('<objId>', '表单 objId')
+        .argument('<appId>', '应用 ID')
+        .requiredOption('--right-id <id>', '权限 ID')
+        .action(async (objId, appId, raw) => {
+        try {
+            const opts = program.opts();
+            const auth = await AuthSession.fromOptions(opts);
+            if (!auth)
+                throw new Error('无法加载认证');
+            const detail = await readPermissionDetail(new ApiClient(auth), auth.getBaseUrl(), appId, objId, String(raw.rightId));
+            if (opts.json) {
+                console.log(JSON.stringify(detail, null, 2));
+                return;
+            }
+            const p = detail.permission;
+            console.log(`[${p.id}] ${p.orgName || p.orgTypeName || ''}  ${permissionRightLabels(p.rightType)}  (${p.codeType}/${p.orgType})`);
+            const extras = [];
+            if (p.layoutId)
+                extras.push(`PC布局=${p.layoutId}`);
+            if (p.mobileLayoutId)
+                extras.push(`移动布局=${p.mobileLayoutId}`);
+            if (String(p.isPcMobileSameLayout) === '1')
+                extras.push('PC移动统一布局');
+            if (p.layoutOrder !== undefined)
+                extras.push(`优先级=${p.layoutOrder}`);
+            if (p.rightDesc)
+                extras.push(`描述=${p.rightDesc}`);
+            if (p.conditionData)
+                extras.push('有权限条件');
+            if (extras.length)
+                console.log(`  ${extras.join('  ')}`);
+            for (const s of detail.syncPermissionList)
+                console.log(`  同步至: ${s.objId} ${s.tableName || ''}`);
+        }
+        catch (error) {
+            console.error(`读取权限失败: ${error.message}`);
             process.exitCode = 1;
         }
     });
@@ -187,6 +683,13 @@ export function registerFormPermissionCommands(form, program) {
     // 用户反馈：想加导入导出权限却加到了共享里。共享(dataRightList/obj_data_admin)只有 查看/编辑/删除 三种，
     // 导入导出是独立分类（impRightList/data_imp_exp），rightType: 8导出/9导入(追加)/93删除导入数据。
     const impCmd = permCmd.command('imp-exp').description('导入导出权限（独立分类，勿用 data add——共享权限只有 查看/编辑/删除）');
+    async function readImpRights(client, baseUrl, appId, objId) {
+        const listed = await client.get(`${baseUrl}/api/bs/ebuilder/form/permission/getRightList?objId=${objId}&apid=${appId}&belongId=${objId}&type=imp`, { ebbusinessid: appId });
+        if (listed?.code !== 200 || !listed?.status)
+            throw new Error(listed?.msg || '查询失败');
+        const items = listed?.data?.rightList?.impRightList || [];
+        return Array.isArray(items) ? items : (items?.pageDatas?.result || []);
+    }
     impCmd.command('list')
         .description('查看导入导出权限列表')
         .argument('<objId>', '表单 objId')
@@ -199,12 +702,7 @@ export function registerFormPermissionCommands(form, program) {
                 throw new Error('无法加载认证');
             const client = new ApiClient(auth);
             const baseUrl = auth.getBaseUrl();
-            const listed = await client.get(`${baseUrl}/api/bs/ebuilder/form/permission/getRightList?objId=${objId}&apid=${appId}&belongId=${objId}&type=imp`, { ebbusinessid: appId });
-            if (listed?.code !== 200 || !listed?.status)
-                throw new Error(listed?.msg || '查询失败');
-            let items = listed?.data?.rightList?.impRightList || [];
-            if (!Array.isArray(items))
-                items = items?.pageDatas?.result || [];
+            const items = await readImpRights(client, baseUrl, appId, objId);
             if (opts.json) {
                 console.log(JSON.stringify(items, null, 2));
                 return;
@@ -238,14 +736,14 @@ export function registerFormPermissionCommands(form, program) {
         .description('添加导入导出权限并回读（rightType: export=8 / import=9 / delete-import=93，93 须与 9 同选）')
         .argument('<objId>', '表单 objId')
         .argument('<appId>', '应用 ID')
-        .requiredOption('--org-type <type>', `授权对象类型: ${Object.keys(ORG_TYPES).join(' / ')}`)
-        .option('--org-id <id>', '授权对象 ID（all 类型时自动为 0）')
-        .option('--org-name <name>', '授权对象名称（all 类型时自动为 所有人）', '')
+        .requiredOption('--org-type <type>', `授权对象类型: ${Object.keys(PERMISSION_ORG_TYPES).join(' / ')}`)
+        .option('--org-id <id>', '授权对象 ID（all / externalAll 自动为 0）')
+        .option('--org-name <name>', '授权对象名称（缺省用类型名）', '')
         .requiredOption('--rights <rights...>', '权限组合: export / import / delete-import（或 8/9/93）')
         .option('--update-import', '允许更新导入（importType 加 1；默认仅追加导入 importType=0）')
         .option('--export-details', '导出明细数据（明细表）')
         .option('--export-attachment', '导出附件')
-        .option('--export-field-range <range>', '导出字段范围: listShowField 列表显示字段 / all 全部', 'listShowField')
+        .option('--export-field-range <range>', '导出字段范围: listShowField 列表显示字段 / allField 全部字段', 'listShowField')
         .option('--creator-related <level>', '权限关系: 0 本人 / 1 上级 / 5 本岗位', '0')
         .action(async (objId, appId, cmdOpts) => {
         try {
@@ -253,12 +751,10 @@ export function registerFormPermissionCommands(form, program) {
             const auth = await AuthSession.fromOptions(opts);
             if (!auth)
                 throw new Error('无法加载认证');
-            if (!ORG_TYPES[cmdOpts.orgType])
+            if (!PERMISSION_ORG_TYPES[cmdOpts.orgType])
                 throw new Error(`不支持的 --org-type: ${cmdOpts.orgType}`);
-            const orgId = cmdOpts.orgType === 'all' ? '0' : (cmdOpts.orgId || '');
-            if (cmdOpts.orgType !== 'all' && !orgId)
-                throw new Error('--org-id 不能为空（all 类型除外）');
-            const orgName = cmdOpts.orgName || ORG_TYPES[cmdOpts.orgType];
+            const orgId = requireOrgId(cmdOpts.orgType, cmdOpts.orgId);
+            const orgName = cmdOpts.orgName || PERMISSION_ORG_TYPES[cmdOpts.orgType];
             const rightType = parseRightValues(cmdOpts.rights, IMP_EXP_RIGHT_ALIASES, '导入导出权限');
             if (rightType.includes('93') && !rightType.includes('9')) {
                 throw new Error('delete-import(93) 必须与 import(9) 同选（删除导入数据依附于导入）');
@@ -270,9 +766,9 @@ export function registerFormPermissionCommands(form, program) {
             const perm = {
                 belong: 'obj', belongId: objId, codeType: 'data_imp_exp',
                 exportDetails: cmdOpts.exportDetails ? 1 : 0,
-                exportFieldRange: cmdOpts.exportFieldRange,
+                exportFieldRange: normalizeExportFieldRange(cmdOpts.exportFieldRange),
                 layoutOrder: 0, orgType: cmdOpts.orgType, creatorRelated: cmdOpts.creatorRelated,
-                orgId, orgVirtualType: '', orgTypeName: ORG_TYPES[cmdOpts.orgType],
+                orgId, orgVirtualType: '', orgTypeName: PERMISSION_ORG_TYPES[cmdOpts.orgType],
                 rightType, importType, excludeObj: '', isPcMobileSameLayout: '0',
                 orgName, conditionData: '',
                 ...(cmdOpts.exportAttachment ? { exportAttachment: true } : {}),
@@ -284,15 +780,16 @@ export function registerFormPermissionCommands(form, program) {
             if (!id)
                 throw new Error('添加响应未返回权限 ID');
             // 回读校验（type=imp 走导入导出分类）
-            const listed = await client.get(`${baseUrl}/api/bs/ebuilder/form/permission/getRightList?objId=${objId}&apid=${appId}&belongId=${objId}&type=imp`, { ebbusinessid: appId });
-            if (listed?.code !== 200 || !listed?.status)
-                throw new Error(listed?.msg || '权限回读失败');
-            let items = listed?.data?.rightList?.impRightList || [];
-            if (!Array.isArray(items))
-                items = items?.pageDatas?.result || [];
+            const items = await readImpRights(client, baseUrl, appId, objId);
             const saved = items.find((item) => String(item.id) === id);
             if (!saved || String(saved.rightType) !== rightType)
                 throw new Error('导入导出权限保存后回读不一致');
+            if (String(saved.orgType) !== String(cmdOpts.orgType)) {
+                throw new Error('导入导出权限保存后回读不一致（授权对象类型被平台改写）');
+            }
+            if (!['all', 'externalAll'].includes(cmdOpts.orgType) && String(saved.orgId ?? '') !== String(orgId)) {
+                throw new Error('导入导出权限保存后回读不一致（授权对象 ID 被平台改写）');
+            }
             const label = rightTypeLabel(rightType);
             if (opts.json)
                 console.log(JSON.stringify({ success: true, id, orgName, orgType: cmdOpts.orgType, orgId, rightType, label, importType }, null, 2));
@@ -307,6 +804,175 @@ export function registerFormPermissionCommands(form, program) {
             process.exitCode = 1;
         }
     });
+    impCmd.command('update')
+        .description('修改导入导出权限（整行回写，只改点名项）')
+        .argument('<objId>', '表单 objId')
+        .argument('<appId>', '应用 ID')
+        .requiredOption('--right-id <id>', '权限 ID（form permission imp-exp list 里的 [id]）')
+        .option('--org-type <type>', `授权对象类型: ${Object.keys(PERMISSION_ORG_TYPES).join(' / ')}`)
+        .option('--org-id <id>', '授权对象 ID（all / externalAll 自动为 0）')
+        .option('--org-name <name>', '授权对象名称')
+        .option('--rights <rights...>', '权限组合: export / import / delete-import（或 8/9/93）')
+        .option('--update-import <on|off>', '允许更新导入（importType 加 1）')
+        .option('--export-details <on|off>', '导出明细数据（明细表）')
+        .option('--export-attachment <on|off>', '导出附件')
+        .option('--export-field-range <range>', '导出字段范围: listShowField 列表显示字段 / allField 全部字段')
+        .option('--creator-related <level>', '权限关系: 0 本人 / 1 上级 / 5 本岗位')
+        .action(async (objId, appId, raw) => {
+        try {
+            const opts = program.opts();
+            const auth = await AuthSession.fromOptions(opts);
+            if (!auth)
+                throw new Error('无法加载认证');
+            const client = new ApiClient(auth);
+            const baseUrl = auth.getBaseUrl();
+            const rightId = String(raw.rightId);
+            const current = (await readImpRights(client, baseUrl, appId, objId))
+                .find((r) => String(r.id) === rightId);
+            if (!current)
+                throw new Error(`导入导出权限 ${rightId} 不存在`);
+            const permission = {
+                id: rightId,
+                belong: current.belong || 'obj',
+                belongId: current.belongId || objId,
+                codeType: 'data_imp_exp',
+                orgType: current.orgType,
+                orgId: current.orgId ?? '',
+                orgName: current.orgName ?? '',
+                orgTypeName: current.orgTypeName ?? '',
+                rightType: String(current.rightType ?? ''),
+                importType: String(current.importType ?? '0'),
+                exportDetails: Number(current.exportDetails ?? 0),
+                exportFieldRange: current.exportFieldRange || 'listShowField',
+                exportAttachment: Boolean(current.exportAttachment),
+                creatorRelated: String(current.creatorRelated ?? '0'),
+                layoutOrder: Number(current.layoutOrder ?? 0),
+                isPcMobileSameLayout: String(current.isPcMobileSameLayout ?? '0'),
+                orgVirtualType: current.orgVirtualType ?? '',
+                excludeObj: current.excludeObj ?? '',
+                conditionData: current.conditionData ?? '',
+            };
+            const changed = [];
+            if (raw.orgType !== undefined) {
+                const orgType = String(raw.orgType);
+                if (!PERMISSION_ORG_TYPES[orgType]) {
+                    throw new Error(`不支持的 --org-type: ${orgType}，可选: ${Object.keys(PERMISSION_ORG_TYPES).join(' / ')}`);
+                }
+                permission.orgType = orgType;
+                permission.orgId = requireOrgId(orgType, raw.orgId);
+                permission.orgName = raw.orgName || PERMISSION_ORG_TYPES[orgType];
+                permission.orgTypeName = PERMISSION_ORG_TYPES[orgType];
+                changed.push('orgType', 'orgId');
+            }
+            else if (raw.orgId !== undefined) {
+                throw new Error('改授权对象需要同时给 --org-type（判断对象种类）');
+            }
+            if (raw.rights?.length) {
+                const rightType = parseRightValues(raw.rights, IMP_EXP_RIGHT_ALIASES, '导入导出权限');
+                if (rightType.includes('93') && !rightType.includes('9')) {
+                    throw new Error('delete-import(93) 必须与 import(9) 同选');
+                }
+                permission.rightType = rightType;
+                changed.push('rightType');
+            }
+            if (raw.updateImport !== undefined || permission.rightType.includes('93')) {
+                const wantsUpdate = raw.updateImport !== undefined
+                    ? parseOnOff(raw.updateImport, '--update-import') : true;
+                permission.importType = wantsUpdate || permission.rightType.includes('93') ? '0,1' : '0';
+                if (changed.some((k) => k === 'rightType') || raw.updateImport !== undefined)
+                    changed.push('importType');
+            }
+            if (raw.exportDetails !== undefined) {
+                permission.exportDetails = parseOnOff(raw.exportDetails, '--export-details') ? 1 : 0;
+                changed.push('exportDetails');
+            }
+            if (raw.exportAttachment !== undefined) {
+                permission.exportAttachment = parseOnOff(raw.exportAttachment, '--export-attachment');
+                changed.push('exportAttachment');
+            }
+            if (raw.exportFieldRange !== undefined) {
+                permission.exportFieldRange = normalizeExportFieldRange(raw.exportFieldRange);
+                changed.push('exportFieldRange');
+            }
+            if (raw.creatorRelated !== undefined) {
+                const level = String(raw.creatorRelated);
+                if (!/^[0-7]$/.test(level))
+                    throw new Error('--creator-related 需是 0~7');
+                permission.creatorRelated = level;
+                changed.push('creatorRelated');
+            }
+            if (!changed.length)
+                throw new Error('未指定任何要修改的项');
+            const q = new URLSearchParams({ objId, apid: appId, tpaid: objId }).toString();
+            const saved = await client.post(`${baseUrl}/api/bs/ebuilder/form/permission/updateAndSyncPermission?${q}`, { permission, sourceChanged: true, syncPermissionList: [] }, { ebbusinessid: appId });
+            if (saved?.code !== 200 || !saved?.status)
+                throw new Error(saved?.msg || '保存失败');
+            const after = (await readImpRights(client, baseUrl, appId, objId))
+                .find((r) => String(r.id) === rightId);
+            if (!after)
+                throw new Error('已提交，但权限列表里找不到该行');
+            const mismatch = [];
+            const cmp = (key) => {
+                if (['orgName', 'orgTypeName'].includes(key))
+                    return;
+                if (String(after[key] ?? '') !== String(permission[key] ?? '')) {
+                    mismatch.push(`${key}: 期望 ${permission[key] ?? ''}，回读 ${after[key] ?? ''}`);
+                }
+            };
+            for (const key of new Set(changed)) {
+                if (key === 'orgId' && ['all', 'externalAll'].includes(String(permission.orgType)))
+                    continue;
+                cmp(key);
+            }
+            if (mismatch.length)
+                throw new Error(`导入导出权限保存后回读不一致 —— ${mismatch.join('；')}`);
+            const label = rightTypeLabel(String(permission.rightType));
+            if (opts.json) {
+                console.log(JSON.stringify({ success: true, id: rightId, orgType: permission.orgType, orgId: permission.orgId, rightType: permission.rightType, label, importType: permission.importType }, null, 2));
+            }
+            else {
+                console.log(`导入导出权限已修改: [${rightId}] ${permission.orgName || permission.orgTypeName} ${label}${permission.importType === '0,1' ? '（含更新导入）' : ''}`);
+            }
+        }
+        catch (error) {
+            console.error(`修改导入导出权限失败: ${error.message}`);
+            process.exitCode = 1;
+        }
+    });
+    impCmd.command('show')
+        .description('查看一条导入导出权限的完整配置')
+        .argument('<objId>', '表单 objId')
+        .argument('<appId>', '应用 ID')
+        .requiredOption('--right-id <id>', '权限 ID')
+        .action(async (objId, appId, raw) => {
+        try {
+            const opts = program.opts();
+            const auth = await AuthSession.fromOptions(opts);
+            if (!auth)
+                throw new Error('无法加载认证');
+            const items = await readImpRights(new ApiClient(auth), auth.getBaseUrl(), appId, objId);
+            const row = items.find((r) => String(r.id) === String(raw.rightId));
+            if (!row)
+                throw new Error(`导入导出权限 ${raw.rightId} 不存在`);
+            if (opts.json) {
+                console.log(JSON.stringify(row, null, 2));
+                return;
+            }
+            console.log(`[${row.id}] ${row.orgName || row.orgTypeName}(${row.orgType}/${row.orgId ?? ''})  ${row.rightTypeName || rightTypeLabel(row.rightType)}`);
+            if (row.importType)
+                console.log(`  importType=${row.importType}`);
+            if (row.exportFieldRange)
+                console.log(`  导出字段范围=${row.exportFieldRange}`);
+            if (row.exportDetails)
+                console.log('  导出明细');
+            if (row.exportAttachment)
+                console.log('  导出附件');
+        }
+        catch (error) {
+            console.error(`读取导入导出权限失败: ${error.message}`);
+            process.exitCode = 1;
+        }
+    });
     permCmd.command('add')
         .description('添加表单权限')
         .argument('<objId>', '表单 objId')