feat(v2.7): 接入协作治理前端体验

apps/web/stores/useXiaobaoRiskStore.ts

@@ -1,6 +1,8 @@
 'use client';
 import { create } from 'zustand';
 import { loadServerData, saveServerData, SERVER_DATA_CACHE_MS } from '@/lib/server-data';
+import { api } from '@/lib/api';
+import { useMemberStore } from './useMemberStore';
 import {
   mergeDailySnapshotCacheForSave,
   mergeInsightCacheForSave,
@@ -74,6 +76,7 @@ export const useXiaobaoRiskStore = create<XiaobaoRiskState>((set, get) => ({
       const snapshots = mergeDailySnapshotCacheForSave(get().snapshots, Array.isArray(remote) ? remote : [], item);
       set({ snapshots, error: undefined });
       await saveServerData('xiaobao-risk-snapshots', snapshots);
+      void notifyRiskManagers(item).catch(() => {});
     });
     snapshotSaveQueue = task.catch(() => undefined);
     try {
@@ -119,3 +122,32 @@ export const useXiaobaoRiskStore = create<XiaobaoRiskState>((set, get) => ({
     set({ pendingInsightKeys: get().pendingInsightKeys.filter((item) => item !== key) });
   },
 }));
+
+async function notifyRiskManagers(item: XiaobaoRiskSnapshot) {
+  if (!['at_risk', 'likely_delayed', 'blocked'].includes(item.riskLevel)) return;
+  const memberStore = useMemberStore.getState();
+  if (!memberStore.loaded) {
+    await memberStore.fetchMembers().catch(() => undefined);
+  }
+  const state = useMemberStore.getState();
+  const roleMap = new Map(state.roles.map((role) => [role.id, role]));
+  const recipients = state.members.filter((member) => {
+    const permissions = roleMap.get(member.roleId)?.permissions ?? [];
+    return permissions.includes('*') || permissions.includes('xiaobao.warning:manage');
+  });
+  await Promise.all(recipients.map((member) => api.post('/notifications', {
+    recipientId: member.id,
+    actorId: 'xiaobao',
+    type: 'risk_alert',
+    title: '小宝预警更新',
+    body: `版本 ${item.versionId} 当前风险 ${item.riskLevel}，风险分 ${item.riskScore}`,
+    resourceType: 'version',
+    resourceId: item.versionId,
+    versionId: item.versionId,
+    metadata: {
+      riskLevel: item.riskLevel,
+      riskScore: item.riskScore,
+      riskSignature: `${item.versionId}:${item.date}:${item.riskScore}:${item.riskLevel}`,
+    },
+  }).catch(() => undefined)));
+}