@allbluecn/admin-app 0.1.0

package/src/server/serverFns/dependency/helpers.ts

@@ -0,0 +1,245 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// apps/admin/src/server/serverFns/dependency/helpers.ts
+import { existsSync } from "node:fs"
+import { readFile } from "node:fs/promises"
+import path from "node:path"
+import { prisma } from "@allbluecn/database"
+import {
+  DEFAULT_WATCHED_DEPENDENCIES,
+  type DependencyUsage,
+  type VersionStatus,
+} from "@allbluecn/kernel"
+
+/** 同步查找 monorepo 根（含 pnpm-workspace.yaml） */
+function findMonorepoRootSync(): string {
+  let dir = process.cwd()
+  for (let i = 0; i < 8; i++) {
+    if (existsSync(path.join(dir, "pnpm-workspace.yaml"))) return dir
+    const parent = path.dirname(dir)
+    if (parent === dir) break
+    dir = parent
+  }
+  return process.cwd()
+}
+
+/** monorepo 中要扫描的 package.json 相对路径 */
+const PACKAGE_FILES = [
+  "apps/web/package.json",
+  "apps/admin/package.json",
+  "packages/database/package.json",
+  "packages/shared/package.json",
+  "packages/ui/package.json",
+]
+
+interface ParsedPkgFile {
+  /** 相对 monorepo 根的目录，如 "apps/web" */
+  app: string
+  /** name → version range（合并 dependencies + devDependencies） */
+  deps: Record<string, string>
+}
+
+/** 读取 monorepo 所有 package.json */
+export async function readMonorepoPackages(): Promise<ParsedPkgFile[]> {
+  const root = findMonorepoRootSync()
+  const out: ParsedPkgFile[] = []
+  for (const rel of PACKAGE_FILES) {
+    const abs = path.join(root, rel)
+    try {
+      const raw = await readFile(abs, "utf-8")
+      const json = JSON.parse(raw) as {
+        dependencies?: Record<string, string>
+        devDependencies?: Record<string, string>
+      }
+      out.push({
+        app: path.dirname(rel),
+        deps: { ...json.dependencies, ...json.devDependencies },
+      })
+    } catch {
+      // 文件不存在跳过
+    }
+  }
+  return out
+}
+
+/** 聚合某个包在 monorepo 中的使用情况 */
+export async function aggregateUsages(
+  pkgName: string,
+  files?: ParsedPkgFile[],
+): Promise<DependencyUsage[]> {
+  const list = files ?? (await readMonorepoPackages())
+  const usages: DependencyUsage[] = []
+  for (const f of list) {
+    const range = f.deps[pkgName]
+    if (range) usages.push({ app: f.app, declaredRange: range })
+  }
+  return usages
+}
+
+/** 查询 npm registry + GitHub Releases，返回 latest 版本 + homepage + changelog */
+export async function queryNpmRegistry(
+  pkgName: string,
+): Promise<{ latestVersion: string; homepage: string | null; changelog: string | null }> {
+  // scope 包 URL 编码：@tiptap/core → @tiptap%2Fcore
+  const encoded = pkgName.replace(/\//g, "%2F")
+  const url = `https://registry.npmjs.org/${encoded}/latest`
+  const res = await fetch(url, {
+    headers: { Accept: "application/json" },
+  })
+  if (!res.ok) {
+    throw new Error(`npm registry ${res.status}: ${res.statusText}`)
+  }
+  const json = (await res.json()) as {
+    version: string
+    homepage?: string | null
+    repository?: { url?: string } | null
+  }
+  const homepage = json.homepage ?? json.repository?.url ?? null
+  // 清洗 git+ 前缀
+  const cleanHomepage = homepage?.replace(/^git\+/, "").replace(/\.git$/, "") ?? null
+
+  // 尝试获取 GitHub Release changelog
+  const repoUrl = json.repository?.url ?? cleanHomepage
+  const changelog = repoUrl ? await fetchGitHubChangelog(repoUrl, json.version) : null
+
+  return { latestVersion: json.version, homepage: cleanHomepage, changelog }
+}
+
+/** 从 repository URL 解析 GitHub owner/repo */
+function parseGitHubRepo(repoUrl: string): { owner: string; repo: string } | null {
+  // 匹配 github.com/owner/repo（容忍 git+ 前缀、.git 后缀、ssh 协议）
+  const m = repoUrl.match(/github\.com[:/]([^/]+)\/([^/\.]+)/i)
+  if (!m) return null
+  return { owner: m[1], repo: m[2] }
+}
+
+/**
+ * 查询 GitHub Releases 获取指定版本的 changelog。
+ * tag 尝试顺序：v$version → $version → $name@$version（monorepo 风格）
+ * 失败返回 null（不阻塞同步）。
+ */
+async function fetchGitHubChangelog(
+  repoUrl: string,
+  version: string,
+): Promise<string | null> {
+  const gh = parseGitHubRepo(repoUrl)
+  if (!gh) return null
+
+  const headers: Record<string, string> = {
+    Accept: "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "allblue-admin-dependency-sync",
+  }
+  // 可选 GitHub Token 提升 API 速率限制（60→5000/h）
+  const ghToken = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN
+  if (ghToken) headers.Authorization = `Bearer ${ghToken}`
+
+  const tags = [`v${version}`, version]
+  for (const tag of tags) {
+    try {
+      const res = await fetch(
+        `https://api.github.com/repos/${gh.owner}/${gh.repo}/releases/tags/${encodeURIComponent(tag)}`,
+        { headers },
+      )
+      if (res.ok) {
+        const data = (await res.json()) as { body?: string | null; html_url?: string }
+        if (data.body) return data.body.trim()
+      }
+      if (res.status === 404) continue // 试下一个 tag
+      // 速率限制或其他错误，停止尝试
+      break
+    } catch {
+      break
+    }
+  }
+  return null
+}
+
+/**
+ * 比较版本，返回落后程度。
+ * currentRange 形如 "^3.23.6" / "~1.0.0" / "19.2.4"
+ */
+export function compareVersions(
+  currentRange: string | null,
+  latest: string | null,
+): VersionStatus {
+  if (!latest) return "unknown"
+  if (!currentRange) return "unknown"
+  const cur = parseSemver(currentRange)
+  const lat = parseSemver(latest)
+  if (!cur || !lat) return "unknown"
+  if (cur[0] !== lat[0]) return "major"
+  if (cur[1] !== lat[1]) return "minor"
+  if (cur[2] !== lat[2]) return "patch"
+  return "latest"
+}
+
+/** 从 semver range 提取 [major, minor, patch] */
+function parseSemver(range: string): [number, number, number] | null {
+  // 去 prefix ^ ~ > >= 和 v 前缀，取前三段
+  const m = range.replace(/^[\^~>=<v]+/, "").split(".")
+  const major = Number(m[0])
+  const minor = Number(m[1] ?? 0)
+  const patch = Number(m[2] ?? 0)
+  if (Number.isNaN(major) || Number.isNaN(minor) || Number.isNaN(patch)) return null
+  return [major, minor, patch]
+}
+
+/** 取 usages 中第一个可解析的 semver，作为表格展示用 currentVersion */
+export function pickCurrentVersion(usages: DependencyUsage[]): string | null {
+  for (const u of usages) {
+    const parsed = parseSemver(u.declaredRange)
+    if (parsed) return parsed.join(".")
+  }
+  return usages[0]?.declaredRange ?? null
+}
+
+/** 首次访问时 seed 预设关注列表；若已 seed 则回填缺失的 description（升级兼容） */
+let seeded = false
+export async function ensureSeedData(): Promise<void> {
+  if (seeded) return
+  const count = await prisma.thirdPartyDependency.count()
+  if (count === 0) {
+    await prisma.thirdPartyDependency.createMany({
+      data: DEFAULT_WATCHED_DEPENDENCIES.map((d, i) => ({
+        name: d.name,
+        displayName: d.displayName,
+        description: d.description,
+        homepage: d.homepage,
+        category: d.category,
+        priority: d.priority,
+        isWatched: true,
+        sortOrder: i,
+      })),
+    })
+  } else {
+    // 回填：对预设包中 description 为空的行补上（兼容本次新增 description 字段）
+    for (const d of DEFAULT_WATCHED_DEPENDENCIES) {
+      await prisma.thirdPartyDependency.updateMany({
+        where: { name: d.name, description: null },
+        data: { description: d.description },
+      })
+    }
+  }
+  seeded = true
+}
+
+/** 包名 → npm 页面地址 */
+export function npmUrlOf(name: string): string {
+  return `https://www.npmjs.com/package/${name}`
+}

package/src/server/serverFns/dependency/list.ts

@@ -0,0 +1,127 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// apps/admin/src/server/serverFns/dependency/list.ts
+import { createServerFn } from "@tanstack/react-start"
+import { z } from "zod"
+import { prisma } from "@allbluecn/database"
+import type { ThirdPartyDependencyRow } from "@allbluecn/kernel"
+import {
+  aggregateUsages,
+  compareVersions,
+  ensureSeedData,
+  npmUrlOf,
+  pickCurrentVersion,
+  readMonorepoPackages,
+} from "./helpers"
+
+const listInput = z.object({
+  /** 仅返回关注列表 */
+  watchedOnly: z.boolean().optional(),
+  category: z.string().optional(),
+  search: z.string().optional(),
+})
+
+/**
+ * 列出所有依赖。
+ * 1. 首次访问自动 seed 预设关注列表
+ * 2. 读 monorepo 所有 package.json，聚合当前版本（实时）
+ * 3. 合并 DB 缓存的 latestVersion
+ * 4. DB 中未跟踪的包（出现在 package.json 但不在 DB）也会返回，归入「全部依赖」
+ */
+export const listDependenciesFn = createServerFn({ method: "GET" })
+  .validator(listInput)
+  .handler(async ({ data }) => {
+    await ensureSeedData()
+
+    // 一次读取所有 package.json，供聚合复用
+    const pkgFiles = await readMonorepoPackages()
+    // 收集 monorepo 全部依赖名（去重）
+    const allPkgNames = new Set<string>()
+    for (const f of pkgFiles) {
+      for (const n of Object.keys(f.deps)) {
+        // 排除 workspace 内部包
+        if (!n.startsWith("@allblue/")) allPkgNames.add(n)
+      }
+    }
+
+    // 读 DB 所有记录
+    const where: { isWatched?: boolean; category?: string } = {}
+    if (data.watchedOnly) where.isWatched = true
+    if (data.category) where.category = data.category
+    const dbRows = await prisma.thirdPartyDependency.findMany({ where })
+    const dbMap = new Map(dbRows.map((r) => [r.name, r]))
+
+    // 构造结果集：DB 中所有记录 + package.json 中存在但 DB 未跟踪的包
+    const resultNameSet = new Set<string>()
+    if (!data.watchedOnly) {
+      // 全部模式：包含 DB 所有 + package.json 所有
+      for (const n of allPkgNames) resultNameSet.add(n)
+      for (const r of dbRows) resultNameSet.add(r.name)
+    } else {
+      // 关注模式：仅 DB 中 isWatched=true
+      for (const r of dbRows) if (r.isWatched) resultNameSet.add(r.name)
+    }
+
+    const rows: ThirdPartyDependencyRow[] = []
+    for (const name of resultNameSet) {
+      const db = dbMap.get(name)
+      const usages = await aggregateUsages(name, pkgFiles)
+      const currentVersion = pickCurrentVersion(usages)
+      const latestVersion = db?.latestVersion ?? null
+      const versionStatus = compareVersions(currentVersion, latestVersion)
+      const searchLower = data.search?.toLowerCase()
+      const displayName = db?.displayName ?? db?.name ?? name
+      if (
+        searchLower &&
+        !name.toLowerCase().includes(searchLower) &&
+        !displayName.toLowerCase().includes(searchLower)
+      ) {
+        continue
+      }
+
+      rows.push({
+        id: db?.id ?? `untracked:${name}`,
+        name,
+        displayName,
+        description: db?.description ?? null,
+        homepage: db?.homepage ?? null,
+        npmUrl: npmUrlOf(name),
+        category: (db?.category ?? "other") as ThirdPartyDependencyRow["category"],
+        isWatched: db?.isWatched ?? false,
+        priority: (db?.priority ?? "normal") as ThirdPartyDependencyRow["priority"],
+        usages,
+        currentVersion,
+        latestVersion,
+        latestChangelog: db?.latestChangelog ?? null,
+        lastSyncAt: db?.lastSyncAt ? db.lastSyncAt.toISOString() : null,
+        versionStatus,
+        notes: db?.notes ?? null,
+        sortOrder: db?.sortOrder ?? 9999,
+        updatedAt: db?.updatedAt ? db.updatedAt.toISOString() : new Date(0).toISOString(),
+      })
+    }
+
+    // 排序：关注优先 → sortOrder → 名称
+    rows.sort((a, b) => {
+      if (a.isWatched !== b.isWatched) return a.isWatched ? -1 : 1
+      if (a.sortOrder !== b.sortOrder) return a.sortOrder - b.sortOrder
+      return a.name.localeCompare(b.name)
+    })
+
+    return rows
+  })

package/src/server/serverFns/dependency/sync.ts

@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// apps/admin/src/server/serverFns/dependency/sync.ts
+import { createServerFn } from "@tanstack/react-start"
+import { z } from "zod"
+import { prisma } from "@allbluecn/database"
+import type { SyncDependencyResult } from "@allbluecn/kernel"
+import { queryNpmRegistry } from "./helpers"
+
+const syncInput = z.object({
+  /** npm 包名；不存在于 DB 时会 upsert 创建 */
+  name: z.string().min(1),
+})
+
+/**
+ * 同步单个包的最新版本（实时调 npm registry，写入 DB 缓存）。
+ * 包不存在时自动创建一行（isWatched 默认 false，后续可编辑加入关注）。
+ */
+export const syncDependencyFn = createServerFn({ method: "POST" })
+  .validator(syncInput)
+  .handler(async ({ data }): Promise<SyncDependencyResult> => {
+    try {
+      const { latestVersion, homepage, changelog } = await queryNpmRegistry(data.name)
+      await prisma.thirdPartyDependency.upsert({
+        where: { name: data.name },
+        create: {
+          name: data.name,
+          displayName: data.name,
+          homepage,
+          latestVersion,
+          latestChangelog: changelog,
+          lastSyncAt: new Date(),
+          isWatched: false, // 未跟踪包默认不加入关注列表（schema 默认 true 是给 seed 用的）
+        },
+        update: {
+          latestVersion,
+          latestChangelog: changelog,
+          lastSyncAt: new Date(),
+          // homepage 只在 DB 为空时回填，不覆盖 admin 已编辑值
+          ...(homepage ? {} : {}),
+        },
+      })
+      // 若 DB 有空 homepage 且 npm 返回了，单独更新一次
+      if (homepage) {
+        await prisma.thirdPartyDependency.updateMany({
+          where: { name: data.name, homepage: null },
+          data: { homepage },
+        })
+      }
+      return { name: data.name, success: true, latestVersion, homepage, changelog }
+    } catch (e) {
+      return {
+        name: data.name,
+        success: false,
+        error: e instanceof Error ? e.message : String(e),
+      }
+    }
+  })
+
+const syncAllInput = z.object({
+  /** 要同步的包名列表（前端传当前视图的全部包名，含未跟踪的会 upsert 创建） */
+  names: z.array(z.string().min(1)),
+})
+
+/**
+ * 批量同步（顺序请求避免 npm registry 速率限制）。
+ * 接收明确的包名列表，未跟踪的包会 upsert 创建 DB 行。
+ * 返回每个包的结果。
+ */
+export const syncAllDependenciesFn = createServerFn({ method: "POST" })
+  .validator(syncAllInput)
+  .handler(async ({ data }): Promise<SyncDependencyResult[]> => {
+    const results: SyncDependencyResult[] = []
+    // 顺序执行（npm registry 建议不并发轰炸）
+    for (const name of data.names) {
+      try {
+        const { latestVersion, homepage, changelog } = await queryNpmRegistry(name)
+        await prisma.thirdPartyDependency.upsert({
+          where: { name },
+          create: {
+            name,
+            displayName: name,
+            homepage,
+            latestVersion,
+            latestChangelog: changelog,
+            lastSyncAt: new Date(),
+            isWatched: false, // 未跟踪包默认不加入关注列表
+          },
+          update: { latestVersion, latestChangelog: changelog, lastSyncAt: new Date() },
+        })
+        // 若 DB 有空 homepage 且 npm 返回了，单独回填（不覆盖 admin 已编辑值）
+        if (homepage) {
+          await prisma.thirdPartyDependency.updateMany({
+            where: { name, homepage: null },
+            data: { homepage },
+          })
+        }
+        results.push({ name, success: true, latestVersion, homepage, changelog })
+      } catch (e) {
+        results.push({
+          name,
+          success: false,
+          error: e instanceof Error ? e.message : String(e),
+        })
+      }
+    }
+    return results
+  })

package/src/server/serverFns/dependency/update.ts

@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// apps/admin/src/server/serverFns/dependency/update.ts
+import { createServerFn } from "@tanstack/react-start"
+import { z } from "zod"
+import { prisma } from "@allbluecn/database"
+import type { UpdateDependencyInput } from "@allbluecn/kernel"
+
+const updateInput = z.object({
+  id: z.string().min(1),
+  displayName: z.string().optional(),
+  description: z.string().nullable().optional(),
+  homepage: z.string().nullable().optional(),
+  category: z.enum(["framework", "ui", "editor", "ai", "state", "auth", "tool", "other"]).optional(),
+  isWatched: z.boolean().optional(),
+  priority: z.enum(["high", "normal", "low"]).optional(),
+  notes: z.string().nullable().optional(),
+  sortOrder: z.number().optional(),
+}) satisfies z.ZodType<UpdateDependencyInput & { id: string }>
+
+/** 编辑依赖元数据（名称不可改） */
+export const updateDependencyFn = createServerFn({ method: "POST" })
+  .validator(updateInput)
+  .handler(async ({ data }) => {
+    const { id, ...patch } = data
+    // 过滤 undefined 字段，避免覆盖为 null
+    const cleanPatch: Record<string, unknown> = {}
+    for (const [k, v] of Object.entries(patch)) {
+      if (v !== undefined) cleanPatch[k] = v
+    }
+    const updated = await prisma.thirdPartyDependency.update({
+      where: { id },
+      data: cleanPatch,
+    })
+    return { id: updated.id, updatedAt: updated.updatedAt.toISOString() }
+  })