@allbluecn/web-app 0.10.3 → 0.11.1

package/src/lib/changelog/sdk-versions.ts

@@ -10,7 +10,7 @@ export const SDK_GROUPS: SdkGroup[] = [
         "name": "@tanstack/react-start",
         "displayName": "TanStack Start",
         "version": "v1.168.49",
-        "lastUpdate": "Sep 9, 2026",
+        "lastUpdate": "Sep 11, 2026",
         "source": "apps/web/package.json#dependencies",
         "docsUrl": "https://tanstack.com/start/latest"
       },
@@ -18,7 +18,7 @@ export const SDK_GROUPS: SdkGroup[] = [
         "name": "@tanstack/react-router",
         "displayName": "TanStack Router",
         "version": "v1.170.32",
-        "lastUpdate": "Sep 9, 2026",
+        "lastUpdate": "Sep 11, 2026",
         "source": "apps/web/package.json#dependencies",
         "docsUrl": "https://tanstack.com/router/latest"
       },
@@ -26,7 +26,7 @@ export const SDK_GROUPS: SdkGroup[] = [
         "name": "@tanstack/react-query",
         "displayName": "TanStack Query",
         "version": "v5.102.8",
-        "lastUpdate": "Sep 9, 2026",
+        "lastUpdate": "Sep 11, 2026",
         "source": "apps/web/package.json#dependencies",
         "docsUrl": "https://tanstack.com/query/latest"
       },
@@ -34,7 +34,7 @@ export const SDK_GROUPS: SdkGroup[] = [
         "name": "@tanstack/ai",
         "displayName": "TanStack AI",
         "version": "v0.52.0",
-        "lastUpdate": "Sep 9, 2026",
+        "lastUpdate": "Sep 11, 2026",
         "source": "apps/web/package.json#dependencies",
         "docsUrl": "https://tanstack.com/ai/latest"
       },
@@ -42,7 +42,7 @@ export const SDK_GROUPS: SdkGroup[] = [
         "name": "@tanstack/react-table",
         "displayName": "TanStack Table",
         "version": "v9.2.3",
-        "lastUpdate": "Sep 9, 2026",
+        "lastUpdate": "Sep 11, 2026",
         "source": "apps/web/package.json#dependencies",
         "docsUrl": "https://tanstack.com/table/latest"
       },
@@ -50,7 +50,7 @@ export const SDK_GROUPS: SdkGroup[] = [
         "name": "@tanstack/react-form",
         "displayName": "TanStack Form",
         "version": "v2.0.0-alpha.2",
-        "lastUpdate": "Sep 9, 2026",
+        "lastUpdate": "Sep 11, 2026",
         "source": "apps/web/package.json#dependencies",
         "docsUrl": "https://tanstack.com/form/latest"
       },
@@ -58,7 +58,7 @@ export const SDK_GROUPS: SdkGroup[] = [
         "name": "@tanstack/charts",
         "displayName": "TanStack Charts",
         "version": "v0.16.0",
-        "lastUpdate": "Sep 9, 2026",
+        "lastUpdate": "Sep 11, 2026",
         "source": "apps/admin/package.json#dependencies",
         "docsUrl": "https://tanstack.com/charts/latest"
       },
@@ -66,7 +66,7 @@ export const SDK_GROUPS: SdkGroup[] = [
         "name": "@tanstack/react-pacer",
         "displayName": "TanStack Pacer",
         "version": "v0.23.0",
-        "lastUpdate": "Sep 9, 2026",
+        "lastUpdate": "Sep 11, 2026",
         "source": "apps/web/package.json#dependencies",
         "docsUrl": "https://tanstack.com/pacer/latest"
       },
@@ -74,7 +74,7 @@ export const SDK_GROUPS: SdkGroup[] = [
         "name": "@tanstack/react-hotkeys",
         "displayName": "TanStack Hotkeys",
         "version": "v0.10.0",
-        "lastUpdate": "Sep 9, 2026",
+        "lastUpdate": "Sep 11, 2026",
         "source": "apps/web/package.json#dependencies",
         "docsUrl": "https://tanstack.com/hotkeys/latest"
       },
@@ -82,7 +82,7 @@ export const SDK_GROUPS: SdkGroup[] = [
         "name": "@tanstack/react-virtual",
         "displayName": "TanStack Virtual",
         "version": "v3.14.10",
-        "lastUpdate": "Sep 9, 2026",
+        "lastUpdate": "Sep 11, 2026",
         "source": "apps/admin/package.json#dependencies",
         "docsUrl": "https://tanstack.com/virtual/latest"
       }
@@ -95,15 +95,15 @@ export const SDK_GROUPS: SdkGroup[] = [
     "items": [
       {
         "name": "@allbluecn/web-app",
-        "version": "v0.10.3",
-        "lastUpdate": "Sep 9, 2026",
+        "version": "v0.11.1",
+        "lastUpdate": "Sep 12, 2026",
         "source": "apps/web/package.json",
         "docsUrl": "https://github.com/allbluecn/allblue"
       },
       {
         "name": "@allbluecn/kernel",
-        "version": "v0.6.0",
-        "lastUpdate": "Sep 9, 2026",
+        "version": "v0.8.0",
+        "lastUpdate": "Sep 12, 2026",
         "source": "packages/kernel/package.json",
         "docsUrl": "https://github.com/allbluecn/allblue"
       }
@@ -117,42 +117,42 @@ export const SDK_GROUPS: SdkGroup[] = [
       {
         "name": "Vite",
         "version": "v8.1.5",
-        "lastUpdate": "Sep 9, 2026",
+        "lastUpdate": "Sep 11, 2026",
         "source": "apps/web/package.json#devDependencies",
         "docsUrl": "https://vite.dev/"
       },
       {
         "name": "Node.js",
         "version": "v24.19.0",
-        "lastUpdate": "Sep 9, 2026",
+        "lastUpdate": "Sep 11, 2026",
         "source": ".nvmrc",
         "docsUrl": "https://nodejs.org/"
       },
       {
         "name": "Prisma",
         "version": "v7.8.0",
-        "lastUpdate": "Sep 9, 2026",
+        "lastUpdate": "Sep 11, 2026",
         "source": "packages/database/package.json#devDependencies",
         "docsUrl": "https://www.prisma.io/docs"
       },
       {
         "name": "shadcn UI",
         "version": "v1.2.4",
-        "lastUpdate": "Sep 9, 2026",
+        "lastUpdate": "Sep 11, 2026",
         "source": "apps/web/package.json#dependencies",
         "docsUrl": "https://ui.shadcn.com/"
       },
       {
         "name": "TipTap",
         "version": "v3.27.4",
-        "lastUpdate": "Sep 9, 2026",
+        "lastUpdate": "Sep 11, 2026",
         "source": "apps/web/package.json#dependencies",
         "docsUrl": "https://tiptap.dev/"
       },
       {
         "name": "Lucide React",
-        "version": "v1.27.0",
-        "lastUpdate": "Sep 9, 2026",
+        "version": "v1.43.0",
+        "lastUpdate": "Sep 11, 2026",
         "source": "apps/web/package.json#dependencies",
         "docsUrl": "https://lucide.dev/"
       }

package/src/lib/collections/knowledge/knowledge-bases-collection.ts

@@ -20,10 +20,12 @@ import { queryCollectionOptions } from '@tanstack/query-db-collection'
 import { listKnowledgeFn } from '@/server/serverFns/knowledge'
 import { getQueryClient } from '@/lib/query-client-seam'
 
+export const KNOWLEDGE_BASES_QUERY_KEY = ['knowledge-bases'] as const
+
 export const knowledgeBasesCollection = createCollection(
   queryCollectionOptions({
     id: 'knowledge-bases',
-    queryKey: ['knowledge-bases'],
+    queryKey: KNOWLEDGE_BASES_QUERY_KEY,
     queryFn: () => listKnowledgeFn(),
     getKey: (item: { id: string }) => item.id,
     queryClient: getQueryClient(),

package/src/lib/collections/reference/workspaces-collection.ts

@@ -20,10 +20,12 @@ import { queryCollectionOptions } from '@tanstack/query-db-collection'
 import { listPinnedWorkspacesBriefFn } from '@/server/serverFns/workspace'
 import { getQueryClient } from '@/lib/query-client-seam'
 
+export const WORKSPACES_QUERY_KEY = ['workspaces'] as const
+
 export const workspacesCollection = createCollection(
   queryCollectionOptions({
     id: 'workspaces',
-    queryKey: ['workspaces'],
+    queryKey: WORKSPACES_QUERY_KEY,
     queryFn: () => listPinnedWorkspacesBriefFn(),
     getKey: (item: { id: string }) => item.id,
     queryClient: getQueryClient(),

package/src/lib/edition-desktop.ts

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// beforeLoad 同构执行（SSR + 客户端导航），不能读 process.env；
+// Vite define 已注入 import.meta.env.VITE_DEPLOY_TARGET（见 vite.shared.ts）
+export function isDesktopEdition(): boolean {
+  return import.meta.env.VITE_DEPLOY_TARGET === 'desktop'
+}

package/src/lib/fetch-json.ts

@@ -0,0 +1,23 @@
+/**
+ * 带默认超时与 JSON 解析的 fetch 封装（供客户端 SDK / 工具函数复用）。
+ *
+ * 默认超时 10s：接口调用应在 10 秒内返回；超过视为网络/服务异常，
+ * 由上层（React Query 等）触发重试或降级。
+ *
+ * 调用方可传入自己的 AbortSignal 覆盖默认超时（如与外层 Promise.race
+ * 联动，或用 AbortController 手动取消），不会被默认超时覆盖。
+ *
+ * @throws 当响应非 2xx 时抛 `Error`，消息含 URL 与 HTTP 状态码，便于日志定位。
+ */
+export async function fetchJson<T>(url: string, init?: RequestInit): Promise<T> {
+  const res = await fetch(url, {
+    ...init,
+    headers: {
+      "content-type": "application/json",
+      ...(init?.headers ?? {}),
+    },
+    signal: init?.signal ?? AbortSignal.timeout(10_000),
+  })
+  if (!res.ok) throw new Error(`fetchJson ${url} 失败：HTTP ${res.status}`)
+  return (await res.json()) as T
+}

package/src/{components/workspace/workspace-kb-card.tsx → lib/i18n/resolver.ts}

@@ -15,17 +15,11 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-import { LayoutGrid } from "lucide-react";
-import { m } from "@/paraglide/messages.js";
+// paraglide 动态 key 解析：静态具名导出（m.xxx）覆盖不到的运行时拼接 key 场景。
+import * as messages from "@/paraglide/messages.js";
 
-export function WorkspaceKbCard() {
-  return (
-    <div className="mb-6 rounded-lg border bg-card p-4">
-      <div className="mb-3 flex items-center gap-2">
-        <LayoutGrid className="size-4 text-muted-foreground" />
-        <h2 className="text-base font-semibold">{m.workspace_home_kbTitle()}</h2>
-      </div>
-      <p className="py-4 text-center text-sm text-muted-foreground">{m.workspace_home_kbPlaceholder()}</p>
-    </div>
-  );
+/** 按消息 key 取文案；未知 key 原样返回（便于发现缺失） */
+export function t(key: string): string {
+  const fn = (messages as unknown as Record<string, unknown>)[key];
+  return typeof fn === "function" ? (fn as () => string)() : key;
 }

package/src/lib/sanitize.ts

@@ -1,5 +1,18 @@
 import DOMPurify from 'isomorphic-dompurify'
 
+// HTML 清理：默认配置（html + svg + mathMl profile 均启用），
+// 覆盖富文本 diff、附件预览等 7 处 HTML 渲染场景。
 export function sanitize(html: string): string {
   return DOMPurify.sanitize(html)
-}
+}
+
+// SVG 清理：头像渲染（NotionAvatar）专用。
+// 显式复用默认配置——DOMPurify 默认 profile 已包含 SVG 滤镜元素
+// （<defs>/<filter>/<feMorphology>/<feFlood>/<feComposite>/<feMerge>/<feMergeNode>），
+// 同时清除 <script>/on*/javascript: 等 XSS 载荷。
+// 禁止改成 USE_PROFILES: { svg: true }——严格 SVG profile 会移除全部 fe* 滤镜元素，
+// 头像轮廓辉光（feMorphology+feFlood+feComposite+feMerge）会失效渲染白屏。
+// 结构完整性由 __tests__/security/xss-sanitize.test.ts 的双向断言锁定。
+export function sanitizeSvg(svg: string): string {
+  return DOMPurify.sanitize(svg)
+}

package/src/lib/session.ts

@@ -17,7 +17,7 @@
 
 import { getSession } from 'start-authjs'
 import type { AuthSession } from 'start-authjs'
-import { authConfig } from './auth/auth.config'
+import { getAuthConfig } from './auth/auth.config'
 
 export type SessionUser = NonNullable<AuthSession['user']> & {
   id?: string
@@ -40,5 +40,13 @@ export type Session = Omit<AuthSession, 'user'> & { user?: SessionUser | null }
 
 export async function getCurrentSession(request?: Request): Promise<Session | null> {
   if (!request) return null
-  return (await getSession(request, authConfig)) as Session | null
+  try {
+    return (await getSession(request, await getAuthConfig())) as Session | null
+  } catch (error) {
+    // JWT 解密失败（AUTH_SECRET 轮换 / 跨应用同名 cookie 污染）等效于无 session：
+    // 返回 null 走未登录分支；@auth/core 会自行清理坏 cookie。
+    // 不兜底时 JWTSessionError 会炸穿所有未捕获的调用点（route beforeLoad / serverFn）。
+    console.warn('[session] 读取 session 失败（坏 cookie 或 auth 配置异常），降级为未登录:', error instanceof Error ? error.message : error)
+    return null
+  }
 }

package/src/lib/vector-store/__tests__/factory.test.ts

@@ -54,6 +54,6 @@ describe("getVectorStore 工厂", () => {
 
   it("未知 VECTOR_BACKEND 抛错", async () => {
     process.env.VECTOR_BACKEND = "unknown_backend";
-    await expect(getVectorStore()).rejects.toMatchObject({ message: expect.stringContaining("未知 VECTOR_BACKEND") });
+    await expect(getVectorStore()).rejects.toThrow("未知 VECTOR_BACKEND");
   });
 });

package/src/lib/vector-store/__tests__/sqlite-vec-store.test.ts

@@ -131,13 +131,13 @@ describe("sqliteVecStore", () => {
   it("非法表名/列名抛错", async () => {
     await expect(
       sqliteVecStore.searchByVector([1, 0, 0, 0], "evil" as never)
-    ).rejects.toMatchObject({ message: expect.stringContaining("非法表名") });
+    ).rejects.toThrow("非法表名");
     await expect(
       sqliteVecStore.deleteEmbeddings(
         "knowledge_embeddings",
         "evil" as never,
         "x"
       )
-    ).rejects.toMatchObject({ message: expect.stringContaining("非法删除过滤列") });
+    ).rejects.toThrow("非法删除过滤列");
   });
 });

package/src/plugins/core/tags/__tests__/tags.test.ts

@@ -140,7 +140,7 @@ describe('listTagsFn', () => {
   it('未登录时抛 UnauthorizedError', async () => {
     mocks.getCurrentSession.mockResolvedValue(null)
 
-    await expect(listTagsFn()).rejects.toMatchObject({ message: expect.stringMatching(/UNAUTHORIZED/) })
+    await expect(listTagsFn()).rejects.toThrow(/UNAUTHORIZED/)
   })
 })
 
@@ -194,7 +194,7 @@ describe('createTagFn', () => {
   it('未登录时抛 UnauthorizedError', async () => {
     mocks.getCurrentSession.mockResolvedValue(null)
 
-    await expect(createTagFn({ data: { name: 'AI' } })).rejects.toMatchObject({ message: expect.stringMatching(/UNAUTHORIZED/) })
+    await expect(createTagFn({ data: { name: 'AI' } })).rejects.toThrow(/UNAUTHORIZED/)
   })
 })
 
@@ -227,7 +227,7 @@ describe('updateTagFn', () => {
     mocks.getCurrentSession.mockResolvedValue({ user: { id: 'user-1' } })
     mocks.findFirst.mockResolvedValue(null)
 
-    await expect(updateTagFn({ data: { id: 't-other', name: 'X' } })).rejects.toMatchObject({ message: expect.stringMatching(/FORBIDDEN/) })
+    await expect(updateTagFn({ data: { id: 't-other', name: 'X' } })).rejects.toThrow(/FORBIDDEN/)
     expect(mocks.update).not.toHaveBeenCalled()
   })
 
@@ -237,13 +237,13 @@ describe('updateTagFn', () => {
       .mockResolvedValueOnce({ id: 't1', name: 'AI', userId: 'user-1' })
       .mockResolvedValueOnce({ id: 't2', name: 'AI-New', userId: 'user-1' })
 
-    await expect(updateTagFn({ data: { id: 't1', name: 'AI-New' } })).rejects.toMatchObject({ message: expect.stringMatching(/TAG_NAME_CONFLICT/) })
+    await expect(updateTagFn({ data: { id: 't1', name: 'AI-New' } })).rejects.toThrow(/TAG_NAME_CONFLICT/)
   })
 
   it('未登录时抛 UnauthorizedError', async () => {
     mocks.getCurrentSession.mockResolvedValue(null)
 
-    await expect(updateTagFn({ data: { id: 't1', name: 'X' } })).rejects.toMatchObject({ message: expect.stringMatching(/UNAUTHORIZED/) })
+    await expect(updateTagFn({ data: { id: 't1', name: 'X' } })).rejects.toThrow(/UNAUTHORIZED/)
   })
 })
 
@@ -258,7 +258,7 @@ describe('deleteTagFn', () => {
     mocks.getCurrentSession.mockResolvedValue({ user: { id: 'user-1' } })
     mocks.findFirst.mockResolvedValue(null)
 
-    await expect(deleteTagFn({ data: { id: 't-other' } })).rejects.toMatchObject({ message: expect.stringMatching(/FORBIDDEN/) })
+    await expect(deleteTagFn({ data: { id: 't-other' } })).rejects.toThrow(/FORBIDDEN/)
     expect(mocks.update).not.toHaveBeenCalled()
   })
 
@@ -279,7 +279,7 @@ describe('deleteTagFn', () => {
   it('未登录时抛 UnauthorizedError', async () => {
     mocks.getCurrentSession.mockResolvedValue(null)
 
-    await expect(deleteTagFn({ data: { id: 't1' } })).rejects.toMatchObject({ message: expect.stringMatching(/UNAUTHORIZED/) })
+    await expect(deleteTagFn({ data: { id: 't1' } })).rejects.toThrow(/UNAUTHORIZED/)
   })
 })
 
@@ -329,7 +329,7 @@ describe('reorderTagsFn', () => {
   it('未登录时抛 UnauthorizedError', async () => {
     mocks.getCurrentSession.mockResolvedValue(null)
 
-    await expect(reorderTagsFn({ data: { orderedIds: ['t1'] } })).rejects.toMatchObject({ message: expect.stringMatching(/UNAUTHORIZED/) })
+    await expect(reorderTagsFn({ data: { orderedIds: ['t1'] } })).rejects.toThrow(/UNAUTHORIZED/)
   })
 })
 
@@ -342,7 +342,7 @@ describe('assignTagsToPrdFn', () => {
     mocks.getCurrentSession.mockResolvedValue({ user: { id: 'user-1' } })
     mocks.prdFindFirst.mockResolvedValue(null)
 
-    await expect(assignTagsToPrdFn({ data: { prdId: 'p1', tagIds: ['t1'] } })).rejects.toMatchObject({ message: expect.stringMatching(/FORBIDDEN/) })
+    await expect(assignTagsToPrdFn({ data: { prdId: 'p1', tagIds: ['t1'] } })).rejects.toThrow(/FORBIDDEN/)
   })
 
   it('校验 tagId 不属于自己时抛 FORBIDDEN', async () => {
@@ -350,7 +350,7 @@ describe('assignTagsToPrdFn', () => {
     mocks.prdFindFirst.mockResolvedValue({ id: 'p1' })
     mocks.findFirst.mockResolvedValue(null)
 
-    await expect(assignTagsToPrdFn({ data: { prdId: 'p1', tagIds: ['t-other'] } })).rejects.toMatchObject({ message: expect.stringMatching(/FORBIDDEN/) })
+    await expect(assignTagsToPrdFn({ data: { prdId: 'p1', tagIds: ['t-other'] } })).rejects.toThrow(/FORBIDDEN/)
   })
 
   it('事务内 diff 增删', async () => {