@allbluecn/web-app 0.11.0 → 0.11.2

package/src/routes/_login/email-unsubscribe/route.lazy.tsx

@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createLazyFileRoute, Link } from '@tanstack/react-router'
+import { RainbowButton } from '@/components/magicui/rainbow-button'
+import { ArrowRight, Settings } from 'lucide-react'
+import { AuthLayout, AuthLayoutLeft, AuthLayoutRight } from '@/components/auth/auth-layout'
+import { AuthHeader } from '@/components/auth/auth-header'
+import { AuthBrandPanel } from '@/components/auth/auth-brand-panel'
+import { m } from '@/paraglide/messages.js'
+
+export const Route = createLazyFileRoute('/_login/email-unsubscribe')({
+  component: EmailUnsubscribePage,
+})
+
+function EmailUnsubscribePage() {
+  const { ok } = Route.useRouteContext()
+
+  return (
+    <AuthLayout>
+      <AuthLayoutLeft>
+        {ok ? (
+          <>
+            <AuthHeader
+              title={m.common_email_unsubscribe_success()}
+              subtitle={m.common_email_unsubscribe_successDesc()}
+            />
+            <RainbowButton asChild className="w-full">
+              <Link to="/settings/notifications">
+                <Settings className="mr-2 h-4 w-4" />
+                {m.common_email_unsubscribe_manage()}
+                <ArrowRight className="ml-2 h-4 w-4" />
+              </Link>
+            </RainbowButton>
+            <div className="mt-4 text-center text-sm text-muted-foreground">
+              {m.common_email_unsubscribe_transactionalNote()}
+            </div>
+          </>
+        ) : (
+          <>
+            <AuthHeader
+              title={m.common_email_unsubscribe_invalid()}
+              subtitle={m.common_email_unsubscribe_invalidDesc()}
+            />
+            <RainbowButton asChild className="w-full">
+              <Link to="/login">
+                {m.common_email_unsubscribe_login()}
+                <ArrowRight className="ml-2 h-4 w-4" />
+              </Link>
+            </RainbowButton>
+          </>
+        )}
+      </AuthLayoutLeft>
+      <AuthLayoutRight>
+        <AuthBrandPanel
+          title="AllBlue"
+          subtitle={ok ? m.common_email_unsubscribe_success() : m.common_email_unsubscribe_invalid()}
+        />
+      </AuthLayoutRight>
+    </AuthLayout>
+  )
+}

package/src/routes/_login/email-unsubscribe/route.tsx

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createFileRoute } from '@tanstack/react-router'
+import { unsubscribeByEmailTokenFn } from '@/server/serverFns/email-unsubscribe'
+
+export const Route = createFileRoute('/_login/email-unsubscribe')({
+  validateSearch: (s: { token?: string }) => ({ token: s.token ?? '' }),
+  beforeLoad: async ({ search }) => {
+    if (!search.token) return { ok: false }
+    const r = await unsubscribeByEmailTokenFn({ data: { token: search.token } })
+    return { ok: r.ok }
+  },
+})

package/src/routes/_login/forgot-password/route.lazy.tsx

@@ -62,7 +62,7 @@ function ForgotPasswordPage() {
           onSubmit={(e) => { e.preventDefault(); e.stopPropagation(); form.handleSubmit() }}
           className="space-y-6"
         >
-          <AppField name="email" form={form}>
+          <AppField name="email" form={form} renderError={false}>
             {(field) => (
               <IconInput
                 icon={Mail}
@@ -71,6 +71,7 @@ function ForgotPasswordPage() {
                 value={field.value}
                 onBlur={field.handleBlur}
                 onChange={(e) => field.handleChange(e.target.value)}
+                error={field.meta.isTouched && field.errors.length > 0 ? (field.errors.map((e) => e.message).filter(Boolean)[0] as string | undefined) : undefined}
               />
             )}
           </AppField>

package/src/routes/_login/login/route.lazy.tsx

@@ -166,7 +166,7 @@ function LoginPage() {
           onSubmit={(e) => { e.preventDefault(); e.stopPropagation(); form.handleSubmit() }}
           className="space-y-6"
         >
-          <AppField name="email" form={form}>
+          <AppField name="email" form={form} renderError={false}>
             {(field) => (
               <IconInput
                 icon={Mail}
@@ -175,6 +175,7 @@ function LoginPage() {
                 value={field.value}
                 onBlur={field.handleBlur}
                 onChange={(e) => field.handleChange(e.target.value)}
+                error={field.meta.isTouched && field.errors.length > 0 ? (field.errors.map((e) => e.message).filter(Boolean)[0] as string | undefined) : undefined}
               />
             )}
           </AppField>
@@ -184,7 +185,7 @@ function LoginPage() {
               <SsoSection email={email} />
             )}
           />
-          <AppField name="password" form={form}>
+          <AppField name="password" form={form} renderError={false}>
             {(field) => (
               <PasswordInput
                 label={m.auth_login_passwordLabel()}
@@ -192,6 +193,7 @@ function LoginPage() {
                 value={field.value}
                 onBlur={field.handleBlur}
                 onChange={(e) => field.handleChange(e.target.value)}
+                error={field.meta.isTouched && field.errors.length > 0 ? (field.errors.map((e) => e.message).filter(Boolean)[0] as string | undefined) : undefined}
               />
             )}
           </AppField>

package/src/routes/_login/register/route.lazy.tsx

@@ -39,7 +39,7 @@ export const Route = createLazyFileRoute('/_login/register')({
 
 function RegisterPage() {
   const router = useRouter()
-  const { googleEnabled } = Route.useLoaderData()
+  const { googleEnabled, registrationMode } = Route.useLoaderData()
   const { invite, email: emailFromUrl } = Route.useSearch()
   const registerFeatures = [
     { icon: Users, label: m.auth_features_userResearch(), desc: m.auth_features_userResearchDesc() },
@@ -58,6 +58,10 @@ function RegisterPage() {
     },
     validators: [{ run: registerSchema as any, triggers: ['change'] }],
     onSubmit: async ({ value }) => {
+      if (registrationMode === 'invite' && !value.invitationCode?.trim()) {
+        toast.error(m.common_form_invitationCodeRequired())
+        return
+      }
       try {
         await registerFn({ data: value })
         toast.success(m.auth_register_success())
@@ -86,7 +90,7 @@ function RegisterPage() {
           onSubmit={(e) => { e.preventDefault(); e.stopPropagation(); form.handleSubmit() }}
           className="space-y-6"
         >
-          <AppField name="username" form={form}>
+          <AppField name="username" form={form} renderError={false}>
             {(field) => (
               <IconInput
                 icon={User}
@@ -95,10 +99,11 @@ function RegisterPage() {
                 value={field.value}
                 onBlur={field.handleBlur}
                 onChange={(e) => field.handleChange(e.target.value)}
+                error={field.meta.isTouched && field.errors.length > 0 ? (field.errors.map((e) => e.message).filter(Boolean)[0] as string | undefined) : undefined}
               />
             )}
           </AppField>
-          <AppField name="email" form={form}>
+          <AppField name="email" form={form} renderError={false}>
             {(field) => (
               <IconInput
                 icon={Mail}
@@ -107,11 +112,12 @@ function RegisterPage() {
                 value={field.value}
                 onBlur={field.handleBlur}
                 onChange={(e) => field.handleChange(e.target.value)}
+                error={field.meta.isTouched && field.errors.length > 0 ? (field.errors.map((e) => e.message).filter(Boolean)[0] as string | undefined) : undefined}
               />
             )}
           </AppField>
           <div className="grid grid-cols-2 gap-4">
-            <AppField name="password" form={form}>
+            <AppField name="password" form={form} renderError={false}>
               {(field) => (
                 <PasswordInput
                   label={m.auth_register_passwordLabel()}
@@ -119,10 +125,11 @@ function RegisterPage() {
                   value={field.value}
                   onBlur={field.handleBlur}
                   onChange={(e) => field.handleChange(e.target.value)}
+                  error={field.meta.isTouched && field.errors.length > 0 ? (field.errors.map((e) => e.message).filter(Boolean)[0] as string | undefined) : undefined}
                 />
               )}
             </AppField>
-            <AppField name="confirmPassword" form={form}>
+            <AppField name="confirmPassword" form={form} renderError={false}>
               {(field) => (
                 <PasswordInput
                   label={m.auth_register_confirmPasswordLabel()}
@@ -130,22 +137,26 @@ function RegisterPage() {
                   value={field.value}
                   onBlur={field.handleBlur}
                   onChange={(e) => field.handleChange(e.target.value)}
+                  error={field.meta.isTouched && field.errors.length > 0 ? (field.errors.map((e) => e.message).filter(Boolean)[0] as string | undefined) : undefined}
                 />
               )}
             </AppField>
           </div>
-          <AppField name="invitationCode" form={form}>
-            {(field) => (
-              <IconInput
-                icon={QrCode}
-                label={m.auth_register_invitationCodeLabel()}
-                placeholder={m.auth_register_invitationCodePlaceholder()}
-                value={field.value}
-                onBlur={field.handleBlur}
-                onChange={(e) => field.handleChange(e.target.value)}
-              />
-            )}
-          </AppField>
+          {registrationMode === 'invite' && (
+            <AppField name="invitationCode" form={form} renderError={false}>
+              {(field) => (
+                <IconInput
+                  icon={QrCode}
+                  label={m.auth_register_invitationCodeLabel()}
+                  placeholder={m.auth_register_invitationCodePlaceholder()}
+                  value={field.value}
+                  onBlur={field.handleBlur}
+                  onChange={(e) => field.handleChange(e.target.value)}
+                  error={field.meta.isTouched && field.errors.length > 0 ? (field.errors.map((e) => e.message).filter(Boolean)[0] as string | undefined) : undefined}
+                />
+              )}
+            </AppField>
+          )}
           <form.Subscribe
             selector={(state) => state.isSubmitting}
             children={(isSubmitting) => (

package/src/routes/_login/register/route.tsx

@@ -18,11 +18,18 @@
 import { createFileRoute } from '@tanstack/react-router'
 import { z } from 'zod'
 import { getAuthProviders } from '@/server/serverFns/auth/providers'
+import { getRegistrationModeFn } from '@/server/serverFns/auth/registration-mode'
 
 export const Route = createFileRoute('/_login/register')({
   validateSearch: z.object({
     invite: z.string().optional(),
     email: z.string().optional(),
   }),
-  loader: () => getAuthProviders(),
+  loader: async () => {
+    const [providers, { mode: registrationMode }] = await Promise.all([
+      getAuthProviders(),
+      getRegistrationModeFn(),
+    ])
+    return { ...providers, registrationMode }
+  },
 })

package/src/routes/_login/reset-password/route.lazy.tsx

@@ -66,7 +66,7 @@ function ResetPasswordPage() {
           className="space-y-6"
         >
           <div className="grid grid-cols-2 gap-4">
-            <AppField name="password" form={form}>
+            <AppField name="password" form={form} renderError={false}>
               {(field) => (
                 <PasswordInput
                   label={m.auth_resetPassword_newPasswordLabel()}
@@ -74,10 +74,11 @@ function ResetPasswordPage() {
                   value={field.value}
                   onBlur={field.handleBlur}
                   onChange={(e) => field.handleChange(e.target.value)}
+                  error={field.meta.isTouched && field.errors.length > 0 ? (field.errors.map((e) => e.message).filter(Boolean)[0] as string | undefined) : undefined}
                 />
               )}
             </AppField>
-            <AppField name="confirmPassword" form={form}>
+            <AppField name="confirmPassword" form={form} renderError={false}>
               {(field) => (
                 <PasswordInput
                   label={m.auth_resetPassword_confirmPasswordLabel()}
@@ -85,6 +86,7 @@ function ResetPasswordPage() {
                   value={field.value}
                   onBlur={field.handleBlur}
                   onChange={(e) => field.handleChange(e.target.value)}
+                  error={field.meta.isTouched && field.errors.length > 0 ? (field.errors.map((e) => e.message).filter(Boolean)[0] as string | undefined) : undefined}
                 />
               )}
             </AppField>

package/src/routes/_login/schemas/-auth.ts

@@ -18,29 +18,52 @@
 import { z } from "zod"
 import { m } from '@/paraglide/messages.js'
 
+const passwordRule = z
+  .string()
+  .min(8, m.common_form_passwordMin8())
+  .max(32, m.common_form_passwordMax32())
+  .regex(/[a-zA-Z]/, m.common_form_passwordNeedLetter())
+  .regex(/[0-9]/, m.common_form_passwordNeedDigit())
+
+const usernameRule = z
+  .string()
+  .regex(/^[a-zA-Z0-9_-]{3,20}$/, m.common_form_usernameCharset())
+
+const invitationCodeRule = z
+  .string()
+  .refine((v) => v === "" || /^[A-Za-z0-9]{3,32}$/.test(v), {
+    message: m.common_form_invitationCodeFormat(),
+  })
+  .default("")
+
+const emailRule = z
+  .string()
+  .transform((v) => v.toLowerCase().trim())
+  .pipe(z.string().email(m.common_form_invalidEmail()))
+
 export const loginSchema = z.object({
-  email: z.string().email(m.common_form_invalidEmail()),
+  email: emailRule,
   password: z.string().min(1, m.common_form_passwordNotEmpty()),
   remember: z.boolean(),
 })
 
 export const registerSchema = z.object({
-  username: z.string().min(3, m.common_form_usernameMin3()).max(20),
-  email: z.string().email(m.common_form_invalidEmail()),
-  password: z.string().min(8, m.common_form_passwordMin8()),
+  username: usernameRule,
+  email: emailRule,
+  password: passwordRule,
   confirmPassword: z.string(),
-  invitationCode: z.string().min(1, m.common_form_invitationCodeRequired()),
+  invitationCode: invitationCodeRule,
 }).refine((data) => data.password === data.confirmPassword, {
   message: m.common_form_passwordMismatch(),
   path: ["confirmPassword"],
 })
 
 export const forgotPasswordSchema = z.object({
-  email: z.string().email(m.common_form_invalidEmail()),
+  email: emailRule,
 })
 
 export const resetPasswordSchema = z.object({
-  password: z.string().min(8, m.common_form_passwordMin8()),
+  password: passwordRule,
   confirmPassword: z.string(),
 }).refine((d) => d.password === d.confirmPassword, {
   message: m.common_form_passwordMismatch(),

package/src/routes/_login/verify-email/route.lazy.tsx

@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createLazyFileRoute, Link } from '@tanstack/react-router'
+import { toast } from '@/components/ui/sonner'
+import { RainbowButton } from '@/components/magicui/rainbow-button'
+import { ArrowRight } from 'lucide-react'
+import { AuthLayout, AuthLayoutLeft, AuthLayoutRight } from '@/components/auth/auth-layout'
+import { AuthHeader } from '@/components/auth/auth-header'
+import { AuthBrandPanel } from '@/components/auth/auth-brand-panel'
+import { resendVerificationEmailFn } from '@/server/serverFns/auth/email-verification'
+import { m } from '@/paraglide/messages.js'
+
+export const Route = createLazyFileRoute('/_login/verify-email')({
+  component: VerifyEmailPage,
+})
+
+function VerifyEmailPage() {
+  const { verified } = Route.useRouteContext()
+
+  const handleResend = async () => {
+    try {
+      const r = await resendVerificationEmailFn({ data: {} })
+      toast.success(
+        r.alreadyVerified ? m.auth_verify_alreadyVerified() : m.auth_verify_resendSuccess(),
+      )
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : String(err))
+    }
+  }
+
+  return (
+    <AuthLayout>
+      <AuthLayoutLeft>
+        {verified ? (
+          <>
+            <AuthHeader title={m.auth_verify_success()} subtitle={m.auth_verify_successDesc()} />
+            <RainbowButton asChild className="w-full">
+              <Link to="/dashboard">
+                {m.auth_verify_goDashboard()}
+                <ArrowRight className="ml-2 h-4 w-4" />
+              </Link>
+            </RainbowButton>
+          </>
+        ) : (
+          <>
+            <AuthHeader title={m.auth_verify_invalid()} subtitle={m.auth_verify_invalidDesc()} />
+            <RainbowButton className="w-full" onClick={handleResend}>
+              {m.auth_verify_resend()}
+            </RainbowButton>
+            <div className="mt-4 flex items-center justify-center gap-2 text-sm text-muted-foreground">
+              <span>{m.auth_verify_notLogged()}</span>
+              <Link to="/login" className="text-primary hover:underline">
+                {m.auth_login_submit()}
+              </Link>
+            </div>
+          </>
+        )}
+      </AuthLayoutLeft>
+      <AuthLayoutRight>
+        <AuthBrandPanel
+          title="AllBlue"
+          subtitle={verified ? m.auth_verify_success() : m.auth_verify_invalid()}
+        />
+      </AuthLayoutRight>
+    </AuthLayout>
+  )
+}

package/src/routes/_login/verify-email/route.tsx

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createFileRoute } from '@tanstack/react-router'
+import { confirmEmailVerificationFn } from '@/server/serverFns/auth/email-verification'
+
+export const Route = createFileRoute('/_login/verify-email')({
+  validateSearch: (s: { token?: string }) => ({ token: s.token ?? '' }),
+  beforeLoad: async ({ search }) => {
+    if (!search.token) return { verified: false }
+    const r = await confirmEmailVerificationFn({ data: { token: search.token } })
+    return { verified: r.ok }
+  },
+})

package/src/routes/_nav/route.tsx

@@ -23,6 +23,7 @@ import { m } from '@/paraglide/messages.js'
 import { isDesktopServer } from '@/server/desktop-guest'
 import { listPinnedWorkspacesBriefFn } from '@/server/serverFns/workspace'
 import { listKnowledgeFn } from '@/server/serverFns/knowledge'
+import { ensureVerifyReminderFn } from '@/server/serverFns/auth/verify-reminder'
 import { WORKSPACES_QUERY_KEY } from '@/lib/collections/reference/workspaces-collection'
 import { KNOWLEDGE_BASES_QUERY_KEY } from '@/lib/collections/knowledge/knowledge-bases-collection'
 import { Empty, EmptyContent, EmptyDescription, EmptyHeader, EmptyMedia, EmptyTitle } from '@/components/ui/empty'
@@ -177,6 +178,10 @@ export const Route = createFileRoute('/_nav')({
     ]).catch(() => {
       // 预取失败降级为客户端 fetch（与旧行为一致），不阻塞页面
     })
+
+    if (context.session?.user?.id) {
+      ensureVerifyReminderFn({ data: {} }).catch(() => undefined)
+    }
   },
   notFoundComponent: NavNotFound,
   errorComponent: GlobalErrorBoundary,

package/src/routes/_public/index/route.tsx

@@ -17,11 +17,12 @@
 
 import { createFileRoute, redirect } from '@tanstack/react-router'
 import { isSaasEdition } from '@/lib/edition'
+import { isDesktopEdition } from '@/lib/edition-desktop'
 import AgencyHeroSection from '@/components/shadcn-space/blocks/hero-01'
 
 export const Route = createFileRoute('/_public/')({
   beforeLoad: () => {
-    if (!isSaasEdition) throw redirect({ to: '/dashboard' })
+    if (!isSaasEdition || isDesktopEdition()) throw redirect({ to: '/dashboard' })
   },
   component: IndexPage,
 })

package/src/routes/api/auth/desktop-callback.ts

@@ -2,7 +2,7 @@ import { createFileRoute } from '@tanstack/react-router'
 import { getSession } from 'start-authjs'
 import { prisma } from '@allbluecn/database'
 import { getProService, isProEdition } from '@/server/pro-services'
-import { authConfig } from '@/lib/auth/auth.config'
+import { getAuthConfig } from '@/lib/auth/auth.config'
 import { generateEntitlementsToken } from '@/server/entitlements-token'
 import type { FeatureKey } from '@allbluecn/kernel'
 
@@ -10,7 +10,7 @@ export const Route = createFileRoute('/api/auth/desktop-callback')({
   server: {
     handlers: {
       GET: async ({ request }) => {
-        const session = await getSession(request, authConfig)
+        const session = await getSession(request, await getAuthConfig())
         if (!session?.user) {
           return new Response('未登录', { status: 401 })
         }

package/src/routes/api/billing-webhook.ts

@@ -18,6 +18,7 @@
 import { createFileRoute } from '@tanstack/react-router'
 import { getProService } from '@/server/pro-services'
 import { WebhookSignatureError } from '@allbluecn/kernel'
+import { sendBillingEmailForEvent } from '@/server/billing-email'
 
 export const Route = createFileRoute('/api/billing-webhook')({
   server: {
@@ -32,6 +33,9 @@ export const Route = createFileRoute('/api/billing-webhook')({
         const rawBody = await request.text()
         try {
           await (getProService('billing')!)?.handleWebhookEvent(rawBody, signature)
+          if (getProService('billing')) {
+            await sendBillingEmailForEvent(rawBody)
+          }
           return new Response(JSON.stringify({ received: true }), {
             status: 200,
             headers: { 'Content-Type': 'application/json' },

package/src/routes/api/cron/changelog-release.ts

@@ -0,0 +1,100 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createFileRoute } from '@tanstack/react-router'
+import { prisma } from '@allbluecn/database'
+import { sendTemplateEmail } from '@/server/email'
+import { APP_VERSION } from '@/lib/app-version'
+
+const BATCH_SIZE = 50
+const LAST_RELEASED_KEY = 'changelog.lastReleasedVersion'
+
+async function isAuthorized(request: Request): Promise<boolean> {
+  const secret = process.env.CRON_SECRET
+  if (!secret) {
+    return process.env.NODE_ENV !== 'production'
+  }
+  return (request.headers.get('authorization') ?? '') === `Bearer ${secret}`
+}
+
+export const Route = createFileRoute('/api/cron/changelog-release')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        if (!(await isAuthorized(request))) {
+          return Response.json({ error: 'Forbidden' }, { status: 403 })
+        }
+
+        const current = APP_VERSION
+        const last = await prisma.systemSetting.findUnique({
+          where: { key: LAST_RELEASED_KEY },
+        })
+        if (last?.value === current) {
+          return Response.json({ done: true, reason: 'up-to-date' })
+        }
+
+        const appUrl = process.env.VITE_APP_URL ?? 'http://localhost:3000'
+
+        // Prisma 无 NOT EXISTS 便捷写法：用 emailLog.dedupeKey 前缀反查已发送 email，
+        // 再在 subscriber 查询层用 notIn 排除，避免「取 batch → filter」导致的死循环。
+        const sentEmails = await prisma.emailLog.findMany({
+          where: { dedupeKey: { startsWith: `release:${current}:` } },
+          select: { to: true },
+        })
+        const sentEmailSet = new Set(sentEmails.map((e) => e.to))
+
+        const subs = await prisma.emailSubscriber.findMany({
+          where: {
+            confirmedAt: { not: null },
+            unsubscribedAt: null,
+            email: { notIn: [...sentEmailSet] },
+          },
+          select: { email: true, locale: true, confirmToken: true },
+          take: BATCH_SIZE,
+        })
+
+        let sent = 0
+        for (const sub of subs) {
+          const dedupeKey = `release:${current}:${sub.email}`
+          const res = await sendTemplateEmail({
+            key: 'product.changelog-release',
+            to: sub.email,
+            locale: sub.locale,
+            dedupeKey,
+            unsubscribeUrl: `${appUrl}/email-unsubscribe?token=${sub.confirmToken}`,
+            vars: {
+              version: current,
+              highlights: '',
+              detailUrl: `${appUrl}/changelog`,
+            },
+          })
+          if (res.sent) sent++
+        }
+
+        if (subs.length < BATCH_SIZE) {
+          await prisma.systemSetting.upsert({
+            where: { key: LAST_RELEASED_KEY },
+            create: { key: LAST_RELEASED_KEY, value: current, desc: 'changelog 已发布版本号' },
+            update: { value: current },
+          })
+          return Response.json({ done: true, sent })
+        }
+        return Response.json({ done: false, sent })
+      },
+    },
+  },
+})