@allbluecn/web-app 0.18.2 → 0.19.0

package/src/server/serverFns/{knowledge-public → knowledge/public}/bookmarks/list.ts

@@ -16,11 +16,12 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
+import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { aggregateSharers } from '@/server/knowledge-public/share-merge'
+import { aggregateSharers } from '@/server/knowledge/public/share-merge'
 
 const listSchema = z.object({
   scope: z.enum(['all', 'private', 'share', 'favorite']).default('all'),
@@ -38,7 +39,7 @@ export const listBookmarksFn = createServerFn({ method: 'GET' })
     const request = getRequest()
     const session = await requireAuth(request)
     const userId = session.user!.id!
-    const where: any = { isDeleted: false }
+    const where: Prisma.WebsiteBookmarkWhereInput = { isDeleted: false }
     if (data.scope === 'private') {
       where.userId = userId
       where.visibility = 'private'

package/src/server/serverFns/{knowledge-public → knowledge/public}/bookmarks/refresh-favicon.ts

@@ -20,7 +20,7 @@ import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
 import { checkUserActionRateLimit } from '@/server/lib/rate-limit'
-import { syncBookmarkFavicon } from '@/server/knowledge-public/favicon'
+import { syncBookmarkFavicon } from '@/server/knowledge/public/favicon'
 
 export const refreshFaviconFn = createServerFn({ method: 'POST' })
   .validator(z.object({ id: z.string() }))

package/src/server/serverFns/{knowledge-public → knowledge/public}/bookmarks/share.ts

@@ -20,7 +20,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { shareToPublic, type ShareResult } from '@/server/knowledge-public/share-merge'
+import { shareToPublic, type ShareResult } from '@/server/knowledge/public/share-merge'
 
 export const shareBookmarkFn = createServerFn({ method: 'POST' })
   .validator(z.object({ id: z.string() }))

package/src/server/serverFns/{knowledge-public → knowledge/public}/bookmarks/sync-github.ts

@@ -19,7 +19,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { syncBookmarkGithub } from '@/server/knowledge-public/github-sync'
+import { syncBookmarkGithub } from '@/server/knowledge/public/github-sync'
 
 export const syncBookmarkGithubFn = createServerFn({ method: 'POST' })
   .validator(z.object({ id: z.string() }))

package/src/server/serverFns/{knowledge-public → knowledge/public}/bookmarks/update.ts

@@ -16,13 +16,14 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
+import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { bookmarkCanonicalId, parseGithubUrl } from '@/server/knowledge-public/canonical-id'
-import { fetchGithubData } from '@/server/knowledge-public/github-sync'
-import { resolveFavicon } from '@/server/knowledge-public/favicon'
+import { bookmarkCanonicalId, parseGithubUrl } from '@/server/knowledge/public/canonical-id'
+import { fetchGithubData } from '@/server/knowledge/public/github-sync'
+import { resolveFavicon } from '@/server/knowledge/public/favicon'
 
 const updateSchema = z.object({
   id: z.string(),
@@ -46,7 +47,7 @@ export const updateBookmarkFn = createServerFn({ method: 'POST' })
     const isAdmin = session.user!.role === 'ADMIN' || session.user!.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
 
-    const updateData: any = { ...rest }
+    const updateData: Prisma.WebsiteBookmarkUncheckedUpdateInput = { ...rest }
     const urlChanged = data.url !== undefined && data.url !== existing.url
     if (urlChanged && data.url) {
       const gh = parseGithubUrl(data.url)

package/src/server/serverFns/{knowledge-public → knowledge/public}/compliance/create.ts

@@ -20,7 +20,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { complianceCanonicalId } from '@/server/knowledge-public/canonical-id'
+import { complianceCanonicalId } from '@/server/knowledge/public/canonical-id'
 
 const createSchema = z.object({
   title: z.string().min(1).max(200),

package/src/server/serverFns/{knowledge-public → knowledge/public}/compliance/detail.ts

@@ -20,7 +20,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { aggregateSharers } from '@/server/knowledge-public/share-merge'
+import { aggregateSharers, type PublicSharer } from '@/server/knowledge/public/share-merge'
 
 export const getComplianceDetailFn = createServerFn({ method: 'GET' })
   .validator(z.object({ id: z.string() }))
@@ -40,7 +40,7 @@ export const getComplianceDetailFn = createServerFn({ method: 'GET' })
     if (item.visibility === 'private' && item.userId !== session.user!.id!) {
       throw new Error('无权限')
     }
-    let sharers: any[] = []
+    let sharers: PublicSharer[] = []
     if (item.visibility === 'public') {
       const map = await aggregateSharers('compliance', [item.canonicalId])
       sharers = map.get(item.canonicalId) ?? []

package/src/server/serverFns/{knowledge-public → knowledge/public}/compliance/list.ts

@@ -16,11 +16,12 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
+import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { aggregateSharers } from '@/server/knowledge-public/share-merge'
+import { aggregateSharers } from '@/server/knowledge/public/share-merge'
 
 const listSchema = z.object({
   scope: z.enum(['all', 'private', 'share', 'favorite']).default('all'),
@@ -39,7 +40,7 @@ export const listComplianceFn = createServerFn({ method: 'GET' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const where: any = { isDeleted: false }
+    const where: Prisma.IndustryComplianceWhereInput = { isDeleted: false }
     where.NOT = { title: '未命名合规' }
     const userId = session.user!.id!
     if (data.scope === 'private') {

package/src/server/serverFns/{knowledge-public → knowledge/public}/compliance/share.ts

@@ -20,7 +20,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { shareToPublic, type ShareResult } from '@/server/knowledge-public/share-merge'
+import { shareToPublic, type ShareResult } from '@/server/knowledge/public/share-merge'
 
 export const shareComplianceFn = createServerFn({ method: 'POST' })
   .validator(z.object({ id: z.string() }))

package/src/server/serverFns/{knowledge-public → knowledge/public}/compliance/update.ts

@@ -16,11 +16,12 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
+import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { complianceCanonicalId } from '@/server/knowledge-public/canonical-id'
+import { complianceCanonicalId } from '@/server/knowledge/public/canonical-id'
 
 const updateSchema = z.object({
   id: z.string(),
@@ -49,7 +50,7 @@ export const updateComplianceFn = createServerFn({ method: 'POST' })
     const isAdmin = session.user!.role === 'ADMIN' || session.user!.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
 
-    const updateData: any = { ...rest }
+    const updateData: Prisma.IndustryComplianceUncheckedUpdateInput = { ...rest }
     if (code !== undefined || data.title !== undefined) {
       updateData.canonicalId = complianceCanonicalId({
         title: data.title ?? existing.title,

package/src/server/serverFns/{knowledge-public → knowledge/public}/dictionary/create.ts

@@ -20,7 +20,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { dictionaryCanonicalId } from '@/server/knowledge-public/canonical-id'
+import { dictionaryCanonicalId } from '@/server/knowledge/public/canonical-id'
 
 const createSchema = z.object({
   title: z.string().min(1).max(200),

package/src/server/serverFns/{knowledge-public → knowledge/public}/dictionary/detail.ts

@@ -20,7 +20,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { aggregateSharers } from '@/server/knowledge-public/share-merge'
+import { aggregateSharers, type PublicSharer } from '@/server/knowledge/public/share-merge'
 
 export const getDictionaryDetailFn = createServerFn({ method: 'GET' })
   .validator(z.object({ id: z.string() }))
@@ -35,7 +35,7 @@ export const getDictionaryDetailFn = createServerFn({ method: 'GET' })
     if (item.visibility === 'private' && item.userId !== session.user!.id!) {
       throw new Error('无权限')
     }
-    let sharers: any[] = []
+    let sharers: PublicSharer[] = []
     if (item.visibility === 'public') {
       const map = await aggregateSharers('dictionary', [item.canonicalId])
       sharers = map.get(item.canonicalId) ?? []

package/src/server/serverFns/{knowledge-public → knowledge/public}/dictionary/list.ts

@@ -16,11 +16,12 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
+import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { aggregateSharers } from '@/server/knowledge-public/share-merge'
+import { aggregateSharers } from '@/server/knowledge/public/share-merge'
 
 const listSchema = z.object({
   scope: z.enum(['all', 'private', 'share', 'favorite']).default('all'),
@@ -37,7 +38,7 @@ export const listDictionaryFn = createServerFn({ method: 'GET' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const where: any = { isDeleted: false }
+    const where: Prisma.DictionaryTermWhereInput = { isDeleted: false }
     const userId = session.user!.id!
     if (data.scope === 'private') {
       where.userId = userId

package/src/server/serverFns/{knowledge-public → knowledge/public}/dictionary/share.ts

@@ -20,7 +20,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { shareToPublic, type ShareResult } from '@/server/knowledge-public/share-merge'
+import { shareToPublic, type ShareResult } from '@/server/knowledge/public/share-merge'
 
 export const shareDictionaryFn = createServerFn({ method: 'POST' })
   .validator(z.object({ id: z.string() }))

package/src/server/serverFns/{knowledge-public → knowledge/public}/dictionary/update.ts

@@ -16,11 +16,12 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
+import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { dictionaryCanonicalId } from '@/server/knowledge-public/canonical-id'
+import { dictionaryCanonicalId } from '@/server/knowledge/public/canonical-id'
 
 const updateSchema = z.object({
   id: z.string(),
@@ -45,7 +46,7 @@ export const updateDictionaryFn = createServerFn({ method: 'POST' })
     const isAdmin = session.user!.role === 'ADMIN' || session.user!.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
 
-    const updateData: any = { ...data }
+    const updateData: Prisma.DictionaryTermUncheckedUpdateInput = { ...data }
     delete updateData.id
     if (data.title !== undefined || data.industry !== undefined) {
       updateData.canonicalId = dictionaryCanonicalId(

package/src/server/serverFns/{knowledge-public → knowledge/public}/legal/create.ts

@@ -20,7 +20,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { legalCanonicalId } from '@/server/knowledge-public/canonical-id'
+import { legalCanonicalId } from '@/server/knowledge/public/canonical-id'
 
 const createSchema = z.object({
   title: z.string().min(1).max(200),

package/src/server/serverFns/{knowledge-public → knowledge/public}/legal/detail.ts

@@ -20,7 +20,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { aggregateSharers } from '@/server/knowledge-public/share-merge'
+import { aggregateSharers, type PublicSharer } from '@/server/knowledge/public/share-merge'
 
 export const getLegalDetailFn = createServerFn({ method: 'GET' })
   .validator(z.object({ id: z.string() }))
@@ -40,7 +40,7 @@ export const getLegalDetailFn = createServerFn({ method: 'GET' })
     if (item.visibility === 'private' && item.userId !== session.user!.id!) {
       throw new Error('无权限')
     }
-    let sharers: any[] = []
+    let sharers: PublicSharer[] = []
     if (item.visibility === 'public') {
       const map = await aggregateSharers('legal', [item.canonicalId])
       sharers = map.get(item.canonicalId) ?? []

package/src/server/serverFns/{knowledge-public → knowledge/public}/legal/list.ts

@@ -16,11 +16,12 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
+import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { aggregateSharers } from '@/server/knowledge-public/share-merge'
+import { aggregateSharers } from '@/server/knowledge/public/share-merge'
 
 const listSchema = z.object({
   scope: z.enum(['all', 'private', 'share', 'favorite']).default('all'),
@@ -40,7 +41,7 @@ export const listLegalFn = createServerFn({ method: 'GET' })
     const prisma = await getPrisma()
     const request = getRequest()
     const session = await requireAuth(request)
-    const where: any = { isDeleted: false }
+    const where: Prisma.LegalRegulationWhereInput = { isDeleted: false }
     where.NOT = { title: '未命名法规' }
     const userId = session.user!.id!
     if (data.scope === 'private') {

package/src/server/serverFns/{knowledge-public → knowledge/public}/legal/share.ts

@@ -20,7 +20,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { shareToPublic, type ShareResult } from '@/server/knowledge-public/share-merge'
+import { shareToPublic, type ShareResult } from '@/server/knowledge/public/share-merge'
 
 export const shareLegalFn = createServerFn({ method: 'POST' })
   .validator(z.object({ id: z.string() }))

package/src/server/serverFns/{knowledge-public → knowledge/public}/legal/update.ts

@@ -16,11 +16,12 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
+import { Prisma } from '@allbluecn/database'
 import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { requireAuth } from '@/server/auth-helpers'
-import { legalCanonicalId } from '@/server/knowledge-public/canonical-id'
+import { legalCanonicalId } from '@/server/knowledge/public/canonical-id'
 
 const updateSchema = z.object({
   id: z.string(),
@@ -51,7 +52,7 @@ export const updateLegalFn = createServerFn({ method: 'POST' })
     const isAdmin = session.user!.role === 'ADMIN' || session.user!.role === 'SUPER_ADMIN'
     if (!isOwner && !isAdmin) throw new Error('无权限')
 
-    const updateData: any = { ...rest }
+    const updateData: Prisma.LegalRegulationUncheckedUpdateInput = { ...rest }
     if (code !== undefined || data.title !== undefined) {
       updateData.canonicalId = legalCanonicalId({
         title: data.title ?? existing.title,

package/src/server/serverFns/knowledge.ts

@@ -16,6 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { getPrisma } from "@allbluecn/database/get-prisma"
+import { buildRoomName } from "@allbluecn/collab-core/rooms"
 import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
@@ -27,6 +28,8 @@ import { getVectorStore } from '@/lib/vector-store'
 import { requirePermission } from '@/server/permissions'
 import { auditLog } from '@/server/audit'
 import { assertOwned } from '@/server/lib/ownership'
+import { withCollabGuard } from '@/server/collab/write-guard'
+import { touchCollabSnapshot } from '@/server/collab/touch-snapshot'
 
 /** 读权限放宽：自己的 KB ∪ 他人 team/general KB */
 const READABLE_KB = (userId: string) => ({
@@ -301,23 +304,127 @@ export const updateDocumentFn = createServerFn({ method: 'POST' })
     const session = await requireAuth(request)
     const userId = session.user!.id!
     await requirePermission(userId, 'knowledge', 'write')
-    // DB-03：属主校验（经 kb.userId 关系过滤）合并进写入，单查询返回更新行
-    const rows = await prisma.knowledgeDocument.updateManyAndReturn({
-      where: {
-        id: data.id,
-        isDeleted: false,
-        kb: { userId, isDeleted: false },
-      },
-      data: {
-        ...(data.title !== undefined && { title: data.title }),
-        ...(data.content !== undefined && { content: data.content }),
-        ...(data.icon !== undefined && { icon: data.icon }),
-        ...(data.tags !== undefined && { tags: data.tags }),
-        ...(data.properties !== undefined && { properties: data.properties }),
+    // ── Yjs 多人协作 §5.3 写入门卫（任务 17）：CollabDocument 存在且 patch 含
+    // content → 一律转发 collab 内部通道（room 活跃判定在 collab 侧：在线应用
+    // Y 并广播、离线 collab 直落业务列）；无快照/不可达 TTL 降级 → 照旧直写。
+    // 元数据（title/icon/tags/properties）不归 Y，无论裁决如何都直写。
+    const guard = await withCollabGuard({
+      roomName: buildRoomName({ kind: 'knowledge-doc', docId: data.id }),
+      docId: data.id,
+      actor: userId,
+      patch: { content: data.content },
+      // C1 属主预检（复审修复）：转发前只读校验属主，失败短路——requirePermission
+      // 是模块级权限（普通用户默认 write），不构成属主校验；不预检则越权者的
+      // content 会先落进受害者 Y 态/业务列、web 侧才报错（mutation 已发生）。
+      // 直写路径不经此回调，属主校验保持合并在写库 WHERE（DB-03 单查询）。
+      assertWriteAllowed: async () => {
+        await assertOwned(
+          prisma.knowledgeDocument,
+          {
+            where: {
+              id: data.id,
+              isDeleted: false,
+              kb: { userId, isDeleted: false },
+            },
+            select: { id: true },
+          },
+          '未找到或无权限',
+        )
       },
-      select: { id: true, title: true, content: true, icon: true, tags: true, properties: true, updatedAt: true },
     })
-    if (rows.length === 0) throw new Error('未找到或无权限')
+
+    if (guard.kind === 'forwarded') {
+      // content 已由 collab 接管：直写数据剥离 content（防互吞），元数据照旧；
+      // 无元数据字段时属主校验与行回读合并单查询（assertOwned，无探针/回读
+      // 两段 TOCTOU 窗口）。索引重建由 collab 侧单源触发（导出器/离线直落
+      // 路径均带重建通知），web 不再重复触发。
+      const forwardedSelect = { id: true, title: true, content: true, icon: true, tags: true, properties: true, updatedAt: true } as const
+      if (
+        data.title !== undefined ||
+        data.icon !== undefined ||
+        data.tags !== undefined ||
+        data.properties !== undefined
+      ) {
+        // R11 touch 不变式：forwarded 组合 patch 的生效直写为纯元数据
+        // （content 已剥离）——@updatedAt 仍被 bump，同事务 touch 快照防
+        // 下次打开误判旁路写 → 全量重种子化（Y 协作历史重置）。
+        // DB-03：属主校验（经 kb.userId 关系过滤）合并进写入
+        const rows = await prisma.$transaction(async (tx) => {
+          const rows = await tx.knowledgeDocument.updateManyAndReturn({
+            where: {
+              id: data.id,
+              isDeleted: false,
+              kb: { userId, isDeleted: false },
+            },
+            data: {
+              ...(data.title !== undefined && { title: data.title }),
+              ...(data.icon !== undefined && { icon: data.icon }),
+              ...(data.tags !== undefined && { tags: data.tags }),
+              ...(data.properties !== undefined && { properties: data.properties }),
+            },
+            select: forwardedSelect,
+          })
+          if (rows.length === 0) throw new Error('未找到或无权限')
+          await touchCollabSnapshot(
+            tx,
+            buildRoomName({ kind: 'knowledge-doc', docId: data.id }),
+            rows[0]!.updatedAt,
+          )
+          return rows
+        })
+        await auditLog({ workspaceId: '', userId, resourceType: 'document', resourceId: data.id, action: 'document.update' })
+        // content 回显本次请求值（DB 列由 collab 接管，回写时序不定）
+        return { ...rows[0]!, content: data.content }
+      }
+      const row = await assertOwned(
+        prisma.knowledgeDocument,
+        {
+          where: {
+            id: data.id,
+            isDeleted: false,
+            kb: { userId, isDeleted: false },
+          },
+          select: forwardedSelect,
+        },
+        '未找到或无权限',
+      )
+      await auditLog({ workspaceId: '', userId, resourceType: 'document', resourceId: data.id, action: 'document.update' })
+      return { ...row, content: data.content }
+    }
+
+    // pass-through / degraded：原行为——content 随直写落库 + fire-and-forget 索引
+    // R11 touch 不变式：生效直写含 content（Y 属主面，含 unsupported-content
+    // 历史形状）→ 旁路语义刻意不 touch——业务列必须反超快照，重种子化兜底才
+    // 有正确输入；纯元数据 patch（content 缺席）→ 同事务 touch 防误判旁路写
+    // （无快照计 0 天然跳过）。DB-03：属主校验（经 kb.userId 关系过滤）合并
+    // 进写入，单查询返回更新行
+    const writesYFace = data.content !== undefined
+    const rows = await prisma.$transaction(async (tx) => {
+      const rows = await tx.knowledgeDocument.updateManyAndReturn({
+        where: {
+          id: data.id,
+          isDeleted: false,
+          kb: { userId, isDeleted: false },
+        },
+        data: {
+          ...(data.title !== undefined && { title: data.title }),
+          ...(data.content !== undefined && { content: data.content }),
+          ...(data.icon !== undefined && { icon: data.icon }),
+          ...(data.tags !== undefined && { tags: data.tags }),
+          ...(data.properties !== undefined && { properties: data.properties }),
+        },
+        select: { id: true, title: true, content: true, icon: true, tags: true, properties: true, updatedAt: true },
+      })
+      if (rows.length === 0) throw new Error('未找到或无权限')
+      if (!writesYFace) {
+        await touchCollabSnapshot(
+          tx,
+          buildRoomName({ kind: 'knowledge-doc', docId: data.id }),
+          rows[0]!.updatedAt,
+        )
+      }
+      return rows
+    })
     const updated = rows[0]
 
     if (data.content !== undefined) {
@@ -358,10 +465,19 @@ export const deleteDocumentFn = createServerFn({ method: 'POST' })
       '未找到或无权限',
     )
     if (doc.isHomepage) throw new Error('首页不可删除')
-    await prisma.knowledgeDocument.update({
-      where: { id: data.id },
-      data: { isDeleted: true },
-    })
+    // 软删实体 + 协同快照同事务清理（Yjs 多人协作 §5.2 删除路径，任务 16）：
+    // 实体删后快照行必删，防 collab 服务后续装载幽灵 room；用 deleteMany
+    // 而非 delete——room 未协同打开过时无行，delete 会 P2025 竞态炸。
+    // room 命名与 collab-core 注册表一致（doc:knowledge:<docId>）。
+    await prisma.$transaction([
+      prisma.knowledgeDocument.update({
+        where: { id: data.id },
+        data: { isDeleted: true },
+      }),
+      prisma.collabDocument.deleteMany({
+        where: { roomName: buildRoomName({ kind: 'knowledge-doc', docId: data.id }) },
+      }),
+    ])
     const store = await getVectorStore()
     store.deleteEmbeddings("knowledge_embeddings", "documentId", data.id).catch(() => {})
     await auditLog({ workspaceId: '', userId, resourceType: 'document', resourceId: data.id, action: 'document.delete' })

package/src/server/serverFns/project/module-overview.ts

@@ -62,7 +62,7 @@ export const getModuleOverviewFn = createServerFn({ method: "GET" })
           )
         : null;
 
-    // testcase / bug / acceptance 暂无独立数据模型，真实空值
+    // testcase / bug 暂无独立数据模型，真实空值
     return {
       requirement: {
         count: storyAgg._count._all,
@@ -75,7 +75,6 @@ export const getModuleOverviewFn = createServerFn({ method: "GET" })
       design: { count: 0, lastUpdatedAt: null },
       testcase: { count: 0, lastUpdatedAt: null },
       bug: { count: 0, lastUpdatedAt: null },
-      acceptance: { count: 0, lastUpdatedAt: null },
     };
   });
 

package/src/server/serverFns/share/version.ts

@@ -23,6 +23,10 @@ interface ShareVersionData {
   prdName: string
   versionLabel: string
   notes: string | null
+  /** 所属 share token（分享页 presence join 用，§9） */
+  shareToken: string
+  /** 所属 share 的 designId（presence 密码 sessionStorage key 段） */
+  designId: string
   pageVersions: Array<{
     pageId: string
     pageName: string
@@ -48,7 +52,7 @@ export const getVersionShareFn = createServerFn({ method: 'GET' })
           OR: [{ expiresAt: null }, { expiresAt: { gt: new Date() } }],
         },
       },
-      select: { id: true },
+      select: { id: true, share: { select: { token: true, designId: true } } },
     })
     if (!shareVersion) return null
 
@@ -82,6 +86,8 @@ export const getVersionShareFn = createServerFn({ method: 'GET' })
       prdName: version.design.name,
       versionLabel: version.versionLabel,
       notes: version.notes,
+      shareToken: shareVersion.share.token,
+      designId: shareVersion.share.designId,
       pageVersions,
     }
   })

package/src/server/serverFns/story/__tests__/bulk.test.ts

@@ -59,6 +59,8 @@ vi.mock("@allbluecn/database", () => {
     story: { findMany: mocks.findMany, update: mocks.update, deleteMany: mocks.deleteMany },
     storyActivity: { create: mocks.activityCreate },
     projectMember: { findMany: mocks.memberFindMany },
+    // R11 touch：真实 touchCollabSnapshot 走 collabDocument.updateMany（无快照计 0）
+    collabDocument: { updateMany: vi.fn().mockResolvedValue({ count: 0 }) },
     $transaction: (cb: any) => cb(prisma),
   };
   return { prisma, Prisma: {} };
@@ -85,6 +87,10 @@ describe("bulkArchiveStoriesFn", () => {
       { id: "c", state: "todo", archived: false },
       { id: "d", state: "done", archived: true },
     ]);
+    // R11 touch 读回读行 updatedAt（未配置时用首次调用参数派生）
+    mocks.update.mockImplementation(({ where, data }) =>
+      Promise.resolve({ id: where.id, ...data }),
+    );
     const out = await bulkArchiveStoriesFn({ data: { storyIds: ["a", "b", "c", "d"] } });
     expect(out).toEqual({ archived: 2, skipped: 2 });
     expect(mocks.findMany).toHaveBeenCalledWith({