@allbluecn/web-app 0.19.4 → 0.20.0

package/src/paraglide/server.js

@@ -0,0 +1,294 @@
+/* eslint-disable */
+
+import * as runtime from "./runtime.js";
+
+/**
+ * Server middleware that handles locale-based routing and request processing.
+ *
+ * Configure `disableAsyncLocalStorage` when generating Paraglide with
+ * `paraglideVitePlugin()` or `compile()`, not when calling
+ * `paraglideMiddleware()`. Keep AsyncLocalStorage enabled by default and
+ * only disable it for runtimes that lack `AsyncLocalStorage` support and
+ * guarantee request isolation.
+ *
+ * This middleware performs several key functions:
+ *
+ * 1. Determines the locale for the incoming request using configured strategies
+ * 2. Handles URL localization and redirects (only for document requests)
+ * 3. Maintains locale state using AsyncLocalStorage to prevent request interference
+ *
+ * When URL strategy is used:
+ *
+ * - The locale is extracted from the URL for all request types
+ * - If URL doesn't match the determined locale, redirects to localized URL (only for document requests)
+ * - De-localizes URLs before passing to server (e.g., `/fr/about` → `/about`)
+ *
+ * @see https://paraglidejs.com/middleware
+ *
+ * @template T - The return type of the resolve function
+ *
+ * @param {Request} request - The incoming request object
+ * @param {(args: { request: Request, locale: import("./runtime.js").Locale }) => T | Promise<T>} resolve - Function to handle the request. The callback receives:
+ *   - `request`: A modified request with a delocalized URL when the URL strategy is used (e.g., `/fr/about` → `/about`).
+ *      If your framework handles URL localization itself (e.g., TanStack Router's `rewrite` option), use the original
+ *      request instead to avoid redirect loops.
+ *   - `locale`: The determined locale for this request.
+ * @param {{
+ *   effectiveRequestUrl?: string | URL | ((request: Request) => string | URL),
+ *   onRedirect?: (response: Response) => void
+ * }} [options] - Options to control middleware behavior. `effectiveRequestUrl` sets the effective request URL used for route matching, URL-based locale detection, redirects, and `getUrlOrigin()`.
+ * @returns {Promise<Response>}
+ *
+ * @example
+ * ```typescript
+ * // Basic usage in metaframeworks like NextJS, SvelteKit, Astro, Nuxt, etc.
+ * export const handle = async ({ event, resolve }) => {
+ *   return paraglideMiddleware(event.request, ({ request, locale }) => {
+ *     // let the framework further resolve the request
+ *     return resolve(request);
+ *   });
+ * };
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Usage in a framework like Express JS or Hono
+ * app.use(async (req, res, next) => {
+ *   const result = await paraglideMiddleware(req, ({ request, locale }) => {
+ *     // If a redirect happens this won't be called
+ *     return next(request);
+ *   });
+ * });
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Usage with frameworks that handle URL localization/delocalization themselves
+ * //
+ * // Some frameworks like TanStack Router handle URL localization and delocalization
+ * // themselves via their own rewrite APIs (e.g., `rewrite.input`/`rewrite.output`).
+ * //
+ * // When the framework handles this, the middleware's URL delocalization is not needed.
+ * // Using the modified `request` from the callback would cause a redirect loop because
+ * // both the middleware and the framework would attempt to delocalize the URL.
+ * //
+ * // Solution: Pass the original request to the handler instead of the modified one.
+ * // The middleware still handles locale detection, cookies, and AsyncLocalStorage context.
+ * //
+ * // ❌ WRONG - causes redirect loop when framework handles URL rewriting:
+ * // paraglideMiddleware(req, ({ request }) => handler.fetch(request))
+ * //
+ * // ✅ CORRECT - use original request when framework handles URL localization:
+ * // paraglideMiddleware(req, () => handler.fetch(req))
+ *
+ * * *
+ * export default {
+ *   fetch(req: Request): Promise<Response> {
+ *     // TanStack Router handles URL rewriting via deLocalizeUrl/localizeUrl
+ *     // so we pass the original `req` instead of the modified `request`
+ *     return paraglideMiddleware(req, () => handler.fetch(req))
+ *   },
+ * }
+ * ```
+ */
+export async function paraglideMiddleware(request, resolve, options) {
+    let requestAsyncLocalStorage = runtime.serverAsyncLocalStorage;
+    requestAsyncLocalStorage = runtime.getServerAsyncLocalStorage();
+    if (!runtime.disableAsyncLocalStorage && !requestAsyncLocalStorage) {
+      const { AsyncLocalStorage } = await import("async_hooks");
+      requestAsyncLocalStorage = runtime.getServerAsyncLocalStorage();
+      if (!requestAsyncLocalStorage) {
+        requestAsyncLocalStorage = new AsyncLocalStorage();
+        runtime.overwriteServerAsyncLocalStorage(requestAsyncLocalStorage);
+      }
+    }
+    if (!requestAsyncLocalStorage) {
+      requestAsyncLocalStorage = createMockAsyncLocalStorage();
+      runtime.overwriteServerAsyncLocalStorage(requestAsyncLocalStorage);
+    }
+    const url = resolveMiddlewareUrl(request, options?.effectiveRequestUrl);
+    const origin = url.origin;
+    if (runtime.isExcludedByRouteStrategy(url.href)) {
+        const locale = runtime.baseLocale;
+        const newRequest = cloneRequestWithFallback(request, url);
+        /** @type {Set<string>} */
+        const messageCalls = new Set();
+        return /** @type {Response} */ (await requestAsyncLocalStorage?.run({ locale, origin, messageCalls }, () => resolve({ locale, request: newRequest })));
+    }
+    const strategy = runtime.getStrategyForUrl(url.href);
+    const decision = await runtime.shouldRedirect({
+        request,
+        effectiveRequestUrl: url,
+    });
+    const locale = decision.locale;
+    // if the client makes a request to a URL that doesn't match
+    // the localizedUrl, redirect the client to the localized URL
+    if (request.headers.get("Sec-Fetch-Dest") === "document" &&
+        decision.shouldRedirect &&
+        decision.redirectUrl) {
+        // Create headers object with Vary header if preferredLanguage strategy is used
+        /** @type {Record<string, string>} */
+        const headers = {};
+        if (strategy.includes("preferredLanguage")) {
+            headers["Vary"] = "Accept-Language";
+        }
+        const response = new Response(null, {
+            status: 307,
+            headers: {
+                Location: decision.redirectUrl.href,
+                ...headers,
+            },
+        });
+        options?.onRedirect?.(response);
+        return response;
+    }
+    // If the strategy includes "url", we need to de-localize the URL
+    // before passing it to the server middleware.
+    //
+    // The middleware is responsible for mapping a localized URL to the
+    // de-localized URL e.g. `/en/about` to `/about`. Otherwise,
+    // the server can't render the correct page.
+    let newRequest;
+    if (strategy.includes("url")) {
+        newRequest = cloneRequestWithFallback(request, runtime.deLocalizeUrl(url));
+    }
+    else {
+        newRequest = cloneRequestWithFallback(request, url);
+    }
+    // the message functions that have been called in this request
+    /** @type {Set<string>} */
+    const messageCalls = new Set();
+    const response = await requestAsyncLocalStorage?.run({ locale, origin, messageCalls }, () => resolve({ locale, request: newRequest }));
+    // Only modify HTML responses
+    if (runtime.experimentalMiddlewareLocaleSplitting &&
+        response.headers.get("Content-Type")?.includes("html")) {
+        const body = await response.text();
+        const messages = [];
+        // using .values() to avoid polyfilling in older projects. else the following error is thrown
+        // Type 'Set<string>' can only be iterated through when using the '--downlevelIteration' flag or with a '--target' of 'es2015' or higher.
+        for (const messageCall of Array.from(messageCalls)) {
+            const [id, locale] = 
+            /** @type {[string, import("./runtime.js").Locale]} */ (messageCall.split(":"));
+            messages.push(`${id}: ${compiledBundles[id]?.[locale]}`);
+        }
+        // Prevent translated content from terminating the inline script tag.
+        const escapedMessages = messages
+            .join(",")
+            .replace(/<\/(script)/gi, "<\\/$1");
+        // Reuse the request's CSP nonce (if any) so the injected script is allowed under a strict CSP
+        const nonce = response.headers
+            .get("Content-Security-Policy")
+            ?.match(/'nonce-([\w+/=-]+)'/)?.[1];
+        const nonceAttr = nonce ? `nonce="${nonce}"` : "";
+        const script = `<script ${nonceAttr}>globalThis.__paraglide = globalThis.__paraglide ?? {}; globalThis.__paraglide.ssr = { ${escapedMessages} }</script>`;
+        // Insert the script before the closing head tag
+        const newBody = body.replace("</head>", `${script}</head>`);
+        // Create a new response with the modified body
+        // Clone all headers except Content-Length which will be set automatically
+        const newHeaders = new Headers(response.headers);
+        newHeaders.delete("Content-Length"); // Let the browser calculate the correct length
+        return new Response(newBody, {
+            status: response.status,
+            statusText: response.statusText,
+            headers: newHeaders,
+        });
+    }
+    return response;
+}
+/**
+ * @param {Request} request
+ * @param {string | URL | ((request: Request) => string | URL) | undefined} effectiveRequestUrl
+ * @returns {URL}
+ */
+function resolveMiddlewareUrl(request, effectiveRequestUrl) {
+    if (typeof effectiveRequestUrl === "function") {
+        return new URL(effectiveRequestUrl(request), request.url);
+    }
+    if (typeof effectiveRequestUrl === "string" ||
+        effectiveRequestUrl instanceof URL) {
+        return new URL(effectiveRequestUrl, request.url);
+    }
+    return new URL(request.url);
+}
+/**
+ * Some metaframeworks (NextJS) require a new Request object.
+ * https://github.com/opral/inlang-paraglide-js/issues/411
+ *
+ * However, some frameworks (TanStack Start 1.143+) use custom Request
+ * implementations that cannot be cloned with `new Request(request)`.
+ * https://github.com/opral/paraglide-js/issues/573
+ *
+ * Effective request URL overrides behind proxies:
+ * https://github.com/opral/paraglide-js/issues/652
+ *
+ * @param {Request} request
+ * @param {string | URL} [url]
+ * @returns {Request}
+ */
+function cloneRequestWithFallback(request, url = request.url) {
+    const targetUrl = typeof url === "string" ? url : url.href;
+    if (targetUrl === request.url) {
+        try {
+            // Clone first so building a new Request does not consume the original body stream.
+            return new Request(request.clone());
+        }
+        catch {
+            try {
+                return new Request(request);
+            }
+            catch {
+                return request;
+            }
+        }
+    }
+    try {
+        // Clone first so building a new Request does not consume the original body stream.
+        return new Request(targetUrl, request.clone());
+    }
+    catch {
+        try {
+            return new Request(targetUrl, request);
+        }
+        catch {
+            return request;
+        }
+    }
+}
+/**
+ * Creates a mock AsyncLocalStorage implementation for environments where
+ * native AsyncLocalStorage is not available or disabled.
+ *
+ * This mock implementation mimics the behavior of the native AsyncLocalStorage
+ * but doesn't require the async_hooks module. It's used as a fallback when
+ * the runtime does not expose AsyncLocalStorage or when it has been disabled.
+ *
+ * @returns {import("./runtime.js").ParaglideAsyncLocalStorage}
+ */
+function createMockAsyncLocalStorage() {
+    /** @type {any} */
+    let currentStore = undefined;
+    return {
+        getStore() {
+            return currentStore;
+        },
+        async run(store, callback) {
+            currentStore = store;
+            try {
+                return await callback();
+            }
+            finally {
+                currentStore = undefined;
+            }
+        },
+    };
+}
+// Used in generated server.js when async local storage is disabled.
+void createMockAsyncLocalStorage;
+/**
+ * The compiled messages for the server middleware.
+ *
+ * Only populated if `enableMiddlewareOptimizations` is set to `true`.
+ *
+ * @type {Record<string, Record<import("./runtime.js").Locale, string>>}
+ */
+const compiledBundles = {};

package/src/routes/_nav/bugs/$bugId/route.lazy.tsx

@@ -17,8 +17,8 @@
 
 import { createLazyFileRoute, useNavigate } from "@tanstack/react-router";
 import { useState } from "react";
-import type { BugDetail } from "@/components/bug/types";
-import type { UserBrief } from "@/components/story/types";
+import type { BugDetail } from "@/shared/bug/types";
+import type { UserBrief } from "@/shared/story/types";
 import { BugDetailBody } from "@/components/bug/detail/bug-detail-body";
 import { BugPanelHeader } from "@/components/bug/bug-panel-header";
 

package/src/routes/_nav/projects/$projectId/iterations/$iterationId/route.lazy.tsx

@@ -32,7 +32,7 @@ import { listProjectsBriefFn } from "@/server/serverFns/project";
 import { toast } from "@/components/ui/toast";
 import { useQuery } from "@tanstack/react-query";
 import type { IterationSummary } from "@/server/serverFns/iteration/schemas";
-import type { StoryState } from "@/components/story/constants";
+import type { StoryState } from "@/shared/story/constants";
 import type { AvatarConfig } from "@allbluecn/kernel";
 import { m } from "@/paraglide/messages.js";
 import { toastError } from "@/lib/toast-error";

package/src/routes/_nav/route.tsx

@@ -23,8 +23,7 @@ import { listPinnedWorkspacesBriefFn } from '@/server/serverFns/workspace'
 import { listKnowledgeFn } from '@/server/serverFns/knowledge'
 import { ensureVerifyReminderFn } from '@/server/serverFns/auth/verify-reminder'
 import { getSidebarStateFn } from '@/server/serverFns/sidebar-state'
-import { WORKSPACES_QUERY_KEY } from '@/lib/collections/reference/workspaces-collection'
-import { KNOWLEDGE_BASES_QUERY_KEY } from '@/lib/collections/knowledge/knowledge-bases-collection'
+import { WORKSPACES_QUERY_KEY, KNOWLEDGE_BASES_QUERY_KEY } from '@/lib/collections/query-keys'
 import { GlobalErrorBoundary } from '@/components/error/global-error-boundary'
 import { NavNotFound } from './-components/nav-not-found'
 

package/src/routes/_nav/stories/$storyId/route.lazy.tsx

@@ -17,9 +17,9 @@
 
 import { createLazyFileRoute, useNavigate, useRouter } from "@tanstack/react-router";
 import { useCallback, useState, type UIEvent } from "react";
-import type { StoryDetail, UserBrief, CommentWithReplies, ActivityItem, RelationsData } from "@/components/story/types";
+import type { StoryDetail, UserBrief, CommentWithReplies, ActivityItem, RelationsData } from "@/shared/story/types";
 import type { IterationSummary } from "@/server/serverFns/iteration/schemas";
-import type { StoryState } from "@/components/story/constants";
+import type { StoryState } from "@/shared/story/constants";
 import { StoryDetailBody } from "@/components/story/detail/story-detail-body";
 import { StoryPanelHeader } from "@/components/story/story-panel-header";
 

package/src/routes/_nav/stories/$storyId/route.tsx

@@ -35,7 +35,7 @@ import { listProjectsBriefFn } from "@/server/serverFns/project";
 import { listIterationsFn } from "@/server/serverFns/iteration";
 import { getCollabSnapshotFn } from "@/server/serverFns/collab-snapshot";
 import { isCollabEnabled } from "@/lib/collab/env";
-import type { RelationsData } from "@/components/story/types";
+import type { RelationsData } from "@/shared/story/types";
 import { StoryDetailSkeleton } from "../-components/story-detail-skeleton";
 
 // 「关联需求」选择源拉取上限：超过该数的需求会被静默截断（组件端无搜索补拉），

package/src/routes/api/design/prototype/__tests__/route.test.ts

@@ -450,6 +450,9 @@ describe('/api/design/prototype 流式生成', () => {
     expect(eventsOf(events, 'canvas/nodes')).toHaveLength(1)
     const dones = eventsOf(events, 'canvas/done')
     expect(dones).toHaveLength(1)
-    expect((dones[0].value as { message: string }).message.length).toBeGreaterThan(0)
+    // 文案协议化（2026-10-28）：服务端只回 status，完成文案由客户端 m.canvas_ai_doneFallback()
+    // 渲染；无 LLM 总结时 message 缺省（不再由服务端塞中文）
+    expect((dones[0].value as { status: string }).status).toBe('completed')
+    expect((dones[0].value as { message?: string }).message).toBeUndefined()
   })
 })

package/src/server/__tests__/task-executor.test.ts

@@ -20,6 +20,10 @@ vi.mock('@allbluecn/database', () => ({
     testCase: { findUnique: vi.fn() },
   },
 }))
+// 源条目属主校验（2026-10-28 审计 A4x-1）：测试默认按「是项目成员」放行，
+// 需要验证拒绝路径时在用例内改 mock
+vi.mock('@/server/lib/project-membership', () => ({ isProjectMember: vi.fn(async () => true) }))
+
 vi.mock('@/server/ai-task/context-builder', async (importOriginal) => {
   const actual = await importOriginal<typeof import('@/server/ai-task/context-builder')>()
   return { ...actual, buildSourceContextBlock: vi.fn(() => '## 需求上下文（mock）') }
@@ -257,6 +261,7 @@ describe('executeAiTaskRun', () => {
 
   it('源型 story：查源表并注入 buildSourceContextBlock 输出到 systemPrompts', async () => {
     storyFindUnique.mockResolvedValue({
+      projectId: 'p1',
       identifier: 'ALB-S12',
       name: '登录页重构',
       description: null,
@@ -272,6 +277,7 @@ describe('executeAiTaskRun', () => {
     expect(storyFindUnique).toHaveBeenCalledWith({
       where: { id: 'story-1' },
       select: expect.objectContaining({
+        projectId: true,
         identifier: true,
         name: true,
         description: true,
@@ -308,6 +314,7 @@ describe('executeAiTaskRun', () => {
 
   it('源型分发：bug / testcase 各查对应表', async () => {
     bugFindUnique.mockResolvedValue({
+      projectId: 'p1',
       identifier: 'ALB-B3',
       title: '首页白屏',
       severity: 'critical',

package/src/server/serverFns/__tests__/legal-code-canonical.test.ts

@@ -0,0 +1,169 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 审计 S7（2026-10-28）LegalRegulation.code 持久化回归：
+// - update：canonicalId 仅在显式传 code 时重算（compliance 同款裁定），
+//   仅改 title 一律不漂移（有 code 行身份=code；无 code 存量行保持创建时 key）；
+// - code 落库 + 空串归一 null；
+// - create：code 落库 + canonicalId = code || title。
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: (_config: unknown) => {
+    const api = {
+      _validator: undefined as unknown,
+      validator(schema: unknown) {
+        this._validator = schema
+        return this
+      },
+      handler(fn: (args: { data: unknown }) => Promise<unknown>) {
+        const wrapped = async (args: unknown) => {
+          let data = (args as { data?: unknown } | null | undefined)?.data
+          if (this._validator && data !== undefined) {
+            const v = this._validator as { parse?: (d: unknown) => unknown }
+            data = v.parse ? v.parse(data) : data
+          }
+          return fn({ data })
+        }
+        return wrapped
+      },
+    }
+    return api
+  },
+}))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: vi.fn(),
+}))
+
+const m = vi.hoisted(() => ({
+  legalRegulation: {
+    findUnique: vi.fn(),
+    create: vi.fn(),
+    update: vi.fn(),
+  },
+}))
+
+vi.mock('@allbluecn/database/get-prisma', () => ({ getPrisma: async () => m }))
+vi.mock('@allbluecn/database', () => ({ Prisma: {} }))
+
+vi.mock('@/server/auth-helpers', () => ({ requireAuth: vi.fn() }))
+
+import { requireAuth } from '@/server/auth-helpers'
+import * as updateMod from '../knowledge/public/legal/update'
+import * as createMod from '../knowledge/public/legal/create'
+
+const mockRequireAuth = vi.mocked(requireAuth)
+
+describe('updateLegalFn：code 持久化 + canonicalId 重算口径（S7）', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockRequireAuth.mockResolvedValue({ user: { id: 'u1', role: 'USER' } } as never)
+    m.legalRegulation.update.mockResolvedValue({ id: 'row-1' })
+  })
+
+  it('仅改 title（有 code 行）→ canonicalId 保持 code 维度不漂移，code 不重写', async () => {
+    m.legalRegulation.findUnique.mockResolvedValue({
+      id: 'row-1', userId: 'u1', title: '旧标题', code: 'GB 4943', canonicalId: 'GB 4943',
+    })
+    await updateMod.updateLegalFn({ data: { id: 'row-1', title: '新标题' } })
+    expect(m.legalRegulation.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.not.objectContaining({ canonicalId: expect.anything(), code: expect.anything() }),
+      }),
+    )
+  })
+
+  it('仅改 title（无 code 存量行）→ canonicalId 保持创建时 key 不失联', async () => {
+    m.legalRegulation.findUnique.mockResolvedValue({
+      id: 'row-1', userId: 'u1', title: '旧标题', code: null, canonicalId: '旧标题',
+    })
+    await updateMod.updateLegalFn({ data: { id: 'row-1', title: '新标题' } })
+    expect(m.legalRegulation.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.not.objectContaining({ canonicalId: expect.anything() }),
+      }),
+    )
+  })
+
+  it('显式传 code → code 落库且 canonicalId 以 code 重算', async () => {
+    m.legalRegulation.findUnique.mockResolvedValue({
+      id: 'row-1', userId: 'u1', title: '旧标题', code: null, canonicalId: '旧标题',
+    })
+    await updateMod.updateLegalFn({ data: { id: 'row-1', code: 'GB 4943' } })
+    expect(m.legalRegulation.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ code: 'GB 4943', canonicalId: 'GB 4943' }),
+      }),
+    )
+  })
+
+  it('code 传空串 → 归一为 null 落库，canonicalId 回落 title 维度', async () => {
+    m.legalRegulation.findUnique.mockResolvedValue({
+      id: 'row-1', userId: 'u1', title: '旧标题', code: 'GB 4943', canonicalId: 'GB 4943',
+    })
+    await updateMod.updateLegalFn({ data: { id: 'row-1', code: '' } })
+    expect(m.legalRegulation.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ code: null, canonicalId: '旧标题' }),
+      }),
+    )
+  })
+
+  it('code + title 同传 → code 维度优先', async () => {
+    m.legalRegulation.findUnique.mockResolvedValue({
+      id: 'row-1', userId: 'u1', title: '旧标题', code: null, canonicalId: '旧标题',
+    })
+    await updateMod.updateLegalFn({ data: { id: 'row-1', title: '新标题', code: 'GB 4943-2024' } })
+    expect(m.legalRegulation.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ code: 'GB 4943-2024', canonicalId: 'GB 4943-2024' }),
+      }),
+    )
+  })
+})
+
+describe('createLegalFn：code 落库（S7）', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockRequireAuth.mockResolvedValue({ user: { id: 'u1', role: 'USER' } } as never)
+    m.legalRegulation.create.mockResolvedValue({ id: 'new-1' })
+  })
+
+  it('传 code → 落库且 canonicalId = code', async () => {
+    await createMod.createLegalFn({
+      data: { title: '某标准', code: 'GB 4943', jurisdiction: 'CN_NATIONAL', category: '安全', tags: [] },
+    })
+    expect(m.legalRegulation.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ code: 'GB 4943', canonicalId: 'GB 4943' }),
+      }),
+    )
+  })
+
+  it('不传 code → code 落 null，canonicalId = title', async () => {
+    await createMod.createLegalFn({
+      data: { title: '某办法', jurisdiction: 'CN_LOCAL', category: '管理', tags: [] },
+    })
+    expect(m.legalRegulation.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ code: null, canonicalId: '某办法' }),
+      }),
+    )
+  })
+})

package/src/server/serverFns/__tests__/story-tree.test.ts

@@ -82,7 +82,6 @@ import {
   addChildFn,
   removeChildFn,
 } from "../story/story-tree";
-import { STORY_LIST_SELECT, castStoryUsers } from "../../story/types";
 
 const USER = "u-current";
 const PARENT = "st-parent";

package/src/server/serverFns/__tests__/update-bug-guard.test.ts

@@ -92,7 +92,7 @@ vi.mock("@/server/collab/write-guard", () => ({
 }));
 
 import { updateBugFn } from "../bug/bug-crud";
-import { BUG_LIST_SELECT } from "@/components/bug/types";
+import { BUG_LIST_SELECT } from "@/shared/bug/types";
 
 const U = "u-1";
 const P = "pr-1";

package/src/server/serverFns/bug/__tests__/bug-comments.test.ts

@@ -93,7 +93,7 @@ import {
   listCommentsFn,
   updateCommentFn,
 } from "../bug-comments";
-import { BUG_USER_BRIEF_SELECT } from "@/components/bug/types";
+import { BUG_USER_BRIEF_SELECT } from "@/shared/bug/types";
 
 const USER = "u-current";
 const OTHER = "u-other";

package/src/server/serverFns/bug/__tests__/bug-groups.test.ts

@@ -108,7 +108,7 @@ import {
   DEFAULT_BUG_DISPLAY_OPTIONS,
 } from "@/shared/bug/display-types";
 import { BUG_STATES } from "@/shared/bug/constants";
-import { BUG_LIST_SELECT } from "@/components/bug/types";
+import { BUG_LIST_SELECT } from "@/shared/bug/types";
 import type { BugDisplayOptions } from "@/shared/bug/display-types";
 
 const DATE = new Date("2026-01-01T00:00:00Z");

package/src/server/serverFns/bug/bug-activities.ts

@@ -21,8 +21,8 @@ import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import type { AvatarConfig } from "@allbluecn/kernel";
-import { BUG_USER_BRIEF_SELECT } from "@/components/bug/types";
-import type { BugActivityItem } from "@/components/bug/types";
+import { BUG_USER_BRIEF_SELECT } from "@/shared/bug/types";
+import type { BugActivityItem } from "@/shared/bug/types";
 import { assertBugProjectMember } from "@/server/bug/bug-permissions";
 
 // BugActivity.userId 可空（SDK/agent 产生），user 关系 onDelete: SetNull

package/src/server/serverFns/bug/bug-comments.ts

@@ -21,9 +21,9 @@ import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import type { AvatarConfig } from "@allbluecn/kernel";
-import { BUG_USER_BRIEF_SELECT } from "@/components/bug/types";
-import type { BugCommentWithReplies } from "@/components/bug/types";
-import type { ReactionGroup } from "@/components/story/types";
+import { BUG_USER_BRIEF_SELECT } from "@/shared/bug/types";
+import type { BugCommentWithReplies } from "@/shared/bug/types";
+import type { ReactionGroup } from "@/shared/story/types";
 import { assertBugProjectMember } from "@/server/bug/bug-permissions";
 import { aggregateReactions } from "@/server/story/types";
 

package/src/server/serverFns/bug/bug-crud/detail-select.ts

@@ -21,7 +21,7 @@
 // 任务 2 裁定：详情扩展字段在 serverFns/bug 侧扩展，不改 components/bug/types.ts
 // 的 BUG_LIST_SELECT——列表查询不多拉大字段。
 import type { Prisma } from "@allbluecn/database";
-import { BUG_LIST_SELECT } from "@/components/bug/types";
+import { BUG_LIST_SELECT } from "@/shared/bug/types";
 
 export const BUG_DETAIL_SELECT = {
   ...BUG_LIST_SELECT,

package/src/server/serverFns/bug/bug-crud/detail.ts

@@ -20,8 +20,8 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
-import { castBugUsers } from "@/components/bug/types";
-import type { BugDetail, ReproduceSteps } from "@/components/bug/types";
+import { castBugUsers } from "@/shared/bug/types";
+import type { BugDetail, ReproduceSteps } from "@/shared/bug/types";
 import { assertBugProjectMember } from "@/server/bug/bug-permissions";
 import { BUG_DETAIL_SELECT, extractScreenshotBlobId } from "./detail-select";