@allbluecn/web-app 0.19.5 → 0.21.0

package/src/server/serverFns/chat/conversations.ts

@@ -162,6 +162,10 @@ const forkConversationSchema = z.object({
   threadId: z.string().min(1),
 })
 
+// S21：fork 消息写入分批大小与监控告警阈值（不截断——见 handler 内 DB-05 注释）
+const FORK_MSG_BATCH_SIZE = 500;
+const FORK_MSG_WARN_THRESHOLD = 2000;
+
 export const forkConversationFn = createServerFn({ method: "POST" })
   .validator(forkConversationSchema)
   .handler(async ({ data }) => {
@@ -181,7 +185,8 @@ export const forkConversationFn = createServerFn({ method: "POST" })
     if (!source) throw new Error("thread not found")
 
     // DB-05：fork 全量复制只 select 被复制的列；不加 take——
-    // fork 语义要求完整消息集，截断会产生丢消息的残缺副本（行为红线）
+    // fork 语义要求完整消息集，截断会产生丢消息的残缺副本（行为红线）。
+    // S21（审计 A2x ⚪）：大事务治理=写入分批 + 超限监控（截断仍禁止）
     const msgs = await prisma.chatMessage.findMany({
       where: { threadId: source.id },
       orderBy: { createdAt: "asc" },
@@ -206,18 +211,27 @@ export const forkConversationFn = createServerFn({ method: "POST" })
       })
 
       if (msgs.length > 0) {
-        await tx.chatMessage.createMany({
-          data: msgs.map((msg): Prisma.ChatMessageCreateManyInput => ({
-            threadId: thread.id,
-            role: msg.role,
-            content: jsonRef(msg.content),
-            parts: jsonRef(msg.parts),
-            thinking: msg.thinking,
-            citations: jsonRef(msg.citations),
-            toolCallId: msg.toolCallId,
-            createdAt: msg.createdAt,
-          })),
-        })
+        // 超限监控：超大线程的复制耗时/内存峰值可见化（阈值仅告警，不截断）
+        if (msgs.length > FORK_MSG_WARN_THRESHOLD) {
+          console.warn(
+            `[fork] 大会话复制 thread=${source.id} messages=${msgs.length}（阈值 ${FORK_MSG_WARN_THRESHOLD}）`,
+          );
+        }
+        // createMany 分批：单语句载荷有界，降低长事务峰值
+        for (let i = 0; i < msgs.length; i += FORK_MSG_BATCH_SIZE) {
+          await tx.chatMessage.createMany({
+            data: msgs.slice(i, i + FORK_MSG_BATCH_SIZE).map((msg): Prisma.ChatMessageCreateManyInput => ({
+              threadId: thread.id,
+              role: msg.role,
+              content: jsonRef(msg.content),
+              parts: jsonRef(msg.parts),
+              thinking: msg.thinking,
+              citations: jsonRef(msg.citations),
+              toolCallId: msg.toolCallId,
+              createdAt: msg.createdAt,
+            })),
+          });
+        }
       }
 
       return thread

package/src/server/serverFns/harness/github-workspace.ts

@@ -40,6 +40,37 @@ const GITHUB_API_TIMEOUT_MS = 15_000
  * 2. 其次读 Account 表（provider='github'）的 access_token（session 级，不持久化）
  * 3. 都不存在时返回空数组（未连接 GitHub）
  */
+// token 解析单一来源（S27 抽取）：AiProviderConfig 持久化 → Account session 级兜底
+async function resolveGithubToken(userId: string): Promise<{ token: string | null; source: "saved" | "session" | null }> {
+  const prisma = await getPrisma()
+  const providerConfig = await prisma.aiProviderConfig.findFirst({
+    where: { userId, providerId: "github" },
+    select: { apiKey: true },
+  })
+  if (providerConfig?.apiKey) {
+    try {
+      return { token: decryptApiKey(providerConfig.apiKey), source: "saved" }
+    } catch {
+      // 解密失败视为无持久化 token，继续 Account 兜底
+    }
+  }
+  const account = await prisma.account.findFirst({
+    where: { userId, provider: "github" },
+    select: { access_token: true },
+  })
+  return { token: account?.access_token ?? null, source: account?.access_token ? "session" : null }
+}
+
+/** S27：GitHub 连接状态显式返回（token 不出服务端，仅回是否已配置及来源） */
+export const getGithubConnectionFn = createServerFn({ method: "GET" })
+  .handler(async () => {
+    const request = getRequest()
+    const session = await getCurrentSession(request)
+    if (!session?.user?.id) return { connected: false, source: null }
+    const { source } = await resolveGithubToken(session.user.id)
+    return { connected: source !== null, source }
+  })
+
 export const listGithubReposFn = createServerFn({ method: "GET" })
   .handler(async () => {
     const prisma = await getPrisma()
@@ -47,31 +78,7 @@ export const listGithubReposFn = createServerFn({ method: "GET" })
     const session = await getCurrentSession(request)
     if (!session?.user?.id) throw new Error("Unauthorized")
 
-    const userId = session.user.id
-
-    // 尝试从 AiProviderConfig 读取持久化 token
-    const providerConfig = await prisma.aiProviderConfig.findFirst({
-      where: { userId, providerId: "github" },
-      select: { apiKey: true },
-    })
-
-    let token: string | null = null
-    if (providerConfig?.apiKey) {
-      try {
-        token = decryptApiKey(providerConfig.apiKey)
-      } catch {
-        token = null
-      }
-    }
-
-    // 兜底：从 Account 表读 session 级 token（未显式保存）
-    if (!token) {
-      const account = await prisma.account.findFirst({
-        where: { userId, provider: "github" },
-        select: { access_token: true },
-      })
-      token = account?.access_token ?? null
-    }
+    const { token } = await resolveGithubToken(session.user.id)
 
     if (!token) return { repos: [] }
 

package/src/server/serverFns/harness/search-mention-candidates.ts

@@ -43,12 +43,14 @@ export const searchKbDocsForMentionFn = createServerFn({ method: "GET" })
           : {}),
       },
       take: 10,
-      select: { id: true, title: true, kbId: true },
+      select: { id: true, title: true, kbId: true, kb: { select: { name: true } } },
     })
     return docs.map((d) => ({
       kind: "kb-doc" as const,
       id: d.id,
       label: d.title,
       kbId: d.kbId,
+      // S29：mention 菜单按知识库名分组（此前只有 kind 语义标签）
+      kbName: d.kb.name,
     }))
   })

package/src/server/serverFns/iteration/iteration-crud.ts

@@ -28,7 +28,7 @@ import {
   iterationIdSchema,
   type IterationSummary,
 } from "./schemas";
-import type { StoryState } from "@/components/story/constants";
+import type { StoryState } from "@/shared/story/constants";
 import { ensureUpcomingIterations, ensureAutoRollover } from "@/server/iteration/auto-schedule-internal";
 import { resolveStoryScopeProjectId, resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import { assertIterationProjectMember, assertIterationProjectMembership as assertProjectMembership } from "@/server/iteration/permissions";

package/src/server/serverFns/knowledge/public/legal/create.ts

@@ -48,6 +48,9 @@ export const createLegalFn = createServerFn({ method: 'POST' })
       data: {
         canonicalId: legalCanonicalId({ title: data.title, code: data.code }),
         title: data.title,
+        // S7：code 持久化（此前仅参与 canonicalId 计算）。空串归一 null，
+        // 与 update 侧口径一致，避免空串短路与 canonicalId 维度回退语义混淆
+        code: data.code?.trim() || null,
         jurisdiction: data.jurisdiction,
         region: data.region || null,
         country: data.country || null,

package/src/server/serverFns/knowledge/public/legal/update.ts

@@ -54,16 +54,16 @@ export const updateLegalFn = createServerFn({ method: 'POST' })
     if (!isOwner && !isAdmin) throw new Error('无权限')
 
     const updateData: Prisma.LegalRegulationUncheckedUpdateInput = { ...rest }
-    if (code !== undefined || data.title !== undefined) {
-      // 审计 🟡（2026-10-25）核实：code 仅参与 canonicalId 计算，LegalRegulation
-      // 无 code 列（create 同样不落库），故无 existing.code 可回退——与
-      // dictionary/update.ts 的 industry 回退不可对齐属数据模型差异。
-      // 仅改标题时 canonicalId 会从「code 维度」回落「title 维度」，分享关联
-      // （按 canonicalId 匹配）可能错位；修复需为 LegalRegulation 增加 code 列
-      // （schema 变更，见修复报告待决策项）。
+    // S7（审计 2026-10-25）：code 已持久化（迁移 20261028130000，存量行按
+    // canonicalId <> title 回填）。重算口径与 compliance 同款裁定——仅显式传
+    // code 时重算并落库：有 code 行身份=code，改标题不再从「code 维度」漂移到
+    // 「title 维度」；无 code 存量行保持创建时 key，分享/收藏关联（按
+    // canonicalId 匹配）一律不失联。
+    if (code !== undefined) {
+      updateData.code = code.trim() || null
       updateData.canonicalId = legalCanonicalId({
         title: data.title ?? existing.title,
-        code: code ?? undefined,
+        code,
       })
     }
     return prisma.legalRegulation.update({ where: { id }, data: updateData, select: { id: true } })

package/src/server/serverFns/knowledge-index.ts

@@ -22,6 +22,7 @@ import { z } from "zod"
 import { requireAuth } from "@/server/auth-helpers"
 import { getVectorStore } from "@/lib/vector-store"
 import { checkAiRateLimit } from "@/server/lib/rate-limit"
+import { tryAcquireReindex, releaseReindex } from "@/server/knowledge/reindex-guard"
 import {
   KB_EMBEDDINGS_TABLE,
   indexDocumentEmbeddings,
@@ -86,10 +87,13 @@ export const reindexKnowledgeBaseFn = createServerFn({ method: "POST" })
     })
     if (!kb) throw new Error("未找到或无权限")
 
-    const docs = await prisma.knowledgeDocument.findMany({
-      where: { kbId: data.kbId, isDeleted: false },
-      select: { id: true, title: true, content: true, kbId: true },
-    })
+    // S26：同 KB 重建进行中拒绝重复触发（防配额双耗与删建窗口交叠）
+    if (!tryAcquireReindex(data.kbId)) throw new Error("该知识库正在重建索引，请稍后再试")
+    try {
+      const docs = await prisma.knowledgeDocument.findMany({
+        where: { kbId: data.kbId, isDeleted: false },
+        select: { id: true, title: true, content: true, kbId: true },
+      })
 
     const aiConfig = await resolveAiConfig(data.kbId)
 
@@ -112,5 +116,8 @@ export const reindexKnowledgeBaseFn = createServerFn({ method: "POST" })
       }
     }
 
-    return { indexed: total, documentCount: docs.length, failed }
+      return { indexed: total, documentCount: docs.length, failed }
+    } finally {
+      releaseReindex(data.kbId)
+    }
   })

package/src/server/serverFns/project.ts

@@ -30,13 +30,9 @@ import { startOfMonth, endOfMonth, subMonths, eachDayOfInterval } from "date-fns
 import { formatInTimeZone } from "date-fns-tz";
 import type { Prisma } from "@allbluecn/database";
 
-// 成员列表专用：项目成员管理 UI 渲染并按 email 搜索成员（project-member-manager /
-// invite-member-dialog），属最小必要的 email 披露面；其余 owner/活动摘要一律走
-// 共享 USER_BRIEF_SELECT（不含 email，审计 ⚪ 最小披露，@/server/lib/user-brief 单一来源）
-const USER_BRIEF_SELECT_WITH_EMAIL = {
-  ...USER_BRIEF_SELECT,
-  email: true,
-} satisfies Prisma.UserDefaultArgs["select"];
+// S41（审计 ⚪ 最小披露收尾）：项目域全部用户面（成员列表/活动流/owner 摘要）
+// 统一走共享 USER_BRIEF_SELECT（不含 email，@/server/lib/user-brief 单一来源）；
+// email 展示/搜索仅在 workspace team 管理域保留
 
 // 权限校验：返回成员记录，无权限抛错
 async function requireProjectMember(
@@ -374,7 +370,7 @@ export const listProjectMembersFn = createServerFn({ method: "GET" })
         role: true,
         status: true,
         joinedAt: true,
-        user: { select: USER_BRIEF_SELECT_WITH_EMAIL },
+        user: { select: USER_BRIEF_SELECT },
       },
     });
   });
@@ -549,9 +545,7 @@ export const listProjectActivitiesFn = createServerFn({ method: "GET" })
         targetId: true,
         metadata: true,
         createdAt: true,
-        // ProjectActivity 消费方类型（ProjectUserBrief）含 email，activity 流
-        // 暂保留（收窄需同步改 components 的 ProjectActivity 契约，另行决策）
-        user: { select: USER_BRIEF_SELECT_WITH_EMAIL },
+        user: { select: USER_BRIEF_SELECT },
       },
     });
   });

package/src/server/serverFns/story/__tests__/story-dependencies.test.ts

@@ -176,9 +176,10 @@ describe("addDependenciesFn", () => {
     expect(res.failed[0].targetId).toBe("b");
     expect(res.failed[0].reason).toBe("DUPLICATED");
     expect(mocks.depCreateManyAndReturn).not.toHaveBeenCalled();
-    // 判重完全来自取全边预取（select 白名单形状不变），无逐边 findFirst
+    // S23：判重来自定向 OR 查询（仅本批 pair，非全表），无逐边 findFirst
     expect(mocks.depFindMany).toHaveBeenCalledTimes(1);
     expect(mocks.depFindMany).toHaveBeenCalledWith({
+      where: { OR: [{ sourceId: "a", targetId: "b" }] },
       select: { sourceId: true, targetId: true },
     });
     expect(mocks.depFindFirst).not.toHaveBeenCalled();
@@ -234,9 +235,19 @@ describe("addDependenciesFn", () => {
       select: { id: true, sourceId: true, targetId: true },
     });
     expect(mocks.depCreate).not.toHaveBeenCalled();
-    // 性能契约：环检测的图只查一次（取全边），且不带任何 where 过滤
-    expect(mocks.depFindMany).toHaveBeenCalledTimes(1);
-    expect(mocks.depFindMany).toHaveBeenCalledWith({
+    // S23 性能契约：判重 1 次定向 OR 查询 + 每条边 1 次 SQL BFS（首层 sourceId IN，
+    // 边集为空即终局）；不再全表加载
+    expect(mocks.depFindMany).toHaveBeenCalledTimes(3);
+    expect(mocks.depFindMany).toHaveBeenNthCalledWith(1, {
+      where: { OR: [{ sourceId: "a", targetId: "b" }, { sourceId: "a", targetId: "c" }] },
+      select: { sourceId: true, targetId: true },
+    });
+    expect(mocks.depFindMany).toHaveBeenNthCalledWith(2, {
+      where: { sourceId: { in: ["b"] } },
+      select: { sourceId: true, targetId: true },
+    });
+    expect(mocks.depFindMany).toHaveBeenNthCalledWith(3, {
+      where: { sourceId: { in: ["c"] } },
       select: { sourceId: true, targetId: true },
     });
     // created 按 items 输入序回带（经 sourceId|targetId 映射，不依赖返回行顺序）

package/src/server/serverFns/story/__tests__/story-transfer.test.ts

@@ -179,6 +179,26 @@ describe("transferStoryToProjectFn", () => {
     expect(res.projectId).toBe(P_TARGET);
   });
 
+  it("S13：转移活动 value 存项目 id（非项目名），不再查询项目名称", async () => {
+    mocks.memberFindUnique.mockResolvedValue({ status: "active" });
+    mocks.storyFindUnique.mockResolvedValue(storyRow());
+    mocks.projectFindUnique.mockResolvedValue({ id: P_TARGET, name: "目标项目", displayId: "TGT" });
+    mocks.sequenceCounterUpsert.mockResolvedValue({ scope: P_TARGET, seq: 3 });
+    mocks.storyUpdate.mockResolvedValue(storyRow({ projectId: P_TARGET, identifier: "TGT-3" }));
+
+    await transferStoryToProjectFn({ data: { storyId: "st-1", targetProjectId: P_TARGET } });
+
+    expect(mocks.activityCreate).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          action: "project_transferred",
+          oldValue: P_SRC,
+          newValue: P_TARGET,
+        }),
+      }),
+    );
+  });
+
   it("转移发号自愈：目标项目计数器落后存量（seq=3/max=9）时跳到 max+1 并回写计数器，identifier 用自愈后序号", async () => {
     mocks.memberFindUnique.mockResolvedValue({ status: "active" });
     mocks.storyFindUnique.mockResolvedValue(storyRow());

package/src/server/serverFns/story/link-preview.ts

@@ -21,10 +21,11 @@ import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { checkUserActionRateLimit } from "@/server/lib/rate-limit";
 import { assertFetchableUrl } from "@/server/fetch-guard";
-import { httpUrl } from "@/server/lib/validators";
 
 const checkSchema = z.object({
-  url: httpUrl,
+  // 语义校验由 handler 的 assertFetchableUrl 完成（非 http(s) 返回 embeddable:false，
+  // 与既有客户端契约一致）；此处仅做语法校验
+  url: z.string().url(),
   origin: z.string().url().optional(),
 });
 

package/src/server/serverFns/story/story-children.ts

@@ -23,7 +23,7 @@ import { requireAuth } from "@/server/auth-helpers";
 import { assertStoryProjectMember } from "@/server/story/permissions";
 import { STORY_LIST_SELECT, castStoryUsers } from "@/server/story/types";
 
-import type { StoryListItem } from "@/components/story/types";
+import type { StoryListItem } from "@/shared/story/types";
 
 const childrenSchema = z.object({ parentId: z.string() });
 

package/src/server/serverFns/story/story-comments.ts

@@ -20,7 +20,7 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
-import type { CommentWithReplies, ReactionGroup } from "@/components/story/types";
+import type { CommentWithReplies, ReactionGroup } from "@/shared/story/types";
 import { USER_BRIEF_SELECT, castUserBrief, aggregateReactions } from "@/server/story/types";
 import { assertStoryProjectMember, assertStoryProjectMembership as assertProjectMembership } from "@/server/story/permissions";
 

package/src/server/serverFns/story/story-crud/bulk.ts

@@ -20,7 +20,7 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRequest } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
-import { STORY_STATES, STORY_PRIORITIES, type StoryState, type StoryPriority } from "@/components/story/constants";
+import { STORY_STATES, STORY_PRIORITIES, type StoryState, type StoryPriority } from "@/shared/story/constants";
 import { toDateKeyUtc } from "@/server/story/date-key";
 import type { Prisma } from "@allbluecn/database";
 import { buildRoomName } from "@allbluecn/collab-core/rooms";

package/src/server/serverFns/story/story-crud.ts

@@ -25,7 +25,7 @@ import { ensureBuiltinIndependentProject, resolveStoryScopeProjectIds } from "@/
 import { validateAssignee } from "@/server/lib/validate-assignee";
 import { withCollabGuard } from "@/server/collab/write-guard";
 import { touchCollabSnapshot } from "@/server/collab/touch-snapshot";
-import type { ActivityItem } from "@/components/story/types";
+import type { ActivityItem } from "@/shared/story/types";
 import { diffDescriptionBlocks } from "@/lib/story/description-diff";
 import { USER_BRIEF_SELECT, STORY_LIST_SELECT, castStoryUsers, castUserBrief } from "@/server/story/types";
 import { toDateKeyUtc } from "@/server/story/date-key";

package/src/server/serverFns/story/story-dependencies.ts

@@ -22,7 +22,8 @@ import { z } from "zod";
 import { requireAuth } from "@/server/auth-helpers";
 import { resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import { STORY_LIST_SELECT, castStoryUsers, ACTIVITY_SELECT, toActivityItem } from "@/server/story/types";
-import type { DependencyRow } from "@/components/story/types";
+import type { Prisma } from "@allbluecn/database";
+import type { DependencyRow } from "@/shared/story/types";
 import { assertStoryProjectMember, assertStoriesProjectMember } from "@/server/story/permissions";
 
 const edgeTypeSchema = z.enum(["BLOCKS", "STARTS_BEFORE", "FINISHES_BEFORE"]);
@@ -31,7 +32,47 @@ const edgeTypeSchema = z.enum(["BLOCKS", "STARTS_BEFORE", "FINISHES_BEFORE"]);
 
 /** 依赖边无向归一化键（查重口径：双向均视为同一条边） */
 function normalizedEdgeKey(a: string, b: string): string {
-  return a < b ? `${a}|${b}` : `${b}|${a}`;
+  return a < b ? `${a}-${b}` : `${b}-${a}`;
+}
+// S23：环检测的 SQL 迭代 BFS——从 fromId 出发逐层扩展 source→target 有向边，
+// 只加载可达子图（替代全表加载：数据量随图局部性而非全表规模增长）。
+// additionalEdges：未落库边并入图（批量建边防批内互指环漏检）；
+// excludeEdgeId：排除某条既有边（方向反转场景排除自身）。
+// maxDepth 防御性上限：异常超深结构按不可达放行，避免病态数据打满查询。
+async function graphReaches(
+  prisma: Pick<Prisma.TransactionClient, "storyDependency">,
+  fromId: string,
+  toId: string,
+  opts: {
+    additionalEdges?: Array<{ sourceId: string; targetId: string }>;
+    excludeEdgeId?: string;
+    maxDepth?: number;
+  } = {},
+): Promise<boolean> {
+  if (fromId === toId) return true;
+  const maxDepth = opts.maxDepth ?? 64;
+  const visited = new Set<string>([fromId]);
+  let frontier = new Set<string>([fromId]);
+  for (let depth = 0; depth < maxDepth && frontier.size > 0; depth++) {
+    const next = new Set<string>();
+    const edges = await prisma.storyDependency.findMany({
+      where: {
+        sourceId: { in: [...frontier] },
+        ...(opts.excludeEdgeId ? { id: { not: opts.excludeEdgeId } } : {}),
+      },
+      select: { sourceId: true, targetId: true },
+    });
+    for (const e of edges) {
+      if (!visited.has(e.targetId)) next.add(e.targetId);
+    }
+    for (const e of opts.additionalEdges ?? []) {
+      if (frontier.has(e.sourceId) && !visited.has(e.targetId)) next.add(e.targetId);
+    }
+    if (next.has(toId)) return true;
+    for (const n of next) visited.add(n);
+    frontier = next;
+  }
+  return false;
 }
 
 export const addDependenciesFn = createServerFn({ method: "POST" })
@@ -60,40 +101,19 @@ export const addDependenciesFn = createServerFn({ method: "POST" })
       userId,
     );
 
-    // 一次性取全部出边（3 类型合并；不按 projectId 裁剪——跨项目边同样参与环判定），
-    // 构建内存邻接表供本批循环的环检测复用，避免 O(items × 可达节点) 次串行 RTT
-    const allEdges = await prisma.storyDependency.findMany({
+    // S23（审计 A2x ⚪ 性能债重构）：环检测从「全表加载边 + 内存遍历」升级为
+    // SQL 迭代 BFS（graphReaches）——只加载 fromId 可达子图的边，数据量随图
+    // 局部性而非全表规模增长；跨项目边仍参与判定（查询不带 projectId 裁剪，
+    // DB-01 语义不变）。查重随之改定向 OR 查询（不再依赖全表集合）。
+    const dedupEdges = await prisma.storyDependency.findMany({
+      where: {
+        OR: data.items.map((i) => ({ sourceId: i.sourceId, targetId: i.targetId })),
+      },
       select: { sourceId: true, targetId: true },
     });
-    const adjacency = new Map<string, string[]>();
-    for (const e of allEdges) {
-      const list = adjacency.get(e.sourceId);
-      if (list) list.push(e.targetId);
-      else adjacency.set(e.sourceId, [e.targetId]);
-    }
-
-    // 环检测：从 fromId 出发沿 source→target 有向边能否到达 toId（纯内存遍历）
-    // batchEdges：本批已插入边（防批内互指环漏检）
-    function reaches(
-      fromId: string,
-      toId: string,
-      batchEdges: Array<{ sourceId: string; targetId: string }>,
-    ): boolean {
-      const visited = new Set<string>();
-      const stack = [fromId];
-      while (stack.length > 0) {
-        const current = stack.pop()!;
-        if (current === toId) return true;
-        if (visited.has(current)) continue;
-        visited.add(current);
-        for (const next of adjacency.get(current) ?? []) {
-          if (!visited.has(next)) stack.push(next);
-        }
-        for (const e of batchEdges) {
-          if (e.sourceId === current && !visited.has(e.targetId)) stack.push(e.targetId);
-        }
-      }
-      return false;
+    const existingEdgeKeys = new Set<string>();
+    for (const e of dedupEdges) {
+      existingEdgeKeys.add(normalizedEdgeKey(e.sourceId, e.targetId));
     }
 
     const failed: Array<{ targetId: string; reason: "SELF" | "DUPLICATED" | "CYCLE" }> = [];
@@ -104,13 +124,6 @@ export const addDependenciesFn = createServerFn({ method: "POST" })
       type: "BLOCKS" | "STARTS_BEFORE" | "FINISHES_BEFORE";
     }> = [];
 
-    // DB-01：查重从逐边 findFirst（N 次 OR 查询）改为复用 allEdges 内存无向键集合（0 次额外查询）；
-    // 批内重复边在插入后加入集合，第 2 次出现同样命中 DUPLICATED（与原 create 后可见语义一致）
-    const existingEdgeKeys = new Set<string>();
-    for (const e of allEdges) {
-      existingEdgeKeys.add(normalizedEdgeKey(e.sourceId, e.targetId));
-    }
-
     for (const item of data.items) {
       if (item.sourceId === item.targetId) {
         failed.push({ targetId: item.targetId, reason: "SELF" });
@@ -120,8 +133,8 @@ export const addDependenciesFn = createServerFn({ method: "POST" })
         failed.push({ targetId: item.targetId, reason: "DUPLICATED" });
         continue;
       }
-      // 插入 (S,T) 后成环 ⇔ 已存在路径 T →…→ S（含本批边）
-      if (reaches(item.targetId, item.sourceId, batchEdges)) {
+      // 插入 (S,T) 后成环 ⇔ 已存在路径 T →…→ S（含本批已入列边）
+      if (await graphReaches(prisma, item.targetId, item.sourceId, { additionalEdges: batchEdges })) {
         failed.push({ targetId: item.targetId, reason: "CYCLE" });
         continue;
       }
@@ -213,32 +226,10 @@ export const updateDependencyFn = createServerFn({ method: "POST" })
       return { ok: true as const, activities: [] };
     }
 
-    // 方向反转可能成环：写入 (S,T) 后成环 ⇔ 排除自身边后存在路径 T →…→ S
-    const edges = await prisma.storyDependency.findMany({
-      where: { id: { not: dep.id } },
-      select: { sourceId: true, targetId: true },
+    // 方向反转可能成环：写入 (S,T) 后成环 ⇔ 排除自身边后存在路径 T →…→ S（S23 SQL BFS）
+    const cyclic = await graphReaches(prisma, data.targetId, data.sourceId, {
+      excludeEdgeId: dep.id,
     });
-    const adjacency = new Map<string, string[]>();
-    for (const e of edges) {
-      const list = adjacency.get(e.sourceId);
-      if (list) list.push(e.targetId);
-      else adjacency.set(e.sourceId, [e.targetId]);
-    }
-    const visited = new Set<string>();
-    const stack = [data.targetId];
-    let cyclic = false;
-    while (stack.length > 0) {
-      const current = stack.pop()!;
-      if (current === data.sourceId) {
-        cyclic = true;
-        break;
-      }
-      if (visited.has(current)) continue;
-      visited.add(current);
-      for (const next of adjacency.get(current) ?? []) {
-        if (!visited.has(next)) stack.push(next);
-      }
-    }
     if (cyclic) return { ok: false as const, reason: "CYCLE" as const };
 
     await prisma.storyDependency.update({
@@ -342,7 +333,8 @@ export const getDependenciesFn = createServerFn({ method: "GET" })
     const build = (d: (typeof deps)[number], storyId: string): DependencyRow | null => {
       const otherId = d.sourceId === storyId ? d.targetId : d.sourceId;
       const s = byId.get(otherId);
-      return s ? ({ ...s, depId: d.id, depType: d.type } as DependencyRow) : null;
+      // castStoryUsers 已显式返回 StoryListItem，公共行扩展此处结构自然成立（S14）
+      return s ? { ...s, depId: d.id, depType: d.type } : null;
     };
 
     return {

package/src/server/serverFns/story/story-groups.ts

@@ -23,7 +23,7 @@ import { requireAuth } from "@/server/auth-helpers";
 import { resolveStoryScopeProjectIds } from "@/server/builtin-project";
 import { GROUP_KEYS, ORDER_KEYS, ORDER_DIRECTIONS, resolveOrderDir } from "@/shared/list-kit/display-values";
 import type { GroupKey, OrderKey } from "@/shared/list-kit/display-types";
-import { STORY_STATES, STORY_PRIORITIES, type StoryState, type StoryPriority } from "@/components/story/constants";
+import { STORY_STATES, STORY_PRIORITIES, type StoryState, type StoryPriority } from "@/shared/story/constants";
 import { STORY_LIST_SELECT_LIGHT, castStoryUsersLight, type StoryListRowLight } from "@/server/story/types";
 import { buildListWhere, buildGroupFilter } from "./story-list-query";
 import type { Prisma } from "@allbluecn/database";

package/src/server/serverFns/story/story-transfer.ts

@@ -173,20 +173,16 @@ export const transferStoryToProjectFn = createServerFn({ method: "POST" })
       });
 
       if (projectChanged) {
-        const [oldProject, newProject] = await Promise.all([
-          existing.projectId
-            ? tx.project.findUnique({ where: { id: existing.projectId }, select: { name: true } })
-            : null,
-          tx.project.findUnique({ where: { id: data.targetProjectId }, select: { name: true } }),
-        ]);
+        // S13：activity value 存项目 id（此前存项目名，重名项目图标错配且改名后
+        // 失真）；展示层经 projects brief 以 id 解析名称/图标，存量名值回退兼容
         await tx.storyActivity.create({
           data: {
             storyId: data.storyId,
             userId,
             action: "project_transferred",
             field: "projectId",
-            oldValue: oldProject?.name ?? "",
-            newValue: newProject?.name ?? data.targetProjectId,
+            oldValue: existing.projectId ?? "",
+            newValue: data.targetProjectId,
           },
         });
         if (alloc) {
@@ -345,24 +341,16 @@ export const transferStoryAsChildFn = createServerFn({ method: "POST" })
       const createdActivities: Array<Prisma.StoryActivityGetPayload<{ select: typeof activitySelect }>> = [];
 
       if (projectChanged) {
-        const [oldProject, newProject] = await Promise.all([
-          existing.projectId
-            ? tx.project.findUnique({ where: { id: existing.projectId }, select: { name: true } })
-            : null,
-          tx.project.findUnique({ where: { id: parent.projectId }, select: { name: true } }),
-        ]);
-        const newProjectName = newProject?.name ?? parent.projectId;
-        const transferValue = parent.identifier
-          ? `${newProjectName} - ${parent.identifier} 的子需求`
-          : newProjectName;
+        // S13：value 存目标项目 id；「成为某需求子级」语义由同流程 parent_changed
+        // 活动承载（此前拼进 value 的「X - ID 的子需求」冗余且使图标/改名解析失效）
         createdActivities.push(await tx.storyActivity.create({
           data: {
             storyId: data.storyId,
             userId,
             action: "project_transferred",
             field: "projectId",
-            oldValue: oldProject?.name ?? "",
-            newValue: transferValue,
+            oldValue: existing.projectId ?? "",
+            newValue: parent.projectId,
             isAI: false,
           },
           select: {