@allbluecn/web-app 0.21.0 → 0.22.0

package/src/paraglide/messages/chat_workspace_githubnotconnected2.d.ts

@@ -0,0 +1,17 @@
+export { chat_workspace_githubnotconnected2 as "chat_workspace_githubNotConnected" };
+export type LocalizedString = import("../runtime.js").LocalizedString;
+export type Chat_Workspace_Githubnotconnected2Inputs = {};
+/**
+* | output |
+* | --- |
+* | "GitHub not connected: save a GitHub Token in Settings → AI Providers, or sign in with GitHub and retry" |
+*
+* @param {Chat_Workspace_Githubnotconnected2Inputs} inputs
+* @param {{ locale?: "zh" | "en" }} options
+* @returns {LocalizedString}
+*/
+declare const chat_workspace_githubnotconnected2: ((inputs?: Chat_Workspace_Githubnotconnected2Inputs, options?: {
+    locale?: "zh" | "en";
+}) => LocalizedString) & import("../runtime.js").MessageMetadata<Chat_Workspace_Githubnotconnected2Inputs, {
+    locale?: "zh" | "en";
+}, {}>;

package/src/paraglide/messages/chat_workspace_githubnotconnected2.js

@@ -0,0 +1,30 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Chat_Workspace_Githubnotconnected2Inputs */
+
+const zh_chat_workspace_githubnotconnected2 = /** @type {(inputs: Chat_Workspace_Githubnotconnected2Inputs) => LocalizedString} */ () => {
+	return /** @type {LocalizedString} */ (`未连接 GitHub：请在「设置 → AI 提供方」保存 GitHub Token，或使用 GitHub 登录后重试`)
+};
+
+const en_chat_workspace_githubnotconnected2 = /** @type {(inputs: Chat_Workspace_Githubnotconnected2Inputs) => LocalizedString} */ () => {
+	return /** @type {LocalizedString} */ (`GitHub not connected: save a GitHub Token in Settings → AI Providers, or sign in with GitHub and retry`)
+};
+
+/**
+* | output |
+* | --- |
+* | "GitHub not connected: save a GitHub Token in Settings → AI Providers, or sign in with GitHub and retry" |
+*
+* @param {Chat_Workspace_Githubnotconnected2Inputs} inputs
+* @param {{ locale?: "zh" | "en" }} options
+* @returns {LocalizedString}
+*/
+const chat_workspace_githubnotconnected2 = /** @type {((inputs?: Chat_Workspace_Githubnotconnected2Inputs, options?: { locale?: "zh" | "en" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Chat_Workspace_Githubnotconnected2Inputs, { locale?: "zh" | "en" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_chat_workspace_githubnotconnected2(inputs)
+	return zh_chat_workspace_githubnotconnected2(inputs)
+});
+export { chat_workspace_githubnotconnected2 as "chat_workspace_githubNotConnected" }

package/src/paraglide/messages/dashboard_activityfeed_ai1.d.ts

@@ -0,0 +1,17 @@
+export { dashboard_activityfeed_ai1 as "dashboard_activityFeed_ai" };
+export type LocalizedString = import("../runtime.js").LocalizedString;
+export type Dashboard_Activityfeed_Ai1Inputs = {};
+/**
+* | output |
+* | --- |
+* | "AI" |
+*
+* @param {Dashboard_Activityfeed_Ai1Inputs} inputs
+* @param {{ locale?: "zh" | "en" }} options
+* @returns {LocalizedString}
+*/
+declare const dashboard_activityfeed_ai1: ((inputs?: Dashboard_Activityfeed_Ai1Inputs, options?: {
+    locale?: "zh" | "en";
+}) => LocalizedString) & import("../runtime.js").MessageMetadata<Dashboard_Activityfeed_Ai1Inputs, {
+    locale?: "zh" | "en";
+}, {}>;

package/src/paraglide/messages/dashboard_activityfeed_ai1.js

@@ -0,0 +1,30 @@
+/* eslint-disable */
+import { getLocale, experimentalStaticLocale } from '../runtime.js';
+
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+
+/** @typedef {{}} Dashboard_Activityfeed_Ai1Inputs */
+
+const zh_dashboard_activityfeed_ai1 = /** @type {(inputs: Dashboard_Activityfeed_Ai1Inputs) => LocalizedString} */ () => {
+	return /** @type {LocalizedString} */ (`AI`)
+};
+
+const en_dashboard_activityfeed_ai1 = /** @type {(inputs: Dashboard_Activityfeed_Ai1Inputs) => LocalizedString} */ () => {
+	return /** @type {LocalizedString} */ (`AI`)
+};
+
+/**
+* | output |
+* | --- |
+* | "AI" |
+*
+* @param {Dashboard_Activityfeed_Ai1Inputs} inputs
+* @param {{ locale?: "zh" | "en" }} options
+* @returns {LocalizedString}
+*/
+const dashboard_activityfeed_ai1 = /** @type {((inputs?: Dashboard_Activityfeed_Ai1Inputs, options?: { locale?: "zh" | "en" }) => LocalizedString) & import('../runtime.js').MessageMetadata<Dashboard_Activityfeed_Ai1Inputs, { locale?: "zh" | "en" }, {}>} */ ((inputs = {}, options = {}) => {
+	const locale = experimentalStaticLocale ?? options.locale ?? getLocale()
+	if (locale === "en") return en_dashboard_activityfeed_ai1(inputs)
+	return zh_dashboard_activityfeed_ai1(inputs)
+});
+export { dashboard_activityfeed_ai1 as "dashboard_activityFeed_ai" }

package/src/routes/_nav/bugs/$bugId/route.tsx

@@ -63,7 +63,7 @@ export const Route = createFileRoute("/_nav/bugs/$bugId")({
     const [collab, users, labels, neighbors] = await Promise.all([
       collabPromise,
       listUsersBriefFn({ data: bug.projectId ? { projectId: bug.projectId } : {} }),
-      listLabelsFn(),
+      listLabelsFn({ data: { projectId: bug.projectId } }),
       getBugNeighborsFn({ data: { bugId: params.bugId } }),
     ]);
     return { bug, collab, users, labels, neighbors };

package/src/routes/_nav/bugs/index.tsx

@@ -24,7 +24,7 @@ export const Route = createFileRoute("/_nav/bugs/")({
     // 分组/table 视图均走 usePagedBugGroups 自拉数据，listBugsFn 零消费方不再预取
     const [users, labels, projects] = await Promise.all([
       listUsersBriefFn(),
-      listLabelsFn(),
+      listLabelsFn({ data: {} }),
       listProjectsBriefFn(),
     ]);
     return { users, labels, projects };

package/src/routes/_nav/dashboard/-components/activity-feed.tsx

@@ -18,12 +18,27 @@
 import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
 import { MessageSquare } from 'lucide-react'
 import { m } from "@/paraglide/messages.js";
+import { ACTIVITY_LABEL } from "@/shared/story/constants";
+
+function formatRelative(iso: string): string {
+  const diff = Date.now() - new Date(iso).getTime();
+  const min = Math.floor(diff / 60000);
+  if (min < 1) return m.story_time_justNow();
+  if (min < 60) return m.story_time_minutesAgo({ count: min });
+  const hr = Math.floor(min / 60);
+  if (hr < 24) return m.story_time_hoursAgo({ count: hr });
+  const day = Math.floor(hr / 24);
+  if (day < 30) return m.story_time_daysAgo({ count: day });
+  return new Date(iso).toLocaleDateString();
+}
 
 interface Activity {
   id: string
-  content: string
-  userName: string
+  action: string
+  isAI: boolean
   createdAt: string
+  storyIdentifier: string
+  storyName: string
 }
 
 interface ActivityFeedProps {
@@ -47,9 +62,13 @@ export function ActivityFeed({ activities }: ActivityFeedProps) {
             {activities.map((activity) => (
               <div key={activity.id} className="flex items-start gap-3">
                 <div className="flex-1">
-                  <p className="text-sm">{activity.content}</p>
+                  <p className="text-sm">
+                    <span className="font-medium">{activity.storyIdentifier}</span>{" "}
+                    {ACTIVITY_LABEL[activity.action]?.() ?? activity.action}
+                    {activity.isAI ? ` · ${m.dashboard_activityFeed_ai()}` : ""}
+                  </p>
                   <p className="text-xs text-muted-foreground">
-                    {activity.userName} · {activity.createdAt}
+                    {activity.storyName} · {formatRelative(activity.createdAt)}
                   </p>
                 </div>
               </div>

package/src/routes/_nav/dashboard/route.lazy.tsx

@@ -38,7 +38,7 @@ export const Route = createLazyFileRoute('/_nav/dashboard')({
 })
 
 function DashboardPage() {
-  const { prds, activityData } = Route.useLoaderData()
+  const { prds, activityData, stats, recentActivities } = Route.useLoaderData()
   const context = Route.useRouteContext()
   // 明暗跟随全局 ThemeModeProvider（auto 模式含系统外观 + 时段规则），
   // 不再自建 MutationObserver 监听 documentElement class
@@ -54,10 +54,10 @@ function DashboardPage() {
         <AiChatPrompt hasAiKey={context?.session?.user?.hasAiKey} />
 
         <StatsGrid
-          prdCount={prds.length}
-          completedToday={0}
-          unreadComments={0}
-          installedApps={0}
+          prdCount={stats.prdCount}
+          completedToday={stats.completedToday}
+          unreadComments={stats.unreadComments}
+          installedApps={stats.installedApps}
           className="mt-60"
         />
 
@@ -71,7 +71,7 @@ function DashboardPage() {
         </Card>
 
         <div className="grid gap-6 lg:grid-cols-2">
-          <ActivityFeed activities={[]} />
+          <ActivityFeed activities={recentActivities} />
           <Card className="border">
             <CardHeader>
               <CardTitle>{m.dashboard_dashboard_quickEntry()}</CardTitle>

package/src/routes/_nav/dashboard/route.tsx

@@ -17,22 +17,29 @@
 
 import { createFileRoute } from '@tanstack/react-router'
 import { listDesignsFn } from '@/server/serverFns/design'
-import { getActivityDataFn } from '@/server/serverFns/activity'
+import { getActivityDataFn, getDashboardStatsFn, getRecentActivitiesFn } from '@/server/serverFns/activity'
 import { resolveTimezone } from '@/lib/datetime'
 
 export const Route = createFileRoute('/_nav/dashboard')({
   loader: async ({ context }) => {
     try {
       const timezone = resolveTimezone(null, context.session?.user?.timezone)
-      const [prds, activityData] = await Promise.all([
+      const [prds, activityData, stats, recentActivities] = await Promise.all([
         listDesignsFn({ data: {} }),
         getActivityDataFn({ data: { timezone } }),
+        getDashboardStatsFn(),
+        getRecentActivitiesFn({ data: { take: 10 } }),
       ])
-      return { prds, activityData }
+      return { prds, activityData, stats, recentActivities }
     } catch (e) {
       // 降级为空数据前先留痕（否则服务端故障被伪装成「用户没有数据」）
       console.error('[dashboard] loader failed:', e instanceof Error ? e.message : String(e))
-      return { prds: [], activityData: [] }
+      return {
+        prds: [],
+        activityData: [],
+        stats: { prdCount: 0, completedToday: 0, unreadComments: 0, installedApps: 0 },
+        recentActivities: [],
+      }
     }
   },
 })

package/src/routes/_nav/projects/$projectId/settings/route.lazy.tsx

@@ -59,12 +59,17 @@ function ProjectSettingsPage() {
   const [displayIdError, setDisplayIdError] = useState("");
   const [useCustomTz, setUseCustomTz] = useState(!!project.timezone);
   const [projectTimezone, setProjectTimezone] = useState(project.timezone ?? "");
+  // S17（裁决：独立保存）：时区卡片拆出独立保存——与基本信息卡「保存更改」
+  // 解耦，脏检查（与 server 权威值比对）控制按钮可用性，保存即时落库
+  const [savingTz, setSavingTz] = useState(false);
   const [saving, setSaving] = useState(false);
   const [deleteOpen, setDeleteOpen] = useState(false);
   const [kbChecked, setKbChecked] = useState<Set<string>>(() => new Set(linkedKbIds));
   const [savingKbs, setSavingKbs] = useState(false);
   const [deleteMode, setDeleteMode] = useState<"transfer" | "clear">("transfer");
   const userTimezone = useTimezone();
+  // S17：时区脏检查（与 server 权威值比对；按钮仅变化时可用）
+  const tzUnchanged = (useCustomTz ? projectTimezone : null) === project.timezone;
 
   useEffect(() => {
     setIcon(project.icon);
@@ -96,7 +101,6 @@ function ProjectSettingsPage() {
           icon,
           description: description.trim() || null,
           displayId: displayId.toUpperCase(),
-          timezone: useCustomTz ? projectTimezone : null,
         },
       });
       toast.success(m.projects_settings_saved());
@@ -109,6 +113,25 @@ function ProjectSettingsPage() {
     }
   };
 
+  // S17：时区独立保存（不再搭车基本信息卡）
+  const handleSaveTimezone = async () => {
+    setSavingTz(true);
+    try {
+      await updateProjectFn({
+        data: {
+          projectId: project.id,
+          timezone: useCustomTz ? projectTimezone : null,
+        },
+      });
+      toast.success(m.projects_settings_saved());
+      await router.invalidate();
+    } catch (err) {
+      toastError(err, m.projects_settings_saveFailed());
+    } finally {
+      setSavingTz(false);
+    }
+  };
+
   const saveKbs = async () => {
     setSavingKbs(true);
     try {
@@ -246,6 +269,17 @@ function ProjectSettingsPage() {
                   )}
                 </div>
               </RadioGroup>
+              <div>
+                <Button
+                  size="sm"
+                  variant="outline"
+                  onClick={handleSaveTimezone}
+                  disabled={savingTz || tzUnchanged}
+                >
+                  {savingTz ? <Loader2 className="mr-1 size-3.5 animate-spin" /> : null}
+                  {m.common_button_save()}
+                </Button>
+              </div>
             </CardContent>
           </Card>
         )}

package/src/routes/_nav/stories/$storyId/route.tsx

@@ -74,7 +74,7 @@ export const Route = createFileRoute("/_nav/stories/$storyId")({
       listActivitiesFn({ data: { storyId: params.storyId, take: 50 } }),
       getStoryNeighborsFn({ data: { storyId: params.storyId } }),
       listProjectsBriefFn(),
-      listLabelsFn(),
+      listLabelsFn({ data: { projectId: story.projectId ?? undefined } }),
       listStoriesFn({ data: { archived: false, take: RELATED_STORIES_TAKE } }),
       listChildStoriesFn({ data: { parentId: params.storyId } }),
       getDependenciesFn({ data: { storyId: params.storyId } }),

package/src/routes/_nav/stories/index.tsx

@@ -24,7 +24,7 @@ export const Route = createFileRoute("/_nav/stories/")({
     const [stories, users, labels, projects] = await Promise.all([
       listStoriesFn({ data: {} }),
       listUsersBriefFn(),
-      listLabelsFn(),
+      listLabelsFn({ data: {} }),
       listProjectsBriefFn(),
     ]);
     return { stories, users, labels, projects };

package/src/routes/api/billing-webhook.ts

@@ -39,7 +39,7 @@ export const Route = createFileRoute('/api/billing-webhook')({
         }
         try {
           await billing.handleWebhookEvent(rawBody, signature)
-          await sendBillingEmailForEvent(rawBody)
+          await sendBillingEmailForEvent(rawBody, signature, billing)
           return new Response(JSON.stringify({ received: true }), {
             status: 200,
             headers: { 'Content-Type': 'application/json' },

package/src/server/__tests__/resources.agents.test.ts

@@ -18,6 +18,8 @@ vi.mock('@allbluecn/database', () => ({
     aiUsageLog: { count: vi.fn().mockResolvedValue(0), aggregate: vi.fn().mockResolvedValue({ _sum: { durationMs: null } }) },
     userAgent: { count: vi.fn().mockResolvedValue(0) },
     userSkill: { count: vi.fn().mockResolvedValue(0) },
+    anyHubApp: { count: vi.fn().mockResolvedValue(0) },
+    blob: { aggregate: vi.fn().mockResolvedValue({ _sum: { size: null } }) },
     generationRun: { count: vi.fn().mockResolvedValue(0) },
     subscription: { findUnique: vi.fn() },
     plan: { findUnique: vi.fn(), findFirst: vi.fn() },

package/src/server/__tests__/resources.license.test.ts

@@ -28,6 +28,8 @@ vi.mock('@allbluecn/database', () => ({
     aiUsageLog: { count: vi.fn().mockResolvedValue(0), aggregate: vi.fn().mockResolvedValue({ _sum: { durationMs: null } }) },
     userAgent: { count: vi.fn().mockResolvedValue(0) },
     userSkill: { count: vi.fn().mockResolvedValue(0) },
+    anyHubApp: { count: vi.fn().mockResolvedValue(0) },
+    blob: { aggregate: vi.fn().mockResolvedValue({ _sum: { size: null } }) },
     generationRun: { count: vi.fn().mockResolvedValue(0) },
     subscription: { findUnique: vi.fn() },
     plan: { findUnique: vi.fn(), findFirst: vi.fn() },

package/src/server/__tests__/resources.team-seats.test.ts

@@ -10,6 +10,8 @@ vi.mock('@allbluecn/database', () => ({
     aiUsageLog: { count: vi.fn() },
     userAgent: { count: vi.fn() },
     userSkill: { count: vi.fn() },
+    anyHubApp: { count: vi.fn().mockResolvedValue(0) },
+    blob: { aggregate: vi.fn().mockResolvedValue({ _sum: { size: null } }) },
   },
 }))
 vi.mock('@/server/auth-helpers', () => ({ requireAuth: vi.fn() }))

package/src/server/__tests__/resources.test.ts

@@ -39,6 +39,8 @@ vi.mock('@allbluecn/database', () => ({
     aiUsageLog: { count: vi.fn(), aggregate: vi.fn().mockResolvedValue({ _sum: { durationMs: null } }) },
     userAgent: { count: vi.fn().mockResolvedValue(0) },
     userSkill: { count: vi.fn().mockResolvedValue(0) },
+    anyHubApp: { count: vi.fn().mockResolvedValue(0) },
+    blob: { aggregate: vi.fn().mockResolvedValue({ _sum: { size: null } }) },
     generationRun: { count: vi.fn().mockResolvedValue(0) },
   },
 }))

package/src/server/ai-gateway/__tests__/pgvector-memory-adapter.test.ts

@@ -101,6 +101,22 @@ afterEach(() => {
   vi.restoreAllMocks()
 })
 
+describe("S25：per-user 记忆事实上限窗口", () => {
+  it("save 成功后执行裁剪 DELETE（保留最近 200 条，淘汰最旧）", async () => {
+    mocks.queryRaw.mockResolvedValue({ rows: [{ embedding: "[1,2,3]" }] })
+    mocks.executeRaw.mockResolvedValue(undefined)
+    const adapter = makeAdapter({ now: () => new Date("2026-01-01T00:00:00Z").toISOString() })
+    await adapter.save(
+      { userId: "u1", threadId: "t1" },
+      { user: "u".repeat(30), assistant: "a" },
+    )
+    const calls = mocks.executeRaw.mock.calls.map((c) => String(c[0]))
+    expect(calls.length).toBe(2)
+    expect(calls[1]).toContain("DELETE FROM \"memory_facts\"")
+    expect(calls[1]).toContain("LIMIT")
+  })
+})
+
 describe("pgvector MemoryAdapter.save", () => {
   it("持久化 turn（embedding + 原文）并返回 ok 与 latencyMs", async () => {
     advanceNowBy(25)

package/src/server/ai-gateway/memory/pgvector-adapter.ts

@@ -85,6 +85,8 @@ export function createPgVectorMemoryAdapter(
   options: PgVectorMemoryAdapterOptions = {},
 ): MemoryAdapter {
   const minUserChars = options.minUserChars ?? DEFAULT_MIN_USER_CHARS
+// S25：per-user 记忆事实上限（超限淘汰最旧）
+const MEMORY_FACTS_USER_CAP = 200
   const candidateLimit = options.recallCandidateLimit ?? DEFAULT_RECALL_CANDIDATE_LIMIT
   const topK = options.recallTopK ?? DEFAULT_RECALL_TOP_K
   const similarityThreshold =
@@ -180,6 +182,18 @@ export function createPgVectorMemoryAdapter(
         await prisma.$executeRaw`
           INSERT INTO "memory_facts" ("id", "userId", "threadId", "content", "embedding")
           VALUES (${id}, ${scope.userId}, ${scope.threadId}, ${content}, ${formatVector(embedding)}::vector)`
+        // S25（裁决：按高收益方向）：per-user 上限窗口——超限淘汰最旧，防无限
+        // 增长；相似度去重复杂度不成比例，不做。上限写死 200（长期记忆召回
+        // 取 TOP-K 远小于此，裁剪只影响被淘汰的最旧事实）。
+        await prisma.$executeRaw`
+          DELETE FROM "memory_facts"
+          WHERE "userId" = ${scope.userId}
+            AND "id" NOT IN (
+              SELECT "id" FROM "memory_facts"
+              WHERE "userId" = ${scope.userId}
+              ORDER BY "createdAt" DESC
+              LIMIT ${MEMORY_FACTS_USER_CAP}
+            )`
         return [
           {
             ok: true,

package/src/server/ai-gateway/storage/__tests__/blob-store.test.ts

@@ -17,6 +17,10 @@ vi.mock("@allbluecn/database", () => ({
   },
 }))
 
+vi.mock("@/server/resources", () => ({
+  requireResourceForUser: vi.fn().mockResolvedValue(undefined),
+}))
+
 describe("DbBlobStore", () => {
   beforeEach(() => {
     vi.clearAllMocks()

package/src/server/ai-gateway/storage/db-blob-store.ts

@@ -1,4 +1,5 @@
 import { prisma } from "@allbluecn/database"
+import { requireResourceForUser } from "@/server/resources"
 import type { BlobRef, BlobStore } from "./blob-store"
 
 /**
@@ -19,6 +20,9 @@ export class DbBlobStore implements BlobStore {
     if (size === 0 || size > MAX_BLOB_BYTES) {
       throw new Error(`blob size ${size} exceeds limit ${MAX_BLOB_BYTES}`)
     }
+    // S6：blob 存储配额预检（存储汇点覆盖全部上传路径；TOCTOU 统计性预检同
+    // requireResource 口径）。1MB=1MiB，向上取整。
+    await requireResourceForUser(userId, 'blobStorageMb', Math.ceil(size / (1024 * 1024)))
     const record = await prisma.blob.create({
       data: { mimeType, bytes: Uint8Array.from(blob), size, userId },
     })

package/src/server/billing-email.ts

@@ -1,7 +1,7 @@
-// 计费 webhook 邮件链路：上游 routes/api/billing-webhook.ts 必须先经
-// getProService('billing').handleWebhookEvent(rawBody, signature) 完成 Creem
-// 签名校验（WebhookSignatureError → 400）后才调用本函数——本模块信任该前置，
-// 不重复验签。OSS 无 billing 服务时上游同 gate 拦截，本函数不会被触达。
+// 计费 webhook 邮件链路。S43（裁决落地）：不再单靠「上游 handleWebhookEvent
+// 已验签」的顺序契约——本函数在 JSON.parse 前调用 billing 服务暴露的
+// verifyWebhookSignatureRaw 独立验签（Pro 实现；OSS 无 billing 时上游 gate
+// 已 501 拦截，本函数不会被触达）。上游双重验签成本为一次 HMAC，可忽略。
 import { prisma } from '@allbluecn/database'
 import { sendTemplateEmail } from '@/server/email'
 
@@ -11,8 +11,21 @@ interface CreemEvent {
   object?: { id?: string; subscriptionId?: string; metadata?: Record<string, string> }
 }
 
-export async function sendBillingEmailForEvent(rawBody: string): Promise<void> {
+export async function sendBillingEmailForEvent(
+  rawBody: string,
+  signature?: string,
+  billing?: {
+    verifyWebhookSignatureRaw?(rawBody: string, signature: string): Promise<unknown>
+  },
+): Promise<void> {
   try {
+    // S43：独立验签优先——Pro 端未实现（旧 Pro 包）时回退顺序契约并留证
+    if (billing?.verifyWebhookSignatureRaw) {
+      if (!signature) throw new Error('缺少 creem-signature（邮件链路独立验签）')
+      await billing.verifyWebhookSignatureRaw(rawBody, signature)
+    } else {
+      console.warn('[billing-email] billing 服务未暴露独立验签，回退上游顺序契约')
+    }
     const evt = JSON.parse(rawBody) as CreemEvent
     // 官方路径 `object.id`；保留 `object.subscriptionId` fallback 兜底旧版/非标准 payload。
     const subId = evt.object?.id ?? evt.object?.subscriptionId

package/src/server/bug/bug-crud-helpers.ts

@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// S2（裁决：纯机械拆分）：bug-crud.ts 的纯 helper 子流程迁此——主文件只留
+// serverFn 定义。import 自兄弟文件，测试经 bug-crud re-export 零改动。
+
+import { getPrisma } from "@allbluecn/database/get-prisma";
+import type { AvatarConfig } from "@allbluecn/kernel";
+import { isUserInTeam } from "@/server/team-access";
+
+export async function validateBugAssignee(projectId: string, assigneeId: string | null | undefined) {
+  if (!assigneeId) return;
+  const prisma = await getPrisma();
+  const project = await prisma.project.findUnique({
+    where: { id: projectId },
+    select: { ownerId: true },
+  });
+  if (!project) throw new Error("项目不存在");
+  const ok = await isUserInTeam(project.ownerId, assigneeId);
+  if (!ok) throw new Error("负责人必须是团队成员");
+}
+
+// 批量写路径的成员圈定（R6）：与 deleteBugFn 同口径——目标 bugs 所属每个项目
+// 都须有当前用户的有效成员关系（status 非 suspended），任一无权即整体拒绝。
+// 判定在事务前完成，防止批量入口绕过单删的权限语义。
+export async function assertBugsInMemberProjects(bugIds: string[], userId: string) {
+  const prisma = await getPrisma();
+  const rows = await prisma.bug.findMany({
+    where: { id: { in: bugIds } },
+    select: { projectId: true },
+  });
+  const projectIds = [...new Set(rows.map((r) => r.projectId))];
+  if (projectIds.length === 0) return;
+  const memberships = await prisma.projectMember.findMany({
+    where: { userId, projectId: { in: projectIds }, status: { not: "suspended" } },
+    select: { projectId: true },
+  });
+  const allowed = new Set(memberships.map((m) => m.projectId));
+  if (projectIds.some((p) => !allowed.has(p))) {
+    throw new Error("无权限操作该项目的 BUG");
+  }
+}
+
+export function toBugActivityItem(a: {
+  id: string;
+  action: string;
+  field: string | null;
+  oldValue: string | null;
+  newValue: string | null;
+  isAI: boolean;
+  createdAt: Date;
+  user: {
+    id: string;
+    username: string;
+    email: string;
+    avatarConfig: unknown;
+    bgShape: string | null;
+    bgColor: string | null;
+  } | null;
+}) {
+  return {
+    id: a.id,
+    action: a.action,
+    field: a.field,
+    oldValue: a.oldValue,
+    newValue: a.newValue,
+    isAI: a.isAI,
+    createdAt: a.createdAt.toISOString(),
+    user: a.user
+      ? { ...a.user, avatarConfig: (a.user.avatarConfig as AvatarConfig | null) ?? null }
+      : null,
+  };
+}
+
+/**
+ * Bug.description（Text 列 JSON 串）→ {html, markdown} 门卫 content。
+ * 与 components/story/types.ts parseStoryDescription 读取口径同构的镜像
+ * （服务端不 import 组件模块）；历史裸串兜底为双轨原串。Bug.description 与
+ * Story.description 存储同构（schema 注释），S12 裁决 UI 本期不接协同编辑，
+ * 但旁路写（创建对话框等）仍须经理卫转发防互吞。
+ */
+export function bugDescriptionToContent(description: string): { html: string; markdown: string } {
+  try {
+    const parsed = JSON.parse(description) as { html?: unknown; markdown?: unknown };
+    if (typeof parsed.html === "string") {
+      const markdown = typeof parsed.markdown === "string" ? parsed.markdown : parsed.html;
+      return { html: parsed.html, markdown };
+    }
+  } catch {
+    // 历史裸串兜底
+  }
+  return { html: description, markdown: description };
+}

package/src/server/knowledge/knowledge-helpers.ts

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// S2（纯机械拆分）：knowledge.ts 纯 helper 迁 server 树兄弟文件
+//（serverFns 树外，纯净性口径②）。
+
+// 文档 content/properties 的 JSON 体积上限（updateDocumentFn schema refine 消费）
+export const MAX_DOC_CONTENT_JSON_CHARS = 2_000_000
+export const MAX_DOC_PROPERTIES_JSON_CHARS = 256_000
+
+
+export function jsonSizeOk(value: unknown, max: number): boolean {
+  if (value === undefined || value === null) return true
+  try {
+    return JSON.stringify(value).length <= max
+  } catch {
+    return false
+  }
+}
+
+/** 嵌入行 id 约定为 `${documentId}-${chunkIndex}`（knowledge-index-utils
+ * indexDocumentEmbeddings 写入），chunkIndex 可为多位数字，取最后一个 "-" 前缀。 */
+export function documentIdFromEmbeddingRowId(rowId: string): string {
+  const cut = rowId.lastIndexOf('-')
+  return cut > 0 ? rowId.slice(0, cut) : rowId
+}