@allbluecn/web-app 0.4.21 → 0.5.0

package/src/server/serverFns/__tests__/team-invitation.test.ts

@@ -40,8 +40,9 @@ vi.mock('@allbluecn/database', () => ({
       update: vi.fn(),
       count: vi.fn(),
       deleteMany: vi.fn(),
+      delete: vi.fn(),
     },
-    teamJoinRequest: { updateMany: vi.fn(), findMany: vi.fn() },
+    teamJoinRequest: { updateMany: vi.fn(), findMany: vi.fn(), findUnique: vi.fn(), delete: vi.fn() },
     $transaction: vi.fn(),
   },
 }))
@@ -68,16 +69,18 @@ import {
   refreshTeamInvitationLinkFn,
   listTeamInvitationsFn,
   clearExpiredInvitationsFn,
+  deleteTeamInvitationFn,
+  deleteTeamJoinRequestFn,
 } from '../team'
 
 describe('refreshTeamInvitationLinkFn', () => {
   beforeEach(() => vi.clearAllMocks())
 
-  it('生成新链接，删除旧链接', async () => {
+  it('生成新链接，旧链接置 revoked 保留申请历史', async () => {
     vi.mocked(prisma.$transaction).mockImplementation(async (fn: any) => {
       const tx = {
         teamInvitation: {
-          deleteMany: vi.fn().mockResolvedValue({}),
+          updateMany: vi.fn().mockResolvedValue({}),
           create: vi.fn().mockResolvedValue({ id: 'inv-new', token: 'abc123' }),
         },
         teamJoinRequest: {
@@ -97,7 +100,7 @@ describe('refreshTeamInvitationLinkFn', () => {
     vi.mocked(prisma.$transaction).mockImplementation(async (fn: any) => {
       const tx = {
         teamInvitation: {
-          deleteMany: vi.fn().mockResolvedValue({}),
+          updateMany: vi.fn().mockResolvedValue({}),
           create: vi.fn().mockResolvedValue({ id: 'inv-new', token: 'xyz' }),
         },
         teamJoinRequest: {
@@ -114,7 +117,7 @@ describe('refreshTeamInvitationLinkFn', () => {
     vi.mocked(prisma.$transaction).mockImplementation(async (fn: any) => {
       const tx = {
         teamInvitation: {
-          deleteMany: vi.fn().mockResolvedValue({}),
+          updateMany: vi.fn().mockResolvedValue({}),
           create: vi.fn().mockResolvedValue({ id: 'inv-new', token: 'tok' }),
         },
         teamJoinRequest: {
@@ -199,15 +202,78 @@ describe('createTeamInvitationFn link 邀请', () => {
 describe('clearExpiredInvitationsFn', () => {
   beforeEach(() => vi.clearAllMocks())
 
-  it('清除所有过期邀请', async () => {
+  it('清除所有过期邮箱邀请（链接行保留以维持申请历史）', async () => {
     vi.mocked(prisma.teamInvitation.deleteMany).mockResolvedValue({ count: 2 } as never)
     const result = await clearExpiredInvitationsFn({ data: {} })
     expect(result.success).toBe(true)
     expect(result.count).toBe(2)
     expect(prisma.teamInvitation.deleteMany).toHaveBeenCalledWith(
       expect.objectContaining({
-        where: expect.objectContaining({ status: 'expired' }),
+        where: expect.objectContaining({ status: 'expired', channel: 'email' }),
       }),
     )
   })
 })
+
+describe('deleteTeamInvitationFn', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it('删除自己的 email 邀请记录', async () => {
+    vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue({
+      id: 'inv1', ownerId: 'owner1', channel: 'email', email: 'x@y.com',
+    } as never)
+    vi.mocked(prisma.teamInvitation.delete).mockResolvedValue({} as never)
+
+    const result = await deleteTeamInvitationFn({ data: { invitationId: 'inv1' } })
+
+    expect(result.success).toBe(true)
+    expect(prisma.teamInvitation.delete).toHaveBeenCalledWith({ where: { id: 'inv1' } })
+  })
+
+  it('link 渠道邀请禁止删除（防级联删申请）', async () => {
+    vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue({
+      id: 'inv2', ownerId: 'owner1', channel: 'link',
+    } as never)
+
+    await expect(
+      deleteTeamInvitationFn({ data: { invitationId: 'inv2' } }),
+    ).rejects.toMatchObject({ message: expect.stringContaining('不可删除') })
+    expect(prisma.teamInvitation.delete).not.toHaveBeenCalled()
+  })
+
+  it('他人邀请不可删除', async () => {
+    vi.mocked(prisma.teamInvitation.findUnique).mockResolvedValue({
+      id: 'inv3', ownerId: 'someone-else', channel: 'email',
+    } as never)
+
+    await expect(
+      deleteTeamInvitationFn({ data: { invitationId: 'inv3' } }),
+    ).rejects.toMatchObject({ message: '邀请不存在' })
+    expect(prisma.teamInvitation.delete).not.toHaveBeenCalled()
+  })
+})
+
+describe('deleteTeamJoinRequestFn', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it('删除自己的申请记录', async () => {
+    vi.mocked(prisma.teamJoinRequest.findUnique).mockResolvedValue({
+      id: 'jr1', ownerId: 'owner1', email: 'a@b.com', status: 'rejected',
+    } as never)
+    vi.mocked(prisma.teamJoinRequest.delete).mockResolvedValue({} as never)
+
+    const result = await deleteTeamJoinRequestFn({ data: { requestId: 'jr1' } })
+
+    expect(result.success).toBe(true)
+    expect(prisma.teamJoinRequest.delete).toHaveBeenCalledWith({ where: { id: 'jr1' } })
+  })
+
+  it('他人申请不可删除', async () => {
+    vi.mocked(prisma.teamJoinRequest.findUnique).mockResolvedValue(null as never)
+
+    await expect(
+      deleteTeamJoinRequestFn({ data: { requestId: 'jrX' } }),
+    ).rejects.toMatchObject({ message: '申请不存在' })
+    expect(prisma.teamJoinRequest.delete).not.toHaveBeenCalled()
+  })
+})

package/src/server/serverFns/__tests__/team-join-request.test.ts

@@ -246,9 +246,9 @@ describe('getTeamInvitationByTokenFn（link 渠道）', () => {
 describe('refreshTeamInvitationLinkFn', () => {
   beforeEach(() => vi.clearAllMocks())
 
-  it('刷新 → 旧链接 pending 申请全部 invalidated，旧链接删除，新链接创建', async () => {
+  it('刷新 → 旧链接 pending 申请全部 invalidated，旧链接置 revoked 保留历史，新链接创建', async () => {
     vi.mocked(prisma.teamJoinRequest.updateMany).mockResolvedValue({ count: 1 } as never)
-    vi.mocked(prisma.teamInvitation.deleteMany).mockResolvedValue({ count: 1 } as never)
+    vi.mocked(prisma.teamInvitation.updateMany).mockResolvedValue({ count: 1 } as never)
     vi.mocked(prisma.teamInvitation.create).mockResolvedValue({ id: 'inv2', token: 'NEW' } as never)
 
     const res = await refreshTeamInvitationLinkFn({ data: { expiresInDays: 7 } })
@@ -258,9 +258,11 @@ describe('refreshTeamInvitationLinkFn', () => {
       where: expect.objectContaining({ ownerId: 'u2', status: 'pending' }),
       data: expect.objectContaining({ status: 'invalidated' }),
     }))
-    expect(prisma.teamInvitation.deleteMany).toHaveBeenCalledWith(expect.objectContaining({
+    expect(prisma.teamInvitation.updateMany).toHaveBeenCalledWith(expect.objectContaining({
       where: { ownerId: 'u2', channel: 'link', status: { in: ['pending', 'pending_approval'] } },
+      data: { status: 'revoked' },
     }))
+    expect(prisma.teamInvitation.deleteMany).not.toHaveBeenCalled()
     expect(prisma.teamInvitation.create).toHaveBeenCalled()
   })
 })

package/src/server/serverFns/knowledge-index-utils.ts

@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { prisma } from "@allbluecn/database"
+import { generateEmbedding, chunkText, resolveDefaultProviderConfig } from "@allbluecn/ai-gateway"
+import { insertEmbedding, deleteEmbeddings } from "@/lib/pgvector"
+
+export const KB_EMBEDDINGS_TABLE = "knowledge_embeddings"
+const OPENROUTER_BASE_URL = "https://openrouter.ai/api/v1"
+const PLACEHOLDER_KEYS = new Set(["sk-your-api-key-here", "", "sk-or-your-api-key-here"])
+
+// embeddings 走 OpenAI 兼容的 /embeddings 端点，仅这两个 adapterKind 可用；
+// 其余（anthropic/gemini/groq/grok/ollama）无兼容路径，回落到 env 兜底。
+const EMBEDDING_CAPABLE_ADAPTERS = new Set(["openai", "openrouter"])
+
+export function extractText(content: unknown): string {
+  if (!content || typeof content !== "object") return ""
+  const obj = content as Record<string, unknown>
+  if (typeof obj.markdown === "string" && obj.markdown) return obj.markdown
+  if (typeof obj.html === "string" && obj.html) return obj.html.replace(/<[^>]*>/g, "")
+  return ""
+}
+
+export async function resolveAiConfig(kbId: string): Promise<{ apiKey?: string; baseUrl?: string }> {
+  const kb = await prisma.knowledgeBase.findUnique({
+    where: { id: kbId },
+    select: { userId: true },
+  })
+  if (!kb) return {}
+
+  // 新表优先：用户在 /settings/ai 配置的 key（AiProviderConfig.apiKey 加密存储，
+  // resolveDefaultProviderConfig 内部已解密）。旧实现只读 User.aiApiKey，
+  // 只配了新表的用户重索引必然报 "not configured"。
+  const cfg = await resolveDefaultProviderConfig(kb.userId)
+  if (cfg && EMBEDDING_CAPABLE_ADAPTERS.has(cfg.adapterKind)) {
+    const provider = await prisma.aiProvider.findUnique({
+      where: { providerId: cfg.providerId },
+      select: { defaultBaseUrl: true },
+    })
+    const baseUrl = cfg.baseUrl || provider?.defaultBaseUrl
+    // resolveDefaultProviderConfig 已跳过空 apiKey，此处 ?? undefined 仅作类型窄化
+    return { apiKey: cfg.apiKey ?? undefined, baseUrl: baseUrl ?? undefined }
+  }
+
+  // 旧字段兜底（迁移期）
+  const user = await prisma.user.findUnique({
+    where: { id: kb.userId },
+    select: { aiApiKey: true, aiProvider: true },
+  })
+  if (!user || !user.aiApiKey || PLACEHOLDER_KEYS.has(user.aiApiKey)) return {}
+
+  const result: { apiKey: string; baseUrl?: string } = { apiKey: user.aiApiKey }
+  if (user.aiProvider === "openrouter") {
+    result.baseUrl = OPENROUTER_BASE_URL
+  }
+  return result
+}
+
+export async function indexDocumentEmbeddings(
+  doc: { id: string; kbId: string; title: string; content: unknown },
+  aiOpts?: { apiKey?: string; baseUrl?: string }
+): Promise<number> {
+  const text = extractText(doc.content) || doc.title
+  if (!text) return 0
+
+  const chunks = chunkText(text)
+  await deleteEmbeddings(KB_EMBEDDINGS_TABLE, "documentId", doc.id)
+
+  for (let i = 0; i < chunks.length; i++) {
+    const embedding = await generateEmbedding(chunks[i], aiOpts)
+    await insertEmbedding(KB_EMBEDDINGS_TABLE, `${doc.id}-${i}`, chunks[i], embedding, {
+      kbId: doc.kbId,
+      documentId: doc.id,
+      chunkIndex: i,
+    })
+  }
+
+  return chunks.length
+}
+
+export async function indexDocumentById(documentId: string): Promise<number> {
+  const doc = await prisma.knowledgeDocument.findUnique({
+    where: { id: documentId },
+    select: { id: true, kbId: true, title: true, content: true },
+  })
+  if (!doc) return 0
+
+  const aiConfig = await resolveAiConfig(doc.kbId)
+  return indexDocumentEmbeddings(doc, aiConfig)
+}

package/src/server/serverFns/knowledge-index.ts

@@ -20,73 +20,12 @@ import { getRequest } from "@tanstack/react-start/server"
 import { z } from "zod"
 import { prisma } from "@allbluecn/database"
 import { requireAuth } from "@/server/auth-helpers"
-import { generateEmbedding, chunkText } from "@allbluecn/ai-gateway"
-import { insertEmbedding, deleteEmbeddings } from "@/lib/pgvector"
-
-const KB_EMBEDDINGS_TABLE = "knowledge_embeddings"
-const OPENROUTER_BASE_URL = "https://openrouter.ai/api/v1"
-const PLACEHOLDER_KEYS = new Set(["sk-your-api-key-here", "", "sk-or-your-api-key-here"])
-
-export function extractText(content: unknown): string {
-  if (!content || typeof content !== "object") return ""
-  const obj = content as Record<string, unknown>
-  if (typeof obj.markdown === "string" && obj.markdown) return obj.markdown
-  if (typeof obj.html === "string" && obj.html) return obj.html.replace(/<[^>]*>/g, "")
-  return ""
-}
-
-export async function resolveAiConfig(kbId: string): Promise<{ apiKey?: string; baseUrl?: string }> {
-  const kb = await prisma.knowledgeBase.findUnique({
-    where: { id: kbId },
-    select: { userId: true },
-  })
-  if (!kb) return {}
-
-  const user = await prisma.user.findUnique({
-    where: { id: kb.userId },
-    select: { aiApiKey: true, aiProvider: true },
-  })
-  if (!user || !user.aiApiKey || PLACEHOLDER_KEYS.has(user.aiApiKey)) return {}
-
-  const result: { apiKey: string; baseUrl?: string } = { apiKey: user.aiApiKey }
-  if (user.aiProvider === "openrouter") {
-    result.baseUrl = OPENROUTER_BASE_URL
-  }
-  return result
-}
-
-export async function indexDocumentEmbeddings(
-  doc: { id: string; kbId: string; title: string; content: unknown },
-  aiOpts?: { apiKey?: string; baseUrl?: string }
-): Promise<number> {
-  const text = extractText(doc.content) || doc.title
-  if (!text) return 0
-
-  const chunks = chunkText(text)
-  await deleteEmbeddings(KB_EMBEDDINGS_TABLE, "documentId", doc.id)
-
-  for (let i = 0; i < chunks.length; i++) {
-    const embedding = await generateEmbedding(chunks[i], aiOpts)
-    await insertEmbedding(KB_EMBEDDINGS_TABLE, `${doc.id}-${i}`, chunks[i], embedding, {
-      kbId: doc.kbId,
-      documentId: doc.id,
-      chunkIndex: i,
-    })
-  }
-
-  return chunks.length
-}
-
-export async function indexDocumentById(documentId: string): Promise<number> {
-  const doc = await prisma.knowledgeDocument.findUnique({
-    where: { id: documentId },
-    select: { id: true, kbId: true, title: true, content: true },
-  })
-  if (!doc) return 0
-
-  const aiConfig = await resolveAiConfig(doc.kbId)
-  return indexDocumentEmbeddings(doc, aiConfig)
-}
+import { deleteEmbeddings } from "@/lib/pgvector"
+import {
+  KB_EMBEDDINGS_TABLE,
+  indexDocumentEmbeddings,
+  resolveAiConfig,
+} from "./knowledge-index-utils"
 
 export const indexKnowledgeDocumentFn = createServerFn({ method: "POST" })
   .validator(z.object({ documentId: z.string() }))

package/src/server/serverFns/knowledge.ts

@@ -20,7 +20,7 @@ import { getRequest } from '@tanstack/react-start/server'
 import { z } from 'zod'
 import { prisma } from '@allbluecn/database'
 import { requireAuth } from '@/server/auth-helpers'
-import { indexDocumentById } from '@/server/serverFns/knowledge-index'
+import { indexDocumentById } from '@/server/serverFns/knowledge-index-utils'
 import { deleteEmbeddings } from '@/lib/pgvector'
 import { requirePermission } from '@/server/permissions'
 import { auditLog } from '@/server/audit'
@@ -306,7 +306,13 @@ export const updateDocumentFn = createServerFn({ method: 'POST' })
     })
 
     if (data.content !== undefined) {
-      indexDocumentById(data.id).catch(() => {})
+      // fire-and-forget：索引失败不阻塞文档保存，但不能静默——
+      // 否则无 AI key / 端点错误时知识库检索悄悄失效且无从排查。
+      indexDocumentById(data.id).catch((e) => {
+        console.warn(
+          `知识库向量索引失败 documentId=${data.id}: ${e instanceof Error ? e.message : String(e)}`,
+        )
+      })
     }
 
     await auditLog({ workspaceId: '', userId, resourceType: 'document', resourceId: data.id, action: 'document.update' })

package/src/server/serverFns/locale.ts

@@ -1,8 +1,20 @@
 import { createServerFn } from '@tanstack/react-start'
-import { getRequest } from '@tanstack/react-start/server'
+import { getRequest, setCookie } from '@tanstack/react-start/server'
 import { detectLocale } from '@/lib/i18n/detect'
 
+/**
+ * 检测用户语言并固化为 lng cookie：
+ * 首次访问（无 cookie）时，SSR 依据 querystring/accept-language 检测出的语言
+ * 写入 cookie，保证客户端 i18n（仅读 querystring/cookie）与服务端同源一致，
+ * 避免 hydration mismatch。
+ */
 export const getLocaleFn = createServerFn({ method: 'GET' }).handler(async () => {
   const request = getRequest()
-  return detectLocale(request, null)
-})
+  const locale = detectLocale(request, null)
+  setCookie('lng', locale, {
+    path: '/',
+    maxAge: 60 * 60 * 24 * 365,
+    sameSite: 'lax',
+  })
+  return locale
+})

package/src/server/serverFns/notifications.ts

@@ -6,10 +6,11 @@ import { prisma } from '@allbluecn/database'
 import { requireAuth } from '@/server/auth-helpers'
 import {
   NOTIFICATION_CATEGORIES,
+  NOTIFICATION_FREQUENCIES,
   type NotificationCategory,
-  type CategoryPreferences,
   type NotificationItem,
   type NotificationListResult,
+  type CategoryFrequencies,
 } from '@allbluecn/shared'
 import {
   getOrCreatePreferences,
@@ -96,6 +97,16 @@ export const deleteNotificationFn = createServerFn({ method: 'POST' })
     return { success: true }
   })
 
+export const clearNotificationsFn = createServerFn({ method: 'POST' })
+  .validator(z.object({}).optional())
+  .handler(async () => {
+    const request = getRequest()
+    const session = await requireAuth(request)
+    const userId = session.user!.id!
+    const result = await prisma.notification.deleteMany({ where: { userId } })
+    return { success: true, count: result.count }
+  })
+
 export const getUnreadCountFn = createServerFn({ method: 'GET' })
   .validator(z.object({}).optional())
   .handler(async () => {
@@ -117,7 +128,7 @@ export const getNotificationPreferencesFn = createServerFn({ method: 'GET' })
   })
 
 const preferencesSchema = z.object({
-  categories: z.record(z.string(), z.boolean()),
+  categories: z.record(z.string(), z.enum(NOTIFICATION_FREQUENCIES)),
   dndEnabled: z.boolean(),
   dndStart: z.string().regex(/^\d{2}:\d{2}$/),
   dndEnd: z.string().regex(/^\d{2}:\d{2}$/),
@@ -131,9 +142,12 @@ export const updateNotificationPreferencesFn = createServerFn({
     const request = getRequest()
     const session = await requireAuth(request)
     const userId = session.user!.id!
-    const categories = { ...DEFAULT_CATEGORIES } as CategoryPreferences
+    const categories = { ...DEFAULT_CATEGORIES } as CategoryFrequencies
     for (const c of NOTIFICATION_CATEGORIES) {
-      if (typeof data.categories[c] === 'boolean') categories[c] = data.categories[c]
+      const v = data.categories[c]
+      if ((NOTIFICATION_FREQUENCIES as readonly string[]).includes(v)) {
+        categories[c] = v as CategoryFrequencies[NotificationCategory]
+      }
     }
     await prisma.notificationPreference.upsert({
       where: { userId },

package/src/server/serverFns/story/__tests__/story-dependencies.test.ts

@@ -0,0 +1,239 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: (config: any) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema;
+        return this;
+      },
+      handler(fn: Function) {
+        const wrapped = async (args: any) => {
+          let data = args?.data;
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse ? this._validator.parse(data) : data;
+          }
+          return fn({ data });
+        };
+        return wrapped;
+      },
+    };
+    return api;
+  },
+}));
+
+vi.mock("@tanstack/react-start/server", () => ({
+  getRequest: () => ({}),
+}));
+
+const mocks = vi.hoisted(() => ({
+  depFindMany: vi.fn(),
+  depFindFirst: vi.fn(),
+  depCreate: vi.fn(),
+  depDelete: vi.fn(),
+  storyFindMany: vi.fn(),
+  currentSession: vi.fn(),
+}));
+
+vi.mock("@allbluecn/database", () => {
+  const prisma = {
+    storyDependency: {
+      findMany: mocks.depFindMany,
+      findFirst: mocks.depFindFirst,
+      create: mocks.depCreate,
+      delete: mocks.depDelete,
+    },
+    story: { findMany: mocks.storyFindMany },
+  };
+  return { prisma, Prisma: {} };
+});
+
+vi.mock("@/server/auth-helpers", () => ({
+  requireAuth: mocks.currentSession,
+}));
+
+import {
+  addDependenciesFn,
+  removeDependencyFn,
+  getDependenciesFn,
+} from "../story-dependencies";
+
+const STORY_ROW = (id: string) => ({
+  id,
+  identifier: `PROJ-${id}`,
+  sequenceId: 1,
+  name: `story ${id}`,
+  description: null,
+  state: "backlog",
+  priority: "medium",
+  archived: false,
+  startDate: null,
+  targetDate: null,
+  boardOrder: 0,
+  projectId: "p1",
+  parentId: null,
+  parent: null,
+  assignee: null,
+  createdBy: { id: "u1", username: "u1", email: "e", avatarConfig: null, bgShape: null, bgColor: null },
+  updatedBy: null,
+  labels: [],
+  createdAt: new Date("2026-01-01T00:00:00Z"),
+  updatedAt: new Date("2026-01-01T00:00:00Z"),
+});
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocks.currentSession.mockResolvedValue({ user: { id: "u1" } });
+  // 默认 DB 无既有依赖边（handler 开头一次性取全边建邻接表，必须返回数组）
+  mocks.depFindMany.mockResolvedValue([]);
+});
+
+describe("addDependenciesFn", () => {
+  it("自依赖拒绝并计入 failed", async () => {
+    const res = await addDependenciesFn({
+      data: { items: [{ sourceId: "a", targetId: "a", type: "BLOCKS" }] },
+    });
+    expect(res.created).toHaveLength(0);
+    expect(res.failed[0].targetId).toBe("a");
+    expect(mocks.depCreate).not.toHaveBeenCalled();
+  });
+
+  it("pair 级判重：同 pair 任意方向任意类型已存在则拒绝", async () => {
+    mocks.depFindFirst.mockResolvedValue({ id: "d0" }); // 命中已有边
+    const res = await addDependenciesFn({
+      data: {
+        items: [
+          { sourceId: "a", targetId: "b", type: "STARTS_BEFORE" }, // 正向查 (a,b,*)
+        ],
+      },
+    });
+    expect(res.failed[0].targetId).toBe("b");
+    expect(mocks.depCreate).not.toHaveBeenCalled();
+    // 守住双向查询：实现退化为单方向（漏掉反向 OR）时本断言必须失败
+    expect(mocks.depFindFirst).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: expect.objectContaining({
+          OR: expect.arrayContaining([
+            { sourceId: "a", targetId: "b" },
+            { sourceId: "b", targetId: "a" },
+          ]),
+        }),
+      }),
+    );
+  });
+
+  it("循环依赖拒绝：target 可达 source（跨类型混合环）", async () => {
+    mocks.depFindFirst.mockResolvedValue(null); // 无重复
+    // 图：b -> a 已存在（b BLOCKS a）；插入 a -> b 成环
+    // handler 开头一次性取全边，返回全图唯一一条边
+    mocks.depFindMany.mockResolvedValue([{ sourceId: "b", targetId: "a" }]);
+    const res = await addDependenciesFn({
+      data: { items: [{ sourceId: "a", targetId: "b", type: "BLOCKS" }] },
+    });
+    expect(res.failed[0].targetId).toBe("b");
+    expect(mocks.depCreate).not.toHaveBeenCalled();
+  });
+
+  it("批内互指环：第二条被逐条拦截", async () => {
+    mocks.depFindFirst.mockResolvedValue(null);
+    mocks.depFindMany.mockResolvedValue([]);
+    mocks.depCreate.mockImplementation(({ data }: any) =>
+      Promise.resolve({ id: `d-${data.sourceId}-${data.targetId}`, ...data }),
+    );
+    // 第一条插入 a->b 后，第二条 b->a 的环检测需看到它：
+    // 实现必须把本批已插入边并入检测图（depFindMany 之后的内存集合）
+    // 这里 mock depFindMany 每次返回空（DB 无边），实现需自维护本批边
+    const res = await addDependenciesFn({
+      data: {
+        items: [
+          { sourceId: "a", targetId: "b", type: "BLOCKS" },
+          { sourceId: "b", targetId: "a", type: "STARTS_BEFORE" },
+        ],
+      },
+    });
+    expect(res.created).toHaveLength(1);
+    expect(res.failed[0].targetId).toBe("a");
+  });
+
+  it("合法边创建成功", async () => {
+    mocks.depFindFirst.mockResolvedValue(null);
+    mocks.depFindMany.mockResolvedValue([]);
+    mocks.depCreate.mockResolvedValue({ id: "d1" });
+    const res = await addDependenciesFn({
+      data: { items: [{ sourceId: "a", targetId: "b", type: "BLOCKS" }] },
+    });
+    expect(res.created).toHaveLength(1);
+    expect(mocks.depCreate).toHaveBeenCalledOnce();
+    // 性能契约：环检测的图只查一次（取全边），且不带任何 where 过滤
+    expect(mocks.depFindMany).toHaveBeenCalledTimes(1);
+    expect(mocks.depFindMany).toHaveBeenCalledWith({
+      select: { sourceId: true, targetId: true },
+    });
+  });
+
+  it("validator 拒绝旧枚举值：BLOCKED_BY 不再合法", async () => {
+    await expect(
+      addDependenciesFn({
+        data: { items: [{ sourceId: "a", targetId: "b", type: "BLOCKED_BY" as any }] },
+      }),
+    ).rejects.toThrow();
+    expect(mocks.depCreate).not.toHaveBeenCalled();
+  });
+});
+
+describe("removeDependencyFn", () => {
+  it("按 depId 删除", async () => {
+    mocks.depDelete.mockResolvedValue({ id: "d1" });
+    const res = await removeDependencyFn({ data: { depId: "d1" } });
+    expect(res.id).toBe("d1");
+    expect(mocks.depDelete).toHaveBeenCalledWith({ where: { id: "d1" } });
+  });
+});
+
+describe("getDependenciesFn", () => {
+  it("双视角分组：dependsOn 取 source，dependents 取 target", async () => {
+    mocks.depFindMany.mockResolvedValue([
+      { id: "d1", sourceId: "s1", targetId: "me", type: "BLOCKS" },
+      { id: "d2", sourceId: "me", targetId: "t1", type: "STARTS_BEFORE" },
+    ]);
+    mocks.storyFindMany.mockImplementation(({ where }: any) => {
+      const rows = [STORY_ROW("s1"), STORY_ROW("t1"), STORY_ROW("me")];
+      return Promise.resolve(rows.filter((r) => where.id.in.includes(r.id)));
+    });
+    const res = await getDependenciesFn({ data: { storyId: "me" } });
+    expect(res.dependsOn).toHaveLength(1);
+    expect(res.dependsOn[0].id).toBe("s1");
+    expect(res.dependsOn[0].depId).toBe("d1");
+    expect(res.dependsOn[0].depType).toBe("BLOCKS");
+    expect(res.dependents).toHaveLength(1);
+    expect(res.dependents[0].id).toBe("t1");
+    expect(res.dependents[0].depType).toBe("STARTS_BEFORE");
+    // 日期已 ISO 化（castStoryUsers）
+    expect(res.dependsOn[0].createdAt).toBe("2026-01-01T00:00:00.000Z");
+  });
+
+  it("无边时返回空分组且不查需求表", async () => {
+    mocks.depFindMany.mockResolvedValue([]);
+    const res = await getDependenciesFn({ data: { storyId: "me" } });
+    expect(res).toEqual({ dependsOn: [], dependents: [] });
+    expect(mocks.storyFindMany).not.toHaveBeenCalled();
+  });
+});