@allbluecn/web-app 0.5.0 → 0.5.1

package/src/routeTree.gen.ts

@@ -82,6 +82,7 @@ import { Route as NavTagsIdRouteRouteImport } from './routes/_nav/tags/$id/route
 import { Route as NavTagsSettingsRouteRouteImport } from './routes/_nav/tags/settings/route'
 import { Route as NavWorkspacesIndexRouteImport } from './routes/_nav/workspaces/index'
 import { Route as NavWorkspacesWorkspaceIdRouteRouteImport } from './routes/_nav/workspaces/$workspaceId/route'
+import { Route as ApiAttachmentsUploadRouteImport } from './routes/api/attachments/upload'
 import { Route as ApiAuthSplatRouteImport } from './routes/api.auth.$'
 import { Route as ApiAuthDesktopCallbackRouteImport } from './routes/api/auth/desktop-callback'
 import { Route as ApiDesignUploadRouteImport } from './routes/api/design/upload'
@@ -100,6 +101,7 @@ import { Route as NavProjectsProjectIdStoryIdRouteRouteImport } from './routes/_
 import { Route as NavProjectsProjectIdSettingsRouteRouteImport } from './routes/_nav/projects/$projectId/settings/route'
 import { Route as NavSettingsAiProviderIdRouteRouteImport } from './routes/_nav/settings/ai/$providerId/route'
 import { Route as NavWorkspacesWorkspaceIdSettingsRouteRouteImport } from './routes/_nav/workspaces/$workspaceId/settings/route'
+import { Route as ApiAttachmentsIdContentRouteImport } from './routes/api/attachments/$id/content'
 import { Route as DesignFilesProjectIdArtboardIdFilenameRouteImport } from './routes/design-files/$projectId/$artboardId/$filename'
 import { Route as NavKnowledgeKbIdDocDocIdRouteRouteImport } from './routes/_nav/knowledge/$kbId/doc/$docId/route'
 import { Route as ApiSharePrdPrdIdEventsRouteImport } from './routes/api/share/prd/$prdId/events'
@@ -575,6 +577,11 @@ const NavWorkspacesWorkspaceIdRouteRoute =
       (d) => d.Route,
     ),
   )
+const ApiAttachmentsUploadRoute = ApiAttachmentsUploadRouteImport.update({
+  id: '/api/attachments/upload',
+  path: '/api/attachments/upload',
+  getParentRoute: () => rootRouteImport,
+} as any)
 const ApiAuthSplatRoute = ApiAuthSplatRouteImport.update({
   id: '/api/auth/$',
   path: '/api/auth/$',
@@ -790,6 +797,11 @@ const NavWorkspacesWorkspaceIdSettingsRouteRoute =
       (d) => d.Route,
     ),
   )
+const ApiAttachmentsIdContentRoute = ApiAttachmentsIdContentRouteImport.update({
+  id: '/api/attachments/$id/content',
+  path: '/api/attachments/$id/content',
+  getParentRoute: () => rootRouteImport,
+} as any)
 const DesignFilesProjectIdArtboardIdFilenameRoute =
   DesignFilesProjectIdArtboardIdFilenameRouteImport.update({
     id: '/design-files/$projectId/$artboardId/$filename',
@@ -898,6 +910,7 @@ export interface FileRoutesByFullPath {
   '/share/law/$id': typeof ShareLawIdRouteRoute
   '/share/prd/$prdId': typeof SharePrdPrdIdRouteRoute
   '/chat/$threadId': typeof NavChatThreadIdRoute
+  '/api/attachments/upload': typeof ApiAttachmentsUploadRoute
   '/api/auth/$': typeof ApiAuthSplatRoute
   '/api/auth/desktop-callback': typeof ApiAuthDesktopCallbackRoute
   '/api/design/upload': typeof ApiDesignUploadRoute
@@ -916,6 +929,7 @@ export interface FileRoutesByFullPath {
   '/projects/$projectId/settings': typeof NavProjectsProjectIdSettingsRouteRoute
   '/settings/ai/$providerId': typeof NavSettingsAiProviderIdRouteRoute
   '/workspaces/$workspaceId/settings': typeof NavWorkspacesWorkspaceIdSettingsRouteRoute
+  '/api/attachments/$id/content': typeof ApiAttachmentsIdContentRoute
   '/design-files/$projectId/$artboardId/$filename': typeof DesignFilesProjectIdArtboardIdFilenameRoute
   '/settings/ai/': typeof NavSettingsAiIndexRouteLazyRoute
   '/knowledge/bookmarks/$id': typeof NavKnowledgeBookmarksIdLazyRoute
@@ -988,6 +1002,7 @@ export interface FileRoutesByTo {
   '/share/law/$id': typeof ShareLawIdRouteRoute
   '/share/prd/$prdId': typeof SharePrdPrdIdRouteRoute
   '/chat/$threadId': typeof NavChatThreadIdRoute
+  '/api/attachments/upload': typeof ApiAttachmentsUploadRoute
   '/api/auth/$': typeof ApiAuthSplatRoute
   '/api/auth/desktop-callback': typeof ApiAuthDesktopCallbackRoute
   '/api/design/upload': typeof ApiDesignUploadRoute
@@ -1006,6 +1021,7 @@ export interface FileRoutesByTo {
   '/projects/$projectId/settings': typeof NavProjectsProjectIdSettingsRouteRoute
   '/settings/ai/$providerId': typeof NavSettingsAiProviderIdRouteRoute
   '/workspaces/$workspaceId/settings': typeof NavWorkspacesWorkspaceIdSettingsRouteRoute
+  '/api/attachments/$id/content': typeof ApiAttachmentsIdContentRoute
   '/design-files/$projectId/$artboardId/$filename': typeof DesignFilesProjectIdArtboardIdFilenameRoute
   '/settings/ai': typeof NavSettingsAiIndexRouteLazyRoute
   '/knowledge/bookmarks/$id': typeof NavKnowledgeBookmarksIdLazyRoute
@@ -1096,6 +1112,7 @@ export interface FileRoutesById {
   '/share/law/$id': typeof ShareLawIdRouteRoute
   '/share/prd/$prdId': typeof SharePrdPrdIdRouteRoute
   '/_nav/chat/$threadId': typeof NavChatThreadIdRoute
+  '/api/attachments/upload': typeof ApiAttachmentsUploadRoute
   '/api/auth/$': typeof ApiAuthSplatRoute
   '/api/auth/desktop-callback': typeof ApiAuthDesktopCallbackRoute
   '/api/design/upload': typeof ApiDesignUploadRoute
@@ -1114,6 +1131,7 @@ export interface FileRoutesById {
   '/_nav/projects/$projectId/settings': typeof NavProjectsProjectIdSettingsRouteRoute
   '/_nav/settings/ai/$providerId': typeof NavSettingsAiProviderIdRouteRoute
   '/_nav/workspaces/$workspaceId/settings': typeof NavWorkspacesWorkspaceIdSettingsRouteRoute
+  '/api/attachments/$id/content': typeof ApiAttachmentsIdContentRoute
   '/design-files/$projectId/$artboardId/$filename': typeof DesignFilesProjectIdArtboardIdFilenameRoute
   '/_nav/settings/ai/': typeof NavSettingsAiIndexRouteLazyRoute
   '/_nav/knowledge/bookmarks/$id': typeof NavKnowledgeBookmarksIdLazyRoute
@@ -1202,6 +1220,7 @@ export interface FileRouteTypes {
     | '/share/law/$id'
     | '/share/prd/$prdId'
     | '/chat/$threadId'
+    | '/api/attachments/upload'
     | '/api/auth/$'
     | '/api/auth/desktop-callback'
     | '/api/design/upload'
@@ -1220,6 +1239,7 @@ export interface FileRouteTypes {
     | '/projects/$projectId/settings'
     | '/settings/ai/$providerId'
     | '/workspaces/$workspaceId/settings'
+    | '/api/attachments/$id/content'
     | '/design-files/$projectId/$artboardId/$filename'
     | '/settings/ai/'
     | '/knowledge/bookmarks/$id'
@@ -1292,6 +1312,7 @@ export interface FileRouteTypes {
     | '/share/law/$id'
     | '/share/prd/$prdId'
     | '/chat/$threadId'
+    | '/api/attachments/upload'
     | '/api/auth/$'
     | '/api/auth/desktop-callback'
     | '/api/design/upload'
@@ -1310,6 +1331,7 @@ export interface FileRouteTypes {
     | '/projects/$projectId/settings'
     | '/settings/ai/$providerId'
     | '/workspaces/$workspaceId/settings'
+    | '/api/attachments/$id/content'
     | '/design-files/$projectId/$artboardId/$filename'
     | '/settings/ai'
     | '/knowledge/bookmarks/$id'
@@ -1399,6 +1421,7 @@ export interface FileRouteTypes {
     | '/share/law/$id'
     | '/share/prd/$prdId'
     | '/_nav/chat/$threadId'
+    | '/api/attachments/upload'
     | '/api/auth/$'
     | '/api/auth/desktop-callback'
     | '/api/design/upload'
@@ -1417,6 +1440,7 @@ export interface FileRouteTypes {
     | '/_nav/projects/$projectId/settings'
     | '/_nav/settings/ai/$providerId'
     | '/_nav/workspaces/$workspaceId/settings'
+    | '/api/attachments/$id/content'
     | '/design-files/$projectId/$artboardId/$filename'
     | '/_nav/settings/ai/'
     | '/_nav/knowledge/bookmarks/$id'
@@ -1452,12 +1476,14 @@ export interface RootRouteChildren {
   ServerWsRoute: typeof ServerWsRoute
   ApiLicenseActivateRouteRoute: typeof ApiLicenseActivateRouteRoute
   ApiLicenseHeartbeatRouteRoute: typeof ApiLicenseHeartbeatRouteRoute
+  ApiAttachmentsUploadRoute: typeof ApiAttachmentsUploadRoute
   ApiAuthSplatRoute: typeof ApiAuthSplatRoute
   ApiAuthDesktopCallbackRoute: typeof ApiAuthDesktopCallbackRoute
   ApiDesignUploadRoute: typeof ApiDesignUploadRoute
   ApiKnowledgeSyncGithubRoute: typeof ApiKnowledgeSyncGithubRoute
   ApiNotificationsStreamRoute: typeof ApiNotificationsStreamRoute
   ServerAnyhubProxySplatRoute: typeof ServerAnyhubProxySplatRoute
+  ApiAttachmentsIdContentRoute: typeof ApiAttachmentsIdContentRoute
   DesignFilesProjectIdArtboardIdFilenameRoute: typeof DesignFilesProjectIdArtboardIdFilenameRoute
   ApiSharePrdPrdIdEventsRoute: typeof ApiSharePrdPrdIdEventsRoute
 }
@@ -1961,6 +1987,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof NavWorkspacesWorkspaceIdRouteRouteImport
       parentRoute: typeof NavWorkspacesRouteRoute
     }
+    '/api/attachments/upload': {
+      id: '/api/attachments/upload'
+      path: '/api/attachments/upload'
+      fullPath: '/api/attachments/upload'
+      preLoaderRoute: typeof ApiAttachmentsUploadRouteImport
+      parentRoute: typeof rootRouteImport
+    }
     '/api/auth/$': {
       id: '/api/auth/$'
       path: '/api/auth/$'
@@ -2164,6 +2197,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof NavWorkspacesWorkspaceIdSettingsRouteRouteImport
       parentRoute: typeof NavWorkspacesWorkspaceIdRouteRoute
     }
+    '/api/attachments/$id/content': {
+      id: '/api/attachments/$id/content'
+      path: '/api/attachments/$id/content'
+      fullPath: '/api/attachments/$id/content'
+      preLoaderRoute: typeof ApiAttachmentsIdContentRouteImport
+      parentRoute: typeof rootRouteImport
+    }
     '/design-files/$projectId/$artboardId/$filename': {
       id: '/design-files/$projectId/$artboardId/$filename'
       path: '/design-files/$projectId/$artboardId/$filename'
@@ -2651,12 +2691,14 @@ const rootRouteChildren: RootRouteChildren = {
   ServerWsRoute: ServerWsRoute,
   ApiLicenseActivateRouteRoute: ApiLicenseActivateRouteRoute,
   ApiLicenseHeartbeatRouteRoute: ApiLicenseHeartbeatRouteRoute,
+  ApiAttachmentsUploadRoute: ApiAttachmentsUploadRoute,
   ApiAuthSplatRoute: ApiAuthSplatRoute,
   ApiAuthDesktopCallbackRoute: ApiAuthDesktopCallbackRoute,
   ApiDesignUploadRoute: ApiDesignUploadRoute,
   ApiKnowledgeSyncGithubRoute: ApiKnowledgeSyncGithubRoute,
   ApiNotificationsStreamRoute: ApiNotificationsStreamRoute,
   ServerAnyhubProxySplatRoute: ServerAnyhubProxySplatRoute,
+  ApiAttachmentsIdContentRoute: ApiAttachmentsIdContentRoute,
   DesignFilesProjectIdArtboardIdFilenameRoute:
     DesignFilesProjectIdArtboardIdFilenameRoute,
   ApiSharePrdPrdIdEventsRoute: ApiSharePrdPrdIdEventsRoute,

package/src/routes/_nav/inspiration/route.tsx

@@ -0,0 +1,8 @@
+// AUTO-GENERATED by @allbluecn/kernel — DO NOT EDIT
+import { createFileRoute } from '@tanstack/react-router'
+import type { PluginRouteContext } from '@allbluecn/kernel'
+import { inspiration_route_0 } from '@allbluecn/plugins-core/inspiration/routes'
+
+export const Route = createFileRoute('/_nav/inspiration')({
+  component: inspiration_route_0.Component as any,
+})

package/src/routes/_nav/prd/$id/route.tsx

@@ -0,0 +1,9 @@
+// AUTO-GENERATED by @allbluecn/kernel — DO NOT EDIT
+import { createFileRoute } from '@tanstack/react-router'
+import type { PluginRouteContext } from '@allbluecn/kernel'
+import { prd_route_2 } from '@allbluecn/plugins-core/prd/routes'
+
+export const Route = createFileRoute('/_nav/prd/$id')({
+  beforeLoad: ((ctx: PluginRouteContext) => prd_route_2.beforeLoad(ctx)) as any,
+  component: prd_route_2.Component as any,
+})

package/src/routes/_nav/prd/index.tsx

@@ -0,0 +1,9 @@
+// AUTO-GENERATED by @allbluecn/kernel — DO NOT EDIT
+import { createFileRoute } from '@tanstack/react-router'
+import type { PluginRouteContext } from '@allbluecn/kernel'
+import { prd_route_1 } from '@allbluecn/plugins-core/prd/routes'
+
+export const Route = createFileRoute('/_nav/prd/')({
+  loader: ((ctx: PluginRouteContext) => prd_route_1.loader(ctx)) as any,
+  component: prd_route_1.Component as any,
+})

package/src/routes/_nav/prd/route.tsx

@@ -0,0 +1,8 @@
+// AUTO-GENERATED by @allbluecn/kernel — DO NOT EDIT
+import { createFileRoute } from '@tanstack/react-router'
+import type { PluginRouteContext } from '@allbluecn/kernel'
+import { prd_route_0 } from '@allbluecn/plugins-core/prd/routes'
+
+export const Route = createFileRoute('/_nav/prd')({
+  component: prd_route_0.Component as any,
+})

package/src/routes/_nav/projects/$projectId/settings/route.lazy.tsx

@@ -19,19 +19,21 @@ import { createLazyFileRoute, Link } from "@tanstack/react-router";
 import { useRouter } from "@tanstack/react-router";
 import { useTranslation } from "react-i18next";
 import { useEffect, useState } from "react";
-import { ArrowLeft, Loader2 } from "lucide-react";
+import { ArrowLeft, BookOpenText, Loader2 } from "lucide-react";
 import { toast } from '@/components/ui/sonner';
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Textarea } from "@/components/ui/textarea";
 import { Label } from "@/components/ui/label";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Checkbox } from "@/components/ui/checkbox";
+import { Badge } from "@/components/ui/badge";
 import { IconPicker } from "@/components/shared/icon-picker";
 import { PROJECT_ICONS } from "@/components/shared/icon-packs/project";
 import { NameConfirmDialog } from "@/components/shared/name-confirm-dialog";
 import { ProjectMemberManager } from "@/components/project/project-member-manager";
 import { extractDisplayId, validateDisplayId } from "@/lib/project-display-id";
-import { checkDisplayIdAvailableFn, updateProjectFn, deleteProjectFn } from "@/server/serverFns/project";
+import { checkDisplayIdAvailableFn, updateProjectFn, deleteProjectFn, setProjectKbsFn } from "@/server/serverFns/project";
 import { useTimezone } from "@/providers/timezone-provider";
 import { TimezoneSelect } from "@/components/shared/timezone-select";
 import { RadioGroup, RadioGroupItem } from "@/components/ui/radio-group";
@@ -39,7 +41,7 @@ import { RadioGroup, RadioGroupItem } from "@/components/ui/radio-group";
 function ProjectSettingsPage() {
   const { t } = useTranslation('projects');
   const router = useRouter();
-  const { project, members } = Route.useLoaderData();
+  const { project, members, linkedKbIds, candidateKbs } = Route.useLoaderData();
   const session = Route.useRouteContext({ select: (c) => c.session });
   const currentUserId = session?.user?.id;
   const currentUserRole =
@@ -57,6 +59,8 @@ function ProjectSettingsPage() {
   const [projectTimezone, setProjectTimezone] = useState(project.timezone ?? "");
   const [saving, setSaving] = useState(false);
   const [deleteOpen, setDeleteOpen] = useState(false);
+  const [kbChecked, setKbChecked] = useState<Set<string>>(() => new Set(linkedKbIds));
+  const [savingKbs, setSavingKbs] = useState(false);
   const [deleteMode, setDeleteMode] = useState<"transfer" | "clear">("transfer");
   const userTimezone = useTimezone();
 
@@ -102,6 +106,18 @@ function ProjectSettingsPage() {
     }
   };
 
+  const saveKbs = async () => {
+    setSavingKbs(true);
+    try {
+      await setProjectKbsFn({ data: { projectId: project.id, kbIds: [...kbChecked] } });
+      toast.success(t('settings.kbSection.saved'));
+    } catch (err) {
+      toast.error((err as Error).message || t('settings.kbSection.saveFailed'));
+    } finally {
+      setSavingKbs(false);
+    }
+  };
+
   const handleDelete = async (mode: "transfer" | "clear") => {
     try {
       await deleteProjectFn({ data: { projectId: project.id, mode } })
@@ -225,6 +241,61 @@ function ProjectSettingsPage() {
           </Card>
         )}
 
+        <Card className="mb-6">
+          <CardHeader>
+            <CardTitle>{t('settings.kbSection.title')}</CardTitle>
+          </CardHeader>
+          <CardContent>
+            <p className="mb-3 text-sm text-muted-foreground">
+              {t('settings.kbSection.desc')}
+            </p>
+            {candidateKbs.filter((kb) => kb.visibility !== 'private').length === 0 && (
+              <p className="text-sm text-muted-foreground">{t('settings.kbSection.empty')}</p>
+            )}
+            <div className="flex flex-col gap-2">
+              {candidateKbs
+                .filter((kb) => kb.visibility !== 'private')
+                .map((kb) => {
+                  const isGeneral = kb.visibility === 'general';
+                  return (
+                    <label
+                      key={kb.id}
+                      className={`flex items-center gap-2 rounded-md border px-3 py-2 text-sm ${
+                        isGeneral ? 'opacity-60' : 'cursor-pointer'
+                      }`}
+                    >
+                      <Checkbox
+                        checked={isGeneral ? false : kbChecked.has(kb.id)}
+                        disabled={isGeneral}
+                        onCheckedChange={(v) =>
+                          setKbChecked((prev) => {
+                            const next = new Set(prev);
+                            if (v) next.add(kb.id);
+                            else next.delete(kb.id);
+                            return next;
+                          })
+                        }
+                      />
+                      <BookOpenText className="size-4 text-muted-foreground" />
+                      <span className="flex-1">{kb.name}</span>
+                      {isGeneral ? (
+                        <span className="text-xs text-muted-foreground">
+                          {t('settings.kbSection.generalDisabled')}
+                        </span>
+                      ) : (
+                        <Badge variant="outline" className="text-xs">{t('knowledge:toolbar.team')}</Badge>
+                      )}
+                    </label>
+                  );
+                })}
+            </div>
+            <Button onClick={saveKbs} disabled={savingKbs} className="mt-3">
+              {savingKbs ? <Loader2 className="mr-2 size-4 animate-spin" /> : null}
+              {t('settings.kbSection.save')}
+            </Button>
+          </CardContent>
+        </Card>
+
         <Card className="mb-6">
           <CardHeader>
             <CardTitle>{t('settings.members')}</CardTitle>

package/src/routes/_nav/projects/$projectId/settings/route.tsx

@@ -19,14 +19,18 @@ import { createFileRoute } from "@tanstack/react-router";
 import {
   getProjectDetailFn,
   listProjectMembersFn,
+  listProjectKbsFn,
 } from "@/server/serverFns/project";
+import { listKnowledgeFn } from "@/server/serverFns/knowledge";
 
 export const Route = createFileRoute("/_nav/projects/$projectId/settings")({
   loader: async ({ params }) => {
-    const [project, members] = await Promise.all([
+    const [project, members, linkedKbs, myKbs] = await Promise.all([
       getProjectDetailFn({ data: { projectId: params.projectId } }),
       listProjectMembersFn({ data: { projectId: params.projectId } }),
+      listProjectKbsFn({ data: { projectId: params.projectId } }),
+      listKnowledgeFn({ data: {} }),
     ]);
-    return { project, members };
+    return { project, members, linkedKbIds: linkedKbs.map((k) => k.id), candidateKbs: myKbs };
   },
 });

package/src/routes/_nav/tags/$id/route.tsx

@@ -0,0 +1,8 @@
+// AUTO-GENERATED by @allbluecn/kernel — DO NOT EDIT
+import { createFileRoute } from '@tanstack/react-router'
+import type { PluginRouteContext } from '@allbluecn/kernel'
+import { tags_route_2 } from '@allbluecn/plugins-core/tags/routes'
+
+export const Route = createFileRoute('/_nav/tags/$id')({
+  component: tags_route_2.Component as any,
+})

package/src/routes/_nav/tags/index.tsx

@@ -0,0 +1,8 @@
+// AUTO-GENERATED by @allbluecn/kernel — DO NOT EDIT
+import { createFileRoute } from '@tanstack/react-router'
+import type { PluginRouteContext } from '@allbluecn/kernel'
+import { tags_route_1 } from '@allbluecn/plugins-core/tags/routes'
+
+export const Route = createFileRoute('/_nav/tags/')({
+  component: tags_route_1.Component as any,
+})

package/src/routes/_nav/tags/route.tsx

@@ -0,0 +1,8 @@
+// AUTO-GENERATED by @allbluecn/kernel — DO NOT EDIT
+import { createFileRoute } from '@tanstack/react-router'
+import type { PluginRouteContext } from '@allbluecn/kernel'
+import { tags_route_0 } from '@allbluecn/plugins-core/tags/routes'
+
+export const Route = createFileRoute('/_nav/tags')({
+  component: tags_route_0.Component as any,
+})

package/src/routes/_nav/tags/settings/route.tsx

@@ -0,0 +1,9 @@
+// AUTO-GENERATED by @allbluecn/kernel — DO NOT EDIT
+import { createFileRoute } from '@tanstack/react-router'
+import type { PluginRouteContext } from '@allbluecn/kernel'
+import { tags_route_3 } from '@allbluecn/plugins-core/tags/routes'
+
+export const Route = createFileRoute('/_nav/tags/settings')({
+  loader: ((ctx: PluginRouteContext) => tags_route_3.loader(ctx)) as any,
+  component: tags_route_3.Component as any,
+})

package/src/routes/api/attachments/$id/content.ts

@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createFileRoute } from "@tanstack/react-router";
+import { prisma } from "@allbluecn/database";
+import { requireAuth } from "@/server/auth-helpers";
+
+// URL 路径中的文件名不可信，Content-Disposition 用 RFC 5987 filename* 编码
+function contentDisposition(fileName: string): string {
+  const encoded = encodeURIComponent(fileName);
+  return `inline; filename*=UTF-8''${encoded}`;
+}
+
+export const Route = createFileRoute("/api/attachments/$id/content")({
+  server: {
+    handlers: {
+      GET: async ({ request, params }) => {
+        try {
+          await requireAuth(request);
+
+          const attachment = await prisma.storyAttachment.findUnique({
+            where: { id: params.id },
+            select: { fileName: true, mimeType: true, bytes: true },
+          });
+          if (!attachment || !attachment.bytes) {
+            return new Response("Not found", { status: 404 });
+          }
+
+          const body = new Uint8Array(attachment.bytes);
+          return new Response(body, {
+            headers: {
+              "Content-Type": attachment.mimeType || "application/octet-stream",
+              "Content-Length": String(body.byteLength),
+              "Content-Disposition": contentDisposition(attachment.fileName),
+              "Cache-Control": "private, max-age=31536000, immutable",
+            },
+          });
+        } catch (e) {
+          const message = e instanceof Error ? e.message : "读取失败";
+          const status = message === "UNAUTHORIZED" ? 401 : 500;
+          return new Response(message, { status });
+        }
+      },
+    },
+  },
+});

package/src/routes/api/attachments/upload.ts

@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createFileRoute } from "@tanstack/react-router";
+import { prisma } from "@allbluecn/database";
+import { requireAuth, requireUserInDb } from "@/server/auth-helpers";
+import { ACTIVITY_SELECT, toActivityItem } from "@/server/serverFns/story/types";
+import { inferMimeType } from "@/components/story/relations/format";
+
+const MAX_FILE_SIZE = 10 * 1024 * 1024;
+
+export const Route = createFileRoute("/api/attachments/upload")({
+  server: {
+    handlers: {
+      POST: async ({ request }) => {
+        try {
+          const session = await requireAuth(request);
+          const userId = session.user!.id!;
+          await requireUserInDb(userId);
+
+          const formData = await request.formData();
+          const storyId = formData.get("storyId");
+          const file = formData.get("file");
+          const rawDescription = formData.get("description");
+          const description =
+            typeof rawDescription === "string" && rawDescription.trim()
+              ? rawDescription.trim().slice(0, 500)
+              : null;
+          const attachmentId = formData.get("attachmentId") as string | null;
+          const fileHash = formData.get("fileHash") as string | null;
+          if (typeof storyId !== "string" || !storyId) {
+            return Response.json({ error: "缺少 storyId" }, { status: 400 });
+          }
+          if (!(file instanceof File)) {
+            return Response.json({ error: "缺少文件" }, { status: 400 });
+          }
+          if (file.size <= 0 || file.size > MAX_FILE_SIZE) {
+            return Response.json({ error: "文件大小需在 10MB 以内" }, { status: 400 });
+          }
+
+          const story = await prisma.story.findUnique({
+            where: { id: storyId },
+            select: { id: true },
+          });
+          if (!story) {
+            return Response.json({ error: "需求不存在" }, { status: 404 });
+          }
+
+          const bytes = new Uint8Array(await file.arrayBuffer());
+          let attachment;
+          let activity;
+
+          if (attachmentId) {
+            // 编辑模式：替换现有附件
+            attachment = await prisma.storyAttachment.update({
+              where: { id: attachmentId },
+              data: {
+                fileName: file.name.slice(0, 255),
+                fileSize: BigInt(file.size),
+                mimeType: inferMimeType(file.name, file.type),
+                description,
+                bytes,
+                fileHash: fileHash ?? null,
+              },
+            });
+            activity = await prisma.storyActivity.create({
+              data: {
+                storyId,
+                userId,
+                action: "attachment_updated",
+                newValue: file.name.slice(0, 255),
+              },
+              select: ACTIVITY_SELECT,
+            });
+          } else {
+            // 新增模式：先检查同 story 是否已有相同 hash 的附件
+            const existing = fileHash
+              ? await prisma.storyAttachment.findFirst({
+                  where: { storyId, fileHash },
+                  select: { id: true },
+                })
+              : null;
+            if (existing) {
+              return Response.json({ duplicated: true, existingId: existing.id }, { status: 200 });
+            }
+            attachment = await prisma.storyAttachment.create({
+              data: {
+                storyId,
+                fileName: file.name.slice(0, 255),
+                fileSize: BigInt(file.size),
+                mimeType: inferMimeType(file.name, file.type),
+                description,
+                storageUrl: "pending",
+                bytes,
+                fileHash: fileHash ?? null,
+              },
+            });
+            const storageUrl = `/api/attachments/${attachment.id}/content`;
+            await prisma.storyAttachment.update({
+              where: { id: attachment.id },
+              data: { storageUrl },
+            });
+            activity = await prisma.storyActivity.create({
+              data: {
+                storyId,
+                userId,
+                action: "attachment_added",
+                newValue: file.name.slice(0, 255),
+              },
+              select: ACTIVITY_SELECT,
+            });
+          }
+
+          const storageUrl = `/api/attachments/${attachment.id}/content`;
+
+          return Response.json({
+            id: attachment.id,
+            fileName: attachment.fileName,
+            fileSize: Number(attachment.fileSize),
+            mimeType: attachment.mimeType,
+            description: attachment.description,
+            storageUrl,
+            fileHash: attachment.fileHash,
+            activity: toActivityItem(activity),
+          });
+        } catch (e) {
+          const message = e instanceof Error ? e.message : "上传失败";
+          const status = message === "UNAUTHORIZED" ? 401 : 500;
+          return Response.json({ error: message }, { status });
+        }
+      },
+    },
+  },
+});

package/src/routes/share/prd/$prdId/route.tsx

@@ -0,0 +1,10 @@
+// AUTO-GENERATED by @allbluecn/kernel — DO NOT EDIT
+import { createFileRoute } from '@tanstack/react-router'
+import type { PluginRouteContext } from '@allbluecn/kernel'
+import { prd_route_3 } from '@allbluecn/plugins-core/prd/routes'
+
+export const Route = createFileRoute('/share/prd/$prdId')({
+  beforeLoad: ((ctx: PluginRouteContext) => prd_route_3.beforeLoad(ctx)) as any,
+  validateSearch: prd_route_3.validateSearch as any,
+  component: prd_route_3.Component as any,
+})