Fix guidance directory counts and preserve submitted filters

Reviewed-on: #9

apps/waterfall-wiki/ACCOUNT.md

@@ -0,0 +1,49 @@
+# Email accounts
+
+`/account` offers registration, password login, email verification/resend, and logout.
+`/api/account/session` returns the current account; other actions use same-origin POST.
+Passwords require at least 12 characters and at most 256 UTF-8 bytes. Only verified
+accounts can log in. Verification links expire after 30 minutes and are consumed once.
+Session tokens expire after seven days; logout deletes the current token immediately.
+Only token SHA-256 digests are stored. Passwords use individually salted scrypt.
+
+## Runtime configuration
+
+The existing production deployment reads `/etc/prompt.env` on ces-control. Set its
+ownership to root and mode to 0600. The operator should update SMTP_PASSWORD there
+through a secure remote session, without putting it in command arguments, repository,
+CI output, release.env, or chat. Existing compose deployment reads this file without
+copying credentials into the release directory. Do not run `docker compose config`
+without `--quiet` against the production environment because interpolation shows secrets.
+Docker administrators can inspect container environment; access to Docker is privileged.
+
+Set ACCOUNT_PUBLIC_ORIGIN to the exact browser origin and SMTP_HOST=smtpdm.aliyun.com,
+SMTP_PORT=465, SMTP_USERNAME and SMTP_FROM=noreply@notice.entroia.com. TLS certificate
+validation stays enabled. Missing SMTP configuration returns a generic service failure;
+resend with the registration password can recover an account whose initial delivery failed.
+
+Keep AUTH_CONFIG_FILE configured for administrator access. Missing administrator
+configuration fails closed. AUTH_DISABLED_FOR_TESTS is false by default and is enabled
+only by the disposable legacy integration stack; never enable it in production.
+Email account cookies never satisfy administrator authorization. With the current HTTP
+acceptance origin use AUTH_COOKIE_SECURE=false; use true after enabling HTTPS.
+
+Limits persist in PostgreSQL: 10 logins and 3 registration/resend attempts per email per
+15 minutes, plus 300 requests per 15 minutes globally. ACCOUNT_TRUST_PROXY defaults
+false. Enable it only when a trusted ingress overwrites x-forwarded-for; this changes
+the global cap to 60 per trusted client address. Do not enable it on the direct public port.
+Limits count failures and successes. Registration/resend always give the same success
+response for existing/unknown emails, and login uses a dummy KDF for unknown accounts.
+The rate limit itself can reveal recent activity for a known email; it does not reveal
+whether an account exists. Synchronous SMTP latency can still expose a timing side channel;
+a durable asynchronous mail queue would be needed to fully decouple delivery timing.
+Logout remains available when login/mail limits are exhausted. No password recovery or
+account deletion is included.
+
+## Verification
+
+ces-control runs crypto/origin tests, PostgreSQL verification-token replay races,
+expired/revoked sessions, concurrent limit consumption and unverified login rejection.
+Production-auth exercises verify that account cookies cannot authorize legacy writes.
+Actual SMTP delivery and visual acceptance at http://8.211.154.134:18131/account require
+operator runtime configuration and the normal manually approved deployment.

apps/waterfall-wiki/db/015_guidance_documents.sql

@@ -0,0 +1,7 @@
+BEGIN;
+CREATE TABLE guidance_documents(id text PRIMARY KEY CHECK(id ~ '^user-[a-z0-9-]{1,74}$'), owner_id uuid NOT NULL REFERENCES account_users(id), latest integer NOT NULL DEFAULT 0, deleted_at timestamptz, CHECK(id LIKE 'user-' || owner_id::text || '-%'));
+CREATE TABLE guidance_revisions(document_id text NOT NULL REFERENCES guidance_documents(id), revision integer NOT NULL CHECK(revision>0), content jsonb NOT NULL, created_at timestamptz NOT NULL DEFAULT now(), PRIMARY KEY(document_id,revision));
+CREATE FUNCTION guidance_immutable() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN RAISE EXCEPTION 'Published revisions are immutable'; END $$;
+CREATE TRIGGER guidance_immutable BEFORE UPDATE OR DELETE ON guidance_revisions FOR EACH ROW EXECUTE FUNCTION guidance_immutable();
+INSERT INTO schema_migrations(version) VALUES('015_guidance_documents');
+COMMIT;

apps/waterfall-wiki/package.json

@@ -10,7 +10,7 @@
     "build": "next build && esbuild src/worker.ts --bundle --platform=node --format=cjs --external:pg-native --external:playwright-core --outfile=dist/worker.cjs && esbuild scripts/bootstrap.ts --bundle --platform=node --format=cjs --external:pg-native --external:playwright-core --outfile=dist/bootstrap.cjs && esbuild scripts/publish-learning-series.ts --bundle --platform=node --format=cjs --external:pg-native --external:playwright-core --outfile=dist/publish-learning-series.cjs && esbuild scripts/auth-cli.ts --bundle --platform=node --format=cjs --external:pg-native --outfile=dist/auth-cli.cjs && node scripts/prepare-standalone.mjs",
     "start": "next start",
     "typecheck": "next typegen && tsc --noEmit",
-    "test": "tsx --test tests/api-documentation.test.ts tests/health.test.ts tests/model.test.ts tests/learning-series.test.ts tests/skill-docs.test.ts tests/wiki.test.ts tests/explore.test.ts tests/preview.test.ts tests/note-markdown.test.tsx tests/api-publication.test.ts tests/discovery.test.ts tests/auth.test.ts tests/account.test.ts tests/guidance.test.ts",
+    "test": "tsx --test tests/api-documentation.test.ts tests/health.test.ts tests/model.test.ts tests/learning-series.test.ts tests/skill-docs.test.ts tests/wiki.test.ts tests/explore.test.ts tests/preview.test.ts tests/note-markdown.test.tsx tests/api-publication.test.ts tests/discovery.test.ts tests/auth.test.ts tests/account.test.ts tests/guidance.test.ts tests/guidance-publishing.test.ts",
     "test:smoke": "node scripts/smoke.mjs",
     "storage:prepare": "tsx scripts/bootstrap.ts",
     "content:publish-learning": "tsx scripts/publish-learning-series.ts",

apps/waterfall-wiki/src/components/GuidanceShell.tsx

@@ -1,4 +1,4 @@
 import Link from 'next/link';
 import type {ReactNode} from 'react';
 import s from '@/styles/guidance.module.css';
-export default function GuidanceShell({children}:{children:ReactNode}){return <div className={s.site}><header className={s.header}><Link className={s.brand} href="/">↗ 织页 <small>实验版</small></Link><nav><Link href="/">探索文档</Link><Link href="/protocol">协议草案</Link></nav><Link className={s.account} href="/account">登录 / 注册 ↗</Link></header>{children}<footer className={s.footer}><span>织页 · Linked Guidance · 名称与协议仍在探索中</span><Link href="/protocol">让每一页都能成为起点 ↗</Link></footer></div>}
+export default function GuidanceShell({children}:{children:ReactNode}){return <div className={s.site}><header className={s.header}><Link className={s.brand} href="/">↗ 织页 <small>实验版</small></Link><nav><Link href="/">探索文档</Link><Link href="/documents">用户文档</Link><Link href="/write">发布文档</Link><Link href="/protocol">协议草案</Link></nav><Link className={s.account} href="/account">登录 / 注册 ↗</Link></header>{children}<footer className={s.footer}><span>织页 · Linked Guidance · 名称与协议仍在探索中</span><Link href="/protocol">让每一页都能成为起点 ↗</Link></footer></div>}

apps/waterfall-wiki/src/content/guides/catalog.ts

@@ -7,4 +7,4 @@ export const guides:Guidance[]=[
 ];
 export function findGuide(id:string,revision?:number){return guides.find(g=>g.id===id&&(revision===undefined||g.revision===revision));}
 const esc=(s:string)=>s.replace(/[<>&"']/g,c=>({'<':'&lt;','>':'&gt;','&':'&amp;','"':'&quot;',"'":'&apos;'}[c]!));
-export function guidanceXml(g:Guidance){const t=(tag:string,s:string)=>`  <${tag}>${esc(s)}</${tag}>`;return `<?xml version="1.0" encoding="UTF-8"?>\n<guidance xmlns="urn:linked-guidance:0.1" id="${esc(g.id)}" revision="${g.revision}" kind="${g.kind}" lang="zh-CN">\n${[t('title',g.title),t('summary',g.summary),t('applies',g.applies),t('body',g.body),...g.steps.map(s=>t('step',s)),...g.links.map(l=>`  <link target="${esc(l.target)}" revision="${l.revision}" relation="${l.relation}" when="${esc(l.when)}">${esc(l.label)}</link>`),...g.checks.map(s=>t('check',s))].join('\n')}\n</guidance>\n`;}
+export function guidanceXml(g:Guidance){const t=(tag:string,s:string)=>`  <${tag}>${esc(s)}</${tag}>`;return `<?xml version="1.0" encoding="UTF-8"?>\n<guidance xmlns="urn:linked-guidance:0.1" id="${esc(g.id)}" revision="${g.revision}" kind="${g.kind}" lang="zh-CN">\n${[t('title',g.title),t('summary',g.summary),t('applies',g.applies),t('body',g.body),...g.steps.map(s=>t('step',s)),...g.links.map(l=>`  <link target="${esc(l.target)}" revision="${l.revision}" relation="${l.relation}" when="${esc(l.when)}">${esc(l.label)}</link>`),...g.checks.map(s=>t('check',s)),...g.tags.map(s=>t('tag',s))].join('\n')}\n</guidance>\n`;}

apps/waterfall-wiki/src/lib/account-handler.ts

@@ -14,10 +14,11 @@ export async function POST(request: Request,context: Context) {
  const {action} = await context.params;
  if (!['register','resend','verify','login','logout'].includes(action)) return json({error:'不存在'},404);
  try {
+  // Revocation remains available even when login or mail limits are exhausted.
+  if (action === 'logout') { await logoutAccount(request); const r=json({ok:true});r.headers.set('Set-Cookie',accountCookie('',true));return r; }
   // Use a global cap by default: forwarding headers are untrusted unless the deployment explicitly enables a trusted ingress.
   const ip = process.env.ACCOUNT_TRUST_PROXY === 'true' ? request.headers.get('x-forwarded-for')?.split(',')[0].trim() || 'unknown' : 'global';
   if (!await rateLimit('request:'+ip,process.env.ACCOUNT_TRUST_PROXY === 'true' ? 60 : 300)) return json({error:'请求过于频繁，请稍后再试'},429);
-  if (action === 'logout') { await logoutAccount(request); const r=json({ok:true});r.headers.set('Set-Cookie',accountCookie('',true));return r; }
   if (Number(request.headers.get('content-length') || 0)>4096) return json({error:'请求过大'},413);
   const text=await request.text(); if(text.length>4096)return json({error:'请求过大'},413);
   let body;try{body=JSON.parse(text);}catch{return json({error:'请求格式错误'},400);}

apps/waterfall-wiki/src/lib/guidance-input.ts

@@ -0,0 +1,22 @@
+import { z } from 'zod';
+const kind=z.enum(['guide','context','evidence']);
+export const validXmlText=(value:string)=>!/[\u0000-\u0008\u000b\u000c\u000e-\u001f\ufffe\uffff]/.test(value)&&!/[\ud800-\udfff]/u.test(value);
+const text=z.string().refine(validXmlText,'非法 XML 字符').trim().min(1).max(20000);
+export const documentInput=z.object({id:z.string().regex(/^user-[a-z0-9-]{1,74}$/),revision:z.number().int().min(1).max(2147483647),kind,title:text.max(200),summary:text.max(1000),applies:text,body:text,steps:z.array(text).max(100),checks:z.array(text).max(100),links:z.array(z.object({target:z.string().regex(/^[a-z0-9-]{1,79}$/),revision:z.number().int().min(1).max(2147483647),relation:kind,when:text.max(1000),label:text.max(200)}).strict()).max(100),tags:z.array(text.max(80)).max(20)}).strict();
+// Deliberately narrow XML 1.0 grammar: no DTD, comments, CDATA, nested markup or arbitrary entities.
+export function parseDocumentXml(source:string){
+ if(!validXmlText(source)||source.includes(']]>'))throw Error('非法 XML 字符');
+ if(Buffer.byteLength(source)>131072)throw Error('XML 过大');
+ const trimXml=(v:string)=>v.replace(/^[ \t\r\n]+|[ \t\r\n]+$/g,'');
+ let s=source.replace(/^<\?xml version="1.0" encoding="UTF-8"\?>[ \t\r\n]*/, '');
+ if(/<\?|<!/.test(s))throw Error('不支持 XML 声明或嵌入');
+ const decode=(v:string)=>{if(/&(?!amp;|lt;|gt;|quot;|apos;)/.test(v))throw Error('非法实体');return v.replace(/&(amp|lt|gt|quot|apos);/g,(_,k)=>({amp:'&',lt:'<',gt:'>',quot:'"',apos:"'"}[k as 'amp'|'lt'|'gt'|'quot'|'apos'] as string));};
+ const attrs=(v:string)=>{const result:Record<string,string>={};while(trimXml(v)){const m=/^[ \t\r\n]+([a-z]+)="([^"<]*)"/.exec(v);if(!m||m[1] in result)throw Error('非法或重复属性');result[m[1]]=decode(m[2]);v=v.slice(m[0].length);}return result;};
+ const root=/^<guidance((?:[ \t\r\n]+[a-z]+="[^"<]*")+[ \t\r\n]*)>([\s\S]*)<\/guidance>[ \t\r\n]*$/.exec(s);if(!root)throw Error('非法根元素');const a=attrs(root[1]);
+ if(Object.keys(a).sort().join(',')!=='id,kind,lang,revision,xmlns'||a.xmlns!=='urn:linked-guidance:0.1'||a.lang!=='zh-CN'||! /^[1-9][0-9]*$/.test(a.revision))throw Error('不支持的协议或属性');
+ const result:Record<string,unknown>={id:a.id,kind:a.kind,revision:Number(a.revision),steps:[],checks:[],links:[],tags:[]};s=root[2];
+ while(trimXml(s)){const m=/^[ \t\r\n]*<(title|summary|applies|body|step|check|tag|link)((?:[ \t\r\n]+[a-z]+="[^"<]*")*[ \t\r\n]*)>([^<]*)<\/\1>/.exec(s);if(!m)throw Error('非法子元素');const [,tag,raw,value]=m;const at=attrs(raw);const v=decode(value);
+ if(tag==='link'){if(Object.keys(at).sort().join(',')!=='relation,revision,target,when'||! /^[1-9][0-9]*$/.test(at.revision))throw Error('非法链接');(result.links as unknown[]).push({...at,revision:Number(at.revision),label:v});}
+ else {if(Object.keys(at).length)throw Error('非法属性');if(tag==='step'||tag==='check'||tag==='tag')(result[tag==='step'?'steps':tag==='tag'?'tags':'checks'] as string[]).push(v);else{if(tag in result)throw Error('重复元素');result[tag]=v;}}s=s.slice(m[0].length);}
+ return documentInput.parse(result);
+}

apps/waterfall-wiki/src/lib/guidance-store.ts

@@ -0,0 +1,15 @@
+import { db,transaction } from './db';
+import { documentInput } from './guidance-input';
+import { findGuide,type Guidance } from '../content/guides/catalog';
+export async function resolveDocument(id:string,revision?:number):Promise<Guidance|null>{
+ if(!id.startsWith('user-'))return findGuide(id,revision)||null;
+ const r=await db().query(`SELECT r.content FROM guidance_documents d JOIN guidance_revisions r ON r.document_id=d.id AND r.revision=COALESCE($2,d.latest) WHERE d.id=$1 AND ($2::integer IS NOT NULL OR d.deleted_at IS NULL)`,[id,revision??null]);return r.rows[0]?.content||null;
+}
+export async function publishDocument(owner:string,value:unknown){const content=documentInput.parse(value);if(!content.id.startsWith('user-'+owner+'-'))throw Error('INVALID_ID');return transaction(async c=>{
+ await c.query('INSERT INTO guidance_documents(id,owner_id) VALUES($1,$2) ON CONFLICT DO NOTHING',[content.id,owner]);
+ const d=(await c.query('SELECT * FROM guidance_documents WHERE id=$1 FOR UPDATE',[content.id])).rows[0];
+ if(d.owner_id!==owner)throw Error('FORBIDDEN');if(d.deleted_at||content.revision!==d.latest+1)throw Error('CONFLICT');
+ await c.query('INSERT INTO guidance_revisions(document_id,revision,content) VALUES($1,$2,$3)',[content.id,content.revision,content]);await c.query('UPDATE guidance_documents SET latest=$2 WHERE id=$1',[content.id,content.revision]);return content;
+ });}
+export async function withdrawDocument(owner:string,id:string){const r=await db().query('UPDATE guidance_documents SET deleted_at=COALESCE(deleted_at,now()) WHERE id=$1 AND owner_id=$2 RETURNING id',[id,owner]);return !!r.rowCount;}
+export async function discoverDocuments(){const r=await db().query(`SELECT d.id,d.latest AS revision,r.content->>'title' AS title,r.content->>'summary' AS summary,r.content->>'kind' AS kind,d.owner_id AS author FROM guidance_documents d JOIN guidance_revisions r ON r.document_id=d.id AND r.revision=d.latest WHERE d.deleted_at IS NULL ORDER BY r.created_at DESC LIMIT 100`);return r.rows;}

apps/waterfall-wiki/src/pages/api/documents/[[...path]].ts

@@ -0,0 +1,27 @@
+import { ZodError } from 'zod';
+import type { NextApiRequest,NextApiResponse } from 'next';
+import { currentAccount } from '@/lib/account';
+import { trustedOrigin } from '@/lib/account-crypto';
+import { documentInput,parseDocumentXml } from '@/lib/guidance-input';
+import { discoverDocuments,publishDocument,resolveDocument,withdrawDocument } from '@/lib/guidance-store';
+import { guidanceXml } from '@/content/guides/catalog';
+export default async function handler(req:NextApiRequest,res:NextApiResponse){
+ res.setHeader('Cache-Control','no-store');const path=req.query.path||[];if(!Array.isArray(path)||path.length>1)return res.status(404).end();const id=path[0];
+ try{
+ if(req.method==='GET'){
+ if(!id)return res.json({documents:await discoverDocuments()});
+ const revision=req.query.revision;if(revision!==undefined&&(typeof revision!=='string'||! /^[1-9][0-9]{0,9}$/.test(revision)||Number(revision)>2147483647))return res.status(400).json({error:'版本无效'});
+ const doc=await resolveDocument(id,revision===undefined?undefined:Number(revision));if(!doc)return res.status(404).json({error:'文档或精确版本不存在'});
+ if(req.query.format==='xml'){res.setHeader('Content-Type','application/xml; charset=utf-8');return res.send(guidanceXml(doc));}return res.json({document:doc});}
+ if(!['POST','DELETE'].includes(req.method||'')){res.setHeader('Allow','GET, POST, DELETE');return res.status(405).end();}
+ const request=new Request(new URL(req.url||'/',process.env.ACCOUNT_PUBLIC_ORIGIN||'http://'+req.headers.host),{headers:new Headers(Object.entries(req.headers).filter(([,v])=>typeof v==='string') as [string,string][])});
+ if(!trustedOrigin(request))return res.status(403).json({error:'请求来源不受信任'});
+ const user=await currentAccount(request);if(!user)return res.status(401).json({error:'请先登录已验证邮箱账户'});
+ if(req.method==='DELETE')return id&&await withdrawDocument(user.id,id)?res.json({ok:true}):res.status(404).json({error:'无权删除或不存在'});
+ const input=typeof req.body==='string'?parseDocumentXml(req.body):documentInput.parse(req.body);
+ if(id==='preview'){const links=await Promise.all(input.links.map(async l=>({...l,resolved:!!await resolveDocument(l.target,l.revision)})));return res.json({document:input,xml:guidanceXml(input),links});}
+ if(id&&id!==input.id)return res.status(400).json({error:'文档 ID 不匹配'});
+ return res.status(201).json({document:await publishDocument(user.id,input)});
+ }catch(e){if(e instanceof ZodError)return res.status(400).json({error:'输入不符合协议，请检查以下字段',fields:e.issues.slice(0,12).map(i=>i.path.join('.')||'文档')});const message=e instanceof Error?e.message:'';if(message==='INVALID_ID')return res.status(400).json({error:'文档 ID 必须以 user-你的账户ID- 开头，请使用编辑器生成的前缀'});if(message==='FORBIDDEN')return res.status(403).json({error:'仅作者可编辑'});if(message==='CONFLICT'||(e as {code?:string}).code==='23505')return res.status(409).json({error:'版本冲突：请加载最新版本，已发布版本不可修改'});if(e instanceof Error&&(e.name==='ZodError'||/XML|实体|元素|属性|协议|链接/.test(message)))return res.status(400).json({error:'输入不符合协议'});return res.status(503).json({error:'文档服务暂不可用'});}
+}
+export const config={api:{bodyParser:{sizeLimit:'128kb'}}};

apps/waterfall-wiki/src/pages/documents/[id].tsx

@@ -0,0 +1,6 @@
+import type { GetServerSideProps } from 'next';
+import type { Guidance } from '@/content/guides/catalog';
+import styles from '@/styles/documents.module.css';
+type Props={canEdit:boolean;versions:number[];doc:Guidance;links:(Guidance['links'][number]&{resolved:boolean})[]};
+export default function Read({doc,links,canEdit,versions}:Props){return <main className={styles.page}><nav><a href="/documents">用户文档</a> · <a href={canEdit?'/write?id='+doc.id:'/write'}>{canEdit?'编辑我的文档':'发布文档'}</a></nav><h1>{doc.title}</h1><p>{doc.kind} · {doc.id} · 固定版本 {doc.revision}</p><p>版本：{versions.map(v=><a key={v} href={'/documents/'+doc.id+'?revision='+v}> v{v} </a>)}</p><p>{doc.summary}</p><h2>适用条件</h2><p>{doc.applies}</p><p className={styles.body}>{doc.body}</p><ol>{doc.steps.map((s,i)=><li key={i}>{s}</li>)}</ol><h2>条件链接</h2>{links.map((l,i)=><article key={i}><p>条件：{l.when} · {l.relation}</p>{l.resolved?<a href={(l.target.startsWith('user-')?'/documents/':'/guide/')+l.target+'?revision='+l.revision}>{l.label} · v{l.revision}</a>:<p>{l.label}：精确版本缺失，请跳过</p>}</article>)}<h2>检查项</h2><ul>{doc.checks.map((s,i)=><li key={i}>{s}</li>)}</ul><a href={'/api/documents/'+doc.id+'?revision='+doc.revision+'&format=xml'}>读取规范 XML</a>{canEdit&&<p><button onClick={async()=>{if(!confirm('撤下后仍保留固定历史版本，确定撤下？'))return;const r=await fetch('/api/documents/'+doc.id,{method:'DELETE'});alert(r.ok?'已撤下，历史版本仍可访问':(await r.json()).error);}}>作者撤下文档</button></p>}</main>;}
+export const getServerSideProps:GetServerSideProps<Props>=async({params,query,res,req})=>{res.setHeader('Cache-Control','no-store');const revision=query.revision;if(revision!==undefined&&(typeof revision!=='string'||! /^[1-9][0-9]{0,9}$/.test(revision)||Number(revision)>2147483647))return {notFound:true};const {resolveDocument}=await import('@/lib/guidance-store');const doc=await resolveDocument(String(params?.id),revision===undefined?undefined:Number(revision));if(!doc)return {notFound:true};const links=await Promise.all(doc.links.map(async l=>({...l,resolved:!!await resolveDocument(l.target,l.revision)})));const {db}=await import('@/lib/db');const {currentAccount}=await import('@/lib/account');const user=await currentAccount(new Request('http://internal',{headers:{cookie:req.headers.cookie||''}}));const owner=await db().query('SELECT owner_id FROM guidance_documents WHERE id=$1',[doc.id]);const rows=await db().query('SELECT revision FROM guidance_revisions WHERE document_id=$1 ORDER BY revision DESC',[doc.id]);return {props:{doc,links,canEdit:!!user&&owner.rows[0]?.owner_id===user.id,versions:rows.rows.map(r=>r.revision)}};};

apps/waterfall-wiki/src/pages/documents/index.tsx

@@ -0,0 +1,3 @@
+import { useEffect,useState } from 'react';
+import styles from '@/styles/documents.module.css';
+export default function Documents(){const [docs,setDocs]=useState<{id:string;revision:number;title:string;summary:string;kind:string}[]>([]),[error,setError]=useState('');useEffect(()=>{fetch('/api/documents').then(async r=>{const b=await r.json();if(!r.ok)throw Error(b.error);setDocs(b.documents);}).catch(e=>setError(e.message));},[]);return <main className={styles.page}><nav><a href="/">首页</a> · <a href="/write">发布文档</a></nav><h1>用户发布的文档</h1><p>{error}</p>{docs.map(d=><article key={d.id}><h2><a href={'/documents/'+d.id+'?revision='+d.revision}>{d.title}</a></h2><p>{d.kind} · v{d.revision}</p><p>{d.summary}</p></article>)}</main>;}

apps/waterfall-wiki/src/pages/index.tsx

@@ -1,7 +1,75 @@
 import Head from 'next/head';
 import Link from 'next/link';
-import {useState} from 'react';
+import {useRouter} from 'next/router';
+import {useEffect,useState,type FormEvent} from 'react';
 import GuidanceShell from '@/components/GuidanceShell';
 import {guides} from '@/content/guides/catalog';
 import s from '@/styles/guidance.module.css';
-export default function Home(){const[q,setQ]=useState(''),[kind,setKind]=useState('all');const items=guides.filter(g=>(kind==='all'||g.kind===kind)&&`${g.title} ${g.summary} ${g.tags.join(' ')}`.toLowerCase().includes(q.toLowerCase()));return <GuidanceShell><Head><title>织页 · 为 Agent 找到下一页</title></Head><section className={s.hero}><span className={s.eyebrow}>A WEB OF USEFUL KNOWLEDGE</span><h1>一个起点，<br/>连接下一种可能。</h1><p>每一篇文档，都能独立帮助你的 Agent。<br/>从当前问题出发，沿着有用的链接继续探索。</p><label className={s.search}>⌕ <input aria-label="搜索文档" placeholder="搜索文档、任务或一种想法…" value={q} onChange={e=>setQ(e.target.value)}/><kbd>探索</kbd></label><div className={s.topics}>{['代码审查','规划','验证'].map(t=><button key={t} onClick={()=>setQ(t)}>{t} ↗</button>)}</div></section><main className={s.layout}><aside className={s.sidebar}><h2>文档目录</h2>{[['all','全部文档'],['guide','操作指导'],['context','背景知识'],['evidence','事实依据']].map(([key,label])=><button key={key} aria-pressed={kind===key} onClick={()=>setKind(key)}>{label}<span>{guides.filter(g=>key==='all'||g.kind===key).length}</span></button>)}<p>一个文档就是一个入口。<br/>集合是组织方式，<br/>无需整套安装。</p></aside><section><div className={s.sectionTitle}><h2>从这里开始 <small>{items.length} 篇</small></h2><span>协议样例 · v0.1</span></div><div className={s.list}>{items.map(g=><article className={s.row} key={g.id}><div className={s.icon}>{g.kind==='guide'?'↗':'≋'}</div><div><div className={s.meta}>织页 / protocol-examples · r{g.revision}</div><h3><Link href={`/guide/${g.id}`}>{g.title}</Link></h3><p>{g.summary}</p><div className={s.tags}>{g.tags.map(t=><span key={t}>{t}</span>)}<span>↗ {g.links.length} 个关联</span></div></div></article>)}{!items.length&&<p>没有匹配文档，请尝试其他关键词或分类。</p>}</div></section><aside className={s.right}><div className={s.manifest}><span className={s.eyebrow}>DOCUMENTS, CONNECTED.</span><h2>知识不必<br/>打包带走。</h2><p>读一页，解决眼前的问题。<br/>需要更多时，再打开下一页。</p><Link href="/protocol">了解文档协议 ↗</Link></div><div className={s.note}><h3>为两种 Agent 而写</h3><p>Coding agent 的工作方法，Personal agent 的日常指导，都可以从一篇文档开始。</p><h3>这是一个早期原型</h3><p>当前展示协议样例。发布、收藏与社区协作将在真实账户和版本系统上逐步开放。</p></div></aside></main></GuidanceShell>}
+
+type PublishedDocument={id:string;revision:number;title:string;summary:string;kind:string};
+const categories=[['all','全部文档'],['guide','操作指导'],['context','背景知识'],['evidence','事实依据']];
+export default function Home(){
+ const router=useRouter();
+ const [published,setPublished]=useState<PublishedDocument[]>([]);
+ const [loadError,setLoadError]=useState('');
+ const [loading,setLoading]=useState(true);
+ const [q,setQ]=useState('');
+ const [kind,setKind]=useState('all');
+ useEffect(()=>{
+  let active=true;
+  fetch('/api/documents').then(async r=>{
+   const b=await r.json();if(!r.ok)throw Error(b.error);
+   if(active)setPublished(b.documents);
+  }).catch(e=>{if(active)setLoadError(e.message);}).finally(()=>{if(active)setLoading(false);});
+  return()=>{active=false;};
+ },[]);
+ useEffect(()=>{
+  if(!router.isReady)return;
+  setQ(typeof router.query.q==='string'?router.query.q:'');
+  setKind(typeof router.query.kind==='string'&&categories.some(([key])=>key===router.query.kind)?router.query.kind:'all');
+ },[router.isReady,router.query.q,router.query.kind]);
+ function rememberFilters(query:string,category:string){
+  const next:{q?:string;kind?:string}={};
+  if(query)next.q=query;if(category!=='all')next.kind=category;
+  void router.push({pathname:'/',query:next},undefined,{shallow:true,scroll:false});
+ }
+ function search(e:FormEvent){e.preventDefault();rememberFilters(q,kind);}
+ function chooseKind(value:string){setKind(value);rememberFilters(q,value);}
+ function clearFilters(){setQ('');setKind('all');rememberFilters('','all');}
+ const matches=(g:{title:string;summary:string;kind:string;tags?:string[]})=>(kind==='all'||g.kind===kind)&&`${g.title} ${g.summary} ${g.tags?.join(' ')||''}`.toLowerCase().includes(q.trim().toLowerCase());
+ const items=guides.filter(matches),userItems=published.filter(matches);
+ const total=items.length+userItems.length;
+ return <GuidanceShell>
+  <Head><title>织页 · 为 Agent 找到下一页</title></Head>
+  <section className={s.hero}>
+   <span className={s.eyebrow}>A WEB OF USEFUL KNOWLEDGE</span>
+   <h1>一个起点，<br/>连接下一种可能。</h1>
+   <p>每一篇文档，都能独立帮助你的 Agent。<br/>从当前问题出发，沿着有用的链接继续探索。</p>
+   <form className={s.search} role="search" onSubmit={search}>
+    <span aria-hidden="true">⌕</span><input aria-label="搜索文档" placeholder="搜索文档、任务或一种想法…" value={q} onChange={e=>setQ(e.target.value)}/><button type="submit">搜索</button>
+   </form>
+   <div className={s.topics}>{['代码审查','规划','验证'].map(t=><button key={t} onClick={()=>{setQ(t);rememberFilters(t,kind);}}>{t} ↗</button>)}</div>
+  </section>
+  <main className={s.layout}>
+   <aside className={s.sidebar}>
+    <h2>文档目录</h2>
+    {categories.map(([key,label])=><button key={key} aria-pressed={kind===key} onClick={()=>chooseKind(key)}>{label}<span>{[...guides,...published].filter(g=>key==='all'||g.kind===key).length}</span></button>)}
+    <p>一个文档就是一个入口。<br/>集合是组织方式，<br/>无需整套安装。</p>
+   </aside>
+   <section aria-label="文档搜索结果">
+    <div className={s.sectionTitle}><p role="status">{loading?'正在加载用户文档…':loadError?`协议样例 ${items.length} 篇；用户文档加载失败`:`找到 ${total} 篇文档`}</p>{(q||kind!=='all')&&<button type="button" onClick={clearFilters}>清除所有筛选</button>}</div>
+    {loadError&&<p role="alert">用户文档暂未加载：{loadError}。下方仍可阅读协议样例。</p>}
+    {!loading&&!loadError&&total===0&&<p>没有匹配文档，请尝试其他关键词或清除筛选。</p>}
+    <div className={s.sectionTitle}><h2>用户发布 <small>{userItems.length} 篇</small></h2><Link href="/write">发布一篇文档 ↗</Link></div>
+    <div className={s.list}>{userItems.map(g=><article className={s.row} key={g.id}><div className={s.icon}>↗</div><div><div className={s.meta}>{g.id} · {g.kind} · v{g.revision}</div><h3><Link href={`/documents/${g.id}?revision=${g.revision}`}>{g.title}</Link></h3><p>{g.summary}</p></div></article>)}</div>
+    {!loading&&!loadError&&!published.length&&<p>还没有用户文档。你可以发布第一篇，或先阅读下方样例。</p>}
+    <div className={s.sectionTitle}><h2>从这里开始 <small>{items.length} 篇</small></h2><span>协议样例 · v0.1</span></div>
+    <div className={s.list}>{items.map(g=><article className={s.row} key={g.id}><div className={s.icon}>{g.kind==='guide'?'↗':'≋'}</div><div><div className={s.meta}>织页 / protocol-examples · r{g.revision}</div><h3><Link href={`/guide/${g.id}`}>{g.title}</Link></h3><p>{g.summary}</p><div className={s.tags}>{g.tags.map(t=><span key={t}>{t}</span>)}<span>↗ {g.links.length} 个关联</span></div></div></article>)}</div>
+   </section>
+   <aside className={s.right}>
+    <div className={s.manifest}><span className={s.eyebrow}>DOCUMENTS, CONNECTED.</span><h2>知识不必<br/>打包带走。</h2><p>读一页，解决眼前的问题。<br/>需要更多时，再打开下一页。</p><Link href="/protocol">了解文档协议 ↗</Link></div>
+    <div className={s.note}><h3>为两种 Agent 而写</h3><p>Coding agent 的工作方法，Personal agent 的日常指导，都可以从一篇文档开始。</p><h3>这是一个早期原型</h3><p>已验证邮箱用户可以发布独立文档，更新会创建不可变版本。下方协议样例与真实用户文档分别展示。</p></div>
+   </aside>
+  </main>
+ </GuidanceShell>;
+}

apps/waterfall-wiki/src/pages/write.tsx

@@ -0,0 +1,14 @@
+import { useEffect,useState } from 'react';
+import type { Guidance } from '@/content/guides/catalog';
+import styles from '@/styles/documents.module.css';
+const blank:Guidance={id:'user-',revision:1,kind:'guide',title:'',summary:'',applies:'',body:'',steps:[],checks:[],links:[],tags:[]};
+export default function Write(){
+ const [busy,setBusy]=useState(false),[published,setPublished]=useState<{id:string;revision:number}|null>(null);
+ const [doc,setDoc]=useState(blank),[xml,setXml]=useState(''),[mode,setMode]=useState(false),[message,setMessage]=useState(''),[preview,setPreview]=useState<{document:Guidance;xml:string;links:{label:string;when:string;resolved:boolean}[]}|null>(null);
+ useEffect(()=>{setPreview(null);},[doc,xml,mode]);
+ useEffect(()=>{fetch('/api/account/session').then(r=>r.json()).then(b=>{if(b.user){const id=new URLSearchParams(window.location.search).get('id');if(id)fetch('/api/documents/'+encodeURIComponent(id)).then(responseBody).then(b=>setDoc({...b.document,revision:b.document.revision+1})).catch(e=>setMessage(e.message));else setDoc(d=>({...d,id:'user-'+b.user.id+'-'}));}else setMessage('请先登录并验证邮箱，再发布文档。');}).catch(()=>setMessage('账户服务暂不可用，请稍后重试。'));},[]);
+ async function responseBody(r:Response){const b=await r.json().catch(()=>({error:'服务返回异常，请稍后重试'}));if(!r.ok)throw Error((b.error||'请求失败')+(b.fields?.length?'：'+b.fields.join('、'):''));return b;}
+ async function load(){setBusy(true);setPreview(null);try{const b=await responseBody(await fetch('/api/documents/'+encodeURIComponent(doc.id)));setDoc({...b.document,revision:b.document.revision+1});setMessage('已加载，保存将创建新版本');}catch(e){setMessage(e instanceof Error?e.message:'加载失败');}finally{setBusy(false);}}
+ async function submit(action:string){setBusy(true);setMessage('处理中…');setPreview(null);setPublished(null);try{const b=await responseBody(await fetch('/api/documents'+(action==='preview'?'/preview':''),{method:'POST',headers:{'Content-Type':mode?'application/xml':'application/json'},body:mode?xml:JSON.stringify(doc)}));if(action==='preview'){setPreview(b);setMessage('预览成功，尚未发布');}else{setDoc({...b.document,revision:b.document.revision+1});setPublished({id:b.document.id,revision:b.document.revision});if(mode)setXml(xml.replace(/revision="[1-9][0-9]*"/,`revision="${b.document.revision+1}"`));setMessage('已发布版本 '+b.document.revision);}}catch(e){setMessage(e instanceof Error?e.message:'请求失败，请稍后重试');}finally{setBusy(false);}}
+ return <main className={styles.page}><nav><a href="/">首页</a> · <a href="/documents">用户文档</a> · <a href="/account">邮箱账户</a></nav><h1>发布独立文档</h1><p>需要已验证邮箱。每次发布创建不可变版本；只有原作者可以更新或撤下。</p><fieldset disabled={busy}><label><input type="checkbox" checked={mode} onChange={e=>{setMode(e.target.checked);setPreview(null);}}/> 使用协议 XML（zh-CN）</label>{mode?<label>XML 输入<textarea rows={22} value={xml} onChange={e=>{setXml(e.target.value);setPreview(null);}}/></label>:<><label>文档 ID（保留账户前缀，在末尾填写短名）<input value={doc.id} onChange={e=>setDoc({...doc,id:e.target.value})}/></label><button disabled={busy} onClick={load}>加载最新版本以编辑</button><label>待发布版本<input type="number" min={1} value={doc.revision} onChange={e=>setDoc({...doc,revision:Number(e.target.value)})}/></label><label>种类<select value={doc.kind} onChange={e=>setDoc({...doc,kind:e.target.value as Guidance['kind']})}><option>guide</option><option>context</option><option>evidence</option></select></label>{(['title','summary','applies','body'] as const).map(k=><label key={k}>{{title:'标题',summary:'摘要',applies:'适用条件',body:'正文'}[k]}<textarea value={doc[k]} onChange={e=>{setDoc({...doc,[k]:e.target.value});setPreview(null);}}/></label>)}{(['steps','checks'] as const).map(k=><label key={k}>{k==='steps'?'步骤':'检查项'}（每行一项）<textarea value={doc[k].join('\n')} onChange={e=>setDoc({...doc,[k]:e.target.value.split('\n').filter(Boolean)})}/></label>)}<h2>条件链接</h2>{doc.links.map((l,i)=><fieldset key={i}>{(['target','revision','relation','when','label'] as const).map(k=><label key={k}>{k}<input value={l[k]} onChange={e=>setDoc({...doc,links:doc.links.map((v,j)=>j===i?{...v,[k]:k==='revision'?Number(e.target.value):e.target.value}:v)})}/></label>)}<button onClick={()=>setDoc({...doc,links:doc.links.filter((_,j)=>j!==i)})}>移除链接</button></fieldset>)}<button onClick={()=>setDoc({...doc,links:[...doc.links,{target:'',revision:1,relation:'context',when:'',label:''}]})}>添加精确版本链接</button></>}<p><button disabled={busy} onClick={()=>submit('preview')}>校验并预览</button> <button disabled={busy} onClick={()=>submit('publish')}>发布新版本</button></p></fieldset><p role="status">{message}</p>{published&&<p><a href={'/documents/'+published.id+'?revision='+published.revision}>打开已发布文档 v{published.revision} ↗</a></p>}{preview&&<article><h2>{preview.document.title}</h2><p>{preview.document.summary}</p><p>适用：{preview.document.applies}</p><p className={styles.body}>{preview.document.body}</p>{preview.document.steps.map((s,i)=><p key={i}>{i+1}. {s}</p>)}{preview.links.map((l,i)=><p key={i}>{l.label} · 条件：{l.when} · {l.resolved?'精确版本可用':'目标缺失，读取时需跳过'}</p>)}<pre>{preview.xml}</pre></article>}</main>;
+}

apps/waterfall-wiki/src/proxy.ts

@@ -5,11 +5,14 @@ export function proxy(request: NextRequest) {
  const responseHeaders = {'Cache-Control':'private, no-store', 'Referrer-Policy':'same-origin'};
  // Public knowledge pages are read-only. Account handlers enforce their own origin and session checks.
  const publicRead = ['GET','HEAD'].includes(request.method) && (path === '/' || path === '/protocol' || path.startsWith('/guide/') || path.startsWith('/api/guides/'));
- if (publicRead || path === '/account' || path.startsWith('/api/account/')) return NextResponse.next({headers:{...responseHeaders,'Referrer-Policy':'no-referrer'}});
+ if (path === '/write' || path === '/documents' || path.startsWith('/documents/') || path === '/api/documents' || path.startsWith('/api/documents/') || publicRead || path === '/account' || path.startsWith('/api/account/')) return NextResponse.next({headers:{...responseHeaders,'Referrer-Policy':'no-referrer'}});
  if (path === '/brand-mark.svg' || path === '/login' || path === '/api/auth/login' || path === '/api/auth/logout' || path === '/api/health' || path === '/api/ready' || path.startsWith('/_next/static/')) return NextResponse.next({headers:responseHeaders});
  let config;
  try { config = authConfig(); } catch { return NextResponse.json({error:'登录服务配置不可用'}, {status:503,headers:responseHeaders}); }
- if (!config) return NextResponse.next();
+ if (!config) {
+  if (process.env.AUTH_DISABLED_FOR_TESTS === 'true' && process.env.AUTH_CONFIG_FILE === '') return NextResponse.next();
+  return NextResponse.json({error:'管理员登录服务尚未配置'}, {status:503,headers:responseHeaders});
+ }
  const bearer = request.headers.get('authorization');
  const token = bearer?.startsWith('Bearer ') ? bearer.slice(7) : request.cookies.get(SESSION_COOKIE)?.value;
  if (validSession(token,config)) {

apps/waterfall-wiki/src/styles/documents.module.css

@@ -0,0 +1 @@
+.page{max-width:850px;margin:0 auto;padding:40px 24px 100px;color:#202326;font-family:system-ui,sans-serif;line-height:1.7}.page nav{margin-bottom:32px}.page a{color:#276750}.page h1{font-size:36px;letter-spacing:-1px}.page label{display:block;margin:18px 0}.page input:not([type=checkbox]),.page textarea,.page select{display:block;width:100%;padding:12px;border:1px solid #d8ded8;border-radius:8px;background:#fff;color:inherit;font:inherit;box-sizing:border-box}.page button{padding:10px 18px;background:#264e40;color:#fff;border:0;border-radius:7px;cursor:pointer}.page article{border-top:1px solid #d8ded8;padding:22px 0}.page pre{white-space:pre-wrap;overflow-wrap:anywhere;background:#f1f4ef;padding:18px}.body{white-space:pre-wrap}.page fieldset{border:1px solid #d8ded8;border-radius:8px;margin:14px 0}

apps/waterfall-wiki/tests/auth.test.ts

@@ -34,14 +34,18 @@ test('proxy protects APIs, data routes, static content and Studio; fails closed'
  const temp=mkdtempSync(join(tmpdir(),'prompt-auth-')); const old=process.env.AUTH_CONFIG_FILE;
  try{
   const config=newAuthConfig(); process.env.AUTH_CONFIG_FILE=join(temp,'config.json'); writeFileSync(process.env.AUTH_CONFIG_FILE,JSON.stringify(config));
-  for(const path of ['/','/library/import','/skills/example.png','/_next/data/build/index.json','/studio']) assert.equal(proxy(new NextRequest('http://wiki.test'+path)).status,307,path);
+  for(const path of ['/library/import','/skills/example.png','/_next/data/build/index.json','/studio']) assert.equal(proxy(new NextRequest('http://wiki.test'+path)).status,307,path);
   for(const path of ['/api/upload','/studio/api/export','/api/feed']) assert.equal(proxy(new NextRequest('http://wiki.test'+path)).status,401,path);
-  for(const path of ['/login','/brand-mark.svg','/_next/static/chunk.js','/api/health','/api/ready']) assert.equal(proxy(new NextRequest('http://wiki.test'+path)).status,200,path);
+  for(const path of ['/','/write','/documents','/api/documents','/api/documents/preview','/guide/welcome','/protocol','/api/guides/welcome','/account','/api/account/session','/login','/brand-mark.svg','/_next/static/chunk.js','/api/health','/api/ready']) assert.equal(proxy(new NextRequest('http://wiki.test'+path)).status,200,path);
   const headers={cookie:'prompt_session='+signSession(config),host:'wiki.test'};
   assert.equal(proxy(new NextRequest('http://wiki.test/api/feed',{headers})).status,200);
   assert.equal(proxy(new NextRequest('http://wiki.test/api/posts',{method:'POST',headers:{...headers,origin:'http://evil.test'}})).status,403);
   assert.equal(proxy(new NextRequest('http://wiki.test/api/posts',{method:'POST',headers:{...headers,origin:'http://wiki.test'}})).status,200);
-  writeFileSync(process.env.AUTH_CONFIG_FILE,'{}'); assert.throws(()=>authConfig()); assert.equal(proxy(new NextRequest('http://wiki.test/')).status,503);
+  assert.equal(proxy(new NextRequest('http://wiki.test/api/posts',{method:'POST',headers:{cookie:'wiki_account='+ 'a'.repeat(64)}})).status,401);
+  assert.equal(proxy(new NextRequest('http://wiki.test/guide/welcome',{method:'POST'})).status,401);
+  writeFileSync(process.env.AUTH_CONFIG_FILE,'{}'); assert.throws(()=>authConfig()); assert.equal(proxy(new NextRequest('http://wiki.test/api/posts')).status,503);
+  delete process.env.AUTH_CONFIG_FILE;
+  assert.equal(proxy(new NextRequest('http://wiki.test/api/posts')).status,503,'Missing admin configuration fails closed');
  }finally{if(old===undefined)delete process.env.AUTH_CONFIG_FILE;else process.env.AUTH_CONFIG_FILE=old;rmSync(temp,{recursive:true,force:true});}
 });
 

apps/waterfall-wiki/tests/guidance-integration.ts

@@ -0,0 +1,64 @@
+import assert from 'node:assert/strict';
+import {chromium} from 'playwright-core';
+import {randomUUID} from 'node:crypto';
+import {newToken,tokenDigest,ACCOUNT_COOKIE} from '../src/lib/account-crypto';
+import {guidanceXml} from '../src/content/guides/catalog';
+import {db} from '../src/lib/db';
+import {publishDocument,resolveDocument,withdrawDocument,discoverDocuments} from '../src/lib/guidance-store';
+export async function verifyGuidancePublishing(base:string){
+ const owner=randomUUID(),other=randomUUID(),id='user-'+owner+'-document';
+ for(const uid of [owner,other])await db().query("INSERT INTO account_users(id,email,password_hash,verified_at) VALUES($1,$2,'test',now())",[uid,uid+'@example.com']);
+ const doc={id,revision:1,kind:'context',title:'实际数据库文档',summary:'摘要',applies:'条件',body:'正文',steps:[],checks:[],links:[],tags:[]};
+ await assert.rejects(()=>publishDocument(other,doc),/INVALID_ID/);
+ await publishDocument(other,{...doc,id:'user-'+other+'-document'});
+ await publishDocument(owner,doc);assert.equal((await resolveDocument(id,1))?.title,doc.title);
+ await assert.rejects(()=>publishDocument(other,{...doc,revision:2}),/INVALID_ID/);
+ const concurrent=await Promise.allSettled([publishDocument(owner,{...doc,revision:2,body:'新正文'}),publishDocument(owner,{...doc,revision:2})]);assert.equal(concurrent.filter(r=>r.status==='fulfilled').length,1);
+ assert.equal((await resolveDocument(id,1))?.body,'正文');assert.equal(await resolveDocument(id,999),null);
+ await assert.rejects(()=>db().query('UPDATE guidance_revisions SET content=$2 WHERE document_id=$1',[id,{}]),/immutable/);
+ assert.equal(await withdrawDocument(other,id),false);assert.equal(await withdrawDocument(owner,id),true);assert.equal(await resolveDocument(id),null);assert.ok(await resolveDocument(id,1));assert.ok(!(await discoverDocuments()).some(d=>d.id===id));
+ const token=newToken();await db().query("INSERT INTO account_tokens(digest,user_id,kind,expires_at) VALUES($1,$2,'session',now()+interval '1 hour')",[tokenDigest(token),owner]);
+ const headers={'Content-Type':'application/json',origin:process.env.ACCOUNT_PUBLIC_ORIGIN||base,cookie:ACCOUNT_COOKIE+'='+token};
+ const httpDoc={...doc,id:'user-'+owner+'-http',tags:['往返标签']};
+ const request=(path:string,method:string,body?:unknown,extra:Record<string,string>={})=>fetch(base+'/api/documents'+path,{method,headers:{...headers,...extra},...(body?{body:typeof body==='string'?body:JSON.stringify(body)}:{})});
+ assert.equal((await request('','POST',httpDoc,{cookie:''})).status,401);
+ assert.equal((await request('','POST',httpDoc,{origin:'https://untrusted.example'})).status,403);
+ const preview=await request('/preview','POST',httpDoc);assert.equal(preview.status,200,await preview.clone().text());assert.equal(await resolveDocument(httpDoc.id,1),null);
+ const created=await request('','POST',guidanceXml(httpDoc),{'Content-Type':'application/xml'});assert.equal(created.status,201,await created.clone().text());
+ assert.equal((await request('','POST',httpDoc)).status,409);
+ assert.equal((await request('','POST',{...httpDoc,id:'user-'+other+'-http'})).status,400);
+ const xml=await fetch(base+'/api/documents/'+httpDoc.id+'?revision=1&format=xml');assert.equal(xml.status,200);assert.match(await xml.text(),/<tag>往返标签<\/tag>/);
+ const page=await fetch(base+'/documents/'+httpDoc.id+'?revision=1');assert.equal(page.status,200);assert.ok((await page.text()).includes('实际数据库文档'));
+ // The homepage and discovery list hydrate from the real API, so verify them in Chromium on the CI runner.
+ const browser=await chromium.launch({executablePath:process.env.CHROMIUM_PATH||'/usr/bin/chromium',headless:true,args:['--no-sandbox','--disable-dev-shm-usage']});
+ try{
+  const page=await browser.newPage();
+  const link=`a[href="/documents/${httpDoc.id}?revision=1"]`;
+  await page.goto(base+'/',{waitUntil:'domcontentloaded'});
+  await page.locator(link).waitFor({state:'visible'});assert.equal(await page.locator(link).textContent(),httpDoc.title);
+  // Published matches must not inherit the examples' empty state; submitted filters survive reload.
+  const search=page.getByRole('textbox',{name:'搜索文档'});
+  await search.fill(httpDoc.title);await search.press('Enter');
+  await page.waitForURL(url=>url.searchParams.get('q')===httpDoc.title);
+  await page.getByRole('status').filter({hasText:'找到 2 篇文档'}).waitFor();
+  assert.equal(await page.getByText('没有匹配文档',{exact:false}).count(),0);
+  await page.reload({waitUntil:'domcontentloaded'});
+  await page.getByRole('status').filter({hasText:'找到 2 篇文档'}).waitFor();
+  assert.equal(await search.inputValue(),httpDoc.title);
+  await page.getByRole('button',{name:'事实依据'}).click();
+  await page.waitForURL(url=>url.searchParams.get('kind')==='evidence');
+  await page.getByText('没有匹配文档，请尝试其他关键词或清除筛选。',{exact:true}).waitFor();
+  await page.getByRole('button',{name:'清除所有筛选'}).click();
+  await page.waitForURL(url=>url.search==='');
+  await page.locator(link).waitFor({state:'visible'});
+  assert.equal(await search.inputValue(),'');
+  await page.locator('header a[href="/documents"]').click();await page.locator(link).waitFor({state:'visible'});
+  await page.locator(link).click();await page.locator('h1').waitFor();assert.equal(await page.locator('h1').textContent(),httpDoc.title);
+  await page.goto(base+'/write',{waitUntil:'domcontentloaded'});assert.equal(await page.locator('h1').textContent(),'发布独立文档');
+ }finally{await browser.close();}
+ assert.equal((await request('/'+httpDoc.id,'DELETE',undefined,{cookie:''})).status,401);
+ assert.equal((await request('/'+httpDoc.id,'DELETE')).status,200);
+ assert.equal((await fetch(base+'/api/documents/'+httpDoc.id)).status,404);
+ assert.equal((await fetch(base+'/api/documents/'+httpDoc.id+'?revision=1')).status,200);
+
+}

apps/waterfall-wiki/tests/guidance-publishing.test.ts

@@ -0,0 +1,10 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {parseDocumentXml,documentInput} from '../src/lib/guidance-input';
+import {guidanceXml} from '../src/content/guides/catalog';
+const doc={id:'user-test',revision:1,kind:'guide' as const,title:'A & B',summary:'摘要',applies:'适用',body:'<正文>',steps:['一步'],checks:[],links:[],tags:[]};
+test('XML canonical round trip and strict rejection',()=>{const xml=guidanceXml(doc);assert.deepEqual(parseDocumentXml(xml),doc);for(const bad of [xml.replace('<title>','<title extra="1">'),xml.replace('</body>','</body><title>duplicate</title>'),xml.replace('urn:linked-guidance:0.1','urn:linked-guidance:0.2'),xml.replace('&amp;','&unknown;'),xml.replace('<guidance','<!DOCTYPE guidance><guidance'),xml.replace('revision="1"','revision="1" revision="2"'),xml.replace('<body>','<body><script>')])assert.throws(()=>parseDocumentXml(bad));assert.throws(()=>documentInput.parse({...doc,admin:true}));assert.throws(()=>documentInput.parse({...doc,id:'review-changes'}));});
+
+test('XML rejects forbidden Unicode, CDATA terminator and non-XML whitespace',()=>{const xml=guidanceXml(doc);for(const bad of [xml.replace('摘要','bad]]>value'),xml.replace('摘要','bad\u0000value'),xml.replace('摘要','bad\ud800value'),xml+'\u00a0',xml.replace(' id=', '\u00a0id=')])assert.throws(()=>parseDocumentXml(bad));assert.throws(()=>documentInput.parse({...doc,body:'\u000b正文'}));assert.equal(parseDocumentXml(xml.replace('摘要','😀摘要')).summary,'😀摘要');});
+
+test('tags round trip and quoted attribute greater-than remains text',()=>{const value={...doc,tags:['标签'],links:[{target:'source-trust',revision:1,relation:'context' as const,when:'a > b',label:'来源'}]};const xml=guidanceXml(value);assert.deepEqual(parseDocumentXml(xml),value);assert.deepEqual(parseDocumentXml(xml.replace('a &gt; b','a > b')),value);assert.throws(()=>parseDocumentXml(xml.replace('when="a &gt; b"','when="a < b"')));});

apps/waterfall-wiki/tests/integration.test.ts

@@ -12,6 +12,7 @@ import sharp from 'sharp';
 import {db} from '../src/lib/db';
 import {probe,run} from '../src/lib/probe';
 import seriesExample from '../fixtures/autumn-journal.json';
+import {verifyGuidancePublishing} from './guidance-integration';
 import {verifyEmailAccounts} from './account-integration';
 import {verifyFlatNoteMigration} from './flat-note-migration';
 import {staticEntries} from '../src/lib/explore';
@@ -29,6 +30,7 @@ test('real PostgreSQL + S3 notes, flat tags, resource sharing and video processi
   let ready=false;for(let i=0;i<60;i++){try{if((await fetch(base+'/api/health')).ok){ready=true;break;}}catch{}await setTimeout(250);}assert.ok(ready);
   for(const route of ['/','/images','/videos','/audio','/articles','/motion','/library/import','/tools/doodle','/tools/skills','/tools/skills/street-people','/tools/skills/shadow-puppet'])assert.equal((await fetch(base+route)).status,200,route);
   await verifyEmailAccounts();
+  await verifyGuidancePublishing(base);
   await verifyFlatNoteMigration();
   const root=await request('/api/tags',{name:'线条',slug:'lines'});const child=await request('/api/tags',{name:'白色',slug:'white'});
   const sameTag=await request('/api/tags',{name:'#线条'});assert.equal(sameTag.id,root.id,'Hashtag creation reuses the globally unique tag');
@@ -207,7 +209,10 @@ test('real PostgreSQL + S3 notes, flat tags, resource sharing and video processi
   for(const image of ['egret-example','dancer-example'])assert.equal((await fetch(base+`/skills/shadow-puppet/${image}.png`,{method:'HEAD'})).status,200);
   for(const path of ['/skills/missing/SKILL.md','/skills/shadow-puppet/missing.md','/tools/skills/shadow-puppet/missing'])assert.equal((await fetch(base+path)).status,404,path);
   assert.equal((await fetch(base+'/api/skill-docs/shadow-puppet/SKILL',{method:'POST'})).status,405);
-  const home=await fetch(base+'/').then(r=>r.text());assert.ok(home.includes('/explore/'));assert.ok(home.includes('分类'));assert.ok(home.includes('照片入皮影'));
+  const home=await fetch(base+'/').then(r=>r.text());
+  for(const href of ['/documents','/write','/protocol','/guide/review-changes'])assert.ok(home.includes('href=\"'+href+'\"'),`Guidance homepage links to ${href}`);
+  assert.ok(home.includes('用户发布'));assert.ok(home.includes('协议样例'));
+  // Legacy media and skill functionality stays covered by its own routes above and below.
 
   const spec=await request('/api/skills/street-people');assert.equal(spec.generation.executor,'coding-agent');
   assert.equal((await fetch(base+'/api/skills/street-people?format=md')).headers.get('content-type'),'text/markdown; charset=utf-8');

compose.yml

@@ -12,6 +12,7 @@ x-waterfall-wiki-environment: &waterfall-wiki-environment
   CHROMIUM_PATH: /usr/bin/chromium
   RENDER_ORIGIN: http://waterfall-wiki:3000
   AUTH_CONFIG_FILE: ${AUTH_CONFIG_FILE:-}
+  AUTH_DISABLED_FOR_TESTS: ${AUTH_DISABLED_FOR_TESTS:-false}
   AUTH_COOKIE_SECURE: ${AUTH_COOKIE_SECURE:-true}
   ACCOUNT_PUBLIC_ORIGIN: ${ACCOUNT_PUBLIC_ORIGIN:-http://8.211.154.134:18131}
   ACCOUNT_TRUST_PROXY: ${ACCOUNT_TRUST_PROXY:-false}

docs/linked-guidance/protocol.md

@@ -19,7 +19,7 @@
 </guidance>
 ```
 
-根元素必需属性：命名空间、id（小写字母、数字与短横线）、正整数 revision、kind（guide/context/evidence）、lang。必需单值子元素：title、summary、applies、body。step、link、check 可重复。未知版本必须明确拒绝，不能猜测执行。正文只提供文本，展示层的 HTML 不属于协议。
+根元素必需属性：命名空间、id（小写字母、数字与短横线）、正整数 revision、kind（guide/context/evidence）、lang。必需单值子元素：title、summary、applies、body。step、link、check、tag 可重复；tag 为纯文本发现标签，不授予执行语义。未知版本必须明确拒绝，不能猜测执行。正文只提供文本，展示层的 HTML 不属于协议。
 
 ## 链接与读取
 

docs/linked-guidance/publishing.md

@@ -0,0 +1,16 @@
+# 真实文档发布
+
+本分支依赖 linked-guidance #7（ee69749）和 wiki-email-auth #6 后续安全修复 c27fa4f。先合并账户及协议依赖，再合并本 PR。使用现有 PostgreSQL、014 账户迁移后执行 015；无需 SMTP 变更。
+
+- `/write`：已验证邮箱账户创建、加载并发布下一版本，支持结构化表单和受限 XML；预览通过 `/api/documents/preview` 校验并解析条件链接，不写数据库。
+- `/documents` 与 `/documents/:id?revision=N`：真实用户文档列表与固定版本阅读。主页可链接这两个入口，现有 `/guide` 可对 `user-` ID 委托 `resolveDocument` 或链接 `/documents/:id`。首页与导航已接入真实发布入口；原型阅读页保留独立样例。
+- `/api/documents` GET 列表，POST 创建/发布；`/api/documents/:id` GET 单篇、POST 下一版、DELETE 作者撤下；`?format=xml&revision=N` 返回规范 XML。未指定版本为发现用途，实际采用需固定 revision。
+- `user-<author UUID>-<slug>` 命名空间独立于静态 catalog，服务端和数据库均校验作者前缀，同一短名可由不同作者分别发布。条件链接可引用静态样例或真实文档；缺失版本明确展示，不自动请求外站、不静默换最新版。撤下后列表及 latest 不再展示，历史固定版本仍然公开可读。
+- 邮箱会话仅由新接口校验，不授予管理员 API 权限。发布是公开行为；目前没有草稿服务、私有文档、恢复撤下或账户删除功能。tags 是发现元数据，通过 XML 可重复的 tag 元素往返保存。
+- 数据库通过行锁分配下一版本并拒绝过时编辑，触发器禁止修改/删除已发布内容。数据库所有者仍可执行数据库维护，触发器不是对数据库管理员的安全隔离。
+
+验证由 ces-control PR CI 执行：严格 XML 单元测试；PostgreSQL 真实发布、所有权、并发版本冲突、不可变内容和撤下保留历史的集成测试。PR 不自动部署，服务器视觉验收须主 chat 人工合并后的部署成功再执行。
+
+首页现已通过 `/api/documents` 加载真实发布摘要，并在 GuidanceShell 提供用户文档与发布入口。`/guide` 继续只读取静态协议样例，不覆盖主 chat 的阅读实现。
+
+编辑器自动加载已验证账户前缀。发布成功提供精确版本链接；网络或服务失败保留输入并显示错误，XML 模式成功后推进待编辑版本。严格 XML 校验另拒绝无效 Unicode、CDATA 终止符和非 XML 空白。

scripts/integration.sh

@@ -11,6 +11,8 @@ cleanup(){ code=$?; if [ "$code" -ne 0 ]; then compose logs --tail 160 waterfall
 trap cleanup EXIT
 # Random credentials exist only for this disposable stack; no host Node required.
 docker run --rm --entrypoint node "$WATERFALL_WIKI_IMAGE" -e "const c=require('crypto');const hex=()=>c.randomBytes(24).toString('hex');console.log('POSTGRES_PASSWORD='+hex()+'\nS3_ACCESS_KEY='+hex()+'\nS3_SECRET_KEY='+hex())" > "$TEST_ENV"
+# Explicitly isolate legacy unauthenticated integration coverage; production fails closed.
+printf '\nAUTH_DISABLED_FOR_TESTS=true\n' >> "$TEST_ENV"
 compose up -d --no-build --wait --wait-timeout 120 postgres objects
 compose run --rm --no-deps migrate
 compose up -d --no-build --wait --wait-timeout 150 waterfall-wiki waterfall-wiki-worker