feat: allow deleting standalone assets and debts

apps/api/src/portfolio.ts

@@ -160,7 +160,6 @@ export class PortfolioBusinessService {
   }
   async deletion(r: UserRequest, id: string) {
     const p = await this.own(r.userId, id, r.revealed);
-    if (p.kind !== 'account') throw new BadRequestException('此功能仅用于删除账户');
     const [historyCount, movementCount, scheduleCount, linkCount] = await Promise.all([
       this.db.revision.count({ where: { positionId: id } }),
       this.db.transfer.count({
@@ -192,23 +191,24 @@ export class PortfolioBusinessService {
       const p = await tx.position.findFirst({
         where: { id, userId: r.userId, ...(r.revealed ? {} : { hidden: false }) },
       });
-      if (!p) throw new NotFoundException('账户不存在');
+      if (!p) throw new NotFoundException('项目不存在');
-      if (p.kind !== 'account') throw new BadRequestException('此功能仅用于删除账户');
       if (input.confirmation !== p.name)
-        throw new BadRequestException('请输入完整账户名称确认删除');
+        throw new BadRequestException('请输入完整项目名称确认删除');
       // Paired movements must be removed through replay, never via cascade.
       if (
         await tx.transfer.count({
           where: { userId: r.userId, OR: [{ sourceId: id }, { targetId: id }] },
         })
       )
-        throw new ConflictException('账户存在资金往来，请先撤销相关记录，或选择归档保留历史');
+        throw new ConflictException(
+          '项目存在资金往来，请先撤销相关转账、借贷或还款记录，或选择归档保留历史',
+        );
       if (
         await tx.schedule.count({
           where: { userId: r.userId, OR: [{ sourceId: id }, { targetId: id }] },
         })
       )
-        throw new ConflictException('账户被定时计划使用，请先删除相关计划，或选择归档');
+        throw new ConflictException('项目被定时计划使用，请先删除相关计划，或选择归档');
       await tx.position.delete({ where: { id } });
       return { ok: true };
     });

apps/api/test/account-deletion-integration.test.ts

@@ -155,7 +155,7 @@ test('real REST account deletion preserves paired balances, blocks schedules, ca
     );
     assert.equal(
       (await call(a, '/positions/' + debt.data.id, 'DELETE', { confirmation: '关联债务' })).status,
-      400,
+      200,
     );
   } finally {
     await db.user.deleteMany({ where: { id: { in: users } } });
@@ -247,3 +247,140 @@ test('draft review resolves only referenced visible names and canonical standalo
     await db.$disconnect();
   }
 });
+
+test('standalone asset and both debt sides delete history and links; paired debts preserve account balances', async () => {
+  const db = new PrismaClient();
+  let userId = '';
+  try {
+    const u = await db.user.create({
+      data: { username: 'delete_position_' + randomUUID(), passwordHash: 'unused', idleMinutes: 0 },
+    });
+    userId = u.id;
+    const token = randomBytes(32).toString('hex'),
+      sid = createHash('sha256').update(token).digest('hex');
+    await db.session.create({
+      data: { id: sid, userId, expiresAt: new Date(Date.now() + 3600000) },
+    });
+    async function call(path: string, method = 'GET', data?: unknown) {
+      const r = await fetch(base + path, {
+        method,
+        headers: {
+          Cookie: 'wp_session=' + token,
+          Origin: origin,
+          ...(data ? { 'Content-Type': 'application/json' } : {}),
+        },
+        body: data ? JSON.stringify(data) : undefined,
+      });
+      return { status: r.status, data: await r.json() };
+    }
+    async function create(
+      name: string,
+      kind: string,
+      side: string,
+      amount: string,
+      hidden = false,
+    ) {
+      const r = await call('/positions', 'POST', {
+        name,
+        kind,
+        side,
+        amount,
+        hidden,
+        currency: 'CNY',
+        category: 'other',
+        date: today(),
+      });
+      assert.equal(r.status, 201);
+      return r.data.id as string;
+    }
+    const cash = await create('关联测试账户', 'account', 'asset', '100');
+    const asset = await create('独立资产删除测试', 'asset', 'asset', '42');
+    const owed = await create('欠款删除测试', 'debt', 'liability', '10');
+    const lent = await create('借出删除测试', 'debt', 'asset', '5');
+    assert.equal(
+      (await call('/positions/' + owed + '/links', 'PUT', { targetIds: [asset, cash] })).status,
+      200,
+    );
+    assert.equal((await call('/positions/' + asset + '/deletion')).data.linkCount, 1);
+    assert.equal(
+      (await call('/positions/' + asset, 'DELETE', { confirmation: '独立资产删除测试' })).status,
+      200,
+    );
+    assert.equal(await db.revision.count({ where: { positionId: asset } }), 0);
+    assert.equal(await db.positionLink.count({ where: { targetId: asset } }), 0);
+    assert.equal((await call('/positions/' + owed)).data.amount, '10');
+    assert.equal((await call('/overview')).data.assets, '105.00');
+    assert.equal(
+      (await call('/positions/' + lent, 'DELETE', { confirmation: '借出删除测试' })).status,
+      200,
+    );
+    assert.equal((await call('/overview')).data.assets, '100.00');
+    const makeMovement = async (operation: string, amount: string) => {
+      const r = await call('/transfers', 'POST', {
+        operation,
+        sourceId: cash,
+        targetId: owed,
+        amount,
+        received: amount,
+        fee: '0',
+        date: today(),
+        requestId: randomUUID(),
+      });
+      assert.equal(r.status, 201);
+      return r.data.id as string;
+    };
+    const borrowed = await makeMovement('borrow', '20');
+    const repayment = await makeMovement('repay', '5');
+    assert.equal((await call('/positions/' + owed + '/deletion')).data.movementCount, 2);
+    assert.equal(
+      (await call('/positions/' + owed, 'DELETE', { confirmation: '欠款删除测试' })).status,
+      409,
+    );
+    assert.equal((await call('/positions/' + cash)).data.amount, '115');
+    assert.equal((await call('/positions/' + owed)).data.amount, '25');
+    assert.equal((await call('/transfers/' + repayment, 'DELETE')).status, 200);
+    assert.equal((await call('/transfers/' + borrowed, 'DELETE')).status, 200);
+    assert.equal((await call('/positions/' + cash)).data.amount, '100');
+    assert.equal(
+      (await call('/positions/' + owed, 'DELETE', { confirmation: '欠款删除测试' })).status,
+      200,
+    );
+    assert.equal(await db.revision.count({ where: { positionId: owed } }), 0);
+    assert.equal(await db.positionLink.count({ where: { sourceId: owed } }), 0);
+    assert.equal((await call('/overview')).data.liabilities, '0.00');
+    assert.ok(
+      !(await call('/history')).data.items.some((h: any) =>
+        [asset, lent, owed].includes(h.positionId),
+      ),
+    );
+    assert.ok(
+      !(await call('/calendar/day?date=' + today())).data.items.some((h: any) =>
+        [asset, lent, owed].includes(h.positionId),
+      ),
+    );
+    for (const [kind, side] of [
+      ['asset', 'asset'],
+      ['debt', 'liability'],
+    ]) {
+      const name = '隐藏归档删除-' + kind,
+        id = await create(name, kind, side, '3', true);
+      await db.position.update({ where: { id }, data: { archived: true } });
+      assert.equal((await call('/positions/' + id + '/deletion')).status, 404);
+      assert.equal((await call('/positions/' + id, 'DELETE', { confirmation: name })).status, 404);
+      await db.session.update({
+        where: { id: sid },
+        data: { revealUntil: new Date(Date.now() + 600000) },
+      });
+      assert.equal((await call('/positions/' + id + '/deletion')).data.canDelete, true);
+      assert.equal(
+        (await call('/positions/' + id, 'DELETE', { confirmation: '错误名称' })).status,
+        400,
+      );
+      assert.equal((await call('/positions/' + id, 'DELETE', { confirmation: name })).status, 200);
+      await db.session.update({ where: { id: sid }, data: { revealUntil: null } });
+    }
+  } finally {
+    if (userId) await db.user.deleteMany({ where: { id: userId } });
+    await db.$disconnect();
+  }
+});

apps/api/test/account-deletion.test.ts

@@ -65,18 +65,12 @@ test('account deletion checks ownership and hidden visibility before deleting or
   await f.service.remove({ ...owner, revealed: true }, 'account', { confirmation: '测试账户' });
   assert.deepEqual(f.state(), { deleted: true, invalidated: true });
 });
-test('wrong confirmation, non-accounts, paired movements and schedules cannot cascade', async () => {
+test('wrong confirmation, paired movements and schedules cannot cascade', async () => {
   const f = fixture();
   await assert.rejects(
     () => f.service.remove(owner, 'account', { confirmation: '错误名称' }),
     BadRequestException,
   );
-  f.row.kind = 'asset';
-  await assert.rejects(
-    () => f.service.remove(owner, 'account', { confirmation: '测试账户' }),
-    BadRequestException,
-  );
-  f.row.kind = 'account';
   f.setMovements(1);
   await assert.rejects(
     () => f.service.remove(owner, 'account', { confirmation: '测试账户' }),
@@ -95,3 +89,14 @@ test('wrong confirmation, non-accounts, paired movements and schedules cannot ca
   });
   assert.deepEqual(f.state(), { deleted: true, invalidated: true });
 });
+
+test('standalone assets and debts support deletion and invalidate totals', async () => {
+  for (const kind of ['asset', 'debt']) {
+    const f = fixture();
+    f.row.kind = kind;
+    assert.deepEqual(await f.service.remove(owner, 'account', { confirmation: '测试账户' }), {
+      ok: true,
+    });
+    assert.deepEqual(f.state(), { deleted: true, invalidated: true });
+  }
+});

apps/web/src/App.tsx

@@ -55,7 +55,7 @@ import { Calendar } from './Calendar';
 import { SchedulePanel } from './SchedulePanel';
 import { AgentConnections } from './AgentConnections';
 import { AgentAuthorization, AgentOperation } from './AgentReview';
-import { AccountDeletion } from './AccountDeletion';
+import { PositionDeletion, deletionLabel } from './PositionDeletion';
 import { IconPicker } from './IconPicker';
 import { MetalPanel } from './MetalPanel';
 import { QuickTransfer } from './QuickTransfer';
@@ -1367,15 +1367,13 @@ export default function App() {
                         </button>
                       </>
                     )}
-                    {p.kind === 'account' && (
+                    <button
-                      <button
+                      className="secondary danger-text"
-                        className="secondary danger-text"
+                      disabled={busy}
-                        disabled={busy}
+                      onClick={() => setModal({ kind: 'delete-position', p })}
-                        onClick={() => setModal({ kind: 'delete-account', p })}
+                    >
-                      >
+                      删除{deletionLabel(p)}
-                        删除账户
+                    </button>
-                      </button>
-                    )}
                     <button className="secondary" onClick={() => setModal({ kind: 'edit', p })}>
                       {tr('编辑资料')}
                     </button>
@@ -2607,8 +2605,8 @@ export default function App() {
               ? modal.p?.kind === 'debt'
                 ? operationLabel(modal.p.side === 'asset' ? 'collect' : 'repay')
                 : tr('收款 / 还款')
-              : modal.kind === 'delete-account'
+              : modal.kind === 'delete-position'
-                ? '删除账户'
+                ? '删除' + deletionLabel(modal.p!)
                 : modal.kind === 'transfer'
                   ? tr('转账')
                   : modal.kind === 'reveal'
@@ -2627,16 +2625,19 @@ export default function App() {
             if (!busy) setModal(null);
           }}
         >
-          {modal.kind === 'delete-account' && modal.p ? (
+          {modal.kind === 'delete-position' && modal.p ? (
-            <AccountDeletion
+            <PositionDeletion
               position={modal.p}
               busy={busy}
               cancel={() => setModal(null)}
               remove={(confirmation) =>
-                void act(async () => {
+                void act(
-                  await api('/positions/' + modal.p!.id, 'DELETE', { confirmation });
+                  async () => {
-                  setSelected(null);
+                    await api('/positions/' + modal.p!.id, 'DELETE', { confirmation });
-                }, '账户已删除')
+                    setSelected(null);
+                  },
+                  deletionLabel(modal.p!) + '已删除',
+                )
               }
             />
           ) : ['transfer', 'debt-payment'].includes(modal.kind) ? (

apps/web/src/PositionDeletion.tsx

@@ -9,7 +9,10 @@ type Impact = {
   linkCount: number;
   canDelete: boolean;
 };
-export function AccountDeletion({
+export function deletionLabel(position: Pick<Position, 'kind'>) {
+  return position.kind === 'asset' ? '独立资产' : position.kind === 'debt' ? '债务' : '账户';
+}
+export function PositionDeletion({
   position,
   busy,
   cancel,
@@ -35,6 +38,9 @@ export function AccountDeletion({
       active = false;
     };
   }, [position.id]);
+  const label = deletionLabel(position);
+  const history =
+    position.kind === 'asset' ? '估值历史' : position.kind === 'debt' ? '借贷历史' : '余额历史';
   return (
     <form
       onSubmit={(e) => {
@@ -42,26 +48,29 @@ export function AccountDeletion({
         if (impact?.canDelete && name === impact.name && !busy) remove(name);
       }}
     >
-      <h3>删除账户「{position.name}」</h3>
+      <h3>
+        删除{label}「{position.name}」
+      </h3>
       {!impact ? (
         <p>正在检查关联记录…</p>
       ) : (
         <>
           <p>
-            删除后将移除该账户、{impact.historyCount} 条余额历史及 {impact.linkCount}{' '}
+            删除后将移除该{label}、{impact.historyCount} 条{history}及 {impact.linkCount}{' '}
             个债务关联。资产总览、趋势和收支日历将同步更新，无法撤销。
           </p>
           {!impact.canDelete ? (
             <div className="agent-warning" role="status">
-              <strong>请先处理账户引用</strong>
+              <strong>请先处理关联记录</strong>
               <p>
                 还有 {impact.movementCount} 条资金往来、{impact.scheduleCount}{' '}
-                个定时计划。请先撤销相关资金往来并删除相关计划，再删除账户。若需要保留历史，可改用归档。
+                个定时计划。请先撤销相关资金往来并删除相关计划，再删除{label}
+                。若需要保留历史，可改用归档。
               </p>
             </div>
           ) : (
             <label>
-              输入完整账户名称确认删除
+              输入完整{label}名称确认删除
               <input
                 value={name}
                 onChange={(e) => setName(e.target.value)}
@@ -80,7 +89,7 @@ export function AccountDeletion({
           className="primary danger"
           disabled={busy || !impact?.canDelete || name !== impact.name}
         >
-          删除账户
+          删除{label}
         </button>
       </div>
     </form>

docs/update-agent-accounts-2026-10-04.md

@@ -1,6 +1,6 @@
 # 账户删除与 Agent 连接更新（2026-10-04）
 
-- 账户详情新增删除入口，先展示将删除的余额历史、资产关联数量，输入完整账户名称才允许删除。关联转账或计划时先处理关联记录，避免影响其他账户余额。删除校验用户归属和隐藏账户权限；独立资产、负债使用各自已有流程。
+- 账户详情新增删除入口，先展示将删除的余额历史、资产关联数量，输入完整账户名称才允许删除。关联转账或计划时先处理关联记录，避免影响其他账户余额。删除校验用户归属和隐藏账户权限；独立资产、债务随后统一扩展到相同删除流程，见 docs/update-position-deletion-2026-10-04.md。
 - OAuth 授权与草稿确认使用独立页面，登录后保持待审核链接，旧链接继续兼容。
 - 草稿改为中文字段及账户名称，显示原记录与修改内容，保留金额精度、负债符号和跨币种单位；显示过期、取消、确认和执行结果。
 - Agent 页面分为连接助手、我的连接、草稿记录、能力权限；连接采用步骤向导，能力可搜索，技术内容折叠展示。

docs/update-position-deletion-2026-10-04.md

@@ -0,0 +1,19 @@
+# 独立资产与债务删除
+
+账户、独立资产和债务详情均提供删除按钮。债务支持借入和借出两种方向；隐藏项目先通过网页解锁，归档项目也可以删除。
+
+## 删除确认
+
+删除前显示将移除的余额、估值或借贷历史及债务关联数量。必须输入完整项目名称才可确认。删除后更新资产总览、净资产趋势、历史和收支日历；该删除无法撤销。
+
+若项目被转账、借贷、还款或定时计划引用，删除会被阻止。需要先撤销相关资金往来并删除计划，再删除项目；需要保留历史时可选择归档。不会级联删除配对资金往来，避免其他账户余额失真。债务与其他资产的普通关联可随项目删除，不会删除关联资产。
+
+## 接口与数据
+
+复用 GET /api/positions/:id/deletion 和 DELETE /api/positions/:id；删除请求为 confirmation 字段，必须与项目名称完全一致。服务端继续验证用户归属、隐藏可见性和关联记录，事务中锁定项目，删除成功后清理统计缓存。
+
+不新增数据库表或字段，无需数据库迁移；已有注释保持不变。MCP 尚无项目删除工具，此功能由用户在网站操作，本次未修改真实用户的资产或债务。
+
+## 验证
+
+类型检查和生产构建通过；44 项单元测试、3 项真实 MySQL 删除与草稿测试全部通过。覆盖两种债务方向、独立资产、隐藏归档、名称确认、跨用户隔离、历史及关联清理、总览与日历联动，以及借贷/还款记录阻止删除时双方余额保持不变。测试账户已自动清理。

update.md

@@ -81,3 +81,4 @@
 - ~~允许 HTTP 正常访问~~ — 已完成并验证：2026-10-04 11:25（UTC+8）
 - ~~将网络安全配置提取到 .env，当前允许所有网络地址访问，后续上线通过配置收紧~~ — 已完成并验证：2026-10-04 11:25（UTC+8），见 docs/network-settings.md
 - ~~在 .env.example 用中文介绍每个配置项的作用~~ — 已完成：2026-10-04 11:25（UTC+8）
+- ~~独立资产，和债务都可以删除~~ — 已完成并验证：2026-10-04 12:24（UTC+8），见 docs/update-position-deletion-2026-10-04.md