@77-zhike/app-sdk 0.2.0-d7b1.7 → 0.2.0-d7b1.9

package/src/server/workflow-blocks/index.d.ts

@@ -0,0 +1,72 @@
+import type {
+  WorkflowObjectSchema,
+  WorkflowSchemaValue,
+  WorkflowStepDefinition,
+  WorkflowStepOutcome,
+  WorkflowStepResult,
+} from "../steps/index.js";
+import type {
+  WorkflowTriggerDefinition,
+  WorkflowTriggerEventResult,
+  WorkflowTriggerOutcome,
+} from "../triggers/index.js";
+
+export type WorkflowStepBlockDefinition<
+  Config extends WorkflowObjectSchema = WorkflowObjectSchema,
+  Outcomes extends readonly WorkflowStepOutcome[] = readonly WorkflowStepOutcome[],
+> = WorkflowStepDefinition<Config, Outcomes> & { readonly type: "step" };
+
+export type WorkflowTriggerBlockDefinition<
+  Config extends WorkflowObjectSchema = WorkflowObjectSchema,
+  Outcomes extends readonly WorkflowTriggerOutcome[] = readonly WorkflowTriggerOutcome[],
+> = WorkflowTriggerDefinition<Config, Outcomes> & { readonly type: "trigger" };
+
+export type WorkflowBlockDefinition = WorkflowStepBlockDefinition | WorkflowTriggerBlockDefinition;
+
+export function defineWorkflowBlock<
+  const Config extends WorkflowObjectSchema,
+  const Outcomes extends readonly [WorkflowStepOutcome, ...WorkflowStepOutcome[]],
+>(definition: WorkflowStepBlockDefinition<Config, Outcomes>): WorkflowStepBlockDefinition<Config, Outcomes>;
+
+export function defineWorkflowBlock<
+  const Config extends WorkflowObjectSchema,
+  const Outcomes extends readonly [WorkflowTriggerOutcome, ...WorkflowTriggerOutcome[]],
+>(definition: WorkflowTriggerBlockDefinition<Config, Outcomes>): WorkflowTriggerBlockDefinition<Config, Outcomes>;
+
+export function defineWorkflowBlockExecute<
+  Config extends WorkflowObjectSchema,
+  Outcomes extends readonly WorkflowStepOutcome[],
+>(
+  block: WorkflowStepBlockDefinition<Config, Outcomes>,
+  execute: (params: Readonly<{ config: WorkflowSchemaValue<Config> }>) =>
+    WorkflowStepResult<Outcomes> | Promise<WorkflowStepResult<Outcomes>>,
+): typeof execute;
+
+export function defineWorkflowBlockActivate<Config extends WorkflowObjectSchema>(
+  block: WorkflowTriggerBlockDefinition<Config>,
+  handler: (params: Readonly<{
+    config: WorkflowSchemaValue<Config>;
+    activationId: string;
+    triggerCallbackUrl: string;
+  }>) => Promise<Readonly<{ subscriptionRef: string | null }>>,
+): typeof handler;
+
+export function defineWorkflowBlockTrigger<
+  Config extends WorkflowObjectSchema,
+  Outcomes extends readonly WorkflowTriggerOutcome[],
+>(
+  block: WorkflowTriggerBlockDefinition<Config, Outcomes>,
+  handler: (params: Readonly<{
+    config: WorkflowSchemaValue<Config>;
+    body: string;
+    headers: Readonly<Record<string, string>>;
+  }>) => Promise<WorkflowTriggerEventResult<Outcomes>>,
+): typeof handler;
+
+export function defineWorkflowBlockDeactivate(
+  block: WorkflowTriggerBlockDefinition,
+  handler: (params: Readonly<{
+    activationId: string;
+    subscriptionRef: string | null;
+  }>) => Promise<void>,
+): typeof handler;

package/src/server/workflow-blocks/index.js

@@ -0,0 +1,32 @@
+const WORKFLOW_BLOCK_MARKER = Symbol.for("zhike.workflow-block.v1");
+
+export function defineWorkflowBlock(definition) {
+  if (!definition || typeof definition !== "object" || Array.isArray(definition) ||
+    !["step", "trigger"].includes(definition.type)) {
+    throw new TypeError("workflow_block_definition_invalid");
+  }
+  return Object.freeze({ ...definition, [WORKFLOW_BLOCK_MARKER]: true });
+}
+
+function bindWorkflowBlockHandler(block, handler, type, kind) {
+  if (!block?.[WORKFLOW_BLOCK_MARKER] || block.type !== type || typeof handler !== "function") {
+    throw new TypeError(`workflow_block_${kind}_invalid`);
+  }
+  return handler;
+}
+
+export function defineWorkflowBlockExecute(block, handler) {
+  return bindWorkflowBlockHandler(block, handler, "step", "execute");
+}
+
+export function defineWorkflowBlockActivate(block, handler) {
+  return bindWorkflowBlockHandler(block, handler, "trigger", "activate");
+}
+
+export function defineWorkflowBlockTrigger(block, handler) {
+  return bindWorkflowBlockHandler(block, handler, "trigger", "trigger");
+}
+
+export function defineWorkflowBlockDeactivate(block, handler) {
+  return bindWorkflowBlockHandler(block, handler, "trigger", "deactivate");
+}

package/src/toolchain/allowed-packages.json

@@ -0,0 +1,7 @@
+{
+  "@77-zhike/qiqi-openapi": {
+    "versions": ["0.1.0"],
+    "targets": ["server"],
+    "subpaths": ["."]
+  }
+}

package/src/toolchain/dependency-policy.js

@@ -0,0 +1,175 @@
+import { readFileSync } from "node:fs";
+import { readFile, realpath } from "node:fs/promises";
+import { builtinModules } from "node:module";
+import { dirname, extname, isAbsolute, relative, resolve, sep } from "node:path";
+import ts from "typescript";
+import { ZhikeCliError } from "../errors.js";
+
+const packages = JSON.parse(readFileSync(new URL("./allowed-packages.json", import.meta.url), "utf8"));
+export const SDK_IMPORTS = new Set([
+  "@77-zhike/app-sdk", "@77-zhike/app-sdk/client", "@77-zhike/app-sdk/ui",
+  "@77-zhike/app-sdk/forms", "@77-zhike/app-sdk/server",
+  "react", "react/jsx-runtime", "react/jsx-dev-runtime",
+]);
+const builtins = new Set(builtinModules.map(name => name.replace(/^node:/, "")));
+
+function fail(code, source, message) {
+  throw new ZhikeCliError(code, source + ": " + message);
+}
+
+function splitPackage(specifier) {
+  const parts = specifier.split("/");
+  const length = specifier.startsWith("@") ? 2 : 1;
+  return { name: parts.slice(0, length).join("/"),
+    subpath: parts.length === length ? "." : "./" + parts.slice(length).join("/") };
+}
+
+export function assertAllowedPackageImport(specifier, target, source) {
+  if (specifier.startsWith("node:") || builtins.has(specifier)) {
+    fail("zhike_node_builtin_forbidden", source, "禁止 Node builtin " + specifier);
+  }
+  if (SDK_IMPORTS.has(specifier)) {
+    if (target === "client" && specifier === "@77-zhike/app-sdk/server") {
+      fail("zhike_server_sdk_client_forbidden", source, "前端代码不得导入服务端 SDK");
+    }
+    return null;
+  }
+  const { name, subpath } = splitPackage(specifier);
+  const policy = Object.hasOwn(packages, name) ? packages[name] : null;
+  if (!policy) fail("zhike_external_dependency_forbidden", source, "未获准依赖 " + specifier);
+  if (!policy.targets.includes(target)) {
+    fail("zhike_dependency_target_forbidden", source, "该运行端不允许导入 " + name);
+  }
+  if (!policy.subpaths.includes(subpath)) {
+    fail("zhike_dependency_subpath_forbidden", source, "未获准包入口 " + specifier);
+  }
+  return { name, policy };
+}
+
+function within(root, path) {
+  const suffix = relative(root, path);
+  return suffix === "" || (!isAbsolute(suffix) && suffix !== ".." && !suffix.startsWith(".." + sep));
+}
+
+// 构建准入规则，不执行依赖代码；最终安全与授权仍由平台沙箱保证。
+export async function createDependencyPolicyPlugin(projectDirectory, target, validateSource) {
+  const projectRoot = await realpath(projectDirectory);
+  const sourceRoot = resolve(projectRoot, "src");
+  const roots = new Map();
+  const packageInfos = new Map();
+  const label = path => relative(projectRoot, path).split(sep).join("/");
+
+  async function packageInfo(path) {
+    let directory = dirname(path);
+    while (within(projectRoot, directory)) {
+      if (packageInfos.has(directory)) return packageInfos.get(directory);
+      let bytes;
+      try { bytes = await readFile(resolve(directory, "package.json"), "utf8"); }
+      catch (error) { if (error.code !== "ENOENT") throw error; }
+      if (bytes !== undefined) {
+        let metadata;
+        try { metadata = JSON.parse(bytes); }
+        catch { fail("zhike_dependency_metadata_invalid", label(path), "包元数据不是合法 JSON"); }
+        const info = { root: directory, name: metadata.name, version: metadata.version };
+        packageInfos.set(directory, info);
+        return info;
+      }
+      const parent = dirname(directory);
+      if (parent === directory) break;
+      directory = parent;
+    }
+    fail("zhike_dependency_path_forbidden", label(path), "依赖必须位于项目内的独立 npm 包");
+  }
+
+  function owner(path) {
+    return [...roots.values()].filter(info => within(info.root, path))
+      .sort((a, b) => b.root.length - a.root.length)[0] ?? null;
+  }
+
+  async function approve(path, expectedName) {
+    if (!within(projectRoot, path)) {
+      fail("zhike_dependency_path_forbidden", "dependency", "依赖真实路径不得越过项目目录");
+    }
+    const info = await packageInfo(path);
+    if (expectedName && info.name !== expectedName) {
+      fail("zhike_dependency_path_forbidden", label(path), "实际包身份与导入包名不一致");
+    }
+    const approved = assertAllowedPackageImport(info.name ?? "", target, label(path));
+    if (!approved) fail("zhike_dependency_path_forbidden", label(path), "不得经相对路径导入平台模块");
+    if (!approved.policy.versions.includes(info.version)) {
+      fail("zhike_dependency_version_forbidden", label(path), "未获准包版本 " + info.name + "@" + info.version);
+    }
+    roots.set(info.root, info);
+    return info;
+  }
+
+  return {
+    name: "zhike-package-policy",
+    setup(buildApi) {
+      async function resolveChecked(args, expectedName) {
+        const resolved = await buildApi.resolve(args.path, { resolveDir: args.resolveDir,
+          importer: args.importer, kind: args.kind,
+          pluginData: { zhikePolicyResolution: true } });
+        if (resolved.errors.length) {
+          fail("zhike_dependency_resolution_failed", args.path, "依赖无法解析，请安装项目声明的依赖");
+        }
+        if (resolved.external || resolved.namespace !== "file") {
+          fail("zhike_dependency_path_forbidden", args.path, "白名单包必须静态合并到 Artifact");
+        }
+        const path = await realpath(resolved.path);
+        let parent = null;
+        if (args.importer) {
+          try { parent = owner(await realpath(args.importer)); }
+          catch (error) { if (error.code !== "ENOENT") throw error; } // esbuild 的虚拟入口不在磁盘上。
+        }
+        if (!expectedName && parent && !within(parent.root, path)) {
+          fail("zhike_dependency_path_forbidden", label(path), "相对依赖不得越过所属包");
+        }
+        if (expectedName || parent) await approve(path, expectedName);
+        else if (!within(sourceRoot, path)) {
+          fail("zhike_source_import_outside_root", label(path), "App relative import 不得越过 src 根目录");
+        }
+        return { path };
+      }
+
+      buildApi.onResolve({ filter: /.*/ }, async args => {
+        if (args.pluginData?.zhikePolicyResolution || args.namespace !== "file") return;
+        if (args.path.startsWith(".") || isAbsolute(args.path)) return resolveChecked(args);
+        const approved = assertAllowedPackageImport(args.path, target, args.path);
+        if (approved) return resolveChecked(args, approved.name);
+      });
+
+      buildApi.onLoad({ filter: /.*/, namespace: "file" }, async args => {
+        const path = await realpath(args.path);
+        const info = owner(path);
+        if (!info) return;
+        await approve(path, info.name);
+        const extension = extname(path);
+        if (extension === ".json") return;
+        const loaders = { ".ts": "ts", ".tsx": "tsx", ".js": "js", ".mjs": "js", ".jsx": "jsx" };
+        if (!Object.hasOwn(loaders, extension)) {
+          fail("zhike_dependency_file_unsupported", label(path), "依赖只支持静态 ESM JS/TS 和 JSON");
+        }
+        const contents = await readFile(path, "utf8");
+        const sourceFile = ts.createSourceFile(label(path), contents, ts.ScriptTarget.ES2022, true,
+          extension === ".tsx" || extension === ".jsx" ? ts.ScriptKind.TSX : ts.ScriptKind.TS);
+        validateSource(sourceFile, label(path), { target, dependency: true });
+        // 在解析优化之前逐条解析，未使用的 import 也不能隐藏未批准依赖或路径逃逸。
+        for (const statement of sourceFile.statements) {
+          const specifier = (ts.isImportDeclaration(statement) || ts.isExportDeclaration(statement))
+            && statement.moduleSpecifier;
+          if (specifier && ts.isStringLiteral(specifier)) {
+            if (specifier.text.startsWith(".")) await resolveChecked({ path: specifier.text,
+              resolveDir: dirname(path), importer: path, kind: "import-statement" });
+            else {
+              const approved = assertAllowedPackageImport(specifier.text, target, label(path));
+              if (approved) await resolveChecked({ path: specifier.text, resolveDir: dirname(path),
+                importer: path, kind: "import-statement" }, approved.name);
+            }
+          }
+        }
+        return { contents, loader: loaders[extension], resolveDir: dirname(path) };
+      });
+    },
+  };
+}

package/src/toolchain/index.js

@@ -1,11 +1,3 @@
-import { createHash } from "node:crypto";
-import { mkdir, writeFile } from "node:fs/promises";
-import { resolve } from "node:path";
-
-import { TOOLING_VERSION } from "../config.js";
-import { ZhikeCliError } from "../errors.js";
-import { readProjectBinding } from "../project-binding.js";
-
 export { discoverAppSources } from "./source-discovery.js";
 export {
   APP_BUNDLE_CONTENT_TYPE,
@@ -21,83 +13,3 @@ export {
   createTransportTar,
   parseTransportTar,
 } from "./transport-tar.js";
-
-export const MOCK_PACKAGE_FORMAT = "zhike.mock-build.v1";
-export const MOCK_ARTIFACT_KIND = "mock";
-export const MOCK_ARTIFACT_MAX_BYTES = 1024 * 1024;
-
-export async function buildMockArtifact({
-  projectDirectory = process.cwd(),
-  expectedEnvironment = null,
-  writeToDist = false,
-} = {}) {
-  await readProjectBinding(projectDirectory, expectedEnvironment);
-  const payload = {
-    format: MOCK_PACKAGE_FORMAT,
-    kind: MOCK_ARTIFACT_KIND,
-    payload: {
-      message: "qiqizhike developer app mock build",
-    },
-    toolingVersion: TOOLING_VERSION,
-  };
-  const bytes = Buffer.from(`${JSON.stringify(payload)}\n`, "utf8");
-  if (bytes.byteLength > MOCK_ARTIFACT_MAX_BYTES) {
-    throw new ZhikeCliError(
-      "zhike_mock_artifact_too_large",
-      "Mock Artifact 超过 1 MiB 上限",
-    );
-  }
-  const result = Object.freeze({
-    bytes,
-    size: bytes.byteLength,
-    sha256: createHash("sha256").update(bytes).digest("hex"),
-    packageFormat: MOCK_PACKAGE_FORMAT,
-    kind: MOCK_ARTIFACT_KIND,
-    toolingVersion: TOOLING_VERSION,
-  });
-  if (writeToDist) {
-    const distDirectory = resolve(projectDirectory, "dist");
-    await mkdir(distDirectory, { recursive: true });
-    await writeFile(resolve(distDirectory, "mock-build.json"), bytes, {
-      flag: "w",
-    });
-  }
-  return result;
-}
-
-export function validateMockArtifact(bytes) {
-  if (!Buffer.isBuffer(bytes) || bytes.byteLength > MOCK_ARTIFACT_MAX_BYTES) {
-    throw new ZhikeCliError(
-      "zhike_mock_artifact_invalid",
-      "Mock Artifact 无效或超过 1 MiB 上限",
-    );
-  }
-  let value;
-  try {
-    value = JSON.parse(bytes.toString("utf8"));
-  } catch (error) {
-    throw new ZhikeCliError(
-      "zhike_mock_artifact_invalid",
-      "Mock Artifact 不是有效 JSON",
-      { cause: error },
-    );
-  }
-  const keys = Object.keys(value).sort();
-  if (
-    keys.join(",") !== "format,kind,payload,toolingVersion" ||
-    value.format !== MOCK_PACKAGE_FORMAT ||
-    value.kind !== MOCK_ARTIFACT_KIND ||
-    value.toolingVersion !== TOOLING_VERSION ||
-    !value.payload ||
-    typeof value.payload !== "object" ||
-    Array.isArray(value.payload) ||
-    Object.keys(value.payload).join(",") !== "message" ||
-    value.payload.message !== "qiqizhike developer app mock build"
-  ) {
-    throw new ZhikeCliError(
-      "zhike_mock_artifact_invalid",
-      "Mock Artifact 不符合 zhike.mock-build.v1 严格合同",
-    );
-  }
-  return value;
-}

package/src/toolchain/real-build.js

@@ -1,4 +1,4 @@
-import { componentTypes } from '../ui/components.generated.js';
+import { publicComponentNames } from '../ui/components.generated.js';
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
 import { mkdir, rm, writeFile } from "node:fs/promises";
@@ -12,7 +12,8 @@ import { TOOLING_VERSION } from "../config.js";
 import { ZhikeCliError } from "../errors.js";
 import { readProjectBinding } from "../project-binding.js";
 import { canonicalJsonBytes } from "./canonical-json.js";
-import { discoverAppSources } from "./source-discovery.js";
+import { discoverAppSources, validateImports } from "./source-discovery.js";
+import { createDependencyPolicyPlugin } from "./dependency-policy.js";
 import { createTransportTar } from "./transport-tar.js";
 
 export const APP_BUNDLE_PACKAGE_FORMAT = "zhike.app-bundle.v1";
@@ -33,18 +34,21 @@ export async function buildAppBundle({
 } = {}) {
   await readProjectBinding(projectDirectory, expectedEnvironment);
   const sources = await discoverAppSources(projectDirectory);
+  let clientBytes, serverBytes;
+  try {
+    clientBytes = sources.frontendExtensions.length > 0
+      ? await buildRemoteReactClient(projectDirectory, sources, development) : null;
+    serverBytes = sources.lifecycleEvents.length > 0 ||
+      sources.serverFunctions.length > 0 ||
+      sources.webhookHandlers.length > 0 ||
+      sources.workflowSteps.length > 0 ||
+      sources.workflowTriggers.length > 0
+      ? await buildServerArtifact(projectDirectory, sources) : null;
+  } catch (error) {
+    const policyError = error.errors?.find(item => item.detail instanceof ZhikeCliError)?.detail;
+    throw policyError ?? error;
+  }
   await assertTypeScriptProgram(projectDirectory, sources);
-
-  const clientBytes =
-    sources.frontendExtensions.length > 0
-      ? await buildRemoteReactClient(projectDirectory, sources, development)
-      : null;
-  const serverBytes =
-    sources.lifecycleEvents.length > 0 ||
-    sources.serverFunctions.length > 0 ||
-    sources.webhookHandlers.length > 0
-      ? await buildServerArtifact(projectDirectory, sources)
-      : null;
   const manifest = createManifest({
     clientBytes,
     serverBytes,
@@ -159,7 +163,8 @@ async function buildRemoteReactClient(projectDirectory, sources, development) {
     absWorkingDir: projectDirectory, bundle: true, charset: "utf8", format: "cjs",
     legalComments: "none", logLevel: "silent", minify: true, platform: "browser",
     external: ["@77-zhike/app-sdk/runtime", "react", "react/jsx-runtime", "react/jsx-dev-runtime", "@77-zhike/app-sdk/client", "@77-zhike/app-sdk/ui", "@77-zhike/app-sdk/forms"],
-    plugins: [createSdkBuildPlugin(projectDirectory, sources, "remote-client")],
+    plugins: [createSdkBuildPlugin(projectDirectory, sources, "remote-client"),
+      await createDependencyPolicyPlugin(projectDirectory, "client", validateImports)],
     sourcemap: development ? "inline" : false,
     banner: { js: 'export function createClientApp(platformModules) {\nconst module = { exports: {} };\nconst exports = module.exports;\nconst require = name => { if (!Object.hasOwn(platformModules, name)) throw new Error("runtime_module_unavailable"); return platformModules[name]; };\nconst Promise = require("@77-zhike/app-sdk/runtime").Promise;' },
     footer: { js: 'return module.exports;\n}' },
@@ -197,6 +202,14 @@ async function buildServerArtifact(projectDirectory, sources) {
       (definition, index) =>
         `import webhookHandler${index} from "./src/${definition.relativePath}";`,
     ),
+    ...sources.workflowSteps.map(
+      (definition, index) =>
+        `import workflowStep${index} from "./src/${definition.handlerPaths.execute}";`,
+    ),
+    ...sources.workflowTriggers.map(
+      (definition, index) => Object.entries(definition.handlerPaths).map(([name, path]) =>
+        `import workflowTrigger${index}_${name} from "./src/${path}";`).join("\n"),
+    ),
   ].join("\n");
   const lifecycleEntries = sources.lifecycleEvents
     .map(
@@ -216,7 +229,19 @@ async function buildServerArtifact(projectDirectory, sources) {
         `[${JSON.stringify(definition.key)}, webhookHandler${index}]`,
     )
     .join(",\n");
-  const stdin = `${imports}\n${serializeWebhookResponse.toString()}\nconst lifecycleEvents = new Map([${lifecycleEntries}]);\nconst serverFunctions = new Map([${serverEntries}]);\nconst webhookHandlers = new Map([${webhookEntries}]);\nexport async function dispatchServerInvocation(request) {\n  if (!request || typeof request !== "object") throw new Error("runtime_invocation_invalid");\n  if (request.kind === "lifecycle_event") {\n    const definition = lifecycleEvents.get(request.entryKey);\n    if (!definition) throw new Error("runtime_lifecycle_event_not_found");\n    const params = definition.event === "app-installed" || definition.event === "app-uninstalled" ? request.context : Object.freeze({ connection: getLifecycleConnection() });\n    await definition.handler(params);\n    return null;\n  }\n  if (request.kind === "server_function") {\n    const handler = serverFunctions.get(request.entryKey);\n    if (!handler) throw new Error("runtime_server_function_not_found");\n    return handler(...request.args);\n  }\n  if (request.kind === "webhook_handler") {\n    const handler = webhookHandlers.get(request.entryKey);\n    if (!handler) throw new Error("runtime_webhook_handler_not_found");\n    const input = request.webRequest;\n    const webRequest = new Request(input.url, { method: input.method, headers: input.headers, body: ["GET", "HEAD"].includes(input.method) ? undefined : input.body });\n    const response = await handler(webRequest, Object.freeze({ ...request.context }));\n    if (!(response instanceof Response)) throw new Error("runtime_webhook_response_invalid");\n    return serializeWebhookResponse(response);\n  }\n  throw new Error("runtime_invocation_kind_invalid");\n}\n`;
+  const workflowEntries = sources.workflowSteps
+    .map((definition, index) => `[${JSON.stringify(definition.entry)}, workflowStep${index}]`)
+    .join(",\n");
+  const triggerEntries = sources.workflowTriggers.flatMap((definition, index) =>
+    Object.entries(definition.entries).map(([name, entry]) =>
+      `[${JSON.stringify(entry)}, workflowTrigger${index}_${name}]`)).join(",\n");
+  const triggerDeclarations = sources.workflowTriggers.length > 0
+    ? `const workflowTriggers = new Map([${triggerEntries}]);\n`
+    : "";
+  const triggerDispatch = sources.workflowTriggers.length > 0
+    ? `  if (request.kind === "workflow_trigger") {\n    const handler = workflowTriggers.get(request.entryKey);\n    if (!handler) throw new Error("runtime_workflow_trigger_not_found");\n    const result = await handler(Object.freeze({ ...request.params }));\n    return request.entryKey.endsWith("/deactivate") ? null : result;\n  }\n`
+    : "";
+  const stdin = `${imports}\n${serializeWebhookResponse.toString()}\nconst lifecycleEvents = new Map([${lifecycleEntries}]);\nconst serverFunctions = new Map([${serverEntries}]);\nconst webhookHandlers = new Map([${webhookEntries}]);\nconst workflowSteps = new Map([${workflowEntries}]);\n${triggerDeclarations}export async function dispatchServerInvocation(request) {\n  if (!request || typeof request !== "object") throw new Error("runtime_invocation_invalid");\n  if (request.kind === "lifecycle_event") {\n    const definition = lifecycleEvents.get(request.entryKey);\n    if (!definition) throw new Error("runtime_lifecycle_event_not_found");\n    const params = definition.event === "app-installed" || definition.event === "app-uninstalled" ? request.context : Object.freeze({ connection: getLifecycleConnection() });\n    await definition.handler(params);\n    return null;\n  }\n  if (request.kind === "server_function") {\n    const handler = serverFunctions.get(request.entryKey);\n    if (!handler) throw new Error("runtime_server_function_not_found");\n    return handler(...request.args);\n  }\n  if (request.kind === "workflow_step") {\n    const handler = workflowSteps.get(request.entryKey);\n    if (!handler) throw new Error("runtime_workflow_step_not_found");\n    return handler(Object.freeze({ config: request.config }));\n  }\n${triggerDispatch}  if (request.kind === "webhook_handler") {\n    const handler = webhookHandlers.get(request.entryKey);\n    if (!handler) throw new Error("runtime_webhook_handler_not_found");\n    const input = request.webRequest;\n    const webRequest = new Request(input.url, { method: input.method, headers: input.headers, body: ["GET", "HEAD"].includes(input.method) ? undefined : input.body });\n    const response = await handler(webRequest, Object.freeze({ ...request.context }));\n    if (!(response instanceof Response)) throw new Error("runtime_webhook_response_invalid");\n    return serializeWebhookResponse(response);\n  }\n  throw new Error("runtime_invocation_kind_invalid");\n}\n`;
   const result = await build({
     absWorkingDir: projectDirectory,
     bundle: true,
@@ -226,7 +251,8 @@ async function buildServerArtifact(projectDirectory, sources) {
     logLevel: "silent",
     minify: true,
     platform: "browser",
-    plugins: [createSdkBuildPlugin(projectDirectory, sources, "server")],
+    plugins: [createSdkBuildPlugin(projectDirectory, sources, "server"),
+      await createDependencyPolicyPlugin(projectDirectory, "server", validateImports)],
     sourcemap: false,
     stdin: { contents: stdin, loader: "ts", resolveDir: projectDirectory, sourcefile: "zhike-server-entry.ts" },
     target: "es2022",
@@ -261,7 +287,7 @@ function createSdkBuildPlugin(projectDirectory, sources, target) {
           };
           export const TableCell = Object.defineProperties(props => createElement(ui.TableCell, props), { Avatar: { get: () => ui.Avatar }, Badge: { value: Badge } });
           export const Table = Object.defineProperties(props => createElement(ui.Table, props), { Header: { get: () => ui.Table.Header }, HeaderCell: { get: () => ui.Table.HeaderCell }, Body: { get: () => ui.Table.Body }, Row: { get: () => ui.Table.Row }, Cell: { value: TableCell } });
-          export const { ${[...componentTypes.filter(type => !["TextBlock", "Badge", "Table", "TableCell"].includes(type)), "Typography", "Widget"].join(", ")} } = ui;
+          export const { ${[...publicComponentNames.filter(name => !["TextBlock", "Badge", "Table", "TableCell"].includes(name)), "Typography", "Widget"].join(", ")} } = ui;
         ` }));
       }
       if (target !== "remote-client") buildApi.onResolve({ filter: /^@77-zhike\/app-sdk\/(client|server)$/ }, (args) => ({
@@ -365,6 +391,20 @@ function createManifest({ clientBytes, serverBytes, sources }) {
       key,
       methods,
     })),
+    ...(sources.workflowSteps.length > 0 ? { workflowSteps: sources.workflowSteps.map(
+      ({ key, title, description, connection, configSchema, outcomes, entry }) => ({
+        artifact: "server", key, entry, title,
+        ...(description === undefined ? {} : { description }),
+        connection, configSchema, outcomes,
+      }),
+    ) } : {}),
+    ...(sources.workflowTriggers.length > 0 ? { workflowTriggers: sources.workflowTriggers.map(
+      ({ key, title, description, connection, requestHeaders, configSchema, outcomes, entries }) => ({
+        artifact: "server", key, entries, title,
+        ...(description === undefined ? {} : { description }),
+        connection, requestHeaders, configSchema, outcomes,
+      }),
+    ) } : {}),
   };
 }
 
@@ -374,6 +414,8 @@ function createServerDefinitionsDigest(sources) {
       lifecycleEvents: sources.lifecycleEvents.map(({ event, key }) => ({ event, key })),
       serverFunctions: sources.serverFunctions.map(({ key }) => ({ key })),
       webhookHandlers: sources.webhookHandlers.map(({ key, methods }) => ({ key, methods })),
+      ...(sources.workflowSteps.length > 0 ? { workflowSteps: sources.workflowSteps.map(({ key, entry }) => ({ key, entry })) } : {}),
+      ...(sources.workflowTriggers.length > 0 ? { workflowTriggers: sources.workflowTriggers.map(({ key, entries }) => ({ key, entries })) } : {}),
     }),
   );
 }