@siming-org/core 0.3.0 → 0.5.0

package/dist/index.js

@@ -1,6 +1,6 @@
 // src/index.ts
 import { readFileSync } from "fs";
-import { z as z11 } from "zod";
+import { z as z20 } from "zod";
 
 // src/store/client.ts
 import { MongoClient } from "mongodb";
@@ -88,6 +88,12 @@ function createRepo(collection, options = {}) {
     }
   };
 }
+function escapeRegExpLiteral(input) {
+  return input.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function enabledNeFalse() {
+  return { enabled: { $ne: false } };
+}
 
 // src/errors.ts
 var BIZ_CODE_MESSAGES = {
@@ -98,6 +104,9 @@ var BIZ_CODE_MESSAGES = {
   TASK_PROJECT_IMMUTABLE: "\u4EFB\u52A1\u5F52\u5C5E\u9879\u76EE\u521B\u5EFA\u540E\u4E0D\u53EF\u53D8\u66F4",
   DEFAULT_PROJECT_IMMUTABLE: "\u9ED8\u8BA4\u9879\u76EE\u4E0D\u53EF\u505C\u7528",
   TEMPLATE_NAME_CONFLICT: "\u76EE\u6807\u9879\u76EE\u5185\u5DF2\u5B58\u5728\u540C\u540D\u6A21\u677F",
+  // T202609020002 模板业务 code 域（创建冲突/不可变；E11000 兜底由 repo 层按 keyValue 二次映射为 TEMPLATE_CODE_CONFLICT）
+  TEMPLATE_CODE_CONFLICT: "\u76EE\u6807\u9879\u76EE\u5185\u5DF2\u5B58\u5728\u76F8\u540C code \u7684\u6A21\u677F\uFF08code \u9879\u76EE\u5185\u552F\u4E00\uFF09",
+  TEMPLATE_CODE_IMMUTABLE: "\u6A21\u677F code \u521B\u5EFA\u540E\u4E0D\u53EF\u53D8\uFF08\u5982\u9700\u65B0\u6807\u8BC6\u8BF7\u590D\u5236\u6A21\u677F\u6307\u5B9A\u65B0 code\uFF09",
   // 仅覆盖 404 分支（不存在）；archived 走独立的 409 PROJECT_ARCHIVED，勿在此合并语义
   PROJECT_NOT_FOUND: "\u9879\u76EE\u4E0D\u5B58\u5728",
   AGENT_SKILL_SCOPE_CONFLICT: "Agent \u7ED1\u5B9A\u7684 Skill \u4F5C\u7528\u57DF\u4E0D\u517C\u5BB9\uFF08\u5168\u5C40 Agent \u4EC5\u53EF\u7ED1\u5B9A\u5168\u5C40 Skill\uFF09",
@@ -108,6 +117,8 @@ var BIZ_CODE_MESSAGES = {
   ENUM_ENTRY_IN_USE: "\u679A\u4E3E\u503C\u88AB\u8D44\u6E90\u5F15\u7528\uFF0C\u7981\u6B62\u5220\u9664",
   ENUM_VALUE_CONFLICT: "\u679A\u4E3E\u503C\u5DF2\u5B58\u5728",
   NAME_SCOPE_CONFLICT: "\u8BE5\u4F5C\u7528\u57DF\u5185\u5DF2\u5B58\u5728\u540C\u540D\u8D44\u6E90\uFF08\u5168\u5C40\u8D44\u6E90\u4E0E\u9879\u76EE\u8D44\u6E90\u4E0D\u53EF\u540C\u540D\uFF09",
+  // T202608270002：主文档引用的引用文档删除保护（message 由路由层附加具体 path 清单）
+  REFERENCE_IN_USE: "\u4E3B\u6587\u6863\u4ECD\u5F15\u7528\u5F85\u5220\u9664\u7684\u5F15\u7528\u6587\u6863\uFF0C\u8BF7\u5148\u79FB\u9664\u4E3B\u6587\u6863\u4E2D\u7684\u5F15\u7528\u518D\u5220\u9664",
   TASK_DOC_NOT_SET: "\u4EFB\u52A1\u672A\u5173\u8054\u4EFB\u52A1\u6587\u4EF6",
   TASK_DOC_NOT_FOUND: "\u4EFB\u52A1\u6587\u4EF6\u4E0D\u5B58\u5728",
   TASK_DOC_SECTION_NOT_FOUND: "\u4EFB\u52A1\u6587\u4EF6\u4E2D\u672A\u627E\u5230\u5339\u914D\u6BB5\u843D",
@@ -121,7 +132,28 @@ var BIZ_CODE_MESSAGES = {
   // T202608240003：类型化任务节点路径（创建时剪枝 + 类型×轨道入口校验）
   TASK_PRUNE_GRAPH_INVALID: "\u526A\u679D\u540E DAG \u56FE\u4E0D\u5B8C\u6574\uFF08\u8282\u70B9\u6E05\u5355\u4E0E\u6A21\u677F\u7ED3\u6784\u4E0D\u517C\u5BB9\uFF0C\u89C1\u9519\u8BEF\u8BE6\u60C5\uFF09",
   TASK_SKIP_NODE_NOT_FOUND: "skip \u6E05\u5355\u542B\u6A21\u677F\u4E0D\u5B58\u5728\u7684\u8282\u70B9 id\uFF08\u89C1\u9519\u8BEF\u8BE6\u60C5\u7684\u5408\u6CD5\u8282\u70B9\u6E05\u5355\uFF09",
-  TASK_TYPE_TRACK_MISMATCH: "\u4EFB\u52A1\u7C7B\u578B\u4E0E\u8F68\u9053\u7EC4\u5408\u975E\u6CD5\uFF08research \u8F68\u9053\u4E3A\u8C03\u7814\u7C7B\u578B\u4E13\u7528\u503C\uFF1BUI \u5FAE\u8C03\u4EC5\u9002\u7528 ui \u8F68\u9053\uFF09"
+  TASK_TYPE_TRACK_MISMATCH: "\u4EFB\u52A1\u7C7B\u578B\u4E0E\u8F68\u9053\u7EC4\u5408\u975E\u6CD5\uFF08research \u8F68\u9053\u4E3A\u8C03\u7814\u7C7B\u578B\u4E13\u7528\u503C\uFF1BUI \u5FAE\u8C03\u4EC5\u9002\u7528 ui \u8F68\u9053\uFF09",
+  // T202608290001：停用模板创建任务守卫（资产启停——停用对创建通道同样不可见）
+  TEMPLATE_DISABLED: "\u6A21\u677F\u5DF2\u505C\u7528\uFF0C\u7981\u6B62\u7528\u4E8E\u521B\u5EFA\u4EFB\u52A1\uFF08Web \u7BA1\u7406\u53F0\u53EF\u91CD\u65B0\u542F\u7528\uFF09",
+  // T202608310001：鉴权域（错误响应以 error: bizCode 为机器可判键）
+  AUTH_REQUIRED: "\u9700\u8981\u767B\u5F55\u6216\u914D\u7F6E Token\uFF08Web \u767B\u5F55\uFF1BCLI \u8FD0\u884C siming auth token set \u914D\u7F6E\uFF09",
+  AUTH_TOKEN_INVALID: "Token \u65E0\u6548\u6216\u5DF2\u88AB\u91CD\u7F6E\uFF08Web \u7BA1\u7406\u53F0\u91CD\u65B0\u751F\u6210\u540E\u8FD0\u884C siming auth token set \u66F4\u65B0\uFF09",
+  AUTH_INVALID_CREDENTIALS: "\u8D26\u53F7\u6216\u5BC6\u7801\u9519\u8BEF",
+  AUTH_FORBIDDEN: "\u5F53\u524D\u51ED\u8BC1\u65E0\u6743\u6267\u884C\u6B64\u64CD\u4F5C\uFF08\u9879\u76EE Token \u4EC5\u9650\u672C\u9879\u76EE\u8BFB\u5199\u4E0E\u5168\u5C40\u8D44\u4EA7\u53EA\u8BFB\uFF09",
+  AUTH_ACCOUNT_EXISTS: "\u7BA1\u7406\u5458\u8D26\u53F7\u5DF2\u521D\u59CB\u5316\uFF08\u65E0\u9700\u91CD\u590D\u521B\u5EFA\uFF09",
+  // T202609010002：批量写入域（信封级——空批/超限整批拒绝并提示拆分）
+  BATCH_EMPTY: "\u6279\u91CF\u6761\u76EE\u4E3A\u7A7A\uFF08items \u81F3\u5C11 1 \u6761\uFF09",
+  BATCH_LIMIT_EXCEEDED: "\u5355\u6B21\u6279\u91CF\u4E0A\u9650 50 \u6761\uFF0C\u8BF7\u62C6\u5206\u4E3A\u591A\u6B21\u8C03\u7528",
+  BATCH_PAYLOAD_TOO_LARGE: "\u6279\u91CF\u5168\u6587\u5FEB\u7167\u603B\u91CF\u8D85\u9650\uFF082M \u5B57\u7B26/\u6279\uFF09\uFF0C\u8BF7\u62C6\u5206\u4E3A\u591A\u6B21\u8C03\u7528\u6216\u6539\u7528 path \u5F15\u7528",
+  // T202609020001：通用 DAG 节点资产域
+  NODE_PRESET_CODE_EXISTS: "\u8282\u70B9 code \u5DF2\u5B58\u5728\uFF08code \u5168\u5C40\u552F\u4E00\uFF0C\u8DE8\u4F5C\u7528\u57DF\u4E0D\u53EF\u91CD\u590D\uFF09",
+  NODE_PRESET_CODE_IMMUTABLE: "\u8282\u70B9 code \u521B\u5EFA\u540E\u4E0D\u53EF\u53D8",
+  NODE_PRESET_VERSION_REQUIRED: "\u8282\u70B9\u5185\u5BB9\u53D8\u66F4\u5FC5\u987B\u540C\u6B65\u63D0\u5347\u7248\u672C\u53F7\uFF08version \u5B57\u6BB5\uFF09",
+  TEMPLATE_NODE_ID_DUPLICATE: "\u6A21\u677F\u5185\u8282\u70B9 id \u91CD\u590D\uFF08\u5148\u5728\u8282\u70B9\u5E93\u4E2D\u590D\u5236\u6539\u540D\u6216\u8C03\u6574\u6A21\u677F\u8282\u70B9\u6807\u8BC6\uFF09",
+  NODE_LIBRARY_COMPOSITION_NOT_FOUND: "\u7EC4\u5408\u5B9A\u4E49\u4E0D\u5B58\u5728\uFF08\u591A\u5E93\u540C\u540D\u7EC4\u5408\u9700\u663E\u5F0F\u6307\u5B9A\u6765\u6E90\u5E93\uFF09",
+  UPGRADE_DECISION_REQUIRED: "\u672C\u5730\u5DF2\u4FEE\u6539\u7684\u8282\u70B9\u5FC5\u987B\u663E\u5F0F\u51B3\u7B56\uFF08upgrade/keep/skip\uFF09",
+  UPGRADE_STALE: "\u6A21\u677F\u72B6\u6001\u4E0E\u5347\u7EA7\u8BA1\u5212\u4E0D\u7B26\uFF08\u8BA1\u5212\u540E\u6A21\u677F\u5DF2\u88AB\u7F16\u8F91\uFF09\uFF0C\u8BF7\u91CD\u65B0\u83B7\u53D6\u5347\u7EA7\u8BA1\u5212",
+  FLOW_MANIFEST_INVALID: "\u8282\u70B9\u5E93 manifest \u683C\u5F0F\u6216\u7248\u672C\u4E0D\u652F\u6301"
 };
 var AppError = class extends Error {
 };
@@ -140,8 +172,25 @@ var NotFoundError = class extends AppError {
   statusCode = 404;
   code = "not_found";
   bizCode;
+  /**
+   * T202609020002：not-found 相近候选清单（模板寻址防转录错误——格式合法但不存在的
+   * code/数据库 id，错误信息携带项目内相近模板，转录错误可当场发现）。附加到响应体
+   * 的 candidates 字段；仅模板寻址路由经 withTemplateCandidates 注入（构造后写入故非
+   * readonly——外部读、内部一次写），其余资源 not-found 形态不变。
+   */
+  templateCandidates;
+  withTemplateCandidates(candidates) {
+    this.templateCandidates = candidates;
+    return this;
+  }
   toResponse() {
-    return { error: this.bizCode ?? this.code, message: this.message, resource: this.resource, id: this.id };
+    return {
+      error: this.bizCode ?? this.code,
+      message: this.message,
+      resource: this.resource,
+      id: this.id,
+      ...this.templateCandidates !== void 0 ? { candidates: this.templateCandidates } : {}
+    };
   }
 };
 var BadRequestError = class extends AppError {
@@ -197,10 +246,40 @@ var ValidationError = class extends AppError {
     return { error: this.bizCode ?? this.code, message: this.message, issues: this.issues };
   }
 };
+var UnauthorizedError = class extends AppError {
+  constructor(bizCode) {
+    super(BIZ_CODE_MESSAGES[bizCode]);
+    this.bizCode = bizCode;
+    this.name = "UnauthorizedError";
+  }
+  bizCode;
+  statusCode = 401;
+  code = "unauthorized";
+  toResponse() {
+    return { error: this.bizCode, message: this.message };
+  }
+};
+var ForbiddenError = class extends AppError {
+  statusCode = 403;
+  code = "forbidden";
+  bizCode = "AUTH_FORBIDDEN";
+  constructor() {
+    super(BIZ_CODE_MESSAGES.AUTH_FORBIDDEN);
+    this.name = "ForbiddenError";
+  }
+  toResponse() {
+    return { error: this.bizCode, message: this.message };
+  }
+};
 
 // src/store/repos/skill.repo.ts
 function createSkillRepo(db) {
   const base = createRepo(db.collection("skills"), { nameField: "name" });
+  const listQuery = (cond, opts) => ({
+    ...cond,
+    ...opts?.includeDisabled ? {} : enabledNeFalse(),
+    ...opts?.q ? { name: { $regex: escapeRegExpLiteral(opts.q), $options: "i" } } : {}
+  });
   return {
     ...base,
     async createSkill(data) {
@@ -218,26 +297,34 @@ function createSkillRepo(db) {
       return base.delete(skill.id);
     },
     async updateByNameScoped(name, scope, projectId, patch) {
-      const skill = await this.getByNameScoped(name, scope, projectId);
+      const skill = await this.getByNameScoped(name, scope, projectId, { includeDisabled: true });
       if (!skill || !skill.id) return null;
       return base.update(skill.id, patch);
     },
     async deleteByNameScoped(name, scope, projectId) {
-      const skill = await this.getByNameScoped(name, scope, projectId);
+      const skill = await this.getByNameScoped(name, scope, projectId, { includeDisabled: true });
       if (!skill || !skill.id) return false;
       return base.delete(skill.id);
     },
-    async getByNameScoped(name, scope, projectId) {
+    async getByNameScoped(name, scope, projectId, opts) {
       const doc = await base._collection.findOne(
-        scope === "project" ? { name, scope: "project", projectId } : { name, scope: "global" }
+        listQuery(
+          scope === "project" ? { name, scope: "project", projectId } : { name, scope: "global" },
+          opts
+        )
       );
       return doc ? toEntity(doc) : null;
     },
-    async listSkillsByScope(projectId) {
-      return base.list({ $or: [{ scope: "global" }, { scope: "project", projectId }] });
+    async listSkillsByScope(projectId, opts) {
+      return base.list(listQuery({ $or: [{ scope: "global" }, { scope: "project", projectId }] }, opts));
+    },
+    async listSkillsByScopeFilter(scope, projectId, opts) {
+      return base.list(
+        listQuery(scope === "project" ? { scope: "project", projectId } : { scope: "global" }, opts)
+      );
     },
-    async listSkillsByScopeFilter(scope, projectId) {
-      return base.list(scope === "project" ? { scope: "project", projectId } : { scope: "global" });
+    async listSkills(opts) {
+      return base.list(listQuery({}, opts));
     },
     async listSkillsByNames(names, scope, projectId) {
       if (names.length === 0) return /* @__PURE__ */ new Map();
@@ -245,6 +332,12 @@ function createSkillRepo(db) {
       const skills = await base.list(filter);
       return new Map(skills.map((s) => [s.name, s]));
     },
+    async hasNameScopeConflict(name, scope) {
+      return await base._collection.countDocuments(
+        scope === "global" ? { name, scope: "project" } : { name, scope: "global" },
+        { limit: 1 }
+      ) > 0;
+    },
     async copySkill(sourceName, source, target, newName) {
       const src = await base._collection.findOne(
         source.scope === "project" ? { name: sourceName, scope: "project", projectId: source.projectId } : { name: sourceName, scope: "global" }
@@ -261,7 +354,7 @@ function createSkillRepo(db) {
         throw new ConflictError("skill", `name already exists: ${newName}`);
       }
       await assertNameScopeAvailable(base._collection, newName, target.scope, target.projectId);
-      const { id: _sourceId, createdAt: _ca, updatedAt: _ua, projectId: _sourceProjectId, scope: _sourceScope, ...rest } = sourceEntity;
+      const { id: _sourceId, createdAt: _ca, updatedAt: _ua, projectId: _sourceProjectId, scope: _sourceScope, enabled: _sourceEnabled, ...rest } = sourceEntity;
       const copy = {
         ...JSON.parse(JSON.stringify(rest)),
         name: newName,
@@ -285,7 +378,31 @@ async function assertNameScopeAvailable(collection, name, scope, projectId) {
 
 // src/store/repos/agent.repo.ts
 function createAgentRepo(db) {
-  const base = createRepo(db.collection("agents"), { nameField: "name" });
+  const raw = createRepo(db.collection("agents"), { nameField: "name" });
+  const normalizeFunction = (agent) => ({ ...agent, "function": agent["function"] ?? "executor" });
+  const base = {
+    ...raw,
+    async list(filter = void 0) {
+      return (await raw.list(filter)).map(normalizeFunction);
+    },
+    async getById(id) {
+      const agent = await raw.getById(id);
+      return agent ? normalizeFunction(agent) : null;
+    },
+    async getByName(name) {
+      const agent = await raw.getByName(name);
+      return agent ? normalizeFunction(agent) : null;
+    },
+    async update(id, patch) {
+      const agent = await raw.update(id, patch);
+      return agent ? normalizeFunction(agent) : null;
+    }
+  };
+  const listQuery = (cond, opts) => ({
+    ...cond,
+    ...opts?.includeDisabled ? {} : enabledNeFalse(),
+    ...opts?.q ? { name: { $regex: escapeRegExpLiteral(opts.q), $options: "i" } } : {}
+  });
   return {
     ...base,
     async createAgent(data) {
@@ -303,26 +420,40 @@ function createAgentRepo(db) {
       return base.delete(agent.id);
     },
     async updateByNameScoped(name, scope, projectId, patch) {
-      const agent = await this.getByNameScoped(name, scope, projectId);
+      const agent = await this.getByNameScoped(name, scope, projectId, { includeDisabled: true });
       if (!agent || !agent.id) return null;
       return base.update(agent.id, patch);
     },
     async deleteByNameScoped(name, scope, projectId) {
-      const agent = await this.getByNameScoped(name, scope, projectId);
+      const agent = await this.getByNameScoped(name, scope, projectId, { includeDisabled: true });
       if (!agent || !agent.id) return false;
       return base.delete(agent.id);
     },
-    async getByNameScoped(name, scope, projectId) {
+    async getByNameScoped(name, scope, projectId, opts) {
       const doc = await base._collection.findOne(
-        scope === "project" ? { name, scope: "project", projectId } : { name, scope: "global" }
+        listQuery(
+          scope === "project" ? { name, scope: "project", projectId } : { name, scope: "global" },
+          opts
+        )
       );
-      return doc ? toEntity(doc) : null;
+      return doc ? normalizeFunction(toEntity(doc)) : null;
     },
-    async listAgentsByScope(projectId) {
-      return base.list({ $or: [{ scope: "global" }, { scope: "project", projectId }] });
+    async listAgentsByScope(projectId, opts) {
+      return base.list(listQuery({ $or: [{ scope: "global" }, { scope: "project", projectId }] }, opts));
     },
-    async listAgentsByScopeFilter(scope, projectId) {
-      return base.list(scope === "project" ? { scope: "project", projectId } : { scope: "global" });
+    async listAgentsByScopeFilter(scope, projectId, opts) {
+      return base.list(
+        listQuery(scope === "project" ? { scope: "project", projectId } : { scope: "global" }, opts)
+      );
+    },
+    async listAgents(opts) {
+      return base.list(listQuery({}, opts));
+    },
+    async hasNameScopeConflict(name, scope) {
+      return await base._collection.countDocuments(
+        scope === "global" ? { name, scope: "project" } : { name, scope: "global" },
+        { limit: 1 }
+      ) > 0;
     },
     async copyAgent(sourceName, source, target, newName, skillRepo) {
       const src = await base._collection.findOne(
@@ -331,7 +462,7 @@ function createAgentRepo(db) {
       if (!src) {
         throw new ConflictError("agent", `copy source not found: ${sourceName}`);
       }
-      const sourceEntity = toEntity(src);
+      const sourceEntity = normalizeFunction(toEntity(src));
       const sameScopeDup = await base._collection.findOne(
         target.scope === "project" ? { name: newName, scope: "project", projectId: target.projectId } : { name: newName, scope: "global" },
         { projection: { _id: 1 } }
@@ -341,7 +472,7 @@ function createAgentRepo(db) {
       }
       await assertNameScopeAvailable2(base._collection, newName, target.scope, target.projectId);
       await assertBoundSkillsCompatible(skillRepo, target.scope, target.projectId, src.boundSkills ?? []);
-      const { id: _sourceId, createdAt: _ca, updatedAt: _ua, projectId: _sourceProjectId, scope: _sourceScope, ...rest } = sourceEntity;
+      const { id: _sourceId, createdAt: _ca, updatedAt: _ua, projectId: _sourceProjectId, scope: _sourceScope, enabled: _sourceEnabled, ...rest } = sourceEntity;
       const copy = {
         ...JSON.parse(JSON.stringify(rest)),
         name: newName,
@@ -380,51 +511,123 @@ async function assertBoundSkillsCompatible(skillRepo, agentScope, agentProjectId
   }
 }
 
-// src/store/repos/dag-template.repo.ts
-function createDagTemplateRepo(db) {
-  const base = createRepo(db.collection("dag_templates"));
-  return {
-    ...base,
-    createDagTemplate(data) {
-      return base.create(data);
-    },
-    async listDagTemplates(filter) {
-      const query = {};
-      if (filter?.projectId) query.projectId = filter.projectId;
-      if (filter?.name) query.name = filter.name;
-      return base.list(query);
-    },
-    async copyDagTemplate(sourceId, targetProjectId, newName) {
-      const source = await base.getById(sourceId);
-      if (!source) {
-        throw new ConflictError("dagTemplate", `copy source not found: ${sourceId}`);
+// src/schemas/dag-template.ts
+import { z as z3 } from "zod";
+
+// src/schemas/skill.ts
+import { z as z2 } from "zod";
+
+// src/schemas/reference.ts
+import { z } from "zod";
+var REFERENCE_LIMITS = {
+  /** 单资产引用文档数量上限 */
+  maxCount: 20,
+  /** 单引用文档内容字符数上限 */
+  maxContentChars: 1e6,
+  /** 聚合护栏：主文档正文 + Σ引用文档内容的字符总量上限 */
+  maxTotalChars: 3e6
+};
+var SKILL_MAIN_DOC = "SKILL.md";
+var AGENT_MAIN_DOC = "agent.md";
+var ReferenceDocBaseSchema = z.object({
+  /** 相对资产根的相对路径（正斜杠分隔；禁止绝对路径 / .. 回溯 / 反斜杠 / 空段 / 主文档名冲突） */
+  path: z.string().min(1),
+  /** 文档全文（空文档合法） */
+  content: z.string().max(REFERENCE_LIMITS.maxContentChars)
+});
+function canonicalizeReferencePath(path) {
+  return path.split("/").filter((segment) => segment !== ".").join("/").toLowerCase();
+}
+function sumReferenceContentChars(references) {
+  return (references ?? []).reduce((total, doc) => total + doc.content.length, 0);
+}
+function createReferencesSchema(mainDocName) {
+  const elementSchema = ReferenceDocBaseSchema.superRefine((val, ctx) => {
+    const path = val.path;
+    let reason = null;
+    if (path.startsWith("/")) {
+      reason = "\u7981\u6B62\u7EDD\u5BF9\u8DEF\u5F84";
+    } else if (path.includes("\\")) {
+      reason = "\u7981\u6B62\u53CD\u659C\u6760\u8DEF\u5F84\u5206\u9694\u7B26\uFF08\u987B\u4F7F\u7528\u6B63\u659C\u6760 /\uFF09";
+    } else {
+      const rawSegments = path.split("/");
+      if (rawSegments.some((segment) => segment === "")) {
+        reason = "\u7981\u6B62\u7A7A\u8DEF\u5F84\u6BB5\uFF08\u8FDE\u7EED\u6216\u5C3E\u968F\u659C\u6760\uFF09";
+      } else if (rawSegments.includes("..")) {
+        reason = "\u7981\u6B62\u8D8A\u754C\u56DE\u6EAF\uFF08.. \u8DEF\u5F84\u6BB5\uFF09";
+      } else if (canonicalizeReferencePath(path).length === 0) {
+        reason = '\u8DEF\u5F84\u4E0D\u80FD\u53EA\u7531 "." \u7EC4\u6210';
+      } else if (canonicalizeReferencePath(path) === canonicalizeReferencePath(mainDocName)) {
+        reason = `\u4E0E\u4E3B\u6587\u6863\u6587\u4EF6\u540D ${mainDocName} \u51B2\u7A81`;
       }
-      const dup = await base._collection.findOne(
-        { projectId: targetProjectId, name: newName },
-        { projection: { _id: 1 } }
-      );
-      if (dup) {
-        throw new ConflictError("dagTemplate", `name conflict in target project: ${newName}`);
+    }
+    if (reason !== null) {
+      ctx.addIssue({ code: "custom", path: ["path"], message: `${reason}\uFF1A${path}` });
+    }
+  });
+  return z.array(elementSchema).max(REFERENCE_LIMITS.maxCount).superRefine((docs, ctx) => {
+    const seen = /* @__PURE__ */ new Map();
+    docs.forEach((doc, index) => {
+      const canonical = canonicalizeReferencePath(doc.path);
+      const firstIndex = seen.get(canonical);
+      if (firstIndex !== void 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: [index],
+          message: `\u5F15\u7528\u6587\u6863\u8DEF\u5F84\u91CD\u590D\uFF08\u4E0E\u7B2C ${firstIndex + 1} \u6761\u89C4\u8303\u5316\u540E\u76F8\u540C\uFF09\uFF1A${doc.path}`
+        });
+        return;
+      }
+      seen.set(canonical, index);
+    });
+    const entries = docs.map((doc, index) => ({ canonical: canonicalizeReferencePath(doc.path), index }));
+    for (const a of entries) {
+      for (const b of entries) {
+        if (a.index >= b.index) continue;
+        if (isDirectoryPrefix(a.canonical, b.canonical) || isDirectoryPrefix(b.canonical, a.canonical)) {
+          ctx.addIssue({
+            code: "custom",
+            path: [b.index],
+            message: `\u5F15\u7528\u6587\u6863\u8DEF\u5F84\u4E92\u4E3A\u76EE\u5F55\u524D\u7F00\uFF08\u843D\u76D8\u65F6\u6587\u4EF6\u4E0E\u76EE\u5F55\u51B2\u7A81\uFF09\uFF1A${docs[a.index]?.path ?? "?"} \u4E0E ${docs[b.index]?.path ?? "?"}`
+          });
+        }
       }
-      const { id: _sourceId, createdAt: _ca, updatedAt: _ua, ...rest } = source;
-      const copy = {
-        ...rest,
-        name: newName,
-        projectId: targetProjectId,
-        isDefault: false,
-        version: "1.0.0"
-      };
-      return base.create(copy);
     }
-  };
+  });
+}
+function isDirectoryPrefix(prefixCanonical, candidateCanonical) {
+  if (prefixCanonical.length >= candidateCanonical.length) return false;
+  if (!candidateCanonical.startsWith(prefixCanonical)) return false;
+  return candidateCanonical.charAt(prefixCanonical.length) === "/";
+}
+function assertReferencesDeletable(params) {
+  const { resource, name, existingReferences, nextReferences, nextMainBody, currentMainBody } = params;
+  if (nextReferences === void 0) return;
+  const nextPaths = new Set(nextReferences.map((doc) => doc.path));
+  const deletedPaths = (existingReferences ?? []).map((doc) => doc.path).filter((path) => !nextPaths.has(path));
+  if (deletedPaths.length === 0) return;
+  const mainBody = nextMainBody ?? currentMainBody;
+  const violating = deletedPaths.filter((path) => mainBody.includes(path));
+  if (violating.length === 0) return;
+  throw new ConflictError(resource, name, {
+    bizCode: "REFERENCE_IN_USE",
+    message: `${BIZ_CODE_MESSAGES.REFERENCE_IN_USE}\uFF08${resource} ${name}\uFF09\uFF1A${violating.join("\u3001")}`
+  });
+}
+function assertReferenceAggregateLimit(params) {
+  const { effectiveMainBody, nextReferences } = params;
+  if (nextReferences === void 0) return;
+  const totalChars = effectiveMainBody.length + sumReferenceContentChars(nextReferences);
+  if (totalChars > REFERENCE_LIMITS.maxTotalChars) {
+    throw new ValidationError(
+      `\u4E3B\u6587\u6863\u4E0E\u5F15\u7528\u6587\u6863\u5185\u5BB9\u603B\u91CF ${String(totalChars)} \u5B57\u7B26\u8D85\u51FA\u805A\u5408\u4E0A\u9650 ${String(REFERENCE_LIMITS.maxTotalChars)}\uFF08\u542B\u5E93\u5185\u73B0\u6709\u4E3B\u6587\u6863\u6B63\u6587\u5408\u5E76\u8BA1\u7B97\uFF09`,
+      [{ path: ["references"], message: `\u603B\u91CF ${String(totalChars)} \u8D85\u51FA\u4E0A\u9650 ${String(REFERENCE_LIMITS.maxTotalChars)}` }]
+    );
+  }
 }
-
-// src/schemas/task.ts
-import { z as z3 } from "zod";
 
 // src/schemas/skill.ts
-import { z } from "zod";
-var SkillScopeSchema = z.enum(["global", "project"]);
+var SkillScopeSchema = z2.enum(["global", "project"]);
 var OBJECT_ID_HEX = /^[a-f0-9]{24}$/;
 var SkillScopeRefine = (val, ctx) => {
   if (val.scope === "project" && !val.projectId) {
@@ -435,38 +638,59 @@ var SkillScopeRefine = (val, ctx) => {
     });
   }
 };
-var SkillShapeSchema = z.object({
-  id: z.string().optional(),
-  name: z.string().regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "kebab-case only"),
-  description: z.string(),
-  content: z.string(),
-  category: z.string(),
-  version: z.string().default("1.0.0"),
+var SkillShapeSchema = z2.object({
+  id: z2.string().optional(),
+  name: z2.string().regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "kebab-case only"),
+  description: z2.string(),
+  content: z2.string(),
+  category: z2.string(),
+  version: z2.string().default("1.0.0"),
+  /** 引用文档集合（可选——存量单文件资产无此字段，行为与升级前一致） */
+  references: createReferencesSchema(SKILL_MAIN_DOC).optional(),
   /** 作用域：global=跨项目复用（默认，仅作存量迁移读侧兜底）/ project=项目专用（N012 D3） */
   scope: SkillScopeSchema.default("global"),
   /** 仅 scope=project 时必填且为合法 ObjectId hex（superRefine 保证） */
-  projectId: z.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional(),
-  createdAt: z.date().optional(),
-  updatedAt: z.date().optional()
+  projectId: z2.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional(),
+  /**
+   * T202608290001 资产启停（可选——存量无此字段 = 启用，零迁移）。
+   * 全局判断规则：enabled === false 即停用，true/缺失均启用。
+   * 唯一写入口是专用启停端点（POST /:name/enabled）——Create/Update/Copy 均不含此字段
+   * （规避 Zod4 .partial() default 注入 + 启停不触发版本提升）。
+   */
+  enabled: z2.boolean().optional(),
+  createdAt: z2.date().optional(),
+  updatedAt: z2.date().optional()
 });
-var SkillSchema = SkillShapeSchema.superRefine(SkillScopeRefine);
+var skillAggregateLimitRefine = (val, ctx) => {
+  const totalChars = (val.content?.length ?? 0) + sumReferenceContentChars(val.references);
+  if (totalChars > REFERENCE_LIMITS.maxTotalChars) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["references"],
+      message: `\u4E3B\u6587\u6863\u4E0E\u5F15\u7528\u6587\u6863\u5185\u5BB9\u603B\u91CF ${totalChars} \u5B57\u7B26\u8D85\u51FA\u805A\u5408\u4E0A\u9650 ${REFERENCE_LIMITS.maxTotalChars}`
+    });
+  }
+};
+var SkillSchema = SkillShapeSchema.superRefine(SkillScopeRefine).superRefine(skillAggregateLimitRefine);
 var SkillCreateSchema = SkillShapeSchema.omit({
   id: true,
   createdAt: true,
-  updatedAt: true
-}).extend({ scope: SkillScopeSchema }).superRefine(SkillScopeRefine);
+  updatedAt: true,
+  enabled: true
+}).extend({ scope: SkillScopeSchema }).superRefine(SkillScopeRefine).superRefine(skillAggregateLimitRefine);
 var SkillUpdateSchema = SkillShapeSchema.omit({
   id: true,
   createdAt: true,
-  updatedAt: true
+  updatedAt: true,
+  enabled: true
 }).extend({
-  version: z.string().optional(),
+  version: z2.string().optional(),
   scope: SkillScopeSchema.optional()
-}).partial().superRefine(SkillScopeRefine);
-var SkillCopySchema = z.object({
-  newName: z.string().regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "kebab-case only"),
+}).partial().superRefine(SkillScopeRefine).superRefine(skillAggregateLimitRefine);
+var SkillCopySchema = z2.object({
+  newName: z2.string().regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "kebab-case only"),
   newScope: SkillScopeSchema,
-  targetProjectId: z.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional()
+  targetProjectId: z2.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional()
 }).superRefine((val, ctx) => {
   if (val.newScope === "project" && !val.targetProjectId) {
     ctx.addIssue({
@@ -478,26 +702,44 @@ var SkillCopySchema = z.object({
 });
 
 // src/schemas/dag-template.ts
-import { z as z2 } from "zod";
-var DagNodePhaseSchema = z2.string();
-var DagNodeTrackSchema = z2.string();
+var DagNodePhaseSchema = z3.string();
+var DagNodeTrackSchema = z3.string();
 var DAG_PHASES = ["entry", "track", "test", "exit"];
 var DAG_TRACKS = ["backend", "ui", "all"];
 var NODE_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
-var DagNodeSchema = z2.object({
-  id: z2.string().regex(NODE_ID_PATTERN, "node id \u53EA\u5141\u8BB8\u5B57\u6BCD/\u6570\u5B57/\u4E0B\u5212\u7EBF/\u8FDE\u5B57\u7B26\uFF08\u70B9\u8DEF\u5F84\u62FC\u63A5\u5B89\u5168\u524D\u63D0\uFF09"),
-  label: z2.string(),
+var capabilityNamesSchema = z3.array(z3.string().min(1)).superRefine((names, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  names.forEach((name, index) => {
+    if (seen.has(name)) {
+      ctx.addIssue({ code: "custom", path: [index], message: `\u540D\u79F0\u91CD\u590D\uFF1A${name}` });
+    }
+    seen.add(name);
+  });
+});
+var SourcePresetSchema = z3.object({
+  code: z3.string().min(1),
+  version: z3.string(),
+  contentHash: z3.string(),
+  /** Agent 名称独立基线；不改变既有 contentHash 算法，存量缺键按空清单比较 */
+  agents: capabilityNamesSchema.optional()
+});
+var DagNodeSchema = z3.object({
+  id: z3.string().regex(NODE_ID_PATTERN, "node id \u53EA\u5141\u8BB8\u5B57\u6BCD/\u6570\u5B57/\u4E0B\u5212\u7EBF/\u8FDE\u5B57\u7B26\uFF08\u70B9\u8DEF\u5F84\u62FC\u63A5\u5B89\u5168\u524D\u63D0\uFF09"),
+  label: z3.string(),
   phase: DagNodePhaseSchema,
   track: DagNodeTrackSchema,
-  prompt: z2.string(),
-  skills: z2.array(z2.string()).default([])
+  prompt: z3.string(),
+  skills: capabilityNamesSchema.default([]),
+  /** 存量模板允许缺键；新组装和任务实例化路径写入完整数组 */
+  agents: capabilityNamesSchema.optional(),
+  sourcePreset: SourcePresetSchema.optional()
 });
-var PausePointTypeSchema = z2.enum(["human_approval", "checkpoint"]);
+var PausePointTypeSchema = z3.enum(["human_approval", "checkpoint"]);
 var PAUSE_POINT_TYPES = ["human_approval", "checkpoint"];
-var EdgePausePointBaseSchema = z2.object({
+var EdgePausePointBaseSchema = z3.object({
   type: PausePointTypeSchema,
-  description: z2.string(),
-  autoResume: z2.boolean().default(false)
+  description: z3.string(),
+  autoResume: z3.boolean().default(false)
 });
 var EdgePausePointSchema = EdgePausePointBaseSchema.superRefine((pp, ctx) => {
   if (pp.type === "human_approval" && pp.autoResume) {
@@ -513,152 +755,394 @@ var EdgePausePointSchema = EdgePausePointBaseSchema.superRefine((pp, ctx) => {
     });
   }
 });
-var DagEdgeSchema = z2.object({
-  from: z2.string(),
-  to: z2.string(),
-  condition: z2.string().optional(),
+var TEMPLATE_CODE_REGEX = /^[a-z0-9]+(-[a-z0-9]+)+$/;
+var TEMPLATE_CODE_MAX_LENGTH = 31;
+var TemplateCodeFieldSchema = z3.string().max(TEMPLATE_CODE_MAX_LENGTH).regex(TEMPLATE_CODE_REGEX, "code \u5FC5\u987B\u4E3A kebab-case \u4E14\u81F3\u5C11\u542B\u4E00\u4E2A\u8FDE\u5B57\u7B26\u6BB5\uFF08\u5982 full-workflow\uFF09\uFF0C\u4E0D\u53EF\u4E0E\u6570\u636E\u5E93 id \u5F62\u6001\u6DF7\u6DC6");
+var TemplateCandidateSchema = z3.object({
+  id: z3.string(),
+  code: z3.string(),
+  name: z3.string()
+});
+var DagEdgeSchema = z3.object({
+  from: z3.string(),
+  to: z3.string(),
+  condition: z3.string().optional(),
   /** N017 D1：边暂停点（可选）。human_approval=人工审批门（advance 落 paused 等 approve）；checkpoint=检查点（仅记录直接流转） */
   pausePoint: EdgePausePointSchema.optional()
 });
-var DagTemplateSchema = z2.object({
-  id: z2.string().optional(),
-  name: z2.string(),
+var DagTemplateSchema = z3.object({
+  id: z3.string().optional(),
+  name: z3.string(),
   /** 归属项目 id（N012：实体层去哨兵 default，由路由层解析写入——校验项目存在且 active 后落库） */
-  projectId: z2.string(),
-  description: z2.string(),
-  nodes: z2.array(DagNodeSchema),
-  edges: z2.array(DagEdgeSchema),
+  projectId: z3.string(),
+  description: z3.string(),
+  /**
+   * T202609020002 业务 code（可选——存量迁移前的模板无此字段，由启动迁移补齐）。
+   * 项目内唯一（{projectId, code} 复合唯一索引，迁移后建）、创建后不可变；
+   * name 仍承担展示职责（可改、可中文）——职责分离，改名不影响 code 引用。
+   */
+  code: TemplateCodeFieldSchema.optional(),
+  nodes: z3.array(DagNodeSchema),
+  edges: z3.array(DagEdgeSchema),
   /** UI 布局坐标（nodeId → {x,y}）。UI 关注点，advance 引擎零感知；旧模板无此字段 → 前端 dagre 兜底布局（N008 D2） */
-  layout: z2.record(z2.string(), z2.object({ x: z2.number(), y: z2.number() })).optional(),
-  isDefault: z2.boolean().default(false),
-  version: z2.string().default("1.0.0"),
-  createdAt: z2.date().optional(),
-  updatedAt: z2.date().optional()
+  layout: z3.record(z3.string(), z3.object({ x: z3.number(), y: z3.number() })).optional(),
+  isDefault: z3.boolean().default(false),
+  version: z3.string().default("1.0.0"),
+  /**
+   * T202608290001 资产启停（可选——存量无此字段 = 启用，零迁移）。
+   * 全局判断规则：enabled === false 即停用，true/缺失均启用。
+   * 唯一写入口是专用启停端点（POST /:id/enabled）——Create/Update/Copy 均不含此字段；
+   * 停用模板对 CLI/MCP 列举与任务创建入口不可见（Web 管理台始终可见可重启）。
+   */
+  enabled: z3.boolean().optional(),
+  createdAt: z3.date().optional(),
+  updatedAt: z3.date().optional()
 });
 var DagTemplateCreateSchema = DagTemplateSchema.omit({
   id: true,
   createdAt: true,
-  updatedAt: true
+  updatedAt: true,
+  enabled: true
 });
 var DagTemplateUpdateSchema = DagTemplateCreateSchema.extend({
-  isDefault: z2.boolean().optional(),
-  version: z2.string().optional()
+  isDefault: z3.boolean().optional(),
+  version: z3.string().optional()
 }).partial();
-var DagTemplateCopySchema = z2.object({
-  newName: z2.string().min(1),
-  targetProjectId: z2.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex")
+var DagTemplateCopySchema = z3.object({
+  newName: z3.string().min(1),
+  targetProjectId: z3.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex"),
+  newCode: TemplateCodeFieldSchema.optional()
 });
+function findDuplicateNodeIds(nodes) {
+  const seen = /* @__PURE__ */ new Set();
+  const duplicated = /* @__PURE__ */ new Set();
+  for (const node of nodes) {
+    if (seen.has(node.id)) duplicated.add(node.id);
+    seen.add(node.id);
+  }
+  return [...duplicated];
+}
+function assertUniqueNodeIds(nodes) {
+  const duplicated = findDuplicateNodeIds(nodes);
+  if (duplicated.length > 0) {
+    throw new ValidationError(
+      `\u6A21\u677F\u8282\u70B9 id \u91CD\u590D\uFF1A${duplicated.join(", ")}`,
+      duplicated.map((id) => ({ path: ["nodes"], message: `\u8282\u70B9 id "${id}" \u5728\u6A21\u677F\u5185\u91CD\u590D` })),
+      {
+        bizCode: "TEMPLATE_NODE_ID_DUPLICATE",
+        message: `${BIZ_CODE_MESSAGES.TEMPLATE_NODE_ID_DUPLICATE}\uFF1A${duplicated.join(", ")}`
+      }
+    );
+  }
+}
+
+// src/store/repos/dag-template.repo.ts
+function normalizeNameToTemplateCode(name) {
+  const folded = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return folded.slice(0, TEMPLATE_CODE_MAX_LENGTH);
+}
+function isLegalTemplateCode(code) {
+  return code.length <= TEMPLATE_CODE_MAX_LENGTH && TEMPLATE_CODE_REGEX.test(code);
+}
+function buildTemplateCode(seedName, takenCodes) {
+  const taken = new Set(takenCodes);
+  const base = normalizeNameToTemplateCode(seedName);
+  let primary;
+  if (base === "") {
+    primary = "tpl-1";
+  } else if (isLegalTemplateCode(base)) {
+    primary = base;
+  } else {
+    primary = `tpl-${base}`.slice(0, TEMPLATE_CODE_MAX_LENGTH);
+  }
+  let candidate = primary;
+  let n = 1;
+  while (taken.has(candidate) || !isLegalTemplateCode(candidate)) {
+    n += 1;
+    const suffix = `-${n}`;
+    candidate = `${primary.slice(0, TEMPLATE_CODE_MAX_LENGTH - suffix.length)}${suffix}`;
+  }
+  return candidate;
+}
+function levenshtein(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(prev[j - 1] + cost, curr[j - 1] + 1, prev[j] + 1);
+    }
+    prev = curr;
+  }
+  return prev[n];
+}
+function scoreTemplateCandidate(ref, tpl) {
+  const refLower = ref.toLowerCase();
+  if (tpl.name === ref) return 100;
+  const code = tpl.code?.toLowerCase();
+  if (code === refLower) return 100;
+  if (code !== void 0) {
+    if (code.startsWith(refLower) || refLower.startsWith(code)) return 80;
+    if (levenshtein(code, refLower) <= 2) return 60;
+  }
+  const nameLower = tpl.name.toLowerCase();
+  if (nameLower.startsWith(refLower) || refLower.startsWith(nameLower)) return 70;
+  if (nameLower.includes(refLower) || refLower.includes(nameLower)) return 65;
+  if (tpl.id !== void 0 && ref.length === 24 && levenshtein(tpl.id, ref) <= 2) return 50;
+  if (levenshtein(nameLower, refLower) <= 2) return 40;
+  return null;
+}
+var OBJECT_ID_HEX_RE = /^[a-f0-9]{24}$/;
+function dupKeyViolation(e) {
+  if (typeof e !== "object" || e === null) return null;
+  if (!("code" in e && e.code === 11e3)) return null;
+  const kv = e.keyValue;
+  return typeof kv === "object" && kv !== null ? kv : null;
+}
+function createDagTemplateRepo(db) {
+  const base = createRepo(db.collection("dag_templates"));
+  const listProjectCodes = async (projectId) => {
+    const docs = await base._collection.find({ projectId }, { projection: { code: 1 } }).toArray();
+    return docs.map((d) => typeof d.code === "string" ? d.code : "").filter((c) => c !== "");
+  };
+  const getByCode = async (projectId, code) => {
+    const doc = await base._collection.findOne({ projectId, code });
+    return doc ? toEntity(doc) : null;
+  };
+  return {
+    ...base,
+    async createDagTemplate(data) {
+      const payload = { ...data };
+      if (payload.code === void 0) {
+        payload.code = buildTemplateCode(data.name, await listProjectCodes(data.projectId));
+      }
+      try {
+        return await base.create(payload);
+      } catch (e) {
+        const kv = dupKeyViolation(e);
+        if (kv !== null && "code" in kv) {
+          throw new ConflictError("dag-template", `code conflict: ${String(kv.code)}`, {
+            bizCode: "TEMPLATE_CODE_CONFLICT",
+            message: BIZ_CODE_MESSAGES.TEMPLATE_CODE_CONFLICT
+          });
+        }
+        if (kv !== null && "name" in kv) {
+          throw new ConflictError("dag-template", `name conflict: ${String(kv.name)}`, {
+            bizCode: "TEMPLATE_NAME_CONFLICT",
+            message: BIZ_CODE_MESSAGES.TEMPLATE_NAME_CONFLICT
+          });
+        }
+        throw e;
+      }
+    },
+    async listDagTemplates(filter) {
+      const query = {};
+      if (filter?.projectId) query.projectId = filter.projectId;
+      if (filter?.name) query.name = filter.name;
+      if (filter?.code) query.code = filter.code;
+      if (!filter?.includeDisabled) Object.assign(query, enabledNeFalse());
+      return base.list(query);
+    },
+    async copyDagTemplate(sourceId, targetProjectId, newName, newCode) {
+      const source = await base.getById(sourceId);
+      if (!source) {
+        throw new ConflictError("dagTemplate", `copy source not found: ${sourceId}`);
+      }
+      const dup = await base._collection.findOne(
+        { projectId: targetProjectId, name: newName },
+        { projection: { _id: 1 } }
+      );
+      if (dup) {
+        throw new ConflictError("dagTemplate", `name conflict in target project: ${newName}`, {
+          bizCode: "TEMPLATE_NAME_CONFLICT",
+          message: BIZ_CODE_MESSAGES.TEMPLATE_NAME_CONFLICT
+        });
+      }
+      if (newCode !== void 0) {
+        const dupCode = await base._collection.findOne(
+          { projectId: targetProjectId, code: newCode },
+          { projection: { _id: 1, name: 1 } }
+        );
+        if (dupCode) {
+          throw new ConflictError("dagTemplate", `code conflict in target project: ${newCode}`, {
+            bizCode: "TEMPLATE_CODE_CONFLICT",
+            message: `${BIZ_CODE_MESSAGES.TEMPLATE_CODE_CONFLICT}\uFF08\u51B2\u7A81\u6A21\u677F\uFF1A${String(dupCode.name)}\uFF09`
+          });
+        }
+      }
+      const code = newCode ?? buildTemplateCode(newName, await listProjectCodes(targetProjectId));
+      const { id: _sourceId, createdAt: _ca, updatedAt: _ua, enabled: _sourceEnabled, code: _sourceCode, ...rest } = source;
+      const copy = {
+        ...rest,
+        name: newName,
+        code,
+        projectId: targetProjectId,
+        isDefault: false,
+        version: "1.0.0"
+      };
+      try {
+        return await base.create(copy);
+      } catch (e) {
+        const kv = dupKeyViolation(e);
+        if (kv !== null && "code" in kv) {
+          throw new ConflictError("dag-template", `code conflict: ${String(kv.code)}`, {
+            bizCode: "TEMPLATE_CODE_CONFLICT",
+            message: BIZ_CODE_MESSAGES.TEMPLATE_CODE_CONFLICT
+          });
+        }
+        if (kv !== null && "name" in kv) {
+          throw new ConflictError("dag-template", `name conflict: ${String(kv.name)}`, {
+            bizCode: "TEMPLATE_NAME_CONFLICT",
+            message: BIZ_CODE_MESSAGES.TEMPLATE_NAME_CONFLICT
+          });
+        }
+        throw e;
+      }
+    },
+    async getByCode(projectId, code) {
+      return getByCode(projectId, code);
+    },
+    async resolveTemplateByRef(ref, projectCtx) {
+      if (OBJECT_ID_HEX_RE.test(ref)) {
+        const byId = await base.getById(ref);
+        if (byId) return byId;
+      }
+      if (projectCtx !== void 0 && !OBJECT_ID_HEX_RE.test(ref)) {
+        return getByCode(projectCtx, ref);
+      }
+      return null;
+    },
+    async findSimilarTemplates(projectId, ref, limit = 5) {
+      const docs = await base._collection.find({ projectId }, { projection: { _id: 1, code: 1, name: 1 } }).toArray();
+      const scored = docs.map((d) => {
+        const id = d._id.toString();
+        const code = typeof d.code === "string" ? d.code : "";
+        const name = typeof d.name === "string" ? d.name : "";
+        const score = scoreTemplateCandidate(ref, { id, ...code !== "" ? { code } : {}, name });
+        return score === null ? null : { score, candidate: { id, code, name } };
+      }).filter((x) => x !== null).sort((a, b) => b.score - a.score).slice(0, limit);
+      return scored.map((x) => x.candidate);
+    }
+  };
+}
 
 // src/schemas/task.ts
+import { z as z4 } from "zod";
 var TASK_TYPES = ["feature", "bugfix", "ui-tweak", "research"];
 var ENTRY_ID_REGEX = /^[a-z0-9]{6}$/;
-var CheckItemSchema = z3.object({
-  id: z3.string().regex(ENTRY_ID_REGEX),
-  item: z3.string().min(1),
-  passed: z3.boolean()
+var CheckItemSchema = z4.object({
+  id: z4.string().regex(ENTRY_ID_REGEX),
+  item: z4.string().min(1),
+  passed: z4.boolean()
 });
 var ARTIFACT_TYPES = ["prd", "tech", "code", "test", "doc", "other"];
-var ArtifactSchema = z3.object({
-  id: z3.string().regex(ENTRY_ID_REGEX),
-  type: z3.enum(ARTIFACT_TYPES),
-  path: z3.string().min(1),
-  note: z3.string().optional(),
-  content: z3.string().max(2e5).optional()
-});
-var ConfirmationSchema = z3.object({
-  id: z3.string().regex(ENTRY_ID_REGEX),
-  quote: z3.string().min(1).max(2e3),
-  at: z3.date()
-});
-var DecisionSchema = z3.object({
-  id: z3.string().regex(ENTRY_ID_REGEX),
-  topic: z3.string().min(1),
-  decision: z3.string().min(1)
-});
-var ReviewSummarySchema = z3.object({
-  verdict: z3.enum(["pass", "fail"]),
-  rounds: z3.number().int().min(1),
-  critical: z3.number().int().min(0)
-});
-var NodeRecordSchema = z3.object({
-  summary: z3.string().optional(),
-  checks: z3.array(CheckItemSchema).default([]),
-  artifacts: z3.array(ArtifactSchema).default([]),
-  confirmations: z3.array(ConfirmationSchema).default([]),
-  decisions: z3.array(DecisionSchema).default([]),
+var ArtifactSchema = z4.object({
+  id: z4.string().regex(ENTRY_ID_REGEX),
+  type: z4.enum(ARTIFACT_TYPES),
+  path: z4.string().min(1),
+  note: z4.string().optional(),
+  content: z4.string().max(2e5).optional()
+});
+var ConfirmationSchema = z4.object({
+  id: z4.string().regex(ENTRY_ID_REGEX),
+  quote: z4.string().min(1).max(2e3),
+  at: z4.date()
+});
+var DecisionSchema = z4.object({
+  id: z4.string().regex(ENTRY_ID_REGEX),
+  topic: z4.string().min(1),
+  decision: z4.string().min(1)
+});
+var ReviewSummarySchema = z4.object({
+  verdict: z4.enum(["pass", "fail"]),
+  rounds: z4.number().int().min(1),
+  critical: z4.number().int().min(0)
+});
+var NodeRecordSchema = z4.object({
+  summary: z4.string().optional(),
+  checks: z4.array(CheckItemSchema).default([]),
+  artifacts: z4.array(ArtifactSchema).default([]),
+  confirmations: z4.array(ConfirmationSchema).default([]),
+  decisions: z4.array(DecisionSchema).default([]),
   review: ReviewSummarySchema.optional()
 });
-var TaskDocContentSchema = z3.object({
-  what: z3.string().min(1),
-  why: z3.string().min(1),
-  acceptance: z3.array(z3.string()).default([]),
-  nonGoals: z3.array(z3.string()).default([]),
-  trackNote: z3.string().optional()
+var TaskDocContentSchema = z4.object({
+  what: z4.string().min(1),
+  why: z4.string().min(1),
+  acceptance: z4.array(z4.string()).default([]),
+  nonGoals: z4.array(z4.string()).default([]),
+  trackNote: z4.string().optional()
 });
-var ArchNoteSchema = z3.object({
-  id: z3.string().regex(ENTRY_ID_REGEX),
-  text: z3.string().min(1).max(2e3),
-  at: z3.date()
+var ArchNoteSchema = z4.object({
+  id: z4.string().regex(ENTRY_ID_REGEX),
+  text: z4.string().min(1).max(2e3),
+  at: z4.date()
 });
-var NodeStatusSchema = z3.string();
+var NodeStatusSchema = z4.string();
 var NODE_STATUSES = ["pending", "active", "completed", "skipped"];
-var NodeStateSchema = z3.object({
+var NodeStateSchema = z4.object({
   status: NodeStatusSchema,
-  enteredAt: z3.date().nullable().default(null),
-  completedAt: z3.date().nullable().default(null)
-});
-var DagInstanceSchema = z3.object({
-  templateId: z3.string(),
-  templateVersion: z3.string(),
-  nodes: z3.array(z3.object({
-    id: z3.string(),
-    label: z3.string(),
-    // N016 F9：枚举放宽（注册表权威）
-    phase: z3.string(),
-    track: z3.string(),
-    prompt: z3.string(),
-    skills: z3.array(z3.string()).default([])
-  })),
+  enteredAt: z4.date().nullable().default(null),
+  completedAt: z4.date().nullable().default(null)
+});
+var DagInstanceNodeSchema = z4.object({
+  id: z4.string(),
+  label: z4.string(),
+  // N016 F9：枚举放宽（注册表权威）
+  phase: z4.string(),
+  track: z4.string(),
+  prompt: z4.string(),
+  skills: z4.array(z4.string()).default([]),
+  agents: z4.array(z4.string()).default([])
+});
+var DagInstanceSchema = z4.object({
+  templateId: z4.string(),
+  templateVersion: z4.string(),
+  nodes: z4.array(DagInstanceNodeSchema),
   // N017 D1：暂停点内联到边（human_approval=审批门 / checkpoint=检查点），顶层数组删除
-  edges: z3.array(z3.object({
-    from: z3.string(),
-    to: z3.string(),
-    condition: z3.string().optional(),
+  edges: z4.array(z4.object({
+    from: z4.string(),
+    to: z4.string(),
+    condition: z4.string().optional(),
     pausePoint: EdgePausePointBaseSchema.optional()
   })),
-  prunedNodes: z3.array(z3.string()),
-  nodeStates: z3.record(z3.string(), NodeStateSchema)
+  prunedNodes: z4.array(z4.string()),
+  nodeStates: z4.record(z4.string(), NodeStateSchema)
 });
-var HistoryActionSchema = z3.enum(["entered", "advanced", "paused", "resumed", "approved", "rejected", "completed", "cancelled"]);
-var HistoryEntrySchema = z3.object({
-  nodeId: z3.string(),
+var HistoryActionSchema = z4.enum(["entered", "advanced", "paused", "resumed", "approved", "rejected", "completed", "cancelled"]);
+var HistoryEntrySchema = z4.object({
+  nodeId: z4.string(),
   action: HistoryActionSchema,
-  timestamp: z3.date().default(() => /* @__PURE__ */ new Date()),
-  details: z3.record(z3.string(), z3.unknown()).default({})
+  timestamp: z4.date().default(() => /* @__PURE__ */ new Date()),
+  details: z4.record(z4.string(), z4.unknown()).default({})
 });
-var TaskStatusSchema = z3.string();
-var TaskPhaseSchema = z3.string();
+var TaskStatusSchema = z4.string();
+var TaskPhaseSchema = z4.string();
 var TASK_STATUSES = ["active", "paused", "completed", "cancelled"];
 var TASK_PHASES = ["entry", "track", "test", "exit"];
-var TaskSchema = z3.object({
-  id: z3.string().optional(),
-  taskId: z3.string(),
-  title: z3.string(),
+var TaskSchema = z4.object({
+  id: z4.string().optional(),
+  taskId: z4.string(),
+  title: z4.string(),
   /**
    * 任务类型标签（T202608240003）：创建时确定、此后不可变（PATCH 白名单不含 type）。
    * 入参与落库同源 enum——持久层防脏值，模板 PRD 调研变体判定依赖精确值。
    */
-  type: z3.enum(TASK_TYPES).optional(),
+  type: z4.enum(TASK_TYPES).optional(),
   /** 归属项目 id（N012：实体层去哨兵 default，由 repo 显式写入——路由层解析：显式携带校验一致性 / 缺省继承模板 projectId） */
-  projectId: z3.string(),
-  dagTemplateId: z3.string(),
+  projectId: z4.string(),
+  dagTemplateId: z4.string(),
   dagInstance: DagInstanceSchema,
-  currentNode: z3.string(),
+  currentNode: z4.string(),
   currentPhase: TaskPhaseSchema,
   status: TaskStatusSchema,
   /** 暂停位置：from 节点 id（暂停点暂停，approve 经 findNextEdge 重推导边）/ null（手动暂停） */
-  pausedAt: z3.string().nullable().default(null),
-  track: z3.string(),
+  pausedAt: z4.string().nullable().default(null),
+  track: z4.string(),
   /**
    * N020 D1：任务级结构化文档（未写时字段缺省——语义即「未写」，不做 null 占位）。
    * 写入口：PATCH /api/tasks/:id/doc（字段级 $set + acceptance/nonGoals 条目 $push）。
@@ -669,27 +1153,33 @@ var TaskSchema = z3.object({
    * MongoDB 自动创建中间对象，故单条目字段可能先于容器整体存在——读侧对
    * record 内数组字段按 `?? []` 容错（toEntity 不跑 parse 补 default）。
    */
-  nodeRecords: z3.record(z3.string(), NodeRecordSchema).default({}),
+  nodeRecords: z4.record(z4.string(), NodeRecordSchema).default({}),
   /** N020 D1：跨节点累积素材（架构信息收集条目，服务端生成 id/at） */
-  archNotes: z3.array(ArchNoteSchema).default([]),
-  history: z3.array(HistoryEntrySchema).default([]),
-  createdAt: z3.date().optional(),
-  updatedAt: z3.date().optional()
+  archNotes: z4.array(ArchNoteSchema).default([]),
+  history: z4.array(HistoryEntrySchema).default([]),
+  createdAt: z4.date().optional(),
+  updatedAt: z4.date().optional()
 });
-var TaskCreateInputSchema = z3.object({
-  title: z3.string(),
-  track: z3.string(),
-  dagTemplateId: z3.string(),
+var TaskCreateInputSchema = z4.object({
+  title: z4.string(),
+  track: z4.string(),
+  /**
+   * T202609020002：模板引用支持 code|id 双形态——24-hex 直查数据库 id 命中即用
+   * （hex 未命中不转 code 检索：code 必含连字符，与 hex 形态天然互斥）；非 hex 在
+   * 项目上下文内按 code 检索（项目域经鉴权过滤：project Token 强制本项目，
+   * open/admin 显式 projectId 优先）。任务实体落库的 dagTemplateId 恒为解析后的数据库 id。
+   */
+  dagTemplateId: z4.string(),
   /**
    * T202608240003 创建时剪枝：显式剔除的节点 id（在轨道自动剔除之外）。
    * 清单来源约束 = task-create skill 的类型×轨道映射矩阵（skip 只允许来自映射，禁止自由发挥）；
    * 剪枝算法与图校验见 core/task/prune.ts。
    */
-  skipNodes: z3.array(z3.string().regex(NODE_ID_PATTERN, "skipNodes \u6761\u76EE\u987B\u4E3A\u5408\u6CD5\u8282\u70B9 id")).optional(),
+  skipNodes: z4.array(z4.string().regex(NODE_ID_PATTERN, "skipNodes \u6761\u76EE\u987B\u4E3A\u5408\u6CD5\u8282\u70B9 id")).optional(),
   /** 任务类型标签（见 TASK_TYPES；与 track 的合法组合由 server 入口校验） */
-  type: z3.enum(TASK_TYPES).optional(),
+  type: z4.enum(TASK_TYPES).optional(),
   /** 归属项目：可选（缺省 → 继承模板 projectId，D2；显式携带且 ≠ 模板 → 409 TEMPLATE_PROJECT_MISMATCH） */
-  projectId: z3.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional()
+  projectId: z4.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional()
 });
 
 // src/task/track-match.ts
@@ -948,6 +1438,26 @@ async function resumeTask(deps, taskId, decision) {
     expectedCurrentNode: task.currentNode
   });
 }
+async function cancelTask(deps, taskId, reason) {
+  const task = await deps.getTask(taskId);
+  if (!task) throw new NotFoundError("task", taskId);
+  if (task.status !== "active" && task.status !== "paused") {
+    throw new BadRequestError(
+      `Cannot cancel: task status is '${task.status}' (terminal). Only active/paused tasks can be cancelled.`,
+      void 0,
+      { bizCode: "TASK_TERMINATED", message: `\u4EFB\u52A1\u5DF2\u5B8C\u7ED3\uFF08completed/cancelled\uFF09\uFF0C\u7981\u6B62\u53D6\u6D88\uFF08\u5F53\u524D status: ${task.status}\uFF09` }
+    );
+  }
+  const patch = {
+    status: "cancelled",
+    pausedAt: null,
+    history: [...task.history, mkHistory(task.currentNode, "cancelled", reason ? { reason } : {})]
+  };
+  return deps.updateTask(taskId, patch, {
+    expectedStatus: task.status,
+    expectedCurrentNode: task.currentNode
+  });
+}
 function findNextEdge(edges, nodes, fromNodeId, track) {
   const outEdges = edges.filter((e) => e.from === fromNodeId);
   const matchSet = trackMatchSet(track);
@@ -1020,6 +1530,7 @@ function toNodeInfo(node, task) {
     track: node.track,
     prompt: renderPrompt(node.prompt, task),
     skills: node.skills,
+    agents: node.agents ?? [],
     upcomingPause: nextEdge?.pausePoint?.description ?? null
   };
 }
@@ -1172,6 +1683,7 @@ function createTaskRepo(db) {
       if (filter?.status) match.status = filter.status;
       if (filter?.track) match.track = filter.track;
       if (filter?.projectId) match.projectId = filter.projectId;
+      if (filter?.q) match.title = { $regex: escapeRegExpLiteral(filter.q), $options: "i" };
       const page = filter?.page ?? 1;
       const limit = filter?.limit ?? 20;
       const skip = (page - 1) * limit;
@@ -1402,7 +1914,8 @@ function deepCopyNode(node) {
     phase: node.phase,
     track: node.track,
     prompt: node.prompt,
-    skills: [...node.skills]
+    skills: [...node.skills],
+    agents: [...node.agents ?? []]
   };
 }
 function deepCopyEdge(edge) {
@@ -1529,14 +2042,32 @@ async function assertModelAliasExists(repo, code) {
 
 // src/store/repos/enum-registry.repo.ts
 var REFERENCE_CHECKS = {
-  dag_phase: { collection: "dag_templates", query: (v) => ({ "nodes.phase": v }) },
-  dag_track: { collection: "dag_templates", query: (v) => ({ "nodes.track": v }) },
-  pause_type: { collection: "dag_templates", query: (v) => ({ "edges.pausePoint.type": v }) },
-  task_status: { collection: "tasks", query: (v) => ({ status: v }) },
-  node_status: { collection: "tasks", query: (v) => ({ "dagInstance.nodeStates.status": v }) },
-  skill_category: { collection: "skills", query: (v) => ({ category: v }) },
-  scope: void 0
+  dag_phase: [
+    { collection: "dag_templates", query: (v) => ({ "nodes.phase": v }) },
+    { collection: "node_presets", query: (v) => ({ phase: v }) }
+  ],
+  dag_track: [
+    { collection: "dag_templates", query: (v) => ({ "nodes.track": v }) },
+    { collection: "node_presets", query: (v) => ({ track: v }) }
+  ],
+  pause_type: [{ collection: "dag_templates", query: (v) => ({ "edges.pausePoint.type": v }) }],
+  task_status: [{ collection: "tasks", query: (v) => ({ status: v }) }],
+  node_status: [{ collection: "tasks", query: (v) => ({ "dagInstance.nodeStates.status": v }) }],
+  skill_category: [{ collection: "skills", query: (v) => ({ category: v }) }],
+  scope: void 0,
+  // T202608260002：agent 功能类型被 agents.function 引用（reviewer/executor 为 builtin 禁删；
+  // 检测映射为未来非 builtin 扩值留防线）
+  agent_function: [{ collection: "agents", query: (v) => ({ "function": v }) }]
 };
+async function countReferences(db, category, value) {
+  const referrers = REFERENCE_CHECKS[category];
+  if (!referrers) return 0;
+  let total = 0;
+  for (const referrer of referrers) {
+    total += await db.collection(referrer.collection).countDocuments(referrer.query(value));
+  }
+  return total;
+}
 function createEnumRegistryRepo(db) {
   const base = createRepo(db.collection("enum_registry"), { nameField: "category" });
   return {
@@ -1585,15 +2116,12 @@ function createEnumRegistryRepo(db) {
           });
         }
         if (prev?.active === true && incoming.active === false) {
-          const ref = REFERENCE_CHECKS[category];
-          if (ref) {
-            const count = await db.collection(ref.collection).countDocuments(ref.query(incoming.value));
-            if (count > 0) {
-              throw new ConflictError("enum-registry", `${category}/${incoming.value}`, {
-                bizCode: "ENUM_ENTRY_IN_USE",
-                message: `${BIZ_CODE_MESSAGES.ENUM_ENTRY_IN_USE}\uFF08${count} \u4E2A\u8D44\u6E90\u5F15\u7528\uFF09`
-              });
-            }
+          const count = await countReferences(db, category, incoming.value);
+          if (count > 0) {
+            throw new ConflictError("enum-registry", `${category}/${incoming.value}`, {
+              bizCode: "ENUM_ENTRY_IN_USE",
+              message: `${BIZ_CODE_MESSAGES.ENUM_ENTRY_IN_USE}\uFF08${count} \u4E2A\u8D44\u6E90\u5F15\u7528\uFF09`
+            });
           }
         }
       }
@@ -1620,15 +2148,12 @@ function createEnumRegistryRepo(db) {
           message: BIZ_CODE_MESSAGES.ENUM_ENTRY_BUILTIN
         });
       }
-      const ref = REFERENCE_CHECKS[category];
-      if (ref) {
-        const count = await db.collection(ref.collection).countDocuments(ref.query(value));
-        if (count > 0) {
-          throw new ConflictError("enum-registry", `${category}/${value}`, {
-            bizCode: "ENUM_ENTRY_IN_USE",
-            message: `${BIZ_CODE_MESSAGES.ENUM_ENTRY_IN_USE}\uFF08${count} \u4E2A\u8D44\u6E90\u5F15\u7528\uFF09`
-          });
-        }
+      const count = await countReferences(db, category, value);
+      if (count > 0) {
+        throw new ConflictError("enum-registry", `${category}/${value}`, {
+          bizCode: "ENUM_ENTRY_IN_USE",
+          message: `${BIZ_CODE_MESSAGES.ENUM_ENTRY_IN_USE}\uFF08${count} \u4E2A\u8D44\u6E90\u5F15\u7528\uFF09`
+        });
       }
       const remaining = existing.entries.filter((e) => e.value !== value);
       return await base.update(existing.id, { entries: remaining }) !== null;
@@ -1636,22 +2161,316 @@ function createEnumRegistryRepo(db) {
   };
 }
 
-// src/schemas/agent.ts
-import { z as z5 } from "zod";
-
-// src/schemas/model-alias.ts
-import { z as z4 } from "zod";
-var SIMING_CODE_REGEX = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-var ModelAliasShapeSchema = z4.object({
-  id: z4.string().optional(),
-  /** siming code：创建后不可变（PUT 显式拒绝 MODEL_CODE_IMMUTABLE，非静默剥离） */
-  code: z4.string().regex(SIMING_CODE_REGEX, "code \u5FC5\u987B\u4E3A kebab-case\uFF08\u5982 primary\u3001fast-model\uFF09"),
-  /** 展示名（如「主力模型」） */
-  name: z4.string().min(1, "\u5C55\u793A\u540D\u4E0D\u80FD\u4E3A\u7A7A"),
-  /** 真实模型标识（如 zhipuai/glm-5.3；改此处 = 引用方全局替换生效） */
-  realModel: z4.string().min(1, "\u771F\u5B9E\u6A21\u578B\u6807\u8BC6\u4E0D\u80FD\u4E3A\u7A7A"),
-  createdAt: z4.date().optional(),
-  updatedAt: z4.date().optional()
+// src/store/repos/node-preset.repo.ts
+function createNodePresetRepo(db) {
+  const base = createRepo(db.collection("node_presets"), { nameField: "code" });
+  const assertCodeAvailable = async (code) => {
+    const clash = await base._collection.findOne({ code }, { projection: { _id: 1 } });
+    if (clash) {
+      throw new ConflictError("node-preset", code, {
+        bizCode: "NODE_PRESET_CODE_EXISTS",
+        message: BIZ_CODE_MESSAGES.NODE_PRESET_CODE_EXISTS
+      });
+    }
+  };
+  return {
+    ...base,
+    async createNodePreset(data) {
+      await assertCodeAvailable(data.code);
+      return base.create(data);
+    },
+    async getByCode(code, opts) {
+      const doc = await base._collection.findOne({
+        code,
+        ...opts?.includeDisabled ? {} : enabledNeFalse()
+      });
+      return doc ? toEntity(doc) : null;
+    },
+    async updateByCode(code, patch) {
+      const existing = await this.getByCode(code, { includeDisabled: true });
+      if (!existing || !existing.id) return null;
+      return base.update(existing.id, patch);
+    },
+    async deleteByCode(code) {
+      const existing = await this.getByCode(code, { includeDisabled: true });
+      if (!existing || !existing.id) return false;
+      return base.delete(existing.id);
+    },
+    async listNodePresets(filter) {
+      const query = {
+        ...filter?.includeDisabled ? {} : enabledNeFalse(),
+        ...filter?.scope ? filter.scope === "project" ? { scope: "project", ...filter.projectId ? { projectId: filter.projectId } : {} } : { scope: "global" } : filter?.projectId ? { $or: [{ scope: "global" }, { scope: "project", projectId: filter.projectId }] } : {},
+        ...filter?.q ? { $or: [
+          { code: { $regex: escapeRegExpLiteral(filter.q), $options: "i" } },
+          { label: { $regex: escapeRegExpLiteral(filter.q), $options: "i" } }
+        ] } : {}
+      };
+      return base.list(query);
+    },
+    async listByCodes(codes) {
+      if (codes.length === 0) return /* @__PURE__ */ new Map();
+      const presets = await base.list({ code: { $in: codes } });
+      return new Map(presets.map((p) => [p.code, p]));
+    },
+    async isCodeOccupied(code) {
+      return await base._collection.countDocuments({ code }, { limit: 1 }) > 0;
+    },
+    async copyNodePreset(sourceCode, target, input) {
+      const source = await this.getByCode(sourceCode, { includeDisabled: true });
+      if (!source) {
+        throw new ConflictError("node-preset", `copy source not found: ${sourceCode}`);
+      }
+      await assertCodeAvailable(input.newCode);
+      const { id: _sourceId, createdAt: _ca, updatedAt: _ua, enabled: _sourceEnabled, source: _sourceOrigin, projectId: _sourceProjectId, ...rest } = source;
+      const copy = {
+        ...JSON.parse(JSON.stringify(rest)),
+        agents: [...source.agents ?? []],
+        code: input.newCode,
+        scope: target.scope,
+        version: "1.0.0",
+        ...target.scope === "project" && target.projectId ? { projectId: target.projectId } : {}
+      };
+      return base.create(copy);
+    }
+  };
+}
+
+// src/store/repos/node-library.repo.ts
+function createNodeLibraryRepo(db) {
+  const base = createRepo(db.collection("node_libraries"), { nameField: "name" });
+  return {
+    ...base,
+    async upsertNodeLibrary(data) {
+      const now = /* @__PURE__ */ new Date();
+      const existing = await base.getByName(data.name);
+      if (existing && existing.id) {
+        const updated = await base.update(existing.id, {
+          version: data.version,
+          scope: data.scope,
+          ...data.scope === "project" && data.projectId ? { projectId: data.projectId } : {},
+          nodes: data.nodes,
+          compositions: data.compositions,
+          installedAt: now
+        });
+        if (!updated) throw new Error(`node_library upsert \u672A\u547D\u4E2D\u5DF2\u5B9A\u4F4D\u767B\u8BB0\uFF1A${data.name}\uFF08\u542F\u52A8\u671F\u4E0D\u5E94\u53D1\u751F\uFF09`);
+        return updated;
+      }
+      const created = await base.create({
+        name: data.name,
+        version: data.version,
+        scope: data.scope,
+        ...data.scope === "project" && data.projectId ? { projectId: data.projectId } : {},
+        nodes: data.nodes,
+        compositions: data.compositions,
+        installedAt: now
+      });
+      return created;
+    },
+    async listNodeLibraries(filter) {
+      const query = filter?.scope ? filter.scope === "project" ? { scope: "project", ...filter.projectId ? { projectId: filter.projectId } : {} } : { scope: "global" } : filter?.projectId ? { $or: [{ scope: "global" }, { scope: "project", projectId: filter.projectId }] } : {};
+      const docs = await base._collection.find(query).toArray();
+      return docs.map((doc) => toEntity(doc));
+    }
+  };
+}
+
+// src/store/repos/auth.repo.ts
+import { ObjectId as ObjectId3 } from "mongodb";
+import { z as z5 } from "zod";
+var AUTH_COLLECTIONS = {
+  accounts: "auth_accounts",
+  tokens: "auth_tokens",
+  sessions: "auth_sessions"
+};
+var SINGLETON_ACCOUNT_ID = new ObjectId3("000000000000000000000001");
+function createAuthAccountRepo(db) {
+  const base = createRepo(db.collection(AUTH_COLLECTIONS.accounts));
+  return {
+    ...base,
+    async getAccount() {
+      const doc = await base._collection.findOne({});
+      return doc ? toEntity(doc) : null;
+    },
+    /** 创建唯一管理员账号：已有账号 → 409（并发初始化仅首个成功，PRD §3.2）。
+     *  单例机制 = 固定 _id 插入（E11000 兜底任意并发形态——异名并发同样仅首个成功） */
+    async createAccount(username, passwordHash) {
+      const existing = await base._collection.findOne({}, { projection: { _id: 1 } });
+      if (existing) {
+        throw new ConflictError("auth-account", "singleton", { message: "admin account already exists" });
+      }
+      const now = /* @__PURE__ */ new Date();
+      const result = await base._collection.insertOne({
+        _id: SINGLETON_ACCOUNT_ID,
+        username,
+        passwordHash,
+        createdAt: now,
+        updatedAt: now
+      });
+      return { username, passwordHash, createdAt: now, updatedAt: now, id: result.insertedId.toString() };
+    },
+    async updatePassword(accountId, newPasswordHash) {
+      return base.update(accountId, { passwordHash: newPasswordHash });
+    }
+  };
+}
+function createAuthTokenRepo(db) {
+  const base = createRepo(db.collection(AUTH_COLLECTIONS.tokens));
+  return {
+    ...base,
+    /** sha256(token 全串含前缀) 等值查询（唯一索引命中） */
+    async findByHash(tokenHash) {
+      const doc = await base._collection.findOne({ tokenHash });
+      return doc ? toEntity(doc) : null;
+    },
+    async getTokenStatus(type, projectId) {
+      const query = { type };
+      if (type === "project") query.projectId = projectId;
+      const doc = await base._collection.findOne(query, { projection: { createdAt: 1 } });
+      return doc ? { hasToken: true, createdAt: doc.createdAt ?? null } : { hasToken: false, createdAt: null };
+    },
+    /** 重置语义：旧 Token 删除 + 新 Token 落库（重置后旧值立即失效，PRD §3.4）。
+     *  事务包删+插（rs0 支持——失败窗口不留零 Token 状态，失败不变性）；admin 单例 /
+     *  project 每项目一枚由 partial unique 索引兜底并发交错 */
+    async upsertToken(type, tokenHash, projectId) {
+      const query = { type };
+      if (type === "project") {
+        if (!projectId) throw new ConflictError("auth-token", "missing-projectId", { message: "project token requires projectId" });
+        query.projectId = projectId;
+      }
+      const db2 = base._collection.db;
+      const session = db2.client.startSession();
+      try {
+        const holder = { token: null };
+        await session.withTransaction(async () => {
+          await base._collection.deleteMany(query, { session });
+          const now = /* @__PURE__ */ new Date();
+          const doc = { tokenHash, type, createdAt: now, updatedAt: now };
+          if (type === "project" && projectId !== void 0) doc.projectId = projectId;
+          const result = await base._collection.insertOne(doc, { session });
+          holder.token = { ...doc, id: result.insertedId.toString() };
+        });
+        if (holder.token === null) {
+          throw new ConflictError("auth-token", "transaction-empty", { message: "Token upsert \u672A\u4EA7\u751F\u7ED3\u679C" });
+        }
+        return holder.token;
+      } finally {
+        await session.endSession();
+      }
+    },
+    async listProjectTokenStatuses(projectIds) {
+      const docs = await base._collection.find({ type: "project", projectId: { $in: projectIds } }, { projection: { projectId: 1, createdAt: 1 } }).toArray();
+      const map = /* @__PURE__ */ new Map();
+      for (const id of projectIds) map.set(id, { hasToken: false, createdAt: null });
+      for (const doc of docs) {
+        if (typeof doc.projectId === "string") {
+          map.set(doc.projectId, { hasToken: true, createdAt: doc.createdAt ?? null });
+        }
+      }
+      return map;
+    }
+  };
+}
+var AuthSessionSchema = z5.object({
+  id: z5.string().optional(),
+  sessionId: z5.string().min(1),
+  /** 管理员账号 id（会话 = 管理员身份） */
+  accountId: z5.string().min(1),
+  expiresAt: z5.date(),
+  createdAt: z5.date().optional(),
+  updatedAt: z5.date().optional()
+});
+function createAuthSessionRepo(db) {
+  const base = createRepo(db.collection(AUTH_COLLECTIONS.sessions));
+  return {
+    ...base,
+    async createSession(sessionId, accountId, expiresAt) {
+      return base.create({ sessionId, accountId, expiresAt });
+    },
+    /** 有效期判定内联：过期即删返回 null（不等 TTL 清理） */
+    async findValidSession(sessionId) {
+      const doc = await base._collection.findOne({ sessionId });
+      if (!doc) return null;
+      if (!doc.expiresAt || doc.expiresAt.getTime() <= Date.now()) {
+        await base.delete(doc._id.toString());
+        return null;
+      }
+      return toEntity(doc);
+    },
+    async deleteBySessionId(sessionId) {
+      const result = await base._collection.deleteOne({ sessionId });
+      return result.deletedCount > 0;
+    },
+    /** 启动时清扫过期会话（幂等，配合 TTL 索引） */
+    async deleteExpiredSessions() {
+      const result = await base._collection.deleteMany({ expiresAt: { $lte: /* @__PURE__ */ new Date() } });
+      return result.deletedCount;
+    }
+  };
+}
+
+// src/store/auth-crypto.ts
+import { createHash, randomBytes, scrypt as scryptCb, timingSafeEqual } from "crypto";
+import { promisify } from "util";
+var scrypt = promisify(scryptCb);
+var SCRYPT_N = 16384;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var SCRYPT_KEYLEN = 64;
+var SALT_LEN = 16;
+async function hashPassword(password) {
+  const salt = randomBytes(SALT_LEN);
+  const derived = await scrypt(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P });
+  return `scrypt$${SCRYPT_N}$${SCRYPT_R}$${SCRYPT_P}$${salt.toString("base64")}$${derived.toString("base64")}`;
+}
+async function verifyPassword(password, stored) {
+  const parts = stored.split("$");
+  if (parts.length !== 6 || parts[0] !== "scrypt") return false;
+  const [, nStr, rStr, pStr, saltB64, hashB64] = parts;
+  const N = Number(nStr);
+  const r = Number(rStr);
+  const p = Number(pStr);
+  if (!Number.isInteger(N) || !Number.isInteger(r) || !Number.isInteger(p)) return false;
+  try {
+    const salt = Buffer.from(saltB64, "base64");
+    const expected = Buffer.from(hashB64, "base64");
+    const derived = await scrypt(password, salt, expected.length, { N, r, p });
+    return derived.length === expected.length && timingSafeEqual(derived, expected);
+  } catch {
+    return false;
+  }
+}
+function generateToken(type) {
+  const prefix = type === "admin" ? "admin-" : "project-";
+  return `${prefix}${randomBytes(32).toString("base64url")}`;
+}
+function tokenTypeFromValue(token) {
+  if (token.startsWith("admin-")) return "admin";
+  if (token.startsWith("project-")) return "project";
+  return null;
+}
+function hashToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+function generateSessionId() {
+  return randomBytes(32).toString("hex");
+}
+
+// src/schemas/agent.ts
+import { z as z7 } from "zod";
+
+// src/schemas/model-alias.ts
+import { z as z6 } from "zod";
+var SIMING_CODE_REGEX = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var ModelAliasShapeSchema = z6.object({
+  id: z6.string().optional(),
+  /** siming code：创建后不可变（PUT 显式拒绝 MODEL_CODE_IMMUTABLE，非静默剥离） */
+  code: z6.string().regex(SIMING_CODE_REGEX, "code \u5FC5\u987B\u4E3A kebab-case\uFF08\u5982 primary\u3001fast-model\uFF09"),
+  /** 展示名（如「主力模型」） */
+  name: z6.string().min(1, "\u5C55\u793A\u540D\u4E0D\u80FD\u4E3A\u7A7A"),
+  /** 真实模型标识（如 zhipuai/glm-5.3；改此处 = 引用方全局替换生效） */
+  realModel: z6.string().min(1, "\u771F\u5B9E\u6A21\u578B\u6807\u8BC6\u4E0D\u80FD\u4E3A\u7A7A"),
+  createdAt: z6.date().optional(),
+  updatedAt: z6.date().optional()
 });
 var ModelAliasSchema = ModelAliasShapeSchema;
 var ModelAliasCreateSchema = ModelAliasShapeSchema.omit({
@@ -1659,17 +2478,18 @@ var ModelAliasCreateSchema = ModelAliasShapeSchema.omit({
   createdAt: true,
   updatedAt: true
 });
-var ModelAliasUpdateSchema = z4.object({
-  code: z4.string().regex(SIMING_CODE_REGEX).optional(),
-  name: z4.string().min(1).optional(),
-  realModel: z4.string().min(1).optional()
+var ModelAliasUpdateSchema = z6.object({
+  code: z6.string().regex(SIMING_CODE_REGEX).optional(),
+  name: z6.string().min(1).optional(),
+  realModel: z6.string().min(1).optional()
 });
 var ModelAliasWithRefCountSchema = ModelAliasShapeSchema.extend({
-  refCount: z4.number().int().min(0)
+  refCount: z6.number().int().min(0)
 });
 
 // src/schemas/agent.ts
-var AgentScopeSchema = z5.enum(["global", "project"]);
+var AgentScopeSchema = z7.enum(["global", "project"]);
+var AgentFunctionSchema = z7.enum(["reviewer", "executor"]);
 var AgentScopeRefine = (val, ctx) => {
   if (val.scope === "project" && !val.projectId) {
     ctx.addIssue({
@@ -1679,48 +2499,72 @@ var AgentScopeRefine = (val, ctx) => {
     });
   }
 };
-var AgentShapeSchema = z5.object({
-  id: z5.string().optional(),
-  name: z5.string(),
-  description: z5.string(),
-  systemPrompt: z5.string(),
-  boundSkills: z5.array(z5.string()).default([]),
-  model: z5.string(),
+var AgentShapeSchema = z7.object({
+  id: z7.string().optional(),
+  name: z7.string(),
+  description: z7.string(),
+  systemPrompt: z7.string(),
+  boundSkills: z7.array(z7.string()).default([]),
+  model: z7.string(),
   /** 资产版本（N015 F13）：install/export 版本对比依据；default 仅读侧兜底（createRepo 不做读侧解析，存量回填走 M6 迁移） */
-  version: z5.string().default("1.0.0"),
-  tools: z5.array(z5.string()).default([]),
-  permissions: z5.array(z5.string()).default([]),
+  version: z7.string().default("1.0.0"),
+  tools: z7.array(z7.string()).default([]),
+  permissions: z7.array(z7.string()).default([]),
+  /** 引用文档集合（可选——存量单文件资产无此字段，行为与升级前一致） */
+  references: createReferencesSchema(AGENT_MAIN_DOC).optional(),
   /** 作用域：global=跨项目复用（默认，仅作存量迁移读侧兜底）/ project=项目专用（N012 D3） */
   scope: AgentScopeSchema.default("global"),
+  /** 功能类型（T202608260002）：default 仅创建侧归一——toEntity 直转不经 Zod parse，读侧归一在 repo 层 + 回填走 M12 */
+  "function": AgentFunctionSchema.default("executor"),
   /** 仅 scope=project 时必填且为合法 ObjectId hex（superRefine 保证） */
-  projectId: z5.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional(),
-  createdAt: z5.date().optional(),
-  updatedAt: z5.date().optional()
+  projectId: z7.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional(),
+  /**
+   * T202608290001 资产启停（可选——存量无此字段 = 启用，零迁移）。
+   * 全局判断规则：enabled === false 即停用，true/缺失均启用。
+   * 唯一写入口是专用启停端点（POST /:name/enabled）——Create/Update/Copy 均不含此字段。
+   */
+  enabled: z7.boolean().optional(),
+  createdAt: z7.date().optional(),
+  updatedAt: z7.date().optional()
 });
-var AgentSchema = AgentShapeSchema.superRefine(AgentScopeRefine);
+var agentAggregateLimitRefine = (val, ctx) => {
+  const totalChars = (val.systemPrompt?.length ?? 0) + sumReferenceContentChars(val.references);
+  if (totalChars > REFERENCE_LIMITS.maxTotalChars) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["references"],
+      message: `\u4E3B\u6587\u6863\u4E0E\u5F15\u7528\u6587\u6863\u5185\u5BB9\u603B\u91CF ${totalChars} \u5B57\u7B26\u8D85\u51FA\u805A\u5408\u4E0A\u9650 ${REFERENCE_LIMITS.maxTotalChars}`
+    });
+  }
+};
+var AgentSchema = AgentShapeSchema.superRefine(AgentScopeRefine).superRefine(agentAggregateLimitRefine);
 var AgentCreateSchema = AgentShapeSchema.omit({
   id: true,
   createdAt: true,
-  updatedAt: true
-}).extend({ scope: AgentScopeSchema }).extend({ model: z5.string().regex(SIMING_CODE_REGEX, "model \u5FC5\u987B\u662F siming code\uFF08kebab-case\uFF09") }).superRefine(AgentScopeRefine);
+  updatedAt: true,
+  enabled: true
+}).extend({ scope: AgentScopeSchema }).extend({ model: z7.string().regex(SIMING_CODE_REGEX, "model \u5FC5\u987B\u662F siming code\uFF08kebab-case\uFF09") }).extend({ "function": AgentFunctionSchema.default("executor") }).superRefine(AgentScopeRefine).superRefine(agentAggregateLimitRefine);
 var AgentUpdateSchema = AgentShapeSchema.omit({
   id: true,
   createdAt: true,
-  updatedAt: true
+  updatedAt: true,
+  enabled: true
 }).extend({
-  boundSkills: z5.array(z5.string()).optional(),
+  boundSkills: z7.array(z7.string()).optional(),
   // N015：version 放行（export apply 版本递增随 PUT 携带）；optional 剥离实体层 default 避免 partial 空 body 注入
-  version: z5.string().optional(),
-  tools: z5.array(z5.string()).optional(),
-  permissions: z5.array(z5.string()).optional(),
+  version: z7.string().optional(),
+  tools: z7.array(z7.string()).optional(),
+  permissions: z7.array(z7.string()).optional(),
   scope: AgentScopeSchema.optional(),
   // N013：model 收紧为 siming code 格式（存在性校验在 handler 层；undefined = 不更新该字段）
-  model: z5.string().regex(SIMING_CODE_REGEX, "model \u5FC5\u987B\u662F siming code\uFF08kebab-case\uFF09").optional()
-}).partial().superRefine(AgentScopeRefine);
-var AgentCopySchema = z5.object({
-  newName: z5.string(),
+  model: z7.string().regex(SIMING_CODE_REGEX, "model \u5FC5\u987B\u662F siming code\uFF08kebab-case\uFF09").optional(),
+  // T202608260002：optional 剥离实体层 default——否则 PUT 空 body 会注入 executor 覆盖 reviewer
+  "function": AgentFunctionSchema.optional()
+}).partial().superRefine(AgentScopeRefine).superRefine(agentAggregateLimitRefine);
+var AgentCopySchema = z7.object({
+  newName: z7.string(),
   newScope: AgentScopeSchema,
-  targetProjectId: z5.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional()
+  targetProjectId: z7.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional()
 }).superRefine((val, ctx) => {
   if (val.newScope === "project" && !val.targetProjectId) {
     ctx.addIssue({
@@ -1731,227 +2575,948 @@ var AgentCopySchema = z5.object({
   }
 });
 
+// src/schemas/export-bundle.ts
+import { z as z8 } from "zod";
+var EXPORT_FORMAT_VERSION = "1.0";
+var TemplatePayloadSchema = DagTemplateSchema.omit({
+  id: true,
+  projectId: true,
+  enabled: true,
+  createdAt: true,
+  updatedAt: true,
+  code: true
+}).extend({
+  version: z8.string(),
+  isDefault: z8.boolean()
+});
+var SkillPayloadSchema = SkillShapeSchema.omit({
+  id: true,
+  projectId: true,
+  enabled: true,
+  createdAt: true,
+  updatedAt: true
+}).extend({
+  version: z8.string(),
+  scope: SkillScopeSchema,
+  references: createReferencesSchema(SKILL_MAIN_DOC)
+});
+var AgentPayloadSchema = AgentShapeSchema.omit({
+  id: true,
+  projectId: true,
+  enabled: true,
+  createdAt: true,
+  updatedAt: true
+}).extend({
+  version: z8.string(),
+  scope: AgentScopeSchema,
+  references: createReferencesSchema(AGENT_MAIN_DOC),
+  boundSkills: z8.array(z8.string()),
+  tools: z8.array(z8.string()),
+  permissions: z8.array(z8.string()),
+  "function": AgentFunctionSchema
+});
+var ModelAliasPayloadSchema = ModelAliasSchema.omit({
+  id: true,
+  createdAt: true,
+  updatedAt: true
+});
+var ExportBundleSchema = z8.object({
+  exportFormatVersion: z8.literal(EXPORT_FORMAT_VERSION, {
+    error: `\u5BFC\u51FA\u683C\u5F0F\u7248\u672C\u4E0D\u652F\u6301\uFF0C\u5F53\u524D\u652F\u6301 ${EXPORT_FORMAT_VERSION}`
+  }),
+  exportedAt: z8.string(),
+  /** 源环境悬空提示（§2.2：悬空 skill/agent.model 不阻断导出）。导出响应恒携带；导入入参可缺省——导入侧提示由 plan 生成，不消费本字段 */
+  warnings: z8.array(z8.string()).optional(),
+  template: TemplatePayloadSchema,
+  dependencies: z8.object({
+    skills: z8.array(SkillPayloadSchema),
+    agents: z8.array(AgentPayloadSchema),
+    modelAliases: z8.array(ModelAliasPayloadSchema)
+  })
+});
+var ImportPlanRequestSchema = z8.object({
+  targetProjectId: z8.string().regex(OBJECT_ID_HEX, "targetProjectId must be a valid ObjectId hex"),
+  bundle: ExportBundleSchema
+});
+var ImportDecisionSchema = z8.discriminatedUnion("kind", [
+  z8.object({
+    kind: z8.literal("skill"),
+    name: z8.string(),
+    scope: SkillScopeSchema,
+    action: z8.enum(["overwrite", "skip"])
+  }),
+  z8.object({
+    kind: z8.literal("agent"),
+    name: z8.string(),
+    scope: AgentScopeSchema,
+    action: z8.enum(["overwrite", "skip"])
+  }),
+  z8.object({
+    kind: z8.literal("modelAlias"),
+    name: z8.string(),
+    action: z8.enum(["overwrite", "skip"])
+  })
+]);
+var ImportApplyRequestSchema = ImportPlanRequestSchema.extend({
+  /** 未列出的冲突项缺省 skip（保守默认：未决策不覆盖） */
+  decisions: z8.array(ImportDecisionSchema).default([])
+});
+var DependencyStatusSchema = z8.enum(["create", "identical", "conflict"]);
+var DependencyCheckSchema = z8.object({
+  kind: z8.enum(["skill", "agent", "modelAlias"]),
+  name: z8.string(),
+  /** skill/agent 携带；modelAlias 无 */
+  scope: z8.enum(["global", "project"]).optional(),
+  status: DependencyStatusSchema,
+  /** status ≠ create 时目标环境现值版本（modelAlias 无 version 概念不填） */
+  currentVersion: z8.string().optional(),
+  importVersion: z8.string().optional(),
+  /** status = conflict 时差异字段名清单（如 "content, references"） */
+  changeSummary: z8.string().optional(),
+  /** 影响范围（PRD F13）：global 资产影响所有项目 / project 资产仅影响所属项目 */
+  impact: z8.enum(["global", "project"])
+});
+var ImportPlanResponseSchema = z8.object({
+  template: z8.object({
+    name: z8.string(),
+    willOverwrite: z8.boolean(),
+    currentVersion: z8.string().optional(),
+    importVersion: z8.string(),
+    isDefaultRequested: z8.boolean(),
+    /** isDefault 降级后的最终生效值（F17：项目已有默认 → false） */
+    isDefaultEffect: z8.boolean(),
+    downgradeReason: z8.string().optional()
+  }),
+  dependencies: z8.array(DependencyCheckSchema),
+  /**
+   * K10①：模板节点直接技能引用完整性逐项核对（node × skill 粒度）——
+   * ok = 在 bundle 依赖 ∪ 目标环境可见集；missing = 双侧皆无（绑定悬空，non-blocking warning）
+   */
+  directSkillChecks: z8.array(
+    z8.object({
+      node: z8.string(),
+      skill: z8.string(),
+      status: z8.enum(["ok", "missing"])
+    })
+  ),
+  /** 非阻断提示（源环境悬空绑定、agent.model 引用缺失、sourcePreset 来源缺失等） */
+  warnings: z8.array(z8.string())
+});
+var DependencyActionSchema = z8.enum(["created", "updated", "skipped", "identical", "failed"]);
+var ImportApplyResponseSchema = z8.object({
+  template: z8.object({
+    id: z8.string(),
+    name: z8.string(),
+    action: z8.enum(["created", "updated"]),
+    isDefaultEffect: z8.boolean()
+  }),
+  dependencies: z8.array(
+    z8.object({
+      kind: z8.enum(["skill", "agent", "modelAlias"]),
+      name: z8.string(),
+      scope: z8.enum(["global", "project"]).optional(),
+      action: DependencyActionSchema,
+      /** action = failed 时的错误说明 */
+      message: z8.string().optional()
+    })
+  ),
+  /** K10②：apply 时刻目标环境缺失来源而被剥除 sourcePreset 的节点 id 清单（降级自建导入） */
+  sourceStripped: z8.array(z8.string())
+});
+function decisionKey(kind, scope, name) {
+  return `${kind}:${scope ?? ""}:${name}`;
+}
+
 // src/schemas/advance.ts
-import { z as z6 } from "zod";
-var AdvanceRequestSchema = z6.object({
-  note: z6.string().optional(),
+import { z as z9 } from "zod";
+var AdvanceRequestSchema = z9.object({
+  note: z9.string().optional(),
   /** min(1).max(2000) 与 record summary 端点对齐（同一 $set 目标，两入口校验强度一致） */
-  summary: z6.string().min(1).max(2e3).optional()
+  summary: z9.string().min(1).max(2e3).optional()
 });
-var ApproveRequestSchema = z6.object({
-  decision: z6.enum(["approved", "rejected"]),
-  comment: z6.string().optional()
+var ApproveRequestSchema = z9.object({
+  decision: z9.enum(["approved", "rejected"]),
+  comment: z9.string().optional()
 });
-var TaskPublicSchema = z6.object({
-  taskId: z6.string(),
-  title: z6.string(),
+var TaskPublicSchema = z9.object({
+  taskId: z9.string(),
+  title: z9.string(),
   // T202608240003：任务类型标签（缺省 = 裸任务/旧任务；模板 PRD 调研变体判定消费）
-  type: z6.enum(TASK_TYPES).optional(),
-  currentNode: z6.string(),
-  currentPhase: z6.string(),
-  status: z6.string(),
-  pausedAt: z6.string().nullable(),
-  track: z6.string()
-});
-var NodeInfoSchema = z6.object({
-  nodeId: z6.string(),
-  label: z6.string(),
-  track: z6.string(),
-  prompt: z6.string(),
-  skills: z6.array(z6.string()),
-  upcomingPause: z6.string().nullable()
-});
-var AdvanceResponseSchema = z6.discriminatedUnion("status", [
-  z6.object({
-    status: z6.literal("advanced"),
+  type: z9.enum(TASK_TYPES).optional(),
+  currentNode: z9.string(),
+  currentPhase: z9.string(),
+  status: z9.string(),
+  pausedAt: z9.string().nullable(),
+  track: z9.string()
+});
+var NodeInfoSchema = z9.object({
+  nodeId: z9.string(),
+  label: z9.string(),
+  track: z9.string(),
+  prompt: z9.string(),
+  skills: z9.array(z9.string()),
+  agents: z9.array(z9.string()),
+  upcomingPause: z9.string().nullable()
+});
+var AdvanceResponseSchema = z9.discriminatedUnion("status", [
+  z9.object({
+    status: z9.literal("advanced"),
     task: TaskPublicSchema,
     nextNode: NodeInfoSchema
   }),
-  z6.object({
-    status: z6.literal("paused"),
+  z9.object({
+    status: z9.literal("paused"),
     task: TaskPublicSchema,
     pausePoint: EdgePausePointSchema,
-    guidance: z6.string()
+    guidance: z9.string()
   }),
-  z6.object({
-    status: z6.literal("completed"),
+  z9.object({
+    status: z9.literal("completed"),
     task: TaskPublicSchema
   })
 ]);
-var ApproveResponseSchema = z6.discriminatedUnion("status", [
-  z6.object({
-    status: z6.literal("advanced"),
+var ApproveResponseSchema = z9.discriminatedUnion("status", [
+  z9.object({
+    status: z9.literal("advanced"),
     task: TaskPublicSchema,
     nextNode: NodeInfoSchema
   }),
-  z6.object({
-    status: z6.literal("rejected"),
+  z9.object({
+    status: z9.literal("rejected"),
     task: TaskPublicSchema,
-    guidance: z6.string()
+    guidance: z9.string()
   }),
   // 「completed」分支当前引擎不可达（approve 从 paused 流转必有下一节点，技术方案 §2.2
   // 已删 paused→completed 直达路径）——按方案 §2.1 契约保留作前向兼容预留
-  z6.object({
-    status: z6.literal("completed"),
+  z9.object({
+    status: z9.literal("completed"),
     task: TaskPublicSchema
   })
 ]);
-var PauseRequestSchema = z6.object({
-  reason: z6.string().optional()
+var PauseRequestSchema = z9.object({
+  reason: z9.string().optional()
 });
-var ResumeRequestSchema = z6.object({
-  decision: z6.string().optional()
+var ResumeRequestSchema = z9.object({
+  decision: z9.string().optional()
+});
+var CancelRequestSchema = z9.object({
+  reason: z9.string().min(1).max(500).optional()
 });
 
 // src/schemas/task-doc.ts
-import { z as z7 } from "zod";
-var TaskContextSchema = z7.object({
-  task: z7.object({
-    taskId: z7.string(),
-    title: z7.string(),
+import { z as z10 } from "zod";
+var TaskContextSchema = z10.object({
+  task: z10.object({
+    taskId: z10.string(),
+    title: z10.string(),
     // T202608240003：与 TaskPublicSchema 同步（toTaskPublic 运行时已产出，schema 声明漂移会导致 typed 消费方 strip 掉 type）
-    type: z7.enum(TASK_TYPES).optional(),
-    currentNode: z7.string(),
-    currentPhase: z7.string(),
-    status: z7.string(),
-    pausedAt: z7.string().nullable(),
-    track: z7.string()
+    type: z10.enum(TASK_TYPES).optional(),
+    currentNode: z10.string(),
+    currentPhase: z10.string(),
+    status: z10.string(),
+    pausedAt: z10.string().nullable(),
+    track: z10.string()
   }),
-  currentNode: z7.object({
-    nodeId: z7.string(),
-    label: z7.string(),
-    phase: z7.string(),
-    track: z7.string(),
+  currentNode: z10.object({
+    nodeId: z10.string(),
+    label: z10.string(),
+    phase: z10.string(),
+    track: z10.string(),
     /** renderPrompt 渲染后（AI 推进任务的直接输入） */
-    prompt: z7.string(),
-    skills: z7.array(z7.string()),
+    prompt: z10.string(),
+    skills: z10.array(z10.string()),
+    agents: z10.array(z10.string()),
     /** 完成当前节点后出边上的暂停点描述（经 findNextEdge 按轨选边） */
-    upcomingPause: z7.string().nullable()
+    upcomingPause: z10.string().nullable()
   }).nullable(),
-  pausedAtEdge: z7.object({
-    from: z7.string(),
-    to: z7.string(),
+  pausedAtEdge: z10.object({
+    from: z10.string(),
+    to: z10.string(),
     pausePoint: EdgePausePointBaseSchema
   }).nullable(),
   /** 全节点实时状态清单 */
-  nodes: z7.array(z7.object({
-    nodeId: z7.string(),
-    label: z7.string(),
-    status: z7.string(),
-    enteredAt: z7.date().nullable(),
-    completedAt: z7.date().nullable()
+  nodes: z10.array(z10.object({
+    nodeId: z10.string(),
+    label: z10.string(),
+    status: z10.string(),
+    enteredAt: z10.date().nullable(),
+    completedAt: z10.date().nullable()
   })),
   /** N020 D1：任务级结构化文档（未写时 null） */
   taskDoc: TaskDocContentSchema.nullable(),
   /** N020 D1：节点执行记录（仅含已写记录的 nodeId） */
-  nodeRecords: z7.record(z7.string(), NodeRecordSchema),
+  nodeRecords: z10.record(z10.string(), NodeRecordSchema),
   /** N020 D1：跨节点累积素材（架构信息收集条目） */
-  archNotes: z7.array(ArchNoteSchema)
+  archNotes: z10.array(ArchNoteSchema)
 });
-var TaskSummarySchema = z7.object({
-  taskId: z7.string(),
-  title: z7.string(),
+var TaskSummarySchema = z10.object({
+  taskId: z10.string(),
+  title: z10.string(),
   // T202608240003：任务类型标签（缺省 = 裸任务/旧任务）
-  type: z7.enum(TASK_TYPES).optional(),
-  projectId: z7.string(),
-  dagTemplateId: z7.string(),
-  currentNode: z7.string(),
-  currentPhase: z7.string(),
-  status: z7.string(),
-  pausedAt: z7.string().nullable(),
-  track: z7.string(),
-  progress: z7.object({
-    completed: z7.number(),
-    total: z7.number()
+  type: z10.enum(TASK_TYPES).optional(),
+  projectId: z10.string(),
+  dagTemplateId: z10.string(),
+  currentNode: z10.string(),
+  currentPhase: z10.string(),
+  status: z10.string(),
+  pausedAt: z10.string().nullable(),
+  track: z10.string(),
+  progress: z10.object({
+    completed: z10.number(),
+    total: z10.number()
   }),
-  createdAt: z7.date().optional(),
-  updatedAt: z7.date().optional()
+  createdAt: z10.date().optional(),
+  updatedAt: z10.date().optional()
+});
+
+// src/schemas/write-ack.ts
+import { z as z11 } from "zod";
+var WRITE_ACK_ENTRY_KINDS = ["check", "artifact", "decision", "confirmation", "archnote"];
+var WriteAckEntryKindSchema = z11.enum(WRITE_ACK_ENTRY_KINDS);
+var EchoItemSchema = z11.object({
+  path: z11.string(),
+  excerpt: z11.string()
+});
+var TaskProgressSchema = z11.object({
+  completed: z11.number().int(),
+  total: z11.number().int()
 });
+var TaskProgressPublicSchema = TaskPublicSchema.extend({
+  projectId: z11.string(),
+  progress: TaskProgressSchema
+});
+var WriteAckSchema = z11.object({
+  taskId: z11.string(),
+  /** 本次写入触及的字段点路径（如 doc.what / nodeRecords.PRD.checks） */
+  updated: z11.array(z11.string()),
+  /** 新建条目标识（$push 五类对象条目；无新条目的端点缺省） */
+  entry: z11.object({
+    id: z11.string(),
+    kind: WriteAckEntryKindSchema
+  }).optional(),
+  /** 写入内容回显（触及字段逐条；无值可回显的端点可缺省） */
+  echo: z11.array(EchoItemSchema).optional(),
+  updatedAt: z11.date(),
+  task: TaskProgressPublicSchema
+});
+var TaskBatchEntrySchema = z11.object({
+  index: z11.number().int().min(0),
+  id: z11.string().optional(),
+  kind: WriteAckEntryKindSchema.optional()
+});
+var TaskBatchFailureSchema = z11.object({
+  index: z11.number().int().min(0),
+  message: z11.string(),
+  hint: z11.string().optional()
+});
+var TaskBatchAckSchema = z11.object({
+  taskId: z11.string(),
+  /** 成功落库条目数（部分失败语义：成功条目保留不回滚） */
+  applied: z11.number().int().min(0),
+  /** 本次写入触及的字段点路径 */
+  updated: z11.array(z11.string()),
+  entries: z11.array(TaskBatchEntrySchema),
+  failures: z11.array(TaskBatchFailureSchema),
+  updatedAt: z11.date(),
+  task: TaskProgressPublicSchema
+});
+var CreateTaskResponseSchema = z11.object({
+  task: TaskProgressPublicSchema,
+  firstNode: NodeInfoSchema
+});
+function taskProgress(task) {
+  const states = Object.values(task.dagInstance.nodeStates);
+  const completed = states.filter((s) => s?.status === "completed").length;
+  const skipped = states.filter((s) => s?.status === "skipped").length;
+  return { completed, total: task.dagInstance.nodes.length - skipped };
+}
+function excerpt(value, max = 120) {
+  const chars = Array.from(value);
+  if (chars.length <= max) return value;
+  return `${chars.slice(0, max - 1).join("")}\u2026`;
+}
+var CONTEXT_VIEWS = ["basic", "full"];
+var ContextViewSchema = z11.enum(CONTEXT_VIEWS);
 
 // src/schemas/project.ts
-import { z as z8 } from "zod";
-var ProjectStatusSchema = z8.enum(["active", "archived"]);
-var ProjectSchema = z8.object({
-  id: z8.string().optional(),
-  key: z8.string().regex(/^[a-z0-9][a-z0-9-]{1,30}$/, "key \u5FC5\u987B\u4E3A kebab-case\uFF082-31 \u5B57\u7B26\uFF09"),
-  name: z8.string().min(1).max(50),
-  description: z8.string().max(500).optional(),
+import { z as z12 } from "zod";
+var ProjectStatusSchema = z12.enum(["active", "archived"]);
+var ProjectSchema = z12.object({
+  id: z12.string().optional(),
+  key: z12.string().regex(/^[a-z0-9][a-z0-9-]{1,30}$/, "key \u5FC5\u987B\u4E3A kebab-case\uFF082-31 \u5B57\u7B26\uFF09"),
+  name: z12.string().min(1).max(50),
+  description: z12.string().max(500).optional(),
   status: ProjectStatusSchema.default("active"),
-  createdAt: z8.date().optional(),
-  updatedAt: z8.date().optional()
+  createdAt: z12.date().optional(),
+  updatedAt: z12.date().optional()
 });
-var ProjectCreateSchema = z8.object({
-  key: z8.string().regex(/^[a-z0-9][a-z0-9-]{1,30}$/, "key \u5FC5\u987B\u4E3A kebab-case\uFF082-31 \u5B57\u7B26\uFF09").optional(),
-  name: z8.string().min(1).max(50),
-  description: z8.string().max(500).optional()
+var ProjectCreateSchema = z12.object({
+  key: z12.string().regex(/^[a-z0-9][a-z0-9-]{1,30}$/, "key \u5FC5\u987B\u4E3A kebab-case\uFF082-31 \u5B57\u7B26\uFF09").optional(),
+  name: z12.string().min(1).max(50),
+  description: z12.string().max(500).optional()
 });
-var ProjectUpdateSchema = z8.object({
-  name: z8.string().min(1).max(50).optional(),
-  description: z8.string().max(500).optional(),
+var ProjectUpdateSchema = z12.object({
+  name: z12.string().min(1).max(50).optional(),
+  description: z12.string().max(500).optional(),
   status: ProjectStatusSchema.optional()
 });
 
 // src/schemas/enum-registry.ts
-import { z as z9 } from "zod";
-var EnumRegistryCategorySchema = z9.enum([
+import { z as z13 } from "zod";
+var EnumRegistryCategorySchema = z13.enum([
   "dag_phase",
   "dag_track",
   "pause_type",
   "task_status",
   "node_status",
   "skill_category",
-  "scope"
+  "scope",
+  "agent_function"
 ]);
-var EnumEntrySchema = z9.object({
+var EnumEntrySchema = z13.object({
   /** 领域层存库的原始枚举值（不可臆造；builtin 值 engine/DB 强依赖；kebab 约束与 skill name 对齐，保证 DELETE /entries/:value 可寻址） */
-  value: z9.string().regex(/^[a-z0-9][a-z0-9_-]*$/, "value \u4EC5\u652F\u6301\u5C0F\u5199\u5B57\u6BCD/\u6570\u5B57/\u4E0B\u5212\u7EBF/\u8FDE\u5B57\u7B26\uFF08kebab-case\uFF09"),
+  value: z13.string().regex(/^[a-z0-9][a-z0-9_-]*$/, "value \u4EC5\u652F\u6301\u5C0F\u5199\u5B57\u6BCD/\u6570\u5B57/\u4E0B\u5212\u7EBF/\u8FDE\u5B57\u7B26\uFF08kebab-case\uFF09"),
   /** 展示文案（消费端下拉直接取用） */
-  label: z9.string().min(1, "label \u4E0D\u80FD\u4E3A\u7A7A"),
+  label: z13.string().min(1, "label \u4E0D\u80FD\u4E3A\u7A7A"),
   /** 可选语义色 token（如 --success / --warning），消费端映射到 UI */
-  color: z9.string().optional(),
+  color: z13.string().optional(),
   /** 下拉排序（升序） */
-  order: z9.number().int().default(0),
+  order: z13.number().int().default(0),
   /** 内置值：禁删 + label/color 可改但 value 不可改（D8）；seed 时标记 */
-  builtin: z9.boolean().default(false),
+  builtin: z13.boolean().default(false),
   /** 启停：false = 下拉禁用展示（历史数据仍可读，新选择不可用） */
-  active: z9.boolean().default(true)
+  active: z13.boolean().default(true)
 });
-var EnumRegistrySchema = z9.object({
-  id: z9.string().optional(),
+var EnumRegistrySchema = z13.object({
+  id: z13.string().optional(),
   category: EnumRegistryCategorySchema,
-  entries: z9.array(EnumEntrySchema).default([]),
-  updatedAt: z9.date().optional()
+  entries: z13.array(EnumEntrySchema).default([]),
+  updatedAt: z13.date().optional()
 });
-var EnumRegistryUpdateSchema = z9.object({
-  entries: z9.array(EnumEntrySchema)
+var EnumRegistryUpdateSchema = z13.object({
+  entries: z13.array(EnumEntrySchema)
+});
+
+// src/schemas/asset-enabled.ts
+import { z as z14 } from "zod";
+var AssetSetEnabledSchema = z14.object({
+  enabled: z14.boolean()
+});
+
+// src/schemas/auth.ts
+import { z as z15 } from "zod";
+var AuthTokenTypeSchema = z15.enum(["admin", "project"]);
+var AuthAccountSchema = z15.object({
+  id: z15.string().optional(),
+  username: z15.string().min(3, "\u8D26\u53F7\u81F3\u5C11 3 \u4E2A\u5B57\u7B26").max(50).regex(/^[a-zA-Z0-9_-]+$/, "\u8D26\u53F7\u4EC5\u5141\u8BB8\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u4E0E\u8FDE\u5B57\u7B26"),
+  /** 存储形态：scrypt$N$r$p$salt$hash（base64 段），明文仅存在于请求体 */
+  passwordHash: z15.string().min(1),
+  createdAt: z15.date().optional(),
+  updatedAt: z15.date().optional()
+});
+var AuthAccountCreateSchema = z15.object({
+  username: AuthAccountSchema.shape.username,
+  password: z15.string().min(8, "\u5BC6\u7801\u81F3\u5C11 8 \u4E2A\u5B57\u7B26").max(128)
+});
+var PasswordChangeSchema = z15.object({
+  currentPassword: z15.string().min(1),
+  newPassword: z15.string().min(8, "\u5BC6\u7801\u81F3\u5C11 8 \u4E2A\u5B57\u7B26").max(128)
+});
+var LoginSchema = z15.object({
+  username: z15.string().min(1),
+  password: z15.string().min(1)
+});
+var AuthTokenSchema = z15.object({
+  id: z15.string().optional(),
+  /** sha256(token 全串含前缀) hex——明文 Token 不入库 */
+  tokenHash: z15.string().regex(/^[a-f0-9]{64}$/),
+  type: AuthTokenTypeSchema,
+  /** type=project 时必填且不可缺失（superRefine 保证）；指向 projects.id（24-hex） */
+  projectId: z15.string().regex(/^[a-f0-9]{24}$/, "projectId \u5FC5\u987B\u4E3A 24-hex ObjectId").optional(),
+  createdAt: z15.date().optional(),
+  updatedAt: z15.date().optional()
+}).superRefine((data, ctx) => {
+  if (data.type === "project" && data.projectId === void 0) {
+    ctx.addIssue({ code: "custom", path: ["projectId"], message: "\u9879\u76EE Token \u5FC5\u987B\u7ED1\u5B9A projectId" });
+  }
+});
+var AuthTokenGenResponseSchema = z15.object({
+  token: z15.string().min(1),
+  type: AuthTokenTypeSchema,
+  projectId: z15.string().optional()
+});
+var AuthTokenStatusSchema = z15.object({
+  type: AuthTokenTypeSchema,
+  projectId: z15.string().optional(),
+  hasToken: z15.boolean(),
+  createdAt: z15.date().nullable().optional()
+});
+var AuthWhoamiSchema = z15.object({
+  identity: z15.enum(["admin", "project", "none"]),
+  project: z15.object({
+    id: z15.string(),
+    key: z15.string(),
+    name: z15.string()
+  }).nullable().optional(),
+  authEnabled: z15.boolean(),
+  server: z15.object({
+    url: z15.string()
+  })
+});
+var AuthStatusSchema = z15.object({
+  authEnabled: z15.boolean(),
+  /** 鉴权开启且无管理员账号 = 初始化引导窗口（PRD §3.2） */
+  needsSetup: z15.boolean()
+});
+
+// src/schemas/node-preset.ts
+import { z as z16 } from "zod";
+var NODE_PRESET_CODE_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var NodePresetScopeRefine = (val, ctx) => {
+  if (val.scope === "project" && !val.projectId) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["projectId"],
+      message: "scope=project \u65F6 projectId \u5FC5\u586B"
+    });
+  }
+};
+var uniqueNamesSchema = z16.array(z16.string().min(1)).superRefine((names, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  names.forEach((name, index) => {
+    if (seen.has(name)) {
+      ctx.addIssue({ code: "custom", path: [index], message: `\u540D\u79F0\u91CD\u590D\uFF1A${name}` });
+    }
+    seen.add(name);
+  });
+});
+var NodePresetShapeSchema = z16.object({
+  id: z16.string().optional(),
+  code: z16.string().regex(NODE_PRESET_CODE_PATTERN, "kebab-case only"),
+  label: z16.string().min(1),
+  /** 组装默认节点标识（模板图结构域；字符集同 NODE_ID_PATTERN——节点记录点路径拼接安全前提） */
+  nodeId: z16.string().regex(/^[A-Za-z0-9_-]+$/, "nodeId \u53EA\u5141\u8BB8\u5B57\u6BCD/\u6570\u5B57/\u4E0B\u5212\u7EBF/\u8FDE\u5B57\u7B26"),
+  /** 运行时注册表判定（对齐 dag_phase/dag_track 放宽策略——Zod 只做类型级） */
+  phase: z16.string(),
+  track: z16.string(),
+  prompt: z16.string().min(1),
+  /** 绑定技能名单（by-name 引用；版本要求只存在于 npm 分发层 manifest，不侵入运行链路） */
+  skills: uniqueNamesSchema,
+  /** 节点执行时可调用的 Agent 名单（by-name 引用；正文仍由独立 Agent 资产承载） */
+  agents: uniqueNamesSchema,
+  scope: z16.enum(["global", "project"]),
+  projectId: z16.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional(),
+  description: z16.string().optional(),
+  version: z16.string(),
+  /** 分发来源标注（flow install 落库时填充包名；手工创建无此字段——「来源可见可核查」信任模型） */
+  source: z16.object({ package: z16.string().min(1) }).optional(),
+  /** 资产启停（可选——存量无此字段 = 启用；唯一写入口 POST /:code/enabled，不入 Create/Update/Copy） */
+  enabled: z16.boolean().optional(),
+  createdAt: z16.date().optional(),
+  updatedAt: z16.date().optional()
+});
+var NodePresetSchema = NodePresetShapeSchema.superRefine(NodePresetScopeRefine);
+var NodePresetCreateSchema = NodePresetShapeSchema.omit({
+  id: true,
+  createdAt: true,
+  updatedAt: true,
+  enabled: true
+}).extend({
+  skills: uniqueNamesSchema.default([]),
+  agents: uniqueNamesSchema.default([]),
+  version: z16.string().default("1.0.0")
+}).superRefine(NodePresetScopeRefine);
+var NodePresetUpdateSchema = NodePresetShapeSchema.omit({
+  id: true,
+  createdAt: true,
+  updatedAt: true,
+  enabled: true
+}).extend({
+  version: z16.string().optional()
+}).partial().superRefine(NodePresetScopeRefine);
+var NodePresetCopySchema = z16.object({
+  newCode: z16.string().regex(NODE_PRESET_CODE_PATTERN, "kebab-case only"),
+  newScope: z16.enum(["global", "project"]),
+  targetProjectId: z16.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional()
+}).superRefine((val, ctx) => {
+  if (val.newScope === "project" && !val.targetProjectId) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["targetProjectId"],
+      message: "newScope=project \u65F6 targetProjectId \u5FC5\u586B"
+    });
+  }
+});
+
+// src/schemas/node-library.ts
+import { z as z17 } from "zod";
+var CompositionEdgeSchema = z17.object({
+  from: z17.string().min(1),
+  to: z17.string().min(1),
+  condition: z17.string().optional(),
+  pausePoint: EdgePausePointSchema.optional()
+});
+var CompositionSchema = z17.object({
+  name: z17.string().min(1),
+  description: z17.string().optional(),
+  nodes: z17.array(z17.string().min(1)).min(1),
+  edges: z17.array(CompositionEdgeSchema)
+});
+var NodeLibrarySchema = z17.object({
+  id: z17.string().optional(),
+  /** 库名 = npm 包名（同库重装按名 upsert 覆盖登记） */
+  name: z17.string().min(1),
+  version: z17.string(),
+  scope: z17.enum(["global", "project"]),
+  projectId: z17.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional(),
+  /** 已装节点 code 清单（flow compose 逐 code 解析 node_presets） */
+  nodes: z17.array(z17.string()),
+  compositions: z17.array(CompositionSchema),
+  installedAt: z17.date().optional()
+});
+var NodeLibraryUpsertSchema = z17.object({
+  name: z17.string().min(1),
+  version: z17.string(),
+  scope: z17.enum(["global", "project"]),
+  projectId: z17.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional(),
+  nodes: z17.array(z17.string()),
+  compositions: z17.array(CompositionSchema)
+}).superRefine((val, ctx) => {
+  if (val.scope === "project" && !val.projectId) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["projectId"],
+      message: "scope=project \u65F6 projectId \u5FC5\u586B"
+    });
+  }
+});
+
+// src/schemas/template-upgrade.ts
+import { z as z18 } from "zod";
+var UpgradeNodeStatusSchema = z18.enum([
+  "updatable",
+  "local-modified",
+  "up-to-date",
+  "source-missing",
+  "source-disabled"
+]);
+var UpgradeActionSchema = z18.enum(["upgrade", "keep", "skip"]);
+var UpgradeDecisionSchema = z18.object({
+  nodeId: z18.string().min(1),
+  action: UpgradeActionSchema,
+  expected: z18.object({ status: UpgradeNodeStatusSchema }).optional()
+});
+var UpgradeApplyRequestSchema = z18.object({
+  decisions: z18.array(UpgradeDecisionSchema).min(1)
 });
 
 // src/config/server-config.ts
-import { z as z10 } from "zod";
-var SimingLogLevelSchema = z10.enum(["debug", "info", "warn", "error"]);
-var SimingConfigSchema = z10.object({
-  mongoUri: z10.string().min(1).default("mongodb://localhost:27017"),
-  port: z10.coerce.number().int().min(1).max(65535).default(7777),
+import { z as z19 } from "zod";
+var SimingLogLevelSchema = z19.enum(["debug", "info", "warn", "error"]);
+var SimingConfigSchema = z19.object({
+  mongoUri: z19.string().min(1).default("mongodb://localhost:27017"),
+  port: z19.coerce.number().int().min(1).max(65535).default(7777),
   /**
    * N018 D8：默认仅绑定本机回环（安全默认）；远程/局域接入（F7）显式配置 host。
    * 超出 PRD V1 配置清单的新增项，依据见技术方案 §3.4「超范围扩展标注」。
    */
-  host: z10.string().min(1).default("127.0.0.1"),
+  host: z19.string().min(1).default("127.0.0.1"),
   logLevel: SimingLogLevelSchema.default("info"),
   /**
-   * F6 预留字段（V2 远程部署）：宽松形态——出现即接受、形状不校验、运行时不读取。
-   * 严格满足 PRD「配置中出现预留字段时不报错」；V2 落地时收紧为类型化 schema。
+   * T202608310001：鉴权开关（F1）——从 F6 预留宽松形态收紧为类型化 schema。
+   * 默认关闭 = 本地开发/存量行为零破坏；云主机部署显式开启（SIMING_AUTH_ENABLED=true）。
    */
-  auth: z10.unknown().optional(),
-  cors: z10.unknown().optional()
+  auth: z19.object({
+    enabled: z19.boolean().default(false)
+  }).prefault({}),
+  cors: z19.unknown().optional()
 });
-var SIMING_CONFIG_KEYS = ["mongoUri", "port", "host", "logLevel"];
+var SIMING_CONFIG_KEYS = ["mongoUri", "port", "host", "logLevel", "auth"];
 var SIMING_CONFIG_ENV_KEYS = {
   mongoUri: "SIMING_MONGO_URI",
   port: "PORT",
   host: "SIMING_HOST",
-  logLevel: "SIMING_LOG_LEVEL"
+  logLevel: "SIMING_LOG_LEVEL",
+  auth: "SIMING_AUTH_ENABLED"
+};
+function parseAuthEnabledEnvValue(raw) {
+  if (raw === "true") return true;
+  if (raw === "false") return false;
+  throw new Error(`SIMING_AUTH_ENABLED \u4EC5\u63A5\u53D7 true/false\uFF0C\u6536\u5230: ${raw}`);
+}
+
+// src/version-bump.ts
+function tryBumpPatch(version) {
+  const m = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+  if (!m || m[1] === void 0 || m[2] === void 0 || m[3] === void 0) return null;
+  return `${m[1]}.${m[2]}.${String(Number(m[3]) + 1)}`;
+}
+function bumpPatch(version) {
+  return tryBumpPatch(version) ?? "1.0.1";
+}
+function bumpPatchOrPassthrough(version) {
+  return tryBumpPatch(version) ?? version;
+}
+
+// src/content-hash.ts
+import { createHash as createHash2 } from "crypto";
+function computeNodeContentHash(node) {
+  const canonical = JSON.stringify({
+    label: node.label,
+    phase: node.phase,
+    track: node.track,
+    prompt: node.prompt,
+    skills: [...node.skills].sort()
+  });
+  return createHash2("sha256").update(canonical).digest("hex").slice(0, 16);
+}
+
+// src/template-content-diff.ts
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value) ?? "null";
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((v) => v === void 0 ? "null" : stableStringify(v)).join(",")}]`;
+  }
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+}
+function sameAgentNames(a, b) {
+  return stableStringify([...a ?? []].sort()) === stableStringify([...b ?? []].sort());
+}
+function edgeKey(e) {
+  return JSON.stringify([e.from, e.to, e.condition ?? null, e.pausePoint ?? null]);
+}
+function diffTemplateContent(imported, existing) {
+  const importedById = new Map(imported.nodes.map((n) => [n.id, n]));
+  const existingById = new Map(existing.nodes.map((n) => [n.id, n]));
+  const nodesAdded = [...importedById.keys()].filter((id) => !existingById.has(id)).sort();
+  const nodesRemoved = [...existingById.keys()].filter((id) => !importedById.has(id)).sort();
+  const nodesChanged = [...importedById.keys()].filter((id) => {
+    const a = importedById.get(id);
+    const b = existingById.get(id);
+    if (a === void 0 || b === void 0) return false;
+    const normA = { ...a, skills: a.skills ?? [] };
+    const normB = { ...b, skills: b.skills ?? [] };
+    return computeNodeContentHash(normA) !== computeNodeContentHash(normB) || !sameAgentNames(a.agents, b.agents) || !sameAgentNames(a.sourcePreset?.agents, b.sourcePreset?.agents);
+  }).sort();
+  const edgesChanged = stableStringify([...imported.edges].map(edgeKey).sort()) !== stableStringify([...existing.edges].map(edgeKey).sort());
+  const descriptionChanged = imported.description !== existing.description;
+  const layoutChanged = stableStringify(imported.layout ?? {}) !== stableStringify(existing.layout ?? {});
+  const identical = imported.name === existing.name && !descriptionChanged && nodesAdded.length === 0 && nodesRemoved.length === 0 && nodesChanged.length === 0 && !edgesChanged && !layoutChanged;
+  return {
+    identical,
+    changes: { nodesAdded, nodesRemoved, nodesChanged, edgesChanged, descriptionChanged, layoutChanged }
+  };
+}
+
+// src/template-upgrade.ts
+function presetContent(preset) {
+  return {
+    label: preset.label,
+    phase: preset.phase,
+    track: preset.track,
+    prompt: preset.prompt,
+    skills: preset.skills
+  };
+}
+var EMPTY_DIFF = {
+  prompt: null,
+  label: null,
+  phase: null,
+  track: null,
+  skills: null,
+  agents: null
 };
+function diffNames(beforeNames, afterNames) {
+  const before = new Set(beforeNames);
+  const after = new Set(afterNames);
+  const added = [...after].filter((name) => !before.has(name)).sort();
+  const removed = [...before].filter((name) => !after.has(name)).sort();
+  return added.length === 0 && removed.length === 0 ? null : { added, removed };
+}
+function sameNames(left, right) {
+  return JSON.stringify([...left].sort()) === JSON.stringify([...right].sort());
+}
+function diffNodeAgainstPreset(node, preset) {
+  return {
+    prompt: node.prompt === preset.prompt ? null : "changed",
+    label: node.label === preset.label ? null : "changed",
+    phase: node.phase === preset.phase ? null : "changed",
+    track: node.track === preset.track ? null : "changed",
+    skills: diffNames(node.skills, preset.skills),
+    agents: diffNames(node.agents ?? [], preset.agents ?? [])
+  };
+}
+function computeUpgradeStatus(node, latest) {
+  const source = node.sourcePreset;
+  if (!source) return { status: "up-to-date", localModified: false };
+  const agentsModified = !sameNames(node.agents ?? [], source.agents ?? []);
+  const localModified = computeNodeContentHash(node) !== source.contentHash || agentsModified;
+  if (!latest) return { status: "source-missing", localModified };
+  if (latest.enabled === false) return { status: "source-disabled", localModified };
+  if (localModified) return { status: "local-modified", localModified };
+  return latest.version !== source.version ? { status: "updatable", localModified: false } : { status: "up-to-date", localModified: false };
+}
+function buildUpgradePlan(template, presetsByCode) {
+  const items = [];
+  for (const node of template.nodes) {
+    const source = node.sourcePreset;
+    if (!source) continue;
+    const latest = presetsByCode.get(source.code) ?? null;
+    const { status, localModified } = computeUpgradeStatus(node, latest);
+    items.push({
+      nodeId: node.id,
+      source: { code: source.code, version: source.version, contentHash: source.contentHash },
+      latest: latest ? {
+        version: latest.version,
+        contentHash: computeNodeContentHash(presetContent(latest)),
+        enabled: latest.enabled ?? true
+      } : null,
+      status,
+      localModified,
+      diff: latest ? diffNodeAgainstPreset(node, latest) : EMPTY_DIFF
+    });
+  }
+  return {
+    templateVersion: template.version,
+    items,
+    upgradableCount: items.filter((item) => item.status === "updatable").length
+  };
+}
+function applyUpgradeDecisions(template, presetsByCode, decisions) {
+  const sourceNodeIds = new Set(template.nodes.filter((n) => n.sourcePreset).map((n) => n.id));
+  const decisionMap = /* @__PURE__ */ new Map();
+  const unknown = [];
+  const duplicated = [];
+  for (const decision of decisions) {
+    if (decisionMap.has(decision.nodeId)) duplicated.push(decision.nodeId);
+    if (!sourceNodeIds.has(decision.nodeId)) unknown.push(decision.nodeId);
+    decisionMap.set(decision.nodeId, decision);
+  }
+  if (duplicated.length > 0) {
+    throw new ValidationError(
+      `\u51B3\u7B56\u542B\u91CD\u590D\u8282\u70B9 id\uFF1A${duplicated.join(", ")}`,
+      duplicated.map((id) => ({ path: ["decisions"], message: `\u8282\u70B9 ${id} \u5B58\u5728\u591A\u6761\u51B3\u7B56` }))
+    );
+  }
+  if (unknown.length > 0) {
+    throw new ValidationError(
+      `\u51B3\u7B56\u542B\u6A21\u677F\u5916\u6216\u65E0\u6765\u6E90\u6807\u8BB0\u7684\u8282\u70B9 id\uFF1A${unknown.join(", ")}`,
+      unknown.map((id) => ({ path: ["decisions"], message: `\u8282\u70B9 ${id} \u4E0D\u5728\u53EF\u5347\u7EA7\u8282\u70B9\u6E05\u5355\u4E2D` }))
+    );
+  }
+  const nodes = template.nodes.map((node) => ({
+    ...node,
+    skills: [...node.skills],
+    agents: [...node.agents ?? []],
+    ...node.sourcePreset ? {
+      sourcePreset: {
+        ...node.sourcePreset,
+        ...node.sourcePreset.agents ? { agents: [...node.sourcePreset.agents] } : {}
+      }
+    } : {}
+  }));
+  const results = [];
+  const stale = [];
+  let changed = false;
+  for (let i = 0; i < template.nodes.length; i++) {
+    const original = template.nodes[i];
+    const source = original.sourcePreset;
+    if (!source) continue;
+    const working = nodes[i];
+    const latest = presetsByCode.get(source.code) ?? null;
+    const { status, localModified } = computeUpgradeStatus(original, latest);
+    const decision = decisionMap.get(original.id);
+    if (localModified && !decision) {
+      throw new ValidationError(
+        `\u8282\u70B9 ${original.id} \u672C\u5730\u5DF2\u4FEE\u6539\uFF08\u72B6\u6001 ${status}\uFF09\uFF0C\u5FC5\u987B\u663E\u5F0F\u51B3\u7B56\uFF08upgrade/keep/skip\uFF09`,
+        [{ path: ["decisions"], message: `\u8282\u70B9 ${original.id} \u7F3A\u5C11\u51B3\u7B56` }],
+        {
+          bizCode: "UPGRADE_DECISION_REQUIRED",
+          message: `${BIZ_CODE_MESSAGES.UPGRADE_DECISION_REQUIRED}\uFF1A${original.id}`
+        }
+      );
+    }
+    if (localModified && decision?.action === "upgrade" && decision.expected === void 0) {
+      throw new ValidationError(
+        `\u8282\u70B9 ${original.id} \u672C\u5730\u5DF2\u4FEE\u6539\uFF0C\u8986\u76D6\u6027 upgrade \u51B3\u7B56\u5FC5\u987B\u643A\u5E26 expected={status:'local-modified'}\uFF08\u91CD\u65B0 plan \u540E\u5E26 expected \u91CD\u8BD5\uFF09`,
+        [{ path: ["decisions"], message: `\u8282\u70B9 ${original.id} \u51B3\u7B56\u7F3A expected \u57FA\u7EBF` }],
+        {
+          bizCode: "UPGRADE_STALE",
+          message: `${BIZ_CODE_MESSAGES.UPGRADE_STALE}\uFF08${original.id} \u51B3\u7B56\u7F3A expected\uFF09`
+        }
+      );
+    }
+    if (!decision) {
+      results.push({ nodeId: original.id, action: "skip", applied: false, reason: "\u672A\u51B3\u7B56\uFF08\u4FDD\u5B88\u8DF3\u8FC7\uFF09" });
+      continue;
+    }
+    if (decision.expected && decision.expected.status !== status) {
+      stale.push(`${original.id}: ${decision.expected.status} \u2192 ${status}`);
+    }
+    if (status === "source-missing" || status === "source-disabled") {
+      results.push({
+        nodeId: original.id,
+        action: "skip",
+        applied: false,
+        reason: status === "source-missing" ? "\u6765\u6E90\u8282\u70B9\u7F3A\u5931\uFF0C\u6309\u7F3A\u7701 skip \u5904\u7406" : "\u6765\u6E90\u8282\u70B9\u5DF2\u505C\u7528\uFF0C\u6309\u7F3A\u7701 skip \u5904\u7406"
+      });
+      continue;
+    }
+    if (!latest) continue;
+    if (status === "up-to-date") {
+      results.push({
+        nodeId: original.id,
+        action: decision.action,
+        applied: false,
+        reason: "\u5DF2\u662F\u6700\u65B0\uFF08\u65E0\u53D8\u66F4\uFF09"
+      });
+      continue;
+    }
+    if (decision.action === "skip") {
+      results.push({ nodeId: original.id, action: "skip", applied: false });
+      continue;
+    }
+    if (decision.action === "upgrade") {
+      working.label = latest.label;
+      working.phase = latest.phase;
+      working.track = latest.track;
+      working.prompt = latest.prompt;
+      working.skills = [...latest.skills];
+      working.agents = [...latest.agents ?? []];
+      working.sourcePreset = {
+        code: source.code,
+        version: latest.version,
+        contentHash: computeNodeContentHash(presetContent(latest)),
+        agents: [...latest.agents ?? []]
+      };
+      changed = true;
+      results.push({ nodeId: original.id, action: "upgrade", applied: true });
+    } else {
+      working.sourcePreset = {
+        code: source.code,
+        version: latest.version,
+        contentHash: computeNodeContentHash(original),
+        agents: [...original.agents ?? []]
+      };
+      changed = true;
+      results.push({ nodeId: original.id, action: "keep", applied: true });
+    }
+  }
+  if (stale.length > 0) {
+    throw new ValidationError(
+      `\u6A21\u677F\u72B6\u6001\u4E0E\u5347\u7EA7\u8BA1\u5212\u4E0D\u7B26\uFF08plan \u540E\u5DF2\u88AB\u4FEE\u6539\uFF09\uFF0C\u8BF7\u91CD\u65B0 plan\u3002\u53D8\u5316\uFF1A${stale.join("; ")}`,
+      stale.map((s) => ({ path: ["decisions"], message: s })),
+      {
+        bizCode: "UPGRADE_STALE",
+        message: `${BIZ_CODE_MESSAGES.UPGRADE_STALE}\uFF08${stale.join("; ")}\uFF09`
+      }
+    );
+  }
+  return { nodes, nextVersion: changed ? bumpPatch(template.version) : null, results };
+}
 
 // src/task/entry-id.ts
 var ENTRY_ID_LENGTH = 6;
@@ -1968,8 +3533,430 @@ function generateEntryId(existing) {
   throw new Error(`entry id generation failed after 32 attempts (existing: ${existing.length})`);
 }
 
+// src/template-transfer/payload.ts
+function toTemplatePayload(tpl) {
+  const { id: _id, projectId: _projectId, enabled: _enabled, createdAt: _ca, updatedAt: _ua, code: _code, ...rest } = tpl;
+  return { ...rest };
+}
+function toSkillPayload(skill) {
+  const { id: _id, projectId: _projectId, enabled: _enabled, createdAt: _ca, updatedAt: _ua, references, ...rest } = skill;
+  return { ...rest, references: references ?? [] };
+}
+function toAgentPayload(agent) {
+  const { id: _id, projectId: _projectId, enabled: _enabled, createdAt: _ca, updatedAt: _ua, references, ...rest } = agent;
+  return { ...rest, references: references ?? [] };
+}
+function toModelAliasPayload(alias) {
+  const { id: _id, createdAt: _ca, updatedAt: _ua, ...rest } = alias;
+  return { ...rest };
+}
+function diffReferences(payload, entity) {
+  const a = payload ?? [];
+  const b = entity ?? [];
+  return a.length === b.length && a.every((doc, i) => doc.path === b[i]?.path && doc.content === b[i]?.content);
+}
+function diffSkillPayload(payload, entity) {
+  const diffs = [];
+  if (entity.description !== payload.description) diffs.push("description");
+  if (entity.content !== payload.content) diffs.push("content");
+  if (entity.category !== payload.category) diffs.push("category");
+  if (entity.version !== payload.version) diffs.push("version");
+  if (!diffReferences(payload.references, entity.references)) diffs.push("references");
+  return diffs;
+}
+function diffAgentPayload(payload, entity) {
+  const diffs = [];
+  if (entity.description !== payload.description) diffs.push("description");
+  if (entity.systemPrompt !== payload.systemPrompt) diffs.push("systemPrompt");
+  if (entity.model !== payload.model) diffs.push("model");
+  if (entity.version !== payload.version) diffs.push("version");
+  if (entity.function !== payload.function) diffs.push("function");
+  const boundA = entity.boundSkills ?? [];
+  if (boundA.length !== payload.boundSkills.length || boundA.some((s, i) => s !== payload.boundSkills[i])) diffs.push("boundSkills");
+  const toolsA = entity.tools ?? [];
+  if (toolsA.length !== payload.tools.length || toolsA.some((t, i) => t !== payload.tools[i])) diffs.push("tools");
+  const permsA = entity.permissions ?? [];
+  if (permsA.length !== payload.permissions.length || permsA.some((p, i) => p !== payload.permissions[i])) diffs.push("permissions");
+  if (!diffReferences(payload.references, entity.references)) diffs.push("references");
+  return diffs;
+}
+function diffModelAliasPayload(payload, entity) {
+  const diffs = [];
+  if (entity.name !== payload.name) diffs.push("name");
+  if (entity.realModel !== payload.realModel) diffs.push("realModel");
+  return diffs;
+}
+
+// src/template-transfer/export-compose.ts
+async function composeExportBundle(deps, templateId) {
+  const tpl = await deps.templateRepo.getById(templateId);
+  if (!tpl) throw new NotFoundError("dag-template", templateId);
+  const warnings = [];
+  const directSkillNames = [...new Set(tpl.nodes.flatMap((node) => node.skills))];
+  const [globalAgents, projectAgents] = await Promise.all([
+    deps.agentRepo.listAgentsByScopeFilter("global", void 0, { includeDisabled: true }),
+    deps.agentRepo.listAgentsByScopeFilter("project", tpl.projectId, { includeDisabled: true })
+  ]);
+  const directSet = new Set(directSkillNames);
+  const agents = [...globalAgents, ...projectAgents].filter(
+    (agent) => (agent.boundSkills ?? []).some((name) => directSet.has(name))
+  );
+  const allSkillNames = [.../* @__PURE__ */ new Set([...directSkillNames, ...agents.flatMap((a) => a.boundSkills ?? [])])];
+  const skillMap = await deps.skillRepo.listSkillsByNames(allSkillNames, "project", tpl.projectId);
+  for (const name of allSkillNames) {
+    if (!skillMap.has(name)) {
+      warnings.push(`SKILL "${name}" \u5728\u6E90\u73AF\u5883\u4E2D\u4E0D\u5B58\u5728\uFF08\u7ED1\u5B9A\u60AC\u7A7A\uFF09\uFF0C\u672A\u5305\u542B\u5728\u5BFC\u51FA\u4F9D\u8D56\u4E2D`);
+    }
+  }
+  const modelCodes = [...new Set(agents.map((a) => a.model))];
+  const modelAliases = [];
+  for (const code of modelCodes) {
+    const alias = await deps.modelAliasRepo.getByCode(code);
+    if (alias) {
+      modelAliases.push(alias);
+    } else {
+      warnings.push(`\u6A21\u578B\u6620\u5C04 "${code}" \u5728\u6E90\u73AF\u5883\u4E2D\u4E0D\u5B58\u5728\uFF08agent.model \u60AC\u7A7A\uFF09\uFF0C\u672A\u5305\u542B\u5728\u5BFC\u51FA\u4F9D\u8D56\u4E2D`);
+    }
+  }
+  return {
+    exportFormatVersion: EXPORT_FORMAT_VERSION,
+    exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    warnings,
+    template: toTemplatePayload(tpl),
+    dependencies: {
+      skills: [...skillMap.values()].map(toSkillPayload),
+      agents: agents.map(toAgentPayload),
+      modelAliases: modelAliases.map(toModelAliasPayload)
+    }
+  };
+}
+
+// src/template-transfer/import-plan.ts
+function statusOf(diffs) {
+  if (diffs === null) return { status: "create" };
+  if (diffs.length === 0) return { status: "identical" };
+  return { status: "conflict", changeSummary: diffs.join(", ") };
+}
+async function hasProjectDefault(deps, targetProjectId) {
+  const hit = await deps.templateRepo._collection.findOne(
+    { projectId: targetProjectId, isDefault: true },
+    { projection: { _id: 1 } }
+  );
+  return hit !== null;
+}
+async function findTemplateByName(deps, targetProjectId, name) {
+  const rows = await deps.templateRepo.listDagTemplates({ projectId: targetProjectId, name, includeDisabled: true });
+  const row = rows[0];
+  return row && row.id ? { id: row.id, version: row.version } : null;
+}
+async function buildImportPlan(deps, targetProjectId, bundle) {
+  const warnings = [];
+  const existing = await findTemplateByName(deps, targetProjectId, bundle.template.name);
+  const projectHasDefault = await hasProjectDefault(deps, targetProjectId);
+  const isDefaultEffect = bundle.template.isDefault && !projectHasDefault;
+  const skillChecks = [];
+  for (const payload of bundle.dependencies.skills) {
+    const entity = await deps.skillRepo.getByNameScoped(
+      payload.name,
+      payload.scope,
+      payload.scope === "project" ? targetProjectId : void 0,
+      { includeDisabled: true }
+    );
+    const { status, changeSummary } = statusOf(entity ? diffSkillPayload(payload, entity) : null);
+    skillChecks.push({
+      kind: "skill",
+      name: payload.name,
+      scope: payload.scope,
+      status,
+      ...entity ? { currentVersion: entity.version } : {},
+      importVersion: payload.version,
+      ...changeSummary ? { changeSummary } : {},
+      impact: payload.scope
+    });
+  }
+  const agentChecks = [];
+  for (const payload of bundle.dependencies.agents) {
+    const entity = await deps.agentRepo.getByNameScoped(
+      payload.name,
+      payload.scope,
+      payload.scope === "project" ? targetProjectId : void 0,
+      { includeDisabled: true }
+    );
+    const { status, changeSummary } = statusOf(entity ? diffAgentPayload(payload, entity) : null);
+    agentChecks.push({
+      kind: "agent",
+      name: payload.name,
+      scope: payload.scope,
+      status,
+      ...entity ? { currentVersion: entity.version } : {},
+      importVersion: payload.version,
+      ...changeSummary ? { changeSummary } : {},
+      impact: payload.scope
+    });
+  }
+  const aliasChecks = [];
+  for (const payload of bundle.dependencies.modelAliases) {
+    const entity = await deps.modelAliasRepo.getByCode(payload.code);
+    const { status, changeSummary } = statusOf(entity ? diffModelAliasPayload(payload, entity) : null);
+    aliasChecks.push({
+      kind: "modelAlias",
+      name: payload.code,
+      status,
+      ...changeSummary ? { changeSummary } : {},
+      // 模型映射无 version 概念（内容即 name/realModel 二元组）
+      impact: "global"
+    });
+  }
+  const bundledCodes = new Set(bundle.dependencies.modelAliases.map((a) => a.code));
+  for (const agent of bundle.dependencies.agents) {
+    if (bundledCodes.has(agent.model)) continue;
+    const alias = await deps.modelAliasRepo.getByCode(agent.model);
+    if (!alias) {
+      warnings.push(`AGENT "${agent.name}" \u5F15\u7528\u7684\u6A21\u578B\u6620\u5C04 "${agent.model}" \u4E0D\u5728\u5BFC\u51FA\u5305\u4E2D\u4E14\u76EE\u6807\u73AF\u5883\u4E0D\u5B58\u5728\uFF0C\u5BFC\u5165\u540E\u8BE5\u5F15\u7528\u5C06\u60AC\u7A7A`);
+    }
+  }
+  const bundledSkillNames = new Set(bundle.dependencies.skills.map((s) => s.name));
+  for (const agent of bundle.dependencies.agents) {
+    for (const skillName of agent.boundSkills) {
+      if (bundledSkillNames.has(skillName)) continue;
+      const globalHit = await deps.skillRepo.getByNameScoped(skillName, "global", void 0, { includeDisabled: true });
+      const projectHit = agent.scope === "project" ? await deps.skillRepo.getByNameScoped(skillName, "project", targetProjectId, { includeDisabled: true }) : null;
+      if (!globalHit && !projectHit) {
+        warnings.push(`AGENT "${agent.name}" \u7ED1\u5B9A\u7684 SKILL "${skillName}" \u4E0D\u5728\u5BFC\u51FA\u5305\u4E2D\u4E14\u76EE\u6807\u73AF\u5883\u4E0D\u5B58\u5728\uFF0C\u5BFC\u5165\u540E\u8BE5\u7ED1\u5B9A\u5C06\u60AC\u7A7A`);
+      }
+    }
+  }
+  const directSkillChecks = [];
+  const unbundledNames = [...new Set(bundle.template.nodes.flatMap((n) => n.skills).filter((s) => !bundledSkillNames.has(s)))];
+  const envVisibleSkills = unbundledNames.length > 0 ? await deps.skillRepo.listSkillsByNames(unbundledNames, "project", targetProjectId) : /* @__PURE__ */ new Map();
+  for (const node of bundle.template.nodes) {
+    for (const skillName of node.skills) {
+      if (bundledSkillNames.has(skillName) || envVisibleSkills.has(skillName)) {
+        directSkillChecks.push({ node: node.id, skill: skillName, status: "ok" });
+      } else {
+        directSkillChecks.push({ node: node.id, skill: skillName, status: "missing" });
+        warnings.push(`\u6A21\u677F\u8282\u70B9 ${node.id} \u76F4\u63A5\u5F15\u7528\u6280\u80FD "${skillName}" \u4E0D\u5728\u5BFC\u51FA\u5305\u4E2D\u4E14\u76EE\u6807\u73AF\u5883\u4E0D\u5B58\u5728\uFF08\u7ED1\u5B9A\u60AC\u7A7A\uFF09`);
+      }
+    }
+  }
+  const presetCodes = [...new Set(bundle.template.nodes.flatMap((n) => n.sourcePreset ? [n.sourcePreset.code] : []))];
+  const presetsByCode = presetCodes.length > 0 ? await deps.nodePresetRepo.listByCodes(presetCodes) : /* @__PURE__ */ new Map();
+  for (const node of bundle.template.nodes) {
+    if (node.sourcePreset && !presetsByCode.has(node.sourcePreset.code)) {
+      warnings.push(`\u6A21\u677F\u8282\u70B9 ${node.id} \u7684\u6765\u6E90\u8282\u70B9 "${node.sourcePreset.code}" \u5728\u76EE\u6807\u73AF\u5883\u4E0D\u5B58\u5728\uFF0C\u5BFC\u5165\u5C06\u5265\u9664\u6765\u6E90\u6807\u8BB0\uFF08\u964D\u7EA7\u81EA\u5EFA\u8282\u70B9\uFF09`);
+    }
+  }
+  return {
+    template: {
+      name: bundle.template.name,
+      willOverwrite: existing !== null,
+      ...existing ? { currentVersion: existing.version } : {},
+      importVersion: bundle.template.version,
+      isDefaultRequested: bundle.template.isDefault,
+      isDefaultEffect,
+      ...bundle.template.isDefault && !isDefaultEffect ? { downgradeReason: "project_has_default" } : {}
+    },
+    dependencies: [...skillChecks, ...agentChecks, ...aliasChecks],
+    directSkillChecks,
+    warnings
+  };
+}
+
+// src/template-transfer/import-apply.ts
+async function applyImport(deps, targetProjectId, bundle, decisions) {
+  const decisionMap = new Map(decisions.map((d) => [decisionKey(d.kind, "scope" in d ? d.scope : void 0, d.name), d.action]));
+  const existing = await findTemplateByName(deps, targetProjectId, bundle.template.name);
+  const projectHasDefault = await hasProjectDefault(deps, targetProjectId);
+  const isDefaultEffect = bundle.template.isDefault && !projectHasDefault;
+  const tplPayload = bundle.template;
+  const sourceCodes = [...new Set(tplPayload.nodes.flatMap((n) => n.sourcePreset ? [n.sourcePreset.code] : []))];
+  const presetsByCode = sourceCodes.length > 0 ? await deps.nodePresetRepo.listByCodes(sourceCodes) : /* @__PURE__ */ new Map();
+  const sourceStripped = [];
+  const nodesForWrite = tplPayload.nodes.map((node) => {
+    if (node.sourcePreset && !presetsByCode.has(node.sourcePreset.code)) {
+      sourceStripped.push(node.id);
+      const { sourcePreset: _stripped, ...rest } = node;
+      return rest;
+    }
+    return node;
+  });
+  const createInput = { ...tplPayload, projectId: targetProjectId, isDefault: isDefaultEffect, nodes: nodesForWrite };
+  const parsed = DagTemplateCreateSchema.safeParse(createInput);
+  if (!parsed.success) {
+    throw new ValidationError("\u6A21\u677F\u5185\u5BB9\u6821\u9A8C\u5931\u8D25\uFF08\u5BFC\u5165\u6587\u4EF6\u5B57\u6BB5\u975E\u6CD5\uFF09", parsed.error.issues);
+  }
+  assertUniqueNodeIds(nodesForWrite);
+  const contentFields = {
+    name: tplPayload.name,
+    description: tplPayload.description,
+    nodes: nodesForWrite,
+    edges: tplPayload.edges,
+    version: tplPayload.version,
+    isDefault: isDefaultEffect,
+    layout: tplPayload.layout ?? {}
+  };
+  let templateResult;
+  if (existing) {
+    const updated = await deps.templateRepo.update(existing.id, contentFields);
+    if (!updated || !updated.id) throw new NotFoundError("dag-template", existing.id);
+    templateResult = { id: updated.id, name: updated.name, action: "updated", isDefaultEffect };
+  } else {
+    const raced = await findTemplateByName(deps, targetProjectId, tplPayload.name);
+    if (raced) {
+      throw new ConflictError("dag-template", `name conflict: ${tplPayload.name}`, {
+        bizCode: "TEMPLATE_NAME_CONFLICT",
+        message: BIZ_CODE_MESSAGES.TEMPLATE_NAME_CONFLICT
+      });
+    }
+    const created = await deps.templateRepo.createDagTemplate({ ...createInput, layout: tplPayload.layout ?? {} });
+    if (!created.id) throw new Error("\u6A21\u677F\u521B\u5EFA\u8FD4\u56DE\u5B9E\u4F53\u7F3A\u5931 id\uFF08\u4E0D\u53EF\u8FBE\u9632\u5FA1\u5206\u652F\uFF09");
+    templateResult = { id: created.id, name: created.name, action: "created", isDefaultEffect };
+  }
+  const results = [];
+  for (const payload of bundle.dependencies.skills) {
+    try {
+      const key = decisionKey("skill", payload.scope, payload.name);
+      const existingSkill = await deps.skillRepo.getByNameScoped(
+        payload.name,
+        payload.scope,
+        payload.scope === "project" ? targetProjectId : void 0,
+        { includeDisabled: true }
+      );
+      const diffs = existingSkill ? diffSkillPayload(payload, existingSkill) : null;
+      const status = diffs === null ? "create" : diffs.length === 0 ? "identical" : "conflict";
+      const action = decide(status, decisionMap.get(key));
+      if (action === "identical") {
+        results.push({ kind: "skill", name: payload.name, scope: payload.scope, action: "identical" });
+        continue;
+      }
+      if (action === "skipped") {
+        results.push({ kind: "skill", name: payload.name, scope: payload.scope, action: "skipped" });
+        continue;
+      }
+      const createData = { ...payload, ...payload.scope === "project" ? { projectId: targetProjectId } : {} };
+      const check = SkillCreateSchema.safeParse(createData);
+      if (!check.success) {
+        results.push({ kind: "skill", name: payload.name, scope: payload.scope, action: "failed", message: summarizeIssues(check.error.issues) });
+        continue;
+      }
+      if (existingSkill && existingSkill.id) {
+        await deps.skillRepo.updateByNameScoped(
+          payload.name,
+          payload.scope,
+          payload.scope === "project" ? targetProjectId : void 0,
+          {
+            description: payload.description,
+            content: payload.content,
+            category: payload.category,
+            version: payload.version,
+            references: payload.references
+          }
+        );
+        results.push({ kind: "skill", name: payload.name, scope: payload.scope, action: "updated" });
+      } else {
+        await deps.skillRepo.createSkill(check.data);
+        results.push({ kind: "skill", name: payload.name, scope: payload.scope, action: "created" });
+      }
+    } catch (err) {
+      results.push({ kind: "skill", name: payload.name, scope: payload.scope, action: "failed", message: errorMessage(err) });
+    }
+  }
+  for (const payload of bundle.dependencies.agents) {
+    try {
+      const key = decisionKey("agent", payload.scope, payload.name);
+      const existingAgent = await deps.agentRepo.getByNameScoped(
+        payload.name,
+        payload.scope,
+        payload.scope === "project" ? targetProjectId : void 0,
+        { includeDisabled: true }
+      );
+      const diffs = existingAgent ? diffAgentPayload(payload, existingAgent) : null;
+      const status = diffs === null ? "create" : diffs.length === 0 ? "identical" : "conflict";
+      const action = decide(status, decisionMap.get(key));
+      if (action === "identical" || action === "skipped") {
+        results.push({ kind: "agent", name: payload.name, scope: payload.scope, action });
+        continue;
+      }
+      const createData = { ...payload, ...payload.scope === "project" ? { projectId: targetProjectId } : {} };
+      const check = AgentCreateSchema.safeParse(createData);
+      if (!check.success) {
+        results.push({ kind: "agent", name: payload.name, scope: payload.scope, action: "failed", message: summarizeIssues(check.error.issues) });
+        continue;
+      }
+      await assertBoundSkillsCompatible(
+        deps.skillRepo,
+        payload.scope,
+        payload.scope === "project" ? targetProjectId : void 0,
+        payload.boundSkills
+      );
+      if (existingAgent && existingAgent.id) {
+        await deps.agentRepo.updateByNameScoped(
+          payload.name,
+          payload.scope,
+          payload.scope === "project" ? targetProjectId : void 0,
+          {
+            description: payload.description,
+            systemPrompt: payload.systemPrompt,
+            boundSkills: payload.boundSkills,
+            model: payload.model,
+            tools: payload.tools,
+            permissions: payload.permissions,
+            version: payload.version,
+            references: payload.references,
+            "function": payload.function
+          }
+        );
+        results.push({ kind: "agent", name: payload.name, scope: payload.scope, action: "updated" });
+      } else {
+        await deps.agentRepo.createAgent(check.data);
+        results.push({ kind: "agent", name: payload.name, scope: payload.scope, action: "created" });
+      }
+    } catch (err) {
+      results.push({ kind: "agent", name: payload.name, scope: payload.scope, action: "failed", message: errorMessage(err) });
+    }
+  }
+  for (const payload of bundle.dependencies.modelAliases) {
+    try {
+      const key = decisionKey("modelAlias", void 0, payload.code);
+      const existingAlias = await deps.modelAliasRepo.getByCode(payload.code);
+      const diffs = existingAlias ? diffModelAliasPayload(payload, existingAlias) : null;
+      const status = diffs === null ? "create" : diffs.length === 0 ? "identical" : "conflict";
+      const action = decide(status, decisionMap.get(key));
+      if (action === "identical" || action === "skipped") {
+        results.push({ kind: "modelAlias", name: payload.code, action });
+        continue;
+      }
+      if (existingAlias) {
+        await deps.modelAliasRepo.updateByCode(payload.code, { name: payload.name, realModel: payload.realModel });
+        results.push({ kind: "modelAlias", name: payload.code, action: "updated" });
+      } else {
+        const createData = { code: payload.code, name: payload.name, realModel: payload.realModel };
+        await deps.modelAliasRepo.createModelAlias(createData);
+        results.push({ kind: "modelAlias", name: payload.code, action: "created" });
+      }
+    } catch (err) {
+      results.push({ kind: "modelAlias", name: payload.code, action: "failed", message: errorMessage(err) });
+    }
+  }
+  return { template: templateResult, dependencies: results, sourceStripped };
+}
+function decide(status, decision) {
+  if (status === "identical") return "identical";
+  if (status === "create") return "create";
+  return decision === "overwrite" ? "overwrite" : "skipped";
+}
+function summarizeIssues(issues) {
+  const parts = issues.map(
+    (issue) => `${issue.path.join(".")}: ${issue.message}`
+  );
+  return `\u6821\u9A8C\u5931\u8D25\uFF1A${parts.join("; ")}`;
+}
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
 // src/index.ts
-var PackageJsonSchema = z11.object({ version: z11.string().min(1) });
+var PackageJsonSchema = z20.object({ version: z20.string().min(1) });
 var packageJsonParsed = PackageJsonSchema.safeParse(
   JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf-8"))
 );
@@ -1981,28 +3968,49 @@ function ping() {
   return "pong";
 }
 export {
+  AGENT_MAIN_DOC,
   ARTIFACT_TYPES,
+  AUTH_COLLECTIONS,
   AdvanceRequestSchema,
   AdvanceResponseSchema,
   AgentCopySchema,
   AgentCreateSchema,
+  AgentFunctionSchema,
+  AgentPayloadSchema,
   AgentSchema,
   AgentScopeSchema,
+  AgentShapeSchema,
   AgentUpdateSchema,
   AppError,
   ApproveRequestSchema,
   ApproveResponseSchema,
   ArchNoteSchema,
   ArtifactSchema,
+  AssetSetEnabledSchema,
+  AuthAccountCreateSchema,
+  AuthAccountSchema,
+  AuthStatusSchema,
+  AuthTokenGenResponseSchema,
+  AuthTokenSchema,
+  AuthTokenStatusSchema,
+  AuthTokenTypeSchema,
+  AuthWhoamiSchema,
   BIZ_CODE_MESSAGES,
   BadRequestError,
+  CONTEXT_VIEWS,
+  CancelRequestSchema,
   CheckItemSchema,
+  CompositionEdgeSchema,
+  CompositionSchema,
   ConfirmationSchema,
   ConflictError,
+  ContextViewSchema,
+  CreateTaskResponseSchema,
   DAG_PHASES,
   DAG_TRACKS,
   DEFAULT_PROJECT_KEY,
   DagEdgeSchema,
+  DagInstanceNodeSchema,
   DagInstanceSchema,
   DagNodePhaseSchema,
   DagNodeSchema,
@@ -2012,85 +4020,171 @@ export {
   DagTemplateSchema,
   DagTemplateUpdateSchema,
   DecisionSchema,
+  DependencyActionSchema,
+  DependencyCheckSchema,
+  DependencyStatusSchema,
   ENTRY_ID_REGEX,
+  EXPORT_FORMAT_VERSION,
+  EchoItemSchema,
   EdgePausePointBaseSchema,
   EdgePausePointSchema,
   EnumEntrySchema,
   EnumRegistryCategorySchema,
   EnumRegistrySchema,
   EnumRegistryUpdateSchema,
+  ExportBundleSchema,
+  ForbiddenError,
   HistoryActionSchema,
   HistoryEntrySchema,
+  ImportApplyRequestSchema,
+  ImportApplyResponseSchema,
+  ImportDecisionSchema,
+  ImportPlanRequestSchema,
+  ImportPlanResponseSchema,
+  LoginSchema,
   ModelAliasCreateSchema,
+  ModelAliasPayloadSchema,
   ModelAliasSchema,
   ModelAliasShapeSchema,
   ModelAliasUpdateSchema,
   ModelAliasWithRefCountSchema,
   NODE_ID_PATTERN,
+  NODE_PRESET_CODE_PATTERN,
   NODE_STATUSES,
   NodeInfoSchema,
+  NodeLibrarySchema,
+  NodeLibraryUpsertSchema,
+  NodePresetCopySchema,
+  NodePresetCreateSchema,
+  NodePresetSchema,
+  NodePresetShapeSchema,
+  NodePresetUpdateSchema,
   NodeRecordSchema,
   NodeStateSchema,
   NodeStatusSchema,
   NotFoundError,
   OBJECT_ID_HEX,
   PAUSE_POINT_TYPES,
+  PasswordChangeSchema,
   PausePointTypeSchema,
   PauseRequestSchema,
   ProjectCreateSchema,
   ProjectSchema,
   ProjectStatusSchema,
   ProjectUpdateSchema,
+  REFERENCE_LIMITS,
   ResumeRequestSchema,
   ReviewSummarySchema,
   SIMING_CODE_REGEX,
   SIMING_CONFIG_ENV_KEYS,
   SIMING_CONFIG_KEYS,
+  SKILL_MAIN_DOC,
   SimingConfigSchema,
   SimingLogLevelSchema,
   SkillCopySchema,
   SkillCreateSchema,
+  SkillPayloadSchema,
   SkillSchema,
   SkillScopeSchema,
+  SkillShapeSchema,
   SkillUpdateSchema,
+  SourcePresetSchema,
   TASK_PHASES,
   TASK_STATUSES,
   TASK_TYPES,
+  TEMPLATE_CODE_MAX_LENGTH,
+  TEMPLATE_CODE_REGEX,
+  TaskBatchAckSchema,
+  TaskBatchEntrySchema,
+  TaskBatchFailureSchema,
   TaskContextSchema,
   TaskCreateInputSchema,
   TaskDocContentSchema,
   TaskPhaseSchema,
+  TaskProgressPublicSchema,
+  TaskProgressSchema,
   TaskPublicSchema,
   TaskSchema,
   TaskStatusSchema,
   TaskSummarySchema,
+  TemplateCandidateSchema,
+  TemplateCodeFieldSchema,
+  TemplatePayloadSchema,
+  UnauthorizedError,
+  UpgradeActionSchema,
+  UpgradeApplyRequestSchema,
+  UpgradeDecisionSchema,
+  UpgradeNodeStatusSchema,
   VERSION,
   ValidationError,
+  WRITE_ACK_ENTRY_KINDS,
+  WriteAckEntryKindSchema,
+  WriteAckSchema,
   advanceTask,
+  applyImport,
+  applyUpgradeDecisions,
   approveTask,
   assertBoundSkillsCompatible,
   assertModelAliasExists,
+  assertReferenceAggregateLimit,
+  assertReferencesDeletable,
+  assertUniqueNodeIds,
+  buildImportPlan,
+  buildTemplateCode,
+  buildUpgradePlan,
+  bumpPatch,
+  bumpPatchOrPassthrough,
+  cancelTask,
+  canonicalizeReferencePath,
   checkTermination,
+  composeExportBundle,
+  computeNodeContentHash,
+  computeUpgradeStatus,
   createAgentRepo,
+  createAuthAccountRepo,
+  createAuthSessionRepo,
+  createAuthTokenRepo,
   createDagTemplateRepo,
   createEnumRegistryRepo,
   createModelAliasRepo,
   createMongoClient,
+  createNodeLibraryRepo,
+  createNodePresetRepo,
   createProjectRepo,
+  createReferencesSchema,
   createRepo,
   createSkillRepo,
   createTaskRepo,
+  decisionKey,
+  diffTemplateContent,
+  enabledNeFalse,
+  escapeRegExpLiteral,
+  excerpt,
+  findDuplicateNodeIds,
   findNextEdge,
+  findTemplateByName,
   generateEntryId,
   generateProjectKey,
+  generateSessionId,
+  generateToken,
+  hasProjectDefault,
+  hashPassword,
+  hashToken,
+  isLegalTemplateCode,
   mkHistory,
+  normalizeNameToTemplateCode,
+  parseAuthEnabledEnvValue,
   pauseTask,
   ping,
   pruneInstance,
   renderPrompt,
   resumeTask,
+  sumReferenceContentChars,
+  taskProgress,
   toNodeInfo,
   toTaskPublic,
+  tokenTypeFromValue,
   trackMatchSet,
+  verifyPassword,
   withTransaction
 };