@siming-org/core 0.4.0 → 0.5.0

package/dist/index.js

@@ -1,6 +1,6 @@
 // src/index.ts
 import { readFileSync } from "fs";
-import { z as z15 } from "zod";
+import { z as z20 } from "zod";
 
 // src/store/client.ts
 import { MongoClient } from "mongodb";
@@ -104,6 +104,9 @@ var BIZ_CODE_MESSAGES = {
   TASK_PROJECT_IMMUTABLE: "\u4EFB\u52A1\u5F52\u5C5E\u9879\u76EE\u521B\u5EFA\u540E\u4E0D\u53EF\u53D8\u66F4",
   DEFAULT_PROJECT_IMMUTABLE: "\u9ED8\u8BA4\u9879\u76EE\u4E0D\u53EF\u505C\u7528",
   TEMPLATE_NAME_CONFLICT: "\u76EE\u6807\u9879\u76EE\u5185\u5DF2\u5B58\u5728\u540C\u540D\u6A21\u677F",
+  // T202609020002 模板业务 code 域（创建冲突/不可变；E11000 兜底由 repo 层按 keyValue 二次映射为 TEMPLATE_CODE_CONFLICT）
+  TEMPLATE_CODE_CONFLICT: "\u76EE\u6807\u9879\u76EE\u5185\u5DF2\u5B58\u5728\u76F8\u540C code \u7684\u6A21\u677F\uFF08code \u9879\u76EE\u5185\u552F\u4E00\uFF09",
+  TEMPLATE_CODE_IMMUTABLE: "\u6A21\u677F code \u521B\u5EFA\u540E\u4E0D\u53EF\u53D8\uFF08\u5982\u9700\u65B0\u6807\u8BC6\u8BF7\u590D\u5236\u6A21\u677F\u6307\u5B9A\u65B0 code\uFF09",
   // 仅覆盖 404 分支（不存在）；archived 走独立的 409 PROJECT_ARCHIVED，勿在此合并语义
   PROJECT_NOT_FOUND: "\u9879\u76EE\u4E0D\u5B58\u5728",
   AGENT_SKILL_SCOPE_CONFLICT: "Agent \u7ED1\u5B9A\u7684 Skill \u4F5C\u7528\u57DF\u4E0D\u517C\u5BB9\uFF08\u5168\u5C40 Agent \u4EC5\u53EF\u7ED1\u5B9A\u5168\u5C40 Skill\uFF09",
@@ -131,7 +134,26 @@ var BIZ_CODE_MESSAGES = {
   TASK_SKIP_NODE_NOT_FOUND: "skip \u6E05\u5355\u542B\u6A21\u677F\u4E0D\u5B58\u5728\u7684\u8282\u70B9 id\uFF08\u89C1\u9519\u8BEF\u8BE6\u60C5\u7684\u5408\u6CD5\u8282\u70B9\u6E05\u5355\uFF09",
   TASK_TYPE_TRACK_MISMATCH: "\u4EFB\u52A1\u7C7B\u578B\u4E0E\u8F68\u9053\u7EC4\u5408\u975E\u6CD5\uFF08research \u8F68\u9053\u4E3A\u8C03\u7814\u7C7B\u578B\u4E13\u7528\u503C\uFF1BUI \u5FAE\u8C03\u4EC5\u9002\u7528 ui \u8F68\u9053\uFF09",
   // T202608290001：停用模板创建任务守卫（资产启停——停用对创建通道同样不可见）
-  TEMPLATE_DISABLED: "\u6A21\u677F\u5DF2\u505C\u7528\uFF0C\u7981\u6B62\u7528\u4E8E\u521B\u5EFA\u4EFB\u52A1\uFF08Web \u7BA1\u7406\u53F0\u53EF\u91CD\u65B0\u542F\u7528\uFF09"
+  TEMPLATE_DISABLED: "\u6A21\u677F\u5DF2\u505C\u7528\uFF0C\u7981\u6B62\u7528\u4E8E\u521B\u5EFA\u4EFB\u52A1\uFF08Web \u7BA1\u7406\u53F0\u53EF\u91CD\u65B0\u542F\u7528\uFF09",
+  // T202608310001：鉴权域（错误响应以 error: bizCode 为机器可判键）
+  AUTH_REQUIRED: "\u9700\u8981\u767B\u5F55\u6216\u914D\u7F6E Token\uFF08Web \u767B\u5F55\uFF1BCLI \u8FD0\u884C siming auth token set \u914D\u7F6E\uFF09",
+  AUTH_TOKEN_INVALID: "Token \u65E0\u6548\u6216\u5DF2\u88AB\u91CD\u7F6E\uFF08Web \u7BA1\u7406\u53F0\u91CD\u65B0\u751F\u6210\u540E\u8FD0\u884C siming auth token set \u66F4\u65B0\uFF09",
+  AUTH_INVALID_CREDENTIALS: "\u8D26\u53F7\u6216\u5BC6\u7801\u9519\u8BEF",
+  AUTH_FORBIDDEN: "\u5F53\u524D\u51ED\u8BC1\u65E0\u6743\u6267\u884C\u6B64\u64CD\u4F5C\uFF08\u9879\u76EE Token \u4EC5\u9650\u672C\u9879\u76EE\u8BFB\u5199\u4E0E\u5168\u5C40\u8D44\u4EA7\u53EA\u8BFB\uFF09",
+  AUTH_ACCOUNT_EXISTS: "\u7BA1\u7406\u5458\u8D26\u53F7\u5DF2\u521D\u59CB\u5316\uFF08\u65E0\u9700\u91CD\u590D\u521B\u5EFA\uFF09",
+  // T202609010002：批量写入域（信封级——空批/超限整批拒绝并提示拆分）
+  BATCH_EMPTY: "\u6279\u91CF\u6761\u76EE\u4E3A\u7A7A\uFF08items \u81F3\u5C11 1 \u6761\uFF09",
+  BATCH_LIMIT_EXCEEDED: "\u5355\u6B21\u6279\u91CF\u4E0A\u9650 50 \u6761\uFF0C\u8BF7\u62C6\u5206\u4E3A\u591A\u6B21\u8C03\u7528",
+  BATCH_PAYLOAD_TOO_LARGE: "\u6279\u91CF\u5168\u6587\u5FEB\u7167\u603B\u91CF\u8D85\u9650\uFF082M \u5B57\u7B26/\u6279\uFF09\uFF0C\u8BF7\u62C6\u5206\u4E3A\u591A\u6B21\u8C03\u7528\u6216\u6539\u7528 path \u5F15\u7528",
+  // T202609020001：通用 DAG 节点资产域
+  NODE_PRESET_CODE_EXISTS: "\u8282\u70B9 code \u5DF2\u5B58\u5728\uFF08code \u5168\u5C40\u552F\u4E00\uFF0C\u8DE8\u4F5C\u7528\u57DF\u4E0D\u53EF\u91CD\u590D\uFF09",
+  NODE_PRESET_CODE_IMMUTABLE: "\u8282\u70B9 code \u521B\u5EFA\u540E\u4E0D\u53EF\u53D8",
+  NODE_PRESET_VERSION_REQUIRED: "\u8282\u70B9\u5185\u5BB9\u53D8\u66F4\u5FC5\u987B\u540C\u6B65\u63D0\u5347\u7248\u672C\u53F7\uFF08version \u5B57\u6BB5\uFF09",
+  TEMPLATE_NODE_ID_DUPLICATE: "\u6A21\u677F\u5185\u8282\u70B9 id \u91CD\u590D\uFF08\u5148\u5728\u8282\u70B9\u5E93\u4E2D\u590D\u5236\u6539\u540D\u6216\u8C03\u6574\u6A21\u677F\u8282\u70B9\u6807\u8BC6\uFF09",
+  NODE_LIBRARY_COMPOSITION_NOT_FOUND: "\u7EC4\u5408\u5B9A\u4E49\u4E0D\u5B58\u5728\uFF08\u591A\u5E93\u540C\u540D\u7EC4\u5408\u9700\u663E\u5F0F\u6307\u5B9A\u6765\u6E90\u5E93\uFF09",
+  UPGRADE_DECISION_REQUIRED: "\u672C\u5730\u5DF2\u4FEE\u6539\u7684\u8282\u70B9\u5FC5\u987B\u663E\u5F0F\u51B3\u7B56\uFF08upgrade/keep/skip\uFF09",
+  UPGRADE_STALE: "\u6A21\u677F\u72B6\u6001\u4E0E\u5347\u7EA7\u8BA1\u5212\u4E0D\u7B26\uFF08\u8BA1\u5212\u540E\u6A21\u677F\u5DF2\u88AB\u7F16\u8F91\uFF09\uFF0C\u8BF7\u91CD\u65B0\u83B7\u53D6\u5347\u7EA7\u8BA1\u5212",
+  FLOW_MANIFEST_INVALID: "\u8282\u70B9\u5E93 manifest \u683C\u5F0F\u6216\u7248\u672C\u4E0D\u652F\u6301"
 };
 var AppError = class extends Error {
 };
@@ -150,8 +172,25 @@ var NotFoundError = class extends AppError {
   statusCode = 404;
   code = "not_found";
   bizCode;
+  /**
+   * T202609020002：not-found 相近候选清单（模板寻址防转录错误——格式合法但不存在的
+   * code/数据库 id，错误信息携带项目内相近模板，转录错误可当场发现）。附加到响应体
+   * 的 candidates 字段；仅模板寻址路由经 withTemplateCandidates 注入（构造后写入故非
+   * readonly——外部读、内部一次写），其余资源 not-found 形态不变。
+   */
+  templateCandidates;
+  withTemplateCandidates(candidates) {
+    this.templateCandidates = candidates;
+    return this;
+  }
   toResponse() {
-    return { error: this.bizCode ?? this.code, message: this.message, resource: this.resource, id: this.id };
+    return {
+      error: this.bizCode ?? this.code,
+      message: this.message,
+      resource: this.resource,
+      id: this.id,
+      ...this.templateCandidates !== void 0 ? { candidates: this.templateCandidates } : {}
+    };
   }
 };
 var BadRequestError = class extends AppError {
@@ -207,6 +246,31 @@ var ValidationError = class extends AppError {
     return { error: this.bizCode ?? this.code, message: this.message, issues: this.issues };
   }
 };
+var UnauthorizedError = class extends AppError {
+  constructor(bizCode) {
+    super(BIZ_CODE_MESSAGES[bizCode]);
+    this.bizCode = bizCode;
+    this.name = "UnauthorizedError";
+  }
+  bizCode;
+  statusCode = 401;
+  code = "unauthorized";
+  toResponse() {
+    return { error: this.bizCode, message: this.message };
+  }
+};
+var ForbiddenError = class extends AppError {
+  statusCode = 403;
+  code = "forbidden";
+  bizCode = "AUTH_FORBIDDEN";
+  constructor() {
+    super(BIZ_CODE_MESSAGES.AUTH_FORBIDDEN);
+    this.name = "ForbiddenError";
+  }
+  toResponse() {
+    return { error: this.bizCode, message: this.message };
+  }
+};
 
 // src/store/repos/skill.repo.ts
 function createSkillRepo(db) {
@@ -268,6 +332,12 @@ function createSkillRepo(db) {
       const skills = await base.list(filter);
       return new Map(skills.map((s) => [s.name, s]));
     },
+    async hasNameScopeConflict(name, scope) {
+      return await base._collection.countDocuments(
+        scope === "global" ? { name, scope: "project" } : { name, scope: "global" },
+        { limit: 1 }
+      ) > 0;
+    },
     async copySkill(sourceName, source, target, newName) {
       const src = await base._collection.findOne(
         source.scope === "project" ? { name: sourceName, scope: "project", projectId: source.projectId } : { name: sourceName, scope: "global" }
@@ -379,6 +449,12 @@ function createAgentRepo(db) {
     async listAgents(opts) {
       return base.list(listQuery({}, opts));
     },
+    async hasNameScopeConflict(name, scope) {
+      return await base._collection.countDocuments(
+        scope === "global" ? { name, scope: "project" } : { name, scope: "global" },
+        { limit: 1 }
+      ) > 0;
+    },
     async copyAgent(sourceName, source, target, newName, skillRepo) {
       const src = await base._collection.findOne(
         source.scope === "project" ? { name: sourceName, scope: "project", projectId: source.projectId } : { name: sourceName, scope: "global" }
@@ -435,48 +511,8 @@ async function assertBoundSkillsCompatible(skillRepo, agentScope, agentProjectId
   }
 }
 
-// src/store/repos/dag-template.repo.ts
-function createDagTemplateRepo(db) {
-  const base = createRepo(db.collection("dag_templates"));
-  return {
-    ...base,
-    createDagTemplate(data) {
-      return base.create(data);
-    },
-    async listDagTemplates(filter) {
-      const query = {};
-      if (filter?.projectId) query.projectId = filter.projectId;
-      if (filter?.name) query.name = filter.name;
-      if (!filter?.includeDisabled) Object.assign(query, enabledNeFalse());
-      return base.list(query);
-    },
-    async copyDagTemplate(sourceId, targetProjectId, newName) {
-      const source = await base.getById(sourceId);
-      if (!source) {
-        throw new ConflictError("dagTemplate", `copy source not found: ${sourceId}`);
-      }
-      const dup = await base._collection.findOne(
-        { projectId: targetProjectId, name: newName },
-        { projection: { _id: 1 } }
-      );
-      if (dup) {
-        throw new ConflictError("dagTemplate", `name conflict in target project: ${newName}`);
-      }
-      const { id: _sourceId, createdAt: _ca, updatedAt: _ua, enabled: _sourceEnabled, ...rest } = source;
-      const copy = {
-        ...rest,
-        name: newName,
-        projectId: targetProjectId,
-        isDefault: false,
-        version: "1.0.0"
-      };
-      return base.create(copy);
-    }
-  };
-}
-
-// src/schemas/task.ts
-import { z as z4 } from "zod";
+// src/schemas/dag-template.ts
+import { z as z3 } from "zod";
 
 // src/schemas/skill.ts
 import { z as z2 } from "zod";
@@ -666,19 +702,37 @@ var SkillCopySchema = z2.object({
 });
 
 // src/schemas/dag-template.ts
-import { z as z3 } from "zod";
 var DagNodePhaseSchema = z3.string();
 var DagNodeTrackSchema = z3.string();
 var DAG_PHASES = ["entry", "track", "test", "exit"];
 var DAG_TRACKS = ["backend", "ui", "all"];
 var NODE_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
+var capabilityNamesSchema = z3.array(z3.string().min(1)).superRefine((names, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  names.forEach((name, index) => {
+    if (seen.has(name)) {
+      ctx.addIssue({ code: "custom", path: [index], message: `\u540D\u79F0\u91CD\u590D\uFF1A${name}` });
+    }
+    seen.add(name);
+  });
+});
+var SourcePresetSchema = z3.object({
+  code: z3.string().min(1),
+  version: z3.string(),
+  contentHash: z3.string(),
+  /** Agent 名称独立基线；不改变既有 contentHash 算法，存量缺键按空清单比较 */
+  agents: capabilityNamesSchema.optional()
+});
 var DagNodeSchema = z3.object({
   id: z3.string().regex(NODE_ID_PATTERN, "node id \u53EA\u5141\u8BB8\u5B57\u6BCD/\u6570\u5B57/\u4E0B\u5212\u7EBF/\u8FDE\u5B57\u7B26\uFF08\u70B9\u8DEF\u5F84\u62FC\u63A5\u5B89\u5168\u524D\u63D0\uFF09"),
   label: z3.string(),
   phase: DagNodePhaseSchema,
   track: DagNodeTrackSchema,
   prompt: z3.string(),
-  skills: z3.array(z3.string()).default([])
+  skills: capabilityNamesSchema.default([]),
+  /** 存量模板允许缺键；新组装和任务实例化路径写入完整数组 */
+  agents: capabilityNamesSchema.optional(),
+  sourcePreset: SourcePresetSchema.optional()
 });
 var PausePointTypeSchema = z3.enum(["human_approval", "checkpoint"]);
 var PAUSE_POINT_TYPES = ["human_approval", "checkpoint"];
@@ -701,6 +755,14 @@ var EdgePausePointSchema = EdgePausePointBaseSchema.superRefine((pp, ctx) => {
     });
   }
 });
+var TEMPLATE_CODE_REGEX = /^[a-z0-9]+(-[a-z0-9]+)+$/;
+var TEMPLATE_CODE_MAX_LENGTH = 31;
+var TemplateCodeFieldSchema = z3.string().max(TEMPLATE_CODE_MAX_LENGTH).regex(TEMPLATE_CODE_REGEX, "code \u5FC5\u987B\u4E3A kebab-case \u4E14\u81F3\u5C11\u542B\u4E00\u4E2A\u8FDE\u5B57\u7B26\u6BB5\uFF08\u5982 full-workflow\uFF09\uFF0C\u4E0D\u53EF\u4E0E\u6570\u636E\u5E93 id \u5F62\u6001\u6DF7\u6DC6");
+var TemplateCandidateSchema = z3.object({
+  id: z3.string(),
+  code: z3.string(),
+  name: z3.string()
+});
 var DagEdgeSchema = z3.object({
   from: z3.string(),
   to: z3.string(),
@@ -714,6 +776,12 @@ var DagTemplateSchema = z3.object({
   /** 归属项目 id（N012：实体层去哨兵 default，由路由层解析写入——校验项目存在且 active 后落库） */
   projectId: z3.string(),
   description: z3.string(),
+  /**
+   * T202609020002 业务 code（可选——存量迁移前的模板无此字段，由启动迁移补齐）。
+   * 项目内唯一（{projectId, code} 复合唯一索引，迁移后建）、创建后不可变；
+   * name 仍承担展示职责（可改、可中文）——职责分离，改名不影响 code 引用。
+   */
+  code: TemplateCodeFieldSchema.optional(),
   nodes: z3.array(DagNodeSchema),
   edges: z3.array(DagEdgeSchema),
   /** UI 布局坐标（nodeId → {x,y}）。UI 关注点，advance 引擎零感知；旧模板无此字段 → 前端 dagre 兜底布局（N008 D2） */
@@ -742,10 +810,228 @@ var DagTemplateUpdateSchema = DagTemplateCreateSchema.extend({
 }).partial();
 var DagTemplateCopySchema = z3.object({
   newName: z3.string().min(1),
-  targetProjectId: z3.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex")
+  targetProjectId: z3.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex"),
+  newCode: TemplateCodeFieldSchema.optional()
 });
+function findDuplicateNodeIds(nodes) {
+  const seen = /* @__PURE__ */ new Set();
+  const duplicated = /* @__PURE__ */ new Set();
+  for (const node of nodes) {
+    if (seen.has(node.id)) duplicated.add(node.id);
+    seen.add(node.id);
+  }
+  return [...duplicated];
+}
+function assertUniqueNodeIds(nodes) {
+  const duplicated = findDuplicateNodeIds(nodes);
+  if (duplicated.length > 0) {
+    throw new ValidationError(
+      `\u6A21\u677F\u8282\u70B9 id \u91CD\u590D\uFF1A${duplicated.join(", ")}`,
+      duplicated.map((id) => ({ path: ["nodes"], message: `\u8282\u70B9 id "${id}" \u5728\u6A21\u677F\u5185\u91CD\u590D` })),
+      {
+        bizCode: "TEMPLATE_NODE_ID_DUPLICATE",
+        message: `${BIZ_CODE_MESSAGES.TEMPLATE_NODE_ID_DUPLICATE}\uFF1A${duplicated.join(", ")}`
+      }
+    );
+  }
+}
+
+// src/store/repos/dag-template.repo.ts
+function normalizeNameToTemplateCode(name) {
+  const folded = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return folded.slice(0, TEMPLATE_CODE_MAX_LENGTH);
+}
+function isLegalTemplateCode(code) {
+  return code.length <= TEMPLATE_CODE_MAX_LENGTH && TEMPLATE_CODE_REGEX.test(code);
+}
+function buildTemplateCode(seedName, takenCodes) {
+  const taken = new Set(takenCodes);
+  const base = normalizeNameToTemplateCode(seedName);
+  let primary;
+  if (base === "") {
+    primary = "tpl-1";
+  } else if (isLegalTemplateCode(base)) {
+    primary = base;
+  } else {
+    primary = `tpl-${base}`.slice(0, TEMPLATE_CODE_MAX_LENGTH);
+  }
+  let candidate = primary;
+  let n = 1;
+  while (taken.has(candidate) || !isLegalTemplateCode(candidate)) {
+    n += 1;
+    const suffix = `-${n}`;
+    candidate = `${primary.slice(0, TEMPLATE_CODE_MAX_LENGTH - suffix.length)}${suffix}`;
+  }
+  return candidate;
+}
+function levenshtein(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(prev[j - 1] + cost, curr[j - 1] + 1, prev[j] + 1);
+    }
+    prev = curr;
+  }
+  return prev[n];
+}
+function scoreTemplateCandidate(ref, tpl) {
+  const refLower = ref.toLowerCase();
+  if (tpl.name === ref) return 100;
+  const code = tpl.code?.toLowerCase();
+  if (code === refLower) return 100;
+  if (code !== void 0) {
+    if (code.startsWith(refLower) || refLower.startsWith(code)) return 80;
+    if (levenshtein(code, refLower) <= 2) return 60;
+  }
+  const nameLower = tpl.name.toLowerCase();
+  if (nameLower.startsWith(refLower) || refLower.startsWith(nameLower)) return 70;
+  if (nameLower.includes(refLower) || refLower.includes(nameLower)) return 65;
+  if (tpl.id !== void 0 && ref.length === 24 && levenshtein(tpl.id, ref) <= 2) return 50;
+  if (levenshtein(nameLower, refLower) <= 2) return 40;
+  return null;
+}
+var OBJECT_ID_HEX_RE = /^[a-f0-9]{24}$/;
+function dupKeyViolation(e) {
+  if (typeof e !== "object" || e === null) return null;
+  if (!("code" in e && e.code === 11e3)) return null;
+  const kv = e.keyValue;
+  return typeof kv === "object" && kv !== null ? kv : null;
+}
+function createDagTemplateRepo(db) {
+  const base = createRepo(db.collection("dag_templates"));
+  const listProjectCodes = async (projectId) => {
+    const docs = await base._collection.find({ projectId }, { projection: { code: 1 } }).toArray();
+    return docs.map((d) => typeof d.code === "string" ? d.code : "").filter((c) => c !== "");
+  };
+  const getByCode = async (projectId, code) => {
+    const doc = await base._collection.findOne({ projectId, code });
+    return doc ? toEntity(doc) : null;
+  };
+  return {
+    ...base,
+    async createDagTemplate(data) {
+      const payload = { ...data };
+      if (payload.code === void 0) {
+        payload.code = buildTemplateCode(data.name, await listProjectCodes(data.projectId));
+      }
+      try {
+        return await base.create(payload);
+      } catch (e) {
+        const kv = dupKeyViolation(e);
+        if (kv !== null && "code" in kv) {
+          throw new ConflictError("dag-template", `code conflict: ${String(kv.code)}`, {
+            bizCode: "TEMPLATE_CODE_CONFLICT",
+            message: BIZ_CODE_MESSAGES.TEMPLATE_CODE_CONFLICT
+          });
+        }
+        if (kv !== null && "name" in kv) {
+          throw new ConflictError("dag-template", `name conflict: ${String(kv.name)}`, {
+            bizCode: "TEMPLATE_NAME_CONFLICT",
+            message: BIZ_CODE_MESSAGES.TEMPLATE_NAME_CONFLICT
+          });
+        }
+        throw e;
+      }
+    },
+    async listDagTemplates(filter) {
+      const query = {};
+      if (filter?.projectId) query.projectId = filter.projectId;
+      if (filter?.name) query.name = filter.name;
+      if (filter?.code) query.code = filter.code;
+      if (!filter?.includeDisabled) Object.assign(query, enabledNeFalse());
+      return base.list(query);
+    },
+    async copyDagTemplate(sourceId, targetProjectId, newName, newCode) {
+      const source = await base.getById(sourceId);
+      if (!source) {
+        throw new ConflictError("dagTemplate", `copy source not found: ${sourceId}`);
+      }
+      const dup = await base._collection.findOne(
+        { projectId: targetProjectId, name: newName },
+        { projection: { _id: 1 } }
+      );
+      if (dup) {
+        throw new ConflictError("dagTemplate", `name conflict in target project: ${newName}`, {
+          bizCode: "TEMPLATE_NAME_CONFLICT",
+          message: BIZ_CODE_MESSAGES.TEMPLATE_NAME_CONFLICT
+        });
+      }
+      if (newCode !== void 0) {
+        const dupCode = await base._collection.findOne(
+          { projectId: targetProjectId, code: newCode },
+          { projection: { _id: 1, name: 1 } }
+        );
+        if (dupCode) {
+          throw new ConflictError("dagTemplate", `code conflict in target project: ${newCode}`, {
+            bizCode: "TEMPLATE_CODE_CONFLICT",
+            message: `${BIZ_CODE_MESSAGES.TEMPLATE_CODE_CONFLICT}\uFF08\u51B2\u7A81\u6A21\u677F\uFF1A${String(dupCode.name)}\uFF09`
+          });
+        }
+      }
+      const code = newCode ?? buildTemplateCode(newName, await listProjectCodes(targetProjectId));
+      const { id: _sourceId, createdAt: _ca, updatedAt: _ua, enabled: _sourceEnabled, code: _sourceCode, ...rest } = source;
+      const copy = {
+        ...rest,
+        name: newName,
+        code,
+        projectId: targetProjectId,
+        isDefault: false,
+        version: "1.0.0"
+      };
+      try {
+        return await base.create(copy);
+      } catch (e) {
+        const kv = dupKeyViolation(e);
+        if (kv !== null && "code" in kv) {
+          throw new ConflictError("dag-template", `code conflict: ${String(kv.code)}`, {
+            bizCode: "TEMPLATE_CODE_CONFLICT",
+            message: BIZ_CODE_MESSAGES.TEMPLATE_CODE_CONFLICT
+          });
+        }
+        if (kv !== null && "name" in kv) {
+          throw new ConflictError("dag-template", `name conflict: ${String(kv.name)}`, {
+            bizCode: "TEMPLATE_NAME_CONFLICT",
+            message: BIZ_CODE_MESSAGES.TEMPLATE_NAME_CONFLICT
+          });
+        }
+        throw e;
+      }
+    },
+    async getByCode(projectId, code) {
+      return getByCode(projectId, code);
+    },
+    async resolveTemplateByRef(ref, projectCtx) {
+      if (OBJECT_ID_HEX_RE.test(ref)) {
+        const byId = await base.getById(ref);
+        if (byId) return byId;
+      }
+      if (projectCtx !== void 0 && !OBJECT_ID_HEX_RE.test(ref)) {
+        return getByCode(projectCtx, ref);
+      }
+      return null;
+    },
+    async findSimilarTemplates(projectId, ref, limit = 5) {
+      const docs = await base._collection.find({ projectId }, { projection: { _id: 1, code: 1, name: 1 } }).toArray();
+      const scored = docs.map((d) => {
+        const id = d._id.toString();
+        const code = typeof d.code === "string" ? d.code : "";
+        const name = typeof d.name === "string" ? d.name : "";
+        const score = scoreTemplateCandidate(ref, { id, ...code !== "" ? { code } : {}, name });
+        return score === null ? null : { score, candidate: { id, code, name } };
+      }).filter((x) => x !== null).sort((a, b) => b.score - a.score).slice(0, limit);
+      return scored.map((x) => x.candidate);
+    }
+  };
+}
 
 // src/schemas/task.ts
+import { z as z4 } from "zod";
 var TASK_TYPES = ["feature", "bugfix", "ui-tweak", "research"];
 var ENTRY_ID_REGEX = /^[a-z0-9]{6}$/;
 var CheckItemSchema = z4.object({
@@ -803,18 +1089,20 @@ var NodeStateSchema = z4.object({
   enteredAt: z4.date().nullable().default(null),
   completedAt: z4.date().nullable().default(null)
 });
+var DagInstanceNodeSchema = z4.object({
+  id: z4.string(),
+  label: z4.string(),
+  // N016 F9：枚举放宽（注册表权威）
+  phase: z4.string(),
+  track: z4.string(),
+  prompt: z4.string(),
+  skills: z4.array(z4.string()).default([]),
+  agents: z4.array(z4.string()).default([])
+});
 var DagInstanceSchema = z4.object({
   templateId: z4.string(),
   templateVersion: z4.string(),
-  nodes: z4.array(z4.object({
-    id: z4.string(),
-    label: z4.string(),
-    // N016 F9：枚举放宽（注册表权威）
-    phase: z4.string(),
-    track: z4.string(),
-    prompt: z4.string(),
-    skills: z4.array(z4.string()).default([])
-  })),
+  nodes: z4.array(DagInstanceNodeSchema),
   // N017 D1：暂停点内联到边（human_approval=审批门 / checkpoint=检查点），顶层数组删除
   edges: z4.array(z4.object({
     from: z4.string(),
@@ -875,6 +1163,12 @@ var TaskSchema = z4.object({
 var TaskCreateInputSchema = z4.object({
   title: z4.string(),
   track: z4.string(),
+  /**
+   * T202609020002：模板引用支持 code|id 双形态——24-hex 直查数据库 id 命中即用
+   * （hex 未命中不转 code 检索：code 必含连字符，与 hex 形态天然互斥）；非 hex 在
+   * 项目上下文内按 code 检索（项目域经鉴权过滤：project Token 强制本项目，
+   * open/admin 显式 projectId 优先）。任务实体落库的 dagTemplateId 恒为解析后的数据库 id。
+   */
   dagTemplateId: z4.string(),
   /**
    * T202608240003 创建时剪枝：显式剔除的节点 id（在轨道自动剔除之外）。
@@ -1236,6 +1530,7 @@ function toNodeInfo(node, task) {
     track: node.track,
     prompt: renderPrompt(node.prompt, task),
     skills: node.skills,
+    agents: node.agents ?? [],
     upcomingPause: nextEdge?.pausePoint?.description ?? null
   };
 }
@@ -1619,7 +1914,8 @@ function deepCopyNode(node) {
     phase: node.phase,
     track: node.track,
     prompt: node.prompt,
-    skills: [...node.skills]
+    skills: [...node.skills],
+    agents: [...node.agents ?? []]
   };
 }
 function deepCopyEdge(edge) {
@@ -1746,17 +2042,32 @@ async function assertModelAliasExists(repo, code) {
 
 // src/store/repos/enum-registry.repo.ts
 var REFERENCE_CHECKS = {
-  dag_phase: { collection: "dag_templates", query: (v) => ({ "nodes.phase": v }) },
-  dag_track: { collection: "dag_templates", query: (v) => ({ "nodes.track": v }) },
-  pause_type: { collection: "dag_templates", query: (v) => ({ "edges.pausePoint.type": v }) },
-  task_status: { collection: "tasks", query: (v) => ({ status: v }) },
-  node_status: { collection: "tasks", query: (v) => ({ "dagInstance.nodeStates.status": v }) },
-  skill_category: { collection: "skills", query: (v) => ({ category: v }) },
+  dag_phase: [
+    { collection: "dag_templates", query: (v) => ({ "nodes.phase": v }) },
+    { collection: "node_presets", query: (v) => ({ phase: v }) }
+  ],
+  dag_track: [
+    { collection: "dag_templates", query: (v) => ({ "nodes.track": v }) },
+    { collection: "node_presets", query: (v) => ({ track: v }) }
+  ],
+  pause_type: [{ collection: "dag_templates", query: (v) => ({ "edges.pausePoint.type": v }) }],
+  task_status: [{ collection: "tasks", query: (v) => ({ status: v }) }],
+  node_status: [{ collection: "tasks", query: (v) => ({ "dagInstance.nodeStates.status": v }) }],
+  skill_category: [{ collection: "skills", query: (v) => ({ category: v }) }],
   scope: void 0,
   // T202608260002：agent 功能类型被 agents.function 引用（reviewer/executor 为 builtin 禁删；
   // 检测映射为未来非 builtin 扩值留防线）
-  agent_function: { collection: "agents", query: (v) => ({ "function": v }) }
+  agent_function: [{ collection: "agents", query: (v) => ({ "function": v }) }]
 };
+async function countReferences(db, category, value) {
+  const referrers = REFERENCE_CHECKS[category];
+  if (!referrers) return 0;
+  let total = 0;
+  for (const referrer of referrers) {
+    total += await db.collection(referrer.collection).countDocuments(referrer.query(value));
+  }
+  return total;
+}
 function createEnumRegistryRepo(db) {
   const base = createRepo(db.collection("enum_registry"), { nameField: "category" });
   return {
@@ -1805,15 +2116,12 @@ function createEnumRegistryRepo(db) {
           });
         }
         if (prev?.active === true && incoming.active === false) {
-          const ref = REFERENCE_CHECKS[category];
-          if (ref) {
-            const count = await db.collection(ref.collection).countDocuments(ref.query(incoming.value));
-            if (count > 0) {
-              throw new ConflictError("enum-registry", `${category}/${incoming.value}`, {
-                bizCode: "ENUM_ENTRY_IN_USE",
-                message: `${BIZ_CODE_MESSAGES.ENUM_ENTRY_IN_USE}\uFF08${count} \u4E2A\u8D44\u6E90\u5F15\u7528\uFF09`
-              });
-            }
+          const count = await countReferences(db, category, incoming.value);
+          if (count > 0) {
+            throw new ConflictError("enum-registry", `${category}/${incoming.value}`, {
+              bizCode: "ENUM_ENTRY_IN_USE",
+              message: `${BIZ_CODE_MESSAGES.ENUM_ENTRY_IN_USE}\uFF08${count} \u4E2A\u8D44\u6E90\u5F15\u7528\uFF09`
+            });
           }
         }
       }
@@ -1840,15 +2148,12 @@ function createEnumRegistryRepo(db) {
           message: BIZ_CODE_MESSAGES.ENUM_ENTRY_BUILTIN
         });
       }
-      const ref = REFERENCE_CHECKS[category];
-      if (ref) {
-        const count = await db.collection(ref.collection).countDocuments(ref.query(value));
-        if (count > 0) {
-          throw new ConflictError("enum-registry", `${category}/${value}`, {
-            bizCode: "ENUM_ENTRY_IN_USE",
-            message: `${BIZ_CODE_MESSAGES.ENUM_ENTRY_IN_USE}\uFF08${count} \u4E2A\u8D44\u6E90\u5F15\u7528\uFF09`
-          });
-        }
+      const count = await countReferences(db, category, value);
+      if (count > 0) {
+        throw new ConflictError("enum-registry", `${category}/${value}`, {
+          bizCode: "ENUM_ENTRY_IN_USE",
+          message: `${BIZ_CODE_MESSAGES.ENUM_ENTRY_IN_USE}\uFF08${count} \u4E2A\u8D44\u6E90\u5F15\u7528\uFF09`
+        });
       }
       const remaining = existing.entries.filter((e) => e.value !== value);
       return await base.update(existing.id, { entries: remaining }) !== null;
@@ -1856,22 +2161,316 @@ function createEnumRegistryRepo(db) {
   };
 }
 
+// src/store/repos/node-preset.repo.ts
+function createNodePresetRepo(db) {
+  const base = createRepo(db.collection("node_presets"), { nameField: "code" });
+  const assertCodeAvailable = async (code) => {
+    const clash = await base._collection.findOne({ code }, { projection: { _id: 1 } });
+    if (clash) {
+      throw new ConflictError("node-preset", code, {
+        bizCode: "NODE_PRESET_CODE_EXISTS",
+        message: BIZ_CODE_MESSAGES.NODE_PRESET_CODE_EXISTS
+      });
+    }
+  };
+  return {
+    ...base,
+    async createNodePreset(data) {
+      await assertCodeAvailable(data.code);
+      return base.create(data);
+    },
+    async getByCode(code, opts) {
+      const doc = await base._collection.findOne({
+        code,
+        ...opts?.includeDisabled ? {} : enabledNeFalse()
+      });
+      return doc ? toEntity(doc) : null;
+    },
+    async updateByCode(code, patch) {
+      const existing = await this.getByCode(code, { includeDisabled: true });
+      if (!existing || !existing.id) return null;
+      return base.update(existing.id, patch);
+    },
+    async deleteByCode(code) {
+      const existing = await this.getByCode(code, { includeDisabled: true });
+      if (!existing || !existing.id) return false;
+      return base.delete(existing.id);
+    },
+    async listNodePresets(filter) {
+      const query = {
+        ...filter?.includeDisabled ? {} : enabledNeFalse(),
+        ...filter?.scope ? filter.scope === "project" ? { scope: "project", ...filter.projectId ? { projectId: filter.projectId } : {} } : { scope: "global" } : filter?.projectId ? { $or: [{ scope: "global" }, { scope: "project", projectId: filter.projectId }] } : {},
+        ...filter?.q ? { $or: [
+          { code: { $regex: escapeRegExpLiteral(filter.q), $options: "i" } },
+          { label: { $regex: escapeRegExpLiteral(filter.q), $options: "i" } }
+        ] } : {}
+      };
+      return base.list(query);
+    },
+    async listByCodes(codes) {
+      if (codes.length === 0) return /* @__PURE__ */ new Map();
+      const presets = await base.list({ code: { $in: codes } });
+      return new Map(presets.map((p) => [p.code, p]));
+    },
+    async isCodeOccupied(code) {
+      return await base._collection.countDocuments({ code }, { limit: 1 }) > 0;
+    },
+    async copyNodePreset(sourceCode, target, input) {
+      const source = await this.getByCode(sourceCode, { includeDisabled: true });
+      if (!source) {
+        throw new ConflictError("node-preset", `copy source not found: ${sourceCode}`);
+      }
+      await assertCodeAvailable(input.newCode);
+      const { id: _sourceId, createdAt: _ca, updatedAt: _ua, enabled: _sourceEnabled, source: _sourceOrigin, projectId: _sourceProjectId, ...rest } = source;
+      const copy = {
+        ...JSON.parse(JSON.stringify(rest)),
+        agents: [...source.agents ?? []],
+        code: input.newCode,
+        scope: target.scope,
+        version: "1.0.0",
+        ...target.scope === "project" && target.projectId ? { projectId: target.projectId } : {}
+      };
+      return base.create(copy);
+    }
+  };
+}
+
+// src/store/repos/node-library.repo.ts
+function createNodeLibraryRepo(db) {
+  const base = createRepo(db.collection("node_libraries"), { nameField: "name" });
+  return {
+    ...base,
+    async upsertNodeLibrary(data) {
+      const now = /* @__PURE__ */ new Date();
+      const existing = await base.getByName(data.name);
+      if (existing && existing.id) {
+        const updated = await base.update(existing.id, {
+          version: data.version,
+          scope: data.scope,
+          ...data.scope === "project" && data.projectId ? { projectId: data.projectId } : {},
+          nodes: data.nodes,
+          compositions: data.compositions,
+          installedAt: now
+        });
+        if (!updated) throw new Error(`node_library upsert \u672A\u547D\u4E2D\u5DF2\u5B9A\u4F4D\u767B\u8BB0\uFF1A${data.name}\uFF08\u542F\u52A8\u671F\u4E0D\u5E94\u53D1\u751F\uFF09`);
+        return updated;
+      }
+      const created = await base.create({
+        name: data.name,
+        version: data.version,
+        scope: data.scope,
+        ...data.scope === "project" && data.projectId ? { projectId: data.projectId } : {},
+        nodes: data.nodes,
+        compositions: data.compositions,
+        installedAt: now
+      });
+      return created;
+    },
+    async listNodeLibraries(filter) {
+      const query = filter?.scope ? filter.scope === "project" ? { scope: "project", ...filter.projectId ? { projectId: filter.projectId } : {} } : { scope: "global" } : filter?.projectId ? { $or: [{ scope: "global" }, { scope: "project", projectId: filter.projectId }] } : {};
+      const docs = await base._collection.find(query).toArray();
+      return docs.map((doc) => toEntity(doc));
+    }
+  };
+}
+
+// src/store/repos/auth.repo.ts
+import { ObjectId as ObjectId3 } from "mongodb";
+import { z as z5 } from "zod";
+var AUTH_COLLECTIONS = {
+  accounts: "auth_accounts",
+  tokens: "auth_tokens",
+  sessions: "auth_sessions"
+};
+var SINGLETON_ACCOUNT_ID = new ObjectId3("000000000000000000000001");
+function createAuthAccountRepo(db) {
+  const base = createRepo(db.collection(AUTH_COLLECTIONS.accounts));
+  return {
+    ...base,
+    async getAccount() {
+      const doc = await base._collection.findOne({});
+      return doc ? toEntity(doc) : null;
+    },
+    /** 创建唯一管理员账号：已有账号 → 409（并发初始化仅首个成功，PRD §3.2）。
+     *  单例机制 = 固定 _id 插入（E11000 兜底任意并发形态——异名并发同样仅首个成功） */
+    async createAccount(username, passwordHash) {
+      const existing = await base._collection.findOne({}, { projection: { _id: 1 } });
+      if (existing) {
+        throw new ConflictError("auth-account", "singleton", { message: "admin account already exists" });
+      }
+      const now = /* @__PURE__ */ new Date();
+      const result = await base._collection.insertOne({
+        _id: SINGLETON_ACCOUNT_ID,
+        username,
+        passwordHash,
+        createdAt: now,
+        updatedAt: now
+      });
+      return { username, passwordHash, createdAt: now, updatedAt: now, id: result.insertedId.toString() };
+    },
+    async updatePassword(accountId, newPasswordHash) {
+      return base.update(accountId, { passwordHash: newPasswordHash });
+    }
+  };
+}
+function createAuthTokenRepo(db) {
+  const base = createRepo(db.collection(AUTH_COLLECTIONS.tokens));
+  return {
+    ...base,
+    /** sha256(token 全串含前缀) 等值查询（唯一索引命中） */
+    async findByHash(tokenHash) {
+      const doc = await base._collection.findOne({ tokenHash });
+      return doc ? toEntity(doc) : null;
+    },
+    async getTokenStatus(type, projectId) {
+      const query = { type };
+      if (type === "project") query.projectId = projectId;
+      const doc = await base._collection.findOne(query, { projection: { createdAt: 1 } });
+      return doc ? { hasToken: true, createdAt: doc.createdAt ?? null } : { hasToken: false, createdAt: null };
+    },
+    /** 重置语义：旧 Token 删除 + 新 Token 落库（重置后旧值立即失效，PRD §3.4）。
+     *  事务包删+插（rs0 支持——失败窗口不留零 Token 状态，失败不变性）；admin 单例 /
+     *  project 每项目一枚由 partial unique 索引兜底并发交错 */
+    async upsertToken(type, tokenHash, projectId) {
+      const query = { type };
+      if (type === "project") {
+        if (!projectId) throw new ConflictError("auth-token", "missing-projectId", { message: "project token requires projectId" });
+        query.projectId = projectId;
+      }
+      const db2 = base._collection.db;
+      const session = db2.client.startSession();
+      try {
+        const holder = { token: null };
+        await session.withTransaction(async () => {
+          await base._collection.deleteMany(query, { session });
+          const now = /* @__PURE__ */ new Date();
+          const doc = { tokenHash, type, createdAt: now, updatedAt: now };
+          if (type === "project" && projectId !== void 0) doc.projectId = projectId;
+          const result = await base._collection.insertOne(doc, { session });
+          holder.token = { ...doc, id: result.insertedId.toString() };
+        });
+        if (holder.token === null) {
+          throw new ConflictError("auth-token", "transaction-empty", { message: "Token upsert \u672A\u4EA7\u751F\u7ED3\u679C" });
+        }
+        return holder.token;
+      } finally {
+        await session.endSession();
+      }
+    },
+    async listProjectTokenStatuses(projectIds) {
+      const docs = await base._collection.find({ type: "project", projectId: { $in: projectIds } }, { projection: { projectId: 1, createdAt: 1 } }).toArray();
+      const map = /* @__PURE__ */ new Map();
+      for (const id of projectIds) map.set(id, { hasToken: false, createdAt: null });
+      for (const doc of docs) {
+        if (typeof doc.projectId === "string") {
+          map.set(doc.projectId, { hasToken: true, createdAt: doc.createdAt ?? null });
+        }
+      }
+      return map;
+    }
+  };
+}
+var AuthSessionSchema = z5.object({
+  id: z5.string().optional(),
+  sessionId: z5.string().min(1),
+  /** 管理员账号 id（会话 = 管理员身份） */
+  accountId: z5.string().min(1),
+  expiresAt: z5.date(),
+  createdAt: z5.date().optional(),
+  updatedAt: z5.date().optional()
+});
+function createAuthSessionRepo(db) {
+  const base = createRepo(db.collection(AUTH_COLLECTIONS.sessions));
+  return {
+    ...base,
+    async createSession(sessionId, accountId, expiresAt) {
+      return base.create({ sessionId, accountId, expiresAt });
+    },
+    /** 有效期判定内联：过期即删返回 null（不等 TTL 清理） */
+    async findValidSession(sessionId) {
+      const doc = await base._collection.findOne({ sessionId });
+      if (!doc) return null;
+      if (!doc.expiresAt || doc.expiresAt.getTime() <= Date.now()) {
+        await base.delete(doc._id.toString());
+        return null;
+      }
+      return toEntity(doc);
+    },
+    async deleteBySessionId(sessionId) {
+      const result = await base._collection.deleteOne({ sessionId });
+      return result.deletedCount > 0;
+    },
+    /** 启动时清扫过期会话（幂等，配合 TTL 索引） */
+    async deleteExpiredSessions() {
+      const result = await base._collection.deleteMany({ expiresAt: { $lte: /* @__PURE__ */ new Date() } });
+      return result.deletedCount;
+    }
+  };
+}
+
+// src/store/auth-crypto.ts
+import { createHash, randomBytes, scrypt as scryptCb, timingSafeEqual } from "crypto";
+import { promisify } from "util";
+var scrypt = promisify(scryptCb);
+var SCRYPT_N = 16384;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var SCRYPT_KEYLEN = 64;
+var SALT_LEN = 16;
+async function hashPassword(password) {
+  const salt = randomBytes(SALT_LEN);
+  const derived = await scrypt(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P });
+  return `scrypt$${SCRYPT_N}$${SCRYPT_R}$${SCRYPT_P}$${salt.toString("base64")}$${derived.toString("base64")}`;
+}
+async function verifyPassword(password, stored) {
+  const parts = stored.split("$");
+  if (parts.length !== 6 || parts[0] !== "scrypt") return false;
+  const [, nStr, rStr, pStr, saltB64, hashB64] = parts;
+  const N = Number(nStr);
+  const r = Number(rStr);
+  const p = Number(pStr);
+  if (!Number.isInteger(N) || !Number.isInteger(r) || !Number.isInteger(p)) return false;
+  try {
+    const salt = Buffer.from(saltB64, "base64");
+    const expected = Buffer.from(hashB64, "base64");
+    const derived = await scrypt(password, salt, expected.length, { N, r, p });
+    return derived.length === expected.length && timingSafeEqual(derived, expected);
+  } catch {
+    return false;
+  }
+}
+function generateToken(type) {
+  const prefix = type === "admin" ? "admin-" : "project-";
+  return `${prefix}${randomBytes(32).toString("base64url")}`;
+}
+function tokenTypeFromValue(token) {
+  if (token.startsWith("admin-")) return "admin";
+  if (token.startsWith("project-")) return "project";
+  return null;
+}
+function hashToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+function generateSessionId() {
+  return randomBytes(32).toString("hex");
+}
+
 // src/schemas/agent.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 
 // src/schemas/model-alias.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 var SIMING_CODE_REGEX = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-var ModelAliasShapeSchema = z5.object({
-  id: z5.string().optional(),
+var ModelAliasShapeSchema = z6.object({
+  id: z6.string().optional(),
   /** siming code：创建后不可变（PUT 显式拒绝 MODEL_CODE_IMMUTABLE，非静默剥离） */
-  code: z5.string().regex(SIMING_CODE_REGEX, "code \u5FC5\u987B\u4E3A kebab-case\uFF08\u5982 primary\u3001fast-model\uFF09"),
+  code: z6.string().regex(SIMING_CODE_REGEX, "code \u5FC5\u987B\u4E3A kebab-case\uFF08\u5982 primary\u3001fast-model\uFF09"),
   /** 展示名（如「主力模型」） */
-  name: z5.string().min(1, "\u5C55\u793A\u540D\u4E0D\u80FD\u4E3A\u7A7A"),
+  name: z6.string().min(1, "\u5C55\u793A\u540D\u4E0D\u80FD\u4E3A\u7A7A"),
   /** 真实模型标识（如 zhipuai/glm-5.3；改此处 = 引用方全局替换生效） */
-  realModel: z5.string().min(1, "\u771F\u5B9E\u6A21\u578B\u6807\u8BC6\u4E0D\u80FD\u4E3A\u7A7A"),
-  createdAt: z5.date().optional(),
-  updatedAt: z5.date().optional()
+  realModel: z6.string().min(1, "\u771F\u5B9E\u6A21\u578B\u6807\u8BC6\u4E0D\u80FD\u4E3A\u7A7A"),
+  createdAt: z6.date().optional(),
+  updatedAt: z6.date().optional()
 });
 var ModelAliasSchema = ModelAliasShapeSchema;
 var ModelAliasCreateSchema = ModelAliasShapeSchema.omit({
@@ -1879,18 +2478,18 @@ var ModelAliasCreateSchema = ModelAliasShapeSchema.omit({
   createdAt: true,
   updatedAt: true
 });
-var ModelAliasUpdateSchema = z5.object({
-  code: z5.string().regex(SIMING_CODE_REGEX).optional(),
-  name: z5.string().min(1).optional(),
-  realModel: z5.string().min(1).optional()
+var ModelAliasUpdateSchema = z6.object({
+  code: z6.string().regex(SIMING_CODE_REGEX).optional(),
+  name: z6.string().min(1).optional(),
+  realModel: z6.string().min(1).optional()
 });
 var ModelAliasWithRefCountSchema = ModelAliasShapeSchema.extend({
-  refCount: z5.number().int().min(0)
+  refCount: z6.number().int().min(0)
 });
 
 // src/schemas/agent.ts
-var AgentScopeSchema = z6.enum(["global", "project"]);
-var AgentFunctionSchema = z6.enum(["reviewer", "executor"]);
+var AgentScopeSchema = z7.enum(["global", "project"]);
+var AgentFunctionSchema = z7.enum(["reviewer", "executor"]);
 var AgentScopeRefine = (val, ctx) => {
   if (val.scope === "project" && !val.projectId) {
     ctx.addIssue({
@@ -1900,17 +2499,17 @@ var AgentScopeRefine = (val, ctx) => {
     });
   }
 };
-var AgentShapeSchema = z6.object({
-  id: z6.string().optional(),
-  name: z6.string(),
-  description: z6.string(),
-  systemPrompt: z6.string(),
-  boundSkills: z6.array(z6.string()).default([]),
-  model: z6.string(),
+var AgentShapeSchema = z7.object({
+  id: z7.string().optional(),
+  name: z7.string(),
+  description: z7.string(),
+  systemPrompt: z7.string(),
+  boundSkills: z7.array(z7.string()).default([]),
+  model: z7.string(),
   /** 资产版本（N015 F13）：install/export 版本对比依据；default 仅读侧兜底（createRepo 不做读侧解析，存量回填走 M6 迁移） */
-  version: z6.string().default("1.0.0"),
-  tools: z6.array(z6.string()).default([]),
-  permissions: z6.array(z6.string()).default([]),
+  version: z7.string().default("1.0.0"),
+  tools: z7.array(z7.string()).default([]),
+  permissions: z7.array(z7.string()).default([]),
   /** 引用文档集合（可选——存量单文件资产无此字段，行为与升级前一致） */
   references: createReferencesSchema(AGENT_MAIN_DOC).optional(),
   /** 作用域：global=跨项目复用（默认，仅作存量迁移读侧兜底）/ project=项目专用（N012 D3） */
@@ -1918,15 +2517,15 @@ var AgentShapeSchema = z6.object({
   /** 功能类型（T202608260002）：default 仅创建侧归一——toEntity 直转不经 Zod parse，读侧归一在 repo 层 + 回填走 M12 */
   "function": AgentFunctionSchema.default("executor"),
   /** 仅 scope=project 时必填且为合法 ObjectId hex（superRefine 保证） */
-  projectId: z6.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional(),
+  projectId: z7.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional(),
   /**
    * T202608290001 资产启停（可选——存量无此字段 = 启用，零迁移）。
    * 全局判断规则：enabled === false 即停用，true/缺失均启用。
    * 唯一写入口是专用启停端点（POST /:name/enabled）——Create/Update/Copy 均不含此字段。
    */
-  enabled: z6.boolean().optional(),
-  createdAt: z6.date().optional(),
-  updatedAt: z6.date().optional()
+  enabled: z7.boolean().optional(),
+  createdAt: z7.date().optional(),
+  updatedAt: z7.date().optional()
 });
 var agentAggregateLimitRefine = (val, ctx) => {
   const totalChars = (val.systemPrompt?.length ?? 0) + sumReferenceContentChars(val.references);
@@ -1944,28 +2543,28 @@ var AgentCreateSchema = AgentShapeSchema.omit({
   createdAt: true,
   updatedAt: true,
   enabled: true
-}).extend({ scope: AgentScopeSchema }).extend({ model: z6.string().regex(SIMING_CODE_REGEX, "model \u5FC5\u987B\u662F siming code\uFF08kebab-case\uFF09") }).extend({ "function": AgentFunctionSchema.default("executor") }).superRefine(AgentScopeRefine).superRefine(agentAggregateLimitRefine);
+}).extend({ scope: AgentScopeSchema }).extend({ model: z7.string().regex(SIMING_CODE_REGEX, "model \u5FC5\u987B\u662F siming code\uFF08kebab-case\uFF09") }).extend({ "function": AgentFunctionSchema.default("executor") }).superRefine(AgentScopeRefine).superRefine(agentAggregateLimitRefine);
 var AgentUpdateSchema = AgentShapeSchema.omit({
   id: true,
   createdAt: true,
   updatedAt: true,
   enabled: true
 }).extend({
-  boundSkills: z6.array(z6.string()).optional(),
+  boundSkills: z7.array(z7.string()).optional(),
   // N015：version 放行（export apply 版本递增随 PUT 携带）；optional 剥离实体层 default 避免 partial 空 body 注入
-  version: z6.string().optional(),
-  tools: z6.array(z6.string()).optional(),
-  permissions: z6.array(z6.string()).optional(),
+  version: z7.string().optional(),
+  tools: z7.array(z7.string()).optional(),
+  permissions: z7.array(z7.string()).optional(),
   scope: AgentScopeSchema.optional(),
   // N013：model 收紧为 siming code 格式（存在性校验在 handler 层；undefined = 不更新该字段）
-  model: z6.string().regex(SIMING_CODE_REGEX, "model \u5FC5\u987B\u662F siming code\uFF08kebab-case\uFF09").optional(),
+  model: z7.string().regex(SIMING_CODE_REGEX, "model \u5FC5\u987B\u662F siming code\uFF08kebab-case\uFF09").optional(),
   // T202608260002：optional 剥离实体层 default——否则 PUT 空 body 会注入 executor 覆盖 reviewer
   "function": AgentFunctionSchema.optional()
 }).partial().superRefine(AgentScopeRefine).superRefine(agentAggregateLimitRefine);
-var AgentCopySchema = z6.object({
-  newName: z6.string(),
+var AgentCopySchema = z7.object({
+  newName: z7.string(),
   newScope: AgentScopeSchema,
-  targetProjectId: z6.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional()
+  targetProjectId: z7.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional()
 }).superRefine((val, ctx) => {
   if (val.newScope === "project" && !val.targetProjectId) {
     ctx.addIssue({
@@ -1977,17 +2576,18 @@ var AgentCopySchema = z6.object({
 });
 
 // src/schemas/export-bundle.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var EXPORT_FORMAT_VERSION = "1.0";
 var TemplatePayloadSchema = DagTemplateSchema.omit({
   id: true,
   projectId: true,
   enabled: true,
   createdAt: true,
-  updatedAt: true
+  updatedAt: true,
+  code: true
 }).extend({
-  version: z7.string(),
-  isDefault: z7.boolean()
+  version: z8.string(),
+  isDefault: z8.boolean()
 });
 var SkillPayloadSchema = SkillShapeSchema.omit({
   id: true,
@@ -1996,7 +2596,7 @@ var SkillPayloadSchema = SkillShapeSchema.omit({
   createdAt: true,
   updatedAt: true
 }).extend({
-  version: z7.string(),
+  version: z8.string(),
   scope: SkillScopeSchema,
   references: createReferencesSchema(SKILL_MAIN_DOC)
 });
@@ -2007,12 +2607,12 @@ var AgentPayloadSchema = AgentShapeSchema.omit({
   createdAt: true,
   updatedAt: true
 }).extend({
-  version: z7.string(),
+  version: z8.string(),
   scope: AgentScopeSchema,
   references: createReferencesSchema(AGENT_MAIN_DOC),
-  boundSkills: z7.array(z7.string()),
-  tools: z7.array(z7.string()),
-  permissions: z7.array(z7.string()),
+  boundSkills: z8.array(z8.string()),
+  tools: z8.array(z8.string()),
+  permissions: z8.array(z8.string()),
   "function": AgentFunctionSchema
 });
 var ModelAliasPayloadSchema = ModelAliasSchema.omit({
@@ -2020,271 +2620,307 @@ var ModelAliasPayloadSchema = ModelAliasSchema.omit({
   createdAt: true,
   updatedAt: true
 });
-var ExportBundleSchema = z7.object({
-  exportFormatVersion: z7.literal(EXPORT_FORMAT_VERSION, {
+var ExportBundleSchema = z8.object({
+  exportFormatVersion: z8.literal(EXPORT_FORMAT_VERSION, {
     error: `\u5BFC\u51FA\u683C\u5F0F\u7248\u672C\u4E0D\u652F\u6301\uFF0C\u5F53\u524D\u652F\u6301 ${EXPORT_FORMAT_VERSION}`
   }),
-  exportedAt: z7.string(),
+  exportedAt: z8.string(),
   /** 源环境悬空提示（§2.2：悬空 skill/agent.model 不阻断导出）。导出响应恒携带；导入入参可缺省——导入侧提示由 plan 生成，不消费本字段 */
-  warnings: z7.array(z7.string()).optional(),
+  warnings: z8.array(z8.string()).optional(),
   template: TemplatePayloadSchema,
-  dependencies: z7.object({
-    skills: z7.array(SkillPayloadSchema),
-    agents: z7.array(AgentPayloadSchema),
-    modelAliases: z7.array(ModelAliasPayloadSchema)
+  dependencies: z8.object({
+    skills: z8.array(SkillPayloadSchema),
+    agents: z8.array(AgentPayloadSchema),
+    modelAliases: z8.array(ModelAliasPayloadSchema)
   })
 });
-var ImportPlanRequestSchema = z7.object({
-  targetProjectId: z7.string().regex(OBJECT_ID_HEX, "targetProjectId must be a valid ObjectId hex"),
+var ImportPlanRequestSchema = z8.object({
+  targetProjectId: z8.string().regex(OBJECT_ID_HEX, "targetProjectId must be a valid ObjectId hex"),
   bundle: ExportBundleSchema
 });
-var ImportDecisionSchema = z7.discriminatedUnion("kind", [
-  z7.object({
-    kind: z7.literal("skill"),
-    name: z7.string(),
+var ImportDecisionSchema = z8.discriminatedUnion("kind", [
+  z8.object({
+    kind: z8.literal("skill"),
+    name: z8.string(),
     scope: SkillScopeSchema,
-    action: z7.enum(["overwrite", "skip"])
+    action: z8.enum(["overwrite", "skip"])
   }),
-  z7.object({
-    kind: z7.literal("agent"),
-    name: z7.string(),
+  z8.object({
+    kind: z8.literal("agent"),
+    name: z8.string(),
     scope: AgentScopeSchema,
-    action: z7.enum(["overwrite", "skip"])
+    action: z8.enum(["overwrite", "skip"])
   }),
-  z7.object({
-    kind: z7.literal("modelAlias"),
-    name: z7.string(),
-    action: z7.enum(["overwrite", "skip"])
+  z8.object({
+    kind: z8.literal("modelAlias"),
+    name: z8.string(),
+    action: z8.enum(["overwrite", "skip"])
   })
 ]);
 var ImportApplyRequestSchema = ImportPlanRequestSchema.extend({
   /** 未列出的冲突项缺省 skip（保守默认：未决策不覆盖） */
-  decisions: z7.array(ImportDecisionSchema).default([])
+  decisions: z8.array(ImportDecisionSchema).default([])
 });
-var DependencyStatusSchema = z7.enum(["create", "identical", "conflict"]);
-var DependencyCheckSchema = z7.object({
-  kind: z7.enum(["skill", "agent", "modelAlias"]),
-  name: z7.string(),
+var DependencyStatusSchema = z8.enum(["create", "identical", "conflict"]);
+var DependencyCheckSchema = z8.object({
+  kind: z8.enum(["skill", "agent", "modelAlias"]),
+  name: z8.string(),
   /** skill/agent 携带；modelAlias 无 */
-  scope: z7.enum(["global", "project"]).optional(),
+  scope: z8.enum(["global", "project"]).optional(),
   status: DependencyStatusSchema,
   /** status ≠ create 时目标环境现值版本（modelAlias 无 version 概念不填） */
-  currentVersion: z7.string().optional(),
-  importVersion: z7.string().optional(),
+  currentVersion: z8.string().optional(),
+  importVersion: z8.string().optional(),
   /** status = conflict 时差异字段名清单（如 "content, references"） */
-  changeSummary: z7.string().optional(),
+  changeSummary: z8.string().optional(),
   /** 影响范围（PRD F13）：global 资产影响所有项目 / project 资产仅影响所属项目 */
-  impact: z7.enum(["global", "project"])
-});
-var ImportPlanResponseSchema = z7.object({
-  template: z7.object({
-    name: z7.string(),
-    willOverwrite: z7.boolean(),
-    currentVersion: z7.string().optional(),
-    importVersion: z7.string(),
-    isDefaultRequested: z7.boolean(),
+  impact: z8.enum(["global", "project"])
+});
+var ImportPlanResponseSchema = z8.object({
+  template: z8.object({
+    name: z8.string(),
+    willOverwrite: z8.boolean(),
+    currentVersion: z8.string().optional(),
+    importVersion: z8.string(),
+    isDefaultRequested: z8.boolean(),
     /** isDefault 降级后的最终生效值（F17：项目已有默认 → false） */
-    isDefaultEffect: z7.boolean(),
-    downgradeReason: z7.string().optional()
+    isDefaultEffect: z8.boolean(),
+    downgradeReason: z8.string().optional()
   }),
-  dependencies: z7.array(DependencyCheckSchema),
-  /** 非阻断提示（源环境悬空绑定、agent.model 引用缺失等） */
-  warnings: z7.array(z7.string())
-});
-var DependencyActionSchema = z7.enum(["created", "updated", "skipped", "identical", "failed"]);
-var ImportApplyResponseSchema = z7.object({
-  template: z7.object({
-    id: z7.string(),
-    name: z7.string(),
-    action: z7.enum(["created", "updated"]),
-    isDefaultEffect: z7.boolean()
+  dependencies: z8.array(DependencyCheckSchema),
+  /**
+   * K10①：模板节点直接技能引用完整性逐项核对（node × skill 粒度）——
+   * ok = 在 bundle 依赖 ∪ 目标环境可见集；missing = 双侧皆无（绑定悬空，non-blocking warning）
+   */
+  directSkillChecks: z8.array(
+    z8.object({
+      node: z8.string(),
+      skill: z8.string(),
+      status: z8.enum(["ok", "missing"])
+    })
+  ),
+  /** 非阻断提示（源环境悬空绑定、agent.model 引用缺失、sourcePreset 来源缺失等） */
+  warnings: z8.array(z8.string())
+});
+var DependencyActionSchema = z8.enum(["created", "updated", "skipped", "identical", "failed"]);
+var ImportApplyResponseSchema = z8.object({
+  template: z8.object({
+    id: z8.string(),
+    name: z8.string(),
+    action: z8.enum(["created", "updated"]),
+    isDefaultEffect: z8.boolean()
   }),
-  dependencies: z7.array(
-    z7.object({
-      kind: z7.enum(["skill", "agent", "modelAlias"]),
-      name: z7.string(),
-      scope: z7.enum(["global", "project"]).optional(),
+  dependencies: z8.array(
+    z8.object({
+      kind: z8.enum(["skill", "agent", "modelAlias"]),
+      name: z8.string(),
+      scope: z8.enum(["global", "project"]).optional(),
       action: DependencyActionSchema,
       /** action = failed 时的错误说明 */
-      message: z7.string().optional()
+      message: z8.string().optional()
     })
-  )
+  ),
+  /** K10②：apply 时刻目标环境缺失来源而被剥除 sourcePreset 的节点 id 清单（降级自建导入） */
+  sourceStripped: z8.array(z8.string())
 });
 function decisionKey(kind, scope, name) {
   return `${kind}:${scope ?? ""}:${name}`;
 }
 
 // src/schemas/advance.ts
-import { z as z8 } from "zod";
-var AdvanceRequestSchema = z8.object({
-  note: z8.string().optional(),
+import { z as z9 } from "zod";
+var AdvanceRequestSchema = z9.object({
+  note: z9.string().optional(),
   /** min(1).max(2000) 与 record summary 端点对齐（同一 $set 目标，两入口校验强度一致） */
-  summary: z8.string().min(1).max(2e3).optional()
+  summary: z9.string().min(1).max(2e3).optional()
 });
-var ApproveRequestSchema = z8.object({
-  decision: z8.enum(["approved", "rejected"]),
-  comment: z8.string().optional()
+var ApproveRequestSchema = z9.object({
+  decision: z9.enum(["approved", "rejected"]),
+  comment: z9.string().optional()
 });
-var TaskPublicSchema = z8.object({
-  taskId: z8.string(),
-  title: z8.string(),
+var TaskPublicSchema = z9.object({
+  taskId: z9.string(),
+  title: z9.string(),
   // T202608240003：任务类型标签（缺省 = 裸任务/旧任务；模板 PRD 调研变体判定消费）
-  type: z8.enum(TASK_TYPES).optional(),
-  currentNode: z8.string(),
-  currentPhase: z8.string(),
-  status: z8.string(),
-  pausedAt: z8.string().nullable(),
-  track: z8.string()
-});
-var NodeInfoSchema = z8.object({
-  nodeId: z8.string(),
-  label: z8.string(),
-  track: z8.string(),
-  prompt: z8.string(),
-  skills: z8.array(z8.string()),
-  upcomingPause: z8.string().nullable()
-});
-var AdvanceResponseSchema = z8.discriminatedUnion("status", [
-  z8.object({
-    status: z8.literal("advanced"),
+  type: z9.enum(TASK_TYPES).optional(),
+  currentNode: z9.string(),
+  currentPhase: z9.string(),
+  status: z9.string(),
+  pausedAt: z9.string().nullable(),
+  track: z9.string()
+});
+var NodeInfoSchema = z9.object({
+  nodeId: z9.string(),
+  label: z9.string(),
+  track: z9.string(),
+  prompt: z9.string(),
+  skills: z9.array(z9.string()),
+  agents: z9.array(z9.string()),
+  upcomingPause: z9.string().nullable()
+});
+var AdvanceResponseSchema = z9.discriminatedUnion("status", [
+  z9.object({
+    status: z9.literal("advanced"),
     task: TaskPublicSchema,
     nextNode: NodeInfoSchema
   }),
-  z8.object({
-    status: z8.literal("paused"),
+  z9.object({
+    status: z9.literal("paused"),
     task: TaskPublicSchema,
     pausePoint: EdgePausePointSchema,
-    guidance: z8.string()
+    guidance: z9.string()
   }),
-  z8.object({
-    status: z8.literal("completed"),
+  z9.object({
+    status: z9.literal("completed"),
     task: TaskPublicSchema
   })
 ]);
-var ApproveResponseSchema = z8.discriminatedUnion("status", [
-  z8.object({
-    status: z8.literal("advanced"),
+var ApproveResponseSchema = z9.discriminatedUnion("status", [
+  z9.object({
+    status: z9.literal("advanced"),
     task: TaskPublicSchema,
     nextNode: NodeInfoSchema
   }),
-  z8.object({
-    status: z8.literal("rejected"),
+  z9.object({
+    status: z9.literal("rejected"),
     task: TaskPublicSchema,
-    guidance: z8.string()
+    guidance: z9.string()
   }),
   // 「completed」分支当前引擎不可达（approve 从 paused 流转必有下一节点，技术方案 §2.2
   // 已删 paused→completed 直达路径）——按方案 §2.1 契约保留作前向兼容预留
-  z8.object({
-    status: z8.literal("completed"),
+  z9.object({
+    status: z9.literal("completed"),
     task: TaskPublicSchema
   })
 ]);
-var PauseRequestSchema = z8.object({
-  reason: z8.string().optional()
+var PauseRequestSchema = z9.object({
+  reason: z9.string().optional()
 });
-var ResumeRequestSchema = z8.object({
-  decision: z8.string().optional()
+var ResumeRequestSchema = z9.object({
+  decision: z9.string().optional()
 });
-var CancelRequestSchema = z8.object({
-  reason: z8.string().min(1).max(500).optional()
+var CancelRequestSchema = z9.object({
+  reason: z9.string().min(1).max(500).optional()
 });
 
 // src/schemas/task-doc.ts
-import { z as z9 } from "zod";
-var TaskContextSchema = z9.object({
-  task: z9.object({
-    taskId: z9.string(),
-    title: z9.string(),
+import { z as z10 } from "zod";
+var TaskContextSchema = z10.object({
+  task: z10.object({
+    taskId: z10.string(),
+    title: z10.string(),
     // T202608240003：与 TaskPublicSchema 同步（toTaskPublic 运行时已产出，schema 声明漂移会导致 typed 消费方 strip 掉 type）
-    type: z9.enum(TASK_TYPES).optional(),
-    currentNode: z9.string(),
-    currentPhase: z9.string(),
-    status: z9.string(),
-    pausedAt: z9.string().nullable(),
-    track: z9.string()
+    type: z10.enum(TASK_TYPES).optional(),
+    currentNode: z10.string(),
+    currentPhase: z10.string(),
+    status: z10.string(),
+    pausedAt: z10.string().nullable(),
+    track: z10.string()
   }),
-  currentNode: z9.object({
-    nodeId: z9.string(),
-    label: z9.string(),
-    phase: z9.string(),
-    track: z9.string(),
+  currentNode: z10.object({
+    nodeId: z10.string(),
+    label: z10.string(),
+    phase: z10.string(),
+    track: z10.string(),
     /** renderPrompt 渲染后（AI 推进任务的直接输入） */
-    prompt: z9.string(),
-    skills: z9.array(z9.string()),
+    prompt: z10.string(),
+    skills: z10.array(z10.string()),
+    agents: z10.array(z10.string()),
     /** 完成当前节点后出边上的暂停点描述（经 findNextEdge 按轨选边） */
-    upcomingPause: z9.string().nullable()
+    upcomingPause: z10.string().nullable()
   }).nullable(),
-  pausedAtEdge: z9.object({
-    from: z9.string(),
-    to: z9.string(),
+  pausedAtEdge: z10.object({
+    from: z10.string(),
+    to: z10.string(),
     pausePoint: EdgePausePointBaseSchema
   }).nullable(),
   /** 全节点实时状态清单 */
-  nodes: z9.array(z9.object({
-    nodeId: z9.string(),
-    label: z9.string(),
-    status: z9.string(),
-    enteredAt: z9.date().nullable(),
-    completedAt: z9.date().nullable()
+  nodes: z10.array(z10.object({
+    nodeId: z10.string(),
+    label: z10.string(),
+    status: z10.string(),
+    enteredAt: z10.date().nullable(),
+    completedAt: z10.date().nullable()
   })),
   /** N020 D1：任务级结构化文档（未写时 null） */
   taskDoc: TaskDocContentSchema.nullable(),
   /** N020 D1：节点执行记录（仅含已写记录的 nodeId） */
-  nodeRecords: z9.record(z9.string(), NodeRecordSchema),
+  nodeRecords: z10.record(z10.string(), NodeRecordSchema),
   /** N020 D1：跨节点累积素材（架构信息收集条目） */
-  archNotes: z9.array(ArchNoteSchema)
+  archNotes: z10.array(ArchNoteSchema)
 });
-var TaskSummarySchema = z9.object({
-  taskId: z9.string(),
-  title: z9.string(),
+var TaskSummarySchema = z10.object({
+  taskId: z10.string(),
+  title: z10.string(),
   // T202608240003：任务类型标签（缺省 = 裸任务/旧任务）
-  type: z9.enum(TASK_TYPES).optional(),
-  projectId: z9.string(),
-  dagTemplateId: z9.string(),
-  currentNode: z9.string(),
-  currentPhase: z9.string(),
-  status: z9.string(),
-  pausedAt: z9.string().nullable(),
-  track: z9.string(),
-  progress: z9.object({
-    completed: z9.number(),
-    total: z9.number()
+  type: z10.enum(TASK_TYPES).optional(),
+  projectId: z10.string(),
+  dagTemplateId: z10.string(),
+  currentNode: z10.string(),
+  currentPhase: z10.string(),
+  status: z10.string(),
+  pausedAt: z10.string().nullable(),
+  track: z10.string(),
+  progress: z10.object({
+    completed: z10.number(),
+    total: z10.number()
   }),
-  createdAt: z9.date().optional(),
-  updatedAt: z9.date().optional()
+  createdAt: z10.date().optional(),
+  updatedAt: z10.date().optional()
 });
 
 // src/schemas/write-ack.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var WRITE_ACK_ENTRY_KINDS = ["check", "artifact", "decision", "confirmation", "archnote"];
-var WriteAckEntryKindSchema = z10.enum(WRITE_ACK_ENTRY_KINDS);
-var EchoItemSchema = z10.object({
-  path: z10.string(),
-  excerpt: z10.string()
+var WriteAckEntryKindSchema = z11.enum(WRITE_ACK_ENTRY_KINDS);
+var EchoItemSchema = z11.object({
+  path: z11.string(),
+  excerpt: z11.string()
 });
-var TaskProgressSchema = z10.object({
-  completed: z10.number().int(),
-  total: z10.number().int()
+var TaskProgressSchema = z11.object({
+  completed: z11.number().int(),
+  total: z11.number().int()
 });
 var TaskProgressPublicSchema = TaskPublicSchema.extend({
-  projectId: z10.string(),
+  projectId: z11.string(),
   progress: TaskProgressSchema
 });
-var WriteAckSchema = z10.object({
-  taskId: z10.string(),
+var WriteAckSchema = z11.object({
+  taskId: z11.string(),
   /** 本次写入触及的字段点路径（如 doc.what / nodeRecords.PRD.checks） */
-  updated: z10.array(z10.string()),
+  updated: z11.array(z11.string()),
   /** 新建条目标识（$push 五类对象条目；无新条目的端点缺省） */
-  entry: z10.object({
-    id: z10.string(),
+  entry: z11.object({
+    id: z11.string(),
     kind: WriteAckEntryKindSchema
   }).optional(),
   /** 写入内容回显（触及字段逐条；无值可回显的端点可缺省） */
-  echo: z10.array(EchoItemSchema).optional(),
-  updatedAt: z10.date(),
+  echo: z11.array(EchoItemSchema).optional(),
+  updatedAt: z11.date(),
   task: TaskProgressPublicSchema
 });
-var CreateTaskResponseSchema = z10.object({
+var TaskBatchEntrySchema = z11.object({
+  index: z11.number().int().min(0),
+  id: z11.string().optional(),
+  kind: WriteAckEntryKindSchema.optional()
+});
+var TaskBatchFailureSchema = z11.object({
+  index: z11.number().int().min(0),
+  message: z11.string(),
+  hint: z11.string().optional()
+});
+var TaskBatchAckSchema = z11.object({
+  taskId: z11.string(),
+  /** 成功落库条目数（部分失败语义：成功条目保留不回滚） */
+  applied: z11.number().int().min(0),
+  /** 本次写入触及的字段点路径 */
+  updated: z11.array(z11.string()),
+  entries: z11.array(TaskBatchEntrySchema),
+  failures: z11.array(TaskBatchFailureSchema),
+  updatedAt: z11.date(),
+  task: TaskProgressPublicSchema
+});
+var CreateTaskResponseSchema = z11.object({
   task: TaskProgressPublicSchema,
   firstNode: NodeInfoSchema
 });
@@ -2300,34 +2936,34 @@ function excerpt(value, max = 120) {
   return `${chars.slice(0, max - 1).join("")}\u2026`;
 }
 var CONTEXT_VIEWS = ["basic", "full"];
-var ContextViewSchema = z10.enum(CONTEXT_VIEWS);
+var ContextViewSchema = z11.enum(CONTEXT_VIEWS);
 
 // src/schemas/project.ts
-import { z as z11 } from "zod";
-var ProjectStatusSchema = z11.enum(["active", "archived"]);
-var ProjectSchema = z11.object({
-  id: z11.string().optional(),
-  key: z11.string().regex(/^[a-z0-9][a-z0-9-]{1,30}$/, "key \u5FC5\u987B\u4E3A kebab-case\uFF082-31 \u5B57\u7B26\uFF09"),
-  name: z11.string().min(1).max(50),
-  description: z11.string().max(500).optional(),
+import { z as z12 } from "zod";
+var ProjectStatusSchema = z12.enum(["active", "archived"]);
+var ProjectSchema = z12.object({
+  id: z12.string().optional(),
+  key: z12.string().regex(/^[a-z0-9][a-z0-9-]{1,30}$/, "key \u5FC5\u987B\u4E3A kebab-case\uFF082-31 \u5B57\u7B26\uFF09"),
+  name: z12.string().min(1).max(50),
+  description: z12.string().max(500).optional(),
   status: ProjectStatusSchema.default("active"),
-  createdAt: z11.date().optional(),
-  updatedAt: z11.date().optional()
+  createdAt: z12.date().optional(),
+  updatedAt: z12.date().optional()
 });
-var ProjectCreateSchema = z11.object({
-  key: z11.string().regex(/^[a-z0-9][a-z0-9-]{1,30}$/, "key \u5FC5\u987B\u4E3A kebab-case\uFF082-31 \u5B57\u7B26\uFF09").optional(),
-  name: z11.string().min(1).max(50),
-  description: z11.string().max(500).optional()
+var ProjectCreateSchema = z12.object({
+  key: z12.string().regex(/^[a-z0-9][a-z0-9-]{1,30}$/, "key \u5FC5\u987B\u4E3A kebab-case\uFF082-31 \u5B57\u7B26\uFF09").optional(),
+  name: z12.string().min(1).max(50),
+  description: z12.string().max(500).optional()
 });
-var ProjectUpdateSchema = z11.object({
-  name: z11.string().min(1).max(50).optional(),
-  description: z11.string().max(500).optional(),
+var ProjectUpdateSchema = z12.object({
+  name: z12.string().min(1).max(50).optional(),
+  description: z12.string().max(500).optional(),
   status: ProjectStatusSchema.optional()
 });
 
 // src/schemas/enum-registry.ts
-import { z as z12 } from "zod";
-var EnumRegistryCategorySchema = z12.enum([
+import { z as z13 } from "zod";
+var EnumRegistryCategorySchema = z13.enum([
   "dag_phase",
   "dag_track",
   "pause_type",
@@ -2337,62 +2973,277 @@ var EnumRegistryCategorySchema = z12.enum([
   "scope",
   "agent_function"
 ]);
-var EnumEntrySchema = z12.object({
+var EnumEntrySchema = z13.object({
   /** 领域层存库的原始枚举值（不可臆造；builtin 值 engine/DB 强依赖；kebab 约束与 skill name 对齐，保证 DELETE /entries/:value 可寻址） */
-  value: z12.string().regex(/^[a-z0-9][a-z0-9_-]*$/, "value \u4EC5\u652F\u6301\u5C0F\u5199\u5B57\u6BCD/\u6570\u5B57/\u4E0B\u5212\u7EBF/\u8FDE\u5B57\u7B26\uFF08kebab-case\uFF09"),
+  value: z13.string().regex(/^[a-z0-9][a-z0-9_-]*$/, "value \u4EC5\u652F\u6301\u5C0F\u5199\u5B57\u6BCD/\u6570\u5B57/\u4E0B\u5212\u7EBF/\u8FDE\u5B57\u7B26\uFF08kebab-case\uFF09"),
   /** 展示文案（消费端下拉直接取用） */
-  label: z12.string().min(1, "label \u4E0D\u80FD\u4E3A\u7A7A"),
+  label: z13.string().min(1, "label \u4E0D\u80FD\u4E3A\u7A7A"),
   /** 可选语义色 token（如 --success / --warning），消费端映射到 UI */
-  color: z12.string().optional(),
+  color: z13.string().optional(),
   /** 下拉排序（升序） */
-  order: z12.number().int().default(0),
+  order: z13.number().int().default(0),
   /** 内置值：禁删 + label/color 可改但 value 不可改（D8）；seed 时标记 */
-  builtin: z12.boolean().default(false),
+  builtin: z13.boolean().default(false),
   /** 启停：false = 下拉禁用展示（历史数据仍可读，新选择不可用） */
-  active: z12.boolean().default(true)
+  active: z13.boolean().default(true)
 });
-var EnumRegistrySchema = z12.object({
-  id: z12.string().optional(),
+var EnumRegistrySchema = z13.object({
+  id: z13.string().optional(),
   category: EnumRegistryCategorySchema,
-  entries: z12.array(EnumEntrySchema).default([]),
-  updatedAt: z12.date().optional()
+  entries: z13.array(EnumEntrySchema).default([]),
+  updatedAt: z13.date().optional()
 });
-var EnumRegistryUpdateSchema = z12.object({
-  entries: z12.array(EnumEntrySchema)
+var EnumRegistryUpdateSchema = z13.object({
+  entries: z13.array(EnumEntrySchema)
 });
 
 // src/schemas/asset-enabled.ts
-import { z as z13 } from "zod";
-var AssetSetEnabledSchema = z13.object({
-  enabled: z13.boolean()
+import { z as z14 } from "zod";
+var AssetSetEnabledSchema = z14.object({
+  enabled: z14.boolean()
+});
+
+// src/schemas/auth.ts
+import { z as z15 } from "zod";
+var AuthTokenTypeSchema = z15.enum(["admin", "project"]);
+var AuthAccountSchema = z15.object({
+  id: z15.string().optional(),
+  username: z15.string().min(3, "\u8D26\u53F7\u81F3\u5C11 3 \u4E2A\u5B57\u7B26").max(50).regex(/^[a-zA-Z0-9_-]+$/, "\u8D26\u53F7\u4EC5\u5141\u8BB8\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u4E0E\u8FDE\u5B57\u7B26"),
+  /** 存储形态：scrypt$N$r$p$salt$hash（base64 段），明文仅存在于请求体 */
+  passwordHash: z15.string().min(1),
+  createdAt: z15.date().optional(),
+  updatedAt: z15.date().optional()
+});
+var AuthAccountCreateSchema = z15.object({
+  username: AuthAccountSchema.shape.username,
+  password: z15.string().min(8, "\u5BC6\u7801\u81F3\u5C11 8 \u4E2A\u5B57\u7B26").max(128)
+});
+var PasswordChangeSchema = z15.object({
+  currentPassword: z15.string().min(1),
+  newPassword: z15.string().min(8, "\u5BC6\u7801\u81F3\u5C11 8 \u4E2A\u5B57\u7B26").max(128)
+});
+var LoginSchema = z15.object({
+  username: z15.string().min(1),
+  password: z15.string().min(1)
+});
+var AuthTokenSchema = z15.object({
+  id: z15.string().optional(),
+  /** sha256(token 全串含前缀) hex——明文 Token 不入库 */
+  tokenHash: z15.string().regex(/^[a-f0-9]{64}$/),
+  type: AuthTokenTypeSchema,
+  /** type=project 时必填且不可缺失（superRefine 保证）；指向 projects.id（24-hex） */
+  projectId: z15.string().regex(/^[a-f0-9]{24}$/, "projectId \u5FC5\u987B\u4E3A 24-hex ObjectId").optional(),
+  createdAt: z15.date().optional(),
+  updatedAt: z15.date().optional()
+}).superRefine((data, ctx) => {
+  if (data.type === "project" && data.projectId === void 0) {
+    ctx.addIssue({ code: "custom", path: ["projectId"], message: "\u9879\u76EE Token \u5FC5\u987B\u7ED1\u5B9A projectId" });
+  }
+});
+var AuthTokenGenResponseSchema = z15.object({
+  token: z15.string().min(1),
+  type: AuthTokenTypeSchema,
+  projectId: z15.string().optional()
+});
+var AuthTokenStatusSchema = z15.object({
+  type: AuthTokenTypeSchema,
+  projectId: z15.string().optional(),
+  hasToken: z15.boolean(),
+  createdAt: z15.date().nullable().optional()
+});
+var AuthWhoamiSchema = z15.object({
+  identity: z15.enum(["admin", "project", "none"]),
+  project: z15.object({
+    id: z15.string(),
+    key: z15.string(),
+    name: z15.string()
+  }).nullable().optional(),
+  authEnabled: z15.boolean(),
+  server: z15.object({
+    url: z15.string()
+  })
+});
+var AuthStatusSchema = z15.object({
+  authEnabled: z15.boolean(),
+  /** 鉴权开启且无管理员账号 = 初始化引导窗口（PRD §3.2） */
+  needsSetup: z15.boolean()
+});
+
+// src/schemas/node-preset.ts
+import { z as z16 } from "zod";
+var NODE_PRESET_CODE_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var NodePresetScopeRefine = (val, ctx) => {
+  if (val.scope === "project" && !val.projectId) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["projectId"],
+      message: "scope=project \u65F6 projectId \u5FC5\u586B"
+    });
+  }
+};
+var uniqueNamesSchema = z16.array(z16.string().min(1)).superRefine((names, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  names.forEach((name, index) => {
+    if (seen.has(name)) {
+      ctx.addIssue({ code: "custom", path: [index], message: `\u540D\u79F0\u91CD\u590D\uFF1A${name}` });
+    }
+    seen.add(name);
+  });
+});
+var NodePresetShapeSchema = z16.object({
+  id: z16.string().optional(),
+  code: z16.string().regex(NODE_PRESET_CODE_PATTERN, "kebab-case only"),
+  label: z16.string().min(1),
+  /** 组装默认节点标识（模板图结构域；字符集同 NODE_ID_PATTERN——节点记录点路径拼接安全前提） */
+  nodeId: z16.string().regex(/^[A-Za-z0-9_-]+$/, "nodeId \u53EA\u5141\u8BB8\u5B57\u6BCD/\u6570\u5B57/\u4E0B\u5212\u7EBF/\u8FDE\u5B57\u7B26"),
+  /** 运行时注册表判定（对齐 dag_phase/dag_track 放宽策略——Zod 只做类型级） */
+  phase: z16.string(),
+  track: z16.string(),
+  prompt: z16.string().min(1),
+  /** 绑定技能名单（by-name 引用；版本要求只存在于 npm 分发层 manifest，不侵入运行链路） */
+  skills: uniqueNamesSchema,
+  /** 节点执行时可调用的 Agent 名单（by-name 引用；正文仍由独立 Agent 资产承载） */
+  agents: uniqueNamesSchema,
+  scope: z16.enum(["global", "project"]),
+  projectId: z16.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional(),
+  description: z16.string().optional(),
+  version: z16.string(),
+  /** 分发来源标注（flow install 落库时填充包名；手工创建无此字段——「来源可见可核查」信任模型） */
+  source: z16.object({ package: z16.string().min(1) }).optional(),
+  /** 资产启停（可选——存量无此字段 = 启用；唯一写入口 POST /:code/enabled，不入 Create/Update/Copy） */
+  enabled: z16.boolean().optional(),
+  createdAt: z16.date().optional(),
+  updatedAt: z16.date().optional()
+});
+var NodePresetSchema = NodePresetShapeSchema.superRefine(NodePresetScopeRefine);
+var NodePresetCreateSchema = NodePresetShapeSchema.omit({
+  id: true,
+  createdAt: true,
+  updatedAt: true,
+  enabled: true
+}).extend({
+  skills: uniqueNamesSchema.default([]),
+  agents: uniqueNamesSchema.default([]),
+  version: z16.string().default("1.0.0")
+}).superRefine(NodePresetScopeRefine);
+var NodePresetUpdateSchema = NodePresetShapeSchema.omit({
+  id: true,
+  createdAt: true,
+  updatedAt: true,
+  enabled: true
+}).extend({
+  version: z16.string().optional()
+}).partial().superRefine(NodePresetScopeRefine);
+var NodePresetCopySchema = z16.object({
+  newCode: z16.string().regex(NODE_PRESET_CODE_PATTERN, "kebab-case only"),
+  newScope: z16.enum(["global", "project"]),
+  targetProjectId: z16.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional()
+}).superRefine((val, ctx) => {
+  if (val.newScope === "project" && !val.targetProjectId) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["targetProjectId"],
+      message: "newScope=project \u65F6 targetProjectId \u5FC5\u586B"
+    });
+  }
+});
+
+// src/schemas/node-library.ts
+import { z as z17 } from "zod";
+var CompositionEdgeSchema = z17.object({
+  from: z17.string().min(1),
+  to: z17.string().min(1),
+  condition: z17.string().optional(),
+  pausePoint: EdgePausePointSchema.optional()
+});
+var CompositionSchema = z17.object({
+  name: z17.string().min(1),
+  description: z17.string().optional(),
+  nodes: z17.array(z17.string().min(1)).min(1),
+  edges: z17.array(CompositionEdgeSchema)
+});
+var NodeLibrarySchema = z17.object({
+  id: z17.string().optional(),
+  /** 库名 = npm 包名（同库重装按名 upsert 覆盖登记） */
+  name: z17.string().min(1),
+  version: z17.string(),
+  scope: z17.enum(["global", "project"]),
+  projectId: z17.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional(),
+  /** 已装节点 code 清单（flow compose 逐 code 解析 node_presets） */
+  nodes: z17.array(z17.string()),
+  compositions: z17.array(CompositionSchema),
+  installedAt: z17.date().optional()
+});
+var NodeLibraryUpsertSchema = z17.object({
+  name: z17.string().min(1),
+  version: z17.string(),
+  scope: z17.enum(["global", "project"]),
+  projectId: z17.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional(),
+  nodes: z17.array(z17.string()),
+  compositions: z17.array(CompositionSchema)
+}).superRefine((val, ctx) => {
+  if (val.scope === "project" && !val.projectId) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["projectId"],
+      message: "scope=project \u65F6 projectId \u5FC5\u586B"
+    });
+  }
+});
+
+// src/schemas/template-upgrade.ts
+import { z as z18 } from "zod";
+var UpgradeNodeStatusSchema = z18.enum([
+  "updatable",
+  "local-modified",
+  "up-to-date",
+  "source-missing",
+  "source-disabled"
+]);
+var UpgradeActionSchema = z18.enum(["upgrade", "keep", "skip"]);
+var UpgradeDecisionSchema = z18.object({
+  nodeId: z18.string().min(1),
+  action: UpgradeActionSchema,
+  expected: z18.object({ status: UpgradeNodeStatusSchema }).optional()
+});
+var UpgradeApplyRequestSchema = z18.object({
+  decisions: z18.array(UpgradeDecisionSchema).min(1)
 });
 
 // src/config/server-config.ts
-import { z as z14 } from "zod";
-var SimingLogLevelSchema = z14.enum(["debug", "info", "warn", "error"]);
-var SimingConfigSchema = z14.object({
-  mongoUri: z14.string().min(1).default("mongodb://localhost:27017"),
-  port: z14.coerce.number().int().min(1).max(65535).default(7777),
+import { z as z19 } from "zod";
+var SimingLogLevelSchema = z19.enum(["debug", "info", "warn", "error"]);
+var SimingConfigSchema = z19.object({
+  mongoUri: z19.string().min(1).default("mongodb://localhost:27017"),
+  port: z19.coerce.number().int().min(1).max(65535).default(7777),
   /**
    * N018 D8：默认仅绑定本机回环（安全默认）；远程/局域接入（F7）显式配置 host。
    * 超出 PRD V1 配置清单的新增项，依据见技术方案 §3.4「超范围扩展标注」。
    */
-  host: z14.string().min(1).default("127.0.0.1"),
+  host: z19.string().min(1).default("127.0.0.1"),
   logLevel: SimingLogLevelSchema.default("info"),
   /**
-   * F6 预留字段（V2 远程部署）：宽松形态——出现即接受、形状不校验、运行时不读取。
-   * 严格满足 PRD「配置中出现预留字段时不报错」；V2 落地时收紧为类型化 schema。
+   * T202608310001：鉴权开关（F1）——从 F6 预留宽松形态收紧为类型化 schema。
+   * 默认关闭 = 本地开发/存量行为零破坏；云主机部署显式开启（SIMING_AUTH_ENABLED=true）。
    */
-  auth: z14.unknown().optional(),
-  cors: z14.unknown().optional()
+  auth: z19.object({
+    enabled: z19.boolean().default(false)
+  }).prefault({}),
+  cors: z19.unknown().optional()
 });
-var SIMING_CONFIG_KEYS = ["mongoUri", "port", "host", "logLevel"];
+var SIMING_CONFIG_KEYS = ["mongoUri", "port", "host", "logLevel", "auth"];
 var SIMING_CONFIG_ENV_KEYS = {
   mongoUri: "SIMING_MONGO_URI",
   port: "PORT",
   host: "SIMING_HOST",
-  logLevel: "SIMING_LOG_LEVEL"
+  logLevel: "SIMING_LOG_LEVEL",
+  auth: "SIMING_AUTH_ENABLED"
 };
+function parseAuthEnabledEnvValue(raw) {
+  if (raw === "true") return true;
+  if (raw === "false") return false;
+  throw new Error(`SIMING_AUTH_ENABLED \u4EC5\u63A5\u53D7 true/false\uFF0C\u6536\u5230: ${raw}`);
+}
 
 // src/version-bump.ts
 function tryBumpPatch(version) {
@@ -2407,6 +3258,266 @@ function bumpPatchOrPassthrough(version) {
   return tryBumpPatch(version) ?? version;
 }
 
+// src/content-hash.ts
+import { createHash as createHash2 } from "crypto";
+function computeNodeContentHash(node) {
+  const canonical = JSON.stringify({
+    label: node.label,
+    phase: node.phase,
+    track: node.track,
+    prompt: node.prompt,
+    skills: [...node.skills].sort()
+  });
+  return createHash2("sha256").update(canonical).digest("hex").slice(0, 16);
+}
+
+// src/template-content-diff.ts
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value) ?? "null";
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((v) => v === void 0 ? "null" : stableStringify(v)).join(",")}]`;
+  }
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+}
+function sameAgentNames(a, b) {
+  return stableStringify([...a ?? []].sort()) === stableStringify([...b ?? []].sort());
+}
+function edgeKey(e) {
+  return JSON.stringify([e.from, e.to, e.condition ?? null, e.pausePoint ?? null]);
+}
+function diffTemplateContent(imported, existing) {
+  const importedById = new Map(imported.nodes.map((n) => [n.id, n]));
+  const existingById = new Map(existing.nodes.map((n) => [n.id, n]));
+  const nodesAdded = [...importedById.keys()].filter((id) => !existingById.has(id)).sort();
+  const nodesRemoved = [...existingById.keys()].filter((id) => !importedById.has(id)).sort();
+  const nodesChanged = [...importedById.keys()].filter((id) => {
+    const a = importedById.get(id);
+    const b = existingById.get(id);
+    if (a === void 0 || b === void 0) return false;
+    const normA = { ...a, skills: a.skills ?? [] };
+    const normB = { ...b, skills: b.skills ?? [] };
+    return computeNodeContentHash(normA) !== computeNodeContentHash(normB) || !sameAgentNames(a.agents, b.agents) || !sameAgentNames(a.sourcePreset?.agents, b.sourcePreset?.agents);
+  }).sort();
+  const edgesChanged = stableStringify([...imported.edges].map(edgeKey).sort()) !== stableStringify([...existing.edges].map(edgeKey).sort());
+  const descriptionChanged = imported.description !== existing.description;
+  const layoutChanged = stableStringify(imported.layout ?? {}) !== stableStringify(existing.layout ?? {});
+  const identical = imported.name === existing.name && !descriptionChanged && nodesAdded.length === 0 && nodesRemoved.length === 0 && nodesChanged.length === 0 && !edgesChanged && !layoutChanged;
+  return {
+    identical,
+    changes: { nodesAdded, nodesRemoved, nodesChanged, edgesChanged, descriptionChanged, layoutChanged }
+  };
+}
+
+// src/template-upgrade.ts
+function presetContent(preset) {
+  return {
+    label: preset.label,
+    phase: preset.phase,
+    track: preset.track,
+    prompt: preset.prompt,
+    skills: preset.skills
+  };
+}
+var EMPTY_DIFF = {
+  prompt: null,
+  label: null,
+  phase: null,
+  track: null,
+  skills: null,
+  agents: null
+};
+function diffNames(beforeNames, afterNames) {
+  const before = new Set(beforeNames);
+  const after = new Set(afterNames);
+  const added = [...after].filter((name) => !before.has(name)).sort();
+  const removed = [...before].filter((name) => !after.has(name)).sort();
+  return added.length === 0 && removed.length === 0 ? null : { added, removed };
+}
+function sameNames(left, right) {
+  return JSON.stringify([...left].sort()) === JSON.stringify([...right].sort());
+}
+function diffNodeAgainstPreset(node, preset) {
+  return {
+    prompt: node.prompt === preset.prompt ? null : "changed",
+    label: node.label === preset.label ? null : "changed",
+    phase: node.phase === preset.phase ? null : "changed",
+    track: node.track === preset.track ? null : "changed",
+    skills: diffNames(node.skills, preset.skills),
+    agents: diffNames(node.agents ?? [], preset.agents ?? [])
+  };
+}
+function computeUpgradeStatus(node, latest) {
+  const source = node.sourcePreset;
+  if (!source) return { status: "up-to-date", localModified: false };
+  const agentsModified = !sameNames(node.agents ?? [], source.agents ?? []);
+  const localModified = computeNodeContentHash(node) !== source.contentHash || agentsModified;
+  if (!latest) return { status: "source-missing", localModified };
+  if (latest.enabled === false) return { status: "source-disabled", localModified };
+  if (localModified) return { status: "local-modified", localModified };
+  return latest.version !== source.version ? { status: "updatable", localModified: false } : { status: "up-to-date", localModified: false };
+}
+function buildUpgradePlan(template, presetsByCode) {
+  const items = [];
+  for (const node of template.nodes) {
+    const source = node.sourcePreset;
+    if (!source) continue;
+    const latest = presetsByCode.get(source.code) ?? null;
+    const { status, localModified } = computeUpgradeStatus(node, latest);
+    items.push({
+      nodeId: node.id,
+      source: { code: source.code, version: source.version, contentHash: source.contentHash },
+      latest: latest ? {
+        version: latest.version,
+        contentHash: computeNodeContentHash(presetContent(latest)),
+        enabled: latest.enabled ?? true
+      } : null,
+      status,
+      localModified,
+      diff: latest ? diffNodeAgainstPreset(node, latest) : EMPTY_DIFF
+    });
+  }
+  return {
+    templateVersion: template.version,
+    items,
+    upgradableCount: items.filter((item) => item.status === "updatable").length
+  };
+}
+function applyUpgradeDecisions(template, presetsByCode, decisions) {
+  const sourceNodeIds = new Set(template.nodes.filter((n) => n.sourcePreset).map((n) => n.id));
+  const decisionMap = /* @__PURE__ */ new Map();
+  const unknown = [];
+  const duplicated = [];
+  for (const decision of decisions) {
+    if (decisionMap.has(decision.nodeId)) duplicated.push(decision.nodeId);
+    if (!sourceNodeIds.has(decision.nodeId)) unknown.push(decision.nodeId);
+    decisionMap.set(decision.nodeId, decision);
+  }
+  if (duplicated.length > 0) {
+    throw new ValidationError(
+      `\u51B3\u7B56\u542B\u91CD\u590D\u8282\u70B9 id\uFF1A${duplicated.join(", ")}`,
+      duplicated.map((id) => ({ path: ["decisions"], message: `\u8282\u70B9 ${id} \u5B58\u5728\u591A\u6761\u51B3\u7B56` }))
+    );
+  }
+  if (unknown.length > 0) {
+    throw new ValidationError(
+      `\u51B3\u7B56\u542B\u6A21\u677F\u5916\u6216\u65E0\u6765\u6E90\u6807\u8BB0\u7684\u8282\u70B9 id\uFF1A${unknown.join(", ")}`,
+      unknown.map((id) => ({ path: ["decisions"], message: `\u8282\u70B9 ${id} \u4E0D\u5728\u53EF\u5347\u7EA7\u8282\u70B9\u6E05\u5355\u4E2D` }))
+    );
+  }
+  const nodes = template.nodes.map((node) => ({
+    ...node,
+    skills: [...node.skills],
+    agents: [...node.agents ?? []],
+    ...node.sourcePreset ? {
+      sourcePreset: {
+        ...node.sourcePreset,
+        ...node.sourcePreset.agents ? { agents: [...node.sourcePreset.agents] } : {}
+      }
+    } : {}
+  }));
+  const results = [];
+  const stale = [];
+  let changed = false;
+  for (let i = 0; i < template.nodes.length; i++) {
+    const original = template.nodes[i];
+    const source = original.sourcePreset;
+    if (!source) continue;
+    const working = nodes[i];
+    const latest = presetsByCode.get(source.code) ?? null;
+    const { status, localModified } = computeUpgradeStatus(original, latest);
+    const decision = decisionMap.get(original.id);
+    if (localModified && !decision) {
+      throw new ValidationError(
+        `\u8282\u70B9 ${original.id} \u672C\u5730\u5DF2\u4FEE\u6539\uFF08\u72B6\u6001 ${status}\uFF09\uFF0C\u5FC5\u987B\u663E\u5F0F\u51B3\u7B56\uFF08upgrade/keep/skip\uFF09`,
+        [{ path: ["decisions"], message: `\u8282\u70B9 ${original.id} \u7F3A\u5C11\u51B3\u7B56` }],
+        {
+          bizCode: "UPGRADE_DECISION_REQUIRED",
+          message: `${BIZ_CODE_MESSAGES.UPGRADE_DECISION_REQUIRED}\uFF1A${original.id}`
+        }
+      );
+    }
+    if (localModified && decision?.action === "upgrade" && decision.expected === void 0) {
+      throw new ValidationError(
+        `\u8282\u70B9 ${original.id} \u672C\u5730\u5DF2\u4FEE\u6539\uFF0C\u8986\u76D6\u6027 upgrade \u51B3\u7B56\u5FC5\u987B\u643A\u5E26 expected={status:'local-modified'}\uFF08\u91CD\u65B0 plan \u540E\u5E26 expected \u91CD\u8BD5\uFF09`,
+        [{ path: ["decisions"], message: `\u8282\u70B9 ${original.id} \u51B3\u7B56\u7F3A expected \u57FA\u7EBF` }],
+        {
+          bizCode: "UPGRADE_STALE",
+          message: `${BIZ_CODE_MESSAGES.UPGRADE_STALE}\uFF08${original.id} \u51B3\u7B56\u7F3A expected\uFF09`
+        }
+      );
+    }
+    if (!decision) {
+      results.push({ nodeId: original.id, action: "skip", applied: false, reason: "\u672A\u51B3\u7B56\uFF08\u4FDD\u5B88\u8DF3\u8FC7\uFF09" });
+      continue;
+    }
+    if (decision.expected && decision.expected.status !== status) {
+      stale.push(`${original.id}: ${decision.expected.status} \u2192 ${status}`);
+    }
+    if (status === "source-missing" || status === "source-disabled") {
+      results.push({
+        nodeId: original.id,
+        action: "skip",
+        applied: false,
+        reason: status === "source-missing" ? "\u6765\u6E90\u8282\u70B9\u7F3A\u5931\uFF0C\u6309\u7F3A\u7701 skip \u5904\u7406" : "\u6765\u6E90\u8282\u70B9\u5DF2\u505C\u7528\uFF0C\u6309\u7F3A\u7701 skip \u5904\u7406"
+      });
+      continue;
+    }
+    if (!latest) continue;
+    if (status === "up-to-date") {
+      results.push({
+        nodeId: original.id,
+        action: decision.action,
+        applied: false,
+        reason: "\u5DF2\u662F\u6700\u65B0\uFF08\u65E0\u53D8\u66F4\uFF09"
+      });
+      continue;
+    }
+    if (decision.action === "skip") {
+      results.push({ nodeId: original.id, action: "skip", applied: false });
+      continue;
+    }
+    if (decision.action === "upgrade") {
+      working.label = latest.label;
+      working.phase = latest.phase;
+      working.track = latest.track;
+      working.prompt = latest.prompt;
+      working.skills = [...latest.skills];
+      working.agents = [...latest.agents ?? []];
+      working.sourcePreset = {
+        code: source.code,
+        version: latest.version,
+        contentHash: computeNodeContentHash(presetContent(latest)),
+        agents: [...latest.agents ?? []]
+      };
+      changed = true;
+      results.push({ nodeId: original.id, action: "upgrade", applied: true });
+    } else {
+      working.sourcePreset = {
+        code: source.code,
+        version: latest.version,
+        contentHash: computeNodeContentHash(original),
+        agents: [...original.agents ?? []]
+      };
+      changed = true;
+      results.push({ nodeId: original.id, action: "keep", applied: true });
+    }
+  }
+  if (stale.length > 0) {
+    throw new ValidationError(
+      `\u6A21\u677F\u72B6\u6001\u4E0E\u5347\u7EA7\u8BA1\u5212\u4E0D\u7B26\uFF08plan \u540E\u5DF2\u88AB\u4FEE\u6539\uFF09\uFF0C\u8BF7\u91CD\u65B0 plan\u3002\u53D8\u5316\uFF1A${stale.join("; ")}`,
+      stale.map((s) => ({ path: ["decisions"], message: s })),
+      {
+        bizCode: "UPGRADE_STALE",
+        message: `${BIZ_CODE_MESSAGES.UPGRADE_STALE}\uFF08${stale.join("; ")}\uFF09`
+      }
+    );
+  }
+  return { nodes, nextVersion: changed ? bumpPatch(template.version) : null, results };
+}
+
 // src/task/entry-id.ts
 var ENTRY_ID_LENGTH = 6;
 var BASE36_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
@@ -2424,7 +3535,7 @@ function generateEntryId(existing) {
 
 // src/template-transfer/payload.ts
 function toTemplatePayload(tpl) {
-  const { id: _id, projectId: _projectId, enabled: _enabled, createdAt: _ca, updatedAt: _ua, ...rest } = tpl;
+  const { id: _id, projectId: _projectId, enabled: _enabled, createdAt: _ca, updatedAt: _ua, code: _code, ...rest } = tpl;
   return { ...rest };
 }
 function toSkillPayload(skill) {
@@ -2615,6 +3726,26 @@ async function buildImportPlan(deps, targetProjectId, bundle) {
       }
     }
   }
+  const directSkillChecks = [];
+  const unbundledNames = [...new Set(bundle.template.nodes.flatMap((n) => n.skills).filter((s) => !bundledSkillNames.has(s)))];
+  const envVisibleSkills = unbundledNames.length > 0 ? await deps.skillRepo.listSkillsByNames(unbundledNames, "project", targetProjectId) : /* @__PURE__ */ new Map();
+  for (const node of bundle.template.nodes) {
+    for (const skillName of node.skills) {
+      if (bundledSkillNames.has(skillName) || envVisibleSkills.has(skillName)) {
+        directSkillChecks.push({ node: node.id, skill: skillName, status: "ok" });
+      } else {
+        directSkillChecks.push({ node: node.id, skill: skillName, status: "missing" });
+        warnings.push(`\u6A21\u677F\u8282\u70B9 ${node.id} \u76F4\u63A5\u5F15\u7528\u6280\u80FD "${skillName}" \u4E0D\u5728\u5BFC\u51FA\u5305\u4E2D\u4E14\u76EE\u6807\u73AF\u5883\u4E0D\u5B58\u5728\uFF08\u7ED1\u5B9A\u60AC\u7A7A\uFF09`);
+      }
+    }
+  }
+  const presetCodes = [...new Set(bundle.template.nodes.flatMap((n) => n.sourcePreset ? [n.sourcePreset.code] : []))];
+  const presetsByCode = presetCodes.length > 0 ? await deps.nodePresetRepo.listByCodes(presetCodes) : /* @__PURE__ */ new Map();
+  for (const node of bundle.template.nodes) {
+    if (node.sourcePreset && !presetsByCode.has(node.sourcePreset.code)) {
+      warnings.push(`\u6A21\u677F\u8282\u70B9 ${node.id} \u7684\u6765\u6E90\u8282\u70B9 "${node.sourcePreset.code}" \u5728\u76EE\u6807\u73AF\u5883\u4E0D\u5B58\u5728\uFF0C\u5BFC\u5165\u5C06\u5265\u9664\u6765\u6E90\u6807\u8BB0\uFF08\u964D\u7EA7\u81EA\u5EFA\u8282\u70B9\uFF09`);
+    }
+  }
   return {
     template: {
       name: bundle.template.name,
@@ -2626,6 +3757,7 @@ async function buildImportPlan(deps, targetProjectId, bundle) {
       ...bundle.template.isDefault && !isDefaultEffect ? { downgradeReason: "project_has_default" } : {}
     },
     dependencies: [...skillChecks, ...agentChecks, ...aliasChecks],
+    directSkillChecks,
     warnings
   };
 }
@@ -2637,15 +3769,27 @@ async function applyImport(deps, targetProjectId, bundle, decisions) {
   const projectHasDefault = await hasProjectDefault(deps, targetProjectId);
   const isDefaultEffect = bundle.template.isDefault && !projectHasDefault;
   const tplPayload = bundle.template;
-  const createInput = { ...tplPayload, projectId: targetProjectId, isDefault: isDefaultEffect };
+  const sourceCodes = [...new Set(tplPayload.nodes.flatMap((n) => n.sourcePreset ? [n.sourcePreset.code] : []))];
+  const presetsByCode = sourceCodes.length > 0 ? await deps.nodePresetRepo.listByCodes(sourceCodes) : /* @__PURE__ */ new Map();
+  const sourceStripped = [];
+  const nodesForWrite = tplPayload.nodes.map((node) => {
+    if (node.sourcePreset && !presetsByCode.has(node.sourcePreset.code)) {
+      sourceStripped.push(node.id);
+      const { sourcePreset: _stripped, ...rest } = node;
+      return rest;
+    }
+    return node;
+  });
+  const createInput = { ...tplPayload, projectId: targetProjectId, isDefault: isDefaultEffect, nodes: nodesForWrite };
   const parsed = DagTemplateCreateSchema.safeParse(createInput);
   if (!parsed.success) {
     throw new ValidationError("\u6A21\u677F\u5185\u5BB9\u6821\u9A8C\u5931\u8D25\uFF08\u5BFC\u5165\u6587\u4EF6\u5B57\u6BB5\u975E\u6CD5\uFF09", parsed.error.issues);
   }
+  assertUniqueNodeIds(nodesForWrite);
   const contentFields = {
     name: tplPayload.name,
     description: tplPayload.description,
-    nodes: tplPayload.nodes,
+    nodes: nodesForWrite,
     edges: tplPayload.edges,
     version: tplPayload.version,
     isDefault: isDefaultEffect,
@@ -2794,7 +3938,7 @@ async function applyImport(deps, targetProjectId, bundle, decisions) {
       results.push({ kind: "modelAlias", name: payload.code, action: "failed", message: errorMessage(err) });
     }
   }
-  return { template: templateResult, dependencies: results };
+  return { template: templateResult, dependencies: results, sourceStripped };
 }
 function decide(status, decision) {
   if (status === "identical") return "identical";
@@ -2812,7 +3956,7 @@ function errorMessage(err) {
 }
 
 // src/index.ts
-var PackageJsonSchema = z15.object({ version: z15.string().min(1) });
+var PackageJsonSchema = z20.object({ version: z20.string().min(1) });
 var packageJsonParsed = PackageJsonSchema.safeParse(
   JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf-8"))
 );
@@ -2826,6 +3970,7 @@ function ping() {
 export {
   AGENT_MAIN_DOC,
   ARTIFACT_TYPES,
+  AUTH_COLLECTIONS,
   AdvanceRequestSchema,
   AdvanceResponseSchema,
   AgentCopySchema,
@@ -2842,11 +3987,21 @@ export {
   ArchNoteSchema,
   ArtifactSchema,
   AssetSetEnabledSchema,
+  AuthAccountCreateSchema,
+  AuthAccountSchema,
+  AuthStatusSchema,
+  AuthTokenGenResponseSchema,
+  AuthTokenSchema,
+  AuthTokenStatusSchema,
+  AuthTokenTypeSchema,
+  AuthWhoamiSchema,
   BIZ_CODE_MESSAGES,
   BadRequestError,
   CONTEXT_VIEWS,
   CancelRequestSchema,
   CheckItemSchema,
+  CompositionEdgeSchema,
+  CompositionSchema,
   ConfirmationSchema,
   ConflictError,
   ContextViewSchema,
@@ -2855,6 +4010,7 @@ export {
   DAG_TRACKS,
   DEFAULT_PROJECT_KEY,
   DagEdgeSchema,
+  DagInstanceNodeSchema,
   DagInstanceSchema,
   DagNodePhaseSchema,
   DagNodeSchema,
@@ -2877,6 +4033,7 @@ export {
   EnumRegistrySchema,
   EnumRegistryUpdateSchema,
   ExportBundleSchema,
+  ForbiddenError,
   HistoryActionSchema,
   HistoryEntrySchema,
   ImportApplyRequestSchema,
@@ -2884,6 +4041,7 @@ export {
   ImportDecisionSchema,
   ImportPlanRequestSchema,
   ImportPlanResponseSchema,
+  LoginSchema,
   ModelAliasCreateSchema,
   ModelAliasPayloadSchema,
   ModelAliasSchema,
@@ -2891,14 +4049,23 @@ export {
   ModelAliasUpdateSchema,
   ModelAliasWithRefCountSchema,
   NODE_ID_PATTERN,
+  NODE_PRESET_CODE_PATTERN,
   NODE_STATUSES,
   NodeInfoSchema,
+  NodeLibrarySchema,
+  NodeLibraryUpsertSchema,
+  NodePresetCopySchema,
+  NodePresetCreateSchema,
+  NodePresetSchema,
+  NodePresetShapeSchema,
+  NodePresetUpdateSchema,
   NodeRecordSchema,
   NodeStateSchema,
   NodeStatusSchema,
   NotFoundError,
   OBJECT_ID_HEX,
   PAUSE_POINT_TYPES,
+  PasswordChangeSchema,
   PausePointTypeSchema,
   PauseRequestSchema,
   ProjectCreateSchema,
@@ -2921,9 +4088,15 @@ export {
   SkillScopeSchema,
   SkillShapeSchema,
   SkillUpdateSchema,
+  SourcePresetSchema,
   TASK_PHASES,
   TASK_STATUSES,
   TASK_TYPES,
+  TEMPLATE_CODE_MAX_LENGTH,
+  TEMPLATE_CODE_REGEX,
+  TaskBatchAckSchema,
+  TaskBatchEntrySchema,
+  TaskBatchFailureSchema,
   TaskContextSchema,
   TaskCreateInputSchema,
   TaskDocContentSchema,
@@ -2934,7 +4107,14 @@ export {
   TaskSchema,
   TaskStatusSchema,
   TaskSummarySchema,
+  TemplateCandidateSchema,
+  TemplateCodeFieldSchema,
   TemplatePayloadSchema,
+  UnauthorizedError,
+  UpgradeActionSchema,
+  UpgradeApplyRequestSchema,
+  UpgradeDecisionSchema,
+  UpgradeNodeStatusSchema,
   VERSION,
   ValidationError,
   WRITE_ACK_ENTRY_KINDS,
@@ -2942,38 +4122,58 @@ export {
   WriteAckSchema,
   advanceTask,
   applyImport,
+  applyUpgradeDecisions,
   approveTask,
   assertBoundSkillsCompatible,
   assertModelAliasExists,
   assertReferenceAggregateLimit,
   assertReferencesDeletable,
+  assertUniqueNodeIds,
   buildImportPlan,
+  buildTemplateCode,
+  buildUpgradePlan,
   bumpPatch,
   bumpPatchOrPassthrough,
   cancelTask,
   canonicalizeReferencePath,
   checkTermination,
   composeExportBundle,
+  computeNodeContentHash,
+  computeUpgradeStatus,
   createAgentRepo,
+  createAuthAccountRepo,
+  createAuthSessionRepo,
+  createAuthTokenRepo,
   createDagTemplateRepo,
   createEnumRegistryRepo,
   createModelAliasRepo,
   createMongoClient,
+  createNodeLibraryRepo,
+  createNodePresetRepo,
   createProjectRepo,
   createReferencesSchema,
   createRepo,
   createSkillRepo,
   createTaskRepo,
   decisionKey,
+  diffTemplateContent,
   enabledNeFalse,
   escapeRegExpLiteral,
   excerpt,
+  findDuplicateNodeIds,
   findNextEdge,
   findTemplateByName,
   generateEntryId,
   generateProjectKey,
+  generateSessionId,
+  generateToken,
   hasProjectDefault,
+  hashPassword,
+  hashToken,
+  isLegalTemplateCode,
   mkHistory,
+  normalizeNameToTemplateCode,
+  parseAuthEnabledEnvValue,
   pauseTask,
   ping,
   pruneInstance,
@@ -2983,6 +4183,8 @@ export {
   taskProgress,
   toNodeInfo,
   toTaskPublic,
+  tokenTypeFromValue,
   trackMatchSet,
+  verifyPassword,
   withTransaction
 };