@siming-org/core 0.8.7 → 0.8.8

package/dist/index.js

@@ -141,10 +141,16 @@ var BIZ_CODE_MESSAGES = {
   TEMPLATE_DISABLED: "\u6A21\u677F\u5DF2\u505C\u7528\uFF0C\u7981\u6B62\u7528\u4E8E\u521B\u5EFA\u4EFB\u52A1\uFF08Web \u7BA1\u7406\u53F0\u53EF\u91CD\u65B0\u542F\u7528\uFF09",
   // T202608310001：鉴权域（错误响应以 error: bizCode 为机器可判键）
   AUTH_REQUIRED: "\u9700\u8981\u767B\u5F55\u6216\u914D\u7F6E Token\uFF08Web \u767B\u5F55\uFF1BCLI \u8FD0\u884C siming auth token set \u914D\u7F6E\uFF09",
-  AUTH_TOKEN_INVALID: "Token \u65E0\u6548\u6216\u5DF2\u88AB\u91CD\u7F6E\uFF08Web \u7BA1\u7406\u53F0\u91CD\u65B0\u751F\u6210\u540E\u8FD0\u884C siming auth token set \u66F4\u65B0\uFF09",
+  // T202610140004：单枚重置模型退役——失效主因变为吊销，文案与治理动作对齐
+  AUTH_TOKEN_INVALID: "Token \u65E0\u6548\u6216\u5DF2\u88AB\u540A\u9500\uFF08Web \u7BA1\u7406\u53F0\u67E5\u770B/\u590D\u5236\u6709\u6548 Token\uFF0C\u6216\u91CD\u65B0\u7B7E\u53D1\u540E\u8FD0\u884C siming auth token set \u66F4\u65B0\uFF09",
   AUTH_INVALID_CREDENTIALS: "\u8D26\u53F7\u6216\u5BC6\u7801\u9519\u8BEF",
   AUTH_FORBIDDEN: "\u5F53\u524D\u51ED\u8BC1\u65E0\u6743\u6267\u884C\u6B64\u64CD\u4F5C\uFF08\u9879\u76EE Token \u4EC5\u9650\u672C\u9879\u76EE\u8BFB\u5199\u4E0E\u5168\u5C40\u8D44\u4EA7\u53EA\u8BFB\uFF09",
   AUTH_ACCOUNT_EXISTS: "\u7BA1\u7406\u5458\u8D26\u53F7\u5DF2\u521D\u59CB\u5316\uFF08\u65E0\u9700\u91CD\u590D\u521B\u5EFA\uFF09",
+  // T202610140004：Token 多枚治理域。LIMIT 文案不含 scope 词（BIZ_CODE_MESSAGES 静态单源，
+  // 管理员/项目语境由端点与页面上下文给出）；数值 10 = core AUTH_TOKEN_LIMIT 常量
+  AUTH_TOKEN_LIMIT: "Token \u6570\u91CF\u5DF2\u8FBE\u4E0A\u9650\uFF0810 \u679A\uFF09\uFF0C\u8BF7\u5148\u540A\u9500\u4E0D\u518D\u4F7F\u7528\u7684 Token",
+  AUTH_TOKEN_NOT_FOUND: "Token \u4E0D\u5B58\u5728\uFF08\u53EF\u80FD\u5DF2\u88AB\u540A\u9500\uFF09",
+  AUTH_TOKEN_MISSING_PROJECT_ID: "\u9879\u76EE Token \u7B7E\u53D1\u7F3A\u5C11 projectId\uFF08\u5185\u90E8\u8C03\u7528\u9519\u8BEF\uFF09",
   // T202609010002：批量写入域（信封级——空批/超限整批拒绝并提示拆分）
   BATCH_EMPTY: "\u6279\u91CF\u6761\u76EE\u4E3A\u7A7A\uFF08items \u81F3\u5C11 1 \u6761\uFF09",
   BATCH_LIMIT_EXCEEDED: "\u5355\u6B21\u6279\u91CF\u4E0A\u9650 50 \u6761\uFF0C\u8BF7\u62C6\u5206\u4E3A\u591A\u6B21\u8C03\u7528",
@@ -2976,7 +2982,133 @@ function createNodeLibraryRepo(db) {
 
 // src/store/repos/auth.repo.ts
 import { ObjectId as ObjectId3 } from "mongodb";
+import { z as z7 } from "zod";
+
+// src/schemas/auth.ts
 import { z as z6 } from "zod";
+var AuthTokenNameSchema = z6.string().trim().min(1, "\u540D\u79F0\u4E0D\u80FD\u4E3A\u7A7A").max(64, "\u540D\u79F0\u6700\u591A 64 \u4E2A\u5B57\u7B26");
+var AUTH_TOKEN_LIMIT = 10;
+var AuthTokenTypeSchema = z6.enum(["admin", "project"]);
+var AuthAccountSchema = z6.object({
+  id: z6.string().optional(),
+  username: z6.string().min(3, "\u8D26\u53F7\u81F3\u5C11 3 \u4E2A\u5B57\u7B26").max(50).regex(/^[a-zA-Z0-9_-]+$/, "\u8D26\u53F7\u4EC5\u5141\u8BB8\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u4E0E\u8FDE\u5B57\u7B26"),
+  /** 存储形态：scrypt$N$r$p$salt$hash（base64 段），明文仅存在于请求体 */
+  passwordHash: z6.string().min(1),
+  createdAt: z6.date().optional(),
+  updatedAt: z6.date().optional()
+});
+var AuthAccountCreateSchema = z6.object({
+  username: AuthAccountSchema.shape.username,
+  password: z6.string().min(8, "\u5BC6\u7801\u81F3\u5C11 8 \u4E2A\u5B57\u7B26").max(128)
+});
+var PasswordChangeSchema = z6.object({
+  currentPassword: z6.string().min(1),
+  newPassword: z6.string().min(8, "\u5BC6\u7801\u81F3\u5C11 8 \u4E2A\u5B57\u7B26").max(128)
+});
+var LoginSchema = z6.object({
+  username: z6.string().min(1),
+  password: z6.string().min(1)
+});
+var AuthTokenSchema = z6.object({
+  id: z6.string().optional(),
+  name: AuthTokenNameSchema,
+  /** 明文全串含前缀（admin- / project-）；唯一性由 token_1 unique 索引兜底 */
+  token: z6.string().min(1),
+  type: AuthTokenTypeSchema,
+  /** type=project 时必填且不可缺失（superRefine 保证）；type=admin 时禁止携带。
+   *  指向 projects.id（24-hex） */
+  projectId: z6.string().regex(/^[a-f0-9]{24}$/, "projectId \u5FC5\u987B\u4E3A 24-hex ObjectId").optional(),
+  createdAt: z6.date().optional(),
+  updatedAt: z6.date().optional()
+}).superRefine((data, ctx) => {
+  if (data.type === "project" && data.projectId === void 0) {
+    ctx.addIssue({ code: "custom", path: ["projectId"], message: "\u9879\u76EE Token \u5FC5\u987B\u7ED1\u5B9A projectId" });
+  }
+  if (data.type === "admin" && data.projectId !== void 0) {
+    ctx.addIssue({ code: "custom", path: ["projectId"], message: "\u7BA1\u7406\u5458 Token \u4E0D\u7ED1\u5B9A\u9879\u76EE" });
+  }
+});
+var AuthTokenIssueInputSchema = z6.object({
+  name: AuthTokenNameSchema
+});
+var AuthTokenGenResponseSchema = z6.object({
+  id: z6.string(),
+  name: z6.string(),
+  token: z6.string().min(1),
+  type: AuthTokenTypeSchema,
+  projectId: z6.string().optional()
+});
+var AuthTokenViewSchema = z6.object({
+  id: z6.string(),
+  name: z6.string(),
+  type: AuthTokenTypeSchema,
+  projectId: z6.string().optional(),
+  token: z6.string().min(1),
+  createdAt: z6.date().nullable().optional()
+});
+var AuthWhoamiSchema = z6.object({
+  identity: z6.enum(["admin", "project", "none"]),
+  project: z6.object({
+    id: z6.string(),
+    key: z6.string(),
+    name: z6.string()
+  }).nullable().optional(),
+  authEnabled: z6.boolean(),
+  server: z6.object({
+    url: z6.string()
+  })
+});
+var AuthStatusSchema = z6.object({
+  authEnabled: z6.boolean(),
+  /** 鉴权开启且无管理员账号 = 初始化引导窗口（PRD §3.2） */
+  needsSetup: z6.boolean()
+});
+
+// src/store/auth-crypto.ts
+import { randomBytes, scrypt as scryptCb, timingSafeEqual } from "crypto";
+import { promisify } from "util";
+var scrypt = promisify(scryptCb);
+var SCRYPT_N = 16384;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var SCRYPT_KEYLEN = 64;
+var SALT_LEN = 16;
+async function hashPassword(password) {
+  const salt = randomBytes(SALT_LEN);
+  const derived = await scrypt(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P });
+  return `scrypt$${SCRYPT_N}$${SCRYPT_R}$${SCRYPT_P}$${salt.toString("base64")}$${derived.toString("base64")}`;
+}
+async function verifyPassword(password, stored) {
+  const parts = stored.split("$");
+  if (parts.length !== 6 || parts[0] !== "scrypt") return false;
+  const [, nStr, rStr, pStr, saltB64, hashB64] = parts;
+  const N = Number(nStr);
+  const r = Number(rStr);
+  const p = Number(pStr);
+  if (!Number.isInteger(N) || !Number.isInteger(r) || !Number.isInteger(p)) return false;
+  try {
+    const salt = Buffer.from(saltB64, "base64");
+    const expected = Buffer.from(hashB64, "base64");
+    const derived = await scrypt(password, salt, expected.length, { N, r, p });
+    return derived.length === expected.length && timingSafeEqual(derived, expected);
+  } catch {
+    return false;
+  }
+}
+function generateToken(type) {
+  const prefix = type === "admin" ? "admin-" : "project-";
+  return `${prefix}${randomBytes(32).toString("base64url")}`;
+}
+function tokenTypeFromValue(token) {
+  if (token.startsWith("admin-")) return "admin";
+  if (token.startsWith("project-")) return "project";
+  return null;
+}
+function generateSessionId() {
+  return randomBytes(32).toString("hex");
+}
+
+// src/store/repos/auth.repo.ts
 var AUTH_COLLECTIONS = {
   accounts: "auth_accounts",
   tokens: "auth_tokens",
@@ -3017,67 +3149,84 @@ function createAuthTokenRepo(db) {
   const base = createRepo(db.collection(AUTH_COLLECTIONS.tokens));
   return {
     ...base,
-    /** sha256(token 全串含前缀) 等值查询（唯一索引命中） */
-    async findByHash(tokenHash) {
-      const doc = await base._collection.findOne({ tokenHash });
-      return doc ? toEntity(doc) : null;
-    },
-    async getTokenStatus(type, projectId) {
-      const query = { type };
-      if (type === "project") query.projectId = projectId;
-      const doc = await base._collection.findOne(query, { projection: { createdAt: 1 } });
-      return doc ? { hasToken: true, createdAt: doc.createdAt ?? null } : { hasToken: false, createdAt: null };
-    },
-    /** 重置语义：旧 Token 删除 + 新 Token 落库（重置后旧值立即失效，PRD §3.4）。
-     *  事务包删+插（rs0 支持——失败窗口不留零 Token 状态，失败不变性）；admin 单例 /
-     *  project 每项目一枚由 partial unique 索引兜底并发交错 */
-    async upsertToken(type, tokenHash, projectId) {
-      const query = { type };
-      if (type === "project") {
-        if (!projectId) throw new ConflictError("auth-token", "missing-projectId", { message: "project token requires projectId" });
-        query.projectId = projectId;
+    /**
+     * 签发（追加语义，不重置他枚）：事务内 ①同类计数（admin=全 type；project=type+projectId）
+     * ②生成明文 ③insert。计数 ≥ AUTH_TOKEN_LIMIT → 409（D2：事务快照隔离防不了幻读，
+     * 单管理员下并发签发概率≈0，理论竞态越界可吊销自愈，计数器文档复杂度不值）。
+     */
+    async issueToken(input) {
+      const { type, projectId, name } = input;
+      if (type === "project" && projectId === void 0) {
+        throw new ConflictError("auth-token", "missing-project-id", {
+          bizCode: "AUTH_TOKEN_MISSING_PROJECT_ID",
+          message: BIZ_CODE_MESSAGES.AUTH_TOKEN_MISSING_PROJECT_ID
+        });
       }
-      const db2 = base._collection.db;
-      const session = db2.client.startSession();
+      const countQuery = { type };
+      if (type === "project") countQuery.projectId = projectId;
+      const now = /* @__PURE__ */ new Date();
+      const holder = { token: null };
+      const session = db.client.startSession();
       try {
-        const holder = { token: null };
         await session.withTransaction(async () => {
-          await base._collection.deleteMany(query, { session });
-          const now = /* @__PURE__ */ new Date();
-          const doc = { tokenHash, type, createdAt: now, updatedAt: now };
+          const count = await base._collection.countDocuments(countQuery, { session });
+          if (count >= AUTH_TOKEN_LIMIT) {
+            throw new ConflictError("auth-token", "limit-reached", {
+              bizCode: "AUTH_TOKEN_LIMIT",
+              message: BIZ_CODE_MESSAGES.AUTH_TOKEN_LIMIT
+            });
+          }
+          const token = generateToken(type);
+          const doc = { name, token, type, createdAt: now, updatedAt: now };
           if (type === "project" && projectId !== void 0) doc.projectId = projectId;
           const result = await base._collection.insertOne(doc, { session });
           holder.token = { ...doc, id: result.insertedId.toString() };
         });
-        if (holder.token === null) {
-          throw new ConflictError("auth-token", "transaction-empty", { message: "Token upsert \u672A\u4EA7\u751F\u7ED3\u679C" });
-        }
-        return holder.token;
       } finally {
         await session.endSession();
       }
+      if (holder.token === null) {
+        throw new ConflictError("auth-token", "transaction-empty", { message: "Token issue \u672A\u4EA7\u751F\u7ED3\u679C" });
+      }
+      return holder.token;
     },
-    async listProjectTokenStatuses(projectIds) {
-      const docs = await base._collection.find({ type: "project", projectId: { $in: projectIds } }, { projection: { projectId: 1, createdAt: 1 } }).toArray();
-      const map = /* @__PURE__ */ new Map();
-      for (const id of projectIds) map.set(id, { hasToken: false, createdAt: null });
-      for (const doc of docs) {
-        if (typeof doc.projectId === "string") {
-          map.set(doc.projectId, { hasToken: true, createdAt: doc.createdAt ?? null });
-        }
+    /** 全量清单（project 型跨全项目，行含 projectId）；按签发时间升序（追加语义稳定展示） */
+    async listTokens(type) {
+      const docs = await base._collection.find({ type }).sort({ createdAt: 1, _id: 1 }).toArray();
+      return docs.map((doc) => toEntity(doc));
+    },
+    /** 吊销单枚（即时失效，他枚不受影响）；非法 hex id 不抛 BSONError，与不存在同归 404（架构评审 F3） */
+    async revokeToken(id) {
+      if (!isValidObjectId(id)) {
+        throw new NotFoundError("auth-token", id, {
+          bizCode: "AUTH_TOKEN_NOT_FOUND",
+          message: BIZ_CODE_MESSAGES.AUTH_TOKEN_NOT_FOUND
+        });
       }
-      return map;
+      const existing = await base._collection.findOne({ _id: new ObjectId3(id) }, { projection: { _id: 1 } });
+      if (!existing) {
+        throw new NotFoundError("auth-token", id, {
+          bizCode: "AUTH_TOKEN_NOT_FOUND",
+          message: BIZ_CODE_MESSAGES.AUTH_TOKEN_NOT_FOUND
+        });
+      }
+      await base._collection.deleteOne({ _id: existing._id });
+    },
+    /** 明文等值查（token_1 唯一索引命中）——鉴权中间件每请求主通道 */
+    async findValidToken(tokenValue) {
+      const doc = await base._collection.findOne({ token: tokenValue });
+      return doc ? toEntity(doc) : null;
     }
   };
 }
-var AuthSessionSchema = z6.object({
-  id: z6.string().optional(),
-  sessionId: z6.string().min(1),
+var AuthSessionSchema = z7.object({
+  id: z7.string().optional(),
+  sessionId: z7.string().min(1),
   /** 管理员账号 id（会话 = 管理员身份） */
-  accountId: z6.string().min(1),
-  expiresAt: z6.date(),
-  createdAt: z6.date().optional(),
-  updatedAt: z6.date().optional()
+  accountId: z7.string().min(1),
+  expiresAt: z7.date(),
+  createdAt: z7.date().optional(),
+  updatedAt: z7.date().optional()
 });
 function createAuthSessionRepo(db) {
   const base = createRepo(db.collection(AUTH_COLLECTIONS.sessions));
@@ -3107,70 +3256,26 @@ function createAuthSessionRepo(db) {
     }
   };
 }
-
-// src/store/auth-crypto.ts
-import { createHash, randomBytes, scrypt as scryptCb, timingSafeEqual } from "crypto";
-import { promisify } from "util";
-var scrypt = promisify(scryptCb);
-var SCRYPT_N = 16384;
-var SCRYPT_R = 8;
-var SCRYPT_P = 1;
-var SCRYPT_KEYLEN = 64;
-var SALT_LEN = 16;
-async function hashPassword(password) {
-  const salt = randomBytes(SALT_LEN);
-  const derived = await scrypt(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P });
-  return `scrypt$${SCRYPT_N}$${SCRYPT_R}$${SCRYPT_P}$${salt.toString("base64")}$${derived.toString("base64")}`;
-}
-async function verifyPassword(password, stored) {
-  const parts = stored.split("$");
-  if (parts.length !== 6 || parts[0] !== "scrypt") return false;
-  const [, nStr, rStr, pStr, saltB64, hashB64] = parts;
-  const N = Number(nStr);
-  const r = Number(rStr);
-  const p = Number(pStr);
-  if (!Number.isInteger(N) || !Number.isInteger(r) || !Number.isInteger(p)) return false;
-  try {
-    const salt = Buffer.from(saltB64, "base64");
-    const expected = Buffer.from(hashB64, "base64");
-    const derived = await scrypt(password, salt, expected.length, { N, r, p });
-    return derived.length === expected.length && timingSafeEqual(derived, expected);
-  } catch {
-    return false;
-  }
-}
-function generateToken(type) {
-  const prefix = type === "admin" ? "admin-" : "project-";
-  return `${prefix}${randomBytes(32).toString("base64url")}`;
-}
-function tokenTypeFromValue(token) {
-  if (token.startsWith("admin-")) return "admin";
-  if (token.startsWith("project-")) return "project";
-  return null;
-}
-function hashToken(token) {
-  return createHash("sha256").update(token).digest("hex");
-}
-function generateSessionId() {
-  return randomBytes(32).toString("hex");
+function isValidObjectId(id) {
+  return ObjectId3.isValid(id);
 }
 
 // src/schemas/agent.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 
 // src/schemas/model-alias.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var SIMING_CODE_REGEX = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-var ModelAliasShapeSchema = z7.object({
-  id: z7.string().optional(),
+var ModelAliasShapeSchema = z8.object({
+  id: z8.string().optional(),
   /** siming code：创建后不可变（PUT 显式拒绝 MODEL_CODE_IMMUTABLE，非静默剥离） */
-  code: z7.string().regex(SIMING_CODE_REGEX, "code \u5FC5\u987B\u4E3A kebab-case\uFF08\u5982 primary\u3001fast-model\uFF09"),
+  code: z8.string().regex(SIMING_CODE_REGEX, "code \u5FC5\u987B\u4E3A kebab-case\uFF08\u5982 primary\u3001fast-model\uFF09"),
   /** 展示名（如「主力模型」） */
-  name: z7.string().min(1, "\u5C55\u793A\u540D\u4E0D\u80FD\u4E3A\u7A7A"),
+  name: z8.string().min(1, "\u5C55\u793A\u540D\u4E0D\u80FD\u4E3A\u7A7A"),
   /** 真实模型标识（如 zhipuai/glm-5.3；改此处 = 引用方全局替换生效） */
-  realModel: z7.string().min(1, "\u771F\u5B9E\u6A21\u578B\u6807\u8BC6\u4E0D\u80FD\u4E3A\u7A7A"),
-  createdAt: z7.date().optional(),
-  updatedAt: z7.date().optional()
+  realModel: z8.string().min(1, "\u771F\u5B9E\u6A21\u578B\u6807\u8BC6\u4E0D\u80FD\u4E3A\u7A7A"),
+  createdAt: z8.date().optional(),
+  updatedAt: z8.date().optional()
 });
 var ModelAliasSchema = ModelAliasShapeSchema;
 var ModelAliasCreateSchema = ModelAliasShapeSchema.omit({
@@ -3178,18 +3283,18 @@ var ModelAliasCreateSchema = ModelAliasShapeSchema.omit({
   createdAt: true,
   updatedAt: true
 });
-var ModelAliasUpdateSchema = z7.object({
-  code: z7.string().regex(SIMING_CODE_REGEX).optional(),
-  name: z7.string().min(1).optional(),
-  realModel: z7.string().min(1).optional()
+var ModelAliasUpdateSchema = z8.object({
+  code: z8.string().regex(SIMING_CODE_REGEX).optional(),
+  name: z8.string().min(1).optional(),
+  realModel: z8.string().min(1).optional()
 });
 var ModelAliasWithRefCountSchema = ModelAliasShapeSchema.extend({
-  refCount: z7.number().int().min(0)
+  refCount: z8.number().int().min(0)
 });
 
 // src/schemas/agent.ts
-var AgentScopeSchema = z8.enum(["global", "project"]);
-var AgentFunctionSchema = z8.enum(["reviewer", "executor"]);
+var AgentScopeSchema = z9.enum(["global", "project"]);
+var AgentFunctionSchema = z9.enum(["reviewer", "executor"]);
 var AgentScopeRefine = (val, ctx) => {
   if (val.scope === "project" && !val.projectId) {
     ctx.addIssue({
@@ -3199,17 +3304,17 @@ var AgentScopeRefine = (val, ctx) => {
     });
   }
 };
-var AgentShapeSchema = z8.object({
-  id: z8.string().optional(),
-  name: z8.string(),
-  description: z8.string(),
-  systemPrompt: z8.string(),
-  boundSkills: z8.array(z8.string()).default([]),
-  model: z8.string(),
+var AgentShapeSchema = z9.object({
+  id: z9.string().optional(),
+  name: z9.string(),
+  description: z9.string(),
+  systemPrompt: z9.string(),
+  boundSkills: z9.array(z9.string()).default([]),
+  model: z9.string(),
   /** 资产版本（N015 F13）：install/export 版本对比依据；default 仅读侧兜底（createRepo 不做读侧解析，存量回填走 M6 迁移） */
-  version: z8.string().default("1.0.0"),
-  tools: z8.array(z8.string()).default([]),
-  permissions: z8.array(z8.string()).default([]),
+  version: z9.string().default("1.0.0"),
+  tools: z9.array(z9.string()).default([]),
+  permissions: z9.array(z9.string()).default([]),
   /** 引用文档集合（可选——存量单文件资产无此字段，行为与升级前一致） */
   references: createReferencesSchema(AGENT_MAIN_DOC).optional(),
   /** 作用域：global=跨项目复用（默认，仅作存量迁移读侧兜底）/ project=项目专用（N012 D3） */
@@ -3217,15 +3322,15 @@ var AgentShapeSchema = z8.object({
   /** 功能类型（T202608260002）：default 仅创建侧归一——toEntity 直转不经 Zod parse，读侧归一在 repo 层 + 回填走 M12 */
   "function": AgentFunctionSchema.default("executor"),
   /** 仅 scope=project 时必填且为合法 ObjectId hex（superRefine 保证） */
-  projectId: z8.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional(),
+  projectId: z9.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional(),
   /**
    * T202608290001 资产启停（可选——存量无此字段 = 启用，零迁移）。
    * 全局判断规则：enabled === false 即停用，true/缺失均启用。
    * 唯一写入口是专用启停端点（POST /:name/enabled）——Create/Update/Copy 均不含此字段。
    */
-  enabled: z8.boolean().optional(),
-  createdAt: z8.date().optional(),
-  updatedAt: z8.date().optional()
+  enabled: z9.boolean().optional(),
+  createdAt: z9.date().optional(),
+  updatedAt: z9.date().optional()
 });
 var agentAggregateLimitRefine = (val, ctx) => {
   const totalChars = (val.systemPrompt?.length ?? 0) + sumReferenceContentChars(val.references);
@@ -3243,28 +3348,28 @@ var AgentCreateSchema = AgentShapeSchema.omit({
   createdAt: true,
   updatedAt: true,
   enabled: true
-}).extend({ scope: AgentScopeSchema }).extend({ model: z8.string().regex(SIMING_CODE_REGEX, "model \u5FC5\u987B\u662F siming code\uFF08kebab-case\uFF09") }).extend({ "function": AgentFunctionSchema.default("executor") }).superRefine(AgentScopeRefine).superRefine(agentAggregateLimitRefine);
+}).extend({ scope: AgentScopeSchema }).extend({ model: z9.string().regex(SIMING_CODE_REGEX, "model \u5FC5\u987B\u662F siming code\uFF08kebab-case\uFF09") }).extend({ "function": AgentFunctionSchema.default("executor") }).superRefine(AgentScopeRefine).superRefine(agentAggregateLimitRefine);
 var AgentUpdateSchema = AgentShapeSchema.omit({
   id: true,
   createdAt: true,
   updatedAt: true,
   enabled: true
 }).extend({
-  boundSkills: z8.array(z8.string()).optional(),
+  boundSkills: z9.array(z9.string()).optional(),
   // N015：version 放行（export apply 版本递增随 PUT 携带）；optional 剥离实体层 default 避免 partial 空 body 注入
-  version: z8.string().optional(),
-  tools: z8.array(z8.string()).optional(),
-  permissions: z8.array(z8.string()).optional(),
+  version: z9.string().optional(),
+  tools: z9.array(z9.string()).optional(),
+  permissions: z9.array(z9.string()).optional(),
   scope: AgentScopeSchema.optional(),
   // N013：model 收紧为 siming code 格式（存在性校验在 handler 层；undefined = 不更新该字段）
-  model: z8.string().regex(SIMING_CODE_REGEX, "model \u5FC5\u987B\u662F siming code\uFF08kebab-case\uFF09").optional(),
+  model: z9.string().regex(SIMING_CODE_REGEX, "model \u5FC5\u987B\u662F siming code\uFF08kebab-case\uFF09").optional(),
   // T202608260002：optional 剥离实体层 default——否则 PUT 空 body 会注入 executor 覆盖 reviewer
   "function": AgentFunctionSchema.optional()
 }).partial().superRefine(AgentScopeRefine).superRefine(agentAggregateLimitRefine);
-var AgentCopySchema = z8.object({
-  newName: z8.string(),
+var AgentCopySchema = z9.object({
+  newName: z9.string(),
   newScope: AgentScopeSchema,
-  targetProjectId: z8.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional()
+  targetProjectId: z9.string().regex(OBJECT_ID_HEX, "projectId must be a valid ObjectId hex").optional()
 }).superRefine((val, ctx) => {
   if (val.newScope === "project" && !val.targetProjectId) {
     ctx.addIssue({
@@ -3276,7 +3381,7 @@ var AgentCopySchema = z8.object({
 });
 
 // src/schemas/export-bundle.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var EXPORT_FORMAT_VERSION = "1.0";
 var TemplatePayloadSchema = DagTemplateSchema.omit({
   id: true,
@@ -3286,8 +3391,8 @@ var TemplatePayloadSchema = DagTemplateSchema.omit({
   updatedAt: true,
   code: true
 }).extend({
-  version: z9.string(),
-  isDefault: z9.boolean()
+  version: z10.string(),
+  isDefault: z10.boolean()
 });
 var SkillPayloadSchema = SkillShapeSchema.omit({
   id: true,
@@ -3296,7 +3401,7 @@ var SkillPayloadSchema = SkillShapeSchema.omit({
   createdAt: true,
   updatedAt: true
 }).extend({
-  version: z9.string(),
+  version: z10.string(),
   scope: SkillScopeSchema,
   references: createReferencesSchema(SKILL_MAIN_DOC)
 });
@@ -3307,12 +3412,12 @@ var AgentPayloadSchema = AgentShapeSchema.omit({
   createdAt: true,
   updatedAt: true
 }).extend({
-  version: z9.string(),
+  version: z10.string(),
   scope: AgentScopeSchema,
   references: createReferencesSchema(AGENT_MAIN_DOC),
-  boundSkills: z9.array(z9.string()),
-  tools: z9.array(z9.string()),
-  permissions: z9.array(z9.string()),
+  boundSkills: z10.array(z10.string()),
+  tools: z10.array(z10.string()),
+  permissions: z10.array(z10.string()),
   "function": AgentFunctionSchema
 });
 var ModelAliasPayloadSchema = ModelAliasSchema.omit({
@@ -3320,357 +3425,357 @@ var ModelAliasPayloadSchema = ModelAliasSchema.omit({
   createdAt: true,
   updatedAt: true
 });
-var ExportBundleSchema = z9.object({
-  exportFormatVersion: z9.literal(EXPORT_FORMAT_VERSION, {
+var ExportBundleSchema = z10.object({
+  exportFormatVersion: z10.literal(EXPORT_FORMAT_VERSION, {
     error: `\u5BFC\u51FA\u683C\u5F0F\u7248\u672C\u4E0D\u652F\u6301\uFF0C\u5F53\u524D\u652F\u6301 ${EXPORT_FORMAT_VERSION}`
   }),
-  exportedAt: z9.string(),
+  exportedAt: z10.string(),
   /** 源环境悬空提示（§2.2：悬空 skill/agent.model 不阻断导出）。导出响应恒携带；导入入参可缺省——导入侧提示由 plan 生成，不消费本字段 */
-  warnings: z9.array(z9.string()).optional(),
+  warnings: z10.array(z10.string()).optional(),
   template: TemplatePayloadSchema,
-  dependencies: z9.object({
-    skills: z9.array(SkillPayloadSchema),
-    agents: z9.array(AgentPayloadSchema),
-    modelAliases: z9.array(ModelAliasPayloadSchema)
+  dependencies: z10.object({
+    skills: z10.array(SkillPayloadSchema),
+    agents: z10.array(AgentPayloadSchema),
+    modelAliases: z10.array(ModelAliasPayloadSchema)
   })
 });
-var ImportPlanRequestSchema = z9.object({
-  targetProjectId: z9.string().regex(OBJECT_ID_HEX, "targetProjectId must be a valid ObjectId hex"),
+var ImportPlanRequestSchema = z10.object({
+  targetProjectId: z10.string().regex(OBJECT_ID_HEX, "targetProjectId must be a valid ObjectId hex"),
   bundle: ExportBundleSchema
 });
-var ImportDecisionSchema = z9.discriminatedUnion("kind", [
-  z9.object({
-    kind: z9.literal("skill"),
-    name: z9.string(),
+var ImportDecisionSchema = z10.discriminatedUnion("kind", [
+  z10.object({
+    kind: z10.literal("skill"),
+    name: z10.string(),
     scope: SkillScopeSchema,
-    action: z9.enum(["overwrite", "skip"])
+    action: z10.enum(["overwrite", "skip"])
   }),
-  z9.object({
-    kind: z9.literal("agent"),
-    name: z9.string(),
+  z10.object({
+    kind: z10.literal("agent"),
+    name: z10.string(),
     scope: AgentScopeSchema,
-    action: z9.enum(["overwrite", "skip"])
+    action: z10.enum(["overwrite", "skip"])
   }),
-  z9.object({
-    kind: z9.literal("modelAlias"),
-    name: z9.string(),
-    action: z9.enum(["overwrite", "skip"])
+  z10.object({
+    kind: z10.literal("modelAlias"),
+    name: z10.string(),
+    action: z10.enum(["overwrite", "skip"])
   })
 ]);
 var ImportApplyRequestSchema = ImportPlanRequestSchema.extend({
   /** 未列出的冲突项缺省 skip（保守默认：未决策不覆盖） */
-  decisions: z9.array(ImportDecisionSchema).default([])
+  decisions: z10.array(ImportDecisionSchema).default([])
 });
-var DependencyStatusSchema = z9.enum(["create", "identical", "conflict"]);
-var DependencyCheckSchema = z9.object({
-  kind: z9.enum(["skill", "agent", "modelAlias"]),
-  name: z9.string(),
+var DependencyStatusSchema = z10.enum(["create", "identical", "conflict"]);
+var DependencyCheckSchema = z10.object({
+  kind: z10.enum(["skill", "agent", "modelAlias"]),
+  name: z10.string(),
   /** skill/agent 携带；modelAlias 无 */
-  scope: z9.enum(["global", "project"]).optional(),
+  scope: z10.enum(["global", "project"]).optional(),
   status: DependencyStatusSchema,
   /** status ≠ create 时目标环境现值版本（modelAlias 无 version 概念不填） */
-  currentVersion: z9.string().optional(),
-  importVersion: z9.string().optional(),
+  currentVersion: z10.string().optional(),
+  importVersion: z10.string().optional(),
   /** status = conflict 时差异字段名清单（如 "content, references"） */
-  changeSummary: z9.string().optional(),
+  changeSummary: z10.string().optional(),
   /** 影响范围（PRD F13）：global 资产影响所有项目 / project 资产仅影响所属项目 */
-  impact: z9.enum(["global", "project"])
+  impact: z10.enum(["global", "project"])
 });
-var ImportPlanResponseSchema = z9.object({
-  template: z9.object({
-    name: z9.string(),
-    willOverwrite: z9.boolean(),
-    currentVersion: z9.string().optional(),
-    importVersion: z9.string(),
-    isDefaultRequested: z9.boolean(),
+var ImportPlanResponseSchema = z10.object({
+  template: z10.object({
+    name: z10.string(),
+    willOverwrite: z10.boolean(),
+    currentVersion: z10.string().optional(),
+    importVersion: z10.string(),
+    isDefaultRequested: z10.boolean(),
     /** isDefault 降级后的最终生效值（F17：项目已有默认 → false） */
-    isDefaultEffect: z9.boolean(),
-    downgradeReason: z9.string().optional()
+    isDefaultEffect: z10.boolean(),
+    downgradeReason: z10.string().optional()
   }),
-  dependencies: z9.array(DependencyCheckSchema),
+  dependencies: z10.array(DependencyCheckSchema),
   /**
    * K10①：模板节点直接技能引用完整性逐项核对（node × skill 粒度）——
    * ok = 在 bundle 依赖 ∪ 目标环境可见集；missing = 双侧皆无（绑定悬空，non-blocking warning）
    */
-  directSkillChecks: z9.array(
-    z9.object({
-      node: z9.string(),
-      skill: z9.string(),
-      status: z9.enum(["ok", "missing"])
+  directSkillChecks: z10.array(
+    z10.object({
+      node: z10.string(),
+      skill: z10.string(),
+      status: z10.enum(["ok", "missing"])
     })
   ),
   /**
    * K10③：模板节点直接 AGENT 引用完整性逐项核对（node × agent 粒度）——
    * 与 directSkillChecks 对称；ok = 在 bundle 依赖 ∪ 目标环境可见集；missing = 双侧皆无（引用悬空，non-blocking warning）
    */
-  directAgentChecks: z9.array(
-    z9.object({
-      node: z9.string(),
-      agent: z9.string(),
-      status: z9.enum(["ok", "missing"])
+  directAgentChecks: z10.array(
+    z10.object({
+      node: z10.string(),
+      agent: z10.string(),
+      status: z10.enum(["ok", "missing"])
     })
   ),
   /** 非阻断提示（源环境悬空绑定、agent.model 引用缺失、sourcePreset 来源缺失等） */
-  warnings: z9.array(z9.string())
+  warnings: z10.array(z10.string())
 });
-var DependencyActionSchema = z9.enum(["created", "updated", "skipped", "identical", "failed"]);
-var ImportApplyResponseSchema = z9.object({
-  template: z9.object({
-    id: z9.string(),
-    name: z9.string(),
-    action: z9.enum(["created", "updated"]),
-    isDefaultEffect: z9.boolean()
+var DependencyActionSchema = z10.enum(["created", "updated", "skipped", "identical", "failed"]);
+var ImportApplyResponseSchema = z10.object({
+  template: z10.object({
+    id: z10.string(),
+    name: z10.string(),
+    action: z10.enum(["created", "updated"]),
+    isDefaultEffect: z10.boolean()
   }),
-  dependencies: z9.array(
-    z9.object({
-      kind: z9.enum(["skill", "agent", "modelAlias"]),
-      name: z9.string(),
-      scope: z9.enum(["global", "project"]).optional(),
+  dependencies: z10.array(
+    z10.object({
+      kind: z10.enum(["skill", "agent", "modelAlias"]),
+      name: z10.string(),
+      scope: z10.enum(["global", "project"]).optional(),
       action: DependencyActionSchema,
       /** action = failed 时的错误说明 */
-      message: z9.string().optional()
+      message: z10.string().optional()
     })
   ),
   /** K10②：apply 时刻目标环境缺失来源而被剥除 sourcePreset 的节点 id 清单（降级自建导入） */
-  sourceStripped: z9.array(z9.string())
+  sourceStripped: z10.array(z10.string())
 });
 function decisionKey(kind, scope, name) {
   return `${kind}:${scope ?? ""}:${name}`;
 }
 
 // src/schemas/advance.ts
-import { z as z10 } from "zod";
-var AdvanceRequestSchema = z10.object({
-  note: z10.string().optional(),
+import { z as z11 } from "zod";
+var AdvanceRequestSchema = z11.object({
+  note: z11.string().optional(),
   /** min(1).max(2000) 与 record summary 端点对齐（同一 $set 目标，两入口校验强度一致） */
-  summary: z10.string().min(1).max(2e3).optional(),
+  summary: z11.string().min(1).max(2e3).optional(),
   /**
    * T202609130009 收尾确认（可选）：终节点推进默认被拒
    * （TASK_FINALIZE_CONFIRMATION_REQUIRED），携带 finalize=true 才完成收尾终态化；
    * 中间节点传递无副作用（守卫不在其路径，宽容语义）。
    */
-  finalize: z10.boolean().optional()
+  finalize: z11.boolean().optional()
 });
-var ApproveRequestSchema = z10.object({
-  decision: z10.enum(["approved", "rejected"]),
-  comment: z10.string().optional()
+var ApproveRequestSchema = z11.object({
+  decision: z11.enum(["approved", "rejected"]),
+  comment: z11.string().optional()
 });
-var TaskPublicSchema = z10.object({
-  taskId: z10.string(),
-  title: z10.string(),
+var TaskPublicSchema = z11.object({
+  taskId: z11.string(),
+  title: z11.string(),
   // T202608240003：任务类型标签（缺省 = 裸任务/旧任务；模板 PRD 调研变体判定消费）
-  type: z10.enum(TASK_TYPES).optional(),
+  type: z11.enum(TASK_TYPES).optional(),
   /** T202609230001：归属项目（CLI advance 门禁经 context 直取 projectId 读项目 vcs 配置，免额外实体查询） */
-  projectId: z10.string(),
-  currentNode: z10.string(),
-  currentPhase: z10.string(),
-  status: z10.string(),
-  pausedAt: z10.string().nullable(),
-  track: z10.string(),
+  projectId: z11.string(),
+  currentNode: z11.string(),
+  currentPhase: z11.string(),
+  status: z11.string(),
+  pausedAt: z11.string().nullable(),
+  track: z11.string(),
   /** T202610120005：组合任务匹配快照（toTaskPublic 投影；迁移前存量缺省） */
-  trackMatch: z10.array(z10.string()).optional()
+  trackMatch: z11.array(z11.string()).optional()
 });
-var NodeInfoSchema = z10.object({
-  nodeId: z10.string(),
-  label: z10.string(),
+var NodeInfoSchema = z11.object({
+  nodeId: z11.string(),
+  label: z11.string(),
   // T202610120005 R7：节点轨道 union（多轨节点——值拷贝冻结原样形态）
-  track: z10.union([z10.string(), z10.array(z10.string())]),
-  prompt: z10.string(),
-  skills: z10.array(z10.string()),
-  agents: z10.array(z10.string()),
-  upcomingPause: z10.string().nullable(),
+  track: z11.union([z11.string(), z11.array(z11.string())]),
+  prompt: z11.string(),
+  skills: z11.array(z11.string()),
+  agents: z11.array(z11.string()),
+  upcomingPause: z11.string().nullable(),
   /**
    * T202609230001：门禁项随资料包注入（四响应单源 toNodeInfo）——响应恒为数组（?? [] 归一），
    * 每节点注入即红线自动重申（对抗长上下文漂移）；AI 据此先自检后推进。
    */
-  toolChecks: z10.array(ToolCheckSchema).default([]),
-  aiChecks: z10.array(AiCheckSchema).default([])
+  toolChecks: z11.array(ToolCheckSchema).default([]),
+  aiChecks: z11.array(AiCheckSchema).default([])
 });
-var AdvanceResponseSchema = z10.discriminatedUnion("status", [
-  z10.object({
-    status: z10.literal("advanced"),
+var AdvanceResponseSchema = z11.discriminatedUnion("status", [
+  z11.object({
+    status: z11.literal("advanced"),
     task: TaskPublicSchema,
     nextNode: NodeInfoSchema
   }),
-  z10.object({
-    status: z10.literal("paused"),
+  z11.object({
+    status: z11.literal("paused"),
     task: TaskPublicSchema,
     pausePoint: EdgePausePointSchema,
-    guidance: z10.string()
+    guidance: z11.string()
   }),
-  z10.object({
-    status: z10.literal("completed"),
+  z11.object({
+    status: z11.literal("completed"),
     task: TaskPublicSchema
   })
 ]);
-var ApproveResponseSchema = z10.discriminatedUnion("status", [
-  z10.object({
-    status: z10.literal("advanced"),
+var ApproveResponseSchema = z11.discriminatedUnion("status", [
+  z11.object({
+    status: z11.literal("advanced"),
     task: TaskPublicSchema,
     nextNode: NodeInfoSchema
   }),
-  z10.object({
-    status: z10.literal("rejected"),
+  z11.object({
+    status: z11.literal("rejected"),
     task: TaskPublicSchema,
-    guidance: z10.string()
+    guidance: z11.string()
   }),
   // 「completed」分支当前引擎不可达（approve 从 paused 流转必有下一节点，技术方案 §2.2
   // 已删 paused→completed 直达路径）——按方案 §2.1 契约保留作前向兼容预留
-  z10.object({
-    status: z10.literal("completed"),
+  z11.object({
+    status: z11.literal("completed"),
     task: TaskPublicSchema
   })
 ]);
-var PauseRequestSchema = z10.object({
-  reason: z10.string().optional()
+var PauseRequestSchema = z11.object({
+  reason: z11.string().optional()
 });
-var ResumeRequestSchema = z10.object({
-  decision: z10.string().optional()
+var ResumeRequestSchema = z11.object({
+  decision: z11.string().optional()
 });
-var CancelRequestSchema = z10.object({
-  reason: z10.string().min(1).max(500).optional()
+var CancelRequestSchema = z11.object({
+  reason: z11.string().min(1).max(500).optional()
 });
-var ReopenRequestSchema = z10.object({
-  reason: z10.string().min(1).max(500)
+var ReopenRequestSchema = z11.object({
+  reason: z11.string().min(1).max(500)
 });
 
 // src/schemas/task-doc.ts
-import { z as z11 } from "zod";
-var TaskContextSchema = z11.object({
-  task: z11.object({
-    taskId: z11.string(),
-    title: z11.string(),
+import { z as z12 } from "zod";
+var TaskContextSchema = z12.object({
+  task: z12.object({
+    taskId: z12.string(),
+    title: z12.string(),
     // T202608240003：与 TaskPublicSchema 同步（toTaskPublic 运行时已产出，schema 声明漂移会导致 typed 消费方 strip 掉 type）
-    type: z11.enum(TASK_TYPES).optional(),
+    type: z12.enum(TASK_TYPES).optional(),
     // T202609230001：与 TaskPublicSchema 同步（advance 门禁读项目 vcs 配置依赖）
-    projectId: z11.string(),
-    currentNode: z11.string(),
-    currentPhase: z11.string(),
-    status: z11.string(),
-    pausedAt: z11.string().nullable(),
-    track: z11.string(),
+    projectId: z12.string(),
+    currentNode: z12.string(),
+    currentPhase: z12.string(),
+    status: z12.string(),
+    pausedAt: z12.string().nullable(),
+    track: z12.string(),
     // T202610120005：组合任务匹配快照（与 TaskPublicSchema 同步——context 读取出口）
-    trackMatch: z11.array(z11.string()).optional()
+    trackMatch: z12.array(z12.string()).optional()
   }),
-  currentNode: z11.object({
-    nodeId: z11.string(),
-    label: z11.string(),
-    phase: z11.string(),
+  currentNode: z12.object({
+    nodeId: z12.string(),
+    label: z12.string(),
+    phase: z12.string(),
     // T202610120005 R7：节点轨道 union（多轨节点）
-    track: z11.union([z11.string(), z11.array(z11.string())]),
+    track: z12.union([z12.string(), z12.array(z12.string())]),
     /** renderPrompt 渲染后（AI 推进任务的直接输入） */
-    prompt: z11.string(),
-    skills: z11.array(z11.string()),
-    agents: z11.array(z11.string()),
+    prompt: z12.string(),
+    skills: z12.array(z12.string()),
+    agents: z12.array(z12.string()),
     /** 完成当前节点后出边上的暂停点描述（经 findNextEdge 按轨选边） */
-    upcomingPause: z11.string().nullable(),
+    upcomingPause: z12.string().nullable(),
     /**
      * T202609230001：门禁项注入（与 NodeInfoSchema 同步的内联镜像——CLI 侧
      * TaskContext['currentNode'] 类型取门禁项供 advance 前置校验消费）。
      */
-    toolChecks: z11.array(ToolCheckSchema).default([]),
-    aiChecks: z11.array(AiCheckSchema).default([])
+    toolChecks: z12.array(ToolCheckSchema).default([]),
+    aiChecks: z12.array(AiCheckSchema).default([])
   }).nullable(),
-  pausedAtEdge: z11.object({
-    from: z11.string(),
-    to: z11.string(),
+  pausedAtEdge: z12.object({
+    from: z12.string(),
+    to: z12.string(),
     pausePoint: EdgePausePointBaseSchema
   }).nullable(),
   /** 全节点实时状态清单 */
-  nodes: z11.array(z11.object({
-    nodeId: z11.string(),
-    label: z11.string(),
-    status: z11.string(),
-    enteredAt: z11.date().nullable(),
-    completedAt: z11.date().nullable()
+  nodes: z12.array(z12.object({
+    nodeId: z12.string(),
+    label: z12.string(),
+    status: z12.string(),
+    enteredAt: z12.date().nullable(),
+    completedAt: z12.date().nullable()
   })),
   /**
    * T202609230001：实例有向边表（B6 前序闭包判定数据源——「前序」按 DAG 拓扑而非列表序，
    * 后继 pending 节点不算前序）。旧 server 不携带 → 客户端 ?? [] 兜底（闭包为空 = 不拦截，
    * 老组合形态本就无门禁，不构成静默放行新增面）。
    */
-  edges: z11.array(z11.object({ from: z11.string(), to: z11.string() })).default([]),
+  edges: z12.array(z12.object({ from: z12.string(), to: z12.string() })).default([]),
   /** N020 D1：任务级结构化文档（未写时 null） */
   taskDoc: TaskDocContentSchema.nullable(),
   /** N020 D1：节点执行记录（仅含已写记录的 nodeId） */
-  nodeRecords: z11.record(z11.string(), NodeRecordSchema),
+  nodeRecords: z12.record(z12.string(), NodeRecordSchema),
   /** N020 D1：跨节点累积素材（架构信息收集条目） */
-  archNotes: z11.array(ArchNoteSchema)
+  archNotes: z12.array(ArchNoteSchema)
 });
-var TaskSummarySchema = z11.object({
-  taskId: z11.string(),
-  title: z11.string(),
+var TaskSummarySchema = z12.object({
+  taskId: z12.string(),
+  title: z12.string(),
   // T202608240003：任务类型标签（缺省 = 裸任务/旧任务）
-  type: z11.enum(TASK_TYPES).optional(),
-  projectId: z11.string(),
-  dagTemplateId: z11.string(),
-  currentNode: z11.string(),
-  currentPhase: z11.string(),
-  status: z11.string(),
-  pausedAt: z11.string().nullable(),
-  track: z11.string(),
+  type: z12.enum(TASK_TYPES).optional(),
+  projectId: z12.string(),
+  dagTemplateId: z12.string(),
+  currentNode: z12.string(),
+  currentPhase: z12.string(),
+  status: z12.string(),
+  pausedAt: z12.string().nullable(),
+  track: z12.string(),
   // T202610120005：组合任务展示数据承载（列表页拼接文案依赖；迁移前存量可能缺省）
-  trackMatch: z11.array(z11.string()).optional(),
-  progress: z11.object({
-    completed: z11.number(),
-    total: z11.number()
+  trackMatch: z12.array(z12.string()).optional(),
+  progress: z12.object({
+    completed: z12.number(),
+    total: z12.number()
   }),
-  createdAt: z11.date().optional(),
-  updatedAt: z11.date().optional()
+  createdAt: z12.date().optional(),
+  updatedAt: z12.date().optional()
 });
 
 // src/schemas/write-ack.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var WRITE_ACK_ENTRY_KINDS = ["check", "artifact", "decision", "confirmation", "archnote"];
-var WriteAckEntryKindSchema = z12.enum(WRITE_ACK_ENTRY_KINDS);
-var EchoItemSchema = z12.object({
-  path: z12.string(),
-  excerpt: z12.string()
+var WriteAckEntryKindSchema = z13.enum(WRITE_ACK_ENTRY_KINDS);
+var EchoItemSchema = z13.object({
+  path: z13.string(),
+  excerpt: z13.string()
 });
-var TaskProgressSchema = z12.object({
-  completed: z12.number().int(),
-  total: z12.number().int()
+var TaskProgressSchema = z13.object({
+  completed: z13.number().int(),
+  total: z13.number().int()
 });
 var TaskProgressPublicSchema = TaskPublicSchema.extend({
-  projectId: z12.string(),
+  projectId: z13.string(),
   progress: TaskProgressSchema
 });
-var WriteAckSchema = z12.object({
-  taskId: z12.string(),
+var WriteAckSchema = z13.object({
+  taskId: z13.string(),
   /** 本次写入触及的字段点路径（如 doc.what / nodeRecords.PRD.checks） */
-  updated: z12.array(z12.string()),
+  updated: z13.array(z13.string()),
   /** 新建条目标识（$push 五类对象条目；无新条目的端点缺省） */
-  entry: z12.object({
-    id: z12.string(),
+  entry: z13.object({
+    id: z13.string(),
     kind: WriteAckEntryKindSchema
   }).optional(),
   /** 写入内容回显（触及字段逐条；无值可回显的端点可缺省） */
-  echo: z12.array(EchoItemSchema).optional(),
-  updatedAt: z12.date(),
+  echo: z13.array(EchoItemSchema).optional(),
+  updatedAt: z13.date(),
   task: TaskProgressPublicSchema
 });
-var TaskBatchEntrySchema = z12.object({
-  index: z12.number().int().min(0),
-  id: z12.string().optional(),
+var TaskBatchEntrySchema = z13.object({
+  index: z13.number().int().min(0),
+  id: z13.string().optional(),
   kind: WriteAckEntryKindSchema.optional()
 });
-var TaskBatchFailureSchema = z12.object({
-  index: z12.number().int().min(0),
-  message: z12.string(),
-  hint: z12.string().optional()
+var TaskBatchFailureSchema = z13.object({
+  index: z13.number().int().min(0),
+  message: z13.string(),
+  hint: z13.string().optional()
 });
-var TaskBatchAckSchema = z12.object({
-  taskId: z12.string(),
+var TaskBatchAckSchema = z13.object({
+  taskId: z13.string(),
   /** 成功落库条目数（部分失败语义：成功条目保留不回滚） */
-  applied: z12.number().int().min(0),
+  applied: z13.number().int().min(0),
   /** 本次写入触及的字段点路径 */
-  updated: z12.array(z12.string()),
-  entries: z12.array(TaskBatchEntrySchema),
-  failures: z12.array(TaskBatchFailureSchema),
-  updatedAt: z12.date(),
+  updated: z13.array(z13.string()),
+  entries: z13.array(TaskBatchEntrySchema),
+  failures: z13.array(TaskBatchFailureSchema),
+  updatedAt: z13.date(),
   task: TaskProgressPublicSchema
 });
-var CreateTaskResponseSchema = z12.object({
+var CreateTaskResponseSchema = z13.object({
   task: TaskProgressPublicSchema,
   firstNode: NodeInfoSchema
 });
@@ -3686,53 +3791,53 @@ function excerpt(value, max = 120) {
   return `${chars.slice(0, max - 1).join("")}\u2026`;
 }
 var CONTEXT_VIEWS = ["basic", "full"];
-var ContextViewSchema = z12.enum(CONTEXT_VIEWS);
+var ContextViewSchema = z13.enum(CONTEXT_VIEWS);
 
 // src/schemas/project.ts
-import { z as z13 } from "zod";
-var ProjectStatusSchema = z13.enum(["active", "archived"]);
-var VcsConfigSchema = z13.object({
+import { z as z14 } from "zod";
+var ProjectStatusSchema = z14.enum(["active", "archived"]);
+var VcsConfigSchema = z14.object({
   /** false=项目级豁免：全部 git 类检查 N/A（纯文档/无分支模型项目不误拦） */
-  enabled: z13.boolean().optional(),
+  enabled: z14.boolean().optional(),
   /** 基础分支（参数解析链第 2 级；第 1 级=nodeRecords[ALIGN].baseBranch） */
-  baseBranch: z13.string().min(1).max(50).optional(),
+  baseBranch: z14.string().min(1).max(50).optional(),
   /** 仓库绝对路径（MCP 宿主 cwd 未必是任务仓库时由管理台配置；缺省=cwd 探测） */
-  repoPath: z13.string().min(1).optional(),
+  repoPath: z14.string().min(1).optional(),
   /** 任务分支前缀模式（A1 判定用） */
-  branchPattern: z13.string().min(1).max(50).optional(),
+  branchPattern: z14.string().min(1).max(50).optional(),
   /** true=worktree 并行模式（A6 停留子项 N/A——主工作区停留基础分支由主会话承载） */
-  worktreeMode: z13.boolean().optional(),
+  worktreeMode: z14.boolean().optional(),
   /** false=项目声明无分支归档流程（A5 N/A；表达「有分支模型但无归档流程」粒度） */
-  archiveToBase: z13.boolean().optional(),
+  archiveToBase: z14.boolean().optional(),
   /** B7 版本一致判定的豁免路径清单（文档/临时产物） */
-  docPaths: z13.array(z13.string().min(1)).max(50).optional()
+  docPaths: z14.array(z14.string().min(1)).max(50).optional()
 });
 var DEFAULT_VCS_DOC_PATHS = ["ProjectHub/", "docs/", "temp/", "*.md"];
-var ProjectSchema = z13.object({
-  id: z13.string().optional(),
-  key: z13.string().regex(/^[a-z0-9][a-z0-9-]{1,30}$/, "key \u5FC5\u987B\u4E3A kebab-case\uFF082-31 \u5B57\u7B26\uFF09"),
-  name: z13.string().min(1).max(50),
-  description: z13.string().max(500).optional(),
+var ProjectSchema = z14.object({
+  id: z14.string().optional(),
+  key: z14.string().regex(/^[a-z0-9][a-z0-9-]{1,30}$/, "key \u5FC5\u987B\u4E3A kebab-case\uFF082-31 \u5B57\u7B26\uFF09"),
+  name: z14.string().min(1).max(50),
+  description: z14.string().max(500).optional(),
   status: ProjectStatusSchema.default("active"),
   vcs: VcsConfigSchema.optional(),
-  createdAt: z13.date().optional(),
-  updatedAt: z13.date().optional()
+  createdAt: z14.date().optional(),
+  updatedAt: z14.date().optional()
 });
-var ProjectCreateSchema = z13.object({
-  key: z13.string().regex(/^[a-z0-9][a-z0-9-]{1,30}$/, "key \u5FC5\u987B\u4E3A kebab-case\uFF082-31 \u5B57\u7B26\uFF09").optional(),
-  name: z13.string().min(1).max(50),
-  description: z13.string().max(500).optional()
+var ProjectCreateSchema = z14.object({
+  key: z14.string().regex(/^[a-z0-9][a-z0-9-]{1,30}$/, "key \u5FC5\u987B\u4E3A kebab-case\uFF082-31 \u5B57\u7B26\uFF09").optional(),
+  name: z14.string().min(1).max(50),
+  description: z14.string().max(500).optional()
 });
-var ProjectUpdateSchema = z13.object({
-  name: z13.string().min(1).max(50).optional(),
-  description: z13.string().max(500).optional(),
+var ProjectUpdateSchema = z14.object({
+  name: z14.string().min(1).max(50).optional(),
+  description: z14.string().max(500).optional(),
   status: ProjectStatusSchema.optional(),
   vcs: VcsConfigSchema.optional()
 });
 
 // src/schemas/enum-registry.ts
-import { z as z14 } from "zod";
-var EnumRegistryCategorySchema = z14.enum([
+import { z as z15 } from "zod";
+var EnumRegistryCategorySchema = z15.enum([
   "dag_phase",
   "dag_track",
   "pause_type",
@@ -3743,100 +3848,34 @@ var EnumRegistryCategorySchema = z14.enum([
   "agent_function",
   "issue_status"
 ]);
-var EnumEntrySchema = z14.object({
+var EnumEntrySchema = z15.object({
   /** 领域层存库的原始枚举值（不可臆造；builtin 值 engine/DB 强依赖；kebab 约束与 skill name 对齐，保证 DELETE /entries/:value 可寻址） */
-  value: z14.string().regex(/^[a-z0-9][a-z0-9_-]*$/, "value \u4EC5\u652F\u6301\u5C0F\u5199\u5B57\u6BCD/\u6570\u5B57/\u4E0B\u5212\u7EBF/\u8FDE\u5B57\u7B26\uFF08kebab-case\uFF09"),
+  value: z15.string().regex(/^[a-z0-9][a-z0-9_-]*$/, "value \u4EC5\u652F\u6301\u5C0F\u5199\u5B57\u6BCD/\u6570\u5B57/\u4E0B\u5212\u7EBF/\u8FDE\u5B57\u7B26\uFF08kebab-case\uFF09"),
   /** 展示文案（消费端下拉直接取用） */
-  label: z14.string().min(1, "label \u4E0D\u80FD\u4E3A\u7A7A"),
+  label: z15.string().min(1, "label \u4E0D\u80FD\u4E3A\u7A7A"),
   /** 可选语义色 token（如 --success / --warning），消费端映射到 UI */
-  color: z14.string().optional(),
+  color: z15.string().optional(),
   /** 下拉排序（升序） */
-  order: z14.number().int().default(0),
+  order: z15.number().int().default(0),
   /** 内置值：禁删 + label/color 可改但 value 不可改（D8）；seed 时标记 */
-  builtin: z14.boolean().default(false),
+  builtin: z15.boolean().default(false),
   /** 启停：false = 下拉禁用展示（历史数据仍可读，新选择不可用） */
-  active: z14.boolean().default(true)
+  active: z15.boolean().default(true)
 });
-var EnumRegistrySchema = z14.object({
-  id: z14.string().optional(),
+var EnumRegistrySchema = z15.object({
+  id: z15.string().optional(),
   category: EnumRegistryCategorySchema,
-  entries: z14.array(EnumEntrySchema).default([]),
-  updatedAt: z14.date().optional()
+  entries: z15.array(EnumEntrySchema).default([]),
+  updatedAt: z15.date().optional()
 });
-var EnumRegistryUpdateSchema = z14.object({
-  entries: z14.array(EnumEntrySchema)
+var EnumRegistryUpdateSchema = z15.object({
+  entries: z15.array(EnumEntrySchema)
 });
 
 // src/schemas/asset-enabled.ts
-import { z as z15 } from "zod";
-var AssetSetEnabledSchema = z15.object({
-  enabled: z15.boolean()
-});
-
-// src/schemas/auth.ts
 import { z as z16 } from "zod";
-var AuthTokenTypeSchema = z16.enum(["admin", "project"]);
-var AuthAccountSchema = z16.object({
-  id: z16.string().optional(),
-  username: z16.string().min(3, "\u8D26\u53F7\u81F3\u5C11 3 \u4E2A\u5B57\u7B26").max(50).regex(/^[a-zA-Z0-9_-]+$/, "\u8D26\u53F7\u4EC5\u5141\u8BB8\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u4E0E\u8FDE\u5B57\u7B26"),
-  /** 存储形态：scrypt$N$r$p$salt$hash（base64 段），明文仅存在于请求体 */
-  passwordHash: z16.string().min(1),
-  createdAt: z16.date().optional(),
-  updatedAt: z16.date().optional()
-});
-var AuthAccountCreateSchema = z16.object({
-  username: AuthAccountSchema.shape.username,
-  password: z16.string().min(8, "\u5BC6\u7801\u81F3\u5C11 8 \u4E2A\u5B57\u7B26").max(128)
-});
-var PasswordChangeSchema = z16.object({
-  currentPassword: z16.string().min(1),
-  newPassword: z16.string().min(8, "\u5BC6\u7801\u81F3\u5C11 8 \u4E2A\u5B57\u7B26").max(128)
-});
-var LoginSchema = z16.object({
-  username: z16.string().min(1),
-  password: z16.string().min(1)
-});
-var AuthTokenSchema = z16.object({
-  id: z16.string().optional(),
-  /** sha256(token 全串含前缀) hex——明文 Token 不入库 */
-  tokenHash: z16.string().regex(/^[a-f0-9]{64}$/),
-  type: AuthTokenTypeSchema,
-  /** type=project 时必填且不可缺失（superRefine 保证）；指向 projects.id（24-hex） */
-  projectId: z16.string().regex(/^[a-f0-9]{24}$/, "projectId \u5FC5\u987B\u4E3A 24-hex ObjectId").optional(),
-  createdAt: z16.date().optional(),
-  updatedAt: z16.date().optional()
-}).superRefine((data, ctx) => {
-  if (data.type === "project" && data.projectId === void 0) {
-    ctx.addIssue({ code: "custom", path: ["projectId"], message: "\u9879\u76EE Token \u5FC5\u987B\u7ED1\u5B9A projectId" });
-  }
-});
-var AuthTokenGenResponseSchema = z16.object({
-  token: z16.string().min(1),
-  type: AuthTokenTypeSchema,
-  projectId: z16.string().optional()
-});
-var AuthTokenStatusSchema = z16.object({
-  type: AuthTokenTypeSchema,
-  projectId: z16.string().optional(),
-  hasToken: z16.boolean(),
-  createdAt: z16.date().nullable().optional()
-});
-var AuthWhoamiSchema = z16.object({
-  identity: z16.enum(["admin", "project", "none"]),
-  project: z16.object({
-    id: z16.string(),
-    key: z16.string(),
-    name: z16.string()
-  }).nullable().optional(),
-  authEnabled: z16.boolean(),
-  server: z16.object({
-    url: z16.string()
-  })
-});
-var AuthStatusSchema = z16.object({
-  authEnabled: z16.boolean(),
-  /** 鉴权开启且无管理员账号 = 初始化引导窗口（PRD §3.2） */
-  needsSetup: z16.boolean()
+var AssetSetEnabledSchema = z16.object({
+  enabled: z16.boolean()
 });
 
 // src/schemas/node-preset.ts
@@ -4057,7 +4096,7 @@ function bumpPatchOrPassthrough(version) {
 }
 
 // src/content-hash.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash } from "crypto";
 function computeNodeContentHash(node) {
   const canonical = JSON.stringify({
     label: node.label,
@@ -4066,7 +4105,7 @@ function computeNodeContentHash(node) {
     prompt: node.prompt,
     skills: [...node.skills].sort()
   });
-  return createHash2("sha256").update(canonical).digest("hex").slice(0, 16);
+  return createHash("sha256").update(canonical).digest("hex").slice(0, 16);
 }
 
 // src/template-content-diff.ts
@@ -4901,6 +4940,7 @@ export {
   AGENT_MAIN_DOC,
   ARTIFACT_TYPES,
   AUTH_COLLECTIONS,
+  AUTH_TOKEN_LIMIT,
   AdvanceRequestSchema,
   AdvanceResponseSchema,
   AgentCopySchema,
@@ -4922,9 +4962,11 @@ export {
   AuthAccountSchema,
   AuthStatusSchema,
   AuthTokenGenResponseSchema,
+  AuthTokenIssueInputSchema,
+  AuthTokenNameSchema,
   AuthTokenSchema,
-  AuthTokenStatusSchema,
   AuthTokenTypeSchema,
+  AuthTokenViewSchema,
   AuthWhoamiSchema,
   BIZ_CODE_MESSAGES,
   BadRequestError,
@@ -5127,7 +5169,6 @@ export {
   generateToken,
   hasProjectDefault,
   hashPassword,
-  hashToken,
   isLegalTemplateCode,
   matchSetOf,
   mkHistory,