@siming-org/server 0.3.0 → 0.5.0

package/dist/chunk-XZWVPHDG.js

@@ -0,0 +1,2980 @@
+// src/middleware/auth.ts
+import {
+  createAuthTokenRepo,
+  createAuthSessionRepo,
+  hashToken,
+  tokenTypeFromValue,
+  ForbiddenError,
+  UnauthorizedError
+} from "@siming-org/core";
+
+// src/middleware/auth-cookie.ts
+var SESSION_COOKIE_NAME = "siming_session";
+
+// src/middleware/auth.ts
+var SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var AUTH_EXEMPT_ROUTES = /* @__PURE__ */ new Set(["GET /health", "GET /api/auth/status"]);
+function isWhoamiRoute(method, path) {
+  return (method === "GET" || method === "POST") && path === "/api/auth/whoami";
+}
+var AUTH_FLOW_ROUTES = /* @__PURE__ */ new Set(["POST /api/auth/login", "POST /api/auth/setup"]);
+var ADMIN_ONLY_ROUTES = [
+  { method: "POST", pattern: /^\/api\/projects$/ },
+  { method: "PUT", pattern: /^\/api\/projects\/[^/]+$/ },
+  { method: "PUT", pattern: /^\/api\/settings\/enums\/[^/]+$/ },
+  { method: "DELETE", pattern: /^\/api\/settings\/enums\/[^/]+\/entries\/[^/]+$/ },
+  { method: "POST", pattern: /^\/api\/model-aliases$/ },
+  { method: "PUT", pattern: /^\/api\/model-aliases\/[^/]+$/ },
+  { method: "DELETE", pattern: /^\/api\/model-aliases\/[^/]+$/ },
+  // Token 管理全 admin
+  { method: "GET", pattern: /^\/api\/auth\/tokens(\/.*)?$/ },
+  { method: "POST", pattern: /^\/api\/auth\/tokens(\/.*)?$/ }
+];
+function createAuthMiddleware(client, deps) {
+  const tokenRepo = createAuthTokenRepo(client.db());
+  const sessionRepo = createAuthSessionRepo(client.db());
+  const parseCredential = async (c) => {
+    const authHeader = c.req.header("Authorization");
+    if (authHeader !== void 0 && authHeader.startsWith("Bearer ")) {
+      const token = authHeader.slice("Bearer ".length).trim();
+      const type = tokenTypeFromValue(token);
+      if (type === null) return null;
+      const matched = await tokenRepo.findByHash(hashToken(token));
+      if (!matched) return null;
+      if (matched.type === "admin") return { kind: "admin" };
+      return { kind: "project", projectId: matched.projectId ?? "" };
+    }
+    const sessionId = getCookie(c, SESSION_COOKIE_NAME);
+    if (sessionId !== void 0) {
+      const session = await sessionRepo.findValidSession(sessionId);
+      if (session) return { kind: "admin" };
+    }
+    return null;
+  };
+  return async (c, next) => {
+    const method = c.req.method;
+    const path = c.req.path;
+    if (isWhoamiRoute(method, path)) {
+      const parsed2 = deps.authEnabled ? await parseCredential(c) : null;
+      c.set("auth", parsed2 === null ? { kind: deps.authEnabled ? "none" : "open" } : parsed2);
+      await next();
+      return;
+    }
+    if (AUTH_EXEMPT_ROUTES.has(`${method} ${path}`) || AUTH_FLOW_ROUTES.has(`${method} ${path}`)) {
+      c.set("auth", { kind: "open" });
+      await next();
+      return;
+    }
+    if (!deps.authEnabled) {
+      c.set("auth", { kind: "open" });
+      await next();
+      return;
+    }
+    const parsed = await parseCredential(c);
+    if (parsed === null) {
+      const authHeader = c.req.header("Authorization");
+      if (authHeader !== void 0 && authHeader.startsWith("Bearer ")) {
+        throw new UnauthorizedError("AUTH_TOKEN_INVALID");
+      }
+      throw new UnauthorizedError("AUTH_REQUIRED");
+    }
+    const auth = parsed.kind === "admin" ? { kind: "admin" } : { kind: "project", projectId: parsed.projectId ?? "" };
+    if (auth.kind === "project") {
+      for (const rule of ADMIN_ONLY_ROUTES) {
+        if (rule.method === method && rule.pattern.test(path)) {
+          throw new ForbiddenError();
+        }
+      }
+    }
+    c.set("auth", auth);
+    await next();
+  };
+}
+function getCookie(c, name) {
+  const cookieHeader = c.req.header("Cookie");
+  if (cookieHeader === void 0) return void 0;
+  for (const part of cookieHeader.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    if (part.slice(0, eq).trim() === name) {
+      const raw = part.slice(eq + 1).trim();
+      try {
+        return decodeURIComponent(raw);
+      } catch {
+        return raw;
+      }
+    }
+  }
+  return void 0;
+}
+
+// src/static.ts
+import { existsSync, readFileSync, statSync } from "fs";
+import { join, resolve, sep } from "path";
+import { Hono } from "hono";
+var ASSETS_PREFIX = "/assets/";
+var API_NAMESPACES = ["/api", "/health"];
+function isApiNamespace(pathname) {
+  return API_NAMESPACES.some((ns) => pathname === ns || pathname.startsWith(`${ns}/`));
+}
+var MIME_TYPES = {
+  html: "text/html; charset=utf-8",
+  js: "text/javascript; charset=utf-8",
+  mjs: "text/javascript; charset=utf-8",
+  css: "text/css; charset=utf-8",
+  json: "application/json; charset=utf-8",
+  map: "application/json",
+  svg: "image/svg+xml",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  avif: "image/avif",
+  ico: "image/x-icon",
+  woff: "font/woff",
+  woff2: "font/woff2",
+  ttf: "font/ttf",
+  otf: "font/otf",
+  txt: "text/plain; charset=utf-8",
+  wasm: "application/wasm"
+};
+function contentTypeFor(filePath) {
+  const ext = filePath.includes(".") ? filePath.slice(filePath.lastIndexOf(".") + 1).toLowerCase() : "";
+  return MIME_TYPES[ext] ?? "application/octet-stream";
+}
+function resolveWebDistRoot() {
+  const base = import.meta.dirname;
+  const candidates = [
+    join(base, "..", "web-dist"),
+    // dist 布局：包根/web-dist；src 布局：包根/web-dist（均命中）
+    join(base, "..", "..", "web", "dist")
+    // dist/src 布局回退：repo packages/web/dist
+  ];
+  for (const dir of candidates) {
+    if (existsSync(join(dir, "index.html"))) return dir;
+  }
+  return null;
+}
+function resolveSafe(webRoot, urlPathname) {
+  const segments = urlPathname.split("/").filter((s) => s.length > 0);
+  if (segments.includes("..")) return null;
+  const target = resolve(webRoot, ...segments);
+  if (target !== webRoot && !target.startsWith(webRoot + sep)) return null;
+  return target;
+}
+function serveFile(absPath, cacheControl) {
+  const body = readFileSync(absPath);
+  return new Response(body, {
+    status: 200,
+    headers: { "Content-Type": contentTypeFor(absPath), "Cache-Control": cacheControl }
+  });
+}
+function createStaticRoutes(webRoot) {
+  const app = new Hono();
+  app.get("*", async (c) => {
+    const pathname = c.req.path;
+    if (isApiNamespace(pathname)) {
+      return c.notFound();
+    }
+    if (webRoot === null) {
+      return c.json(
+        {
+          error: "web_ui_not_built",
+          message: "Web UI \u672A\u6784\u5EFA\uFF0C\u672C\u670D\u52A1\u4EC5\u63D0\u4F9B API\u3002\u5982\u5728 siming \u4ED3\u5E93\u5185\uFF1A\u6267\u884C pnpm --filter @siming-org/web build \u540E\u91CD\u542F\uFF1B\u5982\u9700\u5B8C\u6574\u7BA1\u7406\u754C\u9762\uFF1A\u901A\u8FC7 npm \u5B89\u88C5\u542B web-dist \u7684 @siming-org/server \u5206\u53D1\u7248\u672C"
+        },
+        503
+      );
+    }
+    let decoded;
+    try {
+      decoded = decodeURIComponent(pathname);
+    } catch {
+      return c.json({ error: "bad_path", message: "URL \u8DEF\u5F84\u7F16\u7801\u975E\u6CD5" }, 400);
+    }
+    const absPath = resolveSafe(webRoot, decoded === "/" ? "" : decoded);
+    if (absPath === null) {
+      return c.json({ error: "bad_path", message: "\u8DEF\u5F84\u4E0D\u5408\u6CD5" }, 403);
+    }
+    const st = statSync(absPath, { throwIfNoEntry: false });
+    if (st?.isFile()) {
+      const cache = decoded.startsWith(ASSETS_PREFIX) ? "public, max-age=31536000, immutable" : "no-cache";
+      return serveFile(absPath, cache);
+    }
+    if (decoded.startsWith(ASSETS_PREFIX)) {
+      return c.notFound();
+    }
+    const indexPath = join(webRoot, "index.html");
+    if (existsSync(indexPath)) {
+      return serveFile(indexPath, "no-cache");
+    }
+    return c.notFound();
+  });
+  return app;
+}
+
+// src/app.ts
+import { Hono as Hono15 } from "hono";
+
+// src/errors.ts
+import { AppError } from "@siming-org/core";
+function setupErrorHandler(app) {
+  app.onError((err, c) => {
+    if (err instanceof AppError) {
+      const body = JSON.stringify(err.toResponse());
+      return new Response(body, { status: err.statusCode, headers: { "Content-Type": "application/json" } });
+    }
+    if (typeof err === "object" && err !== null && "code" in err && err.code === 11e3) {
+      return c.json({ error: "conflict", message: "duplicate key" }, 409);
+    }
+    console.error("Unhandled error:", err);
+    return c.json(
+      { error: "internal_error", message: "An unexpected error occurred" },
+      500
+    );
+  });
+}
+
+// src/routes/index.ts
+import { Hono as Hono13 } from "hono";
+
+// src/routes/health.ts
+import { Hono as Hono2 } from "hono";
+import { ping, VERSION } from "@siming-org/core";
+function createHealth(client) {
+  const app = new Hono2();
+  app.get("/health", async (c) => {
+    let mongoStatus = "ok";
+    try {
+      await client.db().command({ ping: 1 });
+    } catch (e) {
+      console.error(`[health] mongo ping failed: ${e instanceof Error ? e.message : String(e)}`);
+      mongoStatus = "error";
+    }
+    const status = mongoStatus === "ok" ? "ok" : "degraded";
+    return c.json({
+      status,
+      version: VERSION,
+      pong: ping(),
+      mongo: { status: mongoStatus }
+    });
+  });
+  return app;
+}
+
+// src/routes/project.routes.ts
+import { Hono as Hono3 } from "hono";
+import { zValidator } from "@hono/zod-validator";
+
+// src/routes/auth-guard.ts
+import { NotFoundError, ForbiddenError as ForbiddenError2 } from "@siming-org/core";
+function getAuth(c) {
+  const auth = c.get("auth");
+  return auth ?? { kind: "open" };
+}
+function assertProjectVisible(c, resourceProjectId) {
+  const auth = getAuth(c);
+  if (auth.kind === "project" && resourceProjectId !== void 0 && resourceProjectId !== "" && resourceProjectId !== auth.projectId) {
+    throw new NotFoundError("resource", resourceProjectId);
+  }
+}
+function assertProjectScope(c, resourceProjectId) {
+  const auth = getAuth(c);
+  if (auth.kind === "project" && resourceProjectId !== auth.projectId) {
+    throw new NotFoundError("resource", resourceProjectId);
+  }
+}
+function requireAdminLike(c) {
+  const auth = getAuth(c);
+  if (auth.kind === "project") {
+    throw new ForbiddenError2();
+  }
+}
+function resolveProjectFilter(c, requested) {
+  const auth = getAuth(c);
+  if (auth.kind === "project") return auth.projectId;
+  return requested;
+}
+
+// src/routes/project.routes.ts
+import {
+  createProjectRepo,
+  ProjectCreateSchema,
+  ProjectUpdateSchema,
+  NotFoundError as NotFoundError2,
+  ConflictError,
+  BIZ_CODE_MESSAGES,
+  DEFAULT_PROJECT_KEY
+} from "@siming-org/core";
+async function loadProjectForWrite(projectRepo, projectId) {
+  const project = await projectRepo.getById(projectId);
+  if (!project) {
+    throw new NotFoundError2("project", projectId, {
+      bizCode: "PROJECT_NOT_FOUND",
+      message: BIZ_CODE_MESSAGES.PROJECT_NOT_FOUND
+    });
+  }
+  if (project.status === "archived") {
+    throw new ConflictError("project", projectId, {
+      bizCode: "PROJECT_ARCHIVED",
+      message: BIZ_CODE_MESSAGES.PROJECT_ARCHIVED
+    });
+  }
+  return project;
+}
+function createProjectRoutes(client) {
+  const app = new Hono3();
+  const repo = createProjectRepo(client.db());
+  app.get("/api/projects", async (c) => {
+    const status = c.req.query("status");
+    const auth = getAuth(c);
+    if (auth.kind === "project") {
+      const own = await repo.getById(auth.projectId);
+      return c.json(own ? [own] : []);
+    }
+    const projects = await repo.list();
+    return c.json(status ? projects.filter((p) => p.status === status) : projects);
+  });
+  app.get("/api/projects/:id", async (c) => {
+    const id = c.req.param("id");
+    const project = await repo.getById(id);
+    if (!project) throw new NotFoundError2("project", id);
+    assertProjectScope(c, project.id ?? id);
+    return c.json(project);
+  });
+  app.post("/api/projects", zValidator("json", ProjectCreateSchema), async (c) => {
+    const data = c.req.valid("json");
+    return c.json(await repo.createProject(data), 201);
+  });
+  app.put("/api/projects/:id", zValidator("json", ProjectUpdateSchema), async (c) => {
+    const id = c.req.param("id");
+    const data = c.req.valid("json");
+    const existing = await repo.getById(id);
+    if (!existing) throw new NotFoundError2("project", id);
+    if (data.status === "archived" && existing.key === DEFAULT_PROJECT_KEY) {
+      throw new ConflictError("project", id, {
+        bizCode: "DEFAULT_PROJECT_IMMUTABLE",
+        message: BIZ_CODE_MESSAGES.DEFAULT_PROJECT_IMMUTABLE
+      });
+    }
+    if (data.name && data.name !== existing.name) {
+      const dup = await repo._collection.findOne({ name: data.name }, { projection: { _id: 1 } });
+      if (dup) throw new ConflictError("project", `name conflict: ${data.name}`);
+    }
+    const patch = {};
+    if (data.name !== void 0) patch.name = data.name;
+    if (data.description !== void 0) patch.description = data.description;
+    if (data.status !== void 0) patch.status = data.status;
+    const project = await repo.update(id, patch);
+    if (!project) throw new NotFoundError2("project", id);
+    return c.json(project);
+  });
+  return app;
+}
+
+// src/routes/skill.routes.ts
+import { Hono as Hono4 } from "hono";
+import { zValidator as zValidator2 } from "@hono/zod-validator";
+import { z } from "zod";
+import {
+  createSkillRepo,
+  createProjectRepo as createProjectRepo2,
+  createEnumRegistryRepo,
+  SkillCreateSchema,
+  SkillUpdateSchema,
+  SkillCopySchema,
+  AssetSetEnabledSchema,
+  OBJECT_ID_HEX,
+  assertReferencesDeletable,
+  assertReferenceAggregateLimit,
+  NotFoundError as NotFoundError3,
+  ConflictError as ConflictError2,
+  BadRequestError,
+  BIZ_CODE_MESSAGES as BIZ_CODE_MESSAGES2
+} from "@siming-org/core";
+var SkillListQuerySchema = z.object({
+  projectId: z.string().optional(),
+  scope: z.enum(["global", "project"]).optional(),
+  q: z.string().trim().min(1).max(100).optional(),
+  includeDisabled: z.stringbool().optional()
+}).refine((q) => !(q.scope === "project" && !q.projectId), {
+  message: "scope=project requires projectId",
+  path: ["projectId"]
+});
+var SkillByNameQuerySchema = z.object({
+  scope: z.enum(["global", "project"]).optional(),
+  projectId: z.string().regex(OBJECT_ID_HEX).optional(),
+  includeDisabled: z.stringbool().optional()
+}).superRefine((q, ctx) => {
+  if (q.scope === "project" && !q.projectId) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "scope=project requires projectId", path: ["projectId"] });
+  }
+});
+function skillToListItem(skill) {
+  const { references, ...rest } = skill;
+  return { ...rest, referenceCount: references?.length ?? 0 };
+}
+function createSkillRoutes(client) {
+  const app = new Hono4();
+  const repo = createSkillRepo(client.db());
+  const projectRepo = createProjectRepo2(client.db());
+  const enumRegistryRepo = createEnumRegistryRepo(client.db());
+  const assertCategoryValid = async (category) => {
+    const categories = await enumRegistryRepo.getEntries("skill_category");
+    if (!categories.some((e) => e.active && e.value === category)) {
+      const validValues = categories.filter((e) => e.active).map((e) => e.value).join(", ");
+      throw new BadRequestError(
+        `category '${category}' is not a valid active skill_category value. Valid values: ${validValues}`
+      );
+    }
+  };
+  app.get("/api/skills", zValidator2("query", SkillListQuerySchema), async (c) => {
+    const q = c.req.valid("query");
+    const opts = { includeDisabled: q.includeDisabled, q: q.q };
+    const auth = getAuth(c);
+    if (auth.kind === "project") {
+      return c.json((await repo.listSkillsByScope(auth.projectId, opts)).map(skillToListItem));
+    }
+    if (q.scope) {
+      return c.json((await repo.listSkillsByScopeFilter(q.scope, q.projectId, opts)).map(skillToListItem));
+    }
+    return c.json(
+      (q.projectId ? await repo.listSkillsByScope(q.projectId, opts) : await repo.listSkills(opts)).map(skillToListItem)
+    );
+  });
+  app.get("/api/skills/:name/scope-availability", zValidator2("query", z.object({ scope: z.enum(["global", "project"]) })), async (c) => {
+    const name = c.req.param("name");
+    const { scope } = c.req.valid("query");
+    return c.json({ name, scope, available: !await repo.hasNameScopeConflict(name, scope) });
+  });
+  app.get("/api/skills/:name", zValidator2("query", SkillByNameQuerySchema), async (c) => {
+    const name = c.req.param("name");
+    const q = c.req.valid("query");
+    const skill = await resolveAssetByScope(repo, name, q, { includeDisabled: q.includeDisabled });
+    if (!skill) throw new NotFoundError3("skill", name);
+    assertProjectVisible(c, skill.projectId);
+    return c.json(skill);
+  });
+  app.post("/api/skills", zValidator2("json", SkillCreateSchema), async (c) => {
+    const data = c.req.valid("json");
+    await assertCategoryValid(data.category);
+    if (data.scope === "project") {
+      assertProjectScope(c, data.projectId);
+      await loadProjectForWrite(projectRepo, data.projectId);
+    } else {
+      requireAdminLike(c);
+    }
+    return c.json(await repo.createSkill(data), 201);
+  });
+  app.put("/api/skills/:name", zValidator2("query", SkillByNameQuerySchema), zValidator2("json", SkillUpdateSchema), async (c) => {
+    const name = c.req.param("name");
+    const data = c.req.valid("json");
+    const q = c.req.valid("query");
+    const existing = await resolveAssetByScope(repo, name, q, { includeDisabled: true });
+    if (!existing) throw new NotFoundError3("skill", name);
+    if ((q.scope ?? "global") === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
+    }
+    if (data.category !== void 0) await assertCategoryValid(data.category);
+    if (isScopeMutation(existing, data)) {
+      throw new ConflictError2("skill", name, {
+        bizCode: "SCOPE_IMMUTABLE",
+        message: BIZ_CODE_MESSAGES2.SCOPE_IMMUTABLE
+      });
+    }
+    const effectiveProjectId = data.projectId ?? existing.projectId;
+    if ((data.scope ?? existing.scope) === "project" && effectiveProjectId) {
+      await loadProjectForWrite(projectRepo, effectiveProjectId);
+    }
+    assertReferencesDeletable({
+      resource: "skill",
+      name,
+      existingReferences: existing.references,
+      nextReferences: data.references,
+      nextMainBody: data.content,
+      currentMainBody: existing.content
+    });
+    assertReferenceAggregateLimit({
+      effectiveMainBody: data.content ?? existing.content,
+      nextReferences: data.references
+    });
+    const skill = await repo.updateByNameScoped(name, q.scope ?? "global", q.projectId, data);
+    if (!skill) throw new NotFoundError3("skill", name);
+    return c.json(skill);
+  });
+  app.post("/api/skills/:name/copy", zValidator2("query", SkillByNameQuerySchema), zValidator2("json", SkillCopySchema), async (c) => {
+    const name = c.req.param("name");
+    const input = c.req.valid("json");
+    const q = c.req.valid("query");
+    const existing = await resolveAssetByScope(repo, name, q, { includeDisabled: true });
+    if (!existing) throw new NotFoundError3("skill", name);
+    assertProjectVisible(c, existing.projectId);
+    if (input.newScope === "project") {
+      assertProjectScope(c, input.targetProjectId);
+      await loadProjectForWrite(projectRepo, input.targetProjectId);
+    } else {
+      requireAdminLike(c);
+    }
+    const copy = await repo.copySkill(
+      name,
+      { scope: q.scope ?? "global", ...q.projectId ? { projectId: q.projectId } : {} },
+      { scope: input.newScope, ...input.targetProjectId ? { projectId: input.targetProjectId } : {} },
+      input.newName
+    );
+    return c.json(copy, 201);
+  });
+  app.delete("/api/skills/:name", zValidator2("query", SkillByNameQuerySchema), async (c) => {
+    const name = c.req.param("name");
+    const q = c.req.valid("query");
+    const existing = await resolveAssetByScope(repo, name, q, { includeDisabled: true });
+    if (!existing) throw new NotFoundError3("skill", name);
+    if ((q.scope ?? "global") === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
+    }
+    const deleted = await repo.deleteByNameScoped(name, q.scope ?? "global", q.projectId);
+    if (!deleted) throw new NotFoundError3("skill", name);
+    return c.body(null, 204);
+  });
+  app.post("/api/skills/:name/enabled", zValidator2("query", SkillByNameQuerySchema), zValidator2("json", AssetSetEnabledSchema), async (c) => {
+    const name = c.req.param("name");
+    const body = c.req.valid("json");
+    const q = c.req.valid("query");
+    const existing = await resolveAssetByScope(repo, name, q, { includeDisabled: true });
+    if (!existing) throw new NotFoundError3("skill", name);
+    const scope = q.scope ?? "global";
+    if (scope === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
+      await loadProjectForWrite(projectRepo, existing.projectId ?? q.projectId);
+    }
+    const skill = await repo.updateByNameScoped(name, scope, q.projectId, { enabled: body.enabled });
+    if (!skill) throw new NotFoundError3("skill", name);
+    return c.json({ name: skill.name, enabled: skill.enabled ?? true });
+  });
+  return app;
+}
+function isScopeMutation(existing, patch) {
+  if (patch.scope !== void 0 && patch.scope !== existing.scope) return true;
+  if (patch.projectId !== void 0 && patch.projectId !== existing.projectId) return true;
+  return false;
+}
+async function resolveAssetByScope(repo, name, q, opts) {
+  return repo.getByNameScoped(name, q.scope ?? "global", q.projectId, opts);
+}
+
+// src/routes/agent.routes.ts
+import { Hono as Hono5 } from "hono";
+import { zValidator as zValidator3 } from "@hono/zod-validator";
+import { z as z2 } from "zod";
+import {
+  bumpPatch,
+  createAgentRepo,
+  createSkillRepo as createSkillRepo2,
+  createProjectRepo as createProjectRepo3,
+  createModelAliasRepo,
+  AgentCreateSchema,
+  AgentUpdateSchema,
+  AgentCopySchema,
+  AssetSetEnabledSchema as AssetSetEnabledSchema2,
+  assertReferencesDeletable as assertReferencesDeletable2,
+  assertReferenceAggregateLimit as assertReferenceAggregateLimit2,
+  NotFoundError as NotFoundError4,
+  ConflictError as ConflictError3,
+  BIZ_CODE_MESSAGES as BIZ_CODE_MESSAGES3,
+  assertBoundSkillsCompatible,
+  assertModelAliasExists
+} from "@siming-org/core";
+function agentToListItem(agent) {
+  const { references, ...rest } = agent;
+  return { ...rest, referenceCount: references?.length ?? 0 };
+}
+var AgentListQuerySchema = z2.object({
+  projectId: z2.string().optional(),
+  scope: z2.enum(["global", "project"]).optional(),
+  q: z2.string().trim().min(1).max(100).optional(),
+  includeDisabled: z2.stringbool().optional()
+}).refine((q) => !(q.scope === "project" && !q.projectId), {
+  message: "scope=project requires projectId",
+  path: ["projectId"]
+});
+function createAgentRoutes(client) {
+  const app = new Hono5();
+  const repo = createAgentRepo(client.db());
+  const skillRepo = createSkillRepo2(client.db());
+  const projectRepo = createProjectRepo3(client.db());
+  const aliasRepo = createModelAliasRepo(client.db());
+  app.get("/api/agents", zValidator3("query", AgentListQuerySchema), async (c) => {
+    const q = c.req.valid("query");
+    const opts = { includeDisabled: q.includeDisabled, q: q.q };
+    const auth = getAuth(c);
+    if (auth.kind === "project") {
+      return c.json((await repo.listAgentsByScope(auth.projectId, opts)).map(agentToListItem));
+    }
+    if (q.scope) {
+      return c.json((await repo.listAgentsByScopeFilter(q.scope, q.projectId, opts)).map(agentToListItem));
+    }
+    return c.json(
+      (q.projectId ? await repo.listAgentsByScope(q.projectId, opts) : await repo.listAgents(opts)).map(agentToListItem)
+    );
+  });
+  app.get("/api/agents/:name/scope-availability", zValidator3("query", z2.object({ scope: z2.enum(["global", "project"]) })), async (c) => {
+    const name = c.req.param("name");
+    const { scope } = c.req.valid("query");
+    return c.json({ name, scope, available: !await repo.hasNameScopeConflict(name, scope) });
+  });
+  app.get("/api/agents/:name", zValidator3("query", SkillByNameQuerySchema), async (c) => {
+    const name = c.req.param("name");
+    const q = c.req.valid("query");
+    const agent = await resolveAssetByScope(repo, name, q, { includeDisabled: q.includeDisabled });
+    if (!agent) throw new NotFoundError4("agent", name);
+    assertProjectVisible(c, agent.projectId);
+    return c.json(agent);
+  });
+  app.post("/api/agents", zValidator3("json", AgentCreateSchema), async (c) => {
+    const data = c.req.valid("json");
+    if (data.scope === "project") {
+      assertProjectScope(c, data.projectId);
+      await loadProjectForWrite(projectRepo, data.projectId);
+    } else {
+      requireAdminLike(c);
+    }
+    await assertBoundSkillsCompatible(skillRepo, data.scope, data.projectId, data.boundSkills);
+    await assertModelAliasExists(aliasRepo, data.model);
+    return c.json(await repo.createAgent(data), 201);
+  });
+  app.put("/api/agents/:name", zValidator3("query", SkillByNameQuerySchema), zValidator3("json", AgentUpdateSchema), async (c) => {
+    const name = c.req.param("name");
+    const data = c.req.valid("json");
+    const q = c.req.valid("query");
+    const existing = await resolveAssetByScope(repo, name, q, { includeDisabled: true });
+    if (!existing) throw new NotFoundError4("agent", name);
+    if ((q.scope ?? "global") === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
+    }
+    let payload = data;
+    if (data["function"] !== void 0 && data["function"] !== existing["function"]) {
+      payload = { ...data, version: bumpPatch(data.version ?? existing.version) };
+    }
+    if (isScopeMutation(existing, data)) {
+      throw new ConflictError3("agent", name, {
+        bizCode: "SCOPE_IMMUTABLE",
+        message: BIZ_CODE_MESSAGES3.SCOPE_IMMUTABLE
+      });
+    }
+    const effectiveProjectId = data.projectId ?? existing.projectId;
+    if ((data.scope ?? existing.scope) === "project" && effectiveProjectId) {
+      await loadProjectForWrite(projectRepo, effectiveProjectId);
+    }
+    if (data.boundSkills !== void 0) {
+      await assertBoundSkillsCompatible(
+        skillRepo,
+        existing.scope,
+        effectiveProjectId,
+        data.boundSkills
+      );
+    }
+    if (data.model !== void 0) {
+      await assertModelAliasExists(aliasRepo, data.model);
+    }
+    assertReferencesDeletable2({
+      resource: "agent",
+      name,
+      existingReferences: existing.references,
+      nextReferences: data.references,
+      nextMainBody: data.systemPrompt,
+      currentMainBody: existing.systemPrompt
+    });
+    assertReferenceAggregateLimit2({
+      effectiveMainBody: data.systemPrompt ?? existing.systemPrompt,
+      nextReferences: data.references
+    });
+    const agent = await repo.updateByNameScoped(name, q.scope ?? "global", q.projectId, payload);
+    if (!agent) throw new NotFoundError4("agent", name);
+    return c.json(agent);
+  });
+  app.post("/api/agents/:name/copy", zValidator3("query", SkillByNameQuerySchema), zValidator3("json", AgentCopySchema), async (c) => {
+    const name = c.req.param("name");
+    const input = c.req.valid("json");
+    const q = c.req.valid("query");
+    const existing = await resolveAssetByScope(repo, name, q, { includeDisabled: true });
+    if (!existing) throw new NotFoundError4("agent", name);
+    assertProjectVisible(c, existing.projectId);
+    if (input.newScope === "project") {
+      assertProjectScope(c, input.targetProjectId);
+      await loadProjectForWrite(projectRepo, input.targetProjectId);
+    } else {
+      requireAdminLike(c);
+    }
+    const copy = await repo.copyAgent(
+      name,
+      { scope: q.scope ?? "global", ...q.projectId ? { projectId: q.projectId } : {} },
+      { scope: input.newScope, ...input.targetProjectId ? { projectId: input.targetProjectId } : {} },
+      input.newName,
+      skillRepo
+    );
+    return c.json(copy, 201);
+  });
+  app.delete("/api/agents/:name", zValidator3("query", SkillByNameQuerySchema), async (c) => {
+    const name = c.req.param("name");
+    const q = c.req.valid("query");
+    const existing = await resolveAssetByScope(repo, name, q, { includeDisabled: true });
+    if (!existing) throw new NotFoundError4("agent", name);
+    if ((q.scope ?? "global") === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
+    }
+    const deleted = await repo.deleteByNameScoped(name, q.scope ?? "global", q.projectId);
+    if (!deleted) throw new NotFoundError4("agent", name);
+    return c.body(null, 204);
+  });
+  app.post("/api/agents/:name/enabled", zValidator3("query", SkillByNameQuerySchema), zValidator3("json", AssetSetEnabledSchema2), async (c) => {
+    const name = c.req.param("name");
+    const body = c.req.valid("json");
+    const q = c.req.valid("query");
+    const existing = await resolveAssetByScope(repo, name, q, { includeDisabled: true });
+    if (!existing) throw new NotFoundError4("agent", name);
+    const scope = q.scope ?? "global";
+    if (scope === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
+      await loadProjectForWrite(projectRepo, existing.projectId ?? q.projectId);
+    }
+    const agent = await repo.updateByNameScoped(name, scope, q.projectId, { enabled: body.enabled });
+    if (!agent) throw new NotFoundError4("agent", name);
+    return c.json({ name: agent.name, enabled: agent.enabled ?? true });
+  });
+  return app;
+}
+
+// src/routes/model-alias.routes.ts
+import { Hono as Hono6 } from "hono";
+import { zValidator as zValidator4 } from "@hono/zod-validator";
+import {
+  createModelAliasRepo as createModelAliasRepo2,
+  ModelAliasCreateSchema,
+  ModelAliasUpdateSchema,
+  NotFoundError as NotFoundError5,
+  ConflictError as ConflictError4,
+  BIZ_CODE_MESSAGES as BIZ_CODE_MESSAGES4
+} from "@siming-org/core";
+function createModelAliasRoutes(client) {
+  const app = new Hono6();
+  const repo = createModelAliasRepo2(client.db());
+  app.get("/api/model-aliases", async (c) => {
+    return c.json(await repo.listWithRefCount());
+  });
+  app.post("/api/model-aliases", zValidator4("json", ModelAliasCreateSchema), async (c) => {
+    const data = c.req.valid("json");
+    const dup = await repo.getByCode(data.code);
+    if (dup) {
+      throw new ConflictError4("model-alias", data.code, {
+        bizCode: "MODEL_CODE_EXISTS",
+        message: BIZ_CODE_MESSAGES4.MODEL_CODE_EXISTS
+      });
+    }
+    return c.json(await repo.createModelAlias(data), 201);
+  });
+  app.put("/api/model-aliases/:code", zValidator4("json", ModelAliasUpdateSchema), async (c) => {
+    const code = c.req.param("code");
+    const data = c.req.valid("json");
+    const existing = await repo.getByCode(code);
+    if (!existing) throw new NotFoundError5("model-alias", code);
+    if (data.code !== void 0 && data.code !== code) {
+      throw new ConflictError4("model-alias", code, {
+        bizCode: "MODEL_CODE_IMMUTABLE",
+        message: BIZ_CODE_MESSAGES4.MODEL_CODE_IMMUTABLE
+      });
+    }
+    const patch = {};
+    if (data.name !== void 0) patch.name = data.name;
+    if (data.realModel !== void 0) patch.realModel = data.realModel;
+    const alias = await repo.updateByCode(code, patch);
+    if (!alias) throw new NotFoundError5("model-alias", code);
+    return c.json(alias);
+  });
+  app.delete("/api/model-aliases/:code", async (c) => {
+    const code = c.req.param("code");
+    const deleted = await repo.deleteByCode(code);
+    if (!deleted) throw new NotFoundError5("model-alias", code);
+    return c.body(null, 204);
+  });
+  return app;
+}
+
+// src/routes/dag-template.routes.ts
+import { Hono as Hono7 } from "hono";
+import { zValidator as zValidator5 } from "@hono/zod-validator";
+import { z as z3 } from "zod";
+import {
+  createDagTemplateRepo,
+  createProjectRepo as createProjectRepo4,
+  createSkillRepo as createSkillRepo3,
+  createAgentRepo as createAgentRepo2,
+  createModelAliasRepo as createModelAliasRepo3,
+  createNodePresetRepo,
+  DagTemplateCreateSchema,
+  DagTemplateCopySchema,
+  DagTemplateUpdateSchema,
+  AssetSetEnabledSchema as AssetSetEnabledSchema3,
+  ImportPlanRequestSchema,
+  ImportApplyRequestSchema,
+  UpgradeApplyRequestSchema,
+  assertUniqueNodeIds,
+  buildUpgradePlan,
+  applyUpgradeDecisions,
+  composeExportBundle,
+  buildImportPlan,
+  applyImport,
+  NotFoundError as NotFoundError7,
+  ConflictError as ConflictError5,
+  BIZ_CODE_MESSAGES as BIZ_CODE_MESSAGES5
+} from "@siming-org/core";
+
+// src/routes/template-ref.ts
+import { NotFoundError as NotFoundError6 } from "@siming-org/core";
+var TEMPLATE_CANDIDATE_LIMIT = 5;
+async function resolveTemplateOr404(repo, ref, projectCtx, refHint) {
+  const template = await repo.resolveTemplateByRef(ref, projectCtx);
+  if (!template || template.id === void 0) {
+    const message = !/^[a-f0-9]{24}$/.test(ref) && projectCtx === void 0 ? `dag-template not found: ${ref}${refHint}` : `dag-template not found: ${ref}`;
+    const err = new NotFoundError6("dag-template", ref, { message });
+    if (projectCtx !== void 0) {
+      err.withTemplateCandidates(await repo.findSimilarTemplates(projectCtx, ref, TEMPLATE_CANDIDATE_LIMIT));
+    }
+    throw err;
+  }
+  return template;
+}
+
+// src/routes/dag-template.routes.ts
+var DagTemplateListQuerySchema = z3.object({
+  projectId: z3.string().optional(),
+  name: z3.string().optional(),
+  code: z3.string().optional(),
+  includeDisabled: z3.stringbool().optional()
+});
+var QUERY_PROJECT_HINT = "\uFF08code \u5F62\u6001\u5BFB\u5740\u9700 ?projectId= \u6307\u5B9A\u9879\u76EE\u2014\u2014code \u9879\u76EE\u5185\u552F\u4E00\uFF0C\u65E0\u9879\u76EE\u57DF\u4E0D\u53EF\u6D88\u6B67\uFF1B\u6216\u6539\u4F20 24 \u4F4D\u6570\u636E\u5E93 id\uFF09";
+function createDagTemplateRoutes(client) {
+  const app = new Hono7();
+  const repo = createDagTemplateRepo(client.db());
+  const projectRepo = createProjectRepo4(client.db());
+  const nodePresetRepo = createNodePresetRepo(client.db());
+  const transferDeps = {
+    templateRepo: repo,
+    skillRepo: createSkillRepo3(client.db()),
+    agentRepo: createAgentRepo2(client.db()),
+    modelAliasRepo: createModelAliasRepo3(client.db()),
+    nodePresetRepo
+  };
+  app.get("/api/dag/templates", zValidator5("query", DagTemplateListQuerySchema), async (c) => {
+    const q = c.req.valid("query");
+    const projectFilter = resolveProjectFilter(c, q.projectId);
+    return c.json(
+      await repo.listDagTemplates({
+        ...projectFilter ? { projectId: projectFilter } : {},
+        ...q.name ? { name: q.name } : {},
+        ...q.code ? { code: q.code } : {},
+        ...q.includeDisabled !== void 0 ? { includeDisabled: q.includeDisabled } : {}
+      })
+    );
+  });
+  app.get("/api/dag/templates/:id", async (c) => {
+    const ref = c.req.param("id");
+    const template = await resolveTemplateOr404(repo, ref, resolveProjectFilter(c, c.req.query("projectId")), QUERY_PROJECT_HINT);
+    assertProjectScope(c, template.projectId);
+    return c.json(template);
+  });
+  app.post("/api/dag/templates/:id/enabled", zValidator5("json", AssetSetEnabledSchema3), async (c) => {
+    const ref = c.req.param("id");
+    const body = c.req.valid("json");
+    const existing = await resolveTemplateOr404(repo, ref, resolveProjectFilter(c, c.req.query("projectId")), QUERY_PROJECT_HINT);
+    assertProjectScope(c, existing.projectId);
+    await loadProjectForWrite(projectRepo, existing.projectId);
+    const template = await repo.update(existing.id, { enabled: body.enabled });
+    if (!template) throw new NotFoundError7("dag-template", existing.id);
+    return c.json({ id: template.id, name: template.name, enabled: template.enabled ?? true });
+  });
+  app.post("/api/dag/templates", zValidator5("json", DagTemplateCreateSchema), async (c) => {
+    const data = c.req.valid("json");
+    assertProjectScope(c, data.projectId);
+    await loadProjectForWrite(projectRepo, data.projectId);
+    assertUniqueNodeIds(data.nodes);
+    if (data.code !== void 0) {
+      const dup = await repo._collection.findOne(
+        { projectId: data.projectId, code: data.code },
+        { projection: { _id: 1, name: 1 } }
+      );
+      if (dup) {
+        throw new ConflictError5("dag-template", `code conflict: ${data.code}`, {
+          bizCode: "TEMPLATE_CODE_CONFLICT",
+          message: `${BIZ_CODE_MESSAGES5.TEMPLATE_CODE_CONFLICT}\uFF08\u51B2\u7A81\u6A21\u677F\uFF1A${String(dup.name)}\uFF09`
+        });
+      }
+    }
+    return c.json(await repo.createDagTemplate(data), 201);
+  });
+  app.put("/api/dag/templates/:id", zValidator5("json", DagTemplateUpdateSchema), async (c) => {
+    const ref = c.req.param("id");
+    const data = c.req.valid("json");
+    const existing = await resolveTemplateOr404(repo, ref, resolveProjectFilter(c, c.req.query("projectId")), QUERY_PROJECT_HINT);
+    assertProjectScope(c, existing.projectId);
+    if (data.code !== void 0 && data.code !== existing.code) {
+      throw new ConflictError5("dag-template", ref, {
+        bizCode: "TEMPLATE_CODE_IMMUTABLE",
+        message: BIZ_CODE_MESSAGES5.TEMPLATE_CODE_IMMUTABLE
+      });
+    }
+    const { code: _codeStrip, ...writable } = data;
+    if (writable.projectId !== void 0 && writable.projectId !== existing.projectId) {
+      throw new ConflictError5("dag-template", ref, {
+        bizCode: "TEMPLATE_PROJECT_IMMUTABLE",
+        message: BIZ_CODE_MESSAGES5.TEMPLATE_PROJECT_IMMUTABLE
+      });
+    }
+    await loadProjectForWrite(projectRepo, existing.projectId);
+    if (data.nodes !== void 0) {
+      assertUniqueNodeIds(data.nodes);
+    }
+    if (writable.name !== void 0 && writable.name !== existing.name) {
+      const dup = await repo._collection.findOne(
+        { projectId: existing.projectId, name: writable.name },
+        { projection: { _id: 1 } }
+      );
+      if (dup) {
+        throw new ConflictError5("dag-template", `name conflict: ${writable.name}`, {
+          bizCode: "TEMPLATE_NAME_CONFLICT",
+          message: BIZ_CODE_MESSAGES5.TEMPLATE_NAME_CONFLICT
+        });
+      }
+    }
+    const template = await repo.update(existing.id, writable);
+    if (!template) throw new NotFoundError7("dag-template", existing.id);
+    return c.json(template);
+  });
+  app.post("/api/dag/templates/:id/copy", zValidator5("json", DagTemplateCopySchema), async (c) => {
+    const ref = c.req.param("id");
+    const input = c.req.valid("json");
+    const existing = await resolveTemplateOr404(repo, ref, resolveProjectFilter(c, c.req.query("projectId")), QUERY_PROJECT_HINT);
+    assertProjectScope(c, existing.projectId);
+    assertProjectScope(c, input.targetProjectId);
+    await loadProjectForWrite(projectRepo, input.targetProjectId);
+    const dup = await repo._collection.findOne(
+      { projectId: input.targetProjectId, name: input.newName },
+      { projection: { _id: 1 } }
+    );
+    if (dup) {
+      throw new ConflictError5("dag-template", `name conflict: ${input.newName}`, {
+        bizCode: "TEMPLATE_NAME_CONFLICT",
+        message: BIZ_CODE_MESSAGES5.TEMPLATE_NAME_CONFLICT
+      });
+    }
+    const copy = await repo.copyDagTemplate(existing.id, input.targetProjectId, input.newName, input.newCode);
+    return c.json(copy, 201);
+  });
+  app.get("/api/dag/templates/:id/export", async (c) => {
+    const ref = c.req.param("id");
+    const template = await resolveTemplateOr404(repo, ref, resolveProjectFilter(c, c.req.query("projectId")), QUERY_PROJECT_HINT);
+    assertProjectScope(c, template.projectId);
+    return c.json(await composeExportBundle(transferDeps, template.id));
+  });
+  app.post("/api/dag/templates/import/plan", zValidator5("json", ImportPlanRequestSchema), async (c) => {
+    const body = c.req.valid("json");
+    assertProjectScope(c, body.targetProjectId);
+    await loadProjectForWrite(projectRepo, body.targetProjectId);
+    return c.json(await buildImportPlan(transferDeps, body.targetProjectId, body.bundle));
+  });
+  app.post("/api/dag/templates/import/apply", zValidator5("json", ImportApplyRequestSchema), async (c) => {
+    const body = c.req.valid("json");
+    assertProjectScope(c, body.targetProjectId);
+    await loadProjectForWrite(projectRepo, body.targetProjectId);
+    return c.json(await applyImport(transferDeps, body.targetProjectId, body.bundle, body.decisions));
+  });
+  app.get("/api/dag/templates/:id/upgrade/plan", async (c) => {
+    const id = c.req.param("id");
+    const template = await repo.getById(id);
+    if (!template) throw new NotFoundError7("dag-template", id);
+    assertProjectScope(c, template.projectId);
+    const codes = [...new Set(template.nodes.flatMap((n) => n.sourcePreset ? [n.sourcePreset.code] : []))];
+    const presetsByCode = await nodePresetRepo.listByCodes(codes);
+    return c.json(buildUpgradePlan(template, presetsByCode));
+  });
+  app.post("/api/dag/templates/:id/upgrade/apply", zValidator5("json", UpgradeApplyRequestSchema), async (c) => {
+    const id = c.req.param("id");
+    const body = c.req.valid("json");
+    const template = await repo.getById(id);
+    if (!template) throw new NotFoundError7("dag-template", id);
+    assertProjectScope(c, template.projectId);
+    await loadProjectForWrite(projectRepo, template.projectId);
+    const codes = [...new Set(template.nodes.flatMap((n) => n.sourcePreset ? [n.sourcePreset.code] : []))];
+    const presetsByCode = await nodePresetRepo.listByCodes(codes);
+    const outcome = applyUpgradeDecisions(template, presetsByCode, body.decisions);
+    let version = template.version;
+    if (outcome.nextVersion !== null) {
+      const updated = await repo.update(id, { nodes: outcome.nodes, version: outcome.nextVersion });
+      if (!updated) throw new NotFoundError7("dag-template", id);
+      version = updated.version;
+    }
+    return c.json({ template: { id, version }, results: outcome.results });
+  });
+  app.delete("/api/dag/templates/:id", async (c) => {
+    const ref = c.req.param("id");
+    const existing = await resolveTemplateOr404(repo, ref, resolveProjectFilter(c, c.req.query("projectId")), QUERY_PROJECT_HINT);
+    assertProjectScope(c, existing.projectId);
+    const deleted = await repo.delete(existing.id);
+    if (!deleted) throw new NotFoundError7("dag-template", existing.id);
+    return c.body(null, 204);
+  });
+  return app;
+}
+
+// src/routes/node-preset.routes.ts
+import { Hono as Hono8 } from "hono";
+import { zValidator as zValidator6 } from "@hono/zod-validator";
+import { z as z4 } from "zod";
+import {
+  createNodePresetRepo as createNodePresetRepo2,
+  createProjectRepo as createProjectRepo5,
+  NodePresetCreateSchema,
+  NodePresetUpdateSchema,
+  NodePresetCopySchema,
+  AssetSetEnabledSchema as AssetSetEnabledSchema4,
+  NODE_PRESET_CODE_PATTERN,
+  computeNodeContentHash,
+  NotFoundError as NotFoundError8,
+  ConflictError as ConflictError6,
+  ValidationError,
+  BIZ_CODE_MESSAGES as BIZ_CODE_MESSAGES6
+} from "@siming-org/core";
+var NodePresetListQuerySchema = z4.object({
+  projectId: z4.string().optional(),
+  scope: z4.enum(["global", "project"]).optional(),
+  q: z4.string().trim().min(1).max(100).optional(),
+  includeDisabled: z4.stringbool().optional()
+}).superRefine((val, ctx) => {
+  if (val.scope === "project" && val.projectId === void 0) {
+    ctx.addIssue({ code: "custom", path: ["projectId"], message: "scope=project \u65F6 projectId \u5FC5\u586B" });
+  }
+});
+var NodePresetByCodeQuerySchema = z4.object({
+  includeDisabled: z4.stringbool().optional()
+});
+function assertCodeShape(code) {
+  if (!NODE_PRESET_CODE_PATTERN.test(code)) {
+    throw new NotFoundError8("node-preset", code);
+  }
+}
+function nodePresetToListItem(preset) {
+  const { prompt: _prompt, ...rest } = preset;
+  return { ...rest, agents: preset.agents ?? [] };
+}
+var CONTENT_FIELDS = ["nodeId", "phase", "track", "prompt", "skills", "agents", "label"];
+function isContentChange(existing, data) {
+  return CONTENT_FIELDS.some((field) => {
+    const next = data[field];
+    if (next === void 0) return false;
+    const current = existing[field];
+    if (field === "skills" || field === "agents") {
+      const currentItems = current ?? [];
+      return JSON.stringify([...next].sort()) !== JSON.stringify([...currentItems].sort());
+    }
+    return next !== current;
+  });
+}
+function createNodePresetRoutes(client) {
+  const app = new Hono8();
+  const repo = createNodePresetRepo2(client.db());
+  const projectRepo = createProjectRepo5(client.db());
+  app.get("/api/node-presets", zValidator6("query", NodePresetListQuerySchema), async (c) => {
+    const q = c.req.valid("query");
+    const auth = getAuth(c);
+    const filter = { scope: q.scope, projectId: q.projectId, q: q.q, includeDisabled: q.includeDisabled };
+    if (auth.kind === "project") {
+      return c.json(
+        (await repo.listNodePresets({ ...filter, scope: void 0, projectId: auth.projectId })).map(nodePresetToListItem)
+      );
+    }
+    return c.json((await repo.listNodePresets(filter)).map(nodePresetToListItem));
+  });
+  app.get("/api/node-presets/:code/availability", async (c) => {
+    const code = c.req.param("code");
+    assertCodeShape(code);
+    return c.json({ code, available: !await repo.isCodeOccupied(code) });
+  });
+  app.get("/api/node-presets/:code", zValidator6("query", NodePresetByCodeQuerySchema), async (c) => {
+    const code = c.req.param("code");
+    const q = c.req.valid("query");
+    assertCodeShape(code);
+    const preset = await repo.getByCode(code, { includeDisabled: q.includeDisabled });
+    if (!preset) throw new NotFoundError8("node-preset", code);
+    assertProjectVisible(c, preset.projectId);
+    return c.json({ ...preset, agents: preset.agents ?? [], contentHash: computeNodeContentHash(preset) });
+  });
+  app.post("/api/node-presets", zValidator6("json", NodePresetCreateSchema), async (c) => {
+    const data = c.req.valid("json");
+    if (data.scope === "project") {
+      assertProjectScope(c, data.projectId);
+      await loadProjectForWrite(projectRepo, data.projectId);
+    } else {
+      requireAdminLike(c);
+    }
+    const created = await repo.createNodePreset(data);
+    return c.json({ ...created, agents: created.agents ?? [] }, 201);
+  });
+  app.put("/api/node-presets/:code", zValidator6("query", NodePresetByCodeQuerySchema), zValidator6("json", NodePresetUpdateSchema), async (c) => {
+    const code = c.req.param("code");
+    const data = c.req.valid("json");
+    assertCodeShape(code);
+    const existing = await repo.getByCode(code, { includeDisabled: true });
+    if (!existing) throw new NotFoundError8("node-preset", code);
+    if (existing.scope === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
+      await loadProjectForWrite(projectRepo, existing.projectId ?? "");
+    }
+    if (data.code !== void 0 && data.code !== existing.code) {
+      throw new ConflictError6("node-preset", code, {
+        bizCode: "NODE_PRESET_CODE_IMMUTABLE",
+        message: BIZ_CODE_MESSAGES6.NODE_PRESET_CODE_IMMUTABLE
+      });
+    }
+    if (isScopeMutation(existing, data)) {
+      throw new ConflictError6("node-preset", code, {
+        bizCode: "SCOPE_IMMUTABLE",
+        message: BIZ_CODE_MESSAGES6.SCOPE_IMMUTABLE
+      });
+    }
+    if (isContentChange(existing, data) && (data.version === void 0 || data.version === existing.version)) {
+      throw new ValidationError(
+        "\u8282\u70B9\u5185\u5BB9\u53D8\u66F4\u5FC5\u987B\u540C\u6B65\u63D0\u5347\u7248\u672C\u53F7\uFF08\u643A\u5E26\u53D8\u66F4\u5B57\u6BB5\u65F6 version \u5FC5\u586B\u4E14\u4E0D\u5F97\u4E0E\u73B0\u503C\u76F8\u540C\uFF09",
+        [{ path: ["version"], message: "\u5185\u5BB9\u53D8\u66F4\u672A\u5347\u7248" }],
+        {
+          bizCode: "NODE_PRESET_VERSION_REQUIRED",
+          message: BIZ_CODE_MESSAGES6.NODE_PRESET_VERSION_REQUIRED
+        }
+      );
+    }
+    const preset = await repo.updateByCode(code, data);
+    if (!preset) throw new NotFoundError8("node-preset", code);
+    return c.json({ ...preset, agents: preset.agents ?? [] });
+  });
+  app.delete("/api/node-presets/:code", zValidator6("query", NodePresetByCodeQuerySchema), async (c) => {
+    const code = c.req.param("code");
+    assertCodeShape(code);
+    const existing = await repo.getByCode(code, { includeDisabled: true });
+    if (!existing) throw new NotFoundError8("node-preset", code);
+    if (existing.scope === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
+    }
+    const deleted = await repo.deleteByCode(code);
+    if (!deleted) throw new NotFoundError8("node-preset", code);
+    return c.body(null, 204);
+  });
+  app.post("/api/node-presets/:code/enabled", zValidator6("query", NodePresetByCodeQuerySchema), zValidator6("json", AssetSetEnabledSchema4), async (c) => {
+    const code = c.req.param("code");
+    const body = c.req.valid("json");
+    assertCodeShape(code);
+    const existing = await repo.getByCode(code, { includeDisabled: true });
+    if (!existing) throw new NotFoundError8("node-preset", code);
+    if (existing.scope === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
+      await loadProjectForWrite(projectRepo, existing.projectId ?? "");
+    }
+    const preset = await repo.updateByCode(code, { enabled: body.enabled });
+    if (!preset) throw new NotFoundError8("node-preset", code);
+    return c.json({ code: preset.code, enabled: preset.enabled ?? true });
+  });
+  app.post("/api/node-presets/:code/copy", zValidator6("query", NodePresetByCodeQuerySchema), zValidator6("json", NodePresetCopySchema), async (c) => {
+    const code = c.req.param("code");
+    const input = c.req.valid("json");
+    assertCodeShape(code);
+    const existing = await repo.getByCode(code, { includeDisabled: true });
+    if (!existing) throw new NotFoundError8("node-preset", code);
+    assertProjectVisible(c, existing.projectId);
+    if (input.newScope === "project") {
+      assertProjectScope(c, input.targetProjectId);
+      await loadProjectForWrite(projectRepo, input.targetProjectId);
+    } else {
+      requireAdminLike(c);
+    }
+    const copy = await repo.copyNodePreset(
+      code,
+      { scope: input.newScope, ...input.targetProjectId ? { projectId: input.targetProjectId } : {} },
+      input
+    );
+    return c.json({ ...copy, agents: copy.agents ?? [] }, 201);
+  });
+  return app;
+}
+
+// src/routes/node-library.routes.ts
+import { Hono as Hono9 } from "hono";
+import { zValidator as zValidator7 } from "@hono/zod-validator";
+import {
+  createNodeLibraryRepo,
+  createProjectRepo as createProjectRepo6,
+  NodeLibraryUpsertSchema
+} from "@siming-org/core";
+function createNodeLibraryRoutes(client) {
+  const app = new Hono9();
+  const repo = createNodeLibraryRepo(client.db());
+  const projectRepo = createProjectRepo6(client.db());
+  app.get("/api/node-libraries", async (c) => {
+    const auth = getAuth(c);
+    if (auth.kind === "project") {
+      return c.json(await repo.listNodeLibraries({ projectId: auth.projectId }));
+    }
+    return c.json(await repo.listNodeLibraries());
+  });
+  app.post("/api/node-libraries", zValidator7("json", NodeLibraryUpsertSchema), async (c) => {
+    const data = c.req.valid("json");
+    if (data.scope === "project") {
+      assertProjectScope(c, data.projectId);
+      await loadProjectForWrite(projectRepo, data.projectId);
+    } else {
+      requireAdminLike(c);
+    }
+    return c.json(await repo.upsertNodeLibrary(data));
+  });
+  return app;
+}
+
+// src/routes/task.routes.ts
+import { Hono as Hono10 } from "hono";
+import { zValidator as zValidator8 } from "@hono/zod-validator";
+import { z as z5 } from "zod";
+import {
+  createTaskRepo,
+  createDagTemplateRepo as createDagTemplateRepo2,
+  createProjectRepo as createProjectRepo7,
+  TaskCreateInputSchema,
+  AdvanceRequestSchema,
+  ApproveRequestSchema,
+  PauseRequestSchema,
+  ResumeRequestSchema,
+  CancelRequestSchema,
+  taskProgress,
+  excerpt,
+  ContextViewSchema,
+  CONTEXT_VIEWS,
+  ARTIFACT_TYPES,
+  NODE_ID_PATTERN,
+  createEnumRegistryRepo as createEnumRegistryRepo2,
+  NotFoundError as NotFoundError9,
+  ConflictError as ConflictError7,
+  BadRequestError as BadRequestError2,
+  ValidationError as ValidationError2,
+  BIZ_CODE_MESSAGES as BIZ_CODE_MESSAGES7,
+  advanceTask,
+  approveTask,
+  pauseTask,
+  resumeTask,
+  cancelTask,
+  renderPrompt,
+  toNodeInfo,
+  toTaskPublic,
+  findNextEdge,
+  generateEntryId
+} from "@siming-org/core";
+var TaskListQuerySchema = z5.object({
+  status: z5.string().optional(),
+  track: z5.string().optional(),
+  projectId: z5.string().optional(),
+  q: z5.string().trim().min(1).max(100).optional(),
+  page: z5.coerce.number().int().min(1).default(1),
+  limit: z5.coerce.number().int().min(1).max(500).default(20),
+  sort: z5.enum(["progress", "createdAt", "updatedAt"]).optional()
+});
+var TaskPatchSchema = z5.object({
+  title: z5.string().min(1).optional()
+});
+var TaskDocSetSchema = z5.object({
+  what: z5.string().min(1).max(2e3).optional(),
+  why: z5.string().min(1).max(2e3).optional(),
+  trackNote: z5.string().max(2e3).optional()
+});
+var TextItemSchema = z5.object({ text: z5.string().min(1).max(2e3) });
+var RecordSummarySchema = z5.object({ summary: z5.string().min(1).max(2e3) });
+var CheckAddSchema = z5.object({ item: z5.string().min(1).max(2e3), passed: z5.boolean().optional() });
+var CheckPatchSchema = z5.object({ passed: z5.boolean() });
+var ArtifactAddSchema = z5.object({
+  type: z5.enum(ARTIFACT_TYPES),
+  path: z5.string().min(1).max(2e3),
+  note: z5.string().max(2e3).optional(),
+  /** 全文快照（CLI --file 读文件后传入；≤200k——续跑会话凭 context 自足） */
+  content: z5.string().max(2e5).optional()
+});
+var ConfirmAddSchema = z5.object({ quote: z5.string().min(1).max(2e3) });
+var DecisionAddSchema = z5.object({
+  topic: z5.string().min(1).max(2e3),
+  decision: z5.string().min(1).max(2e3)
+});
+var ReviewSetSchema = z5.object({
+  verdict: z5.enum(["pass", "fail"]),
+  rounds: z5.number().int().min(1),
+  critical: z5.number().int().min(0)
+});
+function normalizeTaskDoc(doc) {
+  if (!doc) return null;
+  return { ...doc, acceptance: doc.acceptance ?? [], nonGoals: doc.nonGoals ?? [] };
+}
+function normalizeNodeRecords(records) {
+  const src = records ?? {};
+  const out = {};
+  for (const [nodeId, record] of Object.entries(src)) {
+    if (!record) continue;
+    out[nodeId] = {
+      ...record,
+      checks: record.checks ?? [],
+      artifacts: record.artifacts ?? [],
+      confirmations: record.confirmations ?? [],
+      decisions: record.decisions ?? []
+    };
+  }
+  return out;
+}
+function stripArtifactContent(records) {
+  const out = {};
+  for (const [nodeId, record] of Object.entries(records)) {
+    out[nodeId] = {
+      ...record,
+      artifacts: record.artifacts.map((a) => {
+        if (a.content === void 0) return a;
+        const { content: _stripped, ...rest } = a;
+        return rest;
+      })
+    };
+  }
+  return out;
+}
+function writeAck(entity, updated, entry, echo) {
+  return {
+    taskId: entity.taskId,
+    updated,
+    ...entry !== void 0 ? { entry } : {},
+    ...echo !== void 0 ? { echo } : {},
+    updatedAt: entity.updatedAt ?? /* @__PURE__ */ new Date(),
+    task: { ...toTaskPublic(entity), projectId: entity.projectId, progress: taskProgress(entity) }
+  };
+}
+function createTaskRoutes(client) {
+  const app = new Hono10();
+  const repo = createTaskRepo(client.db());
+  const templateRepo = createDagTemplateRepo2(client.db());
+  const projectRepo = createProjectRepo7(client.db());
+  const enumRegistryRepo = createEnumRegistryRepo2(client.db());
+  app.get("/api/tasks", zValidator8("query", TaskListQuerySchema), async (c) => {
+    const q = c.req.valid("query");
+    const { items, total } = await repo.listTasks({
+      ...q.status ? { status: q.status } : {},
+      ...q.track ? { track: q.track } : {},
+      // T202608310001：project 上下文强制覆写 projectId 过滤（"只能看到自己的"）
+      ...resolveProjectFilter(c, q.projectId) ? { projectId: resolveProjectFilter(c, q.projectId) } : {},
+      ...q.q !== void 0 ? { q: q.q } : {},
+      page: q.page,
+      limit: q.limit,
+      ...q.sort ? { sort: q.sort } : {}
+    });
+    return c.json({ items, total, page: q.page, limit: q.limit });
+  });
+  app.get("/api/tasks/:taskId", async (c) => {
+    const taskId = c.req.param("taskId");
+    const task = await repo.getByTaskId(taskId);
+    if (!task) throw new NotFoundError9("task", taskId);
+    assertProjectScope(c, task.projectId);
+    return c.json({
+      ...task,
+      dagInstance: {
+        ...task.dagInstance,
+        nodes: task.dagInstance.nodes.map((node) => ({ ...node, agents: node.agents ?? [] }))
+      }
+    });
+  });
+  app.post("/api/tasks", zValidator8("json", TaskCreateInputSchema), async (c) => {
+    const input = c.req.valid("json");
+    const dagTracks = (await enumRegistryRepo.getEntries("dag_track")).filter(
+      (e) => e.active && e.value !== "all"
+    );
+    if (!dagTracks.some((e) => e.value === input.track)) {
+      const validValues = dagTracks.map((e) => e.value).join(", ");
+      throw new BadRequestError2(
+        `track '${input.track}' is not a valid active dag_track value. Valid values: ${validValues}`
+      );
+    }
+    assertTypeTrackCompatible(input.type, input.track);
+    const template = await resolveTemplateOr404(
+      templateRepo,
+      input.dagTemplateId,
+      resolveProjectFilter(c, input.projectId),
+      "\uFF08code \u5F62\u6001\u5BFB\u5740\u9700 body \u643A\u5E26 projectId \u6307\u5B9A\u9879\u76EE\u2014\u2014code \u9879\u76EE\u5185\u552F\u4E00\uFF0C\u65E0\u9879\u76EE\u57DF\u4E0D\u53EF\u6D88\u6B67\uFF1B\u6216\u6539\u4F20 24 \u4F4D\u6570\u636E\u5E93 id\uFF09"
+    );
+    if (template.enabled === false) {
+      throw new ConflictError7("task", input.dagTemplateId, {
+        bizCode: "TEMPLATE_DISABLED",
+        message: BIZ_CODE_MESSAGES7.TEMPLATE_DISABLED
+      });
+    }
+    if (input.projectId && input.projectId !== template.projectId) {
+      throw new ConflictError7("task", input.dagTemplateId, {
+        bizCode: "TEMPLATE_PROJECT_MISMATCH",
+        message: BIZ_CODE_MESSAGES7.TEMPLATE_PROJECT_MISMATCH
+      });
+    }
+    const resolvedProjectId = input.projectId ?? template.projectId;
+    assertProjectScope(c, resolvedProjectId);
+    await loadProjectForWrite(projectRepo, resolvedProjectId);
+    const created = await repo.createTask(input, template, resolvedProjectId);
+    const firstActive = created.dagInstance.nodes.find(
+      (n) => created.dagInstance.nodeStates[n.id]?.status === "active"
+    );
+    if (!firstActive) {
+      throw new BadRequestError2(
+        `task has no active node to start (all nodes pruned by skipNodes); \u6A21\u677F ${template.name} \u526A\u679D\u540E\u65E0\u53EF\u5F00\u5DE5\u8282\u70B9\uFF0C\u521B\u5EFA\u88AB\u62D2\u7EDD`
+      );
+    }
+    const response = {
+      task: { ...toTaskPublic(created), projectId: created.projectId, progress: taskProgress(created) },
+      firstNode: toNodeInfo(firstActive, created)
+    };
+    return c.json(response, 201);
+  });
+  app.patch("/api/tasks/:taskId", zValidator8("json", TaskPatchSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const body = c.req.valid("json");
+    if (body.title === void 0) {
+      throw new BadRequestError2("PATCH /api/tasks/:taskId \u9700\u8981\u81F3\u5C11\u4E00\u4E2A\u53EF\u66F4\u65B0\u5B57\u6BB5\uFF08title\uFF09");
+    }
+    await assertTaskProjectActive(repo, projectRepo, taskId, c);
+    const patch = { title: body.title };
+    const updatedTask = await repo.updateTask(taskId, patch);
+    return c.json(
+      writeAck(updatedTask, ["title"], void 0, [{ path: "title", excerpt: excerpt(updatedTask.title) }])
+    );
+  });
+  app.post("/api/tasks/:taskId/advance", zValidator8("json", AdvanceRequestSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const body = c.req.valid("json");
+    await assertTaskProjectActive(repo, projectRepo, taskId, c);
+    const deps = mkDeps(repo);
+    const result = await advanceTask(deps, taskId, {
+      ...body.note !== void 0 ? { note: body.note } : {},
+      ...body.summary !== void 0 ? { summary: body.summary } : {}
+    });
+    return c.json(result, 200);
+  });
+  app.post("/api/tasks/:taskId/approve", zValidator8("json", ApproveRequestSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const body = c.req.valid("json");
+    await assertTaskProjectActive(repo, projectRepo, taskId, c);
+    const deps = mkDeps(repo);
+    const result = await approveTask(deps, taskId, body);
+    return c.json(result, 200);
+  });
+  app.post("/api/tasks/:taskId/pause", zValidator8("json", PauseRequestSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const body = c.req.valid("json");
+    await assertTaskProjectActive(repo, projectRepo, taskId, c);
+    const result = await pauseTask(mkDeps(repo), taskId, body.reason);
+    return c.json(writeAck(result, ["status", "pausedAt"], void 0, [{ path: "status", excerpt: result.status }]));
+  });
+  app.post("/api/tasks/:taskId/resume", zValidator8("json", ResumeRequestSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const body = c.req.valid("json");
+    await assertTaskProjectActive(repo, projectRepo, taskId, c);
+    const result = await resumeTask(mkDeps(repo), taskId, body.decision);
+    return c.json(writeAck(result, ["status"], void 0, [{ path: "status", excerpt: `${result.status}\uFF08\u5DF2\u6062\u590D\u624B\u52A8\u6682\u505C\uFF09` }]));
+  });
+  app.post("/api/tasks/:taskId/cancel", zValidator8("json", CancelRequestSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const body = c.req.valid("json");
+    await assertTaskProjectActive(repo, projectRepo, taskId, c);
+    const result = await cancelTask(mkDeps(repo), taskId, body.reason);
+    return c.json(
+      writeAck(
+        result,
+        ["status", "pausedAt"],
+        void 0,
+        [
+          { path: "status", excerpt: result.status },
+          ...body.reason !== void 0 ? [{ path: "history.reason", excerpt: excerpt(body.reason) }] : []
+        ]
+      )
+    );
+  });
+  app.get("/api/tasks/:taskId/history", async (c) => {
+    const taskId = c.req.param("taskId");
+    const task = await repo.getByTaskId(taskId);
+    if (!task) throw new NotFoundError9("task", taskId);
+    assertProjectScope(c, task.projectId);
+    return c.json(task.history);
+  });
+  app.get("/api/tasks/:taskId/node/:nodeId", async (c) => {
+    const taskId = c.req.param("taskId");
+    const nodeId = c.req.param("nodeId");
+    const task = await repo.getByTaskId(taskId);
+    if (!task) throw new NotFoundError9("task", taskId);
+    assertProjectScope(c, task.projectId);
+    const node = task.dagInstance.nodes.find((n) => n.id === nodeId);
+    if (!node) throw new NotFoundError9("node", nodeId);
+    return c.json({
+      ...node,
+      skills: node.skills ?? [],
+      agents: node.agents ?? [],
+      prompt: renderPrompt(node.prompt, task)
+    });
+  });
+  app.get("/api/tasks/:taskId/context", async (c) => {
+    const taskId = c.req.param("taskId");
+    const viewR = ContextViewSchema.safeParse(c.req.query("view") ?? "basic");
+    if (!viewR.success) {
+      throw new BadRequestError2(
+        `context view '${c.req.query("view")}' is invalid. Valid values: ${CONTEXT_VIEWS.join(", ")}`
+      );
+    }
+    const view = viewR.data;
+    const task = await repo.getByTaskId(taskId);
+    if (!task) throw new NotFoundError9("task", taskId);
+    assertProjectScope(c, task.projectId);
+    const currentNodeActive = task.status === "active" ? task.dagInstance.nodes.find((n) => n.id === task.currentNode) : void 0;
+    let pausedAtEdge = null;
+    if (task.status === "paused" && task.pausedAt !== null) {
+      const edge = findNextEdge(task.dagInstance.edges, task.dagInstance.nodes, task.pausedAt, task.track);
+      if (edge?.pausePoint) {
+        pausedAtEdge = { from: edge.from, to: edge.to, pausePoint: edge.pausePoint };
+      }
+    }
+    const context = {
+      task: toTaskPublic(task),
+      currentNode: currentNodeActive ? {
+        ...toNodeInfo(currentNodeActive, task),
+        phase: currentNodeActive.phase
+      } : null,
+      pausedAtEdge,
+      nodes: task.dagInstance.nodes.map((n) => {
+        const state = task.dagInstance.nodeStates[n.id];
+        return {
+          nodeId: n.id,
+          label: n.label,
+          status: state?.status ?? "pending",
+          enteredAt: state?.enteredAt ?? null,
+          completedAt: state?.completedAt ?? null
+        };
+      }),
+      // N020 D1：结构化全景（断点续跑数据源）；?? 容错迁移前旧文档与小步写入的部分形态
+      // （toEntity 不跑 parse 补 default——点路径 $set/$push 只写触及字段，record/doc 内数组
+      // 可能缺键，读侧按字段归一到 schema 目标形状，Web/CLI 消费方拿到的恒为完整形）
+      taskDoc: normalizeTaskDoc(task.doc),
+      nodeRecords: view === "basic" ? stripArtifactContent(normalizeNodeRecords(task.nodeRecords)) : normalizeNodeRecords(task.nodeRecords),
+      archNotes: task.archNotes ?? []
+    };
+    return c.json(context);
+  });
+  app.patch("/api/tasks/:taskId/doc", zValidator8("json", TaskDocSetSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const body = c.req.valid("json");
+    await loadTaskForRecordWrite(repo, projectRepo, taskId, void 0, c);
+    const sets = {};
+    if (body.what !== void 0) sets["doc.what"] = body.what;
+    if (body.why !== void 0) sets["doc.why"] = body.why;
+    if (body.trackNote !== void 0) sets["doc.trackNote"] = body.trackNote;
+    const updatedDoc = await repo.updateTaskPaths(taskId, { sets });
+    return c.json(
+      writeAck(
+        updatedDoc,
+        Object.keys(sets),
+        void 0,
+        Object.entries(sets).map(([path, value]) => ({ path, excerpt: excerpt(String(value)) }))
+      )
+    );
+  });
+  app.post("/api/tasks/:taskId/doc/acceptance", zValidator8("json", TextItemSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const body = c.req.valid("json");
+    await loadTaskForRecordWrite(repo, projectRepo, taskId, void 0, c);
+    const updatedAcc = await repo.updateTaskPaths(taskId, { pushes: { "doc.acceptance": body.text } });
+    return c.json(
+      writeAck(updatedAcc, ["doc.acceptance"], void 0, [
+        { path: "doc.acceptance", excerpt: excerpt(body.text) }
+      ])
+    );
+  });
+  app.post("/api/tasks/:taskId/doc/non-goal", zValidator8("json", TextItemSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const body = c.req.valid("json");
+    await loadTaskForRecordWrite(repo, projectRepo, taskId, void 0, c);
+    const updatedNg = await repo.updateTaskPaths(taskId, { pushes: { "doc.nonGoals": body.text } });
+    return c.json(
+      writeAck(updatedNg, ["doc.nonGoals"], void 0, [{ path: "doc.nonGoals", excerpt: excerpt(body.text) }])
+    );
+  });
+  app.patch("/api/tasks/:taskId/records/:nodeId/summary", zValidator8("json", RecordSummarySchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const nodeId = c.req.param("nodeId");
+    const body = c.req.valid("json");
+    await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
+    const updatedSummary = await repo.updateTaskPaths(taskId, {
+      sets: { [`nodeRecords.${nodeId}.summary`]: body.summary }
+    });
+    return c.json(
+      writeAck(updatedSummary, [`nodeRecords.${nodeId}.summary`], void 0, [
+        { path: `nodeRecords.${nodeId}.summary`, excerpt: excerpt(body.summary) }
+      ])
+    );
+  });
+  app.post("/api/tasks/:taskId/records/:nodeId/checks", zValidator8("json", CheckAddSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const nodeId = c.req.param("nodeId");
+    const body = c.req.valid("json");
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
+    const existing = (task.nodeRecords ?? {})[nodeId]?.checks ?? [];
+    const check = {
+      id: generateEntryId(existing.map((ch) => ch.id)),
+      item: body.item,
+      passed: body.passed ?? true
+    };
+    const updatedCheck = await repo.updateTaskPaths(taskId, {
+      pushes: { [`nodeRecords.${nodeId}.checks`]: check }
+    });
+    return c.json(
+      writeAck(
+        updatedCheck,
+        [`nodeRecords.${nodeId}.checks`],
+        { id: check.id, kind: "check" },
+        [{ path: `nodeRecords.${nodeId}.checks`, excerpt: excerpt(`${check.item}\uFF08passed=${String(check.passed)}\uFF09`) }]
+      )
+    );
+  });
+  app.patch("/api/tasks/:taskId/records/:nodeId/checks/:checkId", zValidator8("json", CheckPatchSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const nodeId = c.req.param("nodeId");
+    const checkId = c.req.param("checkId");
+    const body = c.req.valid("json");
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
+    const check = ((task.nodeRecords ?? {})[nodeId]?.checks ?? []).find((ch) => ch.id === checkId);
+    if (!check) {
+      throw new NotFoundError9("check", checkId, {
+        bizCode: "CHECK_NOT_FOUND",
+        message: `${BIZ_CODE_MESSAGES7.CHECK_NOT_FOUND}\uFF08node ${nodeId}, check ${checkId}\uFF09`
+      });
+    }
+    const updatedFlip = await repo.updateTaskPaths(taskId, {
+      sets: { [`nodeRecords.${nodeId}.checks.$[e].passed`]: body.passed },
+      arrayFilters: [{ "e.id": checkId }]
+    });
+    return c.json(
+      writeAck(updatedFlip, [`nodeRecords.${nodeId}.checks.${checkId}.passed`], void 0, [
+        { path: `nodeRecords.${nodeId}.checks.${checkId}.passed`, excerpt: String(body.passed) }
+      ])
+    );
+  });
+  app.post("/api/tasks/:taskId/records/:nodeId/artifacts", zValidator8("json", ArtifactAddSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const nodeId = c.req.param("nodeId");
+    const body = c.req.valid("json");
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
+    const artifact = {
+      id: generateEntryId(((task.nodeRecords ?? {})[nodeId]?.artifacts ?? []).map((a) => a.id)),
+      type: body.type,
+      path: body.path,
+      ...body.note !== void 0 ? { note: body.note } : {},
+      ...body.content !== void 0 ? { content: body.content } : {}
+    };
+    const updatedArtifact = await repo.updateTaskPaths(taskId, {
+      pushes: { [`nodeRecords.${nodeId}.artifacts`]: artifact }
+    });
+    return c.json(
+      writeAck(
+        updatedArtifact,
+        [`nodeRecords.${nodeId}.artifacts`],
+        { id: artifact.id, kind: "artifact" },
+        [
+          {
+            path: `nodeRecords.${nodeId}.artifacts`,
+            excerpt: excerpt(
+              `${artifact.type} ${artifact.path}${body.content !== void 0 ? `\uFF08\u542B\u5168\u6587\u5FEB\u7167 ${body.content.length} \u5B57\u7B26\uFF09` : ""}`
+            )
+          }
+        ]
+      )
+    );
+  });
+  app.post("/api/tasks/:taskId/records/:nodeId/confirmations", zValidator8("json", ConfirmAddSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const nodeId = c.req.param("nodeId");
+    const body = c.req.valid("json");
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
+    const confirmation = {
+      id: generateEntryId(((task.nodeRecords ?? {})[nodeId]?.confirmations ?? []).map((cf) => cf.id)),
+      quote: body.quote,
+      at: /* @__PURE__ */ new Date()
+    };
+    const updatedConfirm = await repo.updateTaskPaths(taskId, {
+      pushes: { [`nodeRecords.${nodeId}.confirmations`]: confirmation }
+    });
+    return c.json(
+      writeAck(updatedConfirm, [`nodeRecords.${nodeId}.confirmations`], { id: confirmation.id, kind: "confirmation" }, [
+        { path: `nodeRecords.${nodeId}.confirmations`, excerpt: excerpt(confirmation.quote) }
+      ])
+    );
+  });
+  app.post("/api/tasks/:taskId/records/:nodeId/decisions", zValidator8("json", DecisionAddSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const nodeId = c.req.param("nodeId");
+    const body = c.req.valid("json");
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
+    const decision = {
+      id: generateEntryId(((task.nodeRecords ?? {})[nodeId]?.decisions ?? []).map((d) => d.id)),
+      topic: body.topic,
+      decision: body.decision
+    };
+    const updatedDecision = await repo.updateTaskPaths(taskId, {
+      pushes: { [`nodeRecords.${nodeId}.decisions`]: decision }
+    });
+    return c.json(
+      writeAck(updatedDecision, [`nodeRecords.${nodeId}.decisions`], { id: decision.id, kind: "decision" }, [
+        { path: `nodeRecords.${nodeId}.decisions`, excerpt: excerpt(`${decision.topic}: ${decision.decision}`) }
+      ])
+    );
+  });
+  app.put("/api/tasks/:taskId/records/:nodeId/review", zValidator8("json", ReviewSetSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const nodeId = c.req.param("nodeId");
+    const body = c.req.valid("json");
+    await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
+    const updatedReview = await repo.updateTaskPaths(taskId, {
+      sets: { [`nodeRecords.${nodeId}.review`]: body }
+    });
+    return c.json(
+      writeAck(updatedReview, [`nodeRecords.${nodeId}.review`], void 0, [
+        { path: `nodeRecords.${nodeId}.review`, excerpt: `${body.verdict}\uFF08rounds=${String(body.rounds)}, critical=${String(body.critical)}\uFF09` }
+      ])
+    );
+  });
+  app.post("/api/tasks/:taskId/archnotes", zValidator8("json", TextItemSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const body = c.req.valid("json");
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, void 0, c);
+    const note = { id: generateEntryId((task.archNotes ?? []).map((n) => n.id)), text: body.text, at: /* @__PURE__ */ new Date() };
+    const updatedNote = await repo.updateTaskPaths(taskId, { pushes: { archNotes: note } });
+    return c.json(
+      writeAck(updatedNote, ["archNotes"], { id: note.id, kind: "archnote" }, [
+        { path: "archNotes", excerpt: excerpt(note.text) }
+      ])
+    );
+  });
+  return app;
+}
+function assertTypeTrackCompatible(type, track) {
+  const mismatch = (reason) => new ValidationError2(
+    reason,
+    [{ code: "custom", path: ["type"], message: reason }],
+    { bizCode: "TASK_TYPE_TRACK_MISMATCH", message: reason }
+  );
+  if (track === "research") {
+    if (type !== "research") {
+      throw mismatch(`track=research \u4E3A\u8C03\u7814\u7C7B\u578B\u4E13\u7528\u8F68\u9053\u503C\uFF0C\u987B\u914D --type research\uFF08\u5F53\u524D type=${type ?? "\u672A\u6307\u5B9A"}\uFF09`);
+    }
+    return;
+  }
+  if (type === void 0) return;
+  if (type === "research") {
+    throw mismatch(`type=research \u987B\u914D track=research\uFF08\u5F53\u524D track=${track}\uFF09`);
+  }
+  if (type === "ui-tweak" && track !== "ui") {
+    throw mismatch(`UI \u5FAE\u8C03\uFF08ui-tweak\uFF09\u4EC5\u9002\u7528 ui \u8F68\u9053\uFF08\u5F53\u524D track=${track}\uFF09`);
+  }
+}
+function mkDeps(repo) {
+  return {
+    getTask: repo.getByTaskId.bind(repo),
+    updateTask: repo.updateTask.bind(repo)
+  };
+}
+async function assertTaskProjectActive(repo, projectRepo, taskId, c) {
+  const task = await repo.getByTaskId(taskId);
+  if (!task) throw new NotFoundError9("task", taskId);
+  assertProjectScope(c, task.projectId);
+  await loadProjectForWrite(projectRepo, task.projectId);
+}
+async function loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c) {
+  const task = await repo.getByTaskId(taskId);
+  if (!task) throw new NotFoundError9("task", taskId);
+  assertProjectScope(c, task.projectId);
+  await loadProjectForWrite(projectRepo, task.projectId);
+  if (task.status === "completed" || task.status === "cancelled") {
+    throw new BadRequestError2(
+      `Task '${taskId}' is ${task.status} \u2014 task records are read-only after termination`,
+      void 0,
+      { bizCode: "TASK_TERMINATED", message: `${BIZ_CODE_MESSAGES7.TASK_TERMINATED}\uFF08status: ${task.status}\uFF09` }
+    );
+  }
+  if (nodeId === void 0) return task;
+  if (!NODE_ID_PATTERN.test(nodeId)) {
+    throw new BadRequestError2(`nodeId '${nodeId}' \u975E\u6CD5\uFF08\u53EA\u5141\u8BB8\u5B57\u6BCD/\u6570\u5B57/\u4E0B\u5212\u7EBF/\u8FDE\u5B57\u7B26\uFF09`, "nodeId");
+  }
+  const node = task.dagInstance.nodes.find((n) => n.id === nodeId);
+  if (!node) {
+    throw new NotFoundError9("node", nodeId, {
+      bizCode: "NODE_NOT_IN_INSTANCE",
+      message: `${BIZ_CODE_MESSAGES7.NODE_NOT_IN_INSTANCE}\uFF08nodeId: ${nodeId}\uFF09`
+    });
+  }
+  const state = task.dagInstance.nodeStates[nodeId];
+  if (state?.status !== "active" && state?.status !== "completed") {
+    throw new BadRequestError2(
+      `Node '${nodeId}' record is not writable (state '${state?.status ?? "pending"}') \u2014 flow has not reached this node`,
+      void 0,
+      {
+        bizCode: "NODE_RECORD_NOT_WRITABLE",
+        message: `${BIZ_CODE_MESSAGES7.NODE_RECORD_NOT_WRITABLE}\uFF08${nodeId}: ${state?.status ?? "pending"}\uFF09`
+      }
+    );
+  }
+  return task;
+}
+
+// src/routes/task-batch.routes.ts
+import { Hono as Hono11 } from "hono";
+import { zValidator as zValidator9 } from "@hono/zod-validator";
+import { z as z6 } from "zod";
+import {
+  createTaskRepo as createTaskRepo2,
+  createProjectRepo as createProjectRepo8,
+  ValidationError as ValidationError3,
+  BIZ_CODE_MESSAGES as BIZ_CODE_MESSAGES8,
+  toTaskPublic as toTaskPublic2,
+  taskProgress as taskProgress2,
+  generateEntryId as generateEntryId2
+} from "@siming-org/core";
+var BATCH_LIMIT = 50;
+var ARTIFACT_BATCH_CONTENT_LIMIT = 2e6;
+var BatchTextSchema = z6.string().min(1).max(2e3);
+var ObjectItemsSchema = z6.object({ items: z6.array(z6.record(z6.string(), z6.unknown())) });
+var StringItemsSchema = z6.object({ items: z6.array(z6.string()) });
+function zodIssueToMessage(issue) {
+  const shape = issue;
+  switch (issue.code) {
+    case "too_small":
+      return `\u957F\u5EA6\u4E0D\u8DB3\uFF08\u6700\u5C0F ${String(shape.minimum)}\uFF09`;
+    case "too_big":
+      return `\u8D85\u51FA\u4E0A\u9650\uFF08\u6700\u5927 ${String(shape.maximum)}\uFF09`;
+    case "invalid_type":
+      return `\u7C7B\u578B\u4E0D\u5339\u914D\uFF08\u671F\u671B ${String(shape.expected)}\uFF09`;
+    case "invalid_value":
+      return `\u503C\u4E0D\u5408\u6CD5\uFF08${issue.message}\uFF09`;
+    default:
+      return issue.message;
+  }
+}
+function partitionItems(items, schema) {
+  const ok = [];
+  const bad = [];
+  items.forEach((item, index) => {
+    const r = schema.safeParse(item);
+    if (r.success) {
+      ok.push({ index, data: r.data });
+    } else {
+      const issue = r.error.issues[0];
+      const loc = issue !== void 0 && issue.path.length > 0 ? `${issue.path.join(".")}: ` : "";
+      bad.push({ index, message: `${loc}${issue !== void 0 ? zodIssueToMessage(issue) : "\u6761\u76EE\u683C\u5F0F\u4E0D\u5408\u6CD5"}` });
+    }
+  });
+  return { ok, bad };
+}
+function assertBatchSize(items) {
+  if (items.length === 0) {
+    throw new ValidationError3(BIZ_CODE_MESSAGES8.BATCH_EMPTY, [], { bizCode: "BATCH_EMPTY" });
+  }
+  if (items.length > BATCH_LIMIT) {
+    throw new ValidationError3(BIZ_CODE_MESSAGES8.BATCH_LIMIT_EXCEEDED, [], {
+      bizCode: "BATCH_LIMIT_EXCEEDED"
+    });
+  }
+}
+function batchAck(entity, updated, entries, failures) {
+  const applied = entries.length;
+  return {
+    taskId: entity.taskId,
+    applied,
+    updated: applied > 0 ? updated : [],
+    entries,
+    failures,
+    updatedAt: entity.updatedAt ?? /* @__PURE__ */ new Date(),
+    task: { ...toTaskPublic2(entity), projectId: entity.projectId, progress: taskProgress2(entity) }
+  };
+}
+function createTaskBatchRoutes(client) {
+  const app = new Hono11();
+  const repo = createTaskRepo2(client.db());
+  const projectRepo = createProjectRepo8(client.db());
+  app.post("/api/tasks/:taskId/records/:nodeId/checks/batch", zValidator9("json", ObjectItemsSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const nodeId = c.req.param("nodeId");
+    const { items } = c.req.valid("json");
+    assertBatchSize(items);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
+    const { ok, bad } = partitionItems(items, CheckAddSchema);
+    const idSeq = ((task.nodeRecords ?? {})[nodeId]?.checks ?? []).map((ch) => ch.id);
+    const checks = [];
+    const entries = [];
+    for (const { index, data } of ok) {
+      const check = { id: generateEntryId2(idSeq), item: data.item, passed: data.passed ?? true };
+      idSeq.push(check.id);
+      checks.push(check);
+      entries.push({ index, id: check.id, kind: "check" });
+    }
+    if (checks.length === 0) {
+      return c.json(batchAck(task, [`nodeRecords.${nodeId}.checks`], entries, bad));
+    }
+    const updated = await repo.updateTaskPaths(taskId, {
+      pushes: { [`nodeRecords.${nodeId}.checks`]: { $each: checks } }
+    });
+    return c.json(batchAck(updated, [`nodeRecords.${nodeId}.checks`], entries, bad));
+  });
+  app.post("/api/tasks/:taskId/records/:nodeId/artifacts/batch", zValidator9("json", ObjectItemsSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const nodeId = c.req.param("nodeId");
+    const { items } = c.req.valid("json");
+    assertBatchSize(items);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
+    const { ok, bad } = partitionItems(items, ArtifactAddSchema);
+    const totalContent = ok.reduce((sum, { data }) => sum + (data.content?.length ?? 0), 0);
+    if (totalContent > ARTIFACT_BATCH_CONTENT_LIMIT) {
+      throw new ValidationError3(BIZ_CODE_MESSAGES8.BATCH_PAYLOAD_TOO_LARGE, [], {
+        bizCode: "BATCH_PAYLOAD_TOO_LARGE"
+      });
+    }
+    const idSeq = ((task.nodeRecords ?? {})[nodeId]?.artifacts ?? []).map((a) => a.id);
+    const artifacts = [];
+    const entries = [];
+    for (const { index, data } of ok) {
+      const artifact = {
+        id: generateEntryId2(idSeq),
+        type: data.type,
+        path: data.path,
+        ...data.note !== void 0 ? { note: data.note } : {},
+        ...data.content !== void 0 ? { content: data.content } : {}
+      };
+      idSeq.push(artifact.id);
+      artifacts.push(artifact);
+      entries.push({ index, id: artifact.id, kind: "artifact" });
+    }
+    if (artifacts.length === 0) {
+      return c.json(batchAck(task, [`nodeRecords.${nodeId}.artifacts`], entries, bad));
+    }
+    const updated = await repo.updateTaskPaths(taskId, {
+      pushes: { [`nodeRecords.${nodeId}.artifacts`]: { $each: artifacts } }
+    });
+    return c.json(batchAck(updated, [`nodeRecords.${nodeId}.artifacts`], entries, bad));
+  });
+  app.post("/api/tasks/:taskId/records/:nodeId/decisions/batch", zValidator9("json", ObjectItemsSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const nodeId = c.req.param("nodeId");
+    const { items } = c.req.valid("json");
+    assertBatchSize(items);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
+    const { ok, bad } = partitionItems(items, DecisionAddSchema);
+    const idSeq = ((task.nodeRecords ?? {})[nodeId]?.decisions ?? []).map((d) => d.id);
+    const decisions = [];
+    const entries = [];
+    for (const { index, data } of ok) {
+      const decision = { id: generateEntryId2(idSeq), topic: data.topic, decision: data.decision };
+      idSeq.push(decision.id);
+      decisions.push(decision);
+      entries.push({ index, id: decision.id, kind: "decision" });
+    }
+    if (decisions.length === 0) {
+      return c.json(batchAck(task, [`nodeRecords.${nodeId}.decisions`], entries, bad));
+    }
+    const updated = await repo.updateTaskPaths(taskId, {
+      pushes: { [`nodeRecords.${nodeId}.decisions`]: { $each: decisions } }
+    });
+    return c.json(batchAck(updated, [`nodeRecords.${nodeId}.decisions`], entries, bad));
+  });
+  app.post("/api/tasks/:taskId/doc/acceptance/batch", zValidator9("json", StringItemsSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const { items } = c.req.valid("json");
+    assertBatchSize(items);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, void 0, c);
+    const { ok, bad } = partitionItems(items, BatchTextSchema);
+    const entries = ok.map(({ index }) => ({ index }));
+    if (ok.length === 0) {
+      return c.json(batchAck(task, ["doc.acceptance"], entries, bad));
+    }
+    const updated = await repo.updateTaskPaths(taskId, {
+      pushes: { "doc.acceptance": { $each: ok.map(({ data }) => data) } }
+    });
+    return c.json(batchAck(updated, ["doc.acceptance"], entries, bad));
+  });
+  app.post("/api/tasks/:taskId/doc/non-goal/batch", zValidator9("json", StringItemsSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const { items } = c.req.valid("json");
+    assertBatchSize(items);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, void 0, c);
+    const { ok, bad } = partitionItems(items, BatchTextSchema);
+    const entries = ok.map(({ index }) => ({ index }));
+    if (ok.length === 0) {
+      return c.json(batchAck(task, ["doc.nonGoals"], entries, bad));
+    }
+    const updated = await repo.updateTaskPaths(taskId, {
+      pushes: { "doc.nonGoals": { $each: ok.map(({ data }) => data) } }
+    });
+    return c.json(batchAck(updated, ["doc.nonGoals"], entries, bad));
+  });
+  app.post("/api/tasks/:taskId/archnotes/batch", zValidator9("json", StringItemsSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const { items } = c.req.valid("json");
+    assertBatchSize(items);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, void 0, c);
+    const { ok, bad } = partitionItems(items, BatchTextSchema);
+    const idSeq = (task.archNotes ?? []).map((n) => n.id);
+    const notes = [];
+    const entries = [];
+    for (const { index, data } of ok) {
+      const note = { id: generateEntryId2(idSeq), text: data, at: /* @__PURE__ */ new Date() };
+      idSeq.push(note.id);
+      notes.push(note);
+      entries.push({ index, id: note.id, kind: "archnote" });
+    }
+    if (notes.length === 0) {
+      return c.json(batchAck(task, ["archNotes"], entries, bad));
+    }
+    const updated = await repo.updateTaskPaths(taskId, {
+      pushes: { archNotes: { $each: notes } }
+    });
+    return c.json(batchAck(updated, ["archNotes"], entries, bad));
+  });
+  return app;
+}
+
+// src/routes/settings.routes.ts
+import { Hono as Hono12 } from "hono";
+import { zValidator as zValidator10 } from "@hono/zod-validator";
+import { z as z7 } from "zod";
+import {
+  createEnumRegistryRepo as createEnumRegistryRepo3,
+  EnumRegistryUpdateSchema,
+  NotFoundError as NotFoundError10
+} from "@siming-org/core";
+function createSettingsRoutes(client) {
+  const app = new Hono12();
+  const repo = createEnumRegistryRepo3(client.db());
+  app.get("/api/settings/enums", async (c) => {
+    return c.json(await repo.listRegistries());
+  });
+  app.get(
+    "/api/settings/enums/:category",
+    zValidator10("param", z7.object({ category: z7.string() })),
+    async (c) => {
+      const { category } = c.req.valid("param");
+      const registry = await repo.getRegistry(category);
+      if (!registry) throw new NotFoundError10("enum-registry", category);
+      return c.json(registry);
+    }
+  );
+  app.put(
+    "/api/settings/enums/:category",
+    zValidator10("param", z7.object({ category: z7.string() })),
+    zValidator10("json", EnumRegistryUpdateSchema),
+    async (c) => {
+      const { category } = c.req.valid("param");
+      const data = c.req.valid("json");
+      const registry = await repo.updateRegistry(category, data);
+      if (!registry) throw new NotFoundError10("enum-registry", category);
+      return c.json(registry);
+    }
+  );
+  app.delete(
+    "/api/settings/enums/:category/entries/:value",
+    zValidator10("param", z7.object({ category: z7.string(), value: z7.string().min(1) })),
+    async (c) => {
+      const { category, value } = c.req.valid("param");
+      const deleted = await repo.deleteEntry(category, value);
+      if (!deleted) throw new NotFoundError10("enum-registry", category);
+      return c.body(null, 204);
+    }
+  );
+  return app;
+}
+
+// src/routes/index.ts
+function createRoutes(client) {
+  const router = new Hono13();
+  router.route("/", createHealth(client));
+  router.route("/", createProjectRoutes(client));
+  router.route("/", createSkillRoutes(client));
+  router.route("/", createAgentRoutes(client));
+  router.route("/", createModelAliasRoutes(client));
+  router.route("/", createDagTemplateRoutes(client));
+  router.route("/", createNodePresetRoutes(client));
+  router.route("/", createNodeLibraryRoutes(client));
+  router.route("/", createTaskRoutes(client));
+  router.route("/", createTaskBatchRoutes(client));
+  router.route("/", createSettingsRoutes(client));
+  return router;
+}
+
+// src/routes/auth.routes.ts
+import { Hono as Hono14 } from "hono";
+import { zValidator as zValidator11 } from "@hono/zod-validator";
+import {
+  createAuthAccountRepo,
+  createAuthTokenRepo as createAuthTokenRepo2,
+  createAuthSessionRepo as createAuthSessionRepo2,
+  createProjectRepo as createProjectRepo9,
+  hashPassword,
+  verifyPassword,
+  generateToken,
+  generateSessionId,
+  hashToken as hashToken2,
+  AuthAccountCreateSchema,
+  LoginSchema,
+  PasswordChangeSchema,
+  ConflictError as ConflictError8,
+  NotFoundError as NotFoundError11
+} from "@siming-org/core";
+var DUMMY_PASSWORD_HASH = await hashPassword("timing-equalizer-dummy");
+function createAuthRoutes(client, deps) {
+  const app = new Hono14();
+  const accountRepo = createAuthAccountRepo(client.db());
+  const tokenRepo = createAuthTokenRepo2(client.db());
+  const sessionRepo = createAuthSessionRepo2(client.db());
+  const projectRepo = createProjectRepo9(client.db());
+  function setSessionCookie(c, sessionId) {
+    c.header("Set-Cookie", `${SESSION_COOKIE_NAME}=${sessionId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${Math.floor(SESSION_TTL_MS / 1e3)}`);
+  }
+  function clearSessionCookie(c) {
+    c.header("Set-Cookie", `${SESSION_COOKIE_NAME}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);
+  }
+  app.get("/api/auth/status", async (c) => {
+    const account = await accountRepo.getAccount();
+    return c.json({ authEnabled: deps.authEnabled, needsSetup: deps.authEnabled && account === null });
+  });
+  const whoamiHandler = async (c) => {
+    const auth = getAuth(c);
+    const base = { authEnabled: deps.authEnabled, server: { url: new URL(c.req.url).origin } };
+    if (!deps.authEnabled || auth.kind === "open" || auth.kind === "none") {
+      return c.json({ ...base, identity: "none", project: null });
+    }
+    if (auth.kind === "admin") {
+      return c.json({ ...base, identity: "admin", project: null });
+    }
+    const project = await projectRepo.getById(auth.projectId);
+    return c.json({
+      ...base,
+      identity: "project",
+      project: project ? { id: project.id ?? auth.projectId, key: project.key, name: project.name } : null
+    });
+  };
+  app.get("/api/auth/whoami", whoamiHandler);
+  app.post("/api/auth/whoami", whoamiHandler);
+  const v422 = (schema) => zValidator11("json", schema, (result, c) => {
+    if (!result.success) {
+      return c.json({ error: "validation_error", message: "\u683C\u5F0F\u4E0D\u7B26", issues: result.error.issues }, 422);
+    }
+    return void 0;
+  });
+  app.post("/api/auth/setup", v422(AuthAccountCreateSchema), async (c) => {
+    const body = c.req.valid("json");
+    const existing = await accountRepo.getAccount();
+    if (existing) {
+      throw new ConflictError8("auth-account", existing.id ?? "unknown", {
+        bizCode: "AUTH_ACCOUNT_EXISTS",
+        message: "\u7BA1\u7406\u5458\u8D26\u53F7\u5DF2\u521D\u59CB\u5316\uFF08\u65E0\u9700\u91CD\u590D\u521B\u5EFA\uFF09"
+      });
+    }
+    const passwordHash = await hashPassword(body.password);
+    const account = await accountRepo.createAccount(body.username, passwordHash);
+    const sessionId = generateSessionId();
+    await sessionRepo.createSession(sessionId, account.id ?? "", new Date(Date.now() + SESSION_TTL_MS));
+    setSessionCookie(c, sessionId);
+    return c.json({ username: account.username });
+  });
+  app.post("/api/auth/login", zValidator11("json", LoginSchema), async (c) => {
+    const body = c.req.valid("json");
+    const account = await accountRepo.getAccount();
+    if (!account || account.username !== body.username) {
+      await verifyPassword(body.password, DUMMY_PASSWORD_HASH);
+      return c.json({ error: "AUTH_INVALID_CREDENTIALS", message: "\u8D26\u53F7\u6216\u5BC6\u7801\u9519\u8BEF" }, 401);
+    }
+    const ok = await verifyPassword(body.password, account.passwordHash);
+    if (!ok) {
+      return c.json({ error: "AUTH_INVALID_CREDENTIALS", message: "\u8D26\u53F7\u6216\u5BC6\u7801\u9519\u8BEF" }, 401);
+    }
+    const sessionId = generateSessionId();
+    await sessionRepo.createSession(sessionId, account.id ?? "", new Date(Date.now() + SESSION_TTL_MS));
+    setSessionCookie(c, sessionId);
+    return c.json({ username: account.username });
+  });
+  app.post("/api/auth/logout", async (c) => {
+    const sessionId = readSessionCookie(c);
+    if (sessionId !== void 0) {
+      await sessionRepo.deleteBySessionId(sessionId);
+    }
+    clearSessionCookie(c);
+    return c.body(null, 204);
+  });
+  app.get("/api/auth/me", async (c) => {
+    const auth = getAuth(c);
+    if (auth.kind !== "admin") {
+      return c.json({ error: "AUTH_REQUIRED", message: "\u9700\u8981\u767B\u5F55" }, 401);
+    }
+    const account = await accountRepo.getAccount();
+    return c.json({ username: account?.username ?? "" });
+  });
+  app.put("/api/auth/password", v422(PasswordChangeSchema), async (c) => {
+    const auth = getAuth(c);
+    if (auth.kind !== "admin") {
+      return c.json({ error: "AUTH_REQUIRED", message: "\u9700\u8981\u767B\u5F55" }, 401);
+    }
+    const body = c.req.valid("json");
+    const account = await accountRepo.getAccount();
+    if (!account) {
+      return c.json({ error: "AUTH_REQUIRED", message: "\u9700\u8981\u767B\u5F55" }, 401);
+    }
+    const ok = await verifyPassword(body.currentPassword, account.passwordHash);
+    if (!ok) {
+      return c.json({ error: "AUTH_INVALID_CREDENTIALS", message: "\u8D26\u53F7\u6216\u5BC6\u7801\u9519\u8BEF" }, 401);
+    }
+    await accountRepo.updatePassword(account.id ?? "", await hashPassword(body.newPassword));
+    return c.body(null, 204);
+  });
+  app.post("/api/auth/tokens/admin", async (c) => {
+    const token = generateToken("admin");
+    await tokenRepo.upsertToken("admin", hashToken2(token));
+    return c.json({ token, type: "admin" }, 201);
+  });
+  app.get("/api/auth/tokens/admin", async (c) => {
+    const status = await tokenRepo.getTokenStatus("admin");
+    return c.json({ type: "admin", hasToken: status.hasToken, createdAt: status.createdAt });
+  });
+  app.get("/api/auth/tokens/project", async (c) => {
+    const projects = await projectRepo.list();
+    const statuses = await tokenRepo.listProjectTokenStatuses(projects.map((p) => p.id ?? ""));
+    const items = projects.map((p) => {
+      const st = statuses.get(p.id ?? "");
+      return { type: "project", projectId: p.id, hasToken: st?.hasToken ?? false, createdAt: st?.createdAt ?? null };
+    });
+    return c.json({ items, total: items.length, page: 1, limit: items.length });
+  });
+  app.post("/api/auth/tokens/project/:projectId", async (c) => {
+    const projectId = c.req.param("projectId");
+    const project = await projectRepo.getById(projectId);
+    if (!project) throw new NotFoundError11("project", projectId);
+    if (project.status === "archived") {
+      throw new ConflictError8("project", projectId, { bizCode: "PROJECT_ARCHIVED" });
+    }
+    const token = generateToken("project");
+    await tokenRepo.upsertToken("project", hashToken2(token), projectId);
+    return c.json({ token, type: "project", projectId }, 201);
+  });
+  app.get("/api/auth/tokens/project/:projectId", async (c) => {
+    const projectId = c.req.param("projectId");
+    const status = await tokenRepo.getTokenStatus("project", projectId);
+    return c.json({ type: "project", projectId, hasToken: status.hasToken, createdAt: status.createdAt });
+  });
+  return app;
+}
+function readSessionCookie(c) {
+  return getCookie(c, SESSION_COOKIE_NAME);
+}
+
+// src/app.ts
+function createApp(client, opts = {}) {
+  const app = new Hono15();
+  setupErrorHandler(app);
+  const authEnabled = opts.authEnabled ?? false;
+  app.use("/api/*", createAuthMiddleware(client, { authEnabled }));
+  app.use("/health/*", createAuthMiddleware(client, { authEnabled }));
+  app.route("/", createRoutes(client));
+  app.route("/", createAuthRoutes(client, { authEnabled }));
+  const webRoot = opts.webRoot !== void 0 ? opts.webRoot : resolveWebDistRoot();
+  app.route("/", createStaticRoutes(webRoot));
+  return app;
+}
+
+// src/start-server.ts
+import { serve } from "@hono/node-server";
+import { createMongoClient } from "@siming-org/core";
+
+// src/ensure-collections.ts
+import { EnumRegistrySchema, bumpPatch as bumpPatch2, createAuthSessionRepo as createAuthSessionRepo3, buildTemplateCode, isLegalTemplateCode } from "@siming-org/core";
+async function ensureCollections(client) {
+  const db = client.db();
+  await Promise.all([
+    ensureProjectCollection(db),
+    ensureSkillCollection(db),
+    ensureAgentCollection(db),
+    ensureDagTemplateCollection(db),
+    ensureTaskCollection(db),
+    ensureModelAliasCollection(db),
+    ensureEnumRegistryCollection(db),
+    ensureAuthCollections(db),
+    ensureNodePresetCollection(db),
+    ensureNodeLibraryCollection(db)
+  ]);
+  await migrateProjectSentinelData(db);
+  await migrateGateRemovalData(db);
+  await migrateTaskRecordData(db);
+  await migrateDagTrackTaskValues(db);
+  await migrateAgentFunctionBackfill(db);
+  await migrateDagTemplateCode(db);
+  await ensurePostMigrationIndexes(db);
+}
+var ENUM_REGISTRY_SEEDS = {
+  dag_phase: [
+    { value: "entry", label: "\u5165\u53E3", builtin: false },
+    { value: "track", label: "\u8F68\u9053", builtin: false },
+    { value: "test", label: "\u6D4B\u8BD5", builtin: false },
+    { value: "exit", label: "\u51FA\u53E3", builtin: false }
+  ],
+  dag_track: [
+    { value: "backend", label: "\u540E\u7AEF", builtin: true },
+    { value: "ui", label: "\u524D\u7AEF", builtin: true },
+    { value: "all", label: "\u5168\u90E8", builtin: true },
+    // T202608240003：任务级轨道专用值（非节点 track 值）——mixed=双链串行、research=调研任务；
+    // 存量库 doc 已存在（seed 类缺失才插入），由 M11 迁移合并（缺 M11 会测试绿+生产 400）
+    { value: "mixed", label: "\u6DF7\u5408\uFF08\u524D\u540E\u7AEF\uFF09", builtin: true },
+    { value: "research", label: "\u8C03\u7814\uFF08\u5185\u90E8\u503C\uFF0C\u968F\u7C7B\u578B\u81EA\u52A8\u8BBE\u7F6E\uFF09", builtin: true }
+  ],
+  pause_type: [
+    { value: "human_approval", label: "\u4EBA\u5DE5\u5BA1\u6279", builtin: false },
+    { value: "checkpoint", label: "\u68C0\u67E5\u70B9", builtin: false }
+  ],
+  task_status: [
+    { value: "active", label: "\u8FDB\u884C\u4E2D", builtin: true },
+    { value: "paused", label: "\u6682\u505C", builtin: true },
+    { value: "completed", label: "\u5DF2\u5B8C\u6210", builtin: true },
+    { value: "cancelled", label: "\u5DF2\u53D6\u6D88", builtin: true }
+  ],
+  node_status: [
+    { value: "pending", label: "\u5F85\u6267\u884C", builtin: true },
+    { value: "active", label: "\u8FDB\u884C\u4E2D", builtin: true },
+    { value: "completed", label: "\u5DF2\u5B8C\u6210", builtin: true },
+    { value: "skipped", label: "\u5DF2\u8DF3\u8FC7", builtin: true }
+  ],
+  skill_category: [
+    { value: "process", label: "\u6D41\u7A0B", builtin: false },
+    { value: "domain", label: "\u9886\u57DF", builtin: false },
+    { value: "tooling", label: "\u5DE5\u5177", builtin: false }
+  ],
+  scope: [
+    { value: "global", label: "\u5168\u5C40", builtin: true },
+    { value: "project", label: "\u9879\u76EE", builtin: true }
+  ],
+  // T202608260002 C3：schema 固定枚举为消费权威（AgentFunctionSchema），registry 仅展示（仿 pause_type 双轨）——
+  // web 后续经 useEnumEntries('agent_function') 消费；两值 builtin（writer 落盘注入按 reviewer 判定，承重字段）
+  agent_function: [
+    { value: "reviewer", label: "\u5BA1\u67E5\uFF08\u843D\u76D8\u6CE8\u5165\u4FE1\u606F\u8FB9\u754C\uFF09", builtin: true },
+    { value: "executor", label: "\u6267\u884C/\u901A\u7528\uFF08\u9ED8\u8BA4\uFF09", builtin: true }
+  ]
+};
+function buildSeedEntries(seeds) {
+  return seeds.map((s, i) => ({
+    value: s.value,
+    label: s.label,
+    builtin: s.builtin,
+    order: i,
+    active: true,
+    ...s.color ? { color: s.color } : {}
+  }));
+}
+async function ensureAuthCollections(db) {
+  const accountValidator = { $jsonSchema: {
+    bsonType: "object",
+    required: ["username", "passwordHash"],
+    properties: {
+      username: { bsonType: "string", minLength: 1 },
+      passwordHash: { bsonType: "string", minLength: 1 },
+      createdAt: { bsonType: "date" },
+      updatedAt: { bsonType: "date" }
+    }
+  } };
+  const collections = await db.listCollections({ name: "auth_accounts" }).toArray();
+  if (collections.length === 0) {
+    await db.createCollection("auth_accounts", { validator: accountValidator });
+  }
+  await db.collection("auth_accounts").createIndex({ username: 1 }, { unique: true });
+  const tokenValidator = { $jsonSchema: {
+    bsonType: "object",
+    required: ["tokenHash", "type"],
+    properties: {
+      tokenHash: { bsonType: "string" },
+      type: { enum: ["admin", "project"] },
+      projectId: { bsonType: "string" },
+      createdAt: { bsonType: "date" },
+      updatedAt: { bsonType: "date" }
+    }
+  } };
+  const tokenColls = await db.listCollections({ name: "auth_tokens" }).toArray();
+  if (tokenColls.length === 0) {
+    await db.createCollection("auth_tokens", { validator: tokenValidator });
+  }
+  await db.collection("auth_tokens").createIndex({ tokenHash: 1 }, { unique: true });
+  await db.collection("auth_tokens").createIndex(
+    { projectId: 1 },
+    { unique: true, partialFilterExpression: { type: "project" } }
+  );
+  await db.collection("auth_tokens").createIndex(
+    { type: 1 },
+    { unique: true, partialFilterExpression: { type: "admin" } }
+  );
+  const sessionColls = await db.listCollections({ name: "auth_sessions" }).toArray();
+  if (sessionColls.length === 0) {
+    await db.createCollection("auth_sessions");
+  }
+  await db.collection("auth_sessions").createIndex({ sessionId: 1 }, { unique: true });
+  await db.collection("auth_sessions").createIndex({ expiresAt: 1 }, { expireAfterSeconds: 0 });
+  const removed = await createAuthSessionRepo3(db).deleteExpiredSessions();
+  if (removed > 0) {
+    console.log(`[siming] auth: \u6E05\u626B\u8FC7\u671F\u4F1A\u8BDD ${String(removed)} \u4E2A`);
+  }
+}
+async function ensureEnumRegistryCollection(db) {
+  const collections = await db.listCollections({ name: "enum_registry" }).toArray();
+  if (collections.length === 0) {
+    await db.createCollection("enum_registry");
+  }
+  await db.collection("enum_registry").createIndex({ category: 1 }, { unique: true });
+  const coll = db.collection("enum_registry");
+  for (const [category, seeds] of Object.entries(ENUM_REGISTRY_SEEDS)) {
+    const existing = await coll.findOne({ category });
+    if (!existing) {
+      const doc = {
+        category,
+        entries: buildSeedEntries(seeds),
+        updatedAt: /* @__PURE__ */ new Date()
+      };
+      await coll.insertOne(doc);
+    }
+  }
+}
+async function ensureModelAliasCollection(db) {
+  const validator = { $jsonSchema: {
+    bsonType: "object",
+    required: ["code", "name", "realModel"],
+    properties: {
+      code: { bsonType: "string", pattern: "^[a-z0-9]+(-[a-z0-9]+)*$" },
+      name: { bsonType: "string" },
+      realModel: { bsonType: "string" },
+      createdAt: { bsonType: "date" },
+      updatedAt: { bsonType: "date" }
+    }
+  } };
+  const collections = await db.listCollections({ name: "model_aliases" }).toArray();
+  if (collections.length === 0) {
+    await db.createCollection("model_aliases", { validator });
+  }
+  await db.collection("model_aliases").createIndex({ code: 1 }, { unique: true });
+}
+async function ensureProjectCollection(db) {
+  const collections = await db.listCollections({ name: "projects" }).toArray();
+  if (collections.length === 0) {
+    await db.createCollection("projects", { validator: projectValidator() });
+  }
+  await db.collection("projects").createIndex({ key: 1 }, { unique: true });
+  await db.collection("projects").createIndex({ name: 1 }, { unique: true });
+  await db.collection("projects").createIndex({ status: 1 });
+}
+function projectValidator() {
+  return { $jsonSchema: {
+    bsonType: "object",
+    required: ["key", "name", "status"],
+    properties: {
+      key: { bsonType: "string", pattern: "^[a-z0-9][a-z0-9-]{1,30}$" },
+      name: { bsonType: "string" },
+      description: { bsonType: "string" },
+      status: { enum: ["active", "archived"] },
+      createdAt: { bsonType: "date" },
+      updatedAt: { bsonType: "date" }
+    }
+  } };
+}
+async function ensureSkillCollection(db) {
+  const validator = { $jsonSchema: {
+    bsonType: "object",
+    required: ["name", "description", "content", "category", "scope"],
+    properties: {
+      // name 不设 pattern：create 侧 kebab 由应用层 Zod 把守（SkillCreateSchema），DB 层放宽以允许
+      // validator 部署前的 CJK 存量记录被更新（否则 findOneAndUpdate 触发 code 121 拒绝合法编辑，N013 SKILL_EDIT_008）
+      name: { bsonType: "string", minLength: 1 },
+      description: { bsonType: "string" },
+      content: { bsonType: "string" },
+      // N016 F9：category 放宽为任意字符串（枚举注册表为运行时权威，DB 只做类型兜底）
+      category: { bsonType: "string" },
+      // T202608270002：引用文档（可选，存量单文件资产无此字段合法）——路径规则/上限归应用层 Zod，DB 只做类型级声明
+      references: {
+        bsonType: "array",
+        items: {
+          bsonType: "object",
+          required: ["path", "content"],
+          properties: {
+            path: { bsonType: "string", minLength: 1 },
+            content: { bsonType: "string" }
+          }
+        }
+      },
+      // N012 F7：作用域字段（全局 / 项目专用）；projectId 仅 scope=project 携带
+      scope: { enum: ["global", "project"] },
+      projectId: { bsonType: "string" },
+      version: { bsonType: "string" },
+      // T202608290001：资产启停（可选——enabled === false 即停用，缺失 = 启用，存量零迁移）
+      enabled: { bsonType: "bool" },
+      createdAt: { bsonType: "date" },
+      updatedAt: { bsonType: "date" }
+    }
+  } };
+  const collections = await db.listCollections({ name: "skills" }).toArray();
+  if (collections.length === 0) {
+    await db.createCollection("skills", { validator });
+  } else {
+    await db.command({ collMod: "skills", validationLevel: "strict", validator });
+  }
+  await db.collection("skills").createIndex({ scope: 1, projectId: 1 });
+}
+async function ensureAgentCollection(db) {
+  const validator = { $jsonSchema: {
+    bsonType: "object",
+    required: ["name", "description", "systemPrompt", "model", "scope"],
+    properties: {
+      name: { bsonType: "string" },
+      description: { bsonType: "string" },
+      systemPrompt: { bsonType: "string" },
+      boundSkills: { bsonType: "array", items: { bsonType: "string" } },
+      model: { bsonType: "string" },
+      // N015：agent 资产版本（F13 版本对比）；存量回填走 M6 迁移
+      version: { bsonType: "string" },
+      tools: { bsonType: "array", items: { bsonType: "string" } },
+      permissions: { bsonType: "array", items: { bsonType: "string" } },
+      // T202608270002：引用文档（可选，存量单文件资产无此字段合法）——路径规则/上限归应用层 Zod，DB 只做类型级声明
+      references: {
+        bsonType: "array",
+        items: {
+          bsonType: "object",
+          required: ["path", "content"],
+          properties: {
+            path: { bsonType: "string", minLength: 1 },
+            content: { bsonType: "string" }
+          }
+        }
+      },
+      scope: { enum: ["global", "project"] },
+      projectId: { bsonType: "string" },
+      // T202608260002：功能类型（可选——存量缺省合法，M12 回填）——取值域归应用层 Zod，DB 只做类型兜底
+      "function": { bsonType: "string" },
+      // T202608290001：资产启停（可选——enabled === false 即停用，缺失 = 启用，存量零迁移）
+      enabled: { bsonType: "bool" },
+      createdAt: { bsonType: "date" },
+      updatedAt: { bsonType: "date" }
+    }
+  } };
+  const collections = await db.listCollections({ name: "agents" }).toArray();
+  if (collections.length === 0) {
+    await db.createCollection("agents", { validator });
+  } else {
+    await db.command({ collMod: "agents", validationLevel: "strict", validator });
+  }
+  await db.collection("agents").createIndex({ scope: 1, projectId: 1 });
+}
+async function ensureDagTemplateCollection(db) {
+  const validator = { $jsonSchema: {
+    bsonType: "object",
+    // N017 F8：pausePoints 顶层字段退役（暂停点内联 edges.pausePoint）
+    required: ["name", "projectId", "description", "nodes", "edges", "isDefault", "version"],
+    properties: {
+      name: { bsonType: "string" },
+      projectId: { bsonType: "string" },
+      // T202609020002：业务 code（可选——存量迁移前缺失合法，M13 回填；格式规则归应用层 Zod，
+      // DB 只做类型兜底，pattern 禁令见技术架构「DB validator 职责边界」）
+      code: { bsonType: "string" },
+      description: { bsonType: "string" },
+      nodes: { bsonType: "array" },
+      edges: { bsonType: "array" },
+      isDefault: { bsonType: "bool" },
+      version: { bsonType: "string" },
+      // T202608290001：模板启停（可选——enabled === false 即停用，缺失 = 启用，存量零迁移）
+      enabled: { bsonType: "bool" },
+      createdAt: { bsonType: "date" },
+      updatedAt: { bsonType: "date" }
+    }
+  } };
+  const collections = await db.listCollections({ name: "dag_templates" }).toArray();
+  if (collections.length === 0) {
+    await db.createCollection("dag_templates", { validator });
+  } else {
+    await db.command({ collMod: "dag_templates", validationLevel: "strict", validator });
+  }
+  await db.collection("dag_templates").createIndex({ projectId: 1 });
+  await db.collection("dag_templates").createIndex({ isDefault: 1 });
+}
+async function ensureTaskCollection(db) {
+  const validator = { $jsonSchema: {
+    bsonType: "object",
+    required: ["taskId", "title", "projectId", "dagTemplateId", "dagInstance", "currentNode", "currentPhase", "status", "track", "history"],
+    properties: {
+      taskId: { bsonType: "string" },
+      title: { bsonType: "string" },
+      projectId: { bsonType: "string" },
+      dagTemplateId: { bsonType: "string" },
+      dagInstance: { bsonType: "object" },
+      currentNode: { bsonType: "string" },
+      // N016 F06：枚举放宽（D3 注册表权威）——currentPhase/status 不再 DB 枚举硬限，由注册表/应用层把守
+      currentPhase: { bsonType: "string" },
+      status: { bsonType: "string" },
+      pausedAt: { bsonType: ["string", "null"] },
+      track: { bsonType: "string" },
+      // T202608240003：任务类型标签（可选，类型兜底——取值域归应用层 z.enum）
+      type: { bsonType: "string" },
+      // N020 D1：任务信息结构化三字段（可选——存量任务未迁移前缺省合法，M10 补齐）
+      doc: { bsonType: "object" },
+      nodeRecords: { bsonType: "object" },
+      archNotes: { bsonType: "array" },
+      history: { bsonType: "array" },
+      createdAt: { bsonType: "date" },
+      updatedAt: { bsonType: "date" }
+    }
+  } };
+  const collections = await db.listCollections({ name: "tasks" }).toArray();
+  if (collections.length === 0) {
+    await db.createCollection("tasks", { validator });
+  } else {
+    await db.command({ collMod: "tasks", validationLevel: "strict", validator });
+  }
+  await db.collection("tasks").createIndex({ taskId: 1 }, { unique: true });
+  await db.collection("tasks").createIndex({ status: 1 });
+  await db.collection("tasks").createIndex({ track: 1 });
+}
+async function migrateProjectSentinelData(db) {
+  const projects = db.collection("projects");
+  let defaultProject = await projects.findOne({ key: "default" });
+  if (!defaultProject) {
+    const now = /* @__PURE__ */ new Date();
+    await projects.insertOne({
+      key: "default",
+      name: "\u9ED8\u8BA4\u9879\u76EE",
+      description: "\u7CFB\u7EDF\u5185\u7F6E\u9879\u76EE\uFF08\u5B58\u91CF\u8D44\u4EA7\u4E0E\u672A\u6307\u5B9A\u5F52\u5C5E\u8D44\u4EA7\u7684\u843D\u70B9\uFF0C\u4E0D\u53EF\u505C\u7528\uFF09",
+      status: "active",
+      createdAt: now,
+      updatedAt: now
+    });
+    defaultProject = await projects.findOne({ key: "default" });
+  }
+  if (!defaultProject) {
+    throw new Error("N012 M1 \u8FC1\u79FB\u5931\u8D25\uFF1A\u9ED8\u8BA4\u9879\u76EE seed \u540E\u4ECD\u65E0\u6CD5\u8BFB\u53D6");
+  }
+  const defaultProjectId = defaultProject._id.toString();
+  await db.collection("tasks").updateMany({ projectId: "default" }, { $set: { projectId: defaultProjectId } }, { bypassDocumentValidation: true });
+  await db.collection("dag_templates").updateMany({ projectId: "default" }, { $set: { projectId: defaultProjectId } }, { bypassDocumentValidation: true });
+  await db.collection("skills").updateMany({ scope: { $exists: false } }, { $set: { scope: "global" } });
+  await db.collection("agents").updateMany({ scope: { $exists: false } }, { $set: { scope: "global" } });
+  await db.collection("agents").updateMany({ version: { $exists: false } }, { $set: { version: "1.0.0" } });
+}
+async function migrateGateRemovalData(db) {
+  await db.collection("enum_registry").deleteOne({ category: "gate_type" });
+  const legacyTemplates = await db.collection("dag_templates").find(
+    { $or: [{ "nodes.gates": { $exists: true } }, { pausePoints: { $exists: true } }] },
+    { projection: { name: 1 } }
+  ).toArray();
+  if (legacyTemplates.length > 0) {
+    console.log(`[siming] N017 M8\uFF1A\u5220\u9664\u65E7\u7ED3\u6784 DAG \u6A21\u677F ${legacyTemplates.length} \u4E2A\uFF08\u91CD\u5BFC\u65B0 YAML\uFF09\uFF1A${legacyTemplates.map((t) => `${t.name}(${t._id})`).join(", ")}`);
+    await db.collection("dag_templates").deleteMany({
+      _id: { $in: legacyTemplates.map((t) => t._id) }
+    });
+  }
+  const legacyTasks = await db.collection("tasks").find(
+    { "dagInstance.pausePoints": { $exists: true } },
+    { projection: { taskId: 1 } }
+  ).toArray();
+  if (legacyTasks.length > 0) {
+    console.log(`[siming] N017 M9\uFF1A\u5220\u9664\u65E7\u7ED3\u6784\u4EFB\u52A1 ${legacyTasks.length} \u4E2A\uFF1A${legacyTasks.map((t) => t.taskId).join(", ")}`);
+    await db.collection("tasks").deleteMany({
+      _id: { $in: legacyTasks.map((t) => t._id) }
+    });
+  }
+}
+async function migrateTaskRecordData(db) {
+  await db.collection("tasks").updateMany(
+    { nodeRecords: { $exists: false } },
+    { $set: { nodeRecords: {} } },
+    { bypassDocumentValidation: true }
+  );
+  await db.collection("tasks").updateMany(
+    { archNotes: { $exists: false } },
+    { $set: { archNotes: [] } },
+    { bypassDocumentValidation: true }
+  );
+}
+async function migrateDagTrackTaskValues(db) {
+  const coll = db.collection("enum_registry");
+  const doc = await coll.findOne({ category: "dag_track" });
+  if (!doc) return;
+  const parsed = EnumRegistrySchema.safeParse({ category: "dag_track", ...doc, entries: doc.entries ?? [] });
+  if (!parsed.success) {
+    throw new Error(`T202608240003 M11 \u8FC1\u79FB\u5931\u8D25\uFF1A\u5B58\u91CF dag_track entries \u5F62\u72B6\u975E\u6CD5\uFF08${JSON.stringify(parsed.error.issues[0]?.message)}\uFF09`);
+  }
+  const entries = parsed.data.entries;
+  const existingValues = new Set(entries.map((e) => e.value));
+  const maxOrder = entries.reduce((max, e) => Math.max(max, e.order), -1);
+  const additions = ENUM_REGISTRY_SEEDS.dag_track.filter((s) => !existingValues.has(s.value)).map((s, i) => ({
+    value: s.value,
+    label: s.label,
+    builtin: s.builtin,
+    order: maxOrder + 1 + i,
+    active: true
+  }));
+  if (additions.length === 0) return;
+  const result = await coll.updateOne(
+    { _id: doc._id },
+    { $set: { entries: [...entries, ...additions], updatedAt: /* @__PURE__ */ new Date() } }
+  );
+  if (result.matchedCount === 0) {
+    throw new Error("T202608240003 M11 \u8FC1\u79FB\u5931\u8D25\uFF1Adag_track doc \u66F4\u65B0\u672A\u547D\u4E2D\uFF08\u542F\u52A8\u671F\u4E0D\u5E94\u53D1\u751F\uFF09");
+  }
+}
+async function migrateAgentFunctionBackfill(db) {
+  const coll = db.collection("agents");
+  const docs = await coll.find({ "function": { $exists: false } }, { projection: { version: 1 } }).toArray();
+  if (docs.length === 0) return;
+  console.log(`[siming] T202608260002 M12\uFF1Aagents.function \u56DE\u586B ${docs.length} \u4E2A\uFF08executor + version bump\uFF0C\u9A71\u52A8\u5DF2\u88C5\u73AF\u5883\u91CD\u5199\uFF09`);
+  for (const doc of docs) {
+    const baseVersion = typeof doc.version === "string" ? doc.version : "1.0.0";
+    const result = await coll.updateOne(
+      { _id: doc._id, "function": { $exists: false } },
+      { $set: { "function": "executor", version: bumpPatch2(baseVersion) } }
+    );
+    if (result.matchedCount === 0) {
+      throw new Error("T202608260002 M12 \u8FC1\u79FB\u5931\u8D25\uFF1Aagents.function \u56DE\u586B\u672A\u547D\u4E2D\uFF08\u542F\u52A8\u671F\u5355\u8FDB\u7A0B\u4E32\u884C\uFF0C\u4E0D\u5E94\u53D1\u751F\uFF09");
+    }
+  }
+}
+async function ensureNodePresetCollection(db) {
+  const validator = { $jsonSchema: {
+    bsonType: "object",
+    required: ["code", "label", "nodeId", "phase", "track", "prompt", "skills", "scope", "version"],
+    properties: {
+      code: { bsonType: "string" },
+      label: { bsonType: "string", minLength: 1 },
+      nodeId: { bsonType: "string" },
+      phase: { bsonType: "string" },
+      track: { bsonType: "string" },
+      prompt: { bsonType: "string" },
+      skills: { bsonType: "array", items: { bsonType: "string" } },
+      agents: { bsonType: "array", items: { bsonType: "string" } },
+      scope: { enum: ["global", "project"] },
+      projectId: { bsonType: "string" },
+      description: { bsonType: "string" },
+      version: { bsonType: "string" },
+      source: { bsonType: "object" },
+      enabled: { bsonType: "bool" },
+      createdAt: { bsonType: "date" },
+      updatedAt: { bsonType: "date" }
+    }
+  } };
+  const collections = await db.listCollections({ name: "node_presets" }).toArray();
+  if (collections.length === 0) {
+    await db.createCollection("node_presets", { validator });
+  } else {
+    await db.command({ collMod: "node_presets", validationLevel: "strict", validator });
+  }
+  await db.collection("node_presets").createIndex({ code: 1 }, { unique: true });
+  await db.collection("node_presets").createIndex({ scope: 1, projectId: 1 });
+}
+async function ensureNodeLibraryCollection(db) {
+  const validator = { $jsonSchema: {
+    bsonType: "object",
+    required: ["name", "version", "scope", "nodes", "compositions"],
+    properties: {
+      name: { bsonType: "string", minLength: 1 },
+      version: { bsonType: "string" },
+      scope: { enum: ["global", "project"] },
+      projectId: { bsonType: "string" },
+      nodes: { bsonType: "array", items: { bsonType: "string" } },
+      compositions: { bsonType: "array" },
+      installedAt: { bsonType: "date" },
+      createdAt: { bsonType: "date" },
+      updatedAt: { bsonType: "date" }
+    }
+  } };
+  const collections = await db.listCollections({ name: "node_libraries" }).toArray();
+  if (collections.length === 0) {
+    await db.createCollection("node_libraries", { validator });
+  }
+  await db.collection("node_libraries").createIndex({ name: 1 }, { unique: true });
+  await db.collection("node_libraries").createIndex({ scope: 1, projectId: 1 });
+}
+async function migrateDagTemplateCode(db) {
+  const coll = db.collection("dag_templates");
+  const docs = await coll.find({}, { projection: { projectId: 1, name: 1, code: 1 } }).toArray();
+  const takenByProject = /* @__PURE__ */ new Map();
+  for (const doc of docs) {
+    const projectId = String(doc.projectId);
+    if (typeof doc.code === "string" && isLegalTemplateCode(doc.code)) {
+      const taken = takenByProject.get(projectId) ?? /* @__PURE__ */ new Set();
+      taken.add(doc.code);
+      takenByProject.set(projectId, taken);
+    }
+  }
+  let migrated = 0;
+  for (const doc of docs) {
+    const projectId = String(doc.projectId);
+    if (typeof doc.code === "string" && isLegalTemplateCode(doc.code)) continue;
+    const taken = takenByProject.get(projectId) ?? /* @__PURE__ */ new Set();
+    const code = buildTemplateCode(String(doc.name ?? ""), taken);
+    taken.add(code);
+    takenByProject.set(projectId, taken);
+    const result = await coll.updateOne(
+      { _id: doc._id },
+      { $set: { code } },
+      { bypassDocumentValidation: true }
+    );
+    if (result.matchedCount === 0) {
+      throw new Error("T202609020002 M13 \u8FC1\u79FB\u5931\u8D25\uFF1Acode \u56DE\u586B\u672A\u547D\u4E2D\uFF08\u542F\u52A8\u671F\u5355\u8FDB\u7A0B\u4E32\u884C\uFF0C\u4E0D\u5E94\u53D1\u751F\uFF09");
+    }
+    migrated += 1;
+  }
+  if (migrated > 0) {
+    console.log(`[siming] T202609020002 M13\uFF1Adag_templates.code \u56DE\u586B ${migrated} \u4E2A`);
+  }
+}
+async function ensurePostMigrationIndexes(db) {
+  const tasks = db.collection("tasks");
+  const taskIndexes = await tasks.listIndexes().toArray();
+  const legacySingle = taskIndexes.find(
+    (idx) => idx.name === "projectId_1" && Object.keys(idx.key).length === 1
+  );
+  if (legacySingle) {
+    await tasks.dropIndex("projectId_1");
+  }
+  await tasks.createIndex({ projectId: 1, status: 1 });
+  const templates = db.collection("dag_templates");
+  const seen = /* @__PURE__ */ new Map();
+  const docs = await templates.find({}, { projection: { projectId: 1, name: 1 } }).toArray();
+  for (const doc of docs) {
+    const key = `${String(doc.projectId)}\0${String(doc.name)}`;
+    const ids = seen.get(key) ?? [];
+    ids.push(doc._id.toString());
+    seen.set(key, ids);
+  }
+  const conflicts = [...seen.entries()].filter(([, ids]) => ids.length > 1);
+  if (conflicts.length > 0) {
+    const detail = conflicts.map(([key, ids]) => {
+      const [projectId, name] = key.split("\0");
+      return `projectId=${projectId} name="${name}" \xD7${ids.length} (_id: ${ids.join(", ")})`;
+    }).join("; ");
+    throw new Error(`dag_templates \u5B58\u5728\u540C\u9879\u76EE\u91CD\u540D\u6A21\u677F\uFF0C\u65E0\u6CD5\u5EFA\u7ACB (projectId,name) \u552F\u4E00\u7D22\u5F15\uFF0C\u8BF7\u5148\u4EBA\u5DE5\u5F52\u5E76\uFF1A${detail}`);
+  }
+  await templates.createIndex({ projectId: 1, name: 1 }, { unique: true });
+  const seenCodes = /* @__PURE__ */ new Map();
+  const codeDocs = await templates.find(
+    { code: { $exists: true } },
+    { projection: { projectId: 1, code: 1 } }
+  ).toArray();
+  for (const doc of codeDocs) {
+    if (typeof doc.code !== "string") continue;
+    const key = `${String(doc.projectId)}\0${doc.code}`;
+    const ids = seenCodes.get(key) ?? [];
+    ids.push(doc._id.toString());
+    seenCodes.set(key, ids);
+  }
+  const codeConflicts = [...seenCodes.entries()].filter(([, ids]) => ids.length > 1);
+  if (codeConflicts.length > 0) {
+    const detail = codeConflicts.map(([key, ids]) => {
+      const [projectId, code] = key.split("\0");
+      return `projectId=${projectId} code="${code}" \xD7${ids.length} (_id: ${ids.join(", ")})`;
+    }).join("; ");
+    throw new Error(`dag_templates \u5B58\u5728\u540C\u9879\u76EE\u91CD\u590D code\uFF0C\u65E0\u6CD5\u5EFA\u7ACB (projectId,code) \u552F\u4E00\u7D22\u5F15\uFF0C\u8BF7\u5148\u4EBA\u5DE5\u5F52\u5E76\uFF1A${detail}`);
+  }
+  await templates.createIndex(
+    { projectId: 1, code: 1 },
+    { unique: true, partialFilterExpression: { code: { $type: "string" } } }
+  );
+  await db.collection("agents").createIndex({ model: 1 });
+  await migrateNameUniquenessIndexes(db);
+}
+async function migrateNameUniquenessIndexes(db) {
+  const assertNoProjectNameConflict = async (collectionName) => {
+    const coll = db.collection(collectionName);
+    const seen = /* @__PURE__ */ new Map();
+    const docs = await coll.find({ scope: "project" }, { projection: { projectId: 1, name: 1 } }).toArray();
+    for (const doc of docs) {
+      const key = `${String(doc.projectId)}\0${String(doc.name)}`;
+      const ids = seen.get(key) ?? [];
+      ids.push(doc._id.toString());
+      seen.set(key, ids);
+    }
+    const conflicts = [...seen.entries()].filter(([, ids]) => ids.length > 1);
+    if (conflicts.length > 0) {
+      const detail = conflicts.map(([key, ids]) => {
+        const [projectId, name] = key.split("\0");
+        return `projectId=${projectId} name="${name}" \xD7${ids.length} (_id: ${ids.join(", ")})`;
+      }).join("; ");
+      throw new Error(`${collectionName} \u5B58\u5728\u540C\u9879\u76EE\u91CD\u540D\u8D44\u4EA7\uFF0C\u65E0\u6CD5\u5EFA\u7ACB (projectId,name) \u552F\u4E00\u7D22\u5F15\uFF0C\u8BF7\u5148\u4EBA\u5DE5\u5F52\u5E76\uFF1A${detail}`);
+    }
+  };
+  for (const name of ["skills", "agents"]) {
+    const coll = db.collection(name);
+    const indexes = await coll.listIndexes().toArray();
+    const legacyNameUnique = indexes.find(
+      (idx) => idx.name === "name_1" && idx.unique === true && Object.keys(idx.key).length === 1 && // N016 F04：partial 索引名也是 name_1，必须排除（否则每次启动误判 legacy → drop+重建 churn）
+      idx.partialFilterExpression === void 0
+    );
+    if (legacyNameUnique) {
+      await coll.dropIndex("name_1");
+    }
+    await assertNoProjectNameConflict(name);
+    await coll.createIndex(
+      { name: 1 },
+      { unique: true, partialFilterExpression: { scope: "global" } }
+    );
+    await coll.createIndex(
+      { projectId: 1, name: 1 },
+      { unique: true, partialFilterExpression: { scope: "project" } }
+    );
+  }
+}
+
+// src/start-server.ts
+var MONGO_PROBE_TIMEOUT_MS = 5e3;
+async function startServer(config) {
+  const client = await createMongoClient(config.mongoUri, {
+    serverSelectionTimeoutMS: MONGO_PROBE_TIMEOUT_MS
+  });
+  await ensureCollections(client);
+  const webRoot = resolveWebDistRoot();
+  const app = createApp(client, { webRoot, authEnabled: config.auth.enabled });
+  let port = config.port;
+  const server = serve({ fetch: app.fetch, hostname: config.host, port: config.port }, (info) => {
+    port = info.port;
+    console.log(`[siming] server listening on http://${info.address}:${info.port}`);
+  });
+  console.log(webRoot === null ? "[siming] web ui not built \u2014 static disabled (API only)" : `[siming] web ui root: ${webRoot}`);
+  console.log(`[siming] config: port=${config.port} host=${config.host} logLevel=${config.logLevel}`);
+  const stop = async () => {
+    console.log("[siming] shutting down...");
+    server.close();
+    await client.close();
+  };
+  return { server, client, host: config.host, port, stop };
+}
+
+export {
+  ADMIN_ONLY_ROUTES,
+  resolveWebDistRoot,
+  createStaticRoutes,
+  createApp,
+  MONGO_PROBE_TIMEOUT_MS,
+  startServer
+};