@siming-org/server 0.4.0 → 0.5.0

package/dist/{chunk-XVFWTF42.js → chunk-XZWVPHDG.js}

@@ -1,3 +1,113 @@
+// src/middleware/auth.ts
+import {
+  createAuthTokenRepo,
+  createAuthSessionRepo,
+  hashToken,
+  tokenTypeFromValue,
+  ForbiddenError,
+  UnauthorizedError
+} from "@siming-org/core";
+
+// src/middleware/auth-cookie.ts
+var SESSION_COOKIE_NAME = "siming_session";
+
+// src/middleware/auth.ts
+var SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var AUTH_EXEMPT_ROUTES = /* @__PURE__ */ new Set(["GET /health", "GET /api/auth/status"]);
+function isWhoamiRoute(method, path) {
+  return (method === "GET" || method === "POST") && path === "/api/auth/whoami";
+}
+var AUTH_FLOW_ROUTES = /* @__PURE__ */ new Set(["POST /api/auth/login", "POST /api/auth/setup"]);
+var ADMIN_ONLY_ROUTES = [
+  { method: "POST", pattern: /^\/api\/projects$/ },
+  { method: "PUT", pattern: /^\/api\/projects\/[^/]+$/ },
+  { method: "PUT", pattern: /^\/api\/settings\/enums\/[^/]+$/ },
+  { method: "DELETE", pattern: /^\/api\/settings\/enums\/[^/]+\/entries\/[^/]+$/ },
+  { method: "POST", pattern: /^\/api\/model-aliases$/ },
+  { method: "PUT", pattern: /^\/api\/model-aliases\/[^/]+$/ },
+  { method: "DELETE", pattern: /^\/api\/model-aliases\/[^/]+$/ },
+  // Token 管理全 admin
+  { method: "GET", pattern: /^\/api\/auth\/tokens(\/.*)?$/ },
+  { method: "POST", pattern: /^\/api\/auth\/tokens(\/.*)?$/ }
+];
+function createAuthMiddleware(client, deps) {
+  const tokenRepo = createAuthTokenRepo(client.db());
+  const sessionRepo = createAuthSessionRepo(client.db());
+  const parseCredential = async (c) => {
+    const authHeader = c.req.header("Authorization");
+    if (authHeader !== void 0 && authHeader.startsWith("Bearer ")) {
+      const token = authHeader.slice("Bearer ".length).trim();
+      const type = tokenTypeFromValue(token);
+      if (type === null) return null;
+      const matched = await tokenRepo.findByHash(hashToken(token));
+      if (!matched) return null;
+      if (matched.type === "admin") return { kind: "admin" };
+      return { kind: "project", projectId: matched.projectId ?? "" };
+    }
+    const sessionId = getCookie(c, SESSION_COOKIE_NAME);
+    if (sessionId !== void 0) {
+      const session = await sessionRepo.findValidSession(sessionId);
+      if (session) return { kind: "admin" };
+    }
+    return null;
+  };
+  return async (c, next) => {
+    const method = c.req.method;
+    const path = c.req.path;
+    if (isWhoamiRoute(method, path)) {
+      const parsed2 = deps.authEnabled ? await parseCredential(c) : null;
+      c.set("auth", parsed2 === null ? { kind: deps.authEnabled ? "none" : "open" } : parsed2);
+      await next();
+      return;
+    }
+    if (AUTH_EXEMPT_ROUTES.has(`${method} ${path}`) || AUTH_FLOW_ROUTES.has(`${method} ${path}`)) {
+      c.set("auth", { kind: "open" });
+      await next();
+      return;
+    }
+    if (!deps.authEnabled) {
+      c.set("auth", { kind: "open" });
+      await next();
+      return;
+    }
+    const parsed = await parseCredential(c);
+    if (parsed === null) {
+      const authHeader = c.req.header("Authorization");
+      if (authHeader !== void 0 && authHeader.startsWith("Bearer ")) {
+        throw new UnauthorizedError("AUTH_TOKEN_INVALID");
+      }
+      throw new UnauthorizedError("AUTH_REQUIRED");
+    }
+    const auth = parsed.kind === "admin" ? { kind: "admin" } : { kind: "project", projectId: parsed.projectId ?? "" };
+    if (auth.kind === "project") {
+      for (const rule of ADMIN_ONLY_ROUTES) {
+        if (rule.method === method && rule.pattern.test(path)) {
+          throw new ForbiddenError();
+        }
+      }
+    }
+    c.set("auth", auth);
+    await next();
+  };
+}
+function getCookie(c, name) {
+  const cookieHeader = c.req.header("Cookie");
+  if (cookieHeader === void 0) return void 0;
+  for (const part of cookieHeader.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    if (part.slice(0, eq).trim() === name) {
+      const raw = part.slice(eq + 1).trim();
+      try {
+        return decodeURIComponent(raw);
+      } catch {
+        return raw;
+      }
+    }
+  }
+  return void 0;
+}
+
 // src/static.ts
 import { existsSync, readFileSync, statSync } from "fs";
 import { join, resolve, sep } from "path";
@@ -104,7 +214,7 @@ function createStaticRoutes(webRoot) {
 }
 
 // src/app.ts
-import { Hono as Hono11 } from "hono";
+import { Hono as Hono15 } from "hono";
 
 // src/errors.ts
 import { AppError } from "@siming-org/core";
@@ -126,7 +236,7 @@ function setupErrorHandler(app) {
 }
 
 // src/routes/index.ts
-import { Hono as Hono10 } from "hono";
+import { Hono as Hono13 } from "hono";
 
 // src/routes/health.ts
 import { Hono as Hono2 } from "hono";
@@ -155,11 +265,43 @@ function createHealth(client) {
 // src/routes/project.routes.ts
 import { Hono as Hono3 } from "hono";
 import { zValidator } from "@hono/zod-validator";
+
+// src/routes/auth-guard.ts
+import { NotFoundError, ForbiddenError as ForbiddenError2 } from "@siming-org/core";
+function getAuth(c) {
+  const auth = c.get("auth");
+  return auth ?? { kind: "open" };
+}
+function assertProjectVisible(c, resourceProjectId) {
+  const auth = getAuth(c);
+  if (auth.kind === "project" && resourceProjectId !== void 0 && resourceProjectId !== "" && resourceProjectId !== auth.projectId) {
+    throw new NotFoundError("resource", resourceProjectId);
+  }
+}
+function assertProjectScope(c, resourceProjectId) {
+  const auth = getAuth(c);
+  if (auth.kind === "project" && resourceProjectId !== auth.projectId) {
+    throw new NotFoundError("resource", resourceProjectId);
+  }
+}
+function requireAdminLike(c) {
+  const auth = getAuth(c);
+  if (auth.kind === "project") {
+    throw new ForbiddenError2();
+  }
+}
+function resolveProjectFilter(c, requested) {
+  const auth = getAuth(c);
+  if (auth.kind === "project") return auth.projectId;
+  return requested;
+}
+
+// src/routes/project.routes.ts
 import {
   createProjectRepo,
   ProjectCreateSchema,
   ProjectUpdateSchema,
-  NotFoundError,
+  NotFoundError as NotFoundError2,
   ConflictError,
   BIZ_CODE_MESSAGES,
   DEFAULT_PROJECT_KEY
@@ -167,7 +309,7 @@ import {
 async function loadProjectForWrite(projectRepo, projectId) {
   const project = await projectRepo.getById(projectId);
   if (!project) {
-    throw new NotFoundError("project", projectId, {
+    throw new NotFoundError2("project", projectId, {
       bizCode: "PROJECT_NOT_FOUND",
       message: BIZ_CODE_MESSAGES.PROJECT_NOT_FOUND
     });
@@ -185,13 +327,19 @@ function createProjectRoutes(client) {
   const repo = createProjectRepo(client.db());
   app.get("/api/projects", async (c) => {
     const status = c.req.query("status");
+    const auth = getAuth(c);
+    if (auth.kind === "project") {
+      const own = await repo.getById(auth.projectId);
+      return c.json(own ? [own] : []);
+    }
     const projects = await repo.list();
     return c.json(status ? projects.filter((p) => p.status === status) : projects);
   });
   app.get("/api/projects/:id", async (c) => {
     const id = c.req.param("id");
     const project = await repo.getById(id);
-    if (!project) throw new NotFoundError("project", id);
+    if (!project) throw new NotFoundError2("project", id);
+    assertProjectScope(c, project.id ?? id);
     return c.json(project);
   });
   app.post("/api/projects", zValidator("json", ProjectCreateSchema), async (c) => {
@@ -202,7 +350,7 @@ function createProjectRoutes(client) {
     const id = c.req.param("id");
     const data = c.req.valid("json");
     const existing = await repo.getById(id);
-    if (!existing) throw new NotFoundError("project", id);
+    if (!existing) throw new NotFoundError2("project", id);
     if (data.status === "archived" && existing.key === DEFAULT_PROJECT_KEY) {
       throw new ConflictError("project", id, {
         bizCode: "DEFAULT_PROJECT_IMMUTABLE",
@@ -218,7 +366,7 @@ function createProjectRoutes(client) {
     if (data.description !== void 0) patch.description = data.description;
     if (data.status !== void 0) patch.status = data.status;
     const project = await repo.update(id, patch);
-    if (!project) throw new NotFoundError("project", id);
+    if (!project) throw new NotFoundError2("project", id);
     return c.json(project);
   });
   return app;
@@ -239,7 +387,7 @@ import {
   OBJECT_ID_HEX,
   assertReferencesDeletable,
   assertReferenceAggregateLimit,
-  NotFoundError as NotFoundError2,
+  NotFoundError as NotFoundError3,
   ConflictError as ConflictError2,
   BadRequestError,
   BIZ_CODE_MESSAGES as BIZ_CODE_MESSAGES2
@@ -283,6 +431,10 @@ function createSkillRoutes(client) {
   app.get("/api/skills", zValidator2("query", SkillListQuerySchema), async (c) => {
     const q = c.req.valid("query");
     const opts = { includeDisabled: q.includeDisabled, q: q.q };
+    const auth = getAuth(c);
+    if (auth.kind === "project") {
+      return c.json((await repo.listSkillsByScope(auth.projectId, opts)).map(skillToListItem));
+    }
     if (q.scope) {
       return c.json((await repo.listSkillsByScopeFilter(q.scope, q.projectId, opts)).map(skillToListItem));
     }
@@ -290,17 +442,28 @@ function createSkillRoutes(client) {
       (q.projectId ? await repo.listSkillsByScope(q.projectId, opts) : await repo.listSkills(opts)).map(skillToListItem)
     );
   });
+  app.get("/api/skills/:name/scope-availability", zValidator2("query", z.object({ scope: z.enum(["global", "project"]) })), async (c) => {
+    const name = c.req.param("name");
+    const { scope } = c.req.valid("query");
+    return c.json({ name, scope, available: !await repo.hasNameScopeConflict(name, scope) });
+  });
   app.get("/api/skills/:name", zValidator2("query", SkillByNameQuerySchema), async (c) => {
     const name = c.req.param("name");
     const q = c.req.valid("query");
     const skill = await resolveAssetByScope(repo, name, q, { includeDisabled: q.includeDisabled });
-    if (!skill) throw new NotFoundError2("skill", name);
+    if (!skill) throw new NotFoundError3("skill", name);
+    assertProjectVisible(c, skill.projectId);
     return c.json(skill);
   });
   app.post("/api/skills", zValidator2("json", SkillCreateSchema), async (c) => {
     const data = c.req.valid("json");
     await assertCategoryValid(data.category);
-    if (data.scope === "project") await loadProjectForWrite(projectRepo, data.projectId);
+    if (data.scope === "project") {
+      assertProjectScope(c, data.projectId);
+      await loadProjectForWrite(projectRepo, data.projectId);
+    } else {
+      requireAdminLike(c);
+    }
     return c.json(await repo.createSkill(data), 201);
   });
   app.put("/api/skills/:name", zValidator2("query", SkillByNameQuerySchema), zValidator2("json", SkillUpdateSchema), async (c) => {
@@ -308,7 +471,12 @@ function createSkillRoutes(client) {
     const data = c.req.valid("json");
     const q = c.req.valid("query");
     const existing = await resolveAssetByScope(repo, name, q, { includeDisabled: true });
-    if (!existing) throw new NotFoundError2("skill", name);
+    if (!existing) throw new NotFoundError3("skill", name);
+    if ((q.scope ?? "global") === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
+    }
     if (data.category !== void 0) await assertCategoryValid(data.category);
     if (isScopeMutation(existing, data)) {
       throw new ConflictError2("skill", name, {
@@ -333,7 +501,7 @@ function createSkillRoutes(client) {
       nextReferences: data.references
     });
     const skill = await repo.updateByNameScoped(name, q.scope ?? "global", q.projectId, data);
-    if (!skill) throw new NotFoundError2("skill", name);
+    if (!skill) throw new NotFoundError3("skill", name);
     return c.json(skill);
   });
   app.post("/api/skills/:name/copy", zValidator2("query", SkillByNameQuerySchema), zValidator2("json", SkillCopySchema), async (c) => {
@@ -341,9 +509,13 @@ function createSkillRoutes(client) {
     const input = c.req.valid("json");
     const q = c.req.valid("query");
     const existing = await resolveAssetByScope(repo, name, q, { includeDisabled: true });
-    if (!existing) throw new NotFoundError2("skill", name);
+    if (!existing) throw new NotFoundError3("skill", name);
+    assertProjectVisible(c, existing.projectId);
     if (input.newScope === "project") {
+      assertProjectScope(c, input.targetProjectId);
       await loadProjectForWrite(projectRepo, input.targetProjectId);
+    } else {
+      requireAdminLike(c);
     }
     const copy = await repo.copySkill(
       name,
@@ -357,9 +529,14 @@ function createSkillRoutes(client) {
     const name = c.req.param("name");
     const q = c.req.valid("query");
     const existing = await resolveAssetByScope(repo, name, q, { includeDisabled: true });
-    if (!existing) throw new NotFoundError2("skill", name);
+    if (!existing) throw new NotFoundError3("skill", name);
+    if ((q.scope ?? "global") === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
+    }
     const deleted = await repo.deleteByNameScoped(name, q.scope ?? "global", q.projectId);
-    if (!deleted) throw new NotFoundError2("skill", name);
+    if (!deleted) throw new NotFoundError3("skill", name);
     return c.body(null, 204);
   });
   app.post("/api/skills/:name/enabled", zValidator2("query", SkillByNameQuerySchema), zValidator2("json", AssetSetEnabledSchema), async (c) => {
@@ -367,13 +544,16 @@ function createSkillRoutes(client) {
     const body = c.req.valid("json");
     const q = c.req.valid("query");
     const existing = await resolveAssetByScope(repo, name, q, { includeDisabled: true });
-    if (!existing) throw new NotFoundError2("skill", name);
+    if (!existing) throw new NotFoundError3("skill", name);
     const scope = q.scope ?? "global";
-    if (scope === "project") {
+    if (scope === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
       await loadProjectForWrite(projectRepo, existing.projectId ?? q.projectId);
     }
     const skill = await repo.updateByNameScoped(name, scope, q.projectId, { enabled: body.enabled });
-    if (!skill) throw new NotFoundError2("skill", name);
+    if (!skill) throw new NotFoundError3("skill", name);
     return c.json({ name: skill.name, enabled: skill.enabled ?? true });
   });
   return app;
@@ -403,7 +583,7 @@ import {
   AssetSetEnabledSchema as AssetSetEnabledSchema2,
   assertReferencesDeletable as assertReferencesDeletable2,
   assertReferenceAggregateLimit as assertReferenceAggregateLimit2,
-  NotFoundError as NotFoundError3,
+  NotFoundError as NotFoundError4,
   ConflictError as ConflictError3,
   BIZ_CODE_MESSAGES as BIZ_CODE_MESSAGES3,
   assertBoundSkillsCompatible,
@@ -431,6 +611,10 @@ function createAgentRoutes(client) {
   app.get("/api/agents", zValidator3("query", AgentListQuerySchema), async (c) => {
     const q = c.req.valid("query");
     const opts = { includeDisabled: q.includeDisabled, q: q.q };
+    const auth = getAuth(c);
+    if (auth.kind === "project") {
+      return c.json((await repo.listAgentsByScope(auth.projectId, opts)).map(agentToListItem));
+    }
     if (q.scope) {
       return c.json((await repo.listAgentsByScopeFilter(q.scope, q.projectId, opts)).map(agentToListItem));
     }
@@ -438,16 +622,27 @@ function createAgentRoutes(client) {
       (q.projectId ? await repo.listAgentsByScope(q.projectId, opts) : await repo.listAgents(opts)).map(agentToListItem)
     );
   });
+  app.get("/api/agents/:name/scope-availability", zValidator3("query", z2.object({ scope: z2.enum(["global", "project"]) })), async (c) => {
+    const name = c.req.param("name");
+    const { scope } = c.req.valid("query");
+    return c.json({ name, scope, available: !await repo.hasNameScopeConflict(name, scope) });
+  });
   app.get("/api/agents/:name", zValidator3("query", SkillByNameQuerySchema), async (c) => {
     const name = c.req.param("name");
     const q = c.req.valid("query");
     const agent = await resolveAssetByScope(repo, name, q, { includeDisabled: q.includeDisabled });
-    if (!agent) throw new NotFoundError3("agent", name);
+    if (!agent) throw new NotFoundError4("agent", name);
+    assertProjectVisible(c, agent.projectId);
     return c.json(agent);
   });
   app.post("/api/agents", zValidator3("json", AgentCreateSchema), async (c) => {
     const data = c.req.valid("json");
-    if (data.scope === "project") await loadProjectForWrite(projectRepo, data.projectId);
+    if (data.scope === "project") {
+      assertProjectScope(c, data.projectId);
+      await loadProjectForWrite(projectRepo, data.projectId);
+    } else {
+      requireAdminLike(c);
+    }
     await assertBoundSkillsCompatible(skillRepo, data.scope, data.projectId, data.boundSkills);
     await assertModelAliasExists(aliasRepo, data.model);
     return c.json(await repo.createAgent(data), 201);
@@ -457,7 +652,12 @@ function createAgentRoutes(client) {
     const data = c.req.valid("json");
     const q = c.req.valid("query");
     const existing = await resolveAssetByScope(repo, name, q, { includeDisabled: true });
-    if (!existing) throw new NotFoundError3("agent", name);
+    if (!existing) throw new NotFoundError4("agent", name);
+    if ((q.scope ?? "global") === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
+    }
     let payload = data;
     if (data["function"] !== void 0 && data["function"] !== existing["function"]) {
       payload = { ...data, version: bumpPatch(data.version ?? existing.version) };
@@ -496,7 +696,7 @@ function createAgentRoutes(client) {
       nextReferences: data.references
     });
     const agent = await repo.updateByNameScoped(name, q.scope ?? "global", q.projectId, payload);
-    if (!agent) throw new NotFoundError3("agent", name);
+    if (!agent) throw new NotFoundError4("agent", name);
     return c.json(agent);
   });
   app.post("/api/agents/:name/copy", zValidator3("query", SkillByNameQuerySchema), zValidator3("json", AgentCopySchema), async (c) => {
@@ -504,9 +704,13 @@ function createAgentRoutes(client) {
     const input = c.req.valid("json");
     const q = c.req.valid("query");
     const existing = await resolveAssetByScope(repo, name, q, { includeDisabled: true });
-    if (!existing) throw new NotFoundError3("agent", name);
+    if (!existing) throw new NotFoundError4("agent", name);
+    assertProjectVisible(c, existing.projectId);
     if (input.newScope === "project") {
+      assertProjectScope(c, input.targetProjectId);
       await loadProjectForWrite(projectRepo, input.targetProjectId);
+    } else {
+      requireAdminLike(c);
     }
     const copy = await repo.copyAgent(
       name,
@@ -521,9 +725,14 @@ function createAgentRoutes(client) {
     const name = c.req.param("name");
     const q = c.req.valid("query");
     const existing = await resolveAssetByScope(repo, name, q, { includeDisabled: true });
-    if (!existing) throw new NotFoundError3("agent", name);
+    if (!existing) throw new NotFoundError4("agent", name);
+    if ((q.scope ?? "global") === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
+    }
     const deleted = await repo.deleteByNameScoped(name, q.scope ?? "global", q.projectId);
-    if (!deleted) throw new NotFoundError3("agent", name);
+    if (!deleted) throw new NotFoundError4("agent", name);
     return c.body(null, 204);
   });
   app.post("/api/agents/:name/enabled", zValidator3("query", SkillByNameQuerySchema), zValidator3("json", AssetSetEnabledSchema2), async (c) => {
@@ -531,13 +740,16 @@ function createAgentRoutes(client) {
     const body = c.req.valid("json");
     const q = c.req.valid("query");
     const existing = await resolveAssetByScope(repo, name, q, { includeDisabled: true });
-    if (!existing) throw new NotFoundError3("agent", name);
+    if (!existing) throw new NotFoundError4("agent", name);
     const scope = q.scope ?? "global";
-    if (scope === "project") {
+    if (scope === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
       await loadProjectForWrite(projectRepo, existing.projectId ?? q.projectId);
     }
     const agent = await repo.updateByNameScoped(name, scope, q.projectId, { enabled: body.enabled });
-    if (!agent) throw new NotFoundError3("agent", name);
+    if (!agent) throw new NotFoundError4("agent", name);
     return c.json({ name: agent.name, enabled: agent.enabled ?? true });
   });
   return app;
@@ -550,7 +762,7 @@ import {
   createModelAliasRepo as createModelAliasRepo2,
   ModelAliasCreateSchema,
   ModelAliasUpdateSchema,
-  NotFoundError as NotFoundError4,
+  NotFoundError as NotFoundError5,
   ConflictError as ConflictError4,
   BIZ_CODE_MESSAGES as BIZ_CODE_MESSAGES4
 } from "@siming-org/core";
@@ -575,7 +787,7 @@ function createModelAliasRoutes(client) {
     const code = c.req.param("code");
     const data = c.req.valid("json");
     const existing = await repo.getByCode(code);
-    if (!existing) throw new NotFoundError4("model-alias", code);
+    if (!existing) throw new NotFoundError5("model-alias", code);
     if (data.code !== void 0 && data.code !== code) {
       throw new ConflictError4("model-alias", code, {
         bizCode: "MODEL_CODE_IMMUTABLE",
@@ -586,13 +798,13 @@ function createModelAliasRoutes(client) {
     if (data.name !== void 0) patch.name = data.name;
     if (data.realModel !== void 0) patch.realModel = data.realModel;
     const alias = await repo.updateByCode(code, patch);
-    if (!alias) throw new NotFoundError4("model-alias", code);
+    if (!alias) throw new NotFoundError5("model-alias", code);
     return c.json(alias);
   });
   app.delete("/api/model-aliases/:code", async (c) => {
     const code = c.req.param("code");
     const deleted = await repo.deleteByCode(code);
-    if (!deleted) throw new NotFoundError4("model-alias", code);
+    if (!deleted) throw new NotFoundError5("model-alias", code);
     return c.body(null, 204);
   });
   return app;
@@ -608,98 +820,152 @@ import {
   createSkillRepo as createSkillRepo3,
   createAgentRepo as createAgentRepo2,
   createModelAliasRepo as createModelAliasRepo3,
+  createNodePresetRepo,
   DagTemplateCreateSchema,
   DagTemplateCopySchema,
   DagTemplateUpdateSchema,
   AssetSetEnabledSchema as AssetSetEnabledSchema3,
   ImportPlanRequestSchema,
   ImportApplyRequestSchema,
+  UpgradeApplyRequestSchema,
+  assertUniqueNodeIds,
+  buildUpgradePlan,
+  applyUpgradeDecisions,
   composeExportBundle,
   buildImportPlan,
   applyImport,
-  NotFoundError as NotFoundError5,
+  NotFoundError as NotFoundError7,
   ConflictError as ConflictError5,
   BIZ_CODE_MESSAGES as BIZ_CODE_MESSAGES5
 } from "@siming-org/core";
+
+// src/routes/template-ref.ts
+import { NotFoundError as NotFoundError6 } from "@siming-org/core";
+var TEMPLATE_CANDIDATE_LIMIT = 5;
+async function resolveTemplateOr404(repo, ref, projectCtx, refHint) {
+  const template = await repo.resolveTemplateByRef(ref, projectCtx);
+  if (!template || template.id === void 0) {
+    const message = !/^[a-f0-9]{24}$/.test(ref) && projectCtx === void 0 ? `dag-template not found: ${ref}${refHint}` : `dag-template not found: ${ref}`;
+    const err = new NotFoundError6("dag-template", ref, { message });
+    if (projectCtx !== void 0) {
+      err.withTemplateCandidates(await repo.findSimilarTemplates(projectCtx, ref, TEMPLATE_CANDIDATE_LIMIT));
+    }
+    throw err;
+  }
+  return template;
+}
+
+// src/routes/dag-template.routes.ts
 var DagTemplateListQuerySchema = z3.object({
   projectId: z3.string().optional(),
   name: z3.string().optional(),
+  code: z3.string().optional(),
   includeDisabled: z3.stringbool().optional()
 });
+var QUERY_PROJECT_HINT = "\uFF08code \u5F62\u6001\u5BFB\u5740\u9700 ?projectId= \u6307\u5B9A\u9879\u76EE\u2014\u2014code \u9879\u76EE\u5185\u552F\u4E00\uFF0C\u65E0\u9879\u76EE\u57DF\u4E0D\u53EF\u6D88\u6B67\uFF1B\u6216\u6539\u4F20 24 \u4F4D\u6570\u636E\u5E93 id\uFF09";
 function createDagTemplateRoutes(client) {
   const app = new Hono7();
   const repo = createDagTemplateRepo(client.db());
   const projectRepo = createProjectRepo4(client.db());
+  const nodePresetRepo = createNodePresetRepo(client.db());
   const transferDeps = {
     templateRepo: repo,
     skillRepo: createSkillRepo3(client.db()),
     agentRepo: createAgentRepo2(client.db()),
-    modelAliasRepo: createModelAliasRepo3(client.db())
+    modelAliasRepo: createModelAliasRepo3(client.db()),
+    nodePresetRepo
   };
   app.get("/api/dag/templates", zValidator5("query", DagTemplateListQuerySchema), async (c) => {
     const q = c.req.valid("query");
+    const projectFilter = resolveProjectFilter(c, q.projectId);
     return c.json(
       await repo.listDagTemplates({
-        ...q.projectId ? { projectId: q.projectId } : {},
+        ...projectFilter ? { projectId: projectFilter } : {},
         ...q.name ? { name: q.name } : {},
+        ...q.code ? { code: q.code } : {},
         ...q.includeDisabled !== void 0 ? { includeDisabled: q.includeDisabled } : {}
       })
     );
   });
   app.get("/api/dag/templates/:id", async (c) => {
-    const id = c.req.param("id");
-    const template = await repo.getById(id);
-    if (!template) throw new NotFoundError5("dag-template", id);
+    const ref = c.req.param("id");
+    const template = await resolveTemplateOr404(repo, ref, resolveProjectFilter(c, c.req.query("projectId")), QUERY_PROJECT_HINT);
+    assertProjectScope(c, template.projectId);
     return c.json(template);
   });
   app.post("/api/dag/templates/:id/enabled", zValidator5("json", AssetSetEnabledSchema3), async (c) => {
-    const id = c.req.param("id");
+    const ref = c.req.param("id");
     const body = c.req.valid("json");
-    const existing = await repo.getById(id);
-    if (!existing) throw new NotFoundError5("dag-template", id);
+    const existing = await resolveTemplateOr404(repo, ref, resolveProjectFilter(c, c.req.query("projectId")), QUERY_PROJECT_HINT);
+    assertProjectScope(c, existing.projectId);
     await loadProjectForWrite(projectRepo, existing.projectId);
-    const template = await repo.update(id, { enabled: body.enabled });
-    if (!template) throw new NotFoundError5("dag-template", id);
+    const template = await repo.update(existing.id, { enabled: body.enabled });
+    if (!template) throw new NotFoundError7("dag-template", existing.id);
     return c.json({ id: template.id, name: template.name, enabled: template.enabled ?? true });
   });
   app.post("/api/dag/templates", zValidator5("json", DagTemplateCreateSchema), async (c) => {
     const data = c.req.valid("json");
+    assertProjectScope(c, data.projectId);
     await loadProjectForWrite(projectRepo, data.projectId);
+    assertUniqueNodeIds(data.nodes);
+    if (data.code !== void 0) {
+      const dup = await repo._collection.findOne(
+        { projectId: data.projectId, code: data.code },
+        { projection: { _id: 1, name: 1 } }
+      );
+      if (dup) {
+        throw new ConflictError5("dag-template", `code conflict: ${data.code}`, {
+          bizCode: "TEMPLATE_CODE_CONFLICT",
+          message: `${BIZ_CODE_MESSAGES5.TEMPLATE_CODE_CONFLICT}\uFF08\u51B2\u7A81\u6A21\u677F\uFF1A${String(dup.name)}\uFF09`
+        });
+      }
+    }
     return c.json(await repo.createDagTemplate(data), 201);
   });
   app.put("/api/dag/templates/:id", zValidator5("json", DagTemplateUpdateSchema), async (c) => {
-    const id = c.req.param("id");
+    const ref = c.req.param("id");
     const data = c.req.valid("json");
-    const existing = await repo.getById(id);
-    if (!existing) throw new NotFoundError5("dag-template", id);
-    if (data.projectId !== void 0 && data.projectId !== existing.projectId) {
-      throw new ConflictError5("dag-template", id, {
+    const existing = await resolveTemplateOr404(repo, ref, resolveProjectFilter(c, c.req.query("projectId")), QUERY_PROJECT_HINT);
+    assertProjectScope(c, existing.projectId);
+    if (data.code !== void 0 && data.code !== existing.code) {
+      throw new ConflictError5("dag-template", ref, {
+        bizCode: "TEMPLATE_CODE_IMMUTABLE",
+        message: BIZ_CODE_MESSAGES5.TEMPLATE_CODE_IMMUTABLE
+      });
+    }
+    const { code: _codeStrip, ...writable } = data;
+    if (writable.projectId !== void 0 && writable.projectId !== existing.projectId) {
+      throw new ConflictError5("dag-template", ref, {
         bizCode: "TEMPLATE_PROJECT_IMMUTABLE",
         message: BIZ_CODE_MESSAGES5.TEMPLATE_PROJECT_IMMUTABLE
       });
     }
     await loadProjectForWrite(projectRepo, existing.projectId);
-    if (data.name !== void 0 && data.name !== existing.name) {
+    if (data.nodes !== void 0) {
+      assertUniqueNodeIds(data.nodes);
+    }
+    if (writable.name !== void 0 && writable.name !== existing.name) {
       const dup = await repo._collection.findOne(
-        { projectId: existing.projectId, name: data.name },
+        { projectId: existing.projectId, name: writable.name },
         { projection: { _id: 1 } }
       );
       if (dup) {
-        throw new ConflictError5("dag-template", `name conflict: ${data.name}`, {
+        throw new ConflictError5("dag-template", `name conflict: ${writable.name}`, {
           bizCode: "TEMPLATE_NAME_CONFLICT",
           message: BIZ_CODE_MESSAGES5.TEMPLATE_NAME_CONFLICT
         });
       }
     }
-    const template = await repo.update(id, data);
-    if (!template) throw new NotFoundError5("dag-template", id);
+    const template = await repo.update(existing.id, writable);
+    if (!template) throw new NotFoundError7("dag-template", existing.id);
     return c.json(template);
   });
   app.post("/api/dag/templates/:id/copy", zValidator5("json", DagTemplateCopySchema), async (c) => {
-    const id = c.req.param("id");
+    const ref = c.req.param("id");
     const input = c.req.valid("json");
-    const existing = await repo.getById(id);
-    if (!existing) throw new NotFoundError5("dag-template", id);
+    const existing = await resolveTemplateOr404(repo, ref, resolveProjectFilter(c, c.req.query("projectId")), QUERY_PROJECT_HINT);
+    assertProjectScope(c, existing.projectId);
+    assertProjectScope(c, input.targetProjectId);
     await loadProjectForWrite(projectRepo, input.targetProjectId);
     const dup = await repo._collection.findOne(
       { projectId: input.targetProjectId, name: input.newName },
@@ -711,40 +977,289 @@ function createDagTemplateRoutes(client) {
         message: BIZ_CODE_MESSAGES5.TEMPLATE_NAME_CONFLICT
       });
     }
-    const copy = await repo.copyDagTemplate(id, input.targetProjectId, input.newName);
+    const copy = await repo.copyDagTemplate(existing.id, input.targetProjectId, input.newName, input.newCode);
     return c.json(copy, 201);
   });
   app.get("/api/dag/templates/:id/export", async (c) => {
-    const id = c.req.param("id");
-    return c.json(await composeExportBundle(transferDeps, id));
+    const ref = c.req.param("id");
+    const template = await resolveTemplateOr404(repo, ref, resolveProjectFilter(c, c.req.query("projectId")), QUERY_PROJECT_HINT);
+    assertProjectScope(c, template.projectId);
+    return c.json(await composeExportBundle(transferDeps, template.id));
   });
   app.post("/api/dag/templates/import/plan", zValidator5("json", ImportPlanRequestSchema), async (c) => {
     const body = c.req.valid("json");
+    assertProjectScope(c, body.targetProjectId);
     await loadProjectForWrite(projectRepo, body.targetProjectId);
     return c.json(await buildImportPlan(transferDeps, body.targetProjectId, body.bundle));
   });
   app.post("/api/dag/templates/import/apply", zValidator5("json", ImportApplyRequestSchema), async (c) => {
     const body = c.req.valid("json");
+    assertProjectScope(c, body.targetProjectId);
     await loadProjectForWrite(projectRepo, body.targetProjectId);
     return c.json(await applyImport(transferDeps, body.targetProjectId, body.bundle, body.decisions));
   });
-  app.delete("/api/dag/templates/:id", async (c) => {
+  app.get("/api/dag/templates/:id/upgrade/plan", async (c) => {
     const id = c.req.param("id");
-    const deleted = await repo.delete(id);
-    if (!deleted) throw new NotFoundError5("dag-template", id);
+    const template = await repo.getById(id);
+    if (!template) throw new NotFoundError7("dag-template", id);
+    assertProjectScope(c, template.projectId);
+    const codes = [...new Set(template.nodes.flatMap((n) => n.sourcePreset ? [n.sourcePreset.code] : []))];
+    const presetsByCode = await nodePresetRepo.listByCodes(codes);
+    return c.json(buildUpgradePlan(template, presetsByCode));
+  });
+  app.post("/api/dag/templates/:id/upgrade/apply", zValidator5("json", UpgradeApplyRequestSchema), async (c) => {
+    const id = c.req.param("id");
+    const body = c.req.valid("json");
+    const template = await repo.getById(id);
+    if (!template) throw new NotFoundError7("dag-template", id);
+    assertProjectScope(c, template.projectId);
+    await loadProjectForWrite(projectRepo, template.projectId);
+    const codes = [...new Set(template.nodes.flatMap((n) => n.sourcePreset ? [n.sourcePreset.code] : []))];
+    const presetsByCode = await nodePresetRepo.listByCodes(codes);
+    const outcome = applyUpgradeDecisions(template, presetsByCode, body.decisions);
+    let version = template.version;
+    if (outcome.nextVersion !== null) {
+      const updated = await repo.update(id, { nodes: outcome.nodes, version: outcome.nextVersion });
+      if (!updated) throw new NotFoundError7("dag-template", id);
+      version = updated.version;
+    }
+    return c.json({ template: { id, version }, results: outcome.results });
+  });
+  app.delete("/api/dag/templates/:id", async (c) => {
+    const ref = c.req.param("id");
+    const existing = await resolveTemplateOr404(repo, ref, resolveProjectFilter(c, c.req.query("projectId")), QUERY_PROJECT_HINT);
+    assertProjectScope(c, existing.projectId);
+    const deleted = await repo.delete(existing.id);
+    if (!deleted) throw new NotFoundError7("dag-template", existing.id);
     return c.body(null, 204);
   });
   return app;
 }
 
-// src/routes/task.routes.ts
+// src/routes/node-preset.routes.ts
 import { Hono as Hono8 } from "hono";
 import { zValidator as zValidator6 } from "@hono/zod-validator";
 import { z as z4 } from "zod";
+import {
+  createNodePresetRepo as createNodePresetRepo2,
+  createProjectRepo as createProjectRepo5,
+  NodePresetCreateSchema,
+  NodePresetUpdateSchema,
+  NodePresetCopySchema,
+  AssetSetEnabledSchema as AssetSetEnabledSchema4,
+  NODE_PRESET_CODE_PATTERN,
+  computeNodeContentHash,
+  NotFoundError as NotFoundError8,
+  ConflictError as ConflictError6,
+  ValidationError,
+  BIZ_CODE_MESSAGES as BIZ_CODE_MESSAGES6
+} from "@siming-org/core";
+var NodePresetListQuerySchema = z4.object({
+  projectId: z4.string().optional(),
+  scope: z4.enum(["global", "project"]).optional(),
+  q: z4.string().trim().min(1).max(100).optional(),
+  includeDisabled: z4.stringbool().optional()
+}).superRefine((val, ctx) => {
+  if (val.scope === "project" && val.projectId === void 0) {
+    ctx.addIssue({ code: "custom", path: ["projectId"], message: "scope=project \u65F6 projectId \u5FC5\u586B" });
+  }
+});
+var NodePresetByCodeQuerySchema = z4.object({
+  includeDisabled: z4.stringbool().optional()
+});
+function assertCodeShape(code) {
+  if (!NODE_PRESET_CODE_PATTERN.test(code)) {
+    throw new NotFoundError8("node-preset", code);
+  }
+}
+function nodePresetToListItem(preset) {
+  const { prompt: _prompt, ...rest } = preset;
+  return { ...rest, agents: preset.agents ?? [] };
+}
+var CONTENT_FIELDS = ["nodeId", "phase", "track", "prompt", "skills", "agents", "label"];
+function isContentChange(existing, data) {
+  return CONTENT_FIELDS.some((field) => {
+    const next = data[field];
+    if (next === void 0) return false;
+    const current = existing[field];
+    if (field === "skills" || field === "agents") {
+      const currentItems = current ?? [];
+      return JSON.stringify([...next].sort()) !== JSON.stringify([...currentItems].sort());
+    }
+    return next !== current;
+  });
+}
+function createNodePresetRoutes(client) {
+  const app = new Hono8();
+  const repo = createNodePresetRepo2(client.db());
+  const projectRepo = createProjectRepo5(client.db());
+  app.get("/api/node-presets", zValidator6("query", NodePresetListQuerySchema), async (c) => {
+    const q = c.req.valid("query");
+    const auth = getAuth(c);
+    const filter = { scope: q.scope, projectId: q.projectId, q: q.q, includeDisabled: q.includeDisabled };
+    if (auth.kind === "project") {
+      return c.json(
+        (await repo.listNodePresets({ ...filter, scope: void 0, projectId: auth.projectId })).map(nodePresetToListItem)
+      );
+    }
+    return c.json((await repo.listNodePresets(filter)).map(nodePresetToListItem));
+  });
+  app.get("/api/node-presets/:code/availability", async (c) => {
+    const code = c.req.param("code");
+    assertCodeShape(code);
+    return c.json({ code, available: !await repo.isCodeOccupied(code) });
+  });
+  app.get("/api/node-presets/:code", zValidator6("query", NodePresetByCodeQuerySchema), async (c) => {
+    const code = c.req.param("code");
+    const q = c.req.valid("query");
+    assertCodeShape(code);
+    const preset = await repo.getByCode(code, { includeDisabled: q.includeDisabled });
+    if (!preset) throw new NotFoundError8("node-preset", code);
+    assertProjectVisible(c, preset.projectId);
+    return c.json({ ...preset, agents: preset.agents ?? [], contentHash: computeNodeContentHash(preset) });
+  });
+  app.post("/api/node-presets", zValidator6("json", NodePresetCreateSchema), async (c) => {
+    const data = c.req.valid("json");
+    if (data.scope === "project") {
+      assertProjectScope(c, data.projectId);
+      await loadProjectForWrite(projectRepo, data.projectId);
+    } else {
+      requireAdminLike(c);
+    }
+    const created = await repo.createNodePreset(data);
+    return c.json({ ...created, agents: created.agents ?? [] }, 201);
+  });
+  app.put("/api/node-presets/:code", zValidator6("query", NodePresetByCodeQuerySchema), zValidator6("json", NodePresetUpdateSchema), async (c) => {
+    const code = c.req.param("code");
+    const data = c.req.valid("json");
+    assertCodeShape(code);
+    const existing = await repo.getByCode(code, { includeDisabled: true });
+    if (!existing) throw new NotFoundError8("node-preset", code);
+    if (existing.scope === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
+      await loadProjectForWrite(projectRepo, existing.projectId ?? "");
+    }
+    if (data.code !== void 0 && data.code !== existing.code) {
+      throw new ConflictError6("node-preset", code, {
+        bizCode: "NODE_PRESET_CODE_IMMUTABLE",
+        message: BIZ_CODE_MESSAGES6.NODE_PRESET_CODE_IMMUTABLE
+      });
+    }
+    if (isScopeMutation(existing, data)) {
+      throw new ConflictError6("node-preset", code, {
+        bizCode: "SCOPE_IMMUTABLE",
+        message: BIZ_CODE_MESSAGES6.SCOPE_IMMUTABLE
+      });
+    }
+    if (isContentChange(existing, data) && (data.version === void 0 || data.version === existing.version)) {
+      throw new ValidationError(
+        "\u8282\u70B9\u5185\u5BB9\u53D8\u66F4\u5FC5\u987B\u540C\u6B65\u63D0\u5347\u7248\u672C\u53F7\uFF08\u643A\u5E26\u53D8\u66F4\u5B57\u6BB5\u65F6 version \u5FC5\u586B\u4E14\u4E0D\u5F97\u4E0E\u73B0\u503C\u76F8\u540C\uFF09",
+        [{ path: ["version"], message: "\u5185\u5BB9\u53D8\u66F4\u672A\u5347\u7248" }],
+        {
+          bizCode: "NODE_PRESET_VERSION_REQUIRED",
+          message: BIZ_CODE_MESSAGES6.NODE_PRESET_VERSION_REQUIRED
+        }
+      );
+    }
+    const preset = await repo.updateByCode(code, data);
+    if (!preset) throw new NotFoundError8("node-preset", code);
+    return c.json({ ...preset, agents: preset.agents ?? [] });
+  });
+  app.delete("/api/node-presets/:code", zValidator6("query", NodePresetByCodeQuerySchema), async (c) => {
+    const code = c.req.param("code");
+    assertCodeShape(code);
+    const existing = await repo.getByCode(code, { includeDisabled: true });
+    if (!existing) throw new NotFoundError8("node-preset", code);
+    if (existing.scope === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
+    }
+    const deleted = await repo.deleteByCode(code);
+    if (!deleted) throw new NotFoundError8("node-preset", code);
+    return c.body(null, 204);
+  });
+  app.post("/api/node-presets/:code/enabled", zValidator6("query", NodePresetByCodeQuerySchema), zValidator6("json", AssetSetEnabledSchema4), async (c) => {
+    const code = c.req.param("code");
+    const body = c.req.valid("json");
+    assertCodeShape(code);
+    const existing = await repo.getByCode(code, { includeDisabled: true });
+    if (!existing) throw new NotFoundError8("node-preset", code);
+    if (existing.scope === "global") {
+      requireAdminLike(c);
+    } else {
+      assertProjectScope(c, existing.projectId ?? "");
+      await loadProjectForWrite(projectRepo, existing.projectId ?? "");
+    }
+    const preset = await repo.updateByCode(code, { enabled: body.enabled });
+    if (!preset) throw new NotFoundError8("node-preset", code);
+    return c.json({ code: preset.code, enabled: preset.enabled ?? true });
+  });
+  app.post("/api/node-presets/:code/copy", zValidator6("query", NodePresetByCodeQuerySchema), zValidator6("json", NodePresetCopySchema), async (c) => {
+    const code = c.req.param("code");
+    const input = c.req.valid("json");
+    assertCodeShape(code);
+    const existing = await repo.getByCode(code, { includeDisabled: true });
+    if (!existing) throw new NotFoundError8("node-preset", code);
+    assertProjectVisible(c, existing.projectId);
+    if (input.newScope === "project") {
+      assertProjectScope(c, input.targetProjectId);
+      await loadProjectForWrite(projectRepo, input.targetProjectId);
+    } else {
+      requireAdminLike(c);
+    }
+    const copy = await repo.copyNodePreset(
+      code,
+      { scope: input.newScope, ...input.targetProjectId ? { projectId: input.targetProjectId } : {} },
+      input
+    );
+    return c.json({ ...copy, agents: copy.agents ?? [] }, 201);
+  });
+  return app;
+}
+
+// src/routes/node-library.routes.ts
+import { Hono as Hono9 } from "hono";
+import { zValidator as zValidator7 } from "@hono/zod-validator";
+import {
+  createNodeLibraryRepo,
+  createProjectRepo as createProjectRepo6,
+  NodeLibraryUpsertSchema
+} from "@siming-org/core";
+function createNodeLibraryRoutes(client) {
+  const app = new Hono9();
+  const repo = createNodeLibraryRepo(client.db());
+  const projectRepo = createProjectRepo6(client.db());
+  app.get("/api/node-libraries", async (c) => {
+    const auth = getAuth(c);
+    if (auth.kind === "project") {
+      return c.json(await repo.listNodeLibraries({ projectId: auth.projectId }));
+    }
+    return c.json(await repo.listNodeLibraries());
+  });
+  app.post("/api/node-libraries", zValidator7("json", NodeLibraryUpsertSchema), async (c) => {
+    const data = c.req.valid("json");
+    if (data.scope === "project") {
+      assertProjectScope(c, data.projectId);
+      await loadProjectForWrite(projectRepo, data.projectId);
+    } else {
+      requireAdminLike(c);
+    }
+    return c.json(await repo.upsertNodeLibrary(data));
+  });
+  return app;
+}
+
+// src/routes/task.routes.ts
+import { Hono as Hono10 } from "hono";
+import { zValidator as zValidator8 } from "@hono/zod-validator";
+import { z as z5 } from "zod";
 import {
   createTaskRepo,
   createDagTemplateRepo as createDagTemplateRepo2,
-  createProjectRepo as createProjectRepo5,
+  createProjectRepo as createProjectRepo7,
   TaskCreateInputSchema,
   AdvanceRequestSchema,
   ApproveRequestSchema,
@@ -758,11 +1273,11 @@ import {
   ARTIFACT_TYPES,
   NODE_ID_PATTERN,
   createEnumRegistryRepo as createEnumRegistryRepo2,
-  NotFoundError as NotFoundError6,
-  ConflictError as ConflictError6,
+  NotFoundError as NotFoundError9,
+  ConflictError as ConflictError7,
   BadRequestError as BadRequestError2,
-  ValidationError,
-  BIZ_CODE_MESSAGES as BIZ_CODE_MESSAGES6,
+  ValidationError as ValidationError2,
+  BIZ_CODE_MESSAGES as BIZ_CODE_MESSAGES7,
   advanceTask,
   approveTask,
   pauseTask,
@@ -774,43 +1289,43 @@ import {
   findNextEdge,
   generateEntryId
 } from "@siming-org/core";
-var TaskListQuerySchema = z4.object({
-  status: z4.string().optional(),
-  track: z4.string().optional(),
-  projectId: z4.string().optional(),
-  q: z4.string().trim().min(1).max(100).optional(),
-  page: z4.coerce.number().int().min(1).default(1),
-  limit: z4.coerce.number().int().min(1).max(500).default(20),
-  sort: z4.enum(["progress", "createdAt", "updatedAt"]).optional()
+var TaskListQuerySchema = z5.object({
+  status: z5.string().optional(),
+  track: z5.string().optional(),
+  projectId: z5.string().optional(),
+  q: z5.string().trim().min(1).max(100).optional(),
+  page: z5.coerce.number().int().min(1).default(1),
+  limit: z5.coerce.number().int().min(1).max(500).default(20),
+  sort: z5.enum(["progress", "createdAt", "updatedAt"]).optional()
 });
-var TaskPatchSchema = z4.object({
-  title: z4.string().min(1).optional()
+var TaskPatchSchema = z5.object({
+  title: z5.string().min(1).optional()
 });
-var TaskDocSetSchema = z4.object({
-  what: z4.string().min(1).max(2e3).optional(),
-  why: z4.string().min(1).max(2e3).optional(),
-  trackNote: z4.string().max(2e3).optional()
+var TaskDocSetSchema = z5.object({
+  what: z5.string().min(1).max(2e3).optional(),
+  why: z5.string().min(1).max(2e3).optional(),
+  trackNote: z5.string().max(2e3).optional()
 });
-var TextItemSchema = z4.object({ text: z4.string().min(1).max(2e3) });
-var RecordSummarySchema = z4.object({ summary: z4.string().min(1).max(2e3) });
-var CheckAddSchema = z4.object({ item: z4.string().min(1).max(2e3), passed: z4.boolean().optional() });
-var CheckPatchSchema = z4.object({ passed: z4.boolean() });
-var ArtifactAddSchema = z4.object({
-  type: z4.enum(ARTIFACT_TYPES),
-  path: z4.string().min(1).max(2e3),
-  note: z4.string().max(2e3).optional(),
+var TextItemSchema = z5.object({ text: z5.string().min(1).max(2e3) });
+var RecordSummarySchema = z5.object({ summary: z5.string().min(1).max(2e3) });
+var CheckAddSchema = z5.object({ item: z5.string().min(1).max(2e3), passed: z5.boolean().optional() });
+var CheckPatchSchema = z5.object({ passed: z5.boolean() });
+var ArtifactAddSchema = z5.object({
+  type: z5.enum(ARTIFACT_TYPES),
+  path: z5.string().min(1).max(2e3),
+  note: z5.string().max(2e3).optional(),
   /** 全文快照（CLI --file 读文件后传入；≤200k——续跑会话凭 context 自足） */
-  content: z4.string().max(2e5).optional()
+  content: z5.string().max(2e5).optional()
 });
-var ConfirmAddSchema = z4.object({ quote: z4.string().min(1).max(2e3) });
-var DecisionAddSchema = z4.object({
-  topic: z4.string().min(1).max(2e3),
-  decision: z4.string().min(1).max(2e3)
+var ConfirmAddSchema = z5.object({ quote: z5.string().min(1).max(2e3) });
+var DecisionAddSchema = z5.object({
+  topic: z5.string().min(1).max(2e3),
+  decision: z5.string().min(1).max(2e3)
 });
-var ReviewSetSchema = z4.object({
-  verdict: z4.enum(["pass", "fail"]),
-  rounds: z4.number().int().min(1),
-  critical: z4.number().int().min(0)
+var ReviewSetSchema = z5.object({
+  verdict: z5.enum(["pass", "fail"]),
+  rounds: z5.number().int().min(1),
+  critical: z5.number().int().min(0)
 });
 function normalizeTaskDoc(doc) {
   if (!doc) return null;
@@ -856,17 +1371,18 @@ function writeAck(entity, updated, entry, echo) {
   };
 }
 function createTaskRoutes(client) {
-  const app = new Hono8();
+  const app = new Hono10();
   const repo = createTaskRepo(client.db());
   const templateRepo = createDagTemplateRepo2(client.db());
-  const projectRepo = createProjectRepo5(client.db());
+  const projectRepo = createProjectRepo7(client.db());
   const enumRegistryRepo = createEnumRegistryRepo2(client.db());
-  app.get("/api/tasks", zValidator6("query", TaskListQuerySchema), async (c) => {
+  app.get("/api/tasks", zValidator8("query", TaskListQuerySchema), async (c) => {
     const q = c.req.valid("query");
     const { items, total } = await repo.listTasks({
       ...q.status ? { status: q.status } : {},
       ...q.track ? { track: q.track } : {},
-      ...q.projectId ? { projectId: q.projectId } : {},
+      // T202608310001：project 上下文强制覆写 projectId 过滤（"只能看到自己的"）
+      ...resolveProjectFilter(c, q.projectId) ? { projectId: resolveProjectFilter(c, q.projectId) } : {},
       ...q.q !== void 0 ? { q: q.q } : {},
       page: q.page,
       limit: q.limit,
@@ -877,10 +1393,17 @@ function createTaskRoutes(client) {
   app.get("/api/tasks/:taskId", async (c) => {
     const taskId = c.req.param("taskId");
     const task = await repo.getByTaskId(taskId);
-    if (!task) throw new NotFoundError6("task", taskId);
-    return c.json(task);
+    if (!task) throw new NotFoundError9("task", taskId);
+    assertProjectScope(c, task.projectId);
+    return c.json({
+      ...task,
+      dagInstance: {
+        ...task.dagInstance,
+        nodes: task.dagInstance.nodes.map((node) => ({ ...node, agents: node.agents ?? [] }))
+      }
+    });
   });
-  app.post("/api/tasks", zValidator6("json", TaskCreateInputSchema), async (c) => {
+  app.post("/api/tasks", zValidator8("json", TaskCreateInputSchema), async (c) => {
     const input = c.req.valid("json");
     const dagTracks = (await enumRegistryRepo.getEntries("dag_track")).filter(
       (e) => e.active && e.value !== "all"
@@ -892,21 +1415,26 @@ function createTaskRoutes(client) {
       );
     }
     assertTypeTrackCompatible(input.type, input.track);
-    const template = await templateRepo.getById(input.dagTemplateId);
-    if (!template) throw new NotFoundError6("dag-template", input.dagTemplateId);
+    const template = await resolveTemplateOr404(
+      templateRepo,
+      input.dagTemplateId,
+      resolveProjectFilter(c, input.projectId),
+      "\uFF08code \u5F62\u6001\u5BFB\u5740\u9700 body \u643A\u5E26 projectId \u6307\u5B9A\u9879\u76EE\u2014\u2014code \u9879\u76EE\u5185\u552F\u4E00\uFF0C\u65E0\u9879\u76EE\u57DF\u4E0D\u53EF\u6D88\u6B67\uFF1B\u6216\u6539\u4F20 24 \u4F4D\u6570\u636E\u5E93 id\uFF09"
+    );
     if (template.enabled === false) {
-      throw new ConflictError6("task", input.dagTemplateId, {
+      throw new ConflictError7("task", input.dagTemplateId, {
         bizCode: "TEMPLATE_DISABLED",
-        message: BIZ_CODE_MESSAGES6.TEMPLATE_DISABLED
+        message: BIZ_CODE_MESSAGES7.TEMPLATE_DISABLED
       });
     }
     if (input.projectId && input.projectId !== template.projectId) {
-      throw new ConflictError6("task", input.dagTemplateId, {
+      throw new ConflictError7("task", input.dagTemplateId, {
         bizCode: "TEMPLATE_PROJECT_MISMATCH",
-        message: BIZ_CODE_MESSAGES6.TEMPLATE_PROJECT_MISMATCH
+        message: BIZ_CODE_MESSAGES7.TEMPLATE_PROJECT_MISMATCH
       });
     }
     const resolvedProjectId = input.projectId ?? template.projectId;
+    assertProjectScope(c, resolvedProjectId);
     await loadProjectForWrite(projectRepo, resolvedProjectId);
     const created = await repo.createTask(input, template, resolvedProjectId);
     const firstActive = created.dagInstance.nodes.find(
@@ -923,23 +1451,23 @@ function createTaskRoutes(client) {
     };
     return c.json(response, 201);
   });
-  app.patch("/api/tasks/:taskId", zValidator6("json", TaskPatchSchema), async (c) => {
+  app.patch("/api/tasks/:taskId", zValidator8("json", TaskPatchSchema), async (c) => {
     const taskId = c.req.param("taskId");
     const body = c.req.valid("json");
     if (body.title === void 0) {
       throw new BadRequestError2("PATCH /api/tasks/:taskId \u9700\u8981\u81F3\u5C11\u4E00\u4E2A\u53EF\u66F4\u65B0\u5B57\u6BB5\uFF08title\uFF09");
     }
-    await assertTaskProjectActive(repo, projectRepo, taskId);
+    await assertTaskProjectActive(repo, projectRepo, taskId, c);
     const patch = { title: body.title };
     const updatedTask = await repo.updateTask(taskId, patch);
     return c.json(
       writeAck(updatedTask, ["title"], void 0, [{ path: "title", excerpt: excerpt(updatedTask.title) }])
     );
   });
-  app.post("/api/tasks/:taskId/advance", zValidator6("json", AdvanceRequestSchema), async (c) => {
+  app.post("/api/tasks/:taskId/advance", zValidator8("json", AdvanceRequestSchema), async (c) => {
     const taskId = c.req.param("taskId");
     const body = c.req.valid("json");
-    await assertTaskProjectActive(repo, projectRepo, taskId);
+    await assertTaskProjectActive(repo, projectRepo, taskId, c);
     const deps = mkDeps(repo);
     const result = await advanceTask(deps, taskId, {
       ...body.note !== void 0 ? { note: body.note } : {},
@@ -947,32 +1475,32 @@ function createTaskRoutes(client) {
     });
     return c.json(result, 200);
   });
-  app.post("/api/tasks/:taskId/approve", zValidator6("json", ApproveRequestSchema), async (c) => {
+  app.post("/api/tasks/:taskId/approve", zValidator8("json", ApproveRequestSchema), async (c) => {
     const taskId = c.req.param("taskId");
     const body = c.req.valid("json");
-    await assertTaskProjectActive(repo, projectRepo, taskId);
+    await assertTaskProjectActive(repo, projectRepo, taskId, c);
     const deps = mkDeps(repo);
     const result = await approveTask(deps, taskId, body);
     return c.json(result, 200);
   });
-  app.post("/api/tasks/:taskId/pause", zValidator6("json", PauseRequestSchema), async (c) => {
+  app.post("/api/tasks/:taskId/pause", zValidator8("json", PauseRequestSchema), async (c) => {
     const taskId = c.req.param("taskId");
     const body = c.req.valid("json");
-    await assertTaskProjectActive(repo, projectRepo, taskId);
+    await assertTaskProjectActive(repo, projectRepo, taskId, c);
     const result = await pauseTask(mkDeps(repo), taskId, body.reason);
     return c.json(writeAck(result, ["status", "pausedAt"], void 0, [{ path: "status", excerpt: result.status }]));
   });
-  app.post("/api/tasks/:taskId/resume", zValidator6("json", ResumeRequestSchema), async (c) => {
+  app.post("/api/tasks/:taskId/resume", zValidator8("json", ResumeRequestSchema), async (c) => {
     const taskId = c.req.param("taskId");
     const body = c.req.valid("json");
-    await assertTaskProjectActive(repo, projectRepo, taskId);
+    await assertTaskProjectActive(repo, projectRepo, taskId, c);
     const result = await resumeTask(mkDeps(repo), taskId, body.decision);
     return c.json(writeAck(result, ["status"], void 0, [{ path: "status", excerpt: `${result.status}\uFF08\u5DF2\u6062\u590D\u624B\u52A8\u6682\u505C\uFF09` }]));
   });
-  app.post("/api/tasks/:taskId/cancel", zValidator6("json", CancelRequestSchema), async (c) => {
+  app.post("/api/tasks/:taskId/cancel", zValidator8("json", CancelRequestSchema), async (c) => {
     const taskId = c.req.param("taskId");
     const body = c.req.valid("json");
-    await assertTaskProjectActive(repo, projectRepo, taskId);
+    await assertTaskProjectActive(repo, projectRepo, taskId, c);
     const result = await cancelTask(mkDeps(repo), taskId, body.reason);
     return c.json(
       writeAck(
@@ -989,17 +1517,24 @@ function createTaskRoutes(client) {
   app.get("/api/tasks/:taskId/history", async (c) => {
     const taskId = c.req.param("taskId");
     const task = await repo.getByTaskId(taskId);
-    if (!task) throw new NotFoundError6("task", taskId);
+    if (!task) throw new NotFoundError9("task", taskId);
+    assertProjectScope(c, task.projectId);
     return c.json(task.history);
   });
   app.get("/api/tasks/:taskId/node/:nodeId", async (c) => {
     const taskId = c.req.param("taskId");
     const nodeId = c.req.param("nodeId");
     const task = await repo.getByTaskId(taskId);
-    if (!task) throw new NotFoundError6("task", taskId);
+    if (!task) throw new NotFoundError9("task", taskId);
+    assertProjectScope(c, task.projectId);
     const node = task.dagInstance.nodes.find((n) => n.id === nodeId);
-    if (!node) throw new NotFoundError6("node", nodeId);
-    return c.json({ ...node, prompt: renderPrompt(node.prompt, task) });
+    if (!node) throw new NotFoundError9("node", nodeId);
+    return c.json({
+      ...node,
+      skills: node.skills ?? [],
+      agents: node.agents ?? [],
+      prompt: renderPrompt(node.prompt, task)
+    });
   });
   app.get("/api/tasks/:taskId/context", async (c) => {
     const taskId = c.req.param("taskId");
@@ -1011,7 +1546,8 @@ function createTaskRoutes(client) {
     }
     const view = viewR.data;
     const task = await repo.getByTaskId(taskId);
-    if (!task) throw new NotFoundError6("task", taskId);
+    if (!task) throw new NotFoundError9("task", taskId);
+    assertProjectScope(c, task.projectId);
     const currentNodeActive = task.status === "active" ? task.dagInstance.nodes.find((n) => n.id === task.currentNode) : void 0;
     let pausedAtEdge = null;
     if (task.status === "paused" && task.pausedAt !== null) {
@@ -1046,10 +1582,10 @@ function createTaskRoutes(client) {
     };
     return c.json(context);
   });
-  app.patch("/api/tasks/:taskId/doc", zValidator6("json", TaskDocSetSchema), async (c) => {
+  app.patch("/api/tasks/:taskId/doc", zValidator8("json", TaskDocSetSchema), async (c) => {
     const taskId = c.req.param("taskId");
     const body = c.req.valid("json");
-    await loadTaskForRecordWrite(repo, projectRepo, taskId);
+    await loadTaskForRecordWrite(repo, projectRepo, taskId, void 0, c);
     const sets = {};
     if (body.what !== void 0) sets["doc.what"] = body.what;
     if (body.why !== void 0) sets["doc.why"] = body.why;
@@ -1064,10 +1600,10 @@ function createTaskRoutes(client) {
       )
     );
   });
-  app.post("/api/tasks/:taskId/doc/acceptance", zValidator6("json", TextItemSchema), async (c) => {
+  app.post("/api/tasks/:taskId/doc/acceptance", zValidator8("json", TextItemSchema), async (c) => {
     const taskId = c.req.param("taskId");
     const body = c.req.valid("json");
-    await loadTaskForRecordWrite(repo, projectRepo, taskId);
+    await loadTaskForRecordWrite(repo, projectRepo, taskId, void 0, c);
     const updatedAcc = await repo.updateTaskPaths(taskId, { pushes: { "doc.acceptance": body.text } });
     return c.json(
       writeAck(updatedAcc, ["doc.acceptance"], void 0, [
@@ -1075,20 +1611,20 @@ function createTaskRoutes(client) {
       ])
     );
   });
-  app.post("/api/tasks/:taskId/doc/non-goal", zValidator6("json", TextItemSchema), async (c) => {
+  app.post("/api/tasks/:taskId/doc/non-goal", zValidator8("json", TextItemSchema), async (c) => {
     const taskId = c.req.param("taskId");
     const body = c.req.valid("json");
-    await loadTaskForRecordWrite(repo, projectRepo, taskId);
+    await loadTaskForRecordWrite(repo, projectRepo, taskId, void 0, c);
     const updatedNg = await repo.updateTaskPaths(taskId, { pushes: { "doc.nonGoals": body.text } });
     return c.json(
       writeAck(updatedNg, ["doc.nonGoals"], void 0, [{ path: "doc.nonGoals", excerpt: excerpt(body.text) }])
     );
   });
-  app.patch("/api/tasks/:taskId/records/:nodeId/summary", zValidator6("json", RecordSummarySchema), async (c) => {
+  app.patch("/api/tasks/:taskId/records/:nodeId/summary", zValidator8("json", RecordSummarySchema), async (c) => {
     const taskId = c.req.param("taskId");
     const nodeId = c.req.param("nodeId");
     const body = c.req.valid("json");
-    await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId);
+    await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
     const updatedSummary = await repo.updateTaskPaths(taskId, {
       sets: { [`nodeRecords.${nodeId}.summary`]: body.summary }
     });
@@ -1098,11 +1634,11 @@ function createTaskRoutes(client) {
       ])
     );
   });
-  app.post("/api/tasks/:taskId/records/:nodeId/checks", zValidator6("json", CheckAddSchema), async (c) => {
+  app.post("/api/tasks/:taskId/records/:nodeId/checks", zValidator8("json", CheckAddSchema), async (c) => {
     const taskId = c.req.param("taskId");
     const nodeId = c.req.param("nodeId");
     const body = c.req.valid("json");
-    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
     const existing = (task.nodeRecords ?? {})[nodeId]?.checks ?? [];
     const check = {
       id: generateEntryId(existing.map((ch) => ch.id)),
@@ -1121,17 +1657,17 @@ function createTaskRoutes(client) {
       )
     );
   });
-  app.patch("/api/tasks/:taskId/records/:nodeId/checks/:checkId", zValidator6("json", CheckPatchSchema), async (c) => {
+  app.patch("/api/tasks/:taskId/records/:nodeId/checks/:checkId", zValidator8("json", CheckPatchSchema), async (c) => {
     const taskId = c.req.param("taskId");
     const nodeId = c.req.param("nodeId");
     const checkId = c.req.param("checkId");
     const body = c.req.valid("json");
-    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
     const check = ((task.nodeRecords ?? {})[nodeId]?.checks ?? []).find((ch) => ch.id === checkId);
     if (!check) {
-      throw new NotFoundError6("check", checkId, {
+      throw new NotFoundError9("check", checkId, {
         bizCode: "CHECK_NOT_FOUND",
-        message: `${BIZ_CODE_MESSAGES6.CHECK_NOT_FOUND}\uFF08node ${nodeId}, check ${checkId}\uFF09`
+        message: `${BIZ_CODE_MESSAGES7.CHECK_NOT_FOUND}\uFF08node ${nodeId}, check ${checkId}\uFF09`
       });
     }
     const updatedFlip = await repo.updateTaskPaths(taskId, {
@@ -1144,11 +1680,11 @@ function createTaskRoutes(client) {
       ])
     );
   });
-  app.post("/api/tasks/:taskId/records/:nodeId/artifacts", zValidator6("json", ArtifactAddSchema), async (c) => {
+  app.post("/api/tasks/:taskId/records/:nodeId/artifacts", zValidator8("json", ArtifactAddSchema), async (c) => {
     const taskId = c.req.param("taskId");
     const nodeId = c.req.param("nodeId");
     const body = c.req.valid("json");
-    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
     const artifact = {
       id: generateEntryId(((task.nodeRecords ?? {})[nodeId]?.artifacts ?? []).map((a) => a.id)),
       type: body.type,
@@ -1175,11 +1711,11 @@ function createTaskRoutes(client) {
       )
     );
   });
-  app.post("/api/tasks/:taskId/records/:nodeId/confirmations", zValidator6("json", ConfirmAddSchema), async (c) => {
+  app.post("/api/tasks/:taskId/records/:nodeId/confirmations", zValidator8("json", ConfirmAddSchema), async (c) => {
     const taskId = c.req.param("taskId");
     const nodeId = c.req.param("nodeId");
     const body = c.req.valid("json");
-    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
     const confirmation = {
       id: generateEntryId(((task.nodeRecords ?? {})[nodeId]?.confirmations ?? []).map((cf) => cf.id)),
       quote: body.quote,
@@ -1194,11 +1730,11 @@ function createTaskRoutes(client) {
       ])
     );
   });
-  app.post("/api/tasks/:taskId/records/:nodeId/decisions", zValidator6("json", DecisionAddSchema), async (c) => {
+  app.post("/api/tasks/:taskId/records/:nodeId/decisions", zValidator8("json", DecisionAddSchema), async (c) => {
     const taskId = c.req.param("taskId");
     const nodeId = c.req.param("nodeId");
     const body = c.req.valid("json");
-    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
     const decision = {
       id: generateEntryId(((task.nodeRecords ?? {})[nodeId]?.decisions ?? []).map((d) => d.id)),
       topic: body.topic,
@@ -1213,11 +1749,11 @@ function createTaskRoutes(client) {
       ])
     );
   });
-  app.put("/api/tasks/:taskId/records/:nodeId/review", zValidator6("json", ReviewSetSchema), async (c) => {
+  app.put("/api/tasks/:taskId/records/:nodeId/review", zValidator8("json", ReviewSetSchema), async (c) => {
     const taskId = c.req.param("taskId");
     const nodeId = c.req.param("nodeId");
     const body = c.req.valid("json");
-    await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId);
+    await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
     const updatedReview = await repo.updateTaskPaths(taskId, {
       sets: { [`nodeRecords.${nodeId}.review`]: body }
     });
@@ -1227,10 +1763,10 @@ function createTaskRoutes(client) {
       ])
     );
   });
-  app.post("/api/tasks/:taskId/archnotes", zValidator6("json", TextItemSchema), async (c) => {
+  app.post("/api/tasks/:taskId/archnotes", zValidator8("json", TextItemSchema), async (c) => {
     const taskId = c.req.param("taskId");
     const body = c.req.valid("json");
-    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, void 0, c);
     const note = { id: generateEntryId((task.archNotes ?? []).map((n) => n.id)), text: body.text, at: /* @__PURE__ */ new Date() };
     const updatedNote = await repo.updateTaskPaths(taskId, { pushes: { archNotes: note } });
     return c.json(
@@ -1242,7 +1778,7 @@ function createTaskRoutes(client) {
   return app;
 }
 function assertTypeTrackCompatible(type, track) {
-  const mismatch = (reason) => new ValidationError(
+  const mismatch = (reason) => new ValidationError2(
     reason,
     [{ code: "custom", path: ["type"], message: reason }],
     { bizCode: "TASK_TYPE_TRACK_MISMATCH", message: reason }
@@ -1267,20 +1803,22 @@ function mkDeps(repo) {
     updateTask: repo.updateTask.bind(repo)
   };
 }
-async function assertTaskProjectActive(repo, projectRepo, taskId) {
+async function assertTaskProjectActive(repo, projectRepo, taskId, c) {
   const task = await repo.getByTaskId(taskId);
-  if (!task) throw new NotFoundError6("task", taskId);
+  if (!task) throw new NotFoundError9("task", taskId);
+  assertProjectScope(c, task.projectId);
   await loadProjectForWrite(projectRepo, task.projectId);
 }
-async function loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId) {
+async function loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c) {
   const task = await repo.getByTaskId(taskId);
-  if (!task) throw new NotFoundError6("task", taskId);
+  if (!task) throw new NotFoundError9("task", taskId);
+  assertProjectScope(c, task.projectId);
   await loadProjectForWrite(projectRepo, task.projectId);
   if (task.status === "completed" || task.status === "cancelled") {
     throw new BadRequestError2(
       `Task '${taskId}' is ${task.status} \u2014 task records are read-only after termination`,
       void 0,
-      { bizCode: "TASK_TERMINATED", message: `${BIZ_CODE_MESSAGES6.TASK_TERMINATED}\uFF08status: ${task.status}\uFF09` }
+      { bizCode: "TASK_TERMINATED", message: `${BIZ_CODE_MESSAGES7.TASK_TERMINATED}\uFF08status: ${task.status}\uFF09` }
     );
   }
   if (nodeId === void 0) return task;
@@ -1289,9 +1827,9 @@ async function loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId) {
   }
   const node = task.dagInstance.nodes.find((n) => n.id === nodeId);
   if (!node) {
-    throw new NotFoundError6("node", nodeId, {
+    throw new NotFoundError9("node", nodeId, {
       bizCode: "NODE_NOT_IN_INSTANCE",
-      message: `${BIZ_CODE_MESSAGES6.NODE_NOT_IN_INSTANCE}\uFF08nodeId: ${nodeId}\uFF09`
+      message: `${BIZ_CODE_MESSAGES7.NODE_NOT_IN_INSTANCE}\uFF08nodeId: ${nodeId}\uFF09`
     });
   }
   const state = task.dagInstance.nodeStates[nodeId];
@@ -1301,57 +1839,271 @@ async function loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId) {
       void 0,
       {
         bizCode: "NODE_RECORD_NOT_WRITABLE",
-        message: `${BIZ_CODE_MESSAGES6.NODE_RECORD_NOT_WRITABLE}\uFF08${nodeId}: ${state?.status ?? "pending"}\uFF09`
+        message: `${BIZ_CODE_MESSAGES7.NODE_RECORD_NOT_WRITABLE}\uFF08${nodeId}: ${state?.status ?? "pending"}\uFF09`
       }
     );
   }
   return task;
 }
 
+// src/routes/task-batch.routes.ts
+import { Hono as Hono11 } from "hono";
+import { zValidator as zValidator9 } from "@hono/zod-validator";
+import { z as z6 } from "zod";
+import {
+  createTaskRepo as createTaskRepo2,
+  createProjectRepo as createProjectRepo8,
+  ValidationError as ValidationError3,
+  BIZ_CODE_MESSAGES as BIZ_CODE_MESSAGES8,
+  toTaskPublic as toTaskPublic2,
+  taskProgress as taskProgress2,
+  generateEntryId as generateEntryId2
+} from "@siming-org/core";
+var BATCH_LIMIT = 50;
+var ARTIFACT_BATCH_CONTENT_LIMIT = 2e6;
+var BatchTextSchema = z6.string().min(1).max(2e3);
+var ObjectItemsSchema = z6.object({ items: z6.array(z6.record(z6.string(), z6.unknown())) });
+var StringItemsSchema = z6.object({ items: z6.array(z6.string()) });
+function zodIssueToMessage(issue) {
+  const shape = issue;
+  switch (issue.code) {
+    case "too_small":
+      return `\u957F\u5EA6\u4E0D\u8DB3\uFF08\u6700\u5C0F ${String(shape.minimum)}\uFF09`;
+    case "too_big":
+      return `\u8D85\u51FA\u4E0A\u9650\uFF08\u6700\u5927 ${String(shape.maximum)}\uFF09`;
+    case "invalid_type":
+      return `\u7C7B\u578B\u4E0D\u5339\u914D\uFF08\u671F\u671B ${String(shape.expected)}\uFF09`;
+    case "invalid_value":
+      return `\u503C\u4E0D\u5408\u6CD5\uFF08${issue.message}\uFF09`;
+    default:
+      return issue.message;
+  }
+}
+function partitionItems(items, schema) {
+  const ok = [];
+  const bad = [];
+  items.forEach((item, index) => {
+    const r = schema.safeParse(item);
+    if (r.success) {
+      ok.push({ index, data: r.data });
+    } else {
+      const issue = r.error.issues[0];
+      const loc = issue !== void 0 && issue.path.length > 0 ? `${issue.path.join(".")}: ` : "";
+      bad.push({ index, message: `${loc}${issue !== void 0 ? zodIssueToMessage(issue) : "\u6761\u76EE\u683C\u5F0F\u4E0D\u5408\u6CD5"}` });
+    }
+  });
+  return { ok, bad };
+}
+function assertBatchSize(items) {
+  if (items.length === 0) {
+    throw new ValidationError3(BIZ_CODE_MESSAGES8.BATCH_EMPTY, [], { bizCode: "BATCH_EMPTY" });
+  }
+  if (items.length > BATCH_LIMIT) {
+    throw new ValidationError3(BIZ_CODE_MESSAGES8.BATCH_LIMIT_EXCEEDED, [], {
+      bizCode: "BATCH_LIMIT_EXCEEDED"
+    });
+  }
+}
+function batchAck(entity, updated, entries, failures) {
+  const applied = entries.length;
+  return {
+    taskId: entity.taskId,
+    applied,
+    updated: applied > 0 ? updated : [],
+    entries,
+    failures,
+    updatedAt: entity.updatedAt ?? /* @__PURE__ */ new Date(),
+    task: { ...toTaskPublic2(entity), projectId: entity.projectId, progress: taskProgress2(entity) }
+  };
+}
+function createTaskBatchRoutes(client) {
+  const app = new Hono11();
+  const repo = createTaskRepo2(client.db());
+  const projectRepo = createProjectRepo8(client.db());
+  app.post("/api/tasks/:taskId/records/:nodeId/checks/batch", zValidator9("json", ObjectItemsSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const nodeId = c.req.param("nodeId");
+    const { items } = c.req.valid("json");
+    assertBatchSize(items);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
+    const { ok, bad } = partitionItems(items, CheckAddSchema);
+    const idSeq = ((task.nodeRecords ?? {})[nodeId]?.checks ?? []).map((ch) => ch.id);
+    const checks = [];
+    const entries = [];
+    for (const { index, data } of ok) {
+      const check = { id: generateEntryId2(idSeq), item: data.item, passed: data.passed ?? true };
+      idSeq.push(check.id);
+      checks.push(check);
+      entries.push({ index, id: check.id, kind: "check" });
+    }
+    if (checks.length === 0) {
+      return c.json(batchAck(task, [`nodeRecords.${nodeId}.checks`], entries, bad));
+    }
+    const updated = await repo.updateTaskPaths(taskId, {
+      pushes: { [`nodeRecords.${nodeId}.checks`]: { $each: checks } }
+    });
+    return c.json(batchAck(updated, [`nodeRecords.${nodeId}.checks`], entries, bad));
+  });
+  app.post("/api/tasks/:taskId/records/:nodeId/artifacts/batch", zValidator9("json", ObjectItemsSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const nodeId = c.req.param("nodeId");
+    const { items } = c.req.valid("json");
+    assertBatchSize(items);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
+    const { ok, bad } = partitionItems(items, ArtifactAddSchema);
+    const totalContent = ok.reduce((sum, { data }) => sum + (data.content?.length ?? 0), 0);
+    if (totalContent > ARTIFACT_BATCH_CONTENT_LIMIT) {
+      throw new ValidationError3(BIZ_CODE_MESSAGES8.BATCH_PAYLOAD_TOO_LARGE, [], {
+        bizCode: "BATCH_PAYLOAD_TOO_LARGE"
+      });
+    }
+    const idSeq = ((task.nodeRecords ?? {})[nodeId]?.artifacts ?? []).map((a) => a.id);
+    const artifacts = [];
+    const entries = [];
+    for (const { index, data } of ok) {
+      const artifact = {
+        id: generateEntryId2(idSeq),
+        type: data.type,
+        path: data.path,
+        ...data.note !== void 0 ? { note: data.note } : {},
+        ...data.content !== void 0 ? { content: data.content } : {}
+      };
+      idSeq.push(artifact.id);
+      artifacts.push(artifact);
+      entries.push({ index, id: artifact.id, kind: "artifact" });
+    }
+    if (artifacts.length === 0) {
+      return c.json(batchAck(task, [`nodeRecords.${nodeId}.artifacts`], entries, bad));
+    }
+    const updated = await repo.updateTaskPaths(taskId, {
+      pushes: { [`nodeRecords.${nodeId}.artifacts`]: { $each: artifacts } }
+    });
+    return c.json(batchAck(updated, [`nodeRecords.${nodeId}.artifacts`], entries, bad));
+  });
+  app.post("/api/tasks/:taskId/records/:nodeId/decisions/batch", zValidator9("json", ObjectItemsSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const nodeId = c.req.param("nodeId");
+    const { items } = c.req.valid("json");
+    assertBatchSize(items);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, nodeId, c);
+    const { ok, bad } = partitionItems(items, DecisionAddSchema);
+    const idSeq = ((task.nodeRecords ?? {})[nodeId]?.decisions ?? []).map((d) => d.id);
+    const decisions = [];
+    const entries = [];
+    for (const { index, data } of ok) {
+      const decision = { id: generateEntryId2(idSeq), topic: data.topic, decision: data.decision };
+      idSeq.push(decision.id);
+      decisions.push(decision);
+      entries.push({ index, id: decision.id, kind: "decision" });
+    }
+    if (decisions.length === 0) {
+      return c.json(batchAck(task, [`nodeRecords.${nodeId}.decisions`], entries, bad));
+    }
+    const updated = await repo.updateTaskPaths(taskId, {
+      pushes: { [`nodeRecords.${nodeId}.decisions`]: { $each: decisions } }
+    });
+    return c.json(batchAck(updated, [`nodeRecords.${nodeId}.decisions`], entries, bad));
+  });
+  app.post("/api/tasks/:taskId/doc/acceptance/batch", zValidator9("json", StringItemsSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const { items } = c.req.valid("json");
+    assertBatchSize(items);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, void 0, c);
+    const { ok, bad } = partitionItems(items, BatchTextSchema);
+    const entries = ok.map(({ index }) => ({ index }));
+    if (ok.length === 0) {
+      return c.json(batchAck(task, ["doc.acceptance"], entries, bad));
+    }
+    const updated = await repo.updateTaskPaths(taskId, {
+      pushes: { "doc.acceptance": { $each: ok.map(({ data }) => data) } }
+    });
+    return c.json(batchAck(updated, ["doc.acceptance"], entries, bad));
+  });
+  app.post("/api/tasks/:taskId/doc/non-goal/batch", zValidator9("json", StringItemsSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const { items } = c.req.valid("json");
+    assertBatchSize(items);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, void 0, c);
+    const { ok, bad } = partitionItems(items, BatchTextSchema);
+    const entries = ok.map(({ index }) => ({ index }));
+    if (ok.length === 0) {
+      return c.json(batchAck(task, ["doc.nonGoals"], entries, bad));
+    }
+    const updated = await repo.updateTaskPaths(taskId, {
+      pushes: { "doc.nonGoals": { $each: ok.map(({ data }) => data) } }
+    });
+    return c.json(batchAck(updated, ["doc.nonGoals"], entries, bad));
+  });
+  app.post("/api/tasks/:taskId/archnotes/batch", zValidator9("json", StringItemsSchema), async (c) => {
+    const taskId = c.req.param("taskId");
+    const { items } = c.req.valid("json");
+    assertBatchSize(items);
+    const task = await loadTaskForRecordWrite(repo, projectRepo, taskId, void 0, c);
+    const { ok, bad } = partitionItems(items, BatchTextSchema);
+    const idSeq = (task.archNotes ?? []).map((n) => n.id);
+    const notes = [];
+    const entries = [];
+    for (const { index, data } of ok) {
+      const note = { id: generateEntryId2(idSeq), text: data, at: /* @__PURE__ */ new Date() };
+      idSeq.push(note.id);
+      notes.push(note);
+      entries.push({ index, id: note.id, kind: "archnote" });
+    }
+    if (notes.length === 0) {
+      return c.json(batchAck(task, ["archNotes"], entries, bad));
+    }
+    const updated = await repo.updateTaskPaths(taskId, {
+      pushes: { archNotes: { $each: notes } }
+    });
+    return c.json(batchAck(updated, ["archNotes"], entries, bad));
+  });
+  return app;
+}
+
 // src/routes/settings.routes.ts
-import { Hono as Hono9 } from "hono";
-import { zValidator as zValidator7 } from "@hono/zod-validator";
-import { z as z5 } from "zod";
+import { Hono as Hono12 } from "hono";
+import { zValidator as zValidator10 } from "@hono/zod-validator";
+import { z as z7 } from "zod";
 import {
   createEnumRegistryRepo as createEnumRegistryRepo3,
   EnumRegistryUpdateSchema,
-  NotFoundError as NotFoundError7
+  NotFoundError as NotFoundError10
 } from "@siming-org/core";
 function createSettingsRoutes(client) {
-  const app = new Hono9();
+  const app = new Hono12();
   const repo = createEnumRegistryRepo3(client.db());
   app.get("/api/settings/enums", async (c) => {
     return c.json(await repo.listRegistries());
   });
   app.get(
     "/api/settings/enums/:category",
-    zValidator7("param", z5.object({ category: z5.string() })),
+    zValidator10("param", z7.object({ category: z7.string() })),
     async (c) => {
       const { category } = c.req.valid("param");
       const registry = await repo.getRegistry(category);
-      if (!registry) throw new NotFoundError7("enum-registry", category);
+      if (!registry) throw new NotFoundError10("enum-registry", category);
       return c.json(registry);
     }
   );
   app.put(
     "/api/settings/enums/:category",
-    zValidator7("param", z5.object({ category: z5.string() })),
-    zValidator7("json", EnumRegistryUpdateSchema),
+    zValidator10("param", z7.object({ category: z7.string() })),
+    zValidator10("json", EnumRegistryUpdateSchema),
     async (c) => {
       const { category } = c.req.valid("param");
       const data = c.req.valid("json");
       const registry = await repo.updateRegistry(category, data);
-      if (!registry) throw new NotFoundError7("enum-registry", category);
+      if (!registry) throw new NotFoundError10("enum-registry", category);
       return c.json(registry);
     }
   );
   app.delete(
     "/api/settings/enums/:category/entries/:value",
-    zValidator7("param", z5.object({ category: z5.string(), value: z5.string().min(1) })),
+    zValidator10("param", z7.object({ category: z7.string(), value: z7.string().min(1) })),
     async (c) => {
       const { category, value } = c.req.valid("param");
       const deleted = await repo.deleteEntry(category, value);
-      if (!deleted) throw new NotFoundError7("enum-registry", category);
+      if (!deleted) throw new NotFoundError10("enum-registry", category);
       return c.body(null, 204);
     }
   );
@@ -1360,23 +2112,195 @@ function createSettingsRoutes(client) {
 
 // src/routes/index.ts
 function createRoutes(client) {
-  const router = new Hono10();
+  const router = new Hono13();
   router.route("/", createHealth(client));
   router.route("/", createProjectRoutes(client));
   router.route("/", createSkillRoutes(client));
   router.route("/", createAgentRoutes(client));
   router.route("/", createModelAliasRoutes(client));
   router.route("/", createDagTemplateRoutes(client));
+  router.route("/", createNodePresetRoutes(client));
+  router.route("/", createNodeLibraryRoutes(client));
   router.route("/", createTaskRoutes(client));
+  router.route("/", createTaskBatchRoutes(client));
   router.route("/", createSettingsRoutes(client));
   return router;
 }
 
+// src/routes/auth.routes.ts
+import { Hono as Hono14 } from "hono";
+import { zValidator as zValidator11 } from "@hono/zod-validator";
+import {
+  createAuthAccountRepo,
+  createAuthTokenRepo as createAuthTokenRepo2,
+  createAuthSessionRepo as createAuthSessionRepo2,
+  createProjectRepo as createProjectRepo9,
+  hashPassword,
+  verifyPassword,
+  generateToken,
+  generateSessionId,
+  hashToken as hashToken2,
+  AuthAccountCreateSchema,
+  LoginSchema,
+  PasswordChangeSchema,
+  ConflictError as ConflictError8,
+  NotFoundError as NotFoundError11
+} from "@siming-org/core";
+var DUMMY_PASSWORD_HASH = await hashPassword("timing-equalizer-dummy");
+function createAuthRoutes(client, deps) {
+  const app = new Hono14();
+  const accountRepo = createAuthAccountRepo(client.db());
+  const tokenRepo = createAuthTokenRepo2(client.db());
+  const sessionRepo = createAuthSessionRepo2(client.db());
+  const projectRepo = createProjectRepo9(client.db());
+  function setSessionCookie(c, sessionId) {
+    c.header("Set-Cookie", `${SESSION_COOKIE_NAME}=${sessionId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${Math.floor(SESSION_TTL_MS / 1e3)}`);
+  }
+  function clearSessionCookie(c) {
+    c.header("Set-Cookie", `${SESSION_COOKIE_NAME}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);
+  }
+  app.get("/api/auth/status", async (c) => {
+    const account = await accountRepo.getAccount();
+    return c.json({ authEnabled: deps.authEnabled, needsSetup: deps.authEnabled && account === null });
+  });
+  const whoamiHandler = async (c) => {
+    const auth = getAuth(c);
+    const base = { authEnabled: deps.authEnabled, server: { url: new URL(c.req.url).origin } };
+    if (!deps.authEnabled || auth.kind === "open" || auth.kind === "none") {
+      return c.json({ ...base, identity: "none", project: null });
+    }
+    if (auth.kind === "admin") {
+      return c.json({ ...base, identity: "admin", project: null });
+    }
+    const project = await projectRepo.getById(auth.projectId);
+    return c.json({
+      ...base,
+      identity: "project",
+      project: project ? { id: project.id ?? auth.projectId, key: project.key, name: project.name } : null
+    });
+  };
+  app.get("/api/auth/whoami", whoamiHandler);
+  app.post("/api/auth/whoami", whoamiHandler);
+  const v422 = (schema) => zValidator11("json", schema, (result, c) => {
+    if (!result.success) {
+      return c.json({ error: "validation_error", message: "\u683C\u5F0F\u4E0D\u7B26", issues: result.error.issues }, 422);
+    }
+    return void 0;
+  });
+  app.post("/api/auth/setup", v422(AuthAccountCreateSchema), async (c) => {
+    const body = c.req.valid("json");
+    const existing = await accountRepo.getAccount();
+    if (existing) {
+      throw new ConflictError8("auth-account", existing.id ?? "unknown", {
+        bizCode: "AUTH_ACCOUNT_EXISTS",
+        message: "\u7BA1\u7406\u5458\u8D26\u53F7\u5DF2\u521D\u59CB\u5316\uFF08\u65E0\u9700\u91CD\u590D\u521B\u5EFA\uFF09"
+      });
+    }
+    const passwordHash = await hashPassword(body.password);
+    const account = await accountRepo.createAccount(body.username, passwordHash);
+    const sessionId = generateSessionId();
+    await sessionRepo.createSession(sessionId, account.id ?? "", new Date(Date.now() + SESSION_TTL_MS));
+    setSessionCookie(c, sessionId);
+    return c.json({ username: account.username });
+  });
+  app.post("/api/auth/login", zValidator11("json", LoginSchema), async (c) => {
+    const body = c.req.valid("json");
+    const account = await accountRepo.getAccount();
+    if (!account || account.username !== body.username) {
+      await verifyPassword(body.password, DUMMY_PASSWORD_HASH);
+      return c.json({ error: "AUTH_INVALID_CREDENTIALS", message: "\u8D26\u53F7\u6216\u5BC6\u7801\u9519\u8BEF" }, 401);
+    }
+    const ok = await verifyPassword(body.password, account.passwordHash);
+    if (!ok) {
+      return c.json({ error: "AUTH_INVALID_CREDENTIALS", message: "\u8D26\u53F7\u6216\u5BC6\u7801\u9519\u8BEF" }, 401);
+    }
+    const sessionId = generateSessionId();
+    await sessionRepo.createSession(sessionId, account.id ?? "", new Date(Date.now() + SESSION_TTL_MS));
+    setSessionCookie(c, sessionId);
+    return c.json({ username: account.username });
+  });
+  app.post("/api/auth/logout", async (c) => {
+    const sessionId = readSessionCookie(c);
+    if (sessionId !== void 0) {
+      await sessionRepo.deleteBySessionId(sessionId);
+    }
+    clearSessionCookie(c);
+    return c.body(null, 204);
+  });
+  app.get("/api/auth/me", async (c) => {
+    const auth = getAuth(c);
+    if (auth.kind !== "admin") {
+      return c.json({ error: "AUTH_REQUIRED", message: "\u9700\u8981\u767B\u5F55" }, 401);
+    }
+    const account = await accountRepo.getAccount();
+    return c.json({ username: account?.username ?? "" });
+  });
+  app.put("/api/auth/password", v422(PasswordChangeSchema), async (c) => {
+    const auth = getAuth(c);
+    if (auth.kind !== "admin") {
+      return c.json({ error: "AUTH_REQUIRED", message: "\u9700\u8981\u767B\u5F55" }, 401);
+    }
+    const body = c.req.valid("json");
+    const account = await accountRepo.getAccount();
+    if (!account) {
+      return c.json({ error: "AUTH_REQUIRED", message: "\u9700\u8981\u767B\u5F55" }, 401);
+    }
+    const ok = await verifyPassword(body.currentPassword, account.passwordHash);
+    if (!ok) {
+      return c.json({ error: "AUTH_INVALID_CREDENTIALS", message: "\u8D26\u53F7\u6216\u5BC6\u7801\u9519\u8BEF" }, 401);
+    }
+    await accountRepo.updatePassword(account.id ?? "", await hashPassword(body.newPassword));
+    return c.body(null, 204);
+  });
+  app.post("/api/auth/tokens/admin", async (c) => {
+    const token = generateToken("admin");
+    await tokenRepo.upsertToken("admin", hashToken2(token));
+    return c.json({ token, type: "admin" }, 201);
+  });
+  app.get("/api/auth/tokens/admin", async (c) => {
+    const status = await tokenRepo.getTokenStatus("admin");
+    return c.json({ type: "admin", hasToken: status.hasToken, createdAt: status.createdAt });
+  });
+  app.get("/api/auth/tokens/project", async (c) => {
+    const projects = await projectRepo.list();
+    const statuses = await tokenRepo.listProjectTokenStatuses(projects.map((p) => p.id ?? ""));
+    const items = projects.map((p) => {
+      const st = statuses.get(p.id ?? "");
+      return { type: "project", projectId: p.id, hasToken: st?.hasToken ?? false, createdAt: st?.createdAt ?? null };
+    });
+    return c.json({ items, total: items.length, page: 1, limit: items.length });
+  });
+  app.post("/api/auth/tokens/project/:projectId", async (c) => {
+    const projectId = c.req.param("projectId");
+    const project = await projectRepo.getById(projectId);
+    if (!project) throw new NotFoundError11("project", projectId);
+    if (project.status === "archived") {
+      throw new ConflictError8("project", projectId, { bizCode: "PROJECT_ARCHIVED" });
+    }
+    const token = generateToken("project");
+    await tokenRepo.upsertToken("project", hashToken2(token), projectId);
+    return c.json({ token, type: "project", projectId }, 201);
+  });
+  app.get("/api/auth/tokens/project/:projectId", async (c) => {
+    const projectId = c.req.param("projectId");
+    const status = await tokenRepo.getTokenStatus("project", projectId);
+    return c.json({ type: "project", projectId, hasToken: status.hasToken, createdAt: status.createdAt });
+  });
+  return app;
+}
+function readSessionCookie(c) {
+  return getCookie(c, SESSION_COOKIE_NAME);
+}
+
 // src/app.ts
 function createApp(client, opts = {}) {
-  const app = new Hono11();
+  const app = new Hono15();
   setupErrorHandler(app);
+  const authEnabled = opts.authEnabled ?? false;
+  app.use("/api/*", createAuthMiddleware(client, { authEnabled }));
+  app.use("/health/*", createAuthMiddleware(client, { authEnabled }));
   app.route("/", createRoutes(client));
+  app.route("/", createAuthRoutes(client, { authEnabled }));
   const webRoot = opts.webRoot !== void 0 ? opts.webRoot : resolveWebDistRoot();
   app.route("/", createStaticRoutes(webRoot));
   return app;
@@ -1387,7 +2311,7 @@ import { serve } from "@hono/node-server";
 import { createMongoClient } from "@siming-org/core";
 
 // src/ensure-collections.ts
-import { EnumRegistrySchema, bumpPatch as bumpPatch2 } from "@siming-org/core";
+import { EnumRegistrySchema, bumpPatch as bumpPatch2, createAuthSessionRepo as createAuthSessionRepo3, buildTemplateCode, isLegalTemplateCode } from "@siming-org/core";
 async function ensureCollections(client) {
   const db = client.db();
   await Promise.all([
@@ -1397,13 +2321,17 @@ async function ensureCollections(client) {
     ensureDagTemplateCollection(db),
     ensureTaskCollection(db),
     ensureModelAliasCollection(db),
-    ensureEnumRegistryCollection(db)
+    ensureEnumRegistryCollection(db),
+    ensureAuthCollections(db),
+    ensureNodePresetCollection(db),
+    ensureNodeLibraryCollection(db)
   ]);
   await migrateProjectSentinelData(db);
   await migrateGateRemovalData(db);
   await migrateTaskRecordData(db);
   await migrateDagTrackTaskValues(db);
   await migrateAgentFunctionBackfill(db);
+  await migrateDagTemplateCode(db);
   await ensurePostMigrationIndexes(db);
 }
 var ENUM_REGISTRY_SEEDS = {
@@ -1464,6 +2392,57 @@ function buildSeedEntries(seeds) {
     ...s.color ? { color: s.color } : {}
   }));
 }
+async function ensureAuthCollections(db) {
+  const accountValidator = { $jsonSchema: {
+    bsonType: "object",
+    required: ["username", "passwordHash"],
+    properties: {
+      username: { bsonType: "string", minLength: 1 },
+      passwordHash: { bsonType: "string", minLength: 1 },
+      createdAt: { bsonType: "date" },
+      updatedAt: { bsonType: "date" }
+    }
+  } };
+  const collections = await db.listCollections({ name: "auth_accounts" }).toArray();
+  if (collections.length === 0) {
+    await db.createCollection("auth_accounts", { validator: accountValidator });
+  }
+  await db.collection("auth_accounts").createIndex({ username: 1 }, { unique: true });
+  const tokenValidator = { $jsonSchema: {
+    bsonType: "object",
+    required: ["tokenHash", "type"],
+    properties: {
+      tokenHash: { bsonType: "string" },
+      type: { enum: ["admin", "project"] },
+      projectId: { bsonType: "string" },
+      createdAt: { bsonType: "date" },
+      updatedAt: { bsonType: "date" }
+    }
+  } };
+  const tokenColls = await db.listCollections({ name: "auth_tokens" }).toArray();
+  if (tokenColls.length === 0) {
+    await db.createCollection("auth_tokens", { validator: tokenValidator });
+  }
+  await db.collection("auth_tokens").createIndex({ tokenHash: 1 }, { unique: true });
+  await db.collection("auth_tokens").createIndex(
+    { projectId: 1 },
+    { unique: true, partialFilterExpression: { type: "project" } }
+  );
+  await db.collection("auth_tokens").createIndex(
+    { type: 1 },
+    { unique: true, partialFilterExpression: { type: "admin" } }
+  );
+  const sessionColls = await db.listCollections({ name: "auth_sessions" }).toArray();
+  if (sessionColls.length === 0) {
+    await db.createCollection("auth_sessions");
+  }
+  await db.collection("auth_sessions").createIndex({ sessionId: 1 }, { unique: true });
+  await db.collection("auth_sessions").createIndex({ expiresAt: 1 }, { expireAfterSeconds: 0 });
+  const removed = await createAuthSessionRepo3(db).deleteExpiredSessions();
+  if (removed > 0) {
+    console.log(`[siming] auth: \u6E05\u626B\u8FC7\u671F\u4F1A\u8BDD ${String(removed)} \u4E2A`);
+  }
+}
 async function ensureEnumRegistryCollection(db) {
   const collections = await db.listCollections({ name: "enum_registry" }).toArray();
   if (collections.length === 0) {
@@ -1618,6 +2597,9 @@ async function ensureDagTemplateCollection(db) {
     properties: {
       name: { bsonType: "string" },
       projectId: { bsonType: "string" },
+      // T202609020002：业务 code（可选——存量迁移前缺失合法，M13 回填；格式规则归应用层 Zod，
+      // DB 只做类型兜底，pattern 禁令见技术架构「DB validator 职责边界」）
+      code: { bsonType: "string" },
       description: { bsonType: "string" },
       nodes: { bsonType: "array" },
       edges: { bsonType: "array" },
@@ -1778,6 +2760,95 @@ async function migrateAgentFunctionBackfill(db) {
     }
   }
 }
+async function ensureNodePresetCollection(db) {
+  const validator = { $jsonSchema: {
+    bsonType: "object",
+    required: ["code", "label", "nodeId", "phase", "track", "prompt", "skills", "scope", "version"],
+    properties: {
+      code: { bsonType: "string" },
+      label: { bsonType: "string", minLength: 1 },
+      nodeId: { bsonType: "string" },
+      phase: { bsonType: "string" },
+      track: { bsonType: "string" },
+      prompt: { bsonType: "string" },
+      skills: { bsonType: "array", items: { bsonType: "string" } },
+      agents: { bsonType: "array", items: { bsonType: "string" } },
+      scope: { enum: ["global", "project"] },
+      projectId: { bsonType: "string" },
+      description: { bsonType: "string" },
+      version: { bsonType: "string" },
+      source: { bsonType: "object" },
+      enabled: { bsonType: "bool" },
+      createdAt: { bsonType: "date" },
+      updatedAt: { bsonType: "date" }
+    }
+  } };
+  const collections = await db.listCollections({ name: "node_presets" }).toArray();
+  if (collections.length === 0) {
+    await db.createCollection("node_presets", { validator });
+  } else {
+    await db.command({ collMod: "node_presets", validationLevel: "strict", validator });
+  }
+  await db.collection("node_presets").createIndex({ code: 1 }, { unique: true });
+  await db.collection("node_presets").createIndex({ scope: 1, projectId: 1 });
+}
+async function ensureNodeLibraryCollection(db) {
+  const validator = { $jsonSchema: {
+    bsonType: "object",
+    required: ["name", "version", "scope", "nodes", "compositions"],
+    properties: {
+      name: { bsonType: "string", minLength: 1 },
+      version: { bsonType: "string" },
+      scope: { enum: ["global", "project"] },
+      projectId: { bsonType: "string" },
+      nodes: { bsonType: "array", items: { bsonType: "string" } },
+      compositions: { bsonType: "array" },
+      installedAt: { bsonType: "date" },
+      createdAt: { bsonType: "date" },
+      updatedAt: { bsonType: "date" }
+    }
+  } };
+  const collections = await db.listCollections({ name: "node_libraries" }).toArray();
+  if (collections.length === 0) {
+    await db.createCollection("node_libraries", { validator });
+  }
+  await db.collection("node_libraries").createIndex({ name: 1 }, { unique: true });
+  await db.collection("node_libraries").createIndex({ scope: 1, projectId: 1 });
+}
+async function migrateDagTemplateCode(db) {
+  const coll = db.collection("dag_templates");
+  const docs = await coll.find({}, { projection: { projectId: 1, name: 1, code: 1 } }).toArray();
+  const takenByProject = /* @__PURE__ */ new Map();
+  for (const doc of docs) {
+    const projectId = String(doc.projectId);
+    if (typeof doc.code === "string" && isLegalTemplateCode(doc.code)) {
+      const taken = takenByProject.get(projectId) ?? /* @__PURE__ */ new Set();
+      taken.add(doc.code);
+      takenByProject.set(projectId, taken);
+    }
+  }
+  let migrated = 0;
+  for (const doc of docs) {
+    const projectId = String(doc.projectId);
+    if (typeof doc.code === "string" && isLegalTemplateCode(doc.code)) continue;
+    const taken = takenByProject.get(projectId) ?? /* @__PURE__ */ new Set();
+    const code = buildTemplateCode(String(doc.name ?? ""), taken);
+    taken.add(code);
+    takenByProject.set(projectId, taken);
+    const result = await coll.updateOne(
+      { _id: doc._id },
+      { $set: { code } },
+      { bypassDocumentValidation: true }
+    );
+    if (result.matchedCount === 0) {
+      throw new Error("T202609020002 M13 \u8FC1\u79FB\u5931\u8D25\uFF1Acode \u56DE\u586B\u672A\u547D\u4E2D\uFF08\u542F\u52A8\u671F\u5355\u8FDB\u7A0B\u4E32\u884C\uFF0C\u4E0D\u5E94\u53D1\u751F\uFF09");
+    }
+    migrated += 1;
+  }
+  if (migrated > 0) {
+    console.log(`[siming] T202609020002 M13\uFF1Adag_templates.code \u56DE\u586B ${migrated} \u4E2A`);
+  }
+}
 async function ensurePostMigrationIndexes(db) {
   const tasks = db.collection("tasks");
   const taskIndexes = await tasks.listIndexes().toArray();
@@ -1806,6 +2877,30 @@ async function ensurePostMigrationIndexes(db) {
     throw new Error(`dag_templates \u5B58\u5728\u540C\u9879\u76EE\u91CD\u540D\u6A21\u677F\uFF0C\u65E0\u6CD5\u5EFA\u7ACB (projectId,name) \u552F\u4E00\u7D22\u5F15\uFF0C\u8BF7\u5148\u4EBA\u5DE5\u5F52\u5E76\uFF1A${detail}`);
   }
   await templates.createIndex({ projectId: 1, name: 1 }, { unique: true });
+  const seenCodes = /* @__PURE__ */ new Map();
+  const codeDocs = await templates.find(
+    { code: { $exists: true } },
+    { projection: { projectId: 1, code: 1 } }
+  ).toArray();
+  for (const doc of codeDocs) {
+    if (typeof doc.code !== "string") continue;
+    const key = `${String(doc.projectId)}\0${doc.code}`;
+    const ids = seenCodes.get(key) ?? [];
+    ids.push(doc._id.toString());
+    seenCodes.set(key, ids);
+  }
+  const codeConflicts = [...seenCodes.entries()].filter(([, ids]) => ids.length > 1);
+  if (codeConflicts.length > 0) {
+    const detail = codeConflicts.map(([key, ids]) => {
+      const [projectId, code] = key.split("\0");
+      return `projectId=${projectId} code="${code}" \xD7${ids.length} (_id: ${ids.join(", ")})`;
+    }).join("; ");
+    throw new Error(`dag_templates \u5B58\u5728\u540C\u9879\u76EE\u91CD\u590D code\uFF0C\u65E0\u6CD5\u5EFA\u7ACB (projectId,code) \u552F\u4E00\u7D22\u5F15\uFF0C\u8BF7\u5148\u4EBA\u5DE5\u5F52\u5E76\uFF1A${detail}`);
+  }
+  await templates.createIndex(
+    { projectId: 1, code: 1 },
+    { unique: true, partialFilterExpression: { code: { $type: "string" } } }
+  );
   await db.collection("agents").createIndex({ model: 1 });
   await migrateNameUniquenessIndexes(db);
 }
@@ -1859,7 +2954,7 @@ async function startServer(config) {
   });
   await ensureCollections(client);
   const webRoot = resolveWebDistRoot();
-  const app = createApp(client, { webRoot });
+  const app = createApp(client, { webRoot, authEnabled: config.auth.enabled });
   let port = config.port;
   const server = serve({ fetch: app.fetch, hostname: config.host, port: config.port }, (info) => {
     port = info.port;
@@ -1876,6 +2971,7 @@ async function startServer(config) {
 }
 
 export {
+  ADMIN_ONLY_ROUTES,
   resolveWebDistRoot,
   createStaticRoutes,
   createApp,