@southwind-ai/shared 0.2.7 → 0.3.0

package/index.ts

@@ -2,6 +2,9 @@ export * from "./src/audit.js";
 export * from "./src/ai-operation-readiness.js";
 // @windy-module system.agent begin
 export * from "./src/ai-runtime-report.js";
+export * from "./src/agent-workflow.js";
+export * from "./src/agent-workflow-events.js";
+export * from "./src/agent-workflow-evaluation.js";
 // @windy-module system.agent end
 export * from "./src/database.js";
 export * from "./src/data-governance.js";
@@ -20,7 +23,6 @@ export * from "./src/platform-settings.js";
 export * from "./src/profile.js";
 export * from "./src/primitives.js";
 export * from "./src/rbac.js";
-export * from "./src/ruoyi.js";
 export * from "./src/scheduler.js";
 export * from "./src/search-provider.js";
 // @windy-module system.agent begin
@@ -28,3 +30,5 @@ export * from "./src/screenshot-context-digest.js";
 // @windy-module system.agent end
 export * from "./src/stable-key.js";
 export * from "./src/workflow.js";
+
+export * from "./src/license-console-capabilities.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/shared",
-  "version": "0.2.7",
+  "version": "0.3.0",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {

package/src/agent-workflow-definition.ts

@@ -0,0 +1,113 @@
+import type { ISODateTime } from "./primitives.js";
+import type { AgentWorkflowBudget } from "./agent-workflow-run.js";
+
+export const AGENT_WORKFLOW_SCHEMA_VERSION = 1 as const;
+
+export type AgentWorkflowNodeType =
+  | "model"
+  | "tool"
+  | "subagent"
+  | "condition"
+  | "parallel"
+  | "join"
+  | "approval"
+  | "job"
+  | "wait"
+  | "artifact"
+  | "final";
+
+export type AgentWorkflowFailurePolicy =
+  | { readonly mode: "fail-run" }
+  | {
+      readonly mode: "retry";
+      readonly maxAttempts: number;
+      readonly backoffSeconds: number;
+      readonly exhausted: "fail-run" | "skip";
+    }
+  | { readonly mode: "fallback"; readonly nodeId: string }
+  | { readonly mode: "skip" };
+
+interface NodeBase<T extends AgentWorkflowNodeType> {
+  readonly id: string;
+  readonly type: T;
+  readonly label: string;
+  readonly inputSchemaKey?: string;
+  readonly outputSchemaKey?: string;
+  readonly timeoutSeconds?: number;
+  readonly failurePolicy: AgentWorkflowFailurePolicy;
+}
+
+export type AgentWorkflowNode =
+  | (NodeBase<"model"> & {
+      readonly operationKey: string;
+      readonly promptKey: string;
+    })
+  | (NodeBase<"tool"> & {
+      readonly toolKey: string;
+      readonly effect: "read" | "write";
+    })
+  | (NodeBase<"subagent"> & {
+      readonly capabilityKey: string;
+      readonly operationKey: string;
+      readonly allowedToolKeys: readonly string[];
+      readonly requiredFeatureKeys: readonly string[];
+      readonly requiredPermissionKeys: readonly string[];
+      readonly allowedLicenseVersions?: readonly string[];
+      readonly workspacePolicyKey: string;
+      readonly scopePolicyKey: string;
+      readonly budget: AgentWorkflowBudget;
+    })
+  | (NodeBase<"condition"> & {
+      readonly conditionKey: string;
+      readonly branches: readonly string[];
+    })
+  | (NodeBase<"parallel"> & { readonly maxConcurrency: number })
+  | (NodeBase<"join"> & { readonly strategy: "all" | "all-settled" | "any" })
+  | (NodeBase<"approval"> & {
+      readonly title: string;
+      readonly candidateRoles: readonly string[];
+    })
+  | (NodeBase<"job"> & { readonly taskKey: string })
+  | (NodeBase<"wait"> & { readonly signalKey: string })
+  | (NodeBase<"artifact"> & {
+      readonly policyKey: string;
+      readonly artifactKind: string;
+    })
+  | (NodeBase<"final"> & { readonly outputSchemaKey: string });
+
+export interface AgentWorkflowEdge {
+  readonly from: string;
+  readonly to: string;
+  readonly branch?: string;
+}
+
+export interface AgentWorkflowDefinition {
+  readonly schemaVersion: typeof AGENT_WORKFLOW_SCHEMA_VERSION;
+  readonly workflowKey: string;
+  readonly version: string;
+  readonly label: string;
+  readonly description?: string;
+  readonly entryNodeId: string;
+  readonly nodes: readonly AgentWorkflowNode[];
+  readonly edges: readonly AgentWorkflowEdge[];
+  readonly budget: AgentWorkflowBudget;
+}
+
+export interface AgentWorkflowReleaseCoordinates {
+  readonly runtimeVersion: string;
+  readonly routeVersion: string;
+  readonly promptVersion: string;
+  readonly toolSchemaVersion: string;
+  readonly manifestDigest: string;
+}
+
+export interface AgentWorkflowRelease {
+  readonly releaseId: string;
+  readonly releaseDigest: string;
+  readonly definitionId: string;
+  readonly definitionDigest: string;
+  readonly definition: AgentWorkflowDefinition;
+  readonly coordinates: AgentWorkflowReleaseCoordinates;
+  readonly publishedBy: string;
+  readonly publishedAt: ISODateTime;
+}

package/src/agent-workflow-delegation.ts

@@ -0,0 +1,123 @@
+import type { JsonValue } from "./json.js";
+import type { ISODateTime } from "./primitives.js";
+import type {
+  AgentWorkflowArtifactRef,
+  AgentWorkflowBudget,
+  AgentWorkflowUsage,
+} from "./agent-workflow-run.js";
+
+export interface AgentDelegationGrant {
+  readonly delegationId: string;
+  readonly parentRunId: string;
+  readonly parentNodeId: string;
+  readonly parentNodeRunId: string;
+  readonly childSessionId: string;
+  readonly childAgentRunId?: string;
+  readonly capabilityCeiling: {
+    readonly capabilityKey: string;
+    readonly allowedToolKeys: readonly string[];
+    readonly requiredFeatureKeys: readonly string[];
+    readonly requiredPermissionKeys: readonly string[];
+    readonly allowedLicenseVersions?: readonly string[];
+    readonly workspacePolicyKey: string;
+    readonly workspaceId: string;
+    readonly scopeSnapshot: import("./rbac.js").AuthorizationScopeSnapshot;
+    readonly scopePolicyDigest: string;
+    readonly policyDigest: string;
+    readonly authorizationProofId: string;
+    readonly runPolicyDigest: string;
+    readonly scopeDigest: string;
+    readonly authorizationSnapshotDigest: string;
+  };
+  readonly budget: AgentWorkflowBudget;
+  readonly status: "created" | "running" | "completed" | "failed" | "cancelled";
+  readonly outputArtifacts: readonly AgentWorkflowArtifactRef[];
+}
+
+export interface AgentWorkflowBudgetReservation {
+  readonly reservationId: string;
+  readonly parentRunId: string;
+  readonly parentNodeRunId: string;
+  readonly delegationId: string;
+  readonly idempotencyKey: string;
+  readonly authorizationProofId: string;
+  readonly authorizationSnapshotDigest: string;
+  readonly runPolicyDigest: string;
+  readonly reserved: AgentWorkflowBudget;
+  readonly consumed: AgentWorkflowUsage;
+  readonly status: "active" | "settled" | "released";
+  readonly usageReceiptId?: string;
+  readonly reasonCode?: string;
+  readonly settledAt?: ISODateTime;
+  readonly version: number;
+  readonly createdAt: ISODateTime;
+  readonly updatedAt: ISODateTime;
+}
+
+export interface AgentWorkflowSideEffectCommand {
+  readonly commandId: string;
+  readonly runId: string;
+  readonly nodeRunId: string;
+  readonly effectKind: "tool" | "approval" | "job" | "subagent";
+  readonly effectKey: string;
+  readonly adapter: {
+    readonly kind:
+      | "agent-tool"
+      | "approval-work-item"
+      | "durable-job"
+      | "child-agent";
+    readonly coordinate: string;
+  };
+  readonly idempotencyKey: string;
+  readonly requestDigest: string;
+  readonly generation: number;
+  readonly fenceTokenDigest?: string;
+  readonly authorizationSnapshotDigest?: string;
+  readonly runPolicyDigest?: string;
+  readonly budgetReservationId?: string;
+  readonly delegationId?: string;
+  readonly status:
+    | "prepared"
+    | "dispatched"
+    | "cancellation-requested"
+    | "committed"
+    | "reconciled"
+    | "cancelled"
+    | "failed";
+  readonly safeErrorCode?: string;
+  readonly claimedAt?: ISODateTime;
+  readonly committedAt?: ISODateTime;
+  readonly version: number;
+  readonly createdAt: ISODateTime;
+  readonly updatedAt: ISODateTime;
+}
+
+export interface AgentWorkflowSideEffectReceipt {
+  readonly receiptId: string;
+  readonly commandId: string;
+  readonly runId: string;
+  readonly nodeRunId: string;
+  readonly effectKind: AgentWorkflowSideEffectCommand["effectKind"];
+  readonly generation: number;
+  readonly fenceTokenDigest: string;
+  readonly requestDigest: string;
+  readonly externalReceiptId: string;
+  readonly resultDigest: string;
+  readonly smallResult?: JsonValue;
+  readonly artifactRefs?: readonly AgentWorkflowArtifactRef[];
+  readonly authorizationSnapshotDigest: string;
+  readonly runPolicyDigest: string;
+  readonly committedAt: ISODateTime;
+}
+
+export function budgetFitsWithin(
+  child: AgentWorkflowBudget,
+  parent: AgentWorkflowBudget,
+): boolean {
+  return (Object.keys(parent) as Array<keyof AgentWorkflowBudget>).every(
+    (key) =>
+      Number.isSafeInteger(child[key]) &&
+      child[key] >= 0 &&
+      child[key] <= parent[key],
+  );
+}

package/src/agent-workflow-evaluation.ts

@@ -0,0 +1,159 @@
+import type { ISODateTime } from "./primitives.js";
+import type {
+  AgentWorkflowArtifactRef,
+  AgentWorkflowBudget,
+  AgentWorkflowMeasuredCost,
+  AgentWorkflowMeasuredCount,
+} from "./agent-workflow-run.js";
+
+export type AgentWorkflowEvaluationArmKind = "single-agent" | "multi-agent";
+
+export interface AgentWorkflowEvaluationReleaseIdentity {
+  readonly releaseDigest: string;
+  readonly routeVersion: string;
+  readonly promptVersion: string;
+  readonly manifestDigest: string;
+}
+
+export interface AgentWorkflowEvaluationConditions {
+  readonly inputDigest: string | null;
+  readonly modelRouteKey: string | null;
+  readonly model: string | null;
+  readonly modelDeploymentDigest: string | null;
+  readonly modelConfigurationDigest: string | null;
+  readonly toolSchemaDigest: string;
+  readonly toolRuntimePolicyDigest: string | null;
+  readonly allowedToolKeys: readonly string[];
+  readonly budget: AgentWorkflowBudget;
+  readonly scopeDigest: string;
+  readonly authorizationSnapshotDigest: string | null;
+  readonly workspacePolicyDigest: string | null;
+  readonly executionPolicyDigest: string | null;
+  readonly runtimeVersion: string;
+}
+
+export type AgentWorkflowEvaluationAvailability =
+  | { readonly status: "run"; readonly runId: string }
+  | { readonly status: "unavailable"; readonly reasonCode: string };
+
+export interface AgentWorkflowEvaluationArmCoordinates {
+  readonly releaseId: string;
+  readonly release: AgentWorkflowEvaluationReleaseIdentity;
+  readonly conditions: AgentWorkflowEvaluationConditions;
+  readonly availability: AgentWorkflowEvaluationAvailability;
+}
+
+export interface AgentWorkflowEvaluationIdentity {
+  readonly evaluationSetKey: string;
+  readonly evaluationSetVersion: string;
+  readonly caseKey: string;
+  readonly caseVersion: string;
+  readonly trialKey: string;
+  readonly trialIndex: number;
+  readonly scopeDigest: string;
+  readonly singleAgent: AgentWorkflowEvaluationArmCoordinates;
+  readonly multiAgent: AgentWorkflowEvaluationArmCoordinates;
+  readonly rubricKey: string;
+  readonly rubricVersion: string;
+}
+
+export interface AgentWorkflowEvaluationMismatchEvidence {
+  readonly source: "requested-vs-observed" | "arm-comparison";
+  readonly field: string;
+  readonly reasonCode: string;
+  readonly expectedDigest: string;
+  readonly observedDigest?: string;
+  readonly counterpartArm?: AgentWorkflowEvaluationArmKind;
+}
+
+export interface AgentWorkflowEvaluationFailure {
+  readonly category:
+    | "model"
+    | "tool"
+    | "authorization"
+    | "approval"
+    | "job"
+    | "recovery"
+    | "budget"
+    | "runtime";
+  readonly stage: string;
+  readonly safeCode: string;
+}
+
+export interface AgentWorkflowHumanHandoff {
+  readonly reason: string;
+  readonly outcome: "resolved" | "unresolved" | "cancelled";
+  readonly durationMs: number;
+}
+
+export interface AgentWorkflowEvaluationMetrics {
+  readonly outcome:
+    | "completed"
+    | "failed"
+    | "cancelled"
+    | "timed-out"
+    | "invalid";
+  readonly latencyMs: number;
+  readonly cost: AgentWorkflowMeasuredCost;
+  readonly inputTokens: AgentWorkflowMeasuredCount;
+  readonly outputTokens: AgentWorkflowMeasuredCount;
+  readonly failures: readonly AgentWorkflowEvaluationFailure[];
+  readonly humanHandoffs: readonly AgentWorkflowHumanHandoff[];
+  readonly evidenceQuality:
+    | {
+        readonly status: "graded";
+        readonly score: number;
+        readonly source: "rubric-evidence";
+      }
+    | { readonly status: "unknown"; readonly reasonCode: string };
+  readonly safety:
+    | {
+        readonly status: "measured";
+        readonly refusalCount: number;
+        readonly unsafeAllowCount: number;
+        readonly source: "host-audit";
+      }
+    | { readonly status: "unknown"; readonly reasonCode: string };
+  readonly recovery:
+    | {
+        readonly status: "measured";
+        readonly attemptCount: number;
+        readonly succeeded: boolean;
+        readonly source: "workflow-run";
+      }
+    | { readonly status: "unknown"; readonly reasonCode: string };
+}
+
+export interface AgentWorkflowEvaluationArm {
+  readonly kind: AgentWorkflowEvaluationArmKind;
+  readonly status: "pending" | "completed" | "unavailable" | "invalid";
+  readonly coordinates: AgentWorkflowEvaluationArmCoordinates;
+  readonly runId?: string;
+  readonly metrics?: AgentWorkflowEvaluationMetrics;
+  readonly evidenceArtifacts: readonly AgentWorkflowArtifactRef[];
+  readonly mismatchEvidence: readonly AgentWorkflowEvaluationMismatchEvidence[];
+  readonly dispositionReason?: string;
+}
+
+export interface AgentWorkflowEvaluationRecord {
+  readonly evaluationId: string;
+  readonly tenantId: string;
+  readonly createdBy: string;
+  readonly identity: AgentWorkflowEvaluationIdentity;
+  readonly identityDigest: string;
+  readonly singleAgent: AgentWorkflowEvaluationArm;
+  readonly multiAgent: AgentWorkflowEvaluationArm;
+  readonly status: "pending" | "completed" | "unavailable" | "non-comparable";
+  readonly dispositionReason?: string;
+  readonly createdAt: ISODateTime;
+  readonly completedAt?: ISODateTime;
+}
+
+export interface AgentWorkflowEvaluationSummary {
+  readonly evaluationSetKey: string;
+  readonly evaluationSetVersion: string;
+  readonly comparableSampleCount: number;
+  readonly totalSampleCount: number;
+  readonly singleAgentCompletionRate?: number;
+  readonly multiAgentCompletionRate?: number;
+}

package/src/agent-workflow-events.ts

@@ -0,0 +1,99 @@
+import type { ISODateTime } from "./primitives.js";
+import type {
+  AgentWorkflowArtifactRef,
+  AgentWorkflowInputReceipt,
+} from "./agent-workflow.js";
+
+export const AGENT_WORKFLOW_EVENT_SCHEMA_VERSION = 1 as const;
+
+export type AgentWorkflowEventData =
+  | {
+      readonly type: "workflow.run-created";
+      readonly releaseId: string;
+      readonly inputReceipt: AgentWorkflowInputReceipt;
+      readonly parentRunId?: string;
+      readonly parentNodeId?: string;
+      readonly parentNodeRunId?: string;
+      readonly delegationId?: string;
+    }
+  | { readonly type: "workflow.run-started" }
+  | {
+      readonly type: "workflow.wait-signalled";
+      readonly nodeRunId: string;
+      readonly signalKey: string;
+      readonly payloadDigest: string;
+      readonly receiptId: string;
+    }
+  | {
+      readonly type:
+        | "workflow.run-completed"
+        | "workflow.run-failed"
+        | "workflow.run-cancelled"
+        | "workflow.run-timed-out";
+      readonly safeCode?: string;
+    }
+  | {
+      readonly type: "workflow.cancellation-requested";
+      readonly reasonCode: string;
+    }
+  | {
+      readonly type:
+        | "workflow.recovery-started"
+        | "workflow.recovery-completed";
+      readonly recoveryNumber: number;
+    }
+  | {
+      readonly type: "workflow.recovery-waiting" | "workflow.recovery-failed";
+      readonly recoveryNumber: number;
+      readonly safeCode: string;
+      readonly unresolvedCount: number;
+    }
+  | {
+      readonly type:
+        | "workflow.node-ready"
+        | "workflow.node-started"
+        | "workflow.node-waiting"
+        | "workflow.node-completed"
+        | "workflow.node-failed"
+        | "workflow.node-cancelled"
+        | "workflow.node-skipped"
+        | "workflow.node-timed-out"
+        | "workflow.node-retry-scheduled";
+      readonly nodeRunId: string;
+      readonly nodeId: string;
+      readonly resultDigest?: string;
+      readonly receiptId?: string;
+      readonly safeCode?: string;
+    }
+  | {
+      readonly type:
+        | "workflow.delegation-created"
+        | "workflow.delegation-child-linked"
+        | "workflow.delegation-completed"
+        | "workflow.delegation-failed"
+        | "workflow.delegation-cancel-requested";
+      readonly delegationId: string;
+      readonly parentNodeId: string;
+      readonly parentNodeRunId: string;
+      readonly childSessionId: string;
+      readonly childAgentRunId?: string;
+      readonly artifactIds?: readonly string[];
+      readonly safeCode?: string;
+    }
+  | {
+      readonly type: "workflow.artifact-linked";
+      readonly nodeRunId: string;
+      readonly artifact: AgentWorkflowArtifactRef;
+    };
+
+export interface AgentWorkflowEventEnvelope {
+  readonly schemaVersion: typeof AGENT_WORKFLOW_EVENT_SCHEMA_VERSION;
+  readonly eventId: string;
+  readonly workflowRunId: string;
+  readonly sequence: number;
+  readonly occurredAt: ISODateTime;
+  readonly causationEventId?: string;
+  readonly parentEventId?: string;
+  readonly childWorkflowRunId?: string;
+  readonly data: AgentWorkflowEventData;
+}

package/src/agent-workflow-run.ts

@@ -0,0 +1,259 @@
+import type { JsonValue } from "./json.js";
+import type { ISODateTime } from "./primitives.js";
+import type { AgentWorkflowNodeType } from "./agent-workflow-definition.js";
+
+export interface AgentWorkflowBudget {
+  readonly maxDurationSeconds: number;
+  readonly maxModelAttempts: number;
+  readonly maxToolCalls: number;
+  readonly maxSubagents: number;
+  readonly maxParallelism: number;
+  readonly maxInputTokens: number;
+  readonly maxOutputTokens: number;
+  readonly maxCostMicros: number;
+}
+
+export interface AgentWorkflowArtifactRef {
+  readonly artifactId: string;
+  readonly kind: string;
+  readonly mediaType: string;
+  readonly byteSize: number;
+  readonly sha256: string;
+  readonly retentionPolicyKey: string;
+  readonly source: {
+    readonly moduleKey: string;
+    readonly kind: string;
+    readonly id: string;
+    readonly version: string;
+    readonly sequence: number;
+    readonly digest?: string;
+  };
+}
+
+export type AgentWorkflowMeasuredCount =
+  | {
+      readonly status: "measured";
+      readonly value: number;
+      readonly source: "provider-reported" | "host-measured";
+    }
+  | { readonly status: "unknown"; readonly reasonCode: string };
+
+export type AgentWorkflowMeasuredCost =
+  | {
+      readonly status: "measured";
+      readonly amountMicros: number;
+      readonly currency: string;
+      readonly source:
+        | "provider-reported"
+        | "catalog-estimated"
+        | "host-measured";
+    }
+  | { readonly status: "unknown"; readonly reasonCode: string };
+
+export interface AgentWorkflowUsage {
+  readonly durationMs: number;
+  readonly modelAttempts: number;
+  readonly toolCalls: number;
+  readonly subagents: number;
+  readonly inputTokens: AgentWorkflowMeasuredCount;
+  readonly outputTokens: AgentWorkflowMeasuredCount;
+  readonly cost: AgentWorkflowMeasuredCost;
+}
+
+export interface AgentWorkflowInputReceipt {
+  readonly schemaKey: string;
+  readonly value: JsonValue;
+  readonly valueDigest: string;
+  readonly recordedAt: ISODateTime;
+}
+
+export type AgentWorkflowRunStatus =
+  | "accepted"
+  | "running"
+  | "waiting"
+  | "completed"
+  | "failed"
+  | "cancelled"
+  | "timed-out";
+export type AgentWorkflowNodeRunStatus =
+  | "pending"
+  | "ready"
+  | "running"
+  | "waiting"
+  | "retry-scheduled"
+  | "completed"
+  | "failed"
+  | "cancelled"
+  | "skipped"
+  | "timed-out";
+
+export interface AgentWorkflowRun {
+  readonly runId: string;
+  readonly releaseId: string;
+  readonly tenantId: string;
+  readonly actorId: string;
+  readonly routeKey: string;
+  readonly inputDigest: string;
+  readonly inputReceipt: AgentWorkflowInputReceipt;
+  readonly scopeDigest: string;
+  readonly authorizationSnapshotDigest: string;
+  readonly toolPolicyDigest: string;
+  readonly workspacePolicyDigest: string;
+  readonly executionPolicyDigest: string;
+  readonly status: AgentWorkflowRunStatus;
+  readonly budget: AgentWorkflowBudget;
+  readonly usage: AgentWorkflowUsage;
+  readonly deadlineAt: ISODateTime;
+  readonly sessionId?: string;
+  readonly parentRunId?: string;
+  readonly parentNodeId?: string;
+  readonly parentNodeRunId?: string;
+  readonly cancellationRequestedAt?: ISODateTime;
+  readonly createdAt: ISODateTime;
+  readonly updatedAt: ISODateTime;
+  readonly finishedAt?: ISODateTime;
+  readonly version: number;
+  readonly safeErrorCode?: string;
+}
+
+export interface AgentWorkflowNodeResultReceipt {
+  readonly receiptId: string;
+  readonly nodeRunId: string;
+  readonly resultDigest: string;
+  readonly outputSchemaKey?: string;
+  readonly selectedBranch?: string;
+  readonly smallResult?: JsonValue;
+  readonly executionEvidence?: {
+    readonly source: "agent-runtime-report";
+    readonly agentRunId: string;
+    readonly modelRouteKey: string;
+    readonly model: string;
+    readonly modelDeploymentDigest: string;
+    readonly modelConfigurationDigest: string;
+  };
+  readonly artifactIds: readonly string[];
+  readonly recordedAt: ISODateTime;
+}
+
+export interface AgentWorkflowNodeRun {
+  readonly nodeRunId: string;
+  readonly runId: string;
+  readonly nodeId: string;
+  readonly previousNodeRunId?: string;
+  readonly nodeType: AgentWorkflowNodeType;
+  readonly status: AgentWorkflowNodeRunStatus;
+  readonly attempt: number;
+  readonly maxAttempts: number;
+  readonly idempotencyKey: string;
+  readonly adapter?: {
+    readonly kind:
+      | "model-operation"
+      | "agent-tool"
+      | "child-agent"
+      | "approval-work-item"
+      | "durable-job"
+      | "wait-signal"
+      | "artifact-store"
+      | "finalizer";
+    readonly coordinate: string;
+  };
+  readonly inputArtifacts: readonly AgentWorkflowArtifactRef[];
+  readonly outputArtifacts: readonly AgentWorkflowArtifactRef[];
+  readonly resultReceipt?: AgentWorkflowNodeResultReceipt;
+  readonly safeErrorCode?: string;
+  readonly createdAt: ISODateTime;
+  readonly updatedAt: ISODateTime;
+  readonly startedAt?: ISODateTime;
+  readonly finishedAt?: ISODateTime;
+  readonly version: number;
+}
+
+export function isAgentWorkflowTerminal(
+  status: AgentWorkflowRunStatus,
+): boolean {
+  return ["completed", "failed", "cancelled", "timed-out"].includes(status);
+}
+
+export function isAgentWorkflowNodeTerminal(
+  status: AgentWorkflowNodeRunStatus,
+): boolean {
+  return ["completed", "failed", "cancelled", "skipped", "timed-out"].includes(
+    status,
+  );
+}
+
+export function isAgentWorkflowRunTransitionAllowed(
+  from: AgentWorkflowRunStatus,
+  to: AgentWorkflowRunStatus,
+): boolean {
+  const allowed: Record<
+    AgentWorkflowRunStatus,
+    readonly AgentWorkflowRunStatus[]
+  > = {
+    accepted: ["running", "cancelled", "timed-out", "failed"],
+    running: ["waiting", "completed", "failed", "cancelled", "timed-out"],
+    waiting: ["running", "failed", "cancelled", "timed-out"],
+    completed: [],
+    failed: [],
+    cancelled: [],
+    "timed-out": [],
+  };
+  return allowed[from].includes(to);
+}
+
+export function isAgentWorkflowNodeTransitionAllowed(
+  from: AgentWorkflowNodeRunStatus,
+  to: AgentWorkflowNodeRunStatus,
+): boolean {
+  const allowed: Record<
+    AgentWorkflowNodeRunStatus,
+    readonly AgentWorkflowNodeRunStatus[]
+  > = {
+    pending: ["ready", "skipped", "cancelled", "timed-out"],
+    ready: ["running", "cancelled", "timed-out"],
+    running: [
+      "waiting",
+      "completed",
+      "failed",
+      "cancelled",
+      "skipped",
+      "timed-out",
+    ],
+    waiting: [
+      "running",
+      "completed",
+      "failed",
+      "cancelled",
+      "skipped",
+      "timed-out",
+    ],
+    failed: ["retry-scheduled"],
+    "retry-scheduled": ["cancelled", "timed-out"],
+    completed: [],
+    cancelled: [],
+    skipped: [],
+    "timed-out": [],
+  };
+  return allowed[from].includes(to);
+}
+
+export function usageFitsWithinBudget(
+  usage: AgentWorkflowUsage,
+  budget: AgentWorkflowBudget,
+): boolean {
+  if (
+    usage.inputTokens.status !== "measured" ||
+    usage.outputTokens.status !== "measured" ||
+    usage.cost.status !== "measured"
+  )
+    return false;
+  return (
+    usage.durationMs <= budget.maxDurationSeconds * 1_000 &&
+    usage.modelAttempts <= budget.maxModelAttempts &&
+    usage.toolCalls <= budget.maxToolCalls &&
+    usage.subagents <= budget.maxSubagents &&
+    usage.inputTokens.value <= budget.maxInputTokens &&
+    usage.outputTokens.value <= budget.maxOutputTokens &&
+    usage.cost.amountMicros <= budget.maxCostMicros
+  );
+}

package/src/agent-workflow.ts

@@ -0,0 +1,3 @@
+export * from "./agent-workflow-definition.js";
+export * from "./agent-workflow-run.js";
+export * from "./agent-workflow-delegation.js";

package/src/ai-runtime-report.ts

@@ -107,6 +107,8 @@ export interface AiRuntimeRunModelDeployment {
 
 export interface AiRuntimeRunListItem {
   runId: string;
+  /** 创建该 Run 的稳定 Engine 实现标识；历史 ADK Run 保持原值。 */
+  engineId: string;
   operationKey: string;
   actor: AiRuntimeActorSummary | null;
   status: AiRuntimeRunStatus;
@@ -142,11 +144,34 @@ export interface AiRuntimeAttemptDetail extends AiRuntimeRunUsage {
   finishedAt: ISODateTime | null;
 }
 
+export interface AiRuntimeTrajectoryEvent {
+  sequence: number;
+  sequenceEnd: number;
+  type: string;
+  title: string;
+  toolKey?: string;
+  approvalOutcome?: string;
+  attemptSequence?: number;
+  totalTokens?: number;
+  artifactCount?: number;
+  inputModalities?: string[];
+  deltaCount?: number;
+  outputCharacters?: number;
+  errorCode?: string;
+}
+
+export interface AiRuntimeTrajectory {
+  /** canonical Run 超过既有留存期后，报表仍可读但轨迹不再可用。 */
+  available: boolean;
+  events: AiRuntimeTrajectoryEvent[];
+}
+
 export interface AiRuntimeRunDetail extends AiRuntimeRunListItem {
   releaseId: string;
   traceId: string;
   safeErrorCode: string | null;
   attempts: AiRuntimeAttemptDetail[];
+  trajectory: AiRuntimeTrajectory;
 }
 
 export type AiRuntimeRunPage = PageResult<AiRuntimeRunListItem>;

package/src/license-console-capabilities.ts

@@ -0,0 +1,163 @@
+import type { LicenseOperatorPermission } from "./license.js";
+
+/** 厂商签发中心独立认证域；不装配到客户 system.license。 */
+export const LICENSE_CONSOLE_CAPABILITIES = {
+  records: {
+    feature: "license.record",
+    permission: "license.record.read",
+    entry: "records",
+    apis: [
+      "GET /api/licenses",
+      "GET /api/licenses/:id",
+      "GET /api/licenses/:id/download",
+      "GET /api/licenses/:id/activation-code",
+      "GET /api/licenses/:id/events",
+      "GET /api/events",
+      "GET /api/customers",
+      "GET /api/customers/:id",
+      "GET /api/projects",
+      "GET /api/projects/:id",
+      "GET /api/contracts",
+      "GET /api/contracts/:id",
+      "GET /api/license-versions",
+      "GET /api/license-versions/:id",
+      "GET /api/nodes",
+      "GET /api/nodes/:id",
+      "GET /api/keys/active",
+      "GET /api/projects/:projectId/contracts",
+      "GET /api/projects/:projectId/nodes",
+      "GET /api/projects/:projectId/license-versions",
+      "GET /api/projects/:projectId/licenses",
+      "GET /api/keys",
+      "GET /api/signing/diagnostics",
+    ],
+    auditActions: ["license.downloaded"],
+  },
+  projects: {
+    feature: "license.project",
+    permission: "license.project.manage",
+    entry: "maintenance",
+    apis: [
+      "POST /api/customers",
+      "POST /api/projects",
+      "POST /api/contracts",
+      "POST /api/license-versions",
+      "POST /api/nodes",
+      "PATCH /api/customers/:id",
+      "PATCH /api/projects/:id",
+      "PATCH /api/contracts/:id",
+      "PATCH /api/license-versions/:id",
+      "PATCH /api/nodes/:id",
+      "PATCH /api/customers/:id/archive",
+      "PATCH /api/projects/:id/archive",
+      "PATCH /api/contracts/:id/archive",
+      "PATCH /api/license-versions/:id/archive",
+      "PATCH /api/nodes/:id/archive",
+    ],
+    auditActions: ["crud.create", "crud.update"],
+  },
+  issuance: {
+    feature: "license.issue",
+    permission: "license.issue",
+    entry: "project-issuance",
+    apis: [
+      "POST /api/projects/:projectId/licenses",
+      "POST /api/projects/:projectId/license-review",
+      "GET /api/projects/:projectId/issuance-requests/:key",
+      "POST /api/licenses",
+      "POST /api/licenses/:id/revocation-marks",
+      "POST /api/licenses/:id/note-corrections",
+    ],
+    auditActions: [
+      "license.issued",
+      "license.replaced",
+      "license.superseded",
+      "license.revocation-marked",
+      "license.note-corrected",
+    ],
+  },
+  keys: {
+    feature: "license.key",
+    permission: "license.key.rotate",
+    entry: "operations",
+    apis: ["POST /api/keys/rotate", "POST /api/keys/:keyId/compatibility"],
+    auditActions: ["license.key.rotated", "license.key.compatibility-declared"],
+  },
+  operators: {
+    feature: "license.operator",
+    permission: "license.operator.manage",
+    entry: "administration",
+    apis: [
+      "GET /api/operators",
+      "POST /api/operators",
+      "PATCH /api/operators/:id",
+    ],
+    auditActions: ["license.operator.created", "license.operator.updated"],
+  },
+  sessions: {
+    feature: "license.session",
+    permission: "license.session.revoke",
+    entry: "administration",
+    apis: ["POST /api/auth/sessions/:id/revoke"],
+    auditActions: ["auth.session.revoke"],
+  },
+  audit: {
+    feature: "license.audit",
+    permission: "license.audit.read",
+    entry: "administration",
+    apis: ["GET /api/audit-logs"],
+    auditActions: [],
+  },
+} as const satisfies Record<
+  string,
+  {
+    feature: string;
+    permission: LicenseOperatorPermission;
+    entry: string;
+    apis: readonly string[];
+    auditActions: readonly string[];
+  }
+>;
+
+export interface LicenseConsoleCapability {
+  feature: string;
+  permission: LicenseOperatorPermission;
+  entry: string;
+  apis: readonly string[];
+  auditActions: readonly string[];
+}
+export function validateLicenseConsoleCapabilities(
+  items: readonly LicenseConsoleCapability[] = Object.values(
+    LICENSE_CONSOLE_CAPABILITIES,
+  ),
+): void {
+  const features = new Set<string>();
+  const permissions = new Set<string>();
+  const apis = new Set<string>();
+  for (const item of items) {
+    if (features.has(item.feature) || permissions.has(item.permission))
+      throw new Error("签发中心能力声明重复");
+    if (
+      item.permission !== item.feature &&
+      !item.permission.startsWith(`${item.feature}.`)
+    )
+      throw new Error("签发中心权限基础 Key 不匹配");
+    features.add(item.feature);
+    permissions.add(item.permission);
+    for (const api of item.apis) {
+      if (apis.has(api)) throw new Error("签发中心 API 声明重复");
+      apis.add(api);
+    }
+  }
+}
+
+export function hasLicenseConsolePermission(
+  permissions: readonly string[],
+  permission: string,
+): boolean {
+  return (
+    Object.values(LICENSE_CONSOLE_CAPABILITIES).some(
+      (item) => item.permission === permission,
+    ) && permissions.includes(permission)
+  );
+}

package/src/license-console.ts

@@ -0,0 +1,94 @@
+import type {
+  LicenseContractVersion,
+  LicenseCustomer,
+  LicenseIssueRecord,
+  LicenseNode,
+  LicenseProject,
+  LicenseReplacement,
+  LicenseV1Claims,
+  LicenseVersion,
+} from "./license.js";
+
+export interface LicenseIssueSummary {
+  id: string;
+  customerId: string;
+  projectId: string;
+  contractVersionId: string;
+  nodeId: string;
+  operatorId: string;
+  claims: LicenseV1Claims;
+  targetSoftwareVersion?: string;
+  predecessor?: LicenseReplacement;
+  successor?: LicenseReplacement;
+  revocationMarked: boolean;
+}
+export interface LicenseConsoleCollections {
+  customers: LicenseCustomer;
+  projects: LicenseProject;
+  contracts: LicenseContractVersion;
+  nodes: LicenseNode;
+  "license-versions": LicenseVersion;
+  licenses: LicenseIssueSummary;
+}
+export interface LicenseListQuery {
+  page: number;
+  pageSize: number;
+  q?: string;
+  customerId?: string;
+  projectId?: string;
+  status?: string;
+  contractVersionId?: string;
+  nodeId?: string;
+  machineCode?: string;
+  licenseVersionKey?: string;
+  issuedFrom?: string;
+  issuedTo?: string;
+  expiresFrom?: string;
+  expiresTo?: string;
+  expiresWithinDays?: 7 | 30 | 60;
+}
+export interface LicensePage<T> {
+  items: T[];
+  total: number;
+  page: number;
+  pageSize: number;
+}
+export interface LicenseNewNode {
+  code: string;
+  name: string;
+  purpose?: string;
+  machineCode: string;
+}
+export interface LicenseReviewCommand {
+  contractVersionId: string;
+  nodeId?: string;
+  newNode?: LicenseNewNode;
+  expiresAt: string;
+  softwareVersion: string;
+  replacementOfLicenseId?: string;
+  replacementReason?: string;
+}
+export interface LicenseReviewConfirmation {
+  customer: LicenseCustomer;
+  project: LicenseProject;
+  contract: LicenseContractVersion;
+  licenseVersion: LicenseVersion;
+  node: LicenseNewNode;
+  keyId: string;
+  expiresAt: string;
+  softwareVersion: string;
+  replacementOfLicenseId?: string;
+  replacementReason?: string;
+}
+export interface LicenseReviewResult {
+  reviewDigest: string;
+  confirmation: LicenseReviewConfirmation;
+  blockingReasons: string[];
+}
+export interface LicenseRequestStatus {
+  status: "processing" | "failed" | "completed";
+  licenseId: string;
+  result?: LicenseIssueRecord;
+  error?: { code: string; reason: string };
+  retryAfterSeconds?: number;
+}

package/src/license.ts

@@ -1,6 +1,7 @@
 import type { EntityId, ISODateTime } from "./primitives.js";
 
 export * from "./license-legacy.js";
+export * from "./license-console.js";
 
 declare const entitlementKeyBrand: unique symbol;
 declare const licenseVersionKeyBrand: unique symbol;
@@ -132,6 +133,8 @@ export interface LicenseProject {
 }
 
 export interface LicenseContractVersion {
+  predecessorId?: EntityId;
+  issuedCount?: number;
   id: EntityId;
   projectId: EntityId;
   contractNumber: string;
@@ -147,6 +150,7 @@ export interface LicenseContractVersion {
 }
 
 export interface LicenseNode {
+  issuedCount?: number;
   id: EntityId;
   projectId: EntityId;
   code: string;
@@ -200,6 +204,7 @@ export type LicenseOperatorRole =
 
 export type LicenseOperatorPermission =
   | "license.record.read"
+  | "license.audit.read"
   | "license.issue"
   | "license.project.manage"
   | "license.key.rotate"

package/src/rbac.ts

@@ -69,6 +69,30 @@ export interface AgentRunAuthorizationSnapshot {
   featureKey: string;
   allowedToolKeys: string[];
   toolNetworkMode: "forbidden";
+  /** Host-normalized current Case coordinate; absent forbids Case Memory. */
+  memoryScopeCaseId?: string;
+  // @windy-module system.agent begin
+  /** Workflow-only: binds the narrowed runtime budget to the Run grant. */
+  runtimeBudgetDigest?: string;
+  /** Workflow-only: frozen provider deployment and model used for this Run. */
+  modelPin?: {
+    deploymentKey: string;
+    model: string;
+  };
+  /** Child Agent only: immutable effective delegation ceiling. */
+  delegation?: {
+    delegationId: string;
+    policyDigest: string;
+    budgetDigest: string;
+    workspaceId: string;
+    workspacePolicyKey: string;
+    scopeDigest: string;
+    scopePolicyDigest: string;
+    capabilityKey: string;
+    requiredFeatureKeys: string[];
+    requiredPermissionKeys: string[];
+  };
+  // @windy-module system.agent end
 }
 
 export type CredentialState = "active" | "must-change-password";

package/src/ruoyi.ts

@@ -1,98 +0,0 @@
-import type { AuditEvent, AuditLogWriter } from "./audit.js";
-import type { LegacyTableMapping } from "./database.js";
-import type { EntityId, ISODateTime } from "./primitives.js";
-import type {
-  MenuNode,
-  PermissionDefinition,
-  RoleDefinition,
-  UserAccount,
-} from "./rbac.js";
-
-export type RuoYiCoreTable =
-  | "sys_user"
-  | "sys_role"
-  | "sys_user_role"
-  | "sys_dept"
-  | "sys_post"
-  | "sys_user_post"
-  | "sys_menu"
-  | "sys_role_menu"
-  | "sys_role_dept"
-  | "sys_dict_type"
-  | "sys_dict_data"
-  | "sys_config"
-  | "sys_notice"
-  | "sys_logininfor"
-  | "sys_oper_log"
-  | "sys_job"
-  | "sys_job_log";
-
-export interface RuoYiConnectionConfig {
-  mysqlDsn: string;
-  redisDsn?: string;
-  readonly: boolean;
-}
-
-export interface RuoYiMigrationPlan {
-  id: EntityId;
-  createdAt: ISODateTime;
-  tables: RuoYiCoreTable[];
-  dryRun: boolean;
-  resetPasswords: boolean;
-}
-
-export interface RuoYiMigrationReport {
-  planId: EntityId;
-  startedAt: ISODateTime;
-  finishedAt?: ISODateTime;
-  importedRows: Record<RuoYiCoreTable, number>;
-  failedRows: Record<RuoYiCoreTable, number>;
-  warnings: string[];
-  auditEvents: AuditEvent[];
-}
-
-export interface RuoYiPermissionSnapshot {
-  user: UserAccount;
-  roles: RoleDefinition[];
-  menus: MenuNode[];
-  permissions: PermissionDefinition[];
-}
-
-export interface RuoYiImportAdapter {
-  dryRun(plan: RuoYiMigrationPlan): Promise<RuoYiMigrationReport>;
-  import(
-    plan: RuoYiMigrationPlan,
-    audit: AuditLogWriter,
-  ): Promise<RuoYiMigrationReport>;
-}
-
-export interface RuoYiLegacyRuntimeAdapter {
-  connect(config: RuoYiConnectionConfig): Promise<void>;
-  disconnect(): Promise<void>;
-  readPermissionSnapshot(userId: EntityId): Promise<RuoYiPermissionSnapshot>;
-}
-
-export interface RuoYiReportAdapter {
-  compareUserPermissions(userId: EntityId): Promise<RuoYiMigrationReport>;
-  tableMappings(): LegacyTableMapping[];
-}
-
-export const ruoyiCoreTables: RuoYiCoreTable[] = [
-  "sys_user",
-  "sys_role",
-  "sys_user_role",
-  "sys_dept",
-  "sys_post",
-  "sys_user_post",
-  "sys_menu",
-  "sys_role_menu",
-  "sys_role_dept",
-  "sys_dict_type",
-  "sys_dict_data",
-  "sys_config",
-  "sys_notice",
-  "sys_logininfor",
-  "sys_oper_log",
-  "sys_job",
-  "sys_job_log",
-];