agentworkshop 0.8.6 → 0.8.8

package/server/api/workshop/daq/storage/retention.put.ts

@@ -0,0 +1,66 @@
+/**
+ * PUT /api/workshop/daq/storage/retention —— 逐产线保留期覆写。
+ * body: { line_id, raw_retention_h?, minute_retention_h?, hour_retention_h? }
+ *
+ * 语义:
+ *  - raw_retention_h 允许短于/长于全局(长于全局时,全局 drop_chunks 已停用,
+ *    由逐线删除保证不误删);
+ *  - minute_retention_h ≥ 1(小时);hour_retention_h = 0 表示永久保留;
+ *  - 至少提供一个字段;未提供=保持现值不动;显式传 null=重置回全局缺省。
+ */
+import { readBody } from 'h3'
+import { requireRole, resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { AppError } from '@/server/utils/errors'
+import { tsdbLayoutInfo, tsdbSetLineRetention } from '@/server/services/workshop/daq/storage'
+import { recordOps } from '@/server/services/workshop/ops/ops'
+
+interface Body {
+  line_id?: string
+  raw_retention_h?: number | null
+  minute_retention_h?: number | null
+  hour_retention_h?: number | null
+}
+
+function num(v: unknown, field: string, allowZero: boolean): number | null | undefined {
+  // 2026-10-30 修复:absent(undefined)=保持现值;显式 null=重置回全局缺省。
+  // 旧实现把「未提供」也折算成 null 下发,部分更新(如只改 hour)会把既有 raw 覆写
+  // 静默抹掉 → sweep 按全局裁剪,长保留数据被删(数据安全事故级)。
+  if (v === undefined) return undefined
+  if (v === null) return null
+  const n = Number(v)
+  if (!Number.isFinite(n) || n < 0 || (!allowZero && n < 1)) {
+    throw new AppError(400, 'VALIDATION_ERROR', `${field} 必须为${allowZero ? '非负' : '正'}数字(收到 ${String(v)})`)
+  }
+  return Math.round(n)
+}
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  requireRole(event, ['admin', 'editor'])
+  const body = await readBody<Body>(event) ?? {}
+  if (body.line_id == null || String(body.line_id).trim() === '') {
+    throw new AppError(400, 'VALIDATION_ERROR', 'line_id 必填(未分配产线请显式传空串的语义请用专用接口,不支持在此误改)')
+  }
+  const patch = {
+    rawRetentionH: num(body.raw_retention_h, 'raw_retention_h', false),
+    minuteRetentionH: num(body.minute_retention_h, 'minute_retention_h', false),
+    hourRetentionH: num(body.hour_retention_h, 'hour_retention_h', true),
+  }
+  if (body.raw_retention_h === undefined && body.minute_retention_h === undefined && body.hour_retention_h === undefined) {
+    throw new AppError(400, 'VALIDATION_ERROR', '至少提供 raw_retention_h / minute_retention_h / hour_retention_h 之一')
+  }
+  await tsdbSetLineRetention(String(body.line_id), patch)
+  recordOps({
+    actor: user.id,
+    actorName: user.name,
+    actorKind: 'user',
+    action: 'daq.storage.retention',
+    kind: 'daq',
+    targetKind: 'daq-line',
+    targetId: String(body.line_id),
+    lineId: String(body.line_id),
+    summary: `设置产线保留期:raw=${patch.rawRetentionH === undefined ? '未改' : patch.rawRetentionH ?? '重置为全局'}h / minute=${patch.minuteRetentionH === undefined ? '未改' : patch.minuteRetentionH ?? '重置为全局'}h / hour=${patch.hourRetentionH === undefined ? '未改' : patch.hourRetentionH ?? '重置为全局'}h`,
+  })
+  return { layout: await tsdbLayoutInfo() }
+})

package/server/api/workshop/daq/storage/rollup.post.ts

@@ -0,0 +1,28 @@
+/**
+ * POST /api/workshop/daq/storage/rollup —— 手动触发一轮增量聚合(1m/1h)。
+ * 控制面操作:admin/editor;调度器已在 daq 启动插件里按 daq.rollup.intervalMs 周期运行,
+ * 本端点用于运维补跑/验收。
+ */
+import { requireRole, resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { tsdbRunRollup } from '@/server/services/workshop/daq/storage'
+import { recordOps } from '@/server/services/workshop/ops/ops'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  requireRole(event, ['admin', 'editor'])
+  const result = await tsdbRunRollup()
+  recordOps({
+    actor: user.id,
+    actorName: user.name,
+    actorKind: 'user',
+    action: 'daq.storage.rollup',
+    kind: 'daq',
+    targetKind: 'daq-tsdb',
+    targetId: 'daq_rollup',
+    summary: result
+      ? `手动触发增量聚合:1m ${result.minuteRows} 行 / 1h ${result.hourRows} 行(${result.lines} 条产线)`
+      : '手动触发增量聚合:当前后端未启用 rollup',
+  })
+  return { result }
+})

package/server/api/workshop/daq/storage.get.ts

@@ -0,0 +1,17 @@
+/**
+ * GET /api/workshop/daq/storage —— 时序存储运维面(只读):
+ * 布局(原始/聚合/逐产线保留期)、聚合水位、共享表体积。
+ *
+ * 用于回答"数据到底保留多久、聚合追到哪、哪条产线被单独调过保留期"。
+ */
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { tsdbLayoutInfo, tsdbRetentionInfo } from '@/server/services/workshop/daq/storage'
+
+export default defineApiHandler(async (event) => {
+  resolveUser(event)
+  return {
+    retention: tsdbRetentionInfo(),
+    layout: await tsdbLayoutInfo(),
+  }
+})

package/server/api/workshop/daq/templates/[key].delete.ts

@@ -10,9 +10,9 @@ import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
 import type { AepDaqTemplateChange } from '#shared/daq-protocol'
 
 export default defineApiHandler(async (event) => {
-  resolveUser(event)
+  const user = resolveUser(event)
   const key = getRouterParam(event, 'key') ?? ''
-  const removed = getDaqTemplateRegistry().remove(key)
+  const removed = getDaqTemplateRegistry().remove(key, user)
   broadcastSceneEvent('daq.template.changed', { op: 'removed', template: removed } satisfies AepDaqTemplateChange)
   return { removed: removed.key }
 })

package/server/api/workshop/daq/templates/[key].patch.ts

@@ -1,19 +1,19 @@
-/**
- * PATCH /api/workshop/daq/templates/:key —— 编辑自定义信号模板(内置模板拒绝)。
- * 成功后广播 daq.template.changed(op=updated)。
- */
-import { getRouterParam, readBody } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { getDaqTemplateRegistry } from '@/server/services/workshop/daq/daq-templates'
-import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
-import type { AepDaqTemplateChange, DaqTemplateInput } from '#shared/daq-protocol'
-
-export default defineApiHandler(async (event) => {
-  resolveUser(event)
-  const key = getRouterParam(event, 'key') ?? ''
-  const body = (await readBody(event) ?? {}) as Partial<DaqTemplateInput>
-  const template = getDaqTemplateRegistry().update(key, body)
-  broadcastSceneEvent('daq.template.changed', { op: 'updated', template } satisfies AepDaqTemplateChange)
-  return { template }
-})
+/**
+ * PATCH /api/workshop/daq/templates/:key —— 编辑自定义信号模板(内置模板拒绝)。
+ * 成功后广播 daq.template.changed(op=updated)。
+ */
+import { getRouterParam, readBody } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getDaqTemplateRegistry } from '@/server/services/workshop/daq/daq-templates'
+import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
+import type { AepDaqTemplateChange, DaqTemplateInput } from '#shared/daq-protocol'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const key = getRouterParam(event, 'key') ?? ''
+  const body = (await readBody(event) ?? {}) as Partial<DaqTemplateInput>
+  const template = getDaqTemplateRegistry().update(key, body, user)
+  broadcastSceneEvent('daq.template.changed', { op: 'updated', template } satisfies AepDaqTemplateChange)
+  return { template }
+})

package/server/api/workshop/daq/templates/index.post.ts

@@ -1,18 +1,18 @@
-/**
- * POST /api/workshop/daq/templates —— 新建自定义信号模板(登录用户)。
- * 成功后广播 daq.template.changed(op=added)收敛全部客户端。
- */
-import { readBody } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { getDaqTemplateRegistry } from '@/server/services/workshop/daq/daq-templates'
-import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
-import type { AepDaqTemplateChange, DaqTemplateInput } from '#shared/daq-protocol'
-
-export default defineApiHandler(async (event) => {
-  resolveUser(event)
-  const body = (await readBody(event) ?? {}) as DaqTemplateInput
-  const template = getDaqTemplateRegistry().create(body)
-  broadcastSceneEvent('daq.template.changed', { op: 'added', template } satisfies AepDaqTemplateChange)
-  return { template }
-})
+/**
+ * POST /api/workshop/daq/templates —— 新建自定义信号模板(登录用户)。
+ * 成功后广播 daq.template.changed(op=added)收敛全部客户端。
+ */
+import { readBody } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { getDaqTemplateRegistry } from '@/server/services/workshop/daq/daq-templates'
+import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
+import type { AepDaqTemplateChange, DaqTemplateInput } from '#shared/daq-protocol'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const body = (await readBody(event) ?? {}) as DaqTemplateInput
+  const template = getDaqTemplateRegistry().create(body, user.id)
+  broadcastSceneEvent('daq.template.changed', { op: 'added', template } satisfies AepDaqTemplateChange)
+  return { template }
+})

package/server/api/workshop/dcw/[id]/write.post.ts

@@ -1,30 +1,31 @@
-/**
- * POST /api/workshop/dcw/:id/write —— 设定值下发(核心写命令;body: { value: number })。
- * 工程量安全校验 → 驱动换算/写/回读校验 → ACK。越界 400;在飞 409。
- * R1 留痕由 write() 中央埋点统一完成(manual 来源携带真实用户身份)。
- */
-import { getRouterParam, readBody, getRequestHeader } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { requireLineMode } from '@/server/services/workshop/permissions'
-import { defineApiHandler } from '@/server/utils/response'
-import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
-import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
-
-export default defineApiHandler(async (event) => {
-  const user = resolveUser(event)
-  bindDcwBroadcast(broadcastSceneEvent)
-  const id = getRouterParam(event, 'id') ?? ''
-  const body = await readBody<{ value?: number }>(event) ?? {}
-  // 产线权限:写控设定值需「可操控」(readonly/无权用户 403)
-  requireLineMode(user, getDcwController().byId(id)?.lineId, 'operate')
+/**
+ * POST /api/workshop/dcw/:id/write —— 设定值下发(核心写命令;body: { value: number })。
+ * 工程量安全校验 → 驱动换算/写/回读校验 → ACK。越界 400;在飞 409。
+ * R1 留痕由 write() 中央埋点统一完成(manual 来源携带真实用户身份)。
+ */
+import { getRouterParam, readBody, getRequestHeader } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { requireLineMode } from '@/server/services/workshop/permissions'
+import { defineApiHandler } from '@/server/utils/response'
+import { bindDcwBroadcast, getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
+import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
+import { benchModeEnabled } from '@/server/services/workshop/bench-mode'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  bindDcwBroadcast(broadcastSceneEvent)
+  const id = getRouterParam(event, 'id') ?? ''
+  const body = await readBody<{ value?: number }>(event) ?? {}
+  // 产线权限:写控设定值需「可操控」(readonly/无权用户 403)
+  requireLineMode(user, getDcwController().byId(id)?.lineId, 'operate')
   // D8 基准消融臂透传(仅 AW_BENCH_MODE=1 时生效;生产模式恒 undefined=full 臂)
-
-  const benchArm = process.env.AW_BENCH_MODE === '1'
-
+
+  const benchArm = benchModeEnabled()
+
     ? (getRequestHeader(event, 'x-aw-bench-arm') || undefined) as 'no-interlock' | 'no-readback' | 'ungated' | undefined
-
+
     : undefined
-
-  const outcome = await getDcwController().write(id, Number(body.value), null, { source: 'manual', actor: user.id, actorName: user.name, benchArm })
-  return { outcome }
-})
+
+  const outcome = await getDcwController().write(id, Number(body.value), null, { source: 'manual', actor: user.id, actorName: user.name, benchArm })
+  return { outcome }
+})

package/server/api/workshop/dcw/recipes/[id].delete.ts

@@ -1,5 +1,11 @@
 /**
  * DELETE /api/workshop/dcw/recipes/:id —— 删除配方。
+ *
+ * 数据保留语义(2026-10-29 明确化):删除**只移除配方定义行** ——
+ *   - 历史批次(runs)、数采样本(打标含 recipe_id)、AML 数据集与模型**一律保留**;
+ *   - recipe_id 作为"墓碑键"继续存在于数据镜像中(数据集/模型行无外键,不级联);
+ *   - 响应与产线日志附带 AML 谱系盘点(datasets/models 计数),删除可审计、数据可追溯;
+ *   - AML 侧按 recipe_id 的历史查询/重训不受影响(显示层对已删配方回退为原始 id)。
  */
 import { getRouterParam } from 'h3'
 import { resolveUser } from '@/server/api/workshop/caller'
@@ -21,13 +27,26 @@ export default defineApiHandler(async (event) => {
     throw new AppError(409, ErrorCodes.CONFLICT, `配方「${recipe.name}」仍在批次 ${activeRun.id.slice(0, 8)} 中执行，请先停线/关批次后再删除`)
   }
   getDcwRecipeRepo().remove(id)
+  // AML 谱系盘点(非阻断;动态 import 防模块环):删除不级联,计数只作保留证明与审计
+  let amlLineage: { datasets: number, models: number, productionModels: number } | null = null
+  try {
+    const { getAmlRuntime } = await import('@/server/services/workshop/aml/runtime')
+    const rt = getAmlRuntime()
+    amlLineage = {
+      datasets: rt.repo.dataset.list({ recipeId: id, limit: 500 }).length,
+      models: rt.repo.model.list({ recipeId: id, limit: 500 }).length,
+      productionModels: rt.repo.model.list({ recipeId: id, stage: 'production', limit: 50 }).length,
+    }
+  }
+  catch { /* AML 运行时未就绪等;盘点失败不影响删除 */ }
   recordOps({
     actor: user.id, actorName: user.name, actorKind: 'user',
     action: 'recipe.delete', kind: 'recipe', targetKind: 'recipe', targetId: id,
     lineId: recipe?.lineId ?? '',
     productId: recipe?.productId ?? '',
     recipeId: id,
-    summary: `删除配方「${recipe?.name ?? id}」${recipe?.lineId ? `(产线 ${recipe.lineId})` : ''}`,
+    summary: `删除配方「${recipe?.name ?? id}」${recipe?.lineId ? `(产线 ${recipe.lineId})` : ''}${amlLineage ? `(AML 数据保留:数据集 ${amlLineage.datasets} / 模型 ${amlLineage.models})` : ''}`,
+    detail: { name: recipe?.name, productId: recipe?.productId, amlLineage },
   })
-  return { deleted: true }
+  return { deleted: true, dataRetention: { runs: '保留(历史批次台账)', samples: '保留(打标含本配方 id)', amlLineage } }
 })

package/server/api/workshop/device-twins/[id]/control.post.ts

@@ -1,21 +1,23 @@
-/**
- * POST /api/workshop/device-twins/:id/control —— 下发设备指令(模拟域)。
- * - Bearer 用户 token;body: { command, args? }
- * - 等价于 MCP device.control 的用户面入口
- * - 返回 { twin }
- */
-import { getRouterParam, readBody } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { AppError } from '@/server/utils/errors'
-import { defineApiHandler } from '@/server/utils/response'
-import { getDeviceTwinRepo } from '@/server/services/workshop/assets/device-twin.repo'
-
-export default defineApiHandler(async (event) => {
-  resolveUser(event)
-  const id = getRouterParam(event, 'id')!
-  const body = await readBody<{ command?: string, args?: Record<string, unknown> }>(event)
-  if (!body?.command) throw new AppError(400, 'BAD_REQUEST', 'command 必填')
-  const twin = getDeviceTwinRepo().applyControl(id, body.command, body.args ?? {})
-  if (!twin) throw new AppError(404, 'NOT_FOUND', `设备不存在: ${id}`)
-  return { twin }
-})
+/**
+ * POST /api/workshop/device-twins/:id/control —— 下发设备指令(模拟域)。
+ * - Bearer 用户 token;body: { command, args? }
+ * - 等价于 MCP device.control 的用户面入口
+ * - 返回 { twin }
+ */
+import { getRouterParam, readBody } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { AppError } from '@/server/utils/errors'
+import { defineApiHandler } from '@/server/utils/response'
+import { getDeviceTwinRepo } from '@/server/services/workshop/assets/device-twin.repo'
+import { assertAssetManager } from '@/server/utils/asset-auth'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  assertAssetManager(user, '设备孪生操控')
+  const id = getRouterParam(event, 'id')!
+  const body = await readBody<{ command?: string, args?: Record<string, unknown> }>(event)
+  if (!body?.command) throw new AppError(400, 'BAD_REQUEST', 'command 必填')
+  const twin = getDeviceTwinRepo().applyControl(id, body.command, body.args ?? {})
+  if (!twin) throw new AppError(404, 'NOT_FOUND', `设备不存在: ${id}`)
+  return { twin }
+})

package/server/api/workshop/device-twins/[id].delete.ts

@@ -10,9 +10,11 @@ import { getDeviceTwinRepo } from '@/server/services/workshop/assets/device-twin
 import { getDaqController } from '@/server/services/workshop/daq/daq-controller'
 import { getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
 import { broadcastSceneEvent } from '@/server/services/workshop/scene-events'
+import { assertAssetManager } from '@/server/utils/asset-auth'
 
 export default defineApiHandler(async (event) => {
-  resolveUser(event)
+  const user = resolveUser(event)
+  assertAssetManager(user, '删除设备孪生')
   const id = getRouterParam(event, 'id')!
   const twin = getDeviceTwinRepo().findById(id)
   const ok = getDeviceTwinRepo().remove(id)

package/server/api/workshop/device-twins/[id].patch.ts

@@ -1,29 +1,31 @@
-/**
- * PATCH /api/workshop/device-twins/:id —— 更新数字孪生设备(含 3D 场景落点 transform)。
- * - Bearer 用户 token;body: { name?, modelRef?, posX?, posZ?, rotationY?, scale? }
- * - 落点坐标/朝向/缩放由 3D 小镇编辑模式拖拽/滑杆结束防抖写入;
- * - 更新后广播 device.updated(全部已连 peer,其他小镇客户端即时同步场景节点)。
- */
-import { getRouterParam, readBody } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { AppError } from '@/server/utils/errors'
-import { defineApiHandler } from '@/server/utils/response'
-import { getDeviceTwinRepo, deviceScenePayload } from '@/server/services/workshop/assets/device-twin.repo'
-import { broadcastSceneEvent } from '@/server/api/workshop/ws'
-
-export default defineApiHandler(async (event) => {
-  resolveUser(event)
-  const id = getRouterParam(event, 'id')!
-  const body = await readBody<{ name?: string, modelRef?: string, posX?: number, posZ?: number, rotationY?: number, scale?: number }>(event)
-  const twin = getDeviceTwinRepo().update(id, {
-    name: typeof body?.name === 'string' && body.name.trim() ? body.name.trim() : undefined,
-    modelRef: typeof body?.modelRef === 'string' ? body.modelRef.trim() : undefined,
-    posX: typeof body?.posX === 'number' && Number.isFinite(body.posX) ? Math.round(body.posX * 10) / 10 : undefined,
-    posZ: typeof body?.posZ === 'number' && Number.isFinite(body.posZ) ? Math.round(body.posZ * 10) / 10 : undefined,
-    rotationY: typeof body?.rotationY === 'number' && Number.isFinite(body.rotationY) ? Math.round(body.rotationY * 10) / 10 : undefined,
-    scale: typeof body?.scale === 'number' && Number.isFinite(body.scale) && body.scale > 0 ? Math.round(body.scale * 100) / 100 : undefined,
-  })
-  if (!twin) throw new AppError(404, 'NOT_FOUND', `设备不存在: ${id}`)
-  broadcastSceneEvent('device.updated', deviceScenePayload(twin))
-  return { twin }
-})
+/**
+ * PATCH /api/workshop/device-twins/:id —— 更新数字孪生设备(含 3D 场景落点 transform)。
+ * - Bearer 用户 token;body: { name?, modelRef?, posX?, posZ?, rotationY?, scale? }
+ * - 落点坐标/朝向/缩放由 3D 小镇编辑模式拖拽/滑杆结束防抖写入;
+ * - 更新后广播 device.updated(全部已连 peer,其他小镇客户端即时同步场景节点)。
+ */
+import { getRouterParam, readBody } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { AppError } from '@/server/utils/errors'
+import { defineApiHandler } from '@/server/utils/response'
+import { getDeviceTwinRepo, deviceScenePayload } from '@/server/services/workshop/assets/device-twin.repo'
+import { broadcastSceneEvent } from '@/server/api/workshop/ws'
+import { assertAssetManager } from '@/server/utils/asset-auth'
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  assertAssetManager(user, '更新设备孪生')
+  const id = getRouterParam(event, 'id')!
+  const body = await readBody<{ name?: string, modelRef?: string, posX?: number, posZ?: number, rotationY?: number, scale?: number }>(event)
+  const twin = getDeviceTwinRepo().update(id, {
+    name: typeof body?.name === 'string' && body.name.trim() ? body.name.trim() : undefined,
+    modelRef: typeof body?.modelRef === 'string' ? body.modelRef.trim() : undefined,
+    posX: typeof body?.posX === 'number' && Number.isFinite(body.posX) ? Math.round(body.posX * 10) / 10 : undefined,
+    posZ: typeof body?.posZ === 'number' && Number.isFinite(body.posZ) ? Math.round(body.posZ * 10) / 10 : undefined,
+    rotationY: typeof body?.rotationY === 'number' && Number.isFinite(body.rotationY) ? Math.round(body.rotationY * 10) / 10 : undefined,
+    scale: typeof body?.scale === 'number' && Number.isFinite(body.scale) && body.scale > 0 ? Math.round(body.scale * 100) / 100 : undefined,
+  })
+  if (!twin) throw new AppError(404, 'NOT_FOUND', `设备不存在: ${id}`)
+  broadcastSceneEvent('device.updated', deviceScenePayload(twin))
+  return { twin }
+})

package/server/api/workshop/ops-logs/index.post.ts

@@ -1,69 +1,92 @@
-/**
- * POST /api/workshop/ops-logs —— 人工手动记录事件(值班记录/现场处置/备注)。
- * body: { summary(必填), lineId?, productId?, recipeId?, detail? }
- *
- * 产线归属一致性:给了 productId / recipeId 时自动补全 lineId,并与显式 lineId 交叉校验
- * (不允许把 A 线配方写进 B 线日志)。lineId 为空的记录只进全局审计台账,
- * **不会**出现在产线日志查询与实时轨 —— 前端因此要求先选产线。
- */
-import { readBody } from 'h3'
-import { resolveUser } from '@/server/api/workshop/caller'
-import { defineApiHandler } from '@/server/utils/response'
-import { AppError, ErrorCodes } from '../../../utils/errors'
-import { recordOps } from '../../../services/workshop/ops/ops'
-import { getDcwLineRepo } from '@/server/services/workshop/dcw/dcw-line.repo'
-import { getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
-import { getDcwProductRepo } from '@/server/services/workshop/dcw/dcw-product.repo'
-
-export default defineApiHandler(async (event) => {
-  const user = resolveUser(event)
-  const body = await readBody<{
-    summary?: string
-    lineId?: string
-    productId?: string
-    recipeId?: string
-    detail?: Record<string, unknown>
-  }>(event) ?? {}
-  const summary = String(body.summary ?? '').trim()
-  if (!summary)
-    throw new AppError(400, ErrorCodes.VALIDATION_ERROR, '手动记录内容(summary)不能为空')
-
-  let lineId = String(body.lineId ?? '').trim()
-  const productId = String(body.productId ?? '').trim()
-  const recipeId = String(body.recipeId ?? '').trim()
-  if (lineId && !getDcwLineRepo().byId(lineId))
-    throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `产线不存在: ${lineId}`)
-
-  if (productId) {
-    const product = getDcwProductRepo().byId(productId)
-    if (!product)
-      throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `产品不存在: ${productId}`)
-    if (lineId && product.lineId && product.lineId !== lineId)
-      throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `产品「${product.name}」归属产线 ${product.lineId},与 lineId=${lineId} 不一致`)
-    if (!lineId && product.lineId) lineId = product.lineId
-  }
-  if (recipeId) {
-    const recipe = getDcwController().listRecipes().find(r => r.id === recipeId)
-    if (!recipe)
-      throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `配方不存在: ${recipeId}`)
-    if (lineId && recipe.lineId && recipe.lineId !== lineId)
-      throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `配方「${recipe.name}」归属产线 ${recipe.lineId},与 lineId=${lineId} 不一致`)
-    if (!lineId && recipe.lineId) lineId = recipe.lineId
-  }
-
-  recordOps({
-    actor: user.id,
-    actorName: user.name,
-    actorKind: 'user',
-    action: 'ops.manual',
-    kind: 'manual',
-    targetKind: 'manual-log',
-    targetId: '',
-    summary,
-    lineId,
-    productId,
-    recipeId,
-    detail: { manual: true, ...(body.detail ?? {}) },
-  })
-  return { ok: true, lineScoped: Boolean(lineId), lineId, productId, recipeId }
-})
+/**
+ * POST /api/workshop/ops-logs —— 人工手动记录事件(值班记录/现场处置/备注/异常上报)。
+ * body: { summary(必填), lineId?, productId?, recipeId?, detail?, level? }
+ *
+ * level(2026-10-29):人工记录也带严重级 —— 值班员上报异常时选 warn/error,
+ * 记录在 /logs 与实时轨带红黄标,与自动 error-ledger/写控 ACK 同一口径。
+ *
+ * 产线归属一致性:给了 productId / recipeId 时自动补全 lineId,并与显式 lineId 交叉校验
+ * (不允许把 A 线配方写进 B 线日志)。lineId 为空的记录只进全局审计台账,
+ * **不会**出现在产线日志查询与实时轨 —— 前端因此要求先选产线。
+ */
+import { readBody } from 'h3'
+import { resolveUser } from '@/server/api/workshop/caller'
+import { defineApiHandler } from '@/server/utils/response'
+import { AppError, ErrorCodes } from '../../../utils/errors'
+import { recordOps } from '../../../services/workshop/ops/ops'
+import { getDcwLineRepo } from '@/server/services/workshop/dcw/dcw-line.repo'
+import { getDcwController } from '@/server/services/workshop/dcw/dcw-controller'
+import { getDcwProductRepo } from '@/server/services/workshop/dcw/dcw-product.repo'
+import { requireLineForResource } from '@/server/services/workshop/line-scope'
+
+const MANUAL_LEVELS = ['info', 'warn', 'error'] as const
+/** 防御上限:摘要 2k 字符 / 详情 32KB(超限 400 拒绝,防单条日志撑爆 sqlite 与前端渲染) */
+const SUMMARY_MAX_CHARS = 2000
+const DETAIL_MAX_BYTES = 32 * 1024
+
+export default defineApiHandler(async (event) => {
+  const user = resolveUser(event)
+  const body = await readBody<{
+    summary?: string
+    lineId?: string
+    productId?: string
+    recipeId?: string
+    detail?: Record<string, unknown>
+    level?: string
+  }>(event) ?? {}
+  const summary = String(body.summary ?? '').trim()
+  if (!summary)
+    throw new AppError(400, ErrorCodes.VALIDATION_ERROR, '手动记录内容(summary)不能为空')
+  if (summary.length > SUMMARY_MAX_CHARS)
+    throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `手动记录内容超长:${summary.length} 字符(上限 ${SUMMARY_MAX_CHARS},长文请放附件/文档后引用)`)
+  if (body.detail !== undefined && JSON.stringify(body.detail ?? {}).length > DETAIL_MAX_BYTES)
+    throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `手动记录详情过大(序列化后超 ${DETAIL_MAX_BYTES} 字节);大段内容请落文档后在此引用`)
+  const levelInput = String(body.level ?? 'info').trim()
+  if (!MANUAL_LEVELS.includes(levelInput as typeof MANUAL_LEVELS[number]))
+    throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `level 只支持 info/warn/error,收到: ${levelInput}`)
+  const level = levelInput as typeof MANUAL_LEVELS[number]
+
+  let lineId = String(body.lineId ?? '').trim()
+  const productId = String(body.productId ?? '').trim()
+  const recipeId = String(body.recipeId ?? '').trim()
+  if (lineId && !getDcwLineRepo().byId(lineId))
+    throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `产线不存在: ${lineId}`)
+
+  if (productId) {
+    const product = getDcwProductRepo().byId(productId)
+    if (!product)
+      throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `产品不存在: ${productId}`)
+    if (lineId && product.lineId && product.lineId !== lineId)
+      throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `产品「${product.name}」归属产线 ${product.lineId},与 lineId=${lineId} 不一致`)
+    if (!lineId && product.lineId) lineId = product.lineId
+  }
+  if (recipeId) {
+    const recipe = getDcwController().listRecipes().find(r => r.id === recipeId)
+    if (!recipe)
+      throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `配方不存在: ${recipeId}`)
+    if (lineId && recipe.lineId && recipe.lineId !== lineId)
+      throw new AppError(400, ErrorCodes.VALIDATION_ERROR, `配方「${recipe.name}」归属产线 ${recipe.lineId},与 lineId=${lineId} 不一致`)
+    if (!lineId && recipe.lineId) lineId = recipe.lineId
+  }
+
+  // 产线归属归一后统一授权:写产线日志需要该线 operate;
+  // lineId 为空 = 全局审计台账(跨线运维信息),仅 admin 可写(与 GET 收权同口径)。
+  requireLineForResource(user, lineId, '运行日志', 'operate')
+
+  recordOps({
+    actor: user.id,
+    actorName: user.name,
+    actorKind: 'user',
+    action: 'ops.manual',
+    kind: 'manual',
+    targetKind: 'manual-log',
+    targetId: '',
+    summary,
+    lineId,
+    productId,
+    recipeId,
+    level,
+    detail: { manual: true, ...(body.detail ?? {}) },
+  })
+  return { ok: true, lineScoped: Boolean(lineId), lineId, productId, recipeId }
+})