create-windy 0.3.17 → 0.3.19

package/template/apps/server/src/application-services.ts

@@ -1,4 +1,7 @@
+// @windy-module system.bulk-data begin
 import { DictionaryBulkResourceHandler } from "./bulk-data/dictionary-handler.js";
+// @windy-module system.bulk-data end
+// @windy-module system.data-governance begin
 import { DrizzleGovernedExportRepository } from "./data-governance/export/drizzle-repository.js";
 import { WorkflowGovernedExportApproval } from "./data-governance/export/approval-port.js";
 import { GovernedExportJobRuntime } from "./data-governance/export/job-runtime.js";
@@ -9,25 +12,41 @@ import {
   GovernedUserExportSource,
   ModuleGovernedExportSource,
 } from "./data-governance/export/source.js";
+// @windy-module system.data-governance end
+// @windy-module system.bulk-data begin
 import { DrizzleBulkDataRepository } from "./bulk-data/drizzle-repository.js";
 import { InMemoryBulkDataRepository } from "./bulk-data/repository.js";
+// @windy-module system.bulk-data end
 import type { createFoundationSnapshot } from "./foundation.js";
 import { createLegacyServiceRuntime } from "./jobs/legacy-service-runtime.js";
+// @windy-module system.data-governance begin
 import { DurableArtifactService } from "./jobs/artifact-service.js";
+// @windy-module system.data-governance end
+// @windy-module system.notification begin
 import { DrizzleNotificationRepository } from "./notification/drizzle-repository.js";
 import { InMemoryNotificationRepository } from "./notification/repository.js";
+// @windy-module system.notification end
 import type { createServerPersistence } from "./persistence.js";
 import type { createServerRuntime } from "./runtime.js";
 import { createPlatformTaskDefinitions } from "./scheduler/definitions.js";
 import { DrizzleSchedulerRepository } from "./scheduler/drizzle-repository.js";
 import { InMemorySchedulerRepository } from "./scheduler/repository.js";
 import type { ScheduledTaskDefinition } from "./scheduler/types.js";
+// @windy-module system.storage begin
 import type { createStorageRuntime } from "./storage/runtime.js";
+// @windy-module system.storage end
+// @windy-module system.notification begin
 import type { PlatformConfig } from "@southwind-ai/config";
+// @windy-module system.notification end
 import type { DurableHandlerRegistry } from "@southwind-ai/jobs";
+// @windy-module system.storage begin
 import { collectActiveBlobRefs } from "./storage/blob-reference-registry.js";
+// @windy-module system.storage end
 import type { createSystemRepositories } from "./system/seed.js";
+// @windy-module system.data-governance begin
 import { identityRouteConfigs } from "./system/identity-route-config.js";
+// @windy-module system.data-governance end
+// @windy-module system.workflow begin
 import { SystemWorkflowAssigneeDirectory } from "./workflow/assignee-directory.js";
 import { DrizzleWorkflowRepository } from "./workflow/drizzle-repository.js";
 import {
@@ -37,6 +56,8 @@ import {
 } from "./workflow/effects.js";
 import { InMemoryWorkflowRepository } from "./workflow/repository.js";
 import { WorkflowService } from "./workflow/service.js";
+// @windy-module system.workflow end
+// @windy-module system.notification begin
 import { NotificationChannelRegistry } from "./notification/channel-adapter.js";
 import { DrizzleNotificationDeliveryRepository } from "./notification/delivery-repository.js";
 import { NotificationDeliveryWorker } from "./notification/delivery-worker.js";
@@ -48,6 +69,7 @@ import {
 import { SystemNotificationRecipientDirectory } from "./notification/recipient-directory.js";
 import { NotificationService } from "./notification/service.js";
 import { SmtpNotificationChannelAdapter } from "./notification/smtp-adapter.js";
+// @windy-module system.notification end
 import type { InitializedModuleHosts } from "./module-host.js";
 import {
   createModuleDurableContextualizer,
@@ -60,10 +82,16 @@ interface ApplicationServicesInput {
   systemRepositories: ReturnType<typeof createSystemRepositories>;
   foundation: ReturnType<typeof createFoundationSnapshot>;
   runtime: ReturnType<typeof createServerRuntime>;
+  // @windy-module system.storage begin
   storage: ReturnType<typeof createStorageRuntime>;
+  // @windy-module system.storage end
   moduleTasks: ScheduledTaskDefinition[];
+  // @windy-module system.bulk-data begin
   bulkRetentionDays: number;
+  // @windy-module system.bulk-data end
+  // @windy-module system.notification begin
   mailConfig?: PlatformConfig["mail"];
+  // @windy-module system.notification end
   installModuleDurableHandlers?: (registry: DurableHandlerRegistry) => void;
   moduleHosts: InitializedModuleHosts;
   // @windy-module system.agent begin
@@ -75,6 +103,7 @@ export async function createApplicationServices(
   input: ApplicationServicesInput,
 ) {
   const { persistence } = input;
+  // @windy-module system.notification begin
   const notifications = persistence
     ? new DrizzleNotificationRepository(persistence.db)
     : new InMemoryNotificationRepository();
@@ -104,6 +133,8 @@ export async function createApplicationServices(
     notificationRecipients,
     notificationChannels,
   );
+  // @windy-module system.notification end
+  // @windy-module system.workflow begin
   const deferredTimeout = new DeferredWorkflowTimeoutScheduler();
   const workflow = new WorkflowService(
     persistence
@@ -116,31 +147,50 @@ export async function createApplicationServices(
       deferredTimeout,
     ),
   );
+  // @windy-module system.workflow end
+  // @windy-module system.data-governance begin
   const governedExportDispatch: {
     runNext?: GovernedExportJobRuntime["runNext"];
   } = {};
+  // @windy-module system.data-governance end
+  // @windy-module system.bulk-data begin
   const bulkRepository = persistence
     ? new DrizzleBulkDataRepository(persistence.db)
     : new InMemoryBulkDataRepository();
+  // @windy-module system.bulk-data end
   const taskDefinitions = [
     ...createPlatformTaskDefinitions(input.foundation.features, {
+      // @windy-module system.bulk-data begin
       bulkDataDispatch: () => services.bulkDataService.processNext(),
       bulkDataCleanup: () => services.bulkDataService.cleanupExpired(),
+      // @windy-module system.bulk-data end
+      // @windy-module system.storage begin
       storageCleanup: async () => {
         const now = new Date();
         const referencedRefs = await collectActiveBlobRefs(
-          [services.durable.facts, bulkRepository],
+          [
+            services.durable.facts,
+            // @windy-module system.bulk-data begin
+            bulkRepository,
+            // @windy-module system.bulk-data end
+          ],
           now,
         );
         return {
           ...(await input.storage.uploads.cleanupExpired(100, referencedRefs)),
         };
       },
+      // @windy-module system.storage end
+      // @windy-module system.workflow begin
       workflowTimeoutDispatch: () => services.workflowTimeout.runNext(),
+      // @windy-module system.workflow end
+      // @windy-module system.data-governance begin
       governedExportDispatch: async () => {
         const result = await governedExportDispatch.runNext?.();
         return { claimed: Boolean(result && result.status !== "idle") };
       },
+      // @windy-module system.data-governance end
+      // @windy-module system.notification begin
       notificationDispatch: async () => {
         const scheduled = await notificationService.dispatchScheduled();
         const delivery = await notificationDeliveryWorker.runNext();
@@ -150,29 +200,36 @@ export async function createApplicationServices(
           delivery,
         };
       },
+      // @windy-module system.notification end
     }),
     ...input.moduleTasks,
   ];
   const services = createLegacyServiceRuntime({
     db: persistence?.db,
+    // @windy-module system.bulk-data begin
     bulkRepository,
     bulkHandlers: [
       new DictionaryBulkResourceHandler(input.systemRepositories.dictionaries),
     ],
     bulkLimits: { retentionDays: input.bulkRetentionDays },
     blobStore: input.storage.blobStore,
+    // @windy-module system.bulk-data end
     schedulerRepository: persistence
       ? new DrizzleSchedulerRepository(persistence.db)
       : new InMemorySchedulerRepository(),
     taskDefinitions,
     runtime: input.runtime,
+    // @windy-module system.workflow begin
     workflow,
+    // @windy-module system.workflow end
     installModuleDurableHandlers: input.installModuleDurableHandlers,
     durableContextualize: createModuleDurableContextualizer({
       hosts: input.moduleHosts,
       runtime: input.runtime,
       features: input.foundation.features,
+      // @windy-module system.storage begin
       storage: input.storage,
+      // @windy-module system.storage end
       // @windy-module system.agent begin
       backgroundAi: input.backgroundAi,
       // @windy-module system.agent end
@@ -180,6 +237,7 @@ export async function createApplicationServices(
         resolveCurrentSystemActor(input.systemRepositories, actorId),
     }),
   });
+  // @windy-module system.data-governance begin
   const governedExportRequests = persistence
     ? new DrizzleGovernedExportRepository(persistence.db)
     : new InMemoryGovernedExportRepository();
@@ -199,20 +257,21 @@ export async function createApplicationServices(
         resolveCurrentSystemActor(input.systemRepositories, actorId),
       );
     });
-  const moduleGovernedExportRenderers = input.moduleHosts.governedResources.flatMap(
-    ({ moduleName, registration }) => {
-      const policy = input.moduleHosts
-        .manifestOf(moduleName)
-        .dataPolicies?.find(({ key }) => key === registration.policyKey);
-      if (!policy) {
-        throw new Error(`模块数据治理策略不存在：${registration.policyKey}`);
-      }
-      return (registration.export?.renderers ?? []).map((renderer) => ({
-        resourceType: policy.resourceType,
-        renderer,
-      }));
-    },
-  );
+  const moduleGovernedExportRenderers =
+    input.moduleHosts.governedResources.flatMap(
+      ({ moduleName, registration }) => {
+        const policy = input.moduleHosts
+          .manifestOf(moduleName)
+          .dataPolicies?.find(({ key }) => key === registration.policyKey);
+        if (!policy) {
+          throw new Error(`模块数据治理策略不存在：${registration.policyKey}`);
+        }
+        return (registration.export?.renderers ?? []).map((renderer) => ({
+          resourceType: policy.resourceType,
+          renderer,
+        }));
+      },
+    );
   const governedExports = new GovernedExportJobRuntime(
     governedExportRequests,
     services.durable.service,
@@ -251,17 +310,26 @@ export async function createApplicationServices(
     { approvalRequired: true, retentionSeconds: 24 * 60 * 60 },
   );
   governedExportDispatch.runNext = () => governedExports.runNext();
+  // @windy-module system.data-governance end
+  // @windy-module system.workflow begin
   deferredTimeout.attach(services.workflowTimeout);
   await services.workflowTimeout.reconcile();
+  // @windy-module system.workflow end
   await services.scheduler.initialize();
   return {
     ...services,
+    // @windy-module system.notification begin
     notifications,
     notificationService,
     notificationDeliveryWorker,
+    // @windy-module system.notification end
+    // @windy-module system.workflow begin
     workflow,
+    // @windy-module system.workflow end
+    // @windy-module system.data-governance begin
     governedExports,
     governedExportService,
     governedExportRequests,
+    // @windy-module system.data-governance end
   };
 }

package/template/apps/server/src/guards.ts

@@ -29,6 +29,22 @@ export interface RequestActor {
   scopeContext?: ScopeContext;
 }
 
+// @windy-module system.agent begin
+const moduleUserProjection = new WeakMap<RequestActor, string>();
+
+export function bindModuleUserProjection(
+  actor: RequestActor,
+  userId: string,
+): RequestActor {
+  moduleUserProjection.set(actor, userId);
+  return actor;
+}
+
+export function projectedModuleUserId(actor: RequestActor): string | undefined {
+  return moduleUserProjection.get(actor);
+}
+// @windy-module system.agent end
+
 export interface RequestGuardContext {
   requestId: string;
   actor: RequestActor;

package/template/apps/server/src/index.ts

@@ -1,5 +1,3 @@
-import { loadPlatformConfig } from "@southwind-ai/config";
-import pino from "pino";
 import { registerAdminBootstrapRoute } from "./admin/routes.js";
 import { registerSessionContextRoute } from "./session/routes.js";
 import { registerFoundationRoute } from "./foundation-route.js";
@@ -19,9 +17,9 @@ import { readPositiveInt } from "./runtime-config.js";
 // @windy-module system.agent begin
 import { registerAgentPlatformRuntime } from "./agent/runtime-bootstrap.js";
 import { DeferredAgentBackgroundOperationPortFactory } from "./agent/background-operation-port.js";
+import { resolveCurrentSystemActor } from "./system/actor.js";
 // @windy-module system.agent end
 import { createAuthRuntime } from "./auth/runtime.js";
-import { createServerPersistence } from "./persistence.js";
 // @windy-module system.license begin
 import { registerPlatformLicenseRoutes } from "./license/routes.js";
 import {
@@ -70,16 +68,8 @@ import {
   listenPlatformServer,
   logServerStartup,
 } from "./platform-http-runtime.js";
-
-const logger = pino({ name: "windy-server" });
-const platformConfig = loadPlatformConfig();
-const persistence = createServerPersistence(
-  process.env,
-  (status) => {
-    logger.error({ audit: status }, "审计持久化进入降级状态");
-  },
-  platformConfig,
-);
+import { createPlatformBootstrap } from "./platform-bootstrap.js";
+const { logger, persistence, platformConfig } = createPlatformBootstrap();
 // @windy-module system.audit begin
 await persistence?.auditWriter.recover();
 // @windy-module system.audit end
@@ -105,6 +95,10 @@ const useInstalledLicense =
 // @windy-module system.license end
 const runtime = createServerRuntime(process.env, {
   actorResolver: persistence?.actorResolver,
+  // @windy-module system.agent begin
+  adkDebugActorResolver: (actorId) =>
+    resolveCurrentSystemActor(systemRepositories, actorId),
+  // @windy-module system.agent end
   // @windy-module system.license begin
   licenseResolver: useInstalledLicense
     ? platformLicenseRuntime
@@ -145,7 +139,9 @@ const storageRuntime = createStorageRuntime(
   persistence?.db,
   moduleHosts.uploadPolicies,
 );
+// @windy-module system.configuration begin
 configurationRuntime.bindStorage(storageRuntime.uploads);
+// @windy-module system.configuration end
 // @windy-module system.storage end
 // @windy-module system.settings begin
 const platformSettings = createPlatformSettingsRuntime(
@@ -173,23 +169,37 @@ const moduleTaskDefinitions = createModuleTaskDefinitions(
 const moduleBackgroundAi = new DeferredAgentBackgroundOperationPortFactory();
 // @windy-module system.agent end
 const {
+  // @windy-module system.bulk-data begin
   bulkDataService,
+  // @windy-module system.bulk-data end
   scheduler,
   taskDefinitions: scheduledTaskDefinitions,
+  // @windy-module system.notification begin
   notifications: notificationRepository,
   notificationService,
+  // @windy-module system.notification end
+  // @windy-module system.workflow begin
   workflow: workflowService,
+  // @windy-module system.workflow end
+  // @windy-module system.data-governance begin
   governedExportService,
+  // @windy-module system.data-governance end
   durable: durableJobRuntime,
 } = await createApplicationServices({
   persistence,
   systemRepositories,
   foundation: foundationSnapshot,
   runtime,
+  // @windy-module system.storage begin
   storage: storageRuntime,
+  // @windy-module system.storage end
   moduleTasks: moduleTaskDefinitions,
+  // @windy-module system.bulk-data begin
   bulkRetentionDays: readPositiveInt(process.env.BULK_DATA_RETENTION_DAYS, 7),
+  // @windy-module system.bulk-data end
+  // @windy-module system.notification begin
   mailConfig: platformConfig.mail,
+  // @windy-module system.notification end
   moduleHosts,
   installModuleDurableHandlers: moduleHosts.installDurableHandlers,
   // @windy-module system.agent begin
@@ -214,11 +224,9 @@ const app = await createPlatformServerApp({
   logger,
   observability,
 });
-
 // @windy-module system.license begin
 registerPlatformLicenseRoutes(app, platformLicenseRuntime);
 // @windy-module system.license end
-
 // @windy-module system.settings begin
 platformSettings.register(app, runtime, features);
 // @windy-module system.settings end
@@ -254,16 +262,13 @@ registerStorageRoutes(
 // @windy-module system.search begin
 searchHost.register(app);
 // @windy-module system.search end
-
 registerAdminBootstrapRoute(app, runtime, {
   modules: foundationModules,
   snapshot: foundationSnapshot,
   loadMenus: () => systemRepositories.menuRegistry.tree(),
 });
 registerSessionContextRoute(app, runtime, features);
-
 registerFoundationRoute(app, runtime, foundationSnapshot, systemRepositories);
-
 // @windy-module system.data-governance begin
 registerGovernedUserExportRoutes(app, governedExportService, runtime, features);
 // @windy-module system.data-governance end
@@ -323,7 +328,6 @@ installModuleHttpRuntime(moduleHosts, app, {
   governedExportService,
   // @windy-module system.data-governance end
 });
-
 validateInstalledRuntime({
   modules: foundationModules,
   routes: app.routes,
@@ -338,7 +342,6 @@ validateInstalledRuntime({
   // @windy-module system.search end
   hosts: moduleHosts,
 });
-
 const port = listenPlatformServer(app);
 // @windy-module system.scheduler begin
 schedulerWorker.start();

package/template/apps/server/src/jobs/legacy-adapter.integration.test.ts

@@ -34,7 +34,6 @@ describePostgres("PostgreSQL legacy durable adapter", () => {
     });
     await pool.query(`
       truncate table
-        governed_export_requests,
         bulk_data_artifacts,
         bulk_data_jobs,
         scheduled_task_runs,

package/template/apps/server/src/jobs/legacy-adapter.test.ts

@@ -5,9 +5,11 @@ import { createServerRuntime } from "../runtime.js";
 import { InMemorySchedulerRepository } from "../scheduler/repository.js";
 import { SchedulerService } from "../scheduler/service.js";
 import type { SchedulerClock } from "../scheduler/types.js";
+// @windy-module system.bulk-data begin
 import { InMemoryBulkDataRepository } from "../bulk-data/repository.js";
 import { BulkDataService } from "../bulk-data/service.js";
 import type { BulkResourceHandler } from "../bulk-data/resource-handler.js";
+// @windy-module system.bulk-data end
 import { InMemoryDurableExecutionRepository } from "./in-memory-execution.js";
 import {
   DeferredLegacyExecutor,
@@ -17,6 +19,7 @@ import { DurableJobService } from "./service.js";
 import { DurableJobWorker } from "./worker.js";
 
 describe("legacy durable adapters", () => {
+  // @windy-module system.bulk-data begin
   test("running Bulk 在进程重启后回收 lease，重复启动与完成不重复执行", async () => {
     let now = new Date("2026-07-16T00:00:00.000Z");
     const legacy = new InMemoryBulkDataRepository();
@@ -107,6 +110,7 @@ describe("legacy durable adapters", () => {
       processedRows: 1,
     });
   });
+  // @windy-module system.bulk-data end
 
   test("Scheduler 采用未关联 running 记录且重放已完成记录为空操作", async () => {
     const now = new Date("2026-07-16T00:00:00.000Z");
@@ -179,6 +183,7 @@ describe("legacy durable adapters", () => {
   });
 });
 
+// @windy-module system.bulk-data begin
 function testBulkHandler(): BulkResourceHandler {
   return {
     scopeMode: "platform",
@@ -197,3 +202,4 @@ function actor(id: string) {
     permissionKeys: [],
   };
 }
+// @windy-module system.bulk-data end

package/template/apps/server/src/jobs/legacy-service-runtime.ts

@@ -1,10 +1,14 @@
 import { DurableHandlerRegistry } from "@southwind-ai/jobs";
+// @windy-module system.bulk-data begin
 import type { BlobStore } from "@southwind-ai/storage";
+// @windy-module system.bulk-data end
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+// @windy-module system.bulk-data begin
 import { BulkDataService } from "../bulk-data/service.js";
 import type { BulkDataLimits } from "../bulk-data/input-validation.js";
 import type { BulkDataRepository } from "../bulk-data/repository.js";
 import type { BulkResourceHandler } from "../bulk-data/resource-handler.js";
+// @windy-module system.bulk-data end
 import type { createServerRuntime } from "../runtime.js";
 import type { SchedulerRepository } from "../scheduler/repository.js";
 import { SchedulerService } from "../scheduler/service.js";
@@ -18,19 +22,25 @@ import {
 } from "./legacy-adapter.js";
 import { DurableJobService } from "./service.js";
 import { DurableJobWorker, type DurableWorkerOptions } from "./worker.js";
+// @windy-module system.workflow begin
 import type { WorkflowService } from "../workflow/service.js";
 import { WorkflowTimeoutRuntime } from "../workflow/timeout-runtime.js";
+// @windy-module system.workflow end
 
 interface LegacyServiceRuntimeInput {
   db?: NodePgDatabase;
+  // @windy-module system.bulk-data begin
   bulkRepository: BulkDataRepository;
   bulkHandlers: BulkResourceHandler[];
   bulkLimits: Partial<BulkDataLimits>;
   blobStore: BlobStore;
+  // @windy-module system.bulk-data end
   schedulerRepository: SchedulerRepository;
   taskDefinitions: ScheduledTaskDefinition[];
   runtime: ReturnType<typeof createServerRuntime>;
+  // @windy-module system.workflow begin
   workflow: WorkflowService;
+  // @windy-module system.workflow end
   installModuleDurableHandlers?: (registry: DurableHandlerRegistry) => void;
   durableContextualize?: DurableWorkerOptions["contextualize"];
 }
@@ -47,13 +57,16 @@ export function createLegacyServiceRuntime(input: LegacyServiceRuntimeInput) {
   const worker = new DurableJobWorker(execution, registry, {
     contextualize: input.durableContextualize,
   });
+  // @windy-module system.workflow begin
   const workflowTimeout = new WorkflowTimeoutRuntime(
     service,
     worker,
     registry,
     input.workflow,
   );
+  // @windy-module system.workflow end
 
+  // @windy-module system.bulk-data begin
   const bulkExecutor = new DeferredLegacyExecutor();
   const bulkDataService = new BulkDataService(
     input.bulkRepository,
@@ -71,6 +84,7 @@ export function createLegacyServiceRuntime(input: LegacyServiceRuntimeInput) {
   bulkExecutor.attach(({ legacyId, generation }) =>
     bulkDataService.resumeDurable(legacyId, generation),
   );
+  // @windy-module system.bulk-data end
 
   const schedulerExecutor = new DeferredLegacyExecutor();
   const taskDefinitions = input.taskDefinitions;
@@ -91,10 +105,14 @@ export function createLegacyServiceRuntime(input: LegacyServiceRuntimeInput) {
   );
 
   return {
+    // @windy-module system.bulk-data begin
     bulkDataService,
+    // @windy-module system.bulk-data end
     scheduler,
     taskDefinitions,
+    // @windy-module system.workflow begin
     workflowTimeout,
+    // @windy-module system.workflow end
     durable: { facts, service, registry, worker },
   };
 }

package/template/apps/server/src/module-host/durable-context-unavailable.test.ts

@@ -0,0 +1,84 @@
+import { describe, expect, test } from "bun:test";
+import type { DurableHandlerContext } from "@southwind-ai/jobs";
+import { featureKey } from "@southwind-ai/shared";
+import { buildActorScopeContexts } from "../data-access/context.js";
+import { captureAuthorizationScope } from "../data-access/scope-snapshot.js";
+import type { RequestActor } from "../guards.js";
+import { createServerRuntime } from "../runtime.js";
+import { createModuleDurableContextualizer } from "./durable-context.js";
+
+const feature = {
+  key: featureKey("evidence.catalog"),
+  label: "电子物证",
+  module: "evidence",
+  visible: "visible" as const,
+  enabled: true,
+  stage: "stable" as const,
+};
+
+describe("模块 Durable Handler 可选端口", () => {
+  test("未挂载 Storage 时仍重建 Actor，并对文件读取 fail-closed", async () => {
+    const actor = currentActor();
+    const contextualize = createModuleDurableContextualizer({
+      hosts: {} as never,
+      runtime: createServerRuntime(
+        { NODE_ENV: "test" },
+        { featureCatalog: [feature] },
+      ),
+      features: [feature],
+      resolveActor: async () => actor,
+    });
+    const context = await contextualize({
+      claim: { job: job(actor) },
+      moduleName: "evidence",
+      context: baseContext(),
+    });
+
+    expect(context).toMatchObject({ actor: { id: "user-reader" } });
+    await expect(
+      (
+        context as typeof context & {
+          storage: { openResourceFile(input: never): Promise<unknown> };
+        }
+      ).storage.openResourceFile({} as never),
+    ).rejects.toThrow("模块 evidence 的存储 Port 未挂载");
+  });
+});
+
+function currentActor(): RequestActor {
+  return {
+    id: "user-reader",
+    type: "user",
+    name: "物证读取者",
+    roleCodes: ["investigator"],
+    permissionKeys: ["evidence.read"],
+    ...buildActorScopeContexts("user-reader", "dept-case", [
+      {
+        id: "role-investigator",
+        code: "investigator",
+        dataScope: "all",
+        departmentIds: [],
+      },
+    ]),
+  };
+}
+
+function job(actor: RequestActor) {
+  return {
+    id: "job-evidence",
+    requestedBy: actor.id,
+    authorizationScope: captureAuthorizationScope(actor.scopeContext).snapshot,
+  };
+}
+
+function baseContext(): DurableHandlerContext {
+  return {
+    jobId: "job-evidence",
+    stageKey: "main",
+    attemptNumber: 1,
+    signal: new AbortController().signal,
+    heartbeat: async () => undefined,
+    progress: async () => undefined,
+    publishArtifact: async () => undefined,
+  };
+}