create-windy 0.3.2 → 0.3.5

package/template/packages/database/drizzle/meta/_journal.json

@@ -274,6 +274,34 @@
       "when": 1785013875842,
       "tag": "0038_uneven_wasp",
       "breakpoints": true
+    },
+    {
+      "idx": 39,
+      "version": "7",
+      "when": 1785093639918,
+      "tag": "0039_early_ezekiel_stane",
+      "breakpoints": true
+    },
+    {
+      "idx": 40,
+      "version": "7",
+      "when": 1785100685405,
+      "tag": "0040_colossal_baron_strucker",
+      "breakpoints": true
+    },
+    {
+      "idx": 41,
+      "version": "7",
+      "when": 1785102272102,
+      "tag": "0041_yummy_prowler",
+      "breakpoints": true
+    },
+    {
+      "idx": 42,
+      "version": "7",
+      "when": 1785151819729,
+      "tag": "0042_puzzling_rumiko_fujikawa",
+      "breakpoints": true
     }
   ]
 }

package/template/packages/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/database",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {
@@ -15,7 +15,7 @@
     "typecheck": "tsc --noEmit --project tsconfig.json"
   },
   "dependencies": {
-    "@southwind-ai/shared": "workspace:*",
+    "@southwind-ai/shared": "workspace:^",
     "drizzle-orm": "^0.45.2"
   },
   "exports": {

package/template/packages/database/src/agent-runtime-schema.test.ts

@@ -0,0 +1,54 @@
+import { expect, test } from "bun:test";
+import { getTableConfig } from "drizzle-orm/pg-core";
+import {
+  agentEvaluationResults,
+  agentOperationReleases,
+  agentRunBindings,
+  agentRuntimeEvents,
+  agentRuntimeRuns,
+} from "./schema/index.js";
+
+test("Agent Run 固定不可变 Release 并持久化恢复租约", async () => {
+  expect(getTableConfig(agentOperationReleases).name).toBe(
+    "agent_operation_releases",
+  );
+  expect(agentOperationReleases.snapshotJson.notNull).toBe(true);
+  expect(getTableConfig(agentRuntimeRuns).name).toBe("agent_runtime_runs");
+  expect(agentRuntimeRuns.invocationCipher.notNull).toBe(false);
+  expect(agentRuntimeRuns.releaseId.notNull).toBe(true);
+  expect(agentRuntimeRuns.traceId.notNull).toBe(true);
+  expect(
+    getTableConfig(agentRuntimeRuns).indexes.some(
+      (index) =>
+        index.config.name === "uk_agent_runtime_runs_idempotency" &&
+        index.config.unique,
+    ),
+  ).toBe(true);
+  expect(getTableConfig(agentRuntimeEvents).name).toBe("agent_runtime_events");
+  expect(agentRuntimeEvents.eventCipher.notNull).toBe(true);
+  expect(getTableConfig(agentEvaluationResults).name).toBe(
+    "agent_evaluation_results",
+  );
+  expect(getTableConfig(agentRunBindings).name).toBe("agent_run_bindings");
+  expect(agentRunBindings.scopeSnapshot.notNull).toBe(true);
+  expect(agentRunBindings.authorizationSnapshot.notNull).toBe(true);
+
+  const migration = await Bun.file(
+    new URL("../drizzle/0040_colossal_baron_strucker.sql", import.meta.url),
+  ).text();
+  expect(migration).toContain('CREATE TABLE "agent_operation_releases"');
+  expect(migration).toContain('CREATE TABLE "agent_runtime_runs"');
+  expect(migration).toContain(
+    'CREATE UNIQUE INDEX "uk_agent_evaluation_release_set"',
+  );
+  expect(migration).toContain(
+    'CREATE TRIGGER "trg_agent_operation_releases_immutable"',
+  );
+  const bindingMigration = await Bun.file(
+    new URL("../drizzle/0041_yummy_prowler.sql", import.meta.url),
+  ).text();
+  expect(bindingMigration).toContain('CREATE TABLE "agent_run_bindings"');
+  expect(bindingMigration).toContain(
+    'CREATE UNIQUE INDEX "uk_agent_run_bindings_token"',
+  );
+});

package/template/packages/database/src/schema/agent-runtime.ts

@@ -0,0 +1,149 @@
+import { sql } from "drizzle-orm";
+import {
+  check,
+  doublePrecision,
+  index,
+  integer,
+  jsonb,
+  pgTable,
+  primaryKey,
+  text,
+  uniqueIndex,
+  varchar,
+} from "drizzle-orm/pg-core";
+import type {
+  AgentRunAuthorizationSnapshot,
+  AuthorizationScopeSnapshot,
+} from "@southwind-ai/shared";
+
+export const agentOperationReleases = pgTable(
+  "agent_operation_releases",
+  {
+    releaseId: varchar("release_id", { length: 80 }).primaryKey(),
+    operationKey: varchar("operation_key", { length: 200 }).notNull(),
+    snapshotJson: jsonb("snapshot_json")
+      .$type<Record<string, unknown>>()
+      .notNull(),
+    createdAt: doublePrecision("created_at").notNull(),
+  },
+  (table) => [
+    index("idx_agent_releases_operation").on(
+      table.operationKey,
+      table.createdAt,
+    ),
+  ],
+);
+
+export const agentRuntimeRuns = pgTable(
+  "agent_runtime_runs",
+  {
+    runId: varchar("run_id", { length: 80 }).primaryKey(),
+    operationKey: varchar("operation_key", { length: 200 }).notNull(),
+    idempotencyKey: varchar("idempotency_key", { length: 200 }).notNull(),
+    fingerprint: varchar("fingerprint", { length: 64 }).notNull(),
+    status: varchar("status", { length: 32 }).notNull(),
+    invocationCipher: text("invocation_cipher"),
+    outputCipher: text("output_cipher"),
+    releaseId: varchar("release_id", { length: 80 })
+      .notNull()
+      .references(() => agentOperationReleases.releaseId, {
+        onDelete: "restrict",
+      }),
+    releaseJson: jsonb("release_json")
+      .$type<Record<string, unknown>>()
+      .notNull(),
+    traceId: varchar("trace_id", { length: 160 }).notNull(),
+    leaseOwner: varchar("lease_owner", { length: 80 }),
+    leaseUntil: doublePrecision("lease_until").notNull().default(0),
+    createdAt: doublePrecision("created_at").notNull(),
+    updatedAt: doublePrecision("updated_at").notNull(),
+    expiresAt: doublePrecision("expires_at").notNull(),
+  },
+  (table) => [
+    uniqueIndex("uk_agent_runtime_runs_idempotency").on(table.idempotencyKey),
+    index("idx_agent_runtime_runs_recovery").on(table.status, table.leaseUntil),
+    index("idx_agent_runtime_runs_release").on(
+      table.releaseId,
+      table.createdAt,
+    ),
+    index("idx_agent_runtime_runs_expiry").on(table.status, table.expiresAt),
+    check(
+      "ck_agent_runtime_runs_status",
+      sql`${table.status} in ('accepted', 'running', 'awaiting-approval', 'completed', 'failed', 'cancelled')`,
+    ),
+  ],
+);
+
+export const agentRuntimeEvents = pgTable(
+  "agent_runtime_events",
+  {
+    runId: varchar("run_id", { length: 80 })
+      .notNull()
+      .references(() => agentRuntimeRuns.runId, { onDelete: "cascade" }),
+    sequence: integer("sequence").notNull(),
+    eventCipher: text("event_cipher").notNull(),
+  },
+  (table) => [
+    primaryKey({ columns: [table.runId, table.sequence] }),
+    check("ck_agent_runtime_events_sequence", sql`${table.sequence} > 0`),
+  ],
+);
+
+export const agentEvaluationResults = pgTable(
+  "agent_evaluation_results",
+  {
+    evaluationId: varchar("evaluation_id", { length: 80 }).primaryKey(),
+    releaseId: varchar("release_id", { length: 80 })
+      .notNull()
+      .references(() => agentOperationReleases.releaseId, {
+        onDelete: "restrict",
+      }),
+    evaluationSetKey: varchar("evaluation_set_key", {
+      length: 160,
+    }).notNull(),
+    evaluationSetVersion: varchar("evaluation_set_version", {
+      length: 80,
+    }).notNull(),
+    metricsJson: jsonb("metrics_json")
+      .$type<Record<string, number>>()
+      .notNull(),
+    createdAt: doublePrecision("created_at").notNull(),
+  },
+  (table) => [
+    uniqueIndex("uk_agent_evaluation_release_set").on(
+      table.releaseId,
+      table.evaluationSetKey,
+      table.evaluationSetVersion,
+    ),
+  ],
+);
+
+export const agentRunBindings = pgTable(
+  "agent_run_bindings",
+  {
+    bindingId: varchar("binding_id", { length: 80 }).primaryKey(),
+    runId: varchar("run_id", { length: 80 }),
+    operationKey: varchar("operation_key", { length: 200 }).notNull(),
+    actorId: varchar("actor_id", { length: 64 }).notNull(),
+    idempotencyHash: varchar("idempotency_hash", { length: 64 }).notNull(),
+    tokenHash: varchar("token_hash", { length: 64 }).notNull(),
+    scopeHash: varchar("scope_hash", { length: 64 }).notNull(),
+    scopeSnapshot: jsonb("scope_snapshot")
+      .$type<AuthorizationScopeSnapshot>()
+      .notNull(),
+    authorizationSnapshot: jsonb("authorization_snapshot")
+      .$type<AgentRunAuthorizationSnapshot>()
+      .notNull(),
+    releaseId: varchar("release_id", { length: 80 }).notNull(),
+    createdAt: doublePrecision("created_at").notNull(),
+    boundAt: doublePrecision("bound_at"),
+    expiresAt: doublePrecision("expires_at").notNull(),
+  },
+  (table) => [
+    uniqueIndex("uk_agent_run_bindings_run").on(table.runId),
+    uniqueIndex("uk_agent_run_bindings_idempotency").on(table.idempotencyHash),
+    uniqueIndex("uk_agent_run_bindings_token").on(table.tokenHash),
+    index("idx_agent_run_bindings_actor").on(table.actorId, table.expiresAt),
+    index("idx_agent_run_bindings_expiry").on(table.expiresAt),
+  ],
+);

package/template/packages/database/src/schema/common.ts

@@ -1,3 +1,4 @@
+import type { AuthorizationScopeSnapshot } from "@southwind-ai/shared";
 import { timestamp, varchar } from "drizzle-orm/pg-core";
 
 export const idColumn = (name = "id") => varchar(name, { length: 64 });
@@ -17,17 +18,4 @@ export const auditColumns = {
   deletedBy: varchar("deleted_by", { length: 64 }),
 };
 
-export interface GovernedExportScopeSnapshot {
-  tenantId: "single-tenant";
-  actorId: string;
-  departmentId?: string;
-  grants: Array<
-    | { scope: "all" | "tenant" | "self" }
-    | {
-        scope: "department" | "department-and-children";
-        departmentId?: string;
-      }
-    | { scope: "custom"; dimension: string; values: string[] }
-  >;
-  roleIds: string[];
-}
+export type GovernedExportScopeSnapshot = AuthorizationScopeSnapshot;

package/template/packages/database/src/schema/durable-jobs.ts

@@ -1,4 +1,5 @@
 import { sql } from "drizzle-orm";
+import type { AuthorizationScopeSnapshot } from "@southwind-ai/shared";
 import {
   boolean,
   check,
@@ -23,6 +24,9 @@ export const durableJobs = pgTable(
     payload: jsonb("payload").$type<Record<string, unknown>>().notNull(),
     priority: integer("priority").notNull().default(0),
     requestedBy: varchar("requested_by", { length: 64 }).notNull(),
+    authorizationScope: jsonb(
+      "authorization_scope",
+    ).$type<AuthorizationScopeSnapshot>(),
     maxAttempts: integer("max_attempts").notNull().default(3),
     timeoutSeconds: integer("timeout_seconds").notNull().default(900),
     availableAt: timestamp("available_at", { withTimezone: true }).notNull(),
@@ -201,6 +205,7 @@ export const durableJobArtifacts = pgTable(
     byteSize: integer("byte_size").notNull(),
     sha256: varchar("sha256", { length: 64 }).notNull(),
     ownerId: varchar("owner_id", { length: 64 }).notNull(),
+    metadata: jsonb("metadata").$type<Record<string, unknown>>(),
     expiresAt: timestamp("expires_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true })
       .notNull()

package/template/packages/database/src/schema/governed-exports.ts

@@ -1,5 +1,5 @@
 import { sql } from "drizzle-orm";
-import type { LifecycleStatus } from "@southwind-ai/shared";
+import type { JsonValue } from "@southwind-ai/shared";
 import {
   boolean,
   check,
@@ -14,10 +14,19 @@ import type { GovernedExportScopeSnapshot } from "./common.js";
 import { durableJobs } from "./durable-jobs.js";
 
 export interface GovernedExportQuerySnapshot {
-  q?: string;
-  status?: LifecycleStatus;
-  includeDeleted: boolean;
-  sort?: Array<{ field: string; order: "asc" | "desc" }>;
+  readonly [key: string]: JsonValue | undefined;
+}
+
+export interface GovernedExportRendererSnapshot {
+  formatKey: string;
+  templateKey: string;
+  templateVersion: string;
+  inputSchemaKey: string;
+  contentType: string;
+  filenameExtension: string;
+  maxRecords: number;
+  maxOutputBytes: number;
+  timeoutSeconds: number;
 }
 
 export const governedExportRequests = pgTable(
@@ -42,6 +51,9 @@ export const governedExportRequests = pgTable(
     querySnapshot: jsonb("query_snapshot")
       .$type<GovernedExportQuerySnapshot>()
       .notNull(),
+    renderer: jsonb("renderer")
+      .$type<GovernedExportRendererSnapshot>()
+      .notNull(),
     status: varchar("status", { length: 32 }).notNull(),
     approvalRequired: boolean("approval_required").notNull(),
     approvalId: varchar("approval_id", { length: 64 }),

package/template/packages/database/src/schema/index.ts

@@ -28,3 +28,6 @@ export * from "./scheduler.js";
 // @windy-module system.workflow begin
 export * from "./workflow.js";
 // @windy-module system.workflow end
+// @windy-module system.agent begin
+export * from "./agent-runtime.js";
+// @windy-module system.agent end

package/template/packages/database/src/schema-durable-recovery.test.ts

@@ -0,0 +1,31 @@
+// @windy-module system.scheduler begin
+import { describe, expect, test } from "bun:test";
+import { getTableConfig } from "drizzle-orm/pg-core";
+import { durableJobRecoveries } from "./schema/index.js";
+
+describe("durable job recovery schema", () => {
+  test("人工恢复事实按任务与外部请求幂等", async () => {
+    expect(getTableConfig(durableJobRecoveries).name).toBe(
+      "durable_job_recoveries",
+    );
+    expect(durableJobRecoveries.reason.notNull).toBe(true);
+    expect(getTableConfig(durableJobRecoveries).foreignKeys[0]?.onDelete).toBe(
+      "restrict",
+    );
+    expect(
+      getTableConfig(durableJobRecoveries).indexes.some(
+        (index) =>
+          index.config.name === "uk_durable_job_recoveries_idempotency" &&
+          index.config.unique,
+      ),
+    ).toBe(true);
+    const migration = await Bun.file(
+      new URL("../drizzle/0024_misty_lizard.sql", import.meta.url),
+    ).text();
+    expect(migration).toContain('CREATE TABLE "durable_job_recoveries"');
+    expect(migration).toContain(
+      'CREATE UNIQUE INDEX "uk_durable_job_recoveries_idempotency"',
+    );
+  });
+});
+// @windy-module system.scheduler end

package/template/packages/database/src/schema-governed-exports.test.ts

@@ -1,6 +1,9 @@
 import { describe, expect, test } from "bun:test";
 import { getTableConfig } from "drizzle-orm/pg-core";
-import { governedExportRequests } from "./schema/index.js";
+import {
+  durableJobArtifacts,
+  governedExportRequests,
+} from "./schema/index.js";
 
 describe("governed export schema", () => {
   test("申请以 owner/resource/idempotency 唯一并受 Durable Job 外键约束", async () => {
@@ -9,6 +12,7 @@ describe("governed export schema", () => {
     expect(config.name).toBe("governed_export_requests");
     expect(governedExportRequests.scopeSnapshot.notNull).toBe(true);
     expect(governedExportRequests.requestFingerprint.notNull).toBe(true);
+    expect(governedExportRequests.renderer.notNull).toBe(true);
     expect(governedExportRequests.durableJobId.notNull).toBe(false);
     expect(config.foreignKeys[0]?.onDelete).toBe("restrict");
     expect(
@@ -45,5 +49,21 @@ describe("governed export schema", () => {
     expect(constraintMigration).toContain(
       'VALIDATE CONSTRAINT "ck_governed_exports_approval_job_state"',
     );
+    const rendererMigration = await Bun.file(
+      new URL(
+        "../drizzle/0042_puzzling_rumiko_fujikawa.sql",
+        import.meta.url,
+      ),
+    ).text();
+    expect(rendererMigration).toContain(
+      'UPDATE "governed_export_requests"',
+    );
+    expect(rendererMigration).toContain(
+      'ALTER COLUMN "renderer" SET NOT NULL',
+    );
+    expect(rendererMigration).toContain(
+      'UPDATE "durable_job_artifacts" AS artifact',
+    );
+    expect(durableJobArtifacts.metadata.notNull).toBe(false);
   });
 });

package/template/packages/database/src/schema.test.ts

@@ -11,7 +11,6 @@ import {
   durableJobFailures,
   durableJobLeases,
   durableJobProgress,
-  durableJobRecoveries,
   durableJobStages,
   durableJobs,
   scheduledTaskRuns,
@@ -263,6 +262,7 @@ describe("database schema", () => {
   test("durable job 七类事实具备幂等、租约和不可变历史约束", async () => {
     expect(getTableConfig(durableJobs).name).toBe("durable_jobs");
     expect(durableJobs.payload.notNull).toBe(true);
+    expect(durableJobs.authorizationScope).toBeDefined();
     expect(
       getTableConfig(durableJobs).indexes.some(
         (index) =>
@@ -315,30 +315,13 @@ describe("database schema", () => {
     expect(migration).toContain(
       'CREATE UNIQUE INDEX "uk_durable_job_leases_active_stage"',
     );
-  });
-
-  test("durable job 人工恢复事实按任务与外部请求幂等", async () => {
-    expect(getTableConfig(durableJobRecoveries).name).toBe(
-      "durable_job_recoveries",
-    );
-    expect(durableJobRecoveries.reason.notNull).toBe(true);
-    expect(getTableConfig(durableJobRecoveries).foreignKeys[0]?.onDelete).toBe(
-      "restrict",
-    );
-    expect(
-      getTableConfig(durableJobRecoveries).indexes.some(
-        (index) =>
-          index.config.name === "uk_durable_job_recoveries_idempotency" &&
-          index.config.unique,
-      ),
-    ).toBe(true);
-    const migration = await Bun.file(
-      new URL("../drizzle/0024_misty_lizard.sql", import.meta.url),
+    const authorizationMigration = await Bun.file(
+      new URL("../drizzle/0039_early_ezekiel_stane.sql", import.meta.url),
     ).text();
-    expect(migration).toContain('CREATE TABLE "durable_job_recoveries"');
-    expect(migration).toContain(
-      'CREATE UNIQUE INDEX "uk_durable_job_recoveries_idempotency"',
+    expect(authorizationMigration).toContain(
+      'ALTER TABLE "durable_jobs" ADD COLUMN "authorization_scope" jsonb',
     );
   });
+
   // @windy-module system.scheduler end
 });

package/template/packages/jobs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/jobs",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {
@@ -16,7 +16,8 @@
     "typecheck": "tsc --noEmit --project tsconfig.json"
   },
   "dependencies": {
-    "@southwind-ai/storage": "workspace:*"
+    "@southwind-ai/shared": "workspace:^",
+    "@southwind-ai/storage": "workspace:^"
   },
   "exports": {
     ".": "./index.ts",

package/template/packages/jobs/src/handlers.test.ts

@@ -57,6 +57,19 @@ describe("DurableHandlerRegistry", () => {
       "任务 handler 重复注册：example.sync",
     );
   });
+
+  test("保留宿主颁发的模块归属供 Worker 重建受限上下文", () => {
+    const registry = new DurableHandlerRegistry().register(
+      {
+        key: "evidence.parse",
+        payload: { parse: () => ({}) },
+        execute: () => undefined,
+      },
+      { moduleName: "evidence" },
+    );
+
+    expect(registry.get("evidence.parse")?.moduleName).toBe("evidence");
+  });
 });
 
 function createContext(): DurableHandlerContext {

package/template/packages/jobs/src/handlers.ts

@@ -25,6 +25,7 @@ export interface DurableHandlerContext {
     sha256: string;
     ownerId: string;
     expiresAt?: string;
+    metadata?: Record<string, unknown>;
   }): Promise<void>;
 }
 
@@ -36,6 +37,7 @@ export interface DurableHandlerDefinition<T> {
 
 export interface RegisteredDurableHandler {
   key: string;
+  moduleName?: string;
   execute(
     payload: Record<string, unknown>,
     context: DurableHandlerContext,
@@ -45,13 +47,17 @@ export interface RegisteredDurableHandler {
 export class DurableHandlerRegistry {
   private readonly handlers = new Map<string, RegisteredDurableHandler>();
 
-  register<T>(definition: DurableHandlerDefinition<T>): this {
+  register<T>(
+    definition: DurableHandlerDefinition<T>,
+    metadata: { moduleName?: string } = {},
+  ): this {
     if (!definition.key.trim()) throw new Error("任务 handler key 不能为空");
     if (this.handlers.has(definition.key)) {
       throw new Error(`任务 handler 重复注册：${definition.key}`);
     }
     this.handlers.set(definition.key, {
       key: definition.key,
+      moduleName: metadata.moduleName,
       execute: async (payload, context) => {
         await definition.execute(definition.payload.parse(payload), context);
       },

package/template/packages/jobs/src/types.ts

@@ -1,4 +1,5 @@
 import type { ArtifactRef } from "@southwind-ai/storage";
+import type { AuthorizationScopeSnapshot } from "@southwind-ai/shared";
 
 export type DurableJobStatus =
   | "queued"
@@ -31,6 +32,7 @@ export interface DurableJob {
   payload: Record<string, unknown>;
   priority: number;
   requestedBy: string;
+  authorizationScope?: AuthorizationScopeSnapshot;
   maxAttempts: number;
   timeoutSeconds: number;
   availableAt: string;
@@ -108,6 +110,7 @@ export interface DurableJobArtifact {
   sha256: string;
   ownerId: string;
   expiresAt?: string;
+  metadata?: Record<string, unknown>;
   createdAt: string;
 }
 
@@ -166,6 +169,7 @@ export interface SubmitDurableJob {
   idempotencyKey: string;
   payload: Record<string, unknown>;
   requestedBy: string;
+  authorizationScope?: AuthorizationScopeSnapshot;
   queue?: string;
   priority?: number;
   maxAttempts?: number;

package/template/packages/modules/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/modules",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {
@@ -12,7 +12,7 @@
     "!src/**/*.test.ts"
   ],
   "dependencies": {
-    "@southwind-ai/shared": "workspace:*"
+    "@southwind-ai/shared": "workspace:^"
   },
   "exports": {
     ".": "./index.ts"