create-windy 0.6.11 → 0.6.14

package/template/apps/server/src/module-host/http-runtime.ts

@@ -16,6 +16,8 @@ import type { AiArtifactRuntime } from "../ai-artifact/runtime.js";
 import type { ModuleAiOperationPort } from "@southwind-ai/server-sdk";
 import type { ModuleAiOperationReadinessPortV1 } from "@southwind-ai/server-sdk";
 import type { ModuleAiScreenshotIntakePortV1 } from "@southwind-ai/server-sdk";
+import type { ModuleAgentSessionMemoryPortV1 } from "@southwind-ai/server-sdk";
+import type { ModuleAuthoritativeSourceInvalidationPortV1 } from "@southwind-ai/server-sdk";
 // @windy-module system.agent end
 import { installModuleRoutes } from "./route-installer.js";
 import type { InitializedModuleHosts } from "./initialize.js";
@@ -59,6 +61,16 @@ export function installModuleHttpRuntime(
       guardContext: RequestGuardContext,
       signal: AbortSignal,
     ) => ModuleAiScreenshotIntakePortV1;
+    sessionMemory?: (
+      moduleName: string,
+      guardContext: RequestGuardContext,
+      signal: AbortSignal,
+    ) => ModuleAgentSessionMemoryPortV1;
+    sourceInvalidation?: (
+      moduleName: string,
+      guardContext: RequestGuardContext,
+      signal: AbortSignal,
+    ) => ModuleAuthoritativeSourceInvalidationPortV1;
     // @windy-module system.agent end
     // @windy-module system.data-governance begin
     reauthenticate(actorId: string, password: string): Promise<boolean>;
@@ -103,6 +115,8 @@ export function installModuleHttpRuntime(
     aiOperations: context.aiOperations,
     aiReadiness: context.aiReadiness,
     screenshots: context.screenshots,
+    sessionMemory: context.sessionMemory,
+    sourceInvalidation: context.sourceInvalidation,
     // @windy-module system.agent end
   });
   // @windy-module system.data-governance begin

package/template/apps/server/src/module-host/initialize-contracts.ts

@@ -6,7 +6,7 @@ import type {
 import type {
   InstallableServerModule,
   ModuleAiOperationHandlerRegistration,
-  ModuleDebugSessionProviderV1,
+  ModuleAgentSessionProviderV1,
   ModuleDurableHandlerDefinition,
   ModuleInitializer,
   ModuleGovernedResourceRegistration,
@@ -70,11 +70,10 @@ export interface RegisteredModuleSearchProvider {
   readonly provider: ModuleSearchProvider;
 }
 
-export interface RegisteredModuleDebugSessionProvider {
+export interface RegisteredModuleAgentSessionProvider {
   readonly moduleName: string;
-  readonly provider: ModuleDebugSessionProviderV1;
+  readonly provider: ModuleAgentSessionProviderV1;
 }
-
 export interface InitializeModuleHostsInput {
   modules: readonly ModuleManifest[];
   /** Manifest 与 setup 由同一业务模块安装单元贡献。 */
@@ -101,7 +100,7 @@ export interface InitializedModuleHosts {
   readonly governedResources: readonly RegisteredModuleGovernedResource[];
   readonly rolePresets: readonly RegisteredModuleRolePreset[];
   readonly searchProviders: readonly RegisteredModuleSearchProvider[];
-  readonly debugSessionProviders: readonly RegisteredModuleDebugSessionProvider[];
+  readonly agentSessionProviders: readonly RegisteredModuleAgentSessionProvider[];
   manifestOf(moduleName: string): ModuleManifest;
   /** 该模块经 Host 注册的上传用途集合（不含平台基础用途）。 */
   uploadPurposesOf(moduleName: string): ReadonlySet<string>;

package/template/apps/server/src/module-host/initialize.ts

@@ -19,7 +19,7 @@ export type {
   InitializedModuleHosts,
   InitializeModuleHostsInput,
   RegisteredModuleAiOperationHandler,
-  RegisteredModuleDebugSessionProvider,
+  RegisteredModuleAgentSessionProvider,
   RegisteredModuleDurableHandler,
   RegisteredModuleGovernedResource,
   RegisteredModuleRolePreset,
@@ -94,8 +94,8 @@ export async function initializeModuleHosts(
     rolePresetKeys: new Set<string>(),
     searchProviders: [],
     searchProviderKeys: new Set<string>(),
-    debugSessionProviders: [],
-    debugSessionProviderKeys: new Set<string>(),
+    agentSessionProviders: [],
+    agentSessionProviderKeys: new Set<string>(),
   };
 
   const installations = [
@@ -155,7 +155,7 @@ export async function initializeModuleHosts(
     governedResources: [...state.governedResources],
     rolePresets: [...state.rolePresets],
     searchProviders: [...state.searchProviders],
-    debugSessionProviders: [...state.debugSessionProviders],
+    agentSessionProviders: [...state.agentSessionProviders],
     manifestOf(moduleName) {
       const manifest = manifests.get(moduleName);
       if (!manifest) throw new Error(`模块未安装：${moduleName}`);

package/template/apps/server/src/module-host/request-context.test.ts

@@ -79,13 +79,13 @@ describe("模块 Actor 运行时边界", () => {
   });
 
   // @windy-module system.agent begin
-  test("开发调试委托只向业务 Module 投影真实用户，核心主体保持不变", () => {
+  test("客户端 Agent 委托只向业务 Module 投影真实用户，核心主体保持不变", () => {
     const requestActor = bindModuleUserProjection(
       {
-        id: "service_adk_debug",
+        id: "service_page_agent",
         type: "service",
-        name: "ADK 开发调试",
-        roleCodes: ["adk-debug"],
+        name: "PageAgent 客户端",
+        roleCodes: ["client-agent"],
         permissionKeys: ["analysis.copilot.execute"],
       },
       "user_dev_admin",
@@ -96,7 +96,7 @@ describe("模块 Actor 运行时边界", () => {
     expect(actor).toMatchObject({
       id: "user_dev_admin",
       type: "user",
-      name: "ADK 开发调试",
+      name: "PageAgent 客户端",
     });
     expect(requestActorFromModule(actor)).toBe(requestActor);
   });

package/template/apps/server/src/module-host/request-context.ts

@@ -6,6 +6,8 @@ import type {
   ModuleAiOperationPort,
   ModuleAiOperationReadinessPortV1,
   ModuleAiScreenshotIntakePortV1,
+  ModuleAgentSessionMemoryPortV1,
+  ModuleAuthoritativeSourceInvalidationPortV1,
   ModuleAuditEmitInput,
   ModuleAuditEmitter,
   ModuleRequestContext,
@@ -105,6 +107,8 @@ export interface ModuleRequestContextInput {
   aiOperations?: ModuleAiOperationPort;
   aiReadiness?: ModuleAiOperationReadinessPortV1;
   screenshots?: ModuleAiScreenshotIntakePortV1;
+  sessionMemory?: ModuleAgentSessionMemoryPortV1;
+  sourceInvalidation?: ModuleAuthoritativeSourceInvalidationPortV1;
   onAuditEmit?: (action: string) => void;
 }
 
@@ -128,6 +132,10 @@ export function buildModuleRequestContext(
     ...(input.screenshots
       ? { screenshots: narrowModuleScreenshotIntakePort(input.screenshots) }
       : {}),
+    ...(input.sessionMemory ? { sessionMemory: input.sessionMemory } : {}),
+    ...(input.sourceInvalidation
+      ? { sourceInvalidation: input.sourceInvalidation }
+      : {}),
     jobs: createModuleJobPort({
       moduleName: input.moduleName,
       guardContext: input.guardContext,

package/template/apps/server/src/module-host/route-install-context.ts

@@ -0,0 +1,65 @@
+import type { DurableJobs } from "@southwind-ai/jobs";
+import type {
+  ModuleAiArtifactRef,
+  ModuleAiArtifactPort,
+  ModuleAiOperationPort,
+  ModuleAiOperationReadinessPortV1,
+  ModuleAiScreenshotIntakePortV1,
+  ModuleAgentSessionMemoryPortV1,
+  ModuleAuthoritativeSourceInvalidationPortV1,
+} from "@southwind-ai/server-sdk";
+import type { FeatureFlagDefinition } from "@southwind-ai/shared";
+import type { createServerRuntime } from "../runtime.js";
+import type { routeContext } from "../system/route-helpers.js";
+import type { ModuleJobControlRuntime } from "./job-port.js";
+import type { ModuleStorageServices } from "./storage-port.js";
+import type { ModuleUserDirectoryServices } from "./user-directory-port.js";
+
+type GuardContext = ReturnType<typeof routeContext>["guardContext"];
+
+export interface ModuleRouteInstallContext {
+  runtime: ReturnType<typeof createServerRuntime>;
+  features: readonly FeatureFlagDefinition[];
+  jobs?: DurableJobs;
+  jobControl?: ModuleJobControlRuntime;
+  storage?: ModuleStorageServices;
+  // @windy-module system.storage begin
+  reportStaging?: import("../report-staging/service.js").ReportStagingService;
+  // @windy-module system.storage end
+  userDirectory?: Omit<ModuleUserDirectoryServices, "runtime" | "features">;
+  aiArtifacts?: (
+    moduleName: string,
+    guardContext: GuardContext,
+    signal: AbortSignal,
+  ) => ModuleAiArtifactPort;
+  validateAiArtifact?: (
+    reference: ModuleAiArtifactRef,
+    moduleName: string,
+    guardContext: GuardContext,
+  ) => ModuleAiArtifactRef;
+  aiOperations?: (
+    moduleName: string,
+    guardContext: GuardContext,
+    signal: AbortSignal,
+  ) => ModuleAiOperationPort;
+  aiReadiness?: (
+    moduleName: string,
+    guardContext: GuardContext,
+    signal: AbortSignal,
+  ) => ModuleAiOperationReadinessPortV1;
+  screenshots?: (
+    moduleName: string,
+    guardContext: GuardContext,
+    signal: AbortSignal,
+  ) => ModuleAiScreenshotIntakePortV1;
+  sessionMemory?: (
+    moduleName: string,
+    guardContext: GuardContext,
+    signal: AbortSignal,
+  ) => ModuleAgentSessionMemoryPortV1;
+  sourceInvalidation?: (
+    moduleName: string,
+    guardContext: GuardContext,
+    signal: AbortSignal,
+  ) => ModuleAuthoritativeSourceInvalidationPortV1;
+}

package/template/apps/server/src/module-host/route-installer.ts

@@ -1,84 +1,29 @@
-import type { DurableJobs } from "@southwind-ai/jobs";
-import type { FeatureFlagDefinition } from "@southwind-ai/shared";
 import { evaluateRouteGuards, findFeature } from "../route-guards.js";
 import { forbidden, routeContext } from "../system/route-helpers.js";
 import type { RouteApp } from "../system/route-types.js";
-import type { createServerRuntime } from "../runtime.js";
 import type { InitializedModuleHosts } from "./initialize.js";
-import type {
-  ModuleAiArtifactRef,
-  ModuleAiArtifactPort,
-  ModuleAiOperationPort,
-  ModuleAiOperationReadinessPortV1,
-  ModuleAiScreenshotIntakePortV1,
-} from "@southwind-ai/server-sdk";
 // @windy-module system.storage begin
 import { ModuleReportStagingError } from "@southwind-ai/server-sdk";
 // @windy-module system.storage end
 import { buildModuleRequestContext } from "./request-context.js";
 import {
   createModuleStoragePort,
-  type ModuleStorageServices,
 } from "./storage-port.js";
 import {
   createModuleUserDirectoryPort,
-  type ModuleUserDirectoryServices,
 } from "./user-directory-port.js";
 import { createModuleStorageScope } from "./storage-scope.js";
 import { createModuleStorageWritePort } from "./storage-write-port.js";
-import type { ModuleJobControlRuntime } from "./job-port.js";
 import { createModuleSecretPort } from "./module-secret-port.js";
 import { createGovernedModuleScreenshotIntakePort } from "./screenshot-intake-port.js";
 import { ScreenshotIntakePlanStore } from "./screenshot-intake-store.js";
 // @windy-module system.storage begin
-import type { ReportStagingService } from "../report-staging/service.js";
 import { createModuleReportStagingPort } from "./report-staging-port.js";
 // @windy-module system.storage end
-
-type ServerRuntime = ReturnType<typeof createServerRuntime>;
+import type { ModuleRouteInstallContext } from "./route-install-context.js";
 
 type RouteMethod = "get" | "post" | "put" | "delete";
 
-export interface ModuleRouteInstallContext {
-  runtime: ServerRuntime;
-  features: readonly FeatureFlagDefinition[];
-  jobs?: DurableJobs;
-  jobControl?: ModuleJobControlRuntime;
-  /** 平台存储服务；提供后模块获得受限 Upload/BlobRead Port。 */
-  storage?: ModuleStorageServices;
-  // @windy-module system.storage begin
-  /** Host 持有的大报告暂存生命周期；模块只获得作用域 Port。 */
-  reportStaging?: ReportStagingService;
-  // @windy-module system.storage end
-  /** 平台身份目录；Adapter 会绑定当前请求 Actor 与服务端数据范围。 */
-  userDirectory?: Omit<ModuleUserDirectoryServices, "runtime" | "features">;
-  aiArtifacts?: (
-    moduleName: string,
-    guardContext: ReturnType<typeof routeContext>["guardContext"],
-    signal: AbortSignal,
-  ) => ModuleAiArtifactPort;
-  validateAiArtifact?: (
-    reference: ModuleAiArtifactRef,
-    moduleName: string,
-    guardContext: ReturnType<typeof routeContext>["guardContext"],
-  ) => ModuleAiArtifactRef;
-  aiOperations?: (
-    moduleName: string,
-    guardContext: ReturnType<typeof routeContext>["guardContext"],
-    signal: AbortSignal,
-  ) => ModuleAiOperationPort;
-  aiReadiness?: (
-    moduleName: string,
-    guardContext: ReturnType<typeof routeContext>["guardContext"],
-    signal: AbortSignal,
-  ) => ModuleAiOperationReadinessPortV1;
-  screenshots?: (
-    moduleName: string,
-    guardContext: ReturnType<typeof routeContext>["guardContext"],
-    signal: AbortSignal,
-  ) => ModuleAiScreenshotIntakePortV1;
-}
-
 /**
  * 把模块经 Host 注册的路由定义安装为走统一 Guard 的 API 路由。
  * Guard（权限 / Feature / License）与 security.denied 审计由
@@ -217,6 +162,16 @@ export function installModuleRoutes(
                   ),
               })
             : undefined,
+        sessionMemory: context.sessionMemory?.(
+          moduleName,
+          route.guardContext,
+          route.request.signal,
+        ),
+        sourceInvalidation: context.sourceInvalidation?.(
+          moduleName,
+          route.guardContext,
+          route.request.signal,
+        ),
         jobs: context.jobs,
         jobControl: context.jobControl,
         reauthorizeJobs: async () =>

package/template/apps/server/src/module-host/scoped-host.ts

@@ -11,7 +11,7 @@ import {
 } from "@southwind-ai/server-sdk";
 import type {
   RegisteredModuleAiOperationHandler,
-  RegisteredModuleDebugSessionProvider,
+  RegisteredModuleAgentSessionProvider,
   RegisteredModuleDurableHandler,
   RegisteredModuleGovernedResource,
   RegisteredModuleRolePreset,
@@ -21,7 +21,7 @@ import type {
   RegisteredModuleTaskHandler,
   RegisteredModuleToolHandler,
 } from "./initialize-contracts.js";
-import { validateDebugSessionProviderRegistration } from "./debug-session-provider-registration.js";
+import { validateAgentSessionProviderRegistration } from "./agent-session-provider-registration.js";
 import { registerModuleDurableHandler } from "./durable-handler-registration.js";
 import { registerGovernedResources } from "./governed-resources.js";
 import { registerResourceFileAccessPolicies } from "./resource-file-policies.js";
@@ -62,8 +62,8 @@ export interface HostCollections {
   rolePresetKeys: Set<string>;
   searchProviders: RegisteredModuleSearchProvider[];
   searchProviderKeys: Set<string>;
-  debugSessionProviders: RegisteredModuleDebugSessionProvider[];
-  debugSessionProviderKeys: Set<string>;
+  agentSessionProviders: RegisteredModuleAgentSessionProvider[];
+  agentSessionProviderKeys: Set<string>;
 }
 
 export function createScopedHost(
@@ -71,6 +71,17 @@ export function createScopedHost(
   state: HostCollections,
 ): ModuleHost {
   const moduleName = manifest.name;
+  const registerAgentSessionProviders: ModuleHost["registerAgentSessionProviders"] =
+    (providers) => {
+      for (const provider of providers) {
+        validateAgentSessionProviderRegistration(manifest, provider);
+        if (state.agentSessionProviderKeys.has(provider.key)) {
+          throw new Error(`Agent 会话 Provider 重复注册：${provider.key}`);
+        }
+        state.agentSessionProviderKeys.add(provider.key);
+        state.agentSessionProviders.push({ moduleName, provider });
+      }
+    };
   return {
     moduleName,
     registerUploadPolicy(policy) {
@@ -219,15 +230,9 @@ export function createScopedHost(
         state.searchProviders.push({ moduleName, provider });
       }
     },
+    registerAgentSessionProviders,
     registerDebugSessionProviders(providers) {
-      for (const provider of providers) {
-        validateDebugSessionProviderRegistration(manifest, provider);
-        if (state.debugSessionProviderKeys.has(provider.key)) {
-          throw new Error(`调试会话 Provider 重复注册：${provider.key}`);
-        }
-        state.debugSessionProviderKeys.add(provider.key);
-        state.debugSessionProviders.push({ moduleName, provider });
-      }
+      registerAgentSessionProviders(providers);
     },
   };
 }

package/template/apps/server/src/module-host/storage-authorization-binding.test.ts

@@ -157,10 +157,10 @@ describe("模块上传会话授权绑定", () => {
     ]);
     const actor = bindModuleUserProjection(
       {
-        id: "service_adk_debug",
+        id: "service_page_agent",
         type: "service",
-        name: "调试服务",
-        roleCodes: ["adk-debug"],
+        name: "PageAgent 客户端",
+        roleCodes: ["client-agent"],
         permissionKeys: ["shop.upload.manage"],
         scopeContext,
       },

package/template/apps/server/src/module-host.ts

@@ -9,17 +9,15 @@ export {
   type RegisteredModuleTaskHandler,
   type RegisteredModuleToolHandler,
   type RegisteredModuleAiOperationHandler,
-  type RegisteredModuleDebugSessionProvider,
+  type RegisteredModuleAgentSessionProvider,
 } from "./module-host/initialize.js";
 export {
   buildModuleRequestContext,
   requestActorFromModule,
   toModuleActor,
 } from "./module-host/request-context.js";
-export {
-  installModuleRoutes,
-  type ModuleRouteInstallContext,
-} from "./module-host/route-installer.js";
+export { installModuleRoutes } from "./module-host/route-installer.js";
+export type { ModuleRouteInstallContext } from "./module-host/route-install-context.js";
 export {
   moduleRolePresetId,
   synchronizeModuleRolePresets,

package/template/apps/server/src/runtime.ts

@@ -31,17 +31,10 @@ import {
   requestSourcePolicyFromEnv,
   resolveRequestSource,
 } from "./http/request-source.js";
-import { resolveRequestActor } from "./runtime-request-actor.js";
 import {
   matchesAuditQuery,
   type AuditEventListQuery,
 } from "./runtime-audit-query.js";
-// @windy-module system.agent begin
-import {
-  createAdkDebugRuntime,
-  type AdkDebugActorResolver,
-} from "./runtime-adk-debug.js";
-// @windy-module system.agent end
 
 export type {
   FeatureFlagRuntimeResolver,
@@ -79,9 +72,6 @@ export interface ServerRuntimeOptions {
   disabledModuleNames?: ReadonlySet<string>;
   auditWriter?: AuditEventWriter;
   auditReader?: AuditEventReader;
-  // @windy-module system.agent begin
-  adkDebugActorResolver?: AdkDebugActorResolver;
-  // @windy-module system.agent end
 }
 
 export class InMemorySessionStore {
@@ -190,19 +180,6 @@ export function createServerRuntime(
   options: ServerRuntimeOptions = {},
 ) {
   const developmentAuth = readDevelopmentAuthBypass(env);
-  // @windy-module system.agent begin
-  const adkDebug = createAdkDebugRuntime(
-    env,
-    undefined,
-    options.adkDebugActorResolver,
-  );
-  if (adkDebug.usesToken(developmentAuth.token)) {
-    throw new Error("ADK Web 调试 Token 不能复用开发管理员 Token");
-  }
-  if (adkDebug.usesToken(env.AGENT_SERVER_INTERNAL_TOKEN?.trim())) {
-    throw new Error("ADK Web 调试 Token 不能复用 Agent 内部服务 Token");
-  }
-  // @windy-module system.agent end
   const sessionStore = new InMemorySessionStore(
     developmentAuth.token
       ? [{ token: developmentAuth.token, actor: developmentAdminActor() }]
@@ -234,15 +211,9 @@ export function createServerRuntime(
         metadata.clientIp,
         requestSourcePolicy,
       );
-      const actor = await resolveRequestActor(
-        request,
-        async () =>
-          (await options.actorResolver?.resolve(request)) ||
-          sessionStore.resolve(request),
-        // @windy-module system.agent begin
-        adkDebug,
-        // @windy-module system.agent end
-      );
+      const actor =
+        (await options.actorResolver?.resolve(request)) ||
+        sessionStore.resolve(request);
       const license =
         (await options.licenseResolver?.resolve()) || licenseStore.resolve();
       return createRequestGuardContext(request, {
@@ -252,10 +223,6 @@ export function createServerRuntime(
         licenseEnforced: options.licenseEnforced,
       });
     },
-    // @windy-module system.agent begin
-    resolveEphemeralActor: adkDebug.resolveActor,
-    agentDebugOperationForActor: adkDebug.operationForActor,
-    // @windy-module system.agent end
     async createGuardContextForActor(
       request: Request,
       actor: RequestActor,

package/template/apps/server/src/storage/routes-stream-cancellation.test.ts

@@ -69,6 +69,25 @@ describe("legacy Storage 分片路由取消未读请求体", () => {
     ).rejects.toThrow("injected guard failure");
     expect(request.cancelled()).toBe(true);
   });
+
+  test("运行时请求体缺少 cancel 时 Guard 拒绝仍保留 403", async () => {
+    const fixture = setup();
+    const request = new Request("http://localhost/api/system/storage/upload", {
+      method: "PUT",
+    });
+    Object.defineProperty(request, "body", {
+      value: {},
+      configurable: true,
+    });
+
+    const response = await fixture.invoke(
+      actor([]),
+      "upload_44444444444444444444444444444444",
+      request,
+    );
+
+    expect(response.status).toBe(403);
+  });
 });
 
 function setup(guardFailure = false) {

package/template/apps/server/src/storage/routes.ts

@@ -311,7 +311,9 @@ async function cancelUnreadBody(
   body: ReadableStream<Uint8Array> | null | undefined,
   reason: string,
 ): Promise<void> {
-  await body?.cancel(reason).catch(() => undefined);
+  const cancel = body?.cancel;
+  if (typeof cancel !== "function") return;
+  await cancel.call(body, reason).catch(() => undefined);
 }
 
 function record(

package/template/apps/server/src/system/actor.ts

@@ -1,5 +1,6 @@
 import { buildActorScopeContexts } from "../data-access/context.js";
 import type { RequestActor } from "../guards.js";
+import type { ManagedRole, ManagedUser } from "./entities.js";
 import type { SystemRepositories } from "./seed.js";
 
 export async function resolveCurrentSystemActor(
@@ -7,9 +8,21 @@ export async function resolveCurrentSystemActor(
   actorId: string,
 ): Promise<RequestActor | undefined> {
   const user = await repositories.users.get(actorId);
-  if (!user || user.status !== "active") return undefined;
+  if (!user) return undefined;
+  return resolveSystemActorForUser(repositories, user);
+}
+
+export async function resolveSystemActorForUser(
+  repositories: Pick<SystemRepositories, "roles">,
+  user: ManagedUser,
+  roleOverrides: readonly ManagedRole[] = [],
+): Promise<RequestActor | undefined> {
+  if (user.status !== "active") return undefined;
+  const overrides = new Map(roleOverrides.map((role) => [role.id, role]));
   const roles = (
-    await Promise.all(user.roleIds.map((id) => repositories.roles.get(id)))
+    await Promise.all(
+      user.roleIds.map((id) => overrides.get(id) ?? repositories.roles.get(id)),
+    )
   ).filter(
     (role): role is NonNullable<typeof role> => role?.status === "active",
   );

package/template/apps/server/src/system/authorization-invalidation-bridge.ts

@@ -0,0 +1,30 @@
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { RequestActor } from "../guards.js";
+
+export interface AgentAuthorizationInvalidationInput {
+  readonly previousActor: RequestActor;
+  readonly eventId: string;
+  readonly occurredAt: string;
+  readonly database: NodePgDatabase;
+}
+
+export type AgentAuthorizationInvalidationTarget = (
+  input: AgentAuthorizationInvalidationInput,
+) => Promise<void>;
+
+/** Routes are registered before Agent composition, so startup binds this once. */
+export class DeferredAgentAuthorizationInvalidation {
+  #target?: AgentAuthorizationInvalidationTarget;
+
+  bind(target: AgentAuthorizationInvalidationTarget | undefined) {
+    if (this.#target) throw new Error("Agent 授权失效传播已绑定");
+    this.#target = target;
+  }
+
+  async publish(input: AgentAuthorizationInvalidationInput) {
+    if (!this.#target) {
+      throw new Error("Agent 授权失效传播暂不可用");
+    }
+    await this.#target(input);
+  }
+}

package/template/apps/server/src/system/authorization-invalidation-composition.ts

@@ -0,0 +1,36 @@
+import type { PlatformConfig } from "@southwind-ai/config";
+import type { AgentAuthorizationInvalidationTarget } from "./authorization-invalidation-bridge.js";
+import { DeferredAgentAuthorizationInvalidation } from "./authorization-invalidation-bridge.js";
+import type { ServerPersistence } from "../persistence.js";
+import type { SystemRepositories } from "./seed.js";
+
+export function createAuthorizationInvalidationComposition(input: {
+  readonly platformConfig: PlatformConfig;
+  readonly persistence?: ServerPersistence;
+  readonly repositories: SystemRepositories;
+}) {
+  const bridge = new DeferredAgentAuthorizationInvalidation();
+  const authorizationRevocations =
+    input.platformConfig.enableAI && input.persistence?.db
+      ? {
+          publish: (
+            event: Omit<Parameters<typeof bridge.publish>[0], "database">,
+          ) =>
+            bridge.publish({
+              ...event,
+              database:
+                input.repositories.organizationTransaction?.currentDatabase() ??
+                input.persistence!.db!,
+            }),
+        }
+      : undefined;
+  return {
+    systemRouteOptions: {
+      authRepository: input.persistence?.authRepository,
+      ...(authorizationRevocations ? { authorizationRevocations } : {}),
+    },
+    bind(target: AgentAuthorizationInvalidationTarget | undefined) {
+      bridge.bind(target);
+    },
+  };
+}

package/template/apps/server/src/system/drizzle-system.ts

@@ -55,6 +55,9 @@ export interface DrizzleSystemRepositories {
   licenses: EntityRepository<ManagedLicense>;
   // @windy-module system.license end
   organizationMutationRunner: MutationRunner;
+  organizationTransaction: {
+    currentDatabase(): NodePgDatabase;
+  };
 }
 
 export function createDrizzleSystemRepositories(
@@ -62,7 +65,7 @@ export function createDrizzleSystemRepositories(
   seeds: DrizzleSystemRepositorySeeds,
 ): DrizzleSystemRepositories {
   const transactionContext = new DrizzleTransactionContext();
-  return {
+  const repositories = {
     users: new DrizzleScopedEntityRepository(
       db,
       userConfig(seeds.users),
@@ -107,5 +110,9 @@ export function createDrizzleSystemRepositories(
       "windy:system:organization",
       transactionContext,
     ),
+    organizationTransaction: {
+      currentDatabase: () => transactionContext.current(db),
+    },
   };
+  return repositories;
 }