create-windy 0.6.12 → 0.6.14

package/template/apps/server/src/auth/routes.test-support.ts

@@ -11,6 +11,7 @@ export function authFixture(
   users: AuthUserRecord[],
   passwordPolicy?: () => PasswordPolicy,
   sessionTtlSeconds?: () => number,
+  onSessionsRevoked?: (actorId: string) => Promise<void> | void,
 ) {
   const repository = new InMemoryAuthRepository(users);
   const resolver = new RepositoryActorResolver(repository, {
@@ -21,6 +22,7 @@ export function authFixture(
   const service = new AuthService(repository, {
     passwordPolicy,
     sessionTtlSeconds,
+    onSessionsRevoked,
     auditWriter: {
       write(event) {
         events.push(event);

package/template/apps/server/src/auth/routes.test.ts

@@ -89,6 +89,24 @@ describe("platform auth API", () => {
     expect(JSON.stringify(body)).not.toContain(current.token);
   });
 
+  test("登出即时通知 Client Agent Session 按 canonical Actor 撤销", async () => {
+    const revoked: string[] = [];
+    const fixture = authFixture(
+      [activeUser()],
+      undefined,
+      undefined,
+      (actorId) => {
+        revoked.push(actorId);
+      },
+    );
+    const current = await login(fixture.app, "admin");
+    const response = await fixture.app.handle(
+      apiRequest("/api/auth/logout", current.token, "POST"),
+    );
+    expect(response.status).toBe(200);
+    expect(revoked).toEqual(["user_admin"]);
+  });
+
   test("Admin 登录只签发 Cookie，独立 API 登录才返回 Bearer Token", async () => {
     const fixture = authFixture([activeUser()]);
     const browserLogin = await fixture.app.handle(

package/template/apps/server/src/auth/runtime.ts

@@ -11,6 +11,7 @@ interface AuthRuntimeInput {
   passwordPolicy?: () => PasswordPolicy;
   auditWriter: AuditEventWriter["write"];
   auditReader?: AuditEventReader;
+  onSessionsRevoked?: (actorId: string) => Promise<void> | void;
 }
 
 export function createAuthRuntime(input: AuthRuntimeInput) {
@@ -22,6 +23,7 @@ export function createAuthRuntime(input: AuthRuntimeInput) {
     auditWriter: { write: input.auditWriter },
     auditReader: input.auditReader,
     passwordHasher,
+    onSessionsRevoked: input.onSessionsRevoked,
   });
   const reauthentication = new ReauthenticationService(
     authRepository,

package/template/apps/server/src/auth/service-options.ts

@@ -0,0 +1,16 @@
+import type { PasswordPolicy } from "@southwind-ai/shared";
+import type { AuditEventReader, AuditEventWriter } from "../runtime.js";
+import type { AuthenticationProviderRegistry } from "./authentication-provider.js";
+import type { PasswordHasher } from "./password.js";
+
+export interface AuthServiceOptions {
+  sessionTtlSeconds?: number | (() => number);
+  passwordPolicy?: () => PasswordPolicy;
+  now?: () => Date;
+  tokenFactory?: () => string;
+  passwordHasher?: PasswordHasher;
+  authenticationProviders?: AuthenticationProviderRegistry;
+  auditWriter: AuditEventWriter;
+  auditReader?: AuditEventReader;
+  onSessionsRevoked?: (actorId: string) => Promise<void> | void;
+}

package/template/apps/server/src/auth/service.ts

@@ -6,7 +6,6 @@ import {
   type PasswordPolicy,
 } from "@southwind-ai/shared";
 import type { RequestActor } from "../guards.js";
-import type { AuditEventReader, AuditEventWriter } from "../runtime.js";
 import { hashSessionToken } from "./actor-resolver.js";
 import {
   AuthenticationProviderRegistry,
@@ -20,6 +19,7 @@ import {
   type PasswordUpdateResult,
 } from "./credential-service.js";
 import { OwnSessionService } from "./session-service.js";
+import type { AuthServiceOptions } from "./service-options.js";
 
 export interface AuthRequestMetadata {
   ip?: string;
@@ -45,17 +45,6 @@ export type RevokeResult =
   | { ok: true; sessionId: string; currentSessionRevoked: boolean }
   | { ok: false; code: "SESSION_NOT_FOUND" | "FORBIDDEN" };
 
-export interface AuthServiceOptions {
-  sessionTtlSeconds?: number | (() => number);
-  passwordPolicy?: () => PasswordPolicy;
-  now?: () => Date;
-  tokenFactory?: () => string;
-  passwordHasher?: PasswordHasher;
-  authenticationProviders?: AuthenticationProviderRegistry;
-  auditWriter: AuditEventWriter;
-  auditReader?: AuditEventReader;
-}
-
 export class AuthService {
   private readonly sessionTtlSeconds: () => number;
   private readonly passwordPolicy: () => PasswordPolicy;
@@ -191,6 +180,8 @@ export class AuthService {
     const revoked = session
       ? await this.repository.revokeSession(session.id, this.now())
       : false;
+    if (revoked && session)
+      await this.options.onSessionsRevoked?.(session.userId);
     await this.recordAuthEvent({
       action: "auth.logout",
       outcome: revoked ? "success" : "failure",
@@ -267,6 +258,7 @@ export class AuthService {
     const currentSessionRevoked =
       revoked &&
       (await this.ownSessions.isCurrent(sessionId, actor, currentToken));
+    if (revoked) await this.options.onSessionsRevoked?.(session.userId);
     return revoked
       ? { ok: true, sessionId, currentSessionRevoked }
       : { ok: false, code: "SESSION_NOT_FOUND" };
@@ -299,6 +291,9 @@ export class AuthService {
       metadata: { scope: "all-own", includeCurrent, ...result },
       request: metadata,
     });
+    if (result.revokedSessions > 0) {
+      await this.options.onSessionsRevoked?.(actor.id);
+    }
     return result;
   }
 

package/template/apps/server/src/index.ts

@@ -14,15 +14,11 @@ import { createServerRuntime } from "./runtime.js";
 import { readPositiveInt } from "./runtime-config.js";
 // @windy-module system.scheduler end
 // @windy-module system.agent begin
-import { registerAgentPlatformRuntime } from "./agent/runtime-bootstrap.js";
 import { DeferredAgentBackgroundOperationPortFactory } from "./agent/background-operation-port.js";
-import {
-  projectAiScreenshotIntakeFactoryV1,
-  projectAiScreenshotPageRegistryV2,
-} from "./app/ai-screenshot-intake-binding.js";
-import { resolveCurrentSystemActor } from "./system/actor.js";
+import { composeApplicationAgentRuntime } from "./app/agent-runtime-composition.js";
+import { workflowDurableInput } from "./agent/workflow-durable-runtime-input.js";
 // @windy-module system.agent end
-import { createAuthRuntime } from "./auth/runtime.js";
+import { createComposedAuthRuntime } from "./auth/composition.js";
 // @windy-module system.license begin
 import { createLicenseRuntimeActivation } from "./license/activation.js";
 // @windy-module system.license end
@@ -31,6 +27,7 @@ import { registerSystemOperationRoutes } from "./system/operations.js";
 import { createPostgresMonitorProbe } from "./system/postgres-monitoring.js";
 // @windy-module system.operations end
 import { registerSystemRoutes } from "./system/routes.js";
+import { createAuthorizationInvalidationComposition } from "./system/authorization-invalidation-composition.js";
 // @windy-module system.scheduler begin
 import { registerSchedulerRoutes } from "./scheduler/routes.js";
 import { SchedulerWorker } from "./scheduler/worker.js";
@@ -85,10 +82,6 @@ const licenseActivation = createLicenseRuntimeActivation(
 // @windy-module system.license end
 const runtime = createServerRuntime(process.env, {
   actorResolver: persistence?.actorResolver,
-  // @windy-module system.agent begin
-  adkDebugActorResolver: (actorId) =>
-    resolveCurrentSystemActor(systemRepositories, actorId),
-  // @windy-module system.agent end
   // @windy-module system.license begin
   licenseResolver: licenseActivation.resolver,
   licenseEnforced: licenseActivation.enforced,
@@ -102,26 +95,27 @@ const runtime = createServerRuntime(process.env, {
   // @windy-module system.audit end
 });
 const observability = createHttpObservability(runtime, persistence, logger);
+const authorizationInvalidation = createAuthorizationInvalidationComposition({
+  platformConfig,
+  persistence,
+  repositories: systemRepositories,
+});
 // @windy-module system.license begin
 licenseActivation.runtime.setAuditSink(runtime.auditSink);
 // @windy-module system.license end
 const {
   authRepository,
   authService,
+  // @windy-module system.agent begin
+  bindClientAgentSessions,
+  // @windy-module system.agent end
   // @windy-module system.data-governance begin
   reauthentication,
   // @windy-module system.data-governance end
-} = createAuthRuntime({
-  repository: persistence?.authRepository,
-  sessionTtlSeconds: () => platformConfig.security.sessionTtlSeconds,
-  passwordPolicy: () => ({
-    minLength: platformConfig.security.passwordMinLength,
-    maxLength: platformConfig.security.passwordMaxLength,
-  }),
-  auditWriter: (event) => runtime.auditSink.recordCriticalEvent(event),
-  // @windy-module system.audit begin
-  auditReader: persistence?.auditReader,
-  // @windy-module system.audit end
+} = createComposedAuthRuntime({
+  platformConfig,
+  persistence,
+  runtime,
 });
 // @windy-module system.storage begin
 const { storageRuntime, reportStagingRuntime } = createStorageHostRuntime(
@@ -263,9 +257,13 @@ registerFoundationRoute(app, runtime, foundationSnapshot, systemRepositories);
 // @windy-module system.data-governance begin
 registerGovernedUserExportRoutes(app, governedExportService, runtime, features);
 // @windy-module system.data-governance end
-registerSystemRoutes(app, systemRepositories, runtime, features, {
-  authRepository: persistence?.authRepository,
-});
+registerSystemRoutes(
+  app,
+  systemRepositories,
+  runtime,
+  features,
+  authorizationInvalidation.systemRouteOptions,
+);
 // @windy-module system.operations begin
 registerSystemOperationRoutes(app, runtime, features, {
   redisHealthProbe: configurationRuntime.redisHealthProbe,
@@ -278,7 +276,7 @@ registerSystemOperationRoutes(app, runtime, features, {
 });
 // @windy-module system.operations end
 // @windy-module system.agent begin
-const agentRuntime = registerAgentPlatformRuntime({
+const agentRuntime = composeApplicationAgentRuntime({
   app,
   platformConfig,
   modules: foundationModules,
@@ -287,13 +285,13 @@ const agentRuntime = registerAgentPlatformRuntime({
   systemRepositories,
   storage: storageRuntime,
   workflow: workflowService,
+  ...workflowDurableInput([durableJobRuntime, storageRuntime, logger]),
   db: persistence?.db,
   backgroundAi: moduleBackgroundAi,
-  screenshotPageRegistry: platformConfig.enableAI
-    ? projectAiScreenshotPageRegistryV2
-    : undefined,
+  bindAuthorizationInvalidation: (target) =>
+    authorizationInvalidation.bind(target),
+  bindClientAgentSessions,
 });
-const { toolHandlers, aiArtifacts, aiOperations, aiReadiness } = agentRuntime;
 // @windy-module system.agent end
 // @windy-module system.scheduler begin
 registerSchedulerRoutes(app, scheduler, runtime, features);
@@ -314,12 +312,12 @@ installModuleHttpRuntime(moduleHosts, app, {
   // @windy-module system.storage end
   systemRepositories,
   // @windy-module system.agent begin
-  aiArtifacts,
-  aiOperations,
-  aiReadiness,
-  screenshots: platformConfig.enableAI
-    ? projectAiScreenshotIntakeFactoryV1
-    : undefined,
+  aiArtifacts: agentRuntime.aiArtifacts,
+  aiOperations: agentRuntime.aiOperations,
+  aiReadiness: agentRuntime.aiReadiness,
+  sessionMemory: agentRuntime.sessionMemory,
+  sourceInvalidation: agentRuntime.sourceInvalidation,
+  screenshots: agentRuntime.screenshots,
   // @windy-module system.agent end
   // @windy-module system.data-governance begin
   reauthenticate: (actorId, password) =>
@@ -334,7 +332,7 @@ finalizePlatformStartup({
   tasks: scheduledTaskDefinitions,
   // @windy-module system.scheduler end
   // @windy-module system.agent begin
-  tools: toolHandlers,
+  tools: agentRuntime.toolHandlers,
   disposeAgentRuntime: agentRuntime.disposeAgentRuntime,
   // @windy-module system.agent end
   // @windy-module system.search begin

package/template/apps/server/src/license/pairing-service.test.ts

@@ -48,7 +48,7 @@ describe("License 手机配对会话", () => {
 
     const tampered = {
       ...fixture.license,
-      signature: `A${fixture.license.signature.slice(1)}`,
+      signature: `${fixture.license.signature.startsWith("A") ? "B" : "A"}${fixture.license.signature.slice(1)}`,
     };
     await expect(
       service.deliver(

package/template/apps/server/src/module-host/agent-session-memory-port.ts

@@ -0,0 +1,91 @@
+import {
+  MODULE_AGENT_SESSION_MEMORY_SCHEMA_VERSION,
+  type ModuleAgentSessionMemoryPortV1,
+  type ModuleSessionMemorySourceV1,
+} from "@southwind-ai/server-sdk";
+import type { RequestGuardContext } from "../guards.js";
+import type { ContextSourceReference } from "../agent/context-memory/contracts.js";
+import type { MemoryProjectionTriggerPort } from "../agent/context-memory/memory-projector.js";
+
+export function createModuleAgentSessionMemoryPort(
+  moduleName: string,
+  context: RequestGuardContext,
+  signal: AbortSignal,
+  projector: MemoryProjectionTriggerPort,
+): ModuleAgentSessionMemoryPortV1 {
+  const common = (input: ModuleMemoryBase) => ({
+    triggerId: `${moduleName}:${input.triggerId}`,
+    derivation: {
+      sessionId: input.sessionId,
+      throughSequence: input.throughSequence,
+    },
+    sources: input.sources.map((source) => sourceReference(moduleName, source)),
+    ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),
+  });
+  return {
+    schemaVersion: MODULE_AGENT_SESSION_MEMORY_SCHEMA_VERSION,
+    async rememberUserPreference(input) {
+      return receipt(await projector.projectUserPreference({
+        ...common(input),
+        kind: "user-preference",
+        actorId: context.actor.id,
+        preferenceKey: input.preferenceKey,
+        value: input.value,
+      }, context, signal));
+    },
+    async proposeCaseMemory(input) {
+      return receipt(await projector.projectCaseMemoryCandidate({
+        ...common(input),
+        kind: "case-memory-candidate",
+        caseId: input.caseId,
+        claim: input.claim,
+        ...(input.confidence !== undefined
+          ? { confidence: input.confidence }
+          : {}),
+      }, context, signal));
+    },
+    async referenceVerifiedFact(input) {
+      return receipt(await projector.projectVerifiedFactReference({
+        ...common(input),
+        kind: "verified-fact-reference",
+        caseId: input.caseId,
+        fact: { moduleKey: moduleName, ...input.fact },
+      }, context, signal));
+    },
+  };
+}
+
+interface ModuleMemoryBase {
+  readonly triggerId: string;
+  readonly sessionId: string;
+  readonly throughSequence: number;
+  readonly sources: readonly ModuleSessionMemorySourceV1[];
+  readonly expiresAt?: string;
+}
+
+function sourceReference(
+  moduleName: string,
+  source: ModuleSessionMemorySourceV1,
+): ContextSourceReference {
+  return {
+    moduleKey: moduleName,
+    kind: source.kind as ContextSourceReference["kind"],
+    id: source.id,
+    version: source.version,
+    sequence: source.sequence,
+    digest: source.digest,
+    validity: {
+      status: "valid",
+      checkedAt: source.checkedAt,
+      ...(source.expiresAt ? { expiresAt: source.expiresAt } : {}),
+    },
+  };
+}
+
+function receipt(projection: { memoryId: string; version: string; digest: string }) {
+  return {
+    memoryId: projection.memoryId,
+    version: projection.version,
+    digest: projection.digest,
+  };
+}

package/template/apps/server/src/module-host/{debug-session-provider-registration.test.ts → agent-session-provider-registration.test.ts}

@@ -1,30 +1,32 @@
 import { describe, expect, test } from "bun:test";
 import type { ModuleManifest } from "@southwind-ai/modules";
 import {
+  MODULE_AGENT_SESSION_SCHEMA_VERSION,
   MODULE_DEBUG_SESSION_SCHEMA_VERSION,
+  type ModuleAgentSessionProviderV1,
   type ModuleDebugSessionProviderV1,
 } from "@southwind-ai/server-sdk";
 import { featureKey } from "@southwind-ai/shared";
 import { initializeModuleHosts } from "./initialize.js";
 import { manifest } from "./test-fixtures.js";
 
-describe("ADK 调试会话 Provider 注册", () => {
+describe("Agent 会话 Provider 注册", () => {
   test("只接受同模块 Agent Operation 的 Feature 与权限绑定", async () => {
-    const module = debugManifest();
-    const provider = debugProvider();
+    const module = agentManifest();
+    const provider = agentProvider();
     const hosts = await initializeModuleHosts({
       modules: [module],
       installations: [
         {
           manifest: module,
           setup(host) {
-            host.registerDebugSessionProviders([provider]);
+            host.registerAgentSessionProviders([provider]);
           },
         },
       ],
     });
 
-    expect(hosts.debugSessionProviders).toEqual([
+    expect(hosts.agentSessionProviders).toEqual([
       { moduleName: "known", provider },
     ]);
 
@@ -45,25 +47,25 @@ describe("ADK 调试会话 Provider 注册", () => {
   test("协议版本、Manifest 审计动作、命名空间与重复 Key fail closed", async () => {
     await expect(
       initializeWith({
-        ...debugProvider(),
+        ...agentProvider(),
         key: "other.history",
       }),
     ).rejects.toThrow("不属于模块 known");
     await expect(
       initializeWith({
-        ...debugProvider(),
+        ...agentProvider(),
         auditAction: "known.missing",
       }),
     ).rejects.toThrow("审计动作未在 Manifest 声明");
     await expect(
       initializeWith({
-        ...debugProvider(),
+        ...agentProvider(),
         schemaVersion: 2 as 1,
       }),
     ).rejects.toThrow("协议版本不受支持");
 
-    const module = debugManifest();
-    const provider = debugProvider();
+    const module = agentManifest();
+    const provider = agentProvider();
     await expect(
       initializeModuleHosts({
         modules: [module],
@@ -71,33 +73,56 @@ describe("ADK 调试会话 Provider 注册", () => {
           {
             manifest: module,
             setup(host) {
-              host.registerDebugSessionProviders([provider, provider]);
+              host.registerAgentSessionProviders([provider, provider]);
             },
           },
         ],
       }),
     ).rejects.toThrow("重复注册");
   });
+
+  test("旧 Debug Session 名称只作为同一注册表的兼容 alias", async () => {
+    const module = agentManifest();
+    const provider: ModuleDebugSessionProviderV1 = {
+      ...agentProvider(),
+      schemaVersion: MODULE_DEBUG_SESSION_SCHEMA_VERSION,
+    };
+    const hosts = await initializeModuleHosts({
+      modules: [module],
+      installations: [
+        {
+          manifest: module,
+          setup(host) {
+            host.registerDebugSessionProviders([provider]);
+          },
+        },
+      ],
+    });
+
+    expect(hosts.agentSessionProviders).toEqual([
+      { moduleName: "known", provider },
+    ]);
+  });
 });
 
-async function initializeWith(provider: ModuleDebugSessionProviderV1) {
-  const module = debugManifest();
+async function initializeWith(provider: ModuleAgentSessionProviderV1) {
+  const module = agentManifest();
   return initializeModuleHosts({
     modules: [module],
     installations: [
       {
         manifest: module,
         setup(host) {
-          host.registerDebugSessionProviders([provider]);
+          host.registerAgentSessionProviders([provider]);
         },
       },
     ],
   });
 }
 
-function debugProvider(): ModuleDebugSessionProviderV1 {
+function agentProvider(): ModuleAgentSessionProviderV1 {
   return {
-    schemaVersion: MODULE_DEBUG_SESSION_SCHEMA_VERSION,
+    schemaVersion: MODULE_AGENT_SESSION_SCHEMA_VERSION,
     key: "known.copilot.history",
     operationKeys: ["known.copilot.global"],
     featureKey: "known.copilot",
@@ -108,7 +133,7 @@ function debugProvider(): ModuleDebugSessionProviderV1 {
   };
 }
 
-function debugManifest(): ModuleManifest {
+function agentManifest(): ModuleManifest {
   return manifest("known", {
     features: [
       {

package/template/apps/server/src/module-host/{debug-session-provider-registration.ts → agent-session-provider-registration.ts}

@@ -1,59 +1,59 @@
 import type { ModuleManifest } from "@southwind-ai/modules";
 import {
-  MODULE_DEBUG_SESSION_SCHEMA_VERSION,
+  MODULE_AGENT_SESSION_SCHEMA_VERSION,
   requireModuleNamespace,
-  type ModuleDebugSessionProviderV1,
+  type ModuleAgentSessionProviderV1,
 } from "@southwind-ai/server-sdk";
 
-export function validateDebugSessionProviderRegistration(
+export function validateAgentSessionProviderRegistration(
   manifest: ModuleManifest,
-  provider: ModuleDebugSessionProviderV1,
+  provider: ModuleAgentSessionProviderV1,
 ): void {
   const moduleName = manifest.name;
-  requireModuleNamespace("调试会话 Provider", provider.key, moduleName);
+  requireModuleNamespace("Agent 会话 Provider", provider.key, moduleName);
   requireModuleNamespace(
-    "调试会话 Provider Feature",
+    "Agent 会话 Provider Feature",
     provider.featureKey,
     moduleName,
   );
   requireModuleNamespace(
-    "调试会话 Provider 权限",
+    "Agent 会话 Provider 权限",
     provider.permissionKey,
     moduleName,
   );
   requireModuleNamespace(
-    "调试会话 Provider 审计动作",
+    "Agent 会话 Provider 审计动作",
     provider.auditAction,
     moduleName,
   );
-  if (provider.schemaVersion !== MODULE_DEBUG_SESSION_SCHEMA_VERSION) {
-    throw new Error(`调试会话 Provider 协议版本不受支持：${provider.key}`);
+  if (provider.schemaVersion !== MODULE_AGENT_SESSION_SCHEMA_VERSION) {
+    throw new Error(`Agent 会话 Provider 协议版本不受支持：${provider.key}`);
   }
   if (!manifest.features.some(({ key }) => key === provider.featureKey)) {
     throw new Error(
-      `调试会话 Provider Feature 未在 Manifest 声明：${provider.featureKey}`,
+      `Agent 会话 Provider Feature 未在 Manifest 声明：${provider.featureKey}`,
     );
   }
   if (!manifest.permissions.some(({ key }) => key === provider.permissionKey)) {
     throw new Error(
-      `调试会话 Provider 权限未在 Manifest 声明：${provider.permissionKey}`,
+      `Agent 会话 Provider 权限未在 Manifest 声明：${provider.permissionKey}`,
     );
   }
   if (!manifestAuditActions(manifest).has(provider.auditAction)) {
     throw new Error(
-      `调试会话 Provider 审计动作未在 Manifest 声明：${provider.auditAction}`,
+      `Agent 会话 Provider 审计动作未在 Manifest 声明：${provider.auditAction}`,
     );
   }
   if (provider.operationKeys.length === 0) {
     throw new Error(
-      `调试会话 Provider 必须绑定至少一个 Operation：${provider.key}`,
+      `Agent 会话 Provider 必须绑定至少一个 Operation：${provider.key}`,
     );
   }
   const operationKeys = new Set<string>();
   for (const operationKey of provider.operationKeys) {
-    requireModuleNamespace("调试会话 Operation", operationKey, moduleName);
+    requireModuleNamespace("Agent 会话 Operation", operationKey, moduleName);
     if (operationKeys.has(operationKey)) {
-      throw new Error(`调试会话 Provider Operation 重复：${operationKey}`);
+      throw new Error(`Agent 会话 Provider Operation 重复：${operationKey}`);
     }
     operationKeys.add(operationKey);
     const operation = manifest.aiOperations?.find(
@@ -61,7 +61,7 @@ export function validateDebugSessionProviderRegistration(
     );
     if (!operation || operation.kind !== "agent") {
       throw new Error(
-        `调试会话 Provider Operation 未声明为 Agent：${operationKey}`,
+        `Agent 会话 Provider Operation 未声明为 Agent：${operationKey}`,
       );
     }
     if (
@@ -69,7 +69,7 @@ export function validateDebugSessionProviderRegistration(
       operation.permissionKey !== provider.permissionKey
     ) {
       throw new Error(
-        `调试会话 Provider 必须复用 Operation 的 Feature 与权限：${operationKey}`,
+        `Agent 会话 Provider 必须复用 Operation 的 Feature 与权限：${operationKey}`,
       );
     }
   }

package/template/apps/server/src/module-host/agent-source-invalidation-port.ts

@@ -0,0 +1,53 @@
+import {
+  ModuleAuthoritativeSourceInvalidationUnavailableError,
+  type ModuleAuthoritativeSourceInvalidationPortV1,
+} from "@southwind-ai/server-sdk";
+import type { RequestGuardContext } from "../guards.js";
+import type { ModuleAuthoritativeSourceAccessRegistry } from "../agent/context-memory/authoritative-source-registry.js";
+import type { ModuleAuthoritativeInvalidationProducerPort } from "../agent/session-invalidation/module-authoritative-producer.js";
+import type { DrizzleSessionInvalidationOutbox } from "../agent/session-persistence/drizzle-invalidation-outbox.js";
+import { authorizationCoordinateForActor } from "../agent/session-projection-access.js";
+
+export function createModuleAuthoritativeSourceInvalidationPort(
+  moduleName: string,
+  context: RequestGuardContext,
+  signal: AbortSignal,
+  sources: ModuleAuthoritativeSourceAccessRegistry,
+  outbox: DrizzleSessionInvalidationOutbox,
+): ModuleAuthoritativeSourceInvalidationPortV1 {
+  let producer: ModuleAuthoritativeInvalidationProducerPort;
+  try {
+    producer = sources.bindTransactionalInvalidationProducer({
+      moduleKey: moduleName,
+      authorization: authorizationCoordinateForActor(context.actor),
+      appendInTransaction: (db, envelope) =>
+        outbox.appendInTransaction(db, envelope),
+    });
+  } catch {
+    return unavailablePort();
+  }
+  return {
+    sourceDeleted: (input) => invoke(() => producer.sourceDeleted(input), signal),
+    sourceExpired: (input) => invoke(() => producer.sourceExpired(input), signal),
+    sourceSuperseded: (input) =>
+      invoke(() => producer.sourceSuperseded(input), signal),
+    authorizationRevoked: (input) =>
+      invoke(() => producer.authorizationRevoked(input), signal),
+  };
+}
+
+function unavailablePort(): ModuleAuthoritativeSourceInvalidationPortV1 {
+  const unavailable = () =>
+    Promise.reject(new ModuleAuthoritativeSourceInvalidationUnavailableError());
+  return {
+    sourceDeleted: unavailable,
+    sourceExpired: unavailable,
+    sourceSuperseded: unavailable,
+    authorizationRevoked: unavailable,
+  };
+}
+
+function invoke<T>(operation: () => Promise<T>, signal: AbortSignal) {
+  if (signal.aborted) throw new Error("权威来源失效写入暂不可用");
+  return operation();
+}