create-windy 0.6.12 → 0.6.15

package/template/packages/server-sdk/src/request-context.ts

@@ -4,6 +4,8 @@ import type { ModuleAiArtifactPort } from "./ai-artifact-port.js";
 import type { ModuleAiOperationPort } from "./ai-operation-port.js";
 import type { ModuleAiOperationReadinessPortV1 } from "./ai-runtime-readiness.js";
 import type { ModuleAiScreenshotIntakePortV1 } from "./ai-screenshot-intake-port.js";
+import type { ModuleAgentSessionMemoryPortV1 } from "./agent-session-memory-port.js";
+import type { ModuleAuthoritativeSourceInvalidationPortV1 } from "./agent-source-invalidation-port.js";
 import type { ModuleJobPort } from "./jobs-port.js";
 import type { ModuleReportStagingPortV1 } from "./report-staging-port.js";
 import type { ModuleSecretPort } from "./secret-port.js";
@@ -12,6 +14,9 @@ import type {
   ModuleStorageWritePortV1,
 } from "./storage-port.js";
 import type { ModuleUserDirectoryPort } from "./user-directory-port.js";
+// @windy-module system.agent begin
+import type { ModuleWorkflowInputMaterializationPortV1 } from "./workflow-input-artifact-port.js";
+// @windy-module system.agent end
 
 /**
  * 模块路由 Handler 的受限请求上下文。
@@ -37,7 +42,15 @@ export interface ModuleRequestContext {
   readonly aiReadiness?: ModuleAiOperationReadinessPortV1;
   /** VLM 截图输入的独立版本化接缝，不改变既有 aiArtifacts 必填表面。 */
   readonly screenshots?: ModuleAiScreenshotIntakePortV1;
+  /** Module-authoritative long-session Memory triggers; absent means fail closed. */
+  readonly sessionMemory?: ModuleAgentSessionMemoryPortV1;
+  /** Host-bound authoritative source lifecycle and authorization revocation outbox. */
+  readonly sourceInvalidation?: ModuleAuthoritativeSourceInvalidationPortV1;
   readonly jobs: ModuleJobPort;
+  // @windy-module system.agent begin
+  /** 真实 Durable Job 两阶段物化；缺失时不得声明 Workflow input readiness。 */
+  readonly workflowInputMaterialization?: ModuleWorkflowInputMaterializationPortV1;
+  // @windy-module system.agent end
   /** 大报告受治理暂存是版本化、可选的 additive seam。 */
   readonly reportStaging?: ModuleReportStagingPortV1;
   /**

package/template/packages/server-sdk/src/workflow-input-artifact-port.ts

@@ -0,0 +1,104 @@
+import type { AgentWorkflowArtifactRef, JsonValue } from "@southwind-ai/shared";
+import type { ModuleResourceFileRequest } from "./storage-port.js";
+
+export interface ModuleWorkflowInputArtifactSourceV1 {
+  /** Host 固定 moduleKey；调用方只声明模块内的权威对象坐标。 */
+  readonly kind: string;
+  readonly id: string;
+  readonly version: string;
+  readonly sequence: number;
+  readonly digest?: string;
+}
+
+export interface ModuleWorkflowInputArtifactPublicationV1 {
+  /** 同一 Job stage 内的稳定幂等键。 */
+  readonly publicationKey: string;
+  readonly kind: string;
+  readonly filename: string;
+  readonly retentionPolicyKey: string;
+  readonly source: ModuleWorkflowInputArtifactSourceV1;
+}
+
+export interface ModuleWorkflowInputResourceArtifactV1 extends ModuleWorkflowInputArtifactPublicationV1 {
+  /** 仍走当前模块注册的 resource-file policy 与对象授权。 */
+  readonly resource: ModuleResourceFileRequest;
+}
+
+export interface ModuleWorkflowInputJsonArtifactV1 extends ModuleWorkflowInputArtifactPublicationV1 {
+  readonly value: JsonValue;
+}
+
+/**
+ * 只在真实 Durable Handler attempt 中可用：复制受权源到 BlobStore，再发布正式
+ * Durable Job Artifact，并返回可直接作为 Workflow input 的真实 artifactId。
+ */
+export interface ModuleWorkflowInputArtifactPublicationPortV1 {
+  publishResource(
+    input: ModuleWorkflowInputResourceArtifactV1,
+  ): Promise<AgentWorkflowArtifactRef>;
+  publishJson(
+    input: ModuleWorkflowInputJsonArtifactV1,
+  ): Promise<AgentWorkflowArtifactRef>;
+}
+
+export type ModuleWorkflowInputMaterializationSourceV1 =
+  | ({ readonly mode: "resource" } & ModuleWorkflowInputResourceArtifactV1)
+  | ({ readonly mode: "json" } & ModuleWorkflowInputJsonArtifactV1);
+
+export interface ModuleWorkflowInputMaterializationHandleV1 {
+  readonly materializationId: string;
+}
+
+export type ModuleWorkflowInputMaterializationViewV1 =
+  | (ModuleWorkflowInputMaterializationHandleV1 & {
+      readonly status: "pending";
+    })
+  | (ModuleWorkflowInputMaterializationHandleV1 & {
+      readonly status: "ready";
+      readonly artifacts: readonly AgentWorkflowArtifactRef[];
+    });
+
+/** Route/Application 两阶段 seam：只有 ready 的正式 Artifact refs 才能进入 Workflow input。 */
+export interface ModuleWorkflowInputMaterializationPortV1 {
+  begin(input: {
+    readonly idempotencyKey: string;
+    readonly sources: readonly ModuleWorkflowInputMaterializationSourceV1[];
+  }): Promise<ModuleWorkflowInputMaterializationHandleV1>;
+  resolve(
+    handle: ModuleWorkflowInputMaterializationHandleV1,
+  ): Promise<ModuleWorkflowInputMaterializationViewV1>;
+  cancel(
+    handle: ModuleWorkflowInputMaterializationHandleV1 & {
+      readonly reason: string;
+    },
+  ): Promise<void>;
+}
+
+export class ModuleWorkflowInputMaterializationError extends Error {
+  constructor(
+    readonly code:
+      | "MATERIALIZATION_UNAVAILABLE"
+      | "MATERIALIZATION_FAILED"
+      | "MATERIALIZATION_RESULT_INVALID",
+  ) {
+    super("Workflow input materialization 不可用");
+    this.name = "ModuleWorkflowInputMaterializationError";
+  }
+}
+
+export function moduleWorkflowInputMaterializationHandlerKey(
+  moduleName: string,
+) {
+  return `${moduleName}.workflow-input-materialize`;
+}
+
+export class ModuleWorkflowInputArtifactUnavailableError extends Error {
+  readonly code = "WORKFLOW_INPUT_ARTIFACT_UNAVAILABLE";
+}
+
+export function requireModuleWorkflowInputArtifactPublicationPortV1(
+  port: ModuleWorkflowInputArtifactPublicationPortV1 | undefined,
+) {
+  if (!port) throw new ModuleWorkflowInputArtifactUnavailableError();
+  return port;
+}

package/template/packages/server-sdk/src/workflow-input-artifact-validation.contract.test.ts

@@ -0,0 +1,124 @@
+import { expect, test } from "bun:test";
+import {
+  MODULE_WORKFLOW_INPUT_MATERIALIZATION_LIMITS_V1 as limits,
+  parseModuleWorkflowInputJsonValueV1,
+  parseModuleWorkflowInputMaterializationBeginV1,
+  parseModuleWorkflowInputMaterializationPayloadV1,
+  parseModuleWorkflowInputMaterializationSourceV1,
+} from "../index.js";
+
+const publication = {
+  publicationKey: "case-1-v7",
+  kind: "case-snapshot",
+  filename: "case-1.json",
+  retentionPolicyKey: "case.analysis",
+  source: {
+    kind: "case",
+    id: "case-1",
+    version: "7",
+    sequence: 7,
+    digest: `sha256:${"a".repeat(64)}`,
+  },
+} as const;
+
+test("materialization parser 按 mode 精确拒绝多余和互斥字段", () => {
+  expect(
+    parseModuleWorkflowInputMaterializationSourceV1({
+      mode: "resource",
+      ...publication,
+      resource: {
+        fileId: "file-1",
+        purpose: "case-evidence",
+        resourceType: "case",
+        resourceId: "case-1",
+      },
+    }),
+  ).toMatchObject({ mode: "resource", resource: { fileId: "file-1" } });
+  expect(() =>
+    parseModuleWorkflowInputMaterializationSourceV1({
+      mode: "resource",
+      ...publication,
+      resource: {
+        fileId: "file-1",
+        purpose: "case-evidence",
+        resourceType: "case",
+        resourceId: "case-1",
+      },
+      value: {},
+    }),
+  ).toThrow("WORKFLOW_INPUT_MATERIALIZATION_PAYLOAD_INVALID");
+  expect(() =>
+    parseModuleWorkflowInputMaterializationSourceV1({
+      mode: "json",
+      ...publication,
+      value: {},
+      unknown: true,
+    }),
+  ).toThrow("WORKFLOW_INPUT_MATERIALIZATION_PAYLOAD_INVALID");
+});
+
+test("begin、durable payload 与 JSON value 使用同一 fail-closed budgets", () => {
+  const source = { mode: "json" as const, ...publication, value: { ok: true } };
+  expect(
+    parseModuleWorkflowInputMaterializationBeginV1({
+      idempotencyKey: "case-1-v7",
+      sources: [source],
+    }),
+  ).toMatchObject({ sources: [{ mode: "json" }] });
+  expect(
+    parseModuleWorkflowInputMaterializationPayloadV1({
+      schemaVersion: 1,
+      sources: [source],
+    }),
+  ).toMatchObject({ schemaVersion: 1 });
+  expect(() =>
+    parseModuleWorkflowInputMaterializationBeginV1({
+      idempotencyKey: "case-1-v7",
+      sources: [source],
+      actorId: "browser-claim",
+    }),
+  ).toThrow("WORKFLOW_INPUT_MATERIALIZATION_PAYLOAD_INVALID");
+  expect(() =>
+    parseModuleWorkflowInputMaterializationPayloadV1({
+      schemaVersion: 1,
+      sources: [source],
+      retry: true,
+    }),
+  ).toThrow("WORKFLOW_INPUT_MATERIALIZATION_PAYLOAD_INVALID");
+
+  const dangerous = {} as Record<string, unknown>;
+  Object.defineProperty(dangerous, "__proto__", {
+    enumerable: true,
+    value: "pollute",
+  });
+  expect(() => parseModuleWorkflowInputJsonValueV1(dangerous)).toThrow(
+    "WORKFLOW_INPUT_MATERIALIZATION_PAYLOAD_INVALID",
+  );
+  expect(() => parseModuleWorkflowInputJsonValueV1(undefined)).toThrow();
+  expect(() => parseModuleWorkflowInputJsonValueV1(Number.NaN)).toThrow();
+  const sparse = Array<unknown>(2);
+  sparse[1] = "sparse";
+  expect(() => parseModuleWorkflowInputJsonValueV1(sparse)).toThrow();
+  expect(() =>
+    parseModuleWorkflowInputJsonValueV1(
+      Object.defineProperty({}, "lazy", {
+        enumerable: true,
+        get: () => "not-read",
+      }),
+    ),
+  ).toThrow();
+
+  let deep: unknown = null;
+  for (let index = 0; index <= limits.jsonDepth; index += 1) {
+    deep = { next: deep };
+  }
+  expect(() => parseModuleWorkflowInputJsonValueV1(deep)).toThrow();
+  expect(() =>
+    parseModuleWorkflowInputJsonValueV1(
+      Array.from({ length: limits.arrayItems + 1 }, () => null),
+    ),
+  ).toThrow();
+  expect(() =>
+    parseModuleWorkflowInputJsonValueV1("x".repeat(limits.stringBytes + 1)),
+  ).toThrow();
+});

package/template/packages/server-sdk/src/workflow-input-artifact-validation.ts

@@ -0,0 +1,347 @@
+import type { JsonValue } from "@southwind-ai/shared";
+import type {
+  ModuleWorkflowInputJsonArtifactV1,
+  ModuleWorkflowInputMaterializationSourceV1,
+  ModuleWorkflowInputResourceArtifactV1,
+} from "./workflow-input-artifact-port.js";
+
+export const MODULE_WORKFLOW_INPUT_MATERIALIZATION_LIMITS_V1 = {
+  sources: 32,
+  totalBytes: 16 * 1024 * 1024,
+  jsonDepth: 32,
+  jsonNodes: 50_000,
+  arrayItems: 4_096,
+  objectProperties: 2_048,
+  keyBytes: 256,
+  stringBytes: 4 * 1024 * 1024,
+  totalStringBytes: 12 * 1024 * 1024,
+} as const;
+
+const unsafeKeys = new Set(["__proto__", "constructor", "prototype"]);
+const encoder = new TextEncoder();
+
+interface Budget {
+  nodes: number;
+  stringBytes: number;
+  readonly seen: WeakSet<object>;
+}
+
+export function parseModuleWorkflowInputMaterializationBeginV1(value: unknown) {
+  const input = strictRecord(value, ["idempotencyKey", "sources"]);
+  const budget = freshBudget();
+  const result = {
+    idempotencyKey: text(input.idempotencyKey, 200, budget),
+    sources: sources(input.sources, budget),
+  };
+  assertTotalBytes(result);
+  return result;
+}
+
+export function parseModuleWorkflowInputMaterializationPayloadV1(
+  value: unknown,
+) {
+  const input = strictRecord(value, ["schemaVersion", "sources"]);
+  if (input.schemaVersion !== 1) fail();
+  const budget = freshBudget();
+  const result = {
+    schemaVersion: 1 as const,
+    sources: sources(input.sources, budget),
+  };
+  assertTotalBytes(result);
+  return result;
+}
+
+export function parseModuleWorkflowInputMaterializationSourceV1(
+  value: unknown,
+): ModuleWorkflowInputMaterializationSourceV1 {
+  const budget = freshBudget();
+  const result = source(value, budget);
+  assertTotalBytes(result);
+  return result;
+}
+
+export function parseModuleWorkflowInputResourceArtifactV1(
+  value: unknown,
+): ModuleWorkflowInputResourceArtifactV1 {
+  const budget = freshBudget();
+  const result = resourceArtifact(value, budget, false);
+  assertTotalBytes(result);
+  return result;
+}
+
+export function parseModuleWorkflowInputJsonArtifactV1(
+  value: unknown,
+): ModuleWorkflowInputJsonArtifactV1 {
+  const budget = freshBudget();
+  const result = jsonArtifact(value, budget, false);
+  assertTotalBytes(result);
+  return result;
+}
+
+export function parseModuleWorkflowInputJsonValueV1(value: unknown): JsonValue {
+  const budget = freshBudget();
+  const result = json(value, 0, budget);
+  assertTotalBytes(result);
+  return result;
+}
+
+function sources(value: unknown, budget: Budget) {
+  if (
+    !Array.isArray(value) ||
+    value.length < 1 ||
+    value.length > MODULE_WORKFLOW_INPUT_MATERIALIZATION_LIMITS_V1.sources
+  ) {
+    fail();
+  }
+  return strictArray(value, value.length).map((item) => source(item, budget));
+}
+
+function source(
+  value: unknown,
+  budget: Budget,
+): ModuleWorkflowInputMaterializationSourceV1 {
+  const mode = dataProperty(value, "mode");
+  if (mode === "resource") {
+    return { mode, ...resourceArtifact(value, budget, true) };
+  }
+  if (mode === "json") return { mode, ...jsonArtifact(value, budget, true) };
+  return fail();
+}
+
+function resourceArtifact(value: unknown, budget: Budget, withMode: boolean) {
+  const input = artifactRecord(value, withMode, "resource");
+  const resource = strictRecord(input.resource, [
+    "fileId",
+    "purpose",
+    "resourceType",
+    "resourceId",
+  ]);
+  return {
+    ...publication(input, budget),
+    resource: {
+      fileId: text(resource.fileId, 256, budget),
+      purpose: text(resource.purpose, 160, budget),
+      resourceType: text(resource.resourceType, 160, budget),
+      resourceId: text(resource.resourceId, 256, budget),
+    },
+  } satisfies ModuleWorkflowInputResourceArtifactV1;
+}
+
+function jsonArtifact(value: unknown, budget: Budget, withMode: boolean) {
+  const input = artifactRecord(value, withMode, "json");
+  return {
+    ...publication(input, budget),
+    value: json(input.value, 0, budget),
+  } satisfies ModuleWorkflowInputJsonArtifactV1;
+}
+
+function artifactRecord(value: unknown, withMode: boolean, mode: string) {
+  const common = [
+    "publicationKey",
+    "kind",
+    "filename",
+    "retentionPolicyKey",
+    "source",
+  ];
+  const specific = mode === "resource" ? "resource" : "value";
+  return strictRecord(
+    value,
+    withMode ? ["mode", ...common, specific] : [...common, specific],
+  );
+}
+
+function publication(input: Record<string, unknown>, budget: Budget) {
+  const source = strictRecord(input.source, [
+    "kind",
+    "id",
+    "version",
+    "sequence",
+    "digest?",
+  ]);
+  if (!Number.isSafeInteger(source.sequence) || Number(source.sequence) < 1)
+    fail();
+  const filename = text(input.filename, 240, budget);
+  if (filename.includes("/") || filename.includes("\\")) fail();
+  return {
+    publicationKey: text(input.publicationKey, 200, budget),
+    kind: text(input.kind, 160, budget),
+    filename,
+    retentionPolicyKey: text(input.retentionPolicyKey, 256, budget),
+    source: {
+      kind: text(source.kind, 160, budget),
+      id: text(source.id, 256, budget),
+      version: text(source.version, 256, budget),
+      sequence: Number(source.sequence),
+      ...(source.digest === undefined
+        ? {}
+        : { digest: digest(source.digest, budget) }),
+    },
+  };
+}
+
+function json(value: unknown, depth: number, budget: Budget): JsonValue {
+  budget.nodes += 1;
+  if (
+    budget.nodes > MODULE_WORKFLOW_INPUT_MATERIALIZATION_LIMITS_V1.jsonNodes ||
+    depth > MODULE_WORKFLOW_INPUT_MATERIALIZATION_LIMITS_V1.jsonDepth
+  ) {
+    fail();
+  }
+  if (value === null || typeof value === "boolean") return value;
+  if (typeof value === "string") return jsonString(value, budget);
+  if (typeof value === "number") return Number.isFinite(value) ? value : fail();
+  if (!value || typeof value !== "object" || budget.seen.has(value)) fail();
+  budget.seen.add(value);
+  if (Array.isArray(value)) {
+    if (
+      value.length > MODULE_WORKFLOW_INPUT_MATERIALIZATION_LIMITS_V1.arrayItems
+    ) {
+      fail();
+    }
+    return strictArray(value, value.length).map((item) =>
+      json(item, depth + 1, budget),
+    );
+  }
+  if (Object.getPrototypeOf(value) !== Object.prototype) fail();
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  const keys = Reflect.ownKeys(descriptors);
+  if (
+    keys.length >
+      MODULE_WORKFLOW_INPUT_MATERIALIZATION_LIMITS_V1.objectProperties ||
+    keys.some((key) => typeof key !== "string" || unsafeKeys.has(key))
+  ) {
+    fail();
+  }
+  const result: Record<string, JsonValue> = {};
+  for (const key of keys as string[]) {
+    keyText(key, budget);
+    const descriptor = descriptors[key];
+    if (!descriptor?.enumerable || !Object.hasOwn(descriptor, "value")) fail();
+    result[key] = json(descriptor.value, depth + 1, budget);
+  }
+  return result;
+}
+
+function strictRecord(value: unknown, keys: readonly string[]) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    Object.getPrototypeOf(value) !== Object.prototype
+  ) {
+    fail();
+  }
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  const actual = Reflect.ownKeys(descriptors);
+  const required = keys.filter((key) => !key.endsWith("?"));
+  const allowed = new Set(keys.map((key) => key.replace(/\?$/u, "")));
+  if (
+    actual.some((key) => typeof key !== "string" || !allowed.has(key)) ||
+    required.some((key) => !actual.includes(key))
+  ) {
+    fail();
+  }
+  const result: Record<string, unknown> = {};
+  for (const key of actual as string[]) {
+    const descriptor = descriptors[key];
+    if (!descriptor?.enumerable || !Object.hasOwn(descriptor, "value")) fail();
+    result[key] = descriptor.value;
+  }
+  return result;
+}
+
+function dataProperty(value: unknown, key: string) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) fail();
+  const descriptor = Object.getOwnPropertyDescriptor(value, key);
+  if (!descriptor?.enumerable || !Object.hasOwn(descriptor, "value")) fail();
+  return descriptor.value;
+}
+
+function strictArray(value: readonly unknown[], expectedLength: number) {
+  if (Object.getPrototypeOf(value) !== Array.prototype) fail();
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  const keys = Reflect.ownKeys(descriptors);
+  const lengthDescriptor = Object.getOwnPropertyDescriptor(value, "length");
+  if (
+    keys.length !== expectedLength + 1 ||
+    !lengthDescriptor ||
+    !Object.hasOwn(lengthDescriptor, "value") ||
+    lengthDescriptor.value !== expectedLength ||
+    lengthDescriptor.enumerable
+  ) {
+    fail();
+  }
+  const result: unknown[] = [];
+  for (let index = 0; index < expectedLength; index += 1) {
+    const descriptor = descriptors[String(index)];
+    if (!descriptor?.enumerable || !Object.hasOwn(descriptor, "value")) fail();
+    result.push(descriptor.value);
+  }
+  return result;
+}
+
+function text(value: unknown, maxBytes: number, budget: Budget) {
+  if (
+    typeof value !== "string" ||
+    value !== value.trim() ||
+    !value ||
+    value.includes("\0")
+  )
+    fail();
+  const bytes = encoder.encode(value).byteLength;
+  if (bytes > maxBytes) fail();
+  budget.stringBytes += bytes;
+  if (
+    budget.stringBytes >
+    MODULE_WORKFLOW_INPUT_MATERIALIZATION_LIMITS_V1.totalStringBytes
+  )
+    fail();
+  return value;
+}
+
+function jsonString(value: string, budget: Budget) {
+  const bytes = encoder.encode(value).byteLength;
+  if (bytes > MODULE_WORKFLOW_INPUT_MATERIALIZATION_LIMITS_V1.stringBytes)
+    fail();
+  budget.stringBytes += bytes;
+  if (
+    budget.stringBytes >
+    MODULE_WORKFLOW_INPUT_MATERIALIZATION_LIMITS_V1.totalStringBytes
+  )
+    fail();
+  return value;
+}
+
+function keyText(value: string, budget: Budget) {
+  if (!value || value.includes("\0") || unsafeKeys.has(value)) fail();
+  return text(
+    value,
+    MODULE_WORKFLOW_INPUT_MATERIALIZATION_LIMITS_V1.keyBytes,
+    budget,
+  );
+}
+
+function digest(value: unknown, budget: Budget) {
+  const result = text(value, 71, budget);
+  if (!/^sha256:[0-9a-f]{64}$/u.test(result)) fail();
+  return result;
+}
+
+function assertTotalBytes(value: unknown) {
+  const encoded = JSON.stringify(value);
+  if (
+    encoded === undefined ||
+    encoder.encode(encoded).byteLength >
+      MODULE_WORKFLOW_INPUT_MATERIALIZATION_LIMITS_V1.totalBytes
+  ) {
+    fail();
+  }
+}
+
+function freshBudget(): Budget {
+  return { nodes: 0, stringBytes: 0, seen: new WeakSet() };
+}
+
+function fail(): never {
+  throw new Error("WORKFLOW_INPUT_MATERIALIZATION_PAYLOAD_INVALID");
+}

package/template/packages/server-sdk/src/workflow-input-materialization-handler.ts

@@ -0,0 +1,43 @@
+import type { AuditActionType } from "@southwind-ai/shared";
+import type { ModuleDurableHandlerDefinition } from "./durable-handler.js";
+import {
+  moduleWorkflowInputMaterializationHandlerKey,
+  requireModuleWorkflowInputArtifactPublicationPortV1,
+  type ModuleWorkflowInputMaterializationSourceV1,
+} from "./workflow-input-artifact-port.js";
+import { parseModuleWorkflowInputMaterializationPayloadV1 } from "./workflow-input-artifact-validation.js";
+
+export function defineModuleWorkflowInputMaterializationHandlerV1(input: {
+  readonly moduleName: string;
+  readonly featureKey: string;
+  readonly permissionKey: string;
+  readonly auditAction: AuditActionType;
+}): ModuleDurableHandlerDefinition<{
+  readonly schemaVersion: 1;
+  readonly sources: readonly ModuleWorkflowInputMaterializationSourceV1[];
+}> {
+  return {
+    key: moduleWorkflowInputMaterializationHandlerKey(input.moduleName),
+    featureKey: input.featureKey,
+    permissionKey: input.permissionKey,
+    auditAction: input.auditAction,
+    payload: { parse: parsePayload },
+    async execute(payload, context) {
+      const artifacts = requireModuleWorkflowInputArtifactPublicationPortV1(
+        context.workflowInputArtifacts,
+      );
+      for (const source of payload.sources) {
+        if (context.signal.aborted) throw context.signal.reason;
+        if (source.mode === "resource") {
+          const { mode: _mode, ...publication } = source;
+          await artifacts.publishResource(publication);
+        } else {
+          const { mode: _mode, ...publication } = source;
+          await artifacts.publishJson(publication);
+        }
+      }
+    },
+  };
+}
+
+const parsePayload = parseModuleWorkflowInputMaterializationPayloadV1;

package/template/packages/shared/index.ts

@@ -2,6 +2,9 @@ export * from "./src/audit.js";
 export * from "./src/ai-operation-readiness.js";
 // @windy-module system.agent begin
 export * from "./src/ai-runtime-report.js";
+export * from "./src/agent-workflow.js";
+export * from "./src/agent-workflow-events.js";
+export * from "./src/agent-workflow-evaluation.js";
 // @windy-module system.agent end
 export * from "./src/database.js";
 export * from "./src/data-governance.js";

package/template/packages/shared/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/shared",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {