create-windy 0.6.14 → 0.6.16

package/template/apps/server/src/app/agent-runtime-composition.ts

@@ -6,11 +6,14 @@ import {
   projectAiScreenshotPageRegistryV2,
 } from "./ai-screenshot-intake-binding.js";
 import { projectClientAgentHostAuthAdapter } from "./client-agent-host-auth-binding.js";
+import { projectClientAgentWorkflowArtifactBindings } from "./client-agent-workflow-artifact-binding.js";
 
 export function composeApplicationAgentRuntime(
   input: Omit<
     AgentPlatformRuntimeInput,
-    "clientAgentHostAuth" | "screenshotPageRegistry"
+    | "clientAgentHostAuth"
+    | "clientAgentWorkflowArtifactBindings"
+    | "screenshotPageRegistry"
   > & {
     readonly bindAuthorizationInvalidation: (
       target: AgentAuthorizationInvalidationTarget | undefined,
@@ -23,6 +26,8 @@ export function composeApplicationAgentRuntime(
   const runtime = registerAgentPlatformRuntime({
     ...input,
     clientAgentHostAuth: projectClientAgentHostAuthAdapter,
+    clientAgentWorkflowArtifactBindings:
+      projectClientAgentWorkflowArtifactBindings,
     screenshotPageRegistry: input.platformConfig.enableAI
       ? projectAiScreenshotPageRegistryV2
       : undefined,

package/template/apps/server/src/app/client-agent-workflow-artifact-binding.ts

@@ -0,0 +1,14 @@
+import type { ModuleClientAgentWorkflowArtifactProjectBinding } from "@southwind-ai/server-sdk";
+
+/**
+ * Project-owned Workflow -> PageAgent 绑定。Starter 默认空数组并 fail closed；
+ * 产品只为已审核、已发布的固定 Workflow Job node 增加静态绑定。Operation 必须声明
+ * `clientExecution.launchAuthority="workflow-artifact"`；binding 必须登记 Immutable
+ * canonical `releaseDigest`、scope containment contract v1，以及 project launch、client task、terminal
+ * authority version/digest。launch authority 从 Host 当前 scope 显式收窄；terminal authority
+ * 同时复验 Host 重授权并打开的 canonical input artifacts。project preset 使用
+ * runtime.agentWorkflowProjects；普通 routes 永远不能发布/启动受保护 Workflow。
+ * 发布 Release 或 authority contract 后必须重新审核并显式更新。
+ */
+export const projectClientAgentWorkflowArtifactBindings: readonly ModuleClientAgentWorkflowArtifactProjectBinding[] =
+  [];

package/template/apps/server/src/application-services.ts

@@ -43,6 +43,9 @@ import type { DurableHandlerRegistry } from "@southwind-ai/jobs";
 // @windy-module system.storage begin
 import { collectActiveBlobRefs } from "./storage/blob-reference-registry.js";
 // @windy-module system.storage end
+// @windy-module system.agent begin
+import { clientWorkflowArtifactActiveBlobReferences } from "./agent/client-workflow-artifact/active-blob-references.js";
+// @windy-module system.agent end
 import type { createSystemRepositories } from "./system/seed.js";
 // @windy-module system.data-governance begin
 import { identityRouteConfigs } from "./system/identity-route-config.js";
@@ -175,6 +178,9 @@ export async function createApplicationServices(
             // @windy-module system.bulk-data begin
             bulkRepository,
             // @windy-module system.bulk-data end
+            // @windy-module system.agent begin
+            ...clientWorkflowArtifactActiveBlobReferences(persistence?.db),
+            // @windy-module system.agent end
           ],
           now,
         );

package/template/apps/server/src/data-access/scope-containment.test.ts

@@ -0,0 +1,31 @@
+import { expect, test } from "bun:test";
+import type { AuthorizationScopeSnapshot } from "@southwind-ai/shared";
+import { authorizationScopeContains } from "./scope-containment.js";
+
+const base = {
+  tenantId: "single-tenant",
+  actorId: "actor-1",
+  roleIds: ["analyst"],
+} satisfies Omit<AuthorizationScopeSnapshot, "grants">;
+
+test("当前多案 custom scope 可包含冻结单案 scope", () => {
+  const current: AuthorizationScopeSnapshot = {
+    ...base,
+    grants: [{ scope: "custom", dimension: "caseId", values: ["a", "b"] }],
+  };
+  const frozen: AuthorizationScopeSnapshot = {
+    ...base,
+    grants: [{ scope: "custom", dimension: "caseId", values: ["a"] }],
+  };
+  expect(authorizationScopeContains(current, frozen)).toBe(true);
+  expect(
+    authorizationScopeContains(current, {
+      ...frozen,
+      roleIds: ["role-no-longer-held"],
+    }),
+  ).toBe(false);
+  expect(authorizationScopeContains(frozen, current)).toBe(false);
+  expect(
+    authorizationScopeContains({ ...current, actorId: "other-actor" }, frozen),
+  ).toBe(false);
+});

package/template/apps/server/src/data-access/scope-containment.ts

@@ -0,0 +1,48 @@
+import type {
+  AuthorizationScopeSnapshot,
+  PersistedScopeGrant,
+} from "@southwind-ai/shared";
+
+/** 当前 Actor scope 必须覆盖冻结 Run scope；不允许反向恢复更宽权限。 */
+export function authorizationScopeContains(
+  current: AuthorizationScopeSnapshot,
+  frozen: AuthorizationScopeSnapshot,
+): boolean {
+  return (
+    current.actorId === frozen.actorId &&
+    current.tenantId === frozen.tenantId &&
+    frozen.roleIds.every((roleId) => current.roleIds.includes(roleId)) &&
+    frozen.grants.every((required) =>
+      current.grants.some((grant) => grantContains(grant, required)),
+    )
+  );
+}
+
+function grantContains(
+  current: PersistedScopeGrant,
+  frozen: PersistedScopeGrant,
+): boolean {
+  if (current.scope === "all" || current.scope === "tenant") return true;
+  if (current.scope === "self") return frozen.scope === "self";
+  if (current.scope === "custom") {
+    return (
+      frozen.scope === "custom" &&
+      current.dimension === frozen.dimension &&
+      frozen.values.every((value) => current.values.includes(value))
+    );
+  }
+  if (current.scope === "department-and-children") {
+    return (
+      (frozen.scope === "department" ||
+        frozen.scope === "department-and-children") &&
+      Boolean(current.departmentId) &&
+      current.departmentId === frozen.departmentId
+    );
+  }
+  return (
+    current.scope === "department" &&
+    frozen.scope === "department" &&
+    Boolean(current.departmentId) &&
+    current.departmentId === frozen.departmentId
+  );
+}

package/template/apps/server/src/jobs/artifact-publication.test.ts

@@ -0,0 +1,192 @@
+import { describe, expect, test } from "bun:test";
+import {
+  DurableHandlerRegistry,
+  type DurableArtifactPublicationReceipt,
+} from "@southwind-ai/jobs";
+import { artifactRef } from "@southwind-ai/storage";
+import { DurableArtifactPublicationConflictError } from "./execution-repository.js";
+import { InMemoryDurableExecutionRepository } from "./in-memory-execution.js";
+import { DurableJobService } from "./service.js";
+import { DurableJobWorker } from "./worker.js";
+
+const base = new Date("2026-08-28T09:00:00.000Z");
+const artifact = {
+  kind: "workflow-result",
+  artifactRef: artifactRef("blob_0123456789abcdef0123456789abcdef"),
+  filename: "result.json",
+  contentType: "application/json",
+  byteSize: 12,
+  sha256: "a".repeat(64),
+  ownerId: "user_1",
+  metadata: { nested: { second: 2, first: 1 } },
+};
+
+describe("durable artifact stable publication", () => {
+  test("repository 对相同发布返回首发事实并拒绝内容漂移", async () => {
+    const repository = new InMemoryDurableExecutionRepository();
+    const service = new DurableJobService(repository, () => base);
+    const submitted = await service.submit(jobInput("repository-once"));
+    const claim = await repository.claim(claimInput("worker-repository"));
+    if (!claim) throw new Error("任务未领取");
+    const publication = {
+      id: "dap_stable",
+      jobId: claim.jobId,
+      stageId: claim.stageId,
+      ...artifact,
+    };
+
+    await expect(
+      repository.publishArtifactOnce(
+        claim,
+        { ...publication, jobId: "job_forged" },
+        base,
+      ),
+    ).rejects.toBeInstanceOf(DurableArtifactPublicationConflictError);
+    await expect(
+      repository.publishArtifactOnce(
+        claim,
+        { ...publication, stageId: "stage_forged" },
+        base,
+      ),
+    ).rejects.toBeInstanceOf(DurableArtifactPublicationConflictError);
+    expect((await service.get(submitted.job.id))?.artifacts).toEqual([]);
+
+    const first = await repository.publishArtifactOnce(
+      claim,
+      publication,
+      base,
+    );
+    const replay = await repository.publishArtifactOnce(
+      claim,
+      {
+        ...publication,
+        metadata: { nested: { first: 1, second: 2 } },
+      },
+      new Date(base.getTime() + 1),
+    );
+
+    expect(replay).toEqual(first);
+    await expect(
+      repository.publishArtifactOnce(
+        claim,
+        { ...publication, filename: "drifted.json" },
+        new Date(base.getTime() + 2),
+      ),
+    ).rejects.toBeInstanceOf(DurableArtifactPublicationConflictError);
+    await expect(
+      repository.publishArtifactOnce(
+        claim,
+        { ...publication, kind: "other-result" },
+        new Date(base.getTime() + 3),
+      ),
+    ).rejects.toBeInstanceOf(DurableArtifactPublicationConflictError);
+    expect((await service.get(submitted.job.id))?.artifacts).toEqual([
+      expect.objectContaining({
+        id: "dap_stable",
+        filename: "result.json",
+        createdAt: base.toISOString(),
+      }),
+    ]);
+  });
+
+  test("Worker 从稳定坐标生成同一 receipt", async () => {
+    const repository = new InMemoryDurableExecutionRepository();
+    const service = new DurableJobService(repository, () => base);
+    const submitted = await service.submit(jobInput("worker-once"));
+    const receipts: DurableArtifactPublicationReceipt[] = [];
+    const handlers = new DurableHandlerRegistry().register({
+      key: "test.handler",
+      payload: { parse: () => ({}) },
+      execute: async (_payload, context) => {
+        receipts.push(
+          await context.publishArtifactOnce!("page-agent-final", artifact),
+        );
+        receipts.push(
+          await context.publishArtifactOnce!("page-agent-final", artifact),
+        );
+      },
+    });
+    const worker = new DurableJobWorker(repository, handlers, {
+      now: () => base,
+    });
+
+    expect(await worker.runNext("default", "worker-a")).toMatchObject({
+      status: "succeeded",
+    });
+    expect(receipts).toHaveLength(2);
+    expect(receipts[1]).toEqual(receipts[0]);
+    expect(receipts[0]?.artifactId).toMatch(/^dap_[a-f0-9]{60}$/);
+    expect((await service.get(submitted.job.id))?.artifacts).toEqual([
+      expect.objectContaining({ id: receipts[0]?.artifactId }),
+    ]);
+  });
+
+  test("取消请求阻止一次性产物写入", async () => {
+    const repository = new InMemoryDurableExecutionRepository();
+    const service = new DurableJobService(repository, () => base);
+    const submitted = await service.submit(jobInput("repository-cancelled"));
+    const claim = await repository.claim(claimInput("worker-cancelled"));
+    if (!claim) throw new Error("取消任务未领取");
+    await repository.requestCancel(claim.jobId, base);
+
+    expect(
+      await repository.publishArtifactOnce(
+        claim,
+        {
+          id: "dap_cancelled",
+          jobId: claim.jobId,
+          stageId: claim.stageId,
+          ...artifact,
+        },
+        base,
+      ),
+    ).toMatchObject({ ok: true, cancelRequested: true });
+    expect((await service.get(submitted.job.id))?.artifacts).toEqual([]);
+  });
+
+  test("Worker 将同 publicationKey 的漂移固化为不可重试失败", async () => {
+    const repository = new InMemoryDurableExecutionRepository();
+    const service = new DurableJobService(repository, () => base);
+    const submitted = await service.submit(jobInput("worker-conflict"));
+    const handlers = new DurableHandlerRegistry().register({
+      key: "test.handler",
+      payload: { parse: () => ({}) },
+      execute: async (_payload, context) => {
+        await context.publishArtifactOnce!("page-agent-final", artifact);
+        await context.publishArtifactOnce!("page-agent-final", {
+          ...artifact,
+          sha256: "b".repeat(64),
+        });
+      },
+    });
+    const worker = new DurableJobWorker(repository, handlers, {
+      now: () => base,
+    });
+
+    expect(await worker.runNext("default", "worker-a")).toMatchObject({
+      status: "failed",
+    });
+    expect(await service.get(submitted.job.id)).toMatchObject({
+      artifacts: [{ sha256: "a".repeat(64) }],
+      failures: [
+        {
+          code: "ARTIFACT_PUBLICATION_CONFLICT",
+          retryable: false,
+        },
+      ],
+    });
+  });
+});
+
+function jobInput(idempotencyKey: string) {
+  return {
+    handlerKey: "test.handler",
+    idempotencyKey,
+    payload: {},
+    requestedBy: "user_1",
+  };
+}
+
+function claimInput(workerId: string) {
+  return { queue: "default", workerId, now: base, leaseDurationMs: 30_000 };
+}

package/template/apps/server/src/jobs/artifact-publication.ts

@@ -0,0 +1,56 @@
+import type {
+  DurableJobArtifact,
+  DurableLeaseIdentity,
+} from "@southwind-ai/jobs";
+import {
+  DurableArtifactPublicationConflictError,
+  type DurableArtifactPublication,
+} from "./execution-repository.js";
+
+export function assertArtifactPublicationIdentity(
+  identity: DurableLeaseIdentity,
+  candidate: DurableArtifactPublication,
+) {
+  if (
+    candidate.jobId !== identity.jobId ||
+    candidate.stageId !== identity.stageId
+  ) {
+    throw new DurableArtifactPublicationConflictError(
+      "产物发布身份与任务租约不匹配",
+    );
+  }
+}
+
+export function sameArtifactPublication(
+  persisted: DurableJobArtifact,
+  candidate: DurableArtifactPublication,
+): boolean {
+  return (
+    persisted.id === candidate.id &&
+    persisted.jobId === candidate.jobId &&
+    persisted.stageId === candidate.stageId &&
+    persisted.kind === candidate.kind &&
+    persisted.artifactRef === candidate.artifactRef &&
+    persisted.filename === candidate.filename &&
+    persisted.contentType === candidate.contentType &&
+    persisted.byteSize === candidate.byteSize &&
+    persisted.sha256 === candidate.sha256 &&
+    persisted.ownerId === candidate.ownerId &&
+    persisted.expiresAt === candidate.expiresAt &&
+    canonicalJson(persisted.metadata) === canonicalJson(candidate.metadata)
+  );
+}
+
+function canonicalJson(value: unknown): string | undefined {
+  return JSON.stringify(canonicalValue(value));
+}
+
+function canonicalValue(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(canonicalValue);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([key, entry]) => [key, canonicalValue(entry)]),
+  );
+}

package/template/apps/server/src/jobs/artifact-publisher.ts

@@ -0,0 +1,101 @@
+import {
+  DurableHandlerError,
+  type DurableHandlerContext,
+  type DurableLeaseIdentity,
+} from "@southwind-ai/jobs";
+import { createHash } from "node:crypto";
+import {
+  DurableArtifactPublicationConflictError,
+  type DurableExecutionRepository,
+  type LeaseResult,
+} from "./execution-repository.js";
+
+export function createDurableArtifactPublisher(input: {
+  readonly repository: DurableExecutionRepository;
+  readonly identity: DurableLeaseIdentity;
+  readonly stageKey: string;
+  readonly now: () => Date;
+  readonly assertLease: (result: LeaseResult) => void;
+}): Required<
+  Pick<DurableHandlerContext, "publishArtifact" | "publishArtifactOnce">
+> {
+  return {
+    publishArtifact: async (artifact) => {
+      const result = await input.repository.publishArtifact(
+        input.identity,
+        {
+          id: Bun.randomUUIDv7(),
+          jobId: input.identity.jobId,
+          stageId: input.identity.stageId,
+          ...artifact,
+          createdAt: input.now().toISOString(),
+        },
+        input.now(),
+      );
+      input.assertLease(result);
+    },
+    publishArtifactOnce: async (publicationKey, artifact) => {
+      validatePublicationKey(publicationKey);
+      let result;
+      try {
+        result = await input.repository.publishArtifactOnce(
+          input.identity,
+          {
+            id: stableArtifactId(input.identity, publicationKey),
+            jobId: input.identity.jobId,
+            stageId: input.identity.stageId,
+            ...artifact,
+          },
+          input.now(),
+        );
+      } catch (error) {
+        if (error instanceof DurableArtifactPublicationConflictError) {
+          throw new DurableHandlerError(
+            "ARTIFACT_PUBLICATION_CONFLICT",
+            error.message,
+            false,
+          );
+        }
+        throw error;
+      }
+      if (!result.ok) {
+        input.assertLease(result);
+        throw new Error("产物发布租约校验未终结");
+      }
+      input.assertLease(result);
+      if (result.cancelRequested) {
+        throw new Error("已取消任务不应返回产物发布事实");
+      }
+      return {
+        schemaVersion: 1,
+        publicationKey,
+        artifactId: result.artifact.id,
+        jobId: input.identity.jobId,
+        stageKey: input.stageKey,
+        kind: result.artifact.kind,
+        artifactRef: result.artifact.artifactRef,
+        sha256: result.artifact.sha256,
+      };
+    },
+  };
+}
+
+function validatePublicationKey(value: string) {
+  if (!value || value !== value.trim() || value.length > 160) {
+    throw new DurableHandlerError(
+      "ARTIFACT_PUBLICATION_KEY_INVALID",
+      "产物 publicationKey 必须为 1 到 160 个非空白字符",
+      false,
+    );
+  }
+}
+
+function stableArtifactId(
+  identity: Pick<DurableLeaseIdentity, "jobId" | "stageId">,
+  publicationKey: string,
+) {
+  const digest = createHash("sha256")
+    .update(JSON.stringify([identity.jobId, identity.stageId, publicationKey]))
+    .digest("hex");
+  return `dap_${digest.slice(0, 60)}`;
+}

package/template/apps/server/src/jobs/drizzle-artifact.ts

@@ -4,13 +4,21 @@ import {
   durableJobs,
 } from "@southwind-ai/database";
 import type { DurableLeaseIdentity } from "@southwind-ai/jobs";
-import { eq } from "drizzle-orm";
+import { and, eq, or } from "drizzle-orm";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type {
+  DurableArtifactPublication,
+  DurableArtifactPublicationResult,
   DurableExecutionRepository,
   LeaseResult,
 } from "./execution-repository.js";
+import { DurableArtifactPublicationConflictError } from "./execution-repository.js";
 import { activeLeaseWhere } from "./drizzle-lease.js";
+import {
+  assertArtifactPublicationIdentity,
+  sameArtifactPublication,
+} from "./artifact-publication.js";
+import { mapArtifact } from "./drizzle-mappers.js";
 
 type Artifact = Parameters<DurableExecutionRepository["publishArtifact"]>[1];
 
@@ -53,6 +61,70 @@ export function publishDrizzleArtifact(
   });
 }
 
+export function publishDrizzleArtifactOnce(
+  db: NodePgDatabase,
+  identity: DurableLeaseIdentity,
+  artifact: DurableArtifactPublication,
+  now: Date,
+  leaseFailure: () => Promise<LeaseResult>,
+): Promise<DurableArtifactPublicationResult> {
+  return db.transaction(async (tx) => {
+    const [lease] = await tx
+      .select()
+      .from(durableJobLeases)
+      .where(activeLeaseWhere(identity, now))
+      .for("update")
+      .limit(1);
+    if (!lease) {
+      const failure = await leaseFailure();
+      if (failure.ok) {
+        throw new Error("DURABLE_ARTIFACT_LEASE_FAILURE_INVALID");
+      }
+      return failure;
+    }
+    const [job] = await tx
+      .select({ cancelRequestedAt: durableJobs.cancelRequestedAt })
+      .from(durableJobs)
+      .where(eq(durableJobs.id, identity.jobId))
+      .for("update")
+      .limit(1);
+    if (!job) return { ok: false, reason: "not-found" } as const;
+    assertArtifactPublicationIdentity(identity, artifact);
+    const expiresAt = lease.expiresAt.toISOString();
+    if (job.cancelRequestedAt) {
+      return { ok: true, cancelRequested: true, expiresAt } as const;
+    }
+    const leaseResult = {
+      ok: true,
+      cancelRequested: false,
+      expiresAt,
+    } as const;
+    const candidate = { ...artifact, createdAt: now.toISOString() };
+    const [row] = await tx
+      .select()
+      .from(durableJobArtifacts)
+      .where(
+        or(
+          eq(durableJobArtifacts.id, artifact.id),
+          and(
+            eq(durableJobArtifacts.jobId, artifact.jobId),
+            eq(durableJobArtifacts.kind, artifact.kind),
+          ),
+        ),
+      )
+      .limit(1);
+    if (row) {
+      const existing = mapArtifact(row);
+      if (!sameArtifactPublication(existing, artifact)) {
+        throw new DurableArtifactPublicationConflictError();
+      }
+      return { ...leaseResult, artifact: existing };
+    }
+    await tx.insert(durableJobArtifacts).values(toDatabaseArtifact(candidate));
+    return { ...leaseResult, artifact: candidate };
+  });
+}
+
 function toDatabaseArtifact(artifact: Artifact) {
   return {
     ...artifact,

package/template/apps/server/src/jobs/drizzle-execution-repository.ts

@@ -20,7 +20,10 @@ import type {
 } from "./execution-repository.js";
 import { DrizzleDurableRecoveryRepository } from "./drizzle-recovery-repository.js";
 import { claimDurableJob } from "./drizzle-claim.js";
-import { publishDrizzleArtifact } from "./drizzle-artifact.js";
+import {
+  publishDrizzleArtifact,
+  publishDrizzleArtifactOnce,
+} from "./drizzle-artifact.js";
 import { activeLeaseWhere } from "./drizzle-lease.js";
 
 export class DrizzleDurableExecutionRepository implements DurableExecutionRepository {
@@ -95,6 +98,16 @@ export class DrizzleDurableExecutionRepository implements DurableExecutionReposi
     );
   }
 
+  async publishArtifactOnce(
+    identity: DurableLeaseIdentity,
+    artifact: Parameters<DurableExecutionRepository["publishArtifactOnce"]>[1],
+    now: Date,
+  ) {
+    return publishDrizzleArtifactOnce(this.db, identity, artifact, now, () =>
+      this.leaseFailure(identity, now),
+    );
+  }
+
   async complete(identity: DurableLeaseIdentity, now: Date) {
     return this.db.transaction(async (tx) => {
       const [lease] = await tx