create-windy 0.6.14 → 0.6.16

package/template/apps/server/src/module-host/storage-port.ts

@@ -14,6 +14,7 @@ import {
   type UploadAuthorizationBinding,
   type FileMetadata,
   type FileService,
+  type BlobStore,
   type UploadSession,
   type UploadService,
 } from "@southwind-ai/storage";
@@ -21,6 +22,8 @@ import {
 export interface ModuleStorageServices {
   uploads: UploadService;
   files: FileService;
+  /** Host-only Durable publication seam；ModuleStoragePort 不暴露 BlobStore。 */
+  blobStore?: BlobStore;
 }
 
 export interface ModuleStorageScope {

package/template/apps/server/src/module-host/workflow-input-artifact-port.test.ts

@@ -0,0 +1,104 @@
+import { expect, test } from "bun:test";
+import type { DurableHandlerArtifactInput } from "@southwind-ai/jobs";
+import { MemoryBlobStore } from "@southwind-ai/storage";
+import { createModuleWorkflowInputArtifactPublicationPort } from "./workflow-input-artifact-port.js";
+
+test("Storage resource 经真实 Durable publication 后才成为 Workflow artifact ref", async () => {
+  const blobs = new MemoryBlobStore();
+  const published: DurableHandlerArtifactInput[] = [];
+  const port = createModuleWorkflowInputArtifactPublicationPort({
+    moduleName: "case",
+    actorId: "actor-1",
+    blobs,
+    storage: {
+      async openResourceFile() {
+        const bytes = new TextEncoder().encode('{"caseId":"case-1"}');
+        return {
+          id: "file_storage_only",
+          purpose: "case-evidence",
+          filename: "case.json",
+          mimeType: "application/json",
+          byteSize: bytes.byteLength,
+          sha256:
+            "b749cb42fc25c341604392803be93cd89343609feddd5d93d5b6596e6d7d31e9",
+          body: new Blob([bytes]).stream(),
+        };
+      },
+    },
+    durable: {
+      jobId: "job-1",
+      stageKey: "prepare",
+      attemptNumber: 1,
+      signal: new AbortController().signal,
+      heartbeat: async () => undefined,
+      progress: async () => undefined,
+      publishArtifact: async () => undefined,
+      async publishArtifactOnce(publicationKey, artifact) {
+        published.push(artifact);
+        return {
+          schemaVersion: 1,
+          publicationKey,
+          artifactId: "dap_real_artifact",
+          jobId: "job-1",
+          stageKey: "prepare",
+          kind: artifact.kind,
+          artifactRef: artifact.artifactRef,
+          sha256: artifact.sha256,
+        };
+      },
+    },
+  });
+
+  const result = await port.publishResource({
+    publicationKey: "case-input-v1",
+    kind: "case-snapshot",
+    filename: "case.json",
+    retentionPolicyKey: "case.analysis",
+    resource: {
+      fileId: "file_storage_only",
+      purpose: "case-evidence",
+      resourceType: "case",
+      resourceId: "case-1",
+    },
+    source: {
+      kind: "case",
+      id: "case-1",
+      version: "42",
+      sequence: 42,
+      digest: `sha256:${"a".repeat(64)}`,
+    },
+  });
+
+  expect(result.artifactId).toBe("dap_real_artifact");
+  expect(result.artifactId).not.toBe("file_storage_only");
+  expect(result.source).toEqual({
+    moduleKey: "case",
+    kind: "case",
+    id: "case-1",
+    version: "42",
+    sequence: 42,
+    digest: `sha256:${"a".repeat(64)}`,
+  });
+  expect(published[0]?.metadata).toMatchObject({
+    sourceModuleKey: "case",
+    sourceId: "case-1",
+    retentionPolicyKey: "case.analysis",
+  });
+  expect(blobs.size).toBe(1);
+  await expect(
+    port.publishJson({
+      publicationKey: "invalid-json",
+      kind: "case-snapshot",
+      filename: "invalid.json",
+      retentionPolicyKey: "case.analysis",
+      source: {
+        kind: "case",
+        id: "case-1",
+        version: "42",
+        sequence: 42,
+      },
+      value: undefined as never,
+    }),
+  ).rejects.toMatchObject({ code: "WORKFLOW_INPUT_ARTIFACT_INVALID" });
+  expect(blobs.size).toBe(1);
+});

package/template/apps/server/src/module-host/workflow-input-artifact-port.ts

@@ -0,0 +1,229 @@
+import { createHash } from "node:crypto";
+import {
+  DurableHandlerError,
+  type DurableHandlerContext,
+} from "@southwind-ai/jobs";
+import {
+  parseModuleWorkflowInputJsonArtifactV1,
+  parseModuleWorkflowInputResourceArtifactV1,
+  type ModuleDurableStoragePort,
+  type ModuleWorkflowInputArtifactPublicationPortV1,
+  type ModuleWorkflowInputArtifactSourceV1,
+} from "@southwind-ai/server-sdk";
+import type { AgentWorkflowArtifactRef, JsonValue } from "@southwind-ai/shared";
+import {
+  artifactRef,
+  type BlobStore,
+  type ContentHash,
+} from "@southwind-ai/storage";
+
+export function createModuleWorkflowInputArtifactPublicationPort(input: {
+  readonly moduleName: string;
+  readonly actorId: string;
+  readonly storage: ModuleDurableStoragePort;
+  readonly blobs: BlobStore;
+  readonly durable: DurableHandlerContext;
+}): ModuleWorkflowInputArtifactPublicationPortV1 {
+  return {
+    async publishResource(spec) {
+      const parsed = parseResource(spec);
+      const opened = await input.storage.openResourceFile(parsed.resource);
+      return publish(input, {
+        ...parsed,
+        mediaType: opened.mimeType,
+        byteSize: opened.byteSize,
+        sha256: opened.sha256,
+        body: opened.body,
+      });
+    },
+    async publishJson(spec) {
+      const parsed = parseJsonArtifact(spec);
+      const bytes = new TextEncoder().encode(stableJson(parsed.value));
+      return publish(input, {
+        ...parsed,
+        mediaType: "application/json",
+        byteSize: bytes.byteLength,
+        sha256: sha256(bytes),
+        body: new Blob([bytes]).stream(),
+      });
+    },
+  };
+}
+
+export function moduleWorkflowInputArtifactContext(
+  moduleName: string,
+  actorId: string,
+  storage: ModuleDurableStoragePort,
+  blobs: BlobStore | undefined,
+  durable: DurableHandlerContext,
+) {
+  return blobs
+    ? {
+        workflowInputArtifacts:
+          createModuleWorkflowInputArtifactPublicationPort({
+            moduleName,
+            actorId,
+            storage,
+            blobs,
+            durable,
+          }),
+      }
+    : {};
+}
+
+async function publish(
+  host: {
+    moduleName: string;
+    actorId: string;
+    blobs: BlobStore;
+    durable: DurableHandlerContext;
+  },
+  artifact: {
+    publicationKey: string;
+    kind: string;
+    filename: string;
+    retentionPolicyKey: string;
+    source: ModuleWorkflowInputArtifactSourceV1;
+    mediaType: string;
+    byteSize: number;
+    sha256: string;
+    body: ReadableStream<Uint8Array>;
+  },
+): Promise<AgentWorkflowArtifactRef> {
+  assertCoordinate(artifact);
+  if (!host.blobs.putOnce || !host.durable.publishArtifactOnce) {
+    throw unavailable();
+  }
+  const ref = artifactRef(
+    `blob_${sha256Text(
+      JSON.stringify([
+        host.durable.jobId,
+        host.durable.stageKey,
+        artifact.publicationKey,
+      ]),
+    ).slice(0, 32)}`,
+  );
+  const expectedContentHash: ContentHash = {
+    algorithm: "sha256",
+    value: artifact.sha256,
+  };
+  const stored = await host.blobs.putOnce({
+    ref,
+    body: artifact.body,
+    expectedByteSize: artifact.byteSize,
+    expectedContentHash,
+  });
+  const receipt = await host.durable.publishArtifactOnce(
+    artifact.publicationKey,
+    {
+      kind: artifact.kind,
+      artifactRef: stored.ref,
+      filename: artifact.filename,
+      contentType: artifact.mediaType,
+      byteSize: stored.byteSize,
+      sha256: stored.contentHash.value,
+      ownerId: host.actorId,
+      metadata: {
+        publicationKey: artifact.publicationKey,
+        retentionPolicyKey: artifact.retentionPolicyKey,
+        sourceModuleKey: host.moduleName,
+        sourceKind: artifact.source.kind,
+        sourceId: artifact.source.id,
+        sourceVersion: artifact.source.version,
+        sourceSequence: artifact.source.sequence,
+        ...(artifact.source.digest
+          ? { sourceDigest: artifact.source.digest }
+          : {}),
+      },
+    },
+  );
+  return {
+    artifactId: receipt.artifactId,
+    kind: artifact.kind,
+    mediaType: artifact.mediaType,
+    byteSize: stored.byteSize,
+    sha256: stored.contentHash.value,
+    retentionPolicyKey: artifact.retentionPolicyKey,
+    source: { moduleKey: host.moduleName, ...artifact.source },
+  };
+}
+
+function assertCoordinate(input: {
+  publicationKey: string;
+  kind: string;
+  filename: string;
+  retentionPolicyKey: string;
+  source: ModuleWorkflowInputArtifactSourceV1;
+}) {
+  const text = [
+    input.publicationKey,
+    input.kind,
+    input.filename,
+    input.retentionPolicyKey,
+    input.source.kind,
+    input.source.id,
+    input.source.version,
+  ];
+  if (
+    text.some((value) => !value.trim() || value !== value.trim()) ||
+    !Number.isSafeInteger(input.source.sequence) ||
+    input.source.sequence < 1
+  ) {
+    throw new DurableHandlerError(
+      "WORKFLOW_INPUT_ARTIFACT_INVALID",
+      "Workflow input artifact 坐标无效",
+      false,
+    );
+  }
+}
+
+function stableJson(value: JsonValue): string {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.keys(value)
+      .sort()
+      .map((key) => `${JSON.stringify(key)}:${stableJson(value[key]!)}`)
+      .join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+function sha256(bytes: Uint8Array) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+
+function sha256Text(value: string) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function unavailable() {
+  return new DurableHandlerError(
+    "WORKFLOW_INPUT_ARTIFACT_UNAVAILABLE",
+    "Workflow input artifact publication 未装配",
+    false,
+  );
+}
+
+function parseResource(value: unknown) {
+  try {
+    return parseModuleWorkflowInputResourceArtifactV1(value);
+  } catch {
+    throw invalid();
+  }
+}
+
+function parseJsonArtifact(value: unknown) {
+  try {
+    return parseModuleWorkflowInputJsonArtifactV1(value);
+  } catch {
+    throw invalid();
+  }
+}
+
+function invalid() {
+  return new DurableHandlerError(
+    "WORKFLOW_INPUT_ARTIFACT_INVALID",
+    "Workflow input artifact 输入无效",
+    false,
+  );
+}

package/template/apps/server/src/module-host/workflow-input-materialization.test.ts

@@ -0,0 +1,163 @@
+import { expect, test } from "bun:test";
+import type { DurableJobSnapshot, DurableJobs } from "@southwind-ai/jobs";
+import type { ModuleJobPort } from "@southwind-ai/server-sdk";
+import { artifactRef } from "@southwind-ai/storage";
+import { buildScopeContext } from "../data-access/context.js";
+import { captureAuthorizationScope } from "../data-access/scope-snapshot.js";
+import type { RequestGuardContext } from "../guards.js";
+import { createModuleWorkflowInputMaterializationPort } from "./workflow-input-materialization.js";
+
+test("两阶段 coordinator 只在真实 module Job succeeded 后返回正式 artifact refs", async () => {
+  const context = guard();
+  const source = {
+    mode: "json" as const,
+    publicationKey: "case-1-v7",
+    kind: "structured-data",
+    filename: "case-1.json",
+    retentionPolicyKey: "case.analysis",
+    source: {
+      kind: "case",
+      id: "case-1",
+      version: "7",
+      sequence: 7,
+      digest: `sha256:${"a".repeat(64)}`,
+    },
+    value: { caseId: "case-1" },
+  };
+  let status: "running" | "succeeded" = "running";
+  let submittedPayload: Record<string, unknown> | undefined;
+  const snapshot = (): DurableJobSnapshot => ({
+    job: {
+      id: "job-real",
+      handlerKey: "case.workflow-input-materialize",
+      queue: "case",
+      status,
+      idempotencyKey: "materialize-case-1",
+      payload: submittedPayload!,
+      requestedBy: "actor-1",
+      authorizationScope: captureAuthorizationScope(context.actor.scopeContext)
+        .snapshot,
+      priority: 0,
+      maxAttempts: 3,
+      timeoutSeconds: 900,
+      availableAt: "2026-08-28T00:00:00.000Z",
+      createdAt: "2026-08-28T00:00:00.000Z",
+      updatedAt: "2026-08-28T00:00:00.000Z",
+    },
+    stages: [],
+    attempts: [],
+    leases: [],
+    progress: [],
+    failures: [],
+    recoveries: [],
+    artifacts:
+      status === "succeeded"
+        ? [
+            {
+              id: "dap_real",
+              jobId: "job-real",
+              kind: source.kind,
+              artifactRef: artifactRef(`blob_${"b".repeat(32)}`),
+              filename: source.filename,
+              contentType: "application/json",
+              byteSize: 19,
+              sha256: "c".repeat(64),
+              ownerId: "actor-1",
+              metadata: {
+                publicationKey: source.publicationKey,
+                retentionPolicyKey: source.retentionPolicyKey,
+                sourceModuleKey: "case",
+                sourceKind: source.source.kind,
+                sourceId: source.source.id,
+                sourceVersion: source.source.version,
+                sourceSequence: source.source.sequence,
+                sourceDigest: source.source.digest,
+              },
+              createdAt: "2026-08-28T00:00:00.000Z",
+            },
+          ]
+        : [],
+  });
+  const moduleJobs = {
+    async submit(input) {
+      submittedPayload = input.payload;
+      return { jobId: "job-real", created: true };
+    },
+    async get() {
+      return undefined;
+    },
+    async cancel() {
+      throw new Error("not used");
+    },
+    async recover() {
+      throw new Error("not used");
+    },
+  } satisfies ModuleJobPort;
+  const jobs = {
+    async submit() {
+      throw new Error("coordinator must use scoped module job port");
+    },
+    async get() {
+      return snapshot();
+    },
+    async list() {
+      return [];
+    },
+  } satisfies DurableJobs;
+  const port = createModuleWorkflowInputMaterializationPort({
+    moduleName: "case",
+    guardContext: context,
+    jobs,
+    moduleJobs,
+  });
+
+  const handle = await port.begin({
+    idempotencyKey: "materialize-case-1",
+    sources: [source],
+  });
+  await expect(port.resolve(handle)).resolves.toEqual({
+    ...handle,
+    status: "pending",
+  });
+  status = "succeeded";
+  await expect(port.resolve(handle)).resolves.toMatchObject({
+    status: "ready",
+    artifacts: [{ artifactId: "dap_real", source: { moduleKey: "case" } }],
+  });
+  expect(submittedPayload).toEqual({ schemaVersion: 1, sources: [source] });
+  await expect(
+    port.begin({
+      idempotencyKey: "materialize-invalid",
+      sources: [{ ...source, value: Number.POSITIVE_INFINITY }],
+    }),
+  ).rejects.toMatchObject({ code: "MATERIALIZATION_RESULT_INVALID" });
+});
+
+function guard(): RequestGuardContext {
+  const scope = buildScopeContext(
+    "actor-1",
+    undefined,
+    [
+      {
+        id: "analyst",
+        code: "analyst",
+        dataScope: "custom",
+        departmentIds: ["case-1", "case-2"],
+      },
+    ],
+    [{ scope: "custom", dimension: "caseId", values: ["case-1", "case-2"] }],
+  );
+  return {
+    requestId: "request-1",
+    actor: {
+      id: "actor-1",
+      type: "user",
+      name: "analyst",
+      roleCodes: ["analyst"],
+      permissionKeys: ["case.analysis"],
+      dataAccess: scope,
+      scopeContext: scope,
+    },
+    startedAt: "2026-08-28T00:00:00.000Z",
+  };
+}

package/template/apps/server/src/module-host/workflow-input-materialization.ts

@@ -0,0 +1,161 @@
+import type { DurableJobArtifact, DurableJobs } from "@southwind-ai/jobs";
+import {
+  ModuleWorkflowInputMaterializationError,
+  moduleWorkflowInputMaterializationHandlerKey,
+  parseModuleWorkflowInputMaterializationBeginV1,
+  parseModuleWorkflowInputMaterializationPayloadV1,
+  type ModuleJobPort,
+  type ModuleWorkflowInputMaterializationPortV1,
+  type ModuleWorkflowInputMaterializationSourceV1,
+} from "@southwind-ai/server-sdk";
+import type { AgentWorkflowArtifactRef } from "@southwind-ai/shared";
+import type { RequestGuardContext } from "../guards.js";
+import { captureAuthorizationScope } from "../data-access/scope-snapshot.js";
+import { authorizationScopeContains } from "../data-access/scope-containment.js";
+
+export function createModuleWorkflowInputMaterializationPort(input: {
+  readonly moduleName: string;
+  readonly guardContext: RequestGuardContext;
+  readonly jobs: DurableJobs;
+  readonly moduleJobs: ModuleJobPort;
+  readonly reauthorize?: () => Promise<boolean>;
+}): ModuleWorkflowInputMaterializationPortV1 {
+  const handlerKey = moduleWorkflowInputMaterializationHandlerKey(
+    input.moduleName,
+  );
+  return {
+    async begin(request) {
+      let parsed;
+      try {
+        parsed = parseModuleWorkflowInputMaterializationBeginV1(request);
+      } catch {
+        throw invalid();
+      }
+      const submitted = await input.moduleJobs.submit({
+        handlerKey,
+        idempotencyKey: parsed.idempotencyKey,
+        payload: {
+          schemaVersion: 1,
+          sources: parsed.sources,
+        },
+      });
+      return { materializationId: submitted.jobId };
+    },
+    async resolve(handle) {
+      const snapshot = await currentSnapshot(input, handle.materializationId);
+      if (["queued", "running"].includes(snapshot.job.status)) {
+        return { ...handle, status: "pending" };
+      }
+      if (snapshot.job.status !== "succeeded") throw failed();
+      const sources = payloadSources(snapshot.job.payload);
+      if (snapshot.artifacts.length !== sources.length) throw invalid();
+      const artifacts = sources.map((source) =>
+        projectArtifact(snapshot.artifacts, source, input),
+      );
+      if (
+        new Set(artifacts.map(({ artifactId }) => artifactId)).size !==
+        artifacts.length
+      ) {
+        throw invalid();
+      }
+      return { ...handle, status: "ready", artifacts };
+    },
+    async cancel(handle) {
+      const current = await input.moduleJobs.get(handle.materializationId);
+      if (!current || current.handlerKey !== handlerKey) throw unavailable();
+      if (current.status === "cancelled") return;
+      if (!["queued", "running"].includes(current.status)) throw unavailable();
+      await input.moduleJobs.cancel({
+        jobId: handle.materializationId,
+        reason: handle.reason,
+        expectedStatus: current.status,
+        expectedVersion: current.version,
+      });
+    },
+  };
+}
+
+async function currentSnapshot(
+  input: Parameters<typeof createModuleWorkflowInputMaterializationPort>[0],
+  jobId: string,
+) {
+  if (input.reauthorize && !(await input.reauthorize())) throw unavailable();
+  const snapshot = await input.jobs.get(jobId);
+  const current = captureAuthorizationScope(
+    input.guardContext.actor.scopeContext,
+  ).snapshot;
+  const job = snapshot?.job;
+  if (
+    !snapshot ||
+    !job?.authorizationScope ||
+    job.queue !== input.moduleName ||
+    job.handlerKey !==
+      moduleWorkflowInputMaterializationHandlerKey(input.moduleName) ||
+    job.requestedBy !== input.guardContext.actor.id ||
+    !authorizationScopeContains(current, job.authorizationScope)
+  ) {
+    throw unavailable();
+  }
+  return snapshot;
+}
+
+function payloadSources(payload: Record<string, unknown>) {
+  try {
+    return parseModuleWorkflowInputMaterializationPayloadV1(payload).sources;
+  } catch {
+    throw invalid();
+  }
+}
+
+function projectArtifact(
+  artifacts: readonly DurableJobArtifact[],
+  source: ModuleWorkflowInputMaterializationSourceV1,
+  input: { moduleName: string; guardContext: RequestGuardContext },
+): AgentWorkflowArtifactRef {
+  const artifact = artifacts.find(
+    ({ metadata }) => metadata?.publicationKey === source.publicationKey,
+  );
+  const metadata = artifact?.metadata;
+  if (
+    !artifact ||
+    artifact.ownerId !== input.guardContext.actor.id ||
+    metadata?.sourceModuleKey !== input.moduleName ||
+    metadata.sourceKind !== source.source.kind ||
+    metadata.sourceId !== source.source.id ||
+    metadata.sourceVersion !== source.source.version ||
+    metadata.sourceSequence !== source.source.sequence ||
+    metadata.sourceDigest !== source.source.digest ||
+    metadata.retentionPolicyKey !== source.retentionPolicyKey ||
+    artifact.kind !== source.kind
+  ) {
+    throw invalid();
+  }
+  return {
+    artifactId: artifact.id,
+    kind: artifact.kind,
+    mediaType: artifact.contentType,
+    byteSize: artifact.byteSize,
+    sha256: artifact.sha256,
+    retentionPolicyKey: source.retentionPolicyKey,
+    source: {
+      moduleKey: input.moduleName,
+      ...source.source,
+    },
+  };
+}
+
+function unavailable() {
+  return new ModuleWorkflowInputMaterializationError(
+    "MATERIALIZATION_UNAVAILABLE",
+  );
+}
+
+function failed() {
+  return new ModuleWorkflowInputMaterializationError("MATERIALIZATION_FAILED");
+}
+
+function invalid() {
+  return new ModuleWorkflowInputMaterializationError(
+    "MATERIALIZATION_RESULT_INVALID",
+  );
+}

package/template/apps/server/src/workflow/drizzle-repository.integration.test.ts

@@ -32,6 +32,7 @@ describePostgres("PostgreSQL 最小审批 Repository", () => {
     await pool.query(`truncate table
       governed_export_requests,
       bulk_data_artifacts, bulk_data_jobs, scheduled_task_runs,
+      client_agent_workflow_artifacts,
       durable_job_recoveries, durable_job_failures, durable_job_artifacts,
       durable_job_progress, durable_job_leases, durable_job_attempts,
       durable_job_stages, durable_jobs,

package/template/apps/web/src/pages/system/components/ai-runtime/AiRuntimeFilters.vue

@@ -55,7 +55,8 @@ function searchActors() {
         :key="item.value"
         size="sm"
         class="h-8 px-3"
-        :variant="range === item.value ? 'secondary' : 'ghost'"
+        :variant="range === item.value ? 'default' : 'ghost'"
+        :aria-pressed="range === item.value"
         :disabled="disabled"
         @click="emit('update:range', item.value)"
       >