create-windy 0.8.3 → 0.10.0

package/template/apps/agent-server/scripts/documents-delivery-check.mjs

@@ -0,0 +1,309 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { createServer } from "node:http";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { mkdtemp, mkdir, readFile, writeFile, symlink } from "node:fs/promises";
+import { join } from "node:path";
+import { Context } from "@deepseek-ai/cordis";
+import { LocalFileSystem } from "@deepseek-ai/dsh-fs-local";
+import {
+  SessionId,
+  SessionSeq,
+  SessionLogOffset,
+} from "@deepseek-ai/dsh-session/types";
+import { apply as installDownloads } from "../plugins/downloads/index.mjs";
+
+// Synthetic coordinates/authentication below exercise the production download
+// adapter and actual filesystem/HTTP transport; this is not browser acceptance.
+assert.equal(process.platform, "linux");
+assert.equal(process.arch, "arm64");
+assert.equal(process.getuid(), 20000);
+const exec = promisify(execFile);
+const fixture = process.env.WINDY_DOCUMENT_FIXTURE_DIR || "/fixtures";
+const root = await mkdtemp("/tmp/windy-documents-delivery-");
+const workspace = join(root, "workspace");
+await mkdir(workspace, { mode: 0o700 });
+const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const inputs = ["platform-example.json", "source.docx", "users.xlsx"];
+const before = Object.fromEntries(
+  await Promise.all(
+    inputs.map(async (name) => [
+      name,
+      hash(await readFile(join(fixture, name))),
+    ]),
+  ),
+);
+const proof = JSON.parse(await readFile(join(fixture, inputs[0]), "utf8"));
+assert.equal(proof.synthetic, true);
+assert.equal(proof.tool, "system.users.list");
+assert.equal(proof.userCount, 1);
+assert.ok(proof.checks.includes("actual-platform-tool-registry"));
+assert.ok(proof.checks.includes("official-dsh-loop"));
+const skill = await readFile(
+  new URL("../plugins/skills/windy-office/SKILL.md", import.meta.url),
+  "utf8",
+);
+assert.match(skill, /name: windy-office/);
+for (const rule of ["生成新文件", "保留原件", "独立回读", "未验证的版式"])
+  assert.ok(skill.includes(rule));
+
+const python = String.raw`
+import hashlib, json, sys
+from pathlib import Path
+from docx import Document
+from openpyxl import Workbook, load_workbook
+sys.path.insert(0, "/opt/windy-documents")
+from office import read_text, write_revision, save_new
+
+source, output = Path(sys.argv[1]), Path(sys.argv[2])
+proof = json.loads((source / "platform-example.json").read_text())
+digest = lambda p: hashlib.sha256(p.read_bytes()).hexdigest()
+originals = {n: digest(source / n) for n in ("source.docx", "users.xlsx", "platform-example.json")}
+source_text = read_text(source / "source.docx")
+assert proof["answer"] in source_text and proof["tool"] in source_text
+docx = output / "平台用户核验报告.docx"
+revision = source_text + "\n核验记录：本次样本中的授权平台用户数为 " + str(proof["userCount"]) + "。\n来源快照 SHA256：" + originals["platform-example.json"]
+write_revision(source / "source.docx", docx, revision, "平台用户核验报告")
+# Independent output parse: do not reuse the generator's in-memory Document.
+parsed = Document(docx)
+paragraphs = [p.text for p in parsed.paragraphs]
+assert proof["answer"] in "\n".join(paragraphs)
+assert proof["tool"] in "\n".join(paragraphs)
+assert originals["platform-example.json"] in "\n".join(paragraphs)
+assert originals["source.docx"] in parsed.core_properties.subject
+
+original = load_workbook(source / "users.xlsx", read_only=True, data_only=False)
+try:
+    cells = list(original.active.iter_rows())
+    assert [[c.value for c in r] for r in cells] == [["编号", "平台用户数"], ["001", proof["userCount"]]]
+    assert all(c.data_type != "f" for r in cells for c in r)
+    workbook = Workbook()
+    sheet = workbook.active
+    sheet.title = "平台用户核验"
+    for row in cells:
+        sheet.append([cell.value for cell in row])
+    sheet["A2"].number_format = "@"
+    attribution = workbook.create_sheet("来源说明")
+    attribution.append(["来源工具", proof["tool"]])
+    attribution.append(["来源 SHA256", originals["users.xlsx"]])
+    attribution.append(["快照 SHA256", originals["platform-example.json"]])
+    attribution.append(["验证边界", "合成 Provider 与示例平台数据；未调用客户模型"])
+    xlsx = output / "平台用户核验表.xlsx"
+    save_new(workbook, xlsx)
+finally:
+    original.close()
+for data_only in (False, True):
+    checked = load_workbook(xlsx, read_only=True, data_only=data_only)
+    try:
+        values = list(checked["平台用户核验"].values)
+        assert values == [("编号", "平台用户数"), ("001", proof["userCount"])]
+        assert checked["平台用户核验"]["A2"].data_type == "s"
+        sources = dict(checked["来源说明"].values)
+        assert sources["来源工具"] == proof["tool"]
+        assert sources["来源 SHA256"] == originals["users.xlsx"]
+    finally:
+        checked.close()
+assert all(digest(source / name) == value for name, value in originals.items())
+print(json.dumps({"userCount": proof["userCount"], "leadingZeroIdentifier": "001", "docxParagraphs": len(paragraphs), "sourcePreserved": True, "files": {p.name: {"sha256": digest(p), "bytes": p.stat().st_size} for p in (docx, xlsx)}, "layoutAndPagination": "not-verified", "formulaRecalculation": "not-applicable-no-formulas"}, ensure_ascii=False))
+`;
+const generated = await exec(
+  "/opt/venv/bin/python",
+  ["-c", python, fixture, workspace],
+  { timeout: 30000, maxBuffer: 1024 * 1024 },
+);
+assert.equal(generated.stderr, "");
+const documents = JSON.parse(generated.stdout);
+assert.equal(documents.sourcePreserved, true);
+const filenames = Object.keys(documents.files);
+const privatePath = join(root, "不可下载.docx");
+await writeFile(privatePath, "private-outside-workspace");
+await symlink(privatePath, join(workspace, "越界链接.docx"));
+
+const service = new Context();
+const fs = new LocalFileSystem(service, {
+  cwd: workspace,
+  diffBasisMaxBytes: 10485760,
+});
+let reads = 0,
+  registered;
+const cleanups = [];
+const ctx = {
+  fs,
+  sandboxPolicy: { workspaceRoot: workspace },
+  connection: {
+    requestRejection: (request) =>
+      request.headers.get("cookie") === "native=synthetic-owner"
+        ? undefined
+        : 401,
+  },
+  sessionQuery: {
+    async readEvent(request) {
+      reads++;
+      if (request.sessionId !== "document-session" || request.seq !== 2)
+        throw new Error("SYNTHETIC_SESSION_NOT_FOUND");
+      const target = {
+        seq: SessionSeq(2),
+        time: Date.now(),
+        type: "deliverables/presented",
+        data: {
+          turn: 1,
+          callId: "synthetic-present",
+          files: [
+            ...filenames.map((path) => ({ path })),
+            { path: "../不可下载.docx" },
+            { path: "越界链接.docx" },
+          ],
+        },
+      };
+      return {
+        session: {
+          id: SessionId("document-session"),
+          cwd: workspace,
+          createdAt: Date.now(),
+          version: 4,
+          isSeeded: false,
+        },
+        inheritedEventCount: SessionLogOffset(0),
+        target,
+        events: [target],
+        startSeq: SessionSeq(2),
+        endSeq: SessionSeq(2),
+      };
+    },
+  },
+  get: () => undefined,
+  webServer: {
+    register(route) {
+      assert.equal(route.path, "/windy/download");
+      registered = route;
+      return () => {
+        registered = undefined;
+      };
+    },
+  },
+  effect(action) {
+    const cleanup = action();
+    if (typeof cleanup === "function") cleanups.push(cleanup);
+  },
+};
+installDownloads(ctx);
+assert.ok(registered);
+const server = createServer((request, response) => {
+  if (new URL(request.url, "http://internal").pathname !== registered.path) {
+    response.writeHead(404).end();
+    return;
+  }
+  void registered.handler(request, response).catch(() => {
+    response.writeHead(500).end();
+  });
+});
+await new Promise((accept) => server.listen(0, "127.0.0.1", accept));
+const address = server.address();
+const endpoint = `http://127.0.0.1:${address.port}/windy/download`;
+const get = (query, authenticated = true) =>
+  fetch(`${endpoint}?${query}`, {
+    headers: authenticated ? { cookie: "native=synthetic-owner" } : {},
+    signal: AbortSignal.timeout(5000),
+  });
+const query = (index, session = "document-session") =>
+  `kind=present&sessionId=${session}&seq=2&index=${index}`;
+const downloads = [];
+try {
+  const beforeUnauthenticated = reads;
+  const anonymous = await get(query(0), false);
+  assert.equal(anonymous.status, 401);
+  await anonymous.body.cancel();
+  assert.equal(reads, beforeUnauthenticated);
+  for (const [index, filename] of filenames.entries()) {
+    const response = await get(query(index));
+    assert.equal(response.status, 200);
+    const bytes = Buffer.from(await response.arrayBuffer());
+    const expected = await readFile(join(workspace, filename));
+    assert.deepEqual(bytes, expected);
+    assert.equal(hash(bytes), documents.files[filename].sha256);
+    assert.equal(bytes.length, documents.files[filename].bytes);
+    assert.ok(
+      response.headers
+        .get("content-disposition")
+        .includes(`filename*=UTF-8''${encodeURIComponent(filename)}`),
+    );
+    assert.equal(response.headers.get("cache-control"), "no-store");
+    assert.equal(response.headers.get("x-content-type-options"), "nosniff");
+    assert.equal(
+      response.headers.get("content-type"),
+      filename.endsWith(".docx")
+        ? "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
+        : "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    );
+    downloads.push({
+      filename,
+      bytes: bytes.length,
+      sha256: hash(bytes),
+      unicodeFilename: true,
+    });
+  }
+  for (const [parameters, status] of [
+    [query(0, "another-session"), 404],
+    [query(2), 404],
+    [query(3), 404],
+    [query(99), 404],
+    [query(0) + "&path=/etc/passwd", 400],
+  ]) {
+    const rejected = await get(parameters);
+    assert.equal(rejected.status, status);
+    const body = await rejected.text();
+    assert.ok(!body.includes("private-outside-workspace"));
+  }
+  for (const name of inputs)
+    assert.equal(hash(await readFile(join(fixture, name))), before[name]);
+  console.log(
+    JSON.stringify(
+      {
+        validation: "synthetic-linux-arm64-document-http-delivery",
+        runtime: {
+          node: process.version,
+          architecture: process.arch,
+          uid: process.getuid(),
+        },
+        skill: {
+          name: "windy-office",
+          sha256: hash(skill),
+          source: "image-bundled-read-only",
+        },
+        platformEvidence: {
+          sha256: before["platform-example.json"],
+          tool: proof.tool,
+          userCount: proof.userCount,
+        },
+        documents,
+        downloads,
+        checks: {
+          realLocalFileSystem: true,
+          productionDownloadPlugin: true,
+          realLoopbackHttp: true,
+          unauthenticatedRejectedBeforeSessionRead: true,
+          anotherSessionRejected: true,
+          outsideWorkspaceRejected: true,
+          symlinkRejected: true,
+          browserPathsRejected: true,
+          sourceInputsPreserved: true,
+        },
+        boundaries: {
+          sessionCoordinates: "explicit-synthetic-fixture",
+          connectionIdentity: "explicit-synthetic-fixture",
+          browserAcceptance: false,
+          realCustomerModel: false,
+          automaticBusinessArchive: false,
+          pdfPreview: "separately-verified-not-repeated",
+        },
+      },
+      null,
+      2,
+    ),
+  );
+} finally {
+  server.closeAllConnections();
+  await new Promise((accept) => server.close(() => accept()));
+  for (const cleanup of cleanups.reverse()) cleanup();
+}

package/template/apps/agent-server/scripts/office-preview-check.mjs

@@ -0,0 +1,92 @@
+/** Opt-in immutable-image probe; input must be a synthetic DOCX fixture. */
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import { Context } from "@deepseek-ai/cordis";
+import OfficeToPdf, { OfficeSourceKey } from "@deepseek-ai/dsh-office-to-pdf";
+
+const config = JSON.parse(process.env.WINDY_OFFICE_TEST_CONFIG);
+const bytes = new Uint8Array(await readFile("/fixture/source.docx"));
+const ctx = new Context();
+const scope = ctx.plugin(OfficeToPdf, config);
+await scope.await();
+const service = ctx.get("officeToPdf");
+assert(service, "Office conversion provider must mount");
+const source = (input, version = "synthetic-v1") => ({
+  key: OfficeSourceKey(`synthetic:${version}`),
+  version,
+  bytes: input.length,
+  read: async (signal, limit) => {
+    signal.throwIfAborted();
+    assert(input.length <= limit);
+    return { bytes: input, version };
+  },
+});
+const started = performance.now();
+try {
+  const result = await service.convert({
+    extension: "docx",
+    priority: "foreground",
+    source: source(bytes),
+  });
+  const pdf = Buffer.from(result.pdf);
+  assert.match(pdf.subarray(0, 8).toString(), /^%PDF-\d\.\d/);
+  assert(pdf.subarray(-1024).toString().trimEnd().endsWith("%%EOF"));
+  assert(pdf.length <= config.maxOutputBytes);
+  let readOversized = false;
+  await assert.rejects(
+    service.convert({
+      extension: "docx",
+      priority: "foreground",
+      source: {
+        ...source(bytes, "oversized"),
+        bytes: config.maxInputBytes + 1,
+        read: async () => {
+          readOversized = true;
+          throw new Error("must not read");
+        },
+      },
+    }),
+    (error) => error.code === "input-too-large",
+  );
+  assert.equal(readOversized, false);
+  const cancellation = new AbortController();
+  cancellation.abort(new Error("synthetic cancellation"));
+  await assert.rejects(
+    service.convert(
+      {
+        extension: "docx",
+        priority: "foreground",
+        source: source(bytes, "cancelled"),
+      },
+      cancellation.signal,
+    ),
+    /synthetic cancellation/,
+  );
+  await assert.rejects(
+    service.convert({
+      extension: "docx",
+      priority: "background",
+      source: source(bytes, "background"),
+    }),
+    (error) => error.code === "busy",
+  );
+  console.log(
+    JSON.stringify({
+      checks: [
+        "actual-docx-to-pdf",
+        "complete-pdf",
+        "oversize-before-read",
+        "cancelled-reader",
+        "background-disabled",
+      ],
+      elapsedMs: Math.round(performance.now() - started),
+      peakRssKiB: process.resourceUsage().maxRSS,
+      inputBytes: bytes.length,
+      outputBytes: pdf.length,
+      missingFonts: result.missingFonts,
+      pdf: pdf.toString("base64"),
+    }),
+  );
+} finally {
+  await scope.dispose();
+}

package/template/apps/agent-server/scripts/test-confinement.ts

@@ -0,0 +1,58 @@
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// Opt-in: no model, business data, extra services or image builds are involved.
+const app = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const architecture = process.arch === "arm64" ? "arm64" : "amd64";
+const image =
+  process.env.WINDY_AGENT_TEST_IMAGE ??
+  "windy-platform/agent-server:embedded-dsh-native-check";
+const command = [
+  "docker",
+  "run",
+  "--rm",
+  "--no-healthcheck",
+  "--pull",
+  "never",
+  "--platform",
+  `linux/${architecture}`,
+  "--network",
+  "none",
+  "--read-only",
+  "--cap-drop",
+  "ALL",
+  "--security-opt",
+  "no-new-privileges:true",
+  "--user",
+  "20000:20000",
+  "--pids-limit",
+  "128",
+  "--memory",
+  "512m",
+  "--cpus",
+  "1",
+  "--tmpfs",
+  "/tmp:rw,nosuid,nodev,size=64m",
+  "--tmpfs",
+  "/workspace:rw,nosuid,nodev,uid=20000,gid=20000,mode=0700,size=64m",
+  "--tmpfs",
+  "/outside:rw,nosuid,nodev,uid=20000,gid=20000,mode=0700,size=32m",
+  "--env",
+  "WINDY_WORKSPACE_ROOT=/workspace",
+  "--env",
+  "NARB_DISABLE_NATIVE_CACHE=1",
+  "--env",
+  `WINDY_EXPECTED_ARCH=${process.arch}`,
+  "--mount",
+  `type=bind,src=${resolve(app, "scripts/confinement-check.mjs")},dst=/app/apps/agent-server/scripts/confinement-check.mjs,readonly`,
+  "--entrypoint",
+  "node",
+  image,
+  "scripts/confinement-check.mjs",
+];
+const child = Bun.spawn(command, {
+  stdin: "ignore",
+  stdout: "inherit",
+  stderr: "inherit",
+});
+process.exitCode = await child.exited;

package/template/apps/agent-server/scripts/test-coordinator.ts

@@ -0,0 +1,36 @@
+import { resolve } from "node:path";
+const root = resolve(import.meta.dir, "..");
+const image =
+  process.env.WINDY_AGENT_TEST_IMAGE ||
+  "windy-platform/agent-server:embedded-dsh-native-check";
+const args = [
+  "docker",
+  "run",
+  "--rm",
+  "--network",
+  "none",
+  "--cap-drop",
+  "ALL",
+  ...["SETUID", "SETGID", "CHOWN", "DAC_OVERRIDE", "KILL"].flatMap((cap) => [
+    "--cap-add",
+    cap,
+  ]),
+  "--security-opt",
+  "no-new-privileges",
+  "--pids-limit",
+  "512",
+  "--memory",
+  "4g",
+  "--cpus",
+  "2",
+  "--mount",
+  `type=bind,src=${resolve(root, "scripts/coordinator-check.mjs")},dst=/tmp/check.mjs,readonly`,
+  "--entrypoint",
+  "node",
+  image,
+  "/tmp/check.mjs",
+];
+process.exitCode = await Bun.spawn(args, {
+  stdout: "inherit",
+  stderr: "inherit",
+}).exited;

package/template/apps/agent-server/scripts/test-runtime.ts

@@ -0,0 +1,46 @@
+import { mkdtemp, readdir, rm } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// These tests exercise Node 24's native SQLite API. Bun builds the TypeScript,
+// while Node runs its own test API; Bun's default discovery must not load them.
+const appRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const available = (await readdir(join(appRoot, "runtime")))
+  .filter((name) => name.endsWith(".nodecheck.ts"))
+  .sort();
+const requested = process.argv.slice(2);
+const names = requested.length ? requested : available;
+if (!names.length || names.some((name) => !available.includes(name)))
+  throw new Error("Unknown Agent Server Node test selection");
+const output = await mkdtemp(join(appRoot, ".node-tests-"));
+try {
+  const build = await Bun.build({
+    entrypoints: names.map((name) => join(appRoot, "runtime", name)),
+    root: join(appRoot, "runtime"),
+    target: "node",
+    outdir: output,
+    external: ["@deepseek-ai/*", "ajv", "zod", "sharp"],
+  });
+  if (!build.success) {
+    for (const log of build.logs) console.error(String(log));
+    throw new Error("Agent Server Node tests failed to build");
+  }
+  const executable = process.env.NODE_BINARY?.trim() || "node";
+  const child = Bun.spawn(
+    [
+      executable,
+      "--test",
+      ...names.map((name) => join(output, name.replace(/\.ts$/, ".js"))),
+    ],
+    {
+      cwd: appRoot,
+      env: process.env,
+      stdin: "inherit",
+      stdout: "inherit",
+      stderr: "inherit",
+    },
+  );
+  process.exitCode = await child.exited;
+} finally {
+  await rm(output, { recursive: true, force: true });
+}

package/template/apps/agent-server/tsconfig.json

@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "target": "esnext",
+    "module": "esnext",
+    "lib": ["esnext", "dom"],
+    "moduleResolution": "bundler",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "types": ["bun"],
+    "noEmit": true
+  },
+  "include": [
+    "*.ts",
+    "runtime/**/*.ts",
+    "native/**/*.ts",
+    "plugins/**/*.ts",
+    "scripts/**/*.ts"
+  ],
+  "exclude": ["node_modules", "dist"]
+}

package/template/apps/server/Dockerfile

@@ -6,10 +6,12 @@ WORKDIR /app
 COPY package.json bun.lock ./
 COPY windy.modules.json windy.modules.json
 # windy-copy:deps begin
+COPY apps/agent-server/package.json apps/agent-server/package.json
 COPY apps/license/package.json apps/license/package.json
 COPY apps/server/package.json apps/server/package.json
 COPY apps/signing-service/package.json apps/signing-service/package.json
 COPY apps/web/package.json apps/web/package.json
+COPY apps/windy-gateway/package.json apps/windy-gateway/package.json
 COPY packages/ai-client/package.json packages/ai-client/package.json
 COPY packages/config/package.json packages/config/package.json
 COPY packages/create-windy/package.json packages/create-windy/package.json
@@ -19,12 +21,14 @@ COPY packages/delivery/package.json packages/delivery/package.json
 COPY packages/example-work-order/package.json packages/example-work-order/package.json
 COPY packages/jobs/package.json packages/jobs/package.json
 COPY packages/license-sdk/package.json packages/license-sdk/package.json
+COPY packages/model-gateway/package.json packages/model-gateway/package.json
 COPY packages/modules/package.json packages/modules/package.json
 COPY packages/server-sdk/package.json packages/server-sdk/package.json
 COPY packages/shared/package.json packages/shared/package.json
 COPY packages/storage/package.json packages/storage/package.json
 # windy-copy:deps end
-RUN --mount=type=cache,id=windy-bun-1.3.14,target=/root/.bun/install/cache,sharing=shared bun -e 'const child=Bun.spawn(["bun","install","--frozen-lockfile","--no-progress","--backend=copyfile","--linker=hoisted","--ignore-scripts"],{stdin:"inherit",stdout:"inherit",stderr:"inherit"});const heartbeat=setInterval(()=>console.log("[windy] Bun 依赖安装仍在进行"),15000);const exitCode=await child.exited;clearInterval(heartbeat);process.exit(exitCode)' && bun --cwd apps/server -e 'await import("argon2")'
+ARG WINDY_NPM_REGISTRY=https://registry.npmjs.org
+RUN --mount=type=cache,id=windy-bun-1.3.14,target=/root/.bun/install/cache,sharing=shared bun -e 'const child=Bun.spawn(["bun","install","--frozen-lockfile","--no-progress","--filter","*","--filter","!./apps/agent-server","--registry",process.env.WINDY_NPM_REGISTRY||"https://registry.npmjs.org","--backend=copyfile","--linker=hoisted","--ignore-scripts"],{stdin:"inherit",stdout:"inherit",stderr:"inherit"});const started=Date.now();const heartbeat=setInterval(()=>console.log("[windy] Bun 依赖安装尚未完成，已耗时 "+Math.round((Date.now()-started)/1000)+" 秒"),15000);const deadline=setTimeout(()=>{console.error("[windy] Bun 安装超过 300 秒，请检查 npm 下载网络或通过 WINDY_NPM_REGISTRY 指定可用源");child.kill("SIGKILL")},300000);const exitCode=await child.exited;clearInterval(heartbeat);clearTimeout(deadline);process.exit(exitCode)' && bun --cwd apps/server -e 'await import("argon2")'
 
 FROM deps AS runner
 # @windy-module system.storage begin

package/template/apps/server/package.json

@@ -11,8 +11,8 @@
   },
   "dependencies": {
     "@elysiajs/swagger": "^1.3.1",
-    "@modelcontextprotocol/sdk": "^1",
-    "@noble/ed25519": "^3.1.0",
+    "@modelcontextprotocol/sdk": "^1.32.2",
+    "@noble/ed25519": "^3.2.0",
     "@southwind-ai/config": "workspace:*",
     "@southwind-ai/database": "workspace:*",
     "@southwind-ai/example-work-order": "workspace:*",
@@ -24,16 +24,20 @@
     "@southwind-ai/storage": "workspace:*",
     "ajv": "^8.20.0",
     "argon2": "^0.44.0",
-    "drizzle-orm": "^0.45.2",
-    "elysia": "^1.4.29",
-    "mysql2": "^3.22.6",
-    "nodemailer": "^9.0.3",
-    "pg": "^8.22.0",
-    "pino": "^10.3.1",
+    "drizzle-orm": "^0.45.4",
+    "elysia": "^1.4.31",
+    "fflate": "^0.8.3",
+    "mysql2": "^3.24.6",
+    "nodemailer": "^9.1.1",
+    "pg": "^8.23.1",
+    "pino": "^10.4.0",
     "unicode-case-folding": "1.1.1",
-    "zod": "^4.4.3"
+    "ws": "^8.22.1",
+    "yaml": "^2.9.1",
+    "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@types/nodemailer": "^8.0.1"
+    "@types/nodemailer": "^8.0.2",
+    "@types/ws": "^8.18.2"
   }
 }