create-windy 0.9.1 → 0.10.1

package/template/apps/server/src/index.ts

@@ -9,25 +9,22 @@ import { registerBulkDataRoutes } from "./bulk-data/routes.js";
 // @windy-module system.data-governance begin
 import { registerGovernedUserExportRoutes } from "./data-governance/export/routes.js";
 // @windy-module system.data-governance end
-import { createServerRuntime } from "./runtime.js";
 // @windy-module system.scheduler begin
 import { readPositiveInt } from "./runtime-config.js";
 // @windy-module system.scheduler end
+// @windy-module system.media-runtime begin
+import { composeMediaOnlyRuntime } from "./media-runtime/media-only-composition.js";
+// @windy-module system.media-runtime end
 // @windy-module system.agent begin
 import { DeferredAgentBackgroundOperationPortFactory } from "./agent/background-operation-port.js";
 import { composeApplicationAgentRuntime } from "./app/agent-runtime-composition.js";
 import { workflowDurableInput } from "./agent/workflow-durable-runtime-input.js";
 // @windy-module system.agent end
-import { createComposedAuthRuntime } from "./auth/composition.js";
-// @windy-module system.license begin
-import { createLicenseRuntimeActivation } from "./license/activation.js";
-// @windy-module system.license end
 // @windy-module system.operations begin
 import { registerSystemOperationRoutes } from "./system/operations.js";
 import { createPostgresMonitorProbe } from "./system/postgres-monitoring.js";
 // @windy-module system.operations end
 import { registerSystemRoutes } from "./system/routes.js";
-import { createAuthorizationInvalidationComposition } from "./system/authorization-invalidation-composition.js";
 // @windy-module system.scheduler begin
 import { registerSchedulerRoutes } from "./scheduler/routes.js";
 import { SchedulerWorker } from "./scheduler/worker.js";
@@ -56,9 +53,9 @@ import { createSearchHost } from "./search/host.js";
 import { registerWorkflowRoutes } from "./workflow/routes.js";
 // @windy-module system.workflow end
 import { bootstrapServerModules } from "./module-bootstrap.js";
-import { createHttpObservability } from "./platform-http-runtime.js";
 import { bootstrapPlatformApp } from "./platform-app-bootstrap.js";
 import { createPreparedPlatformBootstrap } from "./startup-preflight.js";
+import { createStartupRuntime } from "./startup-runtime.js";
 import { finalizePlatformStartup } from "./startup-finalization.js";
 const { logger, persistence, platformConfig, preparedModules } =
   await createPreparedPlatformBootstrap();
@@ -73,36 +70,6 @@ const {
   systemRepositories,
 } = await bootstrapServerModules(platformConfig, persistence, preparedModules);
 const features = foundationSnapshot.features;
-// @windy-module system.license begin
-const licenseActivation = createLicenseRuntimeActivation(
-  process.env,
-  foundationSnapshot.platform.licenseEnabled,
-  persistence?.licenseResolver,
-);
-// @windy-module system.license end
-const runtime = createServerRuntime(process.env, {
-  actorResolver: persistence?.actorResolver,
-  // @windy-module system.license begin
-  licenseResolver: licenseActivation.resolver,
-  licenseEnforced: licenseActivation.enforced,
-  // @windy-module system.license end
-  featureResolver: persistence ? systemRepositories.features : undefined,
-  featureCatalog: features,
-  disabledModuleNames: new Set(foundationSnapshot.disabledModuleNames),
-  // @windy-module system.audit begin
-  auditReader: persistence?.auditReader,
-  auditWriter: persistence?.auditWriter,
-  // @windy-module system.audit end
-});
-const observability = createHttpObservability(runtime, persistence, logger);
-const authorizationInvalidation = createAuthorizationInvalidationComposition({
-  platformConfig,
-  persistence,
-  repositories: systemRepositories,
-});
-// @windy-module system.license begin
-licenseActivation.runtime.setAuditSink(runtime.auditSink);
-// @windy-module system.license end
 const {
   authRepository,
   authService,
@@ -112,12 +79,18 @@ const {
   // @windy-module system.data-governance begin
   reauthentication,
   // @windy-module system.data-governance end
-} = createComposedAuthRuntime({
-  repositories: systemRepositories,
-  platformConfig,
-  persistence,
   runtime,
-});
+  observability,
+  authorizationInvalidation,
+  aiRuntimeSwitches,
+  disabledAiFeatures,
+  // @windy-module system.license begin
+  licenseActivation,
+  // @windy-module system.license end
+} = await createStartupRuntime(
+  { logger, persistence, platformConfig },
+  { foundationSnapshot, systemRepositories },
+);
 // @windy-module system.storage begin
 const { storageRuntime, reportStagingRuntime } = createStorageHostRuntime(
   process.env,
@@ -276,23 +249,47 @@ registerSystemOperationRoutes(app, runtime, features, {
   databaseMonitorProbe: createPostgresMonitorProbe(persistence?.pool),
 });
 // @windy-module system.operations end
-// @windy-module system.agent begin
-const agentRuntime = composeApplicationAgentRuntime({
+// @windy-module system.media-runtime begin
+const aiRuntimeInput = {
   app,
-  platformConfig,
   modules: foundationModules,
   hosts: moduleHosts,
   runtime,
   systemRepositories,
   storage: storageRuntime,
-  workflow: workflowService,
-  ...workflowDurableInput([durableJobRuntime, storageRuntime, logger]),
   db: persistence?.db,
-  backgroundAi: moduleBackgroundAi,
-  bindAuthorizationInvalidation: (target) =>
-    authorizationInvalidation.bind(target),
-  bindClientAgentSessions,
-});
+};
+let sharedAiPorts:
+  | Pick<
+      Parameters<typeof installModuleHttpRuntime>[2],
+      "aiArtifacts" | "aiOperations" | "aiReadiness"
+    >
+  | undefined;
+if (aiRuntimeSwitches.agent === false) {
+  sharedAiPorts = composeMediaOnlyRuntime({
+    ...aiRuntimeInput,
+    enableAI: platformConfig.enableAI,
+    switches: aiRuntimeSwitches,
+    features,
+  });
+}
+// @windy-module system.media-runtime end
+// @windy-module system.agent begin
+const agentRuntime =
+  aiRuntimeSwitches.agent !== false
+    ? composeApplicationAgentRuntime({
+        ...aiRuntimeInput,
+        aiRuntimeSwitches,
+        platformConfig,
+        workflow: workflowService,
+        ...workflowDurableInput([durableJobRuntime, storageRuntime, logger]),
+        backgroundAi: moduleBackgroundAi,
+        bindAuthorizationInvalidation: (target) =>
+          authorizationInvalidation.bind(target),
+        bindClientAgentSessions,
+      })
+    : undefined;
+if (agentRuntime) sharedAiPorts = agentRuntime;
 // @windy-module system.agent end
 // @windy-module system.scheduler begin
 registerSchedulerRoutes(app, scheduler, runtime, features);
@@ -312,13 +309,15 @@ installModuleHttpRuntime(moduleHosts, app, {
   reportStaging: reportStagingRuntime,
   // @windy-module system.storage end
   systemRepositories,
+  // @windy-module system.media-runtime begin
+  aiArtifacts: sharedAiPorts?.aiArtifacts,
+  aiOperations: sharedAiPorts?.aiOperations,
+  aiReadiness: sharedAiPorts?.aiReadiness,
+  // @windy-module system.media-runtime end
   // @windy-module system.agent begin
-  aiArtifacts: agentRuntime.aiArtifacts,
-  aiOperations: agentRuntime.aiOperations,
-  aiReadiness: agentRuntime.aiReadiness,
-  sessionMemory: agentRuntime.sessionMemory,
-  sourceInvalidation: agentRuntime.sourceInvalidation,
-  screenshots: agentRuntime.screenshots,
+  sessionMemory: agentRuntime?.sessionMemory,
+  sourceInvalidation: agentRuntime?.sourceInvalidation,
+  screenshots: agentRuntime?.screenshots,
   // @windy-module system.agent end
   // @windy-module system.data-governance begin
   reauthenticate: (actorId, password) =>
@@ -328,13 +327,14 @@ installModuleHttpRuntime(moduleHosts, app, {
 });
 finalizePlatformStartup({
   app,
+  disabledFeatureKeys: disabledAiFeatures,
   modules: foundationModules,
   // @windy-module system.scheduler begin
   tasks: scheduledTaskDefinitions,
   // @windy-module system.scheduler end
   // @windy-module system.agent begin
-  tools: agentRuntime.toolHandlers,
-  disposeAgentRuntime: agentRuntime.disposeAgentRuntime,
+  tools: agentRuntime?.toolHandlers,
+  disposeAgentRuntime: agentRuntime?.disposeAgentRuntime,
   // @windy-module system.agent end
   // @windy-module system.search begin
   providers: searchHost.providerKeys,

package/template/apps/server/src/license/routes.ts

@@ -35,7 +35,10 @@ export function registerPlatformLicenseRoutes(
       { restrictedModeAccess: "admin-admission" },
     );
     if (denied) return denied;
-    return licenseRuntime.snapshotForActor(context.guardContext.actor);
+    return Response.json(
+      await licenseRuntime.snapshotForActor(context.guardContext.actor),
+      { headers: { "cache-control": "no-store" } },
+    );
   });
 
   app.post(

package/template/apps/server/src/license/runtime-business-access.test.ts

@@ -0,0 +1,261 @@
+import { describe, expect, test } from "bun:test";
+import { generateKeyPairSync, sign } from "node:crypto";
+import { Elysia } from "elysia";
+import {
+  createLicenseSigningPayload,
+  MemoryAtomicLicenseStore,
+} from "@southwind-ai/license";
+import { licenseVersionKey, type SignedLicenseV1 } from "@southwind-ai/shared";
+import { createFoundationSnapshot, loadSystemModules } from "../foundation.js";
+import { createServerRuntime } from "../runtime.js";
+import { createStaticRouteAuthorizer } from "../module-host/static-route-authorization.js";
+import { evaluateAdminAccess } from "../admin/routes.js";
+import { evaluateRouteGuards } from "../route-guards.js";
+import { PlatformLicenseRuntime } from "./runtime-service.js";
+import { registerPlatformLicenseRoutes } from "./routes.js";
+import {
+  evaluateRestrictedHttpRequest,
+  licenseRestrictedResponse,
+} from "./restriction.js";
+
+const businessPermissions = ["home.read", "case.read"];
+
+describe("普通业务账号的 License 运行状态契约", () => {
+  test("仅业务权限可读取最小投影并通过业务 Guard，未授权页面和后台仍拒绝", async () => {
+    const fixture = createFixture();
+    const response = await fixture.request("/license/runtime");
+    expect(response.status).toBe(200);
+    expect(response.headers.get("cache-control")).toBe("no-store");
+    expect(await response.json()).toEqual({
+      status: "valid",
+      restricted: false,
+      expiresAt: "2030-08-01T00:00:00.000Z",
+      reminder: { level: "none", daysRemaining: 1461 },
+      canViewDetails: false,
+    });
+    const context = await fixture.runtime.createGuardContext(
+      new Request("http://localhost/"),
+    );
+    for (const permissionKey of businessPermissions) {
+      expect(
+        (
+          await evaluateRouteGuards(fixture.runtime, context, {
+            permission: { method: "GET", path: "/api/business", permissionKey },
+          })
+        ).allowed,
+      ).toBe(true);
+    }
+    expect(
+      (
+        await evaluateRouteGuards(fixture.runtime, context, {
+          permission: {
+            method: "POST",
+            path: "/api/cases",
+            permissionKey: "case.manage",
+          },
+        })
+      ).reason,
+    ).toBe("missing-permission");
+    expect(
+      (await evaluateAdminAccess(fixture.runtime, context, fixture.features))
+        .reason,
+    ).toBe("missing-permission");
+  });
+
+  test("匿名及服务 Actor 不取得运行状态", async () => {
+    for (const actorType of ["anonymous", "service"] as const) {
+      expect(
+        (await createFixture({ actorType }).request("/license/runtime")).status,
+      ).toBe(401);
+    }
+  });
+
+  test("无任何权限也只获得基础投影，License 管理开关不影响基础读取", async () => {
+    const fixture = createFixture({
+      permissionKeys: [],
+      licenseFeatureEnabled: false,
+    });
+    const response = await fixture.request("/license/runtime");
+    expect(response.status).toBe(200);
+    expect(await response.json()).toMatchObject({
+      canViewDetails: false,
+      restricted: false,
+    });
+  });
+
+  test("业务用户不可安装、配对、确认或读取管理记录", async () => {
+    const fixture = createFixture();
+    for (const [method, path] of [
+      ["POST", "/license/runtime/install"],
+      ["POST", "/license/runtime/pairing/sessions"],
+      ["GET", "/license/runtime/pairing/sessions/session_1"],
+      ["POST", "/license/runtime/pairing/sessions/session_1/confirm"],
+    ]) {
+      const response = await fixture.request(path!, method!);
+      expect(response.status).toBe(403);
+      expect(await response.json()).toMatchObject({
+        reason: "missing-permission",
+      });
+    }
+    const context = await fixture.runtime.createGuardContext(
+      new Request("http://localhost/"),
+    );
+    expect(
+      (
+        await fixture.authorizer.authorize(
+          context,
+          "GET",
+          "/api/system/licenses",
+        )
+      )?.status,
+    ).toBe(403);
+  });
+
+  test("维护人员保留详情，read 权限不升级为详情权限", async () => {
+    const readOnly = await createFixture({
+      permissionKeys: ["system.license.read"],
+    }).request("/license/runtime");
+    expect(await readOnly.json()).toMatchObject({ canViewDetails: false });
+    const manager = await createFixture({
+      permissionKeys: ["system.license.manage"],
+    }).request("/license/runtime");
+    expect(await manager.json()).toMatchObject({
+      canViewDetails: true,
+      machineCode: "test-machine",
+      license: { claims: { customer: { name: "测试客户" } } },
+    });
+  });
+
+  test.each(["expired", "missing", "invalid"] as const)(
+    "%s 状态仍可读取，业务访问保持受限",
+    async (status) => {
+      const fixture = createFixture({ status });
+      const response = await fixture.request("/license/runtime");
+      expect(response.status).toBe(200);
+      expect(await response.json()).toMatchObject({
+        status,
+        restricted: true,
+        canViewDetails: false,
+      });
+      const context = await fixture.runtime.createGuardContext(
+        new Request("http://localhost/"),
+      );
+      expect(
+        (
+          await evaluateRouteGuards(fixture.runtime, context, {
+            permission: {
+              method: "GET",
+              path: "/api/cases",
+              permissionKey: "case.read",
+            },
+          })
+        ).reason,
+      ).toBe("license-restricted");
+      expect(
+        evaluateRestrictedHttpRequest(
+          context,
+          new Request("http://localhost/api/cases"),
+        ).allowed,
+      ).toBe(false);
+      expect(
+        (await fixture.request("/license/runtime/install", "POST")).status,
+      ).toBe(403);
+    },
+  );
+});
+
+function createFixture(
+  options: {
+    actorType?: "user" | "anonymous" | "service";
+    permissionKeys?: string[];
+    licenseFeatureEnabled?: boolean;
+    status?: "expired" | "missing" | "invalid";
+  } = {},
+) {
+  const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+  const unsigned = {
+    formatVersion: 1,
+    algorithm: "ED25519",
+    publicKeyId: "test-key",
+    claims: {
+      licenseId: "test-license",
+      productCode: "windy-platform",
+      machineCode: "test-machine",
+      customer: { id: "customer", code: "C", name: "测试客户" },
+      project: { id: "project", code: "P", name: "测试项目" },
+      contract: { id: "contract", contractNumber: "TEST", version: "1" },
+      issuedAt: "2026-07-01T00:00:00.000Z",
+      expiresAt:
+        options.status === "expired"
+          ? "2026-07-31T00:00:00.000Z"
+          : "2030-08-01T00:00:00.000Z",
+      licenseVersion: { key: licenseVersionKey("advanced"), name: "高级版" },
+    },
+  } as const;
+  const license: SignedLicenseV1 = {
+    ...unsigned,
+    signature: sign(
+      null,
+      Buffer.from(createLicenseSigningPayload(unsigned)),
+      privateKey,
+    ).toString("base64"),
+  };
+  const licenseRuntime = new PlatformLicenseRuntime({
+    productCode: "windy-platform",
+    machineCode: "test-machine",
+    publicKeys: {
+      "test-key": publicKey.export({ type: "spki", format: "pem" }).toString(),
+    },
+    store: new MemoryAtomicLicenseStore(
+      options.status === "missing"
+        ? undefined
+        : options.status === "invalid"
+          ? "{broken"
+          : JSON.stringify(license),
+    ),
+    enforceRestrictions: true,
+    now: () => new Date("2026-08-01T00:00:00.000Z"),
+  });
+  const { features } = createFoundationSnapshot();
+  const runtime = createServerRuntime(
+    {},
+    {
+      actorResolver: {
+        resolve: () => ({
+          id: "business-user",
+          type: options.actorType ?? "user",
+          name: "业务用户",
+          roleCodes: ["officer"],
+          permissionKeys: options.permissionKeys ?? businessPermissions,
+        }),
+      },
+      licenseResolver: licenseRuntime,
+      featureCatalog: features,
+      featureResolver: {
+        resolve: (key) => ({
+          key,
+          enabled:
+            key !== "system.license" || options.licenseFeatureEnabled !== false,
+          visible: "visible",
+        }),
+      },
+    },
+  );
+  const authorizer = createStaticRouteAuthorizer(runtime, loadSystemModules());
+  const app = new Elysia({ prefix: "/api" })
+    .derive(async ({ request }) => ({
+      guardContext: await runtime.createGuardContext(request),
+    }))
+    .onBeforeHandle(({ request, guardContext }) => {
+      if (!evaluateRestrictedHttpRequest(guardContext, request).allowed)
+        return licenseRestrictedResponse(guardContext);
+    });
+  registerPlatformLicenseRoutes(app, licenseRuntime, authorizer);
+  return {
+    runtime,
+    authorizer,
+    features,
+    request: (path: string, method = "GET") =>
+      app.handle(new Request(`http://localhost/api${path}`, { method })),
+  };
+}

package/template/apps/server/src/media-runtime/composition.ts

@@ -0,0 +1,157 @@
+import type { AiRuntimeSwitches } from "@southwind-ai/shared";
+import { DocumentRunFacade } from "../document/facade.js";
+import {
+  RemoteDocumentRuntime,
+  unavailableDocumentRuntime,
+} from "../document/remote-runtime.js";
+import { registerDocumentRunRoutes } from "../document/routes.js";
+import { createDocumentOutputRuntime } from "../document/output-artifact-composition.js";
+import { installDocumentOutputRuntimeRoutes } from "../document/output-artifact-route-composition.js";
+import { EmbeddingFacade } from "../embedding/facade.js";
+import { EmbeddingRunAuthorizations } from "../embedding/run-authorization.js";
+import { InMemoryEmbeddingRunBindingRepository } from "../embedding/run-binding-repository.js";
+import { DrizzleEmbeddingRunBindingRepository } from "../embedding/drizzle-run-binding-repository.js";
+import {
+  RemoteEmbeddingRuntime,
+  unavailableEmbeddingRuntime,
+} from "../embedding/remote-runtime.js";
+import {
+  registerEmbeddingRoutes,
+  registerEmbeddingRunArtifactRoutes,
+} from "../embedding/routes.js";
+import { SpeechRunFacade } from "../speech/facade.js";
+import {
+  RemoteSpeechRuntime,
+  unavailableSpeechRuntime,
+} from "../speech/remote-runtime.js";
+import { registerSpeechRunRoutes } from "../speech/routes.js";
+
+export function connectMediaRuntimes(
+  internalToken: string,
+  switches?: AiRuntimeSwitches,
+) {
+  const documentRemote =
+    switches?.document !== false && process.env.DOCUMENT_SERVER_URL?.trim()
+      ? new RemoteDocumentRuntime({
+          baseUrl: process.env.DOCUMENT_SERVER_URL,
+          internalToken,
+        })
+      : unavailableDocumentRuntime;
+  const speechRemote =
+    switches?.speech !== false && process.env.SPEECH_SERVER_URL?.trim()
+      ? new RemoteSpeechRuntime({
+          baseUrl: process.env.SPEECH_SERVER_URL,
+          internalToken,
+        })
+      : unavailableSpeechRuntime;
+  const embeddingRemote =
+    switches?.embedding !== false && process.env.EMBEDDING_SERVER_URL?.trim()
+      ? new RemoteEmbeddingRuntime({
+          baseUrl: process.env.EMBEDDING_SERVER_URL,
+          internalToken,
+        })
+      : unavailableEmbeddingRuntime;
+  return { documentRemote, speechRemote, embeddingRemote };
+}
+
+export function registerMediaRuntimes(
+  input: ReturnType<typeof connectMediaRuntimes> & {
+    switches?: AiRuntimeSwitches;
+    modules: ConstructorParameters<typeof DocumentRunFacade>[0];
+    hosts: ConstructorParameters<typeof DocumentRunFacade>[1];
+    runtime: ConstructorParameters<typeof DocumentRunFacade>[2];
+    storage: Parameters<typeof createDocumentOutputRuntime>[0]["storage"];
+    db: Parameters<typeof createDocumentOutputRuntime>[0]["db"];
+    aiReadiness: Parameters<typeof createDocumentOutputRuntime>[0]["readiness"];
+    resolveActor: Parameters<
+      typeof createDocumentOutputRuntime
+    >[0]["resolveActor"];
+    aiArtifacts: ConstructorParameters<typeof DocumentRunFacade>[4];
+    grants: ConstructorParameters<typeof DocumentRunFacade>[5];
+    aiRouteApp: Parameters<typeof registerDocumentRunRoutes>[0];
+    internalToken: string;
+  },
+) {
+  const {
+    documentRemote,
+    speechRemote,
+    embeddingRemote,
+    aiReadiness,
+    resolveActor,
+    aiArtifacts,
+    grants,
+    aiRouteApp,
+    internalToken,
+  } = input;
+  const outputRuntime = createDocumentOutputRuntime({
+    modules: input.modules,
+    readiness: aiReadiness,
+    runtime: input.runtime,
+    storage: input.storage,
+    resolveActor,
+    db: input.db,
+    documentEnabled: input.switches?.document,
+    speechEnabled: input.switches?.speech,
+  });
+  const documentFacadeWithOutput =
+    input.switches?.document === false
+      ? undefined
+      : new DocumentRunFacade(
+          input.modules,
+          input.hosts,
+          input.runtime,
+          documentRemote,
+          aiArtifacts,
+          grants,
+          outputRuntime?.host,
+          aiReadiness,
+        );
+  installDocumentOutputRuntimeRoutes(outputRuntime, aiRouteApp, internalToken);
+  if (documentFacadeWithOutput)
+    registerDocumentRunRoutes(
+      aiRouteApp,
+      documentFacadeWithOutput,
+      documentRemote,
+    );
+  const speechFacade =
+    input.switches?.speech === false
+      ? undefined
+      : new SpeechRunFacade(
+          input.modules,
+          input.hosts,
+          input.runtime,
+          speechRemote,
+          aiArtifacts,
+          grants,
+          aiReadiness,
+          outputRuntime?.speechHost,
+        );
+  if (speechFacade)
+    registerSpeechRunRoutes(aiRouteApp, speechFacade, speechRemote);
+  const embeddingFacade =
+    input.switches?.embedding === false
+      ? undefined
+      : new EmbeddingFacade(
+          input.modules,
+          input.hosts,
+          input.runtime,
+          embeddingRemote,
+          aiArtifacts,
+          new EmbeddingRunAuthorizations(
+            input.db
+              ? new DrizzleEmbeddingRunBindingRepository(input.db)
+              : new InMemoryEmbeddingRunBindingRepository(),
+            internalToken,
+          ),
+          aiReadiness,
+        );
+  if (embeddingFacade) {
+    registerEmbeddingRoutes(aiRouteApp, embeddingFacade);
+    registerEmbeddingRunArtifactRoutes(
+      aiRouteApp,
+      embeddingFacade,
+      internalToken,
+    );
+  }
+  return { documentFacadeWithOutput, speechFacade, embeddingFacade };
+}

package/template/apps/server/src/media-runtime/media-only-composition.ts

@@ -0,0 +1,44 @@
+import type { SystemRepositories } from "../system/seed.js";
+import { resolveCurrentSystemActor } from "../system/actor.js";
+import {
+  createManifestAuthorizedRouteApp,
+  createStaticRouteAuthorizer,
+} from "../module-host/static-route-authorization.js";
+import { requiredEnvironment } from "./required-environment.js";
+import { composeSharedAiRuntime } from "./shared-composition.js";
+
+type SharedInput = Parameters<typeof composeSharedAiRuntime>[0];
+
+export function composeMediaOnlyRuntime(
+  input: Omit<
+    SharedInput,
+    "internalToken" | "secret" | "resolveActor" | "agent"
+  > & {
+    enableAI: boolean;
+    systemRepositories: SystemRepositories;
+  },
+) {
+  if (
+    !input.enableAI ||
+    (input.switches?.document === false &&
+      input.switches.speech === false &&
+      input.switches.embedding === false)
+  )
+    return undefined;
+
+  const authorizer = createStaticRouteAuthorizer(input.runtime, input.modules);
+  const shared = composeSharedAiRuntime({
+    ...input,
+    app: createManifestAuthorizedRouteApp(input.app, authorizer),
+    internalToken: requiredEnvironment("AGENT_SERVER_INTERNAL_TOKEN"),
+    secret: requiredEnvironment("AI_ARTIFACT_ENCRYPTION_SECRET"),
+    resolveActor: (actorId) =>
+      resolveCurrentSystemActor(input.systemRepositories, actorId),
+  });
+  const ports = shared.modulePorts();
+  return {
+    aiArtifacts: shared.aiArtifacts,
+    aiOperations: ports.operations,
+    aiReadiness: ports.readiness,
+  };
+}