create-windy 0.9.1 → 0.10.1

package/template/apps/server/src/module-host/static-route-authorization.test.ts

@@ -7,7 +7,7 @@ import {
 } from "./static-route-authorization.js";
 
 // @windy-module system.license begin
-test("平台静态 Route 使用 Manifest Feature 与 Permission Guard", async () => {
+test("License 基础状态免管理 Feature，安装操作仍经过 Manifest Guard", async () => {
   const modules = systemModuleManifests();
   const runtime = createServerRuntime(
     { WINDY_DEV_ADMIN_TOKEN: "token_1" },
@@ -20,10 +20,13 @@ test("平台静态 Route 使用 Manifest Feature 与 Permission Guard", async ()
     }),
   );
 
+  await expect(
+    authorizer.authorize(context, "GET", "/api/license/runtime"),
+  ).resolves.toBeUndefined();
   const denied = await authorizer.authorize(
     context,
-    "GET",
-    "/api/license/runtime",
+    "POST",
+    "/api/license/runtime/install",
   );
 
   expect(denied?.status).toBe(403);

package/template/apps/server/src/module-host/storage-authorization-binding.test.ts

@@ -8,11 +8,13 @@ import {
   type UploadPolicy,
 } from "@southwind-ai/storage";
 import type { ModuleUploadDecision } from "./storage-port.js";
+// @windy-module system.agent begin
 import { buildScopeContext } from "../data-access/context.js";
 import { captureAuthorizationScope } from "../data-access/scope-snapshot.js";
 import { bindModuleUserProjection } from "../guards.js";
 import { createServerRuntime } from "../runtime.js";
 import { createModuleStorageScope } from "./storage-scope.js";
+// @windy-module system.agent end
 import { createModuleStorageWritePort } from "./storage-write-port.js";
 
 const policy: UploadPolicy = {
@@ -146,6 +148,7 @@ describe("模块上传会话授权绑定", () => {
     ).toBe(true);
   });
 
+  // @windy-module system.agent begin
   test("Host 投影 service actor 时仍以业务用户 Scope 颁发绑定", async () => {
     const scopeContext = buildScopeContext("user_projected", undefined, [
       {
@@ -189,6 +192,7 @@ describe("模块上传会话授权绑定", () => {
       scopeHash: captureAuthorizationScope(scopeContext).hash,
     });
   });
+  // @windy-module system.agent end
 });
 
 interface SetupOptions {

package/template/apps/server/src/module-runtime-validation.ts

@@ -4,6 +4,7 @@ import type { InitializedModuleHosts } from "./module-host.js";
 
 export function validateInstalledRuntime(input: {
   modules: ModuleManifest[];
+  disabledFeatureKeys?: ReadonlySet<string>;
   routes: readonly { method: string; path: string }[];
   tasks?: readonly { key: string }[];
   tools?: ReadonlyMap<string, unknown>;
@@ -15,6 +16,7 @@ export function validateInstalledRuntime(input: {
   );
   validateServerModuleComposition({
     modules: input.modules,
+    disabledFeatureKeys: input.disabledFeatureKeys,
     routes: input.routes,
     frameworkRoutes: ["GET /api/swagger", "GET /api/swagger/json"],
     tasks: input.tasks,

package/template/apps/server/src/observability/diagnostic-index.ts

@@ -1,5 +1,9 @@
 import { randomUUIDv7 } from "bun";
-import type { DiagnosticRecord } from "@southwind-ai/shared";
+import type {
+  DiagnosticRecord,
+  PageRequest,
+  PageResult,
+} from "@southwind-ai/shared";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { DrizzleDiagnosticIndex } from "./diagnostic-repository.js";
 
@@ -12,6 +16,7 @@ const ID_PATTERN =
 export interface DiagnosticIndex {
   record(record: DiagnosticRecord): Promise<void>;
   find(id: string, now?: Date): Promise<DiagnosticRecord | undefined>;
+  list(page: PageRequest, now?: Date): Promise<PageResult<DiagnosticRecord>>;
   purgeExpired(now?: Date): Promise<number>;
 }
 
@@ -76,6 +81,26 @@ export class InMemoryDiagnosticIndex implements DiagnosticIndex {
       : undefined;
   }
 
+  async list(
+    { page, pageSize }: PageRequest,
+    now = new Date(),
+  ): Promise<PageResult<DiagnosticRecord>> {
+    const active = [...this.items.values()]
+      .filter((record) => new Date(record.expiresAt) > now)
+      .sort(
+        (left, right) =>
+          right.occurredAt.localeCompare(left.occurredAt) ||
+          right.diagnosticId.localeCompare(left.diagnosticId),
+      );
+    const start = (page - 1) * pageSize;
+    return {
+      items: structuredClone(active.slice(start, start + pageSize)),
+      total: active.length,
+      page,
+      pageSize,
+    };
+  }
+
   async purgeExpired(now = new Date()): Promise<number> {
     let count = 0;
     for (const [id, item] of this.items) {

package/template/apps/server/src/observability/diagnostic-repository.ts

@@ -1,7 +1,11 @@
-import { and, eq, gt, inArray, lte } from "drizzle-orm";
+import { and, desc, eq, gt, inArray, lte } from "drizzle-orm";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { diagnosticEvents } from "@southwind-ai/database";
-import type { DiagnosticRecord } from "@southwind-ai/shared";
+import type {
+  DiagnosticRecord,
+  PageRequest,
+  PageResult,
+} from "@southwind-ai/shared";
 import type { DiagnosticIndex } from "./diagnostic-index.js";
 
 export class DrizzleDiagnosticIndex implements DiagnosticIndex {
@@ -32,15 +36,30 @@ export class DrizzleDiagnosticIndex implements DiagnosticIndex {
         ),
       )
       .limit(1);
-    return row
-      ? {
-          ...row,
-          service: "server",
-          stage: "http",
-          occurredAt: row.occurredAt.toISOString(),
-          expiresAt: row.expiresAt.toISOString(),
-        }
-      : undefined;
+    return row ? toRecord(row) : undefined;
+  }
+
+  async list(
+    { page, pageSize }: PageRequest,
+    now = new Date(),
+  ): Promise<PageResult<DiagnosticRecord>> {
+    const active = gt(diagnosticEvents.expiresAt, now);
+    const total = await this.db.$count(diagnosticEvents, active);
+    const start = (page - 1) * pageSize;
+    const rows =
+      start < total
+        ? await this.db
+            .select()
+            .from(diagnosticEvents)
+            .where(active)
+            .orderBy(
+              desc(diagnosticEvents.occurredAt),
+              desc(diagnosticEvents.diagnosticId),
+            )
+            .limit(pageSize)
+            .offset(start)
+        : [];
+    return { items: rows.map(toRecord), total, page, pageSize };
   }
 
   async purgeExpired(now = new Date()): Promise<number> {
@@ -65,3 +84,13 @@ export class DrizzleDiagnosticIndex implements DiagnosticIndex {
     return removed.length;
   }
 }
+
+function toRecord(row: typeof diagnosticEvents.$inferSelect): DiagnosticRecord {
+  return {
+    ...row,
+    service: "server",
+    stage: "http",
+    occurredAt: row.occurredAt.toISOString(),
+    expiresAt: row.expiresAt.toISOString(),
+  };
+}

package/template/apps/server/src/platform-http-runtime.ts

@@ -117,7 +117,7 @@ export function listenPlatformServer(
 ): number {
   const port = process.env.PORT ? Number(process.env.PORT) : 9_747;
   app.listen(port);
-  return port;
+  return app.server?.port ?? port;
 }
 
 export function logServerStartup(

package/template/apps/server/src/runtime-feature.ts

@@ -39,6 +39,7 @@ export class RuntimeFeatureCatalog {
     private readonly resolver: FeatureFlagRuntimeResolver | undefined,
     private readonly production: boolean,
     private readonly disabledModuleNames: ReadonlySet<string> = new Set(),
+    private readonly disabledFeatureKeys: ReadonlySet<string> = new Set(),
   ) {
     for (const definition of definitions) {
       this.definitions.set(definition.key, definition);
@@ -108,7 +109,10 @@ export class RuntimeFeatureCatalog {
   private async resolveOwnState(
     manifestFeature: FeatureFlagDefinition,
   ): Promise<FeatureFlagDefinition> {
-    if (this.disabledModuleNames.has(manifestFeature.module)) {
+    if (
+      this.disabledModuleNames.has(manifestFeature.module) ||
+      this.disabledFeatureKeys.has(manifestFeature.key)
+    ) {
       return disabledFeature(manifestFeature);
     }
     if (!this.resolver) {

package/template/apps/server/src/runtime.ts

@@ -70,6 +70,7 @@ export interface ServerRuntimeOptions {
   featureResolver?: FeatureFlagRuntimeResolver;
   featureCatalog?: readonly FeatureFlagDefinition[];
   disabledModuleNames?: ReadonlySet<string>;
+  disabledFeatureKeys?: ReadonlySet<string>;
   auditWriter?: AuditEventWriter;
   auditReader?: AuditEventReader;
 }
@@ -197,11 +198,13 @@ export function createServerRuntime(
     options.featureResolver,
     env.NODE_ENV === "production",
     options.disabledModuleNames ?? new Set(),
+    options.disabledFeatureKeys,
   );
   const requestSourcePolicy = requestSourcePolicyFromEnv(env);
 
   return {
     auditSink,
+    featureDefinitions: options.featureCatalog ?? [],
     async createGuardContext(
       request: Request,
       metadata: { clientIp?: string } = {},

package/template/apps/server/src/settings/drizzle-watermark-repository.ts

@@ -1,6 +1,6 @@
 import { platformWatermarkPolicies } from "@southwind-ai/database";
 import type { PlatformWatermarkPolicy } from "@southwind-ai/shared";
-import { eq } from "drizzle-orm";
+import { and, eq, sql } from "drizzle-orm";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { WatermarkPolicyRepository } from "./watermark-repository.js";
 
@@ -25,6 +25,25 @@ export class DrizzleWatermarkPolicyRepository implements WatermarkPolicyReposito
     policy: PlatformWatermarkPolicy,
     actorId: string,
   ): Promise<PlatformWatermarkPolicy> {
+    const updated = await this.write(policy, actorId);
+    if (!updated) throw new Error("水印策略保存失败");
+    return updated;
+  }
+
+  updateIfCurrent(
+    before: PlatformWatermarkPolicy,
+    policy: PlatformWatermarkPolicy,
+    actorId: string,
+  ) {
+    return this.write(policy, actorId, before);
+  }
+
+  private async write(
+    policy: PlatformWatermarkPolicy,
+    actorId: string,
+    before?: PlatformWatermarkPolicy,
+  ) {
+    const table = platformWatermarkPolicies;
     const [row] = await this.db
       .insert(platformWatermarkPolicies)
       .values({
@@ -35,7 +54,20 @@ export class DrizzleWatermarkPolicyRepository implements WatermarkPolicyReposito
         updatedBy: actorId,
       })
       .onConflictDoUpdate({
-        target: platformWatermarkPolicies.id,
+        target: table.id,
+        setWhere:
+          before &&
+          and(
+            eq(
+              sql<boolean>`(${table.enabled} and ${table.businessPagesEnabled})`,
+              before.enabled,
+            ),
+            eq(table.density, before.density),
+            eq(table.contentFields, before.contentFields),
+            eq(table.customContent, before.customContent),
+            eq(table.opacityPercent, before.opacityPercent),
+            eq(table.fontSize, before.fontSize),
+          ),
         set: {
           enabled: policy.enabled,
           businessPagesEnabled: policy.enabled,
@@ -49,8 +81,7 @@ export class DrizzleWatermarkPolicyRepository implements WatermarkPolicyReposito
         },
       })
       .returning();
-    if (!row) throw new Error("水印策略保存失败");
-    return toPolicy(row);
+    return row ? toPolicy(row) : undefined;
   }
 }
 

package/template/apps/server/src/settings/watermark-repository.ts

@@ -4,6 +4,11 @@ import {
 } from "@southwind-ai/shared";
 
 export interface WatermarkPolicyRepository {
+  updateIfCurrent(
+    before: PlatformWatermarkPolicy,
+    policy: PlatformWatermarkPolicy,
+    actorId: string,
+  ): Promise<PlatformWatermarkPolicy | undefined>;
   get(): Promise<PlatformWatermarkPolicy>;
   update(
     policy: PlatformWatermarkPolicy,
@@ -22,6 +27,15 @@ export class InMemoryWatermarkPolicyRepository implements WatermarkPolicyReposit
     return { ...this.policy };
   }
 
+  async updateIfCurrent(
+    before: PlatformWatermarkPolicy,
+    policy: PlatformWatermarkPolicy,
+    actorId: string,
+  ) {
+    if (JSON.stringify(this.policy) !== JSON.stringify(before)) return;
+    return this.update(policy, actorId);
+  }
+
   async update(
     policy: PlatformWatermarkPolicy,
     _actorId: string,

package/template/apps/server/src/settings/watermark-routes.test.ts

@@ -17,7 +17,9 @@ class FakeRouteApp implements RouteApp {
     this.handlers.set(`GET ${path}`, handler);
   }
 
-  post(): void {}
+  post(path: string, handler: (context: unknown) => unknown): void {
+    this.handlers.set(`POST ${path}`, handler);
+  }
 
   put(path: string, handler: (context: unknown) => unknown): void {
     this.handlers.set(`PUT ${path}`, handler);
@@ -25,7 +27,11 @@ class FakeRouteApp implements RouteApp {
 
   delete(): void {}
 
-  invoke(method: "GET" | "PUT", path: string, context: unknown = {}): unknown {
+  invoke(
+    method: "GET" | "POST" | "PUT",
+    path: string,
+    context: unknown = {},
+  ): unknown {
     const handler = this.handlers.get(`${method} ${path}`);
     if (!handler) throw new Error(`未注册路由 ${method} ${path}`);
     return handler(context);
@@ -206,6 +212,82 @@ describe("平台水印策略路由", () => {
   });
 });
 
+describe("水印 YAML 迁移", () => {
+  const path = "/system/settings/watermark/yaml";
+
+  test("导出白名单字段，预览不写入，拒绝过期确认并保留目标自定义内容", async () => {
+    const fixture = await createFixture(settingsActor(true));
+    const { app, guardContext, repository, runtime } = fixture;
+    const current = {
+      ...(await repository.get()),
+      customContent: "实例专用文字",
+    };
+    await update(fixture, current);
+
+    const exported = (await app.invoke("GET", path, {
+      guardContext,
+    })) as Response;
+    const yaml = (await exported.text()).replace("medium", "high");
+    expect(yaml).not.toContain("customContent");
+    expect(yaml).not.toContain(current.customContent);
+    const preview = async () =>
+      (await app.invoke("POST", `${path}/preview`, {
+        guardContext,
+        body: { yaml },
+      })) as { revision: string; changes: unknown[] };
+    const apply = (revision: string) =>
+      app.invoke("POST", path, {
+        guardContext,
+        body: { yaml, revision },
+      });
+
+    const first = await preview();
+    expect(first.changes).toEqual([
+      { key: "density", before: "medium", after: "high" },
+    ]);
+    expect(await repository.get()).toEqual(current);
+
+    await update(fixture, { ...current, density: "low" });
+    expect(((await apply(first.revision)) as Response).status).toBe(409);
+    expect((await repository.get()).density).toBe("low");
+    expect(await apply((await preview()).revision)).toMatchObject({
+      density: "high",
+      customContent: current.customContent,
+    });
+    expect(runtime.auditSink.list()).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          action: "config.update",
+          metadata: { source: "yaml", changedFields: ["density"] },
+        }),
+      ]),
+    );
+  });
+
+  test("只读用户无法预览，未知字段不能导入", async () => {
+    const reader = await createFixture(settingsActor(false));
+    const exported = (await reader.app.invoke("GET", path, {
+      guardContext: reader.guardContext,
+    })) as Response;
+    const yaml = await exported.text();
+    expect(
+      (
+        (await reader.app.invoke("POST", `${path}/preview`, {
+          guardContext: reader.guardContext,
+          body: { yaml },
+        })) as Response
+      ).status,
+    ).toBe(403);
+
+    const admin = await createFixture(settingsActor(true));
+    const invalid = (await admin.app.invoke("POST", `${path}/preview`, {
+      guardContext: admin.guardContext,
+      body: { yaml: `${yaml}  secret: redacted\n` },
+    })) as Response;
+    expect(invalid.status).toBe(400);
+  });
+});
+
 async function update(
   fixture: Awaited<ReturnType<typeof createFixture>>,
   body: PlatformWatermarkPolicy,

package/template/apps/server/src/settings/watermark-routes.ts

@@ -1,3 +1,4 @@
+import { systemApiPermissionBindings } from "@southwind-ai/modules";
 import type {
   ApiPermissionBinding,
   FeatureFlagDefinition,
@@ -15,6 +16,15 @@ import { resourceEvent, routeContext } from "../system/route-helpers.js";
 import type { RouteApp } from "../system/route-types.js";
 import type { WatermarkPolicyRepository } from "./watermark-repository.js";
 
+import {
+  exportWatermark,
+  readWatermarkTransfer,
+  watermarkPreview,
+} from "./watermark-transfer.js";
+
+const YAML_PATH = "/system/settings/watermark/yaml";
+const PREVIEW_PATH = `${YAML_PATH}/preview`;
+
 type ServerRuntime = ReturnType<typeof createServerRuntime>;
 
 const READ_BINDING = watermarkBinding("GET", "system.watermark.read");
@@ -28,6 +38,80 @@ export function registerWatermarkPolicyRoutes(
 ): void {
   const feature = findFeature(features, "system.watermark");
 
+  const exportBinding = yamlBinding("GET", YAML_PATH);
+  const previewBinding = yamlBinding("POST", PREVIEW_PATH);
+  const importBinding = yamlBinding("POST", YAML_PATH);
+
+  app.get(YAML_PATH, async (rawContext) => {
+    const { guardContext } = routeContext(rawContext);
+    const denied = await guard(runtime, guardContext, exportBinding, feature);
+    if (denied) return denied;
+    const yaml = exportWatermark(await repository.get());
+    return new Response(yaml, {
+      headers: {
+        "Content-Type": "application/yaml; charset=utf-8",
+        "Content-Disposition":
+          'attachment; filename="windy-admin-settings.yaml"',
+        "Cache-Control": "no-store",
+      },
+    });
+  });
+
+  async function transfer(rawContext: unknown, apply: boolean) {
+    const { body, guardContext } = routeContext(rawContext);
+    const denied = await guard(
+      runtime,
+      guardContext,
+      apply ? importBinding : previewBinding,
+      feature,
+    );
+    if (denied) return denied;
+
+    const request = body as { yaml?: unknown; revision?: unknown } | null;
+    const yaml = readWatermarkTransfer(request?.yaml);
+    if (!yaml)
+      return invalidYaml(
+        "文件须为 8 KiB 以内的版本 1 配置，且只能包含支持的字段",
+      );
+
+    const before = await repository.get();
+    const parsed = parseWatermarkPolicy({
+      ...yaml,
+      businessPagesEnabled: yaml.enabled,
+      customContent: before.customContent,
+    });
+    if (!parsed.ok) return invalidYaml(parsed.message);
+
+    const next = { ...parsed.value, customContent: before.customContent };
+    const preview = watermarkPreview(before, next, guardContext.actor.id);
+    if (!apply) return preview;
+    if (request?.revision !== preview.revision) return stalePreview();
+    if (!preview.changes.length) return before;
+
+    const updated = await repository.updateIfCurrent(
+      before,
+      next,
+      guardContext.actor.id,
+    );
+    if (!updated) return stalePreview();
+    await runtime.auditSink.recordCriticalEvent(
+      resourceEvent(
+        guardContext,
+        "config.update",
+        "platform-watermark",
+        "platform",
+        {
+          source: "yaml",
+          changedFields: changedFields(before, updated),
+        },
+      ),
+    );
+    return updated;
+  }
+
+  app.post(PREVIEW_PATH, (context) => transfer(context, false));
+  app.post(YAML_PATH, (context) => transfer(context, true));
+
   app.get("/platform/watermark-policy", () => repository.get());
 
   app.get("/system/settings/watermark", async (rawContext) => {
@@ -67,6 +151,31 @@ export function registerWatermarkPolicyRoutes(
   });
 }
 
+function yamlBinding(method: "GET" | "POST", path: string) {
+  const binding = systemApiPermissionBindings().find(
+    (entry) => entry.method === method && entry.path === `/api${path}`,
+  );
+  if (!binding) throw new Error(`水印 YAML API 未注册：${method} ${path}`);
+  return binding;
+}
+
+function invalidYaml(message: string) {
+  return Response.json(
+    { error: "INVALID_ADMIN_CONFIG_YAML", message },
+    { status: 400 },
+  );
+}
+
+function stalePreview() {
+  return Response.json(
+    {
+      error: "STALE_ADMIN_CONFIG_PREVIEW",
+      message: "配置或文件已变化，请重新预览",
+    },
+    { status: 409 },
+  );
+}
+
 async function guard(
   runtime: ServerRuntime,
   context: ReturnType<typeof routeContext>["guardContext"],

package/template/apps/server/src/settings/watermark-transfer.ts

@@ -0,0 +1,79 @@
+import { createHash } from "node:crypto";
+import type { PlatformWatermarkPolicy } from "@southwind-ai/shared";
+import { parseDocument, stringify, visit } from "yaml";
+
+const fields = [
+  "enabled",
+  "density",
+  "contentFields",
+  "opacityPercent",
+  "fontSize",
+] as const;
+
+export function portableWatermark(policy: PlatformWatermarkPolicy) {
+  return {
+    enabled: policy.enabled,
+    density: policy.density,
+    contentFields: policy.contentFields,
+    opacityPercent: policy.opacityPercent,
+    fontSize: policy.fontSize,
+  };
+}
+
+export function exportWatermark(policy: PlatformWatermarkPolicy) {
+  return stringify({ version: 1, watermark: portableWatermark(policy) });
+}
+
+export function readWatermarkTransfer(input: unknown) {
+  if (typeof input !== "string" || Buffer.byteLength(input) > 8192) return;
+  try {
+    const doc = parseDocument(input, { schema: "core", uniqueKeys: true });
+    if (doc.errors.length || doc.warnings.length) return;
+    let safe = true;
+    visit(doc, {
+      Alias() {
+        safe = false;
+      },
+      Node(_key, node) {
+        if (node.tag || node.anchor) safe = false;
+      },
+    });
+    if (!safe) return;
+    const value: unknown = doc.toJS({ maxAliasCount: 0 });
+    if (!hasFields(value, ["version", "watermark"]) || value.version !== 1)
+      return;
+    if (!hasFields(value.watermark, fields)) return;
+    return value.watermark;
+  } catch {
+    return;
+  }
+}
+
+function hasFields(
+  value: unknown,
+  keys: readonly string[],
+): value is Record<string, unknown> {
+  return (
+    !!value &&
+    typeof value === "object" &&
+    !Array.isArray(value) &&
+    Object.keys(value).length === keys.length &&
+    keys.every((key) => Object.hasOwn(value, key))
+  );
+}
+
+export function watermarkPreview(
+  before: PlatformWatermarkPolicy,
+  after: PlatformWatermarkPolicy,
+  actorId: string,
+) {
+  const current = portableWatermark(before);
+  const next = portableWatermark(after);
+  const changes = fields
+    .filter((key) => JSON.stringify(current[key]) !== JSON.stringify(next[key]))
+    .map((key) => ({ key, before: current[key], after: next[key] }));
+  const revision = createHash("sha256")
+    .update(JSON.stringify([actorId, current, next]))
+    .digest("hex");
+  return { changes, revision };
+}

package/template/apps/server/src/speech/facade-validation.ts

@@ -9,7 +9,7 @@ import type { RequestGuardContext } from "../guards.js";
 import {
   governProviderInput,
   ProviderInputGovernanceError,
-} from "../agent/provider-input-governance.js";
+} from "../ai-runtime-security/provider-input-governance.js";
 import { SpeechRuntimeError, type SpeechRuntimePort } from "./contracts.js";
 import { SpeechFacadeError } from "./errors.js";
 import { legacySpeechCapabilities } from "./facade-contract.js";

package/template/apps/server/src/speech/facade.ts

@@ -8,8 +8,8 @@ import type {
 } from "@southwind-ai/server-sdk";
 import { evaluateAccessGuards } from "../access-guards.js";
 import type { AiArtifactRuntime } from "../ai-artifact/runtime.js";
-import { ExecutionGrantStore } from "../agent/execution-grants.js";
-import { scopedRuntimeIdempotencyKey } from "../agent/idempotency-key.js";
+import { ExecutionGrantStore } from "../ai-runtime-security/execution-grants.js";
+import { scopedRuntimeIdempotencyKey } from "../ai-runtime-security/idempotency-key.js";
 import { auditActor, type RequestGuardContext } from "../guards.js";
 import type { InitializedModuleHosts } from "../module-host.js";
 import { toModuleActor } from "../module-host.js";