@fudanda/client 2.20261024.1-beta.1 → 2.20261024.1-beta.2

package/dist/shared/settings/modules/identity-security.js

@@ -0,0 +1,104 @@
+import * as z from 'zod';
+import { LOGIN_RISK_NEW_DEVICE_ACTIONS, MFA_MODES, SESSION_CONCURRENCY_SCOPES, SESSION_EXCEED_ACTIONS } from '../../identity/constants.js';
+import { defineSettingsModule } from '../module-def.js';
+export const identitySecuritySettingsSchema = z.object({
+    password: z.object({
+        minLength: z.int().min(6).max(64).default(6).meta({ title: '密码最小长度' }),
+        requireUppercase: z.boolean().default(false).meta({ title: '必须包含大写字母' }),
+        requireSpecialChar: z.boolean().default(false).meta({ title: '必须包含特殊字符' }),
+        expiryEnabled: z.boolean().default(false).meta({ title: '密码过期强制重置' }),
+        expiryDays: z.int().min(1).max(3650).default(90).meta({ title: '密码过期天数' }),
+    }).prefault({}).meta({ title: '密码策略' }),
+    loginChallenge: z.object({
+        maxAttemptsPerSource: z.int().min(1).max(1000).default(30).meta({
+            title: '单来源失败次数阈值',
+            description: '同一账号同一 IP 在窗口内的失败次数，达到后该来源登录需先通过验证码',
+        }),
+        sourceLimit: z.int().min(1).max(100).default(5).meta({
+            title: '多来源失败阈值',
+            description: '窗口内失败来源 IP 数达到后，该账号所有来源登录都需通过验证码（应对分布式猜解）',
+        }),
+        windowMinutes: z.int().min(1).max(1440).default(30).meta({
+            title: '计数窗口（分钟）',
+            description: '失败计数与验证码要求的持续时长',
+        }),
+        alert: z.object({
+            enabled: z.boolean().default(true).meta({
+                title: '登录失败突增告警',
+                description: '同一账号在窗口内出现多个失败来源或失败量异常时通知安全管理员，攻击进行中即可看到',
+            }),
+            sourceThreshold: z.int().min(2).max(100).default(3).meta({
+                title: '多来源告警阈值',
+                description: '窗口内失败来源 IP 数达到后告警一次（疑似分布式猜解）',
+            }),
+            failureThreshold: z.int().min(5).max(100000).default(60).meta({
+                title: '失败总量告警阈值',
+                description: '窗口内同一账号的失败总次数达到后告警一次（疑似口令爆破）',
+            }),
+        }).prefault({}).meta({ title: '突增告警' }),
+    }).prefault({}).meta({ title: '登录失败防护' }),
+    session: z.object({
+        maxSessions: z.int().min(0).max(20).default(0).meta({ title: '同时在线上限', description: '0 不限制；1 = 同一账号只能在一处登录；模拟登录会话不计入' }),
+        scope: z.enum(SESSION_CONCURRENCY_SCOPES).default('global').meta({ title: '统计范围', description: 'global 全部终端合计 / per-client 网页、移动审批、桌面端各算一份' }),
+        exceedAction: z.enum(SESSION_EXCEED_ACTIONS).default('kick-oldest').meta({ title: '超限处理', description: 'kick-oldest 新登录挤掉最早的会话 / reject-new 拒绝新登录，登录页可选择下线其它设备' }),
+    }).prefault({}).meta({ title: '会话并发' }),
+    mfa: z.object({
+        enabled: z.boolean().default(false).meta({ title: '启用 MFA' }),
+        mode: z.enum(MFA_MODES).default('off').meta({ title: 'MFA 模式', description: 'off 关闭 / optional 用户自选 / required 强制' }),
+        rememberDeviceDays: z.int().min(1).max(365).default(30).meta({ title: '可信设备免 MFA 天数' }),
+    }).prefault({}).meta({ title: '多因素认证' }),
+    risk: z.object({
+        enabled: z.boolean().default(false).meta({ title: '启用登录风险策略' }),
+        newDeviceAction: z.enum(LOGIN_RISK_NEW_DEVICE_ACTIONS).default('allow').meta({ title: '新设备登录动作', description: 'allow 放行 / challenge 要求 MFA' }),
+    }).prefault({}).meta({ title: '登录风险' }),
+    impersonation: z.object({
+        enabled: z.boolean().default(true).meta({ title: '允许模拟登录', description: '关闭后持有权限的管理员也无法以用户身份登录' }),
+        maxMinutes: z.int().min(1).max(120).default(30).meta({ title: '单次模拟时长上限（分钟）', description: '模拟会话到期自动失效，不可续期；上限 120 分钟' }),
+        allowWrite: z.boolean().default(false).meta({ title: '允许可操作模式', description: '关闭时模拟会话只能只读；开启后发起时可选择可操作' }),
+        notifyTarget: z.boolean().default(true).meta({ title: '通知被模拟用户', description: '开始模拟时向目标用户发送站内通知' }),
+    }).prefault({}).meta({ title: '模拟登录' }),
+}).meta({ id: 'Settings.IdentitySecurity' });
+export const identitySecuritySettingsModule = defineSettingsModule({
+    schema: identitySecuritySettingsSchema,
+    title: '身份安全',
+    description: '密码策略、登录失败防护、多因素认证与登录风险',
+    scope: 'tenant',
+    readPermission: 'system:identity-security:manage',
+    writePermission: 'system:identity-security:manage',
+    visibility: { password: 'public', impersonation: 'authenticated', session: 'authenticated' },
+    page: '/system/identity-security',
+    sort: 20,
+});
+export function validatePassword(password, policy) {
+    if (password.length < policy.minLength) {
+        return `密码长度不能少于 ${policy.minLength} 位`;
+    }
+    if (policy.requireUppercase && !/[A-Z]/.test(password)) {
+        return '密码必须包含至少一个大写字母';
+    }
+    if (policy.requireSpecialChar && !/[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?]/.test(password)) {
+        return '密码必须包含至少一个特殊字符';
+    }
+    return null;
+}
+export function formatPasswordPolicyHint(policy) {
+    if (!policy)
+        return '至少 6 位';
+    const parts = [`至少 ${policy.minLength} 位`];
+    if (policy.requireUppercase)
+        parts.push('包含大写字母');
+    if (policy.requireSpecialChar)
+        parts.push('包含特殊字符');
+    return parts.join('、');
+}
+export function formatSessionPolicyHint(policy) {
+    if (policy.maxSessions <= 0)
+        return '不限制同一账号的同时在线数量。';
+    const where = policy.scope === 'per-client' ? '每种终端（网页 / 移动审批 / 桌面端）各' : '';
+    const limit = policy.maxSessions === 1 ? '只能在一处登录' : `最多同时在 ${policy.maxSessions} 处登录`;
+    const action = policy.exceedAction === 'kick-oldest'
+        ? '新登录会挤掉最早登录的会话，被挤设备会收到提示'
+        : '超出后新登录会被拒绝，可在登录页选择下线其它设备后再登录';
+    return `同一账号${where}${limit}；${action}。模拟登录会话不计入。`;
+}
+//# sourceMappingURL=identity-security.js.map

package/dist/shared/settings/modules/identity-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-security.js","sourceRoot":"","sources":["../../../src/settings/modules/identity-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,6BAA6B,EAAE,SAAS,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACxI,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACtE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACxE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAC1E,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACrE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;KAC3E,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,oBAAoB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;YAC9D,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,qCAAqC;SACnD,CAAC;QACF,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACnD,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,2CAA2C;SACzD,CAAC;QACF,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;YACvD,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,iBAAiB;SAC/B,CAAC;QACF,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;YACd,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;gBACtC,KAAK,EAAE,UAAU;gBACjB,WAAW,EAAE,0CAA0C;aACxD,CAAC;YACF,eAAe,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACvD,KAAK,EAAE,SAAS;gBAChB,WAAW,EAAE,8BAA8B;aAC5C,CAAC;YACF,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;gBAC5D,KAAK,EAAE,UAAU;gBACjB,WAAW,EAAE,8BAA8B;aAC5C,CAAC;SACH,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;KACxC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;QACxH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;QAC9I,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,wDAAwD,EAAE,CAAC;KACnK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC7D,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;QACrH,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;KACxF,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAC/D,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;KAC/I,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;QAClG,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;QACzH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;QAC1G,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;KACpG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;CACxC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,2BAA2B,EAAE,CAAC,CAAC;AAQ7C,MAAM,CAAC,MAAM,8BAA8B,GAAG,oBAAoB,CAAC;IACjE,MAAM,EAAE,8BAA8B;IACtC,KAAK,EAAE,MAAM;IACb,WAAW,EAAE,wBAAwB;IACrC,KAAK,EAAE,QAAQ;IACf,cAAc,EAAE,iCAAiC;IACjD,eAAe,EAAE,iCAAiC;IAGlD,UAAU,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,OAAO,EAAE,eAAe,EAAE;IAC5F,IAAI,EAAE,2BAA2B;IACjC,IAAI,EAAE,EAAE;CACT,CAAC,CAAC;AAMH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAAqB;IACtE,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACvC,OAAO,YAAY,MAAM,CAAC,SAAS,IAAI,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,IAAI,MAAM,CAAC,kBAAkB,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,MAAM,UAAU,wBAAwB,CAAC,MAAwC;IAC/E,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC7B,MAAM,KAAK,GAAa,CAAC,MAAM,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,gBAAgB;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,kBAAkB;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAMD,MAAM,UAAU,uBAAuB,CAAC,MAAgC;IACtE,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,WAAW,MAAM,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,KAAK,aAAa;QAClD,CAAC,CAAC,yBAAyB;QAC3B,CAAC,CAAC,8BAA8B,CAAC;IACnC,OAAO,OAAO,KAAK,GAAG,KAAK,IAAI,MAAM,aAAa,CAAC;AACrD,CAAC"}

package/dist/shared/settings/modules/ip-access.d.ts

@@ -0,0 +1,16 @@
+import * as z from 'zod';
+export declare function isIpOrCidr(value: string): boolean;
+export declare const ipAccessSettingsSchema: z.ZodObject<{
+    whitelistEnabled: z.ZodDefault<z.ZodBoolean>;
+    whitelist: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    blacklistEnabled: z.ZodDefault<z.ZodBoolean>;
+    blacklist: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type IpAccessSettings = z.output<typeof ipAccessSettingsSchema>;
+export declare const ipAccessSettingsModule: import("../module-def.js").SettingsModuleDef<z.ZodObject<{
+    whitelistEnabled: z.ZodDefault<z.ZodBoolean>;
+    whitelist: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    blacklistEnabled: z.ZodDefault<z.ZodBoolean>;
+    blacklist: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>>;
+//# sourceMappingURL=ip-access.d.ts.map

package/dist/shared/settings/modules/ip-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-access.d.ts","sourceRoot":"","sources":["../../../src/settings/modules/ip-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AASzB,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjD;AAKD,eAAO,MAAM,sBAAsB;;;;;iBASC,CAAC;AAErC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEvE,eAAO,MAAM,sBAAsB;;;;;kBASjC,CAAC"}

package/dist/shared/settings/modules/ip-access.js

@@ -0,0 +1,30 @@
+import * as z from 'zod';
+import { defineSettingsModule } from '../module-def.js';
+const IPV4_SEGMENT = '(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)';
+const IPV4_PATTERN = new RegExp(`^(?:${IPV4_SEGMENT}\\.){3}${IPV4_SEGMENT}(?:\\/(?:3[0-2]|[12]?\\d))?$`);
+const IPV6_PATTERN = /^(?=.*:)[0-9a-fA-F:.]{2,45}(?:\/(?:12[0-8]|1[01]\d|[1-9]?\d))?$/;
+export function isIpOrCidr(value) {
+    return IPV4_PATTERN.test(value) || IPV6_PATTERN.test(value);
+}
+const ipOrCidrSchema = z.string().trim().min(1).max(64).refine(isIpOrCidr, '必须是合法的 IP 或 CIDR（如 10.0.0.0/8）');
+export const ipAccessSettingsSchema = z.object({
+    whitelistEnabled: z.boolean().default(false)
+        .meta({ title: '启用白名单', description: '开启后仅名单内 IP 可访问接口（登录等免检路径除外）' }),
+    whitelist: z.array(ipOrCidrSchema).max(1000).default(() => [])
+        .meta({ title: '白名单', description: 'IP 或 CIDR，支持 IPv4 / IPv6' }),
+    blacklistEnabled: z.boolean().default(false)
+        .meta({ title: '启用黑名单', description: '开启后名单内 IP 一律拒绝（黑名单优先于白名单）' }),
+    blacklist: z.array(ipOrCidrSchema).max(1000).default(() => [])
+        .meta({ title: '黑名单', description: 'IP 或 CIDR，支持 IPv4 / IPv6' }),
+}).meta({ id: 'Settings.IpAccess' });
+export const ipAccessSettingsModule = defineSettingsModule({
+    schema: ipAccessSettingsSchema,
+    title: 'IP 访问控制',
+    description: '接口层 IP 黑白名单',
+    scope: 'platform',
+    readPermission: 'system:ip-access:view',
+    writePermission: 'system:ip-access:update',
+    page: '/system/ip-access',
+    sort: 110,
+});
+//# sourceMappingURL=ip-access.js.map

package/dist/shared/settings/modules/ip-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-access.js","sourceRoot":"","sources":["../../../src/settings/modules/ip-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAC/D,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,OAAO,YAAY,UAAU,YAAY,8BAA8B,CAAC,CAAC;AAEzG,MAAM,YAAY,GAAG,iEAAiE,CAAC;AAGvF,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,gCAAgC,CAAC,CAAC;AAG7G,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACzC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;SAC3D,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IAClE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACzC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;IACrE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;SAC3D,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;CACnE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAIrC,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;IACzD,MAAM,EAAE,sBAAsB;IAC9B,KAAK,EAAE,SAAS;IAChB,WAAW,EAAE,aAAa;IAC1B,KAAK,EAAE,UAAU;IACjB,cAAc,EAAE,uBAAuB;IACvC,eAAe,EAAE,yBAAyB;IAC1C,IAAI,EAAE,mBAAmB;IACzB,IAAI,EAAE,GAAG;CACV,CAAC,CAAC"}

package/dist/shared/settings/modules/member.d.ts

@@ -0,0 +1,15 @@
+import * as z from 'zod';
+export declare const memberSettingsSchema: z.ZodObject<{
+    pointExpireDays: z.ZodDefault<z.ZodInt>;
+    birthdayPoints: z.ZodDefault<z.ZodInt>;
+    birthdayCouponId: z.ZodDefault<z.ZodNullable<z.ZodInt>>;
+    inviteRewardPoints: z.ZodDefault<z.ZodInt>;
+}, z.core.$strip>;
+export type MemberSettings = z.output<typeof memberSettingsSchema>;
+export declare const memberSettingsModule: import("../module-def.js").SettingsModuleDef<z.ZodObject<{
+    pointExpireDays: z.ZodDefault<z.ZodInt>;
+    birthdayPoints: z.ZodDefault<z.ZodInt>;
+    birthdayCouponId: z.ZodDefault<z.ZodNullable<z.ZodInt>>;
+    inviteRewardPoints: z.ZodDefault<z.ZodInt>;
+}, z.core.$strip>>;
+//# sourceMappingURL=member.d.ts.map

package/dist/shared/settings/modules/member.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"member.d.ts","sourceRoot":"","sources":["../../../src/settings/modules/member.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAIzB,eAAO,MAAM,oBAAoB;;;;;iBASC,CAAC;AAEnC,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEnE,eAAO,MAAM,oBAAoB;;;;;kBAS/B,CAAC"}

package/dist/shared/settings/modules/member.js

@@ -0,0 +1,23 @@
+import * as z from 'zod';
+import { defineSettingsModule } from '../module-def.js';
+export const memberSettingsSchema = z.object({
+    pointExpireDays: z.int().min(0).max(3650).default(0)
+        .meta({ title: '积分不活跃过期天数', description: '账户超过 N 天无任何积分变动时余额自动过期清零（expire 流水可审计）；0 表示永不过期' }),
+    birthdayPoints: z.int().min(0).max(1_000_000).default(0)
+        .meta({ title: '生日礼积分', description: '生日当天自动发放（每年一次）；0 表示不发放' }),
+    birthdayCouponId: z.int().positive().nullable().default(null)
+        .meta({ title: '生日礼优惠券模板 ID', description: '生日当天自动发放该券（每年一次）；留空表示不发放' }),
+    inviteRewardPoints: z.int().min(0).max(1_000_000).default(0)
+        .meta({ title: '邀请奖励积分', description: '新会员通过邀请码注册成功后发给邀请人；0 表示不奖励' }),
+}).meta({ id: 'Settings.Member' });
+export const memberSettingsModule = defineSettingsModule({
+    schema: memberSettingsSchema,
+    title: '会员权益',
+    description: '积分过期、生日礼与邀请奖励',
+    scope: 'platform',
+    feature: 'member',
+    readPermission: 'system:setting:view',
+    writePermission: 'system:setting:update',
+    sort: 60,
+});
+//# sourceMappingURL=member.js.map

package/dist/shared/settings/modules/member.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"member.js","sourceRoot":"","sources":["../../../src/settings/modules/member.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,eAAe,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SACjD,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;IAC/F,cAAc,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SACrD,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;IAClE,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;SAC1D,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IAC1E,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SACzD,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;CACxE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAInC,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;IACvD,MAAM,EAAE,oBAAoB;IAC5B,KAAK,EAAE,MAAM;IACb,WAAW,EAAE,eAAe;IAC5B,KAAK,EAAE,UAAU;IACjB,OAAO,EAAE,QAAQ;IACjB,cAAc,EAAE,qBAAqB;IACrC,eAAe,EAAE,uBAAuB;IACxC,IAAI,EAAE,EAAE;CACT,CAAC,CAAC"}

package/dist/shared/settings/modules/payment.d.ts

@@ -0,0 +1,25 @@
+import * as z from 'zod';
+export declare const paymentSettingsSchema: z.ZodObject<{
+    refundApprovalThreshold: z.ZodDefault<z.ZodInt>;
+    transferApprovalThreshold: z.ZodDefault<z.ZodInt>;
+    reconEnabled: z.ZodDefault<z.ZodBoolean>;
+    reconDownloadHour: z.ZodDefault<z.ZodInt>;
+    reconWaitMinutes: z.ZodDefault<z.ZodInt>;
+    reconDeadlineHours: z.ZodDefault<z.ZodInt>;
+    reconCaseSlaHours: z.ZodDefault<z.ZodInt>;
+    reconAlertUserIds: z.ZodDefault<z.ZodArray<z.ZodInt>>;
+    reconApprovalDefinitionId: z.ZodDefault<z.ZodNullable<z.ZodInt>>;
+}, z.core.$strip>;
+export type PaymentSettings = z.output<typeof paymentSettingsSchema>;
+export declare const paymentSettingsModule: import("../module-def.js").SettingsModuleDef<z.ZodObject<{
+    refundApprovalThreshold: z.ZodDefault<z.ZodInt>;
+    transferApprovalThreshold: z.ZodDefault<z.ZodInt>;
+    reconEnabled: z.ZodDefault<z.ZodBoolean>;
+    reconDownloadHour: z.ZodDefault<z.ZodInt>;
+    reconWaitMinutes: z.ZodDefault<z.ZodInt>;
+    reconDeadlineHours: z.ZodDefault<z.ZodInt>;
+    reconCaseSlaHours: z.ZodDefault<z.ZodInt>;
+    reconAlertUserIds: z.ZodDefault<z.ZodArray<z.ZodInt>>;
+    reconApprovalDefinitionId: z.ZodDefault<z.ZodNullable<z.ZodInt>>;
+}, z.core.$strip>>;
+//# sourceMappingURL=payment.d.ts.map

package/dist/shared/settings/modules/payment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment.d.ts","sourceRoot":"","sources":["../../../src/settings/modules/payment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAIzB,eAAO,MAAM,qBAAqB;;;;;;;;;;iBAeC,CAAC;AAEpC,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAErE,eAAO,MAAM,qBAAqB;;;;;;;;;;kBAShC,CAAC"}

package/dist/shared/settings/modules/payment.js

@@ -0,0 +1,29 @@
+import * as z from 'zod';
+import { defineSettingsModule } from '../module-def.js';
+export const paymentSettingsSchema = z.object({
+    refundApprovalThreshold: z.int().min(0).max(1_000_000_000_000).default(0)
+        .meta({ title: '退款审批阈值（分）', description: '单笔退款达到该金额时进入四眼审批；0 表示不启用' }),
+    transferApprovalThreshold: z.int().min(0).max(1_000_000_000_000).default(100_000)
+        .meta({ title: '转账审批阈值（分）', description: '单笔转账达到该金额时进入四眼审批；0 表示不启用' }),
+    reconEnabled: z.boolean().default(true).meta({ title: '自动渠道对账' }),
+    reconDownloadHour: z.int().min(0).max(23).default(10)
+        .meta({ title: '次日开始取账小时', description: '渠道账单时区；未出账继续等待，不视作零交易' }),
+    reconWaitMinutes: z.int().min(5).max(1440).default(60).meta({ title: '未出账复查间隔（分钟）' }),
+    reconDeadlineHours: z.int().min(12).max(720).default(36).meta({ title: '账单逾期时限（小时）' }),
+    reconCaseSlaHours: z.int().min(1).max(2160).default(48).meta({ title: '差异处置时限（小时）' }),
+    reconAlertUserIds: z.array(z.int().positive()).default([])
+        .meta({ title: '对账通知接收人', description: '当前租户用户ID；未配置时发送给业务经办人' }),
+    reconApprovalDefinitionId: z.int().positive().nullable().default(null)
+        .meta({ title: '资金调整审批流程', description: '已发布的业务系统主导流程；必须包含非申请人的人工审批' }),
+}).meta({ id: 'Settings.Payment' });
+export const paymentSettingsModule = defineSettingsModule({
+    schema: paymentSettingsSchema,
+    title: '支付与对账',
+    description: '资金审批、自动对账与异常处理策略',
+    scope: 'tenant',
+    feature: 'payment',
+    readPermission: 'system:setting:view',
+    writePermission: 'system:setting:update',
+    sort: 90,
+});
+//# sourceMappingURL=payment.js.map

package/dist/shared/settings/modules/payment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment.js","sourceRoot":"","sources":["../../../src/settings/modules/payment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,uBAAuB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SACtE,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IACxE,yBAAyB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;SAC9E,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IACxE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACjE,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SAClD,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;IACpE,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IACrF,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtF,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACrF,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;IACnE,yBAAyB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;SACnE,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;CAC1E,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAIpC,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;IACxD,MAAM,EAAE,qBAAqB;IAC7B,KAAK,EAAE,OAAO;IACd,WAAW,EAAE,kBAAkB;IAC/B,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,qBAAqB;IACrC,eAAe,EAAE,uBAAuB;IACxC,IAAI,EAAE,EAAE;CACT,CAAC,CAAC"}

package/dist/shared/settings/modules/rules.d.ts

@@ -0,0 +1,9 @@
+import * as z from 'zod';
+export declare const rulesSettingsSchema: z.ZodObject<{
+    publishApproval: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type RulesSettings = z.output<typeof rulesSettingsSchema>;
+export declare const rulesSettingsModule: import("../module-def.js").SettingsModuleDef<z.ZodObject<{
+    publishApproval: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>>;
+//# sourceMappingURL=rules.d.ts.map

package/dist/shared/settings/modules/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../src/settings/modules/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAIzB,eAAO,MAAM,mBAAmB;;iBAGC,CAAC;AAElC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEjE,eAAO,MAAM,mBAAmB;;kBAW9B,CAAC"}

package/dist/shared/settings/modules/rules.js

@@ -0,0 +1,18 @@
+import * as z from 'zod';
+import { defineSettingsModule } from '../module-def.js';
+export const rulesSettingsSchema = z.object({
+    publishApproval: z.boolean().default(false)
+        .meta({ title: '决策表发布审批', description: '四眼原则：开启后发布需先提交申请，由具有「审批发布」权限的其他用户批准后生效' }),
+}).meta({ id: 'Settings.Rules' });
+export const rulesSettingsModule = defineSettingsModule({
+    schema: rulesSettingsSchema,
+    title: '规则引擎',
+    description: '决策表发布审批',
+    scope: 'platform',
+    feature: 'rules',
+    readPermission: 'system:setting:view',
+    writePermission: 'system:setting:update',
+    visibility: { publishApproval: 'authenticated' },
+    sort: 80,
+});
+//# sourceMappingURL=rules.js.map

package/dist/shared/settings/modules/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../src/settings/modules/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACxC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;CACrF,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAIlC,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;IACtD,MAAM,EAAE,mBAAmB;IAC3B,KAAK,EAAE,MAAM;IACb,WAAW,EAAE,SAAS;IACtB,KAAK,EAAE,UAAU;IACjB,OAAO,EAAE,OAAO;IAChB,cAAc,EAAE,qBAAqB;IACrC,eAAe,EAAE,uBAAuB;IAExC,UAAU,EAAE,EAAE,eAAe,EAAE,eAAe,EAAE;IAChD,IAAI,EAAE,EAAE;CACT,CAAC,CAAC"}

package/dist/shared/settings/modules/sql-monitor.d.ts

@@ -0,0 +1,15 @@
+import * as z from 'zod';
+export declare const sqlMonitorSettingsSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    sampleIntervalMinutes: z.ZodDefault<z.ZodInt>;
+    sampleLimit: z.ZodDefault<z.ZodInt>;
+    queryTextMaxChars: z.ZodDefault<z.ZodInt>;
+}, z.core.$strip>;
+export type SqlMonitorSettings = z.output<typeof sqlMonitorSettingsSchema>;
+export declare const sqlMonitorSettingsModule: import("../module-def.js").SettingsModuleDef<z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    sampleIntervalMinutes: z.ZodDefault<z.ZodInt>;
+    sampleLimit: z.ZodDefault<z.ZodInt>;
+    queryTextMaxChars: z.ZodDefault<z.ZodInt>;
+}, z.core.$strip>>;
+//# sourceMappingURL=sql-monitor.d.ts.map

package/dist/shared/settings/modules/sql-monitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-monitor.d.ts","sourceRoot":"","sources":["../../../src/settings/modules/sql-monitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAIzB,eAAO,MAAM,wBAAwB;;;;;iBASC,CAAC;AAEvC,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE3E,eAAO,MAAM,wBAAwB;;;;;kBASnC,CAAC"}

package/dist/shared/settings/modules/sql-monitor.js

@@ -0,0 +1,23 @@
+import * as z from 'zod';
+import { defineSettingsModule } from '../module-def.js';
+export const sqlMonitorSettingsSchema = z.object({
+    enabled: z.boolean().default(true)
+        .meta({ title: '启用 SQL 查询采样', description: '关闭后保留实时查询统计，停止分钟级历史采样' }),
+    sampleIntervalMinutes: z.int().min(1).max(60).default(1)
+        .meta({ title: '采样间隔（分钟）', description: '系统调度每分钟触发一次，实际采样按此间隔执行' }),
+    sampleLimit: z.int().min(20).max(500).default(200)
+        .meta({ title: '每次采样查询数', description: '按累计总耗时取 Top N；数值越大，历史明细写入量越高' }),
+    queryTextMaxChars: z.int().min(200).max(2_000).default(2_000)
+        .meta({ title: 'SQL 文本最大长度', description: '入库前再次截断已归一化 SQL，避免异常长语句占用采样存储' }),
+}).meta({ id: 'Settings.SqlMonitor' });
+export const sqlMonitorSettingsModule = defineSettingsModule({
+    schema: sqlMonitorSettingsSchema,
+    title: 'SQL 监控',
+    description: 'pg_stat_statements 查询统计采样与历史留存设置',
+    scope: 'platform',
+    readPermission: 'system:sql-monitor:list',
+    writePermission: 'system:sql-monitor:manage',
+    platformOnly: 'multi-tenant',
+    sort: 56,
+});
+//# sourceMappingURL=sql-monitor.js.map

package/dist/shared/settings/modules/sql-monitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-monitor.js","sourceRoot":"","sources":["../../../src/settings/modules/sql-monitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;SAC/B,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;IACvE,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SACrD,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;IACrE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;SAC/C,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAC1E,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;SAC1D,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;CAC/E,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAIvC,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;IAC3D,MAAM,EAAE,wBAAwB;IAChC,KAAK,EAAE,QAAQ;IACf,WAAW,EAAE,kCAAkC;IAC/C,KAAK,EAAE,UAAU;IACjB,cAAc,EAAE,yBAAyB;IACzC,eAAe,EAAE,2BAA2B;IAC5C,YAAY,EAAE,cAAc;IAC5B,IAAI,EAAE,EAAE;CACT,CAAC,CAAC"}

package/dist/shared/settings/modules/terminal.d.ts

@@ -0,0 +1,15 @@
+import * as z from 'zod';
+export declare const terminalSettingsSchema: z.ZodObject<{
+    recordingEnabled: z.ZodDefault<z.ZodBoolean>;
+    recordingRetainDays: z.ZodDefault<z.ZodInt>;
+    recordingMaxSizeMb: z.ZodDefault<z.ZodInt>;
+    uploadMaxSizeMb: z.ZodDefault<z.ZodInt>;
+}, z.core.$strip>;
+export type TerminalSettings = z.output<typeof terminalSettingsSchema>;
+export declare const terminalSettingsModule: import("../module-def.js").SettingsModuleDef<z.ZodObject<{
+    recordingEnabled: z.ZodDefault<z.ZodBoolean>;
+    recordingRetainDays: z.ZodDefault<z.ZodInt>;
+    recordingMaxSizeMb: z.ZodDefault<z.ZodInt>;
+    uploadMaxSizeMb: z.ZodDefault<z.ZodInt>;
+}, z.core.$strip>>;
+//# sourceMappingURL=terminal.d.ts.map

package/dist/shared/settings/modules/terminal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal.d.ts","sourceRoot":"","sources":["../../../src/settings/modules/terminal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAIzB,eAAO,MAAM,sBAAsB;;;;;iBASC,CAAC;AAErC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEvE,eAAO,MAAM,sBAAsB;;;;;kBAWjC,CAAC"}

package/dist/shared/settings/modules/terminal.js

@@ -0,0 +1,24 @@
+import * as z from 'zod';
+import { defineSettingsModule } from '../module-def.js';
+export const terminalSettingsSchema = z.object({
+    recordingEnabled: z.boolean().default(false)
+        .meta({ title: '终端录屏', description: '开启后前端记录终端输入输出并在会话结束时提交' }),
+    recordingRetainDays: z.int().min(0).max(3650).default(30)
+        .meta({ title: '录屏保留天数', description: '超过天数的录屏由每日清理任务删除；0 表示不按天数清理' }),
+    recordingMaxSizeMb: z.int().min(0).max(1_000_000).default(500)
+        .meta({ title: '录屏总容量上限（MB）', description: '超出后按时间从旧到新删除；0 表示不限制' }),
+    uploadMaxSizeMb: z.int().min(0).max(102_400).default(200)
+        .meta({ title: '文件上传大小上限（MB）', description: '文件管理器 / SFTP 单文件上限；该链路整份读入内存，0 表示不限制' }),
+}).meta({ id: 'Settings.Terminal' });
+export const terminalSettingsModule = defineSettingsModule({
+    schema: terminalSettingsSchema,
+    title: 'Web 终端',
+    description: '终端录屏与文件传输限制',
+    scope: 'platform',
+    feature: 'ops',
+    readPermission: 'system:setting:view',
+    writePermission: 'system:setting:update',
+    visibility: { recordingEnabled: 'authenticated' },
+    sort: 50,
+});
+//# sourceMappingURL=terminal.js.map

package/dist/shared/settings/modules/terminal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal.js","sourceRoot":"","sources":["../../../src/settings/modules/terminal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACzC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;IACjE,mBAAmB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACtD,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;IACxE,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;SAC3D,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;IACtE,eAAe,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;SACtD,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;CACxF,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAIrC,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;IACzD,MAAM,EAAE,sBAAsB;IAC9B,KAAK,EAAE,QAAQ;IACf,WAAW,EAAE,aAAa;IAC1B,KAAK,EAAE,UAAU;IACjB,OAAO,EAAE,KAAK;IACd,cAAc,EAAE,qBAAqB;IACrC,eAAe,EAAE,uBAAuB;IAExC,UAAU,EAAE,EAAE,gBAAgB,EAAE,eAAe,EAAE;IACjD,IAAI,EAAE,EAAE;CACT,CAAC,CAAC"}

package/dist/shared/settings/modules/ui.d.ts

@@ -0,0 +1,27 @@
+import * as z from 'zod';
+export declare const uiSettingsSchema: z.ZodObject<{
+    watermark: z.ZodPrefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        content: z.ZodDefault<z.ZodString>;
+        fontSize: z.ZodDefault<z.ZodInt>;
+        opacity: z.ZodDefault<z.ZodInt>;
+    }, z.core.$strip>>;
+    quickChatEnabled: z.ZodDefault<z.ZodBoolean>;
+    feedbackEntryEnabled: z.ZodDefault<z.ZodBoolean>;
+    preferencesEntryEnabled: z.ZodDefault<z.ZodBoolean>;
+    preferences: z.ZodPrefault<z.ZodType<import("../../generated/api/identity.js").ApiPreferencePolicy, import("../../generated/api/identity.js").ApiPreferencePolicyInput, z.core.$ZodTypeInternals<import("../../generated/api/identity.js").ApiPreferencePolicy, import("../../generated/api/identity.js").ApiPreferencePolicyInput>>>;
+}, z.core.$strip>;
+export type UiSettings = z.output<typeof uiSettingsSchema>;
+export declare const uiSettingsModule: import("../module-def.js").SettingsModuleDef<z.ZodObject<{
+    watermark: z.ZodPrefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        content: z.ZodDefault<z.ZodString>;
+        fontSize: z.ZodDefault<z.ZodInt>;
+        opacity: z.ZodDefault<z.ZodInt>;
+    }, z.core.$strip>>;
+    quickChatEnabled: z.ZodDefault<z.ZodBoolean>;
+    feedbackEntryEnabled: z.ZodDefault<z.ZodBoolean>;
+    preferencesEntryEnabled: z.ZodDefault<z.ZodBoolean>;
+    preferences: z.ZodPrefault<z.ZodType<import("../../generated/api/identity.js").ApiPreferencePolicy, import("../../generated/api/identity.js").ApiPreferencePolicyInput, z.core.$ZodTypeInternals<import("../../generated/api/identity.js").ApiPreferencePolicy, import("../../generated/api/identity.js").ApiPreferencePolicyInput>>>;
+}, z.core.$strip>>;
+//# sourceMappingURL=ui.d.ts.map

package/dist/shared/settings/modules/ui.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../../../src/settings/modules/ui.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAKzB,eAAO,MAAM,gBAAgB;;;;;;;;;;;iBAcC,CAAC;AAE/B,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE3D,eAAO,MAAM,gBAAgB;;;;;;;;;;;kBAS3B,CAAC"}

package/dist/shared/settings/modules/ui.js

@@ -0,0 +1,29 @@
+import * as z from 'zod';
+import { defineSettingsModule } from '../module-def.js';
+import { preferencePolicySchema, defaultPreferencePolicy } from '../../preferences/index.js';
+export const uiSettingsSchema = z.object({
+    watermark: z.object({
+        enabled: z.boolean().default(false).meta({ title: '页面水印', description: '开启后全站叠加水印（防截图泄漏）' }),
+        content: z.string().max(200).default('').meta({ title: '水印文本', description: '留空则显示当前用户名' }),
+        fontSize: z.int().min(8).max(72).default(14).meta({ title: '字体大小（px）' }),
+        opacity: z.int().min(1).max(100).default(15).meta({ title: '透明度（1-100）' }),
+    }).prefault({}).meta({ title: '水印' }),
+    quickChatEnabled: z.boolean().default(false)
+        .meta({ title: '快捷聊天按钮', description: '全局开关，关闭后偏好设置中的相关选项同步隐藏' }),
+    feedbackEntryEnabled: z.boolean().default(false)
+        .meta({ title: '意见反馈入口', description: '显示在用户头像下拉菜单，关闭后用户无法提交反馈' }),
+    preferencesEntryEnabled: z.boolean().default(true)
+        .meta({ title: '偏好设置入口', description: '显示在用户头像下拉菜单，关闭后隐藏“偏好设置”（含锁屏密码设置）' }),
+    preferences: preferencePolicySchema.prefault(defaultPreferencePolicy).meta({ title: '偏好默认值与用户权限', description: '设置所有用户的默认偏好，并控制每项是否允许个人覆盖' }),
+}).meta({ id: 'Settings.Ui' });
+export const uiSettingsModule = defineSettingsModule({
+    schema: uiSettingsSchema,
+    title: '界面与体验',
+    description: '页面水印、快捷聊天、意见反馈与偏好设置入口、偏好策略',
+    scope: 'platform',
+    readPermission: 'system:setting:view',
+    writePermission: 'system:setting:update',
+    visibility: { watermark: 'authenticated', quickChatEnabled: 'authenticated', feedbackEntryEnabled: 'authenticated', preferencesEntryEnabled: 'authenticated', preferences: 'authenticated' },
+    sort: 30,
+});
+//# sourceMappingURL=ui.js.map

package/dist/shared/settings/modules/ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.js","sourceRoot":"","sources":["../../../src/settings/modules/ui.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAGpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAC5F,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;QAC3F,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACxE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;KAC3E,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACrC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACzC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;IACnE,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SAC7C,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;IACpE,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;SAC/C,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAC7E,WAAW,EAAE,sBAAsB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;CAC9I,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;AAI/B,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;IACnD,MAAM,EAAE,gBAAgB;IACxB,KAAK,EAAE,OAAO;IACd,WAAW,EAAE,4BAA4B;IACzC,KAAK,EAAE,UAAU;IACjB,cAAc,EAAE,qBAAqB;IACrC,eAAe,EAAE,uBAAuB;IACxC,UAAU,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,oBAAoB,EAAE,eAAe,EAAE,uBAAuB,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE;IAC5L,IAAI,EAAE,EAAE;CACT,CAAC,CAAC"}

package/dist/shared/settings/modules/wiki.d.ts

@@ -0,0 +1,27 @@
+import * as z from 'zod';
+export declare const wikiSettingsSchema: z.ZodObject<{
+    requireApproval: z.ZodDefault<z.ZodBoolean>;
+    defaultVisibility: z.ZodDefault<z.ZodEnum<{
+        private: "private";
+        public: "public";
+    }>>;
+    aiSyncEnabled: z.ZodDefault<z.ZodBoolean>;
+    aiSyncKbId: z.ZodDefault<z.ZodNullable<z.ZodInt>>;
+    commentsEnabled: z.ZodDefault<z.ZodBoolean>;
+    recycleRetentionDays: z.ZodDefault<z.ZodInt>;
+    pendingRemindHours: z.ZodDefault<z.ZodInt>;
+}, z.core.$strip>;
+export type WikiSettings = z.output<typeof wikiSettingsSchema>;
+export declare const wikiSettingsModule: import("../module-def.js").SettingsModuleDef<z.ZodObject<{
+    requireApproval: z.ZodDefault<z.ZodBoolean>;
+    defaultVisibility: z.ZodDefault<z.ZodEnum<{
+        private: "private";
+        public: "public";
+    }>>;
+    aiSyncEnabled: z.ZodDefault<z.ZodBoolean>;
+    aiSyncKbId: z.ZodDefault<z.ZodNullable<z.ZodInt>>;
+    commentsEnabled: z.ZodDefault<z.ZodBoolean>;
+    recycleRetentionDays: z.ZodDefault<z.ZodInt>;
+    pendingRemindHours: z.ZodDefault<z.ZodInt>;
+}, z.core.$strip>>;
+//# sourceMappingURL=wiki.d.ts.map

package/dist/shared/settings/modules/wiki.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wiki.d.ts","sourceRoot":"","sources":["../../../src/settings/modules/wiki.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAKzB,eAAO,MAAM,kBAAkB;;;;;;;;;;;iBAeC,CAAC;AAEjC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE/D,eAAO,MAAM,kBAAkB;;;;;;;;;;;kBAU7B,CAAC"}

package/dist/shared/settings/modules/wiki.js

@@ -0,0 +1,31 @@
+import * as z from 'zod';
+import { WIKI_SPACE_VISIBILITIES } from '../../wiki/constants.js';
+import { defineSettingsModule } from '../module-def.js';
+export const wikiSettingsSchema = z.object({
+    requireApproval: z.boolean().default(true)
+        .meta({ title: '发布需要审核', description: '关闭时提交即发布' }),
+    defaultVisibility: z.enum(WIKI_SPACE_VISIBILITIES).default('public')
+        .meta({ title: '新建空间默认可见性' }),
+    aiSyncEnabled: z.boolean().default(false)
+        .meta({ title: '同步 AI 知识库', description: '发布文档自动同步到 AI 知识库' }),
+    aiSyncKbId: z.int().positive().nullable().default(null)
+        .meta({ title: '同步目标知识库 ID', description: '留空表示未指定' }),
+    commentsEnabled: z.boolean().default(true)
+        .meta({ title: '允许评论' }),
+    recycleRetentionDays: z.int().min(0).max(3650).default(0)
+        .meta({ title: '回收站保留天数', description: '0 表示永久保留' }),
+    pendingRemindHours: z.int().min(1).max(720).default(48)
+        .meta({ title: '审核积压提醒时限（小时）' }),
+}).meta({ id: 'Settings.Wiki' });
+export const wikiSettingsModule = defineSettingsModule({
+    schema: wikiSettingsSchema,
+    title: '知识中心',
+    description: '发布审核、默认可见性、评论与 AI 同步',
+    scope: 'platform',
+    feature: 'wiki',
+    readPermission: 'wiki:setting:view',
+    writePermission: 'wiki:setting:edit',
+    page: '/wiki/settings',
+    sort: 130,
+});
+//# sourceMappingURL=wiki.js.map

package/dist/shared/settings/modules/wiki.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wiki.js","sourceRoot":"","sources":["../../../src/settings/modules/wiki.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;SACvC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IACrD,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;SACjE,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACtC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAChE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;SACpD,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACxD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;SACvC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC1B,oBAAoB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SACtD,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IACtD,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACpD,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;CACnC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;AAIjC,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;IACrD,MAAM,EAAE,kBAAkB;IAC1B,KAAK,EAAE,MAAM;IACb,WAAW,EAAE,sBAAsB;IACnC,KAAK,EAAE,UAAU;IACjB,OAAO,EAAE,MAAM;IACf,cAAc,EAAE,mBAAmB;IACnC,eAAe,EAAE,mBAAmB;IACpC,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE,GAAG;CACV,CAAC,CAAC"}

package/dist/shared/settings/modules/workflow.d.ts

@@ -0,0 +1,25 @@
+import * as z from 'zod';
+export declare const workflowSettingsSchema: z.ZodObject<{
+    engine: z.ZodPrefault<z.ZodObject<{
+        healthWarn: z.ZodDefault<z.ZodNumber>;
+        healthCritical: z.ZodDefault<z.ZodNumber>;
+        backlogWarn: z.ZodDefault<z.ZodInt>;
+        backlogCritical: z.ZodDefault<z.ZodInt>;
+        errorRateWarn: z.ZodDefault<z.ZodNumber>;
+        errorRateCritical: z.ZodDefault<z.ZodNumber>;
+        apdexThresholdMs: z.ZodDefault<z.ZodInt>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type WorkflowSettings = z.output<typeof workflowSettingsSchema>;
+export declare const workflowSettingsModule: import("../module-def.js").SettingsModuleDef<z.ZodObject<{
+    engine: z.ZodPrefault<z.ZodObject<{
+        healthWarn: z.ZodDefault<z.ZodNumber>;
+        healthCritical: z.ZodDefault<z.ZodNumber>;
+        backlogWarn: z.ZodDefault<z.ZodInt>;
+        backlogCritical: z.ZodDefault<z.ZodInt>;
+        errorRateWarn: z.ZodDefault<z.ZodNumber>;
+        errorRateCritical: z.ZodDefault<z.ZodNumber>;
+        apdexThresholdMs: z.ZodDefault<z.ZodInt>;
+    }, z.core.$strip>>;
+}, z.core.$strip>>;
+//# sourceMappingURL=workflow.d.ts.map

package/dist/shared/settings/modules/workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../../src/settings/modules/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAIzB,eAAO,MAAM,sBAAsB;;;;;;;;;;iBAUC,CAAC;AAErC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEvE,eAAO,MAAM,sBAAsB;;;;;;;;;;kBASjC,CAAC"}