create-windy 0.1.0

package/template/packages/license-sdk/src/test-fixtures.ts

@@ -0,0 +1,59 @@
+import { generateKeyPairSync, sign } from "node:crypto";
+import type {
+  LegacyPrototypeLicenseClaims as LicenseClaims,
+  LegacyPrototypeSignedLicense as SignedLicense,
+  LicenseV1Claims,
+  SignedLicenseV1,
+} from "@windy/shared";
+import { createLicenseSigningPayload } from "./payload.js";
+import { legacyPrototypeLicensePayloadReader } from "./verification.js";
+
+export function createSignedLicense(inputClaims: LicenseClaims): {
+  license: SignedLicense;
+  publicKeyPem: string;
+} {
+  const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+  const signature = sign(
+    null,
+    Buffer.from(
+      legacyPrototypeLicensePayloadReader.serializeForVerification(inputClaims),
+    ),
+    privateKey,
+  ).toString("base64");
+
+  return {
+    publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+    license: {
+      claims: inputClaims,
+      signature,
+      publicKeyId: "key_1",
+      algorithm: "ED25519",
+    },
+  };
+}
+
+export function createSignedLicenseV1(
+  claims: LicenseV1Claims,
+  keyId = "key_v1",
+): {
+  license: SignedLicenseV1;
+  publicKeyPem: string;
+} {
+  const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+  const unsigned = {
+    formatVersion: 1,
+    algorithm: "ED25519",
+    publicKeyId: keyId,
+    claims,
+  } as const;
+  const signature = sign(
+    null,
+    Buffer.from(createLicenseSigningPayload(unsigned)),
+    privateKey,
+  ).toString("base64");
+
+  return {
+    publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+    license: { ...unsigned, signature },
+  };
+}

package/template/packages/license-sdk/src/v1-test-vector.ts

@@ -0,0 +1,49 @@
+import { licenseVersionKey, type LicenseV1Claims } from "@windy/shared";
+
+/** Public, non-secret interoperability vector shared by SDK and issuer tests. */
+export const LICENSE_V1_TEST_VECTOR: {
+  claims: LicenseV1Claims;
+  keyId: string;
+  publicKeyPem: string;
+  signedPayload: string;
+  payloadDigest: string;
+  signature: string;
+} = {
+  claims: {
+    licenseId: "license_vector_v1",
+    productCode: "windy-platform",
+    customer: {
+      id: "customer_vector",
+      code: "C-001",
+      name: "固定向量客户",
+    },
+    project: {
+      id: "project_vector",
+      code: "P-001",
+      name: "固定向量项目",
+    },
+    contract: {
+      id: "contract_vector",
+      contractNumber: "HT-2026-001",
+      version: "1",
+    },
+    machineCode: "machine-vector-001",
+    issuedAt: "2026-07-10T00:00:00.000Z",
+    expiresAt: "2030-07-10T00:00:00.000Z",
+    licenseVersion: {
+      key: licenseVersionKey("advanced"),
+      name: "高级付费版",
+    },
+  },
+  keyId: "development-version-model-v1",
+  publicKeyPem:
+    "-----BEGIN PUBLIC KEY-----\n" +
+    "MCowBQYDK2VwAyEAbYwI4vgDmeP9rj+Vu5QkqW83LZsKJJCs1athjcE5J5s=\n" +
+    "-----END PUBLIC KEY-----\n",
+  signedPayload:
+    '{"algorithm":"ED25519","claims":{"contract":{"contractNumber":"HT-2026-001","id":"contract_vector","version":"1"},"customer":{"code":"C-001","id":"customer_vector","name":"固定向量客户"},"expiresAt":"2030-07-10T00:00:00.000Z","issuedAt":"2026-07-10T00:00:00.000Z","licenseId":"license_vector_v1","licenseVersion":{"key":"advanced","name":"高级付费版"},"machineCode":"machine-vector-001","productCode":"windy-platform","project":{"code":"P-001","id":"project_vector","name":"固定向量项目"}},"formatVersion":1,"publicKeyId":"development-version-model-v1"}',
+  payloadDigest:
+    "1cbe2a782b74cb79ba03bc987b0736155db56742a9bc619f612af2a162ec535b",
+  signature:
+    "y1tMY82+iYlAfzRvC+IdZoLlufZ3b7EW0TysskwZHi7fXye07K6vQ9cTSvkg3dn+vhMeLeyt+3VjpOLhxFTQBQ==",
+};

package/template/packages/license-sdk/src/validation.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, test } from "bun:test";
+import { licenseVersionKey, type LicenseV1Claims } from "@windy/shared";
+import { createSignedLicenseV1 } from "./test-fixtures.js";
+import { validateLicenseDocument } from "./validation.js";
+
+function claims(overrides: Partial<LicenseV1Claims> = {}): LicenseV1Claims {
+  return {
+    licenseId: "license_1",
+    productCode: "windy-platform",
+    customer: { id: "customer_1", code: "C-1", name: "客户一" },
+    project: { id: "project_1", code: "P-1", name: "项目一" },
+    contract: { id: "contract_1", contractNumber: "HT-1", version: "1" },
+    machineCode: "machine_1",
+    issuedAt: "2026-07-10T00:00:00.000Z",
+    expiresAt: "2027-07-10T00:00:00.000Z",
+    licenseVersion: {
+      key: licenseVersionKey("standard"),
+      name: "普通付费版",
+    },
+    ...overrides,
+  };
+}
+
+describe("V1 runtime validation", () => {
+  test.each([
+    ["productCode", { productCode: "other-product" }, "product-mismatch"],
+    ["machineCode", { machineCode: "other-machine" }, "machine-mismatch"],
+    ["expiresAt", { expiresAt: "2026-07-10T09:00:00.000Z" }, "expired"],
+  ] as const)("拒绝不匹配或过期的 %s", async (_label, overrides, failure) => {
+    const signed = createSignedLicenseV1(claims(overrides));
+    const result = await validateLicenseDocument(
+      JSON.stringify(signed.license),
+      {
+        productCode: "windy-platform",
+        machineCode: "machine_1",
+        publicKeys: { key_v1: signed.publicKeyPem },
+        now: new Date("2026-07-10T10:00:00.000Z"),
+      },
+    );
+
+    expect(result.valid).toBe(false);
+    expect(result.failures).toContain(failure);
+  });
+
+  test("严格拒绝 V1 未声明的 notBefore 字段", async () => {
+    const signed = createSignedLicenseV1(claims());
+    const raw = JSON.stringify({
+      ...signed.license,
+      notBefore: "2026-07-10T00:00:00.000Z",
+    });
+
+    const result = await validateLicenseDocument(raw, {
+      productCode: "windy-platform",
+      machineCode: "machine_1",
+      publicKeys: { key_v1: signed.publicKeyPem },
+      now: new Date("2026-07-10T10:00:00.000Z"),
+    });
+
+    expect(result.valid).toBe(false);
+    expect(result.failures).toEqual(["invalid-format"]);
+  });
+});

package/template/packages/license-sdk/src/validation.ts

@@ -0,0 +1,143 @@
+import type {
+  LicenseFailureReason,
+  LicenseUsageRecord,
+  SignedLicense,
+} from "@windy/shared";
+import { parseSignedLicense } from "./license-parser.js";
+import type { LicensePublicKeySource } from "./verification.js";
+import { verifySignedLicense } from "./verification.js";
+
+export { parseSignedLicense, parseSignedLicenseV1 } from "./license-parser.js";
+
+const DEFAULT_CLOCK_TOLERANCE_MS = 5 * 60 * 1000;
+const RFC_3339 =
+  /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+
+export interface LicenseValidationOptions {
+  productCode: string;
+  machineCode: string;
+  publicKeys: LicensePublicKeySource;
+  now?: Date;
+  lastTrustedAt?: string;
+  clockToleranceMs?: number;
+}
+
+export interface LicenseDocumentVerificationResult {
+  valid: boolean;
+  license?: SignedLicense;
+  failures: LicenseFailureReason[];
+}
+
+export interface LicenseRuntimeValidationResult extends LicenseDocumentVerificationResult {
+  usage: LicenseUsageRecord;
+  nextTrustedAt?: string;
+}
+
+export async function verifyLicenseDocument(
+  rawLicense: string,
+  publicKeys: LicensePublicKeySource,
+): Promise<LicenseDocumentVerificationResult> {
+  const license = parseSignedLicense(rawLicense);
+  if (!license) return { valid: false, failures: ["invalid-format"] };
+
+  const result = await verifySignedLicense(license, publicKeys);
+  return result.valid
+    ? { valid: true, license, failures: [] }
+    : { valid: false, failures: result.failures };
+}
+
+export async function validateLicenseDocument(
+  rawLicense: string,
+  options: LicenseValidationOptions,
+): Promise<LicenseRuntimeValidationResult> {
+  const now = options.now ?? new Date();
+  const openedAt = validNow(now);
+  const verified = await verifyLicenseDocument(rawLicense, options.publicKeys);
+  const failures = [...verified.failures];
+  const license = verified.license;
+
+  if (license) {
+    const issuedAt = parseDateTime(license.claims.issuedAt);
+    const expiresAt = parseDateTime(license.claims.expiresAt);
+    if (
+      issuedAt === undefined ||
+      expiresAt === undefined ||
+      expiresAt <= issuedAt
+    ) {
+      failures.push("invalid-format");
+    } else if (now.getTime() > expiresAt) {
+      failures.push("expired");
+    }
+    if (license.claims.productCode !== options.productCode) {
+      failures.push("product-mismatch");
+    }
+    if (license.claims.machineCode !== options.machineCode) {
+      failures.push("machine-mismatch");
+    }
+  }
+
+  const clock = evaluateClock(
+    now.getTime(),
+    options.lastTrustedAt,
+    options.clockToleranceMs ?? DEFAULT_CLOCK_TOLERANCE_MS,
+  );
+  if (clock.rollback) failures.push("clock-rollback");
+
+  const uniqueFailures = [...new Set(failures)];
+  const valid = Boolean(license) && uniqueFailures.length === 0;
+  return {
+    valid,
+    license,
+    failures: uniqueFailures,
+    nextTrustedAt: clock.nextTrustedAt,
+    usage: {
+      machineCode: options.machineCode,
+      openedAt,
+      previousOpenedAt: options.lastTrustedAt,
+      status: uniqueFailures.includes("clock-rollback")
+        ? "clock-rollback"
+        : valid
+          ? "valid"
+          : uniqueFailures.includes("expired")
+            ? "expired"
+            : "invalid",
+      reason: uniqueFailures[0],
+    },
+  };
+}
+
+function evaluateClock(
+  now: number,
+  lastTrustedAt: string | undefined,
+  toleranceMs: number,
+): { rollback: boolean; nextTrustedAt?: string } {
+  if (!Number.isFinite(toleranceMs) || toleranceMs < 0) {
+    throw new RangeError("clockToleranceMs 必须为非负有限数");
+  }
+  if (!lastTrustedAt) {
+    return { rollback: false, nextTrustedAt: new Date(now).toISOString() };
+  }
+  const previous = parseDateTime(lastTrustedAt);
+  if (previous === undefined) {
+    return { rollback: true };
+  }
+  if (now + toleranceMs < previous) {
+    return { rollback: true, nextTrustedAt: lastTrustedAt };
+  }
+  return {
+    rollback: false,
+    nextTrustedAt: new Date(Math.max(now, previous)).toISOString(),
+  };
+}
+
+function parseDateTime(value: string): number | undefined {
+  if (!RFC_3339.test(value)) return undefined;
+  const timestamp = Date.parse(value);
+  return Number.isFinite(timestamp) ? timestamp : undefined;
+}
+
+function validNow(now: Date): string {
+  if (!Number.isFinite(now.getTime()))
+    throw new RangeError("now 必须是有效时间");
+  return now.toISOString();
+}

package/template/packages/license-sdk/src/verification.test.ts

@@ -0,0 +1,97 @@
+import { describe, expect, test } from "bun:test";
+import type {
+  LegacyPrototypeLicenseClaims as LicenseClaims,
+  LegacyPrototypeSignedLicense as SignedLicense,
+} from "@windy/shared";
+import { createSignedLicense } from "./test-fixtures.js";
+import { LICENSE_V1_TEST_VECTOR } from "./v1-test-vector.js";
+import {
+  legacyPrototypeLicensePayloadReader,
+  verifyLicensePayloadSignature,
+  verifyLegacyPrototypeSignedLicense,
+  verifySignedLicense,
+} from "./verification.js";
+
+const claims: LicenseClaims = {
+  licenseId: "license_1",
+  subject: "演示客户",
+  edition: "standard",
+  issuedAt: "2026-07-09T00:00:00.000Z",
+  machineCode: "machine_1",
+  limits: { maxUsers: 10 },
+  modules: [{ module: "system", enabled: true }],
+};
+
+describe("License verification", () => {
+  test("使用 ED25519 公钥验签", async () => {
+    const { license, publicKeyPem } = createSignedLicense(claims);
+
+    const result = await verifyLegacyPrototypeSignedLicense(license, {
+      key_1: publicKeyPem,
+    });
+
+    expect(result.valid).toBe(true);
+    expect(result.claims?.licenseId).toBe("license_1");
+    expect(result.failures).toEqual([]);
+  });
+
+  test("拒绝 claims 被篡改的 License", async () => {
+    const { license, publicKeyPem } = createSignedLicense(claims);
+    const tampered: SignedLicense = {
+      ...license,
+      claims: {
+        ...license.claims,
+        machineCode: "other_machine",
+      },
+    };
+
+    const result = await verifyLegacyPrototypeSignedLicense(tampered, {
+      key_1: publicKeyPem,
+    });
+
+    expect(result.valid).toBe(false);
+    expect(result.failures).toContain("invalid-signature");
+  });
+
+  test("拒绝缺少公钥的 License", async () => {
+    const { license } = createSignedLicense(claims);
+
+    const result = await verifyLegacyPrototypeSignedLicense(license, {});
+
+    expect(result.valid).toBe(false);
+    expect(result.failures).toContain("invalid-signature");
+  });
+
+  test("支持原始 payload 验签，避免 JSONB 重新序列化", async () => {
+    const { license, publicKeyPem } = createSignedLicense(claims);
+    const payload =
+      legacyPrototypeLicensePayloadReader.serializeForVerification(claims);
+
+    await expect(
+      verifyLicensePayloadSignature(payload, license.signature, publicKeyPem),
+    ).resolves.toBe(true);
+    await expect(
+      verifyLicensePayloadSignature(
+        payload.replace("machine_1", "machine_2"),
+        license.signature,
+        publicKeyPem,
+      ),
+    ).resolves.toBe(false);
+  });
+
+  test("SDK 可验证签发端共享的 V1 固定向量", async () => {
+    const vector = LICENSE_V1_TEST_VECTOR;
+    await expect(
+      verifySignedLicense(
+        {
+          formatVersion: 1,
+          algorithm: "ED25519",
+          publicKeyId: vector.keyId,
+          claims: vector.claims,
+          signature: vector.signature,
+        },
+        { [vector.keyId]: vector.publicKeyPem },
+      ),
+    ).resolves.toMatchObject({ valid: true, failures: [] });
+  });
+});

package/template/packages/license-sdk/src/verification.ts

@@ -0,0 +1,199 @@
+import type {
+  LegacyPrototypeLicenseClaims,
+  LegacyPrototypeLicenseVerificationResult,
+  LegacyPrototypeSignedLicense,
+  LicenseVerificationResult,
+  SignedLicense,
+} from "@windy/shared";
+import { createLicenseSigningPayload } from "./payload.js";
+
+export type LicensePublicKeyMap = Record<string, string>;
+
+export type LicensePublicKeyResolver = (
+  publicKeyId: string,
+) => Promise<string | undefined> | string | undefined;
+
+export type LicensePublicKeySource =
+  | LicensePublicKeyMap
+  | LicensePublicKeyResolver;
+
+export async function verifySignedLicense(
+  license: SignedLicense,
+  publicKeySource: LicensePublicKeySource,
+): Promise<LicenseVerificationResult> {
+  if (license.formatVersion !== 1) {
+    return { valid: false, failures: ["unsupported-format"] };
+  }
+  if (license.algorithm !== "ED25519") {
+    return { valid: false, failures: ["invalid-format"] };
+  }
+  const publicKeyPem = await resolvePublicKey(
+    publicKeySource,
+    license.publicKeyId,
+  );
+  if (!publicKeyPem) {
+    return { valid: false, failures: ["unknown-public-key"] };
+  }
+  const valid = await verifyLicenseSignature(license, publicKeyPem);
+  return valid
+    ? { valid: true, claims: license.claims, failures: [] }
+    : { valid: false, failures: ["invalid-signature"] };
+}
+
+export async function verifyLicenseSignature(
+  license: SignedLicense,
+  publicKeyPem: string,
+): Promise<boolean> {
+  try {
+    return verifyLicensePayloadSignature(
+      createLicenseSigningPayload({
+        formatVersion: 1,
+        algorithm: license.algorithm,
+        publicKeyId: license.publicKeyId,
+        claims: license.claims,
+      }),
+      license.signature,
+      publicKeyPem,
+    );
+  } catch {
+    return false;
+  }
+}
+
+/** Explicit read-only compatibility path. It must never be used to issue. */
+export const legacyPrototypeLicensePayloadReader = {
+  parse(payload: string): LegacyPrototypeLicenseClaims {
+    return JSON.parse(payload) as LegacyPrototypeLicenseClaims;
+  },
+  serializeForVerification(claims: LegacyPrototypeLicenseClaims): string {
+    return JSON.stringify(claims);
+  },
+} as const;
+
+export async function verifyLegacyPrototypeSignedLicense(
+  license: LegacyPrototypeSignedLicense,
+  publicKeySource: LicensePublicKeySource,
+): Promise<LegacyPrototypeLicenseVerificationResult> {
+  if ((license.algorithm as string) !== "ED25519") {
+    return { valid: false, failures: ["invalid-signature"] };
+  }
+  const publicKeyPem = await resolvePublicKey(
+    publicKeySource,
+    license.publicKeyId,
+  );
+  if (!publicKeyPem) {
+    return { valid: false, failures: ["invalid-signature"] };
+  }
+  const valid = await verifyLicensePayloadSignature(
+    legacyPrototypeLicensePayloadReader.serializeForVerification(
+      license.claims,
+    ),
+    license.signature,
+    publicKeyPem,
+  );
+  return valid
+    ? { valid: true, claims: license.claims, failures: [] }
+    : { valid: false, failures: ["invalid-signature"] };
+}
+
+export async function verifyLicensePayloadSignature(
+  payload: string,
+  signatureBase64: string,
+  publicKeyPem: string,
+): Promise<boolean> {
+  let payloadBytes: Uint8Array;
+  let signature: Uint8Array;
+  try {
+    payloadBytes = new TextEncoder().encode(payload);
+    signature = base64ToBytes(signatureBase64);
+  } catch {
+    return false;
+  }
+  const webCryptoResult = await verifyWithWebCrypto(
+    publicKeyPem,
+    signature,
+    payloadBytes,
+  );
+  if (webCryptoResult !== undefined) return webCryptoResult;
+  return verifyWithNodeCrypto(publicKeyPem, signature, payloadBytes);
+}
+
+async function resolvePublicKey(
+  source: LicensePublicKeySource,
+  publicKeyId: string,
+): Promise<string | undefined> {
+  return typeof source === "function"
+    ? source(publicKeyId)
+    : source[publicKeyId];
+}
+
+async function verifyWithWebCrypto(
+  publicKeyPem: string,
+  signature: Uint8Array,
+  payload: Uint8Array,
+): Promise<boolean | undefined> {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) return undefined;
+  try {
+    const algorithm: AlgorithmIdentifier = { name: "Ed25519" };
+    const publicKey = await subtle.importKey(
+      "spki",
+      toArrayBuffer(pemToDer(publicKeyPem)),
+      algorithm,
+      false,
+      ["verify"],
+    );
+    return subtle.verify(
+      algorithm,
+      publicKey,
+      toArrayBuffer(signature),
+      toArrayBuffer(payload),
+    );
+  } catch {
+    return undefined;
+  }
+}
+
+async function verifyWithNodeCrypto(
+  publicKeyPem: string,
+  signature: Uint8Array,
+  payload: Uint8Array,
+): Promise<boolean> {
+  try {
+    const { createPublicKey, verify } = await import("node:crypto");
+    return verify(null, payload, createPublicKey(publicKeyPem), signature);
+  } catch {
+    return false;
+  }
+}
+
+function pemToDer(pem: string): Uint8Array {
+  return base64ToBytes(
+    pem
+      .replace(/-----BEGIN PUBLIC KEY-----/g, "")
+      .replace(/-----END PUBLIC KEY-----/g, "")
+      .replace(/\s+/g, ""),
+  );
+}
+
+function base64ToBytes(value: string): Uint8Array {
+  if (
+    !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(
+      value,
+    )
+  ) {
+    throw new Error("无效 Base64");
+  }
+  if (typeof atob === "function") {
+    const binary = atob(value);
+    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+  }
+  return new Uint8Array(Buffer.from(value, "base64"));
+}
+
+function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {
+  return bytes.buffer.slice(
+    bytes.byteOffset,
+    bytes.byteOffset + bytes.byteLength,
+  ) as ArrayBuffer;
+}

package/template/packages/license-sdk/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "esnext",
+    "module": "esnext",
+    "lib": ["esnext", "dom"],
+    "moduleResolution": "bundler",
+    "strict": true,
+    "noImplicitAny": true,
+    "esModuleInterop": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "outDir": "dist",
+    "types": ["bun"]
+  },
+  "include": ["src/**/*", "index.ts"],
+  "exclude": ["node_modules", "dist"]
+}

package/template/packages/modules/index.ts

@@ -0,0 +1,8 @@
+export * from "./src/manifest.js";
+export * from "./src/composition.js";
+export * from "./src/menu-composition.js";
+export * from "./src/registry.js";
+export * from "./src/system-modules.js";
+export * from "./src/system-module-catalog.js";
+export * from "./src/system-api-permissions.js";
+export * from "./src/installed-business-modules.js";

package/template/packages/modules/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "@windy/modules",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@windy/example-work-order": "workspace:*",
+    "@windy/shared": "workspace:*"
+  },
+  "exports": {
+    ".": "./index.ts"
+  }
+}