create-windy 0.2.16 → 0.2.18

package/README.md

@@ -110,9 +110,10 @@ create-windy 会生成仅供本机使用、被 Git 忽略且权限为 `0600` 的
 直接打印在终端。首次登录必须修改密码，新密码需要 12-128 个字符，且不能与当前密码
 相同。
 
-`bun run dev` 会通过 Docker Compose 等待 PostgreSQL、执行 migration，再启动 Server
-与 Web；首次运行前需安装并启动 Docker 与 Docker Compose。环境变量只负责初始化全新
-数据库，数据库已有管理员后，重启服务不会重新覆盖其密码。
+`bun run dev` 会复用已有 Docker 镜像，等待 PostgreSQL、执行 migration，再启动支持
+热更新的 Server 与 Web；首次缺少镜像时才会构建。依赖、Dockerfile 或 `bun.lock`
+变化后运行 `bun run dev:build`。首次运行前需安装并启动 Docker 与 Docker Compose。
+环境变量只负责初始化全新数据库，数据库已有管理员后，重启服务不会重新覆盖其密码。
 
 只调试单个应用时可分别使用 `bun run dev:web` 和 `bun run dev:server`。`dev:web` 不会
 隐式启动后端；`dev:server` 也不会自动启动 PostgreSQL 或执行 migration。

package/dist/cli.js

@@ -412,13 +412,20 @@ var platformModules = [
       "apps/web/src/pages/settings",
       "apps/web/src/layout/GlobalWatermark.vue",
       "apps/web/src/layout/GlobalWatermark.webtest.ts",
+      "apps/web/src/layout/GlobalWatermark.layering.webtest.ts",
       "apps/web/src/services/platform-settings-api.ts",
       "apps/web/src/composables/useWatermarkSettings.ts",
+      "apps/web/src/composables/useWatermarkSettings.webtest.ts",
       "apps/web/src/composables/watermark-settings.ts",
-      "apps/web/src/composables/watermark-settings.webtest.ts"
+      "apps/web/src/composables/watermark-settings.webtest.ts",
+      "packages/modules/src/system-api-watermark.ts",
+      "packages/modules/src/system-watermark-policy.test.ts"
     ],
     documentation: ["docs/platform/platform-shell-settings.md"],
-    databaseTables: ["platform_branding_settings"]
+    databaseTables: [
+      "platform_branding_settings",
+      "platform_watermark_policies"
+    ]
   },
   {
     ...module2("system.configuration", "配置版本", "类型化配置、应用和回滚。", "recommended", ["system"]),
@@ -1305,7 +1312,7 @@ var starterCompose = `services:
       POSTGRES_USER: windy
       POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:?请在 .env 中设置 POSTGRES_PASSWORD}
     ports:
-      - "5432:5432"
+      - "15432:5432"
     volumes:
       - postgres-data:/var/lib/postgresql/data
     healthcheck:
@@ -1334,14 +1341,15 @@ var starterCompose = `services:
     command: ["bun", "run", "--cwd", "apps/server", "dev"]
     environment:
       NODE_ENV: development
-      PORT: 3000
+      PORT: 9747
       DATABASE_URL: postgresql://windy:\${POSTGRES_PASSWORD}@postgres:5432/windy
       WINDY_BOOTSTRAP_ADMIN_PASSWORD: \${WINDY_BOOTSTRAP_ADMIN_PASSWORD:?请在 .env 中设置管理员初始密码}
       WINDY_AUDIT_QUEUE_FILE: /app/data/audit/recovery-queue.json
       WINDY_CONTAINERIZED: "1"
+      BUN_CONFIG_NO_CLEAR_TERMINAL_ON_RELOAD: "true"
       WINDY_SYSTEM_USAGE_PATHS: /app/data/audit
     ports:
-      - "3000:3000"
+      - "9747:9747"
     volumes:
       - ./apps/server:/app/apps/server
       - ./packages:/app/packages
@@ -1357,14 +1365,26 @@ var starterCompose = `services:
     command: ["bun", "run", "--cwd", "apps/web", "dev"]
     environment:
       NODE_ENV: development
-      WINDY_DEV_PORT: 9746
-      API_UPSTREAM: http://server:3000
+      WINDY_DEV_PORT: 18746
+      WINDY_DEV_USE_POLLING: "1"
+      API_UPSTREAM: http://server:9747
       VITE_DEV_HOST: 0.0.0.0
     ports:
-      - "9746:9746"
+      - "18746:18746"
     volumes:
       - ./apps/web:/app/apps/web
       - ./packages:/app/packages
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "bun",
+          "-e",
+          "const r=await fetch('http://127.0.0.1:18746/-/windy-dev');process.exit(r.ok?0:1)",
+        ]
+      interval: 5s
+      timeout: 3s
+      retries: 6
     depends_on:
       - server
 
@@ -1435,15 +1455,17 @@ create-windy 已创建仅供本机使用且被 Git 忽略的 \`.env\`，其中
 文件权限为 \`0600\`。\`bun run dev\` 会通过 Docker Compose 等待 PostgreSQL、执行
 Drizzle migration，再启动 Server 与 Web；不要跳过 migration 后直接把 Server 连接到
 空数据库。首次启动需要本机已经安装并启动 Docker 与 Docker Compose，并可能需要下载
-基础镜像。
+基础镜像。后续 \`bun run dev\` 会复用已有镜像，不会重复构建；依赖、Dockerfile 或
+\`bun.lock\` 变化后运行 \`bun run dev:build\`。
 
 | 服务 | 地址 |
 | ---- | ---- |
-| Web | http://localhost:9746 |
-| Server 健康检查 | http://localhost:3000/api/health |
-| PostgreSQL | localhost:5432 |
+| Web | http://localhost:18746 |
+| Server 健康检查 | http://localhost:9747/api/health |
+| PostgreSQL | localhost:15432 |
 
-Docker Web 固定使用 \`9746\`。只启动单个应用时使用：
+Docker Web 固定使用 \`18746\`，Web 与 Server 都挂载宿主机源码并保持热更新。只启动
+单个应用时使用：
 
 \`\`\`bash
 bun run dev:web
@@ -1502,6 +1524,7 @@ ${moduleRows}
 
 \`\`\`bash
 bun run dev
+bun run dev:build
 bun run dev:web
 bun run dev:server
 bun run typecheck
@@ -1574,7 +1597,8 @@ function createStarterPackage(source, projectName, includeOxc = true, projectLic
       ...includeOxc ? {
         prepare: "git rev-parse --git-dir >/dev/null 2>&1 || exit 0; husky"
       } : {},
-      dev: "docker compose up --build",
+      dev: "docker compose up",
+      "dev:build": "docker compose up --build",
       ...generatorVersion ? { windy: "create-windy" } : {},
       "dev:web": "bun run --cwd apps/web dev",
       "dev:server": "bun run --cwd apps/server dev",
@@ -1585,8 +1609,7 @@ function createStarterPackage(source, projectName, includeOxc = true, projectLic
       typecheck: [
         "bun run --cwd apps/web typecheck",
         "bun run --cwd apps/server typecheck",
-        "bun run --cwd packages/agent-contracts typecheck",
-        "bun run --cwd packages/agent-client typecheck",
+        "bun run --cwd packages/ai-client typecheck",
         "bun run --cwd packages/jobs typecheck",
         "bun run --cwd packages/server-sdk typecheck",
         "bun run --cwd packages/storage typecheck",
@@ -1625,8 +1648,7 @@ var templateDirectories = [
   "apps/server",
   "apps/web",
   "examples",
-  "packages/agent-client",
-  "packages/agent-contracts",
+  "packages/ai-client",
   "packages/config",
   "packages/crud-generator",
   "packages/database",
@@ -3790,7 +3812,7 @@ function sentenceWithoutStop(value) {
 
 // src/update/cli.ts
 import { rm as rm8 } from "node:fs/promises";
-import { resolve as resolve4 } from "node:path";
+import { resolve as resolve5 } from "node:path";
 
 // src/update/doctor.ts
 import { readFile as readFile11 } from "node:fs/promises";
@@ -3828,9 +3850,10 @@ import {
   mkdir as mkdir5,
   readFile as readFile10,
   rm as rm5,
+  rmdir,
   writeFile as writeFile9
 } from "node:fs/promises";
-import { dirname as dirname3, join as join10 } from "node:path";
+import { dirname as dirname3, join as join10, resolve as resolve4, sep as sep3 } from "node:path";
 var updateStatePath = ".windy/update-state.json";
 async function applyTransaction(plan) {
   if (plan.conflicts.length) {
@@ -3868,7 +3891,11 @@ async function applyTransaction(plan) {
     for (const file of changed) {
       const target = join10(plan.projectDirectory, file.path);
       if (file.action === "delete") {
+        const existed = await exists(target);
         await rm5(target, { force: true });
+        if (existed) {
+          await removeEmptyDeletedFileParents(target, plan.projectDirectory);
+        }
         continue;
       }
       if (!file.content)
@@ -3931,6 +3958,26 @@ async function exists(path2) {
     return false;
   }
 }
+async function removeEmptyDeletedFileParents(deletedFile, projectDirectory) {
+  const projectRoot = resolve4(projectDirectory);
+  let directory = dirname3(resolve4(deletedFile));
+  while (directory !== projectRoot && directory.startsWith(`${projectRoot}${sep3}`)) {
+    try {
+      await rmdir(directory);
+    } catch (error) {
+      if (isDirectoryNotRemovable(error))
+        return;
+      throw error;
+    }
+    directory = dirname3(directory);
+  }
+}
+function isDirectoryNotRemovable(error) {
+  if (!(error instanceof Error) || !("code" in error))
+    return false;
+  const code = error.code;
+  return code === "ENOENT" || code === "ENOTEMPTY" || code === "EEXIST";
+}
 function assertSafePath(path2) {
   if (!path2 || path2.startsWith("/") || path2.split("/").includes("..")) {
     throw new Error(`更新计划包含不安全路径：${path2}`);
@@ -4014,7 +4061,9 @@ var recipes = [
   { id: "starter-0.2.12-to-0.2.13", from: "0.2.12", to: "0.2.13" },
   { id: "starter-0.2.13-to-0.2.14", from: "0.2.13", to: "0.2.14" },
   { id: "starter-0.2.14-to-0.2.15", from: "0.2.14", to: "0.2.15" },
-  { id: "starter-0.2.15-to-0.2.16", from: "0.2.15", to: "0.2.16" }
+  { id: "starter-0.2.15-to-0.2.16", from: "0.2.15", to: "0.2.16" },
+  { id: "starter-0.2.16-to-0.2.17", from: "0.2.16", to: "0.2.17" },
+  { id: "starter-0.2.17-to-0.2.18", from: "0.2.17", to: "0.2.18" }
 ];
 function resolveRecipeChain(sourceVersion, targetVersion) {
   if (sourceVersion === targetVersion)
@@ -4483,7 +4532,7 @@ async function runLifecycleCommand(args) {
   const command = args[0];
   if (command !== "doctor" && command !== "update")
     return false;
-  const projectDirectory = resolve4(readValue2(args, "--cwd") || process.cwd());
+  const projectDirectory = resolve5(readValue2(args, "--cwd") || process.cwd());
   if (command === "doctor") {
     const report = await diagnoseProject(projectDirectory, args.includes("--repair"));
     printDoctor(report);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-windy",
-  "version": "0.2.16",
+  "version": "0.2.18",
   "description": "创建单组织、单租户、私有部署优先的 Windy 企业 Dashboard Starter",
   "type": "module",
   "bin": {

package/template/.dockerignore

@@ -1,5 +1,10 @@
 **/dist
 **/node_modules
+**/.mypy_cache
+**/.pytest_cache
+**/.ruff_cache
+**/.venv
+**/__pycache__
 .git
 .gitignore
 .husky

package/template/.windy-template.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "templateCommit": "a33bfe5d85129939050e231d5e5ab52a763041ac",
-  "generatorVersion": "0.2.16",
+  "templateCommit": "1d4ba94edf509d57d0e3bd9ca36902b4e3778526",
+  "generatorVersion": "0.2.18",
   "modules": [
     {
       "name": "system",

package/template/AGENTS.md

@@ -31,9 +31,19 @@
 - 这是 Starter 的初始配置；项目所有者可按团队需要保留、替换或扩展。
 - 实际可用命令和提交检查以当前项目的 `package.json` 与 Git hooks 为准。
 
+## Windy 升级边界
+
+- 业务需求优先通过自有模块和既有扩展点实现，尽量不要直接修改 Windy 提供的平台核心、
+  Composition Root、共享脚手架和根工具链配置，以减少后续升级冲突。
+- 修改前先查看 `.windy/files.json` 的 ownership；优先扩展 `project-owned` 路径，
+  对 `windy-managed` 路径仅在没有可用扩展点时做最小改动。
+- 确需修改 Windy 受管代码时，使用独立小提交记录原因和影响；升级前先运行
+  `bun run windy update --dry-run`，根据三方合并计划处理冲突。
+
 ## 常用入口
 
-- `bun run dev`：通过 Docker Compose 启动 PostgreSQL、自动 migration、Server 与 Web。
+- `bun run dev`：复用 Docker 镜像启动 PostgreSQL、自动 migration、Server 与支持热更新的 Web。
+- `bun run dev:build`：依赖、Dockerfile 或 lockfile 变化后重建并启动开发环境。
 - `bun run dev:web`：启动 Web 开发服务。
 - `bun run dev:server`：启动 Server 开发服务。
 - `bun run lint`、`bun run typecheck`、`bun run test`、`bun run build`：执行基础验证；未选择 Oxc 时没有 lint 脚本。

package/template/README.md

@@ -30,15 +30,17 @@ create-windy 已创建仅供本机使用且被 Git 忽略的 `.env`，其中两
 文件权限为 `0600`。`bun run dev` 会通过 Docker Compose 等待 PostgreSQL、执行
 Drizzle migration，再启动 Server 与 Web；不要跳过 migration 后直接把 Server 连接到
 空数据库。首次启动需要本机已经安装并启动 Docker 与 Docker Compose，并可能需要下载
-基础镜像。
+基础镜像。后续 `bun run dev` 会复用已有镜像，不会重复构建；依赖、Dockerfile 或
+`bun.lock` 变化后运行 `bun run dev:build`。
 
 | 服务 | 地址 |
 | ---- | ---- |
-| Web | http://localhost:9746 |
-| Server 健康检查 | http://localhost:3000/api/health |
-| PostgreSQL | localhost:5432 |
+| Web | http://localhost:18746 |
+| Server 健康检查 | http://localhost:9747/api/health |
+| PostgreSQL | localhost:15432 |
 
-Docker Web 固定使用 `9746`。只启动单个应用时使用：
+Docker Web 固定使用 `18746`，Web 与 Server 都挂载宿主机源码并保持热更新。只启动
+单个应用时使用：
 
 ```bash
 bun run dev:web
@@ -112,6 +114,7 @@ create-windy 在本机 `.env` 中随机生成的 `WINDY_BOOTSTRAP_ADMIN_PASSWORD
 
 ```bash
 bun run dev
+bun run dev:build
 bun run dev:web
 bun run dev:server
 bun run typecheck

package/template/_gitignore

@@ -2,6 +2,11 @@
 .DS_Store
 node_modules/
 dist/
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+.venv/
+__pycache__/
 packages/create-windy/template/
 .tmp/
 .windy/backups/

package/template/apps/server/Dockerfile

@@ -8,8 +8,7 @@ COPY apps/server/package.json apps/server/package.json
 COPY apps/web/package.json apps/web/package.json
 COPY apps/license/package.json apps/license/package.json
 COPY apps/signing-service/package.json apps/signing-service/package.json
-COPY packages/agent-client/package.json packages/agent-client/package.json
-COPY packages/agent-contracts/package.json packages/agent-contracts/package.json
+COPY packages/ai-client/package.json packages/ai-client/package.json
 COPY packages/config/package.json packages/config/package.json
 COPY packages/create-windy/package.json packages/create-windy/package.json
 COPY packages/crud-generator/package.json packages/crud-generator/package.json
@@ -30,9 +29,9 @@ COPY packages packages
 COPY --chmod=0555 deploy/production/server-entrypoint.sh /usr/local/bin/windy-server-entrypoint
 RUN mkdir -p /app/data/audit /app/data/license && chown -R bun:bun /app/data
 ENV NODE_ENV=production
-ENV PORT=3000
+ENV PORT=9747
 ENV WINDY_CONTAINERIZED=1
-EXPOSE 3000
+EXPOSE 9747
 USER bun
-HEALTHCHECK --interval=15s --timeout=3s --start-period=15s --retries=4 CMD ["bun", "-e", "const r=await fetch('http://127.0.0.1:3000/api/ready');process.exit(r.ok?0:1)"]
+HEALTHCHECK --interval=15s --timeout=3s --start-period=15s --retries=4 CMD ["bun", "-e", "const r=await fetch('http://127.0.0.1:9747/api/ready');process.exit(r.ok?0:1)"]
 CMD ["bun", "run", "--cwd", "apps/server", "start"]

package/template/apps/server/src/index.ts

@@ -53,8 +53,7 @@ import { registerSchedulerRoutes } from "./scheduler/routes.js";
 import { SchedulerWorker } from "./scheduler/worker.js";
 // @windy-module system.scheduler end
 // @windy-module system.settings begin
-import { registerBrandingSettingsRoutes } from "./settings/routes.js";
-import { createBrandingSettingsRepository } from "./settings/runtime.js";
+import { createPlatformSettingsRuntime } from "./settings/runtime.js";
 // @windy-module system.settings end
 import { registerProfileRoutes } from "./profile/routes.js";
 // @windy-module system.notification begin
@@ -191,10 +190,10 @@ const storageRuntime = createStorageRuntime(
 );
 // @windy-module system.storage end
 // @windy-module system.settings begin
-const brandingSettingsRepository = createBrandingSettingsRepository(
-  persistence?.db,
-  { softwareName: platformConfig.name, logoUrl: platformConfig.logoUrl },
-);
+const platformSettings = createPlatformSettingsRuntime(persistence?.db, {
+  softwareName: platformConfig.name,
+  logoUrl: platformConfig.logoUrl,
+});
 // @windy-module system.settings end
 // @windy-module work-order begin
 const exampleModuleRuntime = createExampleModuleRuntime({
@@ -276,12 +275,7 @@ registerPlatformLicenseRoutes(app, platformLicenseRuntime);
 // @windy-module system.license end
 
 // @windy-module system.settings begin
-registerBrandingSettingsRoutes(
-  app,
-  brandingSettingsRepository,
-  runtime,
-  foundationSnapshot.features,
-);
+platformSettings.register(app, runtime, foundationSnapshot.features);
 // @windy-module system.settings end
 // @windy-module system.notification begin
 registerNotificationRoutes(
@@ -304,7 +298,7 @@ registerStorageRoutes(
     uploads: storageRuntime.uploads,
     files: storageRuntime.files,
     isPublicBrandingFile: async (fileId) =>
-      (await brandingSettingsRepository.get()).logoUrl ===
+      (await platformSettings.branding.get()).logoUrl ===
       `/api/platform/files/${fileId}`,
   },
   runtime,
@@ -387,7 +381,7 @@ validateServerModuleComposition({
   // @windy-module system.search end
 });
 
-const port = process.env.PORT ? Number(process.env.PORT) : 3000;
+const port = process.env.PORT ? Number(process.env.PORT) : 9_747;
 app.listen(port);
 // @windy-module system.scheduler begin
 schedulerWorker.start();

package/template/apps/server/src/settings/drizzle-watermark-repository.integration.test.ts

@@ -0,0 +1,57 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { resolve } from "node:path";
+import { DEFAULT_PLATFORM_WATERMARK_POLICY } from "@southwind-ai/shared";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+import { Pool } from "pg";
+import { DrizzleWatermarkPolicyRepository } from "./drizzle-watermark-repository.js";
+
+const databaseUrl = process.env.SETTINGS_TEST_DATABASE_URL;
+const describePostgres = databaseUrl ? describe : describe.skip;
+
+describePostgres("PostgreSQL watermark policy repository", () => {
+  let pool: Pool;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: databaseUrl });
+    const db = drizzle(pool);
+    await migrate(db, {
+      migrationsFolder: resolve(
+        import.meta.dir,
+        "../../../../packages/database/drizzle",
+      ),
+      migrationsSchema: "public",
+      migrationsTable: "__settings_test_migrations",
+    });
+    await pool.query("truncate table platform_watermark_policies");
+  });
+
+  afterAll(async () => {
+    await pool?.end();
+  });
+
+  test("保存后可由重建的 Repository 读取同一全局策略", async () => {
+    const repository = new DrizzleWatermarkPolicyRepository(
+      drizzle(pool),
+      DEFAULT_PLATFORM_WATERMARK_POLICY,
+    );
+    await repository.update(
+      {
+        enabled: true,
+        businessPagesEnabled: true,
+        customContent: "内部资料",
+      },
+      "user_settings",
+    );
+
+    const restarted = new DrizzleWatermarkPolicyRepository(
+      drizzle(pool),
+      DEFAULT_PLATFORM_WATERMARK_POLICY,
+    );
+    expect(await restarted.get()).toEqual({
+      enabled: true,
+      businessPagesEnabled: true,
+      customContent: "内部资料",
+    });
+  });
+});

package/template/apps/server/src/settings/drizzle-watermark-repository.ts

@@ -0,0 +1,62 @@
+import { platformWatermarkPolicies } from "@southwind-ai/database";
+import type { PlatformWatermarkPolicy } from "@southwind-ai/shared";
+import { eq } from "drizzle-orm";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { WatermarkPolicyRepository } from "./watermark-repository.js";
+
+const PLATFORM_WATERMARK_ID = "platform";
+
+export class DrizzleWatermarkPolicyRepository implements WatermarkPolicyRepository {
+  constructor(
+    private readonly db: NodePgDatabase,
+    private readonly defaults: PlatformWatermarkPolicy,
+  ) {}
+
+  async get(): Promise<PlatformWatermarkPolicy> {
+    const [row] = await this.db
+      .select()
+      .from(platformWatermarkPolicies)
+      .where(eq(platformWatermarkPolicies.id, PLATFORM_WATERMARK_ID))
+      .limit(1);
+    return row ? toPolicy(row) : { ...this.defaults };
+  }
+
+  async update(
+    policy: PlatformWatermarkPolicy,
+    actorId: string,
+  ): Promise<PlatformWatermarkPolicy> {
+    const [row] = await this.db
+      .insert(platformWatermarkPolicies)
+      .values({
+        id: PLATFORM_WATERMARK_ID,
+        ...policy,
+        createdBy: actorId,
+        updatedBy: actorId,
+      })
+      .onConflictDoUpdate({
+        target: platformWatermarkPolicies.id,
+        set: {
+          enabled: policy.enabled,
+          businessPagesEnabled: policy.businessPagesEnabled,
+          customContent: policy.customContent,
+          updatedAt: new Date(),
+          updatedBy: actorId,
+        },
+      })
+      .returning();
+    if (!row) throw new Error("水印策略保存失败");
+    return toPolicy(row);
+  }
+}
+
+function toPolicy(row: {
+  enabled: boolean;
+  businessPagesEnabled: boolean;
+  customContent: string;
+}): PlatformWatermarkPolicy {
+  return {
+    enabled: row.enabled,
+    businessPagesEnabled: row.businessPagesEnabled,
+    customContent: row.customContent,
+  };
+}

package/template/apps/server/src/settings/runtime.ts

@@ -1,13 +1,40 @@
-import type { PlatformBrandingSettings } from "@southwind-ai/shared";
+import type {
+  FeatureFlagDefinition,
+  PlatformBrandingSettings,
+} from "@southwind-ai/shared";
+import { DEFAULT_PLATFORM_WATERMARK_POLICY } from "@southwind-ai/shared";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { createServerRuntime } from "../runtime.js";
+import type { RouteApp } from "../system/route-types.js";
 import { DrizzleBrandingSettingsRepository } from "./drizzle-repository.js";
+import { DrizzleWatermarkPolicyRepository } from "./drizzle-watermark-repository.js";
 import { InMemoryBrandingSettingsRepository } from "./repository.js";
+import { registerBrandingSettingsRoutes } from "./routes.js";
+import { InMemoryWatermarkPolicyRepository } from "./watermark-repository.js";
+import { registerWatermarkPolicyRoutes } from "./watermark-routes.js";
 
-export function createBrandingSettingsRepository(
+export function createPlatformSettingsRuntime(
   db: NodePgDatabase | undefined,
   defaults: PlatformBrandingSettings,
 ) {
-  return db
+  const branding = db
     ? new DrizzleBrandingSettingsRepository(db, defaults)
     : new InMemoryBrandingSettingsRepository(defaults);
+  const watermark = db
+    ? new DrizzleWatermarkPolicyRepository(
+        db,
+        DEFAULT_PLATFORM_WATERMARK_POLICY,
+      )
+    : new InMemoryWatermarkPolicyRepository();
+  return {
+    branding,
+    register(
+      app: RouteApp,
+      server: ReturnType<typeof createServerRuntime>,
+      features: FeatureFlagDefinition[],
+    ) {
+      registerBrandingSettingsRoutes(app, branding, server, features);
+      registerWatermarkPolicyRoutes(app, watermark, server, features);
+    },
+  };
 }

package/template/apps/server/src/settings/watermark-repository.ts

@@ -0,0 +1,32 @@
+import {
+  DEFAULT_PLATFORM_WATERMARK_POLICY,
+  type PlatformWatermarkPolicy,
+} from "@southwind-ai/shared";
+
+export interface WatermarkPolicyRepository {
+  get(): Promise<PlatformWatermarkPolicy>;
+  update(
+    policy: PlatformWatermarkPolicy,
+    actorId: string,
+  ): Promise<PlatformWatermarkPolicy>;
+}
+
+export class InMemoryWatermarkPolicyRepository implements WatermarkPolicyRepository {
+  private policy: PlatformWatermarkPolicy;
+
+  constructor(defaults = DEFAULT_PLATFORM_WATERMARK_POLICY) {
+    this.policy = { ...defaults };
+  }
+
+  async get(): Promise<PlatformWatermarkPolicy> {
+    return { ...this.policy };
+  }
+
+  async update(
+    policy: PlatformWatermarkPolicy,
+    _actorId: string,
+  ): Promise<PlatformWatermarkPolicy> {
+    this.policy = { ...policy };
+    return this.get();
+  }
+}