create-windy 0.2.16 → 0.2.18

package/template/apps/web/src/composables/watermark-settings.webtest.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from "vitest";
 import {
   defaultWatermarkContent,
-  parseWatermarkSettings,
+  normalizeWatermarkPolicy,
 } from "./watermark-settings";
 
 describe("水印设置", () => {
@@ -24,41 +24,17 @@ describe("水印设置", () => {
     expect(defaultWatermarkContent(base)).toBe("zhangsan · 张三");
   });
 
-  test("损坏或越界的浏览器设置安全回退", () => {
-    expect(parseWatermarkSettings("broken")).toEqual({
-      enabled: true,
-      businessPagesEnabled: false,
-      customContent: "",
-    });
+  test("服务端策略内容会被规范化后渲染", () => {
     expect(
-      parseWatermarkSettings(
-        JSON.stringify({ enabled: false, customContent: "x".repeat(100) }),
-      ),
+      normalizeWatermarkPolicy({
+        enabled: false,
+        businessPagesEnabled: true,
+        customContent: `  ${"x".repeat(100)}  `,
+      }),
     ).toEqual({
       enabled: false,
-      businessPagesEnabled: false,
-      customContent: "x".repeat(80),
-    });
-  });
-
-  test("业务页面覆盖默认关闭并兼容已保存的范围开关", () => {
-    expect(parseWatermarkSettings(null)).toEqual({
-      enabled: true,
-      businessPagesEnabled: false,
-      customContent: "",
-    });
-    expect(
-      parseWatermarkSettings(
-        JSON.stringify({
-          enabled: true,
-          businessPagesEnabled: true,
-          customContent: "内部资料",
-        }),
-      ),
-    ).toEqual({
-      enabled: true,
       businessPagesEnabled: true,
-      customContent: "内部资料",
+      customContent: "x".repeat(80),
     });
   });
 });

package/template/apps/web/src/layout/GlobalWatermark.layering.webtest.ts

@@ -0,0 +1,81 @@
+import { mount } from "@vue/test-utils";
+import { afterEach, describe, expect, test, vi } from "vitest";
+import GlobalWatermark from "./GlobalWatermark.vue";
+
+const state = vi.hoisted(() => {
+  const actor = {
+    id: "user_1",
+    type: "user" as const,
+    name: "张三",
+    roleCodes: [],
+    permissionKeys: ["system.watermark.read"],
+  };
+  const policy = {
+    value: {
+      enabled: true,
+      businessPagesEnabled: false,
+      customContent: "",
+    },
+  };
+
+  return {
+    actor: { value: actor },
+    access: {
+      value: {
+        actor,
+        menus: [],
+        permissions: [],
+        features: [
+          {
+            key: "system.watermark",
+            enabled: true,
+            visible: "visible" as const,
+            allowed: true,
+            reason: "enabled",
+          },
+        ],
+      },
+    },
+    policy,
+    content: { value: "zhangsan · 张三" },
+  };
+});
+
+vi.mock("@/composables/useAccessSnapshot", () => ({
+  useAccessSnapshot: () => ({ snapshot: state.access }),
+}));
+
+vi.mock("@/composables/useAuthSession", () => ({
+  useAuthSession: () => ({ actor: state.actor }),
+}));
+
+vi.mock("@/composables/useWatermarkSettings", () => ({
+  useWatermarkSettings: () => ({
+    settings: state.policy,
+    policy: state.policy,
+    content: state.content,
+    ensureLoaded: vi.fn(async () => state.policy.value),
+  }),
+}));
+
+afterEach(() => {
+  document.body.replaceChildren();
+});
+
+describe("GlobalWatermark 层级", () => {
+  test("传送到 body 并使用不拦截交互的审计覆盖层", () => {
+    const wrapper = mount(GlobalWatermark);
+    const watermark = document.body.querySelector(
+      '[data-testid="global-watermark"]',
+    );
+
+    expect(watermark).not.toBeNull();
+    expect(watermark?.parentElement).toBe(document.body);
+    expect(watermark?.classList).toContain("isolate");
+    expect(watermark?.classList).toContain("z-[60]");
+    expect(watermark?.classList).toContain("transform-gpu");
+    expect(watermark?.classList).toContain("pointer-events-none");
+
+    wrapper.unmount();
+  });
+});

package/template/apps/web/src/layout/GlobalWatermark.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { computed } from "vue";
+import { computed, onMounted } from "vue";
 import { useAuthSession } from "@/composables/useAuthSession";
 import { useAccessSnapshot } from "@/composables/useAccessSnapshot";
 import { useWatermarkSettings } from "@/composables/useWatermarkSettings";
@@ -16,40 +16,43 @@ const props = withDefaults(
 const auth = useAuthSession();
 const access = useAccessSnapshot();
 const watermark = useWatermarkSettings(auth.actor);
-const allowed = computed(
-  () =>
-    props.scope === "business" ||
-    (access.snapshot.value
-      ? evaluateWebAccess(access.snapshot.value, {
-          permissionKey: "system.watermark.read",
-          featureKey: "system.watermark",
-        }).allowed
-      : false),
-);
+onMounted(() => {
+  void watermark.ensureLoaded();
+});
+const allowed = computed(() => {
+  const snapshot = access.snapshot.value;
+  if (!snapshot) return false;
+  return evaluateWebAccess(snapshot, {
+    featureKey: "system.watermark",
+    permissionKey:
+      props.scope === "admin" ? "system.watermark.read" : undefined,
+  }).allowed;
+});
 const scopeEnabled = computed(
-  () =>
-    props.scope === "admin" || watermark.settings.value.businessPagesEnabled,
+  () => props.scope === "admin" || watermark.policy.value.businessPagesEnabled,
 );
 </script>
 
 <template>
-  <div
-    v-if="
-      allowed &&
-      scopeEnabled &&
-      watermark.settings.value.enabled &&
-      watermark.content.value
-    "
-    class="pointer-events-none fixed inset-0 z-30 grid grid-cols-3 grid-rows-6 overflow-hidden opacity-[0.075] dark:opacity-[0.11]"
-    aria-hidden="true"
-    data-testid="global-watermark"
-  >
-    <span
-      v-for="index in 18"
-      :key="index"
-      class="flex -rotate-[22deg] items-center justify-center whitespace-nowrap px-8 text-sm font-medium text-foreground"
+  <Teleport to="body">
+    <div
+      v-if="
+        allowed &&
+        scopeEnabled &&
+        watermark.policy.value.enabled &&
+        watermark.content.value
+      "
+      class="pointer-events-none fixed inset-0 isolate z-[60] grid transform-gpu grid-cols-3 grid-rows-6 overflow-hidden opacity-[0.075] dark:opacity-[0.11]"
+      aria-hidden="true"
+      data-testid="global-watermark"
     >
-      {{ watermark.content.value }}
-    </span>
-  </div>
+      <span
+        v-for="index in 18"
+        :key="index"
+        class="flex -rotate-[22deg] items-center justify-center whitespace-nowrap px-8 text-sm font-medium text-foreground"
+      >
+        {{ watermark.content.value }}
+      </span>
+    </div>
+  </Teleport>
 </template>

package/template/apps/web/src/layout/GlobalWatermark.webtest.ts

@@ -1,4 +1,4 @@
-import { mount } from "@vue/test-utils";
+import { config, mount } from "@vue/test-utils";
 import { beforeEach, describe, expect, test, vi } from "vitest";
 import GlobalWatermark from "./GlobalWatermark.vue";
 
@@ -34,7 +34,7 @@ const state = vi.hoisted(() => ({
       permissionKeys: ["system.watermark.read"],
     },
   },
-  settings: {
+  policy: {
     value: {
       enabled: true,
       businessPagesEnabled: false,
@@ -54,13 +54,19 @@ vi.mock("@/composables/useAuthSession", () => ({
 
 vi.mock("@/composables/useWatermarkSettings", () => ({
   useWatermarkSettings: () => ({
-    settings: state.settings,
+    policy: state.policy,
     content: state.content,
+    ensureLoaded: vi.fn(async () => state.policy.value),
   }),
 }));
 
+config.global.stubs = {
+  ...config.global.stubs,
+  teleport: true,
+};
+
 beforeEach(() => {
-  state.settings.value = {
+  state.policy.value = {
     enabled: true,
     businessPagesEnabled: false,
     customContent: "",
@@ -76,7 +82,7 @@ describe("GlobalWatermark", () => {
     );
     wrapper.unmount();
 
-    state.settings.value = { ...state.settings.value, enabled: false };
+    state.policy.value = { ...state.policy.value, enabled: false };
     const disabledWrapper = mount(GlobalWatermark);
 
     expect(
@@ -94,8 +100,8 @@ describe("GlobalWatermark", () => {
     );
     wrapper.unmount();
 
-    state.settings.value = {
-      ...state.settings.value,
+    state.policy.value = {
+      ...state.policy.value,
       businessPagesEnabled: true,
     };
     const enabledWrapper = mount(GlobalWatermark, {
@@ -105,5 +111,50 @@ describe("GlobalWatermark", () => {
     expect(
       enabledWrapper.get('[data-testid="global-watermark"]').text(),
     ).toContain("zhangsan · 张三");
+    expect(
+      enabledWrapper.get('[data-testid="global-watermark"]').classes(),
+    ).toEqual(
+      expect.arrayContaining([
+        "isolate",
+        "z-[60]",
+        "transform-gpu",
+        "pointer-events-none",
+      ]),
+    );
+  });
+
+  test("业务页仍服从平台 Feature 最终有效态", () => {
+    state.policy.value = {
+      enabled: true,
+      businessPagesEnabled: true,
+      customContent: "",
+    };
+    state.access.value.features[0]!.allowed = false;
+
+    const wrapper = mount(GlobalWatermark, {
+      props: { scope: "business" },
+    });
+
+    expect(wrapper.find('[data-testid="global-watermark"]').exists()).toBe(
+      false,
+    );
+    state.access.value.features[0]!.allowed = true;
+  });
+
+  test("水印传送到 body，脱离应用壳的层叠上下文", () => {
+    const wrapper = mount(GlobalWatermark, {
+      global: {
+        stubs: {
+          teleport: false,
+        },
+      },
+    });
+
+    const watermark = document.body.querySelector(
+      '[data-testid="global-watermark"]',
+    );
+    expect(watermark).not.toBeNull();
+    expect(watermark?.parentElement).toBe(document.body);
+    wrapper.unmount();
   });
 });

package/template/apps/web/src/pages/settings/GlobalSettingsPage.vue

@@ -143,7 +143,7 @@ function handleBeforeUnload(event: BeforeUnloadEvent) {
     <header class="space-y-2">
       <h1 class="text-3xl font-semibold tracking-tight">全局设置</h1>
       <p class="text-muted-foreground">
-        维护面向所有用户的平台品牌信息，以及当前浏览器的页面水印偏好。
+        维护面向所有用户的平台品牌信息与全局页面水印策略。
       </p>
     </header>
     <Tabs

package/template/apps/web/src/pages/settings/WatermarkSettingsSection.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { computed, shallowRef } from "vue";
+import { computed, onMounted, shallowRef } from "vue";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Switch } from "@/components/ui/switch";
@@ -8,16 +8,17 @@ import { useAppToast } from "@/composables/useAppToast";
 import { useAuthSession } from "@/composables/useAuthSession";
 import { useWatermarkSettings } from "@/composables/useWatermarkSettings";
 import { evaluateWebAccess } from "@/layout/navigation";
+import { DEFAULT_PLATFORM_WATERMARK_POLICY } from "@southwind-ai/shared";
 
 const auth = useAuthSession();
 const access = useAccessSnapshot();
 const toast = useAppToast();
 const watermark = useWatermarkSettings(auth.actor);
-const enabled = shallowRef(watermark.settings.value.enabled);
+const enabled = shallowRef(watermark.policy.value.enabled);
 const businessPagesEnabled = shallowRef(
-  watermark.settings.value.businessPagesEnabled,
+  watermark.policy.value.businessPagesEnabled,
 );
-const customContent = shallowRef(watermark.settings.value.customContent);
+const customContent = shallowRef(watermark.policy.value.customContent);
 const saving = shallowRef(false);
 const baseline = shallowRef(serializeForm());
 const canManage = computed(() => {
@@ -33,17 +34,30 @@ const canManage = computed(() => {
 const isDirty = computed(
   () => canManage.value && serializeForm() !== baseline.value,
 );
+const formDisabled = computed(
+  () => !canManage.value || saving.value || watermark.loading.value,
+);
+
+onMounted(async () => {
+  try {
+    await watermark.loadManaged();
+    applyPolicyToForm();
+  } catch (error) {
+    toast.error("水印策略加载失败", {
+      description: error instanceof Error ? error.message : String(error),
+    });
+  }
+});
 
 async function save(): Promise<boolean> {
   saving.value = true;
   try {
-    watermark.update({
+    await watermark.save({
       enabled: enabled.value,
       businessPagesEnabled: businessPagesEnabled.value,
       customContent: customContent.value,
     });
-    customContent.value = watermark.settings.value.customContent;
-    baseline.value = serializeForm();
+    applyPolicyToForm();
     toast.success("水印设置已保存");
     return true;
   } catch (error) {
@@ -57,12 +71,20 @@ async function save(): Promise<boolean> {
 }
 
 function reset() {
-  enabled.value = true;
-  businessPagesEnabled.value = false;
-  customContent.value = "";
+  enabled.value = DEFAULT_PLATFORM_WATERMARK_POLICY.enabled;
+  businessPagesEnabled.value =
+    DEFAULT_PLATFORM_WATERMARK_POLICY.businessPagesEnabled;
+  customContent.value = DEFAULT_PLATFORM_WATERMARK_POLICY.customContent;
   toast.success("已恢复为默认值，保存后生效");
 }
 
+function applyPolicyToForm() {
+  enabled.value = watermark.policy.value.enabled;
+  businessPagesEnabled.value = watermark.policy.value.businessPagesEnabled;
+  customContent.value = watermark.policy.value.customContent;
+  baseline.value = serializeForm();
+}
+
 function serializeForm() {
   return JSON.stringify({
     enabled: enabled.value,
@@ -82,7 +104,7 @@ defineExpose({
     <div class="mb-6 space-y-1">
       <h2 class="text-xl font-semibold">页面水印</h2>
       <p class="text-sm text-muted-foreground">
-        默认使用当前账号的用户名和手机、邮箱或姓名，帮助定位截图来源。
+        该策略由平台统一管理并应用于所有用户，帮助定位截图来源。
       </p>
     </div>
     <div class="grid gap-5">
@@ -92,7 +114,7 @@ defineExpose({
         <span>显示页面水印</span>
         <Switch
           v-model="enabled"
-          :disabled="!canManage"
+          :disabled="formDisabled"
           aria-label="显示页面水印"
         />
       </label>
@@ -107,7 +129,7 @@ defineExpose({
         </span>
         <Switch
           v-model="businessPagesEnabled"
-          :disabled="!canManage || !enabled"
+          :disabled="formDisabled || !enabled"
           aria-label="在业务页面显示水印"
         />
       </label>
@@ -115,19 +137,19 @@ defineExpose({
         <span>自定义内容</span>
         <Input
           v-model="customContent"
-          :disabled="!canManage"
+          :disabled="formDisabled"
           maxlength="80"
-          :placeholder="watermark.content.value || '使用当前账号信息'"
+          :placeholder="watermark.content.value || '使用各用户的账号信息'"
         />
         <span class="text-xs font-normal text-muted-foreground">
-          留空时自动使用账号身份；该偏好只保存在当前浏览器。
+          留空时为每位用户自动使用其账号身份；保存后全局生效。
         </span>
       </label>
       <div v-if="canManage" class="flex justify-end gap-3 border-t pt-5">
-        <Button variant="outline" :disabled="saving" @click="reset">
+        <Button variant="outline" :disabled="formDisabled" @click="reset">
           恢复默认
         </Button>
-        <Button :disabled="saving" @click="save">
+        <Button :disabled="formDisabled" @click="save">
           {{ saving ? "保存中…" : "保存水印设置" }}
         </Button>
       </div>

package/template/apps/web/src/services/platform-settings-api.ts

@@ -1,7 +1,13 @@
 import { apiRequest } from "./http";
-import type { PlatformBrandingSettings } from "@southwind-ai/shared";
+import type {
+  PlatformBrandingSettings,
+  PlatformWatermarkPolicy,
+} from "@southwind-ai/shared";
 
-export type { PlatformBrandingSettings } from "@southwind-ai/shared";
+export type {
+  PlatformBrandingSettings,
+  PlatformWatermarkPolicy,
+} from "@southwind-ai/shared";
 
 export function loadPublicBranding(): Promise<PlatformBrandingSettings> {
   return apiRequest<PlatformBrandingSettings>("/platform/branding");
@@ -19,3 +25,20 @@ export function updatePlatformBranding(
     body: JSON.stringify(settings),
   });
 }
+
+export function loadPublicWatermarkPolicy(): Promise<PlatformWatermarkPolicy> {
+  return apiRequest<PlatformWatermarkPolicy>("/platform/watermark-policy");
+}
+
+export function loadPlatformWatermarkPolicy(): Promise<PlatformWatermarkPolicy> {
+  return apiRequest<PlatformWatermarkPolicy>("/system/settings/watermark");
+}
+
+export function updatePlatformWatermarkPolicy(
+  policy: PlatformWatermarkPolicy,
+): Promise<PlatformWatermarkPolicy> {
+  return apiRequest<PlatformWatermarkPolicy>("/system/settings/watermark", {
+    method: "PUT",
+    body: JSON.stringify(policy),
+  });
+}

package/template/apps/web/vite.config.ts

@@ -7,6 +7,7 @@ import { projectFingerprint, windyDevIdentityPlugin } from "./dev/dev-identity";
 const fingerprint =
   process.env.WINDY_DEV_FINGERPRINT || projectFingerprint(process.cwd());
 const devPort = Number(process.env.WINDY_DEV_PORT || 8_746);
+const usePolling = process.env.WINDY_DEV_USE_POLLING === "1";
 
 export default defineConfig({
   plugins: [vue(), tailwindcss(), windyDevIdentityPlugin(fingerprint)],
@@ -19,8 +20,9 @@ export default defineConfig({
     host: process.env.VITE_DEV_HOST ?? "127.0.0.1",
     port: devPort,
     strictPort: true,
+    watch: usePolling ? { usePolling: true, interval: 200 } : undefined,
     proxy: {
-      "/api": process.env.API_UPSTREAM ?? "http://localhost:3000",
+      "/api": process.env.API_UPSTREAM ?? "http://localhost:9747",
     },
   },
 });

package/template/docker-compose.yml

@@ -6,7 +6,7 @@ services:
       POSTGRES_USER: windy
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?请在 .env 中设置 POSTGRES_PASSWORD}
     ports:
-      - "5432:5432"
+      - "15432:5432"
     volumes:
       - postgres-data:/var/lib/postgresql/data
     healthcheck:
@@ -35,14 +35,15 @@ services:
     command: ["bun", "run", "--cwd", "apps/server", "dev"]
     environment:
       NODE_ENV: development
-      PORT: 3000
+      PORT: 9747
       DATABASE_URL: postgresql://windy:${POSTGRES_PASSWORD}@postgres:5432/windy
       WINDY_BOOTSTRAP_ADMIN_PASSWORD: ${WINDY_BOOTSTRAP_ADMIN_PASSWORD:?请在 .env 中设置管理员初始密码}
       WINDY_AUDIT_QUEUE_FILE: /app/data/audit/recovery-queue.json
       WINDY_CONTAINERIZED: "1"
+      BUN_CONFIG_NO_CLEAR_TERMINAL_ON_RELOAD: "true"
       WINDY_SYSTEM_USAGE_PATHS: /app/data/audit
     ports:
-      - "3000:3000"
+      - "9747:9747"
     volumes:
       - ./apps/server:/app/apps/server
       - ./packages:/app/packages
@@ -58,14 +59,26 @@ services:
     command: ["bun", "run", "--cwd", "apps/web", "dev"]
     environment:
       NODE_ENV: development
-      WINDY_DEV_PORT: 9746
-      API_UPSTREAM: http://server:3000
+      WINDY_DEV_PORT: 18746
+      WINDY_DEV_USE_POLLING: "1"
+      API_UPSTREAM: http://server:9747
       VITE_DEV_HOST: 0.0.0.0
     ports:
-      - "9746:9746"
+      - "18746:18746"
     volumes:
       - ./apps/web:/app/apps/web
       - ./packages:/app/packages
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "bun",
+          "-e",
+          "const r=await fetch('http://127.0.0.1:18746/-/windy-dev');process.exit(r.ok?0:1)",
+        ]
+      interval: 5s
+      timeout: 3s
+      retries: 6
     depends_on:
       - server
 

package/template/docs/platform/platform-shell-settings.md

@@ -53,9 +53,30 @@
 - 权限：`system.watermark.read`、`system.watermark.manage`
 - 页面入口：全局设置 / 页面水印，不注册独立 Sidebar 菜单
 
-只有 Feature 最终有效且当前用户具有读取权限时才渲染水印及全局设置中的水印区块。当前版本的显示开关与自定义内容是用户在当前浏览器的偏好；默认内容从当前 Actor 派生，顺序为用户名加手机、邮箱或姓名。
-
-后续若引入平台强制水印策略，应由服务端持久化并审计，生效关系为：Feature 开启，且平台强制显示，或平台允许用户控制且个人偏好开启。普通用户不能覆盖“强制显示”。
+水印是平台级强制策略，不是用户偏好。`PlatformWatermarkPolicy` 包含总开关
+`enabled`、业务页范围开关 `businessPagesEnabled` 与最长 80 字符的
+`customContent`。策略由 Admin 的全局设置页面维护，写入
+`platform_watermark_policies`；每次保存都记录 `config.update` 审计，目标为
+`platform-watermark/platform`。用户应用端没有水印开关，也不使用 localStorage
+保存或覆盖策略。
+
+管理接口 `GET/PUT /api/system/settings/watermark` 分别经过
+`system.watermark.read/manage`、Feature 与 License Guard。业务应用通过公开只读接口
+`GET /api/platform/watermark-policy` 获取相同策略；公开响应只包含三个非敏感策略字段。
+Feature 最终有效且 `enabled=true` 时 Admin 页面显示水印；业务页面还要求
+`businessPagesEnabled=true`。Admin 设置区本身仍要求读取权限，但普通业务用户不需要
+水印读取权限，也不能覆盖全局策略。
+
+`customContent` 留空时，客户端从当前 Actor 派生身份水印，顺序为用户名加手机、邮箱或
+姓名；填写后所有用户显示相同的管理员指定内容。水印通过 Vue `Teleport` 直接挂到
+`body`，脱离应用壳的层叠上下文；稳定审计顶层类 `z-[60]` 高于平台统一使用的
+`z-50` Sidebar、Drawer、Overlay 与 Modal，并配合 `isolate`、`transform-gpu`
+保证截图审计信息不会被浮层遮住。容器必须始终保留 `pointer-events-none` 与
+`aria-hidden=true`，不能阻塞点击或进入辅助技术阅读顺序。
+
+数据库迁移 `0031_panoramic_typhoid_mary.sql` 新增策略表。历史版本只保存过浏览器偏好，
+没有可自动提升为全局策略的服务端真源；升级后采用默认策略（总开关开启、业务页关闭），
+管理员应在全局设置中确认范围并保存一次。
 
 ## 个人设置
 

package/template/docs/platform/web-system-crud.md

@@ -64,7 +64,7 @@ POST   /api/system/notifications
 DELETE /api/system/notifications/:id
 ```
 
-开发服务把 `/api` 代理到 `http://localhost:3000`。默认不携带开发 Token；需要调试直通时必须同时显式设置：
+开发服务把 `/api` 代理到 `http://localhost:9747`。默认不携带开发 Token；需要调试直通时必须同时显式设置：
 
 ```text
 VITE_API_BASE=/api
@@ -83,7 +83,7 @@ VITE_DEV_ADMIN_TOKEN=<显式开发 Token>
 - Feature 管理页在列表最右侧操作栏直接显示启停开关，不再打开通用编辑弹窗；修改仍调用受 Guard 和关键审计保护的 Server API。
 - Feature 开关成功修改会写入 `feature.update`，可在审计日志页通过“功能开关变更”直接查看。
 - 系统资源表和字典后台任务表加载时保留表头与列宽，并显示带 `animate-pulse` 的骨架行；加载失败和空数据仍使用各自独立状态。
-- 全局水印默认开启，内容按“用户名 + 手机号 / 邮箱 / 姓名”的顺序从当前会话 Actor 派生。`system.watermark` Feature 和 `system.watermark.read` 权限共同控制渲染及“全局设置”页内的水印区块；水印不注册独立 Sidebar 入口。用户可关闭或写入最多 80 个字符的自定义内容，偏好只保存在当前浏览器，不是平台级强制策略。服务端只向当前用户自己的会话响应补充这些身份字段。
+- 全局水印默认开启，内容按“用户名 + 手机号 / 邮箱 / 姓名”的顺序从当前会话 Actor 派生。管理员在“全局设置”中维护持久化的总开关、业务页面范围和最多 80 个字符的自定义内容；保存写入审计并立即成为所有用户的只读策略。用户应用端不提供开关，也不使用 localStorage。`system.watermark` Feature 控制最终生效态，管理区另需 `system.watermark.read/manage` 权限。水印使用专用审计顶层覆盖 Sidebar、Drawer、Overlay 和 Modal，同时保持 `pointer-events-none`。服务端只向当前用户自己的会话响应补充这些身份字段。
 - 站内通知由 PostgreSQL `platform_notifications` 和 `notification_reads` 持久化；管理人员可在 `/system/notifications` 广播发布和归档，用户从 Header 收件箱阅读正文并幂等写入已读回执。归档是生命周期操作，不物理删除通知或回执。当前发布范围是全体有阅读权限的用户，尚未提供组织、角色、用户定向和外部渠道投递。
 - 字典页已切换为后台 NDJSON 导入导出，展示本人任务状态、进度、重试和终态文件下载；其它系统资源仍保留小数据同步 JSON 入口。详细契约见 [批量导入导出后台任务](./bulk-data-jobs.md)。当前 artifact 存在 10 MiB、50,000 行和 256 KiB 单行上限，扩大容量前需要对象存储 Adapter。
 - 审计日志配置 `DATABASE_URL` 后读取 PostgreSQL `audit_logs`。可靠写入器提供有界重试、降级状态、关键事件本地恢复队列和健康信息；页面仍只读，且不会展示恢复队列中的事件正文。

package/template/drizzle.config.ts

@@ -11,6 +11,6 @@ export default defineConfig({
   },
   dbCredentials: {
     url:
-      process.env.DATABASE_URL || "postgresql://localhost:5432/windy",
+      process.env.DATABASE_URL || "postgresql://localhost:15432/windy",
   },
 });