create-windy 0.2.17 → 0.2.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-windy",
-  "version": "0.2.17",
+  "version": "0.2.19",
   "description": "创建单组织、单租户、私有部署优先的 Windy 企业 Dashboard Starter",
   "type": "module",
   "bin": {

package/template/.windy-template.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "templateCommit": "b22121438a88c70146f3e37d9819a9df15b82ab9",
-  "generatorVersion": "0.2.17",
+  "templateCommit": "7b28912bcf1a776aa3328e0ea36c014cd494461f",
+  "generatorVersion": "0.2.19",
   "modules": [
     {
       "name": "system",

package/template/AGENTS.md

@@ -31,9 +31,19 @@
 - 这是 Starter 的初始配置；项目所有者可按团队需要保留、替换或扩展。
 - 实际可用命令和提交检查以当前项目的 `package.json` 与 Git hooks 为准。
 
+## Windy 升级边界
+
+- 业务需求优先通过自有模块和既有扩展点实现，尽量不要直接修改 Windy 提供的平台核心、
+  Composition Root、共享脚手架和根工具链配置，以减少后续升级冲突。
+- 修改前先查看 `.windy/files.json` 的 ownership；优先扩展 `project-owned` 路径，
+  对 `windy-managed` 路径仅在没有可用扩展点时做最小改动。
+- 确需修改 Windy 受管代码时，使用独立小提交记录原因和影响；升级前先运行
+  `bun run windy update --dry-run`，根据三方合并计划处理冲突。
+
 ## 常用入口
 
-- `bun run dev`：通过 Docker Compose 启动 PostgreSQL、自动 migration、Server 与 Web。
+- `bun run dev`：复用 Docker 镜像启动 PostgreSQL、自动 migration、Server 与支持热更新的 Web。
+- `bun run dev:build`：依赖、Dockerfile 或 lockfile 变化后重建并启动开发环境。
 - `bun run dev:web`：启动 Web 开发服务。
 - `bun run dev:server`：启动 Server 开发服务。
 - `bun run lint`、`bun run typecheck`、`bun run test`、`bun run build`：执行基础验证；未选择 Oxc 时没有 lint 脚本。

package/template/README.md

@@ -30,15 +30,17 @@ create-windy 已创建仅供本机使用且被 Git 忽略的 `.env`，其中两
 文件权限为 `0600`。`bun run dev` 会通过 Docker Compose 等待 PostgreSQL、执行
 Drizzle migration，再启动 Server 与 Web；不要跳过 migration 后直接把 Server 连接到
 空数据库。首次启动需要本机已经安装并启动 Docker 与 Docker Compose，并可能需要下载
-基础镜像。
+基础镜像。后续 `bun run dev` 会复用已有镜像，不会重复构建；依赖、Dockerfile 或
+`bun.lock` 变化后运行 `bun run dev:build`。
 
 | 服务 | 地址 |
 | ---- | ---- |
-| Web | http://localhost:9746 |
-| Server 健康检查 | http://localhost:3000/api/health |
-| PostgreSQL | localhost:5432 |
+| Web | http://localhost:18746 |
+| Server 健康检查 | http://localhost:9747/api/health |
+| PostgreSQL | localhost:15432 |
 
-Docker Web 固定使用 `9746`。只启动单个应用时使用：
+Docker Web 固定使用 `18746`，Web 与 Server 都挂载宿主机源码并保持热更新。只启动
+单个应用时使用：
 
 ```bash
 bun run dev:web
@@ -112,6 +114,7 @@ create-windy 在本机 `.env` 中随机生成的 `WINDY_BOOTSTRAP_ADMIN_PASSWORD
 
 ```bash
 bun run dev
+bun run dev:build
 bun run dev:web
 bun run dev:server
 bun run typecheck

package/template/apps/server/Dockerfile

@@ -29,9 +29,9 @@ COPY packages packages
 COPY --chmod=0555 deploy/production/server-entrypoint.sh /usr/local/bin/windy-server-entrypoint
 RUN mkdir -p /app/data/audit /app/data/license && chown -R bun:bun /app/data
 ENV NODE_ENV=production
-ENV PORT=3000
+ENV PORT=9747
 ENV WINDY_CONTAINERIZED=1
-EXPOSE 3000
+EXPOSE 9747
 USER bun
-HEALTHCHECK --interval=15s --timeout=3s --start-period=15s --retries=4 CMD ["bun", "-e", "const r=await fetch('http://127.0.0.1:3000/api/ready');process.exit(r.ok?0:1)"]
+HEALTHCHECK --interval=15s --timeout=3s --start-period=15s --retries=4 CMD ["bun", "-e", "const r=await fetch('http://127.0.0.1:9747/api/ready');process.exit(r.ok?0:1)"]
 CMD ["bun", "run", "--cwd", "apps/server", "start"]

package/template/apps/server/src/index.ts

@@ -53,8 +53,7 @@ import { registerSchedulerRoutes } from "./scheduler/routes.js";
 import { SchedulerWorker } from "./scheduler/worker.js";
 // @windy-module system.scheduler end
 // @windy-module system.settings begin
-import { registerBrandingSettingsRoutes } from "./settings/routes.js";
-import { createBrandingSettingsRepository } from "./settings/runtime.js";
+import { createPlatformSettingsRuntime } from "./settings/runtime.js";
 // @windy-module system.settings end
 import { registerProfileRoutes } from "./profile/routes.js";
 // @windy-module system.notification begin
@@ -191,10 +190,10 @@ const storageRuntime = createStorageRuntime(
 );
 // @windy-module system.storage end
 // @windy-module system.settings begin
-const brandingSettingsRepository = createBrandingSettingsRepository(
-  persistence?.db,
-  { softwareName: platformConfig.name, logoUrl: platformConfig.logoUrl },
-);
+const platformSettings = createPlatformSettingsRuntime(persistence?.db, {
+  softwareName: platformConfig.name,
+  logoUrl: platformConfig.logoUrl,
+});
 // @windy-module system.settings end
 // @windy-module work-order begin
 const exampleModuleRuntime = createExampleModuleRuntime({
@@ -276,12 +275,7 @@ registerPlatformLicenseRoutes(app, platformLicenseRuntime);
 // @windy-module system.license end
 
 // @windy-module system.settings begin
-registerBrandingSettingsRoutes(
-  app,
-  brandingSettingsRepository,
-  runtime,
-  foundationSnapshot.features,
-);
+platformSettings.register(app, runtime, foundationSnapshot.features);
 // @windy-module system.settings end
 // @windy-module system.notification begin
 registerNotificationRoutes(
@@ -304,7 +298,7 @@ registerStorageRoutes(
     uploads: storageRuntime.uploads,
     files: storageRuntime.files,
     isPublicBrandingFile: async (fileId) =>
-      (await brandingSettingsRepository.get()).logoUrl ===
+      (await platformSettings.branding.get()).logoUrl ===
       `/api/platform/files/${fileId}`,
   },
   runtime,
@@ -387,7 +381,7 @@ validateServerModuleComposition({
   // @windy-module system.search end
 });
 
-const port = process.env.PORT ? Number(process.env.PORT) : 3000;
+const port = process.env.PORT ? Number(process.env.PORT) : 9_747;
 app.listen(port);
 // @windy-module system.scheduler begin
 schedulerWorker.start();

package/template/apps/server/src/settings/drizzle-watermark-repository.integration.test.ts

@@ -0,0 +1,57 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { resolve } from "node:path";
+import { DEFAULT_PLATFORM_WATERMARK_POLICY } from "@southwind-ai/shared";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+import { Pool } from "pg";
+import { DrizzleWatermarkPolicyRepository } from "./drizzle-watermark-repository.js";
+
+const databaseUrl = process.env.SETTINGS_TEST_DATABASE_URL;
+const describePostgres = databaseUrl ? describe : describe.skip;
+
+describePostgres("PostgreSQL watermark policy repository", () => {
+  let pool: Pool;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: databaseUrl });
+    const db = drizzle(pool);
+    await migrate(db, {
+      migrationsFolder: resolve(
+        import.meta.dir,
+        "../../../../packages/database/drizzle",
+      ),
+      migrationsSchema: "public",
+      migrationsTable: "__settings_test_migrations",
+    });
+    await pool.query("truncate table platform_watermark_policies");
+  });
+
+  afterAll(async () => {
+    await pool?.end();
+  });
+
+  test("保存后可由重建的 Repository 读取同一全局策略", async () => {
+    const repository = new DrizzleWatermarkPolicyRepository(
+      drizzle(pool),
+      DEFAULT_PLATFORM_WATERMARK_POLICY,
+    );
+    await repository.update(
+      {
+        enabled: true,
+        businessPagesEnabled: true,
+        customContent: "内部资料",
+      },
+      "user_settings",
+    );
+
+    const restarted = new DrizzleWatermarkPolicyRepository(
+      drizzle(pool),
+      DEFAULT_PLATFORM_WATERMARK_POLICY,
+    );
+    expect(await restarted.get()).toEqual({
+      enabled: true,
+      businessPagesEnabled: true,
+      customContent: "内部资料",
+    });
+  });
+});

package/template/apps/server/src/settings/drizzle-watermark-repository.ts

@@ -0,0 +1,62 @@
+import { platformWatermarkPolicies } from "@southwind-ai/database";
+import type { PlatformWatermarkPolicy } from "@southwind-ai/shared";
+import { eq } from "drizzle-orm";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { WatermarkPolicyRepository } from "./watermark-repository.js";
+
+const PLATFORM_WATERMARK_ID = "platform";
+
+export class DrizzleWatermarkPolicyRepository implements WatermarkPolicyRepository {
+  constructor(
+    private readonly db: NodePgDatabase,
+    private readonly defaults: PlatformWatermarkPolicy,
+  ) {}
+
+  async get(): Promise<PlatformWatermarkPolicy> {
+    const [row] = await this.db
+      .select()
+      .from(platformWatermarkPolicies)
+      .where(eq(platformWatermarkPolicies.id, PLATFORM_WATERMARK_ID))
+      .limit(1);
+    return row ? toPolicy(row) : { ...this.defaults };
+  }
+
+  async update(
+    policy: PlatformWatermarkPolicy,
+    actorId: string,
+  ): Promise<PlatformWatermarkPolicy> {
+    const [row] = await this.db
+      .insert(platformWatermarkPolicies)
+      .values({
+        id: PLATFORM_WATERMARK_ID,
+        ...policy,
+        createdBy: actorId,
+        updatedBy: actorId,
+      })
+      .onConflictDoUpdate({
+        target: platformWatermarkPolicies.id,
+        set: {
+          enabled: policy.enabled,
+          businessPagesEnabled: policy.businessPagesEnabled,
+          customContent: policy.customContent,
+          updatedAt: new Date(),
+          updatedBy: actorId,
+        },
+      })
+      .returning();
+    if (!row) throw new Error("水印策略保存失败");
+    return toPolicy(row);
+  }
+}
+
+function toPolicy(row: {
+  enabled: boolean;
+  businessPagesEnabled: boolean;
+  customContent: string;
+}): PlatformWatermarkPolicy {
+  return {
+    enabled: row.enabled,
+    businessPagesEnabled: row.businessPagesEnabled,
+    customContent: row.customContent,
+  };
+}

package/template/apps/server/src/settings/runtime.ts

@@ -1,13 +1,40 @@
-import type { PlatformBrandingSettings } from "@southwind-ai/shared";
+import type {
+  FeatureFlagDefinition,
+  PlatformBrandingSettings,
+} from "@southwind-ai/shared";
+import { DEFAULT_PLATFORM_WATERMARK_POLICY } from "@southwind-ai/shared";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { createServerRuntime } from "../runtime.js";
+import type { RouteApp } from "../system/route-types.js";
 import { DrizzleBrandingSettingsRepository } from "./drizzle-repository.js";
+import { DrizzleWatermarkPolicyRepository } from "./drizzle-watermark-repository.js";
 import { InMemoryBrandingSettingsRepository } from "./repository.js";
+import { registerBrandingSettingsRoutes } from "./routes.js";
+import { InMemoryWatermarkPolicyRepository } from "./watermark-repository.js";
+import { registerWatermarkPolicyRoutes } from "./watermark-routes.js";
 
-export function createBrandingSettingsRepository(
+export function createPlatformSettingsRuntime(
   db: NodePgDatabase | undefined,
   defaults: PlatformBrandingSettings,
 ) {
-  return db
+  const branding = db
     ? new DrizzleBrandingSettingsRepository(db, defaults)
     : new InMemoryBrandingSettingsRepository(defaults);
+  const watermark = db
+    ? new DrizzleWatermarkPolicyRepository(
+        db,
+        DEFAULT_PLATFORM_WATERMARK_POLICY,
+      )
+    : new InMemoryWatermarkPolicyRepository();
+  return {
+    branding,
+    register(
+      app: RouteApp,
+      server: ReturnType<typeof createServerRuntime>,
+      features: FeatureFlagDefinition[],
+    ) {
+      registerBrandingSettingsRoutes(app, branding, server, features);
+      registerWatermarkPolicyRoutes(app, watermark, server, features);
+    },
+  };
 }

package/template/apps/server/src/settings/watermark-repository.ts

@@ -0,0 +1,32 @@
+import {
+  DEFAULT_PLATFORM_WATERMARK_POLICY,
+  type PlatformWatermarkPolicy,
+} from "@southwind-ai/shared";
+
+export interface WatermarkPolicyRepository {
+  get(): Promise<PlatformWatermarkPolicy>;
+  update(
+    policy: PlatformWatermarkPolicy,
+    actorId: string,
+  ): Promise<PlatformWatermarkPolicy>;
+}
+
+export class InMemoryWatermarkPolicyRepository implements WatermarkPolicyRepository {
+  private policy: PlatformWatermarkPolicy;
+
+  constructor(defaults = DEFAULT_PLATFORM_WATERMARK_POLICY) {
+    this.policy = { ...defaults };
+  }
+
+  async get(): Promise<PlatformWatermarkPolicy> {
+    return { ...this.policy };
+  }
+
+  async update(
+    policy: PlatformWatermarkPolicy,
+    _actorId: string,
+  ): Promise<PlatformWatermarkPolicy> {
+    this.policy = { ...policy };
+    return this.get();
+  }
+}

package/template/apps/server/src/settings/watermark-routes.test.ts

@@ -0,0 +1,203 @@
+import { describe, expect, test } from "bun:test";
+import type { PlatformWatermarkPolicy } from "@southwind-ai/shared";
+import { createFoundationSnapshot } from "../foundation.js";
+import type { RequestActor } from "../guards.js";
+import { createServerRuntime } from "../runtime.js";
+import type { RouteApp } from "../system/route-types.js";
+import {
+  InMemoryWatermarkPolicyRepository,
+  type WatermarkPolicyRepository,
+} from "./watermark-repository.js";
+import { registerWatermarkPolicyRoutes } from "./watermark-routes.js";
+
+class FakeRouteApp implements RouteApp {
+  readonly handlers = new Map<string, (context: unknown) => unknown>();
+
+  get(path: string, handler: (context: unknown) => unknown): void {
+    this.handlers.set(`GET ${path}`, handler);
+  }
+
+  post(): void {}
+
+  put(path: string, handler: (context: unknown) => unknown): void {
+    this.handlers.set(`PUT ${path}`, handler);
+  }
+
+  delete(): void {}
+
+  invoke(method: "GET" | "PUT", path: string, context: unknown = {}): unknown {
+    const handler = this.handlers.get(`${method} ${path}`);
+    if (!handler) throw new Error(`未注册路由 ${method} ${path}`);
+    return handler(context);
+  }
+}
+
+describe("平台水印策略路由", () => {
+  test("公开端点无需登录即可读取全局策略", async () => {
+    const fixture = await createFixture(anonymousActor());
+
+    const policy = (await fixture.app.invoke(
+      "GET",
+      "/platform/watermark-policy",
+    )) as PlatformWatermarkPolicy;
+
+    expect(policy).toEqual({
+      enabled: true,
+      businessPagesEnabled: false,
+      customContent: "",
+    });
+  });
+
+  test("管理员保存的策略对公开端点生效并写入审计", async () => {
+    const fixture = await createFixture(settingsActor(true));
+    const input: PlatformWatermarkPolicy = {
+      enabled: true,
+      businessPagesEnabled: true,
+      customContent: "内部资料",
+    };
+
+    const updated = (await fixture.app.invoke(
+      "PUT",
+      "/system/settings/watermark",
+      {
+        guardContext: fixture.guardContext,
+        body: input,
+        params: {},
+        query: {},
+      },
+    )) as PlatformWatermarkPolicy;
+    const publicPolicy = (await fixture.app.invoke(
+      "GET",
+      "/platform/watermark-policy",
+    )) as PlatformWatermarkPolicy;
+
+    expect(updated).toEqual(input);
+    expect(publicPolicy).toEqual(input);
+    expect(fixture.runtime.auditSink.list()).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          action: "config.update",
+          target: { type: "platform-watermark", id: "platform" },
+          metadata: expect.objectContaining({
+            changedFields: ["businessPagesEnabled", "customContent"],
+          }),
+        }),
+      ]),
+    );
+  });
+
+  test("只读管理员可以读取策略但不能修改", async () => {
+    const fixture = await createFixture(settingsActor(false));
+
+    const readable = (await fixture.app.invoke(
+      "GET",
+      "/system/settings/watermark",
+      { guardContext: fixture.guardContext, params: {}, query: {} },
+    )) as PlatformWatermarkPolicy;
+    const denied = (await update(fixture, {
+      enabled: false,
+      businessPagesEnabled: false,
+      customContent: "",
+    })) as Response;
+
+    expect(readable.enabled).toBe(true);
+    expect(denied.status).toBe(403);
+    await expect(denied.json()).resolves.toMatchObject({
+      reason: "missing-permission",
+    });
+  });
+
+  test("Feature 关闭时拒绝管理读取但公开策略仍可读取", async () => {
+    const fixture = await createFixture(settingsActor(true), false);
+
+    const denied = (await fixture.app.invoke(
+      "GET",
+      "/system/settings/watermark",
+      { guardContext: fixture.guardContext, params: {}, query: {} },
+    )) as Response;
+    const publicPolicy = (await fixture.app.invoke(
+      "GET",
+      "/platform/watermark-policy",
+    )) as PlatformWatermarkPolicy;
+
+    expect(denied.status).toBe(403);
+    expect(publicPolicy.enabled).toBe(true);
+  });
+
+  test("非法策略返回 400 且不会覆盖已保存值", async () => {
+    const fixture = await createFixture(settingsActor(true));
+
+    const response = (await update(fixture, {
+      enabled: true,
+      businessPagesEnabled: true,
+      customContent: "x".repeat(81),
+    })) as Response;
+
+    expect(response.status).toBe(400);
+    expect(await fixture.repository.get()).toEqual({
+      enabled: true,
+      businessPagesEnabled: false,
+      customContent: "",
+    });
+    expect(fixture.runtime.auditSink.list()).toHaveLength(0);
+  });
+});
+
+async function update(
+  fixture: Awaited<ReturnType<typeof createFixture>>,
+  body: PlatformWatermarkPolicy,
+) {
+  return fixture.app.invoke("PUT", "/system/settings/watermark", {
+    guardContext: fixture.guardContext,
+    body,
+    params: {},
+    query: {},
+  });
+}
+
+async function createFixture(actor: RequestActor, featureEnabled = true) {
+  const snapshot = createFoundationSnapshot();
+  const repository: WatermarkPolicyRepository =
+    new InMemoryWatermarkPolicyRepository();
+  const runtime = createServerRuntime(
+    {},
+    {
+      actorResolver: { resolve: () => actor },
+      featureResolver: {
+        resolve: (key) => ({
+          key,
+          enabled: featureEnabled,
+          visible: "visible",
+        }),
+      },
+    },
+  );
+  const app = new FakeRouteApp();
+  registerWatermarkPolicyRoutes(app, repository, runtime, snapshot.features);
+  const guardContext = await runtime.createGuardContext(
+    new Request("http://localhost/api/system/settings/watermark"),
+  );
+  return { app, repository, runtime, guardContext };
+}
+
+function settingsActor(canManage: boolean): RequestActor {
+  return {
+    id: "user_settings",
+    type: "user",
+    name: "配置管理员",
+    roleCodes: ["admin"],
+    permissionKeys: ["system.watermark.read"].concat(
+      canManage ? "system.watermark.manage" : [],
+    ),
+  };
+}
+
+function anonymousActor(): RequestActor {
+  return {
+    id: "anonymous",
+    type: "anonymous",
+    name: "匿名用户",
+    roleCodes: [],
+    permissionKeys: [],
+  };
+}

package/template/apps/server/src/settings/watermark-routes.ts

@@ -0,0 +1,134 @@
+import type {
+  ApiPermissionBinding,
+  FeatureFlagDefinition,
+  PlatformWatermarkPolicy,
+} from "@southwind-ai/shared";
+import { evaluateRouteGuards, findFeature } from "../route-guards.js";
+import type { createServerRuntime } from "../runtime.js";
+import { resourceEvent, routeContext } from "../system/route-helpers.js";
+import type { RouteApp } from "../system/route-types.js";
+import type { WatermarkPolicyRepository } from "./watermark-repository.js";
+
+type ServerRuntime = ReturnType<typeof createServerRuntime>;
+
+const READ_BINDING = watermarkBinding("GET", "system.watermark.read");
+const MANAGE_BINDING = watermarkBinding("PUT", "system.watermark.manage");
+
+export function registerWatermarkPolicyRoutes(
+  app: RouteApp,
+  repository: WatermarkPolicyRepository,
+  runtime: ServerRuntime,
+  features: FeatureFlagDefinition[],
+): void {
+  const feature = findFeature(features, "system.watermark");
+
+  app.get("/platform/watermark-policy", () => repository.get());
+
+  app.get("/system/settings/watermark", async (rawContext) => {
+    const { guardContext } = routeContext(rawContext);
+    const denied = await guard(runtime, guardContext, READ_BINDING, feature);
+    return denied || repository.get();
+  });
+
+  app.put("/system/settings/watermark", async (rawContext) => {
+    const { body, guardContext } = routeContext(rawContext);
+    const denied = await guard(runtime, guardContext, MANAGE_BINDING, feature);
+    if (denied) return denied;
+
+    const parsed = parseWatermarkPolicy(body);
+    if (!parsed.ok) {
+      return Response.json(
+        { error: "INVALID_WATERMARK_POLICY", message: parsed.message },
+        { status: 400 },
+      );
+    }
+
+    const before = await repository.get();
+    const updated = await repository.update(
+      parsed.value,
+      guardContext.actor.id,
+    );
+    await runtime.auditSink.recordCriticalEvent(
+      resourceEvent(
+        guardContext,
+        "config.update",
+        "platform-watermark",
+        "platform",
+        { changedFields: changedFields(before, updated) },
+      ),
+    );
+    return updated;
+  });
+}
+
+async function guard(
+  runtime: ServerRuntime,
+  context: ReturnType<typeof routeContext>["guardContext"],
+  permission: ApiPermissionBinding,
+  feature: FeatureFlagDefinition | undefined,
+): Promise<Response | undefined> {
+  const decision = await evaluateRouteGuards(runtime, context, {
+    permission,
+    feature,
+  });
+  if (decision.allowed) return undefined;
+  return Response.json(
+    { error: "FORBIDDEN", reason: decision.reason },
+    { status: 403 },
+  );
+}
+
+function watermarkBinding(
+  method: "GET" | "PUT",
+  permissionKey: string,
+): ApiPermissionBinding {
+  return {
+    method,
+    path: "/api/system/settings/watermark",
+    permissionKey,
+    featureKey: "system.watermark",
+  };
+}
+
+type WatermarkParseResult =
+  | { ok: true; value: PlatformWatermarkPolicy }
+  | { ok: false; message: string };
+
+function parseWatermarkPolicy(body: unknown): WatermarkParseResult {
+  if (!body || typeof body !== "object") {
+    return { ok: false, message: "请求体必须是对象" };
+  }
+  const source = body as Record<string, unknown>;
+  if (
+    typeof source.enabled !== "boolean" ||
+    typeof source.businessPagesEnabled !== "boolean"
+  ) {
+    return { ok: false, message: "水印开关必须是布尔值" };
+  }
+  if (typeof source.customContent !== "string") {
+    return { ok: false, message: "自定义内容必须是字符串" };
+  }
+  const customContent = source.customContent.trim();
+  if (customContent.length > 80) {
+    return { ok: false, message: "自定义内容不能超过 80 个字符" };
+  }
+  return {
+    ok: true,
+    value: {
+      enabled: source.enabled,
+      businessPagesEnabled: source.businessPagesEnabled,
+      customContent,
+    },
+  };
+}
+
+function changedFields(
+  before: PlatformWatermarkPolicy,
+  after: PlatformWatermarkPolicy,
+): string[] {
+  return ["enabled", "businessPagesEnabled", "customContent"].filter(
+    (field) =>
+      before[field as keyof PlatformWatermarkPolicy] !==
+      after[field as keyof PlatformWatermarkPolicy],
+  );
+}