create-windy 0.2.19 → 0.2.21

package/template/apps/server/src/work-order/routes.ts

@@ -1,141 +1,123 @@
 import {
   createWorkOrderSchema,
   updateWorkOrderSchema,
-  workOrderModule,
 } from "@southwind-ai/example-work-order";
-import type { ApiPermissionBinding } from "@southwind-ai/shared";
-import { recordMutationAudit } from "../audit/policy.js";
-import { accessCall } from "../system/resource-access-response.js";
-import { evaluateRouteGuards } from "../route-guards.js";
-import type { createServerRuntime } from "../runtime.js";
-import {
-  forbidden,
-  notFound,
-  resourceEvent,
-  routeContext,
-} from "../system/route-helpers.js";
-import type { RouteApp } from "../system/route-types.js";
+import type { ModuleRouteDefinition } from "@southwind-ai/server-sdk";
+import { searchAuditMetadata } from "../audit/search-summary.js";
+import { requestActorFromModule } from "../module-host/request-context.js";
 import { parsePagination } from "../pagination.js";
+import { accessCall } from "../system/resource-access-response.js";
+import { notFound } from "../system/route-helpers.js";
 import type { WorkOrderService } from "./service.js";
-import { searchAuditEvent } from "../audit/search-summary.js";
 
-type ServerRuntime = ReturnType<typeof createServerRuntime>;
-const manifest = workOrderModule();
-const feature = manifest.features[0];
-
-export function registerWorkOrderRoutes(
-  app: RouteApp,
-  service: WorkOrderService,
-  runtime: ServerRuntime,
-) {
-  app.get("/work-orders", (raw) =>
-    guarded(raw, binding("GET", "/api/work-orders"), runtime, async () => {
-      const context = routeContext(raw);
-      const pagination = parsePagination(context.query);
-      if (pagination instanceof Response) return pagination;
-      const result = await accessCall(() =>
-        service.list(
-          { ...pagination, q: context.query.q },
-          context.guardContext.actor,
-        ),
-      );
-      if (!(result instanceof Response) && context.query.q?.trim()) {
-        runtime.auditSink.recordEvent(
-          searchAuditEvent(
-            context.guardContext,
-            "work-order",
-            context.query.q,
-            result.total,
+/**
+ * 示例工单的 Guarded Route 定义。
+ *
+ * 只声明 method/path/permissionKey 与 Handler；Guard、审计上下文与受限 Port
+ * 由宿主在 installModuleRoutes 时统一绑定，不再手工查询 Manifest 绑定。
+ * `requireService` 延迟解析宿主装配完成后才存在的模块服务。
+ */
+export function createWorkOrderRouteDefinitions(
+  requireService: () => WorkOrderService,
+): ModuleRouteDefinition[] {
+  return [
+    {
+      method: "GET",
+      path: "/api/work-orders",
+      permissionKey: "work-order.ticket.read",
+      handler: async (context) => {
+        const pagination = parsePagination(context.query);
+        if (pagination instanceof Response) return pagination;
+        const result = await accessCall(() =>
+          requireService().list(
+            { ...pagination, q: context.query.q },
+            requestActorFromModule(context.actor),
           ),
         );
-      }
-      return result;
-    }),
-  );
-
-  app.get("/work-orders/:id", (raw) =>
-    guarded(raw, binding("GET", "/api/work-orders/:id"), runtime, async () => {
-      const context = routeContext(raw);
-      const id = context.params.id || "";
-      const item = await accessCall(() =>
-        service.get(id, context.guardContext.actor),
-      );
-      return item instanceof Response
-        ? item
-        : item || notFound("work-order", id);
-    }),
-  );
-
-  app.post("/work-orders", (raw) =>
-    guarded(raw, binding("POST", "/api/work-orders"), runtime, async () => {
-      const context = routeContext(raw);
-      const parsed = createWorkOrderSchema.safeParse(context.body);
-      if (!parsed.success) return invalid(parsed.error.issues[0]?.message);
-      const item = await accessCall(() =>
-        service.create(parsed.data, context.guardContext.actor),
-      );
-      if (item instanceof Response) return item;
-      await audit(runtime, context.guardContext, "crud.create", item.id);
-      return item;
-    }),
-  );
-
-  app.put("/work-orders/:id", (raw) =>
-    guarded(raw, binding("PUT", "/api/work-orders/:id"), runtime, async () => {
-      const context = routeContext(raw);
-      const id = context.params.id || "";
-      const parsed = updateWorkOrderSchema.safeParse(context.body);
-      if (!parsed.success) return invalid(parsed.error.issues[0]?.message);
-      const item = await accessCall(() =>
-        service.update(id, parsed.data, context.guardContext.actor),
-      );
-      if (item instanceof Response) return item;
-      if (!item) return notFound("work-order", id);
-      await audit(runtime, context.guardContext, "crud.update", id);
-      return item;
-    }),
-  );
-
-  app.delete("/work-orders/:id", (raw) =>
-    guarded(
-      raw,
-      binding("DELETE", "/api/work-orders/:id"),
-      runtime,
-      async () => {
-        const context = routeContext(raw);
+        if (!(result instanceof Response) && context.query.q?.trim()) {
+          await context.audit.emit("data.search", {
+            target: { type: "work-order" },
+            metadata: searchAuditMetadata(context.query.q, result.total),
+          });
+        }
+        return result;
+      },
+    },
+    {
+      method: "GET",
+      path: "/api/work-orders/:id",
+      permissionKey: "work-order.ticket.read",
+      handler: async (context) => {
         const id = context.params.id || "";
         const item = await accessCall(() =>
-          service.archive(id, context.guardContext.actor),
+          requireService().get(id, requestActorFromModule(context.actor)),
+        );
+        return item instanceof Response
+          ? item
+          : item || notFound("work-order", id);
+      },
+    },
+    {
+      method: "POST",
+      path: "/api/work-orders",
+      permissionKey: "work-order.ticket.create",
+      handler: async (context) => {
+        const parsed = createWorkOrderSchema.safeParse(context.body);
+        if (!parsed.success) return invalid(parsed.error.issues[0]?.message);
+        const item = await accessCall(() =>
+          requireService().create(
+            parsed.data,
+            requestActorFromModule(context.actor),
+          ),
+        );
+        if (item instanceof Response) return item;
+        await context.audit.emit("crud.create", {
+          target: { type: "work-order", id: item.id },
+        });
+        return item;
+      },
+    },
+    {
+      method: "PUT",
+      path: "/api/work-orders/:id",
+      permissionKey: "work-order.ticket.manage",
+      handler: async (context) => {
+        const id = context.params.id || "";
+        const parsed = updateWorkOrderSchema.safeParse(context.body);
+        if (!parsed.success) return invalid(parsed.error.issues[0]?.message);
+        const item = await accessCall(() =>
+          requireService().update(
+            id,
+            parsed.data,
+            requestActorFromModule(context.actor),
+          ),
         );
         if (item instanceof Response) return item;
         if (!item) return notFound("work-order", id);
-        await audit(runtime, context.guardContext, "crud.delete", id);
+        await context.audit.emit("crud.update", {
+          target: { type: "work-order", id },
+        });
         return item;
       },
-    ),
-  );
-}
-
-async function guarded(
-  raw: unknown,
-  permission: ApiPermissionBinding,
-  runtime: ServerRuntime,
-  handler: () => unknown,
-) {
-  const decision = await evaluateRouteGuards(
-    runtime,
-    routeContext(raw).guardContext,
-    { permission, feature },
-  );
-  return decision.allowed ? handler() : forbidden(decision.reason);
-}
-
-function binding(method: string, path: string): ApiPermissionBinding {
-  const result = manifest.apiPermissions.find(
-    (item) => item.method === method && item.path === path,
-  );
-  if (!result) throw new Error(`示例工单缺少 API 绑定：${method} ${path}`);
-  return result;
+    },
+    {
+      method: "DELETE",
+      path: "/api/work-orders/:id",
+      permissionKey: "work-order.ticket.manage",
+      handler: async (context) => {
+        const id = context.params.id || "";
+        const item = await accessCall(() =>
+          requireService().archive(id, requestActorFromModule(context.actor)),
+        );
+        if (item instanceof Response) return item;
+        if (!item) return notFound("work-order", id);
+        await context.audit.emit("crud.delete", {
+          target: { type: "work-order", id },
+        });
+        return item;
+      },
+    },
+  ];
 }
 
 function invalid(message = "工单内容无效") {
@@ -144,16 +126,3 @@ function invalid(message = "工单内容无效") {
     { status: 400 },
   );
 }
-
-function audit(
-  runtime: ServerRuntime,
-  context: ReturnType<typeof routeContext>["guardContext"],
-  action: "crud.create" | "crud.update" | "crud.delete",
-  id: string,
-) {
-  return recordMutationAudit(
-    runtime,
-    "work-orders",
-    resourceEvent(context, action, "work-order", id),
-  );
-}

package/template/apps/server/src/work-order/search-api.test.ts

@@ -1,6 +1,12 @@
 import { describe, expect, test } from "bun:test";
-import { workOrderModule, type WorkOrder } from "@southwind-ai/example-work-order";
-import { systemFoundationModule, type ModuleManifest } from "@southwind-ai/modules";
+import {
+  workOrderModule,
+  type WorkOrder,
+} from "@southwind-ai/example-work-order";
+import {
+  systemFoundationModule,
+  type ModuleManifest,
+} from "@southwind-ai/modules";
 import { licenseVersionKey } from "@southwind-ai/shared";
 import { buildScopeContext } from "../data-access/context.js";
 import { InMemoryScopedEntityRepository } from "../data-access/scoped-repository.js";
@@ -11,6 +17,7 @@ import { searchTestContext } from "../search/test-support.js";
 import type { ManagedDepartment } from "../system/entities.js";
 import { InMemoryEntityRepository } from "../system/repository.js";
 import type { RouteApp } from "../system/route-types.js";
+import { adaptModuleSearchProvider } from "../module-host.js";
 import { workOrderDataScopeBinding } from "./repository.js";
 import { WorkOrderSearchProvider } from "./search-provider.js";
 import { WorkOrderService } from "./service.js";
@@ -45,7 +52,11 @@ describe("搜索 API 数据范围", () => {
     );
     const service = new SearchService(
       modules,
-      [new WorkOrderSearchProvider(workOrders)],
+      [
+        adaptModuleSearchProvider(
+          new WorkOrderSearchProvider(() => workOrders),
+        ),
+      ],
       runtime,
     );
     const context = searchTestContext([

package/template/apps/server/src/work-order/search-provider.test.ts

@@ -1,5 +1,8 @@
 import { describe, expect, test } from "bun:test";
-import { workOrderModule, type WorkOrder } from "@southwind-ai/example-work-order";
+import {
+  workOrderModule,
+  type WorkOrder,
+} from "@southwind-ai/example-work-order";
 import type { ModuleManifest } from "@southwind-ai/modules";
 import { licenseVersionKey } from "@southwind-ai/shared";
 import { buildScopeContext } from "../data-access/context.js";
@@ -11,6 +14,7 @@ import type { SearchProvider } from "../search/contracts.js";
 import { SearchService } from "../search/service.js";
 import type { ManagedDepartment } from "../system/entities.js";
 import { InMemoryEntityRepository } from "../system/repository.js";
+import { adaptModuleSearchProvider } from "../module-host.js";
 import { workOrderDataScopeBinding } from "./repository.js";
 import {
   WorkOrderSearchProvider,
@@ -40,10 +44,13 @@ describe("示例工单 SearchProvider", () => {
       throw new Error("搜索不得调用裸 Repository.list");
     };
     const service = searchService([
-      new WorkOrderSearchProvider(
-        new WorkOrderService(
-          repository,
-          new InMemoryEntityRepository<ManagedDepartment>(),
+      adaptModuleSearchProvider(
+        new WorkOrderSearchProvider(
+          () =>
+            new WorkOrderService(
+              repository,
+              new InMemoryEntityRepository<ManagedDepartment>(),
+            ),
         ),
       ),
     ]);
@@ -84,17 +91,18 @@ describe("示例工单 SearchProvider", () => {
   });
 
   test("Provider 游标映射到 scoped Repository 分页", async () => {
-    const provider = new WorkOrderSearchProvider(
-      new WorkOrderService(
-        new InMemoryScopedEntityRepository<WorkOrder>(
-          [
-            ticket("ticket_1", "user_self", "故障一"),
-            ticket("ticket_2", "user_self", "故障二"),
-          ],
-          workOrderDataScopeBinding,
-        ),
-        new InMemoryEntityRepository<ManagedDepartment>(),
+    const workOrders = new WorkOrderService(
+      new InMemoryScopedEntityRepository<WorkOrder>(
+        [
+          ticket("ticket_1", "user_self", "故障一"),
+          ticket("ticket_2", "user_self", "故障二"),
+        ],
+        workOrderDataScopeBinding,
       ),
+      new InMemoryEntityRepository<ManagedDepartment>(),
+    );
+    const provider = adaptModuleSearchProvider(
+      new WorkOrderSearchProvider(() => workOrders),
     );
     const service = searchService([provider]);
     const first = await service.search(

package/template/apps/server/src/work-order/search-provider.ts

@@ -1,9 +1,10 @@
 import type {
-  SearchExecutionContext,
-  SearchProvider,
-  SearchProviderPage,
-  SearchProviderQuery,
-} from "../search/contracts.js";
+  ModuleSearchContext,
+  ModuleSearchPage,
+  ModuleSearchProvider,
+  ModuleSearchQuery,
+} from "@southwind-ai/server-sdk";
+import { requestActorFromModule } from "../module-host/request-context.js";
 import { SearchProtocolError } from "../search/errors.js";
 import { maskSearchText } from "../search/masking.js";
 import type { WorkOrderService } from "./service.js";
@@ -11,21 +12,25 @@ import type { WorkOrderService } from "./service.js";
 export const WORK_ORDER_SEARCH_PROVIDER_KEY = "work-order.ticket.search";
 export const WORK_ORDER_SEARCH_PROVIDER_VERSION = "0.1.0";
 
-export class WorkOrderSearchProvider implements SearchProvider {
+/**
+ * 示例工单搜索 Provider，实现 server-sdk 的受限 Provider 协议。
+ * `requireService` 延迟解析宿主装配完成后才存在的模块服务。
+ */
+export class WorkOrderSearchProvider implements ModuleSearchProvider {
   readonly key = WORK_ORDER_SEARCH_PROVIDER_KEY;
   readonly providerVersion = WORK_ORDER_SEARCH_PROVIDER_VERSION;
 
-  constructor(private readonly service: WorkOrderService) {}
+  constructor(private readonly requireService: () => WorkOrderService) {}
 
   async search(
-    request: SearchProviderQuery,
-    context: SearchExecutionContext,
-  ): Promise<SearchProviderPage> {
+    request: ModuleSearchQuery,
+    context: ModuleSearchContext,
+  ): Promise<ModuleSearchPage> {
     if (request.signal.aborted) throw new Error("search aborted");
     const page = parseProviderCursor(request.cursor);
-    const result = await this.service.list(
+    const result = await this.requireService().list(
       { q: request.text, page, pageSize: request.limit },
-      context.actor,
+      requestActorFromModule(context.actor),
     );
     if (request.signal.aborted) throw new Error("search aborted");
     return {

package/template/apps/server/src/work-order/task.test.ts

@@ -1,21 +1,30 @@
 import { describe, expect, test } from "bun:test";
-import type { WorkOrder } from "@southwind-ai/example-work-order";
+import { type WorkOrder } from "@southwind-ai/example-work-order";
+import { createWorkOrderModule } from "../example-modules.js";
 import { createFoundationSnapshot } from "../foundation.js";
+import {
+  createModuleTaskDefinitions,
+  initializeModuleHosts,
+} from "../module-host.js";
 import { createServerRuntime } from "../runtime.js";
 import { InMemorySchedulerRepository } from "../scheduler/repository.js";
 import { SchedulerService } from "../scheduler/service.js";
 import type { ManagedDepartment } from "../system/entities.js";
 import { InMemoryEntityRepository } from "../system/repository.js";
 import { InMemoryScopedEntityRepository } from "../data-access/scoped-repository.js";
-import { WorkOrderService } from "./service.js";
 import { workOrderDataScopeBinding } from "./repository.js";
-import { createWorkOrderTaskDefinitions } from "./task.js";
 
 describe("示例工单后台任务", () => {
   test("通过统一调度 Guard 执行并把业务快照写入历史", async () => {
     const runtime = createServerRuntime({ WINDY_DEV_ADMIN_TOKEN: "token" });
-    const service = new WorkOrderService(
-      new InMemoryScopedEntityRepository<WorkOrder>(
+    const module = createWorkOrderModule();
+    const hosts = await initializeModuleHosts({
+      modules: [module.manifest],
+      installations: [module],
+    });
+    module.attach({
+      departments: new InMemoryEntityRepository<ManagedDepartment>(),
+      repository: new InMemoryScopedEntityRepository<WorkOrder>(
         [
           item("ticket_high", "high", "open"),
           item("ticket_progress", "medium", "in-progress"),
@@ -23,14 +32,10 @@ describe("示例工单后台任务", () => {
         ],
         workOrderDataScopeBinding,
       ),
-      new InMemoryEntityRepository<ManagedDepartment>(),
-    );
+    });
     const scheduler = new SchedulerService(
       new InMemorySchedulerRepository(),
-      createWorkOrderTaskDefinitions(
-        createFoundationSnapshot().features,
-        service,
-      ),
+      createModuleTaskDefinitions(hosts, createFoundationSnapshot().features),
       runtime,
     );
     await scheduler.initialize();

package/template/apps/web/Dockerfile

@@ -4,6 +4,7 @@ FROM oven/bun:1.3.14-alpine AS deps
 WORKDIR /app
 
 COPY package.json bun.lock ./
+# windy-copy:deps begin
 COPY apps/license/package.json apps/license/package.json
 COPY apps/server/package.json apps/server/package.json
 COPY apps/signing-service/package.json apps/signing-service/package.json
@@ -20,14 +21,16 @@ COPY packages/modules/package.json packages/modules/package.json
 COPY packages/server-sdk/package.json packages/server-sdk/package.json
 COPY packages/shared/package.json packages/shared/package.json
 COPY packages/storage/package.json packages/storage/package.json
+# windy-copy:deps end
 RUN bun install --frozen-lockfile
 
 FROM deps AS build
+# windy-copy:build begin
 COPY apps/web apps/web
-COPY packages/example-work-order packages/example-work-order
 COPY packages/license-sdk packages/license-sdk
 COPY packages/modules packages/modules
 COPY packages/shared packages/shared
+# windy-copy:build end
 RUN bun run --cwd apps/web build
 
 FROM deps AS runner

package/template/apps/web/src/layout/GlobalWatermark.layering.webtest.ts

@@ -42,7 +42,10 @@ const state = vi.hoisted(() => {
 });
 
 vi.mock("@/composables/useAccessSnapshot", () => ({
-  useAccessSnapshot: () => ({ snapshot: state.access }),
+  useAccessSnapshot: () => ({
+    snapshot: state.access,
+    ensureLoaded: vi.fn(async () => state.access.value),
+  }),
 }));
 
 vi.mock("@/composables/useAuthSession", () => ({

package/template/apps/web/src/layout/GlobalWatermark.vue

@@ -18,6 +18,8 @@ const access = useAccessSnapshot();
 const watermark = useWatermarkSettings(auth.actor);
 onMounted(() => {
   void watermark.ensureLoaded();
+  // 业务页路由守卫不会预取访问快照，这里兜底加载，失败时保持水印隐藏。
+  void access.ensureLoaded().catch(() => undefined);
 });
 const allowed = computed(() => {
   const snapshot = access.snapshot.value;

package/template/apps/web/src/layout/GlobalWatermark.webtest.ts

@@ -45,7 +45,10 @@ const state = vi.hoisted(() => ({
 }));
 
 vi.mock("@/composables/useAccessSnapshot", () => ({
-  useAccessSnapshot: () => ({ snapshot: state.access }),
+  useAccessSnapshot: () => ({
+    snapshot: state.access,
+    ensureLoaded: vi.fn(async () => state.access.value),
+  }),
 }));
 
 vi.mock("@/composables/useAuthSession", () => ({

package/template/docker-compose.yml

@@ -42,6 +42,10 @@ services:
       WINDY_CONTAINERIZED: "1"
       BUN_CONFIG_NO_CLEAR_TERMINAL_ON_RELOAD: "true"
       WINDY_SYSTEM_USAGE_PATHS: /app/data/audit
+      PLATFORM_ENABLE_AI: ${PLATFORM_ENABLE_AI:-false}
+      AGENT_SERVER_URL: http://agent-server:8080
+      AGENT_TOOL_HOST_URL: http://server:9747
+      AGENT_SERVER_INTERNAL_TOKEN: ${AGENT_SERVER_INTERNAL_TOKEN:-}
     ports:
       - "9747:9747"
     volumes:
@@ -52,6 +56,26 @@ services:
       migrate:
         condition: service_completed_successfully
 
+  agent-server:
+    profiles: ["agent"]
+    build:
+      context: .
+      dockerfile: apps/agent-server/Dockerfile
+    environment:
+      AGENT_SERVER_INTERNAL_TOKEN: ${AGENT_SERVER_INTERNAL_TOKEN:-}
+      AGENT_RUN_STORE_PATH: /app/data/agent/runs.sqlite3
+      QWEN_API_URL: ${QWEN_API_URL:-}
+      QWEN_API_KEY: ${QWEN_API_KEY:-}
+      QWEN_MODEL: ${QWEN_MODEL:-}
+      AI_PROVIDER_CONNECT_TIMEOUT_MS: ${AI_PROVIDER_CONNECT_TIMEOUT_MS:-5000}
+      AI_PROVIDER_REQUEST_TIMEOUT_MS: ${AI_PROVIDER_REQUEST_TIMEOUT_MS:-60000}
+      AI_PROVIDER_MAX_RESPONSE_BYTES: ${AI_PROVIDER_MAX_RESPONSE_BYTES:-2097152}
+    volumes:
+      - agent-run-data:/app/data/agent
+    depends_on:
+      server:
+        condition: service_started
+
   web:
     build:
       context: .
@@ -85,3 +109,4 @@ services:
 volumes:
   postgres-data:
   server-audit-data:
+  agent-run-data: