create-windy 0.2.29 → 0.2.31

package/template/packages/database/drizzle/meta/_journal.json

@@ -232,6 +232,13 @@
       "when": 1784922914250,
       "tag": "0032_marvelous_pepper_potts",
       "breakpoints": true
+    },
+    {
+      "idx": 33,
+      "version": "7",
+      "when": 1784925586891,
+      "tag": "0033_rich_george_stacy",
+      "breakpoints": true
     }
   ]
 }

package/template/packages/database/src/schema/index.ts

@@ -25,9 +25,6 @@ export * from "./platform-settings.js";
 // @windy-module system.scheduler begin
 export * from "./scheduler.js";
 // @windy-module system.scheduler end
-// @windy-module work-order begin
-export * from "./work-orders.js";
-// @windy-module work-order end
 // @windy-module system.workflow begin
 export * from "./workflow.js";
 // @windy-module system.workflow end

package/template/packages/example-work-order/drizzle/0000_bitter_the_santerians.sql

@@ -0,0 +1,2 @@
+-- Windy module lineage baseline.
+-- Metadata-only migration: intentionally no executable DDL.

package/template/packages/example-work-order/drizzle/meta/0000_snapshot.json

@@ -0,0 +1,179 @@
+{
+  "id": "6dc0667a-7382-40b9-8036-681641b826df",
+  "prevId": "00000000-0000-0000-0000-000000000000",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.work_orders": {
+      "name": "work_orders",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar(64)",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "varchar(120)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "priority": {
+          "name": "priority",
+          "type": "varchar(24)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_status": {
+          "name": "workflow_status",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner_id": {
+          "name": "owner_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "department_id": {
+          "name": "department_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_by": {
+          "name": "updated_by",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by": {
+          "name": "deleted_by",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "idx_work_orders_owner": {
+          "name": "idx_work_orders_owner",
+          "columns": [
+            {
+              "expression": "owner_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_work_orders_department": {
+          "name": "idx_work_orders_department",
+          "columns": [
+            {
+              "expression": "department_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_work_orders_status": {
+          "name": "idx_work_orders_status",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_work_orders_workflow": {
+          "name": "idx_work_orders_workflow",
+          "columns": [
+            {
+              "expression": "workflow_status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}

package/template/packages/example-work-order/drizzle/meta/_journal.json

@@ -0,0 +1,13 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "7",
+      "when": 1784925622159,
+      "tag": "0000_bitter_the_santerians",
+      "breakpoints": true
+    }
+  ]
+}

package/template/packages/example-work-order/drizzle.config.ts

@@ -0,0 +1,8 @@
+import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  dialect: "postgresql",
+  schema: "./src/drizzle-schema.ts",
+  out: "./drizzle",
+  casing: "snake_case",
+});

package/template/packages/example-work-order/index.ts

@@ -1,4 +1,5 @@
 export * from "./src/contract.js";
+export * from "./src/drizzle-schema.js";
 export * from "./src/manifest.js";
 export * from "./src/migration-bundle.js";
 export * from "./src/schema.js";

package/template/packages/example-work-order/package.json

@@ -3,10 +3,14 @@
   "version": "0.1.0",
   "private": true,
   "type": "module",
+  "scripts": {
+    "db:generate": "drizzle-kit generate --config drizzle.config.ts"
+  },
   "dependencies": {
     "@southwind-ai/modules": "workspace:*",
     "@southwind-ai/server-sdk": "workspace:*",
     "@southwind-ai/shared": "workspace:*",
+    "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3"
   },
   "exports": {

package/template/packages/{database/src/schema/work-orders.ts → example-work-order/src/drizzle-schema.ts}

@@ -1,5 +1,19 @@
-import { index, pgTable, text, varchar } from "drizzle-orm/pg-core";
-import { auditColumns, idColumn, statusColumn } from "./common.js";
+import { index, pgTable, text, timestamp, varchar } from "drizzle-orm/pg-core";
+
+const idColumn = () => varchar("id", { length: 64 });
+const statusColumn = () => varchar("status", { length: 32 });
+const auditColumns = {
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+  createdBy: varchar("created_by", { length: 64 }).notNull(),
+  updatedAt: timestamp("updated_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+  updatedBy: varchar("updated_by", { length: 64 }).notNull(),
+  deletedAt: timestamp("deleted_at", { withTimezone: true }),
+  deletedBy: varchar("deleted_by", { length: 64 }),
+};
 
 export const workOrders = pgTable(
   "work_orders",

package/template/packages/modules/index.ts

@@ -7,3 +7,4 @@ export * from "./src/system-modules.js";
 export * from "./src/system-module-catalog.js";
 export * from "./src/system-api-permissions.js";
 export * from "./src/tool-composition.js";
+export * from "./src/ai-network-policy.js";

package/template/packages/modules/src/ai-network-policy.ts

@@ -0,0 +1,50 @@
+import type {
+  AiProviderEgressPolicy,
+  AiToolNetworkPolicy,
+  ModuleAiOperationDefinition,
+} from "./manifest.js";
+
+const providerForbidden: AiProviderEgressPolicy = Object.freeze({
+  mode: "forbidden",
+});
+const toolNetworkForbidden: AiToolNetworkPolicy = Object.freeze({
+  mode: "forbidden",
+});
+
+export function resolveProviderEgress(
+  operation: ModuleAiOperationDefinition,
+): AiProviderEgressPolicy {
+  return operation.providerEgress ?? providerForbidden;
+}
+
+export function resolveToolNetworkPolicy(
+  operation: ModuleAiOperationDefinition,
+): AiToolNetworkPolicy {
+  return operation.toolNetworkPolicy ?? toolNetworkForbidden;
+}
+
+export function validateAiNetworkPolicy(
+  operation: ModuleAiOperationDefinition,
+): void {
+  const provider = resolveProviderEgress(operation);
+  if (provider.mode === "configured-endpoint") {
+    if (!provider.deploymentKey.trim()) {
+      throw new Error(`${operation.key} Provider Deployment Key 不能为空`);
+    }
+  } else if (provider.mode !== "forbidden") {
+    throw new Error(`${operation.key} Provider 出网策略无效`);
+  }
+
+  const tool = resolveToolNetworkPolicy(operation);
+  if (tool.mode !== "forbidden") {
+    throw new Error(`${operation.key} Tool 网络策略无效`);
+  }
+  if (
+    operation.publicNetworkAccess === "allowed" &&
+    operation.providerEgress === undefined
+  ) {
+    throw new Error(
+      `${operation.key} 旧 publicNetworkAccess=allowed 不能安全映射，请声明 providerEgress`,
+    );
+  }
+}

package/template/packages/modules/src/ai-operation-composition.test.ts

@@ -98,6 +98,56 @@ describe("AI Operation Composition", () => {
     expect(() => validateModuleComposition([module])).toThrow("Tool 不能为空");
   });
 
+  test("Provider 与 Tool 网络边界独立且旧声明默认 fail closed", () => {
+    const module = fixture("business");
+    const legacy = operation("business.legacy");
+    module.aiOperations = [legacy];
+    expect(() => validateModuleComposition([module])).not.toThrow();
+
+    module.aiOperations = [
+      {
+        ...operation("business.generate"),
+        publicNetworkAccess: undefined,
+        providerEgress: {
+          mode: "configured-endpoint",
+          deploymentKey: "ai.openai-compatible",
+        },
+        toolNetworkPolicy: { mode: "forbidden" },
+      },
+    ];
+    expect(() => validateModuleComposition([module])).not.toThrow();
+
+    module.aiOperations[0] = {
+      ...operation("business.generate"),
+      publicNetworkAccess: "allowed",
+    };
+    expect(() => validateModuleComposition([module])).toThrow("不能安全映射");
+  });
+
+  test("拒绝空 Provider Deployment 与未知 Tool 网络模式", () => {
+    const module = fixture("business");
+    module.aiOperations = [
+      {
+        ...operation("business.generate"),
+        providerEgress: {
+          mode: "configured-endpoint",
+          deploymentKey: " ",
+        },
+      },
+    ];
+    expect(() => validateModuleComposition([module])).toThrow(
+      "Deployment Key 不能为空",
+    );
+
+    module.aiOperations[0] = {
+      ...operation("business.generate"),
+      toolNetworkPolicy: { mode: "allow" },
+    } as unknown as ModuleAiOperationDefinition;
+    expect(() => validateModuleComposition([module])).toThrow(
+      "Tool 网络策略无效",
+    );
+  });
+
   test("Operation Handler 必须与 Manifest 声明一一对应", () => {
     const module = fixture("business");
     module.aiOperations = [operation("business.generate")];

package/template/packages/modules/src/ai-operation-composition.ts

@@ -2,6 +2,7 @@ import type {
   ModuleAiOperationDefinition,
   ModuleManifest,
 } from "./manifest.js";
+import { validateAiNetworkPolicy } from "./ai-network-policy.js";
 
 interface AiOperationCatalogs {
   permissions: ReadonlySet<string>;
@@ -100,6 +101,7 @@ function validateOperation(
   );
   validateCapabilities(operation);
   validateTools(operation, catalogs.tools);
+  validateAiNetworkPolicy(operation);
   validateLimits(operation);
 }
 

package/template/packages/modules/src/manifest.ts

@@ -88,6 +88,15 @@ export type AiOperationExecution =
   | "background"
   | "live";
 export type AiOperationPublicNetworkAccess = "forbidden" | "allowed";
+export type AiProviderEgressPolicy =
+  | { mode: "forbidden" }
+  | {
+      mode: "configured-endpoint";
+      deploymentKey: string;
+    };
+export interface AiToolNetworkPolicy {
+  mode: "forbidden";
+}
 
 export interface AiOperationLimits {
   maxDurationSeconds: number;
@@ -107,7 +116,10 @@ export interface ModuleAiOperationDefinition {
   allowedToolKeys: readonly string[];
   dataClassification: AiOperationDataClassification;
   execution: AiOperationExecution;
-  publicNetworkAccess: AiOperationPublicNetworkAccess;
+  /** @deprecated 使用 providerEgress 与 toolNetworkPolicy 拆分两类网络边界。 */
+  publicNetworkAccess?: AiOperationPublicNetworkAccess;
+  providerEgress?: AiProviderEgressPolicy;
+  toolNetworkPolicy?: AiToolNetworkPolicy;
   limits: AiOperationLimits;
 }