create-windy 0.2.31 → 0.2.33

package/template/apps/web/src/composables/watermark-settings.webtest.ts

@@ -1,7 +1,8 @@
 import { describe, expect, test } from "vitest";
 import {
-  defaultWatermarkContent,
+  createWatermarkPattern,
   normalizeWatermarkPolicy,
+  watermarkContent,
 } from "./watermark-settings";
 
 describe("水印设置", () => {
@@ -15,13 +16,74 @@ describe("水印设置", () => {
       roleCodes: [],
       permissionKeys: [],
     };
-    expect(defaultWatermarkContent({ ...base, phone: "13800138000" })).toBe(
-      "zhangsan · 13800138000",
-    );
-    expect(defaultWatermarkContent({ ...base, email: "zs@example.com" })).toBe(
-      "zhangsan · zs@example.com",
+    expect(
+      watermarkContent(
+        { ...base, phone: "13800138000" },
+        ["username", "phone"],
+        "",
+      ),
+    ).toBe("zhangsan · 13800138000");
+    expect(
+      watermarkContent(
+        { ...base, email: "zs@example.com" },
+        ["username", "email"],
+        "",
+      ),
+    ).toBe("zhangsan · zs@example.com");
+    expect(watermarkContent(base, ["username", "displayName"], "")).toBe(
+      "zhangsan · 张三",
     );
-    expect(defaultWatermarkContent(base)).toBe("zhangsan · 张三");
+  });
+
+  test("按勾选顺序组合身份和自定义内容并去重", () => {
+    expect(
+      watermarkContent(
+        {
+          id: "user_1",
+          type: "user",
+          name: "张三",
+          username: "zhangsan",
+          displayName: "张三",
+          roleCodes: [],
+          permissionKeys: [],
+        },
+        ["displayName", "username", "custom"],
+        "内部资料",
+      ),
+    ).toBe("张三 · zhangsan · 内部资料");
+  });
+
+  test("勾选字段在当前账号均为空时仍兜底显示用户名", () => {
+    expect(
+      watermarkContent(
+        {
+          id: "user_1",
+          type: "user",
+          name: "张三",
+          username: "zhangsan",
+          roleCodes: [],
+          permissionKeys: [],
+        },
+        ["phone", "email", "custom"],
+        "",
+      ),
+    ).toBe("zhangsan");
+  });
+
+  test("高密度缩小平铺单元且长内容自动换行以避免相邻水印重叠", () => {
+    const content =
+      "zhangsan · 张三 · 13800138000 · zs@example.com · 内部资料请勿外传";
+    const low = createWatermarkPattern(content, "low");
+    const high = createWatermarkPattern(content, "high");
+    const dimensions = (value: typeof low) =>
+      value.size.match(/\d+/g)!.map(Number);
+
+    expect(dimensions(high)[0]).toBeLessThan(dimensions(low)[0]!);
+    expect(dimensions(high)[1]).toBeLessThan(dimensions(low)[1]!);
+    expect(decodeURIComponent(high.image)).toContain("<tspan");
+    expect(
+      decodeURIComponent(high.image).match(/<tspan/g)?.length,
+    ).toBeGreaterThan(1);
   });
 
   test("服务端策略内容会被规范化后渲染", () => {
@@ -29,11 +91,15 @@ describe("水印设置", () => {
       normalizeWatermarkPolicy({
         enabled: false,
         businessPagesEnabled: true,
+        density: "high",
+        contentFields: ["phone", "phone"],
         customContent: `  ${"x".repeat(100)}  `,
       }),
     ).toEqual({
       enabled: false,
       businessPagesEnabled: true,
+      density: "high",
+      contentFields: ["phone"],
       customContent: "x".repeat(80),
     });
   });

package/template/apps/web/src/layout/GlobalWatermark.layering.webtest.ts

@@ -13,7 +13,9 @@ const state = vi.hoisted(() => {
   const policy = {
     value: {
       enabled: true,
-      businessPagesEnabled: false,
+      businessPagesEnabled: true,
+      density: "medium",
+      contentFields: ["username", "displayName"],
       customContent: "",
     },
   };

package/template/apps/web/src/layout/GlobalWatermark.vue

@@ -1,8 +1,9 @@
 <script setup lang="ts">
-import { computed, onMounted } from "vue";
+import { computed, onMounted, type StyleValue } from "vue";
 import { useAuthSession } from "@/composables/useAuthSession";
 import { useAccessSnapshot } from "@/composables/useAccessSnapshot";
 import { useWatermarkSettings } from "@/composables/useWatermarkSettings";
+import { createWatermarkPattern } from "@/composables/watermark-settings";
 import { evaluateWebAccess } from "./navigation";
 
 const props = withDefaults(
@@ -33,6 +34,16 @@ const allowed = computed(() => {
 const scopeEnabled = computed(
   () => props.scope === "admin" || watermark.policy.value.businessPagesEnabled,
 );
+const patternStyle = computed<StyleValue>(() => {
+  const pattern = createWatermarkPattern(
+    watermark.content.value,
+    watermark.policy.value.density,
+  );
+  return {
+    "--watermark-image": pattern.image,
+    "--watermark-size": pattern.size,
+  };
+});
 </script>
 
 <template>
@@ -44,17 +55,19 @@ const scopeEnabled = computed(
         watermark.policy.value.enabled &&
         watermark.content.value
       "
-      class="pointer-events-none fixed inset-0 isolate z-[60] grid transform-gpu grid-cols-3 grid-rows-6 overflow-hidden opacity-[0.075] dark:opacity-[0.11]"
+      class="global-watermark pointer-events-none fixed inset-0 isolate z-[60] transform-gpu bg-foreground opacity-[0.075] dark:opacity-[0.11]"
+      :style="patternStyle"
       aria-hidden="true"
       data-testid="global-watermark"
-    >
-      <span
-        v-for="index in 18"
-        :key="index"
-        class="flex -rotate-[22deg] items-center justify-center whitespace-nowrap px-8 text-sm font-medium text-foreground"
-      >
-        {{ watermark.content.value }}
-      </span>
-    </div>
+    />
   </Teleport>
 </template>
+
+<style scoped>
+.global-watermark {
+  mask-image: var(--watermark-image);
+  mask-size: var(--watermark-size);
+  -webkit-mask-image: var(--watermark-image);
+  -webkit-mask-size: var(--watermark-size);
+}
+</style>

package/template/apps/web/src/layout/GlobalWatermark.webtest.ts

@@ -37,7 +37,9 @@ const state = vi.hoisted(() => ({
   policy: {
     value: {
       enabled: true,
-      businessPagesEnabled: false,
+      businessPagesEnabled: true,
+      density: "medium" as const,
+      contentFields: ["username", "displayName"] as const,
       customContent: "",
     },
   },
@@ -71,7 +73,9 @@ config.global.stubs = {
 beforeEach(() => {
   state.policy.value = {
     enabled: true,
-    businessPagesEnabled: false,
+    businessPagesEnabled: true,
+    density: "medium" as const,
+    contentFields: ["username", "displayName"] as const,
     customContent: "",
   };
 });
@@ -93,30 +97,38 @@ describe("GlobalWatermark", () => {
     ).toBe(false);
   });
 
-  test("业务页面水印默认关闭并由持久化范围开关启用", () => {
+  test("业务页面水印默认开启并可由持久化范围开关关闭", () => {
     const wrapper = mount(GlobalWatermark, {
       props: { scope: "business" },
     });
 
     expect(wrapper.find('[data-testid="global-watermark"]').exists()).toBe(
-      false,
+      true,
     );
     wrapper.unmount();
 
     state.policy.value = {
       ...state.policy.value,
-      businessPagesEnabled: true,
+      businessPagesEnabled: false,
     };
-    const enabledWrapper = mount(GlobalWatermark, {
+    const disabledWrapper = mount(GlobalWatermark, {
       props: { scope: "business" },
     });
 
     expect(
-      enabledWrapper.get('[data-testid="global-watermark"]').text(),
-    ).toContain("zhangsan · 张三");
-    expect(
-      enabledWrapper.get('[data-testid="global-watermark"]').classes(),
-    ).toEqual(
+      disabledWrapper.find('[data-testid="global-watermark"]').exists(),
+    ).toBe(false);
+  });
+
+  test("使用按内容和密度计算的平铺蒙版并保持审计层级", () => {
+    const wrapper = mount(GlobalWatermark, {
+      props: { scope: "business" },
+    });
+    const element = wrapper.get('[data-testid="global-watermark"]');
+
+    expect(element.attributes("style")).toContain("--watermark-image:");
+    expect(element.attributes("style")).toContain("--watermark-size:");
+    expect(element.classes()).toEqual(
       expect.arrayContaining([
         "isolate",
         "z-[60]",
@@ -130,6 +142,8 @@ describe("GlobalWatermark", () => {
     state.policy.value = {
       enabled: true,
       businessPagesEnabled: true,
+      density: "medium",
+      contentFields: ["username", "displayName"],
       customContent: "",
     };
     state.access.value.features[0]!.allowed = false;

package/template/apps/web/src/pages/auth/login-page-extension.ts

@@ -0,0 +1,9 @@
+import type { Component } from "vue";
+
+export type LoginPageComponent = Component;
+
+export function defineLoginPageComponent(
+  component: LoginPageComponent,
+): LoginPageComponent {
+  return component;
+}

package/template/apps/web/src/pages/auth/login-page-extension.webtest.ts

@@ -0,0 +1,10 @@
+import { describe, expect, test } from "vitest";
+import { defineLoginPageComponent } from "./login-page-extension";
+
+describe("登录页组件注册 helper", () => {
+  test("业务组件保持自身 Vue Component 类型与引用", () => {
+    const BusinessLoginPage = { name: "BusinessLoginPage" };
+
+    expect(defineLoginPageComponent(BusinessLoginPage)).toBe(BusinessLoginPage);
+  });
+});

package/template/apps/web/src/pages/settings/WatermarkSettingsSection.vue

@@ -1,14 +1,43 @@
 <script setup lang="ts">
 import { computed, onMounted, shallowRef } from "vue";
 import { Button } from "@/components/ui/button";
+import { Checkbox } from "@/components/ui/checkbox";
 import { Input } from "@/components/ui/input";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
 import { Switch } from "@/components/ui/switch";
 import { useAccessSnapshot } from "@/composables/useAccessSnapshot";
 import { useAppToast } from "@/composables/useAppToast";
 import { useAuthSession } from "@/composables/useAuthSession";
 import { useWatermarkSettings } from "@/composables/useWatermarkSettings";
 import { evaluateWebAccess } from "@/layout/navigation";
-import { DEFAULT_PLATFORM_WATERMARK_POLICY } from "@southwind-ai/shared";
+import {
+  DEFAULT_PLATFORM_WATERMARK_POLICY,
+  type WatermarkContentField,
+  type WatermarkDensity,
+} from "@southwind-ai/shared";
+
+const densityOptions: { value: WatermarkDensity; label: string }[] = [
+  { value: "low", label: "低" },
+  { value: "medium", label: "中" },
+  { value: "high", label: "高" },
+];
+const contentOptions: {
+  value: WatermarkContentField;
+  label: string;
+  description: string;
+}[] = [
+  { value: "username", label: "用户名", description: "账号登录名" },
+  { value: "displayName", label: "姓名", description: "用户显示姓名" },
+  { value: "phone", label: "手机号", description: "已登记的手机号码" },
+  { value: "email", label: "邮箱", description: "已登记的邮箱地址" },
+  { value: "custom", label: "自定义内容", description: "平台统一文字" },
+];
 
 const auth = useAuthSession();
 const access = useAccessSnapshot();
@@ -18,6 +47,10 @@ const enabled = shallowRef(watermark.policy.value.enabled);
 const businessPagesEnabled = shallowRef(
   watermark.policy.value.businessPagesEnabled,
 );
+const density = shallowRef<WatermarkDensity>(watermark.policy.value.density);
+const contentFields = shallowRef<WatermarkContentField[]>([
+  ...watermark.policy.value.contentFields,
+]);
 const customContent = shallowRef(watermark.policy.value.customContent);
 const saving = shallowRef(false);
 const baseline = shallowRef(serializeForm());
@@ -55,6 +88,8 @@ async function save(): Promise<boolean> {
     await watermark.save({
       enabled: enabled.value,
       businessPagesEnabled: businessPagesEnabled.value,
+      density: density.value,
+      contentFields: contentFields.value,
       customContent: customContent.value,
     });
     applyPolicyToForm();
@@ -74,6 +109,8 @@ function reset() {
   enabled.value = DEFAULT_PLATFORM_WATERMARK_POLICY.enabled;
   businessPagesEnabled.value =
     DEFAULT_PLATFORM_WATERMARK_POLICY.businessPagesEnabled;
+  density.value = DEFAULT_PLATFORM_WATERMARK_POLICY.density;
+  contentFields.value = [...DEFAULT_PLATFORM_WATERMARK_POLICY.contentFields];
   customContent.value = DEFAULT_PLATFORM_WATERMARK_POLICY.customContent;
   toast.success("已恢复为默认值，保存后生效");
 }
@@ -81,6 +118,8 @@ function reset() {
 function applyPolicyToForm() {
   enabled.value = watermark.policy.value.enabled;
   businessPagesEnabled.value = watermark.policy.value.businessPagesEnabled;
+  density.value = watermark.policy.value.density;
+  contentFields.value = [...watermark.policy.value.contentFields];
   customContent.value = watermark.policy.value.customContent;
   baseline.value = serializeForm();
 }
@@ -89,10 +128,24 @@ function serializeForm() {
   return JSON.stringify({
     enabled: enabled.value,
     businessPagesEnabled: businessPagesEnabled.value,
+    density: density.value,
+    contentFields: [...contentFields.value].sort(),
     customContent: customContent.value.trim(),
   });
 }
 
+function toggleContentField(field: WatermarkContentField, checked: boolean) {
+  if (checked) {
+    contentFields.value = [...new Set([...contentFields.value, field])];
+    return;
+  }
+  if (contentFields.value.length === 1) {
+    toast.error("请至少保留一项水印内容");
+    return;
+  }
+  contentFields.value = contentFields.value.filter((value) => value !== field);
+}
+
 defineExpose({
   isDirty: () => isDirty.value,
   save,
@@ -134,15 +187,60 @@ defineExpose({
         />
       </label>
       <label class="grid gap-2 text-sm font-medium">
+        <span>水印密度</span>
+        <Select v-model="density" :disabled="formDisabled || !enabled">
+          <SelectTrigger aria-label="水印密度">
+            <SelectValue placeholder="选择密度" />
+          </SelectTrigger>
+          <SelectContent>
+            <SelectItem
+              v-for="option in densityOptions"
+              :key="option.value"
+              :value="option.value"
+            >
+              {{ option.label }}
+            </SelectItem>
+          </SelectContent>
+        </Select>
+        <span class="text-xs font-normal text-muted-foreground">
+          系统会根据内容长度和密度自动计算安全间距，避免水印重叠。
+        </span>
+      </label>
+      <fieldset class="grid gap-3" :disabled="formDisabled || !enabled">
+        <legend class="mb-1 text-sm font-medium">水印内容</legend>
+        <label
+          v-for="option in contentOptions"
+          :key="option.value"
+          class="flex items-center gap-3 rounded-lg border p-3"
+        >
+          <Checkbox
+            :model-value="contentFields.includes(option.value)"
+            :aria-label="option.label"
+            @update:model-value="
+              toggleContentField(option.value, Boolean($event))
+            "
+          />
+          <span>
+            <span class="block text-sm font-medium">{{ option.label }}</span>
+            <span class="block text-xs text-muted-foreground">
+              {{ option.description }}
+            </span>
+          </span>
+        </label>
+      </fieldset>
+      <label
+        v-if="contentFields.includes('custom')"
+        class="grid gap-2 text-sm font-medium"
+      >
         <span>自定义内容</span>
         <Input
           v-model="customContent"
-          :disabled="formDisabled"
+          :disabled="formDisabled || !enabled"
           maxlength="80"
-          :placeholder="watermark.content.value || '使用各用户的账号信息'"
+          placeholder="例如：内部资料，请勿外传"
         />
         <span class="text-xs font-normal text-muted-foreground">
-          留空时为每位用户自动使用其账号身份；保存后全局生效。
+          最多 80 个字符，与勾选的用户身份内容一同显示。
         </span>
       </label>
       <div v-if="canManage" class="flex justify-end gap-3 border-t pt-5">

package/template/apps/web/src/router/index.ts

@@ -6,9 +6,9 @@ import {
 } from "vue-router";
 import DashboardPage from "@/pages/dashboard/DashboardPage.vue";
 import HomePage from "@/app/home/HomePage.vue";
+import { loginPageComponent } from "@/app/auth/login-page";
 import AccessDeniedPage from "@/pages/AccessDeniedPage.vue";
 import ServiceUnavailablePage from "@/pages/ServiceUnavailablePage.vue";
-import LoginPage from "@/pages/auth/LoginPage.vue";
 import ChangePasswordPage from "@/pages/auth/ChangePasswordPage.vue";
 // @windy-module system.license begin
 import LicensePage from "@/pages/license/LicensePage.vue";
@@ -72,7 +72,7 @@ export const routes: RouteRecordRaw[] = [
   {
     path: "/login",
     name: "login",
-    component: LoginPage,
+    component: loginPageComponent,
     meta: { title: "登录", layout: "auth", public: true, guestOnly: true },
   },
   {

package/template/apps/web/src/router/shared-scaffold-neutrality.webtest.ts

@@ -5,10 +5,11 @@ import fixtureSource from "./router-test-fixtures.ts?raw";
 import { collectRouteAccess } from "./router-test-fixtures";
 
 describe("Router shared-scaffold 中性契约", () => {
-  test("平台登录页使用中性共享页面", () => {
+  test("平台登录路由使用 project-owned 业务选择 seam", () => {
     expect(routerSource).toContain(
-      'import LoginPage from "@/pages/auth/LoginPage.vue";',
+      'import { loginPageComponent } from "@/app/auth/login-page";',
     );
+    expect(routerSource).toContain("component: loginPageComponent");
     expect(fixtureSource).toContain("collectRouteAccess");
   });
 

package/template/docs/development/custom-login-page.md

@@ -0,0 +1,90 @@
+# 业务项目定制登录页
+
+Windy 允许业务项目替换完整登录页，但认证、会话和跳转安全仍复用平台能力。扩展入口是：
+
+```text
+apps/web/src/app/auth/login-page.ts
+```
+
+该文件在 `.windy/files.json` 中属于 `project-owned`。Windy 升级会为旧项目新增它，
+但一旦文件存在，后续 `windy update` 只会保留，不会覆盖业务选择。平台默认登录页
+`apps/web/src/pages/auth/LoginPage.vue` 仍是 `windy-managed`，Router 仍是
+`shared-scaffold`；业务项目不应直接修改这两处。
+
+## 默认行为
+
+新项目和未定制的升级项目默认把 selector 指向平台登录页，因此视觉、品牌设置、开发
+认证提示和认证流程与原有 Windy 体验一致：
+
+```ts
+import PlatformLoginPage from "@/pages/auth/LoginPage.vue";
+import { defineLoginPageComponent } from "@/pages/auth/login-page-extension";
+
+export const loginPageComponent = defineLoginPageComponent(PlatformLoginPage);
+```
+
+`defineLoginPageComponent` 是类型化 Composition seam。Router 只消费这个稳定导出，
+不感知具体业务页面。
+
+## 完整业务页面
+
+将业务页面放在同一个 project-owned 目录，例如
+`apps/web/src/app/auth/SharpSwordLoginPage.vue`，然后只修改 selector：
+
+```ts
+import SharpSwordLoginPage from "./SharpSwordLoginPage.vue";
+import { defineLoginPageComponent } from "@/pages/auth/login-page-extension";
+
+export const loginPageComponent = defineLoginPageComponent(SharpSwordLoginPage);
+```
+
+业务 SFC 使用 Vue 3 Composition API 和 TypeScript。认证提交必须复用
+`useLoginFlow()`，不要直接复制登录 API 或解析 `returnTo`：
+
+```vue
+<script setup lang="ts">
+import DevelopmentAuthWarning from "@/components/auth/DevelopmentAuthWarning.vue";
+import LoginForm from "@/components/auth/LoginForm.vue";
+import { useLoginFlow } from "@/composables/useLoginFlow";
+import { developmentAuthStatus } from "@/services/http";
+
+const flow = useLoginFlow();
+const developmentAuth = developmentAuthStatus();
+</script>
+
+<template>
+  <main>
+    <DevelopmentAuthWarning v-if="developmentAuth.configured" />
+    <LoginForm
+      :loading="flow.loading.value"
+      :error="flow.submitError.value"
+      @submit="flow.submit"
+    />
+  </main>
+</template>
+```
+
+`useLoginFlow` 负责调用真实账号认证、重置 Access/License/Session 派生状态，并通过
+`safeReturnTo` 只允许站内目标。它会拒绝外部 URL、协议相对 URL、反斜杠、控制字符、
+过长路径和登录页自循环。真实密码登录还会停用开发 Bearer Token；自定义页面应继续
+显示 `DevelopmentAuthWarning`，避免把本地直通误认为生产认证。
+
+品牌名、Logo 和说明可以通过 `usePlatformSettings()` 复用。业务页面可以完全重做
+布局和内容，但不应绕过 Router 的 `guestOnly` Guard、首次改密跳转或平台认证
+composable。
+
+## 从 0.2.32 升级
+
+先提交当前业务改动并保持 Git 工作区干净，然后执行：
+
+```bash
+bunx --bun create-windy@0.2.33 update --check --cwd .
+bunx --bun create-windy@0.2.33 update --dry-run --cwd .
+bunx --bun create-windy@0.2.33 update --cwd .
+bun install
+```
+
+计划中应看到 selector 以 `project-owned` 新增，Router 通过三方合并接入 selector。
+若旧业务登录页曾放在 `apps/web/src/pages/auth/LoginPage.vue` 或直接改 Router，应将
+业务 SFC 移到 `apps/web/src/app/auth/`，改 selector 指向它，再恢复受管文件。后续升级
+会保留 selector 和业务 SFC。

package/template/docs/platform/platform-shell-settings.md

@@ -54,29 +54,34 @@
 - 页面入口：全局设置 / 页面水印，不注册独立 Sidebar 菜单
 
 水印是平台级强制策略，不是用户偏好。`PlatformWatermarkPolicy` 包含总开关
-`enabled`、业务页范围开关 `businessPagesEnabled` 与最长 80 字符的
-`customContent`。策略由 Admin 的全局设置页面维护，写入
+`enabled`、默认开启的业务页范围开关 `businessPagesEnabled`、`low / medium / high`
+密度、内容字段勾选与最长 80 字符的 `customContent`。可选内容为用户名、姓名、手机号、
+邮箱和自定义内容，至少保留一项；缺少已勾选的用户资料时不会渲染空片段，所有选项均无值时
+兜底使用用户名。策略由 Admin 的全局设置页面维护，写入
 `platform_watermark_policies`；每次保存都记录 `config.update` 审计，目标为
 `platform-watermark/platform`。用户应用端没有水印开关，也不使用 localStorage
 保存或覆盖策略。
 
 管理接口 `GET/PUT /api/system/settings/watermark` 分别经过
 `system.watermark.read/manage`、Feature 与 License Guard。业务应用通过公开只读接口
-`GET /api/platform/watermark-policy` 获取相同策略；公开响应只包含三个非敏感策略字段。
+`GET /api/platform/watermark-policy` 获取相同策略；公开响应只包含上述非敏感策略字段。
 Feature 最终有效且 `enabled=true` 时 Admin 页面显示水印；业务页面还要求
 `businessPagesEnabled=true`。Admin 设置区本身仍要求读取权限，但普通业务用户不需要
 水印读取权限，也不能覆盖全局策略。
 
-`customContent` 留空时，客户端从当前 Actor 派生身份水印，顺序为用户名加手机、邮箱或
-姓名；填写后所有用户显示相同的管理员指定内容。水印通过 Vue `Teleport` 直接挂到
-`body`，脱离应用壳的层叠上下文；稳定审计顶层类 `z-[60]` 高于平台统一使用的
+客户端按管理员勾选顺序从当前 Actor 派生身份水印，自定义内容只有被勾选时才加入。
+渲染算法先按字符视觉宽度自动换行，再根据旋转后文本包围盒与密度预设计算 SVG 平铺
+单元尺寸；每个单元都包含额外横纵安全间距，因此长文本和高密度模式不会让相邻水印重叠。
+水印通过 CSS Mask 平铺并由 Vue `Teleport` 直接挂到 `body`，脱离应用壳的层叠上下文；
+稳定审计顶层类 `z-[60]` 高于平台统一使用的
 `z-50` Sidebar、Drawer、Overlay 与 Modal，并配合 `isolate`、`transform-gpu`
 保证截图审计信息不会被浮层遮住。容器必须始终保留 `pointer-events-none` 与
 `aria-hidden=true`，不能阻塞点击或进入辅助技术阅读顺序。
 
-数据库迁移 `0031_panoramic_typhoid_mary.sql` 新增策略表。历史版本只保存过浏览器偏好，
-没有可自动提升为全局策略的服务端真源；升级后采用默认策略（总开关开启、业务页关闭），
-管理员应在全局设置中确认范围并保存一次。
+数据库迁移 `0031_panoramic_typhoid_mary.sql` 新增策略表，
+`0034_funny_mesmero.sql` 新增密度与内容字段。升级时，已有自定义文字的策略自动迁移为
+勾选“自定义内容”，避免改变既有展示；其它已有策略采用中密度与“用户名 + 姓名”。
+未持久化策略采用默认值（总开关开启、业务页开启、中密度、用户名加姓名）。
 
 ## 个人设置
 

package/template/docs/platform/web-system-crud.md

@@ -83,7 +83,7 @@ VITE_DEV_ADMIN_TOKEN=<显式开发 Token>
 - Feature 管理页在列表最右侧操作栏直接显示启停开关，不再打开通用编辑弹窗；修改仍调用受 Guard 和关键审计保护的 Server API。
 - Feature 开关成功修改会写入 `feature.update`，可在审计日志页通过“功能开关变更”直接查看。
 - 系统资源表和字典后台任务表加载时保留表头与列宽，并显示带 `animate-pulse` 的骨架行；加载失败和空数据仍使用各自独立状态。
-- 全局水印默认开启，内容按“用户名 + 手机号 / 邮箱 / 姓名”的顺序从当前会话 Actor 派生。管理员在“全局设置”中维护持久化的总开关、业务页面范围和最多 80 个字符的自定义内容；保存写入审计并立即成为所有用户的只读策略。用户应用端不提供开关，也不使用 localStorage。`system.watermark` Feature 控制最终生效态，管理区另需 `system.watermark.read/manage` 权限。水印使用专用审计顶层覆盖 Sidebar、Drawer、Overlay 和 Modal，同时保持 `pointer-events-none`。服务端只向当前用户自己的会话响应补充这些身份字段。
+- 全局水印与业务页面范围默认开启。管理员在“全局设置”中维护总开关、低/中/高密度，并勾选用户名、姓名、手机号、邮箱或最多 80 个字符的自定义内容；保存写入审计并立即成为所有用户的只读策略。客户端按旋转文本包围盒自动计算平铺尺寸与安全间距，长内容和高密度模式也不会相互重叠。用户应用端不提供开关，也不使用 localStorage。`system.watermark` Feature 控制最终生效态，管理区另需 `system.watermark.read/manage` 权限。水印使用专用审计顶层覆盖 Sidebar、Drawer、Overlay 和 Modal，同时保持 `pointer-events-none`。服务端只向当前用户自己的会话响应补充这些身份字段。
 - 站内通知由 PostgreSQL `platform_notifications` 和 `notification_reads` 持久化；管理人员可在 `/system/notifications` 广播发布和归档，用户从 Header 收件箱阅读正文并幂等写入已读回执。归档是生命周期操作，不物理删除通知或回执。当前发布范围是全体有阅读权限的用户，尚未提供组织、角色、用户定向和外部渠道投递。
 - 字典页已切换为后台 NDJSON 导入导出，展示本人任务状态、进度、重试和终态文件下载；其它系统资源仍保留小数据同步 JSON 入口。详细契约见 [批量导入导出后台任务](./bulk-data-jobs.md)。当前 artifact 存在 10 MiB、50,000 行和 256 KiB 单行上限，扩大容量前需要对象存储 Adapter。
 - 审计日志配置 `DATABASE_URL` 后读取 PostgreSQL `audit_logs`。可靠写入器提供有界重试、降级状态、关键事件本地恢复队列和健康信息；页面仍只读，且不会展示恢复队列中的事件正文。

package/template/packages/database/drizzle/0034_funny_mesmero.sql

@@ -0,0 +1,5 @@
+ALTER TABLE "platform_watermark_policies" ADD COLUMN "density" varchar(16) DEFAULT 'medium' NOT NULL;--> statement-breakpoint
+ALTER TABLE "platform_watermark_policies" ADD COLUMN "content_fields" jsonb DEFAULT '["username","displayName"]'::jsonb NOT NULL;--> statement-breakpoint
+UPDATE "platform_watermark_policies"
+SET "content_fields" = '["custom"]'::jsonb
+WHERE btrim("custom_content") <> '';