create-windy 0.2.33 → 0.2.34

package/template/apps/server/src/module-host/user-directory-port.test.ts

@@ -0,0 +1,238 @@
+import { describe, expect, test } from "bun:test";
+import { ModuleUserDirectoryError } from "@southwind-ai/server-sdk";
+import { buildScopeContext } from "../data-access/context.js";
+import { createFoundationSnapshot } from "../foundation.js";
+import type { RequestActor, RequestGuardContext } from "../guards.js";
+import { createServerRuntime } from "../runtime.js";
+import type { ManagedDepartment, ManagedUser } from "../system/entities.js";
+import { createSystemRepositories } from "../system/seed.js";
+import { createModuleUserDirectoryPort } from "./user-directory-port.js";
+
+describe("模块用户目录 Port", () => {
+  test("只返回启用用户最小投影，并在 Repository 查询中执行部门范围", async () => {
+    const fixture = await createFixture();
+    const page = await fixture.port.list({
+      page: 1,
+      pageSize: 10,
+      q: "案",
+      ...({ actorId: "forged", departmentId: "dept_other" } as object),
+    });
+
+    expect(page).toEqual({
+      items: [
+        {
+          id: "user_child",
+          displayName: "子部门办案员",
+        },
+      ],
+      total: 1,
+      page: 1,
+      pageSize: 10,
+    });
+    expect(Object.keys(page.items[0] ?? {}).sort()).toEqual([
+      "displayName",
+      "id",
+    ]);
+    expect(fixture.runtime.auditSink.list()).toContainEqual(
+      expect.objectContaining({
+        action: "system.user-directory.query",
+        actor: expect.objectContaining({ id: "actor_manager" }),
+        metadata: expect.objectContaining({ resultCount: 1, total: 1 }),
+      }),
+    );
+  });
+
+  test("缺少权限或 Feature 停用时 fail closed 并记录拒绝", async () => {
+    const missingPermission = await createFixture({ permission: false });
+    await expect(missingPermission.port.list()).rejects.toMatchObject({
+      code: "USER_DIRECTORY_FORBIDDEN",
+    });
+    expect(missingPermission.runtime.auditSink.list()).toContainEqual(
+      expect.objectContaining({
+        action: "security.denied",
+        outcome: "denied",
+      }),
+    );
+
+    const disabledFeature = await createFixture({ featureEnabled: false });
+    await expect(disabledFeature.port.list()).rejects.toMatchObject({
+      code: "USER_DIRECTORY_FORBIDDEN",
+    });
+  });
+
+  test("拒绝越界分页与搜索 Schema", async () => {
+    const fixture = await createFixture();
+    for (const query of [
+      { page: 0 },
+      { pageSize: 101 },
+      { q: "x".repeat(101) },
+      { q: 23 } as never,
+    ]) {
+      await expect(fixture.port.list(query)).rejects.toBeInstanceOf(
+        ModuleUserDirectoryError,
+      );
+      await expect(fixture.port.list(query)).rejects.toMatchObject({
+        code: "USER_DIRECTORY_INVALID_QUERY",
+      });
+    }
+  });
+
+  test("V1 tenant、custom 与 self 均只读取宿主 nominal ScopeContext", async () => {
+    const tenant = await createFixture({ dataScope: "tenant" });
+    expect((await tenant.port.list({ q: "办案员" })).items).toHaveLength(2);
+
+    const custom = await createFixture({ dataScope: "custom" });
+    expect((await custom.port.list({ q: "办案员" })).items).toEqual([
+      { id: "user_child", displayName: "子部门办案员" },
+    ]);
+
+    const self = await createFixture({ dataScope: "self" });
+    expect((await self.port.list({ q: "办案员" })).items).toEqual([
+      { id: "user_child", displayName: "子部门办案员" },
+    ]);
+  });
+
+  test("缺少宿主 nominal ScopeContext 时拒绝，不回退全量目录", async () => {
+    const fixture = await createFixture({ dataScope: "missing" });
+    await expect(fixture.port.list()).rejects.toThrow("data-scope-denied");
+  });
+
+  test("生产关键审计不可持久化时不返回目录结果", async () => {
+    const fixture = await createFixture({ productionAudit: true });
+    await expect(fixture.port.list()).rejects.toThrow(
+      "关键审计事件无法持久化或进入恢复队列",
+    );
+  });
+});
+
+interface FixtureOptions {
+  permission?: boolean;
+  featureEnabled?: boolean;
+  dataScope?: DirectoryScope;
+  productionAudit?: boolean;
+}
+
+type DirectoryScope =
+  | "all"
+  | "tenant"
+  | "department-and-children"
+  | "custom"
+  | "self"
+  | "missing";
+
+async function createFixture(options: FixtureOptions = {}) {
+  const snapshot = createFoundationSnapshot();
+  const repositories = createSystemRepositories(snapshot);
+  await seedDirectory(repositories);
+  const actor = directoryActor(
+    options.permission ?? true,
+    options.dataScope ?? "department-and-children",
+  );
+  const runtime = createServerRuntime(
+    options.productionAudit ? { NODE_ENV: "production" } : {},
+    {
+      featureCatalog: snapshot.features,
+      featureResolver: {
+        resolve: (key) => ({
+          key,
+          enabled: options.featureEnabled ?? true,
+          visible: "visible",
+        }),
+      },
+    },
+  );
+  const context: RequestGuardContext = {
+    requestId: "request-directory",
+    actor,
+    startedAt: "2026-07-25T00:00:00.000Z",
+  };
+  return {
+    runtime,
+    port: createModuleUserDirectoryPort(
+      { repositories, runtime, features: snapshot.features },
+      context,
+    ),
+  };
+}
+
+async function seedDirectory(
+  repositories: ReturnType<typeof createSystemRepositories>,
+) {
+  const system = directoryActor(true, "all");
+  for (const departmentInput of [
+    department("dept_root", "业务部门"),
+    department("dept_child", "子部门", "dept_root"),
+    department("dept_other", "其它部门"),
+  ]) {
+    await repositories.departments.create(departmentInput, system);
+  }
+  for (const userInput of [
+    user("user_root", "根部门用户", "dept_root"),
+    user("user_child", "子部门办案员", "dept_child"),
+    user("user_other", "其它办案员", "dept_other"),
+    user("user_disabled", "停用办案员", "dept_child", "disabled"),
+  ]) {
+    await repositories.users.create(userInput, system);
+  }
+}
+
+function directoryActor(
+  permission: boolean,
+  scope: DirectoryScope = "department-and-children",
+): RequestActor {
+  const actorId = scope === "self" ? "user_child" : "actor_manager";
+  const role =
+    scope === "custom"
+      ? {
+          id: "role",
+          code: "role",
+          dataScope: "custom" as const,
+          departmentIds: ["dept_child"],
+        }
+      : {
+          id: "role",
+          code: "role",
+          dataScope: scope === "missing" ? ("self" as const) : scope,
+          departmentIds: [],
+        };
+  return {
+    id: scope === "all" ? "system_seed" : actorId,
+    type: "user",
+    name: "部门负责人",
+    roleCodes: ["department-manager"],
+    permissionKeys: permission ? ["system.user-directory.read"] : [],
+    ...(scope === "missing"
+      ? {}
+      : {
+          scopeContext: buildScopeContext(
+            scope === "all" ? "system_seed" : actorId,
+            scope === "all" || scope === "tenant" ? undefined : "dept_root",
+            [role],
+          ),
+        }),
+  };
+}
+
+function department(
+  id: string,
+  name: string,
+  parentId?: string,
+): Partial<ManagedDepartment> {
+  return { id, name, code: id, order: 10, status: "active", parentId };
+}
+
+function user(
+  id: string,
+  displayName: string,
+  departmentId: string,
+  status: ManagedUser["status"] = "active",
+): Partial<ManagedUser> {
+  return {
+    id,
+    username: id,
+    displayName,
+    departmentId,
+    roleIds: [],
+    status,
+  };
+}

package/template/apps/server/src/module-host/user-directory-port.ts

@@ -0,0 +1,143 @@
+import { randomUUIDv7 } from "bun";
+import {
+  ModuleUserDirectoryError,
+  type ModuleUserDirectoryPage,
+  type ModuleUserDirectoryPort,
+  type ModuleUserDirectoryQuery,
+} from "@southwind-ai/server-sdk";
+import type { AuditEvent, FeatureFlagDefinition } from "@southwind-ai/shared";
+import { DataScopedResourceService } from "../data-access/scoped-resource.js";
+import { departmentDescendantResolver } from "../data-access/department-tree.js";
+import type { RequestGuardContext } from "../guards.js";
+import { evaluateRouteGuards, findFeature } from "../route-guards.js";
+import type { createServerRuntime } from "../runtime.js";
+import type { SystemRepositories } from "../system/seed.js";
+
+const featureKey = "system.user-directory";
+const permissionKey = "system.user-directory.read";
+const auditAction = "system.user-directory.query";
+
+type ServerRuntime = ReturnType<typeof createServerRuntime>;
+
+export interface ModuleUserDirectoryServices {
+  readonly repositories: Pick<SystemRepositories, "users" | "departments">;
+  readonly runtime: ServerRuntime;
+  readonly features: readonly FeatureFlagDefinition[];
+}
+
+export function createModuleUserDirectoryPort(
+  services: ModuleUserDirectoryServices,
+  context: RequestGuardContext,
+): ModuleUserDirectoryPort {
+  const feature = findFeature([...services.features], featureKey);
+  const access = new DataScopedResourceService(
+    services.repositories.users,
+    departmentDescendantResolver(services.repositories.departments),
+  );
+  return {
+    async list(rawQuery = {}) {
+      if (!feature) {
+        throw new ModuleUserDirectoryError(
+          "USER_DIRECTORY_UNAVAILABLE",
+          `宿主未注册 Feature：${featureKey}`,
+        );
+      }
+      const decision = await evaluateRouteGuards(services.runtime, context, {
+        permission: {
+          method: "GET",
+          path: "/internal/module-user-directory",
+          permissionKey,
+        },
+        feature,
+      });
+      if (!decision.allowed) {
+        throw new ModuleUserDirectoryError(
+          "USER_DIRECTORY_FORBIDDEN",
+          `用户目录访问被拒绝：${decision.reason}`,
+        );
+      }
+      const query = normalizeQuery(rawQuery);
+      const page = await access.list(
+        {
+          page: query.page,
+          pageSize: query.pageSize,
+          q: query.q,
+          status: "active",
+          sort: [{ field: "displayName", order: "asc" }],
+        },
+        ["displayName", "username"],
+        context.actor,
+      );
+      const result: ModuleUserDirectoryPage = {
+        items: page.items.map((user) => ({
+          id: user.id,
+          displayName:
+            user.displayName?.trim() || user.username || "未命名用户",
+        })),
+        total: page.total,
+        page: page.page,
+        pageSize: page.pageSize,
+      };
+      await services.runtime.auditSink.recordCriticalEvent(
+        queryAuditEvent(context, result),
+      );
+      return result;
+    },
+  };
+}
+
+function normalizeQuery(
+  query: ModuleUserDirectoryQuery,
+): Required<Pick<ModuleUserDirectoryQuery, "page" | "pageSize">> &
+  Pick<ModuleUserDirectoryQuery, "q"> {
+  const page = positiveInteger(query.page ?? 1, "page", 10_000);
+  const pageSize = positiveInteger(query.pageSize ?? 20, "pageSize", 100);
+  if (query.q !== undefined && typeof query.q !== "string") {
+    invalidQuery("q 必须是字符串");
+  }
+  const q = query.q?.trim();
+  if (q && q.length > 100) {
+    invalidQuery("q 最多 100 个字符");
+  }
+  return { page, pageSize, ...(q ? { q } : {}) };
+}
+
+function positiveInteger(
+  value: number,
+  field: string,
+  maximum: number,
+): number {
+  if (!Number.isInteger(value) || value < 1 || value > maximum) {
+    invalidQuery(`${field} 必须是 1-${maximum} 的整数`);
+  }
+  return value;
+}
+
+function invalidQuery(message: string): never {
+  throw new ModuleUserDirectoryError("USER_DIRECTORY_INVALID_QUERY", message);
+}
+
+function queryAuditEvent(
+  context: RequestGuardContext,
+  result: ModuleUserDirectoryPage,
+): AuditEvent {
+  return {
+    id: randomUUIDv7(),
+    action: auditAction,
+    outcome: "success",
+    actor: {
+      id: context.actor.id,
+      type: context.actor.type === "anonymous" ? "user" : context.actor.type,
+      name: context.actor.name,
+    },
+    target: { type: "system.user-directory", id: "enabled-users" },
+    requestId: context.requestId,
+    metadata: {
+      page: result.page,
+      pageSize: result.pageSize,
+      resultCount: result.items.length,
+      total: result.total,
+    },
+    occurredAt: new Date().toISOString(),
+  };
+}

package/template/apps/server/src/module-host.ts

@@ -33,6 +33,10 @@ export {
   type ModuleStorageScope,
   type ModuleStorageServices,
 } from "./module-host/storage-port.js";
+export {
+  createModuleUserDirectoryPort,
+  type ModuleUserDirectoryServices,
+} from "./module-host/user-directory-port.js";
 // @windy-module system.scheduler begin
 export { createModuleTaskDefinitions } from "./module-host/task-definitions.js";
 // @windy-module system.scheduler end

package/template/apps/server/src/runtime-development.ts

@@ -25,6 +25,7 @@ export function developmentAdminActor(): RequestActor {
       "system.menu.read",
       "system.user.read",
       "system.user.manage",
+      "system.user-directory.read",
       "system.role.read",
       "system.role.manage",
       "system.department.read",

package/template/apps/server/src/system/built-in-roles.ts

@@ -34,6 +34,7 @@ export function createBuiltInRoleSeeds(
     ...ordinaryPermissions,
     "system.department.read",
     "system.user.read",
+    "system.user-directory.read",
   ].sort();
   return [
     role(

package/template/docker-compose.yml

@@ -64,6 +64,8 @@ services:
     environment:
       AGENT_SERVER_INTERNAL_TOKEN: ${AGENT_SERVER_INTERNAL_TOKEN:-}
       AGENT_RUN_STORE_PATH: /app/data/agent/runs.sqlite3
+      AI_PROVIDER_AUDIT_STORE_PATH: /app/data/agent/provider-audit.sqlite3
+      AI_PROVIDER_AUDIT_RETENTION_DAYS: ${AI_PROVIDER_AUDIT_RETENTION_DAYS:-90}
       QWEN_API_URL: ${QWEN_API_URL:-}
       QWEN_API_KEY: ${QWEN_API_KEY:-}
       QWEN_MODEL: ${QWEN_MODEL:-}

package/template/docs/architecture/ai-egress.md

@@ -23,6 +23,27 @@ Operation 分别声明 Provider egress 与 Tool execution network policy：
     mode: "configured-endpoint",
     deploymentKey: "ai.openai-compatible",
   },
+  providerDataPolicy: {
+    inputFields: [
+      {
+        jsonPointer: "/question",
+        classification: "internal",
+        dlpAction: "redact",
+      },
+    ],
+    envelopeFields: [
+      {
+        field: "instructions",
+        classification: "internal",
+        dlpAction: "reject",
+      },
+      {
+        field: "user-prompt",
+        classification: "internal",
+        dlpAction: "redact",
+      },
+    ],
+  },
   toolNetworkPolicy: {
     mode: "forbidden",
   },
@@ -36,6 +57,14 @@ Operation 分别声明 Provider egress 与 Tool execution network policy：
   不能携带 URL、Host 或 Secret。
 - 当前 Tool 网络策略只支持 `forbidden`，缺省也是 `forbidden`。Provider egress 不会
   继承给 Tool。
+- `inputFields` 是业务 raw input 的 JSON Pointer allowlist。Server 先选择并执行 DLP，
+  再把最小输入交给业务 `prepare` Handler；未列字段不会进入 Handler、Agent Server
+  DTO 或 Provider 请求。
+- `envelopeFields` 是 Provider outbound envelope 的语义字段 allowlist，当前包含
+  `instructions`、`user-prompt`、`tool-definitions`、`provider-output` 和
+  `tool-results`。每轮实际发送前重新检查，字段遗漏或未知角色 fail closed。
+- `dlpAction=reject` 在命中后禁止发送；`redact` 使用固定占位符替换。内置检测覆盖
+  credential/token、Bearer、邮箱、手机号、身份证号和银行卡/长账号。
 
 ## Provider 强制执行
 
@@ -50,9 +79,25 @@ Key。Agent Server 在发出模型请求前核对：
 2. Deployment Key 必须等于当前 Adapter 的配置 Key；
 3. 启动时已验证配置 Endpoint 的 HTTPS Host allowlist；
 4. URL 仍来自 Agent Server 配置，Key 仍由 `SecretRef` 最后时刻解析。
+5. raw input 已按 JSON Pointer allowlist 最小化，outbound envelope 也命中显式字段规则；
+6. DLP 已完成且本次 Provider attempt 审计成功落库。
 
 浏览器 API、SSE、错误响应和 Web 环境均不包含 URL、Host allowlist 或 API Key。
 
+## Provider attempt 审计与留存
+
+OpenAI-compatible Adapter 不启用隐式 HTTP retry。每次
+`POST /chat/completions` 都对应唯一 `(runId, attempt)`，在打开网络请求前追加一条
+Provider 发送审计；审计失败即禁止该次请求。记录只包含 Deployment、Operation、
+Run、Attempt、分类集合、实际序列化 HTTP request body 字节数、策略决定和时间，不
+保存 prompt、body、Tool result、Provider response 或 Secret。
+
+`AI_PROVIDER_AUDIT_STORE_PATH` 必须在配置 Provider 时存在；
+`AI_PROVIDER_AUDIT_RETENTION_DAYS` 默认 90 天、范围 1 到 3650 天。记录在留存期内
+append-only，只有 TTL 清理可以删除过期行，并保留最近/累计删除计数。需要内部 Token
+的 `GET /health/provider-governance` 只返回聚合计数与时间，不返回 Run ID 或内容。
+当前 SQLite Adapter 只支持单副本；共享多副本必须换成集中式 append-only Adapter。
+
 ## Tool 强制执行
 
 短时 Execution Grant 保存宿主校验过的 Operation。每次 Tool 回调重新读取 Grant，并
@@ -65,16 +110,13 @@ Key。Agent Server 在发出模型请求前核对：
 
 ## 尚未覆盖
 
-本 patch 完成契约拆分、Provider 精确配置绑定、HTTPS Host allowlist 和拒绝回归，但
+当前实现完成契约拆分、Provider 精确配置绑定、字段 allowlist、DLP、逐 attempt 审计、
+TTL 与聚合观测，但
 不把以下能力宣称为已完成：
 
-- 现有 `dataClassification` 是 Operation 级分类，尚未提供字段级数据分类、发送字段
-  allowlist、脱敏或 DLP 检查；
-- 现有 Run 与 Tool 审计不等于逐次 Provider 发送审计；尚未记录目标 Deployment、
-  数据分类、字节数与策略决定的独立 append-only 事实；
 - 同进程 project-owned Tool Handler 不是 OS 网络沙箱。平台契约不授予网络 Port，
   但无法拦截业务代码直接调用全局 `fetch`；生产 deny-egress 仍需容器网络策略或防火墙；
 - DNS 解析钉扎、代理治理和多 Provider/多 Endpoint 动态路由尚未实现。
 
-在这些能力补齐前，只能声明“Provider 与 Tool 授权语义已隔离”，不能声明业务 Tool 已
-获得进程级强制断网或完整数据出境治理。
+不能声明业务 Tool 已获得进程级强制断网。DLP 是保守的模式检测，不替代行业专用实体
+识别、人工审批或部署侧代理/防火墙。

package/template/docs/architecture/ai-runtime.md

@@ -272,13 +272,32 @@ interface ModuleAiOperationDefinition {
     mode: "forbidden" | "configured-endpoint";
     deploymentKey?: string;
   };
+  providerDataPolicy?: {
+    inputFields: readonly {
+      jsonPointer: string;
+      classification: "public" | "internal" | "sensitive";
+      dlpAction: "reject" | "redact";
+    }[];
+    envelopeFields: readonly {
+      field:
+        | "instructions"
+        | "user-prompt"
+        | "tool-definitions"
+        | "provider-output"
+        | "tool-results";
+      classification: "public" | "internal" | "sensitive";
+      dlpAction: "reject" | "redact";
+    }[];
+  };
   toolNetworkPolicy?: {
     mode: "forbidden";
   };
 }
 ```
 
-两项缺省均 fail closed。Provider 的实际 Endpoint 与 HTTPS Host allowlist 只存在于
+Provider 与 Tool 网络策略缺省均 fail closed。configured Provider 还必须声明字段
+allowlist；业务 raw input 会在 Handler 前按 JSON Pointer 裁剪，outbound envelope 在
+每个 Provider attempt 前再次治理。Provider 的实际 Endpoint 与 HTTPS Host allowlist 只存在于
 服务端 Deployment 配置，不由业务 Manifest、浏览器或模型提供。详见
 [Agent Provider 与 Tool 网络边界](./ai-egress.md)。
 

package/template/docs/architecture/data-scope-query-enforcement.md

@@ -24,3 +24,7 @@ Core 只理解 ownership dimension 的稳定 key/value 契约，不知道下游
 通用资源路由的 `dataAccess` 是必填判别联合：资源必须明确声明 `request` 并提供 scoped access，或声明 `platform`，不能因漏配可选字段静默回退裸 Repository。V1 异步 bulk handler 只接受显式 `platform` 资源，由服务端构造 nominal `all` context；需要继承申请人数据范围的异步资源必须先设计不可篡改的 context snapshot，不允许套用当前平台模式。工单运营快照同样使用服务端平台任务 Actor，不再暴露或调用裸 Repository。
 
 Search Provider 只能在 D1–D3 全部闭环后接入，不得先用 Provider 内存裁剪冒充 Repository 级强制。
+
+业务模块用户目录同样复用这条 Repository 强制链。V1 `tenantId=single-tenant` 是宿主
+nominal `ScopeContext` 的明确固定租户，不是省略租户判断；业务调用方只提交分页与
+搜索，不能提交 Actor、tenant、department 或 scope。

package/template/docs/architecture/object-storage.md

@@ -2,7 +2,10 @@
 
 ## 模块与 seam
 
-`@southwind-ai/storage` 是平台文件能力的唯一底层模块。业务模块只学习 `BlobStore` 接口：流式写入、流式打开和删除；文件名、MIME、上传会话、Owner、权限与审计不进入这个底层接口，由上层上传模块统一处理。
+`@southwind-ai/storage` 是平台文件能力的唯一底层模块。`BlobStore` 只供平台 Storage
+实现使用：流式写入、流式打开和删除；文件名、MIME、上传会话、Owner、权限与审计不
+进入这个底层接口，由上层上传模块统一处理。可安装业务模块只学习
+`@southwind-ai/server-sdk` 的 `ModuleStoragePort`。
 
 `ArtifactRef` 使用 `blob_` 加 128 位随机值，不包含目录、租户或内容摘要，不能由业务主键推算。`ContentHash` 当前固定为 SHA-256。调用方可以声明大小和摘要，本地 Adapter 会在写入过程中验证；任何不一致都不会发布 Blob。
 
@@ -60,14 +63,29 @@ Logo 使用 `branding-logo` 上传策略。匿名 `/api/platform/files/:id` 只
 
 ## 模块受限 Upload/BlobRead Port
 
-业务模块不直接使用 `UploadService` / `FileService`，而是经 `ModuleRequestContext.storage` 获得 `ModuleStoragePort`（宿主实现见 `apps/server/src/module-host/storage-port.ts`）：
+业务模块不直接使用 `UploadService` / `FileService`，而是经
+`ModuleRequestContext.storage` 或 `ModuleToolContext.storage` 获得
+`ModuleStoragePort`（宿主实现见 `apps/server/src/module-host/storage-port.ts`）：
 
 - `createUploadSession` 的 purpose 强制属于本模块经 Host 注册的 Upload Policy；跨模块用途和平台基础用途（如 `bulk-data`、`branding-logo`）一律以 `UPLOAD_FORBIDDEN` 拒绝。Owner 由宿主以当前 Actor 补齐，模块无法代他人创建会话。
 - `openFile` 走 `FileService.open` 的 Owner 约束，并在返回前校验文件用途属于本模块——即使是本人文件，用途越界也拒绝。
 - `openPublicFile` 走 `FileService.openPublic` 的 Purpose 约束，且只允许本模块已注册用途。
+- `openResourceFile` 用于同一业务范围内的跨上传者读取。模块必须先通过
+  `registerResourceFileAccessPolicies()` 为精确 `purpose + resourceType` 注册
+  project-owned 授权 Resolver，并绑定同 Manifest 的 Feature、Permission 与 Audit
+  Action。Host 每次调用都使用当前请求或 Tool grant 的 Actor 与服务端 ScopeContext
+  重跑 Guard；Resolver 必须从业务 Repository 回查 `resourceId -> fileId` 绑定和案件/
+  项目成员资格，客户端传入的 ID 不是授权证据。
+- 资源读取只返回 `id/purpose/filename/mimeType/byteSize/sha256/body`；不会返回
+  Owner、ArtifactRef、对象存储 Key 或 Repository。成功和拒绝都写稳定审计，仅记录
+  `resourceType/resourceId/fileId/purpose`，不记录文件名、路径或内容。
 - 模块不直接接触 `BlobStore` 或 Upload Repository；宿主未挂载存储服务时，任何访问都以明确错误失败，不静默绕过。
 
 用途唯一性仍在 Host 注册时全局校验：命名空间重叠的模块（如 `shop` 与 `shop.sub`）注册同一 purpose 会在启动时失败。
+资源策略的 purpose 必须由当前模块或其 Manifest 显式依赖模块的 Upload Policy 注册；
+这允许 `media -> evidence` 之类的明确消费者关系，但拒绝平台基础用途和未声明的跨模块
+读取。Feature、Permission、Audit Action 和 resourceType 仍必须属于当前消费者模块，
+任一未知或越界都会在监听前失败。
 
 ## 当前切片
 
@@ -75,3 +93,5 @@ Logo 使用 `branding-logo` 上传策略。匿名 `/api/platform/files/:id` 只
 - F2：上传会话、分片续传、文件元数据、校验和清理已完成。
 - F3：服务端授权下载、审计、bulk artifact 与 Logo 接入已完成。
 - F4：模块受限 Upload/BlobRead Port 已完成，业务模块经 Host 注册用途并受命名空间约束。
+- F5：Route 与 Tool 共用资源绑定读取 Port，支持受审计、受数据范围约束的跨上传者
+  业务文件流读取，不扩散 Storage/Admin Repository。

package/template/docs/development/custom-login-page.md

@@ -78,9 +78,9 @@ composable。
 先提交当前业务改动并保持 Git 工作区干净，然后执行：
 
 ```bash
-bunx --bun create-windy@0.2.33 update --check --cwd .
-bunx --bun create-windy@0.2.33 update --dry-run --cwd .
-bunx --bun create-windy@0.2.33 update --cwd .
+bunx --bun create-windy@0.2.34 update --check --cwd .
+bunx --bun create-windy@0.2.34 update --dry-run --cwd .
+bunx --bun create-windy@0.2.34 update --cwd .
 bun install
 ```