create-windy 0.2.33 → 0.3.0

package/template/packages/modules/src/provider-data-policy-composition.test.ts

@@ -0,0 +1,74 @@
+import { describe, expect, test } from "bun:test";
+import { validateProviderDataPolicy } from "./ai-operation-composition.js";
+import type { ModuleAiOperationDefinition } from "./manifest.js";
+
+describe("Provider 输入字段 Schema", () => {
+  test.each(["/bad~2escape", "/__proto__/polluted", "/constructor/value"])(
+    "拒绝危险或非法 JSON Pointer：%s",
+    (jsonPointer) => {
+      expect(() =>
+        validateProviderDataPolicy(operation([jsonPointer])),
+      ).toThrow("JSON Pointer 无效");
+    },
+  );
+
+  test("拒绝父子重叠路径，避免规则顺序改变结果", () => {
+    expect(() =>
+      validateProviderDataPolicy(operation(["/case", "/case/name"])),
+    ).toThrow("不能父子重叠");
+  });
+
+  test("使用 Tool 时要求声明定义、上一轮输出和 Tool 结果", () => {
+    expect(() =>
+      validateProviderDataPolicy(operation(["/question"], ["business.query"])),
+    ).toThrow("使用 Tool 时");
+  });
+});
+
+function operation(
+  inputPointers: readonly string[],
+  allowedToolKeys: readonly string[] = [],
+): ModuleAiOperationDefinition {
+  return {
+    key: "business.answer",
+    kind: "agent",
+    featureKey: "business.ai",
+    permissionKey: "business.ai.execute",
+    auditAction: "business.ai.execute",
+    inputSchemaKey: "business.input.v1",
+    outputSchemaKey: "business.output.v1",
+    requiredCapabilities: ["text-generation"],
+    allowedToolKeys,
+    dataClassification: "internal",
+    execution: "streaming",
+    providerEgress: {
+      mode: "configured-endpoint",
+      deploymentKey: "ai.openai-compatible",
+    },
+    providerDataPolicy: {
+      inputFields: inputPointers.map((jsonPointer) => ({
+        jsonPointer,
+        classification: "internal",
+        dlpAction: "redact",
+      })),
+      envelopeFields: [
+        {
+          field: "instructions",
+          classification: "internal",
+          dlpAction: "reject",
+        },
+        {
+          field: "user-prompt",
+          classification: "internal",
+          dlpAction: "redact",
+        },
+      ],
+    },
+    toolNetworkPolicy: { mode: "forbidden" },
+    limits: {
+      maxDurationSeconds: 60,
+      maxInputBytes: 4096,
+      maxOutputBytes: 4096,
+    },
+  };
+}

package/template/packages/modules/src/system-api-permissions.ts

@@ -61,6 +61,12 @@ export function systemApiPermissionBindings(): ApiPermissionBinding[] {
       "system.department.create",
       "system.rbac",
     ),
+    binding(
+      "POST",
+      "/api/system/departments/:id/transition",
+      "system.department.manage",
+      "system.rbac",
+    ),
     binding("GET", "/api/system/menus", "system.menu.read", "system.rbac"),
     binding(
       "GET",
@@ -226,12 +232,48 @@ export function systemApiPermissionBindings(): ApiPermissionBinding[] {
       "system.notification.read",
       "system.notification",
     ),
+    binding(
+      "GET",
+      "/api/notifications/preferences",
+      "system.notification.read",
+      "system.notification",
+    ),
+    binding(
+      "PUT",
+      "/api/notifications/preferences",
+      "system.notification.read",
+      "system.notification",
+    ),
     binding(
       "POST",
       "/api/notifications/:id/read",
       "system.notification.read",
       "system.notification",
     ),
+    binding(
+      "PUT",
+      "/api/notifications/:id/favorite",
+      "system.notification.read",
+      "system.notification",
+    ),
+    binding(
+      "DELETE",
+      "/api/notifications/:id/favorite",
+      "system.notification.read",
+      "system.notification",
+    ),
+    binding(
+      "GET",
+      "/api/system/notifications/audience-options",
+      "system.notification.manage",
+      "system.notification",
+    ),
+    binding(
+      "GET",
+      "/api/system/notifications/:id/deliveries",
+      "system.notification.manage",
+      "system.notification",
+    ),
     binding(
       "GET",
       "/api/system/notifications",
@@ -244,6 +286,18 @@ export function systemApiPermissionBindings(): ApiPermissionBinding[] {
       "system.notification.manage",
       "system.notification",
     ),
+    binding(
+      "PUT",
+      "/api/system/notifications/:id",
+      "system.notification.update",
+      "system.notification",
+    ),
+    binding(
+      "GET",
+      "/api/system/notifications/:id/revisions",
+      "system.notification.manage",
+      "system.notification",
+    ),
     binding(
       "DELETE",
       "/api/system/notifications/:id",

package/template/packages/modules/src/system-audit-actions.ts

@@ -8,6 +8,11 @@ export const systemAuditActions: ModuleManifest["auditActions"] = [
   "crud.create",
   "crud.update",
   "crud.delete",
+  {
+    key: "system.user-directory.query",
+    label: "查询业务用户目录",
+    description: "业务模块在平台授权与数据范围内查询启用用户最小投影。",
+  },
   // @windy-module system.configuration begin
   "config.update",
   "config.rollback",
@@ -17,9 +22,19 @@ export const systemAuditActions: ModuleManifest["auditActions"] = [
   // @windy-module system.license end
   "feature.update",
   "menu.structure.update",
+  {
+    key: "organization.department.transition",
+    label: "处置部门组织",
+    description: "迁移部门关联后停用或删除部门。",
+  },
   // @windy-module system.notification begin
   "notification.publish",
+  "notification.schedule",
+  "notification.preference.update",
+  "notification.update",
   "notification.read",
+  "notification.favorite",
+  "notification.unfavorite",
   "notification.archive",
   // @windy-module system.notification end
   // @windy-module system.workflow begin

package/template/packages/modules/src/system-features.ts

@@ -17,6 +17,11 @@ export const systemFeatures: ModuleManifest["features"] = [
     "RBAC 权限链路",
     "用户、角色、权限点与数据范围的统一访问控制链路。",
   ),
+  feature(
+    "system.user-directory",
+    "业务用户目录",
+    "向获授权业务模块提供受数据范围约束的启用用户最小只读投影。",
+  ),
   feature(
     "system.profile",
     "个人设置",
@@ -85,7 +90,7 @@ export const systemFeatures: ModuleManifest["features"] = [
   feature(
     "system.notification",
     "站内通知",
-    "站内通知发布、管理、阅读和已读状态闭环。",
+    "站内通知发布、修改历史、阅读、收藏和已读状态闭环。",
   ),
   // @windy-module system.notification end
   // @windy-module system.workflow begin

package/template/packages/modules/src/system-module-catalog.test.ts

@@ -116,6 +116,22 @@ describe("系统能力模块目录", () => {
       "system.workflow.timeout-dispatch",
     ]);
     expect(identity.dataPolicies).toEqual([]);
+    expect(identity.features.map(({ key }) => key)).toContain(
+      "system.user-directory",
+    );
+    expect(identity.permissions.map(({ key }) => key)).toContain(
+      "system.user-directory.read",
+    );
+    expect(
+      identity.auditActions.map((action) =>
+        typeof action === "string" ? action : action.key,
+      ),
+    ).toContain("system.user-directory.query");
+    expect(
+      systemFoundationModule().auditActions.map((action) =>
+        typeof action === "string" ? action : action.key,
+      ),
+    ).toContain("system.user-directory.query");
     expect(
       systemModuleManifest("system.data-governance").dataPolicies?.map(
         ({ key }) => key,

package/template/packages/modules/src/system-module-catalog.ts

@@ -27,9 +27,17 @@ export const systemModuleDefinitions = [
     version: "0.1.0",
     label: "身份与权限",
     description: "用户、角色、部门、菜单、字典、个人资料和数据范围。",
-    resources: ["user", "role", "department", "menu", "dict", "profile"],
+    resources: [
+      "user",
+      "user-directory",
+      "role",
+      "department",
+      "menu",
+      "dict",
+      "profile",
+    ],
     excludedPermissionKeys: ["system.user.reveal", "system.user.export"],
-    featureKeys: ["system.rbac", "system.profile"],
+    featureKeys: ["system.rbac", "system.user-directory", "system.profile"],
   },
   // @windy-module system.settings begin
   {
@@ -116,7 +124,8 @@ export const systemModuleDefinitions = [
     name: "system.notification",
     version: "0.1.0",
     label: "站内通知",
-    description: "通知发布、阅读、归档与状态管理。",
+    description:
+      "通知定向与定时发布、用户偏好、外部渠道投递、修改历史、阅读、收藏和归档。",
     resources: ["notification"],
     featureKeys: ["system.notification"],
   },
@@ -226,11 +235,26 @@ function createSystemCapabilityModule(
       definition.name === "system.data-governance"
         ? aggregate.dataPolicies
         : [],
-    auditActions: isCore ? aggregate.auditActions : [],
+    auditActions: isCore
+      ? aggregate.auditActions.filter(
+          (action) => auditActionKey(action) !== "system.user-directory.query",
+        )
+      : definition.name === "system.identity"
+        ? aggregate.auditActions.filter(
+            (action) =>
+              auditActionKey(action) === "system.user-directory.query",
+          )
+        : [],
     metadata: { kind: "platform-capability" },
   };
 }
 
+function auditActionKey(
+  action: ModuleManifest["auditActions"][number],
+): string {
+  return typeof action === "string" ? action : action.key;
+}
+
 function permissionResource(permissionKey: string): string {
   const parts = permissionKey.split(".");
   return parts.length >= 3 ? parts.slice(1, -1).join(".") : "";

package/template/packages/modules/src/system-modules.test.ts

@@ -220,7 +220,7 @@ describe("系统模块能力注册", () => {
     expect(catalogs).toEqual(["组织与权限", "平台配置", "安全与合规", "运维"]);
   });
 
-  test("部门快捷创建使用独立权限并绑定真实 API", () => {
+  test("部门创建与迁移处置绑定独立权限、Feature 和审计动作", () => {
     const manifest = systemFoundationModule();
     expect(
       manifest.permissions.some(
@@ -234,6 +234,18 @@ describe("系统模块能力注册", () => {
       featureKey: "system.rbac",
       anonymous: undefined,
     });
+    expect(manifest.apiPermissions).toContainEqual({
+      method: "POST",
+      path: "/api/system/departments/:id/transition",
+      permissionKey: "system.department.manage",
+      featureKey: "system.rbac",
+      anonymous: undefined,
+    });
+    expect(manifest.auditActions).toContainEqual(
+      expect.objectContaining({
+        key: "organization.department.transition",
+      }),
+    );
   });
 
   test("所有权限都由 Manifest 提供稳定中文分组元数据", () => {

package/template/packages/modules/src/system-modules.ts

@@ -270,6 +270,18 @@ export function systemFoundationModule(): ModuleManifest {
         retryDelaySeconds: 30,
       },
       // @windy-module system.scheduler end
+      // @windy-module system.notification begin
+      {
+        key: "system.notification.dispatch",
+        label: "通知发布与外部投递",
+        description: "发布到期通知并领取持久投递队列，执行渠道重试。",
+        permissionKey: "system.notification.manage",
+        featureKey: "system.notification",
+        intervalSeconds: 5,
+        maxAttempts: 3,
+        retryDelaySeconds: 30,
+      },
+      // @windy-module system.notification end
       // @windy-module system.bulk-data begin
       {
         key: "system.bulk-data.dispatch",

package/template/packages/modules/src/system-permissions.ts

@@ -3,6 +3,7 @@ import type { ModuleManifest } from "./manifest.js";
 const systemResourceLabels = {
   admin: "管理面准入",
   user: "用户管理",
+  "user-directory": "业务用户目录",
   role: "角色与权限",
   department: "部门组织",
   menu: "菜单管理",
@@ -32,6 +33,7 @@ type SystemAction =
   | "approve"
   | "export"
   | "reveal"
+  | "update"
   | "manage";
 
 function permission(
@@ -53,11 +55,13 @@ function permission(
             ? "新建"
             : action === "approve"
               ? "处理"
-              : action === "reveal"
-                ? "查看明文"
-                : action === "export"
-                  ? "治理导出"
-                  : "管理",
+              : action === "update"
+                ? "修改"
+                : action === "reveal"
+                  ? "查看明文"
+                  : action === "export"
+                    ? "治理导出"
+                    : "管理",
     module: "system",
     moduleLabel: "系统基础设施",
     resource,
@@ -75,6 +79,7 @@ export const systemPermissions: ModuleManifest["permissions"] = [
   permission("user", "export", "governed-export"),
   // @windy-module system.data-governance end
   permission("user", "manage"),
+  permission("user-directory", "read"),
   permission("role", "read"),
   permission("role", "manage"),
   permission("department", "read"),
@@ -123,6 +128,7 @@ export const systemPermissions: ModuleManifest["permissions"] = [
   // @windy-module system.scheduler end
   // @windy-module system.notification begin
   permission("notification", "read"),
+  permission("notification", "update"),
   permission("notification", "manage"),
   // @windy-module system.notification end
   // @windy-module system.bulk-data begin

package/template/packages/server-sdk/index.ts

@@ -32,9 +32,20 @@ export type {
   ModuleSearchQuery,
 } from "./src/search-provider-port.js";
 export type {
+  ModuleOpenedResourceFile,
+  ModuleResourceFileAccessContext,
+  ModuleResourceFileAccessPolicy,
+  ModuleResourceFileRequest,
   ModuleStoragePort,
   ModuleUploadSessionInput,
 } from "./src/storage-port.js";
+export type {
+  ModuleUserDirectoryEntry,
+  ModuleUserDirectoryPage,
+  ModuleUserDirectoryPort,
+  ModuleUserDirectoryQuery,
+} from "./src/user-directory-port.js";
+export { ModuleUserDirectoryError } from "./src/user-directory-port.js";
 export type {
   ModuleTaskHandler,
   ModuleTaskHandlerRegistration,

package/template/packages/server-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/server-sdk",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {
@@ -21,7 +21,8 @@
     "src/storage-port.ts",
     "src/task-registration.ts",
     "src/tool-registration.ts",
-    "src/tool-host-port.ts"
+    "src/tool-host-port.ts",
+    "src/user-directory-port.ts"
   ],
   "scripts": {
     "test": "bun test",

package/template/packages/server-sdk/src/ai-operation-registration.ts

@@ -9,7 +9,8 @@ export interface ModuleAiOperationContext {
 }
 
 /**
- * 业务模块只负责把类型化输入收敛为模型无关的指令和用户消息。
+ * 业务模块只接收 Manifest `providerDataPolicy.inputFields` allowlist 选出并完成
+ * DLP 的最小输入，再将其收敛为模型无关的指令和用户消息。
  * Provider、Deployment、Secret、Execution Grant 与 Tool 授权均由宿主持有。
  */
 export interface ModuleAiOperationPlan {

package/template/packages/server-sdk/src/module-host.ts

@@ -3,6 +3,7 @@ import type { ModuleAiOperationHandlerRegistration } from "./ai-operation-regist
 import type { ModuleRolePreset } from "./role-preset.js";
 import type { ModuleRouteDefinition } from "./route-definition.js";
 import type { ModuleSearchProvider } from "./search-provider-port.js";
+import type { ModuleResourceFileAccessPolicy } from "./storage-port.js";
 import type { ModuleTaskHandlerRegistration } from "./task-registration.js";
 import type { ModuleToolHandlerRegistration } from "./tool-registration.js";
 
@@ -25,6 +26,13 @@ export interface ModuleUploadPolicy {
 export interface ModuleHost {
   readonly moduleName: string;
   registerUploadPolicy(policy: ModuleUploadPolicy): void;
+  /**
+   * 注册跨上传者资源文件读取策略；purpose 必须由本模块或 Manifest 显式依赖模块的
+   * Upload Policy 声明，Feature、Permission 与 Audit Action 必须来自当前 Manifest。
+   */
+  registerResourceFileAccessPolicies(
+    policies: readonly ModuleResourceFileAccessPolicy[],
+  ): void;
   registerDurableHandler<T>(definition: DurableHandlerDefinition<T>): void;
   /** 注册 Guarded API 路由；须与 Manifest `apiPermissions` 声明一致。 */
   registerRoutes(routes: readonly ModuleRouteDefinition[]): void;

package/template/packages/server-sdk/src/request-context.ts

@@ -2,6 +2,7 @@ import type { ModuleActor } from "./actor.js";
 import type { ModuleAuditEmitter } from "./audit-port.js";
 import type { ModuleJobSubmitter } from "./jobs-port.js";
 import type { ModuleStoragePort } from "./storage-port.js";
+import type { ModuleUserDirectoryPort } from "./user-directory-port.js";
 
 /**
  * 模块路由 Handler 的受限请求上下文。
@@ -18,4 +19,5 @@ export interface ModuleRequestContext {
   readonly audit: ModuleAuditEmitter;
   readonly jobs: ModuleJobSubmitter;
   readonly storage: ModuleStoragePort;
+  readonly userDirectory: ModuleUserDirectoryPort;
 }

package/template/packages/server-sdk/src/storage-port.ts

@@ -1,4 +1,5 @@
 import type { OpenedFile, UploadSession } from "@southwind-ai/storage";
+import type { ModuleActor } from "./actor.js";
 
 export interface ModuleUploadSessionInput {
   readonly purpose: string;
@@ -9,6 +10,62 @@ export interface ModuleUploadSessionInput {
   readonly fileExpiresAt?: Date;
 }
 
+export interface ModuleResourceFileRequest {
+  /** 平台文件元数据 ID；不能是 ArtifactRef、对象存储 Key 或主机路径。 */
+  readonly fileId: string;
+  /**
+   * 必须与本模块或 Manifest 显式依赖模块注册的 Upload Policy，以及当前模块的
+   * 资源文件访问策略完全一致。
+   */
+  readonly purpose: string;
+  /** 本模块命名空间内的稳定业务资源类型，例如 `evidence.file`。 */
+  readonly resourceType: string;
+  /** 由授权策略回查业务 Repository 的稳定资源 ID。 */
+  readonly resourceId: string;
+}
+
+/** 资源授权读取仅返回业务所需的最小元数据与受限文件流。 */
+export interface ModuleOpenedResourceFile {
+  readonly id: string;
+  readonly purpose: string;
+  readonly filename: string;
+  readonly mimeType: string;
+  readonly byteSize: number;
+  readonly sha256: string;
+  readonly body: ReadableStream<Uint8Array>;
+}
+
+export interface ModuleResourceFileAccessContext {
+  readonly actor: ModuleActor;
+  readonly requestId: string;
+  readonly signal: AbortSignal;
+}
+
+/**
+ * 业务模块注册的资源到平台文件关联授权策略。
+ *
+ * `authorize` 必须从 project-owned Repository 回查 resourceId，确认当前 Actor
+ * 可访问该业务资源且该资源实际绑定 fileId；客户端或 Tool 输入不是授权证据。
+ */
+export interface ModuleResourceFileAccessPolicy {
+  /**
+   * 本模块或 Manifest 显式依赖模块拥有的 Upload Policy purpose；
+   * 平台基础 purpose 与未声明跨模块 purpose 均不可引用。
+   */
+  readonly purpose: string;
+  readonly resourceType: string;
+  readonly featureKey: string;
+  readonly permissionKey: string;
+  readonly auditAction: string;
+  authorize(
+    input: Readonly<{
+      fileId: string;
+      resourceId: string;
+    }>,
+    context: ModuleResourceFileAccessContext,
+  ): Promise<boolean> | boolean;
+}
+
 /**
  * 模块受限 Upload / BlobRead Port。
  *
@@ -22,4 +79,13 @@ export interface ModuleStoragePort {
   createUploadSession(input: ModuleUploadSessionInput): Promise<UploadSession>;
   openFile(fileId: string): Promise<OpenedFile>;
   openPublicFile(fileId: string, purpose: string): Promise<OpenedFile>;
+  /**
+   * 经 Host Feature / Permission 与业务资源策略双重授权后读取文件。
+   *
+   * 允许同一业务范围内跨上传者读取，但不授予任意 manage、Repository、BlobStore
+   * 或 ArtifactRef 能力。
+   */
+  openResourceFile(
+    input: ModuleResourceFileRequest,
+  ): Promise<ModuleOpenedResourceFile>;
 }

package/template/packages/server-sdk/src/tool-registration.ts

@@ -1,10 +1,16 @@
 import type { ModuleActor } from "./actor.js";
 import type { ModuleAiJsonValue } from "./ai-operation-registration.js";
+import type { ModuleStoragePort } from "./storage-port.js";
 
 export interface ModuleToolContext {
   readonly actor: ModuleActor;
   readonly requestId: string;
   readonly signal: AbortSignal;
+  /**
+   * 与当前 Tool Actor、请求范围和模块命名空间绑定的受限存储 Port。
+   * Host 未安装 Storage 时为 fail-closed 实现。
+   */
+  readonly storage: ModuleStoragePort;
 }
 
 export type ModuleToolInput = Readonly<Record<string, ModuleAiJsonValue>>;

package/template/packages/server-sdk/src/user-directory-port.ts

@@ -0,0 +1,42 @@
+export interface ModuleUserDirectoryQuery {
+  readonly page?: number;
+  readonly pageSize?: number;
+  readonly q?: string;
+}
+
+export interface ModuleUserDirectoryEntry {
+  readonly id: string;
+  readonly displayName: string;
+}
+
+export interface ModuleUserDirectoryPage {
+  readonly items: readonly ModuleUserDirectoryEntry[];
+  readonly total: number;
+  readonly page: number;
+  readonly pageSize: number;
+}
+
+export type ModuleUserDirectoryErrorCode =
+  | "USER_DIRECTORY_FORBIDDEN"
+  | "USER_DIRECTORY_UNAVAILABLE"
+  | "USER_DIRECTORY_INVALID_QUERY";
+
+export class ModuleUserDirectoryError extends Error {
+  constructor(
+    readonly code: ModuleUserDirectoryErrorCode,
+    message: string,
+  ) {
+    super(message);
+    this.name = "ModuleUserDirectoryError";
+  }
+}
+
+/**
+ * 业务模块使用的只读启用用户目录。
+ *
+ * Actor、租户、部门与 Data Scope 全部由宿主绑定；调用方只能提交分页和搜索条件。
+ * 宿主会执行 Feature、Permission、数据范围与审计，失败时不会降级为全量用户查询。
+ */
+export interface ModuleUserDirectoryPort {
+  list(query?: ModuleUserDirectoryQuery): Promise<ModuleUserDirectoryPage>;
+}

package/template/packages/shared/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/shared",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {

package/template/packages/shared/src/audit.ts

@@ -145,11 +145,36 @@ export const AUDIT_ACTION_DEFINITIONS = [
     label: "通知发布",
     description: "发布站内通知。",
   },
+  {
+    key: "notification.schedule",
+    label: "通知定时发布",
+    description: "创建等待调度器发布的通知。",
+  },
+  {
+    key: "notification.preference.update",
+    label: "通知偏好更新",
+    description: "用户更新外部通知渠道和分类偏好。",
+  },
+  {
+    key: "notification.update",
+    label: "通知修改",
+    description: "修改已发布通知并保留版本历史。",
+  },
   {
     key: "notification.read",
     label: "通知已读",
     description: "用户阅读站内通知。",
   },
+  {
+    key: "notification.favorite",
+    label: "收藏通知",
+    description: "用户收藏可见的站内通知。",
+  },
+  {
+    key: "notification.unfavorite",
+    label: "取消收藏通知",
+    description: "用户取消收藏可见的站内通知。",
+  },
   {
     key: "notification.archive",
     label: "通知归档",