create-windy 0.2.34 → 0.3.0

package/template/apps/server/src/auth/routes.ts

@@ -53,6 +53,10 @@ export function registerAuthRoutes(
   registerLoginRoutes(app, authService, options);
   registerOwnSessionRoutes(app, authService, options);
 
+  app.get("/auth/password/policy", () =>
+    json(authService.getPasswordPolicy(), 200, { "cache-control": "no-store" }),
+  );
+
   app.post("/auth/logout", async (rawContext) => {
     const context = rawContext as AuthRouteContext;
     const token = readRequestSessionToken(context.request, cookieName);
@@ -112,10 +116,11 @@ export function registerAuthRoutes(
       INVALID_PASSWORD: 400,
       PASSWORD_UNCHANGED: 400,
     } as const;
+    const policy = authService.getPasswordPolicy();
     const messages = {
       USER_NOT_FOUND: "当前账号不存在",
       INVALID_CURRENT_PASSWORD: "当前密码错误",
-      INVALID_PASSWORD: "新密码必须为 12-128 个字符",
+      INVALID_PASSWORD: `新密码必须为 ${policy.minLength}-${policy.maxLength} 个字符`,
       PASSWORD_UNCHANGED: "新密码不能与当前密码相同",
     } as const;
     return json(

package/template/apps/server/src/auth/runtime.ts

@@ -1,10 +1,12 @@
 import type { AuditEventReader, AuditEventWriter } from "../runtime.js";
+import type { PasswordPolicy } from "@southwind-ai/shared";
 import { InMemoryAuthRepository, type AuthRepository } from "./repository.js";
 import { AuthService } from "./service.js";
 
 interface AuthRuntimeInput {
   repository?: AuthRepository;
-  sessionTtlSeconds: number;
+  sessionTtlSeconds: number | (() => number);
+  passwordPolicy?: () => PasswordPolicy;
   auditWriter: AuditEventWriter["write"];
   auditReader?: AuditEventReader;
 }
@@ -13,6 +15,7 @@ export function createAuthRuntime(input: AuthRuntimeInput) {
   const authRepository = input.repository ?? new InMemoryAuthRepository();
   const authService = new AuthService(authRepository, {
     sessionTtlSeconds: input.sessionTtlSeconds,
+    passwordPolicy: input.passwordPolicy,
     auditWriter: { write: input.auditWriter },
     auditReader: input.auditReader,
   });

package/template/apps/server/src/auth/service.ts

@@ -1,6 +1,10 @@
 import { randomBytes } from "node:crypto";
 import { randomUUIDv7 } from "bun";
-import type { AuditEvent } from "@southwind-ai/shared";
+import {
+  PASSWORD_POLICY,
+  type AuditEvent,
+  type PasswordPolicy,
+} from "@southwind-ai/shared";
 import type { RequestActor } from "../guards.js";
 import type { AuditEventReader, AuditEventWriter } from "../runtime.js";
 import { hashSessionToken } from "./actor-resolver.js";
@@ -8,7 +12,7 @@ import {
   AuthenticationProviderRegistry,
   LocalArgon2AuthenticationAdapter,
 } from "./authentication-provider.js";
-import { argon2PasswordHasher, type PasswordHasher } from "./password.js";
+import { createArgon2PasswordHasher, type PasswordHasher } from "./password.js";
 import type { AuthRepository, AuthSessionRecord } from "./repository.js";
 import {
   CredentialService,
@@ -42,7 +46,8 @@ export type RevokeResult =
   | { ok: false; code: "SESSION_NOT_FOUND" | "FORBIDDEN" };
 
 export interface AuthServiceOptions {
-  sessionTtlSeconds?: number;
+  sessionTtlSeconds?: number | (() => number);
+  passwordPolicy?: () => PasswordPolicy;
   now?: () => Date;
   tokenFactory?: () => string;
   passwordHasher?: PasswordHasher;
@@ -52,7 +57,8 @@ export interface AuthServiceOptions {
 }
 
 export class AuthService {
-  private readonly sessionTtlSeconds: number;
+  private readonly sessionTtlSeconds: () => number;
+  private readonly passwordPolicy: () => PasswordPolicy;
   private readonly now: () => Date;
   private readonly tokenFactory: () => string;
   private readonly passwordHasher: PasswordHasher;
@@ -64,11 +70,17 @@ export class AuthService {
     private readonly repository: AuthRepository,
     private readonly options: AuthServiceOptions,
   ) {
-    this.sessionTtlSeconds = options.sessionTtlSeconds || 60 * 60 * 8;
+    const sessionTtlSeconds = options.sessionTtlSeconds;
+    this.sessionTtlSeconds =
+      typeof sessionTtlSeconds === "function"
+        ? sessionTtlSeconds
+        : () => sessionTtlSeconds || 60 * 60 * 8;
+    this.passwordPolicy = options.passwordPolicy || (() => PASSWORD_POLICY);
     this.now = options.now || (() => new Date());
     this.tokenFactory =
       options.tokenFactory || (() => randomBytes(32).toString("base64url"));
-    this.passwordHasher = options.passwordHasher || argon2PasswordHasher;
+    this.passwordHasher =
+      options.passwordHasher || createArgon2PasswordHasher(this.passwordPolicy);
     this.authenticationProviders =
       options.authenticationProviders ||
       new AuthenticationProviderRegistry(
@@ -140,7 +152,9 @@ export class AuthService {
       tokenHash: hashSessionToken(token),
       status: "active",
       issuedAt,
-      expiresAt: new Date(issuedAt.getTime() + this.sessionTtlSeconds * 1_000),
+      expiresAt: new Date(
+        issuedAt.getTime() + this.sessionTtlSeconds() * 1_000,
+      ),
       ip: metadata.ip,
       userAgent: metadata.userAgent,
     };
@@ -211,6 +225,10 @@ export class AuthService {
     );
   }
 
+  getPasswordPolicy(): PasswordPolicy {
+    return { ...this.passwordPolicy() };
+  }
+
   async revokeSession(
     sessionId: string,
     actor: RequestActor,

package/template/apps/server/src/configuration/bootstrap.ts

@@ -3,6 +3,10 @@ import type { FeatureFlagDefinition } from "@southwind-ai/shared";
 import type { FoundationSnapshot } from "../foundation.js";
 import type { createServerRuntime } from "../runtime.js";
 import type { RouteApp } from "../system/route-types.js";
+// @windy-module system.storage begin
+import type { UploadService } from "@southwind-ai/storage";
+import { createPlatformUploadPolicies } from "../storage/runtime.js";
+// @windy-module system.storage end
 import {
   createRedisHealthProbe,
   type RedisHealthProbe,
@@ -21,6 +25,9 @@ export async function bootstrapModuleConfiguration(
 ): Promise<{
   service: ModuleConfigurationService;
   bindFoundation(snapshot: FoundationSnapshot): void;
+  // @windy-module system.storage begin
+  bindStorage(uploads: Pick<UploadService, "setPolicy">): void;
+  // @windy-module system.storage end
   redisHealthProbe: RedisHealthProbe;
   register(
     app: Pick<RouteApp, "get" | "post">,
@@ -37,12 +44,24 @@ export async function bootstrapModuleConfiguration(
   return {
     service,
     bindFoundation(snapshot) {
-      adapter.setListener({
+      snapshot.platform.enableAI = config.enableAI;
+      adapter.addListener({
         applied(current) {
           snapshot.platform.enableAI = current.enableAI;
         },
       });
     },
+    // @windy-module system.storage begin
+    bindStorage(uploads: Pick<UploadService, "setPolicy">) {
+      adapter.addListener({
+        applied(current) {
+          for (const policy of createPlatformUploadPolicies(current)) {
+            uploads.setPolicy(policy);
+          }
+        },
+      });
+    },
+    // @windy-module system.storage end
     redisHealthProbe: createLiveRedisHealthProbe(config),
     register(app, runtime, features) {
       registerModuleConfigurationRoutes(app, service, runtime, features);

package/template/apps/server/src/configuration/definition.test.ts

@@ -0,0 +1,71 @@
+import { describe, expect, test } from "bun:test";
+import { loadPlatformConfig } from "@southwind-ai/config";
+import { PlatformConfigApplyAdapter } from "./definition.js";
+
+describe("平台类型化运行配置", () => {
+  test("白名单不包含 SMTP Secret 且旧版本缺失字段由环境基线补齐", () => {
+    const config = loadPlatformConfig({
+      MAIL_SMTP_URL: "smtp://secret-marker@example.invalid",
+    });
+    const definition = new PlatformConfigApplyAdapter(config).definition();
+
+    expect(definition.fields.map((field) => field.path)).not.toContain(
+      "mail.smtpUrl",
+    );
+    expect(JSON.stringify(definition.baseValues())).not.toContain(
+      "secret-marker",
+    );
+    expect(
+      definition.validate({
+        enableAI: true,
+        "cache.healthTimeoutMs": 500,
+      }),
+    ).toMatchObject({
+      enableAI: true,
+      "cache.healthTimeoutMs": 500,
+      "security.passwordMinLength": 12,
+      "security.passwordMaxLength": 128,
+      "regional.timeZone": "Asia/Shanghai",
+    });
+    expect(() =>
+      definition.validate({
+        ...definition.baseValues(),
+        "mail.smtpUrl": "smtp://must-not-persist",
+      }),
+    ).toThrow();
+    expect(() =>
+      definition.validate({
+        ...definition.baseValues(),
+        "mail.enabled": true,
+      }),
+    ).toThrow();
+  });
+
+  test("即时字段应用到共享运行配置对象", async () => {
+    const config = loadPlatformConfig({});
+    const definition = new PlatformConfigApplyAdapter(config).definition();
+
+    await definition.apply(
+      definition.validate({
+        ...definition.baseValues(),
+        "security.sessionTtlSeconds": 3_600,
+        "security.passwordMinLength": 16,
+        "security.passwordMaxLength": 64,
+        "storage.bulkDataMaxByteSize": 1_048_576,
+        "storage.brandingLogoMaxByteSize": 262_144,
+        "regional.timeZone": "UTC",
+      }),
+    );
+
+    expect(config.security).toMatchObject({
+      sessionTtlSeconds: 3_600,
+      passwordMinLength: 16,
+      passwordMaxLength: 64,
+    });
+    expect(config.storage).toEqual({
+      bulkDataMaxByteSize: 1_048_576,
+      brandingLogoMaxByteSize: 262_144,
+    });
+    expect(config.regional.timeZone).toBe("UTC");
+  });
+});

package/template/apps/server/src/configuration/definition.ts

@@ -1,4 +1,7 @@
-import { platformConfigDefinition, type PlatformConfig } from "@southwind-ai/config";
+import {
+  platformConfigDefinition,
+  type PlatformConfig,
+} from "@southwind-ai/config";
 import type {
   ModuleConfigFieldDescriptor,
   ModuleConfigValues,
@@ -18,21 +21,68 @@ export interface PlatformConfigApplyListener {
   applied(config: PlatformConfig): void;
 }
 
-const managedPaths = ["enableAI", "cache.healthTimeoutMs"] as const;
-const platformValuesSchema = z.strictObject({
-  enableAI: z.boolean(),
-  "cache.healthTimeoutMs": z.number().int().min(50).max(10_000),
-});
+const managedPaths = [
+  "enableAI",
+  "cache.healthTimeoutMs",
+  "security.sessionTtlSeconds",
+  "security.passwordMinLength",
+  "security.passwordMaxLength",
+  "storage.bulkDataMaxByteSize",
+  "storage.brandingLogoMaxByteSize",
+  "mail.enabled",
+  "mail.host",
+  "mail.port",
+  "mail.secure",
+  "mail.fromAddress",
+  "mail.connectTimeoutMs",
+  "regional.timeZone",
+] as const;
+const platformValuesSchema = z
+  .strictObject({
+    enableAI: z.boolean(),
+    "cache.healthTimeoutMs": z.number().int().min(50).max(10_000),
+    "security.sessionTtlSeconds": z.number().int().min(60).max(2_592_000),
+    "security.passwordMinLength": z.number().int().min(8).max(128),
+    "security.passwordMaxLength": z.number().int().min(12).max(512),
+    "storage.bulkDataMaxByteSize": z
+      .number()
+      .int()
+      .min(1024)
+      .max(10 * 1024 ** 3),
+    "storage.brandingLogoMaxByteSize": z
+      .number()
+      .int()
+      .min(1024)
+      .max(50 * 1024 ** 2),
+    "mail.enabled": z.boolean(),
+    "mail.host": z.string().trim().max(253),
+    "mail.port": z.number().int().min(1).max(65_535),
+    "mail.secure": z.boolean(),
+    "mail.fromAddress": z.string().trim().max(320),
+    "mail.connectTimeoutMs": z.number().int().min(100).max(120_000),
+    "regional.timeZone": z
+      .string()
+      .trim()
+      .min(1)
+      .max(100)
+      .refine(isSupportedTimeZone),
+  })
+  .refine(
+    (values) =>
+      values["security.passwordMinLength"] <=
+      values["security.passwordMaxLength"],
+    { message: "密码最小长度不能大于最大长度" },
+  );
 
 export class PlatformConfigApplyAdapter {
-  private listener?: PlatformConfigApplyListener;
+  private readonly listeners = new Set<PlatformConfigApplyListener>();
 
   constructor(private readonly config: PlatformConfig) {
     assertSafeManagedPaths();
   }
 
-  setListener(listener: PlatformConfigApplyListener): void {
-    this.listener = listener;
+  addListener(listener: PlatformConfigApplyListener): void {
+    this.listeners.add(listener);
   }
 
   definition(): ManagedModuleConfigDefinition {
@@ -45,6 +95,7 @@ export class PlatformConfigApplyAdapter {
           label: "AI 能力总开关",
           description: "控制 foundation 快照中的平台 AI 能力声明。",
           input: "boolean",
+          applyMode: "live",
         },
         {
           path: "cache.healthTimeoutMs",
@@ -53,29 +104,208 @@ export class PlatformConfigApplyAdapter {
           input: "integer",
           minimum: 50,
           maximum: 10_000,
+          applyMode: "live",
+        },
+        integerField(
+          "security.sessionTtlSeconds",
+          "会话有效期",
+          "控制新创建会话的有效期，单位为秒；已存在会话保持原过期时间。",
+          60,
+          2_592_000,
+        ),
+        integerField(
+          "security.passwordMinLength",
+          "密码最小长度",
+          "修改或重置密码时立即使用的新最小长度。",
+          8,
+          128,
+        ),
+        integerField(
+          "security.passwordMaxLength",
+          "密码最大长度",
+          "修改或重置密码时立即使用的新最大长度。",
+          12,
+          512,
+        ),
+        integerField(
+          "storage.bulkDataMaxByteSize",
+          "批量数据文件上限",
+          "批量导入导出上传的最大字节数。",
+          1024,
+          10 * 1024 ** 3,
+        ),
+        integerField(
+          "storage.brandingLogoMaxByteSize",
+          "品牌 Logo 文件上限",
+          "品牌 Logo 上传的最大字节数。",
+          1024,
+          50 * 1024 ** 2,
+        ),
+        restartBooleanField(
+          "mail.enabled",
+          "启用邮件传输配置",
+          "控制邮件传输配置是否启用；仍需安装业务邮件发送 Adapter。",
+        ),
+        restartTextField("mail.host", "SMTP 主机", "SMTP 服务主机名。"),
+        restartIntegerField(
+          "mail.port",
+          "SMTP 端口",
+          "SMTP 服务端口。",
+          1,
+          65_535,
+        ),
+        restartBooleanField(
+          "mail.secure",
+          "SMTP TLS 直连",
+          "启用后使用 TLS 直连；STARTTLS 由后续邮件 Adapter 处理。",
+        ),
+        restartTextField(
+          "mail.fromAddress",
+          "默认发件地址",
+          "邮件 Adapter 使用的默认 From 地址。",
+        ),
+        restartIntegerField(
+          "mail.connectTimeoutMs",
+          "SMTP 连接超时",
+          "邮件 Adapter 建立连接的超时时间，单位为毫秒。",
+          100,
+          120_000,
+        ),
+        {
+          path: "regional.timeZone",
+          label: "显示时区",
+          description: "平台日期时间展示使用的 IANA 时区，例如 Asia/Shanghai。",
+          input: "text",
+          applyMode: "live",
         },
       ],
-      validate: (values) => platformValuesSchema.parse(values),
+      validate: (values) =>
+        this.parse({
+          ...this.values(),
+          ...(isRecord(values) ? values : {}),
+        }),
       apply: (values) => this.apply(values),
       baseValues: () => this.values(),
     };
   }
 
   private apply(values: ModuleConfigValues): void {
-    const parsed = platformValuesSchema.parse(values);
+    const parsed = this.parse(values);
     this.config.enableAI = parsed.enableAI;
     this.config.cache.healthTimeoutMs = parsed["cache.healthTimeoutMs"];
-    this.listener?.applied(this.config);
+    this.config.security.sessionTtlSeconds =
+      parsed["security.sessionTtlSeconds"];
+    this.config.security.passwordMinLength =
+      parsed["security.passwordMinLength"];
+    this.config.security.passwordMaxLength =
+      parsed["security.passwordMaxLength"];
+    this.config.storage.bulkDataMaxByteSize =
+      parsed["storage.bulkDataMaxByteSize"];
+    this.config.storage.brandingLogoMaxByteSize =
+      parsed["storage.brandingLogoMaxByteSize"];
+    this.config.mail.enabled = parsed["mail.enabled"];
+    this.config.mail.host = parsed["mail.host"];
+    this.config.mail.port = parsed["mail.port"];
+    this.config.mail.secure = parsed["mail.secure"];
+    this.config.mail.fromAddress = parsed["mail.fromAddress"];
+    this.config.mail.connectTimeoutMs = parsed["mail.connectTimeoutMs"];
+    this.config.regional.timeZone = parsed["regional.timeZone"];
+    for (const listener of this.listeners) listener.applied(this.config);
+  }
+
+  private parse(values: unknown) {
+    const parsed = platformValuesSchema.parse(values);
+    if (
+      parsed["mail.enabled"] &&
+      (!parsed["mail.fromAddress"] ||
+        (!parsed["mail.host"] && !this.config.mail.smtpUrl))
+    ) {
+      throw new Error("邮件传输配置不完整");
+    }
+    return parsed;
   }
 
   private values(): ModuleConfigValues {
     return {
       enableAI: this.config.enableAI,
       "cache.healthTimeoutMs": this.config.cache.healthTimeoutMs,
+      "security.sessionTtlSeconds": this.config.security.sessionTtlSeconds,
+      "security.passwordMinLength": this.config.security.passwordMinLength,
+      "security.passwordMaxLength": this.config.security.passwordMaxLength,
+      "storage.bulkDataMaxByteSize": this.config.storage.bulkDataMaxByteSize,
+      "storage.brandingLogoMaxByteSize":
+        this.config.storage.brandingLogoMaxByteSize,
+      "mail.enabled": this.config.mail.enabled,
+      "mail.host": this.config.mail.host,
+      "mail.port": this.config.mail.port,
+      "mail.secure": this.config.mail.secure,
+      "mail.fromAddress": this.config.mail.fromAddress,
+      "mail.connectTimeoutMs": this.config.mail.connectTimeoutMs,
+      "regional.timeZone": this.config.regional.timeZone,
     };
   }
 }
 
+function integerField(
+  path: string,
+  label: string,
+  description: string,
+  minimum: number,
+  maximum: number,
+): ModuleConfigFieldDescriptor {
+  return {
+    path,
+    label,
+    description,
+    input: "integer",
+    applyMode: "live",
+    minimum,
+    maximum,
+  };
+}
+
+function restartIntegerField(
+  path: string,
+  label: string,
+  description: string,
+  minimum: number,
+  maximum: number,
+): ModuleConfigFieldDescriptor {
+  return {
+    ...integerField(path, label, description, minimum, maximum),
+    applyMode: "restart",
+  };
+}
+
+function restartBooleanField(
+  path: string,
+  label: string,
+  description: string,
+): ModuleConfigFieldDescriptor {
+  return { path, label, description, input: "boolean", applyMode: "restart" };
+}
+
+function restartTextField(
+  path: string,
+  label: string,
+  description: string,
+): ModuleConfigFieldDescriptor {
+  return { path, label, description, input: "text", applyMode: "restart" };
+}
+
+function isSupportedTimeZone(value: string): boolean {
+  try {
+    new Intl.DateTimeFormat("zh-CN", { timeZone: value });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
 function assertSafeManagedPaths(): void {
   const fields = new Map(
     platformConfigDefinition.environment.map((field) => [field.path, field]),

package/template/apps/server/src/configuration/drizzle-repository.ts

@@ -1,7 +1,7 @@
 import { randomUUIDv7 } from "bun";
 import { moduleConfigVersions } from "@southwind-ai/database";
 import type { ModuleConfigVersion } from "@southwind-ai/shared";
-import { and, desc, eq, ne, sql } from "drizzle-orm";
+import { and, desc, eq, inArray, ne, sql } from "drizzle-orm";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type {
   BeginConfigVersionInput,
@@ -58,7 +58,10 @@ export class DrizzleModuleConfigVersionRepository implements ModuleConfigVersion
         .where(
           and(
             eq(moduleConfigVersions.moduleKey, candidate.moduleKey),
-            eq(moduleConfigVersions.applyStatus, "effective"),
+            inArray(moduleConfigVersions.applyStatus, [
+              "effective",
+              "pending-restart",
+            ]),
             ne(moduleConfigVersions.id, id),
           ),
         );
@@ -84,6 +87,37 @@ export class DrizzleModuleConfigVersionRepository implements ModuleConfigVersion
     return mapRequired(updated);
   }
 
+  async markPendingRestart(id: string): Promise<ModuleConfigVersion> {
+    return this.db.transaction(async (tx) => {
+      const [candidate] = await tx
+        .select()
+        .from(moduleConfigVersions)
+        .where(eq(moduleConfigVersions.id, id))
+        .limit(1);
+      if (!candidate) throw new Error("配置版本不存在");
+      await tx
+        .update(moduleConfigVersions)
+        .set({ applyStatus: "superseded" })
+        .where(
+          and(
+            eq(moduleConfigVersions.moduleKey, candidate.moduleKey),
+            eq(moduleConfigVersions.applyStatus, "pending-restart"),
+            ne(moduleConfigVersions.id, id),
+          ),
+        );
+      const [updated] = await tx
+        .update(moduleConfigVersions)
+        .set({
+          applyStatus: "pending-restart",
+          applyError: null,
+          appliedAt: null,
+        })
+        .where(eq(moduleConfigVersions.id, id))
+        .returning();
+      return mapRequired(updated);
+    });
+  }
+
   latest(moduleKey: string): Promise<ModuleConfigVersion | undefined> {
     return this.first(moduleKey);
   }

package/template/apps/server/src/configuration/repository.ts

@@ -18,6 +18,7 @@ export interface BeginConfigVersionInput {
 export interface ModuleConfigVersionRepository {
   begin(input: BeginConfigVersionInput): Promise<ModuleConfigVersion>;
   markEffective(id: string, appliedAt: Date): Promise<ModuleConfigVersion>;
+  markPendingRestart(id: string): Promise<ModuleConfigVersion>;
   markFailed(
     id: string,
     applyError: string,
@@ -61,7 +62,8 @@ export class InMemoryModuleConfigVersionRepository implements ModuleConfigVersio
     for (const candidate of this.versions) {
       if (
         candidate.moduleKey === version.moduleKey &&
-        candidate.applyStatus === "effective"
+        (candidate.applyStatus === "effective" ||
+          candidate.applyStatus === "pending-restart")
       ) {
         candidate.applyStatus = "superseded";
       }
@@ -84,6 +86,23 @@ export class InMemoryModuleConfigVersionRepository implements ModuleConfigVersio
     return cloneVersion(version);
   }
 
+  async markPendingRestart(id: string): Promise<ModuleConfigVersion> {
+    const version = this.required(id);
+    for (const candidate of this.versions) {
+      if (
+        candidate.id !== id &&
+        candidate.moduleKey === version.moduleKey &&
+        candidate.applyStatus === "pending-restart"
+      ) {
+        candidate.applyStatus = "superseded";
+      }
+    }
+    version.applyStatus = "pending-restart";
+    version.applyError = undefined;
+    version.appliedAt = undefined;
+    return cloneVersion(version);
+  }
+
   async latest(moduleKey: string): Promise<ModuleConfigVersion | undefined> {
     return this.sorted(moduleKey)[0];
   }
@@ -134,5 +153,11 @@ export function cloneVersion(
 }
 
 export function isApplyStatus(value: string): value is ModuleConfigApplyStatus {
-  return ["applying", "effective", "failed", "superseded"].includes(value);
+  return [
+    "applying",
+    "effective",
+    "failed",
+    "pending-restart",
+    "superseded",
+  ].includes(value);
 }

package/template/apps/server/src/configuration/routes.ts

@@ -176,7 +176,10 @@ function recordResult(
   version: ModuleConfigVersion,
 ): void {
   const outcome: AuditOutcome =
-    version.applyStatus === "effective" ? "success" : "failure";
+    version.applyStatus === "effective" ||
+    version.applyStatus === "pending-restart"
+      ? "success"
+      : "failure";
   runtime.auditSink.recordEvent({
     ...resourceEvent(
       context,