create-windy 0.2.34 → 0.3.1

package/template/packages/modules/src/system-api-operational.ts

@@ -0,0 +1,234 @@
+import type { ApiPermissionBinding } from "@southwind-ai/shared";
+// oxlint-disable-next-line no-unused-vars -- 可选模块全部裁剪后该导入仍需保留类型稳定的生成源码。
+import { binding } from "./system-api-binding.js";
+
+export function systemOperationalApiPermissionBindings(): ApiPermissionBinding[] {
+  return [
+    // @windy-module system.storage begin
+    binding(
+      "POST",
+      "/api/system/storage/uploads",
+      "system.storage.create",
+      "system.storage",
+    ),
+    binding(
+      "GET",
+      "/api/system/storage/uploads/:id",
+      "system.storage.create",
+      "system.storage",
+    ),
+    binding(
+      "PUT",
+      "/api/system/storage/uploads/:id/parts/:partNumber",
+      "system.storage.create",
+      "system.storage",
+    ),
+    binding(
+      "POST",
+      "/api/system/storage/uploads/:id/complete",
+      "system.storage.create",
+      "system.storage",
+    ),
+    binding(
+      "DELETE",
+      "/api/system/storage/uploads/:id",
+      "system.storage.create",
+      "system.storage",
+    ),
+    binding(
+      "GET",
+      "/api/system/storage/files/:id",
+      "system.storage.read",
+      "system.storage",
+    ),
+    binding(
+      "GET",
+      "/api/platform/files/:id",
+      "system.settings.read",
+      "system.settings",
+      true,
+    ),
+    // @windy-module system.storage end
+    // @windy-module system.operations begin
+    binding("GET", "/api/system/operations", "system.ops.read", "system.ops"),
+    // @windy-module system.operations end
+    // @windy-module system.notification begin
+    binding(
+      "GET",
+      "/api/notifications",
+      "system.notification.read",
+      "system.notification",
+    ),
+    binding(
+      "GET",
+      "/api/notifications/preferences",
+      "system.notification.read",
+      "system.notification",
+    ),
+    binding(
+      "PUT",
+      "/api/notifications/preferences",
+      "system.notification.read",
+      "system.notification",
+    ),
+    binding(
+      "POST",
+      "/api/notifications/:id/read",
+      "system.notification.read",
+      "system.notification",
+    ),
+    binding(
+      "PUT",
+      "/api/notifications/:id/favorite",
+      "system.notification.read",
+      "system.notification",
+    ),
+    binding(
+      "DELETE",
+      "/api/notifications/:id/favorite",
+      "system.notification.read",
+      "system.notification",
+    ),
+    binding(
+      "GET",
+      "/api/system/notifications/audience-options",
+      "system.notification.manage",
+      "system.notification",
+    ),
+    binding(
+      "GET",
+      "/api/system/notifications/:id/deliveries",
+      "system.notification.manage",
+      "system.notification",
+    ),
+    binding(
+      "GET",
+      "/api/system/notifications",
+      "system.notification.manage",
+      "system.notification",
+    ),
+    binding(
+      "POST",
+      "/api/system/notifications",
+      "system.notification.manage",
+      "system.notification",
+    ),
+    binding(
+      "PUT",
+      "/api/system/notifications/:id",
+      "system.notification.update",
+      "system.notification",
+    ),
+    binding(
+      "GET",
+      "/api/system/notifications/:id/revisions",
+      "system.notification.manage",
+      "system.notification",
+    ),
+    binding(
+      "DELETE",
+      "/api/system/notifications/:id",
+      "system.notification.manage",
+      "system.notification",
+    ),
+    // @windy-module system.notification end
+    // @windy-module system.workflow begin
+    binding(
+      "GET",
+      "/api/workflow/work-items",
+      "system.workflow.read",
+      "system.workflow",
+    ),
+    binding(
+      "GET",
+      "/api/workflow/work-items/:id",
+      "system.workflow.read",
+      "system.workflow",
+    ),
+    binding(
+      "GET",
+      "/api/workflow/work-items/:id/history",
+      "system.workflow.read",
+      "system.workflow",
+    ),
+    binding(
+      "POST",
+      "/api/workflow/work-items",
+      "system.workflow.create",
+      "system.workflow",
+    ),
+    ...["claim", "transfer", "approve", "reject", "cancel"].map((command) =>
+      binding(
+        "POST",
+        `/api/workflow/work-items/:id/${command}`,
+        "system.workflow.approve",
+        "system.workflow",
+      ),
+    ),
+    // @windy-module system.workflow end
+    // @windy-module system.scheduler begin
+    binding(
+      "GET",
+      "/api/system/scheduled-tasks",
+      "system.scheduler.read",
+      "system.scheduler",
+    ),
+    binding(
+      "GET",
+      "/api/system/scheduled-task-runs",
+      "system.scheduler.read",
+      "system.scheduler",
+    ),
+    binding(
+      "GET",
+      "/api/system/operations/scheduler",
+      "system.scheduler.read",
+      "system.scheduler",
+    ),
+    binding(
+      "POST",
+      "/api/system/scheduled-tasks/:id/trigger",
+      "system.scheduler.manage",
+      "system.scheduler",
+    ),
+    binding(
+      "POST",
+      "/api/system/scheduled-tasks/:id/runs/:runId/recover",
+      "system.scheduler.manage",
+      "system.scheduler",
+    ),
+    // @windy-module system.scheduler end
+    // @windy-module system.bulk-data begin
+    binding(
+      "GET",
+      "/api/system/bulk-data/jobs",
+      "system.dict.read",
+      "system.bulk-data",
+    ),
+    binding(
+      "GET",
+      "/api/system/bulk-data/jobs/:id",
+      "system.dict.read",
+      "system.bulk-data",
+    ),
+    binding(
+      "GET",
+      "/api/system/bulk-data/jobs/:id/artifacts/:kind",
+      "system.dict.read",
+      "system.bulk-data",
+    ),
+    binding(
+      "POST",
+      "/api/system/bulk-data/dictionaries/import",
+      "system.dict.manage",
+      "system.bulk-data",
+    ),
+    binding(
+      "POST",
+      "/api/system/bulk-data/dictionaries/export",
+      "system.dict.read",
+      "system.bulk-data",
+    ),
+    // @windy-module system.bulk-data end
+  ];
+}

package/template/packages/modules/src/system-api-permissions.ts

@@ -1,4 +1,7 @@
 import type { ApiPermissionBinding } from "@southwind-ai/shared";
+// @windy-module system.agent begin
+import { MCP_API_PATH } from "@southwind-ai/shared";
+// @windy-module system.agent end
 import { binding, resourceBindings } from "./system-api-binding.js";
 // @windy-module system.settings begin
 import { watermarkApiPermissionBindings } from "./system-api-watermark.js";
@@ -6,6 +9,7 @@ import { watermarkApiPermissionBindings } from "./system-api-watermark.js";
 // @windy-module system.data-governance begin
 import { dataGovernanceApiPermissionBindings } from "./system-api-data-governance.js";
 // @windy-module system.data-governance end
+import { systemOperationalApiPermissionBindings } from "./system-api-operational.js";
 
 export function systemApiPermissionBindings(): ApiPermissionBinding[] {
   return [
@@ -26,9 +30,9 @@ export function systemApiPermissionBindings(): ApiPermissionBinding[] {
     binding("POST", "/api/search", "system.search.read", "system.search"),
     // @windy-module system.search end
     // @windy-module system.agent begin
-    binding("GET", "/api/mcp", "system.agent.read", "system.agent"),
-    binding("POST", "/api/mcp", "system.agent.read", "system.agent"),
-    binding("DELETE", "/api/mcp", "system.agent.read", "system.agent"),
+    binding("GET", MCP_API_PATH, "system.agent.read", "system.agent"),
+    binding("POST", MCP_API_PATH, "system.agent.read", "system.agent"),
+    binding("DELETE", MCP_API_PATH, "system.agent.read", "system.agent"),
     // @windy-module system.agent end
     ...resourceBindings({
       path: "users",
@@ -61,6 +65,12 @@ export function systemApiPermissionBindings(): ApiPermissionBinding[] {
       "system.department.create",
       "system.rbac",
     ),
+    binding(
+      "POST",
+      "/api/system/departments/:id/transition",
+      "system.department.manage",
+      "system.rbac",
+    ),
     binding("GET", "/api/system/menus", "system.menu.read", "system.rbac"),
     binding(
       "GET",
@@ -171,183 +181,6 @@ export function systemApiPermissionBindings(): ApiPermissionBinding[] {
       "system.audit",
     ),
     // @windy-module system.audit end
-    // @windy-module system.storage begin
-    binding(
-      "POST",
-      "/api/system/storage/uploads",
-      "system.storage.create",
-      "system.storage",
-    ),
-    binding(
-      "GET",
-      "/api/system/storage/uploads/:id",
-      "system.storage.create",
-      "system.storage",
-    ),
-    binding(
-      "PUT",
-      "/api/system/storage/uploads/:id/parts/:partNumber",
-      "system.storage.create",
-      "system.storage",
-    ),
-    binding(
-      "POST",
-      "/api/system/storage/uploads/:id/complete",
-      "system.storage.create",
-      "system.storage",
-    ),
-    binding(
-      "DELETE",
-      "/api/system/storage/uploads/:id",
-      "system.storage.create",
-      "system.storage",
-    ),
-    binding(
-      "GET",
-      "/api/system/storage/files/:id",
-      "system.storage.read",
-      "system.storage",
-    ),
-    binding(
-      "GET",
-      "/api/platform/files/:id",
-      "system.settings.read",
-      "system.settings",
-      true,
-    ),
-    // @windy-module system.storage end
-    // @windy-module system.operations begin
-    binding("GET", "/api/system/operations", "system.ops.read", "system.ops"),
-    // @windy-module system.operations end
-    // @windy-module system.notification begin
-    binding(
-      "GET",
-      "/api/notifications",
-      "system.notification.read",
-      "system.notification",
-    ),
-    binding(
-      "POST",
-      "/api/notifications/:id/read",
-      "system.notification.read",
-      "system.notification",
-    ),
-    binding(
-      "GET",
-      "/api/system/notifications",
-      "system.notification.manage",
-      "system.notification",
-    ),
-    binding(
-      "POST",
-      "/api/system/notifications",
-      "system.notification.manage",
-      "system.notification",
-    ),
-    binding(
-      "DELETE",
-      "/api/system/notifications/:id",
-      "system.notification.manage",
-      "system.notification",
-    ),
-    // @windy-module system.notification end
-    // @windy-module system.workflow begin
-    binding(
-      "GET",
-      "/api/workflow/work-items",
-      "system.workflow.read",
-      "system.workflow",
-    ),
-    binding(
-      "GET",
-      "/api/workflow/work-items/:id",
-      "system.workflow.read",
-      "system.workflow",
-    ),
-    binding(
-      "GET",
-      "/api/workflow/work-items/:id/history",
-      "system.workflow.read",
-      "system.workflow",
-    ),
-    binding(
-      "POST",
-      "/api/workflow/work-items",
-      "system.workflow.create",
-      "system.workflow",
-    ),
-    ...["claim", "transfer", "approve", "reject", "cancel"].map((command) =>
-      binding(
-        "POST",
-        `/api/workflow/work-items/:id/${command}`,
-        "system.workflow.approve",
-        "system.workflow",
-      ),
-    ),
-    // @windy-module system.workflow end
-    // @windy-module system.scheduler begin
-    binding(
-      "GET",
-      "/api/system/scheduled-tasks",
-      "system.scheduler.read",
-      "system.scheduler",
-    ),
-    binding(
-      "GET",
-      "/api/system/scheduled-task-runs",
-      "system.scheduler.read",
-      "system.scheduler",
-    ),
-    binding(
-      "GET",
-      "/api/system/operations/scheduler",
-      "system.scheduler.read",
-      "system.scheduler",
-    ),
-    binding(
-      "POST",
-      "/api/system/scheduled-tasks/:id/trigger",
-      "system.scheduler.manage",
-      "system.scheduler",
-    ),
-    binding(
-      "POST",
-      "/api/system/scheduled-tasks/:id/runs/:runId/recover",
-      "system.scheduler.manage",
-      "system.scheduler",
-    ),
-    // @windy-module system.scheduler end
-    // @windy-module system.bulk-data begin
-    binding(
-      "GET",
-      "/api/system/bulk-data/jobs",
-      "system.dict.read",
-      "system.bulk-data",
-    ),
-    binding(
-      "GET",
-      "/api/system/bulk-data/jobs/:id",
-      "system.dict.read",
-      "system.bulk-data",
-    ),
-    binding(
-      "GET",
-      "/api/system/bulk-data/jobs/:id/artifacts/:kind",
-      "system.dict.read",
-      "system.bulk-data",
-    ),
-    binding(
-      "POST",
-      "/api/system/bulk-data/dictionaries/import",
-      "system.dict.manage",
-      "system.bulk-data",
-    ),
-    binding(
-      "POST",
-      "/api/system/bulk-data/dictionaries/export",
-      "system.dict.read",
-      "system.bulk-data",
-    ),
-    // @windy-module system.bulk-data end
+    ...systemOperationalApiPermissionBindings(),
   ];
 }

package/template/packages/modules/src/system-audit-actions.ts

@@ -22,9 +22,19 @@ export const systemAuditActions: ModuleManifest["auditActions"] = [
   // @windy-module system.license end
   "feature.update",
   "menu.structure.update",
+  {
+    key: "organization.department.transition",
+    label: "处置部门组织",
+    description: "迁移部门关联后停用或删除部门。",
+  },
   // @windy-module system.notification begin
   "notification.publish",
+  "notification.schedule",
+  "notification.preference.update",
+  "notification.update",
   "notification.read",
+  "notification.favorite",
+  "notification.unfavorite",
   "notification.archive",
   // @windy-module system.notification end
   // @windy-module system.workflow begin

package/template/packages/modules/src/system-features.ts

@@ -90,7 +90,7 @@ export const systemFeatures: ModuleManifest["features"] = [
   feature(
     "system.notification",
     "站内通知",
-    "站内通知发布、管理、阅读和已读状态闭环。",
+    "站内通知发布、修改历史、阅读、收藏和已读状态闭环。",
   ),
   // @windy-module system.notification end
   // @windy-module system.workflow begin

package/template/packages/modules/src/system-module-catalog.ts

@@ -124,7 +124,8 @@ export const systemModuleDefinitions = [
     name: "system.notification",
     version: "0.1.0",
     label: "站内通知",
-    description: "通知发布、阅读、归档与状态管理。",
+    description:
+      "通知定向与定时发布、用户偏好、外部渠道投递、修改历史、阅读、收藏和归档。",
     resources: ["notification"],
     featureKeys: ["system.notification"],
   },

package/template/packages/modules/src/system-module-tasks.ts

@@ -0,0 +1,86 @@
+import type { ModuleManifest } from "./manifest.js";
+
+export const systemModuleTasks: ModuleManifest["tasks"] = [
+  // @windy-module system.scheduler begin
+  {
+    key: "system.scheduler.health-snapshot",
+    label: "调度器健康快照",
+    description: "周期验证调度、Guard、执行历史和重试链路可用。",
+    permissionKey: "system.scheduler.manage",
+    featureKey: "system.scheduler",
+    intervalSeconds: 300,
+    maxAttempts: 3,
+    retryDelaySeconds: 30,
+  },
+  // @windy-module system.scheduler end
+  // @windy-module system.notification begin
+  {
+    key: "system.notification.dispatch",
+    label: "通知发布与外部投递",
+    description: "发布到期通知并领取持久投递队列，执行渠道重试。",
+    permissionKey: "system.notification.manage",
+    featureKey: "system.notification",
+    intervalSeconds: 5,
+    maxAttempts: 3,
+    retryDelaySeconds: 30,
+  },
+  // @windy-module system.notification end
+  // @windy-module system.bulk-data begin
+  {
+    key: "system.bulk-data.dispatch",
+    label: "批量数据任务派发",
+    description: "领取一个已排队或到期重试的批量导入导出任务。",
+    permissionKey: "system.bulk-data.manage",
+    featureKey: "system.bulk-data",
+    intervalSeconds: 5,
+    maxAttempts: 3,
+    retryDelaySeconds: 30,
+  },
+  {
+    key: "system.bulk-data.cleanup",
+    label: "批量数据文件清理",
+    description: "清理超过留存期限的源文件、结果和失败明细。",
+    permissionKey: "system.bulk-data.manage",
+    featureKey: "system.bulk-data",
+    intervalSeconds: 3_600,
+    maxAttempts: 3,
+    retryDelaySeconds: 60,
+  },
+  // @windy-module system.bulk-data end
+  // @windy-module system.storage begin
+  {
+    key: "system.storage.cleanup",
+    label: "文件存储清理",
+    description: "清理过期上传、文件、临时分片和超过宽限期的孤儿对象。",
+    permissionKey: "system.storage.manage",
+    featureKey: "system.storage",
+    intervalSeconds: 3_600,
+    maxAttempts: 3,
+    retryDelaySeconds: 60,
+  },
+  // @windy-module system.storage end
+  // @windy-module system.workflow begin
+  {
+    key: "system.workflow.timeout-dispatch",
+    label: "审批超时派发",
+    description: "补偿登记并执行一个到期审批任务，进程重启后继续处理。",
+    permissionKey: "system.workflow.manage",
+    featureKey: "system.workflow",
+    intervalSeconds: 5,
+    maxAttempts: 3,
+    retryDelaySeconds: 30,
+  },
+  // @windy-module system.workflow end
+  // @windy-module system.data-governance begin
+  {
+    key: "system.governed-export.dispatch",
+    label: "受治理导出派发",
+    description: "领取并执行一个已批准的敏感数据导出任务。",
+    permissionKey: "system.user.export",
+    featureKey: "system.rbac",
+    intervalSeconds: 5,
+    maxAttempts: 3,
+    retryDelaySeconds: 30,
+  },
+  // @windy-module system.data-governance end
+];

package/template/packages/modules/src/system-modules-access.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, test } from "bun:test";
+// @windy-module system.agent begin
+import { MCP_API_PATH } from "@southwind-ai/shared";
+// @windy-module system.agent end
+import { systemFoundationModule } from "./system-modules.js";
+
+describe("系统模块管理面与 MCP 注册", () => {
+  test("管理面准入使用独立 Feature 与 access 权限", () => {
+    const manifest = systemFoundationModule();
+
+    expect(manifest.features).toContainEqual(
+      expect.objectContaining({ key: "system.admin", enabled: true }),
+    );
+    expect(manifest.permissions).toContainEqual(
+      expect.objectContaining({
+        key: "system.admin.access",
+        action: "access",
+      }),
+    );
+    expect(manifest.apiPermissions).toContainEqual({
+      method: "GET",
+      path: "/api/admin/bootstrap",
+      permissionKey: "system.admin.access",
+      featureKey: "system.admin",
+      anonymous: undefined,
+    });
+  });
+
+  // @windy-module system.agent begin
+  test("MCP Streamable HTTP 入口统一绑定 Agent Feature 与读取权限", () => {
+    const bindings = systemFoundationModule().apiPermissions.filter(
+      ({ path }) => path === MCP_API_PATH,
+    );
+
+    expect(bindings).toEqual([
+      {
+        method: "GET",
+        path: MCP_API_PATH,
+        permissionKey: "system.agent.read",
+        featureKey: "system.agent",
+        anonymous: undefined,
+      },
+      {
+        method: "POST",
+        path: MCP_API_PATH,
+        permissionKey: "system.agent.read",
+        featureKey: "system.agent",
+        anonymous: undefined,
+      },
+      {
+        method: "DELETE",
+        path: MCP_API_PATH,
+        permissionKey: "system.agent.read",
+        featureKey: "system.agent",
+        anonymous: undefined,
+      },
+    ]);
+  });
+  // @windy-module system.agent end
+});