create-windy 0.2.5 → 0.2.6

package/template/apps/web/src/router/index.webtest.ts

@@ -1,56 +1,19 @@
 import { describe, expect, test } from "vitest";
 import { createMemoryHistory } from "vue-router";
-import { systemFoundationModule } from "@windy/modules";
-import type { WebAccessSnapshot } from "@/layout/navigation";
-import type { PlatformLicenseSnapshot } from "@/services/license-api";
 import { ApiError } from "@/services/http";
-import { safeReturnTo } from "./auth-navigation";
-import { createAppRouter, routes } from "./index";
-
-describe("Manifest 菜单与 Router 契约", () => {
-  test("路由默认要求登录，只有显式 public 的页面允许匿名访问", () => {
-    const publicRoutes = routes.filter((route) => route.meta?.public === true);
-
-    expect(publicRoutes.map((route) => route.path)).toEqual(["/login"]);
-    expect(routes.find((route) => route.path === "/")?.meta?.public).not.toBe(
-      true,
-    );
-    expect(
-      routes.find((route) => route.path === "/admin")?.meta?.public,
-    ).not.toBe(true);
-  });
-
-  test("每个 Admin Route 都由真实页面实现且 Guard 来自 Manifest", () => {
-    const manifests = [systemFoundationModule()];
-    const definitions = manifests.flatMap((manifest) => manifest.adminRoutes);
-    const implementationByKey = new Map(
-      routes.flatMap((route) => {
-        const key = route.meta?.manifestRouteKey;
-        return typeof key === "string" ? [[key, route] as const] : [];
-      }),
-    );
-
-    expect([...implementationByKey.keys()].sort()).toEqual(
-      definitions.map(({ key }) => key).sort(),
-    );
-    for (const definition of definitions) {
-      const route = implementationByKey.get(definition.key);
-      expect(route?.path).toBe(definition.path);
-      expect(route?.meta?.title).toBe(definition.title);
-      if (definition.directAccess !== "authenticated") {
-        expect(route?.meta?.permissionKey).toBe(definition.permissionKey);
-        expect(route?.meta?.featureKey).toBe(definition.featureKey);
-      }
-    }
-    expect(definitions.some(({ path }) => path === "/admin/profile")).toBe(
-      true,
-    );
-    expect(definitions.some(({ path }) => path === "/work-orders")).toBe(false);
-    expect(routes.some(({ path }) => path === "/work-orders")).toBe(false);
-  });
-});
+import { createAppRouter } from "./index";
+import {
+  accessSnapshot,
+  authProvider,
+  // @windy-module system.license begin
+  licenseProvider,
+  licenseSnapshot,
+  // @windy-module system.license end
+  provider,
+} from "./router-test-fixtures";
 
 describe("Web 路由强制访问", () => {
+  // @windy-module system.license begin
   test("普通业务账号可进入首页且不会加载管理面或 License 快照", async () => {
     let accessRefreshes = 0;
     let licenseRefreshes = 0;
@@ -78,12 +41,15 @@ describe("Web 路由强制访问", () => {
     expect(accessRefreshes).toBe(0);
     expect(licenseRefreshes).toBe(0);
   });
+  // @windy-module system.license end
 
   test("拥有管理面准入权限的管理员可进入管理后台", async () => {
     const router = createAppRouter(
       createMemoryHistory(),
       provider(accessSnapshot()),
+      // @windy-module system.license begin
       licenseProvider(),
+      // @windy-module system.license end
       authProvider(),
     );
 
@@ -100,7 +66,9 @@ describe("Web 路由强制访问", () => {
         refresh: async () =>
           Promise.reject(new ApiError("admin access denied", 403)),
       },
+      // @windy-module system.license begin
       licenseProvider(),
+      // @windy-module system.license end
       authProvider(),
     );
 
@@ -119,7 +87,9 @@ describe("Web 路由强制访问", () => {
     const router = createAppRouter(
       createMemoryHistory(),
       provider(snapshot),
+      // @windy-module system.license begin
       licenseProvider(),
+      // @windy-module system.license end
       authProvider(),
     );
 
@@ -138,7 +108,9 @@ describe("Web 路由强制访问", () => {
     const router = createAppRouter(
       createMemoryHistory(),
       provider(snapshot),
+      // @windy-module system.license begin
       licenseProvider(),
+      // @windy-module system.license end
       authProvider(),
     );
     snapshot.features[0]!.allowed = false;
@@ -161,7 +133,9 @@ describe("Web 路由强制访问", () => {
     const router = createAppRouter(
       createMemoryHistory(),
       provider(snapshot),
+      // @windy-module system.license begin
       licenseProvider(),
+      // @windy-module system.license end
       authProvider(),
     );
 
@@ -183,7 +157,9 @@ describe("Web 路由强制访问", () => {
     const router = createAppRouter(
       createMemoryHistory(),
       provider(snapshot),
+      // @windy-module system.license begin
       licenseProvider(),
+      // @windy-module system.license end
       authProvider(),
     );
 
@@ -192,6 +168,7 @@ describe("Web 路由强制访问", () => {
     expect(router.currentRoute.value.path).toBe("/admin/profile");
   });
 
+  // @windy-module system.license begin
   test("到期后任意业务页面都进入 License 更新页且不会重定向循环", async () => {
     const snapshot = accessSnapshot();
     let accessRefreshes = 0;
@@ -232,165 +209,5 @@ describe("Web 路由强制访问", () => {
 
     expect(router.currentRoute.value.name).toBe("runtime-license");
   });
-
-  test("未认证直访受保护页面会保存安全 returnTo 并进入登录页", async () => {
-    const router = createAppRouter(
-      createMemoryHistory(),
-      provider(accessSnapshot()),
-      licenseProvider(),
-      authProvider("anonymous"),
-    );
-
-    await router.push("/admin/system/users?page=2");
-
-    expect(router.currentRoute.value.name).toBe("login");
-    expect(router.currentRoute.value.query.returnTo).toBe(
-      "/admin/system/users?page=2",
-    );
-  });
-
-  test("已认证用户访问登录页只接受站内绝对 returnTo", async () => {
-    const router = createAppRouter(
-      createMemoryHistory(),
-      provider(accessSnapshot()),
-      licenseProvider(),
-      authProvider(),
-    );
-
-    await router.push({
-      name: "login",
-      query: { returnTo: "https://evil.test" },
-    });
-
-    expect(router.currentRoute.value.path).toBe("/");
-  });
-
-  test("管理员重置后的账号只能进入强制改密页且不会重定向循环", async () => {
-    const session = authProvider();
-    session.actor.credentialState = "must-change-password";
-    const router = createAppRouter(
-      createMemoryHistory(),
-      provider(accessSnapshot()),
-      licenseProvider(),
-      session,
-    );
-
-    await router.push("/admin/system/users");
-    expect(router.currentRoute.value.name).toBe("change-password");
-
-    await router.push("/change-password");
-    expect(router.currentRoute.value.name).toBe("change-password");
-  });
-
-  test("会话服务异常不会被误判成未登录", async () => {
-    const router = createAppRouter(
-      createMemoryHistory(),
-      provider(accessSnapshot()),
-      licenseProvider(),
-      {
-        ensureInitialized: async () => Promise.reject(new Error("offline")),
-        clear() {},
-      },
-    );
-
-    await router.push("/admin/system/users");
-
-    expect(router.currentRoute.value.name).toBe("access-denied");
-    expect(router.currentRoute.value.query.reason).toBe("session-unavailable");
-  });
-
-  test("会话过期引发的 401 才会清退到登录页", async () => {
-    const router = createAppRouter(
-      createMemoryHistory(),
-      provider(accessSnapshot()),
-      { refresh: async () => Promise.reject(new ApiError("expired", 401)) },
-      authProvider(),
-    );
-
-    await router.push("/admin/system/license");
-
-    expect(router.currentRoute.value.name).toBe("login");
-    expect(router.currentRoute.value.query.returnTo).toBe(
-      "/admin/system/license",
-    );
-  });
-});
-
-describe("安全 returnTo", () => {
-  test("只接受应用内绝对路径并排除登录页自身", () => {
-    expect(safeReturnTo("/admin/system/users?tab=active#top")).toBe(
-      "/admin/system/users?tab=active#top",
-    );
-    expect(safeReturnTo("https://evil.test/admin/system/users")).toBe("/");
-    expect(safeReturnTo("//evil.test/admin/system/users")).toBe("/");
-    expect(safeReturnTo("/\\evil.test/admin/system/users")).toBe("/");
-    expect(safeReturnTo("/login?returnTo=/admin/system/users")).toBe("/");
-  });
+  // @windy-module system.license end
 });
-
-function provider(snapshot: WebAccessSnapshot) {
-  return { refresh: async () => snapshot };
-}
-
-function licenseProvider(restricted = false) {
-  const snapshot = licenseSnapshot(restricted);
-  return { refresh: async () => snapshot };
-}
-
-function licenseSnapshot(restricted = false): PlatformLicenseSnapshot {
-  return {
-    status: restricted ? "expired" : "valid",
-    restricted,
-    reminder: { level: "none" },
-    canViewDetails: false,
-  };
-}
-
-function authProvider(phase: "authenticated" | "anonymous" = "authenticated") {
-  let currentPhase = phase;
-  const actor = accessSnapshot().actor;
-  return {
-    actor,
-    ensureInitialized: async () => ({
-      phase: currentPhase,
-      actor: currentPhase === "authenticated" ? actor : undefined,
-    }),
-    clear() {
-      currentPhase = "anonymous";
-    },
-  };
-}
-
-function accessSnapshot(): WebAccessSnapshot {
-  return {
-    actor: {
-      id: "user_1",
-      type: "user",
-      name: "审计员",
-      roleCodes: ["auditor"],
-      permissionKeys: [
-        "system.admin.access",
-        "system.audit.read",
-        "system.feature.read",
-      ],
-    },
-    menus: [],
-    permissions: [],
-    features: [
-      {
-        key: "system.audit",
-        enabled: true,
-        visible: "visible",
-        allowed: true,
-        reason: "allowed",
-      },
-      {
-        key: "system.rbac",
-        enabled: true,
-        visible: "visible",
-        allowed: true,
-        reason: "allowed",
-      },
-    ],
-  };
-}

package/template/apps/web/src/router/manifest-routes.webtest.ts

@@ -0,0 +1,49 @@
+import { describe, expect, test } from "vitest";
+import { systemFoundationModule } from "@windy/modules";
+import { routes } from "./index";
+
+describe("Manifest 菜单与 Router 契约", () => {
+  test("路由默认要求登录，只有显式 public 的页面允许匿名访问", () => {
+    const publicRoutes = routes.filter((route) => route.meta?.public === true);
+
+    expect(publicRoutes.map((route) => route.path)).toEqual([
+      "/login",
+      "/service-unavailable",
+    ]);
+    expect(routes.find((route) => route.path === "/")?.meta?.public).not.toBe(
+      true,
+    );
+    expect(
+      routes.find((route) => route.path === "/admin")?.meta?.public,
+    ).not.toBe(true);
+  });
+
+  test("每个 Admin Route 都由真实页面实现且 Guard 来自 Manifest", () => {
+    const manifests = [systemFoundationModule()];
+    const definitions = manifests.flatMap((manifest) => manifest.adminRoutes);
+    const implementationByKey = new Map(
+      routes.flatMap((route) => {
+        const key = route.meta?.manifestRouteKey;
+        return typeof key === "string" ? [[key, route] as const] : [];
+      }),
+    );
+
+    expect([...implementationByKey.keys()].sort()).toEqual(
+      definitions.map(({ key }) => key).sort(),
+    );
+    for (const definition of definitions) {
+      const route = implementationByKey.get(definition.key);
+      expect(route?.path).toBe(definition.path);
+      expect(route?.meta?.title).toBe(definition.title);
+      if (definition.directAccess !== "authenticated") {
+        expect(route?.meta?.permissionKey).toBe(definition.permissionKey);
+        expect(route?.meta?.featureKey).toBe(definition.featureKey);
+      }
+    }
+    expect(definitions.some(({ path }) => path === "/admin/profile")).toBe(
+      true,
+    );
+    expect(definitions.some(({ path }) => path === "/work-orders")).toBe(false);
+    expect(routes.some(({ path }) => path === "/work-orders")).toBe(false);
+  });
+});

package/template/apps/web/src/router/router-test-fixtures.ts

@@ -0,0 +1,75 @@
+import type { WebAccessSnapshot } from "@/layout/navigation";
+// @windy-module system.license begin
+import type { PlatformLicenseSnapshot } from "@/services/license-api";
+// @windy-module system.license end
+
+export function provider(snapshot: WebAccessSnapshot) {
+  return { refresh: async () => snapshot };
+}
+
+// @windy-module system.license begin
+export function licenseProvider(restricted = false) {
+  const snapshot = licenseSnapshot(restricted);
+  return { refresh: async () => snapshot };
+}
+
+export function licenseSnapshot(restricted = false): PlatformLicenseSnapshot {
+  return {
+    status: restricted ? "expired" : "valid",
+    restricted,
+    reminder: { level: "none" },
+    canViewDetails: false,
+  };
+}
+// @windy-module system.license end
+
+export function authProvider(
+  phase: "authenticated" | "anonymous" = "authenticated",
+) {
+  let currentPhase = phase;
+  const actor = accessSnapshot().actor;
+  return {
+    actor,
+    ensureInitialized: async () => ({
+      phase: currentPhase,
+      actor: currentPhase === "authenticated" ? actor : undefined,
+    }),
+    clear() {
+      currentPhase = "anonymous";
+    },
+  };
+}
+
+export function accessSnapshot(): WebAccessSnapshot {
+  return {
+    actor: {
+      id: "user_1",
+      type: "user",
+      name: "审计员",
+      roleCodes: ["auditor"],
+      permissionKeys: [
+        "system.admin.access",
+        "system.audit.read",
+        "system.feature.read",
+      ],
+    },
+    menus: [],
+    permissions: [],
+    features: [
+      {
+        key: "system.audit",
+        enabled: true,
+        visible: "visible",
+        allowed: true,
+        reason: "allowed",
+      },
+      {
+        key: "system.rbac",
+        enabled: true,
+        visible: "visible",
+        allowed: true,
+        reason: "allowed",
+      },
+    ],
+  };
+}

package/template/package.json

@@ -10,7 +10,7 @@
   ],
   "scripts": {
     "prepare": "husky",
-    "dev": "bun run --cwd apps/web dev",
+    "dev": "bun run scripts/dev.ts",
     "dev:web": "bun run --cwd apps/web dev",
     "dev:server": "bun run --cwd apps/server dev",
     "dev:license": "bun run --cwd apps/license dev",

package/template/packages/database/src/schema/governance.ts

@@ -1,19 +1,24 @@
 // @windy-module system.license begin
 import { sql } from "drizzle-orm";
+import { timestamp as licenseTimestamp } from "drizzle-orm/pg-core";
+import { idColumn as licenseIdColumn } from "./common.js";
 // @windy-module system.license end
+// @windy-module system.audit begin
+import { timestamp as auditTimestamp } from "drizzle-orm/pg-core";
+import { idColumn as auditIdColumn } from "./common.js";
+// @windy-module system.audit end
 import {
   boolean,
   index,
   jsonb,
   pgTable,
   text,
-  timestamp,
   // @windy-module system.license begin
   uniqueIndex,
   // @windy-module system.license end
   varchar,
 } from "drizzle-orm/pg-core";
-import { auditColumns, idColumn, statusColumn } from "./common.js";
+import { auditColumns, statusColumn } from "./common.js";
 
 export const featureFlags = pgTable(
   "feature_flags",
@@ -43,7 +48,7 @@ export const featureFlags = pgTable(
 export const licenseOperators = pgTable(
   "license_operators",
   {
-    id: idColumn().primaryKey(),
+    id: licenseIdColumn().primaryKey(),
     username: varchar("username", { length: 80 }).notNull(),
     displayName: varchar("display_name", { length: 120 }).notNull(),
     tokenHash: varchar("token_hash", { length: 128 }),
@@ -51,13 +56,13 @@ export const licenseOperators = pgTable(
     role: varchar("role", { length: 40 }).notNull().default("readonly"),
     permissions: jsonb("permissions").$type<string[]>().notNull(),
     status: statusColumn().notNull(),
-    lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
-    createdAt: timestamp("created_at", { withTimezone: true })
+    lastUsedAt: licenseTimestamp("last_used_at", { withTimezone: true }),
+    createdAt: licenseTimestamp("created_at", { withTimezone: true })
       .notNull()
       .defaultNow(),
-    updatedAt: timestamp("updated_at", { withTimezone: true }),
+    updatedAt: licenseTimestamp("updated_at", { withTimezone: true }),
     updatedBy: varchar("updated_by", { length: 64 }),
-    disabledAt: timestamp("disabled_at", { withTimezone: true }),
+    disabledAt: licenseTimestamp("disabled_at", { withTimezone: true }),
     disabledBy: varchar("disabled_by", { length: 64 }),
   },
   (table) => [
@@ -69,18 +74,18 @@ export const licenseOperators = pgTable(
 export const licenseOperatorSessions = pgTable(
   "license_operator_sessions",
   {
-    id: idColumn().primaryKey(),
+    id: licenseIdColumn().primaryKey(),
     operatorId: varchar("operator_id", { length: 64 })
       .notNull()
       .references(() => licenseOperators.id, { onDelete: "restrict" }),
     tokenHash: varchar("token_hash", { length: 128 }).notNull(),
     status: statusColumn().notNull().default("active"),
-    issuedAt: timestamp("issued_at", { withTimezone: true })
+    issuedAt: licenseTimestamp("issued_at", { withTimezone: true })
       .notNull()
       .defaultNow(),
-    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
-    revokedAt: timestamp("revoked_at", { withTimezone: true }),
-    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }),
+    expiresAt: licenseTimestamp("expires_at", { withTimezone: true }).notNull(),
+    revokedAt: licenseTimestamp("revoked_at", { withTimezone: true }),
+    lastSeenAt: licenseTimestamp("last_seen_at", { withTimezone: true }),
     ip: varchar("ip", { length: 80 }),
     userAgent: text("user_agent"),
   },
@@ -95,7 +100,7 @@ export const licenseOperatorSessions = pgTable(
 export const licenseKeys = pgTable(
   "license_keys",
   {
-    id: idColumn().primaryKey(),
+    id: licenseIdColumn().primaryKey(),
     keyId: varchar("key_id", { length: 160 }).notNull(),
     publicKeyPem: text("public_key_pem").notNull(),
     algorithm: varchar("algorithm", { length: 40 })
@@ -103,11 +108,11 @@ export const licenseKeys = pgTable(
       .default("ED25519"),
     status: statusColumn().notNull(),
     rotatedFromKeyId: varchar("rotated_from_key_id", { length: 160 }),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
+    createdAt: licenseTimestamp("created_at", { withTimezone: true }).notNull(),
     createdBy: varchar("created_by", { length: 64 }).notNull(),
-    retiredAt: timestamp("retired_at", { withTimezone: true }),
+    retiredAt: licenseTimestamp("retired_at", { withTimezone: true }),
     retiredBy: varchar("retired_by", { length: 64 }),
-    retainUntil: timestamp("retain_until", { withTimezone: true }),
+    retainUntil: licenseTimestamp("retain_until", { withTimezone: true }),
   },
   (table) => [
     uniqueIndex("uk_license_keys_key_id").on(table.keyId),
@@ -121,13 +126,13 @@ export const licenseKeys = pgTable(
 export const licenseKeyCompatibilities = pgTable(
   "license_key_compatibilities",
   {
-    id: idColumn().primaryKey(),
+    id: licenseIdColumn().primaryKey(),
     productCode: varchar("product_code", { length: 120 }).notNull(),
     softwareVersion: varchar("software_version", { length: 80 }).notNull(),
     publicKeyId: varchar("public_key_id", { length: 160 })
       .notNull()
       .references(() => licenseKeys.keyId, { onDelete: "restrict" }),
-    declaredAt: timestamp("declared_at", { withTimezone: true })
+    declaredAt: licenseTimestamp("declared_at", { withTimezone: true })
       .notNull()
       .defaultNow(),
     declaredBy: varchar("declared_by", { length: 64 }).notNull(),
@@ -149,12 +154,12 @@ export const licenseKeyCompatibilities = pgTable(
 export const licenseGovernanceEvents = pgTable(
   "license_governance_events",
   {
-    id: idColumn().primaryKey(),
+    id: licenseIdColumn().primaryKey(),
     type: varchar("type", { length: 100 }).notNull(),
     resourceType: varchar("resource_type", { length: 80 }).notNull(),
     resourceId: varchar("resource_id", { length: 160 }).notNull(),
     actorId: varchar("actor_id", { length: 64 }).notNull(),
-    occurredAt: timestamp("occurred_at", { withTimezone: true })
+    occurredAt: licenseTimestamp("occurred_at", { withTimezone: true })
       .notNull()
       .defaultNow(),
     payload: jsonb("payload").$type<Record<string, unknown>>().notNull(),
@@ -178,7 +183,7 @@ export const licenseGovernanceEvents = pgTable(
 export const auditLogs = pgTable(
   "audit_logs",
   {
-    id: idColumn().primaryKey(),
+    id: auditIdColumn().primaryKey(),
     actorId: varchar("actor_id", { length: 64 }),
     action: varchar("action", { length: 120 }).notNull(),
     resource: varchar("resource", { length: 160 }).notNull(),
@@ -186,7 +191,7 @@ export const auditLogs = pgTable(
     ip: varchar("ip", { length: 64 }),
     userAgent: text("user_agent"),
     metadata: jsonb("metadata").$type<Record<string, unknown>>(),
-    createdAt: timestamp("created_at", { withTimezone: true })
+    createdAt: auditTimestamp("created_at", { withTimezone: true })
       .notNull()
       .defaultNow(),
   },

package/template/packages/database/src/schema/platform-settings.ts

@@ -1,43 +1,57 @@
+// 即使两个可选模块都被裁剪，也要保持该文件可由 schema barrel 导出。
+export {};
+
+// @windy-module system.configuration begin
 import type { ModuleConfigDiffEntry, ModuleConfigValues } from "@windy/shared";
 import {
   index,
   integer,
   jsonb,
-  pgTable,
-  text,
+  pgTable as configTable,
   timestamp,
   uniqueIndex,
-  varchar,
+  varchar as configVarchar,
+} from "drizzle-orm/pg-core";
+// @windy-module system.configuration end
+// @windy-module system.settings begin
+import {
+  pgTable as settingsTable,
+  text,
+  varchar as settingsVarchar,
 } from "drizzle-orm/pg-core";
 import { auditColumns } from "./common.js";
+// @windy-module system.settings end
 
 // @windy-module system.settings begin
-export const platformBrandingSettings = pgTable("platform_branding_settings", {
-  id: varchar("id", { length: 64 }).primaryKey(),
-  softwareName: varchar("software_name", { length: 120 }).notNull(),
-  logoUrl: text("logo_url"),
-  description: varchar("description", { length: 500 }),
-  ...auditColumns,
-});
+export const platformBrandingSettings = settingsTable(
+  "platform_branding_settings",
+  {
+    id: settingsVarchar("id", { length: 64 }).primaryKey(),
+    softwareName: settingsVarchar("software_name", { length: 120 }).notNull(),
+    logoUrl: text("logo_url"),
+    description: settingsVarchar("description", { length: 500 }),
+    ...auditColumns,
+  },
+);
 // @windy-module system.settings end
 
 // @windy-module system.configuration begin
-export const moduleConfigVersions = pgTable(
+export const moduleConfigVersions = configTable(
   "module_config_versions",
   {
-    id: varchar("id", { length: 64 }).primaryKey(),
-    moduleKey: varchar("module_key", { length: 80 }).notNull(),
+    id: configVarchar("id", { length: 64 }).primaryKey(),
+    moduleKey: configVarchar("module_key", { length: 80 }).notNull(),
     version: integer("version").notNull(),
     values: jsonb("values").$type<ModuleConfigValues>().notNull(),
     diff: jsonb("diff").$type<ModuleConfigDiffEntry[]>().notNull(),
-    applyStatus: varchar("apply_status", { length: 24 }).notNull(),
-    applyError: varchar("apply_error", { length: 500 }),
+    applyStatus: configVarchar("apply_status", { length: 24 }).notNull(),
+    applyError: configVarchar("apply_error", { length: 500 }),
     rollbackOfVersion: integer("rollback_of_version"),
-    reason: varchar("reason", { length: 500 }),
+    reason: configVarchar("reason", { length: 500 }),
     createdAt: timestamp("created_at", { withTimezone: true })
       .notNull()
       .defaultNow(),
-    createdBy: varchar("created_by", { length: 64 }).notNull(),
+    createdBy: configVarchar("created_by", { length: 64 }).notNull(),
     appliedAt: timestamp("applied_at", { withTimezone: true }),
   },
   (table) => [

package/template/packages/modules/src/system-admin-routes.ts

@@ -33,6 +33,7 @@ export const systemAdminRoutes: ModuleManifest["adminRoutes"] = [
     "system.department.read",
     "system.rbac",
   ),
+  // @windy-module system.settings begin
   {
     ...route(
       "system.settings",
@@ -44,6 +45,7 @@ export const systemAdminRoutes: ModuleManifest["adminRoutes"] = [
     ),
     directAccess: "admin-admission",
   },
+  // @windy-module system.settings end
   route(
     "system.menu",
     "/admin/system/menus",