create-windy 0.3.18 → 0.4.0

package/template/apps/server/src/scheduler/service.ts

@@ -1,7 +1,7 @@
 import { randomUUIDv7 } from "bun";
 import type { SchedulerOperationsSnapshot } from "@southwind-ai/shared";
 import { runGuardedBackgroundTask } from "../background/task-guard.js";
-import type { RequestGuardContext } from "../guards.js";
+import type { RequestActor, RequestGuardContext } from "../guards.js";
 import type { LegacyDurableAdapter } from "../jobs/legacy-adapter.js";
 import type { createServerRuntime } from "../runtime.js";
 import type { SchedulerRepository } from "./repository.js";
@@ -41,6 +41,9 @@ export class SchedulerService {
     private readonly runtime: ServerRuntime,
     private readonly clock: SchedulerClock = systemClock,
     private readonly durable?: LegacyDurableAdapter,
+    private readonly resolveActor?: (
+      actorId: string,
+    ) => Promise<RequestActor | undefined>,
   ) {
     this.recorder = new SchedulerExecutionRecorder(repository, runtime, clock);
     validateTaskDefinitions(definitions);
@@ -196,13 +199,14 @@ export class SchedulerService {
       await this.executeScheduled(run, false);
       return;
     }
-    await this.execute(
-      run,
-      definition,
-      manualResumeContext(run, definition),
-      false,
-      false,
+    const actor = await this.resolveActor?.(run.requestedBy);
+    const context = await this.runtime.createGuardContextForActor(
+      new Request(
+        `http://scheduler.local/tasks/${encodeURIComponent(run.taskKey)}/resume`,
+      ),
+      actor ?? deniedResumeActor(run.requestedBy),
     );
+    await this.execute(run, definition, context, true, false);
   }
 
   private async executeScheduled(run: ScheduledTaskRun, useDurable = true) {
@@ -262,7 +266,7 @@ export class SchedulerService {
           finishedAt: this.clock.now(),
           error: guarded.reason,
         });
-        this.recorder.denied(context, blocked, guarded.reason);
+        this.recorder.denied(context, blocked, definition, guarded.reason);
         return blocked;
       }
       return this.recorder.success(run, definition, context, guarded.value);
@@ -321,19 +325,12 @@ export class SchedulerService {
   }
 }
 
-function manualResumeContext(
-  run: ScheduledTaskRun,
-  definition: ScheduledTaskDefinition,
-): RequestGuardContext {
+function deniedResumeActor(actorId: string): RequestActor {
   return {
-    requestId: randomUUIDv7(),
-    actor: {
-      id: run.requestedBy,
-      type: "user",
-      name: run.requestedBy,
-      roleCodes: [],
-      permissionKeys: [definition.permissionKey],
-    },
-    startedAt: new Date().toISOString(),
+    id: actorId,
+    type: "user",
+    name: actorId,
+    roleCodes: [],
+    permissionKeys: [],
   };
 }

package/template/apps/server/src/scheduler/types.ts

@@ -1,4 +1,7 @@
-import type { FeatureFlagDefinition } from "@southwind-ai/shared";
+import type {
+  AuditActionType,
+  FeatureFlagDefinition,
+} from "@southwind-ai/shared";
 
 export interface SchedulerClock {
   now(): Date;
@@ -20,6 +23,7 @@ export interface ScheduledTaskDefinition {
   maxAttempts: number;
   retryDelaySeconds: number;
   permissionKey: string;
+  auditAction: AuditActionType;
   feature: FeatureFlagDefinition;
   handler: ScheduledTaskHandler;
   isIdleResult?: (value: Record<string, unknown> | void) => boolean;

package/template/apps/server/src/startup-composition-validation.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from "bun:test";
+import { validateCompositionBeforeStartup } from "./startup-composition-validation.js";
+
+describe("完整 Server Composition 启动前门禁", () => {
+  test("正常启动先执行无数据库验证子进程", () => {
+    let databaseUrlSeen = "not-called";
+    validateCompositionBeforeStartup(
+      ["bun", "src/index.ts"],
+      (_command, _args, options) => {
+        databaseUrlSeen = options.env.DATABASE_URL ?? "";
+        return { status: 0 };
+      },
+    );
+
+    expect(databaseUrlSeen).toBe("");
+  });
+
+  test("验证子进程自身不递归，并把失败传回启动进程", () => {
+    let calls = 0;
+    validateCompositionBeforeStartup(
+      ["bun", "src/index.ts", "--validate-module-composition"],
+      () => {
+        calls += 1;
+        return { status: 0 };
+      },
+    );
+    expect(calls).toBe(0);
+
+    expect(() =>
+      validateCompositionBeforeStartup(["bun", "src/index.ts"], () => ({
+        status: 1,
+      })),
+    ).toThrow("启动前校验失败");
+  });
+});

package/template/apps/server/src/startup-composition-validation.ts

@@ -0,0 +1,54 @@
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const VALIDATION_ARGUMENT = "--validate-module-composition";
+const validatorPath = fileURLToPath(
+  new URL("../scripts/validate-module-composition.ts", import.meta.url),
+);
+const serverRoot = fileURLToPath(new URL("..", import.meta.url));
+
+interface ValidationProcessResult {
+  readonly status: number | null;
+  readonly error?: Error;
+}
+
+type SpawnValidationProcess = (
+  command: string,
+  args: readonly string[],
+  options: {
+    readonly cwd: string;
+    readonly env: NodeJS.ProcessEnv;
+    readonly stdio: "inherit";
+  },
+) => ValidationProcessResult;
+
+/**
+ * 正常启动先用无数据库子进程走一遍与 build 相同的完整路由/任务/Provider 门禁。
+ */
+export function validateCompositionBeforeStartup(
+  argv: readonly string[] = process.argv,
+  spawn: SpawnValidationProcess = spawnValidationProcess,
+): void {
+  if (argv.includes(VALIDATION_ARGUMENT)) return;
+  const env = { ...process.env };
+  delete env.DATABASE_URL;
+  const result = spawn(process.execPath, [validatorPath], {
+    cwd: serverRoot,
+    env,
+    stdio: "inherit",
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    throw new Error(
+      `Server 完整 Module Composition 启动前校验失败（exit ${result.status ?? "unknown"}）`,
+    );
+  }
+}
+
+function spawnValidationProcess(
+  command: string,
+  args: readonly string[],
+  options: Parameters<SpawnValidationProcess>[2],
+): ValidationProcessResult {
+  return spawnSync(command, [...args], options);
+}

package/template/apps/server/src/startup-preflight.test.ts

@@ -0,0 +1,36 @@
+import { describe, expect, test } from "bun:test";
+import { runPreflightBeforeRecovery } from "./startup-preflight.js";
+
+describe("Server 启动前门禁顺序", () => {
+  test("先完成无持久化 preflight，再恢复审计队列", async () => {
+    const calls: string[] = [];
+    const result = await runPreflightBeforeRecovery(
+      () => {
+        calls.push("prepare");
+        return Promise.resolve("ready");
+      },
+      () => {
+        calls.push("recover");
+        return Promise.resolve();
+      },
+    );
+
+    expect(result).toBe("ready");
+    expect(calls).toEqual(["prepare", "recover"]);
+  });
+
+  test("preflight 失败时不触发恢复写入", async () => {
+    let recovered = false;
+    await expect(
+      runPreflightBeforeRecovery(
+        () => Promise.reject(new Error("invalid composition")),
+        () => {
+          recovered = true;
+          return Promise.resolve();
+        },
+      ),
+    ).rejects.toThrow("invalid composition");
+
+    expect(recovered).toBe(false);
+  });
+});

package/template/apps/server/src/startup-preflight.ts

@@ -0,0 +1,37 @@
+import type { ModuleUploadPolicy } from "@southwind-ai/server-sdk";
+import { prepareInstalledServerModules } from "./module-preflight.js";
+import { createPlatformBootstrap } from "./platform-bootstrap.js";
+// @windy-module system.storage begin
+import { createPlatformUploadPolicies } from "./storage/runtime.js";
+// @windy-module system.storage end
+
+/**
+ * 在恢复审计队列、执行迁移或写入目录前，完成项目装配、Host 与 attachment 门禁。
+ */
+export async function createPreparedPlatformBootstrap() {
+  const bootstrap = createPlatformBootstrap();
+  const baseUploadPolicies: ModuleUploadPolicy[] = [
+    // @windy-module system.storage begin
+    ...createPlatformUploadPolicies(bootstrap.platformConfig),
+    // @windy-module system.storage end
+  ];
+  const recoverAuditQueue = () =>
+    // @windy-module system.audit begin
+    bootstrap.persistence?.auditWriter.recover() ??
+    // @windy-module system.audit end
+    Promise.resolve();
+  const preparedModules = await runPreflightBeforeRecovery(
+    () => prepareInstalledServerModules(baseUploadPolicies),
+    recoverAuditQueue,
+  );
+  return { ...bootstrap, preparedModules };
+}
+
+export async function runPreflightBeforeRecovery<T>(
+  prepare: () => Promise<T>,
+  recover: () => Promise<void>,
+): Promise<T> {
+  const prepared = await prepare();
+  await recover();
+  return prepared;
+}

package/template/apps/server/src/system/audit-routes.test.ts

@@ -6,12 +6,14 @@ import { registerSystemRoutes } from "./routes.js";
 import { createSystemRepositories } from "./seed.js";
 
 async function auditFixture() {
+  const snapshot = createFoundationSnapshot();
   const runtime = createServerRuntime({ WINDY_DEV_ADMIN_TOKEN: "token_1" });
   const app = new FakeRouteApp();
   registerSystemRoutes(
     app,
-    createSystemRepositories(createFoundationSnapshot()),
+    createSystemRepositories(snapshot),
     runtime,
+    snapshot.features,
   );
   const guardContext = await runtime.createGuardContext(
     new Request("http://localhost/api/system/audit-logs", {
@@ -54,10 +56,12 @@ describe("audit routes", () => {
       },
     );
     const app = new FakeRouteApp();
+    const snapshot = createFoundationSnapshot();
     registerSystemRoutes(
       app,
-      createSystemRepositories(createFoundationSnapshot()),
+      createSystemRepositories(snapshot),
       runtime,
+      snapshot.features,
     );
     const guardContext = await runtime.createGuardContext(
       new Request("http://localhost/api/system/audit-logs", {
@@ -108,10 +112,12 @@ describe("audit routes", () => {
       },
     );
     const app = new FakeRouteApp();
+    const snapshot = createFoundationSnapshot();
     registerSystemRoutes(
       app,
-      createSystemRepositories(createFoundationSnapshot()),
+      createSystemRepositories(snapshot),
       runtime,
+      snapshot.features,
     );
     const guardContext = await runtime.createGuardContext(
       new Request("http://localhost/api/system/audit-logs", {

package/template/apps/server/src/system/department-routes.test.ts

@@ -1,14 +1,16 @@
 import { describe, expect, test } from "bun:test";
 import { createFoundationSnapshot } from "../foundation.js";
-import { createServerRuntime } from "../runtime.js";
 import { FakeRouteApp } from "./route-test-app.js";
+import { createRouteTestRuntime } from "./route-test-runtime.js";
 import { registerSystemRoutes } from "./routes.js";
 import { createSystemRepositories } from "./seed.js";
 
 async function fixture() {
   const snapshot = createFoundationSnapshot();
   const repositories = createSystemRepositories(snapshot);
-  const runtime = createServerRuntime({ WINDY_DEV_ADMIN_TOKEN: "token_1" });
+  const runtime = createRouteTestRuntime(snapshot, {
+    WINDY_DEV_ADMIN_TOKEN: "token_1",
+  });
   const app = new FakeRouteApp();
   registerSystemRoutes(app, repositories, runtime, snapshot.features);
   const guardContext = await runtime.createGuardContext(
@@ -27,7 +29,7 @@ async function fixture() {
 describe("部门组织路由", () => {
   test("部门处置缺少权限时经过统一 Guard 拒绝", async () => {
     const snapshot = createFoundationSnapshot();
-    const runtime = createServerRuntime();
+    const runtime = createRouteTestRuntime(snapshot);
     const app = new FakeRouteApp();
     registerSystemRoutes(
       app,

package/template/apps/server/src/system/feature-routes.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from "bun:test";
 import { createFoundationSnapshot } from "../foundation.js";
-import { createServerRuntime } from "../runtime.js";
 import { FakeRouteApp } from "./route-test-app.js";
+import { createRouteTestRuntime } from "./route-test-runtime.js";
 import { registerSystemRoutes } from "./routes.js";
 import { createSystemRepositories } from "./seed.js";
 
@@ -10,7 +10,8 @@ describe("feature routes", () => {
     const snapshot = createFoundationSnapshot();
     const repositories = createSystemRepositories(snapshot);
     await repositories.features.syncManifest(snapshot.features);
-    const runtime = createServerRuntime(
+    const runtime = createRouteTestRuntime(
+      snapshot,
       { WINDY_DEV_ADMIN_TOKEN: "token_1" },
       { featureResolver: repositories.features },
     );
@@ -46,7 +47,7 @@ describe("feature routes", () => {
     });
     expect(denied.status).toBe(403);
     await expect(denied.json()).resolves.toMatchObject({
-      reason: "feature-disabled",
+      reason: "dependency-missing",
     });
     expect(app.handlers.has("POST /system/features")).toBe(false);
     expect(app.handlers.has("POST /system/features/import")).toBe(false);

package/template/apps/server/src/system/interface-catalog.test.ts

@@ -15,7 +15,8 @@ describe("系统接口权限目录", () => {
       ),
     ).toMatchObject({
       permissionKey: "system.user.manage",
-      featureKey: "system.rbac",
+      featureKey: "system.user",
+      auditAction: "crud.create",
       guardOrder: ["license", "feature", "permission"],
       source: "module-manifest",
     });
@@ -52,11 +53,12 @@ describe("系统接口权限目录", () => {
       ),
     ).toMatchObject({
       permissionKey: "system.feature.manage",
-      guardOrder: ["license", "permission"],
+      featureKey: "system.feature",
+      guardOrder: ["license", "feature", "permission"],
     });
     expect(
       interfaces.find((item) => item.path === "/api/foundation"),
-    ).toMatchObject({ anonymous: true });
+    ).toMatchObject({ anonymous: true, auditAction: undefined });
     // @windy-module system.bulk-data begin
     expect(
       interfaces.find(

package/template/apps/server/src/system/interface-catalog.ts

@@ -1,5 +1,6 @@
 import type { ModuleManifest } from "@southwind-ai/modules";
 import type {
+  AuditActionType,
   EntitlementKey,
   HttpMethod,
   LicenseVersionKey,
@@ -19,6 +20,7 @@ export interface SystemInterfacePermissionDetail {
   permissionKey: string;
   anonymous: boolean;
   featureKey?: string;
+  auditAction?: AuditActionType;
   allowedLicenseVersions?: readonly LicenseVersionKey[];
   entitlementKey?: EntitlementKey;
   guardOrder: readonly GuardStep[];
@@ -56,6 +58,7 @@ export function collectSystemInterfacePermissions(
         permissionKey: binding.permissionKey,
         anonymous: binding.anonymous === true,
         featureKey: feature?.key,
+        auditAction: binding.auditAction,
         allowedLicenseVersions: feature?.allowedLicenseVersions,
         entitlementKey: feature?.requiredEntitlement,
         guardOrder: resolveGuardOrder(feature),

package/template/apps/server/src/system/menu-routes.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from "bun:test";
 import { createFoundationSnapshot } from "../foundation.js";
-import { createServerRuntime } from "../runtime.js";
 import { FakeRouteApp } from "./route-test-app.js";
+import { createRouteTestRuntime } from "./route-test-runtime.js";
 import { registerSystemRoutes } from "./routes.js";
 import { createSystemRepositories } from "./seed.js";
 
@@ -9,7 +9,9 @@ describe("菜单结构批量路由", () => {
   test("完整草稿通过 system.menu.manage Guard 后一次保存并写审计", async () => {
     const snapshot = createFoundationSnapshot();
     const repositories = createSystemRepositories(snapshot);
-    const runtime = createServerRuntime({ WINDY_DEV_ADMIN_TOKEN: "token_1" });
+    const runtime = createRouteTestRuntime(snapshot, {
+      WINDY_DEV_ADMIN_TOKEN: "token_1",
+    });
     const app = new FakeRouteApp();
     registerSystemRoutes(app, repositories, runtime, snapshot.features);
     const guardContext = await runtime.createGuardContext(
@@ -49,7 +51,7 @@ describe("菜单结构批量路由", () => {
   test("缺少管理权限时拒绝保存菜单草稿", async () => {
     const snapshot = createFoundationSnapshot();
     const repositories = createSystemRepositories(snapshot);
-    const runtime = createServerRuntime();
+    const runtime = createRouteTestRuntime(snapshot);
     const app = new FakeRouteApp();
     registerSystemRoutes(app, repositories, runtime, snapshot.features);
     const guardContext = await runtime.createGuardContext(

package/template/apps/server/src/system/route-test-runtime.ts

@@ -0,0 +1,24 @@
+import type { FeatureFlagDefinition } from "@southwind-ai/shared";
+import { createServerRuntime, type ServerRuntimeOptions } from "../runtime.js";
+
+interface TestFeatureCatalog {
+  readonly features: readonly FeatureFlagDefinition[];
+  readonly disabledModuleNames?: readonly string[];
+}
+
+type TestRuntimeOptions = Omit<
+  ServerRuntimeOptions,
+  "featureCatalog" | "disabledModuleNames"
+>;
+
+export function createRouteTestRuntime(
+  catalog: TestFeatureCatalog,
+  env: Record<string, string | undefined> = {},
+  options: TestRuntimeOptions = {},
+) {
+  return createServerRuntime(env, {
+    ...options,
+    featureCatalog: catalog.features,
+    disabledModuleNames: new Set(catalog.disabledModuleNames),
+  });
+}

package/template/apps/server/src/system/routes-validation.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from "bun:test";
 import { createFoundationSnapshot } from "../foundation.js";
-import { createServerRuntime } from "../runtime.js";
 import { FakeRouteApp } from "./route-test-app.js";
+import { createRouteTestRuntime } from "./route-test-runtime.js";
 import { registerSystemRoutes } from "./routes.js";
 import { createSystemRepositories } from "./seed.js";
 
@@ -71,12 +71,16 @@ describe("system route query validation", () => {
 });
 
 async function createFixture(path: string) {
-  const runtime = createServerRuntime({ WINDY_DEV_ADMIN_TOKEN: "token_1" });
+  const snapshot = createFoundationSnapshot();
+  const runtime = createRouteTestRuntime(snapshot, {
+    WINDY_DEV_ADMIN_TOKEN: "token_1",
+  });
   const app = new FakeRouteApp();
   registerSystemRoutes(
     app,
-    createSystemRepositories(createFoundationSnapshot()),
+    createSystemRepositories(snapshot),
     runtime,
+    snapshot.features,
   );
   const guardContext = await runtime.createGuardContext(
     new Request(`http://localhost${path}`, {

package/template/apps/server/src/system/routes.test.ts

@@ -12,19 +12,21 @@ import { registerSystemRoutes } from "./routes.js";
 import { createSystemRepositories } from "./seed.js";
 
 async function routeFixture(
-  features: FeatureFlagDefinition[] = [],
+  features?: FeatureFlagDefinition[],
   auditWriter?: AuditEventWriter,
 ) {
+  const snapshot = createFoundationSnapshot();
+  const activeFeatures = features ?? snapshot.features;
   const runtime = createServerRuntime(
     { WINDY_DEV_ADMIN_TOKEN: "token_1" },
-    { auditWriter },
+    { auditWriter, featureCatalog: activeFeatures },
   );
   const app = new FakeRouteApp();
   registerSystemRoutes(
     app,
-    createSystemRepositories(createFoundationSnapshot()),
+    createSystemRepositories(snapshot),
     runtime,
-    features,
+    activeFeatures,
   );
   const guardContext = await runtime.createGuardContext(
     new Request("http://localhost/api/system/users", {
@@ -78,12 +80,17 @@ describe("system routes", () => {
   });
 
   test("缺少权限时返回 403 Response 并记录 security.denied", async () => {
-    const runtime = createServerRuntime();
+    const snapshot = createFoundationSnapshot();
+    const runtime = createServerRuntime(
+      {},
+      { featureCatalog: snapshot.features },
+    );
     const app = new FakeRouteApp();
     registerSystemRoutes(
       app,
-      createSystemRepositories(createFoundationSnapshot()),
+      createSystemRepositories(snapshot),
       runtime,
+      snapshot.features,
     );
     const guardContext = await runtime.createGuardContext(
       new Request("http://localhost/api/system/users"),
@@ -127,7 +134,7 @@ describe("system routes", () => {
 
     expect(hiddenResponse.status).toBe(403);
     await expect(hiddenResponse.json()).resolves.toMatchObject({
-      reason: "feature-disabled",
+      reason: "dependency-missing",
     });
 
     // @windy-module system.license begin
@@ -209,7 +216,7 @@ describe("system routes", () => {
 
   test("用户与角色变更使用关键策略，普通资源变更保持降级可用", async () => {
     const policies: string[] = [];
-    const { app, guardContext } = await routeFixture([], {
+    const { app, guardContext } = await routeFixture(undefined, {
       write: async (_event, policy) => void policies.push(policy || "ordinary"),
     });
 
@@ -234,7 +241,7 @@ describe("system routes", () => {
   });
 
   test("关键资源审计失败会拒绝请求，普通资源仍完成并报告降级", async () => {
-    const { app, runtime, guardContext } = await routeFixture([], {
+    const { app, runtime, guardContext } = await routeFixture(undefined, {
       write: async () => {
         throw new Error("audit persistence unavailable");
       },
@@ -281,7 +288,10 @@ describe("system routes", () => {
     await repositories.features.syncManifest(snapshot.features);
     const runtime = createServerRuntime(
       { WINDY_DEV_ADMIN_TOKEN: "token_1" },
-      { featureResolver: repositories.features },
+      {
+        featureResolver: repositories.features,
+        featureCatalog: snapshot.features,
+      },
     );
     const app = new FakeRouteApp();
     registerSystemRoutes(app, repositories, runtime, snapshot.features);
@@ -315,7 +325,7 @@ describe("system routes", () => {
     });
     expect(denied.status).toBe(403);
     await expect(denied.json()).resolves.toMatchObject({
-      reason: "feature-disabled",
+      reason: "dependency-missing",
     });
     expect(app.handlers.has("POST /system/features")).toBe(false);
     expect(app.handlers.has("POST /system/features/import")).toBe(false);

package/template/apps/server/src/system/routes.ts

@@ -27,7 +27,7 @@ export function registerSystemRoutes(
   app: RouteApp,
   repositories: SystemRepositories,
   runtime: ReturnType<typeof createServerRuntime>,
-  features: FeatureFlagDefinition[] = [],
+  features: FeatureFlagDefinition[],
   options: {
     authRepository?: Pick<AuthRepository, "revokeUserSessions">;
   } = {},
@@ -98,7 +98,16 @@ export function registerSystemRoutes(
     ),
     runtime,
   );
-  registerFeatureFlagRoutes(app, repositories.features, runtime);
+  const featureManagement = findSystemFeature(features, "feature");
+  if (!featureManagement) {
+    throw new Error("功能开关管理缺少 system.feature Feature");
+  }
+  registerFeatureFlagRoutes(
+    app,
+    repositories.features,
+    runtime,
+    featureManagement,
+  );
   // @windy-module system.license begin
   registerResourceRoutes(
     app,

package/template/apps/server/src/work-order/foundation-modules.test.ts

@@ -43,7 +43,9 @@ describe("平台模块 composition root", () => {
       "advanced",
     ]);
     const workOrder = modules.find(({ name }) => name === "work-order");
-    expect(workOrder?.adminRoutes).toEqual([]);
+    expect(workOrder?.adminRoutes.map(({ key }) => key)).toEqual([
+      "work-order.ticket.list",
+    ]);
     expect(workOrder?.apiPermissions).toHaveLength(5);
     expect(workOrder?.tasks.map(({ key }) => key)).toContain(
       "work-order.ticket.snapshot",
@@ -88,9 +90,9 @@ describe("平台模块 composition root", () => {
       "@southwind-ai/web",
     );
     expect(businessPackage.dependencies).not.toHaveProperty("vue");
-    expect(webPackage.dependencies).not.toHaveProperty(
-      "@southwind-ai/example-work-order",
-    );
+    expect(webPackage.dependencies).toMatchObject({
+      "@southwind-ai/example-work-order": "workspace:*",
+    });
   });
 
   test("示例模块经 Host 声明式装配提供搜索 Provider", async () => {

package/template/apps/server/src/work-order/routes.test.ts

@@ -22,6 +22,9 @@ describe("示例工单 routes", () => {
       items: WorkOrder[];
     };
     expect(listed.items.map(({ id }) => id)).toEqual(["ticket_self"]);
+    expect(fixture.runtime.auditSink.list()).toContainEqual(
+      expect.objectContaining({ action: "data.read" }),
+    );
 
     const denied = (await fixture.invoke("GET", "/work-orders/:id", {
       id: "ticket_other",
@@ -76,6 +79,11 @@ describe("示例工单 routes", () => {
         target: expect.objectContaining({ id: created.id, type: "work-order" }),
       }),
     );
+    expect(
+      fixture.runtime.auditSink
+        .list()
+        .filter(({ action }) => action === "crud.create"),
+    ).toHaveLength(1);
   });
 });