create-windy 0.3.18 → 0.4.0

package/template/apps/server/src/foundation.ts

@@ -14,7 +14,10 @@ import type {
   PermissionDefinition,
 } from "@southwind-ai/shared";
 import { resolveLicenseCatalog } from "@southwind-ai/shared";
-import { installedBusinessModules } from "./installed-business-modules.js";
+import {
+  runtimeBusinessModules,
+  serverComposition,
+} from "./module-host/runtime-composition.js";
 
 export interface FoundationSnapshot {
   platform: {
@@ -34,12 +37,21 @@ export interface FoundationSnapshot {
   auditActions: string[];
   auditActionCatalog: readonly AuditActionDefinition[];
   licenseCatalog: readonly LicenseCatalogDefinition[];
+  disabledModuleNames: readonly string[];
 }
 
 export function loadFoundationModules(): ModuleManifest[] {
   const registry = createModuleRegistry();
-  for (const factory of systemModuleFactories) registry.register(factory);
-  for (const module of installedBusinessModules) {
+  for (const factory of systemModuleFactories) {
+    const manifest = factory();
+    registry.register(() =>
+      applyPlatformModuleActivation(
+        manifest,
+        serverComposition.enabledModuleNames.has(manifest.name),
+      ),
+    );
+  }
+  for (const module of runtimeBusinessModules) {
     registry.register(() => module.manifest);
   }
   return registry.list();
@@ -47,10 +59,48 @@ export function loadFoundationModules(): ModuleManifest[] {
 
 export function loadSystemModules(): ModuleManifest[] {
   const registry = createModuleRegistry();
-  for (const factory of systemModuleFactories) registry.register(factory);
+  for (const factory of systemModuleFactories) {
+    const manifest = factory();
+    registry.register(() =>
+      applyPlatformModuleActivation(
+        manifest,
+        serverComposition.enabledModuleNames.has(manifest.name),
+      ),
+    );
+  }
   return registry.list();
 }
 
+export function applyPlatformModuleActivation(
+  manifest: ModuleManifest,
+  enabled: boolean,
+): ModuleManifest {
+  if (enabled) return manifest;
+  return {
+    ...manifest,
+    metadata: {
+      ...manifest.metadata,
+      runtimeActivation: "disabled",
+    },
+    features: manifest.features.map((feature) => ({
+      ...feature,
+      enabled: false,
+      visible: "hidden",
+    })),
+    menus: manifest.menus.map(hideMenu),
+  };
+}
+
+function hideMenu(menu: MenuNode): MenuNode {
+  return {
+    ...menu,
+    visible: menu.type === "catalog" ? menu.visible : false,
+    ...(menu.children
+      ? { children: menu.children.map((child) => hideMenu(child)) }
+      : {}),
+  };
+}
+
 function collectMenus(modules: ModuleManifest[]): MenuNode[] {
   return composeModuleMenus(modules);
 }
@@ -89,7 +139,13 @@ export function createFoundationSnapshot(
       name: config.name,
       enableAI: config.enableAI,
       databaseDialect: config.database.dialect,
-      licenseEnabled: config.license.enabled,
+      licenseEnabled:
+        config.license.enabled &&
+        modules.some(
+          ({ name, metadata }) =>
+            name === "system.license" &&
+            metadata?.runtimeActivation !== "disabled",
+        ),
       auditEnabled: config.audit.enabled,
       ruoyiCompatibilityEnabled: config.compatibility.ruoyiVue.enabled,
     },
@@ -105,5 +161,8 @@ export function createFoundationSnapshot(
     auditActions: collectAuditActions(modules),
     auditActionCatalog: catalogs.auditActions,
     licenseCatalog: catalogs.licenseVersions,
+    disabledModuleNames: modules
+      .filter(({ metadata }) => metadata?.runtimeActivation === "disabled")
+      .map(({ name }) => name),
   };
 }

package/template/apps/server/src/guards.test.ts

@@ -8,6 +8,8 @@ import {
 import {
   evaluateEntitlementGuard,
   evaluateFeatureGuard,
+  evaluateLicenseRestrictionGuard,
+  evaluateLicenseVersionGuard,
   evaluatePermissionGuard,
   type RequestGuardContext,
 } from "./guards.js";
@@ -72,6 +74,27 @@ describe("guards", () => {
     ).toBe("entitlement-not-granted");
   });
 
+  test("License 未启用时跳过版本、Entitlement 与限制模式", () => {
+    const unrestricted = {
+      ...context,
+      licenseEnforced: false,
+      license: { restricted: true as const, status: "expired" as const },
+    };
+    const licensedFeature = {
+      ...feature,
+      requiredEntitlement: entitlementKey("capability.audit"),
+      allowedLicenseVersions: [],
+    };
+
+    expect(
+      evaluateEntitlementGuard(unrestricted, licensedFeature).allowed,
+    ).toBe(true);
+    expect(
+      evaluateLicenseVersionGuard(unrestricted, licensedFeature).allowed,
+    ).toBe(true);
+    expect(evaluateLicenseRestrictionGuard(unrestricted).allowed).toBe(true);
+  });
+
   test("运行时解析出依赖缺失时拒绝并记录 security.denied", () => {
     const denied = evaluateFeatureGuard(context, {
       ...feature,

package/template/apps/server/src/guards.ts

@@ -58,6 +58,7 @@ export interface RequestGuardContext {
     status?: "valid" | "expired" | "clock-rollback" | "invalid" | "missing";
     restricted?: boolean;
   };
+  licenseEnforced?: boolean;
 }
 
 export type GuardDecisionReason =
@@ -84,6 +85,7 @@ export interface RequestGuardContextOptions {
   resolveLicense?: (
     request: Request,
   ) => RequestGuardContext["license"] | undefined;
+  licenseEnforced?: boolean;
 }
 
 export type PermissionGuardRequirement = Pick<
@@ -107,6 +109,7 @@ export function createRequestGuardContext(
     clientIp: options.clientIp,
     userAgent: options.userAgent,
     license: options.resolveLicense?.(request),
+    licenseEnforced: options.licenseEnforced,
   };
 }
 
@@ -176,6 +179,9 @@ export function evaluateEntitlementGuard(
   context: RequestGuardContext,
   feature: FeatureFlagDefinition,
 ): GuardDecision {
+  if (context.licenseEnforced === false) {
+    return { allowed: true, reason: "allowed" };
+  }
   if (
     !feature.requiredEntitlement ||
     context.license?.entitlements?.includes(feature.requiredEntitlement)
@@ -194,6 +200,9 @@ export function evaluateLicenseVersionGuard(
   context: RequestGuardContext,
   feature: FeatureFlagDefinition,
 ): GuardDecision {
+  if (context.licenseEnforced === false) {
+    return { allowed: true, reason: "allowed" };
+  }
   if (isLicenseVersionAllowed(feature, context.license?.versionKey)) {
     return { allowed: true, reason: "allowed" };
   }
@@ -208,6 +217,9 @@ export function evaluateLicenseRestrictionGuard(
   context: RequestGuardContext,
   explicitlyAllowed = false,
 ): GuardDecision {
+  if (context.licenseEnforced === false) {
+    return { allowed: true, reason: "allowed" };
+  }
   if (!context.license?.restricted || explicitlyAllowed) {
     return { allowed: true, reason: "allowed" };
   }

package/template/apps/server/src/index.ts

@@ -1,5 +1,4 @@
 import { registerAdminBootstrapRoute } from "./admin/routes.js";
-import { registerSessionContextRoute } from "./session/routes.js";
 import { registerFoundationRoute } from "./foundation-route.js";
 // @windy-module system.scheduler begin
 import { createApplicationServices } from "./application-services.js";
@@ -21,12 +20,7 @@ import { resolveCurrentSystemActor } from "./system/actor.js";
 // @windy-module system.agent end
 import { createAuthRuntime } from "./auth/runtime.js";
 // @windy-module system.license begin
-import { registerPlatformLicenseRoutes } from "./license/routes.js";
-import {
-  createPlatformLicenseRuntimeOptions,
-  hasConfiguredLicenseKeys,
-  PlatformLicenseRuntime,
-} from "./license/runtime-service.js";
+import { createLicenseRuntimeActivation } from "./license/activation.js";
 // @windy-module system.license end
 // @windy-module system.operations begin
 import { registerSystemOperationRoutes } from "./system/operations.js";
@@ -64,15 +58,15 @@ import { registerWorkflowRoutes } from "./workflow/routes.js";
 import { bootstrapServerModules } from "./module-bootstrap.js";
 import {
   createHttpObservability,
-  createPlatformServerApp,
   listenPlatformServer,
   logServerStartup,
 } from "./platform-http-runtime.js";
-import { createPlatformBootstrap } from "./platform-bootstrap.js";
-const { logger, persistence, platformConfig } = createPlatformBootstrap();
-// @windy-module system.audit begin
-await persistence?.auditWriter.recover();
-// @windy-module system.audit end
+import { bootstrapPlatformApp } from "./platform-app-bootstrap.js";
+import { createPreparedPlatformBootstrap } from "./startup-preflight.js";
+import { validateCompositionBeforeStartup } from "./startup-composition-validation.js";
+validateCompositionBeforeStartup();
+const { logger, persistence, platformConfig, preparedModules } =
+  await createPreparedPlatformBootstrap();
 const {
   // @windy-module system.configuration begin
   configurationRuntime,
@@ -82,16 +76,14 @@ const {
   foundationSnapshot,
   moduleHosts,
   systemRepositories,
-} = await bootstrapServerModules(platformConfig, persistence);
+} = await bootstrapServerModules(platformConfig, persistence, preparedModules);
 const features = foundationSnapshot.features;
 // @windy-module system.license begin
-const platformLicenseOptions = createPlatformLicenseRuntimeOptions(process.env);
-const platformLicenseRuntime = new PlatformLicenseRuntime(
-  platformLicenseOptions,
+const licenseActivation = createLicenseRuntimeActivation(
+  process.env,
+  foundationSnapshot.platform.licenseEnabled,
+  persistence?.licenseResolver,
 );
-const useInstalledLicense =
-  Boolean(platformLicenseOptions.enforceRestrictions) ||
-  hasConfiguredLicenseKeys(platformLicenseOptions);
 // @windy-module system.license end
 const runtime = createServerRuntime(process.env, {
   actorResolver: persistence?.actorResolver,
@@ -100,12 +92,12 @@ const runtime = createServerRuntime(process.env, {
     resolveCurrentSystemActor(systemRepositories, actorId),
   // @windy-module system.agent end
   // @windy-module system.license begin
-  licenseResolver: useInstalledLicense
-    ? platformLicenseRuntime
-    : persistence?.licenseResolver,
+  licenseResolver: licenseActivation.resolver,
+  licenseEnforced: licenseActivation.enforced,
   // @windy-module system.license end
   featureResolver: persistence ? systemRepositories.features : undefined,
   featureCatalog: features,
+  disabledModuleNames: new Set(foundationSnapshot.disabledModuleNames),
   // @windy-module system.audit begin
   auditReader: persistence?.auditReader,
   auditWriter: persistence?.auditWriter,
@@ -113,7 +105,7 @@ const runtime = createServerRuntime(process.env, {
 });
 const observability = createHttpObservability(runtime, persistence, logger);
 // @windy-module system.license begin
-platformLicenseRuntime.setAuditSink(runtime.auditSink);
+licenseActivation.runtime.setAuditSink(runtime.auditSink);
 // @windy-module system.license end
 const {
   authRepository,
@@ -213,7 +205,7 @@ const schedulerWorker = new SchedulerWorker(
   (result) => observability.metrics.observeSchedulerTick(result),
 );
 // @windy-module system.scheduler end
-const app = await createPlatformServerApp({
+const app = await bootstrapPlatformApp({
   runtime,
   persistence,
   platformConfig,
@@ -223,10 +215,11 @@ const app = await createPlatformServerApp({
   features,
   logger,
   observability,
+  modules: foundationModules,
+  // @windy-module system.license begin
+  licenseRuntime: licenseActivation.runtime,
+  // @windy-module system.license end
 });
-// @windy-module system.license begin
-registerPlatformLicenseRoutes(app, platformLicenseRuntime);
-// @windy-module system.license end
 // @windy-module system.settings begin
 platformSettings.register(app, runtime, features);
 // @windy-module system.settings end
@@ -267,7 +260,6 @@ registerAdminBootstrapRoute(app, runtime, {
   snapshot: foundationSnapshot,
   loadMenus: () => systemRepositories.menuRegistry.tree(),
 });
-registerSessionContextRoute(app, runtime, features);
 registerFoundationRoute(app, runtime, foundationSnapshot, systemRepositories);
 // @windy-module system.data-governance begin
 registerGovernedUserExportRoutes(app, governedExportService, runtime, features);
@@ -342,8 +334,10 @@ validateInstalledRuntime({
   // @windy-module system.search end
   hosts: moduleHosts,
 });
-const port = listenPlatformServer(app);
-// @windy-module system.scheduler begin
-schedulerWorker.start();
-// @windy-module system.scheduler end
-logServerStartup(logger, featureSync, Boolean(persistence), port);
+if (!process.argv.includes("--validate-module-composition")) {
+  const port = listenPlatformServer(app);
+  // @windy-module system.scheduler begin
+  schedulerWorker.start();
+  // @windy-module system.scheduler end
+  logServerStartup(logger, featureSync, Boolean(persistence), port);
+}

package/template/apps/server/src/installed-business-modules.ts

@@ -1,29 +1,18 @@
-// @windy-module work-order begin
-import { createWorkOrderModule } from "./example-modules.js";
-// @windy-module work-order end
 import type { ModuleManifest } from "@southwind-ai/modules";
 import type { InstallableServerModule } from "@southwind-ai/server-sdk";
-import type { NodePgDatabase } from "drizzle-orm/node-postgres";
-import type { ManagedDepartment } from "./system/entities.js";
-import type { EntityRepository } from "./system/repository.js";
 
-export interface BusinessModuleRuntime {
-  readonly db?: NodePgDatabase;
-  readonly departments: EntityRepository<ManagedDepartment>;
-}
+export type { ProjectBusinessModuleRuntime as BusinessModuleRuntime } from "./app/server-composition.js";
+import type { ProjectBusinessModuleRuntime } from "./app/server-composition.js";
 
-interface InstalledBusinessModule extends InstallableServerModule<ModuleManifest> {
-  attach(runtime: BusinessModuleRuntime): void;
-}
+/**
+ * 0.3.17 起保留的 project-owned 兼容装配缝。
+ *
+ * 新项目使用 app/server-composition.ts；升级项目可以继续在这里维护旧模块，受管 Host
+ * 会合并两种来源且不会要求客户文件新增导出。
+ */
+export const installedBusinessModules: readonly InstallableServerModule<ModuleManifest>[] =
+  [];
 
-export const installedBusinessModules: readonly InstalledBusinessModule[] = [
-  // @windy-module work-order begin
-  createWorkOrderModule(),
-  // @windy-module work-order end
-];
-
-export function attachInstalledBusinessModules(
-  runtime: BusinessModuleRuntime,
-): void {
-  for (const module of installedBusinessModules) module.attach(runtime);
-}
+export async function attachInstalledBusinessModules(
+  _runtime: ProjectBusinessModuleRuntime,
+): Promise<void> {}

package/template/apps/server/src/jobs/legacy-adapter.integration.test.ts

@@ -121,6 +121,7 @@ describePostgres("PostgreSQL legacy durable adapter", () => {
       () => now,
       undefined,
       adapter,
+      async () => undefined,
     );
     executor.attach(({ legacyId, generation }) =>
       restarted.resumeDurable(legacyId, generation),

package/template/apps/server/src/jobs/legacy-adapter.test.ts

@@ -73,6 +73,7 @@ describe("legacy durable adapters", () => {
       () => now,
       undefined,
       adapter,
+      async () => undefined,
     );
     executor.attach(({ legacyId, generation }) =>
       restarted.resumeDurable(legacyId, generation),
@@ -110,6 +111,44 @@ describe("legacy durable adapters", () => {
       processedRows: 1,
     });
   });
+
+  test("Bulk durable 恢复会重新校验当前 Actor 与 Module 激活状态", async () => {
+    const now = new Date("2026-07-16T00:00:00.000Z");
+    const repository = new InMemoryBulkDataRepository();
+    let executions = 0;
+    const service = new BulkDataService(
+      repository,
+      [
+        {
+          ...testBulkHandler(),
+          exportRows: async () => {
+            executions += 1;
+            return [{ id: "row-1" }];
+          },
+        },
+      ],
+      {},
+      () => now,
+      undefined,
+      undefined,
+      async () => "feature-disabled",
+    );
+    await service.createExport(
+      "fixtures",
+      "durable:bulk:guard",
+      actor("user_bulk"),
+    );
+    const running = await repository.claimNext(now);
+    if (!running) throw new Error("应创建 running Bulk 任务");
+
+    await service.resumeDurable(running.id, running.attempt);
+
+    expect(executions).toBe(0);
+    expect(await repository.getJob(running.id)).toMatchObject({
+      status: "failed",
+      error: "feature-disabled",
+    });
+  });
   // @windy-module system.bulk-data end
 
   test("Scheduler 采用未关联 running 记录且重放已完成记录为空操作", async () => {
@@ -142,6 +181,7 @@ describe("legacy durable adapters", () => {
           maxAttempts: 3,
           retryDelaySeconds: 10,
           permissionKey: "system.scheduler.manage",
+          auditAction: "task.execute",
           feature,
           handler: () => {
             executions += 1;
@@ -152,6 +192,13 @@ describe("legacy durable adapters", () => {
       createServerRuntime(),
       clock,
       adapter,
+      async (actorId) => ({
+        id: actorId,
+        type: "user",
+        name: actorId,
+        roleCodes: [],
+        permissionKeys: ["system.scheduler.manage"],
+      }),
     );
     executor.attach(({ legacyId, generation }) =>
       scheduler.resumeDurable(legacyId, generation),
@@ -181,6 +228,65 @@ describe("legacy durable adapters", () => {
     expect(durableJob?.id).toBe(completed.durableJobId);
     expect((await durable.get(durableJob!.id))?.attempts).toHaveLength(1);
   });
+
+  test("Scheduler durable 恢复会重新校验当前 Actor 与 Module 激活状态", async () => {
+    const now = new Date("2026-07-16T00:00:00.000Z");
+    const feature = createFoundationSnapshot().features.find(
+      ({ key }) => key === "system.scheduler",
+    );
+    if (!feature) throw new Error("测试缺少 Scheduler Feature");
+    const repository = new InMemorySchedulerRepository();
+    let executions = 0;
+    const scheduler = new SchedulerService(
+      repository,
+      [
+        {
+          key: "test.durable-guard",
+          label: "持久执行恢复门禁",
+          intervalSeconds: 3_600,
+          maxAttempts: 3,
+          retryDelaySeconds: 10,
+          permissionKey: "system.scheduler.manage",
+          auditAction: "task.execute",
+          feature,
+          handler: () => {
+            executions += 1;
+          },
+        },
+      ],
+      createServerRuntime(
+        {},
+        {
+          featureCatalog: [feature],
+          disabledModuleNames: new Set(["system.scheduler"]),
+        },
+      ),
+      { now: () => now },
+      undefined,
+      async (actorId) => ({
+        id: actorId,
+        type: "user",
+        name: actorId,
+        roleCodes: [],
+        permissionKeys: ["system.scheduler.manage"],
+      }),
+    );
+    await scheduler.initialize();
+    const run = await repository.claimManual(
+      "test.durable-guard",
+      "user_scheduler",
+      now,
+    );
+    if (!run) throw new Error("应创建 Scheduler run");
+
+    await scheduler.resumeDurable(run.id, run.attempt);
+
+    expect(executions).toBe(0);
+    expect(await repository.getRun(run.id)).toMatchObject({
+      status: "blocked",
+      error: "feature-disabled",
+    });
+  });
 });
 
 // @windy-module system.bulk-data begin

package/template/apps/server/src/jobs/legacy-service-runtime.ts

@@ -10,6 +10,10 @@ import type { BulkDataRepository } from "../bulk-data/repository.js";
 import type { BulkResourceHandler } from "../bulk-data/resource-handler.js";
 // @windy-module system.bulk-data end
 import type { createServerRuntime } from "../runtime.js";
+import type { RequestActor } from "../guards.js";
+// @windy-module system.bulk-data begin
+import { evaluateAccessGuards } from "../access-guards.js";
+// @windy-module system.bulk-data end
 import type { SchedulerRepository } from "../scheduler/repository.js";
 import { SchedulerService } from "../scheduler/service.js";
 import type { ScheduledTaskDefinition } from "../scheduler/types.js";
@@ -38,6 +42,7 @@ interface LegacyServiceRuntimeInput {
   schedulerRepository: SchedulerRepository;
   taskDefinitions: ScheduledTaskDefinition[];
   runtime: ReturnType<typeof createServerRuntime>;
+  resolveActor?: (actorId: string) => Promise<RequestActor | undefined>;
   // @windy-module system.workflow begin
   workflow: WorkflowService;
   // @windy-module system.workflow end
@@ -80,6 +85,7 @@ export function createLegacyServiceRuntime(input: LegacyServiceRuntimeInput) {
       workerId: `server-${process.pid}-bulk`,
       execute: (payload) => bulkExecutor.execute(payload),
     }),
+    createBulkResumeAuthorization(input),
   );
   bulkExecutor.attach(({ legacyId, generation }) =>
     bulkDataService.resumeDurable(legacyId, generation),
@@ -99,6 +105,7 @@ export function createLegacyServiceRuntime(input: LegacyServiceRuntimeInput) {
       workerId: `server-${process.pid}-scheduler`,
       execute: (payload) => schedulerExecutor.execute(payload),
     }),
+    input.resolveActor,
   );
   schedulerExecutor.attach(({ legacyId, generation }) =>
     scheduler.resumeDurable(legacyId, generation),
@@ -116,3 +123,36 @@ export function createLegacyServiceRuntime(input: LegacyServiceRuntimeInput) {
     durable: { facts, service, registry, worker },
   };
 }
+
+// @windy-module system.bulk-data begin
+function createBulkResumeAuthorization(input: LegacyServiceRuntimeInput) {
+  const feature = input.taskDefinitions.find(
+    ({ key }) => key === "system.bulk-data.dispatch",
+  )?.feature;
+  return async (job: { requestedBy: string }) => {
+    if (!feature) return "feature-definition-missing";
+    const actor =
+      (await input.resolveActor?.(job.requestedBy)) ??
+      deniedResumeActor(job.requestedBy);
+    const context = await input.runtime.createGuardContextForActor(
+      new Request("http://jobs.local/bulk-data/resume"),
+      actor,
+    );
+    const guarded = await evaluateAccessGuards(input.runtime, context, {
+      permission: { permissionKey: "system.bulk-data.manage" },
+      feature,
+    });
+    return guarded.decision.allowed ? undefined : guarded.decision.reason;
+  };
+}
+
+function deniedResumeActor(actorId: string): RequestActor {
+  return {
+    id: actorId,
+    type: "user",
+    name: actorId,
+    roleCodes: [],
+    permissionKeys: [],
+  };
+}
+// @windy-module system.bulk-data end

package/template/apps/server/src/license/activation.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, test } from "bun:test";
+import { createLicenseRuntimeActivation } from "./activation.js";
+
+describe("License Module 激活", () => {
+  test("Module 未启用时不创建授权限制边界", () => {
+    const fallback = { resolve: () => ({ status: "valid" as const }) };
+    const activation = createLicenseRuntimeActivation(
+      { NODE_ENV: "production" },
+      false,
+      fallback,
+    );
+
+    expect(activation.enforced).toBe(false);
+    expect(activation.resolver).toBeUndefined();
+  });
+
+  test("Module 启用后按环境选择官方或持久化 Resolver", () => {
+    const fallback = { resolve: () => ({ status: "valid" as const }) };
+    const production = createLicenseRuntimeActivation(
+      { NODE_ENV: "production" },
+      true,
+      fallback,
+    );
+    const development = createLicenseRuntimeActivation({}, true, fallback);
+
+    expect(production.resolver).toBe(production.runtime);
+    expect(development.resolver).toBe(fallback);
+    expect(production.enforced).toBe(true);
+  });
+});

package/template/apps/server/src/license/activation.ts

@@ -0,0 +1,26 @@
+import type { LicenseEntitlementResolver } from "../runtime-license.js";
+import {
+  createPlatformLicenseRuntimeOptions,
+  hasConfiguredLicenseKeys,
+  PlatformLicenseRuntime,
+} from "./runtime-service.js";
+
+export function createLicenseRuntimeActivation(
+  env: Record<string, string | undefined>,
+  enabled: boolean,
+  fallbackResolver?: LicenseEntitlementResolver,
+) {
+  const options = createPlatformLicenseRuntimeOptions(env);
+  const runtime = new PlatformLicenseRuntime(options);
+  const useOfficialRuntime =
+    Boolean(options.enforceRestrictions) || hasConfiguredLicenseKeys(options);
+  return {
+    enforced: enabled,
+    runtime,
+    resolver: enabled
+      ? useOfficialRuntime
+        ? runtime
+        : fallbackResolver
+      : undefined,
+  };
+}

package/template/apps/server/src/license/restriction.test.ts

@@ -51,4 +51,20 @@ describe("License 限制模式 HTTP 白名单", () => {
       );
     }
   });
+
+  test("License Module 未启用时不进入全局限制模式", async () => {
+    const runtime = createServerRuntime(
+      {},
+      {
+        licenseEnforced: false,
+        licenseResolver: {
+          resolve: () => ({ status: "expired", restricted: true }),
+        },
+      },
+    );
+    const request = new Request("http://localhost/api/system/users");
+    const context = await runtime.createGuardContext(request);
+
+    expect(evaluateRestrictedHttpRequest(context, request).allowed).toBe(true);
+  });
 });