create-windy 0.3.19 → 0.4.0

package/template/apps/server/src/module-preflight.ts

@@ -0,0 +1,96 @@
+import {
+  validateModuleComposition,
+  type ModuleManifest,
+} from "@southwind-ai/modules";
+import type {
+  InstallableServerModule,
+  ModuleUploadPolicy,
+} from "@southwind-ai/server-sdk";
+import { loadFoundationModules } from "./foundation.js";
+import { serverCompositionDeclaration } from "./app/server-composition.js";
+import { initializeModuleHosts } from "./module-host.js";
+import { validateHostedModuleImplementations } from "./module-host/implementation-completeness.js";
+import { validateProjectServerAttachments } from "./module-host/project-attachments.js";
+import {
+  runtimeBusinessModules,
+  serverComposition,
+} from "./module-host/runtime-composition.js";
+import type {
+  WindyServerModuleAdapter,
+  WindyServerModuleAttachment,
+} from "@southwind-ai/server-sdk";
+
+export async function prepareServerModules(input: {
+  readonly modules: readonly ModuleManifest[];
+  readonly installations: readonly InstallableServerModule<ModuleManifest>[];
+  readonly baseUploadPolicies?: readonly ModuleUploadPolicy[];
+  readonly adapters?: readonly WindyServerModuleAdapter<ModuleManifest>[];
+  readonly attachments?: readonly WindyServerModuleAttachment<unknown>[];
+  readonly enabledModuleNames?: ReadonlySet<string>;
+}) {
+  const foundationModules = [...input.modules];
+  const canonicalInstallations = input.installations.map((installation) => ({
+    source: installation,
+    manifest: installation.manifest,
+    fingerprint: JSON.stringify(installation.manifest),
+    installation: {
+      manifest: installation.manifest,
+      setup: installation.setup,
+      setupSandbox: installation.setupSandbox,
+    } satisfies InstallableServerModule<ModuleManifest>,
+  }));
+  validateModuleComposition(foundationModules);
+  validateProjectServerAttachments({
+    attachments: input.attachments ?? [],
+    adapters: input.adapters ?? [],
+    enabledModuleNames: input.enabledModuleNames ?? new Set(),
+  });
+  const moduleHosts = await initializeModuleHosts({
+    modules: foundationModules,
+    installations: canonicalInstallations.map(
+      ({ installation }) => installation,
+    ),
+    baseUploadPolicies: input.baseUploadPolicies,
+  });
+  assertCanonicalManifestIntegrity(canonicalInstallations);
+  validateModuleComposition(foundationModules);
+  validateHostedModuleImplementations(
+    canonicalInstallations.map(({ installation }) => installation),
+    moduleHosts,
+  );
+  return { foundationModules, moduleHosts };
+}
+
+function assertCanonicalManifestIntegrity(
+  installations: readonly {
+    readonly source: InstallableServerModule<ModuleManifest>;
+    readonly manifest: ModuleManifest;
+    readonly fingerprint: string;
+  }[],
+): void {
+  for (const installation of installations) {
+    if (installation.source.manifest !== installation.manifest) {
+      throw new Error(
+        `Server Module 在 setup 期间替换了 canonical Manifest：${installation.manifest.name}`,
+      );
+    }
+    if (JSON.stringify(installation.manifest) !== installation.fingerprint) {
+      throw new Error(
+        `Server Module 在 setup 期间修改了 canonical Manifest：${installation.manifest.name}`,
+      );
+    }
+  }
+}
+
+export function prepareInstalledServerModules(
+  baseUploadPolicies: readonly ModuleUploadPolicy[],
+) {
+  return prepareServerModules({
+    modules: loadFoundationModules(),
+    installations: runtimeBusinessModules,
+    baseUploadPolicies,
+    adapters: serverCompositionDeclaration.adapters,
+    attachments: serverCompositionDeclaration.attachments,
+    enabledModuleNames: serverComposition.enabledModuleNames,
+  });
+}

package/template/apps/server/src/module-runtime-validation.ts

@@ -16,6 +16,7 @@ export function validateInstalledRuntime(input: {
   validateServerModuleComposition({
     modules: input.modules,
     routes: input.routes,
+    frameworkRoutes: ["GET /api/swagger", "GET /api/swagger/json"],
     tasks: input.tasks,
     tools: input.tools,
     aiOperations,

package/template/apps/server/src/platform-app-bootstrap.ts

@@ -0,0 +1,50 @@
+import type { ModuleManifest } from "@southwind-ai/modules";
+import type { FeatureFlagDefinition } from "@southwind-ai/shared";
+import type { AuthRepository } from "./auth/repository.js";
+import type { AuthService } from "./auth/service.js";
+// @windy-module system.license begin
+import type { PlatformLicenseRuntime } from "./license/runtime-service.js";
+import { registerPlatformLicenseRoutes } from "./license/routes.js";
+// @windy-module system.license end
+import {
+  createManifestAuthorizedRouteApp,
+  createStaticRouteAuthorizer,
+} from "./module-host/static-route-authorization.js";
+import type { createServerPersistence } from "./persistence.js";
+import {
+  createPlatformServerApp,
+  type PlatformServerAppInput,
+} from "./platform-http-runtime.js";
+import type { createServerRuntime } from "./runtime.js";
+import { registerSessionContextRoute } from "./session/routes.js";
+
+interface PlatformAppBootstrapInput extends Omit<
+  PlatformServerAppInput,
+  "runtime" | "persistence" | "features"
+> {
+  runtime: ReturnType<typeof createServerRuntime>;
+  persistence: ReturnType<typeof createServerPersistence>;
+  authRepository: AuthRepository;
+  authService: AuthService;
+  features: FeatureFlagDefinition[];
+  modules: readonly ModuleManifest[];
+  // @windy-module system.license begin
+  licenseRuntime: PlatformLicenseRuntime;
+  // @windy-module system.license end
+}
+
+export async function bootstrapPlatformApp(input: PlatformAppBootstrapInput) {
+  const app = await createPlatformServerApp(input);
+  const authorizer = createStaticRouteAuthorizer(input.runtime, input.modules);
+  // @windy-module system.license begin
+  registerPlatformLicenseRoutes(app, input.licenseRuntime, authorizer);
+  // @windy-module system.license end
+  registerSessionContextRoute(
+    createManifestAuthorizedRouteApp(app, authorizer, () => ({
+      immutableCoreAccess: true,
+    })),
+    input.runtime,
+    input.features,
+  );
+  return app;
+}

package/template/apps/server/src/platform-http-runtime.ts

@@ -15,8 +15,13 @@ import { registerProfileRoutes } from "./profile/routes.js";
 import type { createServerRuntime } from "./runtime.js";
 import type { SystemRepositories } from "./system/seed.js";
 import type { FeatureManifestSyncResult } from "./feature/manifest-feature-repository.js";
+import type { ModuleManifest } from "@southwind-ai/modules";
+import {
+  createManifestAuthorizedRouteApp,
+  createStaticRouteAuthorizer,
+} from "./module-host/static-route-authorization.js";
 
-interface CreatePlatformServerAppInput {
+export interface PlatformServerAppInput {
   runtime: ReturnType<typeof createServerRuntime>;
   persistence: ReturnType<typeof createServerPersistence>;
   platformConfig: PlatformConfig;
@@ -26,6 +31,7 @@ interface CreatePlatformServerAppInput {
   features: FeatureFlagDefinition[];
   logger: StructuredRequestLogger;
   observability: ReturnType<typeof createPlatformObservability>;
+  modules: readonly ModuleManifest[];
 }
 
 export function createHttpObservability(
@@ -44,9 +50,7 @@ export function createHttpObservability(
   });
 }
 
-export async function createPlatformServerApp(
-  input: CreatePlatformServerAppInput,
-) {
+export async function createPlatformServerApp(input: PlatformServerAppInput) {
   await bootstrapAdminPassword({
     authService: input.authService,
     authRepository: input.persistence?.authRepository,
@@ -54,9 +58,22 @@ export async function createPlatformServerApp(
     password: process.env.WINDY_BOOTSTRAP_ADMIN_PASSWORD,
   });
   const app = createPlatformHttpApp(input.runtime, input.observability);
-  input.observability.register(app);
-  registerAuthSessionRoute(app);
-  registerAuthRoutes(app, input.authService, {
+  const authorizer = createStaticRouteAuthorizer(input.runtime, input.modules);
+  const guardedApp = createManifestAuthorizedRouteApp(
+    app,
+    authorizer,
+    (method, path) =>
+      immutableCoreRoutes.has(`${method} /api${path}`)
+        ? { immutableCoreAccess: true }
+        : undefined,
+  );
+  input.observability.register(
+    createManifestAuthorizedRouteApp(app, authorizer, () => ({
+      immutableCoreAccess: true,
+    })),
+  );
+  registerAuthSessionRoute(guardedApp);
+  registerAuthRoutes(guardedApp, input.authService, {
     sessionCookieName: input.platformConfig.security.sessionCookieName,
     secureCookie: process.env.NODE_ENV === "production",
   });
@@ -69,6 +86,14 @@ export async function createPlatformServerApp(
   return app;
 }
 
+const immutableCoreRoutes = new Set([
+  "GET /api/auth/session",
+  "POST /api/auth/login",
+  "POST /api/auth/api/login",
+  "GET /api/auth/password/policy",
+  "POST /api/auth/logout",
+]);
+
 export function listenPlatformServer(
   app: ReturnType<typeof createPlatformHttpApp>,
 ): number {

package/template/apps/server/src/route-guards.test.ts

@@ -5,6 +5,10 @@ import {
   licenseVersionKey,
 } from "@southwind-ai/shared";
 import { evaluateAccessGuards } from "./access-guards.js";
+import {
+  systemFeatureKeyForPermission,
+  systemFeatureKeyForResource,
+} from "./route-guards.js";
 import { createServerRuntime } from "./runtime.js";
 
 const commercialFeature = {
@@ -18,6 +22,24 @@ const commercialFeature = {
 };
 
 describe("access guard pipeline", () => {
+  test("Permission 默认映射到同基础 Key Feature", () => {
+    expect(systemFeatureKeyForPermission("system.user.read")).toBe(
+      "system.user",
+    );
+    expect(systemFeatureKeyForPermission("business.report.manage")).toBe(
+      "business.report",
+    );
+  });
+
+  test("系统资源 Route 使用资源级 Feature", () => {
+    expect(systemFeatureKeyForResource("user")).toBe("system.user");
+    expect(systemFeatureKeyForResource("role")).toBe("system.role");
+    expect(systemFeatureKeyForResource("department")).toBe("system.department");
+    expect(systemFeatureKeyForResource("menu")).toBe("system.menu");
+    expect(systemFeatureKeyForResource("dict")).toBe("system.dict");
+    expect(systemFeatureKeyForResource("ops")).toBe("system.ops");
+  });
+
   test.each([
     {
       name: "缺少 Entitlement 优先拒绝",

package/template/apps/server/src/route-guards.ts

@@ -40,15 +40,22 @@ export function findFeature(
 
 export function systemFeatureKeyForResource(resourceName: string): string {
   const resourceFeatures: Record<string, string> = {
+    admin: "system.admin",
     agent: "system.agent",
     audit: "system.audit",
+    department: "system.department",
+    dict: "system.dict",
+    feature: "system.feature",
     license: "system.license",
+    menu: "system.menu",
     ops: "system.ops",
     notification: "system.notification",
+    role: "system.role",
     scheduler: "system.scheduler",
     settings: "system.settings",
+    user: "system.user",
   };
-  return resourceFeatures[resourceName] || "system.rbac";
+  return resourceFeatures[resourceName] || `system.${resourceName}`;
 }
 
 export function findSystemFeature(
@@ -59,6 +66,6 @@ export function findSystemFeature(
 }
 
 export function systemFeatureKeyForPermission(permissionKey: string): string {
-  const resource = permissionKey.split(".").at(1) || "";
-  return systemFeatureKeyForResource(resource);
+  const separator = permissionKey.lastIndexOf(".");
+  return separator > 0 ? permissionKey.slice(0, separator) : "";
 }

package/template/apps/server/src/runtime-audit-query.ts

@@ -0,0 +1,50 @@
+import type { AuditEvent } from "@southwind-ai/shared";
+
+export interface AuditEventListQuery {
+  page: number;
+  pageSize: number;
+  q?: string;
+  actorId?: string;
+  action?: string;
+  resource?: string;
+  resourceId?: string;
+  occurredAfter?: string;
+  occurredBefore?: string;
+  includeScheduler?: boolean;
+}
+
+export function matchesAuditQuery(
+  event: AuditEvent,
+  query: AuditEventListQuery,
+): boolean {
+  return (
+    (!query.q || matchesAuditKeyword(event, query.q)) &&
+    (!query.actorId || event.actor.id === query.actorId) &&
+    (!query.action || event.action === query.action) &&
+    (!query.resource || event.target?.type === query.resource) &&
+    (!query.resourceId || event.target?.id === query.resourceId) &&
+    (query.includeScheduler || event.actor.id !== "system_scheduler") &&
+    (!query.occurredAfter || event.occurredAt >= query.occurredAfter) &&
+    (!query.occurredBefore || event.occurredAt <= query.occurredBefore)
+  );
+}
+
+function matchesAuditKeyword(event: AuditEvent, query: string): boolean {
+  const keyword = query.toLowerCase();
+  const values = [
+    event.action,
+    event.actor.id,
+    event.actor.name,
+    event.target?.type,
+    event.target?.id,
+    event.target?.label,
+    event.actor.ip,
+    event.message,
+    event.module,
+    event.requestId,
+    event.metadata ? JSON.stringify(event.metadata) : undefined,
+  ];
+  return values.some((value) =>
+    value === undefined ? false : String(value).toLowerCase().includes(keyword),
+  );
+}

package/template/apps/server/src/runtime-feature.test.ts

@@ -0,0 +1,46 @@
+import { describe, expect, test } from "bun:test";
+import { featureKey, type FeatureFlagDefinition } from "@southwind-ai/shared";
+import { createRequestGuardContext } from "./guards.js";
+import { RuntimeFeatureCatalog } from "./runtime-feature.js";
+
+describe("运行时 Feature 的 Module 激活上限", () => {
+  test("数据库状态不能重新启用装配清单已停用的 Module", async () => {
+    const manifest = feature("system.ops", "system.operations");
+    const catalog = new RuntimeFeatureCatalog(
+      [manifest],
+      {
+        resolve: () => ({
+          key: manifest.key,
+          enabled: true,
+          visible: "visible",
+        }),
+      },
+      true,
+      new Set(["system.operations"]),
+    );
+
+    await expect(catalog.resolve(context(), manifest)).resolves.toMatchObject({
+      enabled: false,
+      visible: "hidden",
+      disabledReason: "disabled",
+    });
+  });
+});
+
+function feature(key: string, module: string): FeatureFlagDefinition {
+  return {
+    key: featureKey(key),
+    module,
+    label: key,
+    enabled: true,
+    visible: "visible",
+    stage: "stable",
+  };
+}
+
+function context() {
+  return createRequestGuardContext(new Request("http://localhost/api/test"), {
+    resolveActor: () => undefined,
+    resolveLicense: () => undefined,
+  });
+}

package/template/apps/server/src/runtime-feature.ts

@@ -38,6 +38,7 @@ export class RuntimeFeatureCatalog {
     definitions: readonly FeatureFlagDefinition[],
     private readonly resolver: FeatureFlagRuntimeResolver | undefined,
     private readonly production: boolean,
+    private readonly disabledModuleNames: ReadonlySet<string> = new Set(),
   ) {
     for (const definition of definitions) {
       this.definitions.set(definition.key, definition);
@@ -107,6 +108,9 @@ export class RuntimeFeatureCatalog {
   private async resolveOwnState(
     manifestFeature: FeatureFlagDefinition,
   ): Promise<FeatureFlagDefinition> {
+    if (this.disabledModuleNames.has(manifestFeature.module)) {
+      return disabledFeature(manifestFeature);
+    }
     if (!this.resolver) {
       return this.production
         ? disabledFeature(manifestFeature)
@@ -144,6 +148,7 @@ function isFeatureLicensedForContext(
   feature: FeatureFlagDefinition,
   context: RequestGuardContext,
 ): boolean {
+  if (context.licenseEnforced === false) return true;
   return (
     isLicenseVersionAllowed(feature, context.license?.versionKey) &&
     (!feature.requiredEntitlement ||

package/template/apps/server/src/runtime.ts

@@ -32,6 +32,10 @@ import {
   resolveRequestSource,
 } from "./http/request-source.js";
 import { resolveRequestActor } from "./runtime-request-actor.js";
+import {
+  matchesAuditQuery,
+  type AuditEventListQuery,
+} from "./runtime-audit-query.js";
 // @windy-module system.agent begin
 import {
   createAdkDebugRuntime,
@@ -44,6 +48,7 @@ export type {
   FeatureFlagRuntimeState,
   ResolvedFeatureFlag,
 } from "./runtime-feature.js";
+export type { AuditEventListQuery } from "./runtime-audit-query.js";
 
 export interface SessionRecord {
   token: string;
@@ -61,19 +66,6 @@ export interface AuditEventWriter {
   status?(): AuditWriteStatus;
 }
 
-export interface AuditEventListQuery {
-  page: number;
-  pageSize: number;
-  q?: string;
-  actorId?: string;
-  action?: string;
-  resource?: string;
-  resourceId?: string;
-  occurredAfter?: string;
-  occurredBefore?: string;
-  includeScheduler?: boolean;
-}
-
 export interface AuditEventReader {
   list(query: AuditEventListQuery): Promise<PageResult<AuditEvent>>;
 }
@@ -81,8 +73,10 @@ export interface AuditEventReader {
 export interface ServerRuntimeOptions {
   actorResolver?: RequestActorResolver;
   licenseResolver?: LicenseEntitlementResolver;
+  licenseEnforced?: boolean;
   featureResolver?: FeatureFlagRuntimeResolver;
   featureCatalog?: readonly FeatureFlagDefinition[];
+  disabledModuleNames?: ReadonlySet<string>;
   auditWriter?: AuditEventWriter;
   auditReader?: AuditEventReader;
   // @windy-module system.agent begin
@@ -225,6 +219,7 @@ export function createServerRuntime(
     options.featureCatalog || [],
     options.featureResolver,
     env.NODE_ENV === "production",
+    options.disabledModuleNames ?? new Set(),
   );
   const requestSourcePolicy = requestSourcePolicyFromEnv(env);
 
@@ -254,6 +249,7 @@ export function createServerRuntime(
         ...requestSource,
         resolveActor: () => actor,
         resolveLicense: () => license,
+        licenseEnforced: options.licenseEnforced,
       });
     },
     // @windy-module system.agent begin
@@ -276,6 +272,7 @@ export function createServerRuntime(
         ...requestSource,
         resolveActor: () => actor,
         resolveLicense: () => license,
+        licenseEnforced: options.licenseEnforced,
       });
     },
     async resolveFeature(
@@ -311,39 +308,3 @@ export function createServerRuntime(
     },
   };
 }
-
-function matchesAuditQuery(
-  event: AuditEvent,
-  query: AuditEventListQuery,
-): boolean {
-  return (
-    (!query.q || matchesAuditKeyword(event, query.q)) &&
-    (!query.actorId || event.actor.id === query.actorId) &&
-    (!query.action || event.action === query.action) &&
-    (!query.resource || event.target?.type === query.resource) &&
-    (!query.resourceId || event.target?.id === query.resourceId) &&
-    (query.includeScheduler || event.actor.id !== "system_scheduler") &&
-    (!query.occurredAfter || event.occurredAt >= query.occurredAfter) &&
-    (!query.occurredBefore || event.occurredAt <= query.occurredBefore)
-  );
-}
-
-function matchesAuditKeyword(event: AuditEvent, query: string): boolean {
-  const keyword = query.toLowerCase();
-  const values = [
-    event.action,
-    event.actor.id,
-    event.actor.name,
-    event.target?.type,
-    event.target?.id,
-    event.target?.label,
-    event.actor.ip,
-    event.message,
-    event.module,
-    event.requestId,
-    event.metadata ? JSON.stringify(event.metadata) : undefined,
-  ];
-  return values.some((value) =>
-    value === undefined ? false : String(value).toLowerCase().includes(keyword),
-  );
-}

package/template/apps/server/src/scheduler/audit-action.test.ts

@@ -0,0 +1,49 @@
+import { expect, test } from "bun:test";
+import { createFoundationSnapshot } from "../foundation.js";
+import { createServerRuntime } from "../runtime.js";
+import { InMemorySchedulerRepository } from "./repository.js";
+import { SchedulerService } from "./service.js";
+
+test("任务执行审计使用 Manifest 投影的动作", async () => {
+  const feature = createFoundationSnapshot().features.find(
+    ({ key }) => key === "system.workflow",
+  );
+  if (!feature) throw new Error("测试缺少 system.workflow Feature");
+  const runtime = createServerRuntime({
+    WINDY_DEV_ADMIN_TOKEN: "token",
+  });
+  const scheduler = new SchedulerService(
+    new InMemorySchedulerRepository(),
+    [
+      {
+        key: "system.workflow.timeout-test",
+        label: "审批超时测试",
+        intervalSeconds: 60,
+        maxAttempts: 3,
+        retryDelaySeconds: 10,
+        permissionKey: "system.workflow.manage",
+        auditAction: "workflow.timeout",
+        feature,
+        handler: () => undefined,
+      },
+    ],
+    runtime,
+  );
+  await scheduler.initialize();
+  const context = await runtime.createGuardContext(
+    new Request(
+      "http://localhost/api/system/scheduled-tasks/system.workflow.timeout-test/trigger",
+      { headers: { authorization: "Bearer token" } },
+    ),
+  );
+
+  expect(
+    await scheduler.triggerManual("system.workflow.timeout-test", context),
+  ).toMatchObject({ ok: true });
+  expect(runtime.auditSink.list()).toContainEqual(
+    expect.objectContaining({
+      action: "workflow.timeout",
+      outcome: "success",
+    }),
+  );
+});

package/template/apps/server/src/scheduler/audit.ts

@@ -6,7 +6,7 @@ import type { ScheduledTaskRun } from "./types.js";
 export function schedulerAuditEvent(
   context: RequestGuardContext,
   run: ScheduledTaskRun,
-  action: "task.trigger" | "task.execute",
+  action: AuditEvent["action"],
   outcome: AuditEvent["outcome"],
   occurredAt: Date,
 ): AuditEvent {

package/template/apps/server/src/scheduler/execution-recorder.ts

@@ -38,7 +38,7 @@ export class SchedulerExecutionRecorder {
       await this.repository.discardRun(run.id);
       return completed;
     }
-    this.record(context, completed, "task.execute", "success");
+    this.record(context, completed, definition.auditAction, "success");
     return completed;
   }
 
@@ -59,14 +59,19 @@ export class SchedulerExecutionRecorder {
         : undefined,
       error: sanitizeExecutionError(error),
     });
-    this.record(context, completed, "task.execute", "failure");
+    this.record(context, completed, definition.auditAction, "failure");
     return completed;
   }
 
-  denied(context: RequestGuardContext, run: ScheduledTaskRun, reason: string) {
+  denied(
+    context: RequestGuardContext,
+    run: ScheduledTaskRun,
+    definition: ScheduledTaskDefinition,
+    reason: string,
+  ) {
     if (this.denialReasons.get(run.taskKey) === reason) return;
     this.denialReasons.set(run.taskKey, reason);
-    this.record(context, run, "task.execute", "denied");
+    this.record(context, run, definition.auditAction, "denied");
   }
 
   trigger(context: RequestGuardContext, run: ScheduledTaskRun) {
@@ -91,7 +96,7 @@ export class SchedulerExecutionRecorder {
   private record(
     context: RequestGuardContext,
     run: ScheduledTaskRun,
-    action: "task.trigger" | "task.execute",
+    action: AuditEvent["action"],
     outcome: AuditEvent["outcome"],
   ) {
     this.runtime.auditSink.recordEvent(

package/template/apps/server/src/scheduler/recovery-service.test.ts

@@ -183,9 +183,10 @@ async function createFixture(options: FixtureOptions = {}) {
         label: "测试任务",
         intervalSeconds: 100,
         maxAttempts: 3,
-        retryDelaySeconds: 10,
-        permissionKey: "system.scheduler.manage",
-        feature: {
+      retryDelaySeconds: 10,
+      permissionKey: "system.scheduler.manage",
+      auditAction: "task.execute",
+      feature: {
           ...feature,
           requiredEntitlement: entitlementKey("capability.scheduler"),
         },

package/template/apps/server/src/scheduler/service-idle.test.ts

@@ -24,9 +24,10 @@ test("自动轮询没有领取任务时不写历史和审计，人工触发仍
         label: "测试任务",
         intervalSeconds: 100,
         maxAttempts: 3,
-        retryDelaySeconds: 10,
-        permissionKey: "system.scheduler.manage",
-        feature: {
+      retryDelaySeconds: 10,
+      permissionKey: "system.scheduler.manage",
+      auditAction: "task.execute",
+      feature: {
           ...feature,
           requiredEntitlement: entitlementKey("capability.scheduler"),
         },

package/template/apps/server/src/scheduler/service.test.ts

@@ -294,6 +294,7 @@ async function createFixture(
         maxAttempts: 3,
         retryDelaySeconds: 10,
         permissionKey: "system.scheduler.manage",
+        auditAction: "task.execute",
         feature: {
           ...feature,
           requiredEntitlement: entitlementKey("capability.scheduler"),