create-windy 0.3.19 → 0.4.0

package/template/packages/server-sdk/src/route-definition.ts

@@ -13,14 +13,15 @@ export type ModuleRouteHandler = (
  * （path 含 `/api` 前缀）；宿主据此绑定 Guard（权限 / Feature / License），
  * 无需模块手工接线。`permissionKey` 必须与 Manifest 绑定一致并属于本模块命名空间。
  *
- * 声明 `auditAction` 时，宿主在 Handler 成功返回后自动写入一条该动作的审计事件；
- * 动作必须是本模块 Manifest `auditActions` 已注册的动作。
+ * 宿主从同一 API binding 读取 Audit Action，并在 Handler 成功且实现未自行发出同一
+ * 动作时补写审计。实现不需要重复维护动作 Key。
  */
 export interface ModuleRouteDefinition {
   readonly method: ModuleRouteMethod;
   readonly path: string;
   readonly permissionKey: string;
   readonly featureKey?: string;
+  /** @deprecated Audit Action 以 Manifest API binding 为唯一事实源。 */
   readonly auditAction?: string;
   readonly handler: ModuleRouteHandler;
 }

package/template/packages/shared/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/shared",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {

package/template/packages/shared/src/audit.test.ts

@@ -10,6 +10,13 @@ describe("审计动作目录", () => {
       label: "功能开关更新",
       description: "更新功能开关状态、可见性或 License 适用范围。",
     });
+    expect(AUDIT_ACTION_DEFINITIONS.map(({ key }) => key)).toEqual(
+      expect.arrayContaining([
+        "data.read",
+        "file.upload.part.write",
+        "agent.mcp.access",
+      ]),
+    );
     expect(new Set(AUDIT_ACTION_DEFINITIONS.map(({ key }) => key)).size).toBe(
       AUDIT_ACTION_DEFINITIONS.length,
     );

package/template/packages/shared/src/audit.ts

@@ -28,6 +28,7 @@ export const AUDIT_ACTION_DEFINITIONS = [
   { key: "crud.update", label: "数据更新", description: "修改业务记录。" },
   { key: "crud.delete", label: "数据删除", description: "删除业务记录。" },
   { key: "crud.restore", label: "数据恢复", description: "恢复已删除记录。" },
+  { key: "data.read", label: "数据读取", description: "读取业务记录或目录。" },
   { key: "data.import", label: "数据导入", description: "同步导入数据。" },
   { key: "data.export", label: "数据导出", description: "同步导出数据。" },
   {
@@ -95,6 +96,11 @@ export const AUDIT_ACTION_DEFINITIONS = [
     label: "创建文件上传",
     description: "创建受控文件上传会话。",
   },
+  {
+    key: "file.upload.part.write",
+    label: "写入文件分片",
+    description: "向受控上传会话写入文件分片。",
+  },
   {
     key: "file.upload.complete",
     label: "完成文件上传",
@@ -214,11 +220,21 @@ export const AUDIT_ACTION_DEFINITIONS = [
   { key: "task.read", label: "任务查看", description: "查看任务状态或历史。" },
   { key: "task.execute", label: "任务执行", description: "后台任务实际执行。" },
   { key: "task.recover", label: "任务恢复", description: "人工恢复异常任务。" },
+  {
+    key: "agent.mcp.access",
+    label: "MCP 接口访问",
+    description: "访问平台 MCP Streamable HTTP 协议入口。",
+  },
   {
     key: "agent.tool.execute",
     label: "Agent 工具执行",
     description: "Agent 调用受控平台工具。",
   },
+  {
+    key: "agent.operation.execute",
+    label: "AI 操作执行",
+    description: "执行 Agent、Document、Speech 或 Embedding 操作。",
+  },
   {
     key: "security.denied",
     label: "安全拒绝",

package/template/packages/shared/src/migration-bundle-validation.ts

@@ -23,26 +23,24 @@ export function normalizeManifestBundles(
         `Migration Bundle ${bundle.module} 版本 ${bundle.version} 与 Manifest ${manifest.version} 不一致`,
       );
     }
-    assertSameDependencies(manifest, bundle);
+    assertBundleDependenciesDeclared(manifest, bundle);
     assertSameMigrations(manifest, bundle);
     assertSchemaMigrationReferences(manifest, bundle);
     return bundle;
   });
 }
 
-function assertSameDependencies(
+function assertBundleDependenciesDeclared(
   manifest: MigrationManifestSource,
   bundle: MigrationBundle,
 ): void {
-  const declared = manifest.dependencies || [];
-  const bundled = bundle.dependencies || [];
-  if (
-    declared.length !== bundled.length ||
-    declared.some((dependency) => !bundled.includes(dependency))
-  ) {
-    throw new Error(
-      `Manifest ${manifest.name} 的 dependencies 必须与 Migration Bundle 一致`,
-    );
+  const declared = new Set(manifest.dependencies || []);
+  for (const dependency of bundle.dependencies || []) {
+    if (!declared.has(dependency)) {
+      throw new Error(
+        `Migration Bundle ${bundle.module} 依赖未在 Manifest 声明：${dependency}`,
+      );
+    }
   }
 }
 

package/template/packages/shared/src/rbac.ts

@@ -3,6 +3,7 @@ import type {
   EntityId,
   LifecycleStatus,
 } from "./primitives.js";
+import type { AuditActionType } from "./audit.js";
 
 export type HttpMethod =
   | "GET"
@@ -90,6 +91,7 @@ export interface ApiPermissionBinding {
   permissionKey: string;
   anonymous?: boolean;
   featureKey?: string;
+  auditAction?: AuditActionType;
 }
 
 export interface MenuNode {

package/template/apps/web/src/app/business-routes.ts

@@ -1,22 +0,0 @@
-import type { Component } from "vue";
-import type { RouteRecordRaw } from "vue-router";
-
-export interface BusinessAdminRouteRegistration {
-  readonly key: string;
-  readonly path: string;
-  readonly title: string;
-  readonly component: Component;
-  readonly featureKey: string;
-  readonly permissionKey: string;
-  readonly name?: string;
-  readonly props?: RouteRecordRaw["props"];
-}
-
-/**
- * 客户拥有的 Web 业务路由注册表。
- *
- * 导航标题、路径、Feature 和 Permission 必须与业务 Module Manifest 保持一致。
- * 平台 Router 会统一接入访问快照 Guard，业务项目不需要修改 shared-scaffold。
- */
-export const installedBusinessAdminRoutes =
-  [] satisfies readonly BusinessAdminRouteRegistration[];