create-windy 0.8.3 → 0.10.0

package/template/apps/server/src/observability/diagnostic-index.ts

@@ -0,0 +1,113 @@
+import { randomUUIDv7 } from "bun";
+import type {
+  DiagnosticRecord,
+  PageRequest,
+  PageResult,
+} from "@southwind-ai/shared";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { DrizzleDiagnosticIndex } from "./diagnostic-repository.js";
+
+export type { DiagnosticRecord } from "@southwind-ai/shared";
+export const DIAGNOSTIC_RETENTION_DAYS = 30;
+const RETENTION_MS = DIAGNOSTIC_RETENTION_DAYS * 86_400_000;
+const ID_PATTERN =
+  /^diag-([0-9a-f]{8})-([0-9a-f]{4})-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+
+export interface DiagnosticIndex {
+  record(record: DiagnosticRecord): Promise<void>;
+  find(id: string, now?: Date): Promise<DiagnosticRecord | undefined>;
+  list(page: PageRequest, now?: Date): Promise<PageResult<DiagnosticRecord>>;
+  purgeExpired(now?: Date): Promise<number>;
+}
+
+export function createDiagnosticIndex(db?: NodePgDatabase): DiagnosticIndex {
+  return db ? new DrizzleDiagnosticIndex(db) : new InMemoryDiagnosticIndex();
+}
+
+export function newDiagnosticId(): string {
+  return `diag-${randomUUIDv7()}`;
+}
+
+export function validDiagnosticId(id: string): boolean {
+  return ID_PATTERN.test(id);
+}
+
+export function expiredDiagnosticId(id: string, now = new Date()): boolean {
+  const match = ID_PATTERN.exec(id);
+  return Boolean(
+    match &&
+    Number.parseInt(`${match[1]}${match[2]}`, 16) + RETENTION_MS <=
+      now.getTime(),
+  );
+}
+
+export function safeDiagnosticCode(value: unknown, statusCode: number): string {
+  return typeof value === "string" && /^[A-Z][A-Z0-9_]{1,79}$/.test(value)
+    ? value
+    : statusCode >= 500
+      ? "UNEXPECTED_FAILURE"
+      : `HTTP_${statusCode}`;
+}
+
+export function diagnosticRecord(
+  input: Omit<DiagnosticRecord, "occurredAt" | "expiresAt">,
+  now = new Date(),
+): DiagnosticRecord {
+  return {
+    ...input,
+    occurredAt: now.toISOString(),
+    expiresAt: new Date(now.getTime() + RETENTION_MS).toISOString(),
+  };
+}
+
+/** 无数据库开发模式有界保存；正式部署使用相同接口的 Drizzle Repository。 */
+export class InMemoryDiagnosticIndex implements DiagnosticIndex {
+  private readonly items = new Map<string, DiagnosticRecord>();
+  constructor(private readonly maxItems = 10_000) {}
+
+  async record(record: DiagnosticRecord): Promise<void> {
+    this.items.set(record.diagnosticId, structuredClone(record));
+    if (this.items.size > this.maxItems)
+      this.items.delete(this.items.keys().next().value!);
+  }
+
+  async find(
+    id: string,
+    now = new Date(),
+  ): Promise<DiagnosticRecord | undefined> {
+    const item = validDiagnosticId(id) ? this.items.get(id) : undefined;
+    return item && new Date(item.expiresAt) > now
+      ? structuredClone(item)
+      : undefined;
+  }
+
+  async list(
+    { page, pageSize }: PageRequest,
+    now = new Date(),
+  ): Promise<PageResult<DiagnosticRecord>> {
+    const active = [...this.items.values()]
+      .filter((record) => new Date(record.expiresAt) > now)
+      .sort(
+        (left, right) =>
+          right.occurredAt.localeCompare(left.occurredAt) ||
+          right.diagnosticId.localeCompare(left.diagnosticId),
+      );
+    const start = (page - 1) * pageSize;
+    return {
+      items: structuredClone(active.slice(start, start + pageSize)),
+      total: active.length,
+      page,
+      pageSize,
+    };
+  }
+
+  async purgeExpired(now = new Date()): Promise<number> {
+    let count = 0;
+    for (const [id, item] of this.items) {
+      if (new Date(item.expiresAt) > now) continue;
+      this.items.delete(id);
+      count++;
+    }
+    return count;
+  }
+}

package/template/apps/server/src/observability/diagnostic-repository.ts

@@ -0,0 +1,96 @@
+import { and, desc, eq, gt, inArray, lte } from "drizzle-orm";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { diagnosticEvents } from "@southwind-ai/database";
+import type {
+  DiagnosticRecord,
+  PageRequest,
+  PageResult,
+} from "@southwind-ai/shared";
+import type { DiagnosticIndex } from "./diagnostic-index.js";
+
+export class DrizzleDiagnosticIndex implements DiagnosticIndex {
+  constructor(private readonly db: NodePgDatabase) {}
+
+  async record(record: DiagnosticRecord): Promise<void> {
+    await this.db
+      .insert(diagnosticEvents)
+      .values({
+        ...record,
+        occurredAt: new Date(record.occurredAt),
+        expiresAt: new Date(record.expiresAt),
+      })
+      .onConflictDoNothing();
+  }
+
+  async find(
+    id: string,
+    now = new Date(),
+  ): Promise<DiagnosticRecord | undefined> {
+    const [row] = await this.db
+      .select()
+      .from(diagnosticEvents)
+      .where(
+        and(
+          eq(diagnosticEvents.diagnosticId, id),
+          gt(diagnosticEvents.expiresAt, now),
+        ),
+      )
+      .limit(1);
+    return row ? toRecord(row) : undefined;
+  }
+
+  async list(
+    { page, pageSize }: PageRequest,
+    now = new Date(),
+  ): Promise<PageResult<DiagnosticRecord>> {
+    const active = gt(diagnosticEvents.expiresAt, now);
+    const total = await this.db.$count(diagnosticEvents, active);
+    const start = (page - 1) * pageSize;
+    const rows =
+      start < total
+        ? await this.db
+            .select()
+            .from(diagnosticEvents)
+            .where(active)
+            .orderBy(
+              desc(diagnosticEvents.occurredAt),
+              desc(diagnosticEvents.diagnosticId),
+            )
+            .limit(pageSize)
+            .offset(start)
+        : [];
+    return { items: rows.map(toRecord), total, page, pageSize };
+  }
+
+  async purgeExpired(now = new Date()): Promise<number> {
+    const expired = await this.db
+      .select({ id: diagnosticEvents.diagnosticId })
+      .from(diagnosticEvents)
+      .where(lte(diagnosticEvents.expiresAt, now))
+      .limit(5_000);
+    if (!expired.length) return 0;
+    const removed = await this.db
+      .delete(diagnosticEvents)
+      .where(
+        and(
+          inArray(
+            diagnosticEvents.diagnosticId,
+            expired.map(({ id }) => id),
+          ),
+          lte(diagnosticEvents.expiresAt, now),
+        ),
+      )
+      .returning({ id: diagnosticEvents.diagnosticId });
+    return removed.length;
+  }
+}
+
+function toRecord(row: typeof diagnosticEvents.$inferSelect): DiagnosticRecord {
+  return {
+    ...row,
+    service: "server",
+    stage: "http",
+    occurredAt: row.occurredAt.toISOString(),
+    expiresAt: row.expiresAt.toISOString(),
+  };
+}

package/template/apps/server/src/platform-app-bootstrap.ts

@@ -1,3 +1,11 @@
+// @windy-module system.agent begin
+import { prepareAgentGovernance } from "./agent/governance-runtime.js";
+import { registerAgentSkillRoutes } from "./agent-skills/bootstrap.js";
+import { registerDshWorkbenchRoutes } from "./app/dsh-workbench.js";
+// @windy-module system.agent end
+// @windy-module system.audit begin
+import { registerDiagnosticRoutes } from "./system/diagnostic-routes.js";
+// @windy-module system.audit end
 import type { ModuleManifest } from "@southwind-ai/modules";
 import type { FeatureFlagDefinition } from "@southwind-ai/shared";
 import type { AuthRepository } from "./auth/repository.js";
@@ -35,6 +43,15 @@ interface PlatformAppBootstrapInput extends Omit<
 
 export async function bootstrapPlatformApp(input: PlatformAppBootstrapInput) {
   const app = await createPlatformServerApp(input);
+  // @windy-module system.audit begin
+  if (input.modules.some((module) => module.name === "system.audit"))
+    registerDiagnosticRoutes(
+      app,
+      input.runtime,
+      input.features,
+      input.observability.diagnostics,
+    );
+  // @windy-module system.audit end
   const authorizer = createStaticRouteAuthorizer(input.runtime, input.modules);
   // @windy-module system.license begin
   registerPlatformLicenseRoutes(app, input.licenseRuntime, authorizer);
@@ -46,5 +63,30 @@ export async function bootstrapPlatformApp(input: PlatformAppBootstrapInput) {
     input.runtime,
     input.features,
   );
+  // @windy-module system.agent begin
+  if (input.modules.some((module) => module.name === "system.agent")) {
+    const governance = await prepareAgentGovernance({
+      runtime: input.runtime,
+      modules: input.modules,
+      db: input.persistence?.db,
+    });
+    registerAgentSkillRoutes(
+      createManifestAuthorizedRouteApp(app, authorizer),
+      governance.skills,
+    );
+    registerDshWorkbenchRoutes({
+      app,
+      runtime: input.runtime,
+      modules: input.modules,
+      authRepository: input.authRepository,
+      sessionCookieName: input.platformConfig.security.sessionCookieName,
+      enabled: input.platformConfig.enableAI,
+      options: {
+        publishedSkills: (context) =>
+          governance.skills.publishedBundles(context),
+      },
+    });
+  }
+  // @windy-module system.agent end
   return app;
 }

package/template/apps/server/src/platform-http-runtime.ts

@@ -1,3 +1,6 @@
+// @windy-module system.audit begin
+import { createDiagnosticIndex } from "./observability/diagnostic-index.js";
+// @windy-module system.audit end
 import type { PlatformConfig } from "@southwind-ai/config";
 import type { FeatureFlagDefinition } from "@southwind-ai/shared";
 import type { AuthRepository } from "./auth/repository.js";
@@ -52,6 +55,9 @@ export function createHttpObservability(
     databaseRequired: process.env.NODE_ENV === "production",
     auditStatus: () => runtime.auditSink.status(),
     logger,
+    // @windy-module system.audit begin
+    diagnosticIndex: createDiagnosticIndex(persistence?.db),
+    // @windy-module system.audit end
   });
 }
 
@@ -111,7 +117,7 @@ export function listenPlatformServer(
 ): number {
   const port = process.env.PORT ? Number(process.env.PORT) : 9_747;
   app.listen(port);
-  return port;
+  return app.server?.port ?? port;
 }
 
 export function logServerStartup(

package/template/apps/server/src/runtime-development.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, test } from "bun:test";
+import { systemModuleManifests } from "@southwind-ai/modules";
+import { developmentAdminActor } from "./runtime-development.js";
+
+describe("开发Token默认权限", () => {
+  test("随Manifest补充标准能力，不自动授予敏感披露或治理导出", () => {
+    const actor = developmentAdminActor();
+    const permissions = systemModuleManifests().flatMap(
+      (module) => module.permissions,
+    );
+    const standard = permissions.filter(
+      ({ accessRisk }) => !accessRisk || accessRisk === "standard",
+    );
+    const restricted = permissions.filter(
+      ({ accessRisk }) => accessRisk && accessRisk !== "standard",
+    );
+    expect(standard.length).toBeGreaterThan(0);
+    for (const permission of standard)
+      expect(actor.permissionKeys).toContain(permission.key);
+    for (const permission of restricted)
+      expect(actor.permissionKeys).not.toContain(permission.key);
+    expect(actor.permissionKeys).not.toContain("system.user.reveal");
+    expect(actor.permissionKeys).not.toContain("system.user.export");
+  });
+});

package/template/apps/server/src/runtime-development.ts

@@ -1,3 +1,4 @@
+import { systemModuleManifests } from "@southwind-ai/modules";
 import type { RequestActor } from "./guards.js";
 // @windy-module work-order begin
 import { exampleDevelopmentPermissionKeys } from "./example-permissions.js";
@@ -21,50 +22,11 @@ export function developmentAdminActor(): RequestActor {
       },
     ]),
     permissionKeys: [
-      "system.admin.access",
-      "system.menu.read",
-      "system.profile.read",
-      "system.profile.manage",
-      "system.user.read",
-      "system.user.manage",
-      "system.user-directory.read",
-      "system.role.read",
-      "system.role.manage",
-      "system.department.read",
-      "system.department.create",
-      "system.department.manage",
-      "system.menu.manage",
-      "system.dict.read",
-      "system.dict.manage",
-      "system.feature.read",
-      "system.feature.manage",
-      "system.ui-components.read",
-      "system.search.read",
-      "system.search.manage",
-      "system.settings.read",
-      "system.settings.manage",
-      "system.watermark.read",
-      "system.watermark.manage",
-      // @windy-module system.license begin
-      "system.license.read",
-      "system.license.manage",
-      // @windy-module system.license end
-      "system.audit.read",
-      "system.agent.read",
-      "system.ops.read",
-      "system.scheduler.read",
-      "system.scheduler.manage",
-      "system.notification.read",
-      "system.notification.update",
-      "system.notification.manage",
-      "system.bulk-data.manage",
-      "system.storage.read",
-      "system.storage.create",
-      "system.storage.manage",
-      "system.workflow.read",
-      "system.workflow.create",
-      "system.workflow.approve",
-      "system.workflow.manage",
+      ...systemModuleManifests().flatMap((module) =>
+        module.permissions
+          .filter(({ accessRisk }) => !accessRisk || accessRisk === "standard")
+          .map((permission) => permission.key),
+      ),
       // @windy-module work-order begin
       ...exampleDevelopmentPermissionKeys,
       // @windy-module work-order end

package/template/apps/server/src/runtime-feature.ts

@@ -39,6 +39,7 @@ export class RuntimeFeatureCatalog {
     private readonly resolver: FeatureFlagRuntimeResolver | undefined,
     private readonly production: boolean,
     private readonly disabledModuleNames: ReadonlySet<string> = new Set(),
+    private readonly disabledFeatureKeys: ReadonlySet<string> = new Set(),
   ) {
     for (const definition of definitions) {
       this.definitions.set(definition.key, definition);
@@ -108,7 +109,10 @@ export class RuntimeFeatureCatalog {
   private async resolveOwnState(
     manifestFeature: FeatureFlagDefinition,
   ): Promise<FeatureFlagDefinition> {
-    if (this.disabledModuleNames.has(manifestFeature.module)) {
+    if (
+      this.disabledModuleNames.has(manifestFeature.module) ||
+      this.disabledFeatureKeys.has(manifestFeature.key)
+    ) {
       return disabledFeature(manifestFeature);
     }
     if (!this.resolver) {

package/template/apps/server/src/runtime.ts

@@ -70,6 +70,7 @@ export interface ServerRuntimeOptions {
   featureResolver?: FeatureFlagRuntimeResolver;
   featureCatalog?: readonly FeatureFlagDefinition[];
   disabledModuleNames?: ReadonlySet<string>;
+  disabledFeatureKeys?: ReadonlySet<string>;
   auditWriter?: AuditEventWriter;
   auditReader?: AuditEventReader;
 }
@@ -197,11 +198,13 @@ export function createServerRuntime(
     options.featureResolver,
     env.NODE_ENV === "production",
     options.disabledModuleNames ?? new Set(),
+    options.disabledFeatureKeys,
   );
   const requestSourcePolicy = requestSourcePolicyFromEnv(env);
 
   return {
     auditSink,
+    featureDefinitions: options.featureCatalog ?? [],
     async createGuardContext(
       request: Request,
       metadata: { clientIp?: string } = {},

package/template/apps/server/src/settings/drizzle-watermark-repository.ts

@@ -1,6 +1,6 @@
 import { platformWatermarkPolicies } from "@southwind-ai/database";
 import type { PlatformWatermarkPolicy } from "@southwind-ai/shared";
-import { eq } from "drizzle-orm";
+import { and, eq, sql } from "drizzle-orm";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { WatermarkPolicyRepository } from "./watermark-repository.js";
 
@@ -25,6 +25,25 @@ export class DrizzleWatermarkPolicyRepository implements WatermarkPolicyReposito
     policy: PlatformWatermarkPolicy,
     actorId: string,
   ): Promise<PlatformWatermarkPolicy> {
+    const updated = await this.write(policy, actorId);
+    if (!updated) throw new Error("水印策略保存失败");
+    return updated;
+  }
+
+  updateIfCurrent(
+    before: PlatformWatermarkPolicy,
+    policy: PlatformWatermarkPolicy,
+    actorId: string,
+  ) {
+    return this.write(policy, actorId, before);
+  }
+
+  private async write(
+    policy: PlatformWatermarkPolicy,
+    actorId: string,
+    before?: PlatformWatermarkPolicy,
+  ) {
+    const table = platformWatermarkPolicies;
     const [row] = await this.db
       .insert(platformWatermarkPolicies)
       .values({
@@ -35,7 +54,20 @@ export class DrizzleWatermarkPolicyRepository implements WatermarkPolicyReposito
         updatedBy: actorId,
       })
       .onConflictDoUpdate({
-        target: platformWatermarkPolicies.id,
+        target: table.id,
+        setWhere:
+          before &&
+          and(
+            eq(
+              sql<boolean>`(${table.enabled} and ${table.businessPagesEnabled})`,
+              before.enabled,
+            ),
+            eq(table.density, before.density),
+            eq(table.contentFields, before.contentFields),
+            eq(table.customContent, before.customContent),
+            eq(table.opacityPercent, before.opacityPercent),
+            eq(table.fontSize, before.fontSize),
+          ),
         set: {
           enabled: policy.enabled,
           businessPagesEnabled: policy.enabled,
@@ -49,8 +81,7 @@ export class DrizzleWatermarkPolicyRepository implements WatermarkPolicyReposito
         },
       })
       .returning();
-    if (!row) throw new Error("水印策略保存失败");
-    return toPolicy(row);
+    return row ? toPolicy(row) : undefined;
   }
 }
 

package/template/apps/server/src/settings/watermark-repository.ts

@@ -4,6 +4,11 @@ import {
 } from "@southwind-ai/shared";
 
 export interface WatermarkPolicyRepository {
+  updateIfCurrent(
+    before: PlatformWatermarkPolicy,
+    policy: PlatformWatermarkPolicy,
+    actorId: string,
+  ): Promise<PlatformWatermarkPolicy | undefined>;
   get(): Promise<PlatformWatermarkPolicy>;
   update(
     policy: PlatformWatermarkPolicy,
@@ -22,6 +27,15 @@ export class InMemoryWatermarkPolicyRepository implements WatermarkPolicyReposit
     return { ...this.policy };
   }
 
+  async updateIfCurrent(
+    before: PlatformWatermarkPolicy,
+    policy: PlatformWatermarkPolicy,
+    actorId: string,
+  ) {
+    if (JSON.stringify(this.policy) !== JSON.stringify(before)) return;
+    return this.update(policy, actorId);
+  }
+
   async update(
     policy: PlatformWatermarkPolicy,
     _actorId: string,

package/template/apps/server/src/settings/watermark-routes.test.ts

@@ -17,7 +17,9 @@ class FakeRouteApp implements RouteApp {
     this.handlers.set(`GET ${path}`, handler);
   }
 
-  post(): void {}
+  post(path: string, handler: (context: unknown) => unknown): void {
+    this.handlers.set(`POST ${path}`, handler);
+  }
 
   put(path: string, handler: (context: unknown) => unknown): void {
     this.handlers.set(`PUT ${path}`, handler);
@@ -25,7 +27,11 @@ class FakeRouteApp implements RouteApp {
 
   delete(): void {}
 
-  invoke(method: "GET" | "PUT", path: string, context: unknown = {}): unknown {
+  invoke(
+    method: "GET" | "POST" | "PUT",
+    path: string,
+    context: unknown = {},
+  ): unknown {
     const handler = this.handlers.get(`${method} ${path}`);
     if (!handler) throw new Error(`未注册路由 ${method} ${path}`);
     return handler(context);
@@ -206,6 +212,82 @@ describe("平台水印策略路由", () => {
   });
 });
 
+describe("水印 YAML 迁移", () => {
+  const path = "/system/settings/watermark/yaml";
+
+  test("导出白名单字段，预览不写入，拒绝过期确认并保留目标自定义内容", async () => {
+    const fixture = await createFixture(settingsActor(true));
+    const { app, guardContext, repository, runtime } = fixture;
+    const current = {
+      ...(await repository.get()),
+      customContent: "实例专用文字",
+    };
+    await update(fixture, current);
+
+    const exported = (await app.invoke("GET", path, {
+      guardContext,
+    })) as Response;
+    const yaml = (await exported.text()).replace("medium", "high");
+    expect(yaml).not.toContain("customContent");
+    expect(yaml).not.toContain(current.customContent);
+    const preview = async () =>
+      (await app.invoke("POST", `${path}/preview`, {
+        guardContext,
+        body: { yaml },
+      })) as { revision: string; changes: unknown[] };
+    const apply = (revision: string) =>
+      app.invoke("POST", path, {
+        guardContext,
+        body: { yaml, revision },
+      });
+
+    const first = await preview();
+    expect(first.changes).toEqual([
+      { key: "density", before: "medium", after: "high" },
+    ]);
+    expect(await repository.get()).toEqual(current);
+
+    await update(fixture, { ...current, density: "low" });
+    expect(((await apply(first.revision)) as Response).status).toBe(409);
+    expect((await repository.get()).density).toBe("low");
+    expect(await apply((await preview()).revision)).toMatchObject({
+      density: "high",
+      customContent: current.customContent,
+    });
+    expect(runtime.auditSink.list()).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          action: "config.update",
+          metadata: { source: "yaml", changedFields: ["density"] },
+        }),
+      ]),
+    );
+  });
+
+  test("只读用户无法预览，未知字段不能导入", async () => {
+    const reader = await createFixture(settingsActor(false));
+    const exported = (await reader.app.invoke("GET", path, {
+      guardContext: reader.guardContext,
+    })) as Response;
+    const yaml = await exported.text();
+    expect(
+      (
+        (await reader.app.invoke("POST", `${path}/preview`, {
+          guardContext: reader.guardContext,
+          body: { yaml },
+        })) as Response
+      ).status,
+    ).toBe(403);
+
+    const admin = await createFixture(settingsActor(true));
+    const invalid = (await admin.app.invoke("POST", `${path}/preview`, {
+      guardContext: admin.guardContext,
+      body: { yaml: `${yaml}  secret: redacted\n` },
+    })) as Response;
+    expect(invalid.status).toBe(400);
+  });
+});
+
 async function update(
   fixture: Awaited<ReturnType<typeof createFixture>>,
   body: PlatformWatermarkPolicy,