feat: SFMC Desktop 与平台运行指标发布候选

.changeset/desktop-preview-safety.md

@@ -0,0 +1,5 @@
+---
+"@sfmc-bds/cli": patch
+---
+
+桌面接入计划保留高于 npm latest 的平台版本，避免把独立预览部署降级到旧稳定版。未配置 BDS 路径的空目录可以完成管理握手并进入初始化向导。

.changeset/disable-manifest-toggle-policy.md

@@ -0,0 +1,7 @@
+---
+"@sfmc-bds/sdk": minor
+"@sfmc-bds/db-server": minor
+"@sfmc-bds/cli": minor
+---
+
+停用模块 manifest 的 `canDisable` 与 `enabledByDefault`：从 JSON Schema 和 TypeScript 契约移除，SDK v2/v3 校验及 DB 加载器拒绝包含这些字段的声明。模块作者需删除旧字段；安装目录投影统一默认启用、允许服主禁用，已有启停状态仍由 module-lock 管理，升级继续保留。

.changeset/module-registry-submit.md

@@ -0,0 +1,9 @@
+---
+"@sfmc-bds/devkit": major
+"@sfmc-bds/cli": minor
+"@sfmc-bds/create-module": patch
+---
+
+增加模块索引预览和一键 PR 提交，共用 npm、Schema、来源与依赖校验，支持重复提交更新及发布后 CI 接入；脚手架提供索引展示配置。
+
+为避免 CLI 与 devkit 循环依赖，devkit 不再隐式安装 CLI。使用重建部署功能的独立 devkit 消费者需另行安装 @sfmc-bds/cli，或配置 SFMC_CLI / cliPath；官方扩展继续自带 CLI。

.changeset/platform-runtime-metrics.md

@@ -0,0 +1,8 @@
+---
+"@sfmc-bds/sdk": minor
+"@sfmc-bds/db-server": minor
+"@sfmc-bds/cli": minor
+"@sfmc-bds/management": minor
+---
+
+将 TPS、在线人数、维度实体数量与视距区块估算加入平台宿主的基础运行监控，提供受控指标读取、72 小时有界历史和主机内存、进程资源信息。桌面总览使用实际采样并区分断采、过期与未知状态。

.changeset/sfmc-desktop-management.md

@@ -0,0 +1,8 @@
+---
+"@sfmc-bds/management": minor
+"@sfmc-bds/cli": minor
+"@sfmc-bds/sfmc": patch
+"@sfmc-bds/bds-tools": patch
+---
+
+增加版本化桌面管理协议、非交互 stdio 入口、持久化任务和跨进程维护锁；守护进程可由独立 Node 与显式 CLI 入口启动，保持原 CLI 协议兼容。

.github/workflows/desktop-release.yml

@@ -0,0 +1,132 @@
+name: SFMC Desktop release
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - "packages/desktop/**"
+      - "packages/management/**"
+      - "packages/cli/**"
+      - "modules/sdk/**"
+      - "pnpm-lock.yaml"
+      - ".github/workflows/desktop-release.yml"
+  push:
+    tags: ["desktop-v*", "desktop-preview-v*"]
+  workflow_dispatch:
+    inputs:
+      signed:
+        description: "生成签名发行包（需要配置 PFX Secrets 与发布者变量）"
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+jobs:
+  windows:
+    runs-on: windows-2022
+    env:
+      ELECTRON_CACHE: ${{ github.workspace }}\.cache\electron
+      ELECTRON_BUILDER_CACHE: ${{ github.workspace }}\.cache\electron-builder
+    steps:
+      - uses: actions/checkout@v4
+      - name: 核对正式签名配置
+        if: startsWith(github.ref, 'refs/tags/desktop-v') || inputs.signed
+        shell: pwsh
+        env:
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          SFMC_SIGNING_PUBLISHER: ${{ vars.SFMC_SIGNING_PUBLISHER }}
+        run: |
+          if (!$env:CSC_LINK -or !$env:CSC_KEY_PASSWORD -or !$env:SFMC_SIGNING_PUBLISHER) {
+            throw "正式签名配置不完整：需要 CSC_LINK、CSC_KEY_PASSWORD 和 SFMC_SIGNING_PUBLISHER"
+          }
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.8.0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24.21.0
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: 准备 Electron
+        run: node packages/desktop/node_modules/electron/install.js
+      - run: pnpm --filter @sfmc-bds/sfmc... build
+      - run: pnpm --filter @sfmc-bds/management typecheck
+      - run: pnpm --filter @sfmc-bds/cli typecheck
+      - run: pnpm --filter @sfmc-bds/desktop typecheck
+      - name: 核对桌面标签版本
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: pwsh
+        run: |
+          $version = (Get-Content packages/desktop/package.json | ConvertFrom-Json).version
+          $prefix = if ($env:GITHUB_REF_NAME.StartsWith('desktop-preview-v')) { 'desktop-preview-v' } else { 'desktop-v' }
+          if ($prefix -eq 'desktop-preview-v' -and $version -notmatch '-preview\.\d+$') { throw "预览标签必须使用 preview 版本号" }
+          if ($env:GITHUB_REF_NAME -ne "$prefix$version") { throw "桌面标签与 package.json 版本不一致" }
+      - name: 打包
+        shell: pwsh
+        env:
+          CSC_LINK: ${{ (startsWith(github.ref, 'refs/tags/desktop-v') || inputs.signed) && secrets.CSC_LINK || '' }}
+          CSC_KEY_PASSWORD: ${{ (startsWith(github.ref, 'refs/tags/desktop-v') || inputs.signed) && secrets.CSC_KEY_PASSWORD || '' }}
+          SFMC_SIGNING_PUBLISHER: ${{ (startsWith(github.ref, 'refs/tags/desktop-v') || inputs.signed) && vars.SFMC_SIGNING_PUBLISHER || '' }}
+        run: |
+          if ($env:GITHUB_REF -like 'refs/tags/desktop-v*' -or '${{ inputs.signed }}' -eq 'true') {
+            pnpm desktop:package --signed
+          } else {
+            pnpm desktop:package
+          }
+          if ($LASTEXITCODE -ne 0) { throw "桌面打包失败" }
+      - name: 验证签名身份
+        if: startsWith(github.ref, 'refs/tags/desktop-v') || inputs.signed
+        shell: pwsh
+        env:
+          SFMC_SIGNING_PUBLISHER: ${{ vars.SFMC_SIGNING_PUBLISHER }}
+        run: |
+          $files = @(Get-ChildItem packages/desktop/release -Filter '*.exe')
+          $files += Get-Item 'packages/desktop/release/win-unpacked/SFMC Desktop.exe'
+          foreach ($file in $files) {
+            $signature = Get-AuthenticodeSignature -LiteralPath $file.FullName
+            if ($signature.Status -ne 'Valid') { throw "签名无效：$($file.Name)" }
+            if ($signature.SignerCertificate.GetNameInfo([System.Security.Cryptography.X509Certificates.X509NameType]::SimpleName, $false) -ne $env:SFMC_SIGNING_PUBLISHER) { throw "签名发布者不匹配" }
+          }
+      - name: 生成下载校验文件
+        shell: pwsh
+        run: |
+          Get-ChildItem packages/desktop/release -File | Where-Object { $_.Extension -in '.exe', '.zip' } | Sort-Object Name | ForEach-Object { "$(Get-FileHash -LiteralPath $_.FullName -Algorithm SHA256 | Select-Object -ExpandProperty Hash)  $($_.Name)" } | Set-Content packages/desktop/release/SHA256SUMS.txt -Encoding utf8
+      - uses: actions/upload-artifact@v4
+        with:
+          name: sfmc-desktop-windows-x64
+          path: |
+            packages/desktop/release/*.exe
+            packages/desktop/release/*.zip
+            packages/desktop/release/*.yml
+            packages/desktop/release/*.blockmap
+            packages/desktop/release/SHA256SUMS.txt
+            packages/desktop/payload/release-manifest.json
+          if-no-files-found: error
+  publish:
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: windows
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: sfmc-desktop-windows-x64
+          path: artifacts
+      - name: 发布独立桌面版本
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          if [[ "$RELEASE_TAG" == desktop-preview-v* ]]; then
+            mapfile -t assets < <(find artifacts -type f \( -name '*.exe' -o -name '*.zip' -o -name 'release-manifest.json' -o -name 'SHA256SUMS.txt' \))
+            gh release create "$RELEASE_TAG" "${assets[@]}" --title "SFMC Desktop ${RELEASE_TAG#desktop-preview-v}（未签名预览）" --notes-file docs/releases/desktop-preview.md --prerelease --latest=false
+          else
+            mapfile -t assets < <(find artifacts -type f)
+            gh release create "$RELEASE_TAG" "${assets[@]}" --title "SFMC Desktop ${RELEASE_TAG#desktop-v}" --generate-notes --latest=false
+          fi
+