@oj-module/cli 0.2.17 → 0.2.20

package/templates/{api/tests → tests}/lifecycle/market-api.spec.ts

@@ -7,11 +7,11 @@
 // 简报 `task/:id` 段参数形态在模板 http 面无先例（contacts/detail?id= 同款 query 惯例），备案于任务报告。
 // 步骤面全 stub 注入（DIP）：fetch/exec/reload 不真跑；register/smoke/audit 走真实内存库夹具。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（installer.spec 同约定） */
-import type { FsFace } from "../../src/_platform/_lifecycle/atomic";
-import type { FetchFace } from "../../src/_platform/_lifecycle/steps/download";
-import type { ExecFace } from "../../src/_platform/_lifecycle/steps/extract";
-import type { ReloadFace } from "../../src/_platform/_lifecycle/steps/reload";
-import type { MarketEnv } from "../../src/_platform/market/api";
+import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
+import type { FetchFace } from "../../src/_platform/api/_lifecycle/steps/download";
+import type { ExecFace } from "../../src/_platform/api/_lifecycle/steps/extract";
+import type { ReloadFace } from "../../src/_platform/api/_lifecycle/steps/reload";
+import type { MarketEnv } from "../../src/_platform/api/market/api";
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import * as fsp from "node:fs/promises";
@@ -20,14 +20,14 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { parse } from "yaml";
-import { defaultTestKey, nodeVerifyEd25519, signedArchiveFor } from "../../../../src/lifecycle/__tests__/helpers";
-import { signIndex } from "../../../../src/publish";
-import { readLock, writeLock } from "../../src/_platform/_lifecycle/lock";
-import { createStateStore } from "../../src/_platform/_lifecycle/state";
-import { getTask, writeTask } from "../../src/_platform/_lifecycle/tasks";
-import { createTrustStore } from "../../src/_platform/_lifecycle/trust";
-import { invalidateAllUsers } from "../../src/_platform/_shared/service/infra/access";
-import { createMarketApi, marketEnv, parseVersionsJson, versionsJsonPathOf } from "../../src/_platform/market/api";
+import { defaultTestKey, nodeVerifyEd25519, signedArchiveFor } from "../../../src/lifecycle/__tests__/helpers";
+import { signIndex } from "../../../src/publish";
+import { readLock, writeLock } from "../../src/_platform/api/_lifecycle/lock";
+import { createStateStore } from "../../src/_platform/api/_lifecycle/state";
+import { getTask, writeTask } from "../../src/_platform/api/_lifecycle/tasks";
+import { createTrustStore } from "../../src/_platform/api/_lifecycle/trust";
+import { invalidateAllUsers } from "../../src/_platform/api/_shared/service/infra/access";
+import { createMarketApi, marketEnv, parseVersionsJson, versionsJsonPathOf } from "../../src/_platform/api/market/api";
 import { installDb } from "../fixture";
 
 function hexToBytes(hex: string): Uint8Array {
@@ -274,7 +274,7 @@ describe("权限门（R9：市场编排 superadmin 独占，meta 登录即可）
 	it("pair-pin：meta apiVersion === _platform/manifest.yaml version（手工镜像漂移防护，P2-9）", async () => {
 		// API_VERSION（market/api.ts）与 _platform/manifest.yaml version 为手工同步的双真源；
 		// 本测试经 meta 端点间接钉住 API_VERSION，漂移即红（peerPlatform 预检口径失真）。
-		const manifestPath = join(dirname(fileURLToPath(import.meta.url)), "../../src/_platform/manifest.yaml");
+		const manifestPath = join(dirname(fileURLToPath(import.meta.url)), "../../src/_platform/api/manifest.yaml");
 		const manifestVersion = (parse(readFileSync(manifestPath, "utf8")) as { version: string }).version;
 		const api = createMarketApi(makeEnv());
 		g.http = { user: { id: 1 } };
@@ -503,7 +503,7 @@ describe("POST /market/trust {task_id}（P2-3 TOFU 确认：混淆代理防线
 
 	it("确认成功：任务 needs_trust → 指纹复算一致 → 入信任库 added", async () => {
 		const api = createMarketApi(makeEnv());
-		const { generateKeyPair } = await import("../../../../src/lifecycle/keygen");
+		const { generateKeyPair } = await import("../../../src/lifecycle/keygen");
 		const kp = generateKeyPair();
 		const id = await seedNeedsTrust("stranger.pub", kp.publicKeyHex);
 		g.http = { user: { id: 1 }, body: { task_id: id } };
@@ -539,7 +539,7 @@ describe("POST /market/trust {task_id}（P2-3 TOFU 确认：混淆代理防线
 
 	it("混淆代理：任务记录指纹与公钥不符 → 409 拒，信任库零变化", async () => {
 		const api = createMarketApi(makeEnv());
-		const { generateKeyPair } = await import("../../../../src/lifecycle/keygen");
+		const { generateKeyPair } = await import("../../../src/lifecycle/keygen");
 		const kp = generateKeyPair();
 		const id = await seedNeedsTrust("stranger.pub", kp.publicKeyHex, "f".repeat(64)); // 指纹造假
 		g.http = { user: { id: 1 }, body: { task_id: id } };
@@ -552,7 +552,7 @@ describe("POST /market/trust {task_id}（P2-3 TOFU 确认：混淆代理防线
 
 	it("撞绑定：key_id 已绑其他公钥 → 409 trust_bound_mismatch，库内不动", async () => {
 		const api = createMarketApi(makeEnv());
-		const { generateKeyPair } = await import("../../../../src/lifecycle/keygen");
+		const { generateKeyPair } = await import("../../../src/lifecycle/keygen");
 		const kp = generateKeyPair();
 		const id = await seedNeedsTrust("test.publisher", kp.publicKeyHex); // 已播种的 key_id
 		g.http = { user: { id: 1 }, body: { task_id: id } };
@@ -815,10 +815,11 @@ describe("P3-7 索引签名校验（G4 fail-closed：署名相符采用 / 篡改
 });
 
 describe("hostVersions 缺省接线（B-11：C2-09 比对真源 = <dist>/versions.json，ojm 宿主构建产物）", () => {
-	it("versionsJsonPathOf 布局推导：modules.json 同目录 versions.json（相对/绝对同构）", () => {
-		expect(versionsJsonPathOf("dist/modules.json")).toBe("dist/versions.json");
-		expect(versionsJsonPathOf("/site/dist/modules.json")).toBe("/site/dist/versions.json");
-		expect(versionsJsonPathOf("modules.json")).toBe("versions.json");
+	it("versionsJsonPathOf 布局推导：release 根下的 versions.json（相对/绝对/尾斜杠同构）", () => {
+		expect(versionsJsonPathOf("api/dist")).toBe("api/dist/versions.json");
+		expect(versionsJsonPathOf("/site/api/dist")).toBe("/site/api/dist/versions.json");
+		expect(versionsJsonPathOf("api/dist/")).toBe("api/dist/versions.json");
+		expect(versionsJsonPathOf("")).toBe("versions.json");
 	});
 
 	it("parseVersionsJson：{packageName: version} 全字符串表 → 解析；任何违约（非对象/值非字符串/坏 JSON）→ undefined（fail-closed 不猜）", () => {
@@ -829,9 +830,9 @@ describe("hostVersions 缺省接线（B-11：C2-09 比对真源 = <dist>/version
 		}
 	});
 
-	it("集成：env 未注入 hostVersions + dist/versions.json 在盘 → install 全链 done（C2-09 比对走缺省真源）", async () => {
-		await fsp.mkdir(dirname(modulesJsonPath), { recursive: true });
-		await fsp.writeFile(join(dirname(modulesJsonPath), "versions.json"), JSON.stringify({ "@oj-module/runtime": "0.1.77" }));
+	it("集成：env 未注入 hostVersions + <release 根>/versions.json 在盘 → install 全链 done（C2-09 比对走缺省真源）", async () => {
+		await fsp.mkdir(sharedRoot, { recursive: true });
+		await fsp.writeFile(join(sharedRoot, "versions.json"), JSON.stringify({ "@oj-module/runtime": "0.1.77" }));
 		const env = makeEnv();
 		delete (env as Partial<MarketEnv>).hostVersions;
 		const api = createMarketApi(env);
@@ -857,12 +858,12 @@ describe("hostVersions 缺省接线（B-11：C2-09 比对真源 = <dist>/version
 });
 
 describe("P1-16 接线：marketEnv 生产口径 / exec opts 转发 / operator 通道 / 账本真源 / index 即对账入口", () => {
-	it("marketEnv() 缺省 = oj serve release 布局：锁与版本目录在 serve 根 dist（B3），versions.json 同根推导（B4）；暂存/任务/sidecar 留根外", () => {
+	it("marketEnv() 缺省 = 布局 v2 生产口径：版本目录与 versions.json 在 release 根 api/dist，站点 modules 在 web/dist；暂存/任务/sidecar 留 jail 根", () => {
 		const env = marketEnv();
-		expect(env.sharedRoot).toBe("dist");
-		expect(env.siteModulesDir).toBe("dist/modules");
-		expect(env.modulesJsonPath).toBe("dist/modules.json");
-		expect(versionsJsonPathOf(env.modulesJsonPath)).toBe("dist/versions.json");
+		expect(env.sharedRoot).toBe("api/dist");
+		expect(env.siteModulesDir).toBe("web/dist/modules");
+		expect(env.modulesJsonPath).toBe("web/dist/modules.json");
+		expect(versionsJsonPathOf(env.sharedRoot)).toBe("api/dist/versions.json");
 		expect(env.staging).toBe("modules/.staging");
 		expect(env.taskDir).toBe("modules/.install-tasks");
 		expect(env.statePath).toBe("modules/.solutions/state.yaml");

package/templates/{api/tests → tests}/lifecycle/migrate.spec.ts

@@ -7,16 +7,16 @@
 // rollbackGuard 纯函数：目标产物 max seq < 账本 head = 降版部署，禁止（OJ-9/M003 同源红线）；
 // seq 为数值非版本号，直接数值比较（semver.ts 不适用）。
 // exec/fs 面注入 stub（同 steps-fs 范式），不真跑 oj/sqlite。
-import type { FsFace } from "../../src/_platform/_lifecycle/atomic";
-import type { StateStore } from "../../src/_platform/_lifecycle/state";
-import type { ExecFace } from "../../src/_platform/_lifecycle/steps/extract";
-import type { MigrateContext } from "../../src/_platform/_lifecycle/steps/migrate";
+import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
+import type { StateStore } from "../../src/_platform/api/_lifecycle/state";
+import type { ExecFace } from "../../src/_platform/api/_lifecycle/steps/extract";
+import type { MigrateContext } from "../../src/_platform/api/_lifecycle/steps/migrate";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { parseLock } from "../../src/_platform/_lifecycle/lock";
-import { buildMigrateCmd, maxAppliedSeq, migrate, migrateSvcDirOf, parseMigrateOutput, rollbackGuard } from "../../src/_platform/_lifecycle/steps/migrate";
+import { parseLock } from "../../src/_platform/api/_lifecycle/lock";
+import { buildMigrateCmd, maxAppliedSeq, migrate, migrateSvcDirOf, parseMigrateOutput, rollbackGuard } from "../../src/_platform/api/_lifecycle/steps/migrate";
 
 const g = globalThis as any;
 const DB_BYTES = new TextEncoder().encode("sqlite-header-bytes\n");

package/templates/{api/tests → tests}/lifecycle/preflight.spec.ts

@@ -1,5 +1,5 @@
-import type { SolutionState, StateStore } from "../../src/_platform/_lifecycle/state";
-import type { InstallContext } from "../../src/_platform/_lifecycle/steps/preflight";
+import type { SolutionState, StateStore } from "../../src/_platform/api/_lifecycle/state";
+import type { InstallContext } from "../../src/_platform/api/_lifecycle/steps/preflight";
 // BDD：安装预检规则引擎（P1-5，R7/R8/R9/R24，十阶段状态机 stage 1）。
 // 规则真源：docs/prd/solution/202610171254-lifecycle-manifest-contract.md（C2-01~33 安装列）；
 // 期望真源：packages/cli/src/lifecycle/__tests__/fixtures/（fixture-valid 零违规、fixture-invalid 七码齐报）。
@@ -12,9 +12,9 @@ import { fileURLToPath } from "node:url";
 
 import { describe, expect, it } from "vitest";
 import { parse } from "yaml";
-import { preflight } from "../../src/_platform/_lifecycle/steps/preflight";
+import { preflight } from "../../src/_platform/api/_lifecycle/steps/preflight";
 
-const FIXTURES = join(dirname(fileURLToPath(import.meta.url)), "../../../../src/lifecycle/__tests__/fixtures");
+const FIXTURES = join(dirname(fileURLToPath(import.meta.url)), "../../../src/lifecycle/__tests__/fixtures");
 const VALID = parse(readFileSync(join(FIXTURES, "fixture-valid/manifest.yaml"), "utf8")) as any;
 
 /** 宿主 versions.json 假数据（C2-09 真源键：@oj-module/runtime，shell/src/manifest.ts P7.6） */

package/templates/{api/tests → tests}/lifecycle/register.spec.ts

@@ -8,7 +8,7 @@
 /* eslint-disable test/prefer-lowercase-title -- 任务/AC 编号是验收锚点，保留大写（DB/P1-5） */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { checkOccupancy, queryAllRegistered, queryRegistered, registerSolution } from "../../src/_platform/_lifecycle/steps/register";
+import { checkOccupancy, queryAllRegistered, queryRegistered, registerSolution } from "../../src/_platform/api/_lifecycle/steps/register";
 import { installDb } from "../fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/{api/tests → tests}/lifecycle/semver.spec.ts

@@ -3,7 +3,7 @@
 // 无 prerelease > 有 prerelease；「1.0」「1.0.0」「1.0.0.0」视为相等（安装器容错口径）。
 import { describe, expect, it } from "vitest";
 
-import { compareVersions } from "../../src/_platform/_lifecycle/semver";
+import { compareVersions } from "../../src/_platform/api/_lifecycle/semver";
 
 const cases: Array<[a: string, b: string, expected: -1 | 0 | 1]> = [
 	// 主版本数值比较（非字典序）

package/templates/{api/tests → tests}/lifecycle/sha384.spec.ts

@@ -4,7 +4,7 @@
 import { Buffer } from "node:buffer";
 import { createHash } from "node:crypto";
 import { describe, expect, it } from "vitest";
-import { bytesToBase64, sha384B64, sha384Bytes } from "../../src/_platform/_lifecycle/sha384";
+import { bytesToBase64, sha384B64, sha384Bytes } from "../../src/_platform/api/_lifecycle/sha384";
 
 const hex = (bytes: Uint8Array): string => Array.from(bytes, b => b.toString(16).padStart(2, "0")).join("");
 

package/templates/{api/tests → tests}/lifecycle/sig-fixtures.spec.ts

@@ -10,7 +10,7 @@ import { fileURLToPath } from "node:url";
 import { describe, expect, it } from "vitest";
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
-const SIG_DIR = path.resolve(HERE, "../../../../src/lifecycle/__tests__/fixtures/sig");
+const SIG_DIR = path.resolve(HERE, "../../../src/lifecycle/__tests__/fixtures/sig");
 const GEN = path.join(SIG_DIR, "gen-signed-fixtures.mjs");
 
 const HEX64 = /^[0-9a-f]{64}$/;

package/templates/{api/tests → tests}/lifecycle/solutions-api.spec.ts

@@ -5,7 +5,7 @@
 /* eslint-disable test/prefer-lowercase-title -- 端点路径是验收锚点 */
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
-import api from "../../src/_platform/solutions/api";
+import api from "../../src/_platform/api/solutions/api";
 import { installDb } from "../fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/{api/tests → tests}/lifecycle/steps-fs.spec.ts

@@ -6,11 +6,11 @@
 // 命令构造为纯函数，argv 逐字断言（与平台 exec 白名单逐字对齐，S1-2 基座）；
 // exec/fetch/sha256 面经 ctx 注入 stub，不真跑网络；合法夹具集成用例的 exec stub 落到真实系统 tar
 // （与生产同路径：isolate 不内嵌解压，exec.run 系统 tar）。
-import type { FsFace } from "../../src/_platform/_lifecycle/atomic";
-import type { StateStore } from "../../src/_platform/_lifecycle/state";
-import type { DownloadContext } from "../../src/_platform/_lifecycle/steps/download";
-import type { ExecFace, ExtractContext } from "../../src/_platform/_lifecycle/steps/extract";
-import type { VerifyContext } from "../../src/_platform/_lifecycle/steps/verify";
+import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
+import type { StateStore } from "../../src/_platform/api/_lifecycle/state";
+import type { DownloadContext } from "../../src/_platform/api/_lifecycle/steps/download";
+import type { ExecFace, ExtractContext } from "../../src/_platform/api/_lifecycle/steps/extract";
+import type { VerifyContext } from "../../src/_platform/api/_lifecycle/steps/verify";
 import { execFile as execFileCb } from "node:child_process";
 import { createHash } from "node:crypto";
 import * as fsp from "node:fs/promises";
@@ -18,11 +18,11 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { defaultTestKey, nodeVerifyEd25519, signedArchiveFor } from "../../../../src/lifecycle/__tests__/helpers";
-import { archiveFileOf, download } from "../../src/_platform/_lifecycle/steps/download";
-import { buildExtractCmd, buildListCmd, checkModuleManifest, extract } from "../../src/_platform/_lifecycle/steps/extract";
-import { verify } from "../../src/_platform/_lifecycle/steps/verify";
-import { createTrustStore } from "../../src/_platform/_lifecycle/trust";
+import { defaultTestKey, nodeVerifyEd25519, signedArchiveFor } from "../../../src/lifecycle/__tests__/helpers";
+import { archiveFileOf, download } from "../../src/_platform/api/_lifecycle/steps/download";
+import { buildExtractCmd, buildListCmd, checkModuleManifest, extract } from "../../src/_platform/api/_lifecycle/steps/extract";
+import { verify } from "../../src/_platform/api/_lifecycle/steps/verify";
+import { createTrustStore } from "../../src/_platform/api/_lifecycle/trust";
 
 const execFileP = promisify(execFileCb);
 const g = globalThis as any;
@@ -352,8 +352,8 @@ describe("verify（stage=verifying，C2-29 sha256 fail-closed + P2-3 六码验
 	it("sig_key：已信任 key_id 但包内公钥与库绑定不一致（首次绑定不可改族）", async () => {
 		await seed();
 		// 另一把私钥冒用已信任 key_id（trusted key_id + 异公钥 = 绑定不一致）
-		const { signedArchiveFor: signFor } = await import("../../../../src/lifecycle/__tests__/helpers");
-		const { generateKeyPair } = await import("../../../../src/lifecycle/keygen");
+		const { signedArchiveFor: signFor } = await import("../../../src/lifecycle/__tests__/helpers");
+		const { generateKeyPair } = await import("../../../src/lifecycle/keygen");
 		const impostor = signFor(BYTES, "demo-solution", "0.1.0", { keyPair: generateKeyPair(), keyId: "test.publisher" });
 		const r = await verify(vfCtx({ manifest: manifest({ ...manifest().archive, signature: impostor.sig }) }));
 		expect(r).toMatchObject({ ok: false, code: "sig_key" });

package/templates/{api/tests → tests}/lifecycle/text-edit.spec.ts

@@ -5,7 +5,7 @@
 import * as fsp from "node:fs/promises";
 import { describe, expect, it } from "vitest";
 
-import { appendAnonymousPaths, bumpInstallSeq, ensureReloadApi, hasAnchor, insertAnchor } from "../../src/_platform/_lifecycle/text-edit";
+import { appendAnonymousPaths, bumpInstallSeq, ensureReloadApi, hasAnchor, insertAnchor } from "../../src/_platform/api/_lifecycle/text-edit";
 
 describe("insertAnchor（R18）", () => {
 	it("带注释的 config.yaml 插入后注释/缩进/空行/键序逐字保留", () => {

package/templates/{api/tests → tests}/lifecycle/tgz-guard.spec.ts

@@ -4,7 +4,7 @@
 // 拒绝：绝对路径、任何 `..` 段、l/h 条目、空成员名、反斜杠路径；`./` 前缀相对合法。
 import { describe, expect, it } from "vitest";
 
-import { validateTarListing } from "../../src/_platform/_lifecycle/tgz-guard";
+import { validateTarListing } from "../../src/_platform/api/_lifecycle/tgz-guard";
 
 describe("validateTarListing（R1）", () => {
 	it("正常成员列表通过", () => {

package/templates/{api/tests → tests}/lifecycle/trust.spec.ts

@@ -2,17 +2,17 @@
 // store 层：空库/幂等/首次绑定不可改/多 key/吊销/损坏 fail-closed/.bak 回落/并发读不见半截/审计。
 // 端点层：GET /market/trust、POST /market/trust/key、DELETE /market/trust/key?key_id=（del 动词 + query，system/roles 同款先例）。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（market-api.spec 同约定） */
-import type { FsFace } from "../../src/_platform/_lifecycle/atomic";
-import type { MarketEnv } from "../../src/_platform/market/api";
+import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
+import type { MarketEnv } from "../../src/_platform/api/market/api";
 import { Buffer } from "node:buffer";
 import { createHash } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { createTrustStore, isValidKeyId } from "../../src/_platform/_lifecycle/trust";
-import { invalidateAllUsers } from "../../src/_platform/_shared/service/infra/access";
-import { createMarketApi, marketEnv } from "../../src/_platform/market/api";
+import { createTrustStore, isValidKeyId } from "../../src/_platform/api/_lifecycle/trust";
+import { invalidateAllUsers } from "../../src/_platform/api/_shared/service/infra/access";
+import { createMarketApi, marketEnv } from "../../src/_platform/api/market/api";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;

package/templates/{api/tests → tests}/lifecycle/uninstall.spec.ts

@@ -5,17 +5,17 @@
 // 夹具：本仓范式（node:sqlite 真实迁移建表 + 真实 fs 面 g.fs）；market_history 表由平台迁移
 // 0012（IF NOT EXISTS）随 installDb 重放建立，守卫语义（表不存在静默跳过）单列一例。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（market-api.spec 同约定） */
-import type { FsFace } from "../../src/_platform/_lifecycle/atomic";
-import type { MarketEnv } from "../../src/_platform/market/api";
+import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
+import type { MarketEnv } from "../../src/_platform/api/market/api";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { readLock, writeLock } from "../../src/_platform/_lifecycle/lock";
-import { createStateStore } from "../../src/_platform/_lifecycle/state";
-import { collectRetainedTables, moduleTablePrefix } from "../../src/_platform/_lifecycle/uninstall";
-import { invalidateAllUsers } from "../../src/_platform/_shared/service/infra/access";
-import { createMarketApi } from "../../src/_platform/market/api";
+import { readLock, writeLock } from "../../src/_platform/api/_lifecycle/lock";
+import { createStateStore } from "../../src/_platform/api/_lifecycle/state";
+import { collectRetainedTables, moduleTablePrefix } from "../../src/_platform/api/_lifecycle/uninstall";
+import { invalidateAllUsers } from "../../src/_platform/api/_shared/service/infra/access";
+import { createMarketApi } from "../../src/_platform/api/market/api";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;

package/templates/{api/tests → tests}/lifecycle/verify-checks.spec.ts

@@ -1,8 +1,8 @@
 // BDD：深检后端四项 + 端点（P2-7，C2-42）+ SSRF 三钉。
 // 纯 diff 函数 / 探针分类 / SSRF 钉（出站拦截 / header 清洗 / 不跟随重定向）+ 端点门（401/403/404）+ 编排。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（market-api.spec 同约定） */
-import type { FsFace } from "../../src/_platform/_lifecycle/atomic";
-import type { SolutionRouteRow } from "../../src/_platform/_lifecycle/verify-checks";
+import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
+import type { SolutionRouteRow } from "../../src/_platform/api/_lifecycle/verify-checks";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -18,9 +18,9 @@ import {
 	sha384B64,
 
 	verifyRouteReachability,
-} from "../../src/_platform/_lifecycle/verify-checks";
-import { siteOrigin } from "../../src/_platform/market/api";
-import { createSolutionsApi, solutionsEnv } from "../../src/_platform/solutions/api";
+} from "../../src/_platform/api/_lifecycle/verify-checks";
+import { siteOrigin } from "../../src/_platform/api/market/api";
+import { createSolutionsApi, solutionsEnv } from "../../src/_platform/api/solutions/api";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;
@@ -278,7 +278,10 @@ function setHttp(over: Record<string, unknown>) {
 }
 
 function makeEnv() {
-	return { ...solutionsEnv(), sharedRoot: root, statePath: join(root, "state.yaml") };
+	// modulesJsonPath 钉进临时目录（readFile 失败 → 不打 web 项）：默认值 `web/dist/modules.json`
+	// 是相对 cwd 的，会把模板本机构建产物卷进用例，全绿用例随「模板 build 过没有」摇摆。
+	// P4-2 两条 integrity 用例显式覆盖它。
+	return { ...solutionsEnv(), sharedRoot: root, statePath: join(root, "state.yaml"), modulesJsonPath: join(root, "modules.json") };
 }
 
 describe("深检端点门（admin 域）", () => {

package/templates/{api/tests → tests}/lifecycle/verify-report.spec.ts

@@ -1,8 +1,8 @@
 // BDD：P2-8 深检报告结构 + 留存 N=10 + 可信性项（trust_state）+ i18n 降级项 + 设值不进报告。
 // 纯模块单测（verify-report.ts）+ 端点编排（persist-on-POST / GET verify/last / 降级项 / secret 不泄漏）。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（verify-checks.spec 同约定） */
-import type { FsFace } from "../../src/_platform/_lifecycle/atomic";
-import type { VerifyReport } from "../../src/_platform/_lifecycle/verify-report";
+import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
+import type { VerifyReport } from "../../src/_platform/api/_lifecycle/verify-report";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -12,8 +12,8 @@ import {
 	persistReport,
 	VERIFY_REPORTS_KEEP,
 	verifyReportsDirOf,
-} from "../../src/_platform/_lifecycle/verify-report";
-import { createSolutionsApi, solutionsEnv } from "../../src/_platform/solutions/api";
+} from "../../src/_platform/api/_lifecycle/verify-report";
+import { createSolutionsApi, solutionsEnv } from "../../src/_platform/api/solutions/api";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;
@@ -127,7 +127,9 @@ function setHttp(over: Record<string, unknown> = {}) {
 }
 
 function makeEnv() {
-	return { ...solutionsEnv(), sharedRoot: root, statePath: join(root, "state.yaml"), verifyReportsDir: reportsDir };
+	// modulesJsonPath 同 verify-checks.spec：钉进临时目录（缺文件 → 跳过 web 项），
+	// 不吃模板本机 `web/dist/modules.json`。
+	return { ...solutionsEnv(), sharedRoot: root, statePath: join(root, "state.yaml"), modulesJsonPath: join(root, "modules.json"), verifyReportsDir: reportsDir };
 }
 
 async function insertRoute(perm: string | null) {

package/templates/{api/tests → tests}/query-utils.spec.ts

@@ -3,7 +3,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { beforeAll, describe, expect, it } from "vitest";
 
-import { likePattern, paged, pagedFactory } from "../src/_platform/_shared/service/infra/query";
+import { likePattern, paged, pagedFactory } from "../src/_platform/api/_shared/service/infra/query";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/{api/tests → tests}/rbac-audit.spec.ts

@@ -3,7 +3,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { auditDeny, auditOp, recordOp, resetDenyAudit } from "../src/_platform/_shared/service/infra/audit";
+import { auditDeny, auditOp, recordOp, resetDenyAudit } from "../src/_platform/api/_shared/service/infra/audit";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/{api/tests → tests}/rbac-contacts.spec.ts

@@ -4,7 +4,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { contactDetail, searchContacts } from "../src/_platform/_shared/service/domain/contacts";
+import { contactDetail, searchContacts } from "../src/_platform/api/_shared/service/domain/contacts";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
@@ -74,7 +74,7 @@ describe("详情与限速", () => {
 	it("接口级限速：同用户突发超限 → 429", async () => {
 		const uid = mkUser("c_rate");
 		g.http = { user: { id: uid } };
-		const { rateLimit } = await import("../src/_platform/_shared/service/infra/rate");
+		const { rateLimit } = await import("../src/_platform/api/_shared/service/infra/rate");
 		// 窗口 60s / 限额 3（测试参数；生产端点各自定额）
 		for (let i = 0; i < 3; i++)
 			await rateLimit(`contacts:${uid}`, 3, 60_000);

package/templates/{api/tests → tests}/rbac-guard.spec.ts

@@ -4,7 +4,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { assertPermission, assertSuperAdmin, assertSystemAdmin, invalidateUser } from "../src/_platform/_shared/service/infra/access";
+import { assertPermission, assertSuperAdmin, assertSystemAdmin, invalidateUser } from "../src/_platform/api/_shared/service/infra/access";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/{api/tests → tests}/rbac-roles.spec.ts

@@ -4,8 +4,8 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { createRole, deleteRole, listPermissions, listRoles, updateBindings } from "../src/_platform/_shared/service/domain/roles";
-import { assertPermission } from "../src/_platform/_shared/service/infra/access";
+import { createRole, deleteRole, listPermissions, listRoles, updateBindings } from "../src/_platform/api/_shared/service/domain/roles";
+import { assertPermission } from "../src/_platform/api/_shared/service/infra/access";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/{api/tests → tests}/rbac-seed.spec.ts

@@ -7,7 +7,7 @@ import { beforeAll, describe, expect, it } from "vitest";
 
 import { installDb } from "./fixture";
 
-const SEED = join(dirname(fileURLToPath(import.meta.url)), "..", "src", "_platform", "seed.sql");
+const SEED = join(dirname(fileURLToPath(import.meta.url)), "..", "src", "_platform", "api", "seed.sql");
 let dbo: ReturnType<typeof installDb>;
 
 beforeAll(() => {

package/templates/{api/tests → tests}/rbac-settings.spec.ts

@@ -2,8 +2,8 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { listLoginMethods, listSettings, updateSetting } from "../src/_platform/_shared/service/domain/settings";
-import { searchOplog } from "../src/_platform/_shared/service/infra/oplog";
+import { listLoginMethods, listSettings, updateSetting } from "../src/_platform/api/_shared/service/domain/settings";
+import { searchOplog } from "../src/_platform/api/_shared/service/infra/oplog";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/{api/tests → tests}/rbac-solution-perms.spec.ts

@@ -4,7 +4,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { uninstallSolution, upsertSolutionPerms } from "../src/_platform/_shared/service/domain/solution-perms";
+import { uninstallSolution, upsertSolutionPerms } from "../src/_platform/api/_shared/service/domain/solution-perms";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/{api/tests → tests}/rbac-users.spec.ts

@@ -3,11 +3,11 @@
 // 禁止操作自己（AC1-10 注）；roles 写 sys_user_role 唯一权威源 + 写时失效（AC1-7/D10）；
 // 禁用/重置口令级联删 refresh（§3.1 吊销联动）。
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
-import type { SessionDeps } from "../src/auth/_shared/session";
+import type { SessionDeps } from "../src/auth/api/_shared/session";
 
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
-import { changePasswordByAdmin, createUser, listUsers, setForbidden, updateUserRoles } from "../src/_platform/_shared/service/domain/users";
-import { createSession } from "../src/auth/_shared/session";
+import { changePasswordByAdmin, createUser, listUsers, setForbidden, updateUserRoles } from "../src/_platform/api/_shared/service/domain/users";
+import { createSession } from "../src/auth/api/_shared/session";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tsconfig.json

@@ -15,9 +15,13 @@
 		"skipLibCheck": true
 	},
 	"include": [
-		"web",
+		"src",
 		"web.config.ts",
 		"global.d.ts",
 		"env.d.ts"
+	],
+	"exclude": [
+		"src/*/api",
+		"src/*/api/**"
 	]
 }

package/templates/tsconfig.paths.json

@@ -0,0 +1,19 @@
+// 由 ojm 生成：ojm init / ojm build / ojm dev 会按 src/*/api/manifest.yaml 重写本文件，请勿手改。
+//
+// oj 别名 `#/<模块名>/…` 锚在目标模块根（本布局下即 src/<模块名>/api）。tsconfig 的
+// paths 只能静态全局映射，且每条规则的替换值只允许一个 `*`（`./src/*/api/*` 会被 TS
+// 以 TS5062 拒掉），故按模块逐条枚举。
+{
+	"compilerOptions": {
+		"paths": {
+			"#/_platform/*": ["./src/_platform/api/*"],
+			"#/auth/*": ["./src/auth/api/*"],
+			"#/demo/*": ["./src/demo/api/*"],
+			"#/home/*": ["./src/home/api/*"],
+			"#/notification/*": ["./src/notification/api/*"],
+			"#/personal-center/*": ["./src/personal-center/api/*"],
+			"#/system/*": ["./src/system/api/*"],
+			"#/web/*": ["./src/web/api/*"]
+		}
+	}
+}

package/templates/types/oj-modules.d.ts

@@ -0,0 +1,17 @@
+// oj 导入别名（`#` 开头）的类型兜底。
+//
+// 背景：oj 的 `#x`（**本模块根**，本布局下即 `src/<name>/api`）/ `#/<模块名>/x`
+// （**目标模块根**）是「引用方所在模块」相对的，而 tsconfig 的 `paths` 只能做**静态
+// 全局映射**。`tsconfig.paths.json` 因此按模块枚举了 `"#/<模块名>/*"`，仅能命中
+// **已存在**的文件；跨模块别名的模块名写错、或用了尚未创建的 `#_shared/view` 这类
+// 模块内别名，编辑器会报 TS2307「Cannot find module」。
+//
+// 本文件是**非模块**（无顶层 import/export），其中的 `declare module` 才是真正的
+// ambient 声明——放在模块化的 `global.d.ts` 里会被当作 module augmentation 而不生效。
+// 通配 ambient 作为 `paths` 解析失败后的兜底：无法静态定位的 `#` 导入降级为 `any`
+// 且不再报错；**已存在、能被 `paths` 命中的别名仍走其真实文件类型**（解析优先）。
+//
+// 运行时始终由 oj 的 loader（`module_loader.rs::resolve_alias`）解析，本文件只影响
+// 编辑器 / tsc。模块名写错这类事故由 `oj build` 的 S008（别名无法解析）在构建期拦下，
+// 不会拖到运行期。业务项目若自定义了全局或别名，可仿此在源码根另建 `.d.ts`。
+declare module "#*";

package/templates/vitest.config.ts

@@ -0,0 +1,22 @@
+import { fileURLToPath } from "node:url";
+import { defineConfig } from "vitest/config";
+
+// 后端模块测试（BDD）：node:sqlite 内存库 + 真实迁移建表（见 tests/fixture.ts）。
+// root 锚定本目录，保证从工程根跑 vitest 时 include 相对本目录解析。
+const srcDir = fileURLToPath(new URL("./src", import.meta.url));
+
+export default defineConfig({
+	root: fileURLToPath(new URL(".", import.meta.url)),
+	// `#/<模块名>/…` 是 oj 的模块别名（锚在目标模块根，本布局下即 `src/<模块名>/api`）。
+	// oj build / ojm dev 在打包器里解析它，vitest 走 vite 的 resolve，必须在此显式映射，
+	// 否则跨模块 import 的后端 spec 会以「Cannot find module」整文件跳过。
+	// 形如 `#x`（锚本模块根）与导入方相对，静态 alias 表达不了——模板后端不用这种形态，
+	// 一旦引入需先补 vitest 侧解析（或改写成 `#/<模块名>/…`）。
+	resolve: {
+		alias: [{ find: /^#\/([^/]+)\/(.*)$/, replacement: `${srcDir}/$1/api/$2` }],
+	},
+	test: {
+		include: ["tests/**/*.spec.ts"],
+		environment: "node",
+	},
+});