@oj-module/cli 0.2.18 → 0.2.23

package/templates/{api/tests → tests}/lifecycle/market-api.spec.ts

@@ -7,11 +7,11 @@
 // 简报 `task/:id` 段参数形态在模板 http 面无先例（contacts/detail?id= 同款 query 惯例），备案于任务报告。
 // 步骤面全 stub 注入（DIP）：fetch/exec/reload 不真跑；register/smoke/audit 走真实内存库夹具。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（installer.spec 同约定） */
-import type { FsFace } from "../../src/_platform/_lifecycle/atomic";
-import type { FetchFace } from "../../src/_platform/_lifecycle/steps/download";
-import type { ExecFace } from "../../src/_platform/_lifecycle/steps/extract";
-import type { ReloadFace } from "../../src/_platform/_lifecycle/steps/reload";
-import type { MarketEnv } from "../../src/_platform/market/api";
+import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
+import type { FetchFace } from "../../src/_platform/api/_lifecycle/steps/download";
+import type { ExecFace } from "../../src/_platform/api/_lifecycle/steps/extract";
+import type { ReloadFace } from "../../src/_platform/api/_lifecycle/steps/reload";
+import type { MarketEnv } from "../../src/_platform/api/market/api";
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import * as fsp from "node:fs/promises";
@@ -20,14 +20,14 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { parse } from "yaml";
-import { defaultTestKey, nodeVerifyEd25519, signedArchiveFor } from "../../../../src/lifecycle/__tests__/helpers";
-import { signIndex } from "../../../../src/publish";
-import { readLock, writeLock } from "../../src/_platform/_lifecycle/lock";
-import { createStateStore } from "../../src/_platform/_lifecycle/state";
-import { getTask, writeTask } from "../../src/_platform/_lifecycle/tasks";
-import { createTrustStore } from "../../src/_platform/_lifecycle/trust";
-import { invalidateAllUsers } from "../../src/_platform/_shared/service/infra/access";
-import { createMarketApi, marketEnv, parseVersionsJson, versionsJsonPathOf } from "../../src/_platform/market/api";
+import { defaultTestKey, nodeVerifyEd25519, signedArchiveFor } from "../../../src/lifecycle/__tests__/helpers";
+import { signIndex } from "../../../src/publish";
+import { readLock, writeLock } from "../../src/_platform/api/_lifecycle/lock";
+import { createStateStore } from "../../src/_platform/api/_lifecycle/state";
+import { getTask, writeTask } from "../../src/_platform/api/_lifecycle/tasks";
+import { createTrustStore } from "../../src/_platform/api/_lifecycle/trust";
+import { invalidateAllUsers } from "../../src/_platform/api/_shared/service/infra/access";
+import { createMarketApi, marketEnv, parseVersionsJson, versionsJsonPathOf } from "../../src/_platform/api/market/api";
 import { installDb } from "../fixture";
 
 function hexToBytes(hex: string): Uint8Array {
@@ -274,7 +274,7 @@ describe("权限门（R9：市场编排 superadmin 独占，meta 登录即可）
 	it("pair-pin：meta apiVersion === _platform/manifest.yaml version（手工镜像漂移防护，P2-9）", async () => {
 		// API_VERSION（market/api.ts）与 _platform/manifest.yaml version 为手工同步的双真源；
 		// 本测试经 meta 端点间接钉住 API_VERSION，漂移即红（peerPlatform 预检口径失真）。
-		const manifestPath = join(dirname(fileURLToPath(import.meta.url)), "../../src/_platform/manifest.yaml");
+		const manifestPath = join(dirname(fileURLToPath(import.meta.url)), "../../src/_platform/api/manifest.yaml");
 		const manifestVersion = (parse(readFileSync(manifestPath, "utf8")) as { version: string }).version;
 		const api = createMarketApi(makeEnv());
 		g.http = { user: { id: 1 } };
@@ -503,7 +503,7 @@ describe("POST /market/trust {task_id}（P2-3 TOFU 确认：混淆代理防线
 
 	it("确认成功：任务 needs_trust → 指纹复算一致 → 入信任库 added", async () => {
 		const api = createMarketApi(makeEnv());
-		const { generateKeyPair } = await import("../../../../src/lifecycle/keygen");
+		const { generateKeyPair } = await import("../../../src/lifecycle/keygen");
 		const kp = generateKeyPair();
 		const id = await seedNeedsTrust("stranger.pub", kp.publicKeyHex);
 		g.http = { user: { id: 1 }, body: { task_id: id } };
@@ -539,7 +539,7 @@ describe("POST /market/trust {task_id}（P2-3 TOFU 确认：混淆代理防线
 
 	it("混淆代理：任务记录指纹与公钥不符 → 409 拒，信任库零变化", async () => {
 		const api = createMarketApi(makeEnv());
-		const { generateKeyPair } = await import("../../../../src/lifecycle/keygen");
+		const { generateKeyPair } = await import("../../../src/lifecycle/keygen");
 		const kp = generateKeyPair();
 		const id = await seedNeedsTrust("stranger.pub", kp.publicKeyHex, "f".repeat(64)); // 指纹造假
 		g.http = { user: { id: 1 }, body: { task_id: id } };
@@ -552,7 +552,7 @@ describe("POST /market/trust {task_id}（P2-3 TOFU 确认：混淆代理防线
 
 	it("撞绑定：key_id 已绑其他公钥 → 409 trust_bound_mismatch，库内不动", async () => {
 		const api = createMarketApi(makeEnv());
-		const { generateKeyPair } = await import("../../../../src/lifecycle/keygen");
+		const { generateKeyPair } = await import("../../../src/lifecycle/keygen");
 		const kp = generateKeyPair();
 		const id = await seedNeedsTrust("test.publisher", kp.publicKeyHex); // 已播种的 key_id
 		g.http = { user: { id: 1 }, body: { task_id: id } };
@@ -815,10 +815,11 @@ describe("P3-7 索引签名校验（G4 fail-closed：署名相符采用 / 篡改
 });
 
 describe("hostVersions 缺省接线（B-11：C2-09 比对真源 = <dist>/versions.json，ojm 宿主构建产物）", () => {
-	it("versionsJsonPathOf 布局推导：modules.json 同目录 versions.json（相对/绝对同构）", () => {
-		expect(versionsJsonPathOf("dist/modules.json")).toBe("dist/versions.json");
-		expect(versionsJsonPathOf("/site/dist/modules.json")).toBe("/site/dist/versions.json");
-		expect(versionsJsonPathOf("modules.json")).toBe("versions.json");
+	it("versionsJsonPathOf 布局推导：release 根下的 versions.json（相对/绝对/尾斜杠同构）", () => {
+		expect(versionsJsonPathOf("api/dist")).toBe("api/dist/versions.json");
+		expect(versionsJsonPathOf("/site/api/dist")).toBe("/site/api/dist/versions.json");
+		expect(versionsJsonPathOf("api/dist/")).toBe("api/dist/versions.json");
+		expect(versionsJsonPathOf("")).toBe("versions.json");
 	});
 
 	it("parseVersionsJson：{packageName: version} 全字符串表 → 解析；任何违约（非对象/值非字符串/坏 JSON）→ undefined（fail-closed 不猜）", () => {
@@ -829,9 +830,9 @@ describe("hostVersions 缺省接线（B-11：C2-09 比对真源 = <dist>/version
 		}
 	});
 
-	it("集成：env 未注入 hostVersions + dist/versions.json 在盘 → install 全链 done（C2-09 比对走缺省真源）", async () => {
-		await fsp.mkdir(dirname(modulesJsonPath), { recursive: true });
-		await fsp.writeFile(join(dirname(modulesJsonPath), "versions.json"), JSON.stringify({ "@oj-module/runtime": "0.1.77" }));
+	it("集成：env 未注入 hostVersions + <release 根>/versions.json 在盘 → install 全链 done（C2-09 比对走缺省真源）", async () => {
+		await fsp.mkdir(sharedRoot, { recursive: true });
+		await fsp.writeFile(join(sharedRoot, "versions.json"), JSON.stringify({ "@oj-module/runtime": "0.1.77" }));
 		const env = makeEnv();
 		delete (env as Partial<MarketEnv>).hostVersions;
 		const api = createMarketApi(env);
@@ -857,12 +858,12 @@ describe("hostVersions 缺省接线（B-11：C2-09 比对真源 = <dist>/version
 });
 
 describe("P1-16 接线：marketEnv 生产口径 / exec opts 转发 / operator 通道 / 账本真源 / index 即对账入口", () => {
-	it("marketEnv() 缺省 = oj serve release 布局：锁与版本目录在 serve 根 dist（B3），versions.json 同根推导（B4）；暂存/任务/sidecar 留根外", () => {
+	it("marketEnv() 缺省 = 布局 v2 生产口径：版本目录与 versions.json 在 release 根 api/dist，站点 modules 在 web/dist；暂存/任务/sidecar 留 jail 根", () => {
 		const env = marketEnv();
-		expect(env.sharedRoot).toBe("dist");
-		expect(env.siteModulesDir).toBe("dist/modules");
-		expect(env.modulesJsonPath).toBe("dist/modules.json");
-		expect(versionsJsonPathOf(env.modulesJsonPath)).toBe("dist/versions.json");
+		expect(env.sharedRoot).toBe("api/dist");
+		expect(env.siteModulesDir).toBe("web/dist/modules");
+		expect(env.modulesJsonPath).toBe("web/dist/modules.json");
+		expect(versionsJsonPathOf(env.sharedRoot)).toBe("api/dist/versions.json");
 		expect(env.staging).toBe("modules/.staging");
 		expect(env.taskDir).toBe("modules/.install-tasks");
 		expect(env.statePath).toBe("modules/.solutions/state.yaml");

package/templates/{api/tests → tests}/lifecycle/migrate.spec.ts

@@ -7,16 +7,16 @@
 // rollbackGuard 纯函数：目标产物 max seq < 账本 head = 降版部署，禁止（OJ-9/M003 同源红线）；
 // seq 为数值非版本号，直接数值比较（semver.ts 不适用）。
 // exec/fs 面注入 stub（同 steps-fs 范式），不真跑 oj/sqlite。
-import type { FsFace } from "../../src/_platform/_lifecycle/atomic";
-import type { StateStore } from "../../src/_platform/_lifecycle/state";
-import type { ExecFace } from "../../src/_platform/_lifecycle/steps/extract";
-import type { MigrateContext } from "../../src/_platform/_lifecycle/steps/migrate";
+import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
+import type { StateStore } from "../../src/_platform/api/_lifecycle/state";
+import type { ExecFace } from "../../src/_platform/api/_lifecycle/steps/extract";
+import type { MigrateContext } from "../../src/_platform/api/_lifecycle/steps/migrate";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { parseLock } from "../../src/_platform/_lifecycle/lock";
-import { buildMigrateCmd, maxAppliedSeq, migrate, migrateSvcDirOf, parseMigrateOutput, rollbackGuard } from "../../src/_platform/_lifecycle/steps/migrate";
+import { parseLock } from "../../src/_platform/api/_lifecycle/lock";
+import { buildMigrateCmd, maxAppliedSeq, migrate, migrateSvcDirOf, parseMigrateOutput, rollbackGuard } from "../../src/_platform/api/_lifecycle/steps/migrate";
 
 const g = globalThis as any;
 const DB_BYTES = new TextEncoder().encode("sqlite-header-bytes\n");

package/templates/{api/tests → tests}/lifecycle/preflight.spec.ts

@@ -1,5 +1,5 @@
-import type { SolutionState, StateStore } from "../../src/_platform/_lifecycle/state";
-import type { InstallContext } from "../../src/_platform/_lifecycle/steps/preflight";
+import type { SolutionState, StateStore } from "../../src/_platform/api/_lifecycle/state";
+import type { InstallContext } from "../../src/_platform/api/_lifecycle/steps/preflight";
 // BDD：安装预检规则引擎（P1-5，R7/R8/R9/R24，十阶段状态机 stage 1）。
 // 规则真源：docs/prd/solution/202610171254-lifecycle-manifest-contract.md（C2-01~33 安装列）；
 // 期望真源：packages/cli/src/lifecycle/__tests__/fixtures/（fixture-valid 零违规、fixture-invalid 七码齐报）。
@@ -12,9 +12,9 @@ import { fileURLToPath } from "node:url";
 
 import { describe, expect, it } from "vitest";
 import { parse } from "yaml";
-import { preflight } from "../../src/_platform/_lifecycle/steps/preflight";
+import { preflight } from "../../src/_platform/api/_lifecycle/steps/preflight";
 
-const FIXTURES = join(dirname(fileURLToPath(import.meta.url)), "../../../../src/lifecycle/__tests__/fixtures");
+const FIXTURES = join(dirname(fileURLToPath(import.meta.url)), "../../../src/lifecycle/__tests__/fixtures");
 const VALID = parse(readFileSync(join(FIXTURES, "fixture-valid/manifest.yaml"), "utf8")) as any;
 
 /** 宿主 versions.json 假数据（C2-09 真源键：@oj-module/runtime，shell/src/manifest.ts P7.6） */

package/templates/{api/tests → tests}/lifecycle/register.spec.ts

@@ -8,7 +8,7 @@
 /* eslint-disable test/prefer-lowercase-title -- 任务/AC 编号是验收锚点，保留大写（DB/P1-5） */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { checkOccupancy, queryAllRegistered, queryRegistered, registerSolution } from "../../src/_platform/_lifecycle/steps/register";
+import { checkOccupancy, queryAllRegistered, queryRegistered, registerSolution } from "../../src/_platform/api/_lifecycle/steps/register";
 import { installDb } from "../fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/{api/tests → tests}/lifecycle/semver.spec.ts

@@ -3,7 +3,7 @@
 // 无 prerelease > 有 prerelease；「1.0」「1.0.0」「1.0.0.0」视为相等（安装器容错口径）。
 import { describe, expect, it } from "vitest";
 
-import { compareVersions } from "../../src/_platform/_lifecycle/semver";
+import { compareVersions } from "../../src/_platform/api/_lifecycle/semver";
 
 const cases: Array<[a: string, b: string, expected: -1 | 0 | 1]> = [
 	// 主版本数值比较（非字典序）

package/templates/{api/tests → tests}/lifecycle/sha384.spec.ts

@@ -4,7 +4,7 @@
 import { Buffer } from "node:buffer";
 import { createHash } from "node:crypto";
 import { describe, expect, it } from "vitest";
-import { bytesToBase64, sha384B64, sha384Bytes } from "../../src/_platform/_lifecycle/sha384";
+import { bytesToBase64, sha384B64, sha384Bytes } from "../../src/_platform/api/_lifecycle/sha384";
 
 const hex = (bytes: Uint8Array): string => Array.from(bytes, b => b.toString(16).padStart(2, "0")).join("");
 

package/templates/{api/tests → tests}/lifecycle/sig-fixtures.spec.ts

@@ -10,7 +10,7 @@ import { fileURLToPath } from "node:url";
 import { describe, expect, it } from "vitest";
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
-const SIG_DIR = path.resolve(HERE, "../../../../src/lifecycle/__tests__/fixtures/sig");
+const SIG_DIR = path.resolve(HERE, "../../../src/lifecycle/__tests__/fixtures/sig");
 const GEN = path.join(SIG_DIR, "gen-signed-fixtures.mjs");
 
 const HEX64 = /^[0-9a-f]{64}$/;

package/templates/{api/tests → tests}/lifecycle/solutions-api.spec.ts

@@ -5,7 +5,7 @@
 /* eslint-disable test/prefer-lowercase-title -- 端点路径是验收锚点 */
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
-import api from "../../src/_platform/solutions/api";
+import api from "../../src/_platform/api/solutions/api";
 import { installDb } from "../fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/{api/tests → tests}/lifecycle/steps-fs.spec.ts

@@ -6,11 +6,11 @@
 // 命令构造为纯函数，argv 逐字断言（与平台 exec 白名单逐字对齐，S1-2 基座）；
 // exec/fetch/sha256 面经 ctx 注入 stub，不真跑网络；合法夹具集成用例的 exec stub 落到真实系统 tar
 // （与生产同路径：isolate 不内嵌解压，exec.run 系统 tar）。
-import type { FsFace } from "../../src/_platform/_lifecycle/atomic";
-import type { StateStore } from "../../src/_platform/_lifecycle/state";
-import type { DownloadContext } from "../../src/_platform/_lifecycle/steps/download";
-import type { ExecFace, ExtractContext } from "../../src/_platform/_lifecycle/steps/extract";
-import type { VerifyContext } from "../../src/_platform/_lifecycle/steps/verify";
+import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
+import type { StateStore } from "../../src/_platform/api/_lifecycle/state";
+import type { DownloadContext } from "../../src/_platform/api/_lifecycle/steps/download";
+import type { ExecFace, ExtractContext } from "../../src/_platform/api/_lifecycle/steps/extract";
+import type { VerifyContext } from "../../src/_platform/api/_lifecycle/steps/verify";
 import { execFile as execFileCb } from "node:child_process";
 import { createHash } from "node:crypto";
 import * as fsp from "node:fs/promises";
@@ -18,11 +18,11 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { defaultTestKey, nodeVerifyEd25519, signedArchiveFor } from "../../../../src/lifecycle/__tests__/helpers";
-import { archiveFileOf, download } from "../../src/_platform/_lifecycle/steps/download";
-import { buildExtractCmd, buildListCmd, checkModuleManifest, extract } from "../../src/_platform/_lifecycle/steps/extract";
-import { verify } from "../../src/_platform/_lifecycle/steps/verify";
-import { createTrustStore } from "../../src/_platform/_lifecycle/trust";
+import { defaultTestKey, nodeVerifyEd25519, signedArchiveFor } from "../../../src/lifecycle/__tests__/helpers";
+import { archiveFileOf, download } from "../../src/_platform/api/_lifecycle/steps/download";
+import { buildExtractCmd, buildListCmd, checkModuleManifest, extract } from "../../src/_platform/api/_lifecycle/steps/extract";
+import { verify } from "../../src/_platform/api/_lifecycle/steps/verify";
+import { createTrustStore } from "../../src/_platform/api/_lifecycle/trust";
 
 const execFileP = promisify(execFileCb);
 const g = globalThis as any;
@@ -352,8 +352,8 @@ describe("verify（stage=verifying，C2-29 sha256 fail-closed + P2-3 六码验
 	it("sig_key：已信任 key_id 但包内公钥与库绑定不一致（首次绑定不可改族）", async () => {
 		await seed();
 		// 另一把私钥冒用已信任 key_id（trusted key_id + 异公钥 = 绑定不一致）
-		const { signedArchiveFor: signFor } = await import("../../../../src/lifecycle/__tests__/helpers");
-		const { generateKeyPair } = await import("../../../../src/lifecycle/keygen");
+		const { signedArchiveFor: signFor } = await import("../../../src/lifecycle/__tests__/helpers");
+		const { generateKeyPair } = await import("../../../src/lifecycle/keygen");
 		const impostor = signFor(BYTES, "demo-solution", "0.1.0", { keyPair: generateKeyPair(), keyId: "test.publisher" });
 		const r = await verify(vfCtx({ manifest: manifest({ ...manifest().archive, signature: impostor.sig }) }));
 		expect(r).toMatchObject({ ok: false, code: "sig_key" });

package/templates/{api/tests → tests}/lifecycle/text-edit.spec.ts

@@ -5,7 +5,7 @@
 import * as fsp from "node:fs/promises";
 import { describe, expect, it } from "vitest";
 
-import { appendAnonymousPaths, bumpInstallSeq, ensureReloadApi, hasAnchor, insertAnchor } from "../../src/_platform/_lifecycle/text-edit";
+import { appendAnonymousPaths, bumpInstallSeq, ensureReloadApi, hasAnchor, insertAnchor } from "../../src/_platform/api/_lifecycle/text-edit";
 
 describe("insertAnchor（R18）", () => {
 	it("带注释的 config.yaml 插入后注释/缩进/空行/键序逐字保留", () => {

package/templates/{api/tests → tests}/lifecycle/tgz-guard.spec.ts

@@ -4,7 +4,7 @@
 // 拒绝：绝对路径、任何 `..` 段、l/h 条目、空成员名、反斜杠路径；`./` 前缀相对合法。
 import { describe, expect, it } from "vitest";
 
-import { validateTarListing } from "../../src/_platform/_lifecycle/tgz-guard";
+import { validateTarListing } from "../../src/_platform/api/_lifecycle/tgz-guard";
 
 describe("validateTarListing（R1）", () => {
 	it("正常成员列表通过", () => {

package/templates/{api/tests → tests}/lifecycle/trust.spec.ts

@@ -2,17 +2,17 @@
 // store 层：空库/幂等/首次绑定不可改/多 key/吊销/损坏 fail-closed/.bak 回落/并发读不见半截/审计。
 // 端点层：GET /market/trust、POST /market/trust/key、DELETE /market/trust/key?key_id=（del 动词 + query，system/roles 同款先例）。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（market-api.spec 同约定） */
-import type { FsFace } from "../../src/_platform/_lifecycle/atomic";
-import type { MarketEnv } from "../../src/_platform/market/api";
+import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
+import type { MarketEnv } from "../../src/_platform/api/market/api";
 import { Buffer } from "node:buffer";
 import { createHash } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { createTrustStore, isValidKeyId } from "../../src/_platform/_lifecycle/trust";
-import { invalidateAllUsers } from "../../src/_platform/_shared/service/infra/access";
-import { createMarketApi, marketEnv } from "../../src/_platform/market/api";
+import { createTrustStore, isValidKeyId } from "../../src/_platform/api/_lifecycle/trust";
+import { invalidateAllUsers } from "../../src/_platform/api/_shared/service/infra/access";
+import { createMarketApi, marketEnv } from "../../src/_platform/api/market/api";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;

package/templates/{api/tests → tests}/lifecycle/uninstall.spec.ts

@@ -5,17 +5,17 @@
 // 夹具：本仓范式（node:sqlite 真实迁移建表 + 真实 fs 面 g.fs）；market_history 表由平台迁移
 // 0012（IF NOT EXISTS）随 installDb 重放建立，守卫语义（表不存在静默跳过）单列一例。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（market-api.spec 同约定） */
-import type { FsFace } from "../../src/_platform/_lifecycle/atomic";
-import type { MarketEnv } from "../../src/_platform/market/api";
+import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
+import type { MarketEnv } from "../../src/_platform/api/market/api";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { readLock, writeLock } from "../../src/_platform/_lifecycle/lock";
-import { createStateStore } from "../../src/_platform/_lifecycle/state";
-import { collectRetainedTables, moduleTablePrefix } from "../../src/_platform/_lifecycle/uninstall";
-import { invalidateAllUsers } from "../../src/_platform/_shared/service/infra/access";
-import { createMarketApi } from "../../src/_platform/market/api";
+import { readLock, writeLock } from "../../src/_platform/api/_lifecycle/lock";
+import { createStateStore } from "../../src/_platform/api/_lifecycle/state";
+import { collectRetainedTables, moduleTablePrefix } from "../../src/_platform/api/_lifecycle/uninstall";
+import { invalidateAllUsers } from "../../src/_platform/api/_shared/service/infra/access";
+import { createMarketApi } from "../../src/_platform/api/market/api";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;

package/templates/{api/tests → tests}/lifecycle/verify-checks.spec.ts

@@ -1,8 +1,8 @@
 // BDD：深检后端四项 + 端点（P2-7，C2-42）+ SSRF 三钉。
 // 纯 diff 函数 / 探针分类 / SSRF 钉（出站拦截 / header 清洗 / 不跟随重定向）+ 端点门（401/403/404）+ 编排。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（market-api.spec 同约定） */
-import type { FsFace } from "../../src/_platform/_lifecycle/atomic";
-import type { SolutionRouteRow } from "../../src/_platform/_lifecycle/verify-checks";
+import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
+import type { SolutionRouteRow } from "../../src/_platform/api/_lifecycle/verify-checks";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -18,9 +18,9 @@ import {
 	sha384B64,
 
 	verifyRouteReachability,
-} from "../../src/_platform/_lifecycle/verify-checks";
-import { siteOrigin } from "../../src/_platform/market/api";
-import { createSolutionsApi, solutionsEnv } from "../../src/_platform/solutions/api";
+} from "../../src/_platform/api/_lifecycle/verify-checks";
+import { siteOrigin } from "../../src/_platform/api/market/api";
+import { createSolutionsApi, solutionsEnv } from "../../src/_platform/api/solutions/api";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;
@@ -278,7 +278,10 @@ function setHttp(over: Record<string, unknown>) {
 }
 
 function makeEnv() {
-	return { ...solutionsEnv(), sharedRoot: root, statePath: join(root, "state.yaml") };
+	// modulesJsonPath 钉进临时目录（readFile 失败 → 不打 web 项）：默认值 `web/dist/modules.json`
+	// 是相对 cwd 的，会把模板本机构建产物卷进用例，全绿用例随「模板 build 过没有」摇摆。
+	// P4-2 两条 integrity 用例显式覆盖它。
+	return { ...solutionsEnv(), sharedRoot: root, statePath: join(root, "state.yaml"), modulesJsonPath: join(root, "modules.json") };
 }
 
 describe("深检端点门（admin 域）", () => {

package/templates/{api/tests → tests}/lifecycle/verify-report.spec.ts

@@ -1,8 +1,8 @@
 // BDD：P2-8 深检报告结构 + 留存 N=10 + 可信性项（trust_state）+ i18n 降级项 + 设值不进报告。
 // 纯模块单测（verify-report.ts）+ 端点编排（persist-on-POST / GET verify/last / 降级项 / secret 不泄漏）。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（verify-checks.spec 同约定） */
-import type { FsFace } from "../../src/_platform/_lifecycle/atomic";
-import type { VerifyReport } from "../../src/_platform/_lifecycle/verify-report";
+import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
+import type { VerifyReport } from "../../src/_platform/api/_lifecycle/verify-report";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -12,8 +12,8 @@ import {
 	persistReport,
 	VERIFY_REPORTS_KEEP,
 	verifyReportsDirOf,
-} from "../../src/_platform/_lifecycle/verify-report";
-import { createSolutionsApi, solutionsEnv } from "../../src/_platform/solutions/api";
+} from "../../src/_platform/api/_lifecycle/verify-report";
+import { createSolutionsApi, solutionsEnv } from "../../src/_platform/api/solutions/api";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;
@@ -127,7 +127,9 @@ function setHttp(over: Record<string, unknown> = {}) {
 }
 
 function makeEnv() {
-	return { ...solutionsEnv(), sharedRoot: root, statePath: join(root, "state.yaml"), verifyReportsDir: reportsDir };
+	// modulesJsonPath 同 verify-checks.spec：钉进临时目录（缺文件 → 跳过 web 项），
+	// 不吃模板本机 `web/dist/modules.json`。
+	return { ...solutionsEnv(), sharedRoot: root, statePath: join(root, "state.yaml"), modulesJsonPath: join(root, "modules.json"), verifyReportsDir: reportsDir };
 }
 
 async function insertRoute(perm: string | null) {

package/templates/{api/tests → tests}/query-utils.spec.ts

@@ -3,7 +3,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { beforeAll, describe, expect, it } from "vitest";
 
-import { likePattern, paged, pagedFactory } from "../src/_platform/_shared/service/infra/query";
+import { likePattern, paged, pagedFactory } from "../src/_platform/api/_shared/service/infra/query";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/{api/tests → tests}/rbac-audit.spec.ts

@@ -3,7 +3,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { auditDeny, auditOp, recordOp, resetDenyAudit } from "../src/_platform/_shared/service/infra/audit";
+import { auditDeny, auditOp, recordOp, resetDenyAudit } from "../src/_platform/api/_shared/service/infra/audit";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/{api/tests → tests}/rbac-contacts.spec.ts

@@ -4,7 +4,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { contactDetail, searchContacts } from "../src/_platform/_shared/service/domain/contacts";
+import { contactDetail, searchContacts } from "../src/_platform/api/_shared/service/domain/contacts";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
@@ -74,7 +74,7 @@ describe("详情与限速", () => {
 	it("接口级限速：同用户突发超限 → 429", async () => {
 		const uid = mkUser("c_rate");
 		g.http = { user: { id: uid } };
-		const { rateLimit } = await import("../src/_platform/_shared/service/infra/rate");
+		const { rateLimit } = await import("../src/_platform/api/_shared/service/infra/rate");
 		// 窗口 60s / 限额 3（测试参数；生产端点各自定额）
 		for (let i = 0; i < 3; i++)
 			await rateLimit(`contacts:${uid}`, 3, 60_000);

package/templates/{api/tests → tests}/rbac-guard.spec.ts

@@ -4,7 +4,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { assertPermission, assertSuperAdmin, assertSystemAdmin, invalidateUser } from "../src/_platform/_shared/service/infra/access";
+import { assertPermission, assertSuperAdmin, assertSystemAdmin, invalidateUser } from "../src/_platform/api/_shared/service/infra/access";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/{api/tests → tests}/rbac-roles.spec.ts

@@ -4,8 +4,8 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { createRole, deleteRole, listPermissions, listRoles, updateBindings } from "../src/_platform/_shared/service/domain/roles";
-import { assertPermission } from "../src/_platform/_shared/service/infra/access";
+import { createRole, deleteRole, listPermissions, listRoles, updateBindings } from "../src/_platform/api/_shared/service/domain/roles";
+import { assertPermission } from "../src/_platform/api/_shared/service/infra/access";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/{api/tests → tests}/rbac-seed.spec.ts

@@ -1,13 +1,14 @@
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-// BDD：seed 契约——框架内置角色 + seed 超管绑定 + must_change 首登改密（D12/AC1-27）。
+// BDD：seed 契约——框架内置角色 + 内置角色开发账号（账号名=角色名，must_change=0，
+// 2026-10-22 口径，替代原「admin 绑 superadmin + must_change=1」的 D12 旧钉）。
 // 夹具重放真实 migrations + seed.sql 文件，本 spec 即「seed 与文件不漂移」的钉子。
 import { beforeAll, describe, expect, it } from "vitest";
 
 import { installDb } from "./fixture";
 
-const SEED = join(dirname(fileURLToPath(import.meta.url)), "..", "src", "_platform", "seed.sql");
+const SEED = join(dirname(fileURLToPath(import.meta.url)), "..", "src", "_platform", "api", "seed.sql");
 let dbo: ReturnType<typeof installDb>;
 
 beforeAll(() => {
@@ -38,17 +39,18 @@ describe("框架内置角色（ROLES 常量单一真相，PRD §4.2）", () => {
 	});
 });
 
-describe("seed 超管（D12）", () => {
-	// AUTOINCREMENT 不复用 id（sqlite_sequence 语义），统一按 username 动态解析，不钉死 id
-	const adminId = () => (dbo.prepare("SELECT id FROM users WHERE username = 'admin'").get() as { id: number }).id;
-
-	it("admin 账号绑定 superadmin 角色（sys_user_role 权威源）", () => {
-		const row = dbo.prepare("SELECT * FROM sys_user_role WHERE user_id = ? AND role_name = 'superadmin'").get(adminId());
+describe("seed 内置角色开发账号（账号名=角色名，2026-10-22 口径）", () => {
+	it.each(["superadmin", "admin", "editor", "viewer"])("账号 %s 绑定同名角色且 must_change=0", (name) => {
+		const uid = (dbo.prepare("SELECT id FROM users WHERE username = ?").get(name) as { id: number }).id;
+		const row = dbo.prepare("SELECT * FROM sys_user_role WHERE user_id = ? AND role_name = ?").get(uid, name);
 		expect(row).toBeDefined();
+		const mc = dbo.prepare("SELECT must_change FROM users WHERE id = ?").get(uid) as { must_change: number };
+		expect(Number(mc.must_change)).toBe(0);
 	});
 
-	it("must_change=1：首登强制改密（AC1-27 前提）", () => {
-		const row = dbo.prepare("SELECT must_change FROM users WHERE id = ?").get(adminId()) as { must_change: number };
-		expect(Number(row.must_change)).toBe(1);
+	it("admin 不再绑 superadmin（旧 D12 绑定已被幂等 DELETE 收敛）", () => {
+		const uid = (dbo.prepare("SELECT id FROM users WHERE username = 'admin'").get() as { id: number }).id;
+		const row = dbo.prepare("SELECT * FROM sys_user_role WHERE user_id = ? AND role_name = 'superadmin'").get(uid);
+		expect(row).toBeUndefined();
 	});
 });

package/templates/{api/tests → tests}/rbac-settings.spec.ts

@@ -2,8 +2,8 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { listLoginMethods, listSettings, updateSetting } from "../src/_platform/_shared/service/domain/settings";
-import { searchOplog } from "../src/_platform/_shared/service/infra/oplog";
+import { listLoginMethods, listSettings, updateSetting } from "../src/_platform/api/_shared/service/domain/settings";
+import { searchOplog } from "../src/_platform/api/_shared/service/infra/oplog";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/{api/tests → tests}/rbac-solution-perms.spec.ts

@@ -4,7 +4,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { uninstallSolution, upsertSolutionPerms } from "../src/_platform/_shared/service/domain/solution-perms";
+import { uninstallSolution, upsertSolutionPerms } from "../src/_platform/api/_shared/service/domain/solution-perms";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/{api/tests → tests}/rbac-users.spec.ts

@@ -3,11 +3,11 @@
 // 禁止操作自己（AC1-10 注）；roles 写 sys_user_role 唯一权威源 + 写时失效（AC1-7/D10）；
 // 禁用/重置口令级联删 refresh（§3.1 吊销联动）。
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
-import type { SessionDeps } from "../src/auth/_shared/session";
+import type { SessionDeps } from "../src/auth/api/_shared/session";
 
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
-import { changePasswordByAdmin, createUser, listUsers, setForbidden, updateUserRoles } from "../src/_platform/_shared/service/domain/users";
-import { createSession } from "../src/auth/_shared/session";
+import { changePasswordByAdmin, createUser, listUsers, setForbidden, updateUserRoles } from "../src/_platform/api/_shared/service/domain/users";
+import { createSession } from "../src/auth/api/_shared/session";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;