@oj-module/cli 0.2.20 → 0.2.25

package/src/lifecycle/__tests__/bundle.test.ts

@@ -1,8 +1,9 @@
 // BDD：`ojm build --bundle` 方案包组装（P1-11）。
 // 组装契约（对齐 tgz 内布局，契约 §2.9 + P1-9 staging copy 源定版）：
-//   <root>/manifest.yaml                          ← 必填，契约校验 fail-fast 先于打包
-//   api/dist/<name>-<version>/                    ← oj build 产物原样 → tgz 内 api/<name>-<version>/（C2-31 分层核对）
-//   web/dist/modules/<name>/                      ← 站点构建模块产物 → tgz 内 web/modules/<name>/（只入包方案自己的模块）
+//   <root>/solution.yaml | manifest.yaml           ← 必填（solution.yaml 优先，避开 oj 的 api 枚举冲突），契约校验 fail-fast 先于打包
+//   <root>/src/<模块>/solution.yaml | manifest.yaml ← 模块级方案：契约与所打包模块同位（同优先级回退）
+//   dist/api/<name>-<version>/                    ← oj build 产物原样 → tgz 内 api/<name>-<version>/（C2-31 分层核对）
+//   dist/web/modules/<name>/                      ← 站点构建模块产物 → tgz 内 web/modules/<name>/（只入包方案自己的模块）
 // 禁携 modules.json（C2-31 红线）；产物确定性（C2-32）由 deterministic-tar 承担，此处断言端到端复现。
 import { execFileSync } from "node:child_process";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
@@ -31,24 +32,42 @@ afterEach(() => {
 	rmSync(out, { recursive: true, force: true });
 });
 
-/** 预置「已构建」产物：oj build（api/dist/<name>-<version>/）与站点构建（web/dist/modules/） */
+/** 预置「已构建」产物：oj build（dist/api/<name>-<version>/）与站点构建（dist/web/modules/） */
 function makePrebuiltArtifacts(): void {
 	// oj build 产物（模块级 manifest 仅 oj 原生七键；name/version 与 bundle 级逐一相等，C2-31）
-	const apiDist = join(project, "api/dist/demo-solution-0.1.0");
+	const apiDist = join(project, "dist/api/demo-solution-0.1.0");
 	mkdirSync(join(apiDist, "ping"), { recursive: true });
 	mkdirSync(join(apiDist, "migrations"), { recursive: true });
 	writeFileSync(join(apiDist, "manifest.yaml"), "name: demo-solution\ndesc: manifest.yaml 契约全字段合法夹具\nversion: 0.1.0\ntables:\n  - note\n");
 	writeFileSync(join(apiDist, "schema.yaml"), "tables:\n  note: {}\n");
 	writeFileSync(join(apiDist, "routes.js"), "export {};\n");
 	writeFileSync(join(apiDist, "ping/api.js"), "export async function ping() {}\n");
-	// 站点构建产物（web/dist/modules/<name>/<version>/entry.js + css，对应 web.entry/css 声明）
-	const webDist = join(project, "web/dist/modules/demo-solution/0.1.0");
+	// 站点构建产物（dist/web/modules/<name>/<version>/entry.js + css，对应 web.entry/css 声明）
+	const webDist = join(project, "dist/web/modules/demo-solution/0.1.0");
 	mkdirSync(webDist, { recursive: true });
 	writeFileSync(join(webDist, "entry.js"), "export default {};\n");
 	writeFileSync(join(webDist, "demo-solution.css"), ".demo{}\n");
 }
 
-const pack = () => buildBundle(project, { out });
+const pack = () => buildBundle(project, { out }).then(r => r[0]!);
+
+/** 造一个 web-only 用户方案（模块级契约 + 站点产物，无 api 段校验面最小） */
+function addWebSolution(name: string, version = "0.1.0"): void {
+	const dir = join(project, "src", name);
+	mkdirSync(dir, { recursive: true });
+	writeFileSync(join(dir, "solution.yaml"), [
+		`name: ${name}`,
+		`version: ${version}`,
+		`summary: ${name} 用户方案`,
+		`changelog: ${name} 首个版本`,
+		"web:",
+		`  entry: modules/${name}/${version}/entry.js`,
+		"",
+	].join("\n"));
+	const webDist = join(project, "dist/web/modules", name, version);
+	mkdirSync(webDist, { recursive: true });
+	writeFileSync(join(webDist, "entry.js"), "export default {};\n");
+}
 
 describe("buildBundle · 正路径", () => {
 	it("产出 out/<name>-<version>.tgz + 64 位 sha256，布局单根三分（manifest/api/web）", async () => {
@@ -66,7 +85,7 @@ describe("buildBundle · 正路径", () => {
 
 	it("只入包方案自己的前端模块：模板模块（home/login…）不随包", async () => {
 		// 安装器 deployWeb 把包内 web/modules 整树覆盖进目标站，模板产物随包会覆盖宿主同名前端
-		const hostWeb = join(project, "web/dist/modules/home/0.1.0");
+		const hostWeb = join(project, "dist/web/modules/home/0.1.0");
 		mkdirSync(hostWeb, { recursive: true });
 		writeFileSync(join(hostWeb, "entry.js"), "export default {};\n");
 		const names = tarList((await pack()).tgz);
@@ -85,17 +104,161 @@ describe("buildBundle · 正路径", () => {
 		expect(tarList(r.tgz).some(n => n.endsWith("/modules.json"))).toBe(false);
 	});
 
+	it("solution.yaml 作为 bundle 契约（优先于 manifest.yaml，避开 oj 按 manifest.yaml 枚举 api 后端的冲突）", async () => {
+		// 根目录若用 manifest.yaml 当 bundle 契约，会被 oj 的 api 模块搜索枚举误判为 api 模块；
+		// 故解决方案改用 solution.yaml，bundle 工具优先认它（manifest.yaml 仅旧方案回退）。
+		const mf = join(project, "manifest.yaml");
+		const sf = join(project, "solution.yaml");
+		cpSync(mf, sf);
+		rmSync(mf);
+		const r = await pack();
+		expect(r.name).toBe("demo-solution");
+		expect(existsSync(r.tgz)).toBe(true);
+		// tgz 内固定为 manifest.yaml（安装侧只认这个名字），与源文件名无关
+		const names = tarList(r.tgz);
+		expect(names).toContain("demo-solution-0.1.0/manifest.yaml");
+		expect(names.some(n => n.endsWith("/solution.yaml"))).toBe(false);
+	});
+
+	it("src/<模块>/solution.yaml 作为 bundle 契约（模块级方案：契约与所打包模块同位）", async () => {
+		// 单模块方案：契约紧贴它打包的模块 src/<name>/，比工程根更直观；
+		// 仍不在 api/ 下、也不叫 manifest.yaml，等价避开 oj 按 manifest.yaml 枚举 api 后端的冲突。
+		const mf = join(project, "manifest.yaml");
+		const sf = join(project, "src/demo-solution/solution.yaml");
+		mkdirSync(dirname(sf), { recursive: true });
+		cpSync(mf, sf);
+		rmSync(mf);
+		const r = await pack();
+		expect(r.name).toBe("demo-solution");
+		expect(existsSync(r.tgz)).toBe(true);
+		// tgz 内固定为 manifest.yaml（安装侧只认这个名字），与源文件名/源位置无关
+		const names = tarList(r.tgz);
+		expect(names).toContain("demo-solution-0.1.0/manifest.yaml");
+		expect(names.some(n => n.endsWith("/solution.yaml"))).toBe(false);
+	});
+
+	it("src/ 下多份模块级契约 → 全部打包（多方案；B2）", async () => {
+		// 多方案正是本特性要支持的场景：每份契约独立校验、独立出包
+		rmSync(join(project, "manifest.yaml"));
+		addWebSolution("mod-a");
+		addWebSolution("mod-b");
+		const results = await buildBundle(project, { out });
+		expect(results.map(r => r.name).sort()).toEqual(["mod-a", "mod-b"]);
+		for (const r of results)
+			expect(existsSync(r.tgz)).toBe(true);
+	});
+
 	it("产物树混入 modules.json → 打包自检拒绝（C2-31 红线）", async () => {
-		writeFileSync(join(project, "web/dist/modules/demo-solution/0.1.0/modules.json"), "[]");
+		writeFileSync(join(project, "dist/web/modules/demo-solution/0.1.0/modules.json"), "[]");
 		await expect(pack()).rejects.toThrow(/modules\.json/);
 	});
 
-	it("私钥/凭证混入包树 → 打包自检拒绝（P2-4 入包红线：*.pem/*.key/.env/id_ed25519/id_rsa）", async () => {
-		writeFileSync(join(project, "api/dist/demo-solution-0.1.0/signing.pem"), "-----BEGIN PRIVATE KEY-----\n");
+	it("私钥/凭证混入包树 → 打包自检拒绝（P2-4 入包红线：*.pem/*.key/.env(.local…)/id_ed25519/id_rsa/*.p12/*.pfx）", async () => {
+		writeFileSync(join(project, "dist/api/demo-solution-0.1.0/signing.pem"), "-----BEGIN PRIVATE KEY-----\n");
 		await expect(pack()).rejects.toThrow(/私钥\/凭证/);
-		rmSync(join(project, "api/dist/demo-solution-0.1.0/signing.pem"));
-		writeFileSync(join(project, "web/dist/modules/demo-solution/0.1.0/.env"), "SECRET=1\n");
+		rmSync(join(project, "dist/api/demo-solution-0.1.0/signing.pem"));
+		writeFileSync(join(project, "dist/web/modules/demo-solution/0.1.0/.env"), "SECRET=1\n");
 		await expect(pack()).rejects.toThrow(/私钥\/凭证/);
+		rmSync(join(project, "dist/web/modules/demo-solution/0.1.0/.env"));
+		writeFileSync(join(project, "dist/web/modules/demo-solution/0.1.0/.env.production"), "SECRET=1\n");
+		await expect(pack()).rejects.toThrow(/私钥\/凭证/);
+	});
+});
+
+describe("buildBundle · 多方案与内置排除（B3/B7/B8/B9/B10/B12）", () => {
+	it("b3 内置方案跳过：名单内的模块契约不出包，用户契约照打", async () => {
+		rmSync(join(project, "manifest.yaml"));
+		addWebSolution("crm");
+		addWebSolution("oj-market"); // 自带方案也带契约（第一方可分发形态）
+		mkdirSync(join(project, "src"), { recursive: true });
+		writeFileSync(join(project, "src/.ojm-builtin.json"), JSON.stringify({ modules: ["oj-market"] }));
+		const results = await buildBundle(project, { out });
+		expect(results.map(r => r.name)).toEqual(["crm"]);
+	});
+
+	it("b6/B3 无名单文件 → 无内置概念，多份契约全部打包", async () => {
+		rmSync(join(project, "manifest.yaml"));
+		addWebSolution("crm");
+		addWebSolution("oj-market");
+		const results = await buildBundle(project, { out });
+		expect(results.map(r => r.name).sort()).toEqual(["crm", "oj-market"]);
+	});
+
+	it("b7+B8：目录不同契约 name 撞车 → 被 name===目录名 校验拦下（B8 使 B7 向量不可达，决策见计划文档）", async () => {
+		rmSync(join(project, "manifest.yaml"));
+		addWebSolution("crm");
+		// 拷贝改目录忘改 name 的典型症状——B8 在收集期即拒，dist/ 不会出现同名产物
+		const dir = join(project, "src", "crm-copy");
+		mkdirSync(dir, { recursive: true });
+		writeFileSync(join(dir, "solution.yaml"), "name: crm\nversion: 0.1.0\nsummary: dup\nchangelog: x\nweb:\n  entry: modules/crm/0.1.0/entry.js\n");
+		await expect(buildBundle(project, { out })).rejects.toThrow(/与目录名「crm-copy」不一致/);
+	});
+
+	it("b8 模块级契约 name ≠ 目录名 → fail-fast", async () => {
+		rmSync(join(project, "manifest.yaml"));
+		const dir = join(project, "src", "crm");
+		mkdirSync(dir, { recursive: true });
+		writeFileSync(join(dir, "solution.yaml"), "name: erp\nversion: 0.1.0\nsummary: x\n");
+		await expect(pack()).rejects.toThrow(/与目录名「crm」不一致/);
+	});
+
+	it("b9 两段式：多契约其一校验失败 → dist/ 零增量", async () => {
+		rmSync(join(project, "manifest.yaml"));
+		addWebSolution("crm");
+		// erp 契约违规（name 大写触发契约校验）
+		const dir = join(project, "src", "erp");
+		mkdirSync(dir, { recursive: true });
+		writeFileSync(join(dir, "solution.yaml"), "name: erp\nversion: 0.1.0\nsummary: x\n");
+		await expect(buildBundle(project, { out })).rejects.toThrow(/C2-08/);
+		expect(existsSync(join(out, "crm-0.1.0.tgz"))).toBe(false);
+	});
+
+	it("b10 旧契约回退：src/<name>/manifest.yaml（非内置）参与收集", async () => {
+		rmSync(join(project, "manifest.yaml"));
+		const dir = join(project, "src", "crm");
+		mkdirSync(dir, { recursive: true });
+		writeFileSync(join(dir, "manifest.yaml"), "name: crm\nversion: 0.1.0\nsummary: x\nchangelog: x\nweb:\n  entry: modules/crm/0.1.0/entry.js\n");
+		const webDist = join(project, "dist/web/modules/crm/0.1.0");
+		mkdirSync(webDist, { recursive: true });
+		writeFileSync(join(webDist, "entry.js"), "export default {};\n");
+		const results = await buildBundle(project, { out });
+		expect(results.map(r => r.name)).toEqual(["crm"]);
+	});
+
+	it("b12 坏 .ojm-builtin.json → fail-fast 报路径与错因", async () => {
+		mkdirSync(join(project, "src"), { recursive: true });
+		writeFileSync(join(project, "src/.ojm-builtin.json"), "{ not json");
+		await expect(pack()).rejects.toThrow(/\.ojm-builtin\.json/);
+	});
+
+	it("b4 --bundle <name>：按名打包；内置名拒绝；非法名拒绝", async () => {
+		rmSync(join(project, "manifest.yaml"));
+		addWebSolution("crm");
+		addWebSolution("erp");
+		const one = await buildBundle(project, { out, name: "crm" });
+		expect(one.map(r => r.name)).toEqual(["crm"]);
+		await expect(buildBundle(project, { out, name: "erp2" })).rejects.toThrow(/未找到「erp2」/);
+		writeFileSync(join(project, "src/.ojm-builtin.json"), JSON.stringify({ modules: ["erp"] }));
+		await expect(buildBundle(project, { out, name: "erp" })).rejects.toThrow(/框架自带方案/);
+		await expect(buildBundle(project, { out, name: "../evil" })).rejects.toThrow(/非法/);
+		await expect(buildBundle(project, { out, name: "Bad Name" })).rejects.toThrow(/非法/);
+	});
+
+	it("b1 根契约优先于 src 契约（旧行为）+ B11 hint", async () => {
+		addWebSolution("crm"); // 根 manifest.yaml（demo-solution）仍在
+		const spy: string[] = [];
+		const orig = console.log;
+		console.log = (m?: unknown) => {
+			spy.push(String(m));
+		};
+		try {
+			const results = await buildBundle(project, { out });
+			expect(results.map(r => r.name)).toEqual(["demo-solution"]);
+		}
+		finally {
+			console.log = orig;
+		}
+		expect(spy.join("\n")).toMatch(/工程根契约优先/);
 	});
 });
 
@@ -106,29 +269,29 @@ describe("buildBundle · 校验先于打包（fail-fast）", () => {
 		expect(existsSync(join(out, "Demo-1.0.0+build.5.tgz"))).toBe(false);
 	});
 
-	it("manifest.yaml 缺失：可读报错指明期望路径", async () => {
+	it("manifest.yaml 缺失且无用户方案：可读报错指向 ojm new（B5）", async () => {
 		rmSync(join(project, "manifest.yaml"));
-		await expect(pack()).rejects.toThrow(/manifest\.yaml/);
+		await expect(pack()).rejects.toThrow(/没有可打包的用户方案/);
 	});
 
 	it("c2-31 分层核对：模块级 desc ≠ bundle summary → 放行（等值要求已移除）", async () => {
-		writeFileSync(join(project, "api/dist/demo-solution-0.1.0/manifest.yaml"), "name: demo-solution\ndesc: 不一致描述\nversion: 0.1.0\n");
+		writeFileSync(join(project, "dist/api/demo-solution-0.1.0/manifest.yaml"), "name: demo-solution\ndesc: 不一致描述\nversion: 0.1.0\n");
 		await expect(pack()).resolves.toMatchObject({ name: "demo-solution" });
 	});
 
-	it("c2-31 分层核对：api/dist 缺 <name>-<version>/ → 可读报错指明期望产物路径", async () => {
-		rmSync(join(project, "api/dist"), { recursive: true, force: true });
-		await expect(pack()).rejects.toThrow(/api\/dist\/demo-solution-0\.1\.0/);
+	it("c2-31 分层核对：dist/api 缺 <name>-<version>/ → 可读报错指明期望产物路径", async () => {
+		rmSync(join(project, "dist/api"), { recursive: true, force: true });
+		await expect(pack()).rejects.toThrow(/dist\/api\/demo-solution-0\.1\.0/);
 	});
 
 	it("web 段存在但站点产物缺失 → 可读报错指引先构建", async () => {
-		rmSync(join(project, "web/dist"), { recursive: true, force: true });
-		await expect(pack()).rejects.toThrow(/web\/dist\/modules/);
+		rmSync(join(project, "dist/web"), { recursive: true, force: true });
+		await expect(pack()).rejects.toThrow(/dist\/web\/modules/);
 	});
 
-	it("web/dist/modules 在但缺本方案目录 → 可读报错（不整树入包）", async () => {
-		rmSync(join(project, "web/dist/modules/demo-solution"), { recursive: true, force: true });
-		await expect(pack()).rejects.toThrow(/web\/dist\/modules\/demo-solution\//);
+	it("dist/web/modules 在但缺本方案目录 → 可读报错（不整树入包）", async () => {
+		rmSync(join(project, "dist/web/modules/demo-solution"), { recursive: true, force: true });
+		await expect(pack()).rejects.toThrow(/dist\/web\/modules\/demo-solution\//);
 	});
 
 	it("c2-12a：api.tables 与 schema.yaml 表集不一致 → 构建期拒绝", async () => {

package/src/lifecycle/__tests__/install.test.ts

@@ -6,7 +6,6 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { parseLifecycleArgs } from "../../args";
 import { setEnabledCommand } from "../../enable";
 import { installCommand, parseTarget, renderOutcome } from "../../install";
 import { pollTask, resolveSite } from "../../site";
@@ -61,28 +60,6 @@ afterEach(() => {
 	vi.restoreAllMocks();
 });
 
-describe("parseLifecycleArgs · 参数解析", () => {
-	it("位置参数与值式 flag 分离：--url 等的值不被误当位置参数（P6 同款坑）", () => {
-		const a = parseLifecycleArgs(["demo-solution@0.1.0", "--url", "http://x:1", "--user", "u", "--pass", "p", "--locale", "en-US"]);
-		expect(a.positionals).toEqual(["demo-solution@0.1.0"]);
-		expect(a.url).toBe("http://x:1");
-		expect(a.user).toBe("u");
-		expect(a.pass).toBe("p");
-		expect(a.locale).toBe("en-US");
-	});
-
-	it("install 专属 --name/--version 覆盖位", () => {
-		const a = parseLifecycleArgs(["./a.tgz", "--name", "demo-solution", "--version", "0.2.0"]);
-		expect(a.positionals).toEqual(["./a.tgz"]);
-		expect(a.name).toBe("demo-solution");
-		expect(a.version).toBe("0.2.0");
-	});
-
-	it("未知 --flag 忽略不炸", () => {
-		expect(parseLifecycleArgs(["x", "--future"]).positionals).toEqual(["x"]);
-	});
-});
-
 describe("resolveSite · 站点寻址（flag > 环境变量 > 缺省模板 serve 端口 9778）", () => {
 	const ENV_BACKUP = { ...process.env };
 

package/src/lifecycle/__tests__/new.test.ts

@@ -0,0 +1,129 @@
+// BDD：`ojm new <name>` 方案骨架生成（docs/plans/2026-10-22-1640-multi-solution-bundle-design.md §C）。
+// N0 非工程拒绝 / N1 骨架 round-trip（生成→补产物→buildBundle 直接过）/ N2 --api
+// N3 非法·保留·内置·重名拒绝 / N5 空名拒绝 / N6 历史布局拒绝 / N7 失败清理
+import fs, { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync, writeFileSync as writeFileSyncOrig } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { buildBundle } from "../../bundle";
+import { createSolution } from "../../new";
+
+let project: string;
+
+beforeEach(() => {
+	project = mkdtempSync(join(tmpdir(), "ojm-new-"));
+});
+
+afterEach(() => {
+	rmSync(project, { recursive: true, force: true });
+});
+
+/** 最小 module-root 工程面：web.config.ts + src/（含一个自带模块 home 与内置名单） */
+function makeModuleRootProject(builtin = true): void {
+	mkdirSync(join(project, "src", "home", "web"), { recursive: true });
+	writeFileSync(join(project, "src", "home", "web", "entry.ts"), "export default { name: \"home\" };\n");
+	writeFileSync(join(project, "web.config.ts"), "export default { baseUrl: \"\", modules: [] };\n");
+	if (builtin)
+		writeFileSync(join(project, "src", ".ojm-builtin.json"), JSON.stringify({ modules: ["home"] }));
+}
+
+/** 给已生成的方案补站点产物，模拟「ojm build 之后」的打包前置 */
+function addWebArtifacts(name: string, version = "0.1.0"): void {
+	const webDist = join(project, "dist/web/modules", name, version);
+	mkdirSync(webDist, { recursive: true });
+	writeFileSync(join(webDist, "entry.js"), "export default {};\n");
+}
+
+describe("createSolution · 守卫", () => {
+	it("n0 非 ojm 工程（无 web.config.ts / src/）→ 拒绝且零写入", () => {
+		expect(() => createSolution(project, "crm")).toThrow(/不是 ojm 工程/);
+		expect(existsSync(join(project, "src"))).toBe(false);
+	});
+
+	it("n6 历史布局工程（web/src 树）→ 拒绝 + 迁移指引", () => {
+		mkdirSync(join(project, "web", "src", "old"), { recursive: true });
+		writeFileSync(join(project, "web.config.ts"), "export default { modules: [] };\n");
+		expect(() => createSolution(project, "crm")).toThrow(/module-root/);
+		expect(existsSync(join(project, "src", "crm"))).toBe(false);
+	});
+
+	it("n3 非法名（大写/数字开头/路径穿越）→ 拒绝", () => {
+		makeModuleRootProject();
+		for (const bad of ["Crm", "9crm", "../crm", "bad name"])
+			expect(() => createSolution(project, bad)).toThrow(/非法/);
+	});
+
+	it("n3 保留名（system）与内置名（home）→ 拒绝 + 指引", () => {
+		makeModuleRootProject();
+		expect(() => createSolution(project, "system")).toThrow(/保留名/);
+		expect(() => createSolution(project, "home")).toThrow(/框架自带/);
+	});
+
+	it("n3 目录已存在（非内置共享目录撞名）→ 拒绝", () => {
+		makeModuleRootProject();
+		mkdirSync(join(project, "src", "crm"), { recursive: true });
+		expect(() => createSolution(project, "crm")).toThrow(/已存在/);
+	});
+
+	it("n5 空名 → 拒绝", () => {
+		makeModuleRootProject();
+		expect(() => createSolution(project, "")).toThrow(/非法/);
+	});
+});
+
+describe("createSolution · 生成", () => {
+	it("n1 生成 web 骨架：solution.yaml/entry.ts/页面/双语 locales 齐备，layout 写进 handle", () => {
+		makeModuleRootProject();
+		const r = createSolution(project, "crm", { layout: "container" });
+		expect(r.files).toHaveLength(5);
+		const entry = readFileSync(join(project, "src/crm/web/entry.ts"), "utf-8");
+		expect(entry).toContain("layout: \"container\"");
+		expect(entry).toContain("crm:menu.main");
+		expect(readFileSync(join(project, "src/crm/solution.yaml"), "utf-8")).toContain("name: crm");
+		expect(JSON.parse(readFileSync(join(project, "src/crm/web/locales/zh-CN.json"), "utf-8")).menu.main).toBeTruthy();
+		expect(JSON.parse(readFileSync(join(project, "src/crm/web/locales/en-US.json"), "utf-8")).menu.main).toBeTruthy();
+		// --layout none
+		createSolution(project, "erp", { layout: "none" });
+		expect(readFileSync(join(project, "src/erp/web/entry.ts"), "utf-8")).toContain("layout: \"none\"");
+	});
+
+	it("n1 round-trip：生成的骨架补产物后 buildBundle({ name }) 直接过", async () => {
+		makeModuleRootProject();
+		createSolution(project, "crm");
+		addWebArtifacts("crm");
+		const results = await buildBundle(project, { out: join(project, "dist"), name: "crm" });
+		expect(results.map(r => r.name)).toEqual(["crm"]);
+		expect(existsSync(results[0]!.tgz)).toBe(true);
+	});
+
+	it("n2 --api：额外生成 api 骨架且 solution.yaml 含 api 段", () => {
+		makeModuleRootProject();
+		createSolution(project, "crm", { api: true });
+		expect(existsSync(join(project, "src/crm/api/manifest.yaml"))).toBe(true);
+		expect(readFileSync(join(project, "src/crm/api/manifest.yaml"), "utf-8")).toContain("name: crm");
+		expect(readFileSync(join(project, "src/crm/api/api.ts"), "utf-8")).toContain("/api/crm/ping");
+		const sol = readFileSync(join(project, "src/crm/solution.yaml"), "utf-8");
+		expect(sol).toContain("api:");
+		expect(sol).toContain("prefix: /api/crm");
+	});
+
+	it("n7 生成中途失败 → 不残留半截 src/<name>/", () => {
+		makeModuleRootProject();
+		// 让第二次写盘（entry.ts）必失败：首写（solution.yaml）成功后触发清理路径——
+		// 预置冲突文件会先在「目录已存在」守卫被拒，测不到 rmSync 回滚（审查发现 n7 旧用例假绿）
+		let calls = 0;
+		const spy = vi.spyOn(fs, "writeFileSync").mockImplementation(((...args: unknown[]) => {
+			calls++;
+			if (calls === 2)
+				throw new Error("ENOSPC: disk full");
+			return (writeFileSyncOrig as (...a: unknown[]) => unknown)(...args);
+		}) as typeof fs.writeFileSync);
+		try {
+			expect(() => createSolution(project, "crm")).toThrow(/disk full/);
+		}
+		finally {
+			spy.mockRestore();
+		}
+		expect(existsSync(join(project, "src", "crm"))).toBe(false);
+	});
+});

package/src/lifecycle/__tests__/smoke.test.ts

@@ -34,7 +34,7 @@ afterEach(() => {
 describe.skipIf(!smokeReady)("真机冒烟（需 OJM_SMOKE_URL/OJM_SMOKE_USER/OJM_SMOKE_PASS）", () => {
 	it("file 源安装 fixture-valid 包 → 终态 done", { timeout: 600_000 }, async () => {
 		// 先出可安装 tgz（同 bundle.test.ts：预置已构建产物再 --bundle 组装）
-		const apiDist = join(project, "api/dist/demo-solution-0.1.0");
+		const apiDist = join(project, "dist/api/demo-solution-0.1.0");
 		const { mkdirSync, writeFileSync } = await import("node:fs");
 		mkdirSync(join(apiDist, "ping"), { recursive: true });
 		// 迁移 SQL 随夹具 src 真源（0001__init.sql 建 note 表）；B-11 硬验收：appliedSeq > 0 可断言
@@ -45,11 +45,12 @@ describe.skipIf(!smokeReady)("真机冒烟（需 OJM_SMOKE_URL/OJM_SMOKE_USER/OJ
 		cpSync(join(FIXTURE_VALID, "api/src/demo-solution/schema.yaml"), join(apiDist, "schema.yaml"));
 		writeFileSync(join(apiDist, "routes.js"), "export {};\n");
 		writeFileSync(join(apiDist, "ping/api.js"), "export async function ping() {}\n");
-		const webDist = join(project, "web/dist/modules/demo-solution/0.1.0");
+		const webDist = join(project, "dist/web/modules/demo-solution/0.1.0");
 		mkdirSync(webDist, { recursive: true });
 		writeFileSync(join(webDist, "entry.js"), "export default {};\n");
 		writeFileSync(join(webDist, "demo-solution.css"), ".demo{}\n");
-		const { tgz } = await buildBundle(project, { out: join(project, "dist") });
+		const [built] = await buildBundle(project, { out: join(project, "dist") });
+		const { tgz } = built!;
 
 		const record = await installCommand(tgz, { url: SMOKE_URL ?? DEFAULT_SITE_URL, user: SMOKE_USER, pass: SMOKE_PASS });
 		expect(record.status).toBe("done");

package/src/manifest-contract.ts

@@ -16,11 +16,24 @@ export type ParseResult = { ok: true, manifest: BundleManifest } | { ok: false,
 
 // ── 契约 §2/§4 正则与清单（与 preflight.ts 逐字对应；改动须先改契约再同步双端与夹具）──
 
-/** C2-01：name 白名单 */
-const NAME_RE = /^[a-z][a-z0-9-]{0,63}$/;
+/** C2-01：name 白名单（导出供 ojm new/--bundle <name> 入口校验共用，DRY） */
+export const NAME_RE = /^[a-z][a-z0-9-]{0,63}$/;
+
+/**
+ * 方案名入口校验（`--bundle <name>` / `ojm new <name>` 共用，先校验再拼路径）：
+ * 与契约 C2-01 同一条正则；入口先给可读错误，契约校验再做正式判罚。
+ * 放在这里而非 bundle.ts——new 入口不应拖入打包模块图（esbuild/deterministic-tar 等）。
+ */
+export function assertValidSolutionName(name: string, where: string): void {
+	if (!NAME_RE.test(name)) {
+		throw new Error(
+			`[ojm] ${where}：「${name}」非法——须为 kebab-case（小写字母/数字/连字符，首字符为小写字母）。`,
+		);
+	}
+}
 
 /** §4.2 保留名清单（C2-01/13/14 共用；market 经 R9 恢复保留） */
-const RESERVED_NAMES = new Set(["_platform", "system", "auth", "market", "framework", "health", "plugins", "_system"]);
+export const RESERVED_NAMES = new Set(["_platform", "system", "auth", "market", "framework", "health", "plugins", "_system"]);
 
 /** C2-02 字符集：[0-9A-Za-z.-]（禁 +——oj validate_version 拒装，附录 B-1；禁 _——契约收紧） */
 const VERSION_CHARS_RE = /^[0-9A-Z.-]+$/i;

package/src/market/__tests__/bootstrap.test.ts

@@ -100,6 +100,30 @@ describe("given 一个装了 oj 二进制的源工程 When 自举隔离站点",
 		await site.cleanup();
 	});
 
+	it("then 起站 api 路径 = 构建产物实际位置 <root>/dist/api（module-root；旧写死 api/dist 起站即挂）", async () => {
+		const src = newSourceProject();
+		const { started, starter } = fakeStarter();
+
+		const site = await bootstrapIsolatedSite({ projectRoot: src, starter });
+
+		// starter 第三参是 oj serve 的 --api-path：必须与 buildBackend 产物落点同源
+		// （layout.ts module-root 口径 apiDist = <root>/dist/api；写死 api/dist 会在
+		// mounts 校验报 No such file or directory，2026-10-23 演练实踩）
+		expect(started[0]?.apiSrc).toBe(join(site.root, "dist", "api"));
+		await site.cleanup();
+	});
+
+	it("then 种子管理员 = superadmin（seed 账号名=角色名口径；admin 已被解绑，用它会 403）", async () => {
+		const src = newSourceProject();
+		const { starter } = fakeStarter();
+
+		const site = await bootstrapIsolatedSite({ projectRoot: src, starter });
+
+		expect(site.admin.user).toBe("superadmin");
+		expect(site.admin.pass).toBe("123456");
+		await site.cleanup();
+	});
+
 	it("then CDN 目录在临时根内且已落好 fixture 包与索引", async () => {
 		const src = newSourceProject();
 		const { starter } = fakeStarter();

package/src/market/__tests__/setup.test.ts

@@ -8,7 +8,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { describe, expect, it } from "vitest";
 
-import { setupMarketUrl } from "../setup";
+import { loginPasswordAfterSetup, setupMarketUrl } from "../setup";
 
 const MOUNTS = "  - prefix: /api\n    api: src\n  - prefix: /cdn\n    web: ../cdn\n";
 const CONFIG = `mounts:\n${MOUNTS}server:\n  host: 127.0.0.1\n  port: 9778\n`;
@@ -112,3 +112,10 @@ describe("given 改密后写设置仍被拒 When setup", () => {
 			.toThrow(/must_change|权限|设置/);
 	});
 });
+
+describe("given setup 返回 changedPassword When 选 setup 后的登录口令", () => {
+	it("then 改密已发生用 newPass，未改密用原种子口令（must_change=0 是当前 seed 常态）", () => {
+		expect(loginPasswordAfterSetup({ siteUrl: "", cdnBaseUrl: "", changedPassword: true }, "new-pass", "123456")).toBe("new-pass");
+		expect(loginPasswordAfterSetup({ siteUrl: "", cdnBaseUrl: "", changedPassword: false }, "new-pass", "123456")).toBe("123456");
+	});
+});

package/src/market/bootstrap.ts

@@ -36,7 +36,9 @@ import { parseFixtureSpec } from "./fixture";
 import { publishPackage } from "./publish";
 
 /** 种子管理员（隔离库全新 seed；与 templates seed.sql 一致） */
-const SEED_ADMIN_USER = "admin";
+// 种子管理员 = superadmin：模板 seed 账号名=角色名（3d93063f 起 admin 被幂等解绑 superadmin
+// 角色），写 market 安全设置要求 actor 持 superadmin 角色——用 admin 会 403（2026-10-23 演练实踩）。
+const SEED_ADMIN_USER = "superadmin";
 const SEED_ADMIN_PASS = "123456";
 
 /** Ed25519 PKCS#8 DER 前缀（RFC 8410 固定头；与 gen-signed-fixtures.mjs 同一手法） */
@@ -50,7 +52,7 @@ export interface IsolatedPublisher {
 }
 
 export interface IsolatedSite {
-	/** 临时根（含 config.yaml / src/ / api/dist/ / bin/ / cdn/） */
+	/** 临时根（含 config.yaml / src/ / dist/api/ / bin/ / cdn/） */
 	root: string
 	port: number
 	baseUrl: string
@@ -96,7 +98,7 @@ export async function bootstrapIsolatedSite(opts: BootstrapOptions = {}): Promis
 
 	const root = mkdtempSync(path.join(tmpdir(), "ojm-trial-"));
 	// 新布局（`src/<name>/{api,web}`）：config.yaml 在隔离根，源码树根为 <root>/src，
-	// 构建产物仍是扁平根 <root>/api/dist（与真实工程同形）。
+	// 构建产物仍是扁平根 <root>/dist/api（与真实工程同形）。
 	const srcDir = path.join(root, "src");
 	const configPath = path.join(root, "config.yaml");
 	const cdnDir = path.join(root, "cdn");
@@ -143,9 +145,9 @@ export async function bootstrapIsolatedSite(opts: BootstrapOptions = {}): Promis
 	mkdirSync(siteDir, { recursive: true });
 	writeFileSync(path.join(siteDir, "index.html"), "<!doctype html><html><body>ojm trial site</body></html>\n", "utf-8");
 	cfg = cfg.replace("web: ./cdn", `web: ${cdnDir}\n  - prefix: /\n    web: ${siteDir}\n    spa: true`);
-	// 安装目标恒为 release 部署：装好的模块落在 api/dist，dev 形态（--api-path src）发现不了。
+	// 安装目标恒为 release 部署：装好的模块落在 dist/api，dev 形态（--api-path src）发现不了。
 	// 故隔离站点以 dist 起站，platform.root 同步改写（oj 校验 root 必须是生效的 api 挂载目录）。
-	// root 相对 **config 所在目录** 解析——config 在隔离根，产物在 <root>/api/dist，故不能写死
+	// root 相对 **config 所在目录** 解析——config 在隔离根，产物在 <root>/dist/api，故不能写死
 	// `dist`（那是 config 还在 api/ 时的旧口径），按布局取值。
 	const apiDistRel = path.relative(root, resolveLayout(root).apiDist).split(path.sep).join("/");
 	cfg = cfg.replace("  root: src", `  root: ${apiDistRel}`);
@@ -172,14 +174,14 @@ export async function bootstrapIsolatedSite(opts: BootstrapOptions = {}): Promis
 	await publishPackage({ projectRoot: root, fixture: opts.fixture, id: keyId, privateKeyPem: publisher.privateKeyPem });
 	await buildIndex({ projectRoot: root, id: keyId, privateKeyPem: publisher.privateKeyPem });
 
-	// 7) 后端构建（api/dist + versions.json；安装与 reloading 都依赖它）
+	// 7) 后端构建（dist/api + versions.json；安装与 reloading 都依赖它）
 	await buildBackend(root);
 
 	// 7b) 起 oj（starter 注入供测试）；ready 失败即整体作废，不留孤儿
 	const starter = opts.starter ?? ((cfgPath: string, base: string, apiSrc: string) => startOj(cfgPath, base, apiSrc));
 	let oj: OjProcess;
 	try {
-		oj = starter(configPath, "/api", path.join(root, "api", "dist"));
+		oj = starter(configPath, "/api", resolveLayout(root).apiDist);
 		await oj.ready;
 	}
 	catch (error) {
@@ -258,7 +260,7 @@ function teardownReport(root: string, port: number): string[] {
 		`隔离根：${root}`,
 		"  config.yaml + config/ 证书 + db.sqlite   站点配置面",
 		"  src/    后端模块源码树（src/<name>/api，拷自 cli 内置模板）",
-		"  api/dist/  构建产物（安装目标）",
+		"  dist/api/  构建产物（安装目标）",
 		"  bin/    oj 二进制与插件（拷贝自源工程）",
 		"  cdn/    隔离 CDN（fixture 包 + 两份索引 + 签名）",
 		`监听端口：127.0.0.1:${port}（进程已停）`,

package/src/market/cdn-layout.ts

@@ -3,9 +3,9 @@
  *
  * 两条不能破的规矩：
  * 1. **不许硬编码端口/主机/挂载路径**——全部从 `api/config.yaml` 读。
- *    dev 形态下 `/cdn` 只在 oj 子进程（`server.port`）上成立，dev server 自己（5174）
- *    会把 `/cdn/*` 交给静态层、未命中就回落 index.html（设计 §3.1.1）；写成相对路径或
- *    写死 9778，市场页拿到的会是 HTML 而不是索引 YAML。
+ *    （2026-10-23 起 dev 形态 ojm 已把 /cdn 反代给 oj 子进程，`framework.market_cdn_url`
+ *    允许写相对路径 `/cdn` = 本站点自供，由消费侧按请求源补全；本模块的绝对基址推导
+ *    只服务 `market setup` 写外部地址的场景。）
  * 2. **基址无尾斜杠**——`market/api.ts` 按 `${base}/bundles.yaml` 拼。
  *
  * 文本版（`resolveCdnLayoutFromConfig`）与工程版（`resolveCdnLayout`）分工：前者纯函数便于单测，