@oj-module/cli 0.2.23 → 0.2.26

package/src/index.ts

@@ -1,223 +1,43 @@
-import fs from "node:fs";
-import path from "node:path";
 import process from "node:process";
-import { parseApiArgs, parseBuildArgs, parseInitArgs, parseLifecycleArgs, parseNewArgs, parseVendorArgs } from "./args";
-import { buildBackend, buildModules } from "./build";
-import { buildBundle } from "./bundle";
-import { devServer } from "./dev";
-import { mergeManifests, printInfo } from "./info";
-import { initProject } from "./init";
-import { createSolution } from "./new";
-import { runPreview } from "./preview";
-import { getCommandHelp, resolveHelpRequest, usageText } from "./usage";
-import { vendorCommand } from "./vendor";
+import { buildCli, localizeCacError, reportCliError, rewriteHelpArgv, unknownCommandResult } from "./cli";
+import { isKnownCommand, resolveLang, usageText } from "./usage";
 import { readCliVersion } from "./versions";
 
-/** ojm → oj 透传子命令（其余参数原样转发，见 src/oj-cmd.ts） */
-const OJ_PASSTHROUGH = new Set(["test", "exec", "openapi", "migrate", "schema"]);
-
-const [command] = process.argv.slice(2);
-
-function usage(): never {
-	console.log(usageText());
-	process.exit(command ? 1 : 0);
-}
-
 async function main() {
-	const projectRoot = process.cwd();
-
-	// 帮助请求：`ojm <cmd> --help` / `ojm help <cmd>` / 顶层 `ojm --help`
-	// 必须在 switch 之前拦截，否则会真正执行子命令（如 `ojm market setup --help` 会去建 CDN）。
-	const helpReq = resolveHelpRequest();
-	if (helpReq !== null) {
-		if (!helpReq.cmd) {
-			console.log(usageText());
-			return;
-		}
-		const text = getCommandHelp(helpReq.cmd, helpReq.sub);
-		if (text) {
-			console.log(text);
-			return;
-		}
-		console.error(`[ojm] 未知命令：${helpReq.cmd}${helpReq.sub ? ` ${helpReq.sub}` : ""}`);
-		process.exit(1);
-	}
+	const lang = resolveLang();
+	const argv = process.argv.slice(2);
 
-	// 顶层 --version / -V：打印 cli 包版本（与 `ojm info` 的 cli 版本同源）
-	if (command === "--version" || command === "-V") {
+	// 顶层 --version / -V：裸版本号（与 ojm info 同源）；不经 cac，避免其 platformInfo 后缀
+	if (argv[0] === "--version" || argv[0] === "-V") {
 		console.log(readCliVersion());
 		return;
 	}
 
-	switch (command) {
-		case "build": {
-			const { bundle, bundleName, out } = parseBuildArgs(process.argv.slice(3));
-			if (bundle) {
-				// 方案包构建（P1-11）：契约校验 fail-fast → 确定性 tgz + sha256（消费方：市场安装器）
-				// 多方案：无 bundleName 打全部用户方案（自带排除），有则只打 name 那一份
-				const results = await buildBundle(projectRoot, { out, name: bundleName });
-				if (results.length > 1)
-					console.log(`[ojm] 共打包 ${results.length} 份方案包（逐包签名：ojm sign dist/<name>-<version>.tgz --id <publisher>.<key> --check）`);
-				break;
-			}
-			// 设计 §5：后端 oj build（零 DB 副作用）→ 前端全站合并（仅 build 清场合并）
-			await buildBackend(projectRoot);
-			await buildModules(projectRoot, { mergeSite: true });
-			break;
-		}
-		case "new": {
-			const { name, layout, api } = parseNewArgs(process.argv.slice(3));
-			if (!name) {
-				console.error("[ojm] 用法：ojm new <name> [--layout container|none] [--api]（非交互环境必须显式给 name）");
-				process.exit(1);
-			}
-			const created = createSolution(projectRoot, name, { layout, api });
-			console.log(`[ojm] 已生成方案骨架：${path.relative(process.cwd(), created.dir)}`);
-			for (const f of created.files)
-				console.log(`[ojm]   + ${f}`);
-			console.log(`[ojm] 下一步：pnpm dev 看效果 → ojm build && ojm build --bundle ${name} 打包`);
-			break;
-		}
-		case "init": {
-			const { dest, yes } = parseInitArgs(process.argv.slice(3));
-			await initProject(dest ? path.resolve(dest) : projectRoot, { yes });
-			break;
-		}
-		case "preview": {
-			const previewPortArg = Number(process.argv[3]);
-			const previewPort = Number.isInteger(previewPortArg) && previewPortArg > 0 ? previewPortArg : undefined;
-			await runPreview(projectRoot, { port: previewPort });
-			break;
-		}
-		case "dev": {
-			const portArg = Number(process.argv[3]);
-			const port = Number.isFinite(portArg) && portArg > 0 ? portArg : 5174;
-			await devServer(projectRoot, { port });
-			break;
-		}
-		case "info":
-			await printInfo(projectRoot, undefined, { all: process.argv.slice(3).includes("--all") });
-			break;
-		case "vendor": {
-			const { force, tag } = parseVendorArgs(process.argv.slice(3));
-			await vendorCommand(projectRoot, { force, tag });
-			break;
-		}
-		case "api": {
-			const { dir, check, docs, exempt } = parseApiArgs(process.argv.slice(3));
-			// S5：显式目录必须先存在——否则静默在错的目录下生成/对账
-			if (dir && !fs.existsSync(path.resolve(dir)))
-				throw new Error(`[ojm-api] 项目目录不存在：${dir}`);
-			const apiRoot = dir ? path.resolve(dir) : projectRoot;
-			if (docs) {
-				const { runApiDocs } = await import("./contract/run");
-				const out = await runApiDocs(apiRoot);
-				console.log(`[ojm-api] 文档站已生成：${path.relative(projectRoot, out)}（浏览器直接打开即可）`);
-				break;
-			}
-			if (check) {
-				const { checkApi } = await import("./contract/check");
-				// --exempt <path>：相对路径按项目根解析；缺省按布局找 .ojm-api-exempt.json（工程根 → api/）
-				// （旧名 api/.ram-api-exempt.json 仍被读取，R4）
-				const { violations, hints } = await checkApi({ cwd: apiRoot, exempt: exempt ? path.resolve(projectRoot, exempt) : undefined });
-				for (const v of violations)
-					console[v.level === "error" ? "error" : "warn"](`${v.level === "error" ? "✗" : "⚠"} ${v.message}`);
-				for (const h of hints)
-					console.log(h);
-				if (violations.length === 0)
-					console.log("[ojm-api] --check 通过：生成物同步、route 双向对账、routes.js 均无 drift。");
-				const errors = violations.filter(v => v.level === "error").length;
-				console.log(`[ojm-api] --check 结果：${errors} error / ${violations.length - errors} warn`);
-				if (errors > 0)
-					process.exit(1);
-				break;
-			}
-			const { runApi } = await import("./contract/run");
-			const result = await runApi({ cwd: apiRoot });
-			console.log(`[ojm-api] 契约 ${result.contracts} 份；写入 ${result.written.length} 个文件，跳过（未变）${result.skipped.length} 个；stub 新建 ${result.stubs.created} / 更新 ${result.stubs.updated} / 跳过 ${result.stubs.skipped}`);
-			for (const p of result.written)
-				console.log(`  + ${path.relative(apiRoot, p)}`);
-			break;
-		}
-		case "merge":
-			await mergeManifests(process.argv[3] ?? "", process.argv.slice(4));
-			break;
-		case "keygen": {
-			// 签名密钥对生成（P2-4，作者工具链）：缺省 ~/.ojm/keys/<id>，工程树内落盘需 --yes
-			const { parseKeygenArgs } = await import("./keygen");
-			const { keygenCommand } = await import("./keygen");
-			const { id, out, yes } = parseKeygenArgs(process.argv.slice(3));
-			keygenCommand({ id, out, yes });
-			break;
-		}
-		case "sign": {
-			// detached 侧车签名（P2-4，G4 载体）：ojm sign <tgz> [--id <publisher.id>] [--key <pem>] [--check]
-			const { parseSignArgs } = await import("./sign");
-			const { signCommand } = await import("./sign");
-			const { positionals, id, key, check } = parseSignArgs(process.argv.slice(3));
-			signCommand(positionals[0] ?? "", { id, key, check });
-			break;
-		}
-		case "install": {
-			// 方案包安装瘦客户端（P1-13，D6）：file 上传 / CDN 市场源 → 轮询任务至终态
-			const { positionals, url, user, pass, locale, name, version } = parseLifecycleArgs(process.argv.slice(3));
-			const { installCommand } = await import("./install");
-			await installCommand(positionals[0] ?? "", { url, user, pass, locale, name, version });
-			break;
-		}
-		case "enable":
-		case "disable": {
-			// 生命周期开关瘦客户端（P1-13，D8）：站点侧 setEnabled 四处同写
-			const { positionals, url, user, pass } = parseLifecycleArgs(process.argv.slice(3));
-			const { setEnabledCommand } = await import("./enable");
-			await setEnabledCommand(positionals[0] ?? "", command === "enable", { url, user, pass });
-			break;
-		}
-		case "uninstall": {
-			// 卸载瘦客户端（P1-15a，缺口 B）：站点侧 runUninstall 四处同删 + 权限级联
-			const { positionals, url, user, pass } = parseLifecycleArgs(process.argv.slice(3));
-			const { uninstallCommand } = await import("./uninstall");
-			await uninstallCommand(positionals[0] ?? "", { url, user, pass });
-			break;
-		}
-		case "trust": {
-			// 信任库运维瘦客户端（P2-2，C2-38/39）：ls / add <key_id> <pubkey_hex> / revoke <key_id> / confirm --task
-			const { positionals, url, user, pass, task } = parseLifecycleArgs(process.argv.slice(3));
-			const { trustCommand } = await import("./trust");
-			await trustCommand(positionals[0] ?? "", positionals.slice(1), { url, user, pass, task });
-			break;
-		}
-		case "publish": {
-			// 索引发布（P3-5/6/7，作者工具链）：重算 bundles/manifests 索引 + detached .sig 签名写回
-			const { parsePublishArgs } = await import("./publish");
-			const { publishCommand } = await import("./publish");
-			const { positionals, id, key, check } = parsePublishArgs(process.argv.slice(3));
-			publishCommand(positionals[0] ?? "", { id, key, check });
-			break;
-		}
-		case "market": {
-			// 本地模拟 CDN 与市场链路（setup / publish / build-index）
-			const { runMarket } = await import("./market/command");
-			await runMarket(process.argv.slice(3));
-			break;
-		}
-		default: {
-			if (command && OJ_PASSTHROUGH.has(command)) {
-				const { runOjSubcommand } = await import("./oj-cmd");
-				runOjSubcommand(projectRoot, command, process.argv.slice(3));
-				break;
-			}
-			usage();
-		}
+	const rewritten = rewriteHelpArgv(argv);
+	const cli = buildCli(process.cwd(), lang);
+	let unknown: string | undefined;
+	cli.on("command:*", () => {
+		// cac 在 --help 输出后会 unsetMatchedCommand 再发 command:*（args[0] 可能是子命令，如 verify）——
+		// 误判根源。按「首位置参数是否是已知命令」判定：market 等已知命令的子命令不误判，未知首参才兜底
+		const first = rewritten.find(a => !a.startsWith("-"));
+		if (first !== undefined && !isKnownCommand(first))
+			unknown = first;
+	});
+	cli.parse(["node", "ojm", ...rewritten]);
+
+	// 未知命令：help 形态报「未知命令」、否则打帮助；均 exit 1（裸 ojm 打帮助退 0 不变）
+	if (unknown !== undefined) {
+		const r = unknownCommandResult(unknown, lang, !!cli.options.help);
+		if (cli.options.help)
+			console.error(r.text);
+		else
+			console.log(r.text);
+		process.exit(r.code);
 	}
+	if (argv.length === 0)
+		console.log(usageText(lang));
 }
 
-main().catch((error: unknown) => {
-	// Error 的 message 已是人话（含修复指引）；堆栈默认是噪音，OJM_DEBUG=1 才输出
-	// （旧名 RAM_DEBUG 一并读，兼容既有排障习惯）。
-	// 文案常自带 [ojm] 前缀（bundle/publish/sign 等抛出的错误），顶层不再叠一个，否则变 [ojm] [ojm]。
-	const isDebug = !!(process.env.OJM_DEBUG ?? process.env.RAM_DEBUG);
-	const body = error instanceof Error ? (isDebug ? error.stack ?? error.message : error.message) : String(error);
-	console.error(/^\[ojm/.test(body) ? body : `[ojm] ${body}`);
-	process.exit(1);
-});
+main().catch((error: unknown) => reportCliError(localizeCacError(error, resolveLang()), (code) => {
+	process.exit(code);
+}));

package/src/init.ts

@@ -489,10 +489,8 @@ logs/
 # 现场签发的开发证书与凭据私钥（ojm dev 缺证时自动签发，见 oj-cert.ts）；私钥绝不入仓
 config/*.pem
 config/cert.jws
-# 构建产物
-api/dist/
-web/dist/
-modules/dist/
+# 构建产物（ojm build：站点 dist/web + 后端 release dist/api）
+dist/
 `;
 
 function ensureGitignore(destDir: string, report: InitReport): void {

package/src/keygen.ts

@@ -24,25 +24,6 @@ export interface KeygenOptions {
 
 export const DEFAULT_KEY_ID = "local.dev";
 
-/** `ojm keygen [--id <publisher.id>] [--out <dir>] [--yes]` 参数解析（值式 flag 逐项消费，P6 同款纪律） */
-export function parseKeygenArgs(argv: string[]): { id?: string, out?: string, yes?: boolean } {
-	const values: Record<string, string> = {};
-	let yes = false;
-	for (let i = 0; i < argv.length; i++) {
-		const a = argv[i]!;
-		if (a === "--yes") {
-			yes = true;
-			continue;
-		}
-		if (a === "--id" || a === "--out") {
-			values[a] = argv[i + 1] ?? "";
-			i++;
-			continue;
-		}
-	}
-	return { id: values["--id"], out: values["--out"], yes };
-}
-
 /** C2-37 key_id 命名空间（与 isolate 侧 trust.ts isValidKeyId 同规则；禁裸通用名单段） */
 export function isValidKeyId(keyId: string): boolean {
 	return /^[a-z][a-z0-9-]*(?:\.[a-z0-9-]+)+$/.test(keyId);

package/src/layout.ts

@@ -14,12 +14,12 @@
  * `src/<x>/api/manifest.yaml` 与 `src/<x>/web/entry.ts` 是唯一真源（设计 C-6：
  * 一侧可缺省，两侧皆无则不是模块）。
  *
- * 产物根在两套布局里语义相同、位置不变：
- *   api/dist   oj 扁平 release 根（<name>-<version>/ 同层兄弟 + manifests.yaml）
- *   web/dist   站点产物（shell + modules/ + modules.json）
+ * 产物根（2026-10-22 起收进工程根单一 dist/，原 {web,api}/dist 与源码混树）：
+ *   dist/api   oj 扁平 release 根（<name>-<version>/ 同层兄弟 + manifests.yaml），三种布局一致
+ *   dist/web   站点产物（shell + modules/ + modules.json）；flat 例外：框架根仓维持 build/
  * 产物按模块聚合已被设计 §2.2 否决（实证见该节），禁止在此引入第二套形状。
  *
- * watch 目标绝不含产物目录：若 watch `web/`，重建产物（web/dist）
+ * watch 目标绝不含产物目录：若 watch `web/`，重建产物（dist/web）
  * 会反过来触发重建，形成自触发循环（设计 §4）。
  */
 
@@ -42,9 +42,9 @@ export interface ProjectLayout {
 	projectRoot: string
 	/** 模块源码目录：module-root → `<project>/src`；new → `<project>/web/src`；flat → `<project>/web` */
 	modulesSrc: string
-	/** 站点产物根：module-root / new → `<project>/web/dist`；flat → `<project>/build` */
+	/** 站点产物根：module-root / new → `<project>/dist/web`；flat → `<project>/build`（框架根仓约定） */
 	distDir: string
-	/** oj 扁平 release 根：恒为 `<project>/api/dist`（设计 C-3/C-7，不随布局变化） */
+	/** oj 扁平 release 根：恒为 `<project>/dist/api`（不随布局变化；无布局回退同值） */
 	apiDist: string
 	/** fs.watch 目标（纯源码，永不落产物） */
 	watchTarget: string
@@ -161,8 +161,8 @@ export function tryResolveLayout(projectRoot: string): ProjectLayout | null {
 			kind: "module-root",
 			projectRoot,
 			modulesSrc: path.join(projectRoot, "src"),
-			distDir: path.join(projectRoot, "web", "dist"),
-			apiDist: path.join(projectRoot, "api", "dist"),
+			distDir: path.join(projectRoot, "dist", "web"),
+			apiDist: path.join(projectRoot, "dist", "api"),
 			watchTarget: path.join(projectRoot, "src"),
 			moduleRoot: path.join(projectRoot, "src"),
 		};
@@ -173,8 +173,8 @@ export function tryResolveLayout(projectRoot: string): ProjectLayout | null {
 			kind: "new",
 			projectRoot,
 			modulesSrc: path.join(projectRoot, "web", "src"),
-			distDir: path.join(projectRoot, "web", "dist"),
-			apiDist: path.join(projectRoot, "api", "dist"),
+			distDir: path.join(projectRoot, "dist", "web"),
+			apiDist: path.join(projectRoot, "dist", "api"),
 			watchTarget: path.join(projectRoot, "web", "src"),
 		};
 	}
@@ -186,7 +186,7 @@ export function tryResolveLayout(projectRoot: string): ProjectLayout | null {
 			projectRoot,
 			modulesSrc: path.join(projectRoot, "web"),
 			distDir: path.join(projectRoot, "build"),
-			apiDist: path.join(projectRoot, "api", "dist"),
+			apiDist: path.join(projectRoot, "dist", "api"),
 			watchTarget: path.join(projectRoot, "web"),
 		};
 	}

package/src/lifecycle/__tests__/authoring.test.ts

@@ -5,8 +5,8 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { DEFAULT_KEY_ID, isValidKeyId, keygenCommand, parseKeygenArgs } from "../../keygen";
-import { parseSignArgs, signCommand } from "../../sign";
+import { DEFAULT_KEY_ID, isValidKeyId, keygenCommand } from "../../keygen";
+import { signCommand } from "../../sign";
 import { readPrivateKeyPem } from "../keygen";
 import { fingerprintOfPublicKey, signCanonical as signCanonicalLocal, verifyCanonical } from "../sign";
 
@@ -19,11 +19,7 @@ afterEach(() => {
 	fs.rmSync(tmp, { recursive: true, force: true });
 });
 
-describe("ojm keygen 参数解析 + key_id 命名空间（C2-37）", () => {
-	it("parseKeygenArgs：--id/--out 值式消费 + --yes 独立", () => {
-		expect(parseKeygenArgs(["--id", "acme.market", "--out", "./k", "--yes"]))
-			.toEqual({ id: "acme.market", out: "./k", yes: true });
-	});
+describe("ojm keygen key_id 命名空间（C2-37）", () => {
 	it("isValidKeyId：<publisher>.<id> 合法 / 裸名·大写·空非法", () => {
 		expect(isValidKeyId("acme.market")).toBe(true);
 		expect(isValidKeyId("acme.dev.key-1")).toBe(true);
@@ -63,13 +59,6 @@ describe("ojm keygen 命令体（Ed25519 落盘 + 私钥红线）", () => {
 	});
 });
 
-describe("ojm sign 参数解析", () => {
-	it("parseSignArgs：位置参数 + --id/--key 值式消费 + --check 独立", () => {
-		expect(parseSignArgs(["pkg.tgz", "--id", "acme.market", "--key", "k.pem", "--check"]))
-			.toEqual({ positionals: ["pkg.tgz"], id: "acme.market", key: "k.pem", check: true });
-	});
-});
-
 describe("ojm sign 命令体（detached .sig，G4 载体）", () => {
 	const TGZ = path.join(tmp, "demo-solution-0.1.0.tgz");
 

package/src/lifecycle/__tests__/bundle.test.ts

@@ -2,8 +2,8 @@
 // 组装契约（对齐 tgz 内布局，契约 §2.9 + P1-9 staging copy 源定版）：
 //   <root>/solution.yaml | manifest.yaml           ← 必填（solution.yaml 优先，避开 oj 的 api 枚举冲突），契约校验 fail-fast 先于打包
 //   <root>/src/<模块>/solution.yaml | manifest.yaml ← 模块级方案：契约与所打包模块同位（同优先级回退）
-//   api/dist/<name>-<version>/                    ← oj build 产物原样 → tgz 内 api/<name>-<version>/（C2-31 分层核对）
-//   web/dist/modules/<name>/                      ← 站点构建模块产物 → tgz 内 web/modules/<name>/（只入包方案自己的模块）
+//   dist/api/<name>-<version>/                    ← oj build 产物原样 → tgz 内 api/<name>-<version>/（C2-31 分层核对）
+//   dist/web/modules/<name>/                      ← 站点构建模块产物 → tgz 内 web/modules/<name>/（只入包方案自己的模块）
 // 禁携 modules.json（C2-31 红线）；产物确定性（C2-32）由 deterministic-tar 承担，此处断言端到端复现。
 import { execFileSync } from "node:child_process";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
@@ -32,18 +32,18 @@ afterEach(() => {
 	rmSync(out, { recursive: true, force: true });
 });
 
-/** 预置「已构建」产物：oj build（api/dist/<name>-<version>/）与站点构建（web/dist/modules/） */
+/** 预置「已构建」产物：oj build（dist/api/<name>-<version>/）与站点构建（dist/web/modules/） */
 function makePrebuiltArtifacts(): void {
 	// oj build 产物（模块级 manifest 仅 oj 原生七键；name/version 与 bundle 级逐一相等，C2-31）
-	const apiDist = join(project, "api/dist/demo-solution-0.1.0");
+	const apiDist = join(project, "dist/api/demo-solution-0.1.0");
 	mkdirSync(join(apiDist, "ping"), { recursive: true });
 	mkdirSync(join(apiDist, "migrations"), { recursive: true });
 	writeFileSync(join(apiDist, "manifest.yaml"), "name: demo-solution\ndesc: manifest.yaml 契约全字段合法夹具\nversion: 0.1.0\ntables:\n  - note\n");
 	writeFileSync(join(apiDist, "schema.yaml"), "tables:\n  note: {}\n");
 	writeFileSync(join(apiDist, "routes.js"), "export {};\n");
 	writeFileSync(join(apiDist, "ping/api.js"), "export async function ping() {}\n");
-	// 站点构建产物（web/dist/modules/<name>/<version>/entry.js + css，对应 web.entry/css 声明）
-	const webDist = join(project, "web/dist/modules/demo-solution/0.1.0");
+	// 站点构建产物（dist/web/modules/<name>/<version>/entry.js + css，对应 web.entry/css 声明）
+	const webDist = join(project, "dist/web/modules/demo-solution/0.1.0");
 	mkdirSync(webDist, { recursive: true });
 	writeFileSync(join(webDist, "entry.js"), "export default {};\n");
 	writeFileSync(join(webDist, "demo-solution.css"), ".demo{}\n");
@@ -64,7 +64,7 @@ function addWebSolution(name: string, version = "0.1.0"): void {
 		`  entry: modules/${name}/${version}/entry.js`,
 		"",
 	].join("\n"));
-	const webDist = join(project, "web/dist/modules", name, version);
+	const webDist = join(project, "dist/web/modules", name, version);
 	mkdirSync(webDist, { recursive: true });
 	writeFileSync(join(webDist, "entry.js"), "export default {};\n");
 }
@@ -85,7 +85,7 @@ describe("buildBundle · 正路径", () => {
 
 	it("只入包方案自己的前端模块：模板模块（home/login…）不随包", async () => {
 		// 安装器 deployWeb 把包内 web/modules 整树覆盖进目标站，模板产物随包会覆盖宿主同名前端
-		const hostWeb = join(project, "web/dist/modules/home/0.1.0");
+		const hostWeb = join(project, "dist/web/modules/home/0.1.0");
 		mkdirSync(hostWeb, { recursive: true });
 		writeFileSync(join(hostWeb, "entry.js"), "export default {};\n");
 		const names = tarList((await pack()).tgz);
@@ -149,18 +149,18 @@ describe("buildBundle · 正路径", () => {
 	});
 
 	it("产物树混入 modules.json → 打包自检拒绝（C2-31 红线）", async () => {
-		writeFileSync(join(project, "web/dist/modules/demo-solution/0.1.0/modules.json"), "[]");
+		writeFileSync(join(project, "dist/web/modules/demo-solution/0.1.0/modules.json"), "[]");
 		await expect(pack()).rejects.toThrow(/modules\.json/);
 	});
 
 	it("私钥/凭证混入包树 → 打包自检拒绝（P2-4 入包红线：*.pem/*.key/.env(.local…)/id_ed25519/id_rsa/*.p12/*.pfx）", async () => {
-		writeFileSync(join(project, "api/dist/demo-solution-0.1.0/signing.pem"), "-----BEGIN PRIVATE KEY-----\n");
+		writeFileSync(join(project, "dist/api/demo-solution-0.1.0/signing.pem"), "-----BEGIN PRIVATE KEY-----\n");
 		await expect(pack()).rejects.toThrow(/私钥\/凭证/);
-		rmSync(join(project, "api/dist/demo-solution-0.1.0/signing.pem"));
-		writeFileSync(join(project, "web/dist/modules/demo-solution/0.1.0/.env"), "SECRET=1\n");
+		rmSync(join(project, "dist/api/demo-solution-0.1.0/signing.pem"));
+		writeFileSync(join(project, "dist/web/modules/demo-solution/0.1.0/.env"), "SECRET=1\n");
 		await expect(pack()).rejects.toThrow(/私钥\/凭证/);
-		rmSync(join(project, "web/dist/modules/demo-solution/0.1.0/.env"));
-		writeFileSync(join(project, "web/dist/modules/demo-solution/0.1.0/.env.production"), "SECRET=1\n");
+		rmSync(join(project, "dist/web/modules/demo-solution/0.1.0/.env"));
+		writeFileSync(join(project, "dist/web/modules/demo-solution/0.1.0/.env.production"), "SECRET=1\n");
 		await expect(pack()).rejects.toThrow(/私钥\/凭证/);
 	});
 });
@@ -218,7 +218,7 @@ describe("buildBundle · 多方案与内置排除（B3/B7/B8/B9/B10/B12）", ()
 		const dir = join(project, "src", "crm");
 		mkdirSync(dir, { recursive: true });
 		writeFileSync(join(dir, "manifest.yaml"), "name: crm\nversion: 0.1.0\nsummary: x\nchangelog: x\nweb:\n  entry: modules/crm/0.1.0/entry.js\n");
-		const webDist = join(project, "web/dist/modules/crm/0.1.0");
+		const webDist = join(project, "dist/web/modules/crm/0.1.0");
 		mkdirSync(webDist, { recursive: true });
 		writeFileSync(join(webDist, "entry.js"), "export default {};\n");
 		const results = await buildBundle(project, { out });
@@ -275,23 +275,23 @@ describe("buildBundle · 校验先于打包（fail-fast）", () => {
 	});
 
 	it("c2-31 分层核对：模块级 desc ≠ bundle summary → 放行（等值要求已移除）", async () => {
-		writeFileSync(join(project, "api/dist/demo-solution-0.1.0/manifest.yaml"), "name: demo-solution\ndesc: 不一致描述\nversion: 0.1.0\n");
+		writeFileSync(join(project, "dist/api/demo-solution-0.1.0/manifest.yaml"), "name: demo-solution\ndesc: 不一致描述\nversion: 0.1.0\n");
 		await expect(pack()).resolves.toMatchObject({ name: "demo-solution" });
 	});
 
-	it("c2-31 分层核对：api/dist 缺 <name>-<version>/ → 可读报错指明期望产物路径", async () => {
-		rmSync(join(project, "api/dist"), { recursive: true, force: true });
-		await expect(pack()).rejects.toThrow(/api\/dist\/demo-solution-0\.1\.0/);
+	it("c2-31 分层核对：dist/api 缺 <name>-<version>/ → 可读报错指明期望产物路径", async () => {
+		rmSync(join(project, "dist/api"), { recursive: true, force: true });
+		await expect(pack()).rejects.toThrow(/dist\/api\/demo-solution-0\.1\.0/);
 	});
 
 	it("web 段存在但站点产物缺失 → 可读报错指引先构建", async () => {
-		rmSync(join(project, "web/dist"), { recursive: true, force: true });
-		await expect(pack()).rejects.toThrow(/web\/dist\/modules/);
+		rmSync(join(project, "dist/web"), { recursive: true, force: true });
+		await expect(pack()).rejects.toThrow(/dist\/web\/modules/);
 	});
 
-	it("web/dist/modules 在但缺本方案目录 → 可读报错（不整树入包）", async () => {
-		rmSync(join(project, "web/dist/modules/demo-solution"), { recursive: true, force: true });
-		await expect(pack()).rejects.toThrow(/web\/dist\/modules\/demo-solution\//);
+	it("dist/web/modules 在但缺本方案目录 → 可读报错（不整树入包）", async () => {
+		rmSync(join(project, "dist/web/modules/demo-solution"), { recursive: true, force: true });
+		await expect(pack()).rejects.toThrow(/dist\/web\/modules\/demo-solution\//);
 	});
 
 	it("c2-12a：api.tables 与 schema.yaml 表集不一致 → 构建期拒绝", async () => {

package/src/lifecycle/__tests__/install.test.ts

@@ -6,7 +6,6 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { parseLifecycleArgs } from "../../args";
 import { setEnabledCommand } from "../../enable";
 import { installCommand, parseTarget, renderOutcome } from "../../install";
 import { pollTask, resolveSite } from "../../site";
@@ -61,28 +60,6 @@ afterEach(() => {
 	vi.restoreAllMocks();
 });
 
-describe("parseLifecycleArgs · 参数解析", () => {
-	it("位置参数与值式 flag 分离：--url 等的值不被误当位置参数（P6 同款坑）", () => {
-		const a = parseLifecycleArgs(["demo-solution@0.1.0", "--url", "http://x:1", "--user", "u", "--pass", "p", "--locale", "en-US"]);
-		expect(a.positionals).toEqual(["demo-solution@0.1.0"]);
-		expect(a.url).toBe("http://x:1");
-		expect(a.user).toBe("u");
-		expect(a.pass).toBe("p");
-		expect(a.locale).toBe("en-US");
-	});
-
-	it("install 专属 --name/--version 覆盖位", () => {
-		const a = parseLifecycleArgs(["./a.tgz", "--name", "demo-solution", "--version", "0.2.0"]);
-		expect(a.positionals).toEqual(["./a.tgz"]);
-		expect(a.name).toBe("demo-solution");
-		expect(a.version).toBe("0.2.0");
-	});
-
-	it("未知 --flag 忽略不炸", () => {
-		expect(parseLifecycleArgs(["x", "--future"]).positionals).toEqual(["x"]);
-	});
-});
-
 describe("resolveSite · 站点寻址（flag > 环境变量 > 缺省模板 serve 端口 9778）", () => {
 	const ENV_BACKUP = { ...process.env };
 

package/src/lifecycle/__tests__/new.test.ts

@@ -29,7 +29,7 @@ function makeModuleRootProject(builtin = true): void {
 
 /** 给已生成的方案补站点产物，模拟「ojm build 之后」的打包前置 */
 function addWebArtifacts(name: string, version = "0.1.0"): void {
-	const webDist = join(project, "web/dist/modules", name, version);
+	const webDist = join(project, "dist/web/modules", name, version);
 	mkdirSync(webDist, { recursive: true });
 	writeFileSync(join(webDist, "entry.js"), "export default {};\n");
 }

package/src/lifecycle/__tests__/smoke.test.ts

@@ -34,7 +34,7 @@ afterEach(() => {
 describe.skipIf(!smokeReady)("真机冒烟（需 OJM_SMOKE_URL/OJM_SMOKE_USER/OJM_SMOKE_PASS）", () => {
 	it("file 源安装 fixture-valid 包 → 终态 done", { timeout: 600_000 }, async () => {
 		// 先出可安装 tgz（同 bundle.test.ts：预置已构建产物再 --bundle 组装）
-		const apiDist = join(project, "api/dist/demo-solution-0.1.0");
+		const apiDist = join(project, "dist/api/demo-solution-0.1.0");
 		const { mkdirSync, writeFileSync } = await import("node:fs");
 		mkdirSync(join(apiDist, "ping"), { recursive: true });
 		// 迁移 SQL 随夹具 src 真源（0001__init.sql 建 note 表）；B-11 硬验收：appliedSeq > 0 可断言
@@ -45,7 +45,7 @@ describe.skipIf(!smokeReady)("真机冒烟（需 OJM_SMOKE_URL/OJM_SMOKE_USER/OJ
 		cpSync(join(FIXTURE_VALID, "api/src/demo-solution/schema.yaml"), join(apiDist, "schema.yaml"));
 		writeFileSync(join(apiDist, "routes.js"), "export {};\n");
 		writeFileSync(join(apiDist, "ping/api.js"), "export async function ping() {}\n");
-		const webDist = join(project, "web/dist/modules/demo-solution/0.1.0");
+		const webDist = join(project, "dist/web/modules/demo-solution/0.1.0");
 		mkdirSync(webDist, { recursive: true });
 		writeFileSync(join(webDist, "entry.js"), "export default {};\n");
 		writeFileSync(join(webDist, "demo-solution.css"), ".demo{}\n");

package/src/market/__tests__/bootstrap.test.ts

@@ -100,6 +100,30 @@ describe("given 一个装了 oj 二进制的源工程 When 自举隔离站点",
 		await site.cleanup();
 	});
 
+	it("then 起站 api 路径 = 构建产物实际位置 <root>/dist/api（module-root；旧写死 api/dist 起站即挂）", async () => {
+		const src = newSourceProject();
+		const { started, starter } = fakeStarter();
+
+		const site = await bootstrapIsolatedSite({ projectRoot: src, starter });
+
+		// starter 第三参是 oj serve 的 --api-path：必须与 buildBackend 产物落点同源
+		// （layout.ts module-root 口径 apiDist = <root>/dist/api；写死 api/dist 会在
+		// mounts 校验报 No such file or directory，2026-10-23 演练实踩）
+		expect(started[0]?.apiSrc).toBe(join(site.root, "dist", "api"));
+		await site.cleanup();
+	});
+
+	it("then 种子管理员 = superadmin（seed 账号名=角色名口径；admin 已被解绑，用它会 403）", async () => {
+		const src = newSourceProject();
+		const { starter } = fakeStarter();
+
+		const site = await bootstrapIsolatedSite({ projectRoot: src, starter });
+
+		expect(site.admin.user).toBe("superadmin");
+		expect(site.admin.pass).toBe("123456");
+		await site.cleanup();
+	});
+
 	it("then CDN 目录在临时根内且已落好 fixture 包与索引", async () => {
 		const src = newSourceProject();
 		const { starter } = fakeStarter();

package/src/market/__tests__/setup.test.ts

@@ -8,7 +8,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { describe, expect, it } from "vitest";
 
-import { setupMarketUrl } from "../setup";
+import { loginPasswordAfterSetup, setupMarketUrl } from "../setup";
 
 const MOUNTS = "  - prefix: /api\n    api: src\n  - prefix: /cdn\n    web: ../cdn\n";
 const CONFIG = `mounts:\n${MOUNTS}server:\n  host: 127.0.0.1\n  port: 9778\n`;
@@ -112,3 +112,10 @@ describe("given 改密后写设置仍被拒 When setup", () => {
 			.toThrow(/must_change|权限|设置/);
 	});
 });
+
+describe("given setup 返回 changedPassword When 选 setup 后的登录口令", () => {
+	it("then 改密已发生用 newPass，未改密用原种子口令（must_change=0 是当前 seed 常态）", () => {
+		expect(loginPasswordAfterSetup({ siteUrl: "", cdnBaseUrl: "", changedPassword: true }, "new-pass", "123456")).toBe("new-pass");
+		expect(loginPasswordAfterSetup({ siteUrl: "", cdnBaseUrl: "", changedPassword: false }, "new-pass", "123456")).toBe("123456");
+	});
+});