@oj-module/cli 0.2.42 → 0.2.45

package/shell-dist/assets/runtime.js

@@ -304,10 +304,10 @@ function getAppInfo() {
 	return {
 		"pkg": {
 			"name": "@oj-module/runtime",
-			"version": "0.2.42",
+			"version": "0.2.45",
 			"license": "MIT"
 		},
-		"lastBuildTime": "2026-10-26 10:15:05"
+		"lastBuildTime": "2026-10-31 01:51:27"
 	};
 }
 var init_get_app_info = __esmMin((() => {}));
@@ -7520,44 +7520,25 @@ async function loadAll(manifest) {
 		const peerRuntime = definition.peerRuntime ?? entry.peerRuntime;
 		if (manifest.runtimeVersion && peerRuntime && !satisfiesSemver(manifest.runtimeVersion, peerRuntime)) {
 			console.error(`[module-loader] 模块 "${entry.name}" 与宿主 runtime 版本不兼容：期望 ${peerRuntime}，实际 ${manifest.runtimeVersion}。已跳过加载。修复建议：升级宿主 runtime 或按兼容范围重新构建该模块（US-5）。`);
-			modules.set(entry.name, {
-				definition,
-				routePrefix: entry.routePrefix ?? rootSegmentOf(definition.routes) ?? entry.name,
-				status: "error",
-				error: /* @__PURE__ */ new Error(`模块 "${entry.name}" peerRuntime 不兼容：期望 ${peerRuntime}，实际 ${manifest.runtimeVersion}`)
-			});
+			modules.set(entry.name, buildInstance(entry, definition, "error", /* @__PURE__ */ new Error(`模块 "${entry.name}" peerRuntime 不兼容：期望 ${peerRuntime}，实际 ${manifest.runtimeVersion}`)));
 			continue;
 		}
 		definitions.set(entry.name, definition);
 		validEntries.push(entry);
-		modules.set(entry.name, {
-			definition,
-			routePrefix: entry.routePrefix ?? rootSegmentOf(definition.routes) ?? entry.name,
-			status: "loaded"
-		});
-	} else modules.set(entry.name, {
-		definition: {
-			name: entry.name,
-			description: "",
-			version: "0.0.0",
-			routes: []
-		},
-		routePrefix: entry.routePrefix ?? entry.name,
-		status: "error",
-		error: /* @__PURE__ */ new Error("Failed to load module entry")
-	});
+		modules.set(entry.name, buildInstance(entry, definition, "loaded"));
+	} else modules.set(entry.name, buildInstance(entry, {
+		name: entry.name,
+		description: "",
+		version: "0.0.0",
+		routes: []
+	}, "error", /* @__PURE__ */ new Error("Failed to load module entry")));
 	for (let i = validEntries.length - 1; i >= 0; i--) {
 		const entry = validEntries[i];
 		const definition = definitions.get(entry.name);
 		const missing = (definition.config?.dependencies ?? entry.dependencies ?? []).filter((dep) => !definitions.has(dep));
 		if (missing.length > 0) {
 			console.error(`[module-loader] 模块 "${entry.name}" 依赖缺失：${missing.join(", ")} 未加载。已跳过该模块（不执行生命周期、不注册路由）。修复建议：先部署依赖模块，或在清单中移除该依赖（US-9）。`);
-			modules.set(entry.name, {
-				definition,
-				routePrefix: entry.routePrefix ?? rootSegmentOf(definition.routes) ?? entry.name,
-				status: "missing-deps",
-				error: /* @__PURE__ */ new Error(`模块 "${entry.name}" 依赖缺失：${missing.join(", ")}`)
-			});
+			modules.set(entry.name, buildInstance(entry, definition, "missing-deps", /* @__PURE__ */ new Error(`模块 "${entry.name}" 依赖缺失：${missing.join(", ")}`)));
 			validEntries.splice(i, 1);
 			definitions.delete(entry.name);
 		}
@@ -7565,19 +7546,14 @@ async function loadAll(manifest) {
 	const sortedEntries = topologicalSort(validEntries, definitions);
 	for (const entry of sortedEntries) {
 		const definition = definitions.get(entry.name);
-		const ctx = createModuleContext(definition, entry.routePrefix ?? rootSegmentOf(definition.routes) ?? entry.name);
+		const ctx = createModuleContext(definition, modules.get(entry.name).routePrefix);
 		try {
 			if (definition.lifecycle?.beforeInit) await definition.lifecycle.beforeInit(ctx);
 			if (definition.lifecycle?.onInit) await definition.lifecycle.onInit(ctx);
 			await mergeI18nResources(definition);
 		} catch (error) {
 			console.error(`[module-loader] Lifecycle error for "${entry.name}":`, error);
-			modules.set(entry.name, {
-				definition,
-				routePrefix: entry.routePrefix ?? rootSegmentOf(definition.routes) ?? entry.name,
-				status: "error",
-				error: error instanceof Error ? error : new Error(String(error))
-			});
+			modules.set(entry.name, buildInstance(entry, definition, "error", error instanceof Error ? error : new Error(String(error))));
 		}
 	}
 	/**
@@ -7633,6 +7609,8 @@ function tagModuleRoutes(routes, name) {
 * 顶层路由 path 的首段替换为 prefix；children 为相对路径不变。
 * 保持原 path 的「前导斜杠」风格：相对 `wiki` → `kb`、绝对 `/wiki` → `/kb`，
 * 因此缺省 prefix = name 时路径字段逐字节不变（零漂移），仅段值一致。
+* 注意：多根模块（需求一）不走此改写——「首段替换」会把多个根一起覆盖成同一个 prefix
+* 而坍缩碰撞；多根由 getHostRoutes 另按「相对根命名空间化、绝对根原样」处理。
 */
 function applyRoutePrefix(routes, prefix) {
 	return routes.map((route) => {
@@ -7657,6 +7635,58 @@ function rootSegmentOf(routes) {
 	if (typeof p !== "string" || p.length === 0) return void 0;
 	return p.replace(/^\/?/, "").split("/")[0] || void 0;
 }
+/**
+* 多根模块（需求一）的相对根改写：把相对声明的根挂到 `routePrefix` 命名空间下，
+* 绝对路径原样保留（「顶层绝对即权威」口径，与 addRouteIdByPath 一致）。
+*
+* 为什么多根不能直接吃 `applyRoutePrefix`：那条改写是「首段替换」，多根下会把
+* `/crm` 与 `/wiki` 两个根一起改成同一个首段而坍缩碰撞——故多根必须另走这条路。
+*
+* 为什么相对根必须改写：一个多根模块声明 `[crm, wiki]`（相对）时，若不挂命名空间，
+* 两个根会直接落到站点根 `/crm`、`/wiki`——既可能撞宿主自有路由，也会与另一个同样
+* 相对声明的多根模块抢同一条路径（后者静默覆盖前者，菜单与路由表都看不出异常）。
+*/
+function namespaceRelativeRoots(routes, prefix) {
+	const ns = prefix.replace(/^\/+|\/+$/g, "");
+	if (!ns) return routes;
+	return routes.map((route) => {
+		const p = typeof route.path === "string" ? route.path : "";
+		if (!p || p.startsWith("/")) return route;
+		return {
+			...route,
+			path: `${ns}/${p}`
+		};
+	});
+}
+/**
+* 是否多根模块：顶层路由的「首段」去重后 > 1 即多根。
+* 空数组 / 单根（含单根+多子页）/ 多条同首段 → false。
+* 多根模块下各根按 entry.ts 原始路径独立注册为一级菜单，routePrefix 仅作命名空间。
+*/
+function isMultiRoot(routes) {
+	const segments = /* @__PURE__ */ new Set();
+	for (const r of routes) {
+		const seg = (typeof r.path === "string" ? r.path : "").replace(/^\/?/, "").split("/")[0];
+		if (seg) segments.add(seg);
+	}
+	return segments.size > 1;
+}
+/**
+* 构造模块实例（统一 routePrefix / multiRoot 计算，消除 loadAll 内散落的重复口径）。
+* 多根：routePrefix 回落 entry.name（命名空间，不用于路径改写）；
+* 单根：保持 rootSegmentOf 回落（零漂移不变）。
+*/
+function buildInstance(entry, definition, status, error) {
+	const routes = definition.routes ?? [];
+	const multiRoot = isMultiRoot(routes);
+	return {
+		definition,
+		routePrefix: entry.routePrefix ?? (multiRoot ? entry.name : rootSegmentOf(routes) ?? entry.name),
+		multiRoot,
+		status,
+		error
+	};
+}
 function getRoutes() {
 	const { roles, permissions = [] } = useUserStore.getState();
 	const routes = [];
@@ -7682,7 +7712,9 @@ function getHostRoutes() {
 	return rewriteAdminPaths(getRoutes().map((route) => {
 		const mod = route.handle?.module;
 		if (!mod) return route;
-		const prefix = modules.get(mod)?.routePrefix ?? mod;
+		const instance = modules.get(mod);
+		if (instance?.multiRoot) return namespaceRelativeRoots([route], instance.routePrefix)[0] ?? route;
+		const prefix = instance?.routePrefix ?? mod;
 		return applyRoutePrefix([route], prefix)[0] ?? route;
 	}));
 }
@@ -8942,6 +8974,33 @@ var init_auth = __esmMin((() => {
 	}), { name: getAppNamespace("access-token") }));
 }));
 //#endregion
+//#region src/store/tenant.ts
+/**
+* 启动时把 `?tenant=` 落到 store（URL 优先于持久化值）。
+* 返回最终生效的租户，供调用方打日志/透传。
+*/
+function bootstrapTenant() {
+	const fromUrl = new URLSearchParams(window.location.search).get(TENANT_QUERY_PARAM)?.trim();
+	if (fromUrl) useTenantStore.getState().setTenant(fromUrl);
+	return useTenantStore.getState().tenant;
+}
+/** 当前应携带的租户（请求层唯一取值口；空值回落部署默认，绝不发空头） */
+function currentTenant() {
+	return useTenantStore.getState().tenant || "default";
+}
+var DEFAULT_TENANT, TENANT_QUERY_PARAM, TENANT_HEADER, useTenantStore;
+var init_tenant = __esmMin((() => {
+	DEFAULT_TENANT = "default";
+	TENANT_QUERY_PARAM = "tenant";
+	TENANT_HEADER = "X-TENANT-ID";
+	useTenantStore = create()(persist((set) => ({
+		tenant: DEFAULT_TENANT,
+		setTenant: (tenant) => set({ tenant: tenant.trim() || "default" }),
+		clear: () => set({ tenant: DEFAULT_TENANT })
+	}), { name: "oj-tenant" }));
+	if (typeof window !== "undefined") bootstrapTenant();
+}));
+//#endregion
 //#region src/utils/api-base.ts
 /** 归一为不以 `/` 结尾；绝对域（http(s)://）原样剥尾斜杠；空值回落默认 */
 function normalizeApiBase(raw) {
@@ -9201,6 +9260,7 @@ var init_request = __esmMin((() => {
 	init_auth();
 	init_header_provider();
 	init_preferences$3();
+	init_tenant();
 	init_api_base();
 	init_constants$3();
 	init_error_response();
@@ -9221,6 +9281,7 @@ var init_request = __esmMin((() => {
 					setHeaderSafe(request.headers, AUTH_HEADER, `Bearer ${token}`);
 				}
 				setHeaderSafe(request.headers, LANG_HEADER, usePreferencesStore.getState().language);
+				setHeaderSafe(request.headers, TENANT_HEADER, currentTenant());
 				const headerProvider = currentHeaderProvider();
 				if (headerProvider) for (const [name, value] of Object.entries(headerProvider())) setHeaderSafe(request.headers, name, value);
 			}],
@@ -28193,7 +28254,9 @@ init_slots();
 init_access();
 init_auth();
 init_tabs();
+init_tenant();
 init_user();
+init_api_base();
 init_get_app_info();
 init_get_redirect_path();
 init_request();
@@ -28204,4 +28267,4 @@ init_ri();
 init_menu_icons();
 init_tree();
 //#endregion
-export { AccessControl, AccessControlRoles, AntdApp, BasicButton, BasicContent, BasicTable, EmbeddedIcon, ErrorBoundary, ExternalIcon, FormAvatarItem, FormTreeItem, Iframe, LayoutCenterIcon, LayoutEffects, LayoutLeftIcon, LayoutRightIcon, MixedNavigationIcon, OutsidePageIcon, PageError, ProfileCardIcon, RiAccountCircleLine, RiContrastFill, RiFullscreenExitLine, RiFullscreenLine, RiMailCheckLine, RiMoonIcon, RiReactjsLine, RiSunIcon, RiUserSettingsLine, ServerErrorIcon, SideNavigationIcon, TopNavigationIcon, TwoColumnNavigationIcon, accessControlCodes, bindingDiff, canAssignRole, canDeleteRole, canEditRoleBindings, defineModule, fetchAddMenuItem, fetchAddRoleItem, fetchAsyncRoutes, fetchChangePassword, fetchDeleteMenuItem, fetchDeleteRoleItem, fetchLdapLogin, fetchLogin, fetchLoginMethods, fetchLogout, fetchMenuByRoleId, fetchMenuList, fetchRbacAdminResetPassword, fetchRbacContactDetail, fetchRbacContacts, fetchRbacCreateRole, fetchRbacCreateUser, fetchRbacDeleteRole, fetchRbacOplog, fetchRbacOplogPost, fetchRbacPermissionList, fetchRbacRoleList, fetchRbacSetForbidden, fetchRbacSettings, fetchRbacUpdateBindings, fetchRbacUpdateSetting, fetchRbacUpdateUserRoles, fetchRbacUserList, fetchRefreshToken, fetchRoleList, fetchRoleMenu, fetchSolutionRoutes, fetchUpdateMenuItem, fetchUpdateRoleItem, fetchUserInfo, filterTree, getAllExpandedKeys, getAppInfo, getBooleanOptions, getHostRoutes, getModule, getModuleRoutePrefix, getModules, getRedirectPath, getRegisteredApiPrefix, getRegisteredStore, getRoutes, getYesNoOptions, groupByModule, groupSettingsByModule, handleTree, loadAll, mapTree, menuIcons, notify, permissionPrefix, request, resolveSiteBase, roleLabel, setupI18n, traverseTreeValues, unloadModule, useAccess, useAccessStore, useAuthStore, usePreferences, useSlotNodes, useSolutionRoutes, useTabKey, useTabsStore, useUserStore, withSiteBase, external_exports as z };
+export { AccessControl, AccessControlRoles, AntdApp, BasicButton, BasicContent, BasicTable, DEFAULT_TENANT, EmbeddedIcon, ErrorBoundary, ExternalIcon, FormAvatarItem, FormTreeItem, Iframe, LayoutCenterIcon, LayoutEffects, LayoutLeftIcon, LayoutRightIcon, MixedNavigationIcon, OutsidePageIcon, PageError, ProfileCardIcon, RiAccountCircleLine, RiContrastFill, RiFullscreenExitLine, RiFullscreenLine, RiMailCheckLine, RiMoonIcon, RiReactjsLine, RiSunIcon, RiUserSettingsLine, ServerErrorIcon, SideNavigationIcon, TENANT_HEADER, TENANT_QUERY_PARAM, TopNavigationIcon, TwoColumnNavigationIcon, accessControlCodes, bindingDiff, bootstrapTenant, canAssignRole, canDeleteRole, canEditRoleBindings, currentTenant, defineModule, fetchAddMenuItem, fetchAddRoleItem, fetchAsyncRoutes, fetchChangePassword, fetchDeleteMenuItem, fetchDeleteRoleItem, fetchLdapLogin, fetchLogin, fetchLoginMethods, fetchLogout, fetchMenuByRoleId, fetchMenuList, fetchRbacAdminResetPassword, fetchRbacContactDetail, fetchRbacContacts, fetchRbacCreateRole, fetchRbacCreateUser, fetchRbacDeleteRole, fetchRbacOplog, fetchRbacOplogPost, fetchRbacPermissionList, fetchRbacRoleList, fetchRbacSetForbidden, fetchRbacSettings, fetchRbacUpdateBindings, fetchRbacUpdateSetting, fetchRbacUpdateUserRoles, fetchRbacUserList, fetchRefreshToken, fetchRoleList, fetchRoleMenu, fetchSolutionRoutes, fetchUpdateMenuItem, fetchUpdateRoleItem, fetchUserInfo, filterTree, getAllExpandedKeys, getAppInfo, getBooleanOptions, getHostRoutes, getModule, getModuleRoutePrefix, getModules, getRedirectPath, getRegisteredApiPrefix, getRegisteredStore, getRoutes, getYesNoOptions, groupByModule, groupSettingsByModule, handleTree, loadAll, mapTree, menuIcons, notify, permissionPrefix, request, resolveApiBase, resolveSiteBase, roleLabel, setupI18n, traverseTreeValues, unloadModule, useAccess, useAccessStore, useAuthStore, usePreferences, useSlotNodes, useSolutionRoutes, useTabKey, useTabsStore, useTenantStore, useUserStore, withSiteBase, external_exports as z };

package/shell-dist/index.html

@@ -5,9 +5,9 @@
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 		<link rel="icon" href="/favicon.ico" />
 		<title>React Antd Admin · Shell</title>
-		<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self' https://modules.cdn.example.com 'wasm-unsafe-eval' 'nonce-2Xr8lEfbU8h45hDFonkWmg=='; script-src-attr 'none'; connect-src 'self' data: https://modules.cdn.example.com; style-src 'self' https://modules.cdn.example.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; frame-src https://ant.design https://react.dev https://condorheroblog.github.io; form-action 'none'; base-uri 'none'; object-src 'none'; upgrade-insecure-requests" />
+		<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self' https://modules.cdn.example.com 'wasm-unsafe-eval' 'nonce-IiFAOepBufxbhXdsYRrEMA=='; script-src-attr 'none'; connect-src 'self' data: https://modules.cdn.example.com; style-src 'self' https://modules.cdn.example.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; frame-src https://ant.design https://react.dev https://condorheroblog.github.io; form-action 'none'; base-uri 'none'; object-src 'none'; upgrade-insecure-requests" />
 
-		<script type="importmap" nonce="2Xr8lEfbU8h45hDFonkWmg==">{
+		<script type="importmap" nonce="IiFAOepBufxbhXdsYRrEMA==">{
   "imports": {
     "react": "/assets/react.js",
     "react/jsx-runtime": "/assets/jsx-runtime.js",

package/shell-dist/versions.json

@@ -7,9 +7,9 @@
   "react-router": "7.18.2",
   "react-router/dom": "7.18.2",
   "@tanstack/react-query": "5.102.8",
-  "@oj-module/runtime": "0.2.42",
-  "@oj-module/runtime/contract": "0.2.42",
-  "@oj-module/runtime/contract/errors": "0.2.42",
+  "@oj-module/runtime": "0.2.45",
+  "@oj-module/runtime/contract": "0.2.45",
+  "@oj-module/runtime/contract/errors": "0.2.45",
   "@plane/kit": "0.1.20",
   "@plane/editor": "0.1.20",
   "antd": "6.6.1",

package/src/__tests__/manifest-routes-derive.test.ts

@@ -55,6 +55,28 @@ describe("deriveManifestRoutes（entry.ts → manifest routes）", () => {
 		expect(deriveManifestRoutes(def(undefined))).toEqual([]);
 		expect(deriveManifestRoutes(def([]))).toEqual([]);
 	});
+
+	it("d-4 多根树：每个顶层 category 根各自派生为独立 manifest route（需求一·多根）", () => {
+		// 模块 routes 数组 length>1：/crm 与 /wiki 为两个一级菜单根，各自带 children
+		const d = def([
+			{
+				path: "/crm",
+				handle: { category: "main", order: 200, title: "acme:menu.crm" },
+				children: [{ path: "/crm/customers", handle: { title: "acme:menu.customers" } }],
+			},
+			{
+				path: "/wiki",
+				handle: { category: "main", order: 210, title: "acme:menu.wiki" },
+				children: [{ path: "/wiki/pages", handle: { title: "acme:menu.pages" } }],
+			},
+		]);
+		const out = deriveManifestRoutes(d);
+		// 仅取顶层一级菜单根（children 不进 manifest），两棵根都保留、互不坍缩
+		expect(out).toEqual([
+			{ path: "/crm", category: "main", order: 200, title_key: "acme:menu.crm" },
+			{ path: "/wiki", category: "main", order: 210, title_key: "acme:menu.wiki" },
+		]);
+	});
 });
 
 describe("reconcileManifestRoutes（entry.ts 为准 + 漂移警告）", () => {

package/src/__tests__/site-tenant-header.test.ts

@@ -0,0 +1,54 @@
+// BDD：CLI 作为站点客户端必须自带租户头（企微代开发多租户，v3 Phase 0）。
+//
+// 宿主 `tenant.enable: true` 后 oj 对每个请求强制要 `X-TENANT-ID`——**登录这类
+// 匿名端点也不放过**，缺即 `400 missing tenant header`。浏览器侧由 runtime 请求层
+// 注入，CLI 是独立进程：2026-10-31 按 playbook 跑 `ojm market walkthrough` 时，
+// 隔离站点刚起服就卡在登录（400 missing tenant header），install/enable/list/
+// market setup/trial 同命运。本用例盯两件事：
+//   ① login（匿名）与 callApi（Bearer）都带 `X-TENANT-ID: default`；
+//   ② GET 无 body 时也不许因为拼头而漏掉 authorization / 误加 content-type。
+import { describe, expect, it } from "vitest";
+import { callApi, DEFAULT_TENANT, login, TENANT_HEADER } from "../site";
+
+interface RecordedRequest {
+	url: string
+	init: RequestInit
+}
+
+/** 记录请求的 fetch stub：返回 oj 信封形态（Response 的最小可用面，见 unwrapEnvelope 形参） */
+function recordingFetch(data: unknown): { fetchFn: typeof fetch, requests: RecordedRequest[] } {
+	const requests: RecordedRequest[] = [];
+	const fetchFn = (async (url: string | URL, init: RequestInit = {}) => {
+		requests.push({ url: String(url), init });
+		return {
+			ok: true,
+			status: 200,
+			text: async () => JSON.stringify({ code: 0, msg: "ok", data }),
+		};
+	}) as typeof fetch;
+	return { fetchFn, requests };
+}
+
+const headers = (r: RecordedRequest): Record<string, string> => r.init.headers as Record<string, string>;
+
+describe("站点客户端租户头（v3 Phase 0）", () => {
+	it("scenario: 登录（无 Bearer）也带租户头——否则服务端 400 missing tenant header", async () => {
+		const { fetchFn, requests } = recordingFetch({ access_token: "tok" });
+
+		const token = await login(fetchFn, "http://x", "u", "p");
+
+		expect(token).toBe("tok");
+		expect(headers(requests[0]!)[TENANT_HEADER]).toBe(DEFAULT_TENANT);
+	});
+
+	it("scenario: 带 Bearer 的 GET / POST 都带租户头，且不干扰原有头", async () => {
+		const { fetchFn, requests } = recordingFetch({ ok: true });
+
+		await callApi<{ ok: boolean }>(fetchFn, "http://x", "tok", "GET", "/api/_platform/market/trust");
+		await callApi<{ ok: boolean }>(fetchFn, "http://x", "tok", "POST", "/api/_platform/market/install", { name: "demo" });
+
+		expect(headers(requests[0]!)).toEqual({ authorization: "Bearer tok", [TENANT_HEADER]: DEFAULT_TENANT });
+		expect(headers(requests[1]!)[TENANT_HEADER]).toBe(DEFAULT_TENANT);
+		expect(headers(requests[1]!)["content-type"]).toBe("application/json");
+	});
+});

package/src/__tests__/templates-tenant-scope.test.ts

@@ -0,0 +1,139 @@
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+import { parse } from "yaml";
+
+/**
+ * BDD：模板工程的租户定性表与 oj 的 `sql_guard` 装配规则一致（企微代开发 v3 Phase 0）。
+ *
+ * oj 在 `tenant.sql_guard != Off` 时对 schema.yaml 声明的每张表强制二选一：
+ *   A 租户表 —— 必须有 `tenant_id` 列（text/integer/bigint），构造器查询自动注入；
+ *   B 共享表 —— schema.yaml `tenant: false` **且** config `tenant.shared_allow` 列出，双声明才豁免。
+ * 两者缺一：serve 启动 / `oj build` / `oj migrate` 三处 fail-fast。
+ *
+ * 本用例把这个隐式约定固化成可跑的断言，防的是两类真实事故：
+ *   1. 新加表忘了定性 → 上线即拒启；
+ *   2. 标了 `tenant: false` 却漏进 shared_allow（或反之）→ 声明被静默忽略，表被当租户表，守卫全拒。
+ */
+
+const templatesRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../../templates");
+
+interface ColumnDecl {
+	type?: string
+	null?: boolean
+	[key: string]: unknown
+}
+
+interface TableDecl {
+	tenant?: boolean
+	pk?: string | string[]
+	columns?: Record<string, ColumnDecl>
+}
+
+const TENANT_COLUMN_TYPES = new Set(["text", "integer", "bigint"]);
+
+function collectSchemaFiles(dir: string, out: string[] = []): string[] {
+	for (const entry of readdirSync(dir)) {
+		const full = join(dir, entry);
+		if (statSync(full).isDirectory())
+			collectSchemaFiles(full, out);
+		else if (entry === "schema.yaml")
+			out.push(full);
+	}
+	return out;
+}
+
+interface Loaded {
+	/** 表名 → 声明（跨模块同名表会撞，oj 侧 S002 拒启，这里同样断言唯一） */
+	tables: Map<string, TableDecl>
+}
+
+function loadSchemaTables(): Loaded {
+	const tables = new Map<string, TableDecl>();
+	for (const file of collectSchemaFiles(join(templatesRoot, "src"))) {
+		const doc = parse(readFileSync(file, "utf-8")) as { tables?: Record<string, TableDecl> } | null;
+		for (const [name, decl] of Object.entries(doc?.tables ?? {})) {
+			if (tables.has(name))
+				throw new Error(`表 ${name} 被两个模块 schema.yaml 重复声明（${file}）`);
+			tables.set(name, decl);
+		}
+	}
+	return { tables };
+}
+
+function loadTenantConfig(): {
+	enable?: boolean
+	sql_guard?: string | boolean
+	shared_allow?: string[]
+	allow_as_tenant?: boolean
+	anonymous_paths?: unknown[]
+} {
+	const doc = parse(readFileSync(join(templatesRoot, "config.yaml"), "utf-8")) as { tenant?: Record<string, unknown> };
+	return (doc.tenant ?? {}) as never;
+}
+
+describe("templates 租户定性（A 租户表 / B 共享表）", () => {
+	it("t-1 config 已开启多租户且守卫为 deny", () => {
+		const tenant = loadTenantConfig();
+		expect(tenant.enable).toBe(true);
+		expect(tenant.sql_guard).toBe("deny");
+		expect(tenant.allow_as_tenant).toBe(true);
+	});
+
+	it("t-2 每张表二选一：有 tenant_id 列，或 tenant:false + shared_allow 双声明", () => {
+		const { tables } = loadSchemaTables();
+		const sharedAllow = new Set(loadTenantConfig().shared_allow ?? []);
+		const violations: string[] = [];
+
+		for (const [name, decl] of tables) {
+			const shared = decl.tenant === false;
+			const tenantColumn = decl.columns?.tenant_id;
+
+			if (shared) {
+				if (!sharedAllow.has(name))
+					violations.push(`${name}: 标了 tenant:false 但不在 config tenant.shared_allow（声明会被忽略）`);
+				if (tenantColumn)
+					violations.push(`${name}: 既标 tenant:false 又声明 tenant_id 列（自相矛盾）`);
+				continue;
+			}
+
+			if (!tenantColumn) {
+				violations.push(`${name}: 无 tenant_id 列且未标 tenant:false（sql_guard 非 Off 时启动即拒）`);
+				continue;
+			}
+			if (!TENANT_COLUMN_TYPES.has(String(tenantColumn.type)))
+				violations.push(`${name}.tenant_id 类型 ${String(tenantColumn.type)} 不合法（只能是 text/integer/bigint）`);
+		}
+
+		expect(violations).toEqual([]);
+	});
+
+	it("t-3 shared_allow 不含未声明的表名（拼写错误会让豁免静默失效）", () => {
+		const { tables } = loadSchemaTables();
+		const unknown = (loadTenantConfig().shared_allow ?? []).filter(name => !tables.has(name));
+		expect(unknown).toEqual([]);
+	});
+
+	it("t-4 24 张表的 A/B 分组与方案 v3 §5.2 一致（新增表须先定性）", () => {
+		const { tables } = loadSchemaTables();
+		const shared = [...tables].filter(([, d]) => d.tenant === false).map(([n]) => n).sort();
+		// Phase 0 落地 21 张（11 A + 10 B）；Phase 1 加企微三表，全部 B 组（D9：查它们时必然还没有租户上下文）
+		expect(tables.size).toBe(24);
+		expect(shared).toEqual([
+			"_oj_migrations",
+			"market_history",
+			"reg_source_seq",
+			"sys_login_throttle",
+			"sys_permission",
+			"sys_rate_window",
+			"sys_role",
+			"sys_role_permission",
+			"sys_setting",
+			"sys_solution_route",
+			"wecom_app_profile",
+			"wecom_login_ticket",
+			"wecom_suite_ticket",
+		]);
+	});
+});

package/src/build.ts

@@ -112,6 +112,13 @@ export const useAuthStore = _fn;
 export const useSolutionRoutes = _fn;
 export const useUserStore = _fn;
 export const useTabsStore = _fn;
+// 租户上下文（L2）：请求头由运行时注入，模块只在登出清理 / URL 带 tenant 参数时读写
+export const useTenantStore = _fn;
+export const currentTenant = () => "default";
+export const bootstrapTenant = () => "default";
+export const DEFAULT_TENANT = "default";
+export const TENANT_HEADER = "X-TENANT-ID";
+export const TENANT_QUERY_PARAM = "tenant";
 // 页签 key 唯一正确取口（keepAlive 下 useLocation 是激活页位置，0.1.21）
 export const useTabKey = _fn;
 // 图标
@@ -148,6 +155,8 @@ export const getRedirectPath = _fn;
 // 站点部署 base（子路径部署）：stub 只需占位，元数据读取期不拼 URL
 export const resolveSiteBase = _fn;
 export const withSiteBase = _fn;
+// API 端点 base（整页跳转的后端端点、上传 action 用它拼 URL，与站点 base 正交）
+export const resolveApiBase = _fn;
 export const getYesNoOptions = _fn;
 export const getBooleanOptions = _fn;
 // 模块契约

package/src/init.ts

@@ -193,7 +193,10 @@ export async function initProject(destDir: string, opts: InitOptions = {}): Prom
 	if (fs.existsSync(path.join(cliDevkit, "SKILL.md"))) {
 		const ojmSkillDir = path.join(destDir, ".claude/skills/ojm-module-dev");
 		fs.mkdirSync(ojmSkillDir, { recursive: true });
-		for (const name of ["SKILL.md", "manual.md", "README.md"])
+		// `wecom-daikaifa.md`（企业微信代开发：凭据清单 + 用户/开发/部署三视角）
+		// 随之分发——它讲的是「怎么把一个已经写好的连接器接上真实套件」，
+		// 业务工程拿到模板后自助完成对接要用，不能只留本仓。
+		for (const name of ["SKILL.md", "manual.md", "README.md", "wecom-daikaifa.md"])
 			copyIfAbsent(path.join(cliDevkit, name), path.join(ojmSkillDir, name), report);
 	}
 	else {

package/src/install.ts

@@ -10,7 +10,7 @@ import path from "node:path";
 import process from "node:process";
 import { UsageError } from "./exit-codes";
 import { originOf, resolveRegistrySource } from "./registry-source";
-import { callApi, isFutureSchema, login, pollTask, resolveSite, TASK_SCHEMA_VERSION_KNOWN, unwrapEnvelope } from "./site";
+import { callApi, isFutureSchema, login, pollTask, resolveSite, TASK_SCHEMA_VERSION_KNOWN, tenantHeaders, unwrapEnvelope } from "./site";
 
 /**
  * REG-R5 / S5-2②：安装目标的**唯一**归一点（grep 可证——全仓只有这一处把 `@scope/name`
@@ -316,7 +316,7 @@ export async function installCommand(target: string, opts: InstallOptions = {}):
 			}
 			const res = await fetchFn(`${base}/api/_platform/market/install`, {
 				method: "POST",
-				headers: { authorization: `Bearer ${token}` },
+				headers: { authorization: `Bearer ${token}`, ...tenantHeaders() },
 				body: form,
 			});
 			response = await unwrapInstall(res);

package/src/market/__tests__/verify.test.ts

@@ -11,13 +11,16 @@ import { Buffer } from "node:buffer";
 import { generateKeyPairSync } from "node:crypto";
 import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 
 import { describe, expect, it } from "vitest";
 import { parse, stringify } from "yaml";
+import { createDeterministicTgz } from "../../deterministic-tar";
 import { recomputeIndex, signIndex } from "../../publish";
+import { signCommand } from "../../sign";
 import { buildIndex } from "../build-index";
 import { publishPackage } from "../publish";
+import { readTgz } from "../scan";
 import { verifyMarket } from "../verify";
 
 const MOUNTS = "  - prefix: /api\n    api: src\n  - prefix: /cdn\n    web: ../cdn\n";
@@ -72,6 +75,34 @@ describe("given 一个正常落地的包 When 离线验包", () => {
 	});
 });
 
+describe("given 真实工程包（manifest 按 C2-29 整体省略 archive 占位）When 离线验包", () => {
+	it("then manifest 结构不因此打叉（REG-CS8 回归：ojm build --bundle 不落 archive ≠ 缺必填）", async () => {
+		const root = await seed();
+		const tgz = join(root, "cdn", "demo-solution-0.1.0.tgz");
+		// 解包 → 摘掉根 manifest 的 archive（fixture 有、真实方案无的字段差）→ 确定性重打包 → 重签 → 重建索引
+		const staging = mkdtempSync(join(tmpdir(), "ojm-verify-noarchive-"));
+		for (const e of readTgz(new Uint8Array(readFileSync(tgz)))) {
+			if (e.name.endsWith("/"))
+				continue;
+			const abs = join(staging, e.name);
+			mkdirSync(dirname(abs), { recursive: true });
+			writeFileSync(abs, e.content);
+		}
+		const rootManifestPath = join(staging, "manifest.yaml");
+		const manifest = parse(readFileSync(rootManifestPath, "utf-8")) as Record<string, unknown>;
+		delete manifest.archive;
+		writeFileSync(rootManifestPath, stringify(manifest));
+		await createDeterministicTgz(staging, tgz);
+		signCommand(tgz, { id: KEY_ID, privateKeyPem: testPem(), registryId: REGISTRY_ID });
+		await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
+
+		const result = await verifyMarket({ projectRoot: root });
+
+		expect(itemOf(result, "manifest 结构")?.ok).toBe(true);
+		rmSync(staging, { recursive: true, force: true });
+	});
+});
+
 describe("given 预发布版本（文件名含连字符）包体被篡改 When 离线验包", () => {
 	it("then 完整性仍能检出（不再因文件名解析错配而静默放过，REG-CS1 边界）", async () => {
 		const root = newProject();

package/src/market/bootstrap.ts

@@ -138,6 +138,21 @@ export async function bootstrapIsolatedSite(opts: BootstrapOptions = {}): Promis
 		throw new Error(`[ojm] 模板 config 未含 端口: 9778 字面（模板结构变了？）：${configPath}`);
 	}
 	cfg = cfg.replace("__JWT_SECRET__", randomBytes(32).toString("hex"));
+	// 站点对外地址：安装的相对市场基址（/cdn 本站点自供）与深检探针都靠它补全绝对 URL，
+	// 服务端 REG-CS6 刻意不读请求头 Host（防伪造 Host 牵引出站），**缺即拒、不猜**。
+	// 隔离站点的对外地址恒为它自己的 origin（端口本次随机派开），这里替部署侧填好。
+	const originLine = `  canonical_origin: "http://127.0.0.1:${port}"`;
+	if (cfg.includes("canonical_origin:")) {
+		cfg = cfg.split("\n").map(line => (line.includes("canonical_origin:") ? originLine : line)).join("\n");
+	}
+	else {
+		cfg = cfg.includes("\nvars:")
+			? cfg.replace("\nvars:", `\nvars:\n${originLine}`)
+			: `${cfg}\nvars:\n${originLine}`;
+	}
+	if (!cfg.includes(`http://127.0.0.1:${port}`)) {
+		throw new Error(`[ojm] 模板 config 未含 vars 段（模板结构变了？）：${configPath}`);
+	}
 	// 最小 SPA 挂载：真实部署里前端路由（深检会逐条探活）由站点壳承接；没有 web 挂载时
 	// 这些路径一律 404，深检会判成 anomaly。这里放一个 index.html 就够（不构建前端）。
 	const siteDir = path.join(root, "site");

package/src/market/setup.ts

@@ -15,7 +15,7 @@
 import { randomBytes } from "node:crypto";
 import process from "node:process";
 
-import { resolveSite } from "../site";
+import { resolveSite, tenantHeaders } from "../site";
 import { resolveCdnLayout } from "./cdn-layout";
 
 export const MARKET_CDN_URL_SETTING = "framework.market_cdn_url";
@@ -119,7 +119,7 @@ async function putSetting(fetchFn: typeof fetch, base: string, token: string, ke
 async function postJson(fetchFn: typeof fetch, url: string, body: unknown): Promise<Record<string, unknown>> {
 	const res = await fetchFn(url, {
 		method: "POST",
-		headers: { "content-type": "application/json" },
+		headers: { "content-type": "application/json", ...tenantHeaders() },
 		body: JSON.stringify(body),
 	});
 	return (await unwrap(res)) as Record<string, unknown>;
@@ -128,7 +128,7 @@ async function postJson(fetchFn: typeof fetch, url: string, body: unknown): Prom
 async function putJson(fetchFn: typeof fetch, url: string, token: string, body: unknown): Promise<Record<string, unknown>> {
 	const res = await fetchFn(url, {
 		method: "PUT",
-		headers: { "content-type": "application/json", "authorization": `Bearer ${token}` },
+		headers: { "content-type": "application/json", "authorization": `Bearer ${token}`, ...tenantHeaders() },
 		body: JSON.stringify(body),
 	});
 	return (await unwrap(res)) as Record<string, unknown>;