@oj-module/cli 0.2.5 → 0.2.8

package/templates/api/src/_platform/_shared/service/{users.ts → domain/users.ts}

@@ -3,8 +3,8 @@
 // 禁止操作自己（AC1-10 注）；最后 superadmin 兜底（服务端二次防线）；
 // 角色唯一权威源 sys_user_role + 写时失效（AC1-7/D10）；禁用/重置口令级联删 refresh（§3.1）。
 // bcrypt 经注入（Node 侧全局不可 stub，同 session.ts 约定）。
-import { invalidateUser } from "./access";
-import { recordOp } from "./audit";
+import { invalidateUser } from "../infra/access";
+import { recordOp } from "../infra/audit";
 
 export interface UserDeps {
 	bcryptHash: (pw: string) => Promise<string>
@@ -28,12 +28,12 @@ function fail(status: number, message: string): never {
 const RESERVED_PREFIX = /^(?:ldap|sso):/i;
 
 async function rolesOf(uid: number): Promise<string[]> {
-	const rows = await db.query("select role_name from sys_user_role where user_id = ?", [uid]) as Array<{ role_name: string }>;
+	const rows = await db.table("sys_user_role").select(["role_name"]).where({ field: "user_id", op: "eq", value: uid }).all() as Array<{ role_name: string }>;
 	return rows.map(r => r.role_name);
 }
 
 async function usernameOf(uid: number): Promise<string> {
-	const rows = await db.query("select username from users where id = ?", [uid]) as Array<{ username: string }>;
+	const rows = await db.table("users").select(["username"]).where({ field: "id", op: "eq", value: uid }).all() as Array<{ username: string }>;
 	return rows[0] ? String(rows[0].username) : `#${uid}`;
 }
 
@@ -52,10 +52,8 @@ async function assertMembershipAllowed(actorId: number, nextRoles: string[]): Pr
 }
 
 export async function listUsers(): Promise<UserRow[]> {
-	const rows = await db.query(
-		"select id, username, display_name, email, is_forbidden, must_change from users order by username",
-	) as Array<Record<string, unknown>>;
-	const roleRows = await db.query("select user_id, role_name from sys_user_role") as Array<{ user_id: number, role_name: string }>;
+	const rows = await db.table("users").select(["id", "username", "display_name", "email", "is_forbidden", "must_change"]).orderBy([{ field: "username" }]).all() as Array<Record<string, unknown>>;
+	const roleRows = await db.table("sys_user_role").select(["user_id", "role_name"]).all() as Array<{ user_id: number, role_name: string }>;
 	const roleMap = new Map<number, string[]>();
 	for (const r of roleRows)
 		(roleMap.get(Number(r.user_id)) ?? roleMap.set(Number(r.user_id), []).get(Number(r.user_id)))!.push(r.role_name);
@@ -79,14 +77,11 @@ export async function createUser(input: { username: string, password: string, di
 		fail(400, "username prefix reserved for external identity sources");
 	if (!input.password || String(input.password).length < 6)
 		fail(400, "password too short (min 6)");
-	const exists = await db.query("select id from users where username = ?", [username]);
+	const exists = await db.table("users").select(["id"]).where({ field: "username", op: "eq", value: username }).all();
 	if (exists.length)
 		fail(400, "username exists");
 	const hash = await deps.bcryptHash(String(input.password));
-	const rows = await db.query(
-		"insert into users (username, password_hash, display_name, email, must_change) values (?, ?, ?, ?, 1) returning id",
-		[username, hash, input.displayName ?? null, input.email ?? null],
-	) as Array<{ id: number }>;
+	const rows = await db.table("users").insert({ username, password_hash: hash, display_name: input.displayName ?? null, email: input.email ?? null, must_change: 1 }).returning(["id"]).run() as Array<{ id: number }>;
 	const uid = Number(rows[0].id);
 	await recordOp({ action: "user.create", module: "framework", target: username });
 	return uid;
@@ -95,14 +90,13 @@ export async function createUser(input: { username: string, password: string, di
 /** AC1-7：整集替换角色（sys_user_role 权威源），写后失效持有者判权缓存。 */
 export async function updateUserRoles(actorId: number, targetUid: number, roles: string[]): Promise<void> {
 	assertNotSelf(actorId, targetUid);
-	const target = await db.query("select id from users where id = ?", [targetUid]);
+	const target = await db.table("users").select(["id"]).where({ field: "id", op: "eq", value: targetUid }).all();
 	if (!target.length)
 		fail(404, "user not found");
 	const next = [...new Set(roles.map(String))];
 	if (next.length) {
-		const marks = next.map(() => "?").join(",");
-		const known = await db.query(`select name from sys_role where name in (${marks})`, next);
-		const knownSet = new Set(known.map((r: { name: string }) => r.name));
+		const known = await db.table("sys_role").select(["name"]).where({ field: "name", op: "in", value: next }).all();
+		const knownSet = new Set(known.map(r => (r as { name: string }).name));
 		const unknown = next.filter(r => !knownSet.has(r));
 		if (unknown.length)
 			fail(400, `unknown roles: ${unknown.join(", ")}`);
@@ -112,14 +106,14 @@ export async function updateUserRoles(actorId: number, targetUid: number, roles:
 	const beforeSet = new Set(before);
 	// AC1-10 兜底：撤掉最后一个 superadmin 拒绝（现实可达路径已被「禁止操作自己」拦截）
 	if (beforeSet.has("superadmin") && !next.includes("superadmin")) {
-		const supers = await db.query("select count(*) c from sys_user_role where role_name = 'superadmin'") as Array<{ c: number }>;
+		const supers = await db.table("sys_user_role").select([{ fn: "count", as: "c" }]).where({ field: "role_name", op: "eq", value: "superadmin" }).all() as Array<{ c: number }>;
 		if (Number(supers[0].c) <= 1)
 			fail(400, "cannot revoke the last superadmin");
 	}
 	await db.tx(async (t) => {
-		await t.exec("delete from sys_user_role where user_id = ?", [targetUid]);
+		await t.table("sys_user_role").where({ field: "user_id", op: "eq", value: targetUid }).delete().run();
 		for (const role of next)
-			await t.exec("insert into sys_user_role (user_id, role_name) values (?, ?)", [targetUid, role]);
+			await t.table("sys_user_role").insert({ user_id: targetUid, role_name: role }).run();
 	});
 	invalidateUser(Number(targetUid));
 	await recordOp({
@@ -135,13 +129,13 @@ export async function changePasswordByAdmin(actorId: number, targetUid: number,
 	assertNotSelf(actorId, targetUid);
 	if (!newPassword || String(newPassword).length < 6)
 		fail(400, "password too short (min 6)");
-	const rows = await db.query("select id from users where id = ?", [targetUid]);
+	const rows = await db.table("users").select(["id"]).where({ field: "id", op: "eq", value: targetUid }).all();
 	if (!rows.length)
 		fail(404, "user not found");
 	const hash = await deps.bcryptHash(String(newPassword));
 	await db.tx(async (t) => {
-		await t.exec("update users set password_hash = ?, must_change = 1 where id = ?", [hash, targetUid]);
-		await t.exec("delete from sys_refresh_token where user_id = ?", [targetUid]);
+		await t.table("users").update({ password_hash: hash, must_change: 1 }).where({ field: "id", op: "eq", value: targetUid }).run();
+		await t.table("sys_refresh_token").where({ field: "user_id", op: "eq", value: targetUid }).delete().run();
 	});
 	invalidateUser(Number(targetUid));
 	await recordOp({ action: "user.password.reset", module: "framework", target: await usernameOf(Number(targetUid)) });
@@ -150,13 +144,13 @@ export async function changePasswordByAdmin(actorId: number, targetUid: number,
 /** B7：禁用/解禁——禁用级联删 refresh + 写时失效。 */
 export async function setForbidden(actorId: number, targetUid: number, forbidden: boolean): Promise<void> {
 	assertNotSelf(actorId, targetUid);
-	const rows = await db.query("select id from users where id = ?", [targetUid]);
+	const rows = await db.table("users").select(["id"]).where({ field: "id", op: "eq", value: targetUid }).all();
 	if (!rows.length)
 		fail(404, "user not found");
 	await db.tx(async (t) => {
-		await t.exec("update users set is_forbidden = ? where id = ?", [forbidden ? 1 : 0, targetUid]);
+		await t.table("users").update({ is_forbidden: forbidden ? 1 : 0 }).where({ field: "id", op: "eq", value: targetUid }).run();
 		if (forbidden)
-			await t.exec("delete from sys_refresh_token where user_id = ?", [targetUid]);
+			await t.table("sys_refresh_token").where({ field: "user_id", op: "eq", value: targetUid }).delete().run();
 	});
 	invalidateUser(Number(targetUid));
 	await recordOp({ action: "user.forbidden.update", module: "framework", target: await usernameOf(Number(targetUid)), detail: { forbidden } });

package/templates/api/src/_platform/_shared/service/{access.ts → infra/access.ts}

@@ -20,15 +20,12 @@ interface AccessSnapshot {
 const cache = new Map<number, AccessSnapshot>();
 
 async function loadSnapshot(userId: number): Promise<AccessSnapshot> {
-	const userRows = await db.query("select is_forbidden, must_change from users where id = ?", [userId]);
-	const roleRows = await db.query("select role_name from sys_user_role where user_id = ?", [userId]);
-	const roles = roleRows.map((r: { role_name: string }) => r.role_name);
+	const userRows = await db.table("users").select(["is_forbidden", "must_change"]).where({ field: "id", op: "eq", value: userId }).all();
+	const roleRows = await db.table("sys_user_role").select(["role_name"]).where({ field: "user_id", op: "eq", value: userId }).all();
+	const roles = roleRows.map(r => (r as { role_name: string }).role_name);
 	// 只捞该用户角色的绑定（参数化 IN，三方言纪律）；deprecated 不过滤（判权职责，§5）
 	const bindRows = roles.length
-		? await db.query(
-			`select role_name, permission_code from sys_role_permission where role_name in (${roles.map(() => "?").join(",")})`,
-			roles,
-		)
+		? await db.table("sys_role_permission").select(["role_name", "permission_code"]).where({ field: "role_name", op: "in", value: roles }).all()
 		: [];
 	const bindings: Record<string, string[]> = {};
 	for (const r of bindRows as { role_name: string, permission_code: string }[])
@@ -69,7 +66,7 @@ export async function currentAccess(): Promise<AccessSnapshot> {
 	const uid = http.user?.id;
 	if (uid == null)
 		deny();
-	const snap = await snapshot(uid);
+	const snap = await snapshot(Number(uid));
 	if (snap.forbidden)
 		deny();
 	if (snap.mustChange)

package/templates/api/src/_platform/_shared/service/{audit.ts → infra/audit.ts}

@@ -22,27 +22,24 @@ export interface OpEntry {
 async function usernameOf(userId: number): Promise<string> {
 	if (!userId)
 		return "system";
-	const rows = await db.query("select username from users where id = ?", [userId]);
+	const rows = await db.table("users").select(["username"]).where({ field: "id", op: "eq", value: userId }).all();
 	return rows[0] ? String(rows[0].username) : "unknown";
 }
 
 /** 同步落表。关键路径（如 A6 角色管理）直接 await；一般路径用 auditOp。 */
 export async function recordOp(entry: OpEntry): Promise<void> {
-	const uid = http.user?.id ?? 0;
-	await db.exec(
-		"insert into sys_oplog (create_time, user_id, username, action, module, version, target, detail, level) values (?, ?, ?, ?, ?, ?, ?, ?, ?)",
-		[
-			Date.now(),
-			uid,
-			await usernameOf(uid),
-			entry.action,
-			entry.module,
-			entry.version ?? null,
-			entry.target ?? null,
-			entry.detail == null ? null : JSON.stringify(entry.detail),
-			entry.level ?? 6,
-		],
-	);
+	const uid = Number(http.user?.id ?? 0);
+	await db.table("sys_oplog").insert({
+		create_time: Date.now(),
+		user_id: uid,
+		username: await usernameOf(uid),
+		action: entry.action,
+		module: entry.module,
+		version: entry.version ?? null,
+		target: entry.target ?? null,
+		detail: entry.detail == null ? null : JSON.stringify(entry.detail),
+		level: entry.level ?? 6,
+	}).run();
 }
 
 /** fire-and-forget：审计失败静默（写日志也失败的极端场景下，业务正确性优先）。 */
@@ -61,7 +58,7 @@ let denyQueue: Promise<void> = Promise.resolve();
  *  uid 在调用瞬间同步捕获——http.user 是可变全局，异步队列执行时再读会被后续请求覆盖。
  */
 export function auditDeny(code: string): void {
-	const uid = http.user?.id ?? 0;
+	const uid = Number(http.user?.id ?? 0);
 	denyQueue = denyQueue.then(() => recordDeny(uid, code)).catch(() => {});
 }
 
@@ -73,18 +70,21 @@ export function resetDenyAudit(): void {
 async function recordDeny(uid: number, code: string): Promise<void> {
 	const now = Date.now();
 	// 窗口锚点 = 分钟内最近一条同 (user, code) 的 auth.deny 行；命中只更新计数，否则落首条。
-	const rows = await db.query(
-		"select id, detail from sys_oplog where user_id = ? and action = 'auth.deny' and target = ? and create_time > ? order by id desc limit 1",
-		[uid, code, now - DENY_WINDOW_MS],
-	);
+	const rows = await db.table("sys_oplog").select(["id", "detail"]).where({ field: "user_id", op: "eq", value: uid }).where({ field: "action", op: "eq", value: "auth.deny" }).where({ field: "target", op: "eq", value: code }).where({ field: "create_time", op: "gt", value: now - DENY_WINDOW_MS }).orderBy([{ field: "id", dir: "desc" }]).limit(1).all();
 	const hit = rows[0] as { id: number, detail: string } | undefined;
 	if (hit) {
 		const count = (JSON.parse(hit.detail) as { count: number }).count + 1;
-		await db.exec("update sys_oplog set detail = ? where id = ?", [JSON.stringify({ code, count }), hit.id]);
+		await db.table("sys_oplog").update({ detail: JSON.stringify({ code, count }) }).where({ field: "id", op: "eq", value: hit.id }).run();
 		return;
 	}
-	await db.exec(
-		"insert into sys_oplog (create_time, user_id, username, action, module, target, detail, level) values (?, ?, ?, 'auth.deny', ?, ?, ?, 4)",
-		[now, uid, await usernameOf(uid), moduleOf(code), code, JSON.stringify({ code, count: 1 })],
-	);
+	await db.table("sys_oplog").insert({
+		create_time: now,
+		user_id: uid,
+		username: await usernameOf(uid),
+		action: "auth.deny",
+		module: moduleOf(code),
+		target: code,
+		detail: JSON.stringify({ code, count: 1 }),
+		level: 4,
+	}).run();
 }

package/templates/api/src/_platform/_shared/service/{rate.ts → infra/rate.ts}

@@ -12,15 +12,15 @@ export interface RateLimitOpts {
 /** key 维度（如 `contacts:<uid>` / `login:ip:<ip>`）：窗口内超 limit → 429。 */
 export async function rateLimit(key: string, limit: number, windowMs: number, opts: RateLimitOpts = {}): Promise<void> {
 	const now = opts.now?.() ?? Date.now();
-	const rows = await db.query("select window_start, count from sys_rate_window where rate_key = ?", [key]);
+	const rows = await db.table("sys_rate_window").select(["window_start", "count"]).where({ field: "rate_key", op: "eq", value: key }).all();
 	const w = rows[0] as { window_start: number, count: number } | undefined;
 	if (!w || now - Number(w.window_start) >= windowMs) {
-		await db.exec("delete from sys_rate_window where rate_key = ?", [key]);
-		await db.exec("insert into sys_rate_window (rate_key, window_start, count) values (?, ?, 1)", [key, now]);
+		await db.table("sys_rate_window").where({ field: "rate_key", op: "eq", value: key }).delete().run();
+		await db.table("sys_rate_window").insert({ rate_key: key, window_start: now, count: 1 }).run();
 		return;
 	}
 	const count = Number(w.count) + 1;
-	await db.exec("update sys_rate_window set count = ? where rate_key = ?", [count, key]);
+	await db.table("sys_rate_window").update({ count }).where({ field: "rate_key", op: "eq", value: key }).run();
 	if (count > limit)
 		throw Object.assign(new Error("rate limited"), { status: 429 });
 }
@@ -44,12 +44,12 @@ export async function loginFailed(key: string, opts: LoginThrottleOpts = {}): Pr
 	const threshold = opts.threshold ?? 6;
 	const base = opts.baseBackoffMs ?? 15_000;
 	const now = opts.now?.() ?? Date.now();
-	const rows = await db.query("select fail_count, blocked_until from sys_login_throttle where pair_key = ?", [key]);
-	const s = rows[0] as LoginThrottleRow | undefined;
+	const rows = await db.table("sys_login_throttle").select(["fail_count", "blocked_until"]).where({ field: "pair_key", op: "eq", value: key }).all();
+	const s = rows[0] as unknown as LoginThrottleRow | undefined;
 	const count = (s ? Number(s.fail_count) : 0) + 1;
 	const blockedUntil = count >= threshold ? now + base * 2 ** (count - threshold) : (s ? Number(s.blocked_until) : 0);
-	await db.exec("delete from sys_login_throttle where pair_key = ?", [key]);
-	await db.exec("insert into sys_login_throttle (pair_key, fail_count, blocked_until) values (?, ?, ?)", [key, count, blockedUntil]);
+	await db.table("sys_login_throttle").where({ field: "pair_key", op: "eq", value: key }).delete().run();
+	await db.table("sys_login_throttle").insert({ pair_key: key, fail_count: count, blocked_until: blockedUntil }).run();
 	return count;
 }
 
@@ -58,19 +58,19 @@ export async function loginBlocked(key: string, opts: LoginThrottleOpts = {}): P
 	const threshold = opts.threshold ?? 6;
 	const base = opts.baseBackoffMs ?? 15_000;
 	const now = opts.now?.() ?? Date.now();
-	const rows = await db.query("select fail_count, blocked_until from sys_login_throttle where pair_key = ?", [key]);
-	const s = rows[0] as LoginThrottleRow | undefined;
+	const rows = await db.table("sys_login_throttle").select(["fail_count", "blocked_until"]).where({ field: "pair_key", op: "eq", value: key }).all();
+	const s = rows[0] as unknown as LoginThrottleRow | undefined;
 	if (!s || Number(s.blocked_until) <= now)
 		return;
 	const count = Number(s.fail_count) + 1;
 	const blockedUntil = now + base * 2 ** (count - threshold);
-	await db.exec("update sys_login_throttle set fail_count = ?, blocked_until = ? where pair_key = ?", [count, blockedUntil, key]);
+	await db.table("sys_login_throttle").update({ fail_count: count, blocked_until: blockedUntil }).where({ field: "pair_key", op: "eq", value: key }).run();
 	throw Object.assign(new Error("too many login attempts"), { status: 429, retryAfterMs: blockedUntil - now });
 }
 
 /** 登录成功清零连败。 */
 export async function loginSucceeded(key: string): Promise<void> {
-	await db.exec("delete from sys_login_throttle where pair_key = ?", [key]);
+	await db.table("sys_login_throttle").where({ field: "pair_key", op: "eq", value: key }).delete().run();
 }
 
 /** 清登录限速状态（测试夹具/运维排障用）。 */

package/templates/api/src/_platform/_shared/site-facade.ts

@@ -34,7 +34,7 @@ export function withSiteOrigin(fetch: FetchInitFace): FetchFace {
 /** 站点迁移账本 head（oj journal 真源 `_oj_migrations`；表缺失/查询失败 → null = 跳过禁降版判定，不猜） */
 export async function journalHeadOf(name: string): Promise<number | bigint | null> {
 	try {
-		const rows = await db.query("select max(version) as head from _oj_migrations where module = ?", [name]) as Array<{ head: unknown }>;
+		const rows = await db.table("_oj_migrations").select([{ fn: "max", field: "version", as: "head" }]).where({ field: "module", op: "eq", value: name }).all() as Array<{ head: unknown }>;
 		const head = rows[0]?.head;
 		return head == null ? null : Number(head);
 	}

package/templates/api/src/_platform/contacts/api.ts

@@ -2,8 +2,8 @@ import { respond } from "../_shared/respond";
 // 平台共享服务域 /api/_platform/contacts（D207：登录即可，不挂权限点，H12）。
 // 读操作不记审计（设计 §4B）；接口级限速（设计 line 199）经 rate.ts（B5 复用同源）。
 // 单条详情走子组 /api/_platform/contacts/detail?id=（detail/api.ts，含 email/avatar）。
-import { searchContacts } from "../_shared/service/contacts";
-import { rateLimit } from "../_shared/service/rate";
+import { searchContacts } from "../_shared/service/domain/contacts";
+import { rateLimit } from "../_shared/service/infra/rate";
 
 export default {
 	// GET /api/_platform/contacts?keyword=&limit= —— 人员目录（AC1-22~24）。

package/templates/api/src/_platform/contacts/detail/api.ts

@@ -1,7 +1,7 @@
 import { respond } from "../../_shared/respond";
 // GET /api/_platform/contacts/detail?id= —— 单条详情（含 email/avatar，设计 §4B）。
-import { contactDetail } from "../../_shared/service/contacts";
-import { rateLimit } from "../../_shared/service/rate";
+import { contactDetail } from "../../_shared/service/domain/contacts";
+import { rateLimit } from "../../_shared/service/infra/rate";
 
 export default {
 	async get() {

package/templates/api/src/_platform/manifest.yaml

@@ -1,5 +1,5 @@
 name: _platform
-desc: 框架级共有表（users 鉴权 + RBAC 六表 + 设置/日志/路由注册）——普通模块、无路由（参考 sample/src/_platform）
+desc: 平台内核（非业务模块、无自身业务路由前缀）。含三类：① 跨模块服务 _shared/service（infra 基础设施 + domain 管理域）；② 生命周期引擎 _lifecycle（方案安装/卸载/注册/验签/信任状态机）；③ 平台编排 API 面 /api/_platform/{contacts,market,solutions}（由 market/api.ts、contacts/api.ts、solutions/api.ts 暴露，全 superadmin 门禁）。运行时安装的方案包不在此树。
 version: 0.1.0
 tables:
   - users
@@ -12,3 +12,5 @@ tables:
   - sys_user_role
   - sys_refresh_token
   - market_history
+  - sys_rate_window
+  - sys_login_throttle

package/templates/api/src/_platform/market/api.ts

@@ -27,7 +27,7 @@ import { validateTarListing } from "../_lifecycle/tgz-guard";
 import { createTrustStore } from "../_lifecycle/trust";
 import { computeUninstallImpact, runUninstall } from "../_lifecycle/uninstall";
 import { respond } from "../_shared/respond";
-import { assertSuperAdmin } from "../_shared/service/access";
+import { assertSuperAdmin } from "../_shared/service/infra/access";
 import { journalHeadOf, siteOrigin, withSiteOrigin } from "../_shared/site-facade";
 import { BOOTSTRAP_KEY, seedBootstrapKey } from "./bootstrap";
 
@@ -182,7 +182,7 @@ async function cdnBaseOf(env: MarketEnv): Promise<string | null> {
 		return injected === "" ? null : injected.replace(/\/+$/, "");
 	}
 	try {
-		const rows = await db.query("select value, default_value from sys_setting where key = ?", ["framework.market_cdn_url"]) as Array<Record<string, unknown>>;
+		const rows = await db.table("sys_setting").select(["value", "default_value"]).where({ field: "key", op: "eq", value: "framework.market_cdn_url" }).all() as Array<Record<string, unknown>>;
 		const v = String(rows[0]?.value ?? rows[0]?.default_value ?? "").trim().replace(/\/+$/, "");
 		return v === "" ? null : v;
 	}
@@ -263,7 +263,7 @@ async function operatorOf(): Promise<string | null> {
 		return null;
 	}
 	try {
-		const u = await db.query("select username from users where id = ?", [uid]) as Array<{ username: string }>;
+		const u = await db.table("users").select(["username"]).where({ field: "id", op: "eq", value: uid }).all() as Array<{ username: string }>;
 		return u[0]?.username ?? null;
 	}
 	catch {
@@ -274,7 +274,7 @@ async function operatorOf(): Promise<string | null> {
 /** sys_solution_route enabled（reconcile route 一致性面；无行/查询失败 → null 不猜） */
 async function routeEnabledOf(name: string): Promise<boolean | null> {
 	try {
-		const rows = await db.query("select enabled from sys_solution_route where module = ? and deprecated = 0 limit 1", [name]) as Array<{ enabled: unknown }>;
+		const rows = await db.table("sys_solution_route").select(["enabled"]).where({ field: "module", op: "eq", value: name }).where({ field: "deprecated", op: "eq", value: 0 }).limit(1).all() as Array<{ enabled: unknown }>;
 		if (rows.length === 0) {
 			return null;
 		}
@@ -499,7 +499,7 @@ async function installBody(env: MarketEnv): Promise<{ task_id: string }> {
 			manifest,
 			name,
 			version,
-			operator: await operatorOf(),
+			operator: (await operatorOf()) ?? undefined,
 			state: await createStateStore(env.statePath),
 			archiveUrl,
 			sharedRoot: env.sharedRoot,
@@ -564,10 +564,13 @@ interface IndexRow {
 /** 最近一次安装操作人（回落 market_history 行；表不存在/查询失败/无行 → null，观测面不阻断索引） */
 async function lastInstallOperatorOf(name: string): Promise<string | null> {
 	try {
-		const rows = await db.query(
-			"select operator from market_history where solution = ? and action = 'install' order by created_at desc, rowid desc limit 1",
-			[name],
-		) as Array<{ operator: unknown }>;
+		const rows = await db.table("market_history")
+			.select(["operator"])
+			.where({ field: "solution", op: "eq", value: name })
+			.where({ field: "action", op: "eq", value: "install" })
+			.orderBy([{ field: "created_at", dir: "desc" }, { field: "rowid", dir: "desc" }])
+			.limit(1)
+			.all() as Array<{ operator: unknown }>;
 		const op = rows[0]?.operator;
 		return typeof op === "string" ? op : null;
 	}
@@ -728,7 +731,7 @@ export function createMarketApi(env: MarketEnv) {
 						state: await createStateStore(env.statePath),
 						modulesJsonPath: env.modulesJsonPath,
 						trustPath: env.trustPath,
-						operator: await operatorOf(),
+						operator: (await operatorOf()) ?? undefined,
 					});
 				});
 			},
@@ -851,7 +854,7 @@ export function createMarketApi(env: MarketEnv) {
 						lockPath: `${env.sharedRoot}/manifests.yaml`,
 						state: await createStateStore(env.statePath),
 						modulesJsonPath: env.modulesJsonPath,
-						operator: await operatorOf(),
+						operator: (await operatorOf()) ?? undefined,
 					});
 					// P3-11 宿主打磨：方案已不存在 = 资源缺失语义 → 404（非 200 {ok:false}）；
 					// 其余领域拒绝（空锁拒启/级联失败等）维持 200 {ok:false} 人话在 message。
@@ -869,10 +872,10 @@ export function createMarketApi(env: MarketEnv) {
 		"history": {
 			async get() {
 				await respond(async () => {
-					const rows = (await db.query(
-						"select solution, version, action, status, operator, message, created_at from market_history order by created_at desc",
-						[],
-					)) as Array<Record<string, unknown>>;
+					const rows = (await db.table("market_history")
+						.select(["solution", "version", "action", "status", "operator", "message", "created_at"])
+						.orderBy([{ field: "created_at", dir: "desc" }])
+						.all()) as Array<Record<string, unknown>>;
 					return rows ?? [];
 				});
 			},
@@ -880,4 +883,39 @@ export function createMarketApi(env: MarketEnv) {
 	};
 }
 
-export default createMarketApi(marketEnv());
+const marketApi = createMarketApi(marketEnv());
+
+// —— 契约 I/O（schema-first，oj v0.1.72+）：`.schema` 定义入参（body/query）、`.response`
+// 定义出参，供 oj 在 handler 运行前校验 + 生成式 __client 推导有类型函数（与 notification/api.ts
+// 同口径）。出参一律 additionalProperties:true 宽松，不约束运行期返回形状；入参对齐 handler 实际
+// 收口（source 枚举 / 必填项），oj 先校验、handler 仍自校验（双保险，不放松运行期语义）。
+marketApi.install.post.schema = {
+	body: {
+		type: "object",
+		required: ["source", "name"],
+		properties: { source: { type: "string", enum: ["cdn", "file"] }, name: { type: "string" }, version: { type: ["string", "null"] } },
+	},
+};
+marketApi.install.post.response = { type: "object", properties: { task_id: { type: "string" } }, additionalProperties: true };
+marketApi.install.cancel.post.schema = { body: { type: "object", required: ["name"], properties: { name: { type: "string" } } } };
+marketApi.install.cancel.post.response = { type: "object", properties: { ok: { type: "boolean" }, name: { type: "string" }, requested: { type: "boolean" } }, additionalProperties: true };
+marketApi.task.get.schema = { query: { type: "object", required: ["id"], properties: { id: { type: "string" } } } };
+marketApi.task.get.response = { type: "object", additionalProperties: true };
+marketApi.enable.post.schema = { body: { type: "object", required: ["name", "enabled"], properties: { name: { type: "string" }, enabled: { type: "boolean" } } } };
+marketApi.enable.post.response = { type: "object", additionalProperties: true };
+marketApi.meta.get.response = { type: "object", properties: { apiVersion: { type: "string" } }, additionalProperties: true };
+marketApi.trust.get.response = { type: "object", additionalProperties: true };
+marketApi.trust.post.schema = { body: { type: "object", required: ["task_id"], properties: { task_id: { type: "string" } } } };
+marketApi.trust.post.response = { type: "object", additionalProperties: true };
+marketApi.trust.key.post.schema = { body: { type: "object", required: ["key_id", "public_key"], properties: { key_id: { type: "string" }, public_key: { type: "string" } } } };
+marketApi.trust.key.post.response = { type: "object", additionalProperties: true };
+marketApi.trust.key.del.schema = { query: { type: "object", required: ["key_id"], properties: { key_id: { type: "string" } } } };
+marketApi.trust.key.del.response = { type: "object", additionalProperties: true };
+marketApi.index.get.response = { type: "array", items: { type: "object", additionalProperties: true } };
+marketApi["uninstall-impact"].get.schema = { query: { type: "object", required: ["name"], properties: { name: { type: "string" } } } };
+marketApi["uninstall-impact"].get.response = { type: "object", additionalProperties: true };
+marketApi.uninstall.post.schema = { body: { type: "object", required: ["name"], properties: { name: { type: "string" } } } };
+marketApi.uninstall.post.response = { type: "object", additionalProperties: true };
+marketApi.history.get.response = { type: "array", items: { type: "object", additionalProperties: true } };
+
+export default marketApi;

package/templates/api/src/_platform/schema.yaml

@@ -88,6 +88,20 @@ tables:
       expires_at: {type: integer, null: false}
       revoked: {type: integer, null: false}
       created_at: {type: integer, null: false}
+  # 限速/登录节流状态表（V9__sys_throttle 经迁移创建；rate.ts 经 db.table() 访问，
+  # 须在此声明 + 在 manifest.yaml tables 登记，否则 oj 表元数据校验报 unknown table）。
+  sys_rate_window:
+    pk: rate_key
+    columns:
+      rate_key: {type: text, null: false}
+      window_start: {type: integer, null: false}
+      count: {type: integer, null: false}
+  sys_login_throttle:
+    pk: pair_key
+    columns:
+      pair_key: {type: text, null: false}
+      fail_count: {type: integer, null: false}
+      blocked_until: {type: integer, null: false}
   # 市场操作历史（P4 上收 _platform）：install/enable/disable/uninstall/upgrade/rollback 六类动作留痕。
   # 写入由平台编排面（_lifecycle/history.ts recordHistory）落到本表；市场页只读消费。
   market_history:

package/templates/api/src/_platform/solutions/api.ts

@@ -24,7 +24,7 @@ import {
 } from "../_lifecycle/verify-checks";
 import { getLastReport, persistReport, verifyReportsDirOf } from "../_lifecycle/verify-report";
 import { respond } from "../_shared/respond";
-import { assertSystemAdmin } from "../_shared/service/access";
+import { assertSystemAdmin } from "../_shared/service/infra/access";
 import { journalHeadOf, siteOrigin } from "../_shared/site-facade";
 
 /** 线格式行（与 packages/runtime/src/api/rbac/types.ts 的 SolutionRouteRow 对齐） */
@@ -82,11 +82,11 @@ async function trustItemOf(env: SolutionsEnv, name: string): Promise<VerifyItem
 /** 深检主体：四项检查编排 + 可信性项 + i18n 依赖项，组装 VerifyReport{ok,checks,advise}（persist 归端点） */
 async function verifyBody(env: SolutionsEnv, name: string): Promise<VerifyReport> {
 	// 已装校验：sys_solution_route 有该 module 行（未装 → 404，端点门之一）
-	const routeRows = await db.query(
-		`select path, module, category, "order", title_key, required_permission, enabled
-		from sys_solution_route where deprecated = 0 and module = ?`,
-		[name],
-	) as Array<Record<string, unknown>>;
+	const routeRows = await db.table("sys_solution_route")
+		.select(["path", "module", "category", "order", "title_key", "required_permission", "enabled"])
+		.where({ field: "deprecated", op: "eq", value: 0 })
+		.where({ field: "module", op: "eq", value: name })
+		.all() as Array<Record<string, unknown>>;
 	if (routeRows.length === 0)
 		throw Object.assign(new Error(`方案「${name}」未安装或无路由注册`), { status: 404 });
 
@@ -97,13 +97,13 @@ async function verifyBody(env: SolutionsEnv, name: string): Promise<VerifyReport
 
 	// ② RBAC 完整性：声明权限点 ↔ sys_permission 实有
 	const declaredPerms = [...new Set(routes.map(r => r.required_permission).filter((p): p is string => p != null))];
-	const permRows = await db.query("select code from sys_permission") as Array<{ code: string }>;
+	const permRows = await db.table("sys_permission").select(["code"]).all() as Array<{ code: string }>;
 	const rbac = diffPermRows(declaredPerms, new Set(permRows.map(r => r.code)));
 
 	// ③ 设置完整性：manifest 声明设置 key ↔ sys_setting 实有（永不含值）
 	const manifest = await readSolutionManifest(env, name);
 	const declaredSettings = manifest ? declaredSettingsOf(manifest.manifest) : [];
-	const settingRows = await db.query("select key from sys_setting where module = ? and deprecated = 0", [name]) as Array<{ key: string }>;
+	const settingRows = await db.table("sys_setting").select(["key"]).where({ field: "module", op: "eq", value: name }).where({ field: "deprecated", op: "eq", value: 0 }).all() as Array<{ key: string }>;
 	const settings = diffSettingRows(declaredSettings, new Set(settingRows.map(r => r.key)));
 
 	// ④ 迁移账本：manifest 迁移目录最高版本 ↔ _oj_migrations 实有（journalHeadOf 复用，DRY）
@@ -167,10 +167,11 @@ export function createSolutionsApi(env: SolutionsEnv) {
 					return;
 				}
 				await respond(async () => {
-					const rows = await db.query(
-						`select path, module, category, "order", title_key, required_permission, enabled
-						from sys_solution_route where deprecated = 0 order by module, "order", path`,
-					) as Array<Record<string, unknown>>;
+					const rows = await db.table("sys_solution_route")
+						.select(["path", "module", "category", "order", "title_key", "required_permission", "enabled"])
+						.where({ field: "deprecated", op: "eq", value: 0 })
+						.orderBy([{ field: "module" }, { field: "order" }, { field: "path" }])
+						.all() as Array<Record<string, unknown>>;
 					return rows.map(rowOf);
 				});
 			},

package/templates/api/src/auth/_shared/ldap-login.ts

@@ -25,7 +25,7 @@ function fail(status: number, message: string): never {
 }
 
 async function setting(key: string): Promise<string> {
-	const rows = await db.query("select value from sys_setting where key = ?", [key]) as Array<{ value: string | null }>;
+	const rows = await db.table("sys_setting").select(["value"]).where({ field: "key", op: "eq", value: key }).all() as Array<{ value: string | null }>;
 	return rows[0]?.value == null ? "" : String(rows[0].value);
 }
 
@@ -64,20 +64,24 @@ export function createLdapLogin(session: Pick<Session, "issueExternal">, gateway
 		// JIT find-or-create：键 "ldap:<uid>"，占位 hash "!ldap" 恒 verify false（低信任来源不接管本地号）；
 		// must_change=0——外来号无本地旧口令，悬挂期唯一可用写端（改密）必失败 = 号 brick（设计 §9.4）
 		const localName = `ldap:${username}`;
-		let rows = await db.query("select id, is_forbidden from users where username = ?", [localName]) as Array<{ id: number, is_forbidden: number }>;
+		let rows = await db.table("users").select(["id", "is_forbidden"]).where({ field: "username", op: "eq", value: localName }).all() as Array<{ id: number, is_forbidden: number }>;
 		if (!rows.length) {
 			try {
-				await db.exec(
-					"insert into users (username, password_hash, source, email, must_change, is_forbidden) values (?, '!ldap', 'ldap', ?, 0, 0)",
-					[localName, firstAttr(entries[0].attrs, emailAttr) || null],
-				);
+				await db.table("users").insert({
+					username: localName,
+					password_hash: "!ldap",
+					source: "ldap",
+					email: firstAttr(entries[0].attrs, emailAttr) || null,
+					must_change: 0,
+					is_forbidden: 0,
+				}).run();
 			}
 			catch (e) {
 				// 唯一约束兜底（预查与插入间的竞态，同 createUser 模式）：撞 username → 回查复用；其余照抛
 				if (!/unique|constraint/i.test(e instanceof Error ? e.message : String(e)))
 					throw e;
 			}
-			rows = await db.query("select id, is_forbidden from users where username = ?", [localName]) as Array<{ id: number, is_forbidden: number }>;
+			rows = await db.table("users").select(["id", "is_forbidden"]).where({ field: "username", op: "eq", value: localName }).all() as Array<{ id: number, is_forbidden: number }>;
 		}
 		if (Number(rows[0].is_forbidden) === 1)
 			fail(403, "account disabled");