@oj-module/cli 0.2.54 → 0.2.57

package/templates/src/app/web/system/pages/oplog/index.tsx

@@ -1,10 +1,10 @@
 import { useQuery } from "@tanstack/react-query";
-import { Alert, Button, Form, Input, InputNumber, Space, Table, Tooltip } from "antd";
+import { Button, Form, Input, Space, Table, Tooltip } from "antd";
 import dayjs from "dayjs";
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
 
-import { systemOplogGet } from "../../__client/api";
+import { systemOplogGet } from "../../__client";
 import { isForbidden } from "../errors";
 import { ForbiddenPanel } from "../forbidden";
 
@@ -12,20 +12,26 @@ interface OplogFilters {
 	action?: string
 	username?: string
 	module?: string
-	limit?: number
 }
 
+const DEFAULT_PAGE_SIZE = 20;
+const PAGE_SIZE_OPTIONS = [20, 50, 100];
+
 /**
- * 操作日志（AC1-29/D13）：action 精确 / username 前缀 / module 精确，limit 钳 200。
- * truncated=true 表示结果被截断（服务端 paged），顶部提示缩小过滤范围。
+ * 操作日志（AC1-29/D13）：action 精确 / username 包含 / module 精确。
+ *
+ * 分页交给服务端：`page` + `limit`（每页条数，钳 200），响应带 `total`，页面按 total 出页码。
+ * 不再有「结果被截断」的横幅——记录再多也能通过页码翻到，不必靠缩小过滤范围。
  */
 export default function OplogPage() {
 	const { t } = useTranslation();
 	const [filters, setFilters] = useState<OplogFilters>({});
+	const [page, setPage] = useState(1);
+	const [size, setSize] = useState(DEFAULT_PAGE_SIZE);
 
 	const query = useQuery({
-		queryKey: ["system", "oplog", filters],
-		queryFn: () => systemOplogGet(filters),
+		queryKey: ["system", "oplog", filters, page, size],
+		queryFn: () => systemOplogGet({ ...filters, page, limit: size }),
 	});
 
 	if (query.error && isForbidden(query.error))
@@ -50,12 +56,14 @@ export default function OplogPage() {
 		<Space direction="vertical" style={{ width: "100%", paddingTop: 16 }}>
 			<Form
 				layout="inline"
-				onFinish={values => setFilters({
-					action: values.action || undefined,
-					username: values.username || undefined,
-					module: values.module || undefined,
-					limit: values.limit || undefined,
-				})}
+				onFinish={(values) => {
+					setFilters({
+						action: values.action || undefined,
+						username: values.username || undefined,
+						module: values.module || undefined,
+					});
+					setPage(1);
+				}}
 			>
 				<Form.Item name="action" label={t("system:oplog.filterAction")}>
 					<Input allowClear />
@@ -66,25 +74,42 @@ export default function OplogPage() {
 				<Form.Item name="module" label={t("system:oplog.filterModule")}>
 					<Input allowClear />
 				</Form.Item>
-				<Form.Item name="limit" label={t("system:oplog.filterLimit")} initialValue={50}>
-					<InputNumber min={1} max={200} />
-				</Form.Item>
 				<Form.Item>
 					<Space>
 						<Button type="primary" htmlType="submit">{t("system:common.search")}</Button>
-						<Button onClick={() => { setFilters({}); }}>
+						<Button
+							onClick={() => {
+								setFilters({});
+								setPage(1);
+							}}
+						>
 							{t("system:common.reset")}
 						</Button>
 					</Space>
 				</Form.Item>
 			</Form>
-			{query.data?.truncated ? <Alert type="warning" showIcon message={t("system:oplog.truncated")} /> : null}
 			<Table
 				rowKey="id"
 				loading={query.isLoading}
 				dataSource={query.data?.list ?? []}
 				columns={columns}
-				pagination={{ hideOnSinglePage: true, pageSize: 50 }}
+				pagination={{
+					current: page,
+					pageSize: size,
+					total: query.data?.total ?? 0,
+					showSizeChanger: true,
+					pageSizeOptions: PAGE_SIZE_OPTIONS,
+					showTotal: total => t("system:oplog.total", { total }),
+					onChange: (nextPage, nextSize) => {
+						// 改每页条数后原页码可能越界：统一回第 1 页
+						if (nextSize !== size) {
+							setSize(nextSize);
+							setPage(1);
+							return;
+						}
+						setPage(nextPage);
+					},
+				}}
 			/>
 		</Space>
 	);

package/templates/src/app/web/system/pages/roles/index.tsx

@@ -1,12 +1,13 @@
-import type { SystemPermissionsGetData, SystemRolesGetData } from "../../__client/api";
+import type { SystemPermissionsGetData, SystemRolesGetData } from "../../__client";
 
 import { useQuery } from "@tanstack/react-query";
 import { Alert, Space, Table, Tabs, Tag } from "antd";
 import { useTranslation } from "react-i18next";
 
-import { systemPermissionsGet, systemRolesGet } from "../../__client/api";
+import { systemPermissionsGet, systemRolesGet } from "../../__client";
 import { isForbidden } from "../errors";
 import { ForbiddenPanel } from "../forbidden";
+import { visibleRoles } from "./visible-roles";
 
 type RoleRow = SystemRolesGetData[number];
 type PermRow = SystemPermissionsGetData[number];
@@ -19,6 +20,7 @@ export default function RolesPage() {
 	const { t } = useTranslation();
 	const rolesQuery = useQuery({ queryKey: ["system", "roles"], queryFn: systemRolesGet });
 	const permsQuery = useQuery({ queryKey: ["system", "permissions"], queryFn: systemPermissionsGet });
+	const rows = visibleRoles(rolesQuery.data ?? []);
 
 	if ((rolesQuery.error && isForbidden(rolesQuery.error)) || (permsQuery.error && isForbidden(permsQuery.error)))
 		return <ForbiddenPanel t={t} error={rolesQuery.error ?? permsQuery.error} />;
@@ -36,7 +38,13 @@ export default function RolesPage() {
 			),
 		},
 		{ title: "module", dataIndex: "module" },
-		{ title: "title", dataIndex: "title" },
+		{
+			// R2：solution 角色带 title_key → 按当前语言实时翻译，title（安装期解析文本）兜底；
+			// custom/builtin 无 key 原样显示 title（对齐下方权限点 title_key 的渲染先例）
+			title: "title",
+			dataIndex: "title",
+			render: (_: string, row: RoleRow) => (row.title_key ? t(row.title_key, { defaultValue: row.title ?? "" }) : row.title),
+		},
 		{ title: t("system:rolesPage.holders"), dataIndex: "holders" },
 		{
 			title: t("system:rolesPage.permissions"),
@@ -75,7 +83,7 @@ export default function RolesPage() {
 					children: (
 						<>
 							<Alert style={{ marginBottom: 12 }} type="info" showIcon message={t("system:rolesPage.readonlyHint")} />
-							<Table rowKey="name" loading={rolesQuery.isLoading} dataSource={rolesQuery.data ?? []} columns={roleColumns} pagination={{ hideOnSinglePage: true }} />
+							<Table rowKey="name" loading={rolesQuery.isLoading} dataSource={rows} columns={roleColumns} pagination={{ hideOnSinglePage: true }} />
 						</>
 					),
 				},

package/templates/src/app/web/system/pages/roles/visible-roles.ts

@@ -0,0 +1,14 @@
+/**
+ * 角色展示页的可见范围（纯函数，便于用例直接钉住，不必起 React）。
+ *
+ * superadmin 是平台级角色（跨租户），不属于「站点可分配的角色目录」；列在角色页只会让人
+ * 误以为能改它的绑定，故展示层隐去。
+ *
+ * **只在这一层过滤**：后端 listRoles() 必须原样返回 superadmin——成员资格页
+ * （users/roles.tsx）还要拿它作为可授予项（仅 superadmin 可勾选，见那里的 disabled 逻辑）。
+ */
+export const HIDDEN_ROLE = "superadmin";
+
+export function visibleRoles<T extends { name: string }>(roles: readonly T[]): T[] {
+	return roles.filter(r => r.name !== HIDDEN_ROLE);
+}

package/templates/src/app/web/system/pages/settings/index.tsx

@@ -1,13 +1,13 @@
 import type { TFunction } from "i18next";
 
-import type { SystemSettingsGetData } from "../../__client/api";
+import type { SystemSettingsGetData } from "../../__client";
 
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { App, Button, Card, Input, Space, Switch, Tooltip } from "antd";
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
 
-import { systemSettingsGet, systemSettingsPut } from "../../__client/api";
+import { systemSettingsGet, systemSettingsPut } from "../../__client";
 import { explainError, isForbidden } from "../errors";
 import { ForbiddenPanel } from "../forbidden";
 

package/templates/src/app/web/system/pages/users/can-manage.ts

@@ -0,0 +1,21 @@
+/**
+ * /system/users 行级操作门禁：只有 superadmin 能改 superadmin 账号。
+ *
+ * 与后端 `domain/users.ts::assertCanManageTarget` 同一条红线（只有 superadmin 能改
+ * superadmin 的口令/状态/资料/角色）。前端这层只为「不给会 403 的按钮」——灰色可点却不
+ * 生效比报错更糟——真正的防线在服务端：admin 直打接口同样会被 403 挡住。
+ *
+ * 单独成文件是为了可测：vitest 跑在 node 环境，没有 jsdom，整页 render 不了。
+ */
+export const PLATFORM_ROLE = "superadmin";
+
+/**
+ * @param myRoles 当前登录者的角色
+ * @param targetRoles 行上用户的角色
+ * @returns 是否允许对目标账号执行管理操作（改密/启停/改资料/成员资格）
+ */
+export function canManageUser(myRoles: readonly string[], targetRoles: readonly string[]): boolean {
+	if (!targetRoles.includes(PLATFORM_ROLE))
+		return true;
+	return myRoles.includes(PLATFORM_ROLE);
+}

package/templates/src/app/web/system/pages/users/index.tsx

@@ -1,4 +1,4 @@
-import type { SystemUsersGetData } from "../../__client/api";
+import type { SystemUsersGetData } from "../../__client";
 
 import { PlusOutlined } from "@ant-design/icons";
 import { useUserStore } from "@oj-module/runtime";
@@ -9,16 +9,19 @@ import { useTranslation } from "react-i18next";
 
 import { useNavigate } from "react-router";
 
-import { systemDepartmentsGet, systemUsersForbiddenPut, systemUsersGet, systemUsersPasswordPut, systemUsersPost } from "../../__client/api";
+import { systemDepartmentsGet, systemUsersForbiddenPut, systemUsersGet, systemUsersPasswordPut, systemUsersPost } from "../../__client";
 import { buildTreeData, subtreeIds } from "../departments/tree";
 import { explainError, isForbidden } from "../errors";
 import { ForbiddenPanel } from "../forbidden";
+import { canManageUser } from "./can-manage";
 
 type UserRow = SystemUsersGetData[number];
 
 /**
  * 用户管理（C1）：GET /system/users 列表 + 建号 / 禁用切换 / 重置口令。
  * 本人行禁用一切自操作（后端 assertNotSelf 400 兜底，前端不给会失败的按钮，R3）；
+ * superadmin 行也禁用一切操作，除非当前登录者是 superadmin（红线：只有 superadmin 能改
+ * superadmin——后端 assertCanManageTarget 403 兜底，前端把按钮置灰）；
  * 成员资格入口：superadmin 与 **本租户 admin** 均可见（授予 admin 已下放到租户内，
  * 但授予 superadmin 仍只许 superadmin——见 domain/users.ts::assertMembershipAllowed）。
  * 部门列标出主部门，顶部可按部门筛选（含子部门）——筛选在前端做，名单本来就是一页全量。
@@ -117,8 +120,10 @@ export default function UsersPage() {
 						title={t("system:users.forbidden")}
 						description={`${row.username} → ${forbidden ? "false" : "true"}`}
 						onConfirm={() => forbiddenMut.mutate({ uid: row.id, forbidden: !forbidden })}
+						// 置灰的 Switch 不会触发 Popconfirm，这里只是把「为什么点不了」挡在确认框之前
+						disabled={String(row.id) === me || !canManageUser(myRoles, row.roles)}
 					>
-						<Switch size="small" checked={forbidden} disabled={String(row.id) === me} />
+						<Switch size="small" checked={forbidden} disabled={String(row.id) === me || !canManageUser(myRoles, row.roles)} />
 					</Popconfirm>
 					{row.must_change ? <Tag color="orange">{t("system:users.firstLoginHint")}</Tag> : null}
 				</Space>
@@ -127,20 +132,23 @@ export default function UsersPage() {
 		{
 			title: t("system:users.columns.actions"),
 			key: "actions",
-			render: (_: unknown, row: UserRow) => (
-				<Space>
-					<Button size="small" disabled={String(row.id) === me} onClick={() => setPwdTarget(row)}>
-						{t("system:users.resetPwd")}
-					</Button>
-					{canManageMembership
-						? (
-							<Button size="small" type="link" onClick={() => navigate(`/system/users/${row.id}/roles`)}>
-								{t("system:users.membership")}
-							</Button>
-						)
-						: null}
-				</Space>
-			),
+			render: (_: unknown, row: UserRow) => {
+				const manageable = canManageUser(myRoles, row.roles);
+				return (
+					<Space>
+						<Button size="small" disabled={String(row.id) === me || !manageable} onClick={() => setPwdTarget(row)}>
+							{t("system:users.resetPwd")}
+						</Button>
+						{canManageMembership
+							? (
+								<Button size="small" type="link" disabled={!manageable} onClick={() => navigate(`/system/users/${row.id}/roles`)}>
+									{t("system:users.membership")}
+								</Button>
+							)
+							: null}
+					</Space>
+				);
+			},
 		},
 	];
 

package/templates/src/app/web/system/pages/users/roles.tsx

@@ -6,7 +6,7 @@ import { useTranslation } from "react-i18next";
 
 import { useNavigate, useParams } from "react-router";
 
-import { systemRolesGet, systemUsersGet, systemUsersRolesPut } from "../../__client/api";
+import { systemRolesGet, systemUsersGet, systemUsersRolesPut } from "../../__client";
 import { explainError, isForbidden } from "../errors";
 import { ForbiddenPanel } from "../forbidden";
 

package/templates/src/app/web/system/routes.ts

@@ -4,7 +4,7 @@ import { SettingOutlined } from "@ant-design/icons";
 
 import { createElement, lazy } from "react";
 
-import { createSystemClient } from "./__client/api";
+import { createSystemClient } from "./__client";
 
 const Users = lazy(() => import("./pages/users"));
 const UserRoles = lazy(() => import("./pages/users/roles"));

package/templates/src/{web/web/__client/api.ts → app/web/web/__client/index.ts}

@@ -17,6 +17,9 @@ export const API_PREFIX = "/web";
 /** 认领身份前缀（契约 apiPrefix，字面等于模块目录名）：跨模块认领护栏对比基准 */
 export const MODULE_PREFIX = "/web";
 
+/** 认领方模块（web.config clientOwners 指定）：跨模块认领护栏对比基准 */
+export const MODULE_OWNER = "/app";
+
 /**
  * 模块 entry 的 onInit 里一行创建（构造即 install）：完成 apiPrefix 登记 +
  * scoped request 绑定，返回绑好前缀的端点函数集合。一模块一 client；
@@ -28,8 +31,8 @@ export function createWebClient(ctx: ModuleContext) {
 	// 单槽、卸载互相耦合；跨模块需求应由本模块创建后经 provider 暴露。
 	// 注意对比基准是 MODULE_PREFIX（目录名）而非 API_PREFIX——D-M8 映射时线上前缀
 	// 属于别的命名空间，认领身份仍按目录名。
-	if (import.meta.env.DEV && ctx.module.name !== MODULE_PREFIX.slice(1)) {
-		console.warn(`[ojm-api] 模块 "${ctx.module.name}" 正在认领 ${MODULE_PREFIX} 的 client——跨模块认领会共享 request 单槽、卸载互相耦合；应由 "${MODULE_PREFIX.slice(1)}" 模块在自身 onInit 创建，跨模块需求经 provider 暴露。`);
+	if (import.meta.env.DEV && ctx.module.name !== MODULE_OWNER.slice(1)) {
+		console.warn(`[ojm-api] 模块 "${ctx.module.name}" 正在认领 ${MODULE_PREFIX} 的 client——跨模块认领会共享 request 单槽、卸载互相耦合；应由 "${MODULE_OWNER.slice(1)}" 模块在自身 onInit 创建，跨模块需求经 provider 暴露。`);
 	}
 	ctx.register.apiPrefix(API_PREFIX);
 	bindRequest(ctx.utils.request);

package/templates/src/oj-market/web/api/defaultClient.ts

@@ -28,7 +28,7 @@ import {
 	platformMarketTrustPost,
 	platformMarketUninstallImpactGet,
 	platformMarketUninstallPost,
-} from "../../../_platform/web/__client/api";
+} from "../../../app/web/_platform/__client";
 
 // 绑定运行时 request 到生成 client 的模块级单槽（生成 client 是静态单例，必须由某处
 // bindRequest；此处兜底确保市场子应用无论挂载顺序都能拿到请求实例）。与 _platform 模块

package/templates/tests/auth-ldap.spec.ts

@@ -4,8 +4,8 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { esc, firstAttr } from "../src/auth/api/_shared/ldap";
-import { createLdapLogin } from "../src/auth/api/_shared/ldap-login";
+import { esc, firstAttr } from "../src/app/api/auth/_shared/ldap";
+import { createLdapLogin } from "../src/app/api/auth/_shared/ldap-login";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tests/auth-session.spec.ts

@@ -1,11 +1,11 @@
 // BDD：登录链——B1 登录顺序（D14 统一 401）、B2 首登改密（AC1-27）、B3 refresh 轮换/reuse 检测（AC1-13）、B4 JWT 仅 sub。
 // deps 全注入（Node 侧 crypto 只读不可 stub，设计 §9.1）；fake bcrypt 以 `hashed:<pw>` 为口令哈希约定。
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
-import type { SessionDeps } from "../src/auth/api/_shared/session";
+import type { SessionDeps } from "../src/app/api/auth/_shared/session";
 
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
-import { assertPermission } from "../src/_platform/api/_shared/service/infra/access";
-import { createSession } from "../src/auth/api/_shared/session";
+import { assertPermission } from "../src/app/api/_platform/_shared/service/infra/access";
+import { createSession } from "../src/app/api/auth/_shared/session";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tests/auth-throttle.spec.ts

@@ -5,7 +5,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { loginBlocked, loginFailed, loginSucceeded, resetLoginThrottle } from "../src/_platform/api/_shared/service/infra/rate";
+import { loginBlocked, loginFailed, loginSucceeded, resetLoginThrottle } from "../src/app/api/_platform/_shared/service/infra/rate";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tests/fixture.ts

@@ -1,6 +1,6 @@
 // 后端 BDD 夹具：node:sqlite 内存库 + **真实迁移文件**建表，装到 globalThis.db——
 // 与 oj 运行时注入的全局同名同面，service 代码不改一行即可被测。
-// 夹具直接读 src/<模块>/api/migrations/*.sql，与迁移不可能漂移（沿用 oj-wiki 先例）。
+// 夹具直接读 src/app/api/<模块>/migrations/*.sql，与迁移不可能漂移（沿用 oj-wiki 先例）。
 //
 // **构造器垫片（db.table / listTables）**：oj 的构造器是二进制内的 Rust 实现，Node 侧无可复用
 // 模块，故这里按手册契约（oj-api-dev api-manual「查询构造器」）写一层**最小 JS 渲染层**——
@@ -33,6 +33,8 @@ const { join, dirname } = req("node:path");
 const { fileURLToPath } = req("node:url");
 
 const SRC = join(dirname(fileURLToPath(import.meta.url)), "..", "src");
+/** 后端模块根（0.2.55 布局：`src/app/api/<模块>`）；迁移按目录发现，不在夹具里抄模块清单。 */
+const API_ROOT = join(SRC, "app", "api");
 
 export const ADMIN = 1;
 
@@ -465,9 +467,9 @@ function listTables(dbo: any, prefix?: string): string[] {
 /** 建内存库 + 注入全局；返回 DatabaseSync 供用例直插数据/断言。 */
 export function installDb(): any {
 	const dbo = new DatabaseSync(":memory:");
-	// 重放 src 下全部模块的迁移（方言专属文件除外）
-	for (const mod of readdirSync(SRC)) {
-		const dir = join(SRC, mod, "api", "migrations");
+	// 重放 src/app/api 下全部模块的迁移（方言专属文件除外）
+	for (const mod of readdirSync(API_ROOT)) {
+		const dir = join(API_ROOT, mod, "migrations");
 		if (!existsSync(dir))
 			continue;
 		for (const f of readdirSync(dir).filter((f: string) => f.endsWith(".sql") && !/\.(?:mysql|pg)\.sql$/.test(f)).sort())

package/templates/tests/guard.spec.ts

@@ -3,7 +3,7 @@
 // （真实迁移建表 / 运行时全局 db 同面 / 事务往返）——S0 spike 的「一条真实判权 AC + 形态证明」。
 import { beforeAll, describe, expect, it } from "vitest";
 
-import { decideAccess, moduleOf } from "../src/_platform/api/_shared/service/infra/guard";
+import { decideAccess, moduleOf } from "../src/app/api/_platform/_shared/service/infra/guard";
 import { ADMIN, installDb } from "./fixture";
 
 const as = (roles: string[], bindings: Record<string, string[]> = {}) => ({ roles, bindings });

package/templates/tests/lifecycle/atomic-state.spec.ts

@@ -4,14 +4,14 @@
 // 只保证读回自己写出的内容；任何不符格式的字节一律视为损坏 → 空状态，损坏上下文并入
 // 读结果（corruptNote 出口，禁 console——release isolate console 抛 BadResource，Finding A）。
 // fs 依赖经 globalThis.fs 注入（平台 isolate 注入 FsApi；测试注入 node:fs/promises 适配）。
-import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
+import type { FsFace } from "../../src/app/api/_platform/_lifecycle/atomic";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { atomicWriteText } from "../../src/_platform/api/_lifecycle/atomic";
-import { createStateStore } from "../../src/_platform/api/_lifecycle/state";
+import { atomicWriteText } from "../../src/app/api/_platform/_lifecycle/atomic";
+import { createStateStore } from "../../src/app/api/_platform/_lifecycle/state";
 
 const g = globalThis as any;
 

package/templates/tests/lifecycle/bootstrap.spec.ts

@@ -5,14 +5,14 @@
 //    与 PEM 私钥块实体（header 后跟 ≥100 字符 base64 体；tasks.ts redact 正则与测试假体
 //    体长 <100 不误伤）双口径扫描。
 // ③ 集成（market-api.spec）：信任库为空 + bootstrapKey 注入 → cdn 安装直达 done 不落 needs_trust。
-import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
+import type { FsFace } from "../../src/app/api/_platform/_lifecycle/atomic";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { createTrustStore } from "../../src/_platform/api/_lifecycle/trust";
-import { BOOTSTRAP_KEY, seedBootstrapKey } from "../../src/_platform/api/market/bootstrap";
+import { createTrustStore } from "../../src/app/api/_platform/_lifecycle/trust";
+import { BOOTSTRAP_KEY, seedBootstrapKey } from "../../src/app/api/_platform/market/bootstrap";
 
 const g = globalThis as any;
 

package/templates/tests/lifecycle/deploy-smoke.spec.ts

@@ -8,19 +8,19 @@
 // 快照逐数组 ⊇ 声明，少 = 注册丢失判失败）collect-all 全败齐报。
 // entry 浏览器加载不在安装器验（Node import 必假绿——设计 §4.1），注释钉口径。
 // fetch/sha384/query/reload 面经 ctx 注入 stub（同 steps-fs 范式），fs 为 globalThis.fs 面。
-import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
-import type { StateStore } from "../../src/_platform/api/_lifecycle/state";
-import type { DeployWebContext, ModuleEntry } from "../../src/_platform/api/_lifecycle/steps/deploy-web";
-import type { ReloadContext, ReloadFace, ReloadResult } from "../../src/_platform/api/_lifecycle/steps/reload";
-import type { SmokeContext } from "../../src/_platform/api/_lifecycle/steps/smoke";
+import type { FsFace } from "../../src/app/api/_platform/_lifecycle/atomic";
+import type { StateStore } from "../../src/app/api/_platform/_lifecycle/state";
+import type { DeployWebContext, ModuleEntry } from "../../src/app/api/_platform/_lifecycle/steps/deploy-web";
+import type { ReloadContext, ReloadFace, ReloadResult } from "../../src/app/api/_platform/_lifecycle/steps/reload";
+import type { SmokeContext } from "../../src/app/api/_platform/_lifecycle/steps/smoke";
 import { createHash } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { deployWeb, posixPath, upsertModulesJson } from "../../src/_platform/api/_lifecycle/steps/deploy-web";
-import { reloadAndAssert } from "../../src/_platform/api/_lifecycle/steps/reload";
-import { probeUrlOf, smoke } from "../../src/_platform/api/_lifecycle/steps/smoke";
+import { deployWeb, posixPath, upsertModulesJson } from "../../src/app/api/_platform/_lifecycle/steps/deploy-web";
+import { reloadAndAssert } from "../../src/app/api/_platform/_lifecycle/steps/reload";
+import { probeUrlOf, smoke } from "../../src/app/api/_platform/_lifecycle/steps/smoke";
 
 const g = globalThis as any;
 

package/templates/tests/lifecycle/installer.spec.ts

@@ -12,22 +12,22 @@
 // 过期（30min）可接管。setEnabled 四处同写（D12/AC-P1-6）：锁摘除/恢复 + sidecar + route + modules。
 // 步骤面全 stub 注入（DIP）：fetch/exec/tar/reload 不真跑；register/smoke/audit 走真实内存库夹具。
 /* eslint-disable test/prefer-lowercase-title -- 任务/AC 编号是验收锚点，保留大写（register.spec 同约定） */
-import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
-import type { InstallRequest } from "../../src/_platform/api/_lifecycle/installer";
-import type { StateStore } from "../../src/_platform/api/_lifecycle/state";
-import type { ExecFace } from "../../src/_platform/api/_lifecycle/steps/extract";
+import type { FsFace } from "../../src/app/api/_platform/_lifecycle/atomic";
+import type { InstallRequest } from "../../src/app/api/_platform/_lifecycle/installer";
+import type { StateStore } from "../../src/app/api/_platform/_lifecycle/state";
+import type { ExecFace } from "../../src/app/api/_platform/_lifecycle/steps/extract";
 import { createHash } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { defaultTestKey, nodeVerifyEd25519, signedArchiveFor } from "../../../src/lifecycle/__tests__/helpers";
-import { atomicWriteText } from "../../src/_platform/api/_lifecycle/atomic";
-import { gcVersions, reconcile, runInstall, setEnabled, STAGES } from "../../src/_platform/api/_lifecycle/installer";
-import { acquireTaskLock, commitLockEntry, parseLock, readLock, serializeLock, writeLock } from "../../src/_platform/api/_lifecycle/lock";
-import { createStateStore } from "../../src/_platform/api/_lifecycle/state";
-import { getTask, readTasks, redact, sweepTimedOut, writeTask } from "../../src/_platform/api/_lifecycle/tasks";
-import { createTrustStore } from "../../src/_platform/api/_lifecycle/trust";
+import { atomicWriteText } from "../../src/app/api/_platform/_lifecycle/atomic";
+import { gcVersions, reconcile, runInstall, setEnabled, STAGES } from "../../src/app/api/_platform/_lifecycle/installer";
+import { acquireTaskLock, commitLockEntry, parseLock, readLock, serializeLock, writeLock } from "../../src/app/api/_platform/_lifecycle/lock";
+import { createStateStore } from "../../src/app/api/_platform/_lifecycle/state";
+import { getTask, readTasks, redact, sweepTimedOut, writeTask } from "../../src/app/api/_platform/_lifecycle/tasks";
+import { createTrustStore } from "../../src/app/api/_platform/_lifecycle/trust";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;

package/templates/tests/lifecycle/market-api.spec.ts

@@ -7,11 +7,11 @@
 // 简报 `task/:id` 段参数形态在模板 http 面无先例（contacts/detail?id= 同款 query 惯例），备案于任务报告。
 // 步骤面全 stub 注入（DIP）：fetch/exec/reload 不真跑；register/smoke/audit 走真实内存库夹具。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（installer.spec 同约定） */
-import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
-import type { FetchFace } from "../../src/_platform/api/_lifecycle/steps/download";
-import type { ExecFace } from "../../src/_platform/api/_lifecycle/steps/extract";
-import type { ReloadFace } from "../../src/_platform/api/_lifecycle/steps/reload";
-import type { MarketEnv } from "../../src/_platform/api/market/api";
+import type { FsFace } from "../../src/app/api/_platform/_lifecycle/atomic";
+import type { FetchFace } from "../../src/app/api/_platform/_lifecycle/steps/download";
+import type { ExecFace } from "../../src/app/api/_platform/_lifecycle/steps/extract";
+import type { ReloadFace } from "../../src/app/api/_platform/_lifecycle/steps/reload";
+import type { MarketEnv } from "../../src/app/api/_platform/market/api";
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import * as fsp from "node:fs/promises";
@@ -22,14 +22,14 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { parse } from "yaml";
 import { defaultTestKey, nodeVerifyEd25519, signedArchiveFor } from "../../../src/lifecycle/__tests__/helpers";
 import { signIndex } from "../../../src/publish";
-import { readLock, writeLock } from "../../src/_platform/api/_lifecycle/lock";
-import { compareVersions } from "../../src/_platform/api/_lifecycle/semver";
-import { createStateStore } from "../../src/_platform/api/_lifecycle/state";
-import { getTask, writeTask } from "../../src/_platform/api/_lifecycle/tasks";
-import { createTrustStore } from "../../src/_platform/api/_lifecycle/trust";
-import { invalidateAllUsers } from "../../src/_platform/api/_shared/service/infra/access";
-import { createMarketApi, marketEnv, parseVersionsJson, versionsJsonPathOf } from "../../src/_platform/api/market/api";
-import { localIndexSource } from "../../src/_platform/api/market/index-source";
+import { readLock, writeLock } from "../../src/app/api/_platform/_lifecycle/lock";
+import { compareVersions } from "../../src/app/api/_platform/_lifecycle/semver";
+import { createStateStore } from "../../src/app/api/_platform/_lifecycle/state";
+import { getTask, writeTask } from "../../src/app/api/_platform/_lifecycle/tasks";
+import { createTrustStore } from "../../src/app/api/_platform/_lifecycle/trust";
+import { invalidateAllUsers } from "../../src/app/api/_platform/_shared/service/infra/access";
+import { createMarketApi, marketEnv, parseVersionsJson, versionsJsonPathOf } from "../../src/app/api/_platform/market/api";
+import { localIndexSource } from "../../src/app/api/_platform/market/index-source";
 import { installDb } from "../fixture";
 
 function hexToBytes(hex: string): Uint8Array {
@@ -305,7 +305,7 @@ describe("权限门（R9：市场编排 superadmin 独占，meta 登录即可）
 	it("pair-pin：meta apiVersion === _platform/manifest.yaml version（手工镜像漂移防护，P2-9）", async () => {
 		// API_VERSION（market/api.ts）与 _platform/manifest.yaml version 为手工同步的双真源；
 		// 本测试经 meta 端点间接钉住 API_VERSION，漂移即红（peerPlatform 预检口径失真）。
-		const manifestPath = join(dirname(fileURLToPath(import.meta.url)), "../../src/_platform/api/manifest.yaml");
+		const manifestPath = join(dirname(fileURLToPath(import.meta.url)), "../../src/app/api/_platform/manifest.yaml");
 		const manifestVersion = (parse(readFileSync(manifestPath, "utf8")) as { version: string }).version;
 		const api = createMarketApi(makeEnv());
 		g.http = { user: { id: 1 } };

package/templates/tests/lifecycle/migrate.spec.ts

@@ -7,16 +7,16 @@
 // rollbackGuard 纯函数：目标产物 max seq < 账本 head = 降版部署，禁止（OJ-9/M003 同源红线）；
 // seq 为数值非版本号，直接数值比较（semver.ts 不适用）。
 // exec/fs 面注入 stub（同 steps-fs 范式），不真跑 oj/sqlite。
-import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
-import type { StateStore } from "../../src/_platform/api/_lifecycle/state";
-import type { ExecFace } from "../../src/_platform/api/_lifecycle/steps/extract";
-import type { MigrateContext } from "../../src/_platform/api/_lifecycle/steps/migrate";
+import type { FsFace } from "../../src/app/api/_platform/_lifecycle/atomic";
+import type { StateStore } from "../../src/app/api/_platform/_lifecycle/state";
+import type { ExecFace } from "../../src/app/api/_platform/_lifecycle/steps/extract";
+import type { MigrateContext } from "../../src/app/api/_platform/_lifecycle/steps/migrate";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { parseLock } from "../../src/_platform/api/_lifecycle/lock";
-import { buildMigrateCmd, maxAppliedSeq, migrate, migrateSvcDirOf, parseMigrateOutput, rollbackGuard } from "../../src/_platform/api/_lifecycle/steps/migrate";
+import { parseLock } from "../../src/app/api/_platform/_lifecycle/lock";
+import { buildMigrateCmd, maxAppliedSeq, migrate, migrateSvcDirOf, parseMigrateOutput, rollbackGuard } from "../../src/app/api/_platform/_lifecycle/steps/migrate";
 
 const g = globalThis as any;
 const DB_BYTES = new TextEncoder().encode("sqlite-header-bytes\n");