@oj-module/cli 0.2.54 → 0.2.57

package/templates/tests/lifecycle/preflight.spec.ts

@@ -1,5 +1,5 @@
-import type { SolutionState, StateStore } from "../../src/_platform/api/_lifecycle/state";
-import type { InstallContext } from "../../src/_platform/api/_lifecycle/steps/preflight";
+import type { SolutionState, StateStore } from "../../src/app/api/_platform/_lifecycle/state";
+import type { InstallContext } from "../../src/app/api/_platform/_lifecycle/steps/preflight";
 // BDD：安装预检规则引擎（P1-5，R7/R8/R9/R24，十阶段状态机 stage 1）。
 // 规则真源：docs/prd/solution/202610171254-lifecycle-manifest-contract.md（C2-01~33 安装列）；
 // 期望真源：packages/cli/src/lifecycle/__tests__/fixtures/（fixture-valid 零违规、fixture-invalid 七码齐报）。
@@ -12,7 +12,7 @@ import { fileURLToPath } from "node:url";
 
 import { describe, expect, it } from "vitest";
 import { parse } from "yaml";
-import { preflight } from "../../src/_platform/api/_lifecycle/steps/preflight";
+import { preflight } from "../../src/app/api/_platform/_lifecycle/steps/preflight";
 
 const FIXTURES = join(dirname(fileURLToPath(import.meta.url)), "../../../src/lifecycle/__tests__/fixtures");
 const VALID = parse(readFileSync(join(FIXTURES, "fixture-valid/manifest.yaml"), "utf8")) as any;

package/templates/tests/lifecycle/register.spec.ts

@@ -8,7 +8,7 @@
 /* eslint-disable test/prefer-lowercase-title -- 任务/AC 编号是验收锚点，保留大写（DB/P1-5） */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { checkOccupancy, queryAllRegistered, queryRegistered, registerSolution } from "../../src/_platform/api/_lifecycle/steps/register";
+import { checkOccupancy, queryAllRegistered, queryRegistered, registerSolution } from "../../src/app/api/_platform/_lifecycle/steps/register";
 import { installDb } from "../fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tests/lifecycle/role-title-translate.spec.ts

@@ -0,0 +1,171 @@
+// BDD：solution 角色 title 落库时同步翻译（R1–R6，计划 docs/plans/20261103-0948-role-title-translate）。
+// title = 解析文本（站点默认语言）、title_key = 原文（UI 实时翻译锚）；解析失败回退裸 key，
+// 绝不失败安装（R1）；升级元数据覆盖 = 重解析（R3）；迁移 0018 对存量 solution 角色回填、
+// builtin 不动（R2/AC4）；sys_permission 不变（R5）；name/code/绑定不变（R6）。
+/* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写（register.spec 同约定） */
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { afterEach, beforeAll, describe, expect, it } from "vitest";
+import { registerSolution, resolveDeclTitles, siteLanguage } from "../../src/app/api/_platform/_lifecycle/steps/register";
+import { installDb } from "../fixture";
+
+const req = createRequire(import.meta.url);
+const { DatabaseSync } = req("node:sqlite");
+const { readFileSync } = req("node:fs");
+const { dirname, join } = req("node:path");
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const enc = new TextEncoder();
+
+let dbo: ReturnType<typeof installDb>;
+const g = globalThis as any;
+
+beforeAll(() => {
+	dbo = installDb();
+	g.http = {};
+});
+
+afterEach(() => {
+	g.http = {};
+	dbo.exec("DELETE FROM sys_role_permission");
+	dbo.exec("DELETE FROM sys_user_role");
+	dbo.exec("DELETE FROM sys_permission");
+	dbo.exec("DELETE FROM sys_role");
+	dbo.exec("DELETE FROM sys_solution_route");
+	dbo.exec("DELETE FROM sys_setting");
+	dbo.exec("DELETE FROM sys_oplog");
+});
+
+function roleRows() {
+	return dbo.prepare("SELECT name, title, title_key FROM sys_role ORDER BY name").all() as Array<{ name: string, title: string | null, title_key: string | null }>;
+}
+
+/** readFile 假面：包内 locales 按路径精确映射，未命中即「文件不存在」 */
+function fakeReadFile(staging: string, files: Record<string, string>) {
+	return async (p: string) => {
+		const hit = files[p];
+		if (hit === undefined)
+			throw new Error(`ENOENT: ${p}`);
+		return enc.encode(hit);
+	};
+}
+
+const STAGING = "/staging";
+const PM_LOCALES = {
+	[`${STAGING}/web/modules/pm/locales/zh-CN.json`]: JSON.stringify({ role: { sales: "销售", admin: "方案管理员" } }),
+	[`${STAGING}/web/modules/pm/locales/en-US.json`]: JSON.stringify({ role: { sales: "Sales", admin: "Solution Admin" } }),
+};
+
+function pmDecl(title: string) {
+	return {
+		module: "pm",
+		version: "1.0.0",
+		roles: [{ name: "pm.sales", title, title_key: title, permissions: ["pm.doc.create"] as string[] }],
+		permissions: ["pm.doc.create"],
+	};
+}
+
+describe("R4 语言取值", () => {
+	it("缺省 zh-CN（sys_setting 无 site.language 行）", async () => {
+		expect(await siteLanguage()).toBe("zh-CN");
+	});
+
+	it("站点设置 site.language 生效（R4：站点默认语言）", async () => {
+		await g.db.table("sys_setting").insert({ key: "site.language", module: "framework", group: "site", type: "string", value: "en-US", update_time: Date.now(), deprecated: 0 }).run();
+		expect(await siteLanguage()).toBe("en-US");
+	});
+});
+
+describe("R1 注册时解析（resolveDeclTitles）", () => {
+	it("AC1 首装：title_key 解析为站点语言 locale 文本", async () => {
+		const resolved = await resolveDeclTitles(pmDecl("pm:role.sales"), STAGING, "zh-CN", fakeReadFile(STAGING, PM_LOCALES));
+		expect(resolved.roles[0]!.title).toBe("销售");
+		expect(resolved.roles[0]!.title_key).toBe("pm:role.sales");
+	});
+
+	it("R4：语言参数决定读取的 locale 文件", async () => {
+		const resolved = await resolveDeclTitles(pmDecl("pm:role.sales"), STAGING, "en-US", fakeReadFile(STAGING, PM_LOCALES));
+		expect(resolved.roles[0]!.title).toBe("Sales");
+	});
+
+	it("AC3 缺 key：保留裸 key（title 原样），绝不抛错", async () => {
+		const files = { [`${STAGING}/web/modules/pm/locales/zh-CN.json`]: JSON.stringify({ role: { sales: "销售" } }) };
+		const resolved = await resolveDeclTitles(pmDecl("pm:role.admin"), STAGING, "zh-CN", fakeReadFile(STAGING, files));
+		expect(resolved.roles[0]!.title).toBe("pm:role.admin");
+	});
+
+	it("R1 边界：locale 文件缺失 / 坏 JSON / 非 string 值 / 空 key 形状不符 → 原文保留", async () => {
+		const noFile = await resolveDeclTitles(pmDecl("pm:role.sales"), STAGING, "zh-CN", fakeReadFile(STAGING, {}));
+		expect(noFile.roles[0]!.title).toBe("pm:role.sales");
+
+		const badJson = await resolveDeclTitles(pmDecl("pm:role.sales"), STAGING, "zh-CN", fakeReadFile(STAGING, { [`${STAGING}/web/modules/pm/locales/zh-CN.json`]: "{not-json" }));
+		expect(badJson.roles[0]!.title).toBe("pm:role.sales");
+
+		const nonString = await resolveDeclTitles(pmDecl("pm:role.sales"), STAGING, "zh-CN", fakeReadFile(STAGING, { [`${STAGING}/web/modules/pm/locales/zh-CN.json`]: JSON.stringify({ role: { sales: 42 } }) }));
+		expect(nonString.roles[0]!.title).toBe("pm:role.sales");
+
+		// 非 key 形状（中文文本）不做解析尝试——已解析文本二次注册不被误改
+		const plain = await resolveDeclTitles(pmDecl("销售"), STAGING, "zh-CN", fakeReadFile(STAGING, PM_LOCALES));
+		expect(plain.roles[0]!.title).toBe("销售");
+	});
+
+	it("R1 边界：ns ≠ 模块名不越界解析（跨 ns 无本包 locale）", async () => {
+		const decl = { ...pmDecl("wiki:role.sales"), module: "pm" };
+		const resolved = await resolveDeclTitles(decl, STAGING, "zh-CN", fakeReadFile(STAGING, PM_LOCALES));
+		expect(resolved.roles[0]!.title).toBe("wiki:role.sales");
+	});
+});
+
+describe("R1–R3 落库（registerSolution 消费解析后的 decl）", () => {
+	it("AC1 首装：sys_role 落 (title=销售, title_key=pm:role.sales)，权限点照常", async () => {
+		const resolved = await resolveDeclTitles(pmDecl("pm:role.sales"), STAGING, "zh-CN", fakeReadFile(STAGING, PM_LOCALES));
+		const r = await registerSolution(resolved);
+		expect(r.ok).toBe(true);
+		const rows = roleRows();
+		expect(rows).toEqual([{ name: "pm.sales", title: "销售", title_key: "pm:role.sales" }]);
+		const perms = dbo.prepare("SELECT code FROM sys_permission").all() as Array<{ code: string }>;
+		expect(perms.map(p => p.code)).toEqual(["pm.doc.create"]);
+	});
+
+	it("AC2 升级：元数据覆盖写新解析文本 + title_key 刷新（R3 locale 改进随升级传播）", async () => {
+		await registerSolution(await resolveDeclTitles(pmDecl("pm:role.sales"), STAGING, "zh-CN", fakeReadFile(STAGING, PM_LOCALES)));
+		const improved = fakeReadFile(STAGING, { [`${STAGING}/web/modules/pm/locales/zh-CN.json`]: JSON.stringify({ role: { sales: "销售冠军" } }) });
+		const r = await registerSolution(await resolveDeclTitles(pmDecl("pm:role.sales"), STAGING, "zh-CN", improved));
+		expect(r.ok).toBe(true);
+		expect(roleRows()).toEqual([{ name: "pm.sales", title: "销售冠军", title_key: "pm:role.sales" }]);
+	});
+
+	it("AC3 缺 key：注册不失败，title = 裸 key（现行回退形态）", async () => {
+		const r = await registerSolution(await resolveDeclTitles(pmDecl("pm:role.viewer"), STAGING, "zh-CN", fakeReadFile(STAGING, PM_LOCALES)));
+		expect(r.ok).toBe(true);
+		expect(roleRows()).toEqual([{ name: "pm.sales", title: "pm:role.viewer", title_key: "pm:role.viewer" }]);
+	});
+});
+
+describe("R2 迁移 0018（sys_role.title_key 回填）", () => {
+	it("AC4 夹具真实迁移后 sys_role 带 title_key 列（列进库 ↔ schema.yaml 一致守卫的库侧半边）", () => {
+		const cols = (dbo.prepare("PRAGMA table_info(sys_role)").all() as Array<{ name: string }>).map(c => c.name);
+		expect(cols).toContain("title_key");
+	});
+
+	it("AC4 存量 solution 角色按 key 形状回填，builtin 角色不动、title 原文不改", () => {
+		const raw = new DatabaseSync(":memory:");
+		raw.exec(`
+			CREATE TABLE sys_role (
+				name TEXT PRIMARY KEY, module TEXT NOT NULL, title TEXT, description TEXT,
+				builtin INTEGER NOT NULL DEFAULT 0, deprecated INTEGER NOT NULL DEFAULT 0
+			);
+			INSERT INTO sys_role (name, module, title, builtin) VALUES
+				('pm.sales', 'pm', 'pm:role.sales', 0),
+				('wiki.admin', 'wiki', 'wiki:role.admin', 0),
+				('admin', 'framework', '系统管理员', 1);
+		`);
+		raw.exec(readFileSync(join(HERE, "../../src/app/api/_platform/migrations/0018__sys_role_title_key.sql"), "utf8"));
+		const rows = raw.prepare("SELECT name, title, title_key FROM sys_role ORDER BY name").all() as Array<{ name: string, title: string, title_key: string | null }>;
+		expect(rows).toEqual([
+			{ name: "admin", title: "系统管理员", title_key: null },
+			{ name: "pm.sales", title: "pm:role.sales", title_key: "pm:role.sales" },
+			{ name: "wiki.admin", title: "wiki:role.admin", title_key: "wiki:role.admin" },
+		]);
+	});
+});

package/templates/tests/lifecycle/semver.spec.ts

@@ -3,7 +3,7 @@
 // 无 prerelease > 有 prerelease；「1.0」「1.0.0」「1.0.0.0」视为相等（安装器容错口径）。
 import { describe, expect, it } from "vitest";
 
-import { compareVersions } from "../../src/_platform/api/_lifecycle/semver";
+import { compareVersions } from "../../src/app/api/_platform/_lifecycle/semver";
 
 const cases: Array<[a: string, b: string, expected: -1 | 0 | 1]> = [
 	// 主版本数值比较（非字典序）

package/templates/tests/lifecycle/sha384.spec.ts

@@ -4,7 +4,7 @@
 import { Buffer } from "node:buffer";
 import { createHash } from "node:crypto";
 import { describe, expect, it } from "vitest";
-import { bytesToBase64, sha384B64, sha384Bytes } from "../../src/_platform/api/_lifecycle/sha384";
+import { bytesToBase64, sha384B64, sha384Bytes } from "../../src/app/api/_platform/_lifecycle/sha384";
 
 const hex = (bytes: Uint8Array): string => Array.from(bytes, b => b.toString(16).padStart(2, "0")).join("");
 

package/templates/tests/lifecycle/solutions-api.spec.ts

@@ -5,7 +5,7 @@
 /* eslint-disable test/prefer-lowercase-title -- 端点路径是验收锚点 */
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
-import api from "../../src/_platform/api/solutions/api";
+import api from "../../src/app/api/_platform/solutions/api";
 import { installDb } from "../fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tests/lifecycle/source-seq.spec.ts

@@ -4,7 +4,7 @@
 // 四条负向是 G7 的重点：水位写坏 / 表不存在 / 值非法都必须**拒**，不能静默当「第一次见」——
 // 静默重置等于把「防回放」降级成「每次都当第一次见」，攻击者先破坏状态再回放即可穿透。
 import { beforeEach, describe, expect, it } from "vitest";
-import { guardAndRecordSourceSeq, readSourceSeq, SOURCE_SEQ_TABLE } from "../../src/_platform/api/_lifecycle/source-seq";
+import { guardAndRecordSourceSeq, readSourceSeq, SOURCE_SEQ_TABLE } from "../../src/app/api/_platform/_lifecycle/source-seq";
 import { installDb } from "../fixture";
 
 const SRC = "https://cdn.example.com/solutions";

package/templates/tests/lifecycle/steps-fs.spec.ts

@@ -6,11 +6,11 @@
 // 命令构造为纯函数，argv 逐字断言（与平台 exec 白名单逐字对齐，S1-2 基座）；
 // exec/fetch/sha256 面经 ctx 注入 stub，不真跑网络；合法夹具集成用例的 exec stub 落到真实系统 tar
 // （与生产同路径：isolate 不内嵌解压，exec.run 系统 tar）。
-import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
-import type { StateStore } from "../../src/_platform/api/_lifecycle/state";
-import type { DownloadContext } from "../../src/_platform/api/_lifecycle/steps/download";
-import type { ExecFace, ExtractContext } from "../../src/_platform/api/_lifecycle/steps/extract";
-import type { VerifyContext } from "../../src/_platform/api/_lifecycle/steps/verify";
+import type { FsFace } from "../../src/app/api/_platform/_lifecycle/atomic";
+import type { StateStore } from "../../src/app/api/_platform/_lifecycle/state";
+import type { DownloadContext } from "../../src/app/api/_platform/_lifecycle/steps/download";
+import type { ExecFace, ExtractContext } from "../../src/app/api/_platform/_lifecycle/steps/extract";
+import type { VerifyContext } from "../../src/app/api/_platform/_lifecycle/steps/verify";
 import { execFile as execFileCb } from "node:child_process";
 import { createHash } from "node:crypto";
 import * as fsp from "node:fs/promises";
@@ -19,10 +19,10 @@ import { join } from "node:path";
 import { promisify } from "node:util";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import { defaultTestKey, nodeVerifyEd25519, signedArchiveFor } from "../../../src/lifecycle/__tests__/helpers";
-import { archiveFileOf, download } from "../../src/_platform/api/_lifecycle/steps/download";
-import { buildExtractCmd, buildListCmd, checkModuleManifest, extract } from "../../src/_platform/api/_lifecycle/steps/extract";
-import { verify } from "../../src/_platform/api/_lifecycle/steps/verify";
-import { createTrustStore } from "../../src/_platform/api/_lifecycle/trust";
+import { archiveFileOf, download } from "../../src/app/api/_platform/_lifecycle/steps/download";
+import { buildExtractCmd, buildListCmd, checkModuleManifest, extract } from "../../src/app/api/_platform/_lifecycle/steps/extract";
+import { verify } from "../../src/app/api/_platform/_lifecycle/steps/verify";
+import { createTrustStore } from "../../src/app/api/_platform/_lifecycle/trust";
 
 const execFileP = promisify(execFileCb);
 const g = globalThis as any;

package/templates/tests/lifecycle/text-edit.spec.ts

@@ -5,7 +5,7 @@
 import * as fsp from "node:fs/promises";
 import { describe, expect, it } from "vitest";
 
-import { appendAnonymousPaths, bumpInstallSeq, ensureReloadApi, hasAnchor, insertAnchor } from "../../src/_platform/api/_lifecycle/text-edit";
+import { appendAnonymousPaths, bumpInstallSeq, ensureReloadApi, hasAnchor, insertAnchor } from "../../src/app/api/_platform/_lifecycle/text-edit";
 
 describe("insertAnchor（R18）", () => {
 	it("带注释的 config.yaml 插入后注释/缩进/空行/键序逐字保留", () => {

package/templates/tests/lifecycle/tgz-guard.spec.ts

@@ -4,8 +4,8 @@
 // 拒绝：绝对路径、任何 `..` 段、l/h 条目、空成员名、反斜杠路径；`./` 前缀相对合法。
 import { describe, expect, it } from "vitest";
 
-import { MAX_ENTRIES, MAX_PACKAGE_BYTES, MAX_SINGLE_ENTRY_BYTES, MAX_UNPACKED_BYTES } from "../../src/_platform/api/_lifecycle/limits";
-import { accumulateTarVolume, checkTarVolumeLimits, extractTarEntrySize, validateTarListing } from "../../src/_platform/api/_lifecycle/tgz-guard";
+import { MAX_ENTRIES, MAX_PACKAGE_BYTES, MAX_SINGLE_ENTRY_BYTES, MAX_UNPACKED_BYTES } from "../../src/app/api/_platform/_lifecycle/limits";
+import { accumulateTarVolume, checkTarVolumeLimits, extractTarEntrySize, validateTarListing } from "../../src/app/api/_platform/_lifecycle/tgz-guard";
 
 describe("validateTarListing（R1）", () => {
 	it("正常成员列表通过", () => {

package/templates/tests/lifecycle/trust.spec.ts

@@ -2,17 +2,17 @@
 // store 层：空库/幂等/首次绑定不可改/多 key/吊销/损坏 fail-closed/.bak 回落/并发读不见半截/审计。
 // 端点层：GET /market/trust、POST /market/trust/key、DELETE /market/trust/key?key_id=（del 动词 + query，system/roles 同款先例）。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（market-api.spec 同约定） */
-import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
-import type { MarketEnv } from "../../src/_platform/api/market/api";
+import type { FsFace } from "../../src/app/api/_platform/_lifecycle/atomic";
+import type { MarketEnv } from "../../src/app/api/_platform/market/api";
 import { Buffer } from "node:buffer";
 import { createHash } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { createTrustStore, isValidKeyId } from "../../src/_platform/api/_lifecycle/trust";
-import { invalidateAllUsers } from "../../src/_platform/api/_shared/service/infra/access";
-import { createMarketApi, marketEnv } from "../../src/_platform/api/market/api";
+import { createTrustStore, isValidKeyId } from "../../src/app/api/_platform/_lifecycle/trust";
+import { invalidateAllUsers } from "../../src/app/api/_platform/_shared/service/infra/access";
+import { createMarketApi, marketEnv } from "../../src/app/api/_platform/market/api";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;

package/templates/tests/lifecycle/uninstall.spec.ts

@@ -5,17 +5,17 @@
 // 夹具：本仓范式（node:sqlite 真实迁移建表 + 真实 fs 面 g.fs）；market_history 表由平台迁移
 // 0012（IF NOT EXISTS）随 installDb 重放建立，守卫语义（表不存在静默跳过）单列一例。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（market-api.spec 同约定） */
-import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
-import type { MarketEnv } from "../../src/_platform/api/market/api";
+import type { FsFace } from "../../src/app/api/_platform/_lifecycle/atomic";
+import type { MarketEnv } from "../../src/app/api/_platform/market/api";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { readLock, writeLock } from "../../src/_platform/api/_lifecycle/lock";
-import { createStateStore } from "../../src/_platform/api/_lifecycle/state";
-import { collectRetainedTables, moduleTablePrefix } from "../../src/_platform/api/_lifecycle/uninstall";
-import { invalidateAllUsers } from "../../src/_platform/api/_shared/service/infra/access";
-import { createMarketApi } from "../../src/_platform/api/market/api";
+import { readLock, writeLock } from "../../src/app/api/_platform/_lifecycle/lock";
+import { createStateStore } from "../../src/app/api/_platform/_lifecycle/state";
+import { collectRetainedTables, moduleTablePrefix } from "../../src/app/api/_platform/_lifecycle/uninstall";
+import { invalidateAllUsers } from "../../src/app/api/_platform/_shared/service/infra/access";
+import { createMarketApi } from "../../src/app/api/_platform/market/api";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;

package/templates/tests/lifecycle/verify-checks.spec.ts

@@ -1,8 +1,8 @@
 // BDD：深检后端四项 + 端点（P2-7，C2-42）+ SSRF 三钉。
 // 纯 diff 函数 / 探针分类 / SSRF 钉（出站拦截 / header 清洗 / 不跟随重定向）+ 端点门（401/403/404）+ 编排。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（market-api.spec 同约定） */
-import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
-import type { SolutionRouteRow } from "../../src/_platform/api/_lifecycle/verify-checks";
+import type { FsFace } from "../../src/app/api/_platform/_lifecycle/atomic";
+import type { SolutionRouteRow } from "../../src/app/api/_platform/_lifecycle/verify-checks";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -18,9 +18,9 @@ import {
 	sha384B64,
 
 	verifyRouteReachability,
-} from "../../src/_platform/api/_lifecycle/verify-checks";
-import { siteOrigin } from "../../src/_platform/api/market/api";
-import { createSolutionsApi, solutionsEnv } from "../../src/_platform/api/solutions/api";
+} from "../../src/app/api/_platform/_lifecycle/verify-checks";
+import { siteOrigin } from "../../src/app/api/_platform/market/api";
+import { createSolutionsApi, solutionsEnv } from "../../src/app/api/_platform/solutions/api";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;

package/templates/tests/lifecycle/verify-report.spec.ts

@@ -1,8 +1,8 @@
 // BDD：P2-8 深检报告结构 + 留存 N=10 + 可信性项（trust_state）+ i18n 降级项 + 设值不进报告。
 // 纯模块单测（verify-report.ts）+ 端点编排（persist-on-POST / GET verify/last / 降级项 / secret 不泄漏）。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（verify-checks.spec 同约定） */
-import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
-import type { VerifyReport } from "../../src/_platform/api/_lifecycle/verify-report";
+import type { FsFace } from "../../src/app/api/_platform/_lifecycle/atomic";
+import type { VerifyReport } from "../../src/app/api/_platform/_lifecycle/verify-report";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -12,8 +12,8 @@ import {
 	persistReport,
 	VERIFY_REPORTS_KEEP,
 	verifyReportsDirOf,
-} from "../../src/_platform/api/_lifecycle/verify-report";
-import { createSolutionsApi, solutionsEnv } from "../../src/_platform/api/solutions/api";
+} from "../../src/app/api/_platform/_lifecycle/verify-report";
+import { createSolutionsApi, solutionsEnv } from "../../src/app/api/_platform/solutions/api";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;

package/templates/tests/org-departments.spec.ts

@@ -1,4 +1,4 @@
-import type { OrgDeps } from "../src/_platform/api/_shared/service/domain/org";
+import type { OrgDeps } from "../src/app/api/_platform/_shared/service/domain/org";
 
 // BDD：组织架构领域（0016，方案 A1+A2）——CRUD 基线 + 归属权（D13）+ 保底出口（D14）。
 //
@@ -23,8 +23,8 @@ import {
 	updateDepartment,
 	updateMember,
 	upsertDepartment,
-} from "../src/_platform/api/_shared/service/domain/org";
-import { deleteUser, listUsers, updateUserProfile } from "../src/_platform/api/_shared/service/domain/users";
+} from "../src/app/api/_platform/_shared/service/domain/org";
+import { deleteUser, listUsers, updateUserProfile } from "../src/app/api/_platform/_shared/service/domain/users";
 import { ADMIN, installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
@@ -263,12 +263,16 @@ describe("用户侧（改资料 / 删号）", () => {
 		expect(dbo.prepare("SELECT COUNT(*) c FROM sys_refresh_token WHERE user_id = ?").get(uid)).toMatchObject({ c: 0 });
 	});
 
-	it("删号：禁止删自己；最后一个 superadmin 拒删", async () => {
+	it("删号：禁止删自己；非 superadmin 删 superadmin → 403（最后超管的实际防线）", async () => {
 		await expect(deleteUser(ADMIN, ADMIN)).rejects.toMatchObject({ status: 400 });
 		const solo = mkUser("u_sup");
 		dbo.prepare("INSERT INTO sys_user_role (user_id, role_name) VALUES (?, 'superadmin')").run(solo);
-		await expect(deleteUser(ADMIN, solo)).rejects.toMatchObject({ status: 400 });
-		// 有两个 superadmin 时允许删（兜底只保最后一个）
+		// 目标门禁先于「最后一个 superadmin」计数：普通 admin 连碰都碰不到它。
+		// 计数兜底（400）因此在真实路径上不可达——操作者本身是 superadmin 时，
+		// 库里必然已有 ≥2 个 superadmin——保留它只为挡住未来的新写路径。
+		await expect(deleteUser(ADMIN, solo)).rejects.toMatchObject({ status: 403 });
+		expect(dbo.prepare("SELECT COUNT(*) c FROM users WHERE id = ?").get(solo)).toMatchObject({ c: 1 });
+		// 操作者升为 superadmin 后允许删（第二个超管在场）
 		dbo.prepare("INSERT INTO sys_user_role (user_id, role_name) VALUES (?, 'superadmin')").run(ADMIN);
 		await deleteUser(ADMIN, solo);
 		expect(dbo.prepare("SELECT COUNT(*) c FROM users WHERE id = ?").get(solo)).toMatchObject({ c: 0 });

package/templates/tests/org-read.spec.ts

@@ -8,15 +8,15 @@
 //      反过来也钉住：返回字段与 scope 无关，消费模块不该按档位分支解析。
 //
 // 另外钉住 §9.1 阻断项：通讯录只出 activated=1，同步灌进来的「从未登录」账号不得被检索到。
-import type { OrgDeps } from "../src/_platform/api/_shared/service/domain/org";
+import type { OrgDeps } from "../src/app/api/_platform/_shared/service/domain/org";
 
 import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
-import { contactDetail, searchContacts } from "../src/_platform/api/_shared/service/domain/contacts";
+import { contactDetail, searchContacts } from "../src/app/api/_platform/_shared/service/domain/contacts";
 import {
 	addMember,
 	createDepartment,
 	deleteDepartment,
-} from "../src/_platform/api/_shared/service/domain/org";
+} from "../src/app/api/_platform/_shared/service/domain/org";
 import {
 	isMemberOf,
 	pageDepartments,
@@ -28,10 +28,10 @@ import {
 	resolveReader,
 	resolveReadFace,
 	resolveUserIds,
-} from "../src/_platform/api/_shared/service/domain/org-read";
-import { createUser } from "../src/_platform/api/_shared/service/domain/users";
-import { invalidateUser } from "../src/_platform/api/_shared/service/infra/access";
-import { ensureWecomUser } from "../src/auth/api/_shared/wecom/login";
+} from "../src/app/api/_platform/_shared/service/domain/org-read";
+import { createUser } from "../src/app/api/_platform/_shared/service/domain/users";
+import { invalidateUser } from "../src/app/api/_platform/_shared/service/infra/access";
+import { ensureWecomUser } from "../src/app/api/auth/_shared/wecom/login";
 import { ADMIN, installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tests/query-utils.spec.ts

@@ -3,7 +3,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { beforeAll, describe, expect, it } from "vitest";
 
-import { likePattern, paged, pagedFactory } from "../src/_platform/api/_shared/service/infra/query";
+import { likePattern, paged, pagedFactory } from "../src/app/api/_platform/_shared/service/infra/query";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tests/rbac-audit.spec.ts

@@ -3,7 +3,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { auditDeny, auditOp, recordOp, resetDenyAudit } from "../src/_platform/api/_shared/service/infra/audit";
+import { auditDeny, auditOp, recordOp, resetDenyAudit } from "../src/app/api/_platform/_shared/service/infra/audit";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tests/rbac-contacts.spec.ts

@@ -5,7 +5,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { contactDetail, searchContacts } from "../src/_platform/api/_shared/service/domain/contacts";
+import { contactDetail, searchContacts } from "../src/app/api/_platform/_shared/service/domain/contacts";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
@@ -84,7 +84,7 @@ describe("详情与限速", () => {
 	it("接口级限速：同用户突发超限 → 429", async () => {
 		const uid = mkUser("c_rate");
 		g.http = { user: { id: uid } };
-		const { rateLimit } = await import("../src/_platform/api/_shared/service/infra/rate");
+		const { rateLimit } = await import("../src/app/api/_platform/_shared/service/infra/rate");
 		// 窗口 60s / 限额 3（测试参数；生产端点各自定额）
 		for (let i = 0; i < 3; i++)
 			await rateLimit(`contacts:${uid}`, 3, 60_000);

package/templates/tests/rbac-guard.spec.ts

@@ -4,7 +4,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { assertPermission, assertSuperAdmin, assertSystemAdmin, currentAccess, invalidateUser } from "../src/_platform/api/_shared/service/infra/access";
+import { assertPermission, assertSuperAdmin, assertSystemAdmin, currentAccess, invalidateUser } from "../src/app/api/_platform/_shared/service/infra/access";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tests/rbac-roles.spec.ts

@@ -4,8 +4,8 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { createRole, deleteRole, listPermissions, listRoles, updateBindings } from "../src/_platform/api/_shared/service/domain/roles";
-import { assertPermission } from "../src/_platform/api/_shared/service/infra/access";
+import { createRole, deleteRole, listPermissions, listRoles, updateBindings } from "../src/app/api/_platform/_shared/service/domain/roles";
+import { assertPermission } from "../src/app/api/_platform/_shared/service/infra/access";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
@@ -156,4 +156,21 @@ describe("列表支撑（C2 页面数据源）", () => {
 		expect(perms.find(p => p.code === "wiki.old")?.deprecated).toBe(true);
 		expect(perms.find(p => p.code === "wiki.new")?.deprecated).toBe(false);
 	});
+
+	it("listRoles 带出 title_key（R2：solution 角色 UI 实时翻译锚；custom/builtin 为 null）", async () => {
+		// solution 角色带 title_key（0018 起）；custom 角色管理员手填 title、无 key
+		dbo.prepare("INSERT INTO sys_role (name, module, title, title_key, builtin) VALUES ('pm.sales', 'pm', '销售', 'pm:role.sales', 0)").run();
+		await createRole({ name: "custom.tk", title: "手填" });
+		const roles = await listRoles();
+		expect(roles.find(x => x.name === "pm.sales")?.title_key).toBe("pm:role.sales");
+		expect(roles.find(x => x.name === "custom.tk")?.title_key).toBe(null);
+	});
+
+	it("listRoles 原样返回 superadmin（只在 /system/roles 展示层隐去）", async () => {
+		// 成员资格页（users/roles.tsx）把 superadmin 当可授予项（仅 superadmin 可勾选），
+		// 页面数据源里少了它会让「授予超级管理员」直接不可用。过滤只做在展示层。
+		dbo.prepare("INSERT INTO sys_role (name, module, builtin) VALUES ('superadmin', 'framework', 1)").run();
+		const roles = await listRoles();
+		expect(roles.map(r => r.name)).toContain("superadmin");
+	});
 });

package/templates/tests/rbac-seed.spec.ts

@@ -8,7 +8,7 @@ import { beforeAll, describe, expect, it } from "vitest";
 
 import { installDb } from "./fixture";
 
-const SEED = join(dirname(fileURLToPath(import.meta.url)), "..", "src", "_platform", "api", "seed.sql");
+const SEED = join(dirname(fileURLToPath(import.meta.url)), "..", "src", "app", "api", "_platform", "seed.sql");
 let dbo: ReturnType<typeof installDb>;
 
 beforeAll(() => {