@oj-module/cli 0.2.6 → 0.2.14

package/templates/api/src/_platform/_shared/service/{settings.ts → domain/settings.ts}

@@ -1,6 +1,6 @@
 // 系统设置（PRD §4.3）+ 登录方式发现（C5/D2）。
 // secret 项读取掩码（***）；market.* 安全项写操作须 superadmin 操作者（D11 边界在 service 按 actor 角色查）。
-import { recordOp } from "./audit";
+import { recordOp } from "../infra/audit";
 
 export interface SettingItem {
 	key: string
@@ -29,7 +29,7 @@ export interface SettingGroup {
 const SUPER_ONLY_GROUPS = new Set(["security"]);
 
 export async function listSettings(): Promise<SettingGroup[]> {
-	const rows = await db.query("select * from sys_setting order by \"group\", key") as Array<Record<string, unknown>>;
+	const rows = await db.table("sys_setting").select(["key", "module", "group", "type", "value", "default_value", "label_key", "group_label_key", "options", "secret", "update_time"]).orderBy([{ field: "group" }, { field: "key" }]).all() as Array<Record<string, unknown>>;
 	const groups = new Map<string, SettingItem[]>();
 	for (const r of rows) {
 		const item: SettingItem = {
@@ -55,22 +55,22 @@ export async function listSettings(): Promise<SettingGroup[]> {
 }
 
 export async function updateSetting(actorId: number, key: string, value: string): Promise<void> {
-	const rows = await db.query("select * from sys_setting where key = ?", [key]) as Array<Record<string, unknown>>;
+	const rows = await db.table("sys_setting").select(["key", "module", "group", "type", "value", "default_value", "label_key", "group_label_key", "options", "secret", "update_time"]).where({ field: "key", op: "eq", value: key }).all() as Array<Record<string, unknown>>;
 	if (!rows.length)
 		throw Object.assign(new Error(`setting not found: ${key}`), { status: 404 });
 	const row = rows[0];
 	if (SUPER_ONLY_GROUPS.has(String(row.group))) {
-		const actorRoles = await db.query("select role_name from sys_user_role where user_id = ?", [actorId]) as Array<{ role_name: string }>;
+		const actorRoles = await db.table("sys_user_role").select(["role_name"]).where({ field: "user_id", op: "eq", value: actorId }).all() as Array<{ role_name: string }>;
 		if (!actorRoles.some(r => r.role_name === "superadmin"))
 			throw Object.assign(new Error("security settings require superadmin"), { status: 403 });
 	}
-	await db.exec("update sys_setting set value = ?, update_time = ? where key = ?", [String(value ?? ""), Date.now(), key]);
+	await db.table("sys_setting").update({ value: String(value ?? ""), update_time: Date.now() }).where({ field: "key", op: "eq", value: key }).run();
 	await recordOp({ action: "setting.update", module: String(row.module), target: key });
 }
 
 /** C5/D2：登录方式发现的数据源——local 恒在，ldap/sso 由设置项开关。 */
 export async function listLoginMethods(): Promise<{ methods: string[] }> {
-	const rows = await db.query("select key, value from sys_setting where key in ('ldap.enabled', 'sso.enabled')") as Array<{ key: string, value: string | null }>;
+	const rows = await db.table("sys_setting").select(["key", "value"]).where({ field: "key", op: "in", value: ["ldap.enabled", "sso.enabled"] }).all() as Array<{ key: string, value: string | null }>;
 	const enabled = (k: string) => rows.find(r => r.key === k)?.value === "1";
 	return { methods: ["local", ...(enabled("ldap.enabled") ? ["ldap" as const] : []), ...(enabled("sso.enabled") ? ["sso" as const] : [])] };
 }

package/templates/api/src/_platform/_shared/service/{solution-perms.ts → domain/solution-perms.ts}

@@ -28,20 +28,20 @@ export async function upsertSolutionPerms(m: SolutionManifest): Promise<UpsertRe
 	const declaredPerms = new Set(m.roles.flatMap(r => r.permissions ?? []));
 
 	for (const role of m.roles) {
-		const existing = await db.query("select name from sys_role where name = ?", [role.name]) as unknown[];
+		const existing = await db.table("sys_role").select(["name"]).where({ field: "name", op: "eq", value: role.name }).all() as unknown[];
 		// upsert：行存在只覆盖元数据（title），name/builtin 不动（AC2-2 元数据覆盖）
 		if (existing.length) {
-			await db.exec("update sys_role set title = ? where name = ?", [role.title, role.name]);
+			await db.table("sys_role").update({ title: role.title }).where({ field: "name", op: "eq", value: role.name }).run();
 		}
 		else {
-			await db.exec("insert into sys_role (name, module, title, builtin) values (?, ?, ?, 0)", [role.name, m.module, role.title]);
+			await db.table("sys_role").insert({ name: role.name, module: m.module, title: role.title, builtin: 0 }).run();
 			// 声明绑定只在角色创建时写一次（角色级 insert-if-absent，AC1-15 红线）：
 			// 升级/重装对已存在角色永不补写声明绑定——管理员撤过的绑定不复活；
 			// 新版本给既有角色新增权限点时，由管理员显式勾选（insert-if-absent 的取舍边界，§9.5）。
 			for (const code of role.permissions ?? []) {
-				const bound = await db.query("select role_name from sys_role_permission where role_name = ? and permission_code = ?", [role.name, code]) as unknown[];
+				const bound = await db.table("sys_role_permission").select(["role_name"]).where({ field: "role_name", op: "eq", value: role.name }).where({ field: "permission_code", op: "eq", value: code }).all() as unknown[];
 				if (!bound.length)
-					await db.exec("insert into sys_role_permission (role_name, permission_code) values (?, ?)", [role.name, code]);
+					await db.table("sys_role_permission").insert({ role_name: role.name, permission_code: code }).run();
 			}
 		}
 	}
@@ -49,34 +49,37 @@ export async function upsertSolutionPerms(m: SolutionManifest): Promise<UpsertRe
 	// 权限点行独立于角色创建：声明里的新 code 一律 upsert 插入（AC2-1「新增声明 → upsert 插入新行」——
 	// 含既有角色新增权限点的场景；绑定是否自动挂上由上面的角色级规则决定）
 	for (const code of declaredPerms) {
-		const p = await db.query("select code from sys_permission where code = ?", [code]) as unknown[];
+		const p = await db.table("sys_permission").select(["code"]).where({ field: "code", op: "eq", value: code }).all() as unknown[];
 		if (!p.length)
-			await db.exec("insert into sys_permission (code, module) values (?, ?)", [code, m.module]);
+			await db.table("sys_permission").insert({ code, module: m.module }).run();
 	}
 
 	// 声明消失 → 行保留标 deprecated（AC2-3/4）：行与绑定全留，判决不突变；
 	// 重命名的旧 code 走同一条规则（视为删除+新增），deprecated 清单交给安装器告警。
-	const oldPerms = await db.query("select code from sys_permission where module = ? and deprecated = 0", [m.module]) as Array<{ code: string }>;
+	const oldPerms = await db.table("sys_permission").select(["code"]).where({ field: "module", op: "eq", value: m.module }).where({ field: "deprecated", op: "eq", value: 0 }).all() as Array<{ code: string }>;
 	for (const r of oldPerms) {
 		if (!declaredPerms.has(String(r.code))) {
-			await db.exec("update sys_permission set deprecated = 1 where code = ?", [r.code]);
+			await db.table("sys_permission").update({ deprecated: 1 }).where({ field: "code", op: "eq", value: r.code }).run();
 			deprecated.push(String(r.code));
 		}
 	}
-	const oldRoles = await db.query("select name from sys_role where module = ? and builtin = 0 and deprecated = 0", [m.module]) as Array<{ name: string }>;
+	const oldRoles = await db.table("sys_role").select(["name"]).where({ field: "module", op: "eq", value: m.module }).where({ field: "builtin", op: "eq", value: 0 }).where({ field: "deprecated", op: "eq", value: 0 }).all() as Array<{ name: string }>;
 	for (const r of oldRoles) {
 		if (!declaredRoles.has(String(r.name))) {
-			await db.exec("update sys_role set deprecated = 1 where name = ?", [r.name]);
+			await db.table("sys_role").update({ deprecated: 1 }).where({ field: "name", op: "eq", value: r.name }).run();
 			deprecated.push(String(r.name));
 		}
 	}
 	return { deprecated };
 }
 
-/** 事务/非事务统一的 db 面（P3-3：可传入 db.tx 的事务句柄以纳入单一事务） */
+/**
+ * 事务/非事务统一的 db 面（P3-3：可传入 db.tx 的事务句柄以纳入单一事务）。
+ *  只收 table——全构造器化后（v0.1.81 startswith 补齐最后缺口）本出口不再走裸 SQL，
+ *  契约随实现收窄：tx 句柄（{table}）与全局 db 均可传入。
+ */
 interface DbLike {
-	query: (sql: string, params?: unknown[]) => Promise<unknown>
-	exec: (sql: string, params?: unknown[]) => Promise<unknown>
+	table: DBInstance["table"]
 }
 
 /**
@@ -88,14 +91,14 @@ interface DbLike {
  * P3-3：可传入事务句柄 `d`（db.tx 的 t），使级联纳入卸载的单一 DB 事务；缺省回落全局 db（兼容既有调用面）。
  */
 export async function uninstallSolution(module: string, d: DbLike = db): Promise<void> {
-	const roles = await d.query("select name from sys_role where module = ?", [module]) as Array<{ name: string }>;
+	const roles = await d.table("sys_role").select(["name"]).where({ field: "module", op: "eq", value: module }).all() as Array<{ name: string }>;
 	for (const r of roles) {
-		await d.exec("delete from sys_role_permission where role_name = ?", [r.name]);
-		await d.exec("delete from sys_user_role where role_name = ?", [r.name]);
+		await d.table("sys_role_permission").where({ field: "role_name", op: "eq", value: r.name }).delete().run();
+		await d.table("sys_user_role").where({ field: "role_name", op: "eq", value: r.name }).delete().run();
 	}
-	await d.exec("delete from sys_role where module = ?", [module]);
-	// module 名是 slug（[a-z0-9_-]），LIKE 前缀匹配的转义纪律同 query.ts（ESCAPE '!' 三方言同义）
-	const prefix = `${module.replace(/[!%_]/g, c => `!${c}`)}.%`;
-	await d.exec("delete from sys_role_permission where permission_code like ? escape '!'", [prefix]);
-	await d.exec("delete from sys_permission where module = ?", [module]);
+	await d.table("sys_role").where({ field: "module", op: "eq", value: module }).delete().run();
+	// startswith（v0.1.81）：语义化前缀匹配（⇒ `v%`），引擎自动转义 %/_/!——
+	// 替代旧「手工 escape 拼接 + 裸 SQL like ? escape '!'」（三方言 ESCAPE 同义纪律见 query.ts）
+	await d.table("sys_role_permission").where({ field: "permission_code", op: "startswith", value: `${module}.` }).delete().run();
+	await d.table("sys_permission").where({ field: "module", op: "eq", value: module }).delete().run();
 }

package/templates/api/src/_platform/_shared/service/{users.ts → domain/users.ts}

@@ -3,8 +3,8 @@
 // 禁止操作自己（AC1-10 注）；最后 superadmin 兜底（服务端二次防线）；
 // 角色唯一权威源 sys_user_role + 写时失效（AC1-7/D10）；禁用/重置口令级联删 refresh（§3.1）。
 // bcrypt 经注入（Node 侧全局不可 stub，同 session.ts 约定）。
-import { invalidateUser } from "./access";
-import { recordOp } from "./audit";
+import { invalidateUser } from "../infra/access";
+import { recordOp } from "../infra/audit";
 
 export interface UserDeps {
 	bcryptHash: (pw: string) => Promise<string>
@@ -28,12 +28,12 @@ function fail(status: number, message: string): never {
 const RESERVED_PREFIX = /^(?:ldap|sso):/i;
 
 async function rolesOf(uid: number): Promise<string[]> {
-	const rows = await db.query("select role_name from sys_user_role where user_id = ?", [uid]) as Array<{ role_name: string }>;
+	const rows = await db.table("sys_user_role").select(["role_name"]).where({ field: "user_id", op: "eq", value: uid }).all() as Array<{ role_name: string }>;
 	return rows.map(r => r.role_name);
 }
 
 async function usernameOf(uid: number): Promise<string> {
-	const rows = await db.query("select username from users where id = ?", [uid]) as Array<{ username: string }>;
+	const rows = await db.table("users").select(["username"]).where({ field: "id", op: "eq", value: uid }).all() as Array<{ username: string }>;
 	return rows[0] ? String(rows[0].username) : `#${uid}`;
 }
 
@@ -52,10 +52,8 @@ async function assertMembershipAllowed(actorId: number, nextRoles: string[]): Pr
 }
 
 export async function listUsers(): Promise<UserRow[]> {
-	const rows = await db.query(
-		"select id, username, display_name, email, is_forbidden, must_change from users order by username",
-	) as Array<Record<string, unknown>>;
-	const roleRows = await db.query("select user_id, role_name from sys_user_role") as Array<{ user_id: number, role_name: string }>;
+	const rows = await db.table("users").select(["id", "username", "display_name", "email", "is_forbidden", "must_change"]).orderBy([{ field: "username" }]).all() as Array<Record<string, unknown>>;
+	const roleRows = await db.table("sys_user_role").select(["user_id", "role_name"]).all() as Array<{ user_id: number, role_name: string }>;
 	const roleMap = new Map<number, string[]>();
 	for (const r of roleRows)
 		(roleMap.get(Number(r.user_id)) ?? roleMap.set(Number(r.user_id), []).get(Number(r.user_id)))!.push(r.role_name);
@@ -79,14 +77,11 @@ export async function createUser(input: { username: string, password: string, di
 		fail(400, "username prefix reserved for external identity sources");
 	if (!input.password || String(input.password).length < 6)
 		fail(400, "password too short (min 6)");
-	const exists = await db.query("select id from users where username = ?", [username]);
+	const exists = await db.table("users").select(["id"]).where({ field: "username", op: "eq", value: username }).all();
 	if (exists.length)
 		fail(400, "username exists");
 	const hash = await deps.bcryptHash(String(input.password));
-	const rows = await db.query(
-		"insert into users (username, password_hash, display_name, email, must_change) values (?, ?, ?, ?, 1) returning id",
-		[username, hash, input.displayName ?? null, input.email ?? null],
-	) as Array<{ id: number }>;
+	const rows = await db.table("users").insert({ username, password_hash: hash, display_name: input.displayName ?? null, email: input.email ?? null, must_change: 1 }).returning(["id"]).run() as Array<{ id: number }>;
 	const uid = Number(rows[0].id);
 	await recordOp({ action: "user.create", module: "framework", target: username });
 	return uid;
@@ -95,14 +90,13 @@ export async function createUser(input: { username: string, password: string, di
 /** AC1-7：整集替换角色（sys_user_role 权威源），写后失效持有者判权缓存。 */
 export async function updateUserRoles(actorId: number, targetUid: number, roles: string[]): Promise<void> {
 	assertNotSelf(actorId, targetUid);
-	const target = await db.query("select id from users where id = ?", [targetUid]);
+	const target = await db.table("users").select(["id"]).where({ field: "id", op: "eq", value: targetUid }).all();
 	if (!target.length)
 		fail(404, "user not found");
 	const next = [...new Set(roles.map(String))];
 	if (next.length) {
-		const marks = next.map(() => "?").join(",");
-		const known = await db.query(`select name from sys_role where name in (${marks})`, next);
-		const knownSet = new Set(known.map((r: { name: string }) => r.name));
+		const known = await db.table("sys_role").select(["name"]).where({ field: "name", op: "in", value: next }).all();
+		const knownSet = new Set(known.map(r => (r as { name: string }).name));
 		const unknown = next.filter(r => !knownSet.has(r));
 		if (unknown.length)
 			fail(400, `unknown roles: ${unknown.join(", ")}`);
@@ -112,14 +106,14 @@ export async function updateUserRoles(actorId: number, targetUid: number, roles:
 	const beforeSet = new Set(before);
 	// AC1-10 兜底：撤掉最后一个 superadmin 拒绝（现实可达路径已被「禁止操作自己」拦截）
 	if (beforeSet.has("superadmin") && !next.includes("superadmin")) {
-		const supers = await db.query("select count(*) c from sys_user_role where role_name = 'superadmin'") as Array<{ c: number }>;
+		const supers = await db.table("sys_user_role").select([{ fn: "count", as: "c" }]).where({ field: "role_name", op: "eq", value: "superadmin" }).all() as Array<{ c: number }>;
 		if (Number(supers[0].c) <= 1)
 			fail(400, "cannot revoke the last superadmin");
 	}
 	await db.tx(async (t) => {
-		await t.exec("delete from sys_user_role where user_id = ?", [targetUid]);
+		await t.table("sys_user_role").where({ field: "user_id", op: "eq", value: targetUid }).delete().run();
 		for (const role of next)
-			await t.exec("insert into sys_user_role (user_id, role_name) values (?, ?)", [targetUid, role]);
+			await t.table("sys_user_role").insert({ user_id: targetUid, role_name: role }).run();
 	});
 	invalidateUser(Number(targetUid));
 	await recordOp({
@@ -135,13 +129,13 @@ export async function changePasswordByAdmin(actorId: number, targetUid: number,
 	assertNotSelf(actorId, targetUid);
 	if (!newPassword || String(newPassword).length < 6)
 		fail(400, "password too short (min 6)");
-	const rows = await db.query("select id from users where id = ?", [targetUid]);
+	const rows = await db.table("users").select(["id"]).where({ field: "id", op: "eq", value: targetUid }).all();
 	if (!rows.length)
 		fail(404, "user not found");
 	const hash = await deps.bcryptHash(String(newPassword));
 	await db.tx(async (t) => {
-		await t.exec("update users set password_hash = ?, must_change = 1 where id = ?", [hash, targetUid]);
-		await t.exec("delete from sys_refresh_token where user_id = ?", [targetUid]);
+		await t.table("users").update({ password_hash: hash, must_change: 1 }).where({ field: "id", op: "eq", value: targetUid }).run();
+		await t.table("sys_refresh_token").where({ field: "user_id", op: "eq", value: targetUid }).delete().run();
 	});
 	invalidateUser(Number(targetUid));
 	await recordOp({ action: "user.password.reset", module: "framework", target: await usernameOf(Number(targetUid)) });
@@ -150,13 +144,13 @@ export async function changePasswordByAdmin(actorId: number, targetUid: number,
 /** B7：禁用/解禁——禁用级联删 refresh + 写时失效。 */
 export async function setForbidden(actorId: number, targetUid: number, forbidden: boolean): Promise<void> {
 	assertNotSelf(actorId, targetUid);
-	const rows = await db.query("select id from users where id = ?", [targetUid]);
+	const rows = await db.table("users").select(["id"]).where({ field: "id", op: "eq", value: targetUid }).all();
 	if (!rows.length)
 		fail(404, "user not found");
 	await db.tx(async (t) => {
-		await t.exec("update users set is_forbidden = ? where id = ?", [forbidden ? 1 : 0, targetUid]);
+		await t.table("users").update({ is_forbidden: forbidden ? 1 : 0 }).where({ field: "id", op: "eq", value: targetUid }).run();
 		if (forbidden)
-			await t.exec("delete from sys_refresh_token where user_id = ?", [targetUid]);
+			await t.table("sys_refresh_token").where({ field: "user_id", op: "eq", value: targetUid }).delete().run();
 	});
 	invalidateUser(Number(targetUid));
 	await recordOp({ action: "user.forbidden.update", module: "framework", target: await usernameOf(Number(targetUid)), detail: { forbidden } });

package/templates/api/src/_platform/_shared/service/{access.ts → infra/access.ts}

@@ -20,15 +20,12 @@ interface AccessSnapshot {
 const cache = new Map<number, AccessSnapshot>();
 
 async function loadSnapshot(userId: number): Promise<AccessSnapshot> {
-	const userRows = await db.query("select is_forbidden, must_change from users where id = ?", [userId]);
-	const roleRows = await db.query("select role_name from sys_user_role where user_id = ?", [userId]);
-	const roles = roleRows.map((r: { role_name: string }) => r.role_name);
+	const userRows = await db.table("users").select(["is_forbidden", "must_change"]).where({ field: "id", op: "eq", value: userId }).all();
+	const roleRows = await db.table("sys_user_role").select(["role_name"]).where({ field: "user_id", op: "eq", value: userId }).all();
+	const roles = roleRows.map(r => (r as { role_name: string }).role_name);
 	// 只捞该用户角色的绑定（参数化 IN，三方言纪律）；deprecated 不过滤（判权职责，§5）
 	const bindRows = roles.length
-		? await db.query(
-			`select role_name, permission_code from sys_role_permission where role_name in (${roles.map(() => "?").join(",")})`,
-			roles,
-		)
+		? await db.table("sys_role_permission").select(["role_name", "permission_code"]).where({ field: "role_name", op: "in", value: roles }).all()
 		: [];
 	const bindings: Record<string, string[]> = {};
 	for (const r of bindRows as { role_name: string, permission_code: string }[])
@@ -69,7 +66,7 @@ export async function currentAccess(): Promise<AccessSnapshot> {
 	const uid = http.user?.id;
 	if (uid == null)
 		deny();
-	const snap = await snapshot(uid);
+	const snap = await snapshot(Number(uid));
 	if (snap.forbidden)
 		deny();
 	if (snap.mustChange)

package/templates/api/src/_platform/_shared/service/{audit.ts → infra/audit.ts}

@@ -22,27 +22,24 @@ export interface OpEntry {
 async function usernameOf(userId: number): Promise<string> {
 	if (!userId)
 		return "system";
-	const rows = await db.query("select username from users where id = ?", [userId]);
+	const rows = await db.table("users").select(["username"]).where({ field: "id", op: "eq", value: userId }).all();
 	return rows[0] ? String(rows[0].username) : "unknown";
 }
 
 /** 同步落表。关键路径（如 A6 角色管理）直接 await；一般路径用 auditOp。 */
 export async function recordOp(entry: OpEntry): Promise<void> {
-	const uid = http.user?.id ?? 0;
-	await db.exec(
-		"insert into sys_oplog (create_time, user_id, username, action, module, version, target, detail, level) values (?, ?, ?, ?, ?, ?, ?, ?, ?)",
-		[
-			Date.now(),
-			uid,
-			await usernameOf(uid),
-			entry.action,
-			entry.module,
-			entry.version ?? null,
-			entry.target ?? null,
-			entry.detail == null ? null : JSON.stringify(entry.detail),
-			entry.level ?? 6,
-		],
-	);
+	const uid = Number(http.user?.id ?? 0);
+	await db.table("sys_oplog").insert({
+		create_time: Date.now(),
+		user_id: uid,
+		username: await usernameOf(uid),
+		action: entry.action,
+		module: entry.module,
+		version: entry.version ?? null,
+		target: entry.target ?? null,
+		detail: entry.detail == null ? null : JSON.stringify(entry.detail),
+		level: entry.level ?? 6,
+	}).run();
 }
 
 /** fire-and-forget：审计失败静默（写日志也失败的极端场景下，业务正确性优先）。 */
@@ -61,7 +58,7 @@ let denyQueue: Promise<void> = Promise.resolve();
  *  uid 在调用瞬间同步捕获——http.user 是可变全局，异步队列执行时再读会被后续请求覆盖。
  */
 export function auditDeny(code: string): void {
-	const uid = http.user?.id ?? 0;
+	const uid = Number(http.user?.id ?? 0);
 	denyQueue = denyQueue.then(() => recordDeny(uid, code)).catch(() => {});
 }
 
@@ -73,18 +70,21 @@ export function resetDenyAudit(): void {
 async function recordDeny(uid: number, code: string): Promise<void> {
 	const now = Date.now();
 	// 窗口锚点 = 分钟内最近一条同 (user, code) 的 auth.deny 行；命中只更新计数，否则落首条。
-	const rows = await db.query(
-		"select id, detail from sys_oplog where user_id = ? and action = 'auth.deny' and target = ? and create_time > ? order by id desc limit 1",
-		[uid, code, now - DENY_WINDOW_MS],
-	);
+	const rows = await db.table("sys_oplog").select(["id", "detail"]).where({ field: "user_id", op: "eq", value: uid }).where({ field: "action", op: "eq", value: "auth.deny" }).where({ field: "target", op: "eq", value: code }).where({ field: "create_time", op: "gt", value: now - DENY_WINDOW_MS }).orderBy([{ field: "id", dir: "desc" }]).limit(1).all();
 	const hit = rows[0] as { id: number, detail: string } | undefined;
 	if (hit) {
 		const count = (JSON.parse(hit.detail) as { count: number }).count + 1;
-		await db.exec("update sys_oplog set detail = ? where id = ?", [JSON.stringify({ code, count }), hit.id]);
+		await db.table("sys_oplog").update({ detail: JSON.stringify({ code, count }) }).where({ field: "id", op: "eq", value: hit.id }).run();
 		return;
 	}
-	await db.exec(
-		"insert into sys_oplog (create_time, user_id, username, action, module, target, detail, level) values (?, ?, ?, 'auth.deny', ?, ?, ?, 4)",
-		[now, uid, await usernameOf(uid), moduleOf(code), code, JSON.stringify({ code, count: 1 })],
-	);
+	await db.table("sys_oplog").insert({
+		create_time: now,
+		user_id: uid,
+		username: await usernameOf(uid),
+		action: "auth.deny",
+		module: moduleOf(code),
+		target: code,
+		detail: JSON.stringify({ code, count: 1 }),
+		level: 4,
+	}).run();
 }

package/templates/api/src/_platform/_shared/service/infra/oplog.ts

@@ -0,0 +1,40 @@
+// 操作日志查询（AC1-29/D13：admin 可查；读操作不记审计的红线不适用——本表本身就是审计）。
+// 过滤维度：action 精确 / username 包含 / module 精确；分页复用 query.ts 的 pagedFactory（构造器工厂）。
+import { pagedFactory } from "./query";
+
+export interface OplogRow {
+	id: number
+	create_time: number
+	user_id: number
+	username: string
+	action: string
+	module: string
+	version: string | null
+	target: string | null
+	detail: string | null
+	level: number
+}
+
+export interface OplogPage {
+	list: OplogRow[]
+	total: number
+	truncated: boolean
+}
+
+export async function searchOplog(filter: { action?: unknown, username?: unknown, module?: unknown, limit?: unknown }): Promise<OplogPage> {
+	// 构造器（v0.1.82）：可选过滤走 whereIf，条件写一份（mk 工厂），count + list 复用；
+	// username 走语义 op contains（引擎转义 %/_/!，等价旧 LIKE ? ESCAPE '!' 的 %kw%）。
+	// 照抄口径：devkit scenarios 场景 42 ④。
+	// 注意 whereIf 的跳过集是 undefined/null/false/[]——**"" 是合法值会保留**（api-manual
+	// §1153），故缺失值必须归一化为 undefined（不能图省事用 ""，否则会发射 `action = ''`
+	// 把结果过滤空——与旧 if (filter.x) 的「假值整条跳过」语义相悖）。
+	const action = filter.action ? String(filter.action) : undefined;
+	const module = filter.module ? String(filter.module) : undefined;
+	const username = filter.username ? String(filter.username) : undefined;
+	const mk = () => db.table("sys_oplog")
+		.whereIf(action, { field: "action", op: "eq", value: action })
+		.whereIf(module, { field: "module", op: "eq", value: module })
+		.whereIf(username, { field: "username", op: "contains", value: username });
+	const r = await pagedFactory<OplogRow>(mk, { size: filter.limit });
+	return { list: r.list, total: r.total, truncated: r.truncated };
+}

package/templates/api/src/_platform/_shared/service/{query.ts → infra/query.ts}

@@ -37,6 +37,24 @@ export async function paged<T>(
 	return { list, total, page, size, truncated: offset + list.length < total };
 }
 
+// 构造器分页工厂（v0.1.82）：条件写一份（mk 工厂），count + list 各跑一次（count 用聚合，
+// 不受 LIMIT 钳制）；替代「接受任意 SQL 片段」的旧 paged（裸 SQL 包装器）。条件收敛到构造器
+// （contains 替代 LIKE ? ESCAPE '!'），残留任意 SQL 的场景才继续走旧 paged。
+type Builder = ReturnType<typeof db.table>;
+export async function pagedFactory<T>(
+	mk: () => Builder,
+	input: { page?: unknown, size?: unknown } = {},
+): Promise<PageResult<T>> {
+	const { page, size, offset } = pageArgs(input);
+	const total = Number(
+		(await mk().select([{ fn: "count", as: "c" }]).all() as Array<Record<string, unknown>>)[0]?.c ?? 0,
+	);
+	const list = total === 0
+		? []
+		: await mk().orderBy([{ field: "id", dir: "desc" }]).limit(size).offset(offset).all() as T[];
+	return { list, total, page, size, truncated: total > page * size };
+}
+
 /**
  * LIKE 模式：修剪后校验长度（默认 2~64），元字符 % _ ! 加 ! 转义，两侧包 %。
  *  SQL 侧必须写 `like ? escape '!'`（三方言同语义；sqlite 默认无转义符，mysql/pg 默认不是 !）。

package/templates/api/src/_platform/_shared/service/{rate.ts → infra/rate.ts}

@@ -12,15 +12,15 @@ export interface RateLimitOpts {
 /** key 维度（如 `contacts:<uid>` / `login:ip:<ip>`）：窗口内超 limit → 429。 */
 export async function rateLimit(key: string, limit: number, windowMs: number, opts: RateLimitOpts = {}): Promise<void> {
 	const now = opts.now?.() ?? Date.now();
-	const rows = await db.query("select window_start, count from sys_rate_window where rate_key = ?", [key]);
+	const rows = await db.table("sys_rate_window").select(["window_start", "count"]).where({ field: "rate_key", op: "eq", value: key }).all();
 	const w = rows[0] as { window_start: number, count: number } | undefined;
 	if (!w || now - Number(w.window_start) >= windowMs) {
-		await db.exec("delete from sys_rate_window where rate_key = ?", [key]);
-		await db.exec("insert into sys_rate_window (rate_key, window_start, count) values (?, ?, 1)", [key, now]);
+		await db.table("sys_rate_window").where({ field: "rate_key", op: "eq", value: key }).delete().run();
+		await db.table("sys_rate_window").insert({ rate_key: key, window_start: now, count: 1 }).run();
 		return;
 	}
 	const count = Number(w.count) + 1;
-	await db.exec("update sys_rate_window set count = ? where rate_key = ?", [count, key]);
+	await db.table("sys_rate_window").update({ count }).where({ field: "rate_key", op: "eq", value: key }).run();
 	if (count > limit)
 		throw Object.assign(new Error("rate limited"), { status: 429 });
 }
@@ -44,12 +44,12 @@ export async function loginFailed(key: string, opts: LoginThrottleOpts = {}): Pr
 	const threshold = opts.threshold ?? 6;
 	const base = opts.baseBackoffMs ?? 15_000;
 	const now = opts.now?.() ?? Date.now();
-	const rows = await db.query("select fail_count, blocked_until from sys_login_throttle where pair_key = ?", [key]);
-	const s = rows[0] as LoginThrottleRow | undefined;
+	const rows = await db.table("sys_login_throttle").select(["fail_count", "blocked_until"]).where({ field: "pair_key", op: "eq", value: key }).all();
+	const s = rows[0] as unknown as LoginThrottleRow | undefined;
 	const count = (s ? Number(s.fail_count) : 0) + 1;
 	const blockedUntil = count >= threshold ? now + base * 2 ** (count - threshold) : (s ? Number(s.blocked_until) : 0);
-	await db.exec("delete from sys_login_throttle where pair_key = ?", [key]);
-	await db.exec("insert into sys_login_throttle (pair_key, fail_count, blocked_until) values (?, ?, ?)", [key, count, blockedUntil]);
+	await db.table("sys_login_throttle").where({ field: "pair_key", op: "eq", value: key }).delete().run();
+	await db.table("sys_login_throttle").insert({ pair_key: key, fail_count: count, blocked_until: blockedUntil }).run();
 	return count;
 }
 
@@ -58,22 +58,25 @@ export async function loginBlocked(key: string, opts: LoginThrottleOpts = {}): P
 	const threshold = opts.threshold ?? 6;
 	const base = opts.baseBackoffMs ?? 15_000;
 	const now = opts.now?.() ?? Date.now();
-	const rows = await db.query("select fail_count, blocked_until from sys_login_throttle where pair_key = ?", [key]);
-	const s = rows[0] as LoginThrottleRow | undefined;
+	const rows = await db.table("sys_login_throttle").select(["fail_count", "blocked_until"]).where({ field: "pair_key", op: "eq", value: key }).all();
+	const s = rows[0] as unknown as LoginThrottleRow | undefined;
 	if (!s || Number(s.blocked_until) <= now)
 		return;
 	const count = Number(s.fail_count) + 1;
 	const blockedUntil = now + base * 2 ** (count - threshold);
-	await db.exec("update sys_login_throttle set fail_count = ?, blocked_until = ? where pair_key = ?", [count, blockedUntil, key]);
+	await db.table("sys_login_throttle").update({ fail_count: count, blocked_until: blockedUntil }).where({ field: "pair_key", op: "eq", value: key }).run();
 	throw Object.assign(new Error("too many login attempts"), { status: 429, retryAfterMs: blockedUntil - now });
 }
 
 /** 登录成功清零连败。 */
 export async function loginSucceeded(key: string): Promise<void> {
-	await db.exec("delete from sys_login_throttle where pair_key = ?", [key]);
+	await db.table("sys_login_throttle").where({ field: "pair_key", op: "eq", value: key }).delete().run();
 }
 
 /** 清登录限速状态（测试夹具/运维排障用）。 */
 export async function resetLoginThrottle(): Promise<void> {
-	await db.exec("delete from sys_login_throttle", []);
+	// 构造器（v0.1.82）：truncate() 是唯一的「无 where 清空」写动词，命名式、可 grep，
+	// 取代裸 db.exec("delete from …")（审查上像漏写 where 的 delete）。渲染 DELETE FROM t，
+	// 租户守卫照常注入（本表非租户表=整表清空）。
+	await db.table("sys_login_throttle").truncate().run();
 }

package/templates/api/src/_platform/_shared/site-facade.ts

@@ -34,7 +34,7 @@ export function withSiteOrigin(fetch: FetchInitFace): FetchFace {
 /** 站点迁移账本 head（oj journal 真源 `_oj_migrations`；表缺失/查询失败 → null = 跳过禁降版判定，不猜） */
 export async function journalHeadOf(name: string): Promise<number | bigint | null> {
 	try {
-		const rows = await db.query("select max(version) as head from _oj_migrations where module = ?", [name]) as Array<{ head: unknown }>;
+		const rows = await db.table("_oj_migrations").select([{ fn: "max", field: "version", as: "head" }]).where({ field: "module", op: "eq", value: name }).all() as Array<{ head: unknown }>;
 		const head = rows[0]?.head;
 		return head == null ? null : Number(head);
 	}

package/templates/api/src/_platform/contacts/api.ts

@@ -2,8 +2,8 @@ import { respond } from "../_shared/respond";
 // 平台共享服务域 /api/_platform/contacts（D207：登录即可，不挂权限点，H12）。
 // 读操作不记审计（设计 §4B）；接口级限速（设计 line 199）经 rate.ts（B5 复用同源）。
 // 单条详情走子组 /api/_platform/contacts/detail?id=（detail/api.ts，含 email/avatar）。
-import { searchContacts } from "../_shared/service/contacts";
-import { rateLimit } from "../_shared/service/rate";
+import { searchContacts } from "../_shared/service/domain/contacts";
+import { rateLimit } from "../_shared/service/infra/rate";
 
 export default {
 	// GET /api/_platform/contacts?keyword=&limit= —— 人员目录（AC1-22~24）。

package/templates/api/src/_platform/contacts/detail/api.ts

@@ -1,7 +1,7 @@
 import { respond } from "../../_shared/respond";
 // GET /api/_platform/contacts/detail?id= —— 单条详情（含 email/avatar，设计 §4B）。
-import { contactDetail } from "../../_shared/service/contacts";
-import { rateLimit } from "../../_shared/service/rate";
+import { contactDetail } from "../../_shared/service/domain/contacts";
+import { rateLimit } from "../../_shared/service/infra/rate";
 
 export default {
 	async get() {

package/templates/api/src/_platform/fixtures/l1-test-user.sql

@@ -0,0 +1,13 @@
+-- L1 测试账号（仅 `oj test` 经 fixtures 灌入，不进 release 产物）。
+--
+-- 为什么不能用 seed 的 admin 跑 L1 登录：
+--   ① seed 的 admin 是 must_change=1 首登改密态（D12 生产语义），且初始口令 123456
+--      只是开发便利——用户在 dev 库改过口令后（产品主动引导），admin 口令即漂移，
+--      L1 若绑 admin/123456 会随机 401（本地实测踩过：dev 库口令被改成 12345678）。
+--   ② 判权类端点（currentAccess/assertPermission）对 must_change=1 恒 403。
+-- 故 additive 建一个专用账号：INSERT OR IGNORE 幂等，反复重放终态一致，
+-- 不碰 admin 既有行（用户的口令/状态不受 `oj test` 影响）。
+-- 按分号朴素切分（S006）：语句内不得含分号字面量。
+INSERT OR IGNORE INTO users (username, password_hash, avatar_base64, source, display_name, must_change, is_forbidden) VALUES ('l1tester', '$2b$10$/0DuEHsBLYp6.5ZLJCFafOOvksLbruMvs9aMhUqRSpbdY52D9RaXS', '', 'local', 'L1 测试账号', 0, 0);
+-- 绑 superadmin：L1 若打判权类端点可直通（账号生命周期 B6 建号默认 must_change=1，这里显式 0）
+INSERT OR IGNORE INTO sys_user_role (user_id, role_name) SELECT id, 'superadmin' FROM users WHERE username = 'l1tester';

package/templates/api/src/_platform/manifest.yaml

@@ -1,7 +1,8 @@
 name: _platform
-desc: 框架级共有表（users 鉴权 + RBAC 六表 + 设置/日志/路由注册）——普通模块、无路由（参考 sample/src/_platform）
+desc: 平台内核（非业务模块、无自身业务路由前缀）。含三类：① 跨模块服务 _shared/service（infra 基础设施 + domain 管理域）；② 生命周期引擎 _lifecycle（方案安装/卸载/注册/验签/信任状态机）；③ 平台编排 API 面 /api/_platform/{contacts,market,solutions}（由 market/api.ts、contacts/api.ts、solutions/api.ts 暴露，全 superadmin 门禁）。运行时安装的方案包不在此树。
 version: 0.1.0
 tables:
+  - _oj_migrations
   - users
   - sys_setting
   - sys_oplog
@@ -12,3 +13,5 @@ tables:
   - sys_user_role
   - sys_refresh_token
   - market_history
+  - sys_rate_window
+  - sys_login_throttle