@oj-module/cli 0.2.6 → 0.2.14

package/templates/api/src/_platform/market/api.ts

@@ -27,7 +27,7 @@ import { validateTarListing } from "../_lifecycle/tgz-guard";
 import { createTrustStore } from "../_lifecycle/trust";
 import { computeUninstallImpact, runUninstall } from "../_lifecycle/uninstall";
 import { respond } from "../_shared/respond";
-import { assertSuperAdmin } from "../_shared/service/access";
+import { assertSuperAdmin } from "../_shared/service/infra/access";
 import { journalHeadOf, siteOrigin, withSiteOrigin } from "../_shared/site-facade";
 import { BOOTSTRAP_KEY, seedBootstrapKey } from "./bootstrap";
 
@@ -182,7 +182,7 @@ async function cdnBaseOf(env: MarketEnv): Promise<string | null> {
 		return injected === "" ? null : injected.replace(/\/+$/, "");
 	}
 	try {
-		const rows = await db.query("select value, default_value from sys_setting where key = ?", ["framework.market_cdn_url"]) as Array<Record<string, unknown>>;
+		const rows = await db.table("sys_setting").select(["value", "default_value"]).where({ field: "key", op: "eq", value: "framework.market_cdn_url" }).all() as Array<Record<string, unknown>>;
 		const v = String(rows[0]?.value ?? rows[0]?.default_value ?? "").trim().replace(/\/+$/, "");
 		return v === "" ? null : v;
 	}
@@ -263,7 +263,7 @@ async function operatorOf(): Promise<string | null> {
 		return null;
 	}
 	try {
-		const u = await db.query("select username from users where id = ?", [uid]) as Array<{ username: string }>;
+		const u = await db.table("users").select(["username"]).where({ field: "id", op: "eq", value: uid }).all() as Array<{ username: string }>;
 		return u[0]?.username ?? null;
 	}
 	catch {
@@ -274,7 +274,7 @@ async function operatorOf(): Promise<string | null> {
 /** sys_solution_route enabled（reconcile route 一致性面；无行/查询失败 → null 不猜） */
 async function routeEnabledOf(name: string): Promise<boolean | null> {
 	try {
-		const rows = await db.query("select enabled from sys_solution_route where module = ? and deprecated = 0 limit 1", [name]) as Array<{ enabled: unknown }>;
+		const rows = await db.table("sys_solution_route").select(["enabled"]).where({ field: "module", op: "eq", value: name }).where({ field: "deprecated", op: "eq", value: 0 }).limit(1).all() as Array<{ enabled: unknown }>;
 		if (rows.length === 0) {
 			return null;
 		}
@@ -499,7 +499,7 @@ async function installBody(env: MarketEnv): Promise<{ task_id: string }> {
 			manifest,
 			name,
 			version,
-			operator: await operatorOf(),
+			operator: (await operatorOf()) ?? undefined,
 			state: await createStateStore(env.statePath),
 			archiveUrl,
 			sharedRoot: env.sharedRoot,
@@ -564,10 +564,13 @@ interface IndexRow {
 /** 最近一次安装操作人（回落 market_history 行；表不存在/查询失败/无行 → null，观测面不阻断索引） */
 async function lastInstallOperatorOf(name: string): Promise<string | null> {
 	try {
-		const rows = await db.query(
-			"select operator from market_history where solution = ? and action = 'install' order by created_at desc, rowid desc limit 1",
-			[name],
-		) as Array<{ operator: unknown }>;
+		const rows = await db.table("market_history")
+			.select(["operator"])
+			.where({ field: "solution", op: "eq", value: name })
+			.where({ field: "action", op: "eq", value: "install" })
+			.orderBy([{ field: "created_at", dir: "desc" }, { field: "rowid", dir: "desc" }])
+			.limit(1)
+			.all() as Array<{ operator: unknown }>;
 		const op = rows[0]?.operator;
 		return typeof op === "string" ? op : null;
 	}
@@ -728,7 +731,7 @@ export function createMarketApi(env: MarketEnv) {
 						state: await createStateStore(env.statePath),
 						modulesJsonPath: env.modulesJsonPath,
 						trustPath: env.trustPath,
-						operator: await operatorOf(),
+						operator: (await operatorOf()) ?? undefined,
 					});
 				});
 			},
@@ -851,7 +854,7 @@ export function createMarketApi(env: MarketEnv) {
 						lockPath: `${env.sharedRoot}/manifests.yaml`,
 						state: await createStateStore(env.statePath),
 						modulesJsonPath: env.modulesJsonPath,
-						operator: await operatorOf(),
+						operator: (await operatorOf()) ?? undefined,
 					});
 					// P3-11 宿主打磨：方案已不存在 = 资源缺失语义 → 404（非 200 {ok:false}）；
 					// 其余领域拒绝（空锁拒启/级联失败等）维持 200 {ok:false} 人话在 message。
@@ -869,10 +872,10 @@ export function createMarketApi(env: MarketEnv) {
 		"history": {
 			async get() {
 				await respond(async () => {
-					const rows = (await db.query(
-						"select solution, version, action, status, operator, message, created_at from market_history order by created_at desc",
-						[],
-					)) as Array<Record<string, unknown>>;
+					const rows = (await db.table("market_history")
+						.select(["solution", "version", "action", "status", "operator", "message", "created_at"])
+						.orderBy([{ field: "created_at", dir: "desc" }])
+						.all()) as Array<Record<string, unknown>>;
 					return rows ?? [];
 				});
 			},
@@ -880,4 +883,39 @@ export function createMarketApi(env: MarketEnv) {
 	};
 }
 
-export default createMarketApi(marketEnv());
+const marketApi = createMarketApi(marketEnv());
+
+// —— 契约 I/O（schema-first，oj v0.1.72+）：`.schema` 定义入参（body/query）、`.response`
+// 定义出参，供 oj 在 handler 运行前校验 + 生成式 __client 推导有类型函数（与 notification/api.ts
+// 同口径）。出参一律 additionalProperties:true 宽松，不约束运行期返回形状；入参对齐 handler 实际
+// 收口（source 枚举 / 必填项），oj 先校验、handler 仍自校验（双保险，不放松运行期语义）。
+marketApi.install.post.schema = {
+	body: {
+		type: "object",
+		required: ["source", "name"],
+		properties: { source: { type: "string", enum: ["cdn", "file"] }, name: { type: "string" }, version: { type: ["string", "null"] } },
+	},
+};
+marketApi.install.post.response = { type: "object", properties: { task_id: { type: "string" } }, additionalProperties: true };
+marketApi.install.cancel.post.schema = { body: { type: "object", required: ["name"], properties: { name: { type: "string" } } } };
+marketApi.install.cancel.post.response = { type: "object", properties: { ok: { type: "boolean" }, name: { type: "string" }, requested: { type: "boolean" } }, additionalProperties: true };
+marketApi.task.get.schema = { query: { type: "object", required: ["id"], properties: { id: { type: "string" } } } };
+marketApi.task.get.response = { type: "object", additionalProperties: true };
+marketApi.enable.post.schema = { body: { type: "object", required: ["name", "enabled"], properties: { name: { type: "string" }, enabled: { type: "boolean" } } } };
+marketApi.enable.post.response = { type: "object", additionalProperties: true };
+marketApi.meta.get.response = { type: "object", properties: { apiVersion: { type: "string" } }, additionalProperties: true };
+marketApi.trust.get.response = { type: "object", additionalProperties: true };
+marketApi.trust.post.schema = { body: { type: "object", required: ["task_id"], properties: { task_id: { type: "string" } } } };
+marketApi.trust.post.response = { type: "object", additionalProperties: true };
+marketApi.trust.key.post.schema = { body: { type: "object", required: ["key_id", "public_key"], properties: { key_id: { type: "string" }, public_key: { type: "string" } } } };
+marketApi.trust.key.post.response = { type: "object", additionalProperties: true };
+marketApi.trust.key.del.schema = { query: { type: "object", required: ["key_id"], properties: { key_id: { type: "string" } } } };
+marketApi.trust.key.del.response = { type: "object", additionalProperties: true };
+marketApi.index.get.response = { type: "array", items: { type: "object", additionalProperties: true } };
+marketApi["uninstall-impact"].get.schema = { query: { type: "object", required: ["name"], properties: { name: { type: "string" } } } };
+marketApi["uninstall-impact"].get.response = { type: "object", additionalProperties: true };
+marketApi.uninstall.post.schema = { body: { type: "object", required: ["name"], properties: { name: { type: "string" } } } };
+marketApi.uninstall.post.response = { type: "object", additionalProperties: true };
+marketApi.history.get.response = { type: "array", items: { type: "object", additionalProperties: true } };
+
+export default marketApi;

package/templates/api/src/_platform/migrations/0013__users_profile.sql

@@ -0,0 +1,4 @@
+-- 个人中心资料字段：phone_number/description 可空列——「我的资料」表单
+-- POST /api/personal-center/profile 入库用；可空先例同 0007（email）。
+ALTER TABLE users ADD COLUMN phone_number TEXT;
+ALTER TABLE users ADD COLUMN description TEXT;

package/templates/api/src/_platform/schema.yaml

@@ -1,7 +1,17 @@
 # 框架级共有表上收 _platform 伪模块（§3-D2）：归属图单源，杜绝「散在模块 seed」。
 # 与 manifest.tables 双向一致（S005）；auth 模块跨模块读 users 经 deps 声明。
 # D10：users.roles JSON 列已移除——角色唯一权威源为 sys_user_role 关系表。
+# _oj_migrations 为 oj 迁移 journal 内建表（oj 自建自管 DDL）；此处声明只为让 db.table
+# 元数据校验放行（journalHeadOf：深检 ledger 复核 + P3-11 预锁 guard 的真源），列与 oj 真表逐列对齐。
 tables:
+  _oj_migrations:
+    pk: [module, version]
+    columns:
+      module: {type: text, null: false}
+      version: {type: integer, null: false}
+      name: {type: text}
+      applied_on: {type: text}
+      checksum: {type: text}
   users:
     pk: id
     columns:
@@ -14,6 +24,8 @@ tables:
       must_change: {type: integer, null: false}
       is_forbidden: {type: integer, null: false}
       email: {type: text}
+      phone_number: {type: text}
+      description: {type: text}
   sys_setting:
     pk: key
     columns:
@@ -88,6 +100,20 @@ tables:
       expires_at: {type: integer, null: false}
       revoked: {type: integer, null: false}
       created_at: {type: integer, null: false}
+  # 限速/登录节流状态表（V9__sys_throttle 经迁移创建；rate.ts 经 db.table() 访问，
+  # 须在此声明 + 在 manifest.yaml tables 登记，否则 oj 表元数据校验报 unknown table）。
+  sys_rate_window:
+    pk: rate_key
+    columns:
+      rate_key: {type: text, null: false}
+      window_start: {type: integer, null: false}
+      count: {type: integer, null: false}
+  sys_login_throttle:
+    pk: pair_key
+    columns:
+      pair_key: {type: text, null: false}
+      fail_count: {type: integer, null: false}
+      blocked_until: {type: integer, null: false}
   # 市场操作历史（P4 上收 _platform）：install/enable/disable/uninstall/upgrade/rollback 六类动作留痕。
   # 写入由平台编排面（_lifecycle/history.ts recordHistory）落到本表；市场页只读消费。
   market_history:

package/templates/api/src/_platform/solutions/api.ts

@@ -24,7 +24,7 @@ import {
 } from "../_lifecycle/verify-checks";
 import { getLastReport, persistReport, verifyReportsDirOf } from "../_lifecycle/verify-report";
 import { respond } from "../_shared/respond";
-import { assertSystemAdmin } from "../_shared/service/access";
+import { assertSystemAdmin } from "../_shared/service/infra/access";
 import { journalHeadOf, siteOrigin } from "../_shared/site-facade";
 
 /** 线格式行（与 packages/runtime/src/api/rbac/types.ts 的 SolutionRouteRow 对齐） */
@@ -82,11 +82,11 @@ async function trustItemOf(env: SolutionsEnv, name: string): Promise<VerifyItem
 /** 深检主体：四项检查编排 + 可信性项 + i18n 依赖项，组装 VerifyReport{ok,checks,advise}（persist 归端点） */
 async function verifyBody(env: SolutionsEnv, name: string): Promise<VerifyReport> {
 	// 已装校验：sys_solution_route 有该 module 行（未装 → 404，端点门之一）
-	const routeRows = await db.query(
-		`select path, module, category, "order", title_key, required_permission, enabled
-		from sys_solution_route where deprecated = 0 and module = ?`,
-		[name],
-	) as Array<Record<string, unknown>>;
+	const routeRows = await db.table("sys_solution_route")
+		.select(["path", "module", "category", "order", "title_key", "required_permission", "enabled"])
+		.where({ field: "deprecated", op: "eq", value: 0 })
+		.where({ field: "module", op: "eq", value: name })
+		.all() as Array<Record<string, unknown>>;
 	if (routeRows.length === 0)
 		throw Object.assign(new Error(`方案「${name}」未安装或无路由注册`), { status: 404 });
 
@@ -97,13 +97,13 @@ async function verifyBody(env: SolutionsEnv, name: string): Promise<VerifyReport
 
 	// ② RBAC 完整性：声明权限点 ↔ sys_permission 实有
 	const declaredPerms = [...new Set(routes.map(r => r.required_permission).filter((p): p is string => p != null))];
-	const permRows = await db.query("select code from sys_permission") as Array<{ code: string }>;
+	const permRows = await db.table("sys_permission").select(["code"]).all() as Array<{ code: string }>;
 	const rbac = diffPermRows(declaredPerms, new Set(permRows.map(r => r.code)));
 
 	// ③ 设置完整性：manifest 声明设置 key ↔ sys_setting 实有（永不含值）
 	const manifest = await readSolutionManifest(env, name);
 	const declaredSettings = manifest ? declaredSettingsOf(manifest.manifest) : [];
-	const settingRows = await db.query("select key from sys_setting where module = ? and deprecated = 0", [name]) as Array<{ key: string }>;
+	const settingRows = await db.table("sys_setting").select(["key"]).where({ field: "module", op: "eq", value: name }).where({ field: "deprecated", op: "eq", value: 0 }).all() as Array<{ key: string }>;
 	const settings = diffSettingRows(declaredSettings, new Set(settingRows.map(r => r.key)));
 
 	// ④ 迁移账本：manifest 迁移目录最高版本 ↔ _oj_migrations 实有（journalHeadOf 复用，DRY）
@@ -167,10 +167,11 @@ export function createSolutionsApi(env: SolutionsEnv) {
 					return;
 				}
 				await respond(async () => {
-					const rows = await db.query(
-						`select path, module, category, "order", title_key, required_permission, enabled
-						from sys_solution_route where deprecated = 0 order by module, "order", path`,
-					) as Array<Record<string, unknown>>;
+					const rows = await db.table("sys_solution_route")
+						.select(["path", "module", "category", "order", "title_key", "required_permission", "enabled"])
+						.where({ field: "deprecated", op: "eq", value: 0 })
+						.orderBy([{ field: "module" }, { field: "order" }, { field: "path" }])
+						.all() as Array<Record<string, unknown>>;
 					return rows.map(rowOf);
 				});
 			},

package/templates/api/src/auth/_shared/ldap-login.ts

@@ -25,7 +25,7 @@ function fail(status: number, message: string): never {
 }
 
 async function setting(key: string): Promise<string> {
-	const rows = await db.query("select value from sys_setting where key = ?", [key]) as Array<{ value: string | null }>;
+	const rows = await db.table("sys_setting").select(["value"]).where({ field: "key", op: "eq", value: key }).all() as Array<{ value: string | null }>;
 	return rows[0]?.value == null ? "" : String(rows[0].value);
 }
 
@@ -64,20 +64,24 @@ export function createLdapLogin(session: Pick<Session, "issueExternal">, gateway
 		// JIT find-or-create：键 "ldap:<uid>"，占位 hash "!ldap" 恒 verify false（低信任来源不接管本地号）；
 		// must_change=0——外来号无本地旧口令，悬挂期唯一可用写端（改密）必失败 = 号 brick（设计 §9.4）
 		const localName = `ldap:${username}`;
-		let rows = await db.query("select id, is_forbidden from users where username = ?", [localName]) as Array<{ id: number, is_forbidden: number }>;
+		let rows = await db.table("users").select(["id", "is_forbidden"]).where({ field: "username", op: "eq", value: localName }).all() as Array<{ id: number, is_forbidden: number }>;
 		if (!rows.length) {
 			try {
-				await db.exec(
-					"insert into users (username, password_hash, source, email, must_change, is_forbidden) values (?, '!ldap', 'ldap', ?, 0, 0)",
-					[localName, firstAttr(entries[0].attrs, emailAttr) || null],
-				);
+				await db.table("users").insert({
+					username: localName,
+					password_hash: "!ldap",
+					source: "ldap",
+					email: firstAttr(entries[0].attrs, emailAttr) || null,
+					must_change: 0,
+					is_forbidden: 0,
+				}).run();
 			}
 			catch (e) {
 				// 唯一约束兜底（预查与插入间的竞态，同 createUser 模式）：撞 username → 回查复用；其余照抛
 				if (!/unique|constraint/i.test(e instanceof Error ? e.message : String(e)))
 					throw e;
 			}
-			rows = await db.query("select id, is_forbidden from users where username = ?", [localName]) as Array<{ id: number, is_forbidden: number }>;
+			rows = await db.table("users").select(["id", "is_forbidden"]).where({ field: "username", op: "eq", value: localName }).all() as Array<{ id: number, is_forbidden: number }>;
 		}
 		if (Number(rows[0].is_forbidden) === 1)
 			fail(403, "account disabled");

package/templates/api/src/auth/_shared/login-throttle.ts

@@ -1,7 +1,7 @@
 // 登录限速编排（B5/AC1-26）：auth/login 与 auth/ldap-login 共用的 (IP, username) 双维度守卫 + 失败记账。
 // 状态全在 DB（sys_login_throttle/sys_rate_window，迁移 0009）——oj 每请求重建模块，进程内方案恒失效（§9.3-3）。
-import { auditOp } from "../../_platform/_shared/service/audit";
-import { loginBlocked, loginFailed, loginSucceeded, rateLimit } from "../../_platform/_shared/service/rate";
+import { auditOp } from "../../_platform/_shared/service/infra/audit";
+import { loginBlocked, loginFailed, loginSucceeded, rateLimit } from "../../_platform/_shared/service/infra/rate";
 
 /** 客户端 IP：优先 X-Forwarded-For（反代后），回落 X-Real-IP。 */
 export async function clientIp(): Promise<string> {

package/templates/api/src/auth/_shared/session.ts

@@ -4,8 +4,8 @@
 // B4：access JWT 仅载 sub（roles 走登录响应/资料接口，不进 claims）。
 // B3：refresh = 不透明随机串 + DB 存 SHA-256 哈希（sys_refresh_token，迁移 0008）；
 //     轮换作旧 + 滑动窗口（绝对 TTL 封顶 min(旧 exp, now+30d)）；reuse 检测全族吊销 + 审计。
-import { invalidateUser } from "../../_platform/_shared/service/access";
-import { recordOp } from "../../_platform/_shared/service/audit";
+import { invalidateUser } from "../../_platform/_shared/service/infra/access";
+import { recordOp } from "../../_platform/_shared/service/infra/audit";
 
 export interface SessionDeps {
 	randomHex: (bytes: number) => string
@@ -59,13 +59,10 @@ export function createSession(deps: SessionDeps = runtimeDeps()) {
 	const hashOf = (token: string) => deps.sha256Hex(token);
 
 	async function profileOf(uid: number): Promise<SessionUser> {
-		const rows = await db.query(
-			"select id, username, display_name, avatar_base64, must_change from users where id = ?",
-			[uid],
-		) as Array<Record<string, unknown>>;
+		const rows = await db.table("users").select(["id", "username", "display_name", "avatar_base64", "must_change"]).where({ field: "id", op: "eq", value: uid }).all() as Array<Record<string, unknown>>;
 		if (!rows[0])
 			fail(404, "user not found");
-		const roleRows = await db.query("select role_name from sys_user_role where user_id = ?", [uid]) as Array<{ role_name: string }>;
+		const roleRows = await db.table("sys_user_role").select(["role_name"]).where({ field: "user_id", op: "eq", value: uid }).all() as Array<{ role_name: string }>;
 		return {
 			id: uid,
 			username: String(rows[0].username),
@@ -79,10 +76,13 @@ export function createSession(deps: SessionDeps = runtimeDeps()) {
 	async function issueFor(uid: number): Promise<TokenBundle> {
 		const user = await profileOf(uid);
 		const refreshToken = deps.randomHex(32);
-		await db.exec(
-			"insert into sys_refresh_token (token_hash, user_id, expires_at, revoked, created_at) values (?, ?, ?, 0, ?)",
-			[hashOf(refreshToken), uid, now() + deps.refreshTtlSecs, now()],
-		);
+		await db.table("sys_refresh_token").insert({
+			token_hash: hashOf(refreshToken),
+			user_id: uid,
+			expires_at: now() + deps.refreshTtlSecs,
+			revoked: 0,
+			created_at: now(),
+		}).run();
 		return {
 			access_token: await deps.signAccess(String(uid)),
 			refresh_token: refreshToken,
@@ -94,13 +94,13 @@ export function createSession(deps: SessionDeps = runtimeDeps()) {
 
 	/** 吊销联动（§3.1）：禁用/重置口令/改密 → 删该用户全部 refresh 记录。 */
 	async function revokeAll(uid: number): Promise<void> {
-		await db.exec("delete from sys_refresh_token where user_id = ?", [uid]);
+		await db.table("sys_refresh_token").where({ field: "user_id", op: "eq", value: uid }).delete().run();
 	}
 
 	return {
 		/** B1+D14：本地登录——先验口令后查禁用；号不存在/口令错/禁用统一 401（不泄露账号状态）。 */
 		async localLogin(username: string, password: string): Promise<TokenBundle> {
-			const rows = await db.query("select id, password_hash, is_forbidden from users where username = ?", [String(username ?? "")]) as Array<Record<string, unknown>>;
+			const rows = await db.table("users").select(["id", "password_hash", "is_forbidden"]).where({ field: "username", op: "eq", value: String(username ?? "") }).all() as Array<Record<string, unknown>>;
 			const row = rows[0];
 			if (!row || !(await deps.bcryptVerify(String(password ?? ""), String(row.password_hash))))
 				fail(401, "invalid credentials");
@@ -111,7 +111,8 @@ export function createSession(deps: SessionDeps = runtimeDeps()) {
 
 		/** B3：刷新——轮换作旧；reuse 检测（已吊销串二次出现）全族吊销 + 审计。 */
 		async refresh(token: string): Promise<TokenBundle> {
-			const rows = await db.query("select * from sys_refresh_token where token_hash = ?", [hashOf(String(token ?? ""))]) as Array<Record<string, unknown>>;
+			// 构造器（v0.1.81）：select(["*"]) 显式拉全列，无已知列清单也能用，方言无关。
+			const rows = await db.table("sys_refresh_token").select(["*"]).where({ field: "token_hash", op: "eq", value: hashOf(String(token ?? "")) }).all() as Array<Record<string, unknown>>;
 			const row = rows[0];
 			if (!row)
 				fail(401, "invalid or expired refresh token");
@@ -123,14 +124,17 @@ export function createSession(deps: SessionDeps = runtimeDeps()) {
 			}
 			if (Number(row.expires_at) <= now())
 				fail(401, "invalid or expired refresh token");
-			await db.exec("update sys_refresh_token set revoked = 1 where token_hash = ?", [row.token_hash]);
+			await db.table("sys_refresh_token").update({ revoked: 1 }).where({ field: "token_hash", op: "eq", value: row.token_hash }).run();
 			// 滑动窗口 + 绝对 30d 封顶（§3.1「绝对 TTL + 滑动」）
 			const newExp = Math.min(Number(row.expires_at), now() + deps.refreshTtlSecs);
 			const refreshToken = deps.randomHex(32);
-			await db.exec(
-				"insert into sys_refresh_token (token_hash, user_id, expires_at, revoked, created_at) values (?, ?, ?, 0, ?)",
-				[hashOf(refreshToken), uid, newExp, now()],
-			);
+			await db.table("sys_refresh_token").insert({
+				token_hash: hashOf(refreshToken),
+				user_id: uid,
+				expires_at: newExp,
+				revoked: 0,
+				created_at: now(),
+			}).run();
 			const user = await profileOf(uid);
 			return {
 				access_token: await deps.signAccess(String(uid)),
@@ -143,7 +147,7 @@ export function createSession(deps: SessionDeps = runtimeDeps()) {
 
 		/** AC1-27：自助改密——本人 + 旧口令校验；改密清 must_change、级联删 refresh、换发正式 token。 */
 		async changePassword(uid: number, oldPassword: string, newPassword: string): Promise<TokenBundle> {
-			const rows = await db.query("select password_hash from users where id = ?", [uid]) as Array<{ password_hash: string }>;
+			const rows = await db.table("users").select(["password_hash"]).where({ field: "id", op: "eq", value: uid }).all() as Array<{ password_hash: string }>;
 			if (!rows[0])
 				fail(404, "user not found");
 			if (!(await deps.bcryptVerify(String(oldPassword ?? ""), String(rows[0].password_hash))))
@@ -152,8 +156,8 @@ export function createSession(deps: SessionDeps = runtimeDeps()) {
 				fail(400, "password too short (min 6)");
 			const hash = await deps.bcryptHash(String(newPassword));
 			await db.tx(async (t) => {
-				await t.exec("update users set password_hash = ?, must_change = 0 where id = ?", [hash, uid]);
-				await t.exec("delete from sys_refresh_token where user_id = ?", [uid]);
+				await t.table("users").update({ password_hash: hash, must_change: 0 }).where({ field: "id", op: "eq", value: uid }).run();
+				await t.table("sys_refresh_token").where({ field: "user_id", op: "eq", value: uid }).delete().run();
 			});
 			invalidateUser(uid);
 			return issueFor(uid);

package/templates/api/src/auth/api.ts

@@ -36,7 +36,7 @@ const logout = {
 	// POST /api/auth/logout —— 吊销当前 refresh 串（access 到期前仍有效，语义同旧版）。
 	async post() {
 		const token = String((http.body || {}).refresh_token ?? "");
-		await db.exec("delete from sys_refresh_token where token_hash = ?", [crypto.sha256Hex(token)]);
+		await db.table("sys_refresh_token").where({ field: "token_hash", op: "eq", value: crypto.sha256Hex(token) }).delete().run();
 		json.ok(null);
 	},
 };

package/templates/api/src/demo/todos/api.ts

@@ -6,15 +6,15 @@
 const todos = {
 	async get() {
 		const kw = http.query.keyword;
-		const where = kw ? "WHERE title LIKE ?" : "";
-		const params = kw ? [`%${kw}%`] : [];
+		const hasKw = typeof kw === "string" && kw.length > 0;
+		// 构造器：模糊过滤走语义 op（contains 自动转义 %/_/!），count 走聚合，方言无关。
+		const build = () => db.table("todos").whereIf(hasKw, { field: "title", op: "contains", value: kw });
 		try {
-			const totalRows = await db.query(`SELECT COUNT(*) AS c FROM todos ${where}`, params);
-			const total = Number(totalRows[0]?.c ?? 0);
-			const rows = await db.query(
-				`SELECT id, title, done, create_time, update_time FROM todos ${where} ORDER BY id ASC`,
-				params,
-			);
+			const total = Number((await build().select([{ fn: "count", as: "c" }]).all())[0]?.c ?? 0);
+			const rows = await build()
+				.select(["id", "title", "done", "create_time", "update_time"])
+				.orderBy([{ field: "id", dir: "asc" }])
+				.all();
 			const list = rows.map(r => ({
 				id: Number(r.id),
 				title: String(r.title),

package/templates/api/src/home/line/api.ts

@@ -12,10 +12,10 @@ const line = {
 			const today = Math.floor(Date.now() / 86400000);
 			const start = today - days + 1;
 
-			const rows = await db.query(
-				"SELECT day, SUM(value) AS v FROM home_line WHERE day >= ? AND day <= ? GROUP BY day",
-				[start, today],
-			);
+			const rows = await db.table("home_line").select([
+				"day",
+				{ fn: "sum", field: "value", as: "v" },
+			]).where({ field: "day", op: "gte", value: start }).where({ field: "day", op: "lte", value: today }).groupBy(["day"]).all();
 			const map = new Map<number, number>();
 			for (const r of rows)
 				map.set(Number(r.day), Number(r.v));

package/templates/api/src/home/pie/api.ts

@@ -6,10 +6,10 @@
 const pie = {
 	async get() {
 		try {
-			const rows = await db.query(
-				"SELECT category, SUM(value) AS v FROM home_pie GROUP BY category",
-				[],
-			);
+			const rows = await db.table("home_pie").select([
+				"category",
+				{ fn: "sum", field: "value", as: "v" },
+			]).groupBy(["category"]).all();
 			json.ok(rows.map(r => ({ code: String(r.category), value: Number(r.v) })));
 		}
 		catch (e) {