@oj-module/cli 0.2.6 → 0.2.14

package/templates/api/tests/l1-builder.test.ts

@@ -0,0 +1,91 @@
+// L1 回归（`oj test` 收集，*.test.ts；与 vitest 的 *.spec.ts 互不干扰）。
+//
+// 为什么有这类文件：SQL 构造器是 oj 二进制内的纯 Rust 实现，vitest 夹具够不着真
+// builder（架构定论：无 JS 模块可导、不写运行时垫片）——模板 tests/*.spec.ts 只能做
+// L2 记录型断言。**真执行面**（SQL 渲染 / 真过滤 / 真转义）在这里经 oj test 闭环：
+// 真 v8 + 真路由/鉴权 + 真迁移/seed + 真 db + 真构造器（方法论见 devkit oj-test-guide.md）。
+//
+// 覆盖 0.1.81/0.1.82 构造器迁移的关键行为：
+//   ① settings 真构造器（IN + LIMIT）——vitest 侧同源码 5 个用例红海的对照面；
+//   ② demo/todos：whereIf 真跳过（无 keyword 不过滤）+ contains 真渲染（%kw% + 元字符转义）；
+//   ③ notification：join ON 值条件 + UNION ALL + 字面量列 {lit,as} 的真渲染（场景 41 同款）。
+//
+// 登录账号：fixtures 的 l1tester（src/_platform/fixtures/l1-test-user.sql，仅 oj test 灌入）。
+// 不用 seed 的 admin：其 must_change=1（判权端点恒 403）且初始口令 123456 会随用户
+// 首登改密漂移——L1 绑 admin 曾实测 401。l1tester 为 additive 专用账号（must_change=0）。
+//
+// 运行：cd packages/cli/templates/api && ~/.local/share/oj/oj test -c config.yaml -d src -t tests
+
+const L1_USER = { username: "l1tester", password: "l1test1234" };
+const asL1 = async () => ({ Authorization: `Bearer ${await client.login(L1_USER.username, L1_USER.password)}` });
+
+describe("l1：0.1.81/0.1.82 构造器迁移真执行面", () => {
+	it("匿名 login-methods：真构造器（IN + LIMIT 渲染）返回 200 + 方法数组", async () => {
+		const r = await client.get("/system/login-methods");
+		expect(r.status).toBe(200);
+		const body = JSON.parse(r.body);
+		expect(body.code).toBe(0);
+		expect(Array.isArray(body.data.methods)).toBeTruthy();
+		expect(body.data.methods).toContain("local");
+	});
+
+	it("demo/todos 无 keyword：whereIf 真跳过（不发射条件），全量 4 条", async () => {
+		const h = await asL1();
+		const r = await client.get("/demo/todos", { headers: h });
+		expect(r.status).toBe(200);
+		const body = JSON.parse(r.body);
+		expect(body.data.total).toBe(4);
+		expect(body.data.list.length).toBe(4); // L1 expect 无 toHaveLength（契约见 api-manual §9）
+	});
+
+	it("demo/todos keyword=契约：contains 真渲染（%kw%）精确命中 1 条", async () => {
+		const h = await asL1();
+		const r = await client.get(`/demo/todos?keyword=${encodeURIComponent("契约")}`, { headers: h });
+		expect(r.status).toBe(200);
+		const body = JSON.parse(r.body);
+		expect(body.data.total).toBe(1);
+		expect(String(body.data.list[0].title)).toContain("契约");
+	});
+
+	it("demo/todos keyword=%：LIKE 元字符经引擎转义不泛化（0 命中且不炸）", async () => {
+		const h = await asL1();
+		const r = await client.get(`/demo/todos?keyword=${encodeURIComponent("%")}`, { headers: h });
+		expect(r.status).toBe(200);
+		expect(JSON.parse(r.body).data.total).toBe(0);
+	});
+
+	it("notification 列表：join ON 值条件 + UNION + 字面量 scope 列真渲染，按人/广播分流", async () => {
+		const h = await asL1();
+		// 自给自足（oj-test-guide §6 纪律：按自己推的行精确断言，不依赖 seed 的 user_id=1）：
+		// 先清空本人视图，再经真 push 端点各发一条按人 + 一条广播，回来过 list 断言。
+		const clear = await client.post("/notification/notifications/clear", { headers: h });
+		expect(clear.status).toBe(200);
+
+		const pushUser = await client.post("/notification/push", {
+			headers: h,
+			body: JSON.stringify({ title: "L1 按人通知", message: "join ON 值条件 + UNION 真渲染" }),
+		});
+		expect(pushUser.status).toBe(200);
+		const userId = String(JSON.parse(pushUser.body).data.id);
+		expect(userId.startsWith("u:")).toBeTruthy(); // 命名空间 id：按人
+
+		const pushBcast = await client.post("/notification/push-broadcast", {
+			headers: h,
+			body: JSON.stringify({ title: "L1 广播通知", message: "LEFT JOIN 回执 + 字面量 scope 列" }),
+		});
+		expect(pushBcast.status).toBe(200);
+		const bcastId = String(JSON.parse(pushBcast.body).data.id);
+		expect(bcastId.startsWith("b:")).toBeTruthy(); // 命名空间 id：广播
+
+		const r = await client.get("/notification/notifications", { headers: h });
+		expect(r.status).toBe(200);
+		const list = JSON.parse(r.body).data as Array<Record<string, unknown>>;
+		expect(Array.isArray(list)).toBeTruthy();
+		const byId = new Map(list.map(n => [String(n.id), n]));
+		// {lit:"user",as:"scope"} / {lit:"broadcast",...} 经 UNION 落到首列名——两条各带正确作用域
+		expect(byId.get(userId)?.scope).toBe("user");
+		expect(byId.get(bcastId)?.scope).toBe("broadcast");
+		expect(String(byId.get(userId)?.title)).toBe("L1 按人通知");
+		expect(String(byId.get(bcastId)?.title)).toBe("L1 广播通知");
+	});
+});

package/templates/api/tests/lifecycle/installer.spec.ts

@@ -28,7 +28,7 @@ import { acquireTaskLock, commitLockEntry, parseLock, readLock, serializeLock, w
 import { createStateStore } from "../../src/_platform/_lifecycle/state";
 import { getTask, readTasks, redact, sweepTimedOut, writeTask } from "../../src/_platform/_lifecycle/tasks";
 import { createTrustStore } from "../../src/_platform/_lifecycle/trust";
-import { installDb, MARKET_HISTORY_DDL } from "../fixture";
+import { installDb } from "../fixture";
 
 const g = globalThis as any;
 
@@ -979,7 +979,6 @@ describe("market_history 留痕（P1-15a 缺口 A）：install/enable/disable/un
 	}
 
 	it("runInstall 终态（done）落 install 历史（守卫式：随主流程写，失败不阻断）", async () => {
-		dbo.exec(MARKET_HISTORY_DDL);
 		const t = await runInstall(makeReq());
 		expect(t.status).toBe("done");
 		const hist = rows("SELECT solution, version, action, status, operator, message FROM market_history");
@@ -989,7 +988,6 @@ describe("market_history 留痕（P1-15a 缺口 A）：install/enable/disable/un
 	});
 
 	it("setEnabled 落 disable/enable 历史（status=success，message 与返回人话一致）", async () => {
-		dbo.exec(MARKET_HISTORY_DDL);
 		await seedHistory();
 		const off = await setEnabled({ name: "demo-solution", enabled: false, sharedRoot, lockPath, state, modulesJsonPath });
 		const on = await setEnabled({ name: "demo-solution", enabled: true, sharedRoot, lockPath, state, modulesJsonPath });
@@ -1185,7 +1183,6 @@ describe("P1-16 接线：reconcile 不一致自动修复（重跑 setEnabled）+
 	});
 
 	it("operator 通道：runInstall / setEnabled 的 operator 落 market_history（缺省 null 语义不变）", async () => {
-		dbo.exec(MARKET_HISTORY_DDL);
 		await writeLock(lockPath, { "demo-solution": "0.1.0", "auth": "0.1.0" });
 		await state.write({ solutions: { "demo-solution": { version: "0.1.0", enabled: true, installedAt: 1000 } } });
 		await fsp.mkdir(join(sharedRoot, "demo-solution-0.1.0"), { recursive: true });

package/templates/api/tests/lifecycle/market-api.spec.ts

@@ -26,9 +26,9 @@ import { readLock, writeLock } from "../../src/_platform/_lifecycle/lock";
 import { createStateStore } from "../../src/_platform/_lifecycle/state";
 import { getTask, writeTask } from "../../src/_platform/_lifecycle/tasks";
 import { createTrustStore } from "../../src/_platform/_lifecycle/trust";
-import { invalidateAllUsers } from "../../src/_platform/_shared/service/access";
+import { invalidateAllUsers } from "../../src/_platform/_shared/service/infra/access";
 import { createMarketApi, marketEnv, parseVersionsJson, versionsJsonPathOf } from "../../src/_platform/market/api";
-import { installDb, MARKET_HISTORY_DDL } from "../fixture";
+import { installDb } from "../fixture";
 
 function hexToBytes(hex: string): Uint8Array {
 	const out = new Uint8Array(hex.length / 2);
@@ -680,7 +680,6 @@ describe("GET index（CDN bundles.yaml no-cache 拉取 + 本地 state 对比）"
 	});
 
 	it("operator 回落 history 行（P2-11：最近一次 install 动作的 operator；表缺失/无行 → null 不炸）", async () => {
-		dbo.exec(MARKET_HISTORY_DDL);
 		dbo.prepare("insert into market_history (solution, version, action, status, operator, message, created_at) values (?, ?, ?, ?, ?, ?, ?)")
 			.run("demo-solution", "0.1.0", "install", "done", "alice", "", 1700000000);
 		const api = createMarketApi(makeEnv());
@@ -917,7 +916,6 @@ describe("P1-16 接线：marketEnv 生产口径 / exec opts 转发 / operator
 	});
 
 	it("operator 通道：install/enable 端点按 http.user.id 反查 username 落 market_history（uninstall 同款反查）", async () => {
-		dbo.exec(MARKET_HISTORY_DDL);
 		// 预置「已装」最小形态（enable 用例同款：单条目禁用会触发空锁拒启，S1-1.2）
 		await writeLock(join(sharedRoot, "manifests.yaml"), { "demo-solution": "0.1.0", "other": "1.0.0" });
 		const state = await createStateStore(join(sharedRoot, ".solutions", "state.yaml"));

package/templates/api/tests/lifecycle/steps-fs.spec.ts

@@ -514,7 +514,7 @@ describe("checkModuleManifest（C2-31 安装期复核纯函数：C2 manifest ↔
 	const c2 = { name: "demo-solution", version: "0.1.0", summary: "演示方案 Demo — émoji 🎉" };
 	const native = { name: "demo-solution", desc: "演示方案 Demo — émoji 🎉", version: "0.1.0" };
 
-	it("合法：desc === summary（多字节逐字相等）、name/version 三方一致、七键之内 → ok", () => {
+	it("合法：name/version 三方一致、desc 非空、七键之内 → ok", () => {
 		expect(checkModuleManifest(c2, native, "demo-solution", "0.1.0")).toEqual({ ok: true });
 	});
 
@@ -535,10 +535,9 @@ describe("checkModuleManifest（C2-31 安装期复核纯函数：C2 manifest ↔
 		expect(r.ok).toBe(false);
 	});
 
-	it("desc !== summary → 拒（构建期映射被篡改/上游不一致）", () => {
+	it("desc !== summary → 放行（等值要求已于 2026-10-21 移除：desc 只是模块描述，非安全边界）", () => {
 		const r = checkModuleManifest(c2, { ...native, desc: "另一个描述" }, "demo-solution", "0.1.0");
-		expect(r.ok).toBe(false);
-		expect(!r.ok && r.message).toContain("desc");
+		expect(r.ok).toBe(true);
 	});
 
 	it("name 或 version 与包身份不一致 → 拒", () => {
@@ -613,11 +612,9 @@ describe("extract C2-31 安装期复核（B-11：api 段声明与包内原生清
 		expect(r.message).toContain("C2-31");
 	});
 
-	it("包内原生清单 desc !== summary → C2-31 拒（映射被篡改）", async () => {
+	it("包内原生清单 desc !== summary → 放行（等值校验已移除）", async () => {
 		await seedBundle({ nativeManifest: { name: "demo-solution", desc: "另一个描述", version: "0.1.0" } });
 		const r = await extract(exCtx({ manifest: c2Manifest(), exec: realTarExec() }));
-		expect(r.ok).toBe(false);
-		expect(r.retryable).toBe(false);
-		expect(r.message).toContain("C2-31");
+		expect(r.ok).toBe(true);
 	});
 });

package/templates/api/tests/lifecycle/trust.spec.ts

@@ -11,7 +11,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import { createTrustStore, isValidKeyId } from "../../src/_platform/_lifecycle/trust";
-import { invalidateAllUsers } from "../../src/_platform/_shared/service/access";
+import { invalidateAllUsers } from "../../src/_platform/_shared/service/infra/access";
 import { createMarketApi, marketEnv } from "../../src/_platform/market/api";
 import { installDb } from "../fixture";
 

package/templates/api/tests/lifecycle/uninstall.spec.ts

@@ -2,8 +2,8 @@
 // 端点（createMarketApi 的 uninstall-impact / uninstall）只做门禁 + 取参 + 调 runUninstall；
 // 编排器负责四处同删（锁/sidecar/sys_solution_route/modules.json）+ 权限级联 uninstallSolution
 // + 版本目录移除 + 审计 + 全用户失效 + market_history 留痕。本规格为验收锚点。
-// 夹具：本仓范式（node:sqlite 真实迁移建表 + 真实 fs 面 g.fs）；market_history 表真源随市场
-// 方案包（fixture.MARKET_HISTORY_DDL 同构建表），守卫语义（表不存在静默跳过）单列一例。
+// 夹具：本仓范式（node:sqlite 真实迁移建表 + 真实 fs 面 g.fs）；market_history 表由平台迁移
+// 0012（IF NOT EXISTS）随 installDb 重放建立，守卫语义（表不存在静默跳过）单列一例。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（market-api.spec 同约定） */
 import type { FsFace } from "../../src/_platform/_lifecycle/atomic";
 import type { MarketEnv } from "../../src/_platform/market/api";
@@ -13,10 +13,10 @@ import { dirname, join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import { readLock, writeLock } from "../../src/_platform/_lifecycle/lock";
 import { createStateStore } from "../../src/_platform/_lifecycle/state";
-import { catalogSpec, collectRetainedTables, tablePrefixPattern } from "../../src/_platform/_lifecycle/uninstall";
-import { invalidateAllUsers } from "../../src/_platform/_shared/service/access";
+import { collectRetainedTables, moduleTablePrefix } from "../../src/_platform/_lifecycle/uninstall";
+import { invalidateAllUsers } from "../../src/_platform/_shared/service/infra/access";
 import { createMarketApi } from "../../src/_platform/market/api";
-import { installDb, MARKET_HISTORY_DDL } from "../fixture";
+import { installDb } from "../fixture";
 
 const g = globalThis as any;
 
@@ -67,7 +67,6 @@ async function seedInstalled(opts: { withOther?: boolean } = {}): Promise<void>
 		{ name: "demo-solution", enabled: true, src: "modules/demo-solution/" },
 		...(withOther ? [{ name: "other", enabled: true, src: "modules/other/" }] : []),
 	]));
-	dbo.exec(MARKET_HISTORY_DDL);
 	dbo.prepare("INSERT INTO sys_solution_route (path, module, category) VALUES (?, ?, ?)").run("/demo-solution", "demo-solution", "main");
 	dbo.prepare("INSERT INTO sys_role (name, module, title, builtin) VALUES (?, ?, ?, 0)").run("demo-solution.admin", "demo-solution", "管理员");
 	dbo.prepare("INSERT INTO sys_role (name, module, title, builtin) VALUES (?, ?, ?, 0)").run("demo-solution.viewer", "demo-solution", "访客");
@@ -295,92 +294,33 @@ describe("P3-4 业务表保留提示（Q4：不删业务数据，retained 回传
 	});
 });
 
-describe("P4-1 多方言卸载矩阵（P3-4#2）：catalogSpec 三方言 SQL 形态 + 前缀转义方言无关", () => {
-	it("catalogSpec 三方言 existing SQL 形态正确（sqlite=sqlite_master / mysql/pg=information_schema）", () => {
-		const sqlite = catalogSpec("sqlite");
-		const mysql = catalogSpec("mysql");
-		const pg = catalogSpec("pg");
-		expect(sqlite.existing).toBe("SELECT name FROM sqlite_master WHERE type='table'");
-		expect(mysql.existing).toContain("information_schema.tables");
-		expect(mysql.existing).toContain("DATABASE()");
-		expect(pg.existing).toContain("information_schema.tables");
-		expect(pg.existing).toContain("table_schema = 'public'");
+describe("P4-1 卸载业务表保留清单（P3-4#2）：moduleTablePrefix + db.listTables 方言无关", () => {
+	it("moduleTablePrefix 连字符→下划线作表前缀（listTables 内部按字面量前缀匹配，无需手拼 %）", () => {
+		expect(moduleTablePrefix("demo-solution")).toBe("demo_solution_");
+		expect(moduleTablePrefix("a!b%c_d")).toBe("a!b%c_d_");
 	});
 
-	it("catalogSpec.like 三方言均带 ESCAPE '!' + 正确 schema 表达式 + 参数化 pat", () => {
-		const pat = "demo_solution_%";
-		const sqlite = catalogSpec("sqlite").like(pat);
-		const mysql = catalogSpec("mysql").like(pat);
-		const pg = catalogSpec("pg").like(pat);
-		// sqlite
-		expect(sqlite[0]).toBe("SELECT name FROM sqlite_master WHERE type='table' AND name LIKE ? ESCAPE '!'");
-		expect(sqlite[1]).toEqual([pat]);
-		// mysql：information_schema + DATABASE() + ESCAPE + 参数化（值不拼字符串，SSRF/注入无关但口径统一）
-		expect(mysql[0]).toContain("information_schema.tables");
-		expect(mysql[0]).toContain("DATABASE()");
-		expect(mysql[0]).toContain("ESCAPE '!'");
-		expect(mysql[1]).toEqual([pat]);
-		// pg：information_schema + 'public' + ESCAPE + 参数化
-		expect(pg[0]).toContain("information_schema.tables");
-		expect(pg[0]).toContain("table_schema = 'public'");
-		expect(pg[0]).toContain("ESCAPE '!'");
-		expect(pg[1]).toEqual([pat]);
-	});
-
-	it("tablePrefixPattern 转义 !%_ 且连字符→下划线作表前缀", () => {
-		// 连字符→下划线后，该下划线亦被转义（!_）= 字面分隔符而非 LIKE 通配，避免前缀扫描越权命中
-		expect(tablePrefixPattern("demo-solution")).toBe("demo!_solution_%");
-		// 危险字符必须转义，避免 LIKE 通配语义被注入（防前缀扫描越权命中）
-		expect(tablePrefixPattern("a!b%c_d")).toBe("a!!b!%c!_d_%");
-	});
-});
-
-describe("P4-1 多方言卸载矩阵（续）：collectRetainedTables 经 db.dialect 走 mysql/pg 信息_schema 路径", () => {
-	/** 注入指定方言的 db.query 桩：existing 返回全表清单、like 返回前缀命中，模拟 information_schema 行为 */
-	function stubDialect(dialect: "mysql" | "pg", existingNames: string[], likeNames: string[]): void {
-		const spec = catalogSpec(dialect);
-		(g.db as { dialect: () => string, query: (sql: string, p?: unknown[]) => unknown }).dialect = () => dialect;
-		(g.db as { query: (sql: string, p?: unknown[]) => unknown }).query = (sql: string) => {
-			if (sql === spec.existing)
-				return existingNames.map(name => ({ name }));
-			if (sql.includes("AND table_name LIKE"))
-				return likeNames.map(name => ({ name }));
-			return [];
-		};
-	}
-
-	it("mysql 方言：manifest 声明 + 前缀兜底扫描均经 information_schema，返回实际存在的业务表", async () => {
+	it("manifest 声明 + 前缀兜底经 db.listTables 合并，仅回传实际存在的业务表", async () => {
 		await seedInstalledWithTables();
-		stubDialect("mysql", ["demo_solution_notes", "demo_solution_tags", "demo_solution_orphan"], ["demo_solution_orphan"]);
-		const retained = await collectRetainedTables("demo-solution", join(sharedRoot, "demo-solution-0.1.0", "manifest.yaml"));
-		expect(retained).toContain("demo_solution_notes");
-		expect(retained).toContain("demo_solution_tags");
-		expect(retained).toContain("demo_solution_orphan");
-	});
-
-	it("pg 方言：'public' schema 表达式路径一致，返回业务表（与 mysql 口径相同）", async () => {
-		await seedInstalledWithTables();
-		stubDialect("pg", ["demo_solution_notes", "demo_solution_tags", "demo_solution_orphan"], ["demo_solution_orphan"]);
-		const retained = await collectRetainedTables("demo-solution", join(sharedRoot, "demo-solution-0.1.0", "manifest.yaml"));
-		expect(retained).toContain("demo_solution_notes");
-		expect(retained).toContain("demo_solution_tags");
-		expect(retained).toContain("demo_solution_orphan");
-	});
-
-	it("db.dialect 缺省回落 sqlite（不抛、不误导），与既有 sqlite 全量路径一致", async () => {
-		await seedInstalledWithTables();
-		// 还原为缺省（不提供 dialect 函数）→ currentDialect 回落 "sqlite"
-		const spec = catalogSpec("sqlite");
-		(g.db as { dialect?: () => string }).dialect = undefined;
-		(g.db as { query: (sql: string, p?: unknown[]) => unknown }).query = (sql: string) => {
-			if (sql === spec.existing)
-				return [{ name: "demo_solution_notes" }, { name: "demo_solution_tags" }];
-			if (sql.includes("AND name LIKE"))
-				return [{ name: "demo_solution_notes" }];
-			return [];
+		// manifest 追加「声明了但没建表」的幽灵条目，验证存在性过滤
+		const manifestPath = join(sharedRoot, "demo-solution-0.1.0", "manifest.yaml");
+		await fsp.writeFile(manifestPath, `${await fsp.readFile(manifestPath, "utf-8")}  - demo_solution_ghost\n`);
+		// 真实 sqlite 目录：manifest 声明 notes/tags（seed 已建）+ 前缀扫描命中 orphan（未声明）
+		dbo.exec("CREATE TABLE demo_solution_orphan (id INTEGER)");
+		// L2：listTables 是 oj 运行时能力（纯 Rust 二进制内，vitest 无载体，见 devkit
+		// oj-test-guide.md）——桩回放**真实 sqlite 目录**（sqlite_master 实查）并记录
+		// 调用形态；被测的是合并/过滤编排，不是引擎的目录自省本身。
+		const seen: Array<string | undefined> = [];
+		g.db.listTables = async (prefix?: string) => {
+			seen.push(prefix);
+			const all = (dbo.prepare("SELECT name FROM sqlite_master WHERE type='table'").all() as Array<{ name: string }>).map(r => r.name);
+			return prefix === undefined ? all : all.filter(t => t.startsWith(prefix));
 		};
-		const retained = await collectRetainedTables("demo-solution", join(sharedRoot, "demo-solution-0.1.0", "manifest.yaml"));
-		expect(retained).toContain("demo_solution_notes");
-		expect(retained).toContain("demo_solution_tags");
+		const retained = await collectRetainedTables("demo-solution", manifestPath);
+		expect(seen).toEqual(["demo_solution_", undefined]); // 前缀扫描 + 全量存在性过滤各一次
+		expect(retained).toContain("demo_solution_notes"); // manifest 声明
+		expect(retained).toContain("demo_solution_tags"); // manifest 声明
+		expect(retained).toContain("demo_solution_orphan"); // 前缀兜底命中（未声明）
+		expect(retained).not.toContain("demo_solution_ghost"); // 声明但物理不存在 → 不回传
 	});
 });

package/templates/api/tests/query-utils.spec.ts

@@ -3,7 +3,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { beforeAll, describe, expect, it } from "vitest";
 
-import { likePattern, paged } from "../src/_platform/_shared/service/query";
+import { likePattern, paged, pagedFactory } from "../src/_platform/_shared/service/infra/query";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
@@ -66,3 +66,87 @@ describe("AC1-22：LIKE 模式与 keyword 长度红线", () => {
 		expect(likePattern("张三")).toBe("%张三%");
 	});
 });
+
+describe("AC1-24（构造器工厂）：pagedFactory 复用同一组条件", () => {
+	// L2 记录型假构造器：pagedFactory 是纯编排（count 聚合 + 条件分页 + 截断判定），
+	// SQL 渲染/执行在 oj 二进制内，vitest 无真 builder 载体（架构定论：builder 纯 Rust
+	// 实现，无 JS 模块可导；SQL 断言走 oj test / oj exec，见 devkit oj-test-guide.md）。
+	// 这里只断言编排契约：mk 各跑一次、count 走聚合 select、total=0 不跑 list。
+	function fakeBuilder(total: number, rows: any[]) {
+		const calls: string[] = [];
+		let countPath = false;
+		const b: any = {
+			select: (cols: any[]) => {
+				countPath = cols.some((c: any) => c && typeof c === "object" && c.fn === "count");
+				calls.push(`select:${JSON.stringify(cols)}`);
+				return b;
+			},
+			where: (cond: any) => {
+				calls.push(`where:${JSON.stringify(cond)}`);
+				return b;
+			},
+			orderBy: (items: any[]) => {
+				calls.push(`orderBy:${JSON.stringify(items)}`);
+				return b;
+			},
+			limit: (n: number) => {
+				calls.push(`limit:${n}`);
+				return b;
+			},
+			offset: (n: number) => {
+				calls.push(`offset:${n}`);
+				return b;
+			},
+			all: async () => (countPath ? [{ c: total }] : rows),
+		};
+		return { b, calls };
+	}
+
+	it("count + list 各跑一次：count 走聚合 select（不受 LIMIT 钳制），list 带 orderBy/limit/offset", async () => {
+		const built: Array<{ calls: string[] }> = [];
+		const mk = () => {
+			const f = fakeBuilder(301, Array.from({ length: 200 }, (_, i) => ({ id: 300 - i })));
+			built.push(f);
+			return f.b;
+		};
+		const r = await pagedFactory<any>(mk, { page: 1, size: 500 });
+		expect(built).toHaveLength(2);
+		expect(built[0].calls.some(c => c.startsWith("select:") && c.includes("\"count\""))).toBe(true);
+		expect(built[1].calls.includes("limit:200")).toBe(true); // 500 被钳 200
+		expect(built[1].calls.includes("offset:0")).toBe(true);
+		expect(r.total).toBe(301);
+		expect(r.size).toBe(200);
+		expect(r.list.length).toBe(200);
+		expect(r.truncated).toBe(true); // 301 > 1*200
+	});
+
+	it("条件经 mk 工厂收敛（contains 替代 LIKE ? ESCAPE '!'）：两次构造都带上 where", async () => {
+		const built: Array<{ calls: string[] }> = [];
+		const mk = () => {
+			const f = fakeBuilder(1, [{ id: 7, username: "contains_me" }]);
+			f.b.where({ field: "username", op: "contains", value: "contains" });
+			built.push(f);
+			return f.b;
+		};
+		const r = await pagedFactory<any>(mk, { size: 10 });
+		expect(built).toHaveLength(2);
+		for (const f of built)
+			expect(f.calls.some(c => c.startsWith("where:") && c.includes("contains"))).toBe(true);
+		expect(r.total).toBe(1);
+		expect(r.truncated).toBe(false);
+	});
+
+	it("total=0 → 不跑 list 查询（省一次往返），缺省 page=1/size=20", async () => {
+		const built: Array<{ calls: string[] }> = [];
+		const mk = () => {
+			const f = fakeBuilder(0, []);
+			built.push(f);
+			return f.b;
+		};
+		const r = await pagedFactory<any>(mk, {});
+		expect(built).toHaveLength(1); // 只跑了 count
+		expect(r.list).toEqual([]);
+		expect(r.truncated).toBe(false);
+		expect(r.size).toBe(20);
+	});
+});

package/templates/api/tests/rbac-audit.spec.ts

@@ -3,7 +3,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { auditDeny, auditOp, recordOp, resetDenyAudit } from "../src/_platform/_shared/service/audit";
+import { auditDeny, auditOp, recordOp, resetDenyAudit } from "../src/_platform/_shared/service/infra/audit";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/api/tests/rbac-contacts.spec.ts

@@ -4,7 +4,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { contactDetail, searchContacts } from "../src/_platform/_shared/service/contacts";
+import { contactDetail, searchContacts } from "../src/_platform/_shared/service/domain/contacts";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
@@ -74,7 +74,7 @@ describe("详情与限速", () => {
 	it("接口级限速：同用户突发超限 → 429", async () => {
 		const uid = mkUser("c_rate");
 		g.http = { user: { id: uid } };
-		const { rateLimit } = await import("../src/_platform/_shared/service/rate");
+		const { rateLimit } = await import("../src/_platform/_shared/service/infra/rate");
 		// 窗口 60s / 限额 3（测试参数；生产端点各自定额）
 		for (let i = 0; i < 3; i++)
 			await rateLimit(`contacts:${uid}`, 3, 60_000);

package/templates/api/tests/rbac-guard.spec.ts

@@ -4,7 +4,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { assertPermission, assertSuperAdmin, assertSystemAdmin, invalidateUser } from "../src/_platform/_shared/service/access";
+import { assertPermission, assertSuperAdmin, assertSystemAdmin, invalidateUser } from "../src/_platform/_shared/service/infra/access";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/api/tests/rbac-roles.spec.ts

@@ -4,8 +4,8 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { assertPermission } from "../src/_platform/_shared/service/access";
-import { createRole, deleteRole, listPermissions, listRoles, updateBindings } from "../src/_platform/_shared/service/roles";
+import { createRole, deleteRole, listPermissions, listRoles, updateBindings } from "../src/_platform/_shared/service/domain/roles";
+import { assertPermission } from "../src/_platform/_shared/service/infra/access";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/api/tests/rbac-settings.spec.ts

@@ -2,18 +2,13 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { searchOplog } from "../src/_platform/_shared/service/oplog";
-import { listLoginMethods, listSettings, updateSetting } from "../src/_platform/_shared/service/settings";
+import { listLoginMethods, listSettings, updateSetting } from "../src/_platform/_shared/service/domain/settings";
+import { searchOplog } from "../src/_platform/_shared/service/infra/oplog";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
 const g = globalThis as any;
 
-function mkOplog(username: string, action: string, module: string, level = 6) {
-	dbo.prepare("INSERT INTO sys_oplog (create_time, user_id, username, action, module, level) VALUES (?, 1, ?, ?, ?, ?)")
-		.run(1000, username, action, module, level);
-}
-
 beforeAll(() => {
 	dbo = installDb();
 });
@@ -25,22 +20,72 @@ afterEach(() => {
 });
 
 describe("AC1-29/D13：操作日志查询（admin 可查）", () => {
-	it("按 action/username/module 过滤 + 分页截断标记", async () => {
-		mkOplog("alice", "role.create", "framework");
-		mkOplog("alice", "user.create", "framework");
-		mkOplog("bob", "role.create", "framework");
-		const all = await searchOplog({});
-		expect(all.total).toBe(3);
-		const byAction = await searchOplog({ action: "user.create" });
-		expect(byAction.list.map(r => r.username)).toEqual(["alice"]);
-		const byUser = await searchOplog({ username: "bob" });
-		expect(byUser.total).toBe(1);
+	// L2：searchOplog 的本职是「过滤维度 → whereIf 条件」的映射 + 分页复用（pagedFactory）；
+	// 构造器执行（SQL 渲染 / 真过滤）在 oj 二进制内——vitest 无真 builder 载体（架构定论：
+	// builder 纯 Rust 实现、无 JS 模块可导；SQL 断言走 oj test / oj exec，见 devkit
+	// oj-test-guide.md）。这里用记录型假构造器断言条件发射；whereIf 的「假值/空数组跳过」
+	// 按 api-manual §1153 契约建模（引擎语义的忠实复刻，非新逻辑）。
+	function fakeTable() {
+		const conds: Array<{ test: unknown, cond: any }> = [];
+		const b: any = {
+			whereIf: (test: unknown, cond: any) => {
+				if (test !== undefined && test !== null && test !== false && !(Array.isArray(test) && test.length === 0))
+					conds.push({ test, cond });
+				return b;
+			},
+			select: () => b,
+			orderBy: () => b,
+			limit: () => b,
+			offset: () => b,
+			// 固定非零 total：保证 count/list 两条路径都构造（total=0 跳过 list 的行为
+			// 由 query-utils.spec 的 pagedFactory 用例覆盖，这里只关心条件发射）
+			all: async () => [{ c: 42 }],
+		};
+		return { b, conds };
+	}
+
+	/** 以假构造器跑 searchOplog，回传 count 构造发射的条件（并校验 count/list 同条件） */
+	async function captureConds(filter: Parameters<typeof searchOplog>[0]) {
+		const built: Array<ReturnType<typeof fakeTable>> = [];
+		const prevDb = g.db;
+		g.db = {
+			table: () => {
+				const t = fakeTable();
+				built.push(t);
+				return t.b;
+			},
+		};
+		try {
+			await searchOplog(filter);
+		}
+		finally {
+			g.db = prevDb;
+		}
+		expect(built).toHaveLength(2); // count + list 各构造一次
+		expect(built[1].conds).toEqual(built[0].conds); // mk 工厂：两组条件一致
+		return built[0].conds;
+	}
+
+	it("无过滤/空串过滤 → 不发射任何条件（归一化空串 → whereIf 跳过，等价旧 if (filter.x)）", async () => {
+		expect(await captureConds({})).toEqual([]);
+		expect(await captureConds({ action: "", username: "", module: "" })).toEqual([]);
+	});
+
+	it("action/module 精确 + username 包含：三维度各发射一条，字段与 op 对应", async () => {
+		const conds = await captureConds({ action: "user.create", module: "framework", username: "bo" });
+		expect(conds).toEqual([
+			{ test: "user.create", cond: { field: "action", op: "eq", value: "user.create" } },
+			{ test: "framework", cond: { field: "module", op: "eq", value: "framework" } },
+			{ test: "bo", cond: { field: "username", op: "contains", value: "bo" } },
+		]);
 	});
 
-	it("403 拒绝类（auth.deny）可在日志中检索", async () => {
-		mkOplog("mallory", "auth.deny", "wiki", 4);
-		const r = await searchOplog({ action: "auth.deny" });
-		expect(r.total).toBe(1);
+	it("403 拒绝类（auth.deny）可在日志中检索：按 action 精确命中，且从无 level 条件（读不过滤等级）", async () => {
+		const conds = await captureConds({ action: "auth.deny" });
+		expect(conds).toEqual([
+			{ test: "auth.deny", cond: { field: "action", op: "eq", value: "auth.deny" } },
+		]);
+		expect(conds.some(c => (c.cond as { field?: string }).field === "level")).toBe(false);
 	});
 });
 

package/templates/api/tests/rbac-solution-perms.spec.ts

@@ -4,7 +4,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { uninstallSolution, upsertSolutionPerms } from "../src/_platform/_shared/service/solution-perms";
+import { uninstallSolution, upsertSolutionPerms } from "../src/_platform/_shared/service/domain/solution-perms";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/api/tests/rbac-users.spec.ts

@@ -6,7 +6,7 @@
 import type { SessionDeps } from "../src/auth/_shared/session";
 
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
-import { changePasswordByAdmin, createUser, listUsers, setForbidden, updateUserRoles } from "../src/_platform/_shared/service/users";
+import { changePasswordByAdmin, createUser, listUsers, setForbidden, updateUserRoles } from "../src/_platform/_shared/service/domain/users";
 import { createSession } from "../src/auth/_shared/session";
 import { installDb } from "./fixture";