@oj-module/cli 0.2.6 → 0.2.8

package/templates/api/src/_platform/_lifecycle/steps/register.ts

@@ -8,9 +8,9 @@
 // 是其既有语义，本文件不越界代改）。DB 级路由占用检查承接 P1-5 备案③（pre-DB 阶段无真源）。
 // db 为 isolate 全局（同模板 service 层，无需 import；测试由夹具装 globalThis.db）。
 
-import type { SolutionManifest } from "../../_shared/service/solution-perms";
-import { auditOp } from "../../_shared/service/audit";
-import { upsertSolutionPerms } from "../../_shared/service/solution-perms";
+import type { SolutionManifest } from "../../_shared/service/domain/solution-perms";
+import { upsertSolutionPerms } from "../../_shared/service/domain/solution-perms";
+import { auditOp } from "../../_shared/service/infra/audit";
 
 export interface RouteDecl {
 	path: string
@@ -76,19 +76,19 @@ function firstSeg(path: string): string {
  * 让位须走卸载），自占排除（module ≠ 自己）。
  */
 export async function checkOccupancy(module: string, routePaths: string[]): Promise<string[]> {
-	const rows = await db.query("select path from sys_solution_route where module != ?", [module]) as Array<{ path: string }>;
+	const rows = await db.table("sys_solution_route").select(["path"]).where({ field: "module", op: "ne", value: module }).all() as Array<{ path: string }>;
 	const taken = new Set(rows.map(r => firstSeg(String(r.path))));
 	return routePaths.filter(p => taken.has(firstSeg(p)));
 }
 
 /** 声明消失 → 行保留标 deprecated=1（镜像 solution-perms AC2-3/4），返回被标 key/path 清单 */
 async function deprecateGone(table: "sys_setting" | "sys_solution_route", col: "key" | "path", module: string, declared: Set<string>): Promise<string[]> {
-	const old = await db.query(`select ${col} from ${table} where module = ? and deprecated = 0`, [module]) as Array<Record<string, unknown>>;
+	const old = await db.table(table).select([col]).where({ field: "module", op: "eq", value: module }).where({ field: "deprecated", op: "eq", value: 0 }).all() as Array<Record<string, unknown>>;
 	const gone: string[] = [];
 	for (const r of old) {
 		const k = String(r[col]);
 		if (!declared.has(k)) {
-			await db.exec(`update ${table} set deprecated = 1 where ${col} = ?`, [k]);
+			await db.table(table).update({ deprecated: 1 }).where({ field: col, op: "eq", value: k }).run();
 			gone.push(k);
 		}
 	}
@@ -122,36 +122,64 @@ export async function registerSolution(decl: SolutionDecl): Promise<RegisterResu
 		// 设置项 upsert：存在只覆定义列（value/update 语义 = 管理员改过的值不复活，AC1-15），
 		// 不存在插 default_value（首装 value）
 		for (const s of settings) {
-			const exists = await db.query("select key from sys_setting where key = ?", [s.key]) as unknown[];
+			const exists = await db.table("sys_setting").select(["key"]).where({ field: "key", op: "eq", value: s.key }).all() as unknown[];
 			if (exists.length) {
-				await db.exec(
-					"update sys_setting set module = ?, \"group\" = ?, type = ?, default_value = ?, label_key = ?, group_label_key = ?, options = ?, secret = ?, deprecated = 0, update_time = ? where key = ?",
-					[decl.module, s.group, s.type, s.default_value ?? null, s.label_key ?? null, s.group_label_key ?? null, s.options ?? null, s.secret ? 1 : 0, Date.now(), s.key],
-				);
+				await db.table("sys_setting").update({
+					module: decl.module,
+					group: s.group,
+					type: s.type,
+					default_value: s.default_value ?? null,
+					label_key: s.label_key ?? null,
+					group_label_key: s.group_label_key ?? null,
+					options: s.options ?? null,
+					secret: s.secret ? 1 : 0,
+					deprecated: 0,
+					update_time: Date.now(),
+				}).where({ field: "key", op: "eq", value: s.key }).run();
 			}
 			else {
-				await db.exec(
-					"insert into sys_setting (key, module, \"group\", type, value, default_value, label_key, group_label_key, options, secret, update_time, deprecated) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0)",
-					[s.key, decl.module, s.group, s.type, s.value ?? s.default_value ?? null, s.default_value ?? null, s.label_key ?? null, s.group_label_key ?? null, s.options ?? null, s.secret ? 1 : 0, Date.now()],
-				);
+				await db.table("sys_setting").insert({
+					key: s.key,
+					module: decl.module,
+					group: s.group,
+					type: s.type,
+					value: s.value ?? s.default_value ?? null,
+					default_value: s.default_value ?? null,
+					label_key: s.label_key ?? null,
+					group_label_key: s.group_label_key ?? null,
+					options: s.options ?? null,
+					secret: s.secret ? 1 : 0,
+					update_time: Date.now(),
+					deprecated: 0,
+				}).run();
 			}
 		}
 		const settingDeps = await deprecateGone("sys_setting", "key", decl.module, new Set(settings.map(s => s.key)));
 
 		// 路由逐行 upsert：同 path 覆元数据；声明行复位 deprecated=0（重声明回到快照）
 		for (const r of routes) {
-			const exists = await db.query("select path from sys_solution_route where path = ?", [r.path]) as unknown[];
+			const exists = await db.table("sys_solution_route").select(["path"]).where({ field: "path", op: "eq", value: r.path }).all() as unknown[];
 			if (exists.length) {
-				await db.exec(
-					"update sys_solution_route set module = ?, category = ?, \"order\" = ?, title_key = ?, required_permission = ?, deprecated = 0 where path = ?",
-					[decl.module, r.category, r.order, r.title_key ?? null, r.required_permission ?? null, r.path],
-				);
+				await db.table("sys_solution_route").update({
+					module: decl.module,
+					category: r.category,
+					order: r.order,
+					title_key: r.title_key ?? null,
+					required_permission: r.required_permission ?? null,
+					deprecated: 0,
+				}).where({ field: "path", op: "eq", value: r.path }).run();
 			}
 			else {
-				await db.exec(
-					"insert into sys_solution_route (path, module, category, \"order\", title_key, required_permission, deprecated, enabled) values (?, ?, ?, ?, ?, ?, 0, 1)",
-					[r.path, decl.module, r.category, r.order, r.title_key ?? null, r.required_permission ?? null],
-				);
+				await db.table("sys_solution_route").insert({
+					path: r.path,
+					module: decl.module,
+					category: r.category,
+					order: r.order,
+					title_key: r.title_key ?? null,
+					required_permission: r.required_permission ?? null,
+					deprecated: 0,
+					enabled: 1,
+				}).run();
 			}
 		}
 		const routeDeps = await deprecateGone("sys_solution_route", "path", decl.module, new Set(routes.map(r => r.path)));
@@ -177,10 +205,10 @@ export async function registerSolution(decl: SolutionDecl): Promise<RegisterResu
 }
 
 export async function queryRegistered(name: string): Promise<SolutionSnapshot | null> {
-	const routes = (await db.query("select path from sys_solution_route where module = ? and deprecated = 0", [name]) as Array<{ path: string }>).map(r => String(r.path)).sort();
-	const settings = (await db.query("select key from sys_setting where module = ? and deprecated = 0", [name]) as Array<{ key: string }>).map(r => String(r.key)).sort();
-	const roles = (await db.query("select name from sys_role where module = ? and deprecated = 0", [name]) as Array<{ name: string }>).map(r => String(r.name)).sort();
-	const permissions = (await db.query("select code from sys_permission where module = ? and deprecated = 0", [name]) as Array<{ code: string }>).map(r => String(r.code)).sort();
+	const routes = (await db.table("sys_solution_route").select(["path"]).where({ field: "module", op: "eq", value: name }).where({ field: "deprecated", op: "eq", value: 0 }).all() as Array<{ path: string }>).map(r => String(r.path)).sort();
+	const settings = (await db.table("sys_setting").select(["key"]).where({ field: "module", op: "eq", value: name }).where({ field: "deprecated", op: "eq", value: 0 }).all() as Array<{ key: string }>).map(r => String(r.key)).sort();
+	const roles = (await db.table("sys_role").select(["name"]).where({ field: "module", op: "eq", value: name }).where({ field: "deprecated", op: "eq", value: 0 }).all() as Array<{ name: string }>).map(r => String(r.name)).sort();
+	const permissions = (await db.table("sys_permission").select(["code"]).where({ field: "module", op: "eq", value: name }).where({ field: "deprecated", op: "eq", value: 0 }).all() as Array<{ code: string }>).map(r => String(r.code)).sort();
 	if (routes.length + settings.length + roles.length + permissions.length === 0) {
 		return null;
 	}
@@ -195,7 +223,7 @@ export async function queryAllRegistered(): Promise<SolutionSnapshot[]> {
 	const names = new Set<string>();
 	for (const table of ["sys_solution_route", "sys_setting", "sys_role", "sys_permission"]) {
 		// 表名为字面常量，无拼接注入面
-		const rows = await db.query(`select distinct module from ${table} where deprecated = 0`) as Array<{ module: string }>;
+		const rows = await db.table(table).distinct().select(["module"]).where({ field: "deprecated", op: "eq", value: 0 }).all() as Array<{ module: string }>;
 		for (const r of rows) {
 			names.add(String(r.module));
 		}

package/templates/api/src/_platform/_lifecycle/trust.ts

@@ -1,4 +1,4 @@
-import { auditOp } from "../_shared/service/audit";
+import { auditOp } from "../_shared/service/infra/audit";
 // 宿主信任库（P2-2，契约 v1.3 §2.11 / C2-38/39，G3 双轨第一轨 / G5）。
 // 存储：.solutions/trusted-keys.yaml（key_id → {public_key, added_at}）——YAML 受限子集
 // （两层 map + 标量，同 state.ts 口径：只读回本模块写出的内容，不引 yaml 依赖，严格解析）。

package/templates/api/src/_platform/_lifecycle/uninstall.ts

@@ -7,11 +7,11 @@
 // 任一步失败返回 {ok:false, message}（与 setEnabled 同纪律）；部分残差由 admin 重试或重装自愈。
 // SQL 全部参数化（与 audit.ts / setEnabled 同纪律，值不拼字符串）。
 
-import type { OpEntry } from "../_shared/service/audit";
+import type { OpEntry } from "../_shared/service/infra/audit";
 import type { StateStore } from "./state";
-import { invalidateAllUsers } from "../_shared/service/access";
-import { auditOp } from "../_shared/service/audit";
-import { uninstallSolution } from "../_shared/service/solution-perms";
+import { uninstallSolution } from "../_shared/service/domain/solution-perms";
+import { invalidateAllUsers } from "../_shared/service/infra/access";
+import { auditOp } from "../_shared/service/infra/audit";
 import { atomicWriteText, fsFace } from "./atomic";
 import { recordHistory } from "./history";
 import { readLock, writeLock } from "./lock";
@@ -20,10 +20,12 @@ import { readLock, writeLock } from "./lock";
 declare const db: {
 	exec: (sql: string, params: unknown[]) => Promise<unknown>
 	query: (sql: string, params?: unknown[]) => Promise<unknown>
+	/** 安全查询构造器（迁移目标；与 query 同返回行数组） */
+	table: (name: string) => any
 	/** 当前方言（sqlite/mysql/pg）；缺省 sqlite。Q4 业务表目录查询方言无关 */
 	dialect?: () => string
 	/** 单一 DB 事务包裹（P3-3）：回调内语句共享一个 BEGIN/COMMIT/ROLLBACK 边界，异常即整段回滚 */
-	tx: <T>(fn: (t: { exec: (sql: string, params?: unknown[]) => Promise<unknown>, query: (sql: string, params?: unknown[]) => Promise<unknown> }) => Promise<T>) => Promise<T>
+	tx: <T>(fn: (t: { exec: (sql: string, params?: unknown[]) => Promise<unknown>, query: (sql: string, params?: unknown[]) => Promise<unknown>, table: (name: string) => any }) => Promise<T>) => Promise<T>
 };
 
 function isObj(v: unknown): v is Record<string, unknown> {
@@ -83,6 +85,7 @@ export function catalogSpec(dialect: string): { existing: string, like: (pat: st
 
 /** 当前库实际存在的表名集合 */
 async function listExistingTables(dialect: string): Promise<Set<string>> {
+	// 保留 db.query：方言相关表目录查询（sqlite_master / information_schema），构造器无法表达
 	const rows = (await db.query(catalogSpec(dialect).existing)) as Array<{ name: string }>;
 	return new Set(rows.map(r => r.name));
 }
@@ -110,6 +113,7 @@ export async function collectRetainedTables(name: string, manifestPath: string):
 	}
 	// ② 前缀兜底：扫描当前库匹配模块前缀的表，覆盖未声明场景
 	try {
+		// 保留 db.query：LIKE ? ESCAPE '!' 转义子句，构造器 like 无 ESCAPE 支持
 		const [sql, params] = catalogSpec(dialect).like(tablePrefixPattern(name));
 		const rows = (await db.query(sql, params)) as Array<{ name: string }>;
 		for (const r of rows)
@@ -155,10 +159,11 @@ export interface UninstallResult {
 /** 计算卸载影响面（角色数 + 持有这些角色的用户数） */
 export async function computeUninstallImpact(input: UninstallInput): Promise<UninstallImpact> {
 	const { name } = input;
-	const roles = await db.query("select name from sys_role where module = ?", [name]) as Array<{ name: string }>;
+	const roles = await db.table("sys_role").select(["name"]).where({ field: "module", op: "eq", value: name }).all() as Array<{ name: string }>;
 	const roleNames = roles.map(r => r.name);
 	let affectedUsers = 0;
 	if (roleNames.length > 0) {
+		// 保留 db.query：IN 占位符经 JS 字符串拼接动态生成（动态 SQL），构造器 in 仅接受静态数组值
 		const rows = await db.query(
 			`select distinct user_id from sys_user_role where role_name in (${roleNames.map(() => "?").join(",")})`,
 			roleNames,
@@ -202,7 +207,7 @@ export async function runUninstall(input: UninstallInput): Promise<UninstallResu
 	// 边界。任一步失败 → 整段回滚（无角色/权限/路由半残），锁不摘（fail-closed：模块仍挂载、可重试或重装自愈）。
 	try {
 		await db.tx(async (t) => {
-			await t.exec("delete from sys_solution_route where module = ?", [name]);
+			await t.table("sys_solution_route").where({ field: "module", op: "eq", value: name }).delete().run();
 			await uninstallSolution(name, t);
 		});
 	}
@@ -213,7 +218,7 @@ export async function runUninstall(input: UninstallInput): Promise<UninstallResu
 
 	// ② sidecar 删条目（patch 值 null = 删除该方案键）
 	try {
-		await input.state.write({ solutions: { [name]: null } });
+		await input.state.write({ solutions: { [name]: null } } as unknown as Parameters<typeof input.state.write>[0]);
 	}
 	catch (e) {
 		audit(false, `sidecar 写失败：${String(e)}`);

package/templates/api/src/_platform/_lifecycle/verify-checks.ts

@@ -206,12 +206,12 @@ export async function diffWebIntegrity(
 		const bytes = await fsFace().readFile(`${distRoot}/${me.entry}`);
 		const actual = `sha384-${sha384(new Uint8Array(bytes))}`;
 		if (actual !== me.integrity) {
-			items.push({ id: "web", severity: "error", subject: me.entry, advise_key: "lifecycle.verify.web.integrity_mismatch" });
+			items.push({ id: "web", severity: "error", subject: me.entry ?? "*", advise_key: "lifecycle.verify.web.integrity_mismatch" });
 		}
 	}
 	catch {
 		// 资产缺失（web 入口未落位或路径变更）——info 非阻断（路由可达性已另测）
-		items.push({ id: "web", severity: "info", subject: me.entry, advise_key: "lifecycle.verify.web.asset_missing" });
+		items.push({ id: "web", severity: "info", subject: me.entry ?? "*", advise_key: "lifecycle.verify.web.asset_missing" });
 	}
 	return items;
 }

package/templates/api/src/_platform/_shared/service/{contacts.ts → domain/contacts.ts}

@@ -2,7 +2,7 @@
 // 目录红线：只出 id/username/display_name——不含 email/avatar/roles（防低权账号拖走全员邮箱喂钓鱼，安全评审 P2）；
 // 详情端点才给 email/avatar。默认排除 is_forbidden=1（AC1-23：管理域仍可见，目录与管理分离）。
 // keyword≥2、LIKE 转义复用 query.ts；solutions 同 isolate import searchContacts 直调，无 HTTP 往返（AC1-25）。
-import { likePattern } from "./query";
+import { likePattern } from "../infra/query";
 
 export interface ContactRow {
 	id: number
@@ -17,19 +17,21 @@ export async function searchContacts(keyword: unknown, opts: { limit?: unknown }
 	const pattern = likePattern(keyword); // <2 字符在此抛 400（AC1-22）
 	const rawLimit = Number.parseInt(String(opts.limit ?? ""), 10);
 	const limit = Number.isFinite(rawLimit) && rawLimit >= 1 ? Math.min(MAX_LIMIT, rawLimit) : DEFAULT_LIMIT;
+	// 保留 db.query：模糊搜索需 ESCAPE '!'(构造器 like 无 escape 子句；mysql 默认 sql_mode 下 ESCAPE '\' 即 1064)
 	return await db.query(
 		`select id, username, display_name from users
 		 where is_forbidden = 0 and (username like ? escape '!' or display_name like ? escape '!')
 		 order by username limit ?`,
 		[pattern, pattern, limit],
-	) as ContactRow[];
+	) as unknown as ContactRow[];
 }
 
 export async function contactDetail(id: number): Promise<Record<string, unknown>> {
-	const rows = await db.query(
-		"select id, username, display_name, email, avatar_base64 from users where id = ? and is_forbidden = 0",
-		[id],
-	);
+	const rows = await db.table("users")
+		.select(["id", "username", "display_name", "email", "avatar_base64"])
+		.where({ field: "id", op: "eq", value: id })
+		.where({ field: "is_forbidden", op: "eq", value: 0 })
+		.all();
 	if (!rows[0])
 		throw Object.assign(new Error("contact not found"), { status: 404 });
 	return rows[0] as Record<string, unknown>;

package/templates/api/src/_platform/_shared/service/{roles.ts → domain/roles.ts}

@@ -2,8 +2,8 @@
 // 规则锚：custom 机器名强制（AC1-17）、builtin 角色绑定/删除硬拒（AC1-19）、占用禁删（AC1-20）、
 // 绑定调整 = 紧急吊销出口（AC1-30，写后按持有者失效判权缓存）、写审计 await recordOp（AC1-28 关键路径）。
 // 判权本身不经过这里——调用 handler 先过 assertSystemAdmin（H2，管理类端点）。
-import { invalidateUser } from "./access";
-import { recordOp } from "./audit";
+import { invalidateUser } from "../infra/access";
+import { recordOp } from "../infra/audit";
 
 export interface RoleRow {
 	name: string
@@ -35,7 +35,7 @@ const CUSTOM_NAME = /^custom\.[a-z0-9][a-z0-9-]*$/;
 const RESERVED = new Set(["superadmin", "admin", "editor", "viewer"]);
 
 async function assertNotBuiltin(roleName: string): Promise<void> {
-	const rows = await db.query("select builtin from sys_role where name = ?", [roleName]);
+	const rows = await db.table("sys_role").select(["builtin"]).where({ field: "name", op: "eq", value: roleName }).all();
 	if (!rows[0])
 		fail(404, `role not found: ${roleName}`);
 	if (Number((rows[0] as { builtin: unknown }).builtin) === 1)
@@ -45,9 +45,8 @@ async function assertNotBuiltin(roleName: string): Promise<void> {
 async function assertCodesExist(codes: string[]): Promise<void> {
 	if (!codes.length)
 		return;
-	const marks = codes.map(() => "?").join(",");
-	const rows = await db.query(`select code from sys_permission where code in (${marks})`, codes);
-	const known = new Set(rows.map((r: { code: string }) => r.code));
+	const rows = await db.table("sys_permission").select(["code"]).where({ field: "code", op: "in", value: codes }).all();
+	const known = new Set(rows.map(r => (r as { code: string }).code));
 	const unknown = codes.filter(c => !known.has(c));
 	if (unknown.length)
 		fail(400, `unknown permission codes: ${unknown.join(", ")}`);
@@ -55,15 +54,15 @@ async function assertCodesExist(codes: string[]): Promise<void> {
 
 /** 绑定/删除写后按持有者逐人失效判权缓存（D10 撤销即强退的 service 级出口）。 */
 async function invalidateHolders(roleName: string): Promise<void> {
-	const rows = await db.query("select user_id from sys_user_role where role_name = ?", [roleName]);
+	const rows = await db.table("sys_user_role").select(["user_id"]).where({ field: "role_name", op: "eq", value: roleName }).all();
 	for (const r of rows as Array<{ user_id: number }>)
 		invalidateUser(Number(r.user_id));
 }
 
 export async function listRoles(): Promise<RoleRow[]> {
-	const roles = await db.query("select * from sys_role order by name") as Array<Record<string, unknown>>;
-	const holders = await db.query("select role_name, count(*) as c from sys_user_role group by role_name") as Array<{ role_name: string, c: number }>;
-	const binds = await db.query("select role_name, permission_code from sys_role_permission order by permission_code") as Array<{ role_name: string, permission_code: string }>;
+	const roles = await db.table("sys_role").select(["name", "module", "title", "description", "builtin", "deprecated"]).orderBy([{ field: "name" }]).all() as Array<Record<string, unknown>>;
+	const holders = await db.table("sys_user_role").select(["role_name", { fn: "count", as: "c" }]).groupBy(["role_name"]).all() as Array<{ role_name: string, c: number }>;
+	const binds = await db.table("sys_role_permission").select(["role_name", "permission_code"]).orderBy([{ field: "permission_code" }]).all() as Array<{ role_name: string, permission_code: string }>;
 	const holderMap = new Map(holders.map(h => [h.role_name, Number(h.c)]));
 	const bindMap = new Map<string, string[]>();
 	for (const b of binds)
@@ -81,7 +80,7 @@ export async function listRoles(): Promise<RoleRow[]> {
 }
 
 export async function listPermissions(): Promise<PermissionRow[]> {
-	const rows = await db.query("select * from sys_permission order by code") as Array<Record<string, unknown>>;
+	const rows = await db.table("sys_permission").select(["code", "module", "title_key", "deprecated"]).orderBy([{ field: "code" }]).all() as Array<Record<string, unknown>>;
 	return rows.map(r => ({
 		code: String(r.code),
 		module: String(r.module),
@@ -97,9 +96,9 @@ export async function createRole(input: { name: string, title: string, permissio
 	const permissions = [...new Set((input.permissions ?? []).map(String))];
 	await assertCodesExist(permissions);
 	await db.tx(async (t) => {
-		await t.exec("insert into sys_role (name, module, title, builtin, deprecated) values (?, 'custom', ?, 0, 0)", [name, String(input.title ?? "")]);
+		await t.table("sys_role").insert({ name, module: "custom", title: String(input.title ?? ""), builtin: 0, deprecated: 0 }).run();
 		for (const code of permissions)
-			await t.exec("insert into sys_role_permission (role_name, permission_code) values (?, ?)", [name, code]);
+			await t.table("sys_role_permission").insert({ role_name: name, permission_code: code }).run();
 	});
 	await recordOp({ action: "role.create", module: "framework", target: name, detail: { title: String(input.title ?? ""), permissions } });
 	return { name, module: "custom" };
@@ -109,12 +108,12 @@ export async function updateBindings(roleName: string, codes: string[]): Promise
 	await assertNotBuiltin(roleName);
 	const next = [...new Set(codes.map(String))];
 	await assertCodesExist(next);
-	const before = (await db.query("select permission_code from sys_role_permission where role_name = ?", [roleName])) as Array<{ permission_code: string }>;
+	const before = (await db.table("sys_role_permission").select(["permission_code"]).where({ field: "role_name", op: "eq", value: roleName }).all()) as Array<{ permission_code: string }>;
 	const beforeSet = new Set(before.map(b => b.permission_code));
 	await db.tx(async (t) => {
-		await t.exec("delete from sys_role_permission where role_name = ?", [roleName]);
+		await t.table("sys_role_permission").where({ field: "role_name", op: "eq", value: roleName }).delete().run();
 		for (const code of next)
-			await t.exec("insert into sys_role_permission (role_name, permission_code) values (?, ?)", [roleName, code]);
+			await t.table("sys_role_permission").insert({ role_name: roleName, permission_code: code }).run();
 	});
 	await invalidateHolders(roleName);
 	const added = next.filter(c => !beforeSet.has(c));
@@ -124,13 +123,13 @@ export async function updateBindings(roleName: string, codes: string[]): Promise
 
 export async function deleteRole(roleName: string): Promise<void> {
 	await assertNotBuiltin(roleName);
-	const holders = await db.query("select count(*) as c from sys_user_role where role_name = ?", [roleName]);
+	const holders = await db.table("sys_user_role").select([{ fn: "count", as: "c" }]).where({ field: "role_name", op: "eq", value: roleName }).all();
 	const n = Number((holders[0] as { c: unknown }).c);
 	if (n > 0)
 		fail(409, `role has ${n} holder(s)`, { holders: n });
 	await db.tx(async (t) => {
-		await t.exec("delete from sys_role_permission where role_name = ?", [roleName]);
-		await t.exec("delete from sys_role where name = ?", [roleName]);
+		await t.table("sys_role_permission").where({ field: "role_name", op: "eq", value: roleName }).delete().run();
+		await t.table("sys_role").where({ field: "name", op: "eq", value: roleName }).delete().run();
 	});
 	await invalidateHolders(roleName);
 	await recordOp({ action: "role.delete", module: "framework", target: roleName });

package/templates/api/src/_platform/_shared/service/{settings.ts → domain/settings.ts}

@@ -1,6 +1,6 @@
 // 系统设置（PRD §4.3）+ 登录方式发现（C5/D2）。
 // secret 项读取掩码（***）；market.* 安全项写操作须 superadmin 操作者（D11 边界在 service 按 actor 角色查）。
-import { recordOp } from "./audit";
+import { recordOp } from "../infra/audit";
 
 export interface SettingItem {
 	key: string
@@ -29,7 +29,7 @@ export interface SettingGroup {
 const SUPER_ONLY_GROUPS = new Set(["security"]);
 
 export async function listSettings(): Promise<SettingGroup[]> {
-	const rows = await db.query("select * from sys_setting order by \"group\", key") as Array<Record<string, unknown>>;
+	const rows = await db.table("sys_setting").select(["key", "module", "group", "type", "value", "default_value", "label_key", "group_label_key", "options", "secret", "update_time"]).orderBy([{ field: "group" }, { field: "key" }]).all() as Array<Record<string, unknown>>;
 	const groups = new Map<string, SettingItem[]>();
 	for (const r of rows) {
 		const item: SettingItem = {
@@ -55,22 +55,22 @@ export async function listSettings(): Promise<SettingGroup[]> {
 }
 
 export async function updateSetting(actorId: number, key: string, value: string): Promise<void> {
-	const rows = await db.query("select * from sys_setting where key = ?", [key]) as Array<Record<string, unknown>>;
+	const rows = await db.table("sys_setting").select(["key", "module", "group", "type", "value", "default_value", "label_key", "group_label_key", "options", "secret", "update_time"]).where({ field: "key", op: "eq", value: key }).all() as Array<Record<string, unknown>>;
 	if (!rows.length)
 		throw Object.assign(new Error(`setting not found: ${key}`), { status: 404 });
 	const row = rows[0];
 	if (SUPER_ONLY_GROUPS.has(String(row.group))) {
-		const actorRoles = await db.query("select role_name from sys_user_role where user_id = ?", [actorId]) as Array<{ role_name: string }>;
+		const actorRoles = await db.table("sys_user_role").select(["role_name"]).where({ field: "user_id", op: "eq", value: actorId }).all() as Array<{ role_name: string }>;
 		if (!actorRoles.some(r => r.role_name === "superadmin"))
 			throw Object.assign(new Error("security settings require superadmin"), { status: 403 });
 	}
-	await db.exec("update sys_setting set value = ?, update_time = ? where key = ?", [String(value ?? ""), Date.now(), key]);
+	await db.table("sys_setting").update({ value: String(value ?? ""), update_time: Date.now() }).where({ field: "key", op: "eq", value: key }).run();
 	await recordOp({ action: "setting.update", module: String(row.module), target: key });
 }
 
 /** C5/D2：登录方式发现的数据源——local 恒在，ldap/sso 由设置项开关。 */
 export async function listLoginMethods(): Promise<{ methods: string[] }> {
-	const rows = await db.query("select key, value from sys_setting where key in ('ldap.enabled', 'sso.enabled')") as Array<{ key: string, value: string | null }>;
+	const rows = await db.table("sys_setting").select(["key", "value"]).where({ field: "key", op: "in", value: ["ldap.enabled", "sso.enabled"] }).all() as Array<{ key: string, value: string | null }>;
 	const enabled = (k: string) => rows.find(r => r.key === k)?.value === "1";
 	return { methods: ["local", ...(enabled("ldap.enabled") ? ["ldap" as const] : []), ...(enabled("sso.enabled") ? ["sso" as const] : [])] };
 }

package/templates/api/src/_platform/_shared/service/{solution-perms.ts → domain/solution-perms.ts}

@@ -28,20 +28,20 @@ export async function upsertSolutionPerms(m: SolutionManifest): Promise<UpsertRe
 	const declaredPerms = new Set(m.roles.flatMap(r => r.permissions ?? []));
 
 	for (const role of m.roles) {
-		const existing = await db.query("select name from sys_role where name = ?", [role.name]) as unknown[];
+		const existing = await db.table("sys_role").select(["name"]).where({ field: "name", op: "eq", value: role.name }).all() as unknown[];
 		// upsert：行存在只覆盖元数据（title），name/builtin 不动（AC2-2 元数据覆盖）
 		if (existing.length) {
-			await db.exec("update sys_role set title = ? where name = ?", [role.title, role.name]);
+			await db.table("sys_role").update({ title: role.title }).where({ field: "name", op: "eq", value: role.name }).run();
 		}
 		else {
-			await db.exec("insert into sys_role (name, module, title, builtin) values (?, ?, ?, 0)", [role.name, m.module, role.title]);
+			await db.table("sys_role").insert({ name: role.name, module: m.module, title: role.title, builtin: 0 }).run();
 			// 声明绑定只在角色创建时写一次（角色级 insert-if-absent，AC1-15 红线）：
 			// 升级/重装对已存在角色永不补写声明绑定——管理员撤过的绑定不复活；
 			// 新版本给既有角色新增权限点时，由管理员显式勾选（insert-if-absent 的取舍边界，§9.5）。
 			for (const code of role.permissions ?? []) {
-				const bound = await db.query("select role_name from sys_role_permission where role_name = ? and permission_code = ?", [role.name, code]) as unknown[];
+				const bound = await db.table("sys_role_permission").select(["role_name"]).where({ field: "role_name", op: "eq", value: role.name }).where({ field: "permission_code", op: "eq", value: code }).all() as unknown[];
 				if (!bound.length)
-					await db.exec("insert into sys_role_permission (role_name, permission_code) values (?, ?)", [role.name, code]);
+					await db.table("sys_role_permission").insert({ role_name: role.name, permission_code: code }).run();
 			}
 		}
 	}
@@ -49,24 +49,24 @@ export async function upsertSolutionPerms(m: SolutionManifest): Promise<UpsertRe
 	// 权限点行独立于角色创建：声明里的新 code 一律 upsert 插入（AC2-1「新增声明 → upsert 插入新行」——
 	// 含既有角色新增权限点的场景；绑定是否自动挂上由上面的角色级规则决定）
 	for (const code of declaredPerms) {
-		const p = await db.query("select code from sys_permission where code = ?", [code]) as unknown[];
+		const p = await db.table("sys_permission").select(["code"]).where({ field: "code", op: "eq", value: code }).all() as unknown[];
 		if (!p.length)
-			await db.exec("insert into sys_permission (code, module) values (?, ?)", [code, m.module]);
+			await db.table("sys_permission").insert({ code, module: m.module }).run();
 	}
 
 	// 声明消失 → 行保留标 deprecated（AC2-3/4）：行与绑定全留，判决不突变；
 	// 重命名的旧 code 走同一条规则（视为删除+新增），deprecated 清单交给安装器告警。
-	const oldPerms = await db.query("select code from sys_permission where module = ? and deprecated = 0", [m.module]) as Array<{ code: string }>;
+	const oldPerms = await db.table("sys_permission").select(["code"]).where({ field: "module", op: "eq", value: m.module }).where({ field: "deprecated", op: "eq", value: 0 }).all() as Array<{ code: string }>;
 	for (const r of oldPerms) {
 		if (!declaredPerms.has(String(r.code))) {
-			await db.exec("update sys_permission set deprecated = 1 where code = ?", [r.code]);
+			await db.table("sys_permission").update({ deprecated: 1 }).where({ field: "code", op: "eq", value: r.code }).run();
 			deprecated.push(String(r.code));
 		}
 	}
-	const oldRoles = await db.query("select name from sys_role where module = ? and builtin = 0 and deprecated = 0", [m.module]) as Array<{ name: string }>;
+	const oldRoles = await db.table("sys_role").select(["name"]).where({ field: "module", op: "eq", value: m.module }).where({ field: "builtin", op: "eq", value: 0 }).where({ field: "deprecated", op: "eq", value: 0 }).all() as Array<{ name: string }>;
 	for (const r of oldRoles) {
 		if (!declaredRoles.has(String(r.name))) {
-			await db.exec("update sys_role set deprecated = 1 where name = ?", [r.name]);
+			await db.table("sys_role").update({ deprecated: 1 }).where({ field: "name", op: "eq", value: r.name }).run();
 			deprecated.push(String(r.name));
 		}
 	}
@@ -77,6 +77,7 @@ export async function upsertSolutionPerms(m: SolutionManifest): Promise<UpsertRe
 interface DbLike {
 	query: (sql: string, params?: unknown[]) => Promise<unknown>
 	exec: (sql: string, params?: unknown[]) => Promise<unknown>
+	table: DBInstance["table"]
 }
 
 /**
@@ -88,14 +89,14 @@ interface DbLike {
  * P3-3：可传入事务句柄 `d`（db.tx 的 t），使级联纳入卸载的单一 DB 事务；缺省回落全局 db（兼容既有调用面）。
  */
 export async function uninstallSolution(module: string, d: DbLike = db): Promise<void> {
-	const roles = await d.query("select name from sys_role where module = ?", [module]) as Array<{ name: string }>;
+	const roles = await d.table("sys_role").select(["name"]).where({ field: "module", op: "eq", value: module }).all() as Array<{ name: string }>;
 	for (const r of roles) {
-		await d.exec("delete from sys_role_permission where role_name = ?", [r.name]);
-		await d.exec("delete from sys_user_role where role_name = ?", [r.name]);
+		await d.table("sys_role_permission").where({ field: "role_name", op: "eq", value: r.name }).delete().run();
+		await d.table("sys_user_role").where({ field: "role_name", op: "eq", value: r.name }).delete().run();
 	}
-	await d.exec("delete from sys_role where module = ?", [module]);
-	// module 名是 slug（[a-z0-9_-]），LIKE 前缀匹配的转义纪律同 query.ts（ESCAPE '!' 三方言同义）
+	await d.table("sys_role").where({ field: "module", op: "eq", value: module }).delete().run();
+	// 保留 d.exec：LIKE ? escape '!' 转义子句构造器 like 不支持（三方言 ESCAPE 同义纪律见 query.ts）
 	const prefix = `${module.replace(/[!%_]/g, c => `!${c}`)}.%`;
 	await d.exec("delete from sys_role_permission where permission_code like ? escape '!'", [prefix]);
-	await d.exec("delete from sys_permission where module = ?", [module]);
+	await d.table("sys_permission").where({ field: "module", op: "eq", value: module }).delete().run();
 }