@oj-module/cli 0.2.6 → 0.2.8

package/templates/api/src/auth/_shared/login-throttle.ts

@@ -1,7 +1,7 @@
 // 登录限速编排（B5/AC1-26）：auth/login 与 auth/ldap-login 共用的 (IP, username) 双维度守卫 + 失败记账。
 // 状态全在 DB（sys_login_throttle/sys_rate_window，迁移 0009）——oj 每请求重建模块，进程内方案恒失效（§9.3-3）。
-import { auditOp } from "../../_platform/_shared/service/audit";
-import { loginBlocked, loginFailed, loginSucceeded, rateLimit } from "../../_platform/_shared/service/rate";
+import { auditOp } from "../../_platform/_shared/service/infra/audit";
+import { loginBlocked, loginFailed, loginSucceeded, rateLimit } from "../../_platform/_shared/service/infra/rate";
 
 /** 客户端 IP：优先 X-Forwarded-For（反代后），回落 X-Real-IP。 */
 export async function clientIp(): Promise<string> {

package/templates/api/src/auth/_shared/session.ts

@@ -4,8 +4,8 @@
 // B4：access JWT 仅载 sub（roles 走登录响应/资料接口，不进 claims）。
 // B3：refresh = 不透明随机串 + DB 存 SHA-256 哈希（sys_refresh_token，迁移 0008）；
 //     轮换作旧 + 滑动窗口（绝对 TTL 封顶 min(旧 exp, now+30d)）；reuse 检测全族吊销 + 审计。
-import { invalidateUser } from "../../_platform/_shared/service/access";
-import { recordOp } from "../../_platform/_shared/service/audit";
+import { invalidateUser } from "../../_platform/_shared/service/infra/access";
+import { recordOp } from "../../_platform/_shared/service/infra/audit";
 
 export interface SessionDeps {
 	randomHex: (bytes: number) => string
@@ -59,13 +59,10 @@ export function createSession(deps: SessionDeps = runtimeDeps()) {
 	const hashOf = (token: string) => deps.sha256Hex(token);
 
 	async function profileOf(uid: number): Promise<SessionUser> {
-		const rows = await db.query(
-			"select id, username, display_name, avatar_base64, must_change from users where id = ?",
-			[uid],
-		) as Array<Record<string, unknown>>;
+		const rows = await db.table("users").select(["id", "username", "display_name", "avatar_base64", "must_change"]).where({ field: "id", op: "eq", value: uid }).all() as Array<Record<string, unknown>>;
 		if (!rows[0])
 			fail(404, "user not found");
-		const roleRows = await db.query("select role_name from sys_user_role where user_id = ?", [uid]) as Array<{ role_name: string }>;
+		const roleRows = await db.table("sys_user_role").select(["role_name"]).where({ field: "user_id", op: "eq", value: uid }).all() as Array<{ role_name: string }>;
 		return {
 			id: uid,
 			username: String(rows[0].username),
@@ -79,10 +76,13 @@ export function createSession(deps: SessionDeps = runtimeDeps()) {
 	async function issueFor(uid: number): Promise<TokenBundle> {
 		const user = await profileOf(uid);
 		const refreshToken = deps.randomHex(32);
-		await db.exec(
-			"insert into sys_refresh_token (token_hash, user_id, expires_at, revoked, created_at) values (?, ?, ?, 0, ?)",
-			[hashOf(refreshToken), uid, now() + deps.refreshTtlSecs, now()],
-		);
+		await db.table("sys_refresh_token").insert({
+			token_hash: hashOf(refreshToken),
+			user_id: uid,
+			expires_at: now() + deps.refreshTtlSecs,
+			revoked: 0,
+			created_at: now(),
+		}).run();
 		return {
 			access_token: await deps.signAccess(String(uid)),
 			refresh_token: refreshToken,
@@ -94,13 +94,13 @@ export function createSession(deps: SessionDeps = runtimeDeps()) {
 
 	/** 吊销联动（§3.1）：禁用/重置口令/改密 → 删该用户全部 refresh 记录。 */
 	async function revokeAll(uid: number): Promise<void> {
-		await db.exec("delete from sys_refresh_token where user_id = ?", [uid]);
+		await db.table("sys_refresh_token").where({ field: "user_id", op: "eq", value: uid }).delete().run();
 	}
 
 	return {
 		/** B1+D14：本地登录——先验口令后查禁用；号不存在/口令错/禁用统一 401（不泄露账号状态）。 */
 		async localLogin(username: string, password: string): Promise<TokenBundle> {
-			const rows = await db.query("select id, password_hash, is_forbidden from users where username = ?", [String(username ?? "")]) as Array<Record<string, unknown>>;
+			const rows = await db.table("users").select(["id", "password_hash", "is_forbidden"]).where({ field: "username", op: "eq", value: String(username ?? "") }).all() as Array<Record<string, unknown>>;
 			const row = rows[0];
 			if (!row || !(await deps.bcryptVerify(String(password ?? ""), String(row.password_hash))))
 				fail(401, "invalid credentials");
@@ -111,6 +111,7 @@ export function createSession(deps: SessionDeps = runtimeDeps()) {
 
 		/** B3：刷新——轮换作旧；reuse 检测（已吊销串二次出现）全族吊销 + 审计。 */
 		async refresh(token: string): Promise<TokenBundle> {
+			// 保留 db.query：select * 无已知列清单（规则6）
 			const rows = await db.query("select * from sys_refresh_token where token_hash = ?", [hashOf(String(token ?? ""))]) as Array<Record<string, unknown>>;
 			const row = rows[0];
 			if (!row)
@@ -123,14 +124,17 @@ export function createSession(deps: SessionDeps = runtimeDeps()) {
 			}
 			if (Number(row.expires_at) <= now())
 				fail(401, "invalid or expired refresh token");
-			await db.exec("update sys_refresh_token set revoked = 1 where token_hash = ?", [row.token_hash]);
+			await db.table("sys_refresh_token").update({ revoked: 1 }).where({ field: "token_hash", op: "eq", value: row.token_hash }).run();
 			// 滑动窗口 + 绝对 30d 封顶（§3.1「绝对 TTL + 滑动」）
 			const newExp = Math.min(Number(row.expires_at), now() + deps.refreshTtlSecs);
 			const refreshToken = deps.randomHex(32);
-			await db.exec(
-				"insert into sys_refresh_token (token_hash, user_id, expires_at, revoked, created_at) values (?, ?, ?, 0, ?)",
-				[hashOf(refreshToken), uid, newExp, now()],
-			);
+			await db.table("sys_refresh_token").insert({
+				token_hash: hashOf(refreshToken),
+				user_id: uid,
+				expires_at: newExp,
+				revoked: 0,
+				created_at: now(),
+			}).run();
 			const user = await profileOf(uid);
 			return {
 				access_token: await deps.signAccess(String(uid)),
@@ -143,7 +147,7 @@ export function createSession(deps: SessionDeps = runtimeDeps()) {
 
 		/** AC1-27：自助改密——本人 + 旧口令校验；改密清 must_change、级联删 refresh、换发正式 token。 */
 		async changePassword(uid: number, oldPassword: string, newPassword: string): Promise<TokenBundle> {
-			const rows = await db.query("select password_hash from users where id = ?", [uid]) as Array<{ password_hash: string }>;
+			const rows = await db.table("users").select(["password_hash"]).where({ field: "id", op: "eq", value: uid }).all() as Array<{ password_hash: string }>;
 			if (!rows[0])
 				fail(404, "user not found");
 			if (!(await deps.bcryptVerify(String(oldPassword ?? ""), String(rows[0].password_hash))))
@@ -152,8 +156,8 @@ export function createSession(deps: SessionDeps = runtimeDeps()) {
 				fail(400, "password too short (min 6)");
 			const hash = await deps.bcryptHash(String(newPassword));
 			await db.tx(async (t) => {
-				await t.exec("update users set password_hash = ?, must_change = 0 where id = ?", [hash, uid]);
-				await t.exec("delete from sys_refresh_token where user_id = ?", [uid]);
+				await t.table("users").update({ password_hash: hash, must_change: 0 }).where({ field: "id", op: "eq", value: uid }).run();
+				await t.table("sys_refresh_token").where({ field: "user_id", op: "eq", value: uid }).delete().run();
 			});
 			invalidateUser(uid);
 			return issueFor(uid);

package/templates/api/src/auth/api.ts

@@ -36,7 +36,7 @@ const logout = {
 	// POST /api/auth/logout —— 吊销当前 refresh 串（access 到期前仍有效，语义同旧版）。
 	async post() {
 		const token = String((http.body || {}).refresh_token ?? "");
-		await db.exec("delete from sys_refresh_token where token_hash = ?", [crypto.sha256Hex(token)]);
+		await db.table("sys_refresh_token").where({ field: "token_hash", op: "eq", value: crypto.sha256Hex(token) }).delete().run();
 		json.ok(null);
 	},
 };

package/templates/api/src/demo/todos/api.ts

@@ -9,6 +9,7 @@ const todos = {
 		const where = kw ? "WHERE title LIKE ?" : "";
 		const params = kw ? [`%${kw}%`] : [];
 		try {
+			// 保留 db.query：WHERE 由 JS 字符串拼接动态生成（规则5）
 			const totalRows = await db.query(`SELECT COUNT(*) AS c FROM todos ${where}`, params);
 			const total = Number(totalRows[0]?.c ?? 0);
 			const rows = await db.query(

package/templates/api/src/home/line/api.ts

@@ -12,10 +12,10 @@ const line = {
 			const today = Math.floor(Date.now() / 86400000);
 			const start = today - days + 1;
 
-			const rows = await db.query(
-				"SELECT day, SUM(value) AS v FROM home_line WHERE day >= ? AND day <= ? GROUP BY day",
-				[start, today],
-			);
+			const rows = await db.table("home_line").select([
+				"day",
+				{ fn: "sum", field: "value", as: "v" },
+			]).where({ field: "day", op: "gte", value: start }).where({ field: "day", op: "lte", value: today }).groupBy(["day"]).all();
 			const map = new Map<number, number>();
 			for (const r of rows)
 				map.set(Number(r.day), Number(r.v));

package/templates/api/src/home/pie/api.ts

@@ -6,10 +6,10 @@
 const pie = {
 	async get() {
 		try {
-			const rows = await db.query(
-				"SELECT category, SUM(value) AS v FROM home_pie GROUP BY category",
-				[],
-			);
+			const rows = await db.table("home_pie").select([
+				"category",
+				{ fn: "sum", field: "value", as: "v" },
+			]).groupBy(["category"]).all();
 			json.ok(rows.map(r => ({ code: String(r.category), value: Number(r.v) })));
 		}
 		catch (e) {

package/templates/api/src/notification/_shared/notify.ts

@@ -51,6 +51,7 @@ interface Row {
 interface NotifyDb {
 	query: (sql: string, params?: unknown[]) => Promise<Row[]>
 	exec: (sql: string, params?: unknown[]) => Promise<number>
+	table: DBInstance["table"]
 }
 declare const db: NotifyDb;
 
@@ -83,37 +84,30 @@ function mapItem(r: Row): NoticeItem {
 
 /** 给指定用户推一条按人通知，返回命名空间 id "u:<id>" */
 export async function pushNotice(input: PushInput): Promise<string> {
-	const ins = await db.query(
-		`INSERT INTO notifications (user_id, avatar, date, is_read, message, title, link, category)
-		 VALUES (?, ?, ?, 0, ?, ?, ?, ?) RETURNING id`,
-		[
-			Number(input.userId),
-			input.avatar ?? "",
-			nowStr(),
-			input.message,
-			input.title,
-			input.link ?? null,
-			input.category ?? "notice",
-		],
-	);
+	const ins = await db.table("notifications").insert({
+		user_id: Number(input.userId),
+		avatar: input.avatar ?? "",
+		date: nowStr(),
+		is_read: 0,
+		message: input.message,
+		title: input.title,
+		link: input.link ?? null,
+		category: input.category ?? "notice",
+	}).returning(["id"]).run() as Array<{ id: number }>;
 	return `u:${Number(ins[0]!.id)}`;
 }
 
 /** 广播一条通知（全员可见，一行存储），返回命名空间 id "b:<id>" */
 export async function pushBroadcastNotice(input: PushBroadcastInput): Promise<string> {
-	const ins = await db.query(
-		`INSERT INTO notifications_broadcast (avatar, date, message, title, link, category, create_time)
-		 VALUES (?, ?, ?, ?, ?, ?, ?) RETURNING id`,
-		[
-			input.avatar ?? "",
-			nowStr(),
-			input.message,
-			input.title,
-			input.link ?? null,
-			input.category ?? "notice",
-			nowStr(),
-		],
-	);
+	const ins = await db.table("notifications_broadcast").insert({
+		avatar: input.avatar ?? "",
+		date: nowStr(),
+		message: input.message,
+		title: input.title,
+		link: input.link ?? null,
+		category: input.category ?? "notice",
+		create_time: nowStr(),
+	}).returning(["id"]).run() as Array<{ id: number }>;
 	return `b:${Number(ins[0]!.id)}`;
 }
 
@@ -125,16 +119,18 @@ export async function delNotice(id: string, userId: string | number): Promise<bo
 	const [scope, raw] = splitId(id);
 	const uid = Number(userId);
 	if (scope === "b") {
-		await db.exec(
-			"DELETE FROM notifications_broadcast_read WHERE broadcast_id = ? AND user_id = ?",
-			[Number(raw), uid],
-		);
+		await db.table("notifications_broadcast_read")
+			.where({ field: "broadcast_id", op: "eq", value: Number(raw) })
+			.where({ field: "user_id", op: "eq", value: uid })
+			.delete()
+			.run();
 		return true;
 	}
-	const n = await db.exec(
-		"DELETE FROM notifications WHERE id = ? AND user_id = ?",
-		[Number(raw), uid],
-	);
+	const n = await db.table("notifications")
+		.where({ field: "id", op: "eq", value: Number(raw) })
+		.where({ field: "user_id", op: "eq", value: uid })
+		.delete()
+		.run() as number;
 	return n > 0;
 }
 
@@ -170,13 +166,18 @@ export async function markRead(id: string, userId: string | number): Promise<boo
 	const uid = Number(userId);
 	const now = nowStr();
 	if (scope === "b") {
+		// 保留 db.exec：INSERT OR IGNORE 构造器无等价（引擎按方言改写 IGNORE）
 		await db.exec(
 			"INSERT OR IGNORE INTO notifications_broadcast_read (broadcast_id, user_id, read_time) VALUES (?, ?, ?)",
 			[Number(raw), uid, now],
 		);
 		return true;
 	}
-	const n = await db.exec("UPDATE notifications SET is_read = 1 WHERE id = ? AND user_id = ?", [Number(raw), uid]);
+	const n = await db.table("notifications")
+		.where({ field: "id", op: "eq", value: Number(raw) })
+		.where({ field: "user_id", op: "eq", value: uid })
+		.update({ is_read: 1 })
+		.run() as number;
 	return n > 0;
 }
 
@@ -184,7 +185,8 @@ export async function markRead(id: string, userId: string | number): Promise<boo
 export async function markAllRead(userId: string | number): Promise<void> {
 	const uid = Number(userId);
 	const now = nowStr();
-	await db.exec("UPDATE notifications SET is_read = 1 WHERE user_id = ?", [uid]);
+	await db.table("notifications").where({ field: "user_id", op: "eq", value: uid }).update({ is_read: 1 }).run();
+	// 保留 db.exec：INSERT OR IGNORE ... SELECT 构造器无法表达
 	await db.exec(
 		"INSERT OR IGNORE INTO notifications_broadcast_read (broadcast_id, user_id, read_time) SELECT id, ?, ? FROM notifications_broadcast",
 		[uid, now],
@@ -194,6 +196,6 @@ export async function markAllRead(userId: string | number): Promise<void> {
 /** 清空：删按人项 + 删本人广播回执（列表消失） */
 export async function clearNotices(userId: string | number): Promise<void> {
 	const uid = Number(userId);
-	await db.exec("DELETE FROM notifications WHERE user_id = ?", [uid]);
-	await db.exec("DELETE FROM notifications_broadcast_read WHERE user_id = ?", [uid]);
+	await db.table("notifications").where({ field: "user_id", op: "eq", value: uid }).delete().run();
+	await db.table("notifications_broadcast_read").where({ field: "user_id", op: "eq", value: uid }).delete().run();
 }

package/templates/api/src/notifications/api.ts

@@ -12,10 +12,7 @@
 export default {
 	async get() {
 		try {
-			const rows = await db.query(
-				"SELECT id, avatar, date, is_read, message, title FROM notifications ORDER BY id DESC",
-				[],
-			);
+			const rows = await db.table("notifications").select(["id", "avatar", "date", "is_read", "message", "title"]).orderBy([{ field: "id", dir: "desc" }]).all();
 			json.ok(rows.map(r => ({
 				id: Number(r.id),
 				avatar: String(r.avatar),

package/templates/api/src/personal-center/upload/api.ts

@@ -41,7 +41,7 @@ const handler = {
 			const bytes = meta.key ? await blob.get(meta.key) : await http.file(0);
 			const b64 = toBase64(bytes);
 			const dataUrl = `data:${meta.content_type || "application/octet-stream"};base64,${b64}`;
-			await db.exec("UPDATE users SET avatar_base64 = ? WHERE id = ?", [dataUrl, Number(uid)]);
+			await db.table("users").update({ avatar_base64: dataUrl }).where({ field: "id", op: "eq", value: Number(uid) }).run();
 			// 大文件搬运/留档用 blob（v0.1.47）：搬走用 blob.move，别 get + put（字节进 V8）
 			if (meta.key)
 				await blob.del(meta.key);

package/templates/api/src/system/login-methods/api.ts

@@ -1,7 +1,7 @@
 import { respond } from "../../_platform/_shared/respond";
 // GET /api/system/login-methods —— 登录方式发现（C5/D2；匿名端点：登录前无 token，
 // 项目 config.yaml auth.anonymous_paths 必须列 /system/login-methods，漏列则握手 401 登录页必坏）。
-import { listLoginMethods } from "../../_platform/_shared/service/settings";
+import { listLoginMethods } from "../../_platform/_shared/service/domain/settings";
 
 async function get() {
 	await respond(async () => {

package/templates/api/src/system/oplog/api.ts

@@ -1,9 +1,9 @@
 import { respond } from "../../_platform/_shared/respond";
 // GET /api/system/oplog?action=&username=&module=&limit= —— 操作日志查询（AC1-29；D13 admin 可查）。
 // POST /api/system/oplog —— 操作日志写入（C3；登录态即可，解决方案模块记录自身操作）。
-import { assertSystemAdmin, currentAccess } from "../../_platform/_shared/service/access";
-import { recordOp } from "../../_platform/_shared/service/audit";
-import { searchOplog } from "../../_platform/_shared/service/oplog";
+import { assertSystemAdmin, currentAccess } from "../../_platform/_shared/service/infra/access";
+import { recordOp } from "../../_platform/_shared/service/infra/audit";
+import { searchOplog } from "../../_platform/_shared/service/infra/oplog";
 
 async function get() {
 	await respond(async () => {

package/templates/api/src/system/permissions/api.ts

@@ -1,7 +1,7 @@
 import { respond } from "../../_platform/_shared/respond";
+import { listPermissions } from "../../_platform/_shared/service/domain/roles";
 // GET /api/system/permissions —— 权限点全量（C2 绑定编辑器数据源，deprecated 标灰）。
-import { assertSystemAdmin } from "../../_platform/_shared/service/access";
-import { listPermissions } from "../../_platform/_shared/service/roles";
+import { assertSystemAdmin } from "../../_platform/_shared/service/infra/access";
 
 async function get() {
 	await respond(async () => {

package/templates/api/src/system/roles/api.ts

@@ -1,8 +1,8 @@
 import { respond } from "../../_platform/_shared/respond";
+import { createRole, deleteRole, listRoles } from "../../_platform/_shared/service/domain/roles";
 // 管理域端点 /api/system/roles（设计文档 D207：/api/system/* = 管理域，assertSystemAdmin 判权）。
 // handler 层只编排：守卫 → service → json 信封；name 走 query（wiki 先例：静态段 + http.query）。
-import { assertSystemAdmin } from "../../_platform/_shared/service/access";
-import { createRole, deleteRole, listRoles } from "../../_platform/_shared/service/roles";
+import { assertSystemAdmin } from "../../_platform/_shared/service/infra/access";
 
 async function guard(): Promise<void> {
 	await assertSystemAdmin();

package/templates/api/src/system/roles/bindings/api.ts

@@ -1,9 +1,9 @@
 import { respond } from "../../../_platform/_shared/respond";
+import { updateBindings } from "../../../_platform/_shared/service/domain/roles";
 // PUT /api/system/roles/bindings?name=xxx —— 整集替换角色绑定。
 // AC1-18 声明角色绑定可调整；AC1-19 builtin 硬拒（service 层）；AC1-30 摘绑定 = 紧急吊销出口
 // （service 内写后按持有者失效判权缓存）。
-import { assertSystemAdmin } from "../../../_platform/_shared/service/access";
-import { updateBindings } from "../../../_platform/_shared/service/roles";
+import { assertSystemAdmin } from "../../../_platform/_shared/service/infra/access";
 
 async function put() {
 	await respond(async () => {

package/templates/api/src/system/settings/api.ts

@@ -1,7 +1,7 @@
 import { respond } from "../../_platform/_shared/respond";
+import { listSettings, updateSetting } from "../../_platform/_shared/service/domain/settings";
 // /api/system/settings —— 系统设置（PRD §4.3）：GET 按组列出（secret 掩码），PUT 写值（写审计）。
-import { assertSystemAdmin } from "../../_platform/_shared/service/access";
-import { listSettings, updateSetting } from "../../_platform/_shared/service/settings";
+import { assertSystemAdmin } from "../../_platform/_shared/service/infra/access";
 
 const settingItemSchema = {
 	type: "object",

package/templates/api/src/system/users/api.ts

@@ -1,9 +1,9 @@
 import { respond } from "../../_platform/_shared/respond";
+import { createUser, listUsers } from "../../_platform/_shared/service/domain/users";
 // 管理域端点组 /api/system/users（AC1-7~10）：handler 只编排——assertSystemAdmin 守卫 → service → json。
 // 保护红线在 service 层硬 enforcement：禁止操作自己、admin 不碰成员资格、最后 superadmin 兜底。
 // 子端点：roles/password/forbidden 各为独立目录（wiki per-endpoint 先例）。
-import { assertSystemAdmin } from "../../_platform/_shared/service/access";
-import { createUser, listUsers } from "../../_platform/_shared/service/users";
+import { assertSystemAdmin } from "../../_platform/_shared/service/infra/access";
 
 const bcryptDeps = { bcryptHash: (pw: string) => bcrypt.hash(pw) };
 

package/templates/api/src/system/users/forbidden/api.ts

@@ -1,7 +1,7 @@
 import { respond } from "../../../_platform/_shared/respond";
+import { setForbidden } from "../../../_platform/_shared/service/domain/users";
 // PUT /api/system/users/forbidden?uid= —— 禁用/解禁（禁用即删 refresh，撤销即强退）。
-import { assertSystemAdmin } from "../../../_platform/_shared/service/access";
-import { setForbidden } from "../../../_platform/_shared/service/users";
+import { assertSystemAdmin } from "../../../_platform/_shared/service/infra/access";
 
 async function put() {
 	await respond(async () => {

package/templates/api/src/system/users/password/api.ts

@@ -1,7 +1,7 @@
 import { respond } from "../../../_platform/_shared/respond";
+import { changePasswordByAdmin } from "../../../_platform/_shared/service/domain/users";
 // PUT /api/system/users/password?uid= —— 管理员重置口令（must_change=1 + 级联吊销 refresh）。
-import { assertSystemAdmin } from "../../../_platform/_shared/service/access";
-import { changePasswordByAdmin } from "../../../_platform/_shared/service/users";
+import { assertSystemAdmin } from "../../../_platform/_shared/service/infra/access";
 
 async function put() {
 	await respond(async () => {

package/templates/api/src/system/users/roles/api.ts

@@ -1,7 +1,7 @@
 import { respond } from "../../../_platform/_shared/respond";
+import { updateUserRoles } from "../../../_platform/_shared/service/domain/users";
 // PUT /api/system/users/roles?uid= —— 整集替换用户角色（AC1-7；sys_user_role 权威源 + 写时失效）。
-import { assertSystemAdmin } from "../../../_platform/_shared/service/access";
-import { updateUserRoles } from "../../../_platform/_shared/service/users";
+import { assertSystemAdmin } from "../../../_platform/_shared/service/infra/access";
 
 async function put() {
 	await respond(async () => {

package/templates/api/src/web/user-info/api.ts

@@ -10,16 +10,13 @@ export default {
 			return;
 		}
 		try {
-			const rows = await db.query(
-				"SELECT id, username, display_name, avatar_base64, email, must_change FROM users WHERE id = ?",
-				[Number(uid)],
-			);
+			const rows = await db.table("users").select(["id", "username", "display_name", "avatar_base64", "email", "must_change"]).where({ field: "id", op: "eq", value: Number(uid) }).all();
 			const row = rows[0];
 			if (!row) {
 				json.fail(404, "user not found");
 				return;
 			}
-			const roleRows = await db.query("SELECT role_name FROM sys_user_role WHERE user_id = ?", [Number(uid)]) as Array<{ role_name: string }>;
+			const roleRows = await db.table("sys_user_role").select(["role_name"]).where({ field: "user_id", op: "eq", value: Number(uid) }).all() as Array<{ role_name: string }>;
 			json.ok({
 				id: String(row.id),
 				avatar: String(row.avatar_base64 ?? ""),

package/templates/api/tests/auth-session.spec.ts

@@ -4,7 +4,7 @@
 import type { SessionDeps } from "../src/auth/_shared/session";
 
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
-import { assertPermission } from "../src/_platform/_shared/service/access";
+import { assertPermission } from "../src/_platform/_shared/service/infra/access";
 import { createSession } from "../src/auth/_shared/session";
 import { installDb } from "./fixture";
 

package/templates/api/tests/auth-throttle.spec.ts

@@ -5,7 +5,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { loginBlocked, loginFailed, loginSucceeded, resetLoginThrottle } from "../src/_platform/_shared/service/rate";
+import { loginBlocked, loginFailed, loginSucceeded, resetLoginThrottle } from "../src/_platform/_shared/service/infra/rate";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/api/tests/guard.spec.ts

@@ -3,7 +3,7 @@
 // （真实迁移建表 / 运行时全局 db 同面 / 事务往返）——S0 spike 的「一条真实判权 AC + 形态证明」。
 import { beforeAll, describe, expect, it } from "vitest";
 
-import { decideAccess, moduleOf } from "../src/_platform/_shared/service/guard";
+import { decideAccess, moduleOf } from "../src/_platform/_shared/service/infra/guard";
 import { ADMIN, installDb } from "./fixture";
 
 const as = (roles: string[], bindings: Record<string, string[]> = {}) => ({ roles, bindings });

package/templates/api/tests/lifecycle/market-api.spec.ts

@@ -26,7 +26,7 @@ import { readLock, writeLock } from "../../src/_platform/_lifecycle/lock";
 import { createStateStore } from "../../src/_platform/_lifecycle/state";
 import { getTask, writeTask } from "../../src/_platform/_lifecycle/tasks";
 import { createTrustStore } from "../../src/_platform/_lifecycle/trust";
-import { invalidateAllUsers } from "../../src/_platform/_shared/service/access";
+import { invalidateAllUsers } from "../../src/_platform/_shared/service/infra/access";
 import { createMarketApi, marketEnv, parseVersionsJson, versionsJsonPathOf } from "../../src/_platform/market/api";
 import { installDb, MARKET_HISTORY_DDL } from "../fixture";
 

package/templates/api/tests/lifecycle/trust.spec.ts

@@ -11,7 +11,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import { createTrustStore, isValidKeyId } from "../../src/_platform/_lifecycle/trust";
-import { invalidateAllUsers } from "../../src/_platform/_shared/service/access";
+import { invalidateAllUsers } from "../../src/_platform/_shared/service/infra/access";
 import { createMarketApi, marketEnv } from "../../src/_platform/market/api";
 import { installDb } from "../fixture";
 

package/templates/api/tests/lifecycle/uninstall.spec.ts

@@ -14,7 +14,7 @@ import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import { readLock, writeLock } from "../../src/_platform/_lifecycle/lock";
 import { createStateStore } from "../../src/_platform/_lifecycle/state";
 import { catalogSpec, collectRetainedTables, tablePrefixPattern } from "../../src/_platform/_lifecycle/uninstall";
-import { invalidateAllUsers } from "../../src/_platform/_shared/service/access";
+import { invalidateAllUsers } from "../../src/_platform/_shared/service/infra/access";
 import { createMarketApi } from "../../src/_platform/market/api";
 import { installDb, MARKET_HISTORY_DDL } from "../fixture";
 

package/templates/api/tests/query-utils.spec.ts

@@ -3,7 +3,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { beforeAll, describe, expect, it } from "vitest";
 
-import { likePattern, paged } from "../src/_platform/_shared/service/query";
+import { likePattern, paged } from "../src/_platform/_shared/service/infra/query";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/api/tests/rbac-audit.spec.ts

@@ -3,7 +3,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { auditDeny, auditOp, recordOp, resetDenyAudit } from "../src/_platform/_shared/service/audit";
+import { auditDeny, auditOp, recordOp, resetDenyAudit } from "../src/_platform/_shared/service/infra/audit";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/api/tests/rbac-contacts.spec.ts

@@ -4,7 +4,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { contactDetail, searchContacts } from "../src/_platform/_shared/service/contacts";
+import { contactDetail, searchContacts } from "../src/_platform/_shared/service/domain/contacts";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
@@ -74,7 +74,7 @@ describe("详情与限速", () => {
 	it("接口级限速：同用户突发超限 → 429", async () => {
 		const uid = mkUser("c_rate");
 		g.http = { user: { id: uid } };
-		const { rateLimit } = await import("../src/_platform/_shared/service/rate");
+		const { rateLimit } = await import("../src/_platform/_shared/service/infra/rate");
 		// 窗口 60s / 限额 3（测试参数；生产端点各自定额）
 		for (let i = 0; i < 3; i++)
 			await rateLimit(`contacts:${uid}`, 3, 60_000);

package/templates/api/tests/rbac-guard.spec.ts

@@ -4,7 +4,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { assertPermission, assertSuperAdmin, assertSystemAdmin, invalidateUser } from "../src/_platform/_shared/service/access";
+import { assertPermission, assertSuperAdmin, assertSystemAdmin, invalidateUser } from "../src/_platform/_shared/service/infra/access";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/api/tests/rbac-roles.spec.ts

@@ -4,8 +4,8 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { assertPermission } from "../src/_platform/_shared/service/access";
-import { createRole, deleteRole, listPermissions, listRoles, updateBindings } from "../src/_platform/_shared/service/roles";
+import { createRole, deleteRole, listPermissions, listRoles, updateBindings } from "../src/_platform/_shared/service/domain/roles";
+import { assertPermission } from "../src/_platform/_shared/service/infra/access";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/api/tests/rbac-settings.spec.ts

@@ -2,8 +2,8 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { searchOplog } from "../src/_platform/_shared/service/oplog";
-import { listLoginMethods, listSettings, updateSetting } from "../src/_platform/_shared/service/settings";
+import { listLoginMethods, listSettings, updateSetting } from "../src/_platform/_shared/service/domain/settings";
+import { searchOplog } from "../src/_platform/_shared/service/infra/oplog";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;