@oj-module/cli 0.2.64 → 0.2.67

package/src/usage.ts

@@ -245,11 +245,13 @@ export const HELP_GROUPS: HelpGroup[] = [
 					{ raw: "--name <name>", zh: "覆盖文件名推导的方案名", en: "Override the solution name derived from the file name" },
 					{ raw: "--version <version>", zh: "覆盖文件名推导的版本", en: "Override the version derived from the file name" },
 					{ raw: "--registry <url>", zh: "从指定 registry 源安装（白名单在服务端；旧站点 API < 0.2.0 不支持）", en: "Install from the specified registry source (allowlist is server-side; sites with API < 0.2.0 are unsupported)" },
+					{ raw: "--force", zh: "强制重装配（oj 0.1.123+ reloadConfig(force)）：旁路 unchanged 幂等短路，强制宿主重做一次装配", en: "Force re-assembly (oj 0.1.123+ reloadConfig(force)): bypass the unchanged idempotent short-circuit and force a re-assembly" },
 					{ raw: "--locale <locale>", zh: "终态文案语言 zh-CN|en-US", en: "Language of the final status message zh-CN|en-US" },
+					{ raw: "--force", zh: "强制重装配（绕过「unchanged=已是最新装配」幂等短路，要求宿主重跑一次 reload；oj ≥ v0.1.123）", en: "Force a reload even if unchanged (bypass the idempotent short-circuit; requires oj ≥ v0.1.123)" },
 				],
 				detail: {
-					zh: "ojm install <file.tgz | name[@version] | @<scope>/<name>[@version]> [--site-url <u>] [--user <u>] [--pass <p>] [--name <n>] [--version <v>] [--registry <r>] [--locale <zh-CN|en-US>]\n  本地 tgz 走 file 上传（<name>-<version>.tgz 文件名推导身份，可 --name/--version 覆盖）；name[@version] 走 CDN 市场源；@<scope>/<name>[@version] --registry <url> 走外部 registry 源（目录键由 CLI 归一为物理名 slug，白名单在服务端）\n  登录 → 提交 → 轮询任务至终态并打印结果（失败附原因 + 指引）\n  站点寻址：--site-url/--user/--pass，或环境变量 OJM_SITE_URL / OJM_USER / OJM_PASS",
-					en: "ojm install <file.tgz | name[@version] | @<scope>/<name>[@version]> [--site-url <u>] [--user <u>] [--pass <p>] [--name <n>] [--version <v>] [--registry <r>] [--locale <zh-CN|en-US>]\n  Local tgz goes through file upload (identity derived from the <name>-<version>.tgz file name, overridable via --name/--version); name[@version] goes through the CDN marketplace; @<scope>/<name>[@version] --registry <url> goes through an external registry source (the directory key is normalized to the physical slug by the CLI; allowlist is server-side)\n  Login → submit → poll the task to a terminal state and print the result (failures include the reason + guidance)\n  Site addressing: --site-url/--user/--pass, or env vars OJM_SITE_URL / OJM_USER / OJM_PASS",
+					zh: "ojm install <file.tgz | name[@version] | @<scope>/<name>[@version]> [--site-url <u>] [--user <u>] [--pass <p>] [--name <n>] [--version <v>] [--registry <r>] [--force] [--locale <zh-CN|en-US>]\n  本地 tgz 走 file 上传（<name>-<version>.tgz 文件名推导身份，可 --name/--version 覆盖）；name[@version] 走 CDN 市场源；@<scope>/<name>[@version] --registry <url> 走外部 registry 源（目录键由 CLI 归一为物理名 slug，白名单在服务端）\n  登录 → 提交 → 轮询任务至终态并打印结果（失败附原因 + 指引）\n  --force：强制重装配（oj 0.1.123+），旁路「已是最新装配」幂等短路\n  站点寻址：--site-url/--user/--pass，或环境变量 OJM_SITE_URL / OJM_USER / OJM_PASS",
+					en: "ojm install <file.tgz | name[@version] | @<scope>/<name>[@version]> [--site-url <u>] [--user <u>] [--pass <p>] [--name <n>] [--version <v>] [--registry <r>] [--force] [--locale <zh-CN|en-US>]\n  Local tgz goes through file upload (identity derived from the <name>-<version>.tgz file name, overridable via --name/--version); name[@version] goes through the CDN marketplace; @<scope>/<name>[@version] --registry <url> goes through an external registry source (the directory key is normalized to the physical slug by the CLI; allowlist is server-side)\n  Login → submit → poll the task to a terminal state and print the result (failures include the reason + guidance)\n  --force: force re-assembly (oj 0.1.123+), bypassing the \"already latest assembly\" idempotent short-circuit\n  Site addressing: --site-url/--user/--pass, or env vars OJM_SITE_URL / OJM_USER / OJM_PASS",
 				},
 			},
 			{
@@ -364,12 +366,14 @@ export const HELP_GROUPS: HelpGroup[] = [
 				en: "Generate an Ed25519 signing key pair",
 				options: [
 					{ raw: "--id <id>", zh: "发布方 key id（形如 publisher.key）", en: "Publisher key id (e.g. publisher.key)" },
+					{ raw: "--credential <token>", zh: "在线兑换发布凭证（也读 OJM_PUBLISH_CREDENTIAL；与 --id 互斥）", en: "Redeem a publishing credential online (also reads OJM_PUBLISH_CREDENTIAL; mutually exclusive with --id)" },
+					{ raw: "--site-url <url>", zh: "兑换站点（缺省 OJM_SITE_URL / http://127.0.0.1:9778）", en: "Site for redemption (defaults to OJM_SITE_URL / http://127.0.0.1:9778)" },
 					{ raw: "--out <dir>", zh: "输出目录（缺省 ~/.ojm/keys/<id>/；指到工程树内须 --yes）", en: "Output directory (default ~/.ojm/keys/<id>/; pointing inside the project tree requires --yes)" },
 					{ raw: "--yes", zh: "确认私钥落盘到工程树内（私钥入仓即泄露）", en: "Acknowledge writing the private key inside the project tree (a private key in the repo is leaked)" },
 				],
 				detail: {
-					zh: "ojm keygen --id <publisher.id> [--out <dir>] [--yes]\n  私钥默认 ~/.ojm/keys/<id>/ 永不出目录；打印公钥 hex 供 ojm trust add / 模板回填",
-					en: "ojm keygen --id <publisher.id> [--out <dir>] [--yes]\n  The private key stays under ~/.ojm/keys/<id>/ by default; prints the public key hex for ojm trust add / template backfill",
+					zh: "ojm keygen --id <publisher.id> [--out <dir>] [--yes]\n  私钥默认 ~/.ojm/keys/<id>/ 永不出目录；打印公钥 hex 供 ojm trust add / 模板回填\n\nojm keygen --credential <token> [--site-url <url>] [--out <dir>] [--yes]\n  凭证兑换：key_id 由站点按「产品名.用户名」算好下发，CLI 不推导；凭证一次性，兑换即作废\n  失败（过期/已用/已撤销/网络）不落任何密钥文件；兑换成功再走与离线版完全相同的落盘流程",
+					en: "ojm keygen --id <publisher.id> [--out <dir>] [--yes]\n  The private key stays under ~/.ojm/keys/<id>/ by default; prints the public key hex for ojm trust add / template backfill\n\nojm keygen --credential <token> [--site-url <url>] [--out <dir>] [--yes]\n  Credential redemption: key_id is derived server-side as <product>.<username>, the CLI never re-derives it; the credential is single-use\n  Any failure (expired/used/revoked/network) writes no key files; on success the same keygen flow as the offline path runs",
 				},
 			},
 			{

package/src/vendor.ts

@@ -43,8 +43,12 @@ export const NPM_PKG = "@oj-bin/oj";
  * `__client` 内省 fail-fast，`oj openapi --module-root` 契约链整体不可用）修复于
  * 0.1.86（oj-bin 0f8a6e2，第三次基线发布通道实证）；module-root 工程是 0.2.20 起
  * 的默认布局，门禁必须盖住契约链（见 playbook §9 与 2026-10-23 第三次基线）。
+ * **0.2.68 抬到 0.1.121**：模板的方言 seed（`seed.mysql.sql` / `seed.pg.sql`）依赖
+ * 0.1.121 的「方言件胜出、`seed.sql` 兜底」选择语义（oj-bin 7d70b90）；更早的 oj
+ * 只读 `seed.sql`，三方言执行同一份 sqlite 写法 → mysql/pg 上 1064 拒启。模板不再
+ * 教「部署期手工覆盖」，门禁必须盖住这条链路（见 playbook §11 U1）。
  */
-export const MIN_OJ_VERSION = "0.1.86";
+export const MIN_OJ_VERSION = "0.1.121";
 
 /** 按段数值比较（字符串比较会把 0.1.9 判成大于 0.1.69）；非数字段按 0 处理 */
 export function isSupportedOjVersion(version: string): boolean {

package/templates/config.yaml

@@ -50,8 +50,6 @@ db:
   default: 'sqlite://db.sqlite' # 相对 config 目录；缺文件自动建空库
 
 vars:
-  # ojm install 每次安装自增一次，用来触发 reload 热更。别删行、别手工回写旧值。
-  ojm_install_seq: 0
   # 站点对外地址。装方案时服务端拿它把 /cdn 这类相对地址补全成绝对 URL（深检探针也用它）。
   # 故意不读请求头 Host（防伪造 Host 牵引出站）：不配 = fail-closed，不会替你猜。
   # canonical_origin: "https://your-site.example.com"
@@ -160,6 +158,7 @@ auth:
     - /auth/wecom/callback # 企微 302 回跳：code 即凭证，此时还没有本地会话
     - /auth/wecom/ticket # 一次性票据换 TokenBundle：票据本身就是「刚验过的登录证明」
     - /auth/wecom/event # 企微指令回调：靠 msg_signature 验签，不走 Bearer
+    - /publish/credential/exchange # 凭证换发布身份：凭证自身即持有型证明，CLI 可能没有账号密码
 
 # 多租户（企微代开发 v3 Phase 0）：开启后所有 {base} 请求必须带 X-TENANT-ID，否则 400。
 # 前端由 tenantStore + headerProvider 统一注入（单租户部署恒为 default，UX 不变）。
@@ -180,10 +179,12 @@ tenant:
     - sys_rate_window # 限速窗口（登录前就要用）
     - sys_login_throttle # 登录节流（登录前就要用）
     - market_history # 解决方案安装/升级/回滚是站点级留痕
+    - market_release # 发布历史：CDN 是站点级的，历史按站点归口
     - reg_source_seq # 索引新鲜度水位属于站点（防回放）
     - wecom_app_profile # 企微 corp→租户映射权威：查它时必然还没有租户上下文（D9）
     - wecom_suite_ticket # 套件级凭证，按 suite_id 全局唯一
     - wecom_login_ticket # 一次性登录票据：跨「匿名 302 回跳」与「已认证换取」两段
+    - publish_credential # 发布凭证：CLI 兑换那一跳没有业务租户语义，归属走 owner_tenant 列
   # 豁免缺租户头的路径（去 base 前缀后的形态）。与 auth.anonymous_paths 同语义，
   # 但这是「没有租户头也不 400」的逃生口，只给**真的拿不到头**的端点。
   # 登录类端点不在此列：前端 headerProvider 每请求都注头（单租户恒 default），
@@ -196,6 +197,7 @@ tenant:
     - /auth/wecom/callback # 企微 302 回跳：浏览器带不了头，租户由 state→profile 推导
     - /auth/wecom/ticket # 一次性票据换会话：租户由票据行携带
     - /auth/wecom/event # 企微指令回调：验签+解密即认证，无租户语义
+    - /publish/credential/exchange # 凭证兑换：CLI 的裸 fetch 不带租户头；表本身是共享表（B 组）
   # tenant.require_signed_claim：租户头的服务端绑定（平台级 fail-closed）。
   # 暂保持 false——上游 oj 的 jwt.sign 目前会静默丢弃自定义 claim（需求 R6），
   # 开启前无法把 tenant 放进 token。R6 落地后改 true，裸头即失去自证能力。

package/templates/init.include.yaml

@@ -40,11 +40,11 @@ include:
   - src/styles.css
   # 后端 typecheck 工程（package.json 的 typecheck:api 指向它）；只收后端、排除 web
   - src/tsconfig.json
-  # —— 后端：配置 / 种子 / 测试 / 默认模块（模块源码在 src/app/api/<模块>）——
+  # —— 后端：配置 / 测试 / 默认模块（模块源码在 src/app/api/<模块>）——
+  # 方言 seed 不在这里列：它们是模块资产（`src/app/api/<模块>/seed.<dialect>.sql`），
+  # 根级副本会与模块内那份漂移（历史上一份只含 4 条设置、且 mysql 侧裸写保留字列），已删除。
   - config.yaml
   - .ojm-api-exempt.json
-  - seed.mysql.sql
-  - seed.pg.sql
   - vitest.config.ts
   # —— tests 逐条白名单（不收 tests/ 整目录）——
   # 业务工程只拷「纯 node:sqlite 夹具、零 cli 包环境假设」的测试。以下 6 个不分发
@@ -74,6 +74,9 @@ include:
   # 角色页展示层过滤 superadmin（后端 listRoles 仍返回；页面源码随 src/app/web/system 下发）
   - tests/roles-page.spec.ts
   - tests/seed-role-accounts.spec.ts
+  # 发布凭证：身份推导规则是跨端共用的口径，随源码下发，用户工程可本地自检
+  - tests/publish-identity.spec.ts
+  - tests/publish-credential.spec.ts
   # 用户页行级门禁：只有 superadmin 能改 superadmin 账号（后端 assertCanManageTarget 的另一面）
   - tests/users-page.spec.ts
   # 企微连接器与组织同步：源码本就分发（src/app/api/auth），对应回归也必须跟着走，
@@ -105,6 +108,7 @@ include:
   - src/app/api/auth
   - src/app/api/notification
   - src/app/api/personal-center
+  - src/app/api/publish
   - src/app/api/system
   - src/app/api/web
   # —— web 前端模块 ——
@@ -132,5 +136,6 @@ include:
   - src/oj-market/web/hooks
   - src/oj-market/web/locales
   - src/oj-market/web/pages
+  - src/oj-market/web/publish
   - src/oj-market/web/utils
   - src/app/web/web

package/templates/openapi.json

@@ -870,6 +870,96 @@
 				}
 			}
 		},
+		"/api/_platform/market/releases": {
+			"get": {
+				"operationId": "_platform_market_releases_get",
+				"summary": "GET api/_platform/market/releases",
+				"x-oj-file": "app/api/_platform/market/api.ts",
+				"tags": [
+					"_platform"
+				],
+				"parameters": [
+					{
+						"name": "page",
+						"in": "query",
+						"required": false,
+						"schema": {
+							"type": "number",
+							"minimum": 1
+						}
+					},
+					{
+						"name": "limit",
+						"in": "query",
+						"required": false,
+						"schema": {
+							"type": "number",
+							"minimum": 1,
+							"maximum": 200
+						}
+					}
+				],
+				"responses": {
+					"200": {
+						"description": "OK",
+						"x-oj-response-enforced": false,
+						"content": {
+							"application/json": {
+								"schema": {
+									"type": "object",
+									"required": [
+										"code",
+										"msg",
+										"data"
+									],
+									"properties": {
+										"code": {
+											"type": "integer"
+										},
+										"msg": {
+											"type": "string"
+										},
+										"data": {
+											"type": "object",
+											"required": [
+												"list",
+												"total",
+												"page",
+												"size"
+											],
+											"properties": {
+												"list": {
+													"type": "array",
+													"items": {
+														"type": "object",
+														"additionalProperties": true
+													}
+												},
+												"total": {
+													"type": "number"
+												},
+												"page": {
+													"type": "number"
+												},
+												"size": {
+													"type": "number"
+												},
+												"syncError": {
+													"type": [
+														"string",
+														"null"
+													]
+												}
+											}
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		},
 		"/api/_platform/org/departments": {
 			"get": {
 				"operationId": "_platform_org_departments_get",
@@ -4536,6 +4626,368 @@
 				}
 			}
 		},
+		"/api/publish/credential": {
+			"get": {
+				"operationId": "publish_credential_get",
+				"summary": "GET api/publish/credential",
+				"x-oj-file": "app/api/publish/api.ts",
+				"tags": [
+					"publish"
+				],
+				"parameters": [
+					{
+						"name": "page",
+						"in": "query",
+						"required": false,
+						"schema": {
+							"type": "number",
+							"minimum": 1
+						}
+					},
+					{
+						"name": "limit",
+						"in": "query",
+						"required": false,
+						"schema": {
+							"type": "number",
+							"minimum": 1,
+							"maximum": 200
+						}
+					},
+					{
+						"name": "tenant",
+						"in": "query",
+						"required": false,
+						"schema": {
+							"type": "string"
+						}
+					}
+				],
+				"responses": {
+					"200": {
+						"description": "OK",
+						"x-oj-response-enforced": false,
+						"content": {
+							"application/json": {
+								"schema": {
+									"type": "object",
+									"required": [
+										"code",
+										"msg",
+										"data"
+									],
+									"properties": {
+										"code": {
+											"type": "integer"
+										},
+										"msg": {
+											"type": "string"
+										},
+										"data": {
+											"type": "object",
+											"required": [
+												"list",
+												"total"
+											],
+											"properties": {
+												"list": {
+													"type": "array",
+													"items": {
+														"type": "object",
+														"required": [
+															"id",
+															"product",
+															"key_id",
+															"username",
+															"token_hint",
+															"status",
+															"expires_at",
+															"created_at"
+														],
+														"properties": {
+															"id": {
+																"type": "number"
+															},
+															"product": {
+																"type": "string"
+															},
+															"key_id": {
+																"type": "string"
+															},
+															"username": {
+																"type": "string"
+															},
+															"display_name": {
+																"type": [
+																	"string",
+																	"null"
+																]
+															},
+															"token_hint": {
+																"type": "string"
+															},
+															"status": {
+																"type": "string",
+																"enum": [
+																	"active",
+																	"used",
+																	"revoked",
+																	"expired"
+																]
+															},
+															"expires_at": {
+																"type": "number"
+															},
+															"used_at": {
+																"type": [
+																	"number",
+																	"null"
+																]
+															},
+															"created_at": {
+																"type": "number"
+															},
+															"owner_tenant": {
+																"type": "string"
+															}
+														}
+													}
+												},
+												"total": {
+													"type": "number"
+												}
+											}
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+			},
+			"post": {
+				"operationId": "publish_credential_post",
+				"summary": "POST api/publish/credential",
+				"x-oj-file": "app/api/publish/api.ts",
+				"tags": [
+					"publish"
+				],
+				"requestBody": {
+					"required": true,
+					"content": {
+						"application/json": {
+							"schema": {
+								"type": "object",
+								"required": [
+									"product"
+								],
+								"properties": {
+									"product": {
+										"type": "string"
+									}
+								}
+							}
+						}
+					}
+				},
+				"responses": {
+					"200": {
+						"description": "OK",
+						"x-oj-response-enforced": false,
+						"content": {
+							"application/json": {
+								"schema": {
+									"type": "object",
+									"required": [
+										"code",
+										"msg",
+										"data"
+									],
+									"properties": {
+										"code": {
+											"type": "integer"
+										},
+										"msg": {
+											"type": "string"
+										},
+										"data": {
+											"type": "object",
+											"required": [
+												"token",
+												"key_id",
+												"product",
+												"expires_at"
+											],
+											"properties": {
+												"token": {
+													"type": "string"
+												},
+												"key_id": {
+													"type": "string"
+												},
+												"product": {
+													"type": "string"
+												},
+												"token_hint": {
+													"type": "string"
+												},
+												"expires_at": {
+													"type": "number"
+												}
+											}
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		},
+		"/api/publish/credential/revoke": {
+			"post": {
+				"operationId": "publish_credential_revoke_post",
+				"summary": "POST api/publish/credential/revoke",
+				"x-oj-file": "app/api/publish/api.ts",
+				"tags": [
+					"publish"
+				],
+				"requestBody": {
+					"required": true,
+					"content": {
+						"application/json": {
+							"schema": {
+								"type": "object",
+								"required": [
+									"id"
+								],
+								"properties": {
+									"id": {
+										"type": "number"
+									}
+								}
+							}
+						}
+					}
+				},
+				"responses": {
+					"200": {
+						"description": "OK",
+						"x-oj-response-enforced": false,
+						"content": {
+							"application/json": {
+								"schema": {
+									"type": "object",
+									"required": [
+										"code",
+										"msg",
+										"data"
+									],
+									"properties": {
+										"code": {
+											"type": "integer"
+										},
+										"msg": {
+											"type": "string"
+										},
+										"data": {
+											"type": "object",
+											"required": [
+												"ok"
+											],
+											"properties": {
+												"ok": {
+													"type": "boolean"
+												}
+											}
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		},
+		"/api/publish/credential/exchange": {
+			"post": {
+				"operationId": "publish_credential_exchange_post",
+				"summary": "POST api/publish/credential/exchange",
+				"x-oj-file": "app/api/publish/api.ts",
+				"tags": [
+					"publish"
+				],
+				"requestBody": {
+					"required": true,
+					"content": {
+						"application/json": {
+							"schema": {
+								"type": "object",
+								"required": [
+									"token"
+								],
+								"properties": {
+									"token": {
+										"type": "string"
+									}
+								}
+							}
+						}
+					}
+				},
+				"responses": {
+					"200": {
+						"description": "OK",
+						"x-oj-response-enforced": false,
+						"content": {
+							"application/json": {
+								"schema": {
+									"type": "object",
+									"required": [
+										"code",
+										"msg",
+										"data"
+									],
+									"properties": {
+										"code": {
+											"type": "integer"
+										},
+										"msg": {
+											"type": "string"
+										},
+										"data": {
+											"type": "object",
+											"required": [
+												"key_id",
+												"product",
+												"username"
+											],
+											"properties": {
+												"key_id": {
+													"type": "string"
+												},
+												"product": {
+													"type": "string"
+												},
+												"username": {
+													"type": "string"
+												},
+												"display_name": {
+													"type": [
+														"string",
+														"null"
+													]
+												}
+											}
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		},
 		"/api/system/departments": {
 			"get": {
 				"operationId": "system_departments_get",
@@ -5325,7 +5777,8 @@
 										"data": {
 											"type": "object",
 											"required": [
-												"methods"
+												"methods",
+												"site_title"
 											],
 											"properties": {
 												"methods": {
@@ -5333,6 +5786,9 @@
 													"items": {
 														"type": "string"
 													}
+												},
+												"site_title": {
+													"type": "string"
 												}
 											}
 										}
@@ -6862,6 +7318,9 @@
 		{
 			"name": "personal-center"
 		},
+		{
+			"name": "publish"
+		},
 		{
 			"name": "system"
 		},