@oj-module/cli 0.2.66 → 0.2.67

package/templates/src/app/api/publish/api.ts

@@ -0,0 +1,349 @@
+// 发布凭证端点族：/api/publish/credential/*
+//
+// 职责边界（ISP）：本文件只做「门禁 + 入参收口 + 一次原子读写」；
+// 身份推导在 _shared/identity.ts（纯函数，无 IO），凭证换身份 = 一条条件 UPDATE 抢所有权。
+//
+// 三个门径的差别是刻意的：
+//   · 申请 / 列表 / 撤销：登录态（currentAccess 已含「伪造租户头即查无此人」的拦截）
+//   · 兑换：**匿名**。凭证自身就是持有型证明——CLI 可能没有账号密码，
+//     这是它唯一需要的能力。抗穷举靠 256 位随机 + IP 维度限速，不靠登录态。
+//
+// 为什么是工厂（createPublishApi）而不是裸 handler：随机数与时钟必须可注入，
+// 否则「过期」这类用例只能靠 sleep，「并发双花」也无法稳定构造。
+// 与 market/api.ts 的 createMarketApi(marketEnv()) 同一形态。
+import { respond } from "#/_platform/_shared/respond";
+import { currentAccess } from "#/_platform/_shared/service/infra/access";
+import { pagedFactory } from "#/_platform/_shared/service/infra/query";
+import { rateLimit } from "#/_platform/_shared/service/infra/rate";
+import { assertKeyId, assertProduct, CREDENTIAL_TTL_SECS, deriveKeyId } from "./_shared/identity";
+
+/** 兑换失败的唯一文案：不区分「不存在 / 已兑换 / 已过期 / 已撤销」，避免探测，且给出下一步 */
+const EXCHANGE_INVALID = "发布凭证无效或已失效（可能已兑换、已过期或已撤销）。请到「发布管理」页重新申请";
+
+/** 单 IP 兑换尝试上限（每 10 分钟）；256 位随机下正常用户远用不到，超限只可能是扫 */
+const EXCHANGE_RATE_LIMIT = 20;
+const EXCHANGE_RATE_WINDOW_MS = 10 * 60 * 1000;
+
+export interface PublishDeps {
+	/** 秒级时钟 */
+	now: () => number
+	randomHex: (bytes: number) => string
+	sha256Hex: (input: string) => string
+}
+
+function fail(status: number, message: string): never {
+	throw Object.assign(new Error(message), { status });
+}
+
+/** 客户端 IP：反代场景读 x-forwarded-for 首段（与 login-throttle 同口径） */
+function clientIp(): string {
+	const headers = (http.headers ?? {}) as Record<string, string>;
+	return String(headers["x-forwarded-for"] ?? headers["x-real-ip"] ?? "unknown").split(",")[0].trim();
+}
+
+/** 运行时依赖：oj isolate 的 crypto 增补面（无 randomUUID/sha256 时需要显式报缺，不静默降级） */
+export function runtimePublishDeps(): PublishDeps {
+	return {
+		now: () => Math.floor(Date.now() / 1000),
+		randomHex: (n) => {
+			const c = (globalThis as unknown as { crypto?: { randomHex?: (bytes: number) => string } }).crypto;
+			if (typeof c?.randomHex !== "function")
+				throw new Error("publish: 运行时缺少 crypto.randomHex，无法签发凭证");
+			return String(c.randomHex(n));
+		},
+		sha256Hex: (input) => {
+			const c = (globalThis as unknown as { crypto?: { sha256Hex?: (s: string) => string } }).crypto;
+			if (typeof c?.sha256Hex !== "function")
+				throw new Error("publish: 运行时缺少 crypto.sha256Hex，无法签发凭证");
+			return String(c.sha256Hex(input));
+		},
+	};
+}
+
+interface Actor {
+	uid: number
+	username: string
+	displayName: string | null
+	tenant: string
+	superadmin: boolean
+}
+
+interface CredentialRow {
+	id: number
+	product: string
+	key_id: string
+	username: string
+	display_name: string | null
+	owner_tenant: string
+	token_hint: string
+	expires_at: number
+	used: number
+	used_at: number | null
+	revoked: number
+	created_at: number
+}
+
+/** 状态由服务端判定（前端各自推导必然分叉） */
+function statusOf(row: CredentialRow, now: number): "active" | "used" | "revoked" | "expired" {
+	if (Number(row.used) === 1)
+		return "used";
+	if (Number(row.revoked) === 1)
+		return "revoked";
+	if (Number(row.expires_at) <= now)
+		return "expired";
+	return "active";
+}
+
+export function createPublishApi(deps: PublishDeps) {
+	/** 当前操作者：身份来自 token，租户与用户名来自**当前租户下**的 users 行（伪造头即查无此行） */
+	async function actor(): Promise<Actor> {
+		const snap = await currentAccess();
+		const uid = Number(http.user?.id);
+		const rows = await db.table("users")
+			.select(["username", "display_name", "tenant_id"])
+			.where({ field: "id", op: "eq", value: uid })
+			.all() as Array<Record<string, unknown>>;
+		const row = rows[0];
+		if (!row)
+			fail(403, "forbidden");
+		return {
+			uid,
+			username: String(row.username),
+			displayName: row.display_name == null ? null : String(row.display_name),
+			tenant: String(row.tenant_id ?? "default"),
+			superadmin: snap.roles.includes("superadmin"),
+		};
+	}
+
+	// ── GET /api/publish/credential —— 列表（本人；superadmin 可看全部并按租户筛）────────
+	const get = async () => {
+		await respond(async () => {
+			const me = await actor();
+			const q = (http.query ?? {}) as Record<string, unknown>;
+			const tenantFilter = me.superadmin && q.tenant ? String(q.tenant) : undefined;
+
+			// 共享表：构造器不会注入租户谓词，隔离条件必须显式写
+			const mk = () => {
+				const b = db.table("publish_credential")
+					.whereIf(tenantFilter, { field: "owner_tenant", op: "eq", value: tenantFilter });
+				if (me.superadmin)
+					return b;
+				return b.where({ field: "owner_tenant", op: "eq", value: me.tenant })
+					.where({ field: "uid", op: "eq", value: me.uid });
+			};
+
+			const r = await pagedFactory<CredentialRow>(mk, { page: q.page, size: q.limit });
+			const now = deps.now();
+			return {
+				list: r.list.map(row => ({
+					id: Number(row.id),
+					product: row.product,
+					key_id: row.key_id,
+					username: row.username,
+					display_name: row.display_name,
+					token_hint: row.token_hint,
+					status: statusOf(row, now),
+					expires_at: Number(row.expires_at),
+					used_at: row.used_at == null ? null : Number(row.used_at),
+					created_at: Number(row.created_at),
+					// 归属租户只对超管有意义
+					owner_tenant: me.superadmin ? row.owner_tenant : undefined,
+				})),
+				total: r.total,
+			};
+		});
+	};
+	get.schema = {
+		query: {
+			type: "object",
+			properties: {
+				page: { type: "number", minimum: 1 },
+				limit: { type: "number", minimum: 1, maximum: 200 },
+				tenant: { type: "string" },
+			},
+		},
+	};
+	get.response = {
+		type: "object",
+		required: ["list", "total"],
+		properties: {
+			list: {
+				type: "array",
+				items: {
+					type: "object",
+					required: ["id", "product", "key_id", "username", "token_hint", "status", "expires_at", "created_at"],
+					properties: {
+						id: { type: "number" },
+						product: { type: "string" },
+						key_id: { type: "string" },
+						username: { type: "string" },
+						display_name: { type: ["string", "null"] },
+						token_hint: { type: "string" },
+						status: { type: "string", enum: ["active", "used", "revoked", "expired"] },
+						expires_at: { type: "number" },
+						used_at: { type: ["number", "null"] },
+						created_at: { type: "number" },
+						owner_tenant: { type: "string" },
+					},
+				},
+			},
+			total: { type: "number" },
+		},
+	};
+
+	// ── POST /api/publish/credential —— 申请（填产品名 → 一次性拿到凭证 + 已定身份）─────
+	const post = async () => {
+		await respond(async () => {
+			const body = (http.body ?? {}) as Record<string, unknown>;
+			const product = assertProduct(body.product);
+			const me = await actor();
+			const keyId = assertKeyId(deriveKeyId({ product, username: me.username, uid: me.uid }));
+
+			// 撞号：同一 key_id 已被别人占用 → 拒绝。同一人重复申请是允许的
+			// （密钥长期有效，换机重建属正常操作），故只拦 uid 不同。
+			const dup = await db.table("publish_credential")
+				.select(["uid"])
+				.where({ field: "key_id", op: "eq", value: keyId })
+				.limit(1)
+				.all() as Array<Record<string, unknown>>;
+			if (dup.length > 0 && Number(dup[0].uid) !== me.uid)
+				fail(409, `发布身份 ${keyId} 已被其他用户占用，请换一个产品名`);
+
+			const token = deps.randomHex(32);
+			const now = deps.now();
+			const expiresAt = now + CREDENTIAL_TTL_SECS;
+			await db.table("publish_credential").insert({
+				token_hash: deps.sha256Hex(token),
+				token_hint: token.slice(0, 8),
+				uid: me.uid,
+				username: me.username,
+				display_name: me.displayName,
+				product,
+				key_id: keyId,
+				owner_tenant: me.tenant,
+				expires_at: expiresAt,
+				used: 0,
+				revoked: 0,
+				created_at: now,
+				created_ip: clientIp(),
+			}).run();
+
+			// 明文只在这里出现一次；库里只有 sha256
+			return { token, key_id: keyId, product, token_hint: token.slice(0, 8), expires_at: expiresAt };
+		});
+	};
+	post.schema = {
+		body: {
+			type: "object",
+			required: ["product"],
+			properties: { product: { type: "string" } },
+		},
+	};
+	post.response = {
+		type: "object",
+		required: ["token", "key_id", "product", "expires_at"],
+		properties: {
+			token: { type: "string" },
+			key_id: { type: "string" },
+			product: { type: "string" },
+			token_hint: { type: "string" },
+			expires_at: { type: "number" },
+		},
+	};
+
+	// ── POST /api/publish/credential/revoke —— 撤销（本人或超管；已兑换的不可撤销）──────
+	const revoke = async () => {
+		await respond(async () => {
+			const body = (http.body ?? {}) as Record<string, unknown>;
+			const id = Number(body.id);
+			if (!Number.isInteger(id) || id <= 0)
+				fail(400, "id 必须是正整数");
+			const me = await actor();
+
+			const rows = await db.table("publish_credential")
+				.select(["id", "uid", "owner_tenant", "used", "revoked"])
+				.where({ field: "id", op: "eq", value: id })
+				.all() as Array<Record<string, unknown>>;
+			const row = rows[0];
+			// 越权与不存在同一句话：不给探测者区分「存在但不属于你」的材料
+			if (!row || (!me.superadmin && (Number(row.uid) !== me.uid || String(row.owner_tenant) !== me.tenant)))
+				fail(404, "凭证不存在");
+
+			if (Number(row.used) === 1)
+				fail(400, "该凭证已兑换成发布身份，不能撤销（发布身份长期有效；如需停用请移除对应信任公钥）");
+			if (Number(row.revoked) === 1)
+				return { ok: true };
+
+			await db.table("publish_credential").update({ revoked: 1 }).where({ field: "id", op: "eq", value: id }).run();
+			return { ok: true };
+		});
+	};
+	revoke.schema = {
+		body: { type: "object", required: ["id"], properties: { id: { type: "number" } } },
+	};
+	revoke.response = { type: "object", required: ["ok"], properties: { ok: { type: "boolean" } } };
+
+	// ── POST /api/publish/credential/exchange —— 兑换（匿名；一次性，原子抢所有权）──────
+	const exchange = async () => {
+		await respond(async () => {
+			// 抗穷举：单 IP 每 10 分钟最多 20 次尝试
+			await rateLimit(`publish-exchange:ip:${clientIp()}`, EXCHANGE_RATE_LIMIT, EXCHANGE_RATE_WINDOW_MS);
+
+			const body = (http.body ?? {}) as Record<string, unknown>;
+			const token = String(body.token ?? "").trim();
+			// 形状先挡：64 位 hex 以外的输入连查库都不必
+			if (!/^[0-9a-f]{64}$/i.test(token))
+				fail(400, EXCHANGE_INVALID);
+
+			const hash = deps.sha256Hex(token);
+			const now = deps.now();
+			// 一条语句完成「判有效 + 抢所有权」：并发双花只可能有一个 changes=1
+			const changed = Number(await db.table("publish_credential")
+				.update({ used: 1, used_at: now })
+				.where({
+					and: [
+						{ field: "token_hash", op: "eq", value: hash },
+						{ field: "used", op: "eq", value: 0 },
+						{ field: "revoked", op: "eq", value: 0 },
+						{ field: "expires_at", op: "gt", value: now },
+					],
+				})
+				.run());
+			if (changed !== 1)
+				fail(400, EXCHANGE_INVALID);
+
+			const rows = await db.table("publish_credential")
+				.select(["key_id", "product", "username", "display_name"])
+				.where({ field: "token_hash", op: "eq", value: hash })
+				.all() as Array<Record<string, unknown>>;
+			const row = rows[0];
+			if (!row)
+				fail(400, EXCHANGE_INVALID);
+			return {
+				key_id: String(row.key_id),
+				product: String(row.product),
+				username: String(row.username),
+				display_name: row.display_name == null ? null : String(row.display_name),
+			};
+		});
+	};
+	exchange.schema = {
+		body: { type: "object", required: ["token"], properties: { token: { type: "string" } } },
+	};
+	exchange.response = {
+		type: "object",
+		required: ["key_id", "product", "username"],
+		properties: {
+			key_id: { type: "string" },
+			product: { type: "string" },
+			username: { type: "string" },
+			display_name: { type: ["string", "null"] },
+		},
+	};
+
+	return {
+		credential: { get, post, revoke: { post: revoke }, exchange: { post: exchange } },
+	};
+}
+
+export default createPublishApi(runtimePublishDeps());

package/templates/src/app/api/publish/manifest.yaml

@@ -0,0 +1,8 @@
+name: publish
+desc: 发布凭证与发布身份（业务路由）：申请 / 列表 / 撤销 / 一次性兑换。凭证兑换即作废，Ed25519 密钥长期有效；身份只由服务端推导，CLI 不重复实现编码规则。
+version: 0.1.0
+tables:
+  # 共享表（B 组）：兑换发生在 CLI，无业务租户语义；租户归属走 owner_tenant 列
+  - publish_credential
+deps: # 判权（currentAccess）、统一信封（respond）、分页与限速都来自平台内核
+  _platform: ^0.1.0

package/templates/src/app/api/publish/migrations/0001__publish_credential.mysql.sql

@@ -0,0 +1,23 @@
+-- 0001__publish_credential（mysql 方言）：列语义同 0001__publish_credential.sql 头注释。
+-- 差异（沿用 _platform 基线的既有惯例）：键列/短文本收窄为 VARCHAR；秒级 epoch 取 BIGINT；
+-- 索引写在 CREATE TABLE 内（mysql 无 CREATE INDEX IF NOT EXISTS）。
+CREATE TABLE IF NOT EXISTS publish_credential (
+  id BIGINT AUTO_INCREMENT PRIMARY KEY,
+  token_hash VARCHAR(255) NOT NULL,
+  token_hint VARCHAR(64) NOT NULL,
+  uid BIGINT NOT NULL,
+  username VARCHAR(255) NOT NULL,
+  display_name TEXT,
+  product VARCHAR(255) NOT NULL,
+  key_id VARCHAR(255) NOT NULL,
+  owner_tenant VARCHAR(255) NOT NULL,
+  expires_at BIGINT NOT NULL,
+  used BIGINT NOT NULL DEFAULT 0,
+  used_at BIGINT,
+  revoked BIGINT NOT NULL DEFAULT 0,
+  created_at BIGINT NOT NULL,
+  created_ip VARCHAR(64),
+  UNIQUE KEY uk_publish_credential_token (token_hash),
+  KEY idx_publish_credential_owner (owner_tenant, uid, created_at),
+  KEY idx_publish_credential_key (key_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

package/templates/src/app/api/publish/migrations/0001__publish_credential.pg.sql

@@ -0,0 +1,23 @@
+-- 0001__publish_credential（postgres 方言）：列语义同 0001__publish_credential.sql 头注释。
+-- 差异（沿用 _platform 基线的既有惯例）：TEXT 全保留，秒级 epoch 取 BIGINT。
+CREATE TABLE IF NOT EXISTS publish_credential (
+  id BIGSERIAL PRIMARY KEY,
+  token_hash TEXT NOT NULL,
+  token_hint TEXT NOT NULL,
+  uid BIGINT NOT NULL,
+  username TEXT NOT NULL,
+  display_name TEXT,
+  product TEXT NOT NULL,
+  key_id TEXT NOT NULL,
+  owner_tenant TEXT NOT NULL,
+  expires_at BIGINT NOT NULL,
+  used INTEGER NOT NULL DEFAULT 0,
+  used_at BIGINT,
+  revoked INTEGER NOT NULL DEFAULT 0,
+  created_at BIGINT NOT NULL,
+  created_ip TEXT
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uk_publish_credential_token ON publish_credential (token_hash);
+CREATE INDEX IF NOT EXISTS idx_publish_credential_owner
+  ON publish_credential (owner_tenant, uid, created_at);
+CREATE INDEX IF NOT EXISTS idx_publish_credential_key ON publish_credential (key_id);

package/templates/src/app/api/publish/migrations/0001__publish_credential.sql

@@ -0,0 +1,39 @@
+-- 0001__publish_credential（sqlite 方言）：发布凭证表。
+--
+-- 定性：**共享表**（schema.yaml `tenant: false` + config.yaml `tenant.shared_allow` 双声明）。
+-- 理由：兑换是 CLI 发起的，那一刻没有业务租户上下文；建成租户表会让 sql_guard: deny 给
+-- 按 token_hash 的查询强加 tenant_id 过滤，换个租户头就查不到。租户归属由 owner_tenant
+-- 显式承载（命名同 wecom_login_ticket：共享表出现 tenant_id 会被定性红线判为自相矛盾）。
+--
+-- 语义：
+--   · 一次性兑换令牌：兑换成功后 used=1，再兑即拒；未兑换前可用 revoked 手动作废
+--   · key_id 在**申请时**就算好落库，兑换只回读——CLI 不实现任何编码规则（单一真源）
+--   · 只存 token_hash（sha256），明文只在申请响应里出现一次
+--
+-- 主键用自增 id 而非 token_hash：列表分页与撤销都按行 id 操作（pagedFactory 也按 id 排序），
+-- 用 hash 做主键会让这两件事都得先算 hash 再反查。token_hash 仍唯一。
+CREATE TABLE IF NOT EXISTS publish_credential (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  token_hash TEXT NOT NULL,
+  token_hint TEXT NOT NULL,
+  uid INTEGER NOT NULL,
+  username TEXT NOT NULL,
+  display_name TEXT,
+  product TEXT NOT NULL,
+  key_id TEXT NOT NULL,
+  owner_tenant TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  used INTEGER NOT NULL DEFAULT 0,
+  used_at INTEGER,
+  revoked INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL,
+  created_ip TEXT
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uk_publish_credential_token ON publish_credential (token_hash);
+
+-- 「发布管理」页的主查询：按租户 + 本人 + 时间倒序
+CREATE INDEX IF NOT EXISTS idx_publish_credential_owner
+  ON publish_credential (owner_tenant, uid, created_at);
+
+-- 撞号检查（同 key_id 是否已属于别人）
+CREATE INDEX IF NOT EXISTS idx_publish_credential_key ON publish_credential (key_id);

package/templates/src/app/api/publish/schema.yaml

@@ -0,0 +1,33 @@
+# 声明式表结构（S006 纪律：结构真源是 migrations/0001__publish_credential*，本文件只负责
+# 「列集/主键/租户定性」的运行时元数据，与迁移逐列对齐；templates-migration-schema-parity 双双守着）。
+#
+# 定性（三处一致：这里 / config.yaml `tenant.shared_allow` / 迁移文件头注释）：
+# **共享表**（tenant: false）。凭证在 CLI 兑换那一跳被执行，此刻没有业务租户语义——
+# 若建成租户表，sql_guard: deny 会给按 token_hash 的查询强加 tenant_id 过滤，换个租户头即查不到。
+# 租户归属由 `owner_tenant` 列显式承载（语义同 wecom_login_ticket：共享表出现 tenant_id
+# 会被定性红线判为自相矛盾）。
+tables:
+  publish_credential:
+    tenant: false
+    pk: id
+    columns:
+      id: {type: integer, null: false, autoincrement: true}
+      # 只存 sha256(明文)：明文只在申请响应里出现一次
+      token_hash: {type: text, null: false}
+      # 明文前 8 位，仅供「发布管理」页识别是哪一张，不参与任何校验
+      token_hint: {type: text, null: false}
+      uid: {type: integer, null: false}
+      # 申请时快照：改名不影响已签发的凭证与已推导的 key_id
+      username: {type: text, null: false}
+      display_name: {type: text}
+      # 申请时填写的产品名（NAME_RE 校验，落库即定）
+      product: {type: text, null: false}
+      # 服务端推导并落库的发布身份；兑换时原样下发，CLI 零推导
+      key_id: {type: text, null: false}
+      owner_tenant: {type: text, null: false}
+      expires_at: {type: integer, null: false}
+      used: {type: integer, null: false}
+      used_at: {type: integer}
+      revoked: {type: integer, null: false}
+      created_at: {type: integer, null: false}
+      created_ip: {type: text}

package/templates/src/app/api/system/login-methods/api.ts

@@ -10,9 +10,10 @@ async function get() {
 }
 get.response = {
 	type: "object",
-	required: ["methods"],
+	required: ["methods", "site_title"],
 	properties: {
 		methods: { type: "array", items: { type: "string" } },
+		site_title: { type: "string" },
 	},
 };
 

package/templates/src/app/web/_platform/__client/api.schemas.ts

@@ -124,6 +124,21 @@ export const schemas = {
 		data: z.array(z.object({
 
 }).catchall(z.unknown())),
+	},
+	"platformMarketReleasesGet": {
+		query: z.object({
+	"page": z.number().min(1).optional(),
+	"limit": z.number().min(1).max(200).optional()
+}),
+		data: z.object({
+	"list": z.array(z.object({
+
+}).catchall(z.unknown())),
+	"total": z.number(),
+	"page": z.number(),
+	"size": z.number(),
+	"syncError": z.string().nullable().optional()
+}),
 	},
 	"platformOrgDepartmentsGet": {
 		query: z.object({

package/templates/src/app/web/_platform/__client/index.ts

@@ -36,7 +36,7 @@ export function create_platformClient(ctx: ModuleContext) {
 	}
 	ctx.register.apiPrefix(API_PREFIX);
 	bindRequest(ctx.utils.request);
-	return { platformContactsGet, platformContactsDetailGet, platformMarketInstallPost, platformMarketInstallCancelPost, platformMarketTaskGet, platformMarketEnablePost, platformMarketMetaGet, platformMarketTrustGet, platformMarketTrustPost, platformMarketTrustKeyPost, platformMarketTrustKeyDelete, platformMarketIndexGet, platformMarketUninstallImpactGet, platformMarketUninstallPost, platformMarketHistoryGet, platformOrgDepartmentsGet, platformOrgIsMemberGet, platformOrgMembersGet, platformOrgPickerGet, platformOrgResolvePost, platformOrgTreeGet, platformOrgUserGet, platformSolutionsRoutesGet, platformSolutionsVerifyPost, platformSolutionsVerifyLastGet };
+	return { platformContactsGet, platformContactsDetailGet, platformMarketInstallPost, platformMarketInstallCancelPost, platformMarketTaskGet, platformMarketEnablePost, platformMarketMetaGet, platformMarketTrustGet, platformMarketTrustPost, platformMarketTrustKeyPost, platformMarketTrustKeyDelete, platformMarketIndexGet, platformMarketUninstallImpactGet, platformMarketUninstallPost, platformMarketHistoryGet, platformMarketReleasesGet, platformOrgDepartmentsGet, platformOrgIsMemberGet, platformOrgMembersGet, platformOrgPickerGet, platformOrgResolvePost, platformOrgTreeGet, platformOrgUserGet, platformSolutionsRoutesGet, platformSolutionsVerifyPost, platformSolutionsVerifyLastGet };
 }
 
 /**
@@ -423,6 +423,30 @@ export async function platformMarketHistoryGet(): Promise<PlatformMarketHistoryG
 	}
 }
 
+export type PlatformMarketReleasesGetQuery = z.input<(typeof schemas)["platformMarketReleasesGet"]["query"]>;
+export type PlatformMarketReleasesGetData = z.infer<(typeof schemas)["platformMarketReleasesGet"]["data"]>;
+
+export async function platformMarketReleasesGet(query: PlatformMarketReleasesGetQuery): Promise<PlatformMarketReleasesGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`_platform/market/releases`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<PlatformMarketReleasesGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as PlatformMarketReleasesGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["platformMarketReleasesGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] platformMarketReleasesGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
 export type PlatformOrgDepartmentsGetQuery = z.input<(typeof schemas)["platformOrgDepartmentsGet"]["query"]>;
 export type PlatformOrgDepartmentsGetData = z.infer<(typeof schemas)["platformOrgDepartmentsGet"]["data"]>;
 

package/templates/src/app/web/entry.ts

@@ -8,13 +8,16 @@ import { onInit as personalCenterOnInit, routes as personalCenterRoutes } from "
 import { onInit as systemOnInit, routes as systemRoutes } from "./system/routes";
 
 /**
- * 应用模块（多根聚合）：一个 entry 承载六个业务根，各根独立成一级菜单。
+ * 应用模块（多根聚合）：一个 entry 承载五个业务根，各根独立成一级菜单。
  *
- * 为什么聚合：这六个根（首页/登录/个人中心/通知/系统管理）是脚手架的框架内置页面，
- * 同版本发布、同生命周期、缺一不可，拆成六个模块只会把工程目录、web.config 登记、
- * modules.json 与首屏模块入口请求都放大六倍。聚合后仍是「一目录一模块」，但模块内
+ * 为什么聚合：这五个根（首页/登录/个人中心/通知/系统管理）是脚手架的框架内置页面，
+ * 同版本发布、同生命周期、缺一不可，拆成五个模块只会把工程目录、web.config 登记、
+ * modules.json 与首屏模块入口请求都放大五倍。聚合后仍是「一目录一模块」，但模块内
  * 按根分目录（`<root>/routes.ts` + `pages/` + `__client/`），页面相对导入不变。
  *
+ * 发布管理不在这里：它属于方案市场，随 `src/oj-market/web/publish` 走市场模块
+ * （`/publish` 仍是独立一级菜单，URL 与菜单 key 不变）。
+ *
  * 结构约定（多根模块）：
  *   - 顶层路由首段去重 > 1 → runtime 判为多根（`isMultiRoot`），各根按 entry 里的
  *     **绝对路径**原样注册，不被 `routePrefix` 改写——URL 与菜单 key 都不变；
@@ -24,7 +27,8 @@ import { onInit as systemOnInit, routes as systemRoutes } from "./system/routes"
  *
  * i18n 用 `i18nNamespaces` 沿用各根**原命名空间**（home / login / personal-center /
  * notification / system），因此 `t("system:menu.users")`、`useTranslation("system")`
- * 与菜单标题 `<ns>:menu.<key>` 全部零改动。
+ * 与菜单标题 `<ns>:menu.<key>` 全部零改动。发布管理的 `publish` 命名空间随页面
+ * 在 oj-market 侧登记。
  */
 const i18nNamespaces: Record<string, ModuleI18n> = {
 	"home": {

package/templates/src/app/web/home/routes.ts

@@ -35,6 +35,11 @@ export const routes: AppRouteRecordRaw[] = [
 				handle: {
 					title: "home:menu.home",
 					icon: createElement(HomeOutlined),
+					// 首页是 /home 根的 index 子路由，运行时匹配到的叶子路由 id 为 `/home/`（带尾斜杠），
+					// 而菜单项 key 是父级 `/home`，selectedKeys 取叶子 id 导致高亮对不上——
+					// 复刻 react-antd-admin 时「首页」菜单项不亮。用 currentActiveMenu 显式声明高亮 /home
+					// （框架既定机制：页面指定高亮哪个菜单），对齐 playground / react-antd-admin 的选中态。
+					currentActiveMenu: "/home",
 				},
 			},
 		],

package/templates/src/app/web/login/locales/en-US.json

@@ -30,9 +30,15 @@
 		"sso.action": "Sign in with SSO",
 		"wecom": "WeCom",
 		"wecom.action": "Sign in with WeCom",
+		"wecomPending": "WeCom login will be available in a later stage",
 		"wecom.hint": "Enter the enterprise code (corp_id, visible in the WeCom console), or use the dedicated sign-in link from your admin",
 		"wecom.agent": "App ID (agentid)",
 		"wecom.agentHint": "Leave empty if the corp has a single app; otherwise use the agentid provided by your admin",
-		"wecom.exchanging": "Completing WeCom sign-in…"
+		"wecom.exchanging": "Completing WeCom sign-in…",
+		"wecom.scan.hint": "Open the WeCom app, scan with 「Scan」 and confirm — no username or password needed",
+		"wecom.scan.action": "One-tap sign in with WeCom",
+		"wecom.otherCorp": "Another enterprise? Sign in with an enterprise code",
+		"wecom.otherCorpHide": "Hide enterprise code"
+
 	}
 }

package/templates/src/app/web/login/locales/zh-CN.json

@@ -30,9 +30,15 @@
 		"sso.action": "使用 SSO 登录",
 		"wecom": "企业微信",
 		"wecom.action": "使用企业微信登录",
+		"wecomPending": "企业微信登录将在后续阶段提供",
 		"wecom.hint": "填写企业代码（企微后台可见的 corp_id），或直接使用管理员收到的专属登录链接",
 		"wecom.agent": "应用 ID（agentid）",
 		"wecom.agentHint": "留空使用该企业下唯一应用；多应用部署请填管理员提供的 agentid",
-		"wecom.exchanging": "正在完成企业微信登录…"
+		"wecom.exchanging": "正在完成企业微信登录…",
+		"wecom.scan.hint": "打开企业微信 App，用「扫一扫」扫码确认后自动进入，无需输入账号密码",
+		"wecom.scan.action": "使用企业微信一键登录",
+		"wecom.otherCorp": "其他企业？使用企业代码登录",
+		"wecom.otherCorpHide": "收起企业代码"
+
 	}
 }