@oj-module/cli 0.2.66 → 0.2.68

package/templates/src/app/api/home/seed.pg.sql

@@ -0,0 +1,71 @@
+-- 方言覆盖（postgres）：INSERT OR IGNORE → ON CONFLICT DO NOTHING，语句与基础件逐条对应。
+-- home 模块种子（P4-1）。按分号朴素切分（S006）。
+-- home_pie：五分类（code 对齐前端 DATA_KEY），幂等 INSERT OR IGNORE。
+INSERT INTO home_pie (category, value) VALUES ('electronics', 320) ON CONFLICT DO NOTHING;
+INSERT INTO home_pie (category, value) VALUES ('home_goods', 210) ON CONFLICT DO NOTHING;
+INSERT INTO home_pie (category, value) VALUES ('apparel_accessories', 180) ON CONFLICT DO NOTHING;
+INSERT INTO home_pie (category, value) VALUES ('food_beverages', 150) ON CONFLICT DO NOTHING;
+INSERT INTO home_pie (category, value) VALUES ('beauty_skincare', 95) ON CONFLICT DO NOTHING;
+
+-- home_line：日窗口序列（day = epoch-day，种子围绕"当前日期"生成，约 60 天窗口）。
+-- 刻意缺 today-30 / today-12 两天，演示"缺哪天补哪天"——handler 在窗口内对缺失日补 0；
+-- 若整个窗口无 seed（seed 随时间变旧），handler 回落确定式趋势兜底（懒补数）。
+INSERT INTO home_line (day, value) VALUES (20640, 181) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20641, 190) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20642, 199) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20643, 208) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20644, 217) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20645, 226) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20646, 235) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20647, 244) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20648, 253) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20649, 262) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20650, 271) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20651, 280) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20652, 289) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20653, 298) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20654, 100) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20655, 109) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20656, 118) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20657, 127) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20658, 136) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20659, 145) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20660, 154) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20661, 163) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20662, 172) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20663, 181) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20664, 190) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20665, 199) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20666, 208) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20667, 217) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20668, 226) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20669, 235) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20671, 253) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20672, 262) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20673, 271) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20674, 280) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20675, 289) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20676, 298) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20677, 100) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20678, 109) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20679, 118) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20680, 127) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20681, 136) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20682, 145) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20683, 154) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20684, 163) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20685, 172) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20686, 181) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20687, 190) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20689, 208) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20690, 217) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20691, 226) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20692, 235) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20693, 244) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20694, 253) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20695, 262) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20696, 271) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20697, 280) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20698, 289) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20699, 298) ON CONFLICT DO NOTHING;
+INSERT INTO home_line (day, value) VALUES (20700, 100) ON CONFLICT DO NOTHING;

package/templates/src/app/api/notification/_shared/notify.ts

@@ -69,11 +69,9 @@ function splitId(id: string): [scope: "u" | "b", raw: string] {
 function mapItem(r: Row): NoticeItem {
 	const scope = String(r.scope);
 	const isBroadcast = scope === "broadcast";
-	// UNION 结果列名取首分支（userQ）=> 位置 4 名为 is_read。按人项此处即存储整数列；
-	// 广播项此处实际承载回执 read_time（非空即已读，与原始 SQL 的 (read_time IS NOT NULL AND <> '') 等价）。
-	const isRead = isBroadcast
-		? (r.is_read != null && String(r.is_read) !== "")
-		: Number(r.is_read) === 1;
+	// UNION 结果列名取首分支（userQ）=> 位置 4 名为 is_read，两分支都输出整数 0/1
+	// （按人项取存储列，广播项由回执 EXISTS 推导），故统一按整数判已读。
+	const isRead = Number(r.is_read) === 1;
 	return {
 		id: (isBroadcast ? "b:" : "u:") + String(r.id),
 		scope: isBroadcast ? "broadcast" : "user",
@@ -172,7 +170,9 @@ export async function noticesFor(
 		"b.id",
 		"b.avatar",
 		"b.date",
-		"r.read_time",
+		// 第 4 列与首分支 is_read 同型（整数）：pg 的 UNION 不允许 integer/text 混排，
+		// sqlite/mysql 会隐式放宽；回执存在即已读 → 0/1，mapItem 统一按 Number(...) === 1 判定。
+		{ case: { when: [{ cond: { field: "r.read_time", op: "isnull" }, then: 0 }], else: 1 }, as: "is_read" },
 		"b.message",
 		"b.title",
 		"b.link",

package/templates/src/app/api/notification/migrations/0001__create_notifications.mysql.sql

@@ -0,0 +1,11 @@
+-- 0001（mysql 方言）：通知表建表。口径同基础件。
+-- 方言差异：AUTOINCREMENT → BIGINT AUTO_INCREMENT；TEXT 不能带字面默认值 → 短文本收窄 VARCHAR，长文本用括号默认值。
+CREATE TABLE IF NOT EXISTS notifications (
+  id BIGINT AUTO_INCREMENT PRIMARY KEY,
+  avatar VARCHAR(255) NOT NULL DEFAULT '',
+  `date` VARCHAR(64) NOT NULL DEFAULT '',
+  is_read INTEGER NOT NULL DEFAULT 0,
+  message TEXT NOT NULL DEFAULT (''),
+  title VARCHAR(255) NOT NULL DEFAULT ''
+);
+

package/templates/src/app/api/notification/migrations/0001__create_notifications.pg.sql

@@ -0,0 +1,11 @@
+-- 0001（postgres 方言）：通知表建表。口径同基础件。
+-- 方言差异：AUTOINCREMENT → BIGSERIAL（SERIAL 系允许 seed 显式写 id）；TEXT 在 pg 合法且可带默认值。
+CREATE TABLE IF NOT EXISTS notifications (
+  id BIGSERIAL PRIMARY KEY,
+  avatar TEXT NOT NULL DEFAULT '',
+  date TEXT NOT NULL DEFAULT '',
+  is_read INTEGER NOT NULL DEFAULT 0,
+  message TEXT NOT NULL DEFAULT '',
+  title TEXT NOT NULL DEFAULT ''
+);
+

package/templates/src/app/api/notification/migrations/0002__notifications_user.mysql.sql

@@ -0,0 +1,8 @@
+-- 0002（mysql 方言）：按人真实通知表演进。
+-- 方言差异：TEXT 不能带字面默认值 → category 收窄 VARCHAR(255)；MySQL 不支持 CREATE INDEX IF NOT EXISTS，直接建索引。
+ALTER TABLE notifications ADD COLUMN user_id INTEGER;
+ALTER TABLE notifications ADD COLUMN link TEXT;
+ALTER TABLE notifications ADD COLUMN category VARCHAR(255) NOT NULL DEFAULT 'notice';
+CREATE INDEX idx_notifications_user ON notifications (user_id, is_read);
+UPDATE notifications SET user_id = 1, category = 'notice' WHERE user_id IS NULL;
+

package/templates/src/app/api/notification/migrations/0003__notifications_broadcast.mysql.sql

@@ -0,0 +1,21 @@
+-- 0003（mysql 方言）：广播表 + 已读回执表。口径同基础件。
+-- 方言差异：AUTOINCREMENT → BIGINT AUTO_INCREMENT；CREATE INDEX IF NOT EXISTS 不被 MySQL 支持，索引写进建表语句。
+CREATE TABLE IF NOT EXISTS notifications_broadcast (
+  id BIGINT AUTO_INCREMENT PRIMARY KEY,
+  avatar VARCHAR(255) NOT NULL DEFAULT '',
+  `date` VARCHAR(64) NOT NULL DEFAULT '',
+  message TEXT NOT NULL DEFAULT (''),
+  title VARCHAR(255) NOT NULL DEFAULT '',
+  link TEXT,
+  category VARCHAR(255) NOT NULL DEFAULT 'notice',
+  create_time VARCHAR(64) NOT NULL DEFAULT ''
+);
+
+CREATE TABLE IF NOT EXISTS notifications_broadcast_read (
+  id BIGINT AUTO_INCREMENT PRIMARY KEY,
+  broadcast_id BIGINT NOT NULL,
+  user_id BIGINT NOT NULL,
+  read_time VARCHAR(64) NOT NULL DEFAULT '',
+  KEY idx_broadcast_read (user_id, broadcast_id)
+);
+

package/templates/src/app/api/notification/migrations/0003__notifications_broadcast.pg.sql

@@ -0,0 +1,22 @@
+-- 0003（postgres 方言）：广播表 + 已读回执表。口径同基础件。
+-- 方言差异：AUTOINCREMENT → BIGSERIAL（SERIAL 系允许 seed 显式写 id）；其余 DDL 与基础件同语法。
+CREATE TABLE IF NOT EXISTS notifications_broadcast (
+  id BIGSERIAL PRIMARY KEY,
+  avatar TEXT NOT NULL DEFAULT '',
+  date TEXT NOT NULL DEFAULT '',
+  message TEXT NOT NULL DEFAULT '',
+  title TEXT NOT NULL DEFAULT '',
+  link TEXT,
+  category TEXT NOT NULL DEFAULT 'notice',
+  create_time TEXT NOT NULL DEFAULT ''
+);
+
+CREATE TABLE IF NOT EXISTS notifications_broadcast_read (
+  id BIGSERIAL PRIMARY KEY,
+  broadcast_id BIGINT NOT NULL,
+  user_id BIGINT NOT NULL,
+  read_time TEXT NOT NULL DEFAULT ''
+);
+
+CREATE INDEX IF NOT EXISTS idx_broadcast_read ON notifications_broadcast_read (user_id, broadcast_id);
+

package/templates/src/app/api/notification/migrations/0004__notifications_broadcast_hidden.mysql.sql

@@ -0,0 +1,10 @@
+-- 0004（mysql 方言）：广播隐藏标记表。口径同基础件。
+-- 方言差异：AUTOINCREMENT → BIGINT AUTO_INCREMENT；CREATE INDEX IF NOT EXISTS 不被 MySQL 支持，索引写进建表语句。
+CREATE TABLE IF NOT EXISTS notifications_broadcast_hidden (
+  id BIGINT AUTO_INCREMENT PRIMARY KEY,
+  broadcast_id BIGINT NOT NULL,
+  user_id BIGINT NOT NULL,
+  create_time VARCHAR(64) NOT NULL DEFAULT '',
+  KEY idx_broadcast_hidden (user_id, broadcast_id)
+);
+

package/templates/src/app/api/notification/migrations/0004__notifications_broadcast_hidden.pg.sql

@@ -0,0 +1,11 @@
+-- 0004（postgres 方言）：广播隐藏标记表。口径同基础件。
+-- 方言差异：AUTOINCREMENT → BIGSERIAL（SERIAL 系允许 seed 显式写 id）；其余 DDL 与基础件同语法。
+CREATE TABLE IF NOT EXISTS notifications_broadcast_hidden (
+  id BIGSERIAL PRIMARY KEY,
+  broadcast_id BIGINT NOT NULL,
+  user_id BIGINT NOT NULL,
+  create_time TEXT NOT NULL DEFAULT ''
+);
+
+CREATE INDEX IF NOT EXISTS idx_broadcast_hidden ON notifications_broadcast_hidden (user_id, broadcast_id);
+

package/templates/src/app/api/notification/migrations/0005__tenant.pg.sql

@@ -0,0 +1,6 @@
+-- 0005__tenant（postgres 方言）：通知四表租户化。TEXT 在 pg 合法，与基础件同语法。
+ALTER TABLE notifications ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default';
+ALTER TABLE notifications_broadcast ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default';
+ALTER TABLE notifications_broadcast_read ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default';
+ALTER TABLE notifications_broadcast_hidden ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default';
+

package/templates/src/app/api/notification/seed.mysql.sql

@@ -0,0 +1,8 @@
+-- 方言覆盖（mysql）：INSERT OR IGNORE → INSERT IGNORE，语句与基础件逐条对应。
+-- notification 模块种子（按人真实通知）。user_id=1（admin），link/category 幂等可空/默认。
+-- avatar 给真实 URL：铃铛按 avatar 渲染头像，空串会破图（空串仅作为运行时兜底，不作为种子值）。
+-- 按分号朴素切分（S006）：语句内不得含分号字面量。
+INSERT IGNORE INTO notifications (id, user_id, avatar, date, is_read, message, title, link, category) VALUES (1, 1, 'https://avatar.vercel.sh/seed-welcome.svg?text=W', '2026-09-01 09:12', 0, '脚手架已就绪，用 admin / aA123456 登录开始', '欢迎', NULL, 'notice');
+INSERT IGNORE INTO notifications (id, user_id, avatar, date, is_read, message, title, link, category) VALUES (2, 1, 'https://avatar.vercel.sh/seed-bell.svg?text=B', '2026-09-02 14:30', 0, '通知铃支持单条已读、全部已读与清空；广播经 push-broadcast 入 b: 命名空间', '通知铃', NULL, 'notice');
+INSERT IGNORE INTO notifications (id, user_id, avatar, date, is_read, message, title, link, category) VALUES (3, 1, 'https://avatar.vercel.sh/seed-contract.svg?text=C', '2026-09-03 18:45', 1, '契约改动后重跑 ojm api 生成前端 client 与文档', '契约', NULL, 'notice');
+INSERT IGNORE INTO notifications (id, user_id, avatar, date, is_read, message, title, link, category) VALUES (4, 1, 'https://avatar.vercel.sh/seed-dev.svg?text=D', '2026-09-04 08:00', 0, '编辑 api/src 下的 api.ts 保存即热更；handler 组支持四层嵌套（oj v0.1.64）', '开发提示', NULL, 'notice');

package/templates/src/app/api/notification/seed.pg.sql

@@ -0,0 +1,11 @@
+-- 方言覆盖（postgres）：INSERT OR IGNORE → ON CONFLICT DO NOTHING，语句与基础件逐条对应。
+-- notification 模块种子（按人真实通知）。user_id=1（admin），link/category 幂等可空/默认。
+-- avatar 给真实 URL：铃铛按 avatar 渲染头像，空串会破图（空串仅作为运行时兜底，不作为种子值）。
+-- 按分号朴素切分（S006）：语句内不得含分号字面量。
+INSERT INTO notifications (id, user_id, avatar, date, is_read, message, title, link, category) VALUES (1, 1, 'https://avatar.vercel.sh/seed-welcome.svg?text=W', '2026-09-01 09:12', 0, '脚手架已就绪，用 admin / aA123456 登录开始', '欢迎', NULL, 'notice') ON CONFLICT DO NOTHING;
+INSERT INTO notifications (id, user_id, avatar, date, is_read, message, title, link, category) VALUES (2, 1, 'https://avatar.vercel.sh/seed-bell.svg?text=B', '2026-09-02 14:30', 0, '通知铃支持单条已读、全部已读与清空；广播经 push-broadcast 入 b: 命名空间', '通知铃', NULL, 'notice') ON CONFLICT DO NOTHING;
+INSERT INTO notifications (id, user_id, avatar, date, is_read, message, title, link, category) VALUES (3, 1, 'https://avatar.vercel.sh/seed-contract.svg?text=C', '2026-09-03 18:45', 1, '契约改动后重跑 ojm api 生成前端 client 与文档', '契约', NULL, 'notice') ON CONFLICT DO NOTHING;
+INSERT INTO notifications (id, user_id, avatar, date, is_read, message, title, link, category) VALUES (4, 1, 'https://avatar.vercel.sh/seed-dev.svg?text=D', '2026-09-04 08:00', 0, '编辑 api/src 下的 api.ts 保存即热更；handler 组支持四层嵌套（oj v0.1.64）', '开发提示', NULL, 'notice') ON CONFLICT DO NOTHING;
+
+-- 显式写 id 不会推进 BIGSERIAL 序列，补一次 setval 免新增行撞主键（幂等，每次启动按当前最大 id 校正）。
+SELECT setval(pg_get_serial_sequence('notifications', 'id'), GREATEST((SELECT MAX(id) FROM notifications), 1));

package/templates/src/app/api/publish/_shared/identity.ts

@@ -0,0 +1,69 @@
+// 发布身份的推导规则 —— **唯一真源**。
+//
+// 为什么只在服务端算：`key_id` 直接决定 `~/.ojm/keys/<id>/` 的目录名与签名身份，
+// 同一规则若在 `packages/cli` 与模板工程（互不可 import 的两棵树）各写一份，必然漂移，
+// 表现为「CLI 建了 demo-solution.wecom-everpan，服务端记录成 demo-solution.wecom-everpan-x」。
+// 故 key_id 在**申请时**由本文件算好落库，兑换接口原样下发，CLI 零推导。
+//
+// 规则与约束：
+//   · 产品名 = 解决方案名，遵循 NAME_RE（小写字母开头，仅 [a-z0-9-]，≤64）
+//   · 人名段 = username 归一化：小写 → 非 [a-z0-9-] 一律替换为 '-' → 折叠连续 '-' → 去首尾 '-'
+//     （`wecom:everpan` → `wecom-everpan`，目录名不出现冒号；比对也无需回到裸人名）
+//   · key_id = `<product>.<person>`，必须满足 C2-37 的 key_id 形状
+//   · 归一化后为空（例如纯中文用户名）→ 退化为 `u<uid>`，保证仍满足 key_id 形状
+
+/** C2-37 key_id 形状：小写、≥2 段、仅 [a-z0-9-]（与 packages/cli/src/keygen.ts 的 isValidKeyId 同规则） */
+export const KEY_ID_RE = /^[a-z][a-z0-9-]*(?:\.[a-z0-9-]+)+$/;
+
+/** 解决方案名规则（与 packages/cli/src/manifest-contract.ts 的 NAME_RE 同规则） */
+export const PRODUCT_RE = /^[a-z][a-z0-9-]{0,63}$/;
+
+/**
+ * 保留名：产品名占用它们会让人误以为是框架/平台自身发布的包。
+ * 与 manifest-contract 的 RESERVED_NAMES 取交集（`_platform` / `_system` 等带下划线的
+ * 本就过不了 PRODUCT_RE，不必重复列）。
+ */
+export const RESERVED_PRODUCTS = new Set(["oj", "ojm", "system", "auth", "market", "framework", "health", "plugins", "registry"]);
+
+/** 凭证有效期：7 天（一次性令牌的暴露窗口） */
+export const CREDENTIAL_TTL_SECS = 7 * 24 * 3600;
+
+export interface IdentityInput {
+	product: string
+	username: string
+	uid: number
+}
+
+/** username → key_id 的人名段 */
+export function encodePerson(username: string, uid: number): string {
+	const normalized = username
+		.toLowerCase()
+		.replace(/[^a-z0-9-]/g, "-")
+		.replace(/-+/g, "-")
+		.replace(/^-|-$/g, "");
+	return normalized === "" ? `u${uid}` : normalized;
+}
+
+/** 产品名 + 用户名 → key_id（不做校验，调用方先用 assertProduct 收口） */
+export function deriveKeyId(input: IdentityInput): string {
+	return `${input.product}.${encodePerson(input.username, input.uid)}`;
+}
+
+/** 产品名校验：形状 + 保留名。错误信息给可用示例，避免用户反复试错 */
+export function assertProduct(value: unknown): string {
+	const product = typeof value === "string" ? value.trim() : "";
+	if (product === "")
+		throw Object.assign(new Error("产品名不能为空：填你要发布的解决方案名，例如 demo-solution"), { status: 400 });
+	if (!PRODUCT_RE.test(product))
+		throw Object.assign(new Error("产品名只能是小写字母开头的 [a-z0-9-]，最长 64 个字符，例如 demo-solution"), { status: 400 });
+	if (RESERVED_PRODUCTS.has(product))
+		throw Object.assign(new Error(`产品名 ${product} 是框架保留名，请换成你的解决方案名`), { status: 400 });
+	return product;
+}
+
+/** 派生结果自检：理论上必然成立，不成立说明归一化有 bug，宁可 500 也不发一个畸形身份 */
+export function assertKeyId(keyId: string): string {
+	if (!KEY_ID_RE.test(keyId))
+		throw new Error(`内部错误：推导出的发布身份 ${keyId} 不符合 key_id 规则，请联系管理员`);
+	return keyId;
+}

package/templates/src/app/api/publish/api.ts

@@ -0,0 +1,349 @@
+// 发布凭证端点族：/api/publish/credential/*
+//
+// 职责边界（ISP）：本文件只做「门禁 + 入参收口 + 一次原子读写」；
+// 身份推导在 _shared/identity.ts（纯函数，无 IO），凭证换身份 = 一条条件 UPDATE 抢所有权。
+//
+// 三个门径的差别是刻意的：
+//   · 申请 / 列表 / 撤销：登录态（currentAccess 已含「伪造租户头即查无此人」的拦截）
+//   · 兑换：**匿名**。凭证自身就是持有型证明——CLI 可能没有账号密码，
+//     这是它唯一需要的能力。抗穷举靠 256 位随机 + IP 维度限速，不靠登录态。
+//
+// 为什么是工厂（createPublishApi）而不是裸 handler：随机数与时钟必须可注入，
+// 否则「过期」这类用例只能靠 sleep，「并发双花」也无法稳定构造。
+// 与 market/api.ts 的 createMarketApi(marketEnv()) 同一形态。
+import { respond } from "#/_platform/_shared/respond";
+import { currentAccess } from "#/_platform/_shared/service/infra/access";
+import { pagedFactory } from "#/_platform/_shared/service/infra/query";
+import { rateLimit } from "#/_platform/_shared/service/infra/rate";
+import { assertKeyId, assertProduct, CREDENTIAL_TTL_SECS, deriveKeyId } from "./_shared/identity";
+
+/** 兑换失败的唯一文案：不区分「不存在 / 已兑换 / 已过期 / 已撤销」，避免探测，且给出下一步 */
+const EXCHANGE_INVALID = "发布凭证无效或已失效（可能已兑换、已过期或已撤销）。请到「发布管理」页重新申请";
+
+/** 单 IP 兑换尝试上限（每 10 分钟）；256 位随机下正常用户远用不到，超限只可能是扫 */
+const EXCHANGE_RATE_LIMIT = 20;
+const EXCHANGE_RATE_WINDOW_MS = 10 * 60 * 1000;
+
+export interface PublishDeps {
+	/** 秒级时钟 */
+	now: () => number
+	randomHex: (bytes: number) => string
+	sha256Hex: (input: string) => string
+}
+
+function fail(status: number, message: string): never {
+	throw Object.assign(new Error(message), { status });
+}
+
+/** 客户端 IP：反代场景读 x-forwarded-for 首段（与 login-throttle 同口径） */
+function clientIp(): string {
+	const headers = (http.headers ?? {}) as Record<string, string>;
+	return String(headers["x-forwarded-for"] ?? headers["x-real-ip"] ?? "unknown").split(",")[0].trim();
+}
+
+/** 运行时依赖：oj isolate 的 crypto 增补面（无 randomUUID/sha256 时需要显式报缺，不静默降级） */
+export function runtimePublishDeps(): PublishDeps {
+	return {
+		now: () => Math.floor(Date.now() / 1000),
+		randomHex: (n) => {
+			const c = (globalThis as unknown as { crypto?: { randomHex?: (bytes: number) => string } }).crypto;
+			if (typeof c?.randomHex !== "function")
+				throw new Error("publish: 运行时缺少 crypto.randomHex，无法签发凭证");
+			return String(c.randomHex(n));
+		},
+		sha256Hex: (input) => {
+			const c = (globalThis as unknown as { crypto?: { sha256Hex?: (s: string) => string } }).crypto;
+			if (typeof c?.sha256Hex !== "function")
+				throw new Error("publish: 运行时缺少 crypto.sha256Hex，无法签发凭证");
+			return String(c.sha256Hex(input));
+		},
+	};
+}
+
+interface Actor {
+	uid: number
+	username: string
+	displayName: string | null
+	tenant: string
+	superadmin: boolean
+}
+
+interface CredentialRow {
+	id: number
+	product: string
+	key_id: string
+	username: string
+	display_name: string | null
+	owner_tenant: string
+	token_hint: string
+	expires_at: number
+	used: number
+	used_at: number | null
+	revoked: number
+	created_at: number
+}
+
+/** 状态由服务端判定（前端各自推导必然分叉） */
+function statusOf(row: CredentialRow, now: number): "active" | "used" | "revoked" | "expired" {
+	if (Number(row.used) === 1)
+		return "used";
+	if (Number(row.revoked) === 1)
+		return "revoked";
+	if (Number(row.expires_at) <= now)
+		return "expired";
+	return "active";
+}
+
+export function createPublishApi(deps: PublishDeps) {
+	/** 当前操作者：身份来自 token，租户与用户名来自**当前租户下**的 users 行（伪造头即查无此行） */
+	async function actor(): Promise<Actor> {
+		const snap = await currentAccess();
+		const uid = Number(http.user?.id);
+		const rows = await db.table("users")
+			.select(["username", "display_name", "tenant_id"])
+			.where({ field: "id", op: "eq", value: uid })
+			.all() as Array<Record<string, unknown>>;
+		const row = rows[0];
+		if (!row)
+			fail(403, "forbidden");
+		return {
+			uid,
+			username: String(row.username),
+			displayName: row.display_name == null ? null : String(row.display_name),
+			tenant: String(row.tenant_id ?? "default"),
+			superadmin: snap.roles.includes("superadmin"),
+		};
+	}
+
+	// ── GET /api/publish/credential —— 列表（本人；superadmin 可看全部并按租户筛）────────
+	const get = async () => {
+		await respond(async () => {
+			const me = await actor();
+			const q = (http.query ?? {}) as Record<string, unknown>;
+			const tenantFilter = me.superadmin && q.tenant ? String(q.tenant) : undefined;
+
+			// 共享表：构造器不会注入租户谓词，隔离条件必须显式写
+			const mk = () => {
+				const b = db.table("publish_credential")
+					.whereIf(tenantFilter, { field: "owner_tenant", op: "eq", value: tenantFilter });
+				if (me.superadmin)
+					return b;
+				return b.where({ field: "owner_tenant", op: "eq", value: me.tenant })
+					.where({ field: "uid", op: "eq", value: me.uid });
+			};
+
+			const r = await pagedFactory<CredentialRow>(mk, { page: q.page, size: q.limit });
+			const now = deps.now();
+			return {
+				list: r.list.map(row => ({
+					id: Number(row.id),
+					product: row.product,
+					key_id: row.key_id,
+					username: row.username,
+					display_name: row.display_name,
+					token_hint: row.token_hint,
+					status: statusOf(row, now),
+					expires_at: Number(row.expires_at),
+					used_at: row.used_at == null ? null : Number(row.used_at),
+					created_at: Number(row.created_at),
+					// 归属租户只对超管有意义
+					owner_tenant: me.superadmin ? row.owner_tenant : undefined,
+				})),
+				total: r.total,
+			};
+		});
+	};
+	get.schema = {
+		query: {
+			type: "object",
+			properties: {
+				page: { type: "number", minimum: 1 },
+				limit: { type: "number", minimum: 1, maximum: 200 },
+				tenant: { type: "string" },
+			},
+		},
+	};
+	get.response = {
+		type: "object",
+		required: ["list", "total"],
+		properties: {
+			list: {
+				type: "array",
+				items: {
+					type: "object",
+					required: ["id", "product", "key_id", "username", "token_hint", "status", "expires_at", "created_at"],
+					properties: {
+						id: { type: "number" },
+						product: { type: "string" },
+						key_id: { type: "string" },
+						username: { type: "string" },
+						display_name: { type: ["string", "null"] },
+						token_hint: { type: "string" },
+						status: { type: "string", enum: ["active", "used", "revoked", "expired"] },
+						expires_at: { type: "number" },
+						used_at: { type: ["number", "null"] },
+						created_at: { type: "number" },
+						owner_tenant: { type: "string" },
+					},
+				},
+			},
+			total: { type: "number" },
+		},
+	};
+
+	// ── POST /api/publish/credential —— 申请（填产品名 → 一次性拿到凭证 + 已定身份）─────
+	const post = async () => {
+		await respond(async () => {
+			const body = (http.body ?? {}) as Record<string, unknown>;
+			const product = assertProduct(body.product);
+			const me = await actor();
+			const keyId = assertKeyId(deriveKeyId({ product, username: me.username, uid: me.uid }));
+
+			// 撞号：同一 key_id 已被别人占用 → 拒绝。同一人重复申请是允许的
+			// （密钥长期有效，换机重建属正常操作），故只拦 uid 不同。
+			const dup = await db.table("publish_credential")
+				.select(["uid"])
+				.where({ field: "key_id", op: "eq", value: keyId })
+				.limit(1)
+				.all() as Array<Record<string, unknown>>;
+			if (dup.length > 0 && Number(dup[0].uid) !== me.uid)
+				fail(409, `发布身份 ${keyId} 已被其他用户占用，请换一个产品名`);
+
+			const token = deps.randomHex(32);
+			const now = deps.now();
+			const expiresAt = now + CREDENTIAL_TTL_SECS;
+			await db.table("publish_credential").insert({
+				token_hash: deps.sha256Hex(token),
+				token_hint: token.slice(0, 8),
+				uid: me.uid,
+				username: me.username,
+				display_name: me.displayName,
+				product,
+				key_id: keyId,
+				owner_tenant: me.tenant,
+				expires_at: expiresAt,
+				used: 0,
+				revoked: 0,
+				created_at: now,
+				created_ip: clientIp(),
+			}).run();
+
+			// 明文只在这里出现一次；库里只有 sha256
+			return { token, key_id: keyId, product, token_hint: token.slice(0, 8), expires_at: expiresAt };
+		});
+	};
+	post.schema = {
+		body: {
+			type: "object",
+			required: ["product"],
+			properties: { product: { type: "string" } },
+		},
+	};
+	post.response = {
+		type: "object",
+		required: ["token", "key_id", "product", "expires_at"],
+		properties: {
+			token: { type: "string" },
+			key_id: { type: "string" },
+			product: { type: "string" },
+			token_hint: { type: "string" },
+			expires_at: { type: "number" },
+		},
+	};
+
+	// ── POST /api/publish/credential/revoke —— 撤销（本人或超管；已兑换的不可撤销）──────
+	const revoke = async () => {
+		await respond(async () => {
+			const body = (http.body ?? {}) as Record<string, unknown>;
+			const id = Number(body.id);
+			if (!Number.isInteger(id) || id <= 0)
+				fail(400, "id 必须是正整数");
+			const me = await actor();
+
+			const rows = await db.table("publish_credential")
+				.select(["id", "uid", "owner_tenant", "used", "revoked"])
+				.where({ field: "id", op: "eq", value: id })
+				.all() as Array<Record<string, unknown>>;
+			const row = rows[0];
+			// 越权与不存在同一句话：不给探测者区分「存在但不属于你」的材料
+			if (!row || (!me.superadmin && (Number(row.uid) !== me.uid || String(row.owner_tenant) !== me.tenant)))
+				fail(404, "凭证不存在");
+
+			if (Number(row.used) === 1)
+				fail(400, "该凭证已兑换成发布身份，不能撤销（发布身份长期有效；如需停用请移除对应信任公钥）");
+			if (Number(row.revoked) === 1)
+				return { ok: true };
+
+			await db.table("publish_credential").update({ revoked: 1 }).where({ field: "id", op: "eq", value: id }).run();
+			return { ok: true };
+		});
+	};
+	revoke.schema = {
+		body: { type: "object", required: ["id"], properties: { id: { type: "number" } } },
+	};
+	revoke.response = { type: "object", required: ["ok"], properties: { ok: { type: "boolean" } } };
+
+	// ── POST /api/publish/credential/exchange —— 兑换（匿名；一次性，原子抢所有权）──────
+	const exchange = async () => {
+		await respond(async () => {
+			// 抗穷举：单 IP 每 10 分钟最多 20 次尝试
+			await rateLimit(`publish-exchange:ip:${clientIp()}`, EXCHANGE_RATE_LIMIT, EXCHANGE_RATE_WINDOW_MS);
+
+			const body = (http.body ?? {}) as Record<string, unknown>;
+			const token = String(body.token ?? "").trim();
+			// 形状先挡：64 位 hex 以外的输入连查库都不必
+			if (!/^[0-9a-f]{64}$/i.test(token))
+				fail(400, EXCHANGE_INVALID);
+
+			const hash = deps.sha256Hex(token);
+			const now = deps.now();
+			// 一条语句完成「判有效 + 抢所有权」：并发双花只可能有一个 changes=1
+			const changed = Number(await db.table("publish_credential")
+				.update({ used: 1, used_at: now })
+				.where({
+					and: [
+						{ field: "token_hash", op: "eq", value: hash },
+						{ field: "used", op: "eq", value: 0 },
+						{ field: "revoked", op: "eq", value: 0 },
+						{ field: "expires_at", op: "gt", value: now },
+					],
+				})
+				.run());
+			if (changed !== 1)
+				fail(400, EXCHANGE_INVALID);
+
+			const rows = await db.table("publish_credential")
+				.select(["key_id", "product", "username", "display_name"])
+				.where({ field: "token_hash", op: "eq", value: hash })
+				.all() as Array<Record<string, unknown>>;
+			const row = rows[0];
+			if (!row)
+				fail(400, EXCHANGE_INVALID);
+			return {
+				key_id: String(row.key_id),
+				product: String(row.product),
+				username: String(row.username),
+				display_name: row.display_name == null ? null : String(row.display_name),
+			};
+		});
+	};
+	exchange.schema = {
+		body: { type: "object", required: ["token"], properties: { token: { type: "string" } } },
+	};
+	exchange.response = {
+		type: "object",
+		required: ["key_id", "product", "username"],
+		properties: {
+			key_id: { type: "string" },
+			product: { type: "string" },
+			username: { type: "string" },
+			display_name: { type: ["string", "null"] },
+		},
+	};
+
+	return {
+		credential: { get, post, revoke: { post: revoke }, exchange: { post: exchange } },
+	};
+}
+
+export default createPublishApi(runtimePublishDeps());