@oj-module/cli 0.2.66 → 0.2.68

package/templates/src/oj-market/web/publish/__client/index.ts

@@ -0,0 +1,164 @@
+/* eslint-disable */
+// 生成物：ojm api 从契约生成，勿手改（改动请改契约文件后重跑 ojm api）
+import { ContractApiError } from "@oj-module/runtime/contract/errors";
+import type { ScopedRequestLike } from "@oj-module/runtime/contract/errors";
+import type { ModuleContext } from "@oj-module/runtime";
+import type { z } from "@oj-module/runtime";
+import type { schemas } from "./api.schemas";
+
+/** oj 信封（AC-D16）：code=0 成功；非 0 时 HTTP status=code，由 toApiError 归一为 ContractApiError */
+interface OjEnvelope<T> { code: number, msg?: string, data?: T }
+
+let req: ScopedRequestLike | undefined;
+
+/** 线上 API 前缀（ojm api 从契约抽取，唯一真源，勿手改）：请求基址 + 前缀登记用 */
+export const API_PREFIX = "/publish";
+
+/** 认领身份前缀（契约 apiPrefix，字面等于模块目录名）：跨模块认领护栏对比基准 */
+export const MODULE_PREFIX = "/publish";
+
+/** 认领方模块（web.config clientOwners 指定）：跨模块认领护栏对比基准 */
+export const MODULE_OWNER = "/oj-market";
+
+/**
+ * 模块 entry 的 onInit 里一行创建（构造即 install）：完成 apiPrefix 登记 +
+ * scoped request 绑定，返回绑好前缀的端点函数集合。一模块一 client；
+ * 重复构造幂等安全（前缀重复登记同值、request 重绑同值）。
+ */
+export function createPublishClient(ctx: ModuleContext) {
+	// 跨模块认领护栏（DEV）：工厂知道自己该属于谁（MODULE_PREFIX = 契约 apiPrefix），
+	// ctx 又带 module.name——名实不符说明别的模块在替本模块创建 client，会共享 request
+	// 单槽、卸载互相耦合；跨模块需求应由本模块创建后经 provider 暴露。
+	// 注意对比基准是 MODULE_PREFIX（目录名）而非 API_PREFIX——D-M8 映射时线上前缀
+	// 属于别的命名空间，认领身份仍按目录名。
+	if (import.meta.env.DEV && ctx.module.name !== MODULE_OWNER.slice(1)) {
+		console.warn(`[ojm-api] 模块 "${ctx.module.name}" 正在认领 ${MODULE_PREFIX} 的 client——跨模块认领会共享 request 单槽、卸载互相耦合；应由 "${MODULE_OWNER.slice(1)}" 模块在自身 onInit 创建，跨模块需求经 provider 暴露。`);
+	}
+	ctx.register.apiPrefix(API_PREFIX);
+	bindRequest(ctx.utils.request);
+	return { publishCredentialGet, publishCredentialPost, publishCredentialRevokePost, publishCredentialExchangePost };
+}
+
+/**
+ * @deprecated 请改用 createPublishClient(ctx)——工厂构造即完成
+ * 前缀登记 + request 绑定，不会出现「登记了前缀没绑 request」的半接线状态。
+ */
+export function bindRequest(r: ScopedRequestLike): void {
+	req = r;
+}
+
+function ensureReq(): ScopedRequestLike {
+	if (!req)
+		throw new ContractApiError(-1, "[ojm-api] 请求未绑定——请在模块 entry.ts 的 onInit 里调用 createPublishClient(ctx)（或 bindRequest(ctx.utils.request)）。");
+	return req;
+}
+
+/** ky HTTPError → ContractApiError（错误体为信封时取 code/msg）；契约违例与原错误原样透传 */
+async function toApiError(e: unknown): Promise<unknown> {
+	if (e instanceof ContractApiError)
+		return e;
+	// ky 2.x 构造 HTTPError 时已用 getReader() 消费掉原 response 体（res.clone().json() 按规范抛 TypeError，
+	// 体方法一律失效），解析好的错误体在公开字段 error.data——故读 error.data，勿改回 clone().json()。
+	const err = e as { data?: { code?: unknown, msg?: string }, response?: Response } | null;
+	const res = err?.response;
+	const d = err?.data;
+	if (res instanceof Response && d && typeof d.code === "number")
+		return new ContractApiError(d.code, d.msg ?? res.statusText);
+	return e;
+}
+
+export type PublishCredentialGetQuery = z.input<(typeof schemas)["publishCredentialGet"]["query"]>;
+export type PublishCredentialGetData = z.infer<(typeof schemas)["publishCredentialGet"]["data"]>;
+
+export async function publishCredentialGet(query: PublishCredentialGetQuery): Promise<PublishCredentialGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`publish/credential`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<PublishCredentialGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as PublishCredentialGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["publishCredentialGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] publishCredentialGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type PublishCredentialPostBody = z.input<(typeof schemas)["publishCredentialPost"]["body"]>;
+export type PublishCredentialPostData = z.infer<(typeof schemas)["publishCredentialPost"]["data"]>;
+
+export async function publishCredentialPost(body: PublishCredentialPostBody): Promise<PublishCredentialPostData> {
+	const client = ensureReq();
+	try {
+		const env = await client.post(`publish/credential`, { json: body }).json<OjEnvelope<PublishCredentialPostData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as PublishCredentialPostData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["publishCredentialPost"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] publishCredentialPost 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type PublishCredentialRevokePostBody = z.input<(typeof schemas)["publishCredentialRevokePost"]["body"]>;
+export type PublishCredentialRevokePostData = z.infer<(typeof schemas)["publishCredentialRevokePost"]["data"]>;
+
+export async function publishCredentialRevokePost(body: PublishCredentialRevokePostBody): Promise<PublishCredentialRevokePostData> {
+	const client = ensureReq();
+	try {
+		const env = await client.post(`publish/credential/revoke`, { json: body }).json<OjEnvelope<PublishCredentialRevokePostData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as PublishCredentialRevokePostData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["publishCredentialRevokePost"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] publishCredentialRevokePost 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type PublishCredentialExchangePostBody = z.input<(typeof schemas)["publishCredentialExchangePost"]["body"]>;
+export type PublishCredentialExchangePostData = z.infer<(typeof schemas)["publishCredentialExchangePost"]["data"]>;
+
+export async function publishCredentialExchangePost(body: PublishCredentialExchangePostBody): Promise<PublishCredentialExchangePostData> {
+	const client = ensureReq();
+	try {
+		const env = await client.post(`publish/credential/exchange`, { json: body }).json<OjEnvelope<PublishCredentialExchangePostData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as PublishCredentialExchangePostData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["publishCredentialExchangePost"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] publishCredentialExchangePost 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}

package/templates/src/oj-market/web/publish/locales/en-US.json

@@ -0,0 +1,80 @@
+{
+	"menu": {
+		"publish": "Publishing",
+		"history": "Release history"
+	},
+	"history": {
+		"title": "Release history",
+		"subtitle": "Every release recorded in the signed index, newest first. Product, version and publisher all come from the index itself.",
+		"empty": "No releases yet",
+		"syncFailed": "The market index is temporarily unreachable; showing records already stored",
+		"indexTime": "index time",
+		"publishedAtHint": "Uses the CDN file's Last-Modified when available; otherwise falls back to the index build time, tagged “index time”",
+		"total": "{{total}} in total",
+		"columns": {
+			"product": "Product",
+			"version": "Version",
+			"publisher": "Publisher key",
+			"publishedAt": "Published at",
+			"status": "Status"
+		},
+		"status": {
+			"active": "Available",
+			"yanked": "Yanked"
+		}
+	},
+	"page": {
+		"title": "Publishing",
+		"subtitle": "A publishing credential is single-use: redeeming it mints a long-lived publishing identity (key_id).",
+		"apply": "Request credential",
+		"empty": "No publishing credential yet",
+		"total": "{{total}} in total"
+	},
+	"apply": {
+		"title": "Request publishing credential",
+		"product": "Product",
+		"productExtra": "The solution name you are publishing (lowercase, a-z0-9- only). Identity = product + your username; it cannot be changed later.",
+		"productRequired": "Product is required",
+		"ok": "Generate",
+		"cancel": "Cancel"
+	},
+	"issued": {
+		"title": "Credential created (shown once)",
+		"warning": "You will not be able to view it again. Copy it now, or copy the command below.",
+		"token": "Credential",
+		"command": "Command",
+		"copy": "Copy",
+		"copied": "Copied",
+		"identity": "Identity",
+		"expires": "Valid until",
+		"done": "Saved"
+	},
+	"columns": {
+		"product": "Product",
+		"keyId": "Identity",
+		"applicant": "Applicant",
+		"tokenHint": "Credential",
+		"status": "Status",
+		"createdAt": "Requested",
+		"usedAt": "Redeemed",
+		"expiresAt": "Valid until",
+		"tenant": "Tenant",
+		"actions": "Actions"
+	},
+	"status": {
+		"active": "Pending",
+		"used": "Redeemed",
+		"revoked": "Revoked",
+		"expired": "Expired"
+	},
+	"revoke": {
+		"action": "Revoke",
+		"confirm": "Revoking invalidates this credential immediately. Continue?",
+		"ok": "Revoke",
+		"done": "Revoked"
+	},
+	"filter": {
+		"tenant": "Filter by tenant",
+		"tenantPlaceholder": "Leave empty for all tenants"
+	}
+}

package/templates/src/oj-market/web/publish/locales/zh-CN.json

@@ -0,0 +1,80 @@
+{
+	"menu": {
+		"publish": "发布管理",
+		"history": "发布历史"
+	},
+	"history": {
+		"title": "发布历史",
+		"subtitle": "签名索引里出现过的每一次发版：产品、版本与发布身份都来自索引本身，按发布时间倒序。",
+		"empty": "还没有发布记录",
+		"syncFailed": "暂时读不到市场索引，下面是已入库的历史记录",
+		"indexTime": "索引时间",
+		"publishedAtHint": "优先取分发包落 CDN 的时间（Last-Modified）；源不提供时用索引生成时间，会标注「索引时间」",
+		"total": "共 {{total}} 条",
+		"columns": {
+			"product": "产品名",
+			"version": "版本",
+			"publisher": "发布身份",
+			"publishedAt": "发布时间",
+			"status": "状态"
+		},
+		"status": {
+			"active": "在架",
+			"yanked": "已下线"
+		}
+	},
+	"page": {
+		"title": "发布管理",
+		"subtitle": "发布凭证是一次性令牌：兑换后换到一个长期有效的发布身份（key_id），凭证本身随即作废。",
+		"apply": "申请发布凭证",
+		"empty": "还没有申请过发布凭证",
+		"total": "共 {{total}} 条"
+	},
+	"apply": {
+		"title": "申请发布凭证",
+		"product": "产品名",
+		"productExtra": "要发布的解决方案名（小写字母开头，仅 a-z、0-9、-）。发布身份 = 产品名.你的用户名，申请后不可更改。",
+		"productRequired": "请填写产品名",
+		"ok": "生成凭证",
+		"cancel": "取消"
+	},
+	"issued": {
+		"title": "凭证已生成（只显示这一次）",
+		"warning": "关闭后无法再次查看明文，只能重新申请。请先复制凭证或下方命令。",
+		"identity": "发布身份",
+		"token": "凭证",
+		"command": "在本机执行",
+		"expires": "有效期至",
+		"copy": "复制",
+		"copied": "已复制",
+		"done": "我已保存"
+	},
+	"columns": {
+		"product": "产品名",
+		"keyId": "发布身份",
+		"applicant": "申请人",
+		"tokenHint": "凭证标识",
+		"status": "状态",
+		"createdAt": "申请时间",
+		"usedAt": "兑换时间",
+		"expiresAt": "有效期至",
+		"tenant": "归属租户",
+		"actions": "操作"
+	},
+	"status": {
+		"active": "待兑换",
+		"used": "已兑换",
+		"revoked": "已撤销",
+		"expired": "已过期"
+	},
+	"revoke": {
+		"action": "撤销",
+		"confirm": "撤销后该凭证立刻作废，确定？",
+		"ok": "撤销",
+		"done": "已撤销"
+	},
+	"filter": {
+		"tenant": "按租户筛选",
+		"tenantPlaceholder": "留空查看全部租户"
+	}
+}

package/templates/src/oj-market/web/publish/pages/history.tsx

@@ -0,0 +1,112 @@
+import type { ReleaseRow } from "../../types";
+import { useQuery } from "@tanstack/react-query";
+import { Alert, Space, Table, Tag, Tooltip, Typography } from "antd";
+import dayjs from "dayjs";
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { useMarketClient } from "../../api/context";
+
+const DEFAULT_PAGE_SIZE = 20;
+const PAGE_SIZE_OPTIONS = [20, 50, 100];
+
+/** 秒级 epoch（服务端统一存秒）→ 本地时间；缺值显示 - */
+function formatSecs(secs: number | null | undefined): string {
+	return secs == null ? "-" : dayjs.unix(secs).format("YYYY-MM-DD HH:mm");
+}
+
+/**
+ * 发布历史页。
+ *
+ * 数据真相在服务端：每次打开都由后端先与签名索引对账（新版本补进来，已入库行不改时间），
+ * 前端只做分页展示——不在浏览器里重算「谁先谁后」，避免两处排序口径分叉。
+ *
+ * 发布时间优先取分发包落 CDN 的 Last-Modified；源不提供时回落索引生成时间，
+ * 这种情况标一个「索引时间」，让读者知道它不是精确落包时刻。
+ */
+export default function ReleaseHistoryPage() {
+	const { t } = useTranslation();
+	const client = useMarketClient();
+	const [page, setPage] = useState(1);
+	const [size, setSize] = useState(DEFAULT_PAGE_SIZE);
+
+	const query = useQuery({
+		queryKey: ["market", "releases", page, size],
+		queryFn: () => client.releases({ page, limit: size }),
+	});
+
+	const rows = query.data?.list ?? [];
+
+	const columns = [
+		{ title: t("publish:history.columns.product"), dataIndex: "product" },
+		{ title: t("publish:history.columns.version"), dataIndex: "version" },
+		{
+			title: t("publish:history.columns.publisher"),
+			dataIndex: "key_id",
+			render: (value: string | null) => value ?? "-",
+		},
+		{
+			title: (
+				<Tooltip title={t("publish:history.publishedAtHint")}>
+					<span>{t("publish:history.columns.publishedAt")}</span>
+				</Tooltip>
+			),
+			dataIndex: "published_at",
+			render: (value: number, row: ReleaseRow) => (
+				<Space size={4}>
+					<span>{formatSecs(value)}</span>
+					{row.published_at_source === "index" && <Tag color="default">{t("publish:history.indexTime")}</Tag>}
+				</Space>
+			),
+		},
+		{
+			title: t("publish:history.columns.status"),
+			dataIndex: "yanked",
+			render: (value: number) => (
+				<Tag color={value === 1 ? "default" : "green"}>
+					{value === 1 ? t("publish:history.status.yanked") : t("publish:history.status.active")}
+				</Tag>
+			),
+		},
+	];
+
+	return (
+		<Space direction="vertical" style={{ width: "100%", paddingTop: 16 }} size="middle">
+			<Space direction="vertical" size={4}>
+				<Typography.Title level={4} style={{ margin: 0 }}>
+					{t("publish:history.title")}
+				</Typography.Title>
+				<Typography.Text type="secondary">{t("publish:history.subtitle")}</Typography.Text>
+			</Space>
+
+			{query.data?.syncError != null && (
+				<Alert
+					type="warning"
+					showIcon
+					message={t("publish:history.syncFailed")}
+					description={query.data.syncError}
+				/>
+			)}
+
+			<Table<ReleaseRow>
+				rowKey="id"
+				size="middle"
+				columns={columns}
+				dataSource={rows}
+				loading={query.isLoading}
+				locale={{ emptyText: t("publish:history.empty") }}
+				pagination={{
+					current: page,
+					pageSize: size,
+					total: query.data?.total ?? 0,
+					showSizeChanger: true,
+					pageSizeOptions: PAGE_SIZE_OPTIONS,
+					showTotal: total => t("publish:history.total", { total }),
+					onChange: (nextPage, nextSize) => {
+						setPage(nextPage);
+						setSize(nextSize);
+					},
+				}}
+			/>
+		</Space>
+	);
+}

package/templates/src/oj-market/web/publish/pages/index.tsx

@@ -0,0 +1,196 @@
+import type { PublishCredentialGetData } from "../__client";
+import type { CredentialStatus } from "./model";
+import type { IssuedCredential } from "./token-modal";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { App, Button, Form, Input, Modal, Popconfirm, Space, Table, Tag, Tooltip, Typography } from "antd";
+
+import dayjs from "dayjs";
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { publishCredentialGet, publishCredentialPost, publishCredentialRevokePost } from "../__client";
+import { canRevoke, errorText, statusColor } from "./model";
+import { TokenModal } from "./token-modal";
+
+type CredentialRow = PublishCredentialGetData["list"][number];
+
+const DEFAULT_PAGE_SIZE = 20;
+const PAGE_SIZE_OPTIONS = [20, 50, 100];
+
+/** 秒级 epoch（后端统一存秒，不是毫秒——故用 dayjs.unix 而非 dayjs()） */
+function formatSecs(secs: number | null | undefined): string {
+	return secs == null ? "-" : dayjs.unix(secs).format("YYYY-MM-DD HH:mm");
+}
+
+/**
+ * 发布管理页。
+ *
+ * 页面的职责只有三件事：列凭证、申请、撤销。所有推导都留在服务端
+ * （`key_id` 在申请时算好、`status` 由 used/revoked/expiry 三列统一判定），
+ * 前端不重复算——否则「页面显示已过期、后端仍可兑换」这类分叉迟早出现。
+ *
+ * 可见范围同样由服务端决定：普通用户只拿到自己的；超管拿到全部，响应里多一个
+ * `owner_tenant` 字段。前端据「数据里有没有这个字段」决定是否显示租户列与租户筛选，
+ * 不去单独查一次「我是谁」——少一个请求，也少一处会过期的判断。
+ */
+export default function PublishPage() {
+	const { t } = useTranslation();
+	const { message } = App.useApp();
+	const queryClient = useQueryClient();
+	const [page, setPage] = useState(1);
+	const [size, setSize] = useState(DEFAULT_PAGE_SIZE);
+	const [tenant, setTenant] = useState("");
+	const [tenantInput, setTenantInput] = useState("");
+	const [applyOpen, setApplyOpen] = useState(false);
+	const [issued, setIssued] = useState<IssuedCredential | null>(null);
+	const [form] = Form.useForm<{ product: string }>();
+
+	const query = useQuery({
+		queryKey: ["publish", "credential", page, size, tenant],
+		queryFn: () => publishCredentialGet({ page, limit: size, tenant: tenant || undefined }),
+	});
+
+	const apply = useMutation({
+		mutationFn: (product: string) => publishCredentialPost({ product }),
+		onSuccess: (r) => {
+			setApplyOpen(false);
+			form.resetFields();
+			// 明文只在响应里：先落进弹窗，再刷新列表（刷新失败也不该丢掉用户手里这张凭证）
+			setIssued(r);
+			void queryClient.invalidateQueries({ queryKey: ["publish", "credential"] });
+		},
+		onError: e => message.error(errorText(e)),
+	});
+
+	const revoke = useMutation({
+		mutationFn: (id: number) => publishCredentialRevokePost({ id }),
+		onSuccess: () => {
+			message.success(t("publish:revoke.done"));
+			void queryClient.invalidateQueries({ queryKey: ["publish", "credential"] });
+		},
+		onError: e => message.error(errorText(e)),
+	});
+
+	const rows = query.data?.list ?? [];
+	// 超管专属字段出现即说明当前账号看得见全部租户；已在筛选时也保持入口可见（否则无法清空筛选）
+	const seesTenants = tenant !== "" || rows.some(row => row.owner_tenant != null);
+
+	const columns = [
+		{ title: t("publish:columns.product"), dataIndex: "product" },
+		{
+			title: t("publish:columns.keyId"),
+			dataIndex: "key_id",
+			ellipsis: { showTitle: false },
+			render: (keyId: string) => <Tooltip title={keyId}>{keyId}</Tooltip>,
+		},
+		{
+			title: t("publish:columns.applicant"),
+			dataIndex: "username",
+			render: (username: string, row: CredentialRow) => (row.display_name ? `${row.display_name}（${username}）` : username),
+		},
+		{
+			title: t("publish:columns.tokenHint"),
+			dataIndex: "token_hint",
+			render: (hint: string) => (
+				<Typography.Text code>
+					{hint}
+					…
+				</Typography.Text>
+			),
+		},
+		{
+			title: t("publish:columns.status"),
+			dataIndex: "status",
+			render: (status: CredentialStatus) => <Tag color={statusColor(status)}>{t(`publish:status.${status}`)}</Tag>,
+		},
+		{ title: t("publish:columns.createdAt"), dataIndex: "created_at", render: (v: number) => formatSecs(v) },
+		{ title: t("publish:columns.usedAt"), dataIndex: "used_at", render: (v: number | null) => formatSecs(v) },
+		{ title: t("publish:columns.expiresAt"), dataIndex: "expires_at", render: (v: number) => formatSecs(v) },
+		...(seesTenants ? [{ title: t("publish:columns.tenant"), dataIndex: "owner_tenant" }] : []),
+		{
+			title: t("publish:columns.actions"),
+			dataIndex: "id",
+			render: (_: number, row: CredentialRow) => (canRevoke(row.status)
+				? (
+					<Popconfirm title={t("publish:revoke.confirm")} okText={t("publish:revoke.ok")} onConfirm={() => revoke.mutate(row.id)}>
+						<Button type="link" danger size="small" loading={revoke.isPending}>{t("publish:revoke.action")}</Button>
+					</Popconfirm>
+				)
+				: <Typography.Text type="secondary">-</Typography.Text>),
+		},
+	];
+
+	return (
+		<Space direction="vertical" style={{ width: "100%", paddingTop: 16 }}>
+			<Space style={{ width: "100%", justifyContent: "space-between" }} wrap>
+				<Typography.Text type="secondary">{t("publish:page.subtitle")}</Typography.Text>
+				<Space>
+					{seesTenants && (
+						<Input.Search
+							data-testid="publish-tenant-filter"
+							allowClear
+							placeholder={t("publish:filter.tenantPlaceholder")}
+							value={tenantInput}
+							onChange={e => setTenantInput(e.target.value)}
+							onSearch={(value) => {
+								setTenant(value.trim());
+								setPage(1);
+							}}
+							style={{ width: 240 }}
+						/>
+					)}
+					<Button type="primary" data-testid="publish-apply" onClick={() => setApplyOpen(true)}>{t("publish:page.apply")}</Button>
+				</Space>
+			</Space>
+			<Table
+				rowKey="id"
+				loading={query.isLoading}
+				dataSource={rows}
+				columns={columns}
+				locale={{ emptyText: t("publish:page.empty") }}
+				pagination={{
+					current: page,
+					pageSize: size,
+					total: query.data?.total ?? 0,
+					showSizeChanger: true,
+					pageSizeOptions: PAGE_SIZE_OPTIONS,
+					showTotal: total => t("publish:page.total", { total }),
+					onChange: (nextPage, nextSize) => {
+						// 改每页条数后原页码可能越界：统一回第 1 页（与操作日志页同口径）
+						if (nextSize !== size) {
+							setSize(nextSize);
+							setPage(1);
+							return;
+						}
+						setPage(nextPage);
+					},
+				}}
+			/>
+
+			<Modal
+				open={applyOpen}
+				title={t("publish:apply.title")}
+				confirmLoading={apply.isPending}
+				okText={t("publish:apply.ok")}
+				cancelText={t("publish:apply.cancel")}
+				onCancel={() => setApplyOpen(false)}
+				onOk={() => form.submit()}
+			>
+				<Form form={form} layout="vertical" onFinish={v => apply.mutate(v.product)}>
+					<Form.Item
+						name="product"
+						label={t("publish:apply.product")}
+						extra={t("publish:apply.productExtra")}
+						rules={[{ required: true, message: t("publish:apply.productRequired") }]}
+					>
+						<Input data-testid="publish-product" placeholder="demo-solution" autoFocus />
+					</Form.Item>
+				</Form>
+			</Modal>
+
+			<TokenModal
+				issued={issued}
+				onClose={() => setIssued(null)}
+			/>
+		</Space>
+	);
+}