@oj-module/cli 0.2.68 → 0.2.71

package/templates/tests/lifecycle/preflight.spec.ts

@@ -372,4 +372,22 @@ describe("p0 §3.2 质辩1 / E7·E8 匿名保留段与残留检测（写锁前
 		const r = await preflight(ctx({ manifest: m, existingAnonymousPaths: ["/_platform/health", "/auth/login"] }));
 		expect(r.ok).toBe(true);
 	});
+
+	it("e8 第一方编排段 oj-market：config 出厂匿名条目（catalog/upload/yank）属脚手架内建编排面，非方案残留 → 放行", async () => {
+		// Phase B 演练实锤（2026-11-07）：市场编排面随脚手架内置（config 出厂即匿名
+		// /oj-market/catalog|cdn/upload|yank），第一方纯 web 包（无 api 段、无 anonymous
+		// 声明）收敛/首装会整段撞 anonymous_residual——编排段条目与 /auth/* 同为宿主内建。
+		const m = JSON.parse(JSON.stringify(VALID).replaceAll("demo-solution", "oj-market")) as typeof VALID;
+		delete m.api;
+		const r = await preflight(ctx({ manifest: m, existingAnonymousPaths: ["/oj-market/catalog/**", "/oj-market/cdn/upload", "/oj-market/yank"] }));
+		expect(r.ok, r.message).toBe(true);
+	});
+
+	it("e8 非编排段的同 prefix 残留仍拒（豁免不扩散）", async () => {
+		const m = JSON.parse(JSON.stringify(VALID).replaceAll("demo-solution", "other-solution")) as typeof VALID;
+		delete m.api;
+		const r = await preflight(ctx({ manifest: m, existingAnonymousPaths: ["/other-solution/legacy"] }));
+		expect(r.ok).toBe(false);
+		expect(r.code).toBe("anonymous_residual");
+	});
 });

package/templates/tests/lifecycle/trust.spec.ts

@@ -3,7 +3,7 @@
 // 端点层：GET /market/trust、POST /market/trust/key、DELETE /market/trust/key?key_id=（del 动词 + query，system/roles 同款先例）。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（market-api.spec 同约定） */
 import type { FsFace } from "../../src/app/api/_platform/_lifecycle/atomic";
-import type { MarketEnv } from "../../src/app/api/_platform/market/api";
+import type { MarketEnv } from "../../src/oj-market/api/api";
 import { Buffer } from "node:buffer";
 import { createHash } from "node:crypto";
 import * as fsp from "node:fs/promises";
@@ -12,7 +12,7 @@ import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import { createTrustStore, isValidKeyId } from "../../src/app/api/_platform/_lifecycle/trust";
 import { invalidateAllUsers } from "../../src/app/api/_platform/_shared/service/infra/access";
-import { createMarketApi, marketEnv } from "../../src/app/api/_platform/market/api";
+import { createMarketApi, marketEnv } from "../../src/oj-market/api/api";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;

package/templates/tests/lifecycle/uninstall.spec.ts

@@ -6,7 +6,7 @@
 // 0012（IF NOT EXISTS）随 installDb 重放建立，守卫语义（表不存在静默跳过）单列一例。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（market-api.spec 同约定） */
 import type { FsFace } from "../../src/app/api/_platform/_lifecycle/atomic";
-import type { MarketEnv } from "../../src/app/api/_platform/market/api";
+import type { MarketEnv } from "../../src/oj-market/api/api";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
@@ -15,7 +15,7 @@ import { readLock, writeLock } from "../../src/app/api/_platform/_lifecycle/lock
 import { createStateStore } from "../../src/app/api/_platform/_lifecycle/state";
 import { collectRetainedTables, moduleTablePrefix } from "../../src/app/api/_platform/_lifecycle/uninstall";
 import { invalidateAllUsers } from "../../src/app/api/_platform/_shared/service/infra/access";
-import { createMarketApi } from "../../src/app/api/_platform/market/api";
+import { createMarketApi } from "../../src/oj-market/api/api";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;
@@ -165,6 +165,40 @@ describe("POST uninstall 卸载编排（superadmin，R9）", () => {
 		expect(String(hist[0].operator)).toBe("admin");
 	});
 
+	it("双轨同名（web-only 方案 vs 同名内建模块锁条目）：版本以 sidecar 为准——只删方案版本目录，内建锁条目与目录保留", async () => {
+		// 2026-11-07 市场线演练实锤：版本解析「锁优先」会把内建 oj-market 编排模块
+		// （锁 oj-market: 0.1.0，平台 api 轨）当成方案版本删——内建目录被移除、编排端点全灭。
+		// web-only 方案的真相在 sidecar（lock_commit 零锁变更），锁是 api 轨真源与方案版本可能同名不同轨。
+		await writeLock(join(sharedRoot, "manifests.yaml"), { "oj-market": "0.1.0", "other": "1.0.0" });
+		const st0 = await createStateStore(statePath);
+		await st0.write({ solutions: { "oj-market": { version: "0.2.0", enabled: true, installedAt: 1 } } });
+		await fsp.mkdir(join(sharedRoot, "oj-market-0.1.0"), { recursive: true }); // 内建编排模块目录（不可删）
+		await fsp.mkdir(join(sharedRoot, "oj-market-0.2.0"), { recursive: true }); // 方案版本目录（该删）
+		await fsp.writeFile(join(sharedRoot, "oj-market-0.2.0", "manifest.yaml"), "name: oj-market\nversion: 0.2.0\n");
+		await fsp.writeFile(modulesJsonPath, JSON.stringify([{ name: "oj-market", enabled: true }, { name: "other", enabled: true }]));
+		dbo.prepare("INSERT INTO sys_solution_route (path, module, category) VALUES (?, ?, ?)").run("/oj-market", "oj-market", "main");
+		const api = createMarketApi(makeEnv({
+			apiPrefix: "/api/oj-market",
+			// 双轨同名：内建锁条目保留 → oj 装配面无锁 diff，reload 报 unchanged 属预期
+			// （方案摘除发生在 modules.json/sidecar/route 面；断言不得按「卸载空转」拒）
+			reload: { reloadConfig: async () => ({ generation: 2, unchanged: true, applied: [], restart_pending: [], kept_listener: [] }) },
+		}));
+		g.http = { user: { id: 1 }, body: { name: "oj-market" } };
+		await api.uninstall.post();
+		expect(last?.status).toBe(200);
+		expect(last?.data).toMatchObject({ ok: true });
+		// 内建锁条目保留（api 轨不被方案卸载波及），other 亦保留
+		expect(await readLock(join(sharedRoot, "manifests.yaml"))).toEqual({ "oj-market": "0.1.0", "other": "1.0.0" });
+		// 方案版本目录删除；内建目录完好
+		await expect(fsp.readdir(join(sharedRoot, "oj-market-0.2.0"))).rejects.toBeTruthy();
+		await fsp.access(join(sharedRoot, "oj-market-0.1.0"));
+		// sidecar 删条目 + modules.json 删方案条目（other 保留）
+		expect((await createStateStore(statePath)).read().solutions["oj-market"]).toBeUndefined();
+		const list = JSON.parse(await fsp.readFile(modulesJsonPath, "utf8")) as Array<{ name: string }>;
+		expect(list.find(e => e.name === "oj-market")).toBeUndefined();
+		expect(list.find(e => e.name === "other")).toBeDefined();
+	});
+
 	it("未安装方案 → 404 资源缺失语义（P3-11：非 200 {ok:false}），人话在 message", async () => {
 		const api = createMarketApi(makeEnv());
 		g.http = { user: { id: 1 }, body: { name: "nope" } };

package/templates/tests/lifecycle/verify-checks.spec.ts

@@ -19,8 +19,8 @@ import {
 
 	verifyRouteReachability,
 } from "../../src/app/api/_platform/_lifecycle/verify-checks";
-import { siteOrigin } from "../../src/app/api/_platform/market/api";
 import { createSolutionsApi, solutionsEnv } from "../../src/app/api/_platform/solutions/api";
+import { siteOrigin } from "../../src/oj-market/api/api";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;

package/templates/tests/rbac-users.spec.ts

@@ -213,4 +213,12 @@ describe("B7：列表（用户管理页数据源）", () => {
 		expect(u2?.roles).toEqual(["editor"]);
 		expect(JSON.stringify(users)).not.toContain("password_hash");
 	});
+	it("U3：listUsers 返回 employee_no / phone_number（users 表既有列；未设置即 null）", async () => {
+		const uid = mkUser("u_emp");
+		dbo.prepare("UPDATE users SET employee_no = ?, phone_number = ? WHERE id = ?").run("E001", "13800000000", uid);
+		mkUser("u_emp2");
+		const users = await listUsers();
+		expect(users.find(u => u.username === "u_emp")).toMatchObject({ employee_no: "E001", phone_number: "13800000000" });
+		expect(users.find(u => u.username === "u_emp2")).toMatchObject({ employee_no: null, phone_number: null });
+	});
 });

package/templates/tests/solutions-entry.spec.ts

@@ -0,0 +1,55 @@
+// BDD：system 域「方案安装」入口（Phase B T3）——市场 UI 出厂未装，superadmin 经
+// /system/solutions 首装。页面本身只做 query + 渲染，真正会回归的是状态推导：
+// 目录行有无 / 装没装 / 任务终态映射，故这里测纯函数（roles-page.spec 同范式）。
+import { describe, expect, it } from "vitest";
+
+import { marketEntryOf, taskOutcomeOf } from "../src/app/web/system/pages/solutions/market-entry";
+
+const ROW = { name: "oj-market", latest: "0.2.0", installed: null as string | null, upgradable: false };
+
+describe("方案安装入口：市场包状态推导", () => {
+	it("目录无 oj-market 行 → absent（出厂未装且目录未回填）", () => {
+		expect(marketEntryOf([])).toEqual({ kind: "absent" });
+		expect(marketEntryOf([{ ...ROW, name: "wiki" }])).toEqual({ kind: "absent" });
+	});
+
+	it("目录有行未装 → installable（携带目录最新版）", () => {
+		expect(marketEntryOf([ROW])).toEqual({ kind: "installable", latest: "0.2.0" });
+	});
+
+	it("已装 → installed（携带已装版/目录最新版/可升级位）", () => {
+		expect(marketEntryOf([{ ...ROW, installed: "0.2.0" }])).toEqual({ kind: "installed", installed: "0.2.0", latest: "0.2.0", upgradable: false });
+	});
+
+	it("已装且目录有新版 → upgradable=true（市场内升级提示）", () => {
+		expect(marketEntryOf([{ ...ROW, latest: "0.3.0", installed: "0.2.0", upgradable: true }])).toEqual({ kind: "installed", installed: "0.2.0", latest: "0.3.0", upgradable: true });
+	});
+
+	it("不改入参（useQuery 缓存对象不能被就地改写）", () => {
+		const list = [ROW, { ...ROW, name: "wiki" }];
+		const before = list.map(r => r.name);
+		marketEntryOf(list);
+		expect(list.map(r => r.name)).toEqual(before);
+	});
+});
+
+describe("方案安装入口：任务终态映射（needs_trust 是非成功态）", () => {
+	const REC = { status: "running", progress: 40, message: "deploying" };
+
+	it("running → running（携带进度与阶段消息）", () => {
+		expect(taskOutcomeOf(REC)).toEqual({ kind: "running", progress: 40, message: "deploying" });
+	});
+
+	it("done → done", () => {
+		expect(taskOutcomeOf({ ...REC, status: "done" })).toEqual({ kind: "done" });
+	});
+
+	it("needs_trust → needsTrust（发布方 key 待 TOFU 确认——不得按成功渲染）", () => {
+		expect(taskOutcomeOf({ ...REC, status: "needs_trust" })).toEqual({ kind: "needsTrust" });
+	});
+
+	it("failed/partial → failed（人话取任务 message）", () => {
+		expect(taskOutcomeOf({ ...REC, status: "failed", message: "验签失败" })).toEqual({ kind: "failed", message: "验签失败" });
+		expect(taskOutcomeOf({ ...REC, status: "partial", message: "锁后失败" })).toEqual({ kind: "failed", message: "锁后失败" });
+	});
+});

package/templates/tsconfig.paths.json

@@ -10,6 +10,7 @@
 			"#/auth/*": ["./src/app/api/auth/*"],
 			"#/home/*": ["./src/app/api/home/*"],
 			"#/notification/*": ["./src/app/api/notification/*"],
+			"#/oj-market/*": ["./src/oj-market/api/*"],
 			"#/personal-center/*": ["./src/app/api/personal-center/*"],
 			"#/publish/*": ["./src/app/api/publish/*"],
 			"#/system/*": ["./src/app/api/system/*"],

package/templates/types/stream-probes/stream-handlers.ts

@@ -0,0 +1,34 @@
+// U2 类型回归探针：钉住 global.d.ts 的流式响应类型与 oj 运行时/devkit 对齐。
+//
+// 本文件**不是路由**（oj 只认 `api.ts`/`ws.ts` 为端点），也不是 src/ 下的模块
+// （ojm api --check 要求 src/<dir> 至少一侧是模块，不能放 src 内）；放在 types/
+// 是因为 api 侧 tsconfig（src/tsconfig.json）已 include "../types" 而 web 侧没有——
+// 恰好只被 typecheck:api 覆盖（见根 tests/cli/typecheck-coverage.test.ts 的并/交不变量）。
+// global.d.ts 的
+// stream/sse opts 或 StreamWriter.write 一旦被改回旧签名（缺 fileName/disposition、
+// write 不收 Uint8Array），本文件即产生 TS 错误。tests/templates/ 下的
+// stream-types 用例负责在 CI 里真正跑这次 tsc。
+// 探针刻意同时覆盖：文本流（string 通道）与二进制流（Uint8Array 字节通道）。
+
+// 文本流：CSV 导出——status/contentType/fileName/disposition 全量使用
+export function probeTextStream(): void {
+	const writer = json.stream({ status: 200, contentType: "text/csv", fileName: "report.csv", disposition: "attachment" });
+	writer.write("a,b\n");
+	writer.write("1,2\n");
+	writer.end();
+}
+
+// 二进制流：附件下载——非 ASCII 文件名 + 字节通道
+export function probeBinaryStream(bytes: Uint8Array): void {
+	const writer = json.stream({ contentType: "application/octet-stream", fileName: "导出.zip" });
+	writer.write(bytes);
+	writer.end();
+}
+
+// 内联展示 + SSE 的 fileName/disposition 透传（oj devkit 同签名）
+export function probeInlineAndSse(): void {
+	json.stream({ contentType: "image/png", fileName: "图.png", disposition: "inline" }).end();
+	const sse = json.sse({ heartbeatSecs: 5, fileName: "events.txt", disposition: "attachment" });
+	sse.write("tick");
+	sse.end();
+}

package/templates/web.config.ts

@@ -18,12 +18,12 @@ const allModules = [
 	// 各根按 handle.order 排序（/home 1、/personal-center 110、/system -100 底部），
 	// 与拆分时的菜单逐项一致；/login、/change-password、/notification-center 走 hideInMenu。
 	{ name: "app", entry: "src/app/web/entry.ts" },
-	// 解决方案市场：第一方能力（消费 _platform 编排面 /api/_platform/market/*，
-	// R29：第三方方案不得仿照此调用面），默认随脚手架下发。保持独立模块——
-	// 可选能力，不想要就改 `enabled: false`（不要删目录：src/app、src/oj-market
-	// 受完整性门禁保护，删改会让 ojm build 失败，见 src/README.md）；
-	// 发布管理页（/publish）也在这个模块里。
-	{ name: "oj-market", entry: "src/oj-market/web/entry.ts" },
+	// 解决方案市场（Phase B T2 起）：UI 为纯 web 方案包（src/oj-market/solution.yaml，
+	// 出厂未装），superadmin 经 system 域首装后由安装器供给——故本清单不再登记
+	// oj-market。模板工程里它仍被 src/ 扫描捡进构建（打包源），用户工程则没有
+	// web/entry.ts（白名单只下发 __client 生成物），登记了就是死条目。api 编排面
+	// （/api/oj-market/*，R29 第三方不得仿照）随脚手架内置不受影响；发布管理页
+	// （/publish）随方案包走，clientOwners 里 publish 归属 oj-market 不变。
 	// #region demo-only
 	// 以下为模板内置的演示模块（about/access/exception/outside/route-nest），
 	// 用于把 templates 当可运行 demo 直接跑；其文件不在 `ojm init` 的

package/vendor/host-versions.json

@@ -8,9 +8,9 @@
 		"react-router": "7.18.2",
 		"react-router/dom": "7.18.2",
 		"@tanstack/react-query": "5.102.8",
-		"@oj-module/runtime": "0.2.68",
-		"@oj-module/runtime/contract": "0.2.68",
-		"@oj-module/runtime/contract/errors": "0.2.68",
+		"@oj-module/runtime": "0.2.71",
+		"@oj-module/runtime/contract": "0.2.71",
+		"@oj-module/runtime/contract/errors": "0.2.71",
 		"@plane/kit": "0.1.20",
 		"@plane/editor": "0.1.20",
 		"antd": "6.6.1",

package/bin/oj

@@ -1,4 +0,0 @@
-[diffend] Oversized file quarantined before diffing.
-name: package/bin/oj
-size: 126034368 bytes
-sha256: 6774d629abecdd96a84bed71ed220ce85ae46bbbe9a818819eca87a5b5d50be6