@oj-module/cli 0.2.68 → 0.2.71

package/src/enable.ts

@@ -1,4 +1,4 @@
-// ojm enable/disable（P1-13，D8）：生命周期开关瘦客户端——POST /api/_platform/market/enable
+// ojm enable/disable（P1-13，D8）：生命周期开关瘦客户端——POST /api/oj-market/enable
 // 触发站点侧 setEnabled 四处同写（锁/sidecar/route/modules.json，D12）。本地零状态，纯转发。
 import process from "node:process";
 import { callApi, login, resolveSite } from "./site";
@@ -21,7 +21,7 @@ export async function setEnabledCommand(name: string, enabled: boolean, opts: En
 	const fetchFn = opts.fetchFn ?? globalThis.fetch;
 	const { base, user, pass } = resolveSite(opts);
 	const token = await login(fetchFn, base, user, pass);
-	const result = await callApi<{ ok: boolean, message: string }>(fetchFn, base, token, "POST", "/api/_platform/market/enable", { name: name.trim(), enabled });
+	const result = await callApi<{ ok: boolean, message: string }>(fetchFn, base, token, "POST", "/api/oj-market/enable", { name: name.trim(), enabled });
 	console.log(`[ojm] ${result.message}`);
 	if (!result.ok)
 		process.exitCode = 1;

package/src/init.ts

@@ -38,6 +38,8 @@ export interface InitOptions {
 	ojInstaller?: (binDir: string) => Promise<void>
 	/** 注入桩密封（测试）；缺省真跑 bin/oj secret keygen/seal */
 	seal?: Sealer
+	/** 随站第一方 bundle 源目录（测试注入）；缺省 <cliRoot>/shell-dist/bundles（prepack 同步面） */
+	bundlesDir?: string
 }
 
 interface InitReport {
@@ -149,6 +151,12 @@ export async function initProject(destDir: string, opts: InitOptions = {}): Prom
 	else if (builtinStatus === "skipped")
 		report.skipped.push(`${BUILTIN_LIST_FILE}（已存在，不覆盖用户手改）`);
 
+	// 1c) 随站第一方 bundle 落位（Phase B T3b，仅 --yes 自动化路径；交互式零动作——
+	//     决策 #1 两路径并存）：tgz+sig 拷入 cdn/ 并写 bundles.json 意图标记，
+	//     站点经 oj-market index 端点对账收敛（上拉不下拉，方案 §5）。
+	//     bundle 由发布流水线 built+signed 后收进 shell-dist/bundles（scripts/sync-bundles.mjs）。
+	placeBundledSolutions(destDir, opts, report, cliRoot);
+
 	// 1b) tsconfig.paths.json：把 oj 别名 `#/<模块名>/…` 投影成 TS 的 paths。
 	//     必须**现场生成**而不是随模板拷贝——模板兼作 demo 工程（多出 demo/home 两个
 	//     模块），而用户工程只有白名单里的那些；照拷会让 paths 指向不存在的目录。
@@ -277,6 +285,43 @@ export async function initProject(destDir: string, opts: InitOptions = {}): Prom
 }
 
 /** 默认密封器：bin/oj secret keygen + seal（失败返回 null，不抛） */
+/**
+ * 随站第一方 bundle 落位（Phase B T3b）：`ojm init --yes` 把发布流水线收进
+ * shell-dist/bundles 的 <name>-<version>.tgz(+sig) 拷入工程 cdn/，并写
+ * bundles.json 意图标记（站点启动后经 oj-market index 端点对账收敛——上拉不下拉）。
+ * 仅 --yes 自动化路径执行（决策 #1：--yes = 无人值守授权；交互式保持手动口径）；
+ * bundle 源缺失是「发布未内置 bundle」的合法态（如源码仓直跑）——warning 不失败。
+ */
+function placeBundledSolutions(destDir: string, opts: InitOptions, report: InitReport, cliRoot: string): void {
+	if (!opts.yes)
+		return;
+	const srcDir = opts.bundlesDir ?? path.join(cliRoot, "shell-dist", "bundles");
+	if (!fs.existsSync(srcDir)) {
+		report.warnings.push("随站方案包缺失（shell-dist/bundles 不在——发布流水线未内置 bundle）：市场保持出厂未装，superadmin 可经 system 域「方案安装」首装");
+		return;
+	}
+	const files = fs.readdirSync(srcDir).filter(f => f.endsWith(".tgz")).sort();
+	if (files.length === 0) {
+		report.warnings.push("随站方案包目录为空（shell-dist/bundles 无 tgz）：市场保持出厂未装");
+		return;
+	}
+	const cdnDir = path.join(destDir, "cdn");
+	fs.mkdirSync(cdnDir, { recursive: true });
+	const entries: { name: string, version: string, file: string }[] = [];
+	for (const file of files) {
+		fs.copyFileSync(path.join(srcDir, file), path.join(cdnDir, file));
+		const sig = `${file}.sig`;
+		if (fs.existsSync(path.join(srcDir, sig)))
+			fs.copyFileSync(path.join(srcDir, sig), path.join(cdnDir, sig));
+		// name/version 自文件名解析（bundle 命名纪律 <name>-<version>.tgz，同 download 段正名口径）；
+		// version 以数字开头取最后一个连字符切分（name 本身可含连字符，如 oj-market）
+		const m = file.match(/^(.+)-(\d[0-9A-Za-z.+-]*)\.tgz$/);
+		entries.push({ name: m?.[1] ?? file.replace(/\.tgz$/, ""), version: m?.[2] ?? "", file });
+	}
+	fs.writeFileSync(path.join(cdnDir, "bundles.json"), `${JSON.stringify({ solutions: entries }, null, "\t")}\n`);
+	report.created.push(`cdn/ 随站方案包 ${files.length} 个 + 意图标记 bundles.json`);
+}
+
 const defaultSealer: Sealer = async (destDir, plainSecret) => {
 	const ojBin = resolveOjBin(destDir);
 	if (!fs.existsSync(ojBin))

package/src/install.ts

@@ -2,7 +2,7 @@ import type { TaskRecord } from "./site";
 // ojm install（P1-13，D6）：方案包安装瘦客户端。目标两种形态：
 //   · 本地 tgz 路径（<name>-<version>.tgz 文件名推导身份，--name/--version 可覆盖）→ file 源 multipart 上传；
 //   · name[@version] → cdn 源（站点侧 Form B 索引解析，安装器不拼 URL——市场侧职责，api.ts 同纪律）。
-// 流程：登录 → POST /api/_platform/market/install → 轮询 task?id= 至终态 → 渲染。
+// 流程：登录 → POST /api/oj-market/install → 轮询 task?id= 至终态 → 渲染。
 // 终态渲染（契约附录 A 同表取用，R28/DRY）：失败/partial 打 error.reason + retryable 标注 +
 // hintKey 对应双语指引（--locale zh-CN|en-US，缺省 zh-CN；文案真源为契约附录 A 表）。
 import fs from "node:fs";
@@ -285,11 +285,11 @@ export async function installCommand(target: string, opts: InstallOptions = {}):
 		if (opts.name !== undefined && opts.name !== slug)
 			throw new UsageError(`[ojm] --name「${opts.name}」与 registry 目标推导的物理名「${slug}」不一致——registry 源由目标推导身份，请二选一`);
 		// 旧站点拒：meta apiVersion < 0.2.0 不支持 registry 源（REG-R9② 升版反噬 F4 的人话面）
-		const meta = await callApi<{ apiVersion?: string }>(fetchFn, base, token, "GET", "/api/_platform/market/meta");
+		const meta = await callApi<{ apiVersion?: string }>(fetchFn, base, token, "GET", "/api/oj-market/meta");
 		if (!isSiteApiAtLeast(meta.apiVersion, "0.2.0"))
 			throw new Error(`[ojm] 目标站点平台 API 版本过低（需 ≥ 0.2.0 才支持 --registry 源安装，实为 ${meta.apiVersion ?? "未知"}）——请升级目标站点的 oj-module，或改用 CDN/file 源`);
 		const registryOrigin = originOf(src.url) ?? src.url;
-		response = await callApi<{ task_id: string }>(fetchFn, base, token, "POST", `/api/_platform/market/install${forceQ}`, {
+		response = await callApi<{ task_id: string }>(fetchFn, base, token, "POST", `/api/oj-market/install${forceQ}`, {
 			name: slug,
 			version: opts.version ?? version,
 			source: "registry",
@@ -321,7 +321,7 @@ export async function installCommand(target: string, opts: InstallOptions = {}):
 			else {
 				console.log(`[ojm] 未发现签名侧车（${path.basename(sigPath)}）——宿主验签硬 fail-closed，未签名包将被拒（sig_missing）；签名方法见 devkit「签名与信任」`);
 			}
-			const res = await fetchFn(`${base}/api/_platform/market/install${forceQ}`, {
+			const res = await fetchFn(`${base}/api/oj-market/install${forceQ}`, {
 				method: "POST",
 				headers: { authorization: `Bearer ${token}`, ...tenantHeaders() },
 				body: form,
@@ -331,7 +331,7 @@ export async function installCommand(target: string, opts: InstallOptions = {}):
 		else {
 			if (opts.name !== undefined && opts.name !== parsed.name)
 				throw new Error(`[ojm] --name「${opts.name}」与目标「${parsed.name}」不一致——请二选一`);
-			response = await callApi<{ task_id: string }>(fetchFn, base, token, "POST", `/api/_platform/market/install${forceQ}`, {
+			response = await callApi<{ task_id: string }>(fetchFn, base, token, "POST", `/api/oj-market/install${forceQ}`, {
 				name: parsed.name,
 				version: opts.version ?? parsed.version,
 				source: "cdn",

package/src/lifecycle/__tests__/install.test.ts

@@ -96,7 +96,7 @@ describe("pollTask · 轮询退避（800ms 起步指数退避、上限 5s、超
 		sleepLog.length = 0;
 		let n = 0;
 		const { fetchFn } = fetchStub({
-			"/api/_platform/market/task": () => ok(n++ < 2 ? rec({ status: "running", progress: 30 * n }) : rec()),
+			"/api/oj-market/task": () => ok(n++ < 2 ? rec({ status: "running", progress: 30 * n }) : rec()),
 		});
 		const r = await pollTask(fetchFn, "http://x", "tok", "t1", { sleep });
 		expect(r.status).toBe("done");
@@ -107,7 +107,7 @@ describe("pollTask · 轮询退避（800ms 起步指数退避、上限 5s、超
 		sleepLog.length = 0;
 		let n = 0;
 		const { fetchFn } = fetchStub({
-			"/api/_platform/market/task": () => ok(rec({ status: n++ < 5 ? "running" : "done", progress: 10 + n })),
+			"/api/oj-market/task": () => ok(rec({ status: n++ < 5 ? "running" : "done", progress: 10 + n })),
 		});
 		const r = await pollTask(fetchFn, "http://x", "tok", "t1", { sleep, timeoutMs: 20_000 });
 		expect(r.status).toBe("done");
@@ -117,7 +117,7 @@ describe("pollTask · 轮询退避（800ms 起步指数退避、上限 5s、超
 	it("超时报错：总等待预算耗尽即人话退出", async () => {
 		sleepLog.length = 0;
 		const { fetchFn } = fetchStub({
-			"/api/_platform/market/task": () => ok(rec({ status: "running" })),
+			"/api/oj-market/task": () => ok(rec({ status: "running" })),
 		});
 		await expect(pollTask(fetchFn, "http://x", "tok", "t1", { sleep, timeoutMs: 1000 })).rejects.toThrow(/超时/);
 		expect(sleepLog).toEqual([800]);
@@ -125,7 +125,7 @@ describe("pollTask · 轮询退避（800ms 起步指数退避、上限 5s、超
 
 	it("查询参数形态：task?id=<id>（非路径段，P1-12 裁决）", async () => {
 		const { fetchFn, calls } = fetchStub({
-			"/api/_platform/market/task": () => ok(rec()),
+			"/api/oj-market/task": () => ok(rec()),
 		});
 		await pollTask(fetchFn, "http://x", "tok", "t1", { sleep });
 		expect(calls[0]?.url).toContain("task?id=t1");
@@ -233,7 +233,7 @@ describe("schemaVersion 旧记录兼容（P2-10 升版纪律读方侧：高版
 
 	it("pollTask：高版本记录原样返回不炸（轮询消费面兼容）", async () => {
 		const { fetchFn } = fetchStub({
-			"/api/_platform/market/task": () => ok(rec({ status: "done", schemaVersion: 99 })),
+			"/api/oj-market/task": () => ok(rec({ status: "done", schemaVersion: 99 })),
 		});
 		const r = await pollTask(fetchFn, "http://x", "tok", "t1", { sleep: async () => {} });
 		expect(r.status).toBe("done");
@@ -245,8 +245,8 @@ describe("schemaVersion 旧记录兼容（P2-10 升版纪律读方侧：高版
 		writeFileSync(tgz, "fake-tgz-bytes");
 		const { fetchFn } = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-			"/api/_platform/market/install": () => ok({ task_id: "t1" }),
-			"/api/_platform/market/task": () => ok(rec({ status: "done", schemaVersion: 99 })),
+			"/api/oj-market/install": () => ok({ task_id: "t1" }),
+			"/api/oj-market/task": () => ok(rec({ status: "done", schemaVersion: 99 })),
 		});
 		const exitBackup = process.exitCode;
 		process.exitCode = 0;
@@ -351,8 +351,8 @@ describe("installCommand · file 源端到端（stub fetch：登录 → multipar
 		writeFileSync(tgz, "fake-tgz-bytes");
 		const { fetchFn, calls } = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok-1", refresh_token: "r", expires_in: 1 }),
-			"/api/_platform/market/install": () => ok({ task_id: "t1" }),
-			"/api/_platform/market/task": () => ok(rec()),
+			"/api/oj-market/install": () => ok({ task_id: "t1" }),
+			"/api/oj-market/task": () => ok(rec()),
 		});
 		await installCommand(tgz, { siteUrl: "http://x", user: "u", pass: "p", fetchFn, sleep: async () => {} });
 		// 登录体
@@ -378,8 +378,8 @@ describe("installCommand · file 源端到端（stub fetch：登录 → multipar
 		writeFileSync(tgz, "fake-tgz-bytes");
 		const { fetchFn } = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-			"/api/_platform/market/install": () => ok({ task_id: "t1" }),
-			"/api/_platform/market/task": () => ok(rec({
+			"/api/oj-market/install": () => ok({ task_id: "t1" }),
+			"/api/oj-market/task": () => ok(rec({
 				status: "failed",
 				stage: "migrating",
 				error: { reason: "迁移失败", retryable: true, hintKey: "lifecycle.stage.migrating.hint" },
@@ -403,8 +403,8 @@ describe("installCommand · file 源端到端（stub fetch：登录 → multipar
 		writeFileSync(`${tgz}.sig`, JSON.stringify({ alg: "Ed25519", key_id: "test.publisher", public_key: "a".repeat(64), value: "AAAA", canon: "v2", registry_id: "test.registry" }));
 		const { fetchFn, calls } = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-			"/api/_platform/market/install": () => ok({ task_id: "t1" }),
-			"/api/_platform/market/task": () => ok(rec()),
+			"/api/oj-market/install": () => ok({ task_id: "t1" }),
+			"/api/oj-market/task": () => ok(rec()),
 		});
 		await installCommand(tgz, { siteUrl: "http://x", user: "u", pass: "p", fetchFn, sleep: async () => {} });
 		const form = calls[1]?.init?.body as FormData;
@@ -418,8 +418,8 @@ describe("installCommand · file 源端到端（stub fetch：登录 → multipar
 		writeFileSync(tgz, "fake-tgz-bytes");
 		const { fetchFn, calls } = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-			"/api/_platform/market/install": () => ok({ task_id: "t1" }),
-			"/api/_platform/market/task": () => ok(rec()),
+			"/api/oj-market/install": () => ok({ task_id: "t1" }),
+			"/api/oj-market/task": () => ok(rec()),
 		});
 		await installCommand(tgz, { siteUrl: "http://x", user: "u", pass: "p", fetchFn, sleep: async () => {} });
 		const form = calls[1]?.init?.body as FormData;
@@ -441,8 +441,8 @@ describe("installCommand · cdn 源（JSON 体 name@version）", () => {
 	it("source=cdn 的 JSON 体 + 版本缺省 null", async () => {
 		const { fetchFn, calls } = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-			"/api/_platform/market/install": () => ok({ task_id: "t1" }),
-			"/api/_platform/market/task": () => ok(rec()),
+			"/api/oj-market/install": () => ok({ task_id: "t1" }),
+			"/api/oj-market/task": () => ok(rec()),
 		});
 		await installCommand("demo-solution", { siteUrl: "http://x", user: "u", pass: "p", fetchFn, sleep: async () => {} });
 		const installCall = calls[1]!;
@@ -453,8 +453,8 @@ describe("installCommand · cdn 源（JSON 体 name@version）", () => {
 	it("@version 透传", async () => {
 		const { fetchFn, calls } = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-			"/api/_platform/market/install": () => ok({ task_id: "t1" }),
-			"/api/_platform/market/task": () => ok(rec()),
+			"/api/oj-market/install": () => ok({ task_id: "t1" }),
+			"/api/oj-market/task": () => ok(rec()),
 		});
 		await installCommand("demo-solution@0.2.0", { siteUrl: "http://x", user: "u", pass: "p", fetchFn, sleep: async () => {} });
 		expect(JSON.parse(String(calls[1]?.init?.body)).version).toBe("0.2.0");
@@ -465,11 +465,11 @@ describe("setEnabledCommand · enable/disable 瘦客户端（D8）", () => {
 	it("pOST enable {name, enabled} → 打印服务端 message；ok:false 非零退出", async () => {
 		const { fetchFn, calls } = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-			"/api/_platform/market/enable": () => ok({ ok: true, message: "启用完成：四处同写" }),
+			"/api/oj-market/enable": () => ok({ ok: true, message: "启用完成：四处同写" }),
 		});
 		await setEnabledCommand("demo-solution", true, { siteUrl: "http://x", user: "u", pass: "p", fetchFn });
 		const call = calls[1]!;
-		expect(call.url).toContain("/api/_platform/market/enable");
+		expect(call.url).toContain("/api/oj-market/enable");
 		expect(JSON.parse(String(call.init?.body))).toEqual({ name: "demo-solution", enabled: true });
 		expect(logs.join("\n")).toContain("启用完成：四处同写");
 
@@ -478,7 +478,7 @@ describe("setEnabledCommand · enable/disable 瘦客户端（D8）", () => {
 		try {
 			const { fetchFn: fetchFn2 } = fetchStub({
 				"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-				"/api/_platform/market/enable": () => ok({ ok: false, message: "禁用失败：「x」未安装" }),
+				"/api/oj-market/enable": () => ok({ ok: false, message: "禁用失败：「x」未安装" }),
 			});
 			await setEnabledCommand("x", false, { siteUrl: "http://x", user: "u", pass: "p", fetchFn: fetchFn2 });
 			expect(process.exitCode).toBe(1);
@@ -521,13 +521,13 @@ describe("s5-2② REG-R9 install 源切换：registry（CLI 归一 + 旧站点
 	it("installCommand registry：新站点（apiVersion 0.2.0）POST source=registry + registry=origin（slug 归一）", async () => {
 		const { fetchFn, calls } = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok" }),
-			"/api/_platform/market/meta": () => ok({ apiVersion: "0.2.0" }),
-			"/api/_platform/market/install": () => ok({ task_id: "t1" }),
-			"/api/_platform/market/task": () => ok(rec()),
+			"/api/oj-market/meta": () => ok({ apiVersion: "0.2.0" }),
+			"/api/oj-market/install": () => ok({ task_id: "t1" }),
+			"/api/oj-market/task": () => ok(rec()),
 		});
 		const r = await installCommand("@acme/demo", { siteUrl: "http://site", user: "u", pass: "p", registry: "https://r.example.com/", fetchFn });
 		expect(r.status).toBe("done");
-		const call = calls.find(c => c.url.includes("/api/_platform/market/install"));
+		const call = calls.find(c => c.url.includes("/api/oj-market/install"));
 		expect(call).toBeDefined();
 		const body = JSON.parse(String(call!.init!.body));
 		expect(body).toMatchObject({ name: "acme-demo", source: "registry", registry: "https://r.example.com" });
@@ -537,12 +537,12 @@ describe("s5-2② REG-R9 install 源切换：registry（CLI 归一 + 旧站点
 	it("installCommand registry：旧站点（apiVersion 0.1.0）→ 抛「站点版本过低」且不 POST install", async () => {
 		const { fetchFn, calls } = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok" }),
-			"/api/_platform/market/meta": () => ok({ apiVersion: "0.1.0" }),
-			"/api/_platform/market/install": () => ok({ task_id: "t1" }),
+			"/api/oj-market/meta": () => ok({ apiVersion: "0.1.0" }),
+			"/api/oj-market/install": () => ok({ task_id: "t1" }),
 		});
 		await expect(installCommand("@acme/demo", { siteUrl: "http://site", user: "u", pass: "p", registry: "https://r.example.com", fetchFn }))
 			.rejects
 			.toThrow(/版本过低/);
-		expect(calls.some(c => c.url.includes("/api/_platform/market/install"))).toBe(false);
+		expect(calls.some(c => c.url.includes("/api/oj-market/install"))).toBe(false);
 	});
 });

package/src/lifecycle/__tests__/market-bundle.test.ts

@@ -0,0 +1,87 @@
+import { execFileSync } from "node:child_process";
+// BDD：oj-market 第一方方案包（Phase B T1）——市场 UI 以**纯 web 方案包**形态分发：
+// 契约 src/oj-market/solution.yaml（web-only：api 编排面留在平台，随脚手架内置不随包），
+// `ojm build --bundle oj-market` 产出 dist/oj-market-0.2.0.tgz（+ 发包人 ojm sign 平台签名）。
+// 版本基线 0.2.0（20261106-2122 拍板）；entry.ts 版本与契约版本同源漂移由本 spec 钉住。
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { parse } from "yaml";
+import { buildBundle } from "../../bundle";
+import { validateContract } from "../../manifest-contract";
+
+const TEMPLATES = join(dirname(fileURLToPath(import.meta.url)), "../../../templates");
+const CONTRACT = join(TEMPLATES, "src/oj-market/solution.yaml");
+
+/** tar 成员清单（与 bundle.test 同原语） */
+function tarList(tgz: string): string[] {
+	const out = execFileSync("tar", ["-tzf", tgz], { encoding: "utf-8" });
+	return out.split("\n").filter(Boolean);
+}
+
+describe("oj-market 方案包契约（T1）", () => {
+	it("src/oj-market/solution.yaml 在位：name=oj-market、version=0.2.0、web-only（无 api 段）、契约零违规", () => {
+		expect(existsSync(CONTRACT)).toBe(true);
+		const m = parse(readFileSync(CONTRACT, "utf8")) as Record<string, unknown>;
+		expect(m).toMatchObject({ name: "oj-market", version: "0.2.0" });
+		expect(m.api).toBeUndefined(); // 安装编排面留在平台（src/oj-market/api 内置不随包）
+		const web = m.web as Record<string, unknown>;
+		expect(web.entry).toBe("modules/oj-market/0.2.0/entry.js");
+		expect(validateContract(m)).toEqual([]);
+	});
+
+	it("模板工程 builtin 名单不含 oj-market（第一方打包放行；用户工程名单由 init 按白名单派生仍含——两侧语义分歧是本用例钉住的裁决）", () => {
+		const p = join(TEMPLATES, "src/.ojm-builtin.json");
+		const list = JSON.parse(readFileSync(p, "utf8")) as { modules: string[] };
+		expect(list.modules).not.toContain("oj-market");
+	});
+
+	it("版本同源：web entry.ts 模块版本 = 契约版本（0.2.0 基线，双写漂移即红）", async () => {
+		const { readModuleDefinition } = await import("../../build/module-def");
+		const def = await readModuleDefinition(join(TEMPLATES, "src/oj-market/web/entry.ts"), TEMPLATES);
+		expect(def.version).toBe("0.2.0");
+	});
+});
+
+describe("oj-market 方案包组装（T1，scratch 工程钉布局）", () => {
+	let project: string;
+	let out: string;
+
+	beforeEach(() => {
+		project = mkdtempSync(join(tmpdir(), "ojm-market-bundle-"));
+		out = mkdtempSync(join(tmpdir(), "ojm-market-out-"));
+		// 契约原样入 scratch（唯一真源，勿在测试里另写一份）
+		mkdirSync(join(project, "src/oj-market"), { recursive: true });
+		cpSync(CONTRACT, join(project, "src/oj-market/solution.yaml"));
+		// 模块标记（布局探测）+ 无 category 路由的 entry 桩（derive 空 → 保留契约 routes）
+		mkdirSync(join(project, "src/oj-market/web/locales"), { recursive: true });
+		writeFileSync(join(project, "src/oj-market/web/entry.ts"), "export default { name: \"oj-market\", version: \"0.2.0\", routes: [] };\n");
+		writeFileSync(join(project, "src/oj-market/web/locales/zh-CN.json"), JSON.stringify({ menu: { main: "方案市场" } }));
+		writeFileSync(join(project, "src/oj-market/web/locales/en-US.json"), JSON.stringify({ menu: { main: "Market" } }));
+		// 站点构建产物桩（版本段 === 0.2.0）
+		mkdirSync(join(project, "dist/web/modules/oj-market/0.2.0"), { recursive: true });
+		writeFileSync(join(project, "dist/web/modules/oj-market/0.2.0/entry.js"), "export default {};\n");
+	});
+
+	afterEach(() => {
+		rmSync(project, { recursive: true, force: true });
+		rmSync(out, { recursive: true, force: true });
+	});
+
+	it("buildBundle --bundle oj-market：纯 web 包（manifest + web/modules + 双语 locales，无 api/ 成员）", async () => {
+		const [r] = await buildBundle(project, { out, name: "oj-market" });
+		expect(r).toMatchObject({ name: "oj-market", version: "0.2.0" });
+		expect(r!.sha256).toMatch(/^[a-f0-9]{64}$/);
+		const names = tarList(r!.tgz);
+		expect(names).toContain("oj-market-0.2.0/manifest.yaml");
+		expect(names).toContain("oj-market-0.2.0/web/modules/oj-market/0.2.0/entry.js");
+		expect(names).toContain("oj-market-0.2.0/web/modules/oj-market/locales/zh-CN.json");
+		expect(names).toContain("oj-market-0.2.0/web/modules/oj-market/locales/en-US.json");
+		expect(names.some(n => n.includes("/api/"))).toBe(false);
+		// 确定性：同输入两次打包哈希一致（C2-32）
+		const [r2] = await buildBundle(project, { out, name: "oj-market" });
+		expect(r2!.sha256).toBe(r!.sha256);
+	});
+});

package/src/lifecycle/__tests__/publish.test.ts

@@ -205,17 +205,15 @@ describe("ojm publish 索引重算 + 签名（P3-5/6/7，REG-CS5 三级化）",
 	it("索引写入只有 writeIndexFile 一条路径（源码级不变量，grep 可证）", () => {
 		const srcOf = (rel: string) => readFileSync(fileURLToPath(new URL(rel, import.meta.url)), "utf8");
 		const countOf = (text: string, re: RegExp) => text.split("\n").filter(line => re.test(line)).length;
-		// 生成侧：publish.ts 里唯一的 fs.writeFileSync 就在 writeIndexFile 体内（tmp+rename）；
-		// build-index.ts 零直写——索引文件全部经唯一写入口
+		// 生成侧：publish.ts 里唯一的 fs.writeFileSync 就在 writeIndexFile 体内（tmp+rename）
 		expect(countOf(srcOf("../../publish.ts"), /fs\.writeFileSync/)).toBe(1);
 		expect(countOf(srcOf("../../publish.ts"), /appendFileSync/)).toBe(0);
-		expect(countOf(srcOf("../../market/build-index.ts"), /fs\.writeFileSync|writeFileSync\(/)).toBe(0);
-		expect(countOf(srcOf("../../market/build-index.ts"), /appendFileSync/)).toBe(0);
-		// 全仓其余直写只剩 walkthrough 的负向演练：往 catalog 追加重码标记（drill 本身），
-		// 且回抄恢复走 writeIndexFile——除这一行 deliberate tamper 外没有第二个索引直写点
-		const walkthrough = srcOf("../../market/walkthrough.ts");
-		expect(countOf(walkthrough, /appendFileSync/)).toBe(1);
-		expect(countOf(walkthrough, /# tampered/)).toBe(1);
-		expect(countOf(walkthrough, /writeIndexFile\(catalog/)).toBe(1);
+		// A6：市场索引机制整建制退役——build-index/index-builder/sharding/yank-ledger 已删，
+		// 全仓不再有第二个索引写者（registry-* 文件面留档，唯一写入口仍是 writeIndexFile）
+		for (const rel of ["../../market/build-index.ts", "../../market/index-builder.ts", "../../market/sharding.ts", "../../market/yank-ledger.ts"])
+			expect(existsSync(fileURLToPath(new URL(rel, import.meta.url)))).toBe(false);
+		// walkthrough 的索引 tamper drill 随 neg-badindex 退役——不再有任何索引直写点
+		expect(countOf(srcOf("../../market/walkthrough.ts"), /appendFileSync/)).toBe(0);
+		expect(countOf(srcOf("../../market/walkthrough.ts"), /writeIndexFile/)).toBe(0);
 	});
 });

package/src/lifecycle/__tests__/trust.test.ts

@@ -1,6 +1,6 @@
 import process from "node:process";
 // BDD：ojm trust 瘦客户端（P2-2，C2-38/39）——纯转发（uninstall.test.ts 同范式）：
-// 登录 → GET/POST/DELETE /api/_platform/market/trust* → 打印人话；fetch 全 stub 不真发网络。
+// 登录 → GET/POST/DELETE /api/oj-market/trust* → 打印人话；fetch 全 stub 不真发网络。
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { formatFingerprint, trustCommand } from "../../trust";
 
@@ -44,10 +44,10 @@ describe("trustCommand · ls（P2-2）", () => {
 	it("登录后 GET /market/trust → 逐行打印 key_id + 分组指纹", async () => {
 		const { fetchFn, calls } = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-			"/api/_platform/market/trust": () => ok({ keys: [KEY_A], note: null }),
+			"/api/oj-market/trust": () => ok({ keys: [KEY_A], note: null }),
 		});
 		await trustCommand("ls", [], { ...SITE, fetchFn });
-		expect(calls[1]?.url).toContain("/api/_platform/market/trust");
+		expect(calls[1]?.url).toContain("/api/oj-market/trust");
 		expect(calls[1]?.init?.method).toBe("GET");
 		expect((calls[1]?.init?.headers as Record<string, string>).authorization).toBe("Bearer tok");
 		const out = logs.join("\n");
@@ -58,7 +58,7 @@ describe("trustCommand · ls（P2-2）", () => {
 	it("空库 → 可读空态；note 在场（.bak 回落）→ 先打注意行", async () => {
 		const { fetchFn } = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-			"/api/_platform/market/trust": () => ok({ keys: [], note: "x 损坏，已自动回落 x.bak" }),
+			"/api/oj-market/trust": () => ok({ keys: [], note: "x 损坏，已自动回落 x.bak" }),
 		});
 		await trustCommand("ls", [], { ...SITE, fetchFn });
 		expect(logs.join("\n")).toContain("已自动回落");
@@ -69,7 +69,7 @@ describe("trustCommand · add / revoke（P2-2）", () => {
 	it("add：POST {key_id, public_key}；added / exists_same 两种回显", async () => {
 		const added = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-			"/api/_platform/market/trust/key": () => ok({ result: "added" }),
+			"/api/oj-market/trust/key": () => ok({ result: "added" }),
 		});
 		await trustCommand("add", ["ojm.test", "a".repeat(64)], { ...SITE, fetchFn: added.fetchFn });
 		const call = added.calls[1]!;
@@ -79,7 +79,7 @@ describe("trustCommand · add / revoke（P2-2）", () => {
 
 		const idem = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-			"/api/_platform/market/trust/key": () => ok({ result: "exists_same" }),
+			"/api/oj-market/trust/key": () => ok({ result: "exists_same" }),
 		});
 		await trustCommand("add", ["ojm.test", "a".repeat(64)], { ...SITE, fetchFn: idem.fetchFn });
 		expect(logs.join("\n")).toContain("无需重复添加");
@@ -97,18 +97,18 @@ describe("trustCommand · add / revoke（P2-2）", () => {
 		try {
 			const yes = fetchStub({
 				"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-				"/api/_platform/market/trust/key": () => ok({ revoked: true }),
+				"/api/oj-market/trust/key": () => ok({ revoked: true }),
 			});
 			await trustCommand("revoke", ["ojm.test"], { ...SITE, fetchFn: yes.fetchFn });
 			const call = yes.calls[1]!;
 			expect(call.init?.method).toBe("DELETE");
-			expect(call.url).toContain("/api/_platform/market/trust/key?key_id=ojm.test");
+			expect(call.url).toContain("/api/oj-market/trust/key?key_id=ojm.test");
 			expect(process.exitCode).toBe(0);
 
 			process.exitCode = 0;
 			const no = fetchStub({
 				"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-				"/api/_platform/market/trust/key": () => ok({ revoked: false }),
+				"/api/oj-market/trust/key": () => ok({ revoked: false }),
 			});
 			await trustCommand("revoke", ["nope.key"], { ...SITE, fetchFn: no.fetchFn });
 			expect(process.exitCode).toBe(1);
@@ -138,14 +138,14 @@ describe("trustCommand · confirm（P2-3 TOFU 确认链）", () => {
 	it("先展示指纹再调端点：GET task → 打印 key_id + 分组指纹 → POST /market/trust {task_id}", async () => {
 		const { fetchFn, calls } = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-			"/api/_platform/market/task": () => ok(needsTrustTask),
-			"/api/_platform/market/trust": () => ok({ result: "added", key_id: "stranger.pub" }),
+			"/api/oj-market/task": () => ok(needsTrustTask),
+			"/api/oj-market/trust": () => ok({ result: "added", key_id: "stranger.pub" }),
 		});
 		await trustCommand("confirm", [], { ...SITE, task: "install-1-abc", fetchFn });
 		// 调用序：登录 → GET task → POST trust
-		expect(calls[1]?.url).toContain("/api/_platform/market/task?id=install-1-abc");
+		expect(calls[1]?.url).toContain("/api/oj-market/task?id=install-1-abc");
 		expect(calls[2]?.init?.method).toBe("POST");
-		expect(calls[2]?.url).toContain("/api/_platform/market/trust");
+		expect(calls[2]?.url).toContain("/api/oj-market/trust");
 		expect(JSON.parse(String(calls[2]?.init?.body))).toEqual({ task_id: "install-1-abc" });
 		const out = logs.join("\n");
 		expect(out).toContain("stranger.pub");
@@ -157,7 +157,7 @@ describe("trustCommand · confirm（P2-3 TOFU 确认链）", () => {
 	it("任务非 needs_trust → 本地可读报错（不发确认请求）", async () => {
 		const { fetchFn, calls } = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-			"/api/_platform/market/task": () => ok({ ...needsTrustTask, status: "done", trust: undefined }),
+			"/api/oj-market/task": () => ok({ ...needsTrustTask, status: "done", trust: undefined }),
 		});
 		await expect(trustCommand("confirm", [], { ...SITE, task: "install-1-abc", fetchFn })).rejects.toThrow(/不在待信任确认状态/);
 		expect(calls).toHaveLength(2); // 登录 + GET task，无 POST

package/src/lifecycle/__tests__/uninstall.test.ts

@@ -1,6 +1,6 @@
 import process from "node:process";
 // BDD：ojm uninstall 瘦客户端（P1-15a 缺口 B，D6/D8 同款）——纯转发：
-// 登录 → POST /api/_platform/market/uninstall {name} → 打印服务端人话 message；
+// 登录 → POST /api/oj-market/uninstall {name} → 打印服务端人话 message；
 // ok:false（未装/空锁拒启）置 exitCode 1。fetch 全 stub 不真发网络（install.test.ts 同范式）。
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { uninstallCommand } from "../../uninstall";
@@ -42,13 +42,13 @@ describe("uninstallCommand · 卸载瘦客户端（P1-15a 缺口 B）", () => {
 	it("登录后 POST uninstall {name}（Bearer 注入）→ 打印服务端 message", async () => {
 		const { fetchFn, calls } = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-			"/api/_platform/market/uninstall": () => ok({ ok: true, message: "卸载完成：四处同删（demo-solution@0.1.0）" }),
+			"/api/oj-market/uninstall": () => ok({ ok: true, message: "卸载完成：四处同删（demo-solution@0.1.0）" }),
 		});
 		await uninstallCommand("demo-solution", { siteUrl: "http://x", user: "u", pass: "p", fetchFn });
 		// 登录体 + uninstall JSON 体 + Bearer
 		expect(JSON.parse(String(calls[0]?.init?.body))).toEqual({ username: "u", password: "p" });
 		const call = calls[1]!;
-		expect(call.url).toContain("/api/_platform/market/uninstall");
+		expect(call.url).toContain("/api/oj-market/uninstall");
 		expect(call.init?.method).toBe("POST");
 		expect((call.init?.headers as Record<string, string>).authorization).toBe("Bearer tok");
 		expect(JSON.parse(String(call.init?.body))).toEqual({ name: "demo-solution" });
@@ -58,7 +58,7 @@ describe("uninstallCommand · 卸载瘦客户端（P1-15a 缺口 B）", () => {
 	it("ok:false（域逻辑拒绝）→ message 照打 + exitCode 1", async () => {
 		const { fetchFn } = fetchStub({
 			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
-			"/api/_platform/market/uninstall": () => ok({ ok: false, message: "卸载失败：「x」未安装（锁与 sidecar 均无记录）" }),
+			"/api/oj-market/uninstall": () => ok({ ok: false, message: "卸载失败：「x」未安装（锁与 sidecar 均无记录）" }),
 		});
 		const exitBackup = process.exitCode;
 		process.exitCode = 0;

package/src/list.ts

@@ -1,10 +1,10 @@
-// `ojm list`（站点已装方案的可查面）：登录 → GET /api/_platform/market/index → 只挑已装的打表。
+// `ojm list`（站点已装方案的可查面）：登录 → GET /api/oj-market/index → 只挑已装的打表。
 //
 // 为什么需要它：到 0.3.2 为止，CLI **没有任何一条命令能回答「这个站点上装了什么」**——
 // 装完只有一条终态文案，之后要核对版本/启用态得登站点翻市场页。运维与 CI 都需要一个
 // 可脚本化的清单（升级前看谁落后、禁用后确认状态、卸载前确认名字）。
 //
-// 为什么复用 `GET /_platform/market/index` 而不是新增端点：这一条已经把三件事聚合好了——
+// 为什么复用 `GET /oj-market/index` 而不是新增端点：这一条已经把三件事聚合好了——
 // sidecar 里的 installed/enabled、索引里的 latest/available（算 upgradable）、信任库判定
 // 出的 trust_state。新增一个「只列已装」的端点等于让两个真相源各自漂移，而站点侧那边
 // 本来就要维护全量行（市场页在用）。
@@ -59,7 +59,7 @@ function asTrustState(raw: unknown): TrustState {
 
 /** 取一份已装清单（`--all` 时含未装）。不打印、不 exit 的纯函数层，便于 CI 直接在进程内用。 */
 export async function fetchInstalled(fetchFn: typeof fetch, base: string, token: string, all: boolean): Promise<SolutionRow[]> {
-	const rows = await callApi<MarketIndexRow[]>(fetchFn, base, token, "GET", "/api/_platform/market/index");
+	const rows = await callApi<MarketIndexRow[]>(fetchFn, base, token, "GET", "/api/oj-market/index");
 	const out: SolutionRow[] = [];
 	for (const raw of rows) {
 		const name = String(raw.name ?? "").trim();