@oj-module/cli 0.2.69 → 0.2.71

package/src/oj.ts

@@ -21,7 +21,7 @@ import fs from "node:fs";
 import http from "node:http";
 import path from "node:path";
 import process from "node:process";
-import { readOjPluginsDir, readOjPort } from "./oj-config";
+import { readOjPluginsDir, readOjPort, readOjServerField } from "./oj-config";
 import { resolveOjBin } from "./vendor";
 
 /**
@@ -61,6 +61,17 @@ function readLatestLogError(logsDir: string): string {
 	return picked.join("\n").trim();
 }
 
+/**
+ * 健康轮询目标 host：跟随 server.host（用户改绑局域网 IP 时回环探测会永不就绪），
+ * 通配地址（0.0.0.0 / :: / 空）回退 127.0.0.1——通配绑定时回环必然可达。
+ */
+export function healthHostOf(host: string | undefined): string {
+	if (!host)
+		return "127.0.0.1";
+	const trimmed = host.trim();
+	return trimmed === "" || trimmed === "0.0.0.0" || trimmed === "::" ? "127.0.0.1" : trimmed;
+}
+
 export interface OjProcess {
 	port: number
 	/** 健康就绪（或失败拒绝：秒退带 stderr 尾部 / 超时） */
@@ -118,7 +129,7 @@ export function startOj(
 	// clap 拒掉）：历史布局传目录 → `--api-path <dir>`；module-root 布局传**已拼好的
 	// 旗标数组** → `["--module-root", "<project>/src"]`。
 	const apiArgs = Array.isArray(apiSource) ? apiSource : ["--api-path", apiSource];
-	const healthUrl = `http://127.0.0.1:${port}${base}/health`;
+	const healthUrl = `http://${healthHostOf(readOjServerField(configPath, "host"))}:${port}${base}/health`;
 
 	// 插件目录发现显式化：oj 的 resolve_plugins_dir 依赖 current_exe() 启发式，而
 	// Linux glibc 发行包的 bin/oj 是 ld-linux 启动器（exec 加载器而非二进制），

package/src/preview.ts

@@ -28,7 +28,7 @@ import process from "node:process";
 import { loadModulesConfig } from "./config";
 import { resolveConfigPath, resolveLayout } from "./layout";
 import { startOj } from "./oj";
-import { readOjApiPrefix } from "./oj-config";
+import { readOjApiPrefix, readOjServerField } from "./oj-config";
 import { hasRootApiMount, parseMounts, writePreviewConfig } from "./preview-config";
 import { normalizeSiteBase } from "./site-base";
 import { resolveOjBin } from "./vendor";
@@ -119,8 +119,10 @@ export async function runPreview(projectRoot: string, opts: PreviewOptions = {})
 		preview.cleanup();
 		throw error;
 	}
-	console.log(`[ojm] oj 已就绪（release/js，单服务：${base} API + 静态 SPA 同进程）：http://127.0.0.1:${oj.port}`);
-	console.log(`\n[ojm] preview 已启动：http://localhost:${oj.port}${sitePrefix === "/" ? "" : sitePrefix}`);
+	// 提示跟随 config 的 server.host（绑定是 oj 自己做的，提示不能再硬编码 localhost）
+	const host = readOjServerField(preview.configPath, "host") || "127.0.0.1";
+	console.log(`[ojm] oj 已就绪（release/js，单服务：${base} API + 静态 SPA 同进程）：http://${host}:${oj.port}`);
+	console.log(`\n[ojm] preview 已启动：http://${host}:${oj.port}${sitePrefix === "/" ? "" : sitePrefix}`);
 	console.log(`[ojm] 静态由 oj web 挂载直出（spa 深链回落）；派生 config ${path.basename(preview.configPath)} 为本进程临时产物，退出自动清理`);
 
 	// 退出回收：派生 config 必须随 oj 一起消亡（test/integration 断言其不存在）

package/src/publish.ts

@@ -185,7 +185,8 @@ export function recomputeIndex(text: string): string {
 
 /**
  * 索引文件唯一写入口（REG-CS5 原子落盘，红队 F2）：先落 `<路径>.tmp.<pid>.<rand>` 再 `rename`
- * 覆盖。全仓（build-index / publish）只此一条写索引的路径——`grep writeFileSync` 可证没有直写。
+ * 覆盖。全仓只此一条写索引的路径——`grep writeFileSync` 可证没有直写（A6：市场侧索引
+ * 生成器 build-index 已随 DB 目录化退役，本写入口现服务 registry-* 留档面）。
  * 临时文件后缀非 `.yaml`，读取器永不把它当索引；进程被杀最多残留一个 tmp，由下次重建扫掉。
  */
 export function writeIndexFile(file: string, text: string): void {
@@ -266,7 +267,7 @@ export function publishCommand(dir: string, opts: PublishOptions = {}): PublishR
 	for (const no of shardNos)
 		shardSigs.set(no, signIndex("shard", pins.get(no)!, shardTexts.get(no)!, privateKeyPem, keyId));
 
-	// 原子落盘，顺序固定「先分片 → 再 catalog」（catalog 是提交点；与 build-index 同一纪律）
+	// 原子落盘，顺序固定「先分片 → 再 catalog」（catalog 是提交点）
 	// `--dry-run`：同一份计算、同一个顺序，只是不执行写——写盘清单照常返回，CI 可先比对
 	const writes: string[] = [];
 	for (const no of shardNos) {

package/src/scaffold-guard.ts

@@ -132,6 +132,10 @@ export function collectDefaultModuleDrift(projectRoot: string): ScaffoldDrift |
 	if (!guardEnabled(projectRoot))
 		return null;
 	const templatesDir = templatesRoot();
+	// 工程即 cli 包内 templates 自身（上游源仓）：基线 == 自身，比较无意义
+	// （白名单外的 demo-only 文件在 extra 轴上必误报），直接放行
+	if (path.resolve(projectRoot) === path.resolve(templatesDir))
+		return null;
 	const expected = protectedTemplateFiles(templatesDir, readInitInclude(templatesDir));
 	const expectedSet = new Set(expected);
 	const drift: ScaffoldDrift = { modified: [], missing: [], extra: [] };

package/src/site.ts

@@ -152,7 +152,7 @@ export async function pollTask(fetchFn: typeof fetch, base: string, token: strin
 	let interval = interval0;
 	let waited = 0;
 	for (;;) {
-		const record = await callApi<TaskRecord>(fetchFn, base, token, "GET", `/api/_platform/market/task?id=${encodeURIComponent(taskId)}`);
+		const record = await callApi<TaskRecord>(fetchFn, base, token, "GET", `/api/oj-market/task?id=${encodeURIComponent(taskId)}`);
 		if (isTerminal(record.status))
 			return record;
 		if (waited + interval > timeoutMs)

package/src/trust.ts

@@ -1,8 +1,8 @@
 // ojm trust（P2-2，C2-38/39，G3 双轨第一轨 / G5）：宿主信任库运维瘦客户端。
 // 子命令：
-//   ojm trust ls                                  —— 列表（GET  /api/_platform/market/trust）
-//   ojm trust add <key_id> <pubkey_hex>           —— 新增信任（POST /api/_platform/market/trust/key）
-//   ojm trust revoke <key_id>                     —— 吊销（DELETE /api/_platform/market/trust/key?key_id=）
+//   ojm trust ls                                  —— 列表（GET  /api/oj-market/trust）
+//   ojm trust add <key_id> <pubkey_hex>           —— 新增信任（POST /api/oj-market/trust/key）
+//   ojm trust revoke <key_id>                     —— 吊销（DELETE /api/oj-market/trust/key?key_id=）
 //   ojm trust confirm --task <task_id>            —— TOFU 确认（P2-3）：先展示指纹再调 POST /market/trust
 // 本地零状态，纯转发（uninstall.ts 同款）；operator 由站点侧按登录用户反查，CLI 不传。
 import { Buffer } from "node:buffer";
@@ -79,7 +79,7 @@ export async function trustCommand(sub: string, args: string[], opts: TrustOptio
 	const token = await login(fetchFn, base, user, pass);
 	switch (sub) {
 		case "ls": {
-			const result = await callApi<{ keys: TrustKeyRow[], note: string | null }>(fetchFn, base, token, "GET", "/api/_platform/market/trust");
+			const result = await callApi<{ keys: TrustKeyRow[], note: string | null }>(fetchFn, base, token, "GET", "/api/oj-market/trust");
 			if (result.note)
 				console.log(`[ojm] 注意：${result.note}`);
 			printRows(result.keys ?? []);
@@ -87,13 +87,13 @@ export async function trustCommand(sub: string, args: string[], opts: TrustOptio
 		}
 		case "add": {
 			const [keyId, publicKey] = args;
-			const result = await callApi<{ result: "added" | "exists_same" }>(fetchFn, base, token, "POST", "/api/_platform/market/trust/key", { key_id: keyId, public_key: publicKey });
+			const result = await callApi<{ result: "added" | "exists_same" }>(fetchFn, base, token, "POST", "/api/oj-market/trust/key", { key_id: keyId, public_key: publicKey });
 			console.log(result.result === "added" ? `[ojm] 已信任发布方：${keyId}` : `[ojm] 该 key_id 已在信任库且公钥一致（无需重复添加）：${keyId}`);
 			break;
 		}
 		case "revoke": {
 			const [keyId] = args;
-			const result = await callApi<{ revoked: boolean }>(fetchFn, base, token, "DELETE", `/api/_platform/market/trust/key?key_id=${encodeURIComponent(keyId)}`);
+			const result = await callApi<{ revoked: boolean }>(fetchFn, base, token, "DELETE", `/api/oj-market/trust/key?key_id=${encodeURIComponent(keyId)}`);
 			console.log(result.revoked ? `[ojm] 已吊销：${keyId}（已装方案继续运行，新装/升级将被拒）` : `[ojm] 信任库中无此 key_id：${keyId}`);
 			if (!result.revoked)
 				process.exitCode = 1;
@@ -102,13 +102,13 @@ export async function trustCommand(sub: string, args: string[], opts: TrustOptio
 		case "confirm": {
 			const taskId = opts.task!.trim();
 			// 先取任务记录展示指纹（防「确认 A、落 B」：人看到的与服务端入信任库的同源）
-			const rec = await callApi<{ id: string, status: string, name: string, version: string, trust?: { key_id: string, public_key: string, fingerprint: string } }>(fetchFn, base, token, "GET", `/api/_platform/market/task?id=${encodeURIComponent(taskId)}`);
+			const rec = await callApi<{ id: string, status: string, name: string, version: string, trust?: { key_id: string, public_key: string, fingerprint: string } }>(fetchFn, base, token, "GET", `/api/oj-market/task?id=${encodeURIComponent(taskId)}`);
 			if (rec.trust === undefined || rec.status !== "needs_trust")
 				throw new Error(`[ojm] 任务 ${taskId} 不在待信任确认状态（status=${rec.status}）——无需确认`);
 			console.log(`[ojm] 待信任发布方：${rec.trust.key_id}`);
 			console.log(`[ojm] 指纹（sha256(publicKey)，请与发布方公布值逐字核对）：${formatFingerprint(rec.trust.fingerprint)}`);
 			console.log("[ojm] 确认即把该公钥加入宿主信任库（首次绑定不可改；吊销只阻断新装/升级，不动已装方案）");
-			const result = await callApi<{ result: "added" | "exists_same", key_id: string }>(fetchFn, base, token, "POST", "/api/_platform/market/trust", { task_id: taskId });
+			const result = await callApi<{ result: "added" | "exists_same", key_id: string }>(fetchFn, base, token, "POST", "/api/oj-market/trust", { task_id: taskId });
 			console.log(result.result === "added" ? `[ojm] 已信任发布方：${result.key_id}——重试安装命令即可继续（CDN 源重试自动重下，file 源重传包体与 .sig）` : `[ojm] 该发布方已在信任库：${result.key_id}——直接重试安装即可`);
 			break;
 		}

package/src/uninstall.ts

@@ -1,4 +1,4 @@
-// ojm uninstall（P1-15a，缺口 B）：卸载瘦客户端——POST /api/_platform/market/uninstall
+// ojm uninstall（P1-15a，缺口 B）：卸载瘦客户端——POST /api/oj-market/uninstall
 // 触发站点侧 runUninstall 四处同删（锁/sidecar/sys_solution_route/modules.json + 权限级联）。
 // 本地零状态，纯转发（enable.ts 同款）；operator 由站点侧按登录用户反查，CLI 不传。
 //
@@ -34,7 +34,7 @@ export async function uninstallCommand(name: string, opts: UninstallOptions = {}
 	const { base, user, pass } = resolveSite(opts);
 	const token = await login(fetchFn, base, user, pass);
 	console.log(`[ojm] 该包来自站点 ${base} 的已装清单（卸载不涉及仓库源）`);
-	const result = await callApi<{ ok: boolean, message: string }>(fetchFn, base, token, "POST", "/api/_platform/market/uninstall", { name: name.trim() });
+	const result = await callApi<{ ok: boolean, message: string }>(fetchFn, base, token, "POST", "/api/oj-market/uninstall", { name: name.trim() });
 	console.log(`[ojm] ${result.message}`);
 	if (!result.ok)
 		process.exitCode = 1;

package/src/usage.ts

@@ -265,8 +265,8 @@ export const HELP_GROUPS: HelpGroup[] = [
 					{ raw: "--json", zh: "stdout 只放一份 JSON 信封（人话改走 stderr）", en: "Emit a single JSON envelope on stdout (human lines move to stderr)" },
 				],
 				detail: {
-					zh: "ojm list [--site-url <u>] [--user <u>] [--pass <p>] [--all] [--json]\n  读 GET /api/_platform/market/index（superadmin）：只挑已装的行，打「名字 / 已装版本 / 启用态 / 最新版 / 可升级 / 签名可信」\n  --all 连未安装的索引行一起列（installed 显示 -）；升级前看谁落后、禁用后确认状态、卸载前确认名字都靠它\n  退出码：0 成功（清单为空也是 0）/ 1 站点报错 / 2 用法错误（缺凭据）",
-					en: "ojm list [--site-url <u>] [--user <u>] [--pass <p>] [--all] [--json]\n  Reads GET /api/_platform/market/index (superadmin) and keeps installed rows only: name / installed / enabled / latest / upgradable / trust\n  --all also lists index rows that are not installed (installed shows -); use it before upgrading, after disabling, or before uninstalling\n  Exit codes: 0 success (an empty list is still 0) / 1 site error / 2 usage error (missing credentials)",
+					zh: "ojm list [--site-url <u>] [--user <u>] [--pass <p>] [--all] [--json]\n  读 GET /api/oj-market/index（superadmin）：只挑已装的行，打「名字 / 已装版本 / 启用态 / 最新版 / 可升级 / 签名可信」\n  --all 连未安装的索引行一起列（installed 显示 -）；升级前看谁落后、禁用后确认状态、卸载前确认名字都靠它\n  退出码：0 成功（清单为空也是 0）/ 1 站点报错 / 2 用法错误（缺凭据）",
+					en: "ojm list [--site-url <u>] [--user <u>] [--pass <p>] [--all] [--json]\n  Reads GET /api/oj-market/index (superadmin) and keeps installed rows only: name / installed / enabled / latest / upgradable / trust\n  --all also lists index rows that are not installed (installed shows -); use it before upgrading, after disabling, or before uninstalling\n  Exit codes: 0 success (an empty list is still 0) / 1 site error / 2 usage error (missing credentials)",
 				},
 			},
 			{
@@ -462,8 +462,8 @@ export const HELP_GROUPS: HelpGroup[] = [
 			{
 				key: "market",
 				name: "market [sub] [...rest]",
-				zh: "本地模拟 CDN 与市场链路（setup / publish / build-index / verify / trial）",
-				en: "Local mock CDN and marketplace pipeline (setup / publish / build-index / verify / trial)",
+				zh: "市场链路（setup / publish 远端签名推送 / yank / verify / trial / walkthrough）",
+				en: "Marketplace pipeline (setup / remote signed publish / yank / verify / trial / walkthrough)",
 				allowUnknownOptions: true,
 				options: [
 					{ raw: "--site-url <url>", zh: "站点地址", en: "Site URL" },
@@ -472,38 +472,40 @@ export const HELP_GROUPS: HelpGroup[] = [
 					{ raw: "--new-pass <pass>", zh: "首次改密期的新密码（setup）", en: "New password during the forced-reset period (setup)" },
 					{ raw: "--fixture <name@version>", zh: "合成 fixture 方案包（publish / trial）", en: "Synthesize a fixture bundle (publish / trial)" },
 					{ raw: "--real <project>", zh: "走真实方案工程发包（publish）", en: "Publish from a real solution project (publish)" },
-					{ raw: "--id <key>", zh: "签名 key id", en: "Signing key id" },
+					{ raw: "--id <key>", zh: "签名 key id（publish / yank 的发布身份）", en: "Signing key id (publisher identity for publish / yank)" },
 					{ raw: "--key <pem>", zh: "签名私钥 pem", en: "Signing private key pem" },
-					{ raw: "--rebuild-index", zh: "发包后顺带重建索引（publish）", en: "Rebuild the index after publishing (publish)" },
+					{ raw: "--registry-id <registry>", zh: "签发方 registry 身份（包级签名 canonical 首段）", en: "Signer registry identity (first segment of the package signature canonical)" },
+					{ raw: "--reason <原因>", zh: "下线原因（yank 审计留痕）", en: "Yank reason (audit trail)" },
+					{ raw: "--restore", zh: "恢复在架（yank 的反向操作）", en: "Restore to listing (reverse of yank)" },
 					{ raw: "--check", zh: "离线自检签名", en: "Offline signature self-check" },
 				],
 				subs: {
-					"setup": {
+					setup: {
 						short: { zh: "framework.market_cdn_url 指向外部真 CDN（脚手架缺省 /cdn 免 setup）", en: "Point framework.market_cdn_url at an external CDN (scaffold defaults to /cdn, no setup needed)" },
 						zh: "ojm market setup [--site-url <站点地址>] [--user <u> --pass <p>] [--new-pass <p>]\n  把系统设置 framework.market_cdn_url 改写为绝对地址（外部真 CDN 场景；脚手架 seed 缺省 /cdn = 本站点自供，免 setup）。首跑若账号处于首次改密期（seed admin must_change=1），会自动改密换全权 token 后再写入",
 						en: "ojm market setup [--site-url <site>] [--user <u> --pass <p>] [--new-pass <p>]\n  Rewrite the framework.market_cdn_url system setting to an absolute URL (external CDN scenario; the scaffold seed defaults to /cdn = site-served, no setup needed). On first run, if the account is in the forced password-reset period (seed admin must_change=1), it resets the password to obtain a full-privilege token before writing",
 					},
-					"publish": {
-						short: { zh: "方案包落进 cdn/ + 包级签名（不碰索引）", en: "Drop a bundle into cdn/ + package-level signature (index untouched)" },
-						zh: "ojm market publish [--fixture <name@version>] [--real <方案工程>] [--id <key>] [--key <pem>] [--rebuild-index] [--check]\n  把方案包落进 cdn/：合成 fixture（或 --real 走 ojm build --bundle）→ 确定性 tgz → 包级 detached 签名 <name>-<version>.tgz.sig。不碰索引（索引由 build-index 扫描重建，多人发布才不会互相覆盖）",
-						en: "ojm market publish [--fixture <name@version>] [--real <project>] [--id <key>] [--key <pem>] [--rebuild-index] [--check]\n  Drop a solution bundle into cdn/: synthesize a fixture (or --real via ojm build --bundle) → deterministic tgz → package-level detached signature <name>-<version>.tgz.sig. Does not touch the index (the index is rebuilt by build-index so concurrent publishers don't overwrite each other)",
+					publish: {
+						short: { zh: "远端签名推送发布到目标站点市场（不经账号口令）", en: "Publish to a target site's market via signed push (no account credentials)" },
+						zh: "ojm market publish --site-url <url> [--fixture <name@version> | --real <方案工程>] --id <key> [--key <pem>] --registry-id <registry> [--check]\n  构建 + 包级签名后经签名推送发进目标站点市场：catalog 探测站点身份（registry_id）→ 先推 .sig 旁车再推 .tgz（pair 约束）→ 服务端重算 sha256 验签落库（market_release 目录行 + cdn/ 字节）。半成功（sig 已推 tgz 被拒）重跑本命令幂等补齐。签名身份 = ojm keygen --credential 兑换的发布 key（须经站点信任库）",
+						en: "ojm market publish --site-url <url> [--fixture <name@version> | --real <project>] --id <key> [--key <pem>] --registry-id <registry> [--check]\n  Build + package-sign, then signed-push into the target site's market: discover the site identity via catalog (registry_id) → push the .sig sidecar before the .tgz (pair constraint) → the server recomputes sha256, verifies the signature and lands the row (market_release catalog row + cdn/ bytes). Half-success (sig pushed, tgz rejected): re-run this command to idempotently complete. Signing identity = publish key exchanged via ojm keygen --credential (must be in the site trust store)",
 					},
-					"build-index": {
-						short: { zh: "扫描重建三级索引（catalog + shards）并签名", en: "Rebuild the three-tier index (catalog + shards) from a scan and sign" },
-						zh: "ojm market build-index [--id <key>] [--key <pem>] [--check]\n  扫描 cdn/*.tgz、提取包内 manifest，全量重建 catalog.yaml（包名→分片号）+ shards/<n>.yaml（每片 ≤1000 版本）并签名。原子落盘（先分片后 catalog）；结果只取决于目录内容：连续执行字节一致",
-						en: "ojm market build-index [--id <key>] [--key <pem>] [--check]\n  Scan cdn/*.tgz, extract each bundle's manifest, fully rebuild catalog.yaml (name→shard) + shards/<n>.yaml (≤1000 versions each) and sign them. Atomic landing (shards before catalog); the result depends only on directory content: consecutive runs are byte-identical",
+					yank: {
+						short: { zh: "签名下线/恢复某版本（仅发布者本人）", en: "Signed yank/restore of a version (publisher only)" },
+						zh: "ojm market yank <name>@<version> --site-url <url> --id <key> [--key <pem>] [--reason <原因>] [--by <操作人>] [--restore]\n  签名下线（或 --restore 恢复）目标站点市场目录里的某版本：清单即摘除、详情保留 yanked 标记、阻断新装/升级；不动已装方案。仅该行发布者本人可操作（服务端按行 key_id 仲裁）；重复下线幂等",
+						en: "ojm market yank <name>@<version> --site-url <url> --id <key> [--key <pem>] [--reason <reason>] [--by <operator>] [--restore]\n  Signed-yank (or --restore) a version in the target site's market catalog: removed from listing, kept in detail with yanked flag, new installs/upgrades blocked; already-installed solutions untouched. Only the row's publisher may operate (server arbitrates by row key_id); repeated yank is idempotent",
 					},
-					"verify": {
-						short: { zh: "离线验包（sha256 / 验签 / 索引 / manifest 结构）", en: "Offline bundle verification (sha256 / signatures / index / manifest)" },
-						zh: "ojm market verify [--file <tgz>] [--rebuild-index]\n  离线验包（不起站点、不装、不要凭据）：sha256 完整性 / 包级 Ed25519 验签 / 索引验签（catalog 与各分片分列）/ manifest 结构分列输出。--rebuild-index 额外双向比对「扫描重建的索引」与盘上索引：既报落了包却没重建（索引缺条目），也报索引声明了、盘上包却没了的反向漂移。注意：校验通过只说明来源与完整性，不构成内容安全性背书",
-						en: "ojm market verify [--file <tgz>] [--rebuild-index]\n  Offline bundle verification (no site, no install, no credentials): sha256 integrity / package-level Ed25519 signature / index signature (catalog and each shard listed separately) / manifest structure in separate sections. --rebuild-index additionally runs a two-way comparison of the index rebuilt from a scan against the one on disk: it reports both a dropped bundle whose index entry is missing, and the reverse drift where the index declares a version whose tgz is gone. Note: passing only proves origin and integrity — it is not an endorsement of content safety",
+					verify: {
+						short: { zh: "离线验包（包级验签 + manifest 结构）", en: "Offline bundle verification (package signature + manifest structure)" },
+						zh: "ojm market verify [--file <tgz>]\n  离线验包（不起站点、不装、不要凭据）：包级 Ed25519 detached 验签（信任锚）+ manifest 结构（必填字段 / 原生清单 desc / 0001 迁移跨版本一致）。注意：校验通过只说明来源与完整性，不构成内容安全性背书",
+						en: "ojm market verify [--file <tgz>]\n  Offline bundle verification (no site, no install, no credentials): package-level Ed25519 detached signature (trust anchor) + manifest structure (required fields / native manifest desc / 0001 migration consistency across versions). Note: passing only proves origin and integrity — it is not an endorsement of content safety",
 					},
-					"trial": {
+					trial: {
 						short: { zh: "一次性隔离站点试装，跑完即毁", en: "Full install trial in a throwaway isolated site" },
 						zh: "ojm market trial [--fixture <name@version>] [--keep]\n  在一次性隔离站点（随机端口 + 一次性 DB/密钥/凭据/信任库/CDN）里跑完整安装，跑完即毁；--keep 保留现场供排查",
 						en: "ojm market trial [--fixture <name@version>] [--keep]\n  Run a full install in a throwaway isolated site (random port + throwaway DB/keys/credentials/trust store/CDN), destroyed right after; --keep preserves the scene for debugging",
 					},
-					"walkthrough": {
+					walkthrough: {
 						short: { zh: "隔离站点跑全套市场操作并出 AC 表", en: "Run the full marketplace operation set in an isolated site, print an AC table" },
 						zh: "ojm market walkthrough [--only <op>] [--strict] [--keep]\n  隔离站点跑全套市场操作并出 AC 表",
 						en: "ojm market walkthrough [--only <op>] [--strict] [--keep]\n  Run the full marketplace operation set in an isolated site and print an AC table",

package/templates/config.yaml

@@ -110,7 +110,10 @@ vars:
   wecom_base_url: ''
 
 platform:
-  modules: [_platform] # 安装器热更 config 需要 _platform 特权；删了会在装到最后一步报 NotCapable
+  # 安装器热更 config 需要 platform 特权（reloadConfig/信任库写面）；编排面自 Phase B 起在
+  # oj-market 模块（/api/oj-market/*），与 _platform 同权——缺 oj-market 时装到 reloading
+  # 段 NotCapable（2026-11-07 市场线演练实锤）。
+  modules: [_platform, oj-market]
   root: src # 后端模块源码根（src/<name>/api 的父目录）；preview 派生 config 时改写成 dist
   # ⚠️ 手写部署（不用 ojm，靠 mounts 起站）时：root 必须等于 api 挂载目录，
   # 否则 oj serve 直接拒启 `platform.root (…) must be mounted as an api mount`。
@@ -123,10 +126,14 @@ platform:
   # 下面三条命令与安装器逐字对齐（含每个空格），一个 token 都不能动：
   exec:
     _platform:
-      allow:
+      allow: &INSTALLER_EXEC_ALLOW
         - 'tar -tvzf ${path:archive}'
         - 'tar -xzf ${path:archive} -C ${path:dest}'
         - 'oj migrate --format json -d ${path:dir} ${raw:module}'
+    # 市场编排面（src/oj-market/api，端点在 /api/oj-market/*）与 _platform 用同一安装器，
+    # 请求模块上下文 = oj-market（oj exec 按模块逐条授权）——缺这条真机安装/收敛全 NotCapable。
+    oj-market:
+      allow: *INSTALLER_EXEC_ALLOW
 
 # 安装器落盘面：解包到 modules/.staging、写 dist/modules、备份 db.sqlite，全在 config 目录内。
 # 缺这段会 NotCapable，且症状很阴：安装提交返回 200，但 task 查询恒 404。
@@ -159,6 +166,15 @@ auth:
     - /auth/wecom/ticket # 一次性票据换 TokenBundle：票据本身就是「刚验过的登录证明」
     - /auth/wecom/event # 企微指令回调：靠 msg_signature 验签，不走 Bearer
     - /publish/credential/exchange # 凭证换发布身份：凭证自身即持有型证明，CLI 可能没有账号密码
+    # —— 方案市场匿名面（v4 §五：签名制不经账号口令，企微用户无障碍）——
+    # catalog 匿名读：站点身份发现面（registry_id）+ CLI 2×2 兼容矩阵探测（旧站点无此 API → 404 → 人话）
+    # cdn/upload 签名推送：X-OJM-Key-Id / X-OJM-Signature 即凭证（信任库 + Ed25519），不经 Bearer
+    # yank 签名下线：同凭证制——漏列则 oj-auth 守卫在 handler 前硬 401，签名永无到达之日（终审 C1 修补）
+    # `**` 跨段（≥0 段，oj-auth v0.1.20 语义）：一条同盖 catalog 与 catalog/detail
+    # 生效口径：config.yaml 启动冻结段，改后须重启（restart_pending）
+    - /oj-market/catalog/**
+    - /oj-market/cdn/upload
+    - /oj-market/yank
 
 # 多租户（企微代开发 v3 Phase 0）：开启后所有 {base} 请求必须带 X-TENANT-ID，否则 400。
 # 前端由 tenantStore + headerProvider 统一注入（单租户部署恒为 default，UX 不变）。
@@ -180,7 +196,6 @@ tenant:
     - sys_login_throttle # 登录节流（登录前就要用）
     - market_history # 解决方案安装/升级/回滚是站点级留痕
     - market_release # 发布历史：CDN 是站点级的，历史按站点归口
-    - reg_source_seq # 索引新鲜度水位属于站点（防回放）
     - wecom_app_profile # 企微 corp→租户映射权威：查它时必然还没有租户上下文（D9）
     - wecom_suite_ticket # 套件级凭证，按 suite_id 全局唯一
     - wecom_login_ticket # 一次性登录票据：跨「匿名 302 回跳」与「已认证换取」两段
@@ -198,6 +213,10 @@ tenant:
     - /auth/wecom/ticket # 一次性票据换会话：租户由票据行携带
     - /auth/wecom/event # 企微指令回调：验签+解密即认证，无租户语义
     - /publish/credential/exchange # 凭证兑换：CLI 的裸 fetch 不带租户头；表本身是共享表（B 组）
+    # 市场匿名面同列（CLI 推送/下线/发现的裸 fetch 不带租户头；与 auth.anonymous_paths 同条目）
+    - /oj-market/catalog/**
+    - /oj-market/cdn/upload
+    - /oj-market/yank
   # tenant.require_signed_claim：租户头的服务端绑定（平台级 fail-closed）。
   # 暂保持 false——上游 oj 的 jwt.sign 目前会静默丢弃自定义 claim（需求 R6），
   # 开启前无法把 tenant 放进 token。R6 落地后改 true，裸头即失去自证能力。

package/templates/init.include.yaml

@@ -83,6 +83,8 @@ include:
   - tests/users-page.spec.ts
   # 企微连接器与组织同步：源码本就分发（src/app/api/auth），对应回归也必须跟着走，
   # 否则用户工程升级后改配置/换套件时没有任何本地自检手段。
+  # 方案安装入口（Phase B T3）的纯函数钉测：零基建依赖，随源码下发
+  - tests/solutions-entry.spec.ts
   - tests/wecom-admin.spec.ts
   - tests/wecom-client-timeout.spec.ts
   - tests/wecom-connector.spec.ts
@@ -92,6 +94,8 @@ include:
   - tests/wecom-org-sync.spec.ts
   - tests/wecom-sync.spec.ts
   - tests/lifecycle/atomic-state.spec.ts
+  # bundle 启动收敛上拉不下拉规则（Phase B T3b）：纯函数零基建依赖
+  - tests/lifecycle/bundle-converge.spec.ts
   - tests/lifecycle/deploy-smoke.spec.ts
   - tests/lifecycle/migrate.spec.ts
   - tests/lifecycle/register.spec.ts
@@ -129,15 +133,16 @@ include:
   - src/app/web/notification
   - src/app/web/personal-center
   - src/app/web/system
-  # 解决方案市场：默认第一方能力。逐子路径收录——__tests__ 不进脚手架
-  # （用户工程无 web 侧 vitest 基建，拷了是死文件）
-  - src/oj-market/web/entry.ts
-  - src/oj-market/web/types.ts
-  - src/oj-market/web/api
-  - src/oj-market/web/components
-  - src/oj-market/web/hooks
-  - src/oj-market/web/locales
-  - src/oj-market/web/pages
-  - src/oj-market/web/publish
-  - src/oj-market/web/utils
+  # 解决方案市场（Phase B T2 起「出厂未装」分层）：api 编排面（install/catalog/
+  # yank/trust 推送/cdn upload/backfill）随脚手架内置——市场 UI 未装/已卸载时
+  # 端点仍在（方案 §2「安装入口（市场外）」），system 域安装入口经它接线。
+  # v4 api 迁移（42369d5b6）漏收白名单致脚手架零 /api/oj-market/*——本条补上。
+  - src/oj-market/api
+  # 市场 UI 是纯 web 方案包（src/oj-market/solution.yaml，ojm build --bundle oj-market），
+  # superadmin 首装后由安装器 deploy-web 供给——页面源码不进脚手架。
+  # 唯独两份 __client 生成物照拷：openapi.json 含 /api/oj-market/*（api 内置），
+  # ojm api --check 的生成物对账需要落点（同 app/web/_platform 先例；publish
+  # 契约的生成物归属 oj-market 随发布页走包，用户工程只需文件在场）
+  - src/oj-market/web/__client
+  - src/oj-market/web/publish/__client
   - src/app/web/web