feat: 上线前安全加固与发布工程化；appmall 由插件迁移为独立应用

安全（P0）
- 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、
  ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签
  （ywxapp.framework_package_verify，默认开启）
- JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret()
  校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET
- /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验
- 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流
- TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive
- 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php）
- 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis
- paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG

工程化 / 交付
- 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本
- 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过
- 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障
- .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess

结构
- appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）

addon/appmall/Addon.php

@@ -1,119 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp [ WE CAN DO IT JUST THINK ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-
-declare(strict_types=1);
-
-namespace addon\appmall;
-
-use think\facade\Config;
-use think\facade\Db;
-use ywxapp\Addons;
-use ywxapp\model\BaseModel;
-
-/**
- * 插件应用市场（服务端）
- *
- * 把原核心里的「插件商店服务端」整体剥离为独立插件，部署在中心站（插件服务器）。
- * 安装时由框架自动导入 install.sql 建表（appmall_addon_list / appmall_addon_submissions / appmall_developers）；
- * 卸载时清理这些服务端表。
- */
-class Addon extends Addons
-{
-    
-    public function install(): bool
-    {
-        return true;
-    }
-
-    
-    public function uninstall(): bool
-    {
-        // 与 install.sql 表名前缀严格对齐（wxapp_appmall_*），
-        // 直接复用统一前缀，避免依赖 database.prefix 配置（install.sql 为硬写前缀）。
-        $prefix = 'wxapp_appmall_';
-        $tables = [
-            'addon_list',            // 插件市场商品表
-            'addon_submissions',     // 提交审核表
-            'developers',            // 开发者表
-            'addon_revenues',        // 收益账本
-            'addon_withdrawals',     // 提现单
-            'addon_licenses',        // 授权表
-            'addon_orders',          // 购买订单表
-            'addon_download_logs',   // 下载日志表
-            'sites',                 // 客户端站点（授权绑定维度）
-            'framework_list',        // 主框架版本表
-            'framework_download_log',// 主框架下载日志表
-            'throttle',              // 接口频率限制表
-        ];
-        foreach ($tables as $t) {
-            try {
-                Db::execute("DROP TABLE IF EXISTS `{$prefix}{$t}`");
-            } catch (\Exception $e) {
-                // 忽略
-            }
-        }
-        return true;
-    }
-
-    /**
-     * 升级时确保全部表存在（读 install.sql，CREATE TABLE IF NOT EXISTS 幂等建表）。
-     * 单一事实源 = install.sql，避免复制 DDL 导致漂移。
-     */
-    private function ensureTablesFromInstallSql(): void
-    {
-        $sqlFile = __DIR__ . DIRECTORY_SEPARATOR . 'install.sql';
-        if (!is_file($sqlFile)) {
-            return;
-        }
-        $content = (string) file_get_contents($sqlFile);
-        $content = preg_replace('/--.*|\/\*[\s\S]*?\*\//', '', $content);
-        $stmts = array_filter(
-            array_map('trim', explode(';', $content)),
-            function ($s) {
-                return strlen($s) > 5 && preg_match('/^CREATE\s+TABLE/i', $s);
-            }
-        );
-        foreach ($stmts as $sql) {
-            if (preg_match('/CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?`?([\w]+)`?/i', $sql, $m)) {
-                BaseModel::ensureTable($m[1], $sql);
-            }
-        }
-    }
-
-    /**
-     * 升级钩子（在线升级 / 后台手动升级均会触发）。
-     *
-     * 在线升级(AddonService::onlineUpgrade)已重导 install.sql 补全表；
-     * 但「已存在表新增列」install.sql 无力（CREATE TABLE IF NOT EXISTS 对已有表无效）。
-     * 此处作为升级收敛点：确保全部表存在 + 对已知易漂移列做幂等补列兜底。
-     * 未来新增列统一在 $columnFixes 登记，避免各控制器重复 ALTER 导致 DDL 漂移。
-     *
-     * @param string $currentVersion 升级前版本号
-     */
-    public function upgrade($currentVersion = ''): bool
-    {
-        // 1) 确保全部表存在（幂等，单一事实源 install.sql）
-        $this->ensureTablesFromInstallSql();
-
-        // 2) 补列兜底：'完整表名(含前缀)' => ['列名' => '列定义']
-        //    BaseModel::ensureColumn 先探测存在性，重复执行安全。
-        $prefix = 'wxapp_appmall_';
-        $columnFixes = [
-            $prefix . 'addon_download_logs' => [
-                'operator_id' => "int unsigned NOT NULL DEFAULT 0 COMMENT '运营后台下载审计（0=会员自助下载）'",
-            ],
-        ];
-        foreach ($columnFixes as $table => $cols) {
-            foreach ($cols as $column => $def) {
-                BaseModel::ensureColumn($table, $column, $def);
-            }
-        }
-        return true;
-    }
-}

addon/appmall/config.php

@@ -1,97 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp [ WE CAN DO IT JUST THINK ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-// | 应用市场（appmall）后台「插件配置」表单字段定义。
-// | 仅描述「哪些字段可编辑 + 表单默认值」；真正的运行期默认以
-// | config/appmall.php 为准，数据库保存值最高优先级覆盖。
-// | 注意：radio/select 的 value 须为字符串（'1'/'0'）以正确预选，
-// |       代码读取处统一 (bool) 强转，本文件不负责类型。
-// +----------------------------------------------------------------------
-
-return [
-    // ===== 市场基础设置 =====
-    [
-        'name'    => 'appmall_name',
-        'title'   => '市场名称',
-        'type'    => 'string',
-        'value'   => 'YwxApp 应用市场',
-        'tip'     => '显示在开发者注册页标题等位置',
-    ],
-    [
-        'name'    => 'allow_register',
-        'title'   => '开放开发者自助注册',
-        'type'    => 'radio',
-        'options' => ['1' => '开放', '0' => '关闭'],
-        'value'   => '1',
-        'tip'     => '关闭后仅运营手动创建开发者',
-    ],
-    [
-        'name'    => 'need_approval',
-        'title'   => '注册后需审核',
-        'type'    => 'radio',
-        'options' => ['1' => '需要', '0' => '注册即激活'],
-        'value'   => '1',
-        'tip'     => '需要审核时令牌经邮件下发',
-    ],
-    [
-        'name'    => 'allow_upload',
-        'title'   => '允许后台上传发布核心包',
-        'type'    => 'radio',
-        'options' => ['1' => '允许', '0' => '关闭'],
-        'value'   => '1',
-        'tip'     => '关闭后仅能通过数据库/命令行维护主框架版本',
-    ],
-
-    // ===== 官方市场发布（主动推送到 www.ywxapp.cn 公共市场）=====
-    [
-        'name'    => 'developer_token',
-        'title'   => '官方市场开发者令牌',
-        'type'    => 'textarea',
-        'value'   => env('APPMARKET_DEV_TOKEN', ''),
-        'tip'     => '把插件发布到官方公共市场(www.ywxapp.cn)所需令牌，由官方运营分配；留空则后台「发布到官方市场」会提示先配置。也可在 .env 设 APPMARKET_DEV_TOKEN。',
-    ],
-    [
-        'name'    => 'developer_name',
-        'title'   => '开发者名称',
-        'type'    => 'string',
-        'value'   => env('APPMARKET_DEV_NAME', ''),
-        'tip'     => '可选，开发者展示名；对应 .env 的 APPMARKET_DEV_NAME。',
-    ],
-
-    // ===== 远程市场 / 中心站客户机模式（仅当 ywxapp.api_url 指向其他服务器时生效）=====
-    [
-        'name'    => 'remote_token',
-        'title'   => '远程市场共享密钥',
-        'type'    => 'textarea',
-        'value'   => env('APPMARKET_REMOTE_TOKEN', ''),
-        'tip'     => '「谁是中心站」由 config/ywxapp.php 的 api_url 决定（留空=本机即中心站）。仅当 api_url 指向其他服务器（本机作客户机）时需要：与中心站 appmall.remote_token 一致的共享密钥；单站点中心站模式留空即可。',
-    ],
-    [
-        'name'    => 'ssl_verify',
-        'title'   => '远程市场 SSL 证书验证',
-        'type'    => 'select',
-        'options' => ['1' => '严格验证（推荐）', '0' => '跳过验证（仅自托管/排障）'],
-        'value'   => env('APPMARKET_SSL_VERIFY', true) ? '1' : '0',
-        'tip'    => '连接远程市场时的 SSL 校验；跳过验证存在中间人风险；对应 .env 的 APPMARKET_SSL_VERIFY。',
-    ],
-    [
-        'name'    => 'commission_rate',
-        'title'   => '平台抽成比例（0~1）',
-        'type'    => 'number',
-        'value'   => env('APPMARKET_COMMISSION_RATE', 0.2),
-        'tip'     => '开发者收益 = 订单金额 * (1 - 该比例)；对应 .env 的 APPMARKET_COMMISSION_RATE。',
-    ],
-    [
-        'name'    => 'security_scan',
-        'title'   => '提交包安全扫描',
-        'type'    => 'select',
-        'options' => ['1' => '开启', '0' => '关闭'],
-        'value'   => env('APPMARKET_SECURITY_SCAN', true) ? '1' : '0',
-        'tip'     => '发布到官方/远程市场前对 PHP 包做语法 + 高危函数扫描；对应 .env 的 APPMARKET_SECURITY_SCAN。',
-    ],
-];

addon/appmall/config/appmall.php

@@ -1,39 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp [ WE CAN DO IT JUST THINK ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-// | 应用市场（appmall）插件【运行期配置的规范默认源】
-// |
-// | 本文件是 config('appmall.*') 的完整默认集合（代码级默认值，支持 .env 覆盖）。
-// | 后台「插件配置」表单(config.php) 仅负责「可编辑字段 + 默认值展示」，
-// | 数据库保存值按最高优先级覆盖本文件。读取一律用 config('appmall.xxx')。
-// |
-// | 约定：布尔项统一用 bool（true/false），不要写 '1'/'0'（字符串），
-// |      以免代码 if(!$v) 判定出错（'0' 在 PHP 里是 truthy）。
-// +----------------------------------------------------------------------
-
-return [
-    // ===== 市场基础设置（仅中心站相关：运营与开发者自助）=====
-    'appmall_name' => 'YwxApp 应用市场',
-    'allow_register' => true,   // 开放开发者自助注册
-    'need_approval'  => true,   // 注册后需审核（审核通过才下发开发者令牌）
-    'allow_upload'   => true,   // 允许后台上传发布核心包
-
-    // ===== 官方市场发布（把本机插件推送到 www.ywxapp.cn 官方公共市场）=====
-    // 与「远程中心站」是两回事：这里是【主动推送】，下面是【被动拉取】。
-    'developer_token' => env('APPMARKET_DEV_TOKEN', ''),
-    'developer_name'  => env('APPMARKET_DEV_NAME', ''),
-
-    // ===== 远程市场 / 中心站客户机模式（仅当 ywxapp.api_url 指向其他服务器时生效）=====
-    // 「谁是中心站」由 config/ywxapp.php 的 api_url 决定（留空=本机即中心站，无需下面这些）。
-    'remote_token' => env('APPMARKET_REMOTE_TOKEN', ''),   // 客户机↔中心站共享密钥，须与中心站一致
-    'ssl_verify'   => env('APPMARKET_SSL_VERIFY', true),   // 连接远程市场时 SSL 证书校验
-
-    // ===== 交易 / 安全 =====
-    'commission_rate' => env('APPMARKET_COMMISSION_RATE', 0.2),  // 平台抽成 0~1
-    'security_scan'   => env('APPMARKET_SECURITY_SCAN', true),    // 发布前 PHP 语法+高危函数扫描
-];

addon/appmall/controller/Developer.php

@@ -1,388 +0,0 @@
-<?php
- 
-declare(strict_types=1);
-
-namespace addon\appmall\controller;
-
-use think\facade\Db;
-use ywxapp\controller\FrontendBase;
-use ywxapp\library\Mailer;
-use ywxapp\model\BaseModel;
-use addon\appmall\library\AppmallSchema;
-
-/**
- * 开发者中心（独立前台应用，非会员中心、非后台）
- * 开发者自助注册 / 查询令牌 / 收益查询 / 提现；完全公开（noNeedLogin=*），
- * 以开发者令牌(token)而非会员登录态认证。
- * 路由前缀：/appmall/developer/*（由 AppService::loadAddonRoutes 在 boot 阶段包 Route::group('appmall') 注册到全局路由表，不隶属于任何 thinkphp 应用）。
- * 视图：addons/appmall/view/frontend/developer/。
- *
- * 注：AddonFrontend 基类 _initialize 把 view_path 设成【主应用】view/frontend/（与插件目录不符），
- * 故此处必须在 initialize() 显式把 view_path 锁回插件目录，否则 fetch 找不到模板。
- */
-class Developer extends FrontendBase
-{
-    protected $noNeedLogin  = ['*'];
-    protected $noNeedVerify = ['*'];
-
-    /**
-     * 锁定视图路径到插件目录（修复 AddonFrontend 设成主应用目录的坑）
-     */
-    protected function initialize()
-    {
-        // 确保 appmall 运营表存在（开发者中心只读开发者/收益/提现等表，避免全新安装 1146）
-        AppmallSchema::ensure();
-
-        // 仅中心站暴露：客户机（ywxapp.api_url 指向其他服务器，见 is_market_client()）作为中心站客户端，
-        // 不持有 appmall_developers / appmall_addon_revenues / appmall_addon_withdrawals 等运营表，
-        // 访问开发者中心直接 404。即便路由层未拦住（如路由缓存陈旧、被直连）也在此兜底。
-        if (is_market_client()) {
-            abort(404, '开发者中心仅在中心站（市场服务端）可用');
-        }
-
-        $this->view->config([
-            'view_path' => ADDON_PATH . 'appmall' . DIRECTORY_SEPARATOR
-                . 'view' . DIRECTORY_SEPARATOR . 'frontend' . DIRECTORY_SEPARATOR,
-        ]);
-        // 供前端 <script src=".../wxapp.js" module="{$site.app}"> 使用（前台应用目录名）
-        $this->view->assign('site', ['app' => 'frontend']);
-    }
-
-    /**
-     * 注册页
-     */
-    public function index()
-    {
-        $this->view->assign('register_open', (bool) config('appmall.allow_register', true));
-        $this->view->assign('need_approval', (bool) config('appmall.need_approval', true));
-        return $this->view->fetch('developer/register');
-    }
-
-    /**
-     * 提交注册（生成令牌，按配置决定是否需要审核）
-     */
-    public function save()
-    {
-        if (! $this->request->isPost()) {
-            $this->result->error('访问错误');
-        }
-        if (! (bool) config('appmall.allow_register', true)) {
-            $this->result->error('当前未开放自助注册');
-        }
-
-        $email = trim($this->request->param('email', ''));
-        $name  = trim($this->request->param('username', ''));
-        if (! filter_var($email, FILTER_VALIDATE_EMAIL)) {
-            $this->result->error('邮箱格式不正确');
-        }
-        if ($name === '') {
-            $this->result->error('请填写开发者名称');
-        }
-
-        if (Db::name('appmall_developers')->where('email', $email)->find()) {
-            $this->result->error('该邮箱已申请过开发者令牌');
-        }
-
-        $token        = bin2hex(random_bytes(32));
-        $needApproval = (bool) config('appmall.need_approval', true);
-        $status       = $needApproval ? 0 : 1;
-
-        Db::name('appmall_developers')->insert([
-            'username'   => $name,
-            'email'      => $email,
-            'token'      => $token,
-            'status'     => $status,
-            'create_at' => time(),
-            'update_at' => time(),
-        ]);
-
-        if ($needApproval) {
-            Mailer::send($email, '开发者入驻申请已收到', $this->pendingMail($name));
-            $this->result->success([], '注册成功，等待运营审核，通过后令牌将发送至您的邮箱');
-        }
-
-        Mailer::send($email, '您的开发者令牌', $this->tokenMail($name, $token));
-        $this->result->success(
-            ['token' => $token],
-            '注册成功，请将下方令牌配置到开发者控制台的 APPMARKET_DEV_TOKEN'
-        );
-    }
-
-    /**
-     * 查询我的令牌
-     */
-    public function mine()
-    {
-        return $this->view->fetch('developer/mine');
-    }
-
-    /**
-     * 根据邮箱取回令牌（已激活才返回，并重发邮件）
-     */
-    public function lookup()
-    {
-        if (! $this->request->isPost()) {
-            $this->result->error('访问错误');
-        }
-        $email = trim($this->request->param('email', ''));
-        $dev   = Db::name('appmall_developers')->where('email', $email)->find();
-        if (! $dev) {
-            $this->result->error('未找到该邮箱的开发者记录');
-        }
-        $status = (int) $dev['status'];
-        if ($status === 0) {
-            $this->result->error('您的申请正在审核中，请耐心等待');
-        }
-        if ($status === -1) {
-            $this->result->error('开发者账号已被禁用，请联系运营');
-        }
-        Mailer::send($email, '您的开发者令牌', $this->tokenMail($dev['username'], $dev['token']));
-        $this->result->success(
-            ['token' => $dev['token'], 'username' => $dev['username']],
-            '令牌如下（已重新发送至邮箱）'
-        );
-    }
-
-    /**
-     * 我的收益（令牌认证）：返回余额与近期收益账本
-     */
-    public function earnings()
-    {
-        $this->ensureTables();
-        $token = $this->request->param('token', '');
-        $dev   = Db::name('appmall_developers')->where('token', $token)->where('status', 1)->find();
-        if (empty($dev)) {
-            return $this->result->error('令牌无效');
-        }
-        $revenues = Db::name('appmall_addon_revenues')->where('developer_id', $dev['id'])
-            ->order('id', 'desc')->limit(20)->select()->toArray();
-        $this->result->success([
-            'balance'        => $dev['balance'] ?? 0,
-            'frozen_balance' => $dev['frozen_balance'] ?? 0,
-            'revenues'       => $revenues,
-        ], '获取成功');
-    }
-
-    /**
-     * 发起提现（令牌认证）：可提现余额 → 冻结，生成提现单待运营打款
-     */
-    public function withdraw()
-    {
-        if (! $this->request->isPost()) {
-            return $this->result->error('访问错误');
-        }
-        $this->ensureTables();
-        $token   = $this->request->param('token', '');
-        $amount  = (float) $this->request->param('amount', 0);
-        $channel = $this->request->param('channel', 'alipay');
-        $account = trim($this->request->param('account', ''));
-        $dev     = Db::name('appmall_developers')->where('token', $token)->where('status', 1)->find();
-        if (empty($dev)) {
-            return $this->result->error('令牌无效');
-        }
-        if ($amount <= 0) {
-            return $this->result->error('提现金额必须大于 0');
-        }
-        if ($amount > (float) ($dev['balance'] ?? 0)) {
-            return $this->result->error('可提现余额不足');
-        }
-        if ($account === '') {
-            return $this->result->error('请填写收款账号');
-        }
-        Db::transaction(function () use ($dev, $amount, $channel, $account) {
-            Db::name('appmall_developers')->where('id', $dev['id'])
-                ->dec('balance', $amount)->inc('frozen_balance', $amount)->update();
-            Db::name('appmall_addon_withdrawals')->insert([
-                'developer_id' => $dev['id'],
-                'amount'       => $amount,
-                'channel'      => $channel,
-                'account'      => $account,
-                'status'       => 0,
-                'create_at'    => time(),
-                'update_at'    => time(),
-            ]);
-        });
-        return $this->result->success([], '提现申请已提交，等待运营打款');
-    }
-
-    /**
-     * 开发者控制台入口（统一 DZ 风格布局）：令牌认证后渲染控制台
-     * 路由：GET /appmall/developer/console?token=xxx
-     */
-    public function console()
-    {
-        $this->view->assign('token', $this->request->param('token', ''));
-        return $this->view->fetch('developer/console');
-    }
-
-    /**
-     * 开发者控制台（兼容旧入口，重定向到统一控制台）
-     */
-    public function dashboard()
-    {
-        $this->view->assign('token', $this->request->param('token', ''));
-        return $this->view->fetch('developer/console');
-    }
-
-    /**
-     * 控制台概览数据（令牌认证）：应用数 / 待审数 / 总下载 / 余额 / 累计收益 / 近期提交
-     * 路由：POST /appmall/developer/overview
-     */
-    public function overview()
-    {
-        $this->ensureTables();
-        $dev = $this->authDev();
-        if (empty($dev)) {
-            return $this->result->error('令牌无效');
-        }
-        $devId = (int) $dev['id'];
-        $appCount      = Db::name('appmall_addon_list')->where('developer_id', $devId)->where('status', 1)->count();
-        $pendingCount  = Db::name('appmall_addon_submissions')->where('developer_id', $devId)->where('status', 0)->count();
-        $totalDownload = (int) Db::name('appmall_addon_list')->where('developer_id', $devId)->sum('download_count');
-        $totalIncome   = (float) Db::name('appmall_addon_revenues')->where('developer_id', $devId)->where('status', 1)->sum('income');
-        $recent        = Db::name('appmall_addon_submissions')->where('developer_id', $devId)
-            ->field('title,version,status,update_at,type')->order('id', 'desc')->limit(5)->select()->toArray();
-        $this->result->success([
-            'username'        => $dev['username'],
-            'email'           => $dev['email'],
-            'balance'         => $dev['balance'] ?? 0,
-            'frozen_balance'  => $dev['frozen_balance'] ?? 0,
-            'app_count'       => $appCount,
-            'pending_count'   => $pendingCount,
-            'total_downloads' => $totalDownload,
-            'total_income'    => $totalIncome,
-            'recent'          => $recent,
-        ], '获取成功');
-    }
-
-    /**
-     * 我的应用（令牌认证）：已上架/下架应用 + 提交记录（待审/驳回）合并返回
-     * 路由：POST /appmall/developer/apps
-     */
-    public function apps()
-    {
-        $this->ensureTables();
-        $dev = $this->authDev();
-        if (empty($dev)) {
-            return $this->result->error('令牌无效');
-        }
-        $devId = (int) $dev['id'];
-        $listed = Db::name('appmall_addon_list')->where('developer_id', $devId)
-            ->field('id,name,title,version,price,logo,category,download_count,status,update_at,type')
-            ->order('update_at', 'desc')->select()->toArray();
-        $subs = Db::name('appmall_addon_submissions')->where('developer_id', $devId)
-            ->field('id,name,title,version,price,logo,category,status,reject_reason,update_at,type')
-            ->order('update_at', 'desc')->select()->toArray();
-        $this->result->success(['listed' => $listed, 'submissions' => $subs], '获取成功');
-    }
-
-    /**
-     * 修改我的应用价格（令牌认证，仅能改自己名下的应用；无需重新打包/重新提审）
-     * 路由：POST /appmall/developer/price  {token, name, price}
-     */
-    public function price()
-    {
-        if (! $this->request->isPost()) {
-            return $this->result->error('访问错误');
-        }
-        $this->ensureTables();
-        $dev = $this->authDev();
-        if (empty($dev)) {
-            return $this->result->error('令牌无效');
-        }
-        $name  = trim((string) $this->request->param('name', ''));
-        $price = (float) $this->request->param('price', -1);
-        try {
-            \addon\appmall\service\MarketService::instance()
-                ->updatePrice($name, $price, (int) $dev['id']);
-        } catch (\addon\appmall\service\MarketException $e) {
-            return $this->result->error($e->getMessage());
-        }
-        return $this->result->success([], '价格已更新，市场即时生效');
-    }
-
-    /**
-     * 令牌鉴权：返回 status=1 的开发者记录，否则 null（沿用 earnings/withdraw 的契约）
-     */
-    private function authDev()
-    {
-        $token = $this->request->param('token', '');
-        return Db::name('appmall_developers')->where('token', $token)->where('status', 1)->find();
-    }
-
-    /**
-     * 运行时自愈建表（仅当表不存在时创建），保证开发者收益/提现闭环在当前库即可跑通。
-     * 字段与 install.sql、中心站 Market::ensureTables 保持一致。
-     */
-    private function ensureTables(): void
-    {
-        $prefix = Db::getConfig('prefix') ?: '';
-        $tables = [
-            'appmall_developers' => "CREATE TABLE IF NOT EXISTS `{$prefix}appmall_developers` (
-                `id` int unsigned NOT NULL AUTO_INCREMENT,
-                `username` varchar(100) NOT NULL COMMENT '开发者名称',
-                `email` varchar(120) NOT NULL COMMENT '邮箱（接收令牌/通知）',
-                `token` varchar(64) NOT NULL COMMENT '开发者令牌（发布插件时校验）',
-                `status` tinyint DEFAULT 0 COMMENT '0=待审核 1=正常 -1=禁用',
-                `balance` decimal(10,2) DEFAULT '0.00' COMMENT '可提现余额',
-                `frozen_balance` decimal(10,2) DEFAULT '0.00' COMMENT '待结算/冻结金额',
-                `create_at` int DEFAULT 0,
-                `update_at` int DEFAULT 0,
-                PRIMARY KEY (`id`),
-                UNIQUE KEY `uk_email` (`email`),
-                UNIQUE KEY `uk_token` (`token`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='市场开发者表';",
-            'appmall_addon_revenues' => "CREATE TABLE IF NOT EXISTS `{$prefix}appmall_addon_revenues` (
-                `id` int unsigned NOT NULL AUTO_INCREMENT,
-                `developer_id` int unsigned NOT NULL DEFAULT '0' COMMENT '受益开发者',
-                `order_id` int unsigned NOT NULL DEFAULT '0' COMMENT 'appmall_addon_orders.id',
-                `aid` int unsigned NOT NULL DEFAULT '0' COMMENT 'appmall_addon_list.id',
-                `uid` int unsigned NOT NULL DEFAULT '0' COMMENT '购买用户',
-                `amount` decimal(10,2) NOT NULL DEFAULT '0.00' COMMENT '订单金额',
-                `commission` decimal(10,2) NOT NULL DEFAULT '0.00' COMMENT '平台抽成',
-                `income` decimal(10,2) NOT NULL DEFAULT '0.00' COMMENT '开发者应得',
-                `status` tinyint DEFAULT 0 COMMENT '0=待结算 1=已结算',
-                `create_at` int DEFAULT 0,
-                `settle_at` int DEFAULT 0,
-                PRIMARY KEY (`id`),
-                KEY `idx_developer` (`developer_id`),
-                KEY `idx_order` (`order_id`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='插件销售收益账本';",
-            'appmall_addon_withdrawals' => "CREATE TABLE IF NOT EXISTS `{$prefix}appmall_addon_withdrawals` (
-                `id` int unsigned NOT NULL AUTO_INCREMENT,
-                `developer_id` int unsigned NOT NULL DEFAULT '0',
-                `amount` decimal(10,2) NOT NULL DEFAULT '0.00' COMMENT '提现金额',
-                `channel` varchar(20) DEFAULT 'alipay' COMMENT '提现渠道',
-                `account` varchar(100) DEFAULT '' COMMENT '收款账号',
-                `status` tinyint DEFAULT 0 COMMENT '0=待处理 1=已打款 -1=驳回',
-                `remark` varchar(255) DEFAULT '',
-                `create_at` int DEFAULT 0,
-                `update_at` int DEFAULT 0,
-                PRIMARY KEY (`id`),
-                KEY `idx_developer` (`developer_id`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='开发者提现单';",
-        ];
-        foreach ($tables as $t => $sql) {
-            BaseModel::ensureTable($prefix . $t, $sql);
-        }
-    }
-
-    /**
-     * 开发者令牌邮件正文
-     */
-    private function tokenMail($name, $token): string
-    {
-        return "尊敬的 {$name}：<br>您的开发者令牌已生成：<br><br>"
-            . "<code style=\"background:#f4f4f4;padding:4px 8px;border-radius:4px;\">{$token}</code><br><br>"
-            . '请将其配置到开发者控制台的 <b>APPMARKET_DEV_TOKEN</b> 环境变量后，即可在「发布到官方市场」中使用。';
-    }
-
-    /**
-     * 审核中邮件正文
-     */
-    private function pendingMail($name): string
-    {
-        return "尊敬的 {$name}：<br>我们已收到您的开发者入驻申请，将在 1-3 个工作日内完成审核，"
-            . '通过后令牌会发送至本邮箱，请注意查收。';
-    }
-}

addon/appmall/controller/Framework.php

@@ -1,93 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp [ WE CAN DO IT JUST THINK ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-
-declare(strict_types=1);
-
-namespace addon\appmall\controller;
-
-use think\facade\Db;
-use ywxapp\controller\FrontendBase;
-
-/**
- * 主框架发布/下载展示页（公开，仅中心站）
- *
- * 列出已发布的主框架版本，提供「整包 / 增量补丁 / 完整安装包」下载入口。
- * 下载走对外 API /appmall/api/framework/download（无需登录，可选签名）。
- * 路由前缀：/appmall/framework/*（由 AppService::loadAddonRoutes 外层包 Route::group('appmall')）。
- * 视图：addons/appmall/view/frontend/framework/。
- */
-class Framework extends FrontendBase
-{
-    protected $noNeedLogin  = ['*'];
-    protected $noNeedVerify = ['*'];
-
-    /**
-     * 锁定视图路径到插件目录（AddonFrontend 默认指向主应用 view/frontend/，须覆盖）。
-     * 仅中心站暴露：客户机不持有 framework_list 发布数据，访问即 404。
-     */
-    protected function initialize()
-    {
-        if (is_market_client()) {
-            abort(404, '框架下载页仅在中心站（市场服务端）可用');
-        }
-        $this->view->config([
-            'view_path' => ADDON_PATH . 'appmall' . DIRECTORY_SEPARATOR
-                . 'view' . DIRECTORY_SEPARATOR . 'frontend' . DIRECTORY_SEPARATOR,
-        ]);
-    }
-
-    /**
-     * 发布列表展示页
-     */
-    public function index()
-    {
-        $this->ensureColumns();
-        $rows = Db::name('appmall_framework_list')
-            ->where('status', 1)
-            ->order('id', 'desc')
-            ->field('id,version,title,changelog,file_path,patch_path,install_path,patch_from,from_version,download_count,create_at')
-            ->select()
-            ->toArray();
-        foreach ($rows as &$r) {
-            $r['has_full']    = !empty($r['file_path']);
-            $r['has_patch']   = !empty($r['patch_path']);
-            $r['has_install'] = !empty($r['install_path']);
-            $r['patch_from']  = $r['patch_from'] ?: $r['from_version'];
-            $r['create_at_fmt'] = $r['create_at'] ? date('Y-m-d', (int) $r['create_at']) : '';
-            unset($r['file_path'], $r['patch_path'], $r['install_path']);
-        }
-        unset($r);
-
-        $this->view->assign('list', $rows);
-        $this->view->assign('market_name', config('appmall.appmall_name', 'YwxApp 应用市场'));
-        return $this->view->fetch('framework/index');
-    }
-
-    /**
-     * 运行时自愈：补齐 install_path / install_hash 列（早期安装的中心站可能缺失）。
-     */
-    private function ensureColumns(): void
-    {
-        $table = \ywxapp\model\BaseModel::currentPrefix() . 'appmall_framework_list';
-        try {
-            $defs = [
-                'install_path' => "varchar(255) DEFAULT '' COMMENT '完整安装包 zip 物理路径'",
-                'install_hash' => "varchar(64) DEFAULT '' COMMENT '完整安装包 SHA256 校验值'",
-            ];
-            foreach ($defs as $col => $def) {
-                $cols = Db::query("SHOW COLUMNS FROM `{$table}` LIKE '{$col}'");
-                if (empty($cols)) {
-                    Db::execute("ALTER TABLE `{$table}` ADD COLUMN `{$col}` {$def}");
-                }
-            }
-        } catch (\Exception $e) {
-            // ignore
-        }
-    }
-}

addon/appmall/controller/Store.php

@@ -1,163 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp [ WE CAN DO IT JUST THINK ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-
-declare(strict_types=1);
-
-namespace addon\appmall\controller;
-
-use ywxapp\controller\FrontendBase;
-use addon\appmall\service\MarketService;
-
-/**
- * 应用商店前台展示页（公开，仅中心站）
- *
- * 列出应用市场上线的插件 / 模板，卡片展示 logo、价格、评分、下载量等。
- * 数据来自中心站本地库（appmall_addon_list），复用 MarketService::catalog()。
- * 路由前缀：/appmall/store/*（由 AppService::loadAddonRoutes 外层包 Route::group('appmall')）。
- * 视图：addons/appmall/view/frontend/store/。
- */
-class Store extends FrontendBase
-{
-    protected $noNeedLogin  = ['*'];
-    protected $noNeedVerify = ['*'];
-
-    /**
-     * 锁定视图路径到插件目录；仅中心站暴露（客户机不持有市场列表数据，访问即 404）。
-     */
-    protected function initialize()
-    {
-        if (is_market_client()) {
-            abort(404, '应用商店仅在中心站（市场服务端）可用');
-        }
-        $this->view->config([
-            'view_path' => ADDON_PATH . 'appmall' . DIRECTORY_SEPARATOR
-                . 'view' . DIRECTORY_SEPARATOR . 'frontend' . DIRECTORY_SEPARATOR,
-        ]);
-    }
-
-    /**
-     * 商店首页：上线插件列表
-     */
-    public function index()
-    {
-        $catalog    = MarketService::instance()->catalog();
-        $items      = $catalog['list'] ?? [];
-        $categories = $catalog['categories'] ?? [];
-
-        $plugins = [];
-        foreach ($items as $it) {
-            $price = (float) ($it['price'] ?? 0);
-            $plugins[] = [
-                'id'         => $it['id'] ?? 0,
-                'name'       => $it['name'] ?? '',
-                'title'      => $it['title'] ?? ($it['name'] ?? ''),
-                'desc'       => $it['intro'] ?? '',
-                'author'     => $it['author'] ?? '',
-                'logo'       => $it['logo'] ?? '',
-                'version'    => $it['version'] ?? '',
-                'price'      => $price,
-                'price_text' => $price > 0 ? '¥' . number_format($price, 2) : '免费',
-                'rating'     => (float) ($it['rating'] ?? 0),
-                'downloads'  => (int) ($it['download_count'] ?? 0),
-                'category'   => $it['category'] ?? '',
-                'type'       => $it['type'] ?? 'addon',
-            ];
-        }
-
-        $this->view->assign('list', $plugins);
-        $this->view->assign('categories', $categories);
-        $this->view->assign('market_name', config('appmall.appmall_name', 'YwxApp 应用市场'));
-        return $this->view->fetch('store/index');
-    }
-
-    /**
-     * 插件详情页（/appmall/store/detail/<name>）
-     * 参考 FastAdmin 插件市场详情版式：左封面+截图、右元信息+版本历史。
-     */
-    public function detail()
-    {
-        $name = input('name', '', 'trim');
-        if ($name === '') {
-            abort(404, '插件标识为空');
-        }
-        $catalog = MarketService::instance()->catalog();
-        $hit     = null;
-        foreach (($catalog['list'] ?? []) as $it) {
-            if (($it['name'] ?? '') === $name) {
-                $hit = $it;
-                break;
-            }
-        }
-        if (!$hit) {
-            abort(404, '插件不存在或未上架');
-        }
-
-        $price = (float) ($hit['price'] ?? 0);
-        $row = [
-            'id'         => $hit['id'] ?? 0,
-            'name'       => $hit['name'] ?? '',
-            'title'      => $hit['title'] ?? ($hit['name'] ?? ''),
-            'intro'      => $hit['intro'] ?? '',
-            'author'     => $hit['author'] ?? '',
-            'logo'       => $hit['logo'] ?? '',
-            'version'    => $hit['version'] ?? '',
-            'price'      => $price,
-            'price_text' => $price > 0 ? '¥' . number_format($price, 2) : '免费',
-            'rating'     => (float) ($hit['rating'] ?? 0),
-            'downloads'  => (int) ($hit['download_count'] ?? 0),
-            'category'   => $hit['category'] ?? '',
-            'tags'       => $hit['tags'] ?? '',
-            'type'       => $hit['type'] ?? 'addon',
-            'update_at'  => (int) ($hit['update_at'] ?? 0),
-            'update_fmt' => $hit['update_at'] ? date('Y-m-d', (int) $hit['update_at']) : '',
-            'screenshots'=> $this->parseScreenshots($hit['screenshots'] ?? ''),
-            'versions'   => $this->normalizeVersions($hit['versions'] ?? []),
-        ];
-
-        $this->view->assign('addon', $row);
-        $this->view->assign('market_name', config('appmall.appmall_name', 'YwxApp 应用市场'));
-        return $this->view->fetch('store/detail');
-    }
-
-    /**
-     * screenshots 可能是逗号分隔字符串 / JSON 数组，归一化为数组。
-     */
-    private function parseScreenshots($raw): array
-    {
-        if (is_array($raw)) {
-            return array_values($raw);
-        }
-        $raw = trim((string) $raw);
-        if ($raw === '') {
-            return [];
-        }
-        if (strpos($raw, '[') === 0) {
-            $dec = json_decode($raw, true);
-            return is_array($dec) ? array_values($dec) : [];
-        }
-        return array_filter(array_map('trim', explode(',', $raw)), fn ($x) => $x !== '');
-    }
-
-    /**
-     * versions 子版本归一化（version/price/update_fmt）。
-     */
-    private function normalizeVersions(array $vers): array
-    {
-        $out = [];
-        foreach ($vers as $v) {
-            $out[] = [
-                'version'   => (string) ($v['version'] ?? ''),
-                'price'     => (float) ($v['price'] ?? 0),
-                'price_text'=> ((float) ($v['price'] ?? 0)) > 0 ? '¥' . number_format((float) $v['price'], 2) : '免费',
-                'update_fmt'=> !empty($v['update_at']) ? date('Y-m-d', (int) $v['update_at']) : '',
-            ];
-        }
-        return $out;
-    }
-}

addon/appmall/controller/api/Framework.php

@@ -1,235 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp [ WE CAN DO IT JUST THINK ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-
-declare(strict_types=1);
-
-namespace addon\appmall\controller\api;
-
-use think\facade\Config;
-use think\facade\Db;
-use think\facade\Request;
-
-/**
- * 主框架升级服务 API
- *
- * 契约对齐客户端 ywxapp\service\FrameworkService：
- *  - GET /api/framework/version   返回最新版本 + 历史版本（客户端检测更新）
- *  - GET /api/framework/download  下载核心包 zip（可选签名校验）
- * 原 upgrade 插件功能，已合并进 market（应用服务中心）。
- */
-class Framework
-{
-    /**
-     * 版本列表 / 最新版本
-     */
-    public function version()
-    {
-        $this->ensureColumns();
-        try {
-            $rows = Db::name('appmall_framework_list')
-                ->where('status', 1)
-                ->order('id', 'desc')
-                ->limit(20)
-                ->field('id,version,title,changelog,type,from_version,patch_from,file_path,patch_path,install_path,create_at')
-                ->select()
-                ->toArray();
-        } catch (\Exception $e) {
-            return json(['code' => 0, 'msg' => '读取版本列表失败：' . $e->getMessage()]);
-        }
-
-        $latest = $rows[0] ?? null;
-        $hasFull  = !empty($latest['file_path']);
-        $hasPatch = !empty($latest['patch_path']);
-        $hasInstall = !empty($latest['install_path'] ?? '');
-        $patchFrom = $latest['patch_from'] ?? '';
-        if ($patchFrom === '' && $hasPatch) {
-            $patchFrom = $latest['from_version'] ?? '';
-        }
-
-        // 不向客户端泄露物理路径
-        foreach ($rows as &$r) {
-            $r['has_full']    = !empty($r['file_path']);
-            $r['has_patch']   = !empty($r['patch_path']);
-            $r['has_install'] = !empty($r['install_path']);
-            unset($r['file_path'], $r['patch_path'], $r['install_path']);
-        }
-        unset($r);
-
-        return json([
-            'code' => 1,
-            'msg'  => 'success',
-            'data' => [
-                'version'     => $latest['version'] ?? '',
-                'title'       => $latest['title'] ?? '',
-                'changelog'   => $latest['changelog'] ?? '',
-                // 兼容旧客户端：type 只表达「整包缺失时才是纯补丁」
-                'type'        => $hasFull ? 0 : ($hasPatch ? 1 : (int) ($latest['type'] ?? 0)),
-                'from_version'=> $patchFrom,
-                // 新协议：整包与补丁可同版本共存，客户端按自身版本择优
-                'has_full'    => $hasFull,
-                'has_patch'   => $hasPatch,
-                'has_install' => $hasInstall,
-                'patch_from'  => $patchFrom,
-                'release_at'  => $latest['create_at'] ?? 0,
-                'history'     => $rows,
-            ],
-        ]);
-    }
-
-    /**
-     * 兼容已安装库：补齐 type / from_version / patch_* 列，并迁移旧「补丁行」数据
-     */
-    private function ensureColumns(): void
-    {
-        $table = \ywxapp\model\BaseModel::currentPrefix() . 'appmall_framework_list';
-        try {
-            $defs = [
-                'type'         => "tinyint DEFAULT 0 COMMENT '0=整包 1=补丁'",
-                'from_version' => "varchar(20) DEFAULT '' COMMENT '补丁基础版本'",
-                'patch_path'   => "varchar(255) DEFAULT '' COMMENT '增量补丁 zip 物理路径'",
-                'patch_hash'   => "varchar(64) DEFAULT '' COMMENT '补丁 SHA256 校验值'",
-                'patch_from'   => "varchar(20) DEFAULT '' COMMENT '补丁适用的基础版本'",
-                'install_path' => "varchar(255) DEFAULT '' COMMENT '完整安装包 zip 物理路径'",
-                'install_hash' => "varchar(64) DEFAULT '' COMMENT '完整安装包 SHA256 校验值'",
-            ];
-            foreach ($defs as $col => $def) {
-                $cols = Db::query("SHOW COLUMNS FROM `{$table}` LIKE '{$col}'");
-                if (empty($cols)) {
-                    Db::execute("ALTER TABLE `{$table}` ADD COLUMN `{$col}` {$def}");
-                }
-            }
-            Db::execute(
-                "UPDATE `{$table}` SET patch_path = file_path, patch_hash = file_hash, patch_from = from_version,"
-                . " file_path = '', file_hash = ''"
-                . " WHERE type = 1 AND (patch_path = '' OR patch_path IS NULL) AND file_path <> ''"
-            );
-        } catch (\Exception $e) {
-            // ignore
-        }
-    }
-
-    /**
-     * 下载核心包 zip
-     * 客户端 FrameworkService::download() GET ?version= ：
-     *   - 直接返回 zip 二进制（首字节非 '{'）。
-     * 可选签名校验：config('appmall.addon_download_sign') = true 时，
-     * 请求需带 sign=md5('framework'.version.ts.secret) & ts（5 分钟有效期）。
-     */
-    public function download()
-    {
-        $version = Request::param('version', '');
-        // 选包：type=install/2 下安装包；type=patch/1 下补丁；type=full/0 下整包；缺省整包（缺失时回退补丁/安装包）
-        $typeRaw = (string) Request::param('type', '');
-        $wantPatch   = in_array($typeRaw, ['patch', '1'], true);
-        $wantInstall = in_array($typeRaw, ['install', '2'], true);
-
-        if (Config::get('ywxapp.addon_download_sign', false)) {
-            $sign = Request::param('sign', '');
-            $ts   = (int) Request::param('ts', 0);
-            if (!$this->verifySign($version, $ts, $sign)) {
-                return json(['code' => 0, 'message' => '签名校验失败']);
-            }
-        }
-
-        // 运行时自愈：已部署的中心站若早于本版本安装，可能缺下载日志表
-        $this->ensureTables();
-
-        $query = Db::name('appmall_framework_list')->where('status', 1);
-        if ($version !== '') {
-            $query->where('version', $version);
-        }
-        $row = $query->order('id', 'desc')->find();
-        if (empty($row)) {
-            return json(['code' => 0, 'message' => '版本包不存在']);
-        }
-
-        if ($wantInstall) {
-            $path = $row['install_path'] ?? '';
-        } elseif ($wantPatch) {
-            $path = $row['patch_path'] ?? '';
-        } else {
-            $path = $row['file_path'] ?? '';
-            // 兼容「仅补丁/仅安装包」版本行：未显式指定时整包缺失则回退
-            if (($path === '' || !is_file($path)) && !empty($row['patch_path'])) {
-                $path      = $row['patch_path'];
-                $wantPatch = true;
-            }
-            if (($path === '' || !is_file($path)) && !empty($row['install_path'])) {
-                $path        = $row['install_path'];
-                $wantInstall = true;
-            }
-        }
-        if (empty($path) || !is_file($path)) {
-            $msg = $wantInstall ? '该版本无完整安装包或文件缺失'
-                : ($wantPatch ? '该版本无增量补丁或文件缺失' : '版本包不存在或文件缺失');
-            return json(['code' => 0, 'message' => $msg]);
-        }
-
-        // 记录下载次数与日志（列/表缺失时忽略，不影响下载）
-        try {
-            Db::name('appmall_framework_list')->where('id', $row['id'])->inc('download_count')->update();
-            Db::name('appmall_framework_download_log')->insert([
-                'version'   => $row['version'],
-                'uid'       => (int) Request::param('uid', 0),
-                'ip'        => Request::ip(),
-                'create_at' => time(),
-            ]);
-        } catch (\Exception $e) {
-            // ignore
-        }
-
-        $downloadName = 'ywxapp-' . $row['version']
-            . ($wantInstall ? '-install' : ($wantPatch ? '-patch' : '')) . '.zip';
-
-        // 流式下载响应（复用公共类）：避免 ThinkPHP download() 内部 file_get_contents 将整文件读入内存，
-        // 改用分块 fread 输出并支持 Range 续传；类内部已 set_time_limit(0)。
-        return new \ywxapp\library\StreamZipResponse($path, $downloadName);
-    }
-
-    /**
-     * 运行时自愈建表：保证 appmall_framework_download_log 存在（早期安装的中心站可能缺失）。
-     */
-    private function ensureTables(): void
-    {
-        $prefix = \ywxapp\model\BaseModel::currentPrefix();
-        $tables = [
-            'appmall_framework_download_log' => "CREATE TABLE IF NOT EXISTS `{$prefix}appmall_framework_download_log` (
-                `id` int unsigned NOT NULL AUTO_INCREMENT,
-                `version` varchar(20) NOT NULL COMMENT '下载的版本号',
-                `uid` int DEFAULT 0 COMMENT '下载用户ID（来自客户端）',
-                `ip` varchar(45) DEFAULT '' COMMENT '下载来源IP',
-                `create_at` int DEFAULT 0 COMMENT '下载时间',
-                PRIMARY KEY (`id`),
-                KEY `idx_version` (`version`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='主框架下载日志表';",
-        ];
-        foreach ($tables as $t => $sql) {
-            try {
-                if (empty(Db::query("SHOW TABLES LIKE '{$prefix}{$t}'"))) {
-                    Db::execute($sql);
-                }
-            } catch (\Throwable $e) {
-                // 忽略（如权限不足），由后续业务报错暴露
-            }
-        }
-    }
-
-    /**
-     * 下载签名校验
-     */
-    private function verifySign(string $version, int $ts, string $sign): bool
-    {
-        if ($sign === '' || abs(time() - $ts) > 300) {
-            return false;
-        }
-        $secret = Config::get('ywxapp.addon_secret', 'ywxapp-addon-secret-change-me');
-        $expect = md5('framework' . $version . $ts . $secret);
-        return hash_equals($expect, $sign);
-    }
-}

addon/appmall/controller/backend/AddonReview.php

@@ -1,92 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp [ WE CAN DO IT JUST THINK ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-
-declare (strict_types = 1);
-
-namespace addon\appmall\controller\backend;
-
-use think\facade\Db;
-use think\facade\View;
-use Exception;
-use ywxapp\controller\BackendBase;
-
-/**
- * 插件审核（运营后台，中心站）
- *
- * 审核开发者通过 Market::submit 提交的插件上架申请（appmall_addon_submissions）。
- * status: 0=待审核 1=已发布 2=已驳回。
- */
-class AddonReview extends BackendBase
-{
-    /**
-     * 审核列表 / 页面
-     */
-    public function index()
-    {
-        if ($this->request->isAjax()) {
-            $status = $this->request->param('status', '');
-            $query  = Db::name('appmall_addon_submissions')->order('id', 'desc');
-            if ($status !== '') {
-                $query->where('status', (int) $status);
-            }
-            $list = $query->paginate([
-                'page'      => (int) $this->request->param('page', 1),
-                'list_rows' => (int) $this->request->param('limit', 10),
-            ]);
-            $this->result->setCount($list->total())->success($list->items(), '获取成功');
-        }
-        return View::fetch('addonreview/index');
-    }
-
-    /**
-     * 审核通过：标记已发布（status=1）
-     * 注意：正式上架到 appmall_addon_list 由发布流程处理，此处仅切换审核态。
-     */
-    public function audit()
-    {
-        try {
-            $id = (int) input('id');
-            $row = Db::name('appmall_addon_submissions')->where('id', $id)->find();
-            if (empty($row)) {
-                return $this->result->error('提交记录不存在');
-            }
-            if ((int) $row['status'] === 1) {
-                return $this->result->error('该提交已发布');
-            }
-            Db::name('appmall_addon_submissions')->where('id', $id)
-                ->update(['status' => 1, 'reject_reason' => '', 'update_at' => time()]);
-            return $this->result->success([], '已通过审核');
-        } catch (Exception $e) {
-            return $this->result->error($e->getMessage());
-        }
-    }
-
-    /**
-     * 驳回：标记已驳回（status=2）并记录原因
-     */
-    public function reject()
-    {
-        try {
-            $id     = (int) input('id');
-            $reason = trim(input('reason', ''));
-            if ($reason === '') {
-                return $this->result->error('请填写驳回原因');
-            }
-            $row = Db::name('appmall_addon_submissions')->where('id', $id)->find();
-            if (empty($row)) {
-                return $this->result->error('提交记录不存在');
-            }
-            Db::name('appmall_addon_submissions')->where('id', $id)
-                ->update(['status' => 2, 'reject_reason' => $reason, 'update_at' => time()]);
-            return $this->result->success([], '已驳回');
-        } catch (Exception $e) {
-            return $this->result->error($e->getMessage());
-        }
-    }
-}

addon/appmall/controller/backend/Developer.php

@@ -1,121 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp [ WE CAN DO IT JUST THINK ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-
-declare (strict_types = 1);
-
-namespace addon\appmall\controller\backend;
-
-use think\facade\Db;
-use think\facade\View;
-use Exception;
-use ywxapp\controller\BackendBase;
-use ywxapp\library\Mailer;
-
-/**
- * 开发者管理（运营后台，含审核）
- * 由原核心 app/backend/controller/Developer.php 剥离到 market 插件。
- */
-class Developer extends BackendBase
-{
-    
-    public function index()
-    {
-        if ($this->request->isAjax()) {
-            $status = $this->request->param('status', '');
-            $query  = Db::name('appmall_developers');
-            if ($status !== '') {
-                $query->where('status', (int) $status);
-            }
-            $list = $query->order('status', 'asc')
-                ->order('id', 'desc')
-                ->paginate([
-                    'page'      => (int) $this->request->param('page', 1),
-                    'list_rows' => (int) $this->request->param('limit', 10),
-                ]);
-            $this->result->setCount($list->total())->success($list->items(), '获取成功');
-        }
-        return View::fetch('developer/index');
-    }
-
-    /**
-     * 审核通过：激活并邮件下发令牌
-     */
-    public function approve()
-    {
-        try {
-            $id  = (int) input('id');
-            $dev = Db::name('appmall_developers')->where('id', $id)->find();
-            if (empty($dev)) {
-                return $this->result->error('记录不存在');
-            }
-            Db::name('appmall_developers')->where('id', $id)->update(['status' => 1, 'update_at' => time()]);
-            Mailer::send($dev['email'], '开发者申请已通过', $this->tokenMail($dev['username'], $dev['token']));
-            return $this->result->success([], '已通过并发送令牌邮件');
-        } catch (Exception $e) {
-            return $this->result->error($e->getMessage());
-        }
-    }
-
-    /**
-     * 禁用
-     */
-    public function disable()
-    {
-        $id = (int) input('id');
-        Db::name('appmall_developers')->where('id', $id)->update(['status' => -1, 'update_at' => time()]);
-        return $this->result->success([], '已禁用');
-    }
-
-    /**
-     * 重新发送令牌邮件（仅已激活）
-     */
-    public function resend()
-    {
-        $id  = (int) input('id');
-        $dev = Db::name('appmall_developers')->where('id', $id)->find();
-        if (empty($dev)) {
-            return $this->result->error('记录不存在');
-        }
-        if ((int) $dev['status'] !== 1) {
-            return $this->result->error('仅已激活账号可重发');
-        }
-        Mailer::send($dev['email'], '您的开发者令牌', $this->tokenMail($dev['username'], $dev['token']));
-        return $this->result->success([], '已重发令牌邮件');
-    }
-
-    /**
-     * 重置令牌（已激活则同步邮件通知）
-     */
-    public function reset()
-    {
-        try {
-            $id    = (int) input('id');
-            $dev   = Db::name('appmall_developers')->where('id', $id)->find();
-            if (empty($dev)) {
-                return $this->result->error('记录不存在');
-            }
-            $token = bin2hex(random_bytes(32));
-            Db::name('appmall_developers')->where('id', $id)->update(['token' => $token, 'update_at' => time()]);
-            if ((int) $dev['status'] === 1) {
-                Mailer::send($dev['email'], '您的开发者令牌已重置', $this->tokenMail($dev['username'], $token));
-            }
-            return $this->result->success(['token' => $token], '已重置令牌' . ((int) $dev['status'] === 1 ? '并邮件通知' : ''));
-        } catch (Exception $e) {
-            return $this->result->error($e->getMessage());
-        }
-    }
-
-    
-    private function tokenMail($name, $token): string
-    {
-        return "尊敬的 {$name}：<br>您的开发者令牌如下：<br><br>"
-            . "<code style=\"background:#f4f4f4;padding:4px 8px;border-radius:4px;\">{$token}</code><br><br>"
-            . '请将其配置到开发者控制台的 <b>APPMARKET_DEV_TOKEN</b> 环境变量。';
-    }
-}

addon/appmall/controller/backend/Framework.php

@@ -1,296 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp [ WE CAN DO IT JUST THINK ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-
-declare(strict_types=1);
-
-namespace addon\appmall\controller\backend;
-
-use think\facade\Db;
-use think\facade\View;
-use Exception;
-use ywxapp\controller\BackendBase;
-use ywxapp\library\StreamZipResponse;
-
-/**
- * 主框架版本管理（运营后台，中心站）
- *
- * 上传核心包 zip → 入库（草稿）→ 发布（status=1）→ 客户端可见可下载。
- * 原 upgrade 插件功能，已合并进 market（应用服务中心）。
- */
-class Framework extends BackendBase
-{
-    /**
-     * 版本列表 / 页面
-     */
-    public function index()
-    {
-        if ($this->request->isAjax()) {
-            $this->ensurePatchColumns();
-            $status = $this->request->param('status', '');
-            $query  = Db::name('appmall_framework_list');
-            if ($status !== '') {
-                $query->where('status', (int) $status);
-            }
-            $list = $query->order('id', 'desc')
-                ->paginate([
-                    'page'      => (int) $this->request->param('page', 1),
-                    'list_rows' => (int) $this->request->param('limit', 10),
-                ]);
-            $this->result->setCount($list->total())->success($list->items(), '获取成功');
-        }
-        return View::fetch('framework/index');
-    }
-
-    /**
-     * 上传并登记一个主框架核心包（zip），默认草稿态
-     *
-     * 同一版本号对应一行记录：整包（type=0）写 file_path/file_hash，
-     * 增量补丁（type=1）写 patch_path/patch_hash/patch_from，二者可先后上传共存。
-     */
-    public function upload()
-    {
-        try {
-            $this->ensurePatchColumns();
-            $version   = trim(input('version', ''));
-            $title     = trim(input('title', ''));
-            $changelog = input('changelog', '');
-            $type      = (int) input('type', 0); // 0=整包 1=补丁 2=完整安装包
-            $fromVer   = trim(input('from_version', ''));
-            if (!preg_match('/^\d+\.\d+\.\d+$/', $version)) {
-                return $this->result->error('版本号格式不正确（需 x.y.z）');
-            }
-            if ($type === 1 && $fromVer === '') {
-                return $this->result->error('增量补丁必须填写「基础版本」');
-            }
-            if ($type === 1 && !preg_match('/^\d+\.\d+\.\d+$/', $fromVer)) {
-                return $this->result->error('基础版本号格式不正确（需 x.y.z）');
-            }
-            $file = $this->request->file('file');
-            if (empty($file)) {
-                return $this->result->error('请上传核心包 zip');
-            }
-            if (strtolower(substr($file->getOriginalName(), -4)) !== '.zip') {
-                return $this->result->error('仅支持 zip 格式');
-            }
-
-            // 整包需校验 ywxapp 核心结构；补丁只校验为合法 zip（含变更文件即可）
-            $tmp = $file->getRealPath();
-            $zip = new \ZipArchive();
-            if ($zip->open($tmp) !== true) {
-                return $this->result->error('zip 包无法打开');
-            }
-            if ($type === 0) {
-                $hasCore = false;
-                for ($i = 0; $i < $zip->numFiles; $i++) {
-                    $nm = $zip->statIndex($i)['name'];
-                    if (preg_match('#^(ywxapp/)?(service|controller|library|traits)/#', $nm)) {
-                        $hasCore = true;
-                        break;
-                    }
-                }
-                $zip->close();
-                if (!$hasCore) {
-                    return $this->result->error('核心包结构不正确：应包含 ywxapp 核心目录（service/controller/...）');
-                }
-            } elseif ($type === 2) {
-                // 完整安装包：必须含 config/ 与占位符 .env，且不得夹带 runtime/vendor/data 或真实 .env.*
-                $hasConfig = false;
-                $hasEnv    = false;
-                $bad       = false;
-                for ($i = 0; $i < $zip->numFiles; $i++) {
-                    $nm = $zip->statIndex($i)['name'];
-                    if ($nm === 'config' || strpos($nm, 'config/') === 0) {
-                        $hasConfig = true;
-                    }
-                    if ($nm === '.env') {
-                        $hasEnv = true;
-                    }
-                    if (preg_match('#^(runtime/|vendor/|data/|\.env\.)#', $nm)) {
-                        $bad = true;
-                        break;
-                    }
-                }
-                $zip->close();
-                if ($bad) {
-                    return $this->result->error('安装包结构不正确：不应包含 runtime/vendor/data 或真实 .env.* 文件');
-                }
-                if (!$hasConfig || !$hasEnv) {
-                    return $this->result->error('安装包结构不正确：必须包含 config/ 目录与 .env 占位符');
-                }
-            } else {
-                $zip->close();
-            }
-
-            $dir = root_path() . 'runtime' . DIRECTORY_SEPARATOR . 'framework' . DIRECTORY_SEPARATOR;
-            if (!is_dir($dir)) {
-                @mkdir($dir, 0755, true);
-            }
-            $saveName = 'ywxapp-' . $version . ($type === 1 ? '-patch' : ($type === 2 ? '-install' : '')) . '.zip';
-            $file->move($dir, $saveName);
-            $absPath = realpath($dir . $saveName);
-            if (!$absPath || !is_file($absPath)) {
-                return $this->result->error('核心包保存失败');
-            }
-            $hash = hash_file('sha256', $absPath);
-
-            $exist = Db::name('appmall_framework_list')->where('version', $version)->find();
-            // 公共字段：标题/日志仅在填写时覆盖，避免后传的包把先前信息清空
-            $data = [
-                'version'   => $version,
-                'status'    => 0, // 重新上传任一包均回到草稿，需再次发布
-                'update_at' => time(),
-            ];
-            if ($title !== '' || !$exist) {
-                $data['title'] = $title ?: ('主框架 ' . $version);
-            }
-            if (trim((string) $changelog) !== '' || !$exist) {
-                $data['changelog'] = $changelog;
-            }
-            if ($type === 1) {
-                // 增量补丁：只更新 patch 字段，不动整包
-                $data['patch_path'] = $absPath;
-                $data['patch_hash'] = $hash;
-                $data['patch_from'] = $fromVer;
-                $data['from_version'] = $fromVer; // 兼容旧客户端镜像
-            } elseif ($type === 2) {
-                // 完整安装包：只更新 install 字段，与整包/补丁独立共存
-                $data['install_path'] = $absPath;
-                $data['install_hash'] = $hash;
-            } else {
-                // 整包：只更新整包字段，不动补丁
-                $data['file_path'] = $absPath;
-                $data['file_hash'] = $hash;
-            }
-            if ($exist) {
-                Db::name('appmall_framework_list')->where('id', $exist['id'])->update($data);
-                $id = $exist['id'];
-                // type 兼容标志：有整包即 0，仅补丁为 1
-                $hasFull = ($type === 0) || !empty($exist['file_path']);
-                Db::name('appmall_framework_list')->where('id', $id)->update(['type' => $hasFull ? 0 : 1]);
-            } else {
-                $data['type']      = $type;
-                $data['create_at'] = time();
-                $id = Db::name('appmall_framework_list')->insertGetId($data);
-            }
-            $tip = $type === 1 ? '增量补丁已上传' : ($type === 2 ? '完整安装包已上传' : '整包已上传');
-            return $this->result->success(['id' => $id], $tip . '，请点击「发布」使其对外可下载');
-        } catch (Exception $e) {
-            return $this->result->error($e->getMessage());
-        }
-    }
-
-    /**
-     * 发布：将某版本置为已发布（status=1），客户端即可检测到
-     */
-    public function publish()
-    {
-        try {
-            $id = (int) input('id');
-            if ($id <= 0) {
-                return $this->result->error('缺少版本ID');
-            }
-            $row = Db::name('appmall_framework_list')->where('id', $id)->find();
-            if (empty($row)) {
-                return $this->result->error('版本不存在');
-            }
-            if (empty($row['file_path']) && empty($row['patch_path'])) {
-                return $this->result->error('该版本尚未上传任何包，无法发布');
-            }
-            Db::name('appmall_framework_list')->where('id', $id)->update(['status' => 1, 'update_at' => time()]);
-            $tip = empty($row['file_path'])
-                ? (empty($row['patch_path'])
-                    ? (empty($row['install_path']) ? '已发布' : '已发布（完整安装包，可供全新部署下载）')
-                    : '已发布（仅增量补丁：只有停在 ' . ($row['patch_from'] ?: $row['from_version']) . ' 的客户端可升级，建议补传整包）')
-                : (empty($row['patch_path']) ? '已发布（整包）' : '已发布（整包 + 增量补丁）');
-            return $this->result->success([], $tip);
-        } catch (Exception $e) {
-            return $this->result->error($e->getMessage());
-        }
-    }
-
-    /**
-     * 删除版本（同时删除整包与补丁物理文件）
-     */
-    public function delete()
-    {
-        try {
-            $id = (int) input('id');
-            if ($id <= 0) {
-                return $this->result->error('缺少版本ID');
-            }
-            $row = Db::name('appmall_framework_list')->where('id', $id)->find();
-            foreach (['file_path', 'patch_path', 'install_path'] as $col) {
-                if ($row && !empty($row[$col]) && is_file($row[$col])) {
-                    @unlink($row[$col]);
-                }
-            }
-            Db::name('appmall_framework_list')->where('id', $id)->delete();
-            return $this->result->success([], '已删除');
-        } catch (Exception $e) {
-            return $this->result->error($e->getMessage());
-        }
-    }
-
-    /**
-     * 下载核心包（供运营本地校验）
-     * ?type=patch 下载增量补丁，默认整包
-     */
-    public function download()
-    {
-        $id   = (int) input('id');
-        $kind = input('type', 'full');
-        $kind = in_array($kind, ['patch', 'install'], true) ? $kind : 'full';
-        $row  = Db::name('appmall_framework_list')->where('id', $id)->find();
-        if ($kind === 'patch') {
-            $path = $row['patch_path'] ?? '';
-            $suffix = '-patch';
-        } elseif ($kind === 'install') {
-            $path = $row['install_path'] ?? '';
-            $suffix = '-install';
-        } else {
-            $path = $row['file_path'] ?? '';
-            $suffix = '';
-        }
-        if (empty($row) || empty($path) || !is_file($path)) {
-            return json(['code' => 0, 'msg' => '文件不存在']);
-        }
-        return new StreamZipResponse($path, 'ywxapp-' . $row['version'] . $suffix . '.zip');
-    }
-
-    /**
-     * 兼容已安装库：在线补齐 patch_path / patch_hash / patch_from 列
-     */
-    private function ensurePatchColumns(): void
-    {
-        $table = \ywxapp\model\BaseModel::currentPrefix() . 'appmall_framework_list';
-        try {
-            $defs = [
-                'patch_path' => "varchar(255) DEFAULT '' COMMENT '增量补丁 zip 物理路径'",
-                'patch_hash' => "varchar(64) DEFAULT '' COMMENT '补丁 SHA256 校验值'",
-                'patch_from' => "varchar(20) DEFAULT '' COMMENT '补丁适用的基础版本'",
-                'install_path' => "varchar(255) DEFAULT '' COMMENT '完整安装包 zip 物理路径'",
-                'install_hash' => "varchar(64) DEFAULT '' COMMENT '完整安装包 SHA256 校验值'",
-            ];
-            foreach ($defs as $col => $def) {
-                $cols = Db::query("SHOW COLUMNS FROM `{$table}` LIKE '{$col}'");
-                if (empty($cols)) {
-                    Db::execute("ALTER TABLE `{$table}` ADD COLUMN `{$col}` {$def}");
-                }
-            }
-            // 历史数据迁移：旧「补丁行」(type=1 且 patch_path 为空) 把整包字段挪到补丁字段
-            Db::execute(
-                "UPDATE `{$table}` SET patch_path = file_path, patch_hash = file_hash, patch_from = from_version,"
-                . " file_path = '', file_hash = ''"
-                . " WHERE type = 1 AND (patch_path = '' OR patch_path IS NULL) AND file_path <> ''"
-            );
-        } catch (Exception $e) {
-            // ignore
-        }
-    }
-}

addon/appmall/controller/backend/Revenue.php

@@ -1,136 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp [ WE CAN DO IT JUST THINK ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-
-declare(strict_types=1);
-
-namespace addon\appmall\controller\backend;
-
-use think\facade\Db;
-use think\facade\View;
-use Exception;
-use ywxapp\controller\BackendBase;
-
-/**
- * 收益与结算管理（运营后台，中心站）
- *
- * - 收益账本：每笔已支付订单按平台抽成记账，归属对应开发者；
- * - 提现单：开发者发起（或运营代发）后在此审核打款/驳回。
- */
-class Revenue extends BackendBase
-{
-    /**
-     * 收益账本列表
-     */
-    public function index()
-    {
-        if ($this->request->isAjax()) {
-            $devId = $this->request->param('developer_id', '');
-            $query = Db::name('appmall_addon_revenues')->order('id', 'desc');
-            if ($devId !== '') {
-                $query->where('developer_id', (int) $devId);
-            }
-            $list = $query->paginate([
-                'page'      => (int) $this->request->param('page', 1),
-                'list_rows' => (int) $this->request->param('limit', 10),
-            ]);
-            // 汇总：总销售额 / 总抽成 / 总开发者收益
-            $summary = Db::name('appmall_addon_revenues')
-                ->field('SUM(amount) as total_amount, SUM(commission) as total_commission, SUM(income) as total_income')
-                ->find();
-            $this->result->setCount($list->total())->success([
-                'list'     => $list->items(),
-                'summary'  => [
-                    'total_amount'      => $summary['total_amount'] ?? 0,
-                    'total_commission'  => $summary['total_commission'] ?? 0,
-                    'total_income'      => $summary['total_income'] ?? 0,
-                ],
-            ], '获取成功');
-        }
-        return View::fetch('revenue/index');
-    }
-
-    /**
-     * 提现单列表
-     */
-    public function withdrawals()
-    {
-        if ($this->request->isAjax()) {
-            $status = $this->request->param('status', '');
-            $query  = Db::name('appmall_addon_withdrawals')->order('id', 'desc');
-            if ($status !== '') {
-                $query->where('status', (int) $status);
-            }
-            $list = $query->paginate([
-                'page'      => (int) $this->request->param('page', 1),
-                'list_rows' => (int) $this->request->param('limit', 10),
-            ]);
-            $this->result->setCount($list->total())->success($list->items(), '获取成功');
-        }
-        return View::fetch('revenue/withdrawal');
-    }
-
-    /**
-     * 审核通过：标记已打款，释放冻结金额，并将对应收益置为已结算
-     */
-    public function settle()
-    {
-        try {
-            $id = (int) input('id');
-            $w  = Db::name('appmall_addon_withdrawals')->where('id', $id)->find();
-            if (empty($w)) {
-                return $this->result->error('提现单不存在');
-            }
-            if ((int) $w['status'] !== 0) {
-                return $this->result->error('该单已处理');
-            }
-            Db::transaction(function () use ($w) {
-                // 释放冻结（实际打款为线下/对接支付，此处仅结算记账）
-                Db::name('appmall_developers')->where('id', $w['developer_id'])
-                    ->dec('frozen_balance', $w['amount'])->update();
-                Db::name('appmall_addon_withdrawals')->where('id', $w['id'])
-                    ->update(['status' => 1, 'update_at' => time()]);
-                // 同步将该开发者待结算收益置为已结算
-                Db::name('appmall_addon_revenues')->where('developer_id', $w['developer_id'])
-                    ->where('status', 0)
-                    ->update(['status' => 1, 'settle_at' => time()]);
-            });
-            return $this->result->success([], '已结算打款');
-        } catch (Exception $e) {
-            return $this->result->error($e->getMessage());
-        }
-    }
-
-    /**
-     * 驳回提现：冻结金额退回开发者可提现余额
-     */
-    public function rejectWithdrawal()
-    {
-        try {
-            $id     = (int) input('id');
-            $reason = input('reason', '');
-            $w      = Db::name('appmall_addon_withdrawals')->where('id', $id)->find();
-            if (empty($w)) {
-                return $this->result->error('提现单不存在');
-            }
-            if ((int) $w['status'] !== 0) {
-                return $this->result->error('该单已处理');
-            }
-            Db::transaction(function () use ($w, $reason) {
-                Db::name('appmall_developers')->where('id', $w['developer_id'])
-                    ->dec('frozen_balance', $w['amount'])
-                    ->inc('balance', $w['amount'])->update();
-                Db::name('appmall_addon_withdrawals')->where('id', $w['id'])
-                    ->update(['status' => -1, 'remark' => $reason, 'update_at' => time()]);
-            });
-            return $this->result->success([], '已驳回，金额已退回');
-        } catch (Exception $e) {
-            return $this->result->error($e->getMessage());
-        }
-    }
-}

addon/appmall/info.bak.php

@@ -1,19 +0,0 @@
-<?php
-
-return [
-    'name' => 'appmall',
-    'title' => '插件应用市场（服务端）',
-    'intro' => '应用服务中心（插件商店 + 主框架在线升级）服务端：插件市场列表 / 下载 / 授权校验 / 开发者提交与审核，以及主框架核心包版本发布与升级。部署在「中心站」，客户端通过 config ywxapp.api_url 连接。',
-    'author' => 'YwxApp',
-    'website' => 'https://www.ywxapp.cn',
-    'version' => '1.0.19',
-    'state' => 1,
-    'license' => false,
-    'events' => [
-    ],
-    'middleware' => [
-    ],
-    'services' => [
-    ],
-    'install_time' => 1785173040,
-];

addon/appmall/info.php

@@ -1,20 +0,0 @@
-<?php
-
-return [
-    'name' => 'appmall',
-    'title' => '应用市场',
-    'intro' => '应用服务中心（插件商店 + 主框架在线升级）服务端：插件市场列表 / 下载 / 授权校验 / 开发者提交与审核，以及主框架核心包版本发布与升级。部署在「中心站」，客户端通过 config ywxapp.api_url 连接。',
-    'author' => 'YwxApp',
-    'website' => 'https://www.ywxapp.cn',
-    'version' => '1.0.21',
-    'state' => 1,
-    'license' => false,
-    'events' => [
-    ],
-    'middleware' => [
-    ],
-    'services' => [
-    ],
-    'install_time' => 1786292662,
-    'update_time' => 1786808656,
-];

addon/appmall/install.sql

@@ -1,234 +0,0 @@
--- ============================================================
--- 插件应用市场（服务端）建表脚本
--- 由框架插件安装流程（AddonService::executeInstall）自动导入。
--- 部署「插件服务器（中心站）」并启用 market 插件后即生效。
--- 接口契约见 addons/appmall/controller/api/Market.php
--- ============================================================
-
-CREATE TABLE IF NOT EXISTS `__PREFIX__appmall_addon_list` (
-  `id` int unsigned NOT NULL AUTO_INCREMENT,
-  `name` varchar(50) NOT NULL COMMENT '插件标识符，如 mqttbroker',
-  `type` varchar(20) NOT NULL DEFAULT 'addon' COMMENT '商品类型：addon=插件 template=模板',
-  `developer_id` int unsigned DEFAULT '0' COMMENT '发布者（wxapp_appmall_developers.id），用于收益归属',
-  `title` varchar(100) NOT NULL COMMENT '插件名称',
-  `version` varchar(20) NOT NULL COMMENT '版本号',
-  `price` decimal(10,2) NOT NULL DEFAULT 0 COMMENT '价格，0 为免费',
-  `author` varchar(100) DEFAULT '' COMMENT '作者',
-  `description` text COMMENT '简介/描述',
-  `changelog` text COMMENT '更新日志',
-  `require_framework` varchar(20) DEFAULT '' COMMENT '最低兼容框架版本，如 1.2.0',
-  `logo` varchar(255) DEFAULT '' COMMENT '封面图 URL',
-  `category` varchar(50) DEFAULT '' COMMENT '分类（如：工具/电商/社交）',
-  `tags` varchar(255) DEFAULT '' COMMENT '标签（逗号分隔）',
-  `screenshots` text COMMENT '截图 URL（逗号分隔或 JSON 数组）',
-  `rating` decimal(2,1) DEFAULT '0.0' COMMENT '评分（0.0~5.0）',
-  `file_path` varchar(255) NOT NULL COMMENT 'zip 物理路径（非 Web 可访问目录）',
-  `file_hash` varchar(64) NOT NULL COMMENT 'SHA256 校验值',
-  `status` tinyint DEFAULT 1 COMMENT '1=上架 0=下架',
-  `download_count` int DEFAULT 0 COMMENT '下载次数',
-  `create_at` int DEFAULT 0 COMMENT '创建时间',
-  `update_at` int DEFAULT 0 COMMENT '更新时间',
-  PRIMARY KEY (`id`),
-  UNIQUE KEY `uk_name_version` (`name`, `version`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='插件市场商品表';
-
-CREATE TABLE IF NOT EXISTS `__PREFIX__appmall_addon_submissions` (
-  `id` int unsigned NOT NULL AUTO_INCREMENT,
-  `developer_id` int unsigned DEFAULT '0' COMMENT '提交者（wxapp_appmall_developers.id）',
-  `name` varchar(50) NOT NULL COMMENT '插件标识符',
-  `type` varchar(20) NOT NULL DEFAULT 'addon' COMMENT '商品类型：addon=插件 template=模板',
-  `title` varchar(100) NOT NULL COMMENT '插件名称',
-  `author` varchar(100) DEFAULT '' COMMENT '作者',
-  `description` text COMMENT '简介/描述',
-  `changelog` text COMMENT '更新日志',
-  `require_framework` varchar(20) DEFAULT '' COMMENT '最低兼容框架版本，如 1.2.0',
-  `version` varchar(20) NOT NULL COMMENT '版本号',
-  `price` decimal(10,2) NOT NULL DEFAULT 0 COMMENT '价格',
-  `category` varchar(50) DEFAULT '' COMMENT '分类',
-  `tags` varchar(255) DEFAULT '' COMMENT '标签（逗号分隔）',
-  `logo` varchar(255) DEFAULT '' COMMENT '封面图',
-  `file_path` varchar(255) NOT NULL COMMENT '待审 zip 物理路径',
-  `file_hash` varchar(64) NOT NULL COMMENT 'SHA256',
-  `status` tinyint DEFAULT 0 COMMENT '0=待审核 1=已通过 2=已驳回',
-  `reject_reason` varchar(255) DEFAULT '' COMMENT '驳回原因',
-  `create_at` int DEFAULT 0,
-  `update_at` int DEFAULT 0,
-  PRIMARY KEY (`id`),
-  UNIQUE KEY `uk_name_version` (`name`, `version`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='插件市场提交审核表';
-
-CREATE TABLE IF NOT EXISTS `__PREFIX__appmall_developers` (
-  `id` int unsigned NOT NULL AUTO_INCREMENT,
-  `username` varchar(100) NOT NULL COMMENT '开发者名称',
-  `email` varchar(120) NOT NULL COMMENT '邮箱（接收令牌/通知）',
-  `token` varchar(64) NOT NULL COMMENT '开发者令牌（发布插件时校验）',
-  `status` tinyint DEFAULT 0 COMMENT '0=待审核 1=正常 -1=禁用',
-  `balance` decimal(10,2) DEFAULT '0.00' COMMENT '可提现余额',
-  `frozen_balance` decimal(10,2) DEFAULT '0.00' COMMENT '待结算/冻结金额',
-  `create_at` int DEFAULT 0,
-  `update_at` int DEFAULT 0,
-  PRIMARY KEY (`id`),
-  UNIQUE KEY `uk_email` (`email`),
-  UNIQUE KEY `uk_token` (`token`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='市场开发者表';
-
-CREATE TABLE IF NOT EXISTS `__PREFIX__appmall_addon_revenues` (
-  `id` int unsigned NOT NULL AUTO_INCREMENT,
-  `developer_id` int unsigned NOT NULL DEFAULT '0' COMMENT '受益开发者',
-  `order_id` int unsigned NOT NULL DEFAULT '0' COMMENT 'wxapp_appmall_addon_orders.id',
-  `aid` int unsigned NOT NULL DEFAULT '0' COMMENT 'wxapp_appmall_addon_list.id',
-  `uid` int unsigned NOT NULL DEFAULT '0' COMMENT '购买用户',
-  `amount` decimal(10,2) NOT NULL DEFAULT '0.00' COMMENT '订单金额',
-  `commission` decimal(10,2) NOT NULL DEFAULT '0.00' COMMENT '平台抽成',
-  `income` decimal(10,2) NOT NULL DEFAULT '0.00' COMMENT '开发者应得',
-  `status` tinyint DEFAULT 0 COMMENT '0=待结算 1=已结算',
-  `create_at` int DEFAULT 0,
-  `settle_at` int DEFAULT 0,
-  PRIMARY KEY (`id`),
-  KEY `idx_developer` (`developer_id`),
-  KEY `idx_order` (`order_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='插件销售收益账本';
-
-CREATE TABLE IF NOT EXISTS `__PREFIX__appmall_addon_withdrawals` (
-  `id` int unsigned NOT NULL AUTO_INCREMENT,
-  `developer_id` int unsigned NOT NULL DEFAULT '0',
-  `amount` decimal(10,2) NOT NULL DEFAULT '0.00' COMMENT '提现金额',
-  `channel` varchar(20) DEFAULT 'alipay' COMMENT '提现渠道',
-  `account` varchar(100) DEFAULT '' COMMENT '收款账号',
-  `status` tinyint DEFAULT 0 COMMENT '0=待处理 1=已打款 -1=驳回',
-  `remark` varchar(255) DEFAULT '',
-  `create_at` int DEFAULT 0,
-  `update_at` int DEFAULT 0,
-  PRIMARY KEY (`id`),
-  KEY `idx_developer` (`developer_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='开发者提现单';
-
--- ============================================================
--- 以下三张表是「购买/授权闭环」的运行表（订单 / 授权 / 下载日志）。
--- 旧版 install.sql 漏建，导致新装中心站一调 buy/notify/下载就报「表不存在」。
--- 与 docs/appmall_schema.sql、客户端 app/api/controller/v1/Addon.php::ensureTables() 字段保持一致。
--- ============================================================
-
-CREATE TABLE IF NOT EXISTS `__PREFIX__appmall_addon_licenses` (
-  `id` int unsigned NOT NULL AUTO_INCREMENT,
-  `uid` int unsigned NOT NULL COMMENT '用户ID',
-  `aid` int unsigned NOT NULL COMMENT '对应 appmall_addon_list.id',
-  `license_key` varchar(64) NOT NULL COMMENT '授权码',
-  `site_id` int unsigned NOT NULL DEFAULT '0' COMMENT '绑定站点(wxapp_appmall_sites.id)，0=未绑定',
-  `domain` varchar(255) DEFAULT NULL COMMENT '绑定域名(站点授权，对齐 Discuz!)',
-  `status` tinyint NOT NULL DEFAULT '1' COMMENT '1=有效 0=已吊销(退款)',
-  `expire_time` int unsigned DEFAULT '0' COMMENT '0 为永久',
-  `download_count` int DEFAULT '0' COMMENT '下载次数限制',
-  `create_at` int DEFAULT 0 COMMENT '创建时间',
-  `update_at` int DEFAULT 0 COMMENT '更新时间',
-  PRIMARY KEY (`id`),
-  UNIQUE KEY `license_key` (`license_key`),
-  UNIQUE KEY `uk_uid_aid` (`uid`, `aid`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='插件授权表';
-
-CREATE TABLE IF NOT EXISTS `__PREFIX__appmall_addon_orders` (
-  `id` int unsigned NOT NULL AUTO_INCREMENT,
-  `uid` int unsigned NOT NULL DEFAULT '0',
-  `aid` int unsigned NOT NULL DEFAULT '0' COMMENT 'appmall_addon_list.id',
-  `site_id` int unsigned NOT NULL DEFAULT '0' COMMENT '下单站点',
-  `amount` decimal(10,2) NOT NULL DEFAULT '0' COMMENT '订单金额',
-  `status` tinyint NOT NULL DEFAULT '0' COMMENT '0=待支付 1=已支付 2=已退款',
-  `trade_no` varchar(64) NOT NULL DEFAULT '' COMMENT '商户订单号',
-  `pay_time` int unsigned DEFAULT '0' COMMENT '支付时间',
-  `create_at` int unsigned DEFAULT 0,
-  `update_at` int unsigned DEFAULT 0,
-  PRIMARY KEY (`id`),
-  KEY `idx_uid` (`uid`),
-  KEY `idx_trade` (`trade_no`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='插件购买订单表';
-
-CREATE TABLE IF NOT EXISTS `__PREFIX__appmall_addon_download_logs` (
-  `id` bigint unsigned NOT NULL AUTO_INCREMENT,
-  `license_id` int unsigned NOT NULL DEFAULT '0',
-  `uid` int unsigned NOT NULL DEFAULT '0',
-  `aid` int unsigned NOT NULL DEFAULT '0',
-  `operator_id` int unsigned NOT NULL DEFAULT '0' COMMENT '运营后台下载审计（Addons::downloadInstall 透传，0=会员自助下载）',
-  `ip` varchar(45) DEFAULT '',
-  `create_at` int unsigned DEFAULT 0,
-  PRIMARY KEY (`id`),
-  KEY `idx_license` (`license_id`),
-  KEY `idx_operator` (`operator_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='插件下载日志表';
-
--- 市场客户端站点（授权绑定的维度，对齐 Discuz!「授权绑定站点域名」）
-CREATE TABLE IF NOT EXISTS `__PREFIX__appmall_sites` (
-  `id` int unsigned NOT NULL AUTO_INCREMENT,
-  `site_token` varchar(64) NOT NULL DEFAULT '' COMMENT '站点令牌(客户端 install 时生成/上报)',
-  `domain` varchar(255) NOT NULL DEFAULT '' COMMENT '主域名',
-  `owner_uid` int unsigned NOT NULL DEFAULT '0' COMMENT '站点所有者用户ID',
-  `status` tinyint NOT NULL DEFAULT '1' COMMENT '1=正常 0=禁用',
-  `create_at` int DEFAULT 0,
-  `update_at` int DEFAULT 0,
-  PRIMARY KEY (`id`),
-  UNIQUE KEY `uk_domain` (`domain`),
-  KEY `idx_token` (`site_token`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='市场客户端站点(授权绑定维度)';
-
--- ============================================================
--- 主框架升级（原 upgrade 插件，已合并进 market）
--- 客户端 ywxapp\service\FrameworkService 经 /api/framework/* 拉取版本与核心包。
--- ============================================================
-
-CREATE TABLE IF NOT EXISTS `__PREFIX__appmall_framework_list` (
-  `id` int unsigned NOT NULL AUTO_INCREMENT,
-  `version` varchar(20) NOT NULL COMMENT '框架版本号',
-  `title` varchar(100) DEFAULT '' COMMENT '版本标题',
-  `changelog` text COMMENT '更新日志',
-  `file_path` varchar(255) DEFAULT '' COMMENT '整包 zip 物理路径（非 Web 可访问目录）',
-  `file_hash` varchar(64) DEFAULT '' COMMENT '整包 SHA256 校验值',
-  `patch_path` varchar(255) DEFAULT '' COMMENT '增量补丁 zip 物理路径（与整包同版本共存）',
-  `patch_hash` varchar(64) DEFAULT '' COMMENT '补丁 SHA256 校验值',
-  `patch_from` varchar(20) DEFAULT '' COMMENT '补丁适用的基础版本',
-  `type` tinyint DEFAULT 0 COMMENT '兼容旧客户端：0=含整包 1=仅补丁（逻辑以 patch_path 是否为空为准）',
-  `from_version` varchar(20) DEFAULT '' COMMENT '兼容旧客户端：补丁基础版本镜像',
-  `install_path` varchar(255) DEFAULT '' COMMENT '完整安装包 zip 物理路径（全新部署用，含占位符 .env，非 Web 可访问目录）',
-  `install_hash` varchar(64) DEFAULT '' COMMENT '完整安装包 SHA256 校验值',
-  `status` tinyint DEFAULT 0 COMMENT '0=草稿 1=已发布(可下载)',
-  `download_count` int DEFAULT 0 COMMENT '下载次数',
-  `create_at` int DEFAULT 0 COMMENT '创建时间',
-  `update_at` int DEFAULT 0 COMMENT '更新时间',
-  PRIMARY KEY (`id`),
-  UNIQUE KEY `uk_version` (`version`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='主框架版本表';
-
-CREATE TABLE IF NOT EXISTS `__PREFIX__appmall_framework_download_log` (
-  `id` int unsigned NOT NULL AUTO_INCREMENT,
-  `version` varchar(20) NOT NULL COMMENT '下载的版本号',
-  `uid` int DEFAULT 0 COMMENT '下载用户ID（来自客户端）',
-  `ip` varchar(45) DEFAULT '' COMMENT '下载来源IP',
-  `create_at` int DEFAULT 0 COMMENT '下载时间',
-  PRIMARY KEY (`id`),
-  KEY `idx_version` (`version`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='主框架下载日志表';
-
--- 接口频率限制（buy/notify/download/submit 等防刷）
-CREATE TABLE IF NOT EXISTS `__PREFIX__appmall_throttle` (
-  `id` int unsigned NOT NULL AUTO_INCREMENT,
-  `action` varchar(30) NOT NULL COMMENT '限流动作（buy/notify/download/submit）',
-  `ident` varchar(80) NOT NULL COMMENT '限流标识（uid 或 IP）',
-  `count` int unsigned NOT NULL DEFAULT 0 COMMENT '窗口内已请求次数',
-  `expire_at` int unsigned NOT NULL DEFAULT 0 COMMENT '窗口过期时间戳',
-  `create_at` int unsigned DEFAULT 0,
-  PRIMARY KEY (`id`),
-  UNIQUE KEY `uk_action_ident` (`action`, `ident`),
-  KEY `idx_expire` (`expire_at`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='接口频率限制表';
-
-CREATE TABLE IF NOT EXISTS `__PREFIX__appmall_addon_review_log` (
-  `id` int unsigned NOT NULL AUTO_INCREMENT,
-  `submission_id` int unsigned NOT NULL DEFAULT 0 COMMENT 'appmall_addon_submissions.id',
-  `operator_id` int unsigned NOT NULL DEFAULT 0 COMMENT '操作管理员ID',
-  `action` varchar(20) NOT NULL COMMENT '操作：submit/approve/reject',
-  `from_status` tinyint NOT NULL DEFAULT 0 COMMENT '变更前状态',
-  `to_status` tinyint NOT NULL DEFAULT 0 COMMENT '变更后状态',
-  `reason` varchar(255) NOT NULL DEFAULT '' COMMENT '审核意见/驳回理由',
-  `create_at` int unsigned NOT NULL DEFAULT 0 COMMENT '操作时间',
-  PRIMARY KEY (`id`),
-  KEY `idx_submission` (`submission_id`),
-  KEY `idx_create` (`create_at`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='插件审核历史日志（可视化时间线数据源）';

addon/appmall/library/AppmallSchema.php

@@ -1,247 +0,0 @@
-<?php
-namespace addon\appmall\library;
-
-use think\facade\Db;
-use ywxapp\model\BaseModel;
-
-/**
- * 应用市场（appmall）专属表结构自愈。
- *
- * 归属原则：appmall_* 表属于 appmall 插件私有表，其建表/补列逻辑内聚在本插件，
- * 不污染核心框架（核心只在 BaseModel 保留通用自愈引擎）。
- *
- * 建表 DDL 为运行时版事实源（与核心 install.sql 口径一致），列兜底幂等。
- */
-class AppmallSchema
-{
-    /**
-     * 集中创建 appmall 全部业务表（缺则建），并补齐老库扩展列。
-     *
-     * 中心站 / 客户端所有查询 appmall_* 表的入口（api/Market、backend/AddonReview、
-     * developer/Developer、service/MarketService）都应先调用本方法，避免全新安装后
-     * 走到未自愈的查询路径而触发 1146。
-     */
-    public static function ensure(): void
-    {
-        $prefix = BaseModel::currentPrefix();
-        $p = $prefix;
-        $tables = [
-            'appmall_addon_orders' => "CREATE TABLE IF NOT EXISTS `{$p}appmall_addon_orders` (
-                `id` int unsigned NOT NULL AUTO_INCREMENT,
-                `uid` int unsigned NOT NULL DEFAULT 0,
-                `aid` int unsigned NOT NULL DEFAULT 0 COMMENT 'appmall_addon_list.id',
-                `site_id` int unsigned NOT NULL DEFAULT 0 COMMENT '下单站点',
-                `amount` decimal(10,2) NOT NULL DEFAULT 0,
-                `status` tinyint NOT NULL DEFAULT 0 COMMENT '0=待支付 1=已支付 2=已退款',
-                `trade_no` varchar(64) NOT NULL DEFAULT '' COMMENT '商户订单号',
-                `pay_time` int unsigned DEFAULT 0,
-                `create_at` int unsigned DEFAULT 0,
-                `update_at` int unsigned DEFAULT 0,
-                PRIMARY KEY (`id`),
-                KEY `idx_uid` (`uid`),
-                KEY `idx_trade` (`trade_no`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='插件购买订单表';",
-            'appmall_addon_licenses' => "CREATE TABLE IF NOT EXISTS `{$p}appmall_addon_licenses` (
-                `id` int unsigned NOT NULL AUTO_INCREMENT,
-                `uid` int unsigned NOT NULL,
-                `aid` int unsigned NOT NULL,
-                `license_key` varchar(64) NOT NULL COMMENT '授权码',
-                `site_id` int unsigned NOT NULL DEFAULT 0 COMMENT '绑定站点',
-                `domain` varchar(255) DEFAULT NULL COMMENT '绑定域名(站点授权)',
-                `status` tinyint NOT NULL DEFAULT 1 COMMENT '1=有效 0=已吊销',
-                `expire_time` int unsigned DEFAULT 0 COMMENT '0为永久',
-                `download_count` int DEFAULT 0 COMMENT '下载次数限制',
-                `create_at` int DEFAULT 0,
-                `update_at` int DEFAULT 0,
-                PRIMARY KEY (`id`),
-                UNIQUE KEY `license_key` (`license_key`),
-                UNIQUE KEY `uk_uid_aid` (`uid`, `aid`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='插件授权表';",
-            'appmall_addon_download_logs' => "CREATE TABLE IF NOT EXISTS `{$p}appmall_addon_download_logs` (
-                `id` bigint unsigned NOT NULL AUTO_INCREMENT,
-                `license_id` int unsigned NOT NULL DEFAULT 0,
-                `uid` int unsigned NOT NULL DEFAULT 0,
-                `aid` int unsigned NOT NULL DEFAULT 0,
-                `operator_id` int unsigned NOT NULL DEFAULT 0 COMMENT '运营后台安装者（特权放行审计）',
-                `ip` varchar(45) DEFAULT '',
-                `create_at` int unsigned DEFAULT 0,
-                PRIMARY KEY (`id`),
-                KEY `idx_license` (`license_id`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='插件下载日志表';",
-            'appmall_throttle' => "CREATE TABLE IF NOT EXISTS `{$p}appmall_throttle` (
-                `id` int unsigned NOT NULL AUTO_INCREMENT,
-                `action` varchar(30) NOT NULL COMMENT '限流动作（buy/notify/download/submit）',
-                `ident` varchar(80) NOT NULL COMMENT '限流标识（uid 或 IP）',
-                `count` int unsigned NOT NULL DEFAULT 0 COMMENT '窗口内已请求次数',
-                `expire_at` int unsigned NOT NULL DEFAULT 0 COMMENT '窗口过期时间戳',
-                `create_at` int unsigned DEFAULT 0,
-                PRIMARY KEY (`id`),
-                UNIQUE KEY `uk_action_ident` (`action`, `ident`),
-                KEY `idx_expire` (`expire_at`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='接口频率限制表';",
-            'appmall_addon_review_log' => "CREATE TABLE IF NOT EXISTS `{$p}appmall_addon_review_log` (
-                `id` int unsigned NOT NULL AUTO_INCREMENT,
-                `submission_id` int unsigned NOT NULL DEFAULT 0 COMMENT 'appmall_addon_submissions.id',
-                `operator_id` int unsigned NOT NULL DEFAULT 0 COMMENT '操作管理员ID',
-                `action` varchar(20) NOT NULL COMMENT '操作：submit/approve/reject',
-                `from_status` tinyint NOT NULL DEFAULT 0 COMMENT '变更前状态',
-                `to_status` tinyint NOT NULL DEFAULT 0 COMMENT '变更后状态',
-                `reason` varchar(255) NOT NULL DEFAULT '' COMMENT '审核意见/驳回理由',
-                `create_at` int unsigned NOT NULL DEFAULT 0 COMMENT '操作时间',
-                PRIMARY KEY (`id`),
-                KEY `idx_submission` (`submission_id`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='插件审核历史日志（可视化时间线数据源）';",
-            'appmall_developers' => "CREATE TABLE IF NOT EXISTS `{$p}appmall_developers` (
-                `id` int unsigned NOT NULL AUTO_INCREMENT,
-                `username` varchar(100) NOT NULL COMMENT '开发者名称',
-                `email` varchar(120) NOT NULL COMMENT '邮箱（接收令牌/通知）',
-                `token` varchar(64) NOT NULL COMMENT '开发者令牌（发布插件时校验）',
-                `status` tinyint DEFAULT 0 COMMENT '0=待审核 1=正常 -1=禁用',
-                `balance` decimal(10,2) DEFAULT '0.00' COMMENT '可提现余额',
-                `frozen_balance` decimal(10,2) DEFAULT '0.00' COMMENT '待结算/冻结金额',
-                `create_at` int DEFAULT 0,
-                `update_at` int DEFAULT 0,
-                PRIMARY KEY (`id`),
-                UNIQUE KEY `uk_email` (`email`),
-                UNIQUE KEY `uk_token` (`token`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='市场开发者表';",
-            'appmall_addon_revenues' => "CREATE TABLE IF NOT EXISTS `{$p}appmall_addon_revenues` (
-                `id` int unsigned NOT NULL AUTO_INCREMENT,
-                `developer_id` int unsigned NOT NULL DEFAULT '0' COMMENT '受益开发者',
-                `order_id` int unsigned NOT NULL DEFAULT '0' COMMENT 'appmall_addon_orders.id',
-                `aid` int unsigned NOT NULL DEFAULT '0' COMMENT 'appmall_addon_list.id',
-                `uid` int unsigned NOT NULL DEFAULT '0' COMMENT '购买用户',
-                `amount` decimal(10,2) NOT NULL DEFAULT '0.00' COMMENT '订单金额',
-                `commission` decimal(10,2) NOT NULL DEFAULT '0.00' COMMENT '平台抽成',
-                `income` decimal(10,2) NOT NULL DEFAULT '0.00' COMMENT '开发者应得',
-                `status` tinyint DEFAULT 0 COMMENT '0=待结算 1=已结算',
-                `create_at` int DEFAULT 0,
-                `settle_at` int DEFAULT 0,
-                PRIMARY KEY (`id`),
-                KEY `idx_developer` (`developer_id`),
-                KEY `idx_order` (`order_id`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='插件销售收益账本';",
-            'appmall_addon_withdrawals' => "CREATE TABLE IF NOT EXISTS `{$p}appmall_addon_withdrawals` (
-                `id` int unsigned NOT NULL AUTO_INCREMENT,
-                `developer_id` int unsigned NOT NULL DEFAULT '0',
-                `amount` decimal(10,2) NOT NULL DEFAULT '0.00' COMMENT '提现金额',
-                `channel` varchar(20) DEFAULT 'alipay' COMMENT '提现渠道',
-                `account` varchar(100) DEFAULT '' COMMENT '收款账号',
-                `status` tinyint DEFAULT 0 COMMENT '0=待处理 1=已打款 -1=驳回',
-                `remark` varchar(255) DEFAULT '',
-                `create_at` int DEFAULT 0,
-                `update_at` int DEFAULT 0,
-                PRIMARY KEY (`id`),
-                KEY `idx_developer` (`developer_id`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='开发者提现单';",
-            'appmall_addon_submissions' => "CREATE TABLE IF NOT EXISTS `{$p}appmall_addon_submissions` (
-                `id` int unsigned NOT NULL AUTO_INCREMENT,
-                `developer_id` int unsigned NOT NULL DEFAULT 0 COMMENT 'appmall_developers.id',
-                `name` varchar(50) NOT NULL COMMENT '插件标识符',
-                `type` varchar(20) NOT NULL DEFAULT 'addon' COMMENT '商品类型：addon=插件 template=模板',
-                `title` varchar(100) NOT NULL DEFAULT '' COMMENT '名称',
-                `author` varchar(100) DEFAULT '' COMMENT '作者',
-                `description` text COMMENT '简介',
-                `version` varchar(20) NOT NULL COMMENT '版本号',
-                `price` decimal(10,2) NOT NULL DEFAULT 0 COMMENT '价格',
-                `logo` varchar(255) DEFAULT '' COMMENT '封面',
-                `category` varchar(50) DEFAULT '' COMMENT '分类',
-                `tags` varchar(255) DEFAULT '' COMMENT '标签',
-                `file_path` varchar(255) NOT NULL COMMENT '待审包路径',
-                `file_hash` varchar(64) NOT NULL COMMENT 'SHA256',
-                `status` tinyint DEFAULT 0 COMMENT '0待审 1通过 2驳回',
-                `reject_reason` varchar(255) DEFAULT '' COMMENT '驳回原因',
-                `create_at` int DEFAULT 0,
-                `update_at` int DEFAULT 0,
-                PRIMARY KEY (`id`),
-                UNIQUE KEY `uk_name_ver` (`name`, `version`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='插件提交审核表';",
-            'appmall_addon_list' => "CREATE TABLE IF NOT EXISTS `{$p}appmall_addon_list` (
-                `id` int unsigned NOT NULL AUTO_INCREMENT,
-                `name` varchar(50) NOT NULL COMMENT '标识符',
-                `type` varchar(20) NOT NULL DEFAULT 'addon' COMMENT '商品类型：addon=插件 template=模板',
-                `developer_id` int unsigned NOT NULL DEFAULT 0 COMMENT 'appmall_developers.id',
-                `title` varchar(100) NOT NULL COMMENT '名称',
-                `version` varchar(20) NOT NULL COMMENT '版本号',
-                `price` decimal(10,2) NOT NULL DEFAULT 0 COMMENT '价格',
-                `author` varchar(100) DEFAULT '' COMMENT '作者',
-                `description` text COMMENT '简介/描述',
-                `logo` varchar(255) DEFAULT '' COMMENT '封面图 URL',
-                `file_path` varchar(255) NOT NULL COMMENT '存储路径(非公开)',
-                `file_hash` varchar(64) NOT NULL COMMENT 'SHA256校验值',
-                `category` varchar(50) DEFAULT '' COMMENT '分类',
-                `tags` varchar(255) DEFAULT '' COMMENT '标签',
-                `screenshots` text COMMENT '截图URL（逗号分隔或JSON）',
-                `rating` decimal(2,1) DEFAULT '0.0' COMMENT '评分（0.0~5.0）',
-                `status` tinyint DEFAULT 1 COMMENT '1上架 0下架',
-                `download_count` int DEFAULT 0 COMMENT '下载次数',
-                `create_at` int DEFAULT 0 COMMENT '创建时间',
-                `update_at` int DEFAULT 0 COMMENT '更新时间',
-                PRIMARY KEY (`id`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='市场插件列表';",
-            'appmall_sites' => "CREATE TABLE IF NOT EXISTS `{$p}appmall_sites` (
-                `id` int unsigned NOT NULL AUTO_INCREMENT,
-                `site_token` varchar(64) NOT NULL DEFAULT '' COMMENT '站点令牌(客户端 install 时生成/上报)',
-                `domain` varchar(255) NOT NULL DEFAULT '' COMMENT '主域名',
-                `owner_uid` int unsigned NOT NULL DEFAULT '0' COMMENT '站点所有者用户ID',
-                `status` tinyint NOT NULL DEFAULT '1' COMMENT '1=正常 0=禁用',
-                `create_at` int DEFAULT 0,
-                `update_at` int DEFAULT 0,
-                PRIMARY KEY (`id`),
-                UNIQUE KEY `uk_domain` (`domain`),
-                KEY `idx_token` (`site_token`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='市场客户端站点(授权绑定维度)';",
-            'appmall_framework_list' => "CREATE TABLE IF NOT EXISTS `{$p}appmall_framework_list` (
-                `id` int unsigned NOT NULL AUTO_INCREMENT,
-                `version` varchar(20) NOT NULL COMMENT '框架版本号',
-                `title` varchar(100) DEFAULT '' COMMENT '版本标题',
-                `changelog` text COMMENT '更新日志',
-                `file_path` varchar(255) DEFAULT '' COMMENT '整包 zip 物理路径（非 Web 可访问目录）',
-                `file_hash` varchar(64) DEFAULT '' COMMENT '整包 SHA256 校验值',
-                `patch_path` varchar(255) DEFAULT '' COMMENT '增量补丁 zip 物理路径（与整包同版本共存）',
-                `patch_hash` varchar(64) DEFAULT '' COMMENT '补丁 SHA256 校验值',
-                `patch_from` varchar(20) DEFAULT '' COMMENT '补丁适用的基础版本',
-                `type` tinyint DEFAULT 0 COMMENT '兼容旧客户端：0=含整包 1=仅补丁',
-                `from_version` varchar(20) DEFAULT '' COMMENT '兼容旧客户端：补丁基础版本镜像',
-                `status` tinyint DEFAULT 0 COMMENT '0=草稿 1=已发布(可下载)',
-                `download_count` int DEFAULT 0 COMMENT '下载次数',
-                `create_at` int DEFAULT 0 COMMENT '创建时间',
-                `update_at` int DEFAULT 0 COMMENT '更新时间',
-                PRIMARY KEY (`id`),
-                UNIQUE KEY `uk_version` (`version`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='主框架版本表';",
-            'appmall_framework_download_log' => "CREATE TABLE IF NOT EXISTS `{$p}appmall_framework_download_log` (
-                `id` int unsigned NOT NULL AUTO_INCREMENT,
-                `version` varchar(20) NOT NULL COMMENT '下载的版本号',
-                `uid` int DEFAULT 0 COMMENT '下载用户ID（来自客户端）',
-                `ip` varchar(45) DEFAULT '' COMMENT '下载来源IP',
-                `create_at` int DEFAULT 0 COMMENT '下载时间',
-                PRIMARY KEY (`id`),
-                KEY `idx_version` (`version`)
-            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='主框架下载日志表';",
-        ];
-        foreach ($tables as $t => $sql) {
-            BaseModel::ensureTable($prefix . $t, $sql);
-        }
-        // 老库扩展列兜底（幂等）
-        $list = $prefix . 'appmall_addon_list';
-        BaseModel::ensureColumn($list, 'category', "varchar(50) DEFAULT '' COMMENT '分类'");
-        BaseModel::ensureColumn($list, 'tags', "varchar(255) DEFAULT '' COMMENT '标签（逗号分隔）'");
-        BaseModel::ensureColumn($list, 'screenshots', "text COMMENT '截图URL（逗号分隔或JSON）'");
-        BaseModel::ensureColumn($list, 'rating', "decimal(2,1) DEFAULT '0.0' COMMENT '评分（0.0~5.0）'");
-        BaseModel::ensureColumn($list, 'changelog', "text COMMENT '更新日志'");
-        BaseModel::ensureColumn($list, 'require_framework', "varchar(20) DEFAULT '' COMMENT '最低兼容框架版本，如 1.2.0'");
-        BaseModel::ensureColumn($list, 'type', "varchar(20) NOT NULL DEFAULT 'addon' COMMENT '商品类型：addon=插件 template=模板'");
-        $sub = $prefix . 'appmall_addon_submissions';
-        BaseModel::ensureColumn($sub, 'changelog', "text COMMENT '更新日志'");
-        BaseModel::ensureColumn($sub, 'require_framework', "varchar(20) DEFAULT '' COMMENT '最低兼容框架版本，如 1.2.0'");
-        BaseModel::ensureColumn($sub, 'type', "varchar(20) NOT NULL DEFAULT 'addon' COMMENT '商品类型：addon=插件 template=模板'");
-        BaseModel::ensureColumn($prefix . 'appmall_addon_download_logs', 'operator_id', "int unsigned NOT NULL DEFAULT 0 COMMENT '运营后台安装者（特权放行审计）'");
-        BaseModel::ensureColumn($prefix . 'appmall_developers', 'balance', "decimal(10,2) NOT NULL DEFAULT '0.00' COMMENT '可提现余额'");
-        BaseModel::ensureColumn($prefix . 'appmall_developers', 'frozen_balance', "decimal(10,2) NOT NULL DEFAULT '0.00' COMMENT '待结算/冻结金额'");
-        BaseModel::ensureColumn($prefix . 'appmall_addon_licenses', 'status', "tinyint NOT NULL DEFAULT '1' COMMENT '1=有效 0=已吊销'");
-        BaseModel::ensureColumn($prefix . 'appmall_addon_licenses', 'site_id', "int unsigned NOT NULL DEFAULT '0' COMMENT '绑定站点'");
-        BaseModel::ensureColumn($prefix . 'appmall_addon_licenses', 'domain', "varchar(255) DEFAULT NULL COMMENT '绑定域名(站点授权)'");
-        BaseModel::ensureColumn($prefix . 'appmall_addon_licenses', 'expire_time', "int unsigned DEFAULT 0 COMMENT '0为永久'");
-    }
-}

addon/appmall/menu.json

@@ -1,51 +0,0 @@
-{
-  "backend": [
-    {
-      "name": "appmall",
-      "title": "应用市场",
-      "type": 1,
-      "icon": "fa fa-shopping-cart",
-      "child": [
-        {
-          "name": "addonreview",
-          "title": "插件审核",
-          "type": 2,
-          "route": "/appmall/backend/addonreview/index"
-        },
-        {
-          "name": "developer",
-          "title": "开发者管理",
-          "type": 2,
-          "route": "/appmall/backend/developer/index"
-        },
-        {
-          "name": "revenuelist",
-          "title": "收益账本",
-          "type": 2,
-          "route": "/appmall/backend/revenue/index"
-        },
-        {
-          "name": "withdrawallist",
-          "title": "提现管理",
-          "type": 2,
-          "route": "/appmall/backend/revenue/withdrawals"
-        }
-      ]
-    },
-    {
-      "icon": "fa fa-cloud-download",
-      "name": "frameworklist",
-      "title": "框架管理",
-      "type": 2,
-      "route": "/appmall/backend/framework/index"
-    }
-  ],
-  "member": [],
-  "frontend": [
-    {
-      "name": "frameworkdisplay",
-      "title": "框架下载",
-      "route": "/appmall/frontend/framework/index"
-    }
-  ]
-}

addon/appmall/model/AddonDownloadLog.php

@@ -1,33 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp AppMarket [ 应用市场中心站插件 ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-
-declare(strict_types=1);
-
-namespace addon\appmall\model;
-
-use ywxapp\model\BaseModel;
-
-/**
- * 插件下载日志（中心站，风控用）
- * 表：appmall_addon_download_logs
- * @mixin \think\Model
- */
-class AddonDownloadLog extends BaseModel
-{
-    protected function getOptions(): array
-    {
-        return [
-            'strict'             => true,
-            'name'               => 'appmall_addon_download_logs',
-            'autoWriteTimestamp' => 'int',
-            'createTime'         => 'create_at',
-            'updateTime'         => false,
-        ];
-    }
-}

addon/appmall/model/AddonLicense.php

@@ -1,57 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp AppMarket [ 应用市场中心站插件 ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-
-declare(strict_types=1);
-
-namespace addon\appmall\model;
-
-use ywxapp\model\BaseModel;
-
-/**
- * 插件授权（中心站）
- * 表：appmall_addon_licenses
- * @mixin \think\Model
- */
-class AddonLicense extends BaseModel
-{
-    protected function getOptions(): array
-    {
-        return [
-            'strict'             => true,
-            'name'               => 'appmall_addon_licenses',
-            'autoWriteTimestamp' => 'int',
-            'readonly'           => ['uid'],
-            'createTime'         => 'create_at',
-            'updateTime'         => 'update_at',
-        ];
-    }
-
-    /**
-     * 关联插件信息（核心插件注册表）
-     * @return \think\model\relation\BelongsTo
-     */
-    public function addon()
-    {
-        return $this->belongsTo(\ywxapp\model\CommonAddon::class, 'aid', 'id');
-    }
-
-    /**
-     * 生成安全签名（防链接泄漏）
-     * @param string $licenseKey 授权码
-     * @param int    $aid        插件ID
-     * @param int    $timestamp  时间戳
-     * @param string $secret     签名密钥（仅作 HMAC key，不要拼进消息）
-     * @return string
-     */
-    public function generateSign(string $licenseKey, int $aid, int $timestamp, string $secret): string
-    {
-        $str = $licenseKey . $aid . $timestamp;
-        return hash_hmac('sha256', $str, $secret);
-    }
-}

addon/appmall/model/AddonOrder.php

@@ -1,34 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp AppMarket [ 应用市场中心站插件 ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-
-declare(strict_types=1);
-
-namespace addon\appmall\model;
-
-use ywxapp\model\BaseModel;
-
-/**
- * 插件订单（中心站）
- * 表：appmall_addon_orders
- * @mixin \think\Model
- */
-class AddonOrder extends BaseModel
-{
-    protected function getOptions(): array
-    {
-        return [
-            'strict'             => true,
-            'name'               => 'appmall_addon_orders',
-            'autoWriteTimestamp' => 'int',
-            'readonly'           => ['uid'],
-            'createTime'         => 'create_at',
-            'updateTime'         => 'update_at',
-        ];
-    }
-}

addon/appmall/model/Developer.php

@@ -1,51 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp AppMarket [ 应用市场中心站插件 ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-
-declare(strict_types=1);
-
-namespace addon\appmall\model;
-
-use ywxapp\model\BaseModel;
-
-/**
- * 开发者（中心站）
- * 表：appmall_developers
- * @mixin \think\Model
- */
-class Developer extends BaseModel
-{
-    protected function getOptions(): array
-    {
-        return [
-            'strict'             => true,
-            'name'               => 'appmall_developers',
-            'autoWriteTimestamp' => 'int',
-            'createTime'         => 'create_at',
-            'updateTime'         => 'update_at',
-        ];
-    }
-
-    /**
-     * 关联收益记录
-     * @return \think\model\relation\HasMany
-     */
-    public function revenues()
-    {
-        return $this->hasMany(Revenue::class, 'developer_id', 'id');
-    }
-
-    /**
-     * 关联提现单
-     * @return \think\model\relation\HasMany
-     */
-    public function withdrawals()
-    {
-        return $this->hasMany(Withdrawal::class, 'developer_id', 'id');
-    }
-}

addon/appmall/model/Revenue.php

@@ -1,42 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp AppMarket [ 应用市场中心站插件 ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-
-declare(strict_types=1);
-
-namespace addon\appmall\model;
-
-use ywxapp\model\BaseModel;
-
-/**
- * 插件销售收益账本（中心站）
- * 表：appmall_addon_revenues（无 update_at，结算时间用 settle_at 业务字段）
- * @mixin \think\Model
- */
-class Revenue extends BaseModel
-{
-    protected function getOptions(): array
-    {
-        return [
-            'strict'             => true,
-            'name'               => 'appmall_addon_revenues',
-            'autoWriteTimestamp' => 'int',
-            'createTime'         => 'create_at',
-            'updateTime'         => false,
-        ];
-    }
-
-    /**
-     * 关联开发者
-     * @return \think\model\relation\BelongsTo
-     */
-    public function developer()
-    {
-        return $this->belongsTo(Developer::class, 'developer_id', 'id');
-    }
-}

addon/appmall/model/Withdrawal.php

@@ -1,42 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp AppMarket [ 应用市场中心站插件 ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-
-declare(strict_types=1);
-
-namespace addon\appmall\model;
-
-use ywxapp\model\BaseModel;
-
-/**
- * 开发者提现单（中心站）
- * 表：appmall_addon_withdrawals
- * @mixin \think\Model
- */
-class Withdrawal extends BaseModel
-{
-    protected function getOptions(): array
-    {
-        return [
-            'strict'             => true,
-            'name'               => 'appmall_addon_withdrawals',
-            'autoWriteTimestamp' => 'int',
-            'createTime'         => 'create_at',
-            'updateTime'         => 'update_at',
-        ];
-    }
-
-    /**
-     * 关联开发者
-     * @return \think\model\relation\BelongsTo
-     */
-    public function developer()
-    {
-        return $this->belongsTo(Developer::class, 'developer_id', 'id');
-    }
-}

addon/appmall/route/app.php

@@ -1,128 +0,0 @@
-<?php
-/*
- * @Author: YwxApp <ywx@ywxapp.cn>
- * @Date: 2026-07-21 13:36:46
- * @LastEditors: YwxApp <ywx@ywxapp.cn>
- * @LastEditTime: 2026-08-04 22:21:46
- * @Description: 应用市场插件统一路由（对外 API + 主应用业务路由）
- * @FilePath: \ywxapp_dev\addon\appmall\route\app.php
- * @CustomString: Copyright (c) 2026 YwxApp
- */
-// ============================================================
-// 应用市场插件「统一路由入口」（替代原散落的 route/api.php）。
-//
-// 插件名前缀（/appmall）由外层加载器统一补全，本文件【不要】自行写前缀：
-//   主应用：ywxapp/service/AppService::loadAddonRoutes() 包 Route::group('appmall')
-//
-// 全部路由（业务 + 对外 API）都在主应用 boot 阶段注册，形式为「相对组名」，
-// 由外层 Route::group('appmall') 补全 → /appmall/backend、/appmall/developer、
-// /appmall/api（与「插件名开头」约定一致，彻底避免多插件路由冲突）。
-// 注意：group 前缀是累加的，文件内【不要】再写 /appmall/ 或 /api/ 这样的前缀（会双重前缀）。
-// ============================================================
-
-use think\facade\Route;
-use addon\appmall\controller\api\Market;
-use addon\appmall\controller\backend\AddonReview;
-use addon\appmall\controller\backend\Developer;
-use addon\appmall\controller\backend\Revenue as BackendRevenue;
-use addon\appmall\controller\Developer as DeveloperCenter;
-use addon\appmall\controller\backend\Framework;
-use addon\appmall\controller\api\Framework as ApiFramework;
-use addon\appmall\controller\Framework as FrontendFramework;
-use addon\appmall\controller\Store;
-
-// ===================== 业务路由 + 对外 API（/appmall/*） =====================
-// 插件名前缀 /appmall 由 AppService::loadAddonRoutes() 的 Route::group('appmall') 补全。
-
-// ---------- 后台：插件审核 / 开发者管理 / 收益与结算（统一前缀 /appmall/backend） ----------
-Route::group('backend', function () {
-    // 插件审核
-    Route::get('addonreview', [AddonReview::class, 'index']);
-    Route::get('addonreview/index', [AddonReview::class, 'index']);
-    Route::post('addonreview/approve', [AddonReview::class, 'approve']);
-    Route::post('addonreview/reject', [AddonReview::class, 'reject']);
-    Route::post('addonreview/updatePrice', [AddonReview::class, 'updatePrice']);
-    Route::get('addonreview/download', [AddonReview::class, 'download']);
-    Route::get('addonreview/detail', [AddonReview::class, 'detail']);
-    Route::get('addonreview/detailview', [AddonReview::class, 'detailview']);
-    Route::get('addonreview/history', [AddonReview::class, 'history']);
-
-    // 开发者管理
-    Route::get('developer', [Developer::class, 'index']);
-    Route::get('developer/index', [Developer::class, 'index']);
-    Route::post('developer/approve', [Developer::class, 'approve']);
-    Route::post('developer/disable', [Developer::class, 'disable']);
-    Route::post('developer/resend', [Developer::class, 'resend']);
-    Route::post('developer/reset', [Developer::class, 'reset']);
-
-    // 收益与结算
-    Route::get('revenue', [BackendRevenue::class, 'index']);
-    Route::get('revenue/index', [BackendRevenue::class, 'index']);
-    Route::get('revenue/withdrawals', [BackendRevenue::class, 'withdrawals']);
-    Route::post('revenue/settle', [BackendRevenue::class, 'settle']);
-    Route::post('revenue/reject', [BackendRevenue::class, 'rejectWithdrawal']);
-
-    // 主框架升级（原 upgrade 插件，已合并进 market）
-    Route::get('framework', [Framework::class, 'index']);
-    Route::get('framework/index', [Framework::class, 'index']);
-    Route::post('framework/upload', [Framework::class, 'upload']);
-    Route::post('framework/publish', [Framework::class, 'publish']);
-    Route::post('framework/delete', [Framework::class, 'delete']);
-    Route::get('framework/download', [Framework::class, 'download']);
-});
- 
-// ---------- 开发者中心（独立前台应用，公开注册/令牌/收益/提现，非会员中心）：统一前缀 /appmall/developer ----------
-// 仅【中心站】暴露：开发者自助注册/收益/提现依赖 appmall_developers / appmall_addon_revenues / appmall_addon_withdrawals 等
-// 运营表，客户机（ywxapp.api_url 指向其他服务器，见 is_market_client()）作为中心站客户端不持有这些表，故不在路由层注册，
-// 访问即 404。配合 Developer 控制器 initialize() 的运行时兜底（即便路由缓存陈旧或被直连也能拦截）。
-// ---------- 开发者中心（独立前台，令牌认证）：/appmall/Developer/* ----------
- 
-    Route::get('developer/index', [DeveloperCenter::class, 'index']);
-    Route::post('developer/save', [DeveloperCenter::class, 'save']);
-    Route::get('developer/mine', [DeveloperCenter::class, 'mine']);
-    Route::post('developer/lookup', [DeveloperCenter::class, 'lookup']);
-    Route::get('developer/dashboard', [DeveloperCenter::class, 'dashboard']);
-    Route::get('developer/console', [DeveloperCenter::class, 'console']);
-    Route::post('developer/overview', [DeveloperCenter::class, 'overview']);
-    Route::post('developer/apps', [DeveloperCenter::class, 'apps']);
-    Route::post('developer/price', [DeveloperCenter::class, 'price']);
-    Route::post('developer/earnings', [DeveloperCenter::class, 'earnings']);
-    Route::post('developer/withdraw', [DeveloperCenter::class, 'withdraw']);
- 
-// ---------- 对外 API（统一前缀 /appmall/api）：远程客户机经 Remote/Addon/FrameworkService 调用 ----------
-// 由 AppService::loadAddonRoutes() 的 Route::group('appmall') 补全插件名前缀 → /appmall/api/*
-//（与 /appmall/backend、/appmall/developer 同源同构，均为「插件名开头」约定）。
-// 调用方契约（勿单侧改动）：
-//   RemoteAppmallService → /appmall/api/addon/*、/appmall/api/index
-//   AddonService           → /appmall/api/addon/valid、/appmall/api/index/index
-//   FrameworkService       → /appmall/api/framework/version、/appmall/api/framework/download
-Route::group('api', function () {
-    Route::get('addon/lists', [Market::class, 'lists']);
-    Route::get('addon/info', [Market::class, 'info']);
-    Route::post('addon/valid', [Market::class, 'valid']);
-    Route::post('addon/submit', [Market::class, 'submit']);
-    Route::post('addon/buy', [Market::class, 'buy']);
-    Route::get('addon/orderStatus', [Market::class, 'orderStatus']);
-    Route::post('addon/notify', [Market::class, 'notify']);
-    Route::get('addon/payResult', [Market::class, 'payResult']);
-    Route::post('addon/refund', [Market::class, 'refund']);
-    Route::get('addon/my', [Market::class, 'my']);
-    // 插件 zip 下载（RemoteAppmallService 走 /appmall/api/index，AddonService 走 /appmall/api/index/index）
-    Route::get('index', [Market::class, 'index']);
-    Route::get('index/index', [Market::class, 'index']);
-    // 主框架升级分发（FrameworkService 走 /appmall/api/framework/*）
-    Route::get('framework/version', [ApiFramework::class, 'version']);
-    Route::get('framework/download', [ApiFramework::class, 'download']);
-});
-
-// ---------- 前台展示（公开，仅中心站）：主框架发布/下载页 + 应用商店 ----------
-// 前台控制器直接置于 addon\appmall\controller 下（如 ForumFrontend 惯例），
-// 不套 frontend 子目录；URL 前缀为 /appmall/framework、/appmall/store。
-Route::get('framework', [FrontendFramework::class, 'index']);
-Route::get('framework/index', [FrontendFramework::class, 'index']);
-// 应用商店：上线插件列表（/appmall/store）
-Route::get('store', [Store::class, 'index'])->completeMatch();
-Route::get('store/index', [Store::class, 'index'])->completeMatch();
-// 插件详情页（/appmall/store/detail/<name>）
-Route::get('store/detail/:name', [Store::class, 'detail'])
-    ->pattern(['name' => '[\w\-]+']);

addon/appmall/service/MarketException.php

@@ -1,20 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp AppMarket [ 应用市场中心站插件 ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-
-declare(strict_types=1);
-
-namespace addon\appmall\service;
-
-/**
- * 市场领域业务异常：code 携带 HTTP 语义（403/404/500 等），
- * 由调用方（核心 v1/Addon 等）转换为对应的 Result 错误响应。
- */
-class MarketException extends \RuntimeException
-{
-}

addon/appmall/service/MarketService.php

@@ -1,701 +0,0 @@
-<?php
-// +----------------------------------------------------------------------
-// | YwxApp AppMarket [ 应用市场中心站插件 ]
-// +----------------------------------------------------------------------
-// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
-// +----------------------------------------------------------------------
-// | Author: ywxapp<admin@ywxapp.cn>
-// +----------------------------------------------------------------------
-
-declare(strict_types=1);
-
-namespace addon\appmall\service;
-
-use addon\appmall\model\AddonDownloadLog;
-use addon\appmall\model\AddonLicense;
-use addon\appmall\model\AddonOrder;
-use think\facade\Cache;
-use think\facade\Db;
-use think\facade\Log;
-use think\Request;
-use ywxapp\model\BaseModel;
-use Yansongda\Pay\Pay;
-
-/**
- * 市场中心站本地成交域服务（会员直购 / 授权 / 收益 / 下载）。
- *
- * 由核心 app/api/controller/v1/Addon.php 在「本机即中心站」模式下进程内委托调用；
- * 所有中心站领域逻辑（订单、授权、收益账本、支付回调）收敛于插件，核心不再持有。
- *
- * 约定：业务失败抛 MarketException（携带 HTTP 语义 code），由调用方转成 Result 响应。
- */
-class MarketService
-{
-    protected static ?MarketService $instance = null;
-
-    public static function instance(): static
-    {
-        if (static::$instance === null) {
-            static::$instance = new static();
-            // 中心站成交域首次被委托时，确保全部 appmall 表存在（覆盖 v1/Addon 等直接调用方）
-            \addon\appmall\library\AppmallSchema::ensure();
-        }
-        return static::$instance;
-    }
-
-    /**
-     * 运行时自愈建表（仅当表不存在时创建），保证购买闭环在当前库即可跑通。
-     * 已收敛到 \addon\appmall\library\AppmallSchema::ensure()（建全部表 + 扩展列），此处委托。
-     */
-    public function ensureTables(): void
-    {
-        \addon\appmall\library\AppmallSchema::ensure();
-    }
-
-    /**
-     * 商品查询（appmall_addon_list）
-     */
-    public function product(int $id): ?array
-    {
-        return Db::name('appmall_addon_list')->where('id', $id)->where('status', 1)->find();
-    }
-
-    /**
-     * 插件详情（含当前用户已购状态）
-     * @throws MarketException 404 插件不存在或已下架
-     */
-    public function info(int $id, int $uid = 0): array
-    {
-        $addon = $this->product($id);
-        if (!$addon) {
-            throw new MarketException('插件不存在或已下架', 404);
-        }
-        $purchased = false;
-        if ($uid > 0) {
-            $purchased = AddonLicense::where('uid', $uid)->where('aid', $id)->count() > 0;
-        }
-        return [
-            'addon' => [
-                'id'      => $addon['id'],
-                'name'    => $addon['name'],
-                'title'   => $addon['title'],
-                'version' => $addon['version'],
-                'price'   => $addon['price'],
-                'logo'    => $addon['logo'],
-                'intro'   => $addon['description'] ?? '',
-                'author'  => $addon['author'] ?? '',
-            ],
-            'purchased' => $purchased,
-        ];
-    }
-
-    /**
-     * 上架插件分页列表
-     * @return array{items: array, total: int}
-     */
-    public function lists(int $page = 1, int $perPage = 15): array
-    {
-        $perPage = min(max($perPage, 1), 50);
-        $page    = max($page, 1);
-        $query   = Db::name('appmall_addon_list')->where('status', 1);
-        $total   = (clone $query)->count();
-        $items   = $query->field('id,name,title,version,price,logo,description as intro,author')
-            ->order('id', 'desc')
-            ->page($page, $perPage)
-            ->select()
-            ->toArray();
-        return ['items' => $items, 'total' => $total];
-    }
-
-    /**
-     * 发起购买：创建/复用待支付订单并拉起支付（或模拟支付直接签发授权）。
-     * @param string $baseUrl 客户端根地址（用于拼支付回调）
-     * @return array{data: array, message: string}
-     * @throws MarketException
-     */
-    public function buy(int $uid, int $addonId, string $method, string $baseUrl): array
-    {
-        $addon = $this->product($addonId);
-        if (!$addon) {
-            throw new MarketException('插件不存在或已下架', 404);
-        }
-
-        // 免费插件无需购买（服务端 market valid 也直接放行）
-        if ((float) $addon['price'] <= 0) {
-            return ['data' => ['free' => true], 'message' => '该插件免费，可直接安装'];
-        }
-
-        // 幂等：已购直接返回授权
-        $existLicense = AddonLicense::where('uid', $uid)->where('aid', $addonId)->find();
-        if ($existLicense) {
-            return ['data' => ['license_key' => $existLicense->license_key], 'message' => '您已购买该插件'];
-        }
-
-        // 防重复下单：复用 15 分钟内待支付订单
-        $order = AddonOrder::where('uid', $uid)
-            ->where('aid', $addonId)
-            ->where('status', 0)
-            ->where('create_at', '>', time() - 900)
-            ->find();
-        if (!$order) {
-            $order = AddonOrder::create([
-                'uid'      => $uid,
-                'aid'      => $addonId,
-                'amount'   => $addon['price'],
-                'status'   => 0,
-                'trade_no' => date('YmdHis') . $uid . $addonId . random_int(100000, 999999),
-            ]);
-        }
-
-        // 模拟支付：无真实商户号时直接完成并签发授权（仅本地/自托管调试用）
-        if (config('pay.mock_enable')
-            && empty(config('pay.alipay.app_id'))
-            && empty(config('pay.wechat.mch_id'))) {
-            $this->completeOrder($order, $addonId, $uid);
-            $license = AddonLicense::where('uid', $uid)->where('aid', $addonId)->find();
-            return [
-                'data'    => ['license_key' => $license?->license_key, 'mock' => true],
-                'message' => '（模拟支付）购买成功',
-            ];
-        }
-
-        try {
-            $base      = rtrim($baseUrl, '/');
-            $payParams = [
-                'out_trade_no' => $order->trade_no,
-                'total_amount' => $order->amount,
-                'subject'      => '购买插件：' . $addon['title'],
-            ];
-            if ($method === 'wechat') {
-                $wconfig = config('pay.wechat');
-                if (empty($wconfig['mch_id']) || empty($wconfig['app_id'])) {
-                    throw new \Exception('微信支付未配置，请联系管理员');
-                }
-                $wconfig['notify_url'] = $base . '/v1/addon/notify';
-                $result = Pay::wechat($wconfig)->h5($payParams);
-                return [
-                    'data'    => ['order_no' => $order->trade_no, 'pay_params' => $result->getBody()->getContents()],
-                    'message' => '支付发起成功',
-                ];
-            }
-            $aconfig = config('pay.alipay');
-            if (empty($aconfig['app_id']) || empty($aconfig['private_key'])) {
-                throw new \Exception('支付未配置，请联系管理员');
-            }
-            $aconfig['notify_url'] = $base . '/v1/addon/notify';
-            $aconfig['return_url'] = $base . '/v1/addon/payResult';
-            $result = Pay::alipay($aconfig)->web($payParams);
-            return [
-                'data'    => ['order_no' => $order->trade_no, 'pay_params' => $result->getBody()->getContents()],
-                'message' => '支付发起成功',
-            ];
-        } catch (\Throwable $e) {
-            throw new MarketException('支付发起失败: ' . $e->getMessage(), 500);
-        }
-    }
-
-    /**
-     * 订单支付成功后：置已付 + 幂等签发授权 + 写入开发者收益账本（分红）
-     */
-    public function completeOrder($order, int $aid, int $uid): void
-    {
-        if ($order->status == 0) {
-            $order->status   = 1;
-            $order->pay_time = time();
-            $order->save();
-        }
-        $exist = AddonLicense::where('uid', $uid)->where('aid', $aid)->find();
-        if (!$exist) {
-            try {
-                AddonLicense::create([
-                    'uid'            => $uid,
-                    'aid'            => $aid,
-                    'license_key'    => $this->generateLicenseKey($uid, $aid),
-                    'expire_time'    => 0,
-                    'download_count' => 0,
-                ]);
-            } catch (\PDOException $e) {
-                if (stripos($e->getMessage(), 'duplicate') === false
-                    && stripos($e->getMessage(), '1062') === false) {
-                    throw $e;
-                }
-            }
-        }
-        // 写入收益账本（仅当该商品归属某开发者）
-        try {
-            $product = Db::name('appmall_addon_list')->where('id', $aid)->find();
-            $devId   = (int) ($product['developer_id'] ?? 0);
-            if ($devId > 0 && !Db::name('appmall_addon_revenues')->where('order_id', $order->id)->find()) {
-                $rate       = (float) config('appmall.commission_rate', 0.2);
-                $commission = round((float) $order->amount * $rate, 2);
-                $income     = round((float) $order->amount - $commission, 2);
-                Db::name('appmall_addon_revenues')->insert([
-                    'developer_id' => $devId,
-                    'order_id'     => $order->id,
-                    'aid'          => $aid,
-                    'uid'          => $uid,
-                    'amount'       => $order->amount,
-                    'commission'   => $commission,
-                    'income'       => $income,
-                    'status'       => 0,
-                    'create_at'    => time(),
-                ]);
-                // 计入开发者可提现余额（提现申请时再转入冻结待打款）
-                Db::name('appmall_developers')->where('id', $devId)->inc('balance', $income)->update();
-            }
-        } catch (\Exception $e) {
-            // 收益记账失败不影响已完成的购买
-            Log::warning('收益记账失败：' . $e->getMessage());
-        }
-        // 钩子点：订单支付完成（已签发授权 + 写入分红账本）后触发，
-        // 插件可在 info.php['events']['listen']['order_paid'] 监听，用于发货 / 通知等联动。
-        event('order_paid', ['order' => $order, 'aid' => $aid, 'uid' => $uid]);
-    }
-
-    /**
-     * 支付结果查询（前端轮询用）
-     * @throws MarketException 404 订单不存在
-     */
-    public function orderStatus(int $uid, string $tradeNo): array
-    {
-        $order = AddonOrder::where('trade_no', $tradeNo)->where('uid', $uid)->find();
-        if (!$order) {
-            throw new MarketException('订单不存在', 404);
-        }
-        $data = ['status' => $order->status];
-        if ($order->status === 1) {
-            $license             = AddonLicense::where('uid', $uid)->where('aid', $order->aid)->find();
-            $data['license_key'] = $license?->license_key;
-        }
-        return $data;
-    }
-
-    /**
-     * 支付完成落地页状态（支付宝 return_url 跳转，无需登录，仅展示状态）
-     * @return array{data: array, message: string}
-     */
-    public function payResult(string $tradeNo): array
-    {
-        if ($tradeNo === '') {
-            return ['data' => [], 'message' => '支付流程结束'];
-        }
-        $order = AddonOrder::where('trade_no', $tradeNo)->find();
-        if (!$order) {
-            return ['data' => ['status' => 0], 'message' => '订单不存在'];
-        }
-        return ['data' => ['status' => $order->status], 'message' => '获取成功'];
-    }
-
-    /**
-     * 退款 / 吊销授权（买家或运营）
-     * @return array{data: array, message: string}
-     * @throws MarketException
-     */
-    public function refund(int $uid, string $tradeNo, int $orderId): array
-    {
-        $order = null;
-        if ($tradeNo !== '') {
-            $order = AddonOrder::where('trade_no', $tradeNo)->where('uid', $uid)->find();
-        } elseif ($orderId > 0) {
-            $order = AddonOrder::where('id', $orderId)->where('uid', $uid)->find();
-        }
-        if (!$order) {
-            throw new MarketException('订单不存在', 404);
-        }
-        if ($order->status === 2) {
-            return ['data' => ['status' => 2], 'message' => '该订单已退款'];
-        }
-        if ($order->status !== 1) {
-            throw new MarketException('仅已支付订单可申请退款', 400);
-        }
-
-        Db::transaction(function () use ($order, $uid) {
-            $order->status = 2;
-            $order->save();
-            // 吊销授权（status=0 且过期，download/valid 双重拦截）
-            AddonLicense::where('uid', $uid)->where('aid', $order->aid)
-                ->update(['status' => 0, 'expire_time' => time()]);
-            // 收益冲正
-            $rev = Db::name('appmall_addon_revenues')->where('order_id', $order->id)->find();
-            if ($rev) {
-                if ((int) $rev['status'] === 0) {
-                    Db::name('appmall_developers')->where('id', $rev['developer_id'])
-                        ->dec('balance', (float) $rev['income'])->update();
-                }
-                Db::name('appmall_addon_revenues')->where('id', $rev['id'])->update(['status' => 2]);
-            }
-        });
-
-        return ['data' => ['status' => 2], 'message' => '退款成功，授权已吊销'];
-    }
-
-    /**
-     * 我的已购插件（买家视角）：列出已购付费插件 + 授权状态 + 是否可退款
-     */
-    public function mine(int $uid): array
-    {
-        $rows = Db::name('appmall_addon_licenses')
-            ->alias('l')
-            ->join('appmall_addon_list a', 'a.id = l.aid')
-            ->where('l.uid', $uid)
-            ->where('a.price', '>', 0)
-            ->field('a.name,a.title,a.version,a.price,l.status as license_status,l.expire_time,l.domain,l.aid')
-            ->order('l.id', 'desc')
-            ->select()
-            ->toArray();
-        $list = [];
-        foreach ($rows as $r) {
-            $order       = Db::name('appmall_addon_orders')->where('uid', $uid)->where('aid', $r['aid'])
-                ->order('id', 'desc')->find();
-            $orderStatus = $order ? (int) $order['status'] : 0;
-            $refundable  = ((int) $r['license_status'] === 1) && $orderStatus === 1;
-            $list[]      = [
-                'name'           => $r['name'],
-                'title'          => $r['title'],
-                'version'        => $r['version'],
-                'price'          => $r['price'],
-                'license_status' => (int) $r['license_status'],
-                'expire_time'    => (int) $r['expire_time'],
-                'domain'         => $r['domain'] ?? '',
-                'order_id'       => $order ? (int) $order['id'] : 0,
-                'trade_no'       => $order['trade_no'] ?? '',
-                'refundable'     => $refundable,
-            ];
-        }
-        return ['list' => $list];
-    }
-
-    /**
-     * 支付宝/微信异步回调：验签 -> 校验金额 -> 订单置已付 -> 生成授权
-     * @return \think\Response
-     */
-    public function notify(string $method)
-    {
-        try {
-            if ($method === 'wechat') {
-                $pay     = Pay::wechat(config('pay.wechat'));
-                $data    = $pay->callback();
-                $tradeNo = $data->get('out_trade_no');
-                $amount  = (float) $data->get('amount') ?: (float) $data->get('total');
-            } else {
-                $pay         = Pay::alipay(config('pay.alipay'));
-                $data        = $pay->verify();
-                $tradeNo     = $data->get('out_trade_no');
-                $amount      = (float) $data->get('total_amount');
-                $tradeStatus = (string) $data->get('trade_status');
-                if (!in_array($tradeStatus, ['TRADE_SUCCESS', 'TRADE_FINISHED'], true)) {
-                    return $pay->success();
-                }
-            }
-        } catch (\Throwable) {
-            return response('fail');
-        }
-
-        $order = AddonOrder::where('trade_no', $tradeNo)->find();
-        if ($order && $order->status == 0) {
-            // 防金额篡改：回调金额必须与订单一致
-            if (abs((float) $order->amount - $amount) < 0.01) {
-                Db::transaction(function () use ($order) {
-                    $order->refresh();
-                    if ($order->status != 0) {
-                        return;
-                    }
-                    $this->completeOrder($order, $order->aid, $order->uid);
-                });
-            }
-        }
-
-        return $method === 'wechat' ? response('SUCCESS') : Pay::alipay(config('pay.alipay'))->success();
-    }
-
-    /**
-     * 用户下载已购插件（需有效授权 + 域名/签名/次数校验）。
-     * @return array{file: string, filename: string} 通过校验后返回文件路径与下载名
-     * @throws MarketException
-     */
-    public function download(int $uid, int $addonId, Request $request): array
-    {
-        $license = AddonLicense::where('uid', $uid)->where('aid', $addonId)->find();
-        if (!$license) {
-            throw new MarketException('您尚未购买该插件', 403);
-        }
-        // 授权已吊销（退款）：拒绝下载
-        if (isset($license->status) && (int) $license->status !== 1) {
-            throw new MarketException('授权已被吊销，无法下载', 403);
-        }
-        if ($license->expire_time > 0 && $license->expire_time < time()) {
-            throw new MarketException('授权已过期', 403);
-        }
-
-        // 域名绑定：license.domain 非空时，仅允许绑定的域名下载
-        if (!empty($license->domain)) {
-            $host       = $request->host();
-            $hostNoPort = preg_replace('/:\d+$/', '', $host);
-            $allowed    = array_filter(array_map('trim', preg_split('/[,\s]+/', (string) $license->domain)));
-            if (!in_array($host, $allowed, true) && !in_array($hostNoPort, $allowed, true)) {
-                throw new MarketException('该授权未绑定当前域名，无法下载', 403);
-            }
-        }
-
-        // 下载签名校验（开关 addon_download_sign）
-        $signSecret = config('ywxapp.addon_secret');
-        if (config('ywxapp.addon_download_sign') && $signSecret) {
-            $ts   = (int) $request->get('ts', 0);
-            $sign = (string) $request->get('sign', '');
-            if ($ts <= 0 || time() - $ts > 600) {
-                throw new MarketException('下载授权已过期，请重新获取', 403);
-            }
-            $expected = $license->generateSign($license->license_key, $addonId, $ts, $signSecret);
-            if (!hash_equals($expected, $sign)) {
-                throw new MarketException('下载授权校验失败', 403);
-            }
-        }
-
-        $addon = Db::name('appmall_addon_list')->where('id', $addonId)->where('status', 1)->find();
-        if (!$addon) {
-            throw new MarketException('插件不存在或已下架', 404);
-        }
-
-        // 下载次数限制：0 表示不限
-        if ($license->download_count > 0) {
-            $used = AddonDownloadLog::where('license_id', $license->id)->count();
-            if ($used >= $license->download_count) {
-                throw new MarketException('下载次数已用完', 403);
-            }
-        }
-
-        $file = realpath($addon['file_path']);
-        $root = realpath(root_path()) ?: root_path();
-        if ($file === false || !is_file($file) || strpos($file, $root) !== 0) {
-            throw new MarketException('插件文件暂不可用，请联系管理员', 404);
-        }
-
-        AddonDownloadLog::create([
-            'license_id' => $license->id,
-            'uid'        => $uid,
-            'aid'        => $addonId,
-            'ip'         => $request->ip(),
-        ]);
-
-        return ['file' => $file, 'filename' => $addon['name'] . '-' . $addon['version'] . '.zip'];
-    }
-
-    /**
-     * 后台市场目录（中心站本机浏览）：关键词/分类筛选 + 排序 + 分类下拉数据源。
-     * 自愈元数据列（category/tags/screenshots/rating），与 api/Market::ensureAddonListColumns 对齐。
-     * @return array{list: array, categories: array}
-     */
-    public function catalog(string $keyword = '', string $category = '', string $order = 'new', string $type = ''): array
-    {
-        // 自愈元数据列：旧库缺 category/tags/screenshots/rating 时自动补齐
-        $listTable = Db::name('appmall_addon_list')->getTable();
-        $colDefs   = [
-            'category'          => "varchar(50) DEFAULT '' COMMENT '分类'",
-            'tags'              => "varchar(255) DEFAULT '' COMMENT '标签（逗号分隔）'",
-            'screenshots'       => "text COMMENT '截图URL（逗号分隔或JSON）'",
-            'rating'            => "decimal(2,1) DEFAULT '0.0' COMMENT '评分（0.0~5.0）'",
-            'changelog'         => "text COMMENT '更新日志'",
-            'require_framework' => "varchar(20) DEFAULT '' COMMENT '最低兼容框架版本，如 1.2.0'",
-            'type'              => "varchar(20) NOT NULL DEFAULT 'addon' COMMENT '商品类型：addon=插件 template=模板'",
-        ];
-        foreach ($colDefs as $col => $def) {
-            BaseModel::ensureColumn($listTable, $col, $def);
-        }
-
-        // 探测元数据列是否存在，存在才选，保证兼容
-        $hasCols = [];
-        try {
-            $cols    = Db::query("SHOW COLUMNS FROM `{$listTable}`");
-            $hasCols = array_column($cols, 'Field');
-        } catch (\Throwable $e) {
-        }
-        $has = fn (string $c): bool => in_array($c, $hasCols, true);
-
-        $q = Db::name('appmall_addon_list')->where('status', 1);
-        if ($keyword !== '') {
-            $q->where(function ($w) use ($keyword) {
-                $w->where('name', 'like', '%' . $keyword . '%')
-                  ->whereOr('title', 'like', '%' . $keyword . '%')
-                  ->whereOr('author', 'like', '%' . $keyword . '%')
-                  ->whereOr('description', 'like', '%' . $keyword . '%');
-            });
-        }
-        if ($category !== '' && $has('category')) {
-            $q->where('category', $category);
-        }
-        // 商品类型筛选（addon=插件 / template=模板；空=全部）
-        if ($type !== '' && $has('type')) {
-            $q->where('type', $type);
-        }
-        $field = 'id,name,title,description as intro,author,version,logo,price,download_count,update_at';
-        foreach (['category', 'tags', 'screenshots', 'rating', 'changelog', 'require_framework', 'type'] as $mf) {
-            if ($has($mf)) {
-                $field .= ',' . $mf;
-            }
-        }
-        // 排序：对齐 api/Market::lists 的 orderMap（download_count 为商品表内置列）
-        $orderMap = [
-            'new'        => ['id', 'desc'],
-            'hot'        => ['download_count', 'desc'],
-            'price_asc'  => ['price', 'asc'],
-            'price_desc' => ['price', 'desc'],
-        ];
-        [$of, $od] = $orderMap[$order] ?? $orderMap['new'];
-        $list = $q->field($field)->order($of, $od)->select()->toArray();
-        // 同名插件多版本聚合：只展示最新版，其余版本收进 versions（详情弹窗版本下拉用）
-        $list = self::aggregateVersions($list);
-
-        // 分类下拉数据源：本机全部非空分类
-        $categories = [];
-        if ($has('category')) {
-            $categories = Db::name('appmall_addon_list')
-                ->where('status', 1)->where('category', '<>', '')
-                ->distinct(true)->order('category', 'asc')->column('category');
-        }
-        return ['list' => $list, 'categories' => $categories];
-    }
-
-    /**
-     * 运营退款（后台特权）：按插件名退最新「已支付」订单，
-     * 吊销授权 + 订单置已退款 + 收益冲正。
-     * @throws MarketException
-     */
-    public function operatorRefund(string $name): void
-    {
-        $addon = Db::name('appmall_addon_list')->where('name', $name)->find();
-        if (empty($addon)) {
-            throw new MarketException('插件不存在', 404);
-        }
-        $order = Db::name('appmall_addon_orders')->where('aid', $addon['id'])
-            ->where('status', 1)->order('id', 'desc')->find();
-        if (empty($order)) {
-            throw new MarketException('未找到该插件的已支付订单', 404);
-        }
-        Db::transaction(function () use ($order, $addon) {
-            Db::name('appmall_addon_orders')->where('id', $order['id'])
-                ->update(['status' => 2, 'update_at' => time()]);
-            Db::name('appmall_addon_licenses')->where('uid', $order['uid'])
-                ->where('aid', $addon['id'])
-                ->update(['status' => 0, 'expire_time' => time(), 'update_at' => time()]);
-            $rev = Db::name('appmall_addon_revenues')->where('order_id', $order['id'])->find();
-            if ($rev) {
-                if ((int) $rev['status'] === 0) {
-                    Db::name('appmall_developers')->where('id', $rev['developer_id'])
-                        ->dec('balance', (float) $rev['income'])->update();
-                }
-                Db::name('appmall_addon_revenues')->where('id', $rev['id'])->update(['status' => 2]);
-            }
-        });
-    }
-
-    /**
-     * 同名插件多版本聚合：每个插件只保留最新版一条作代表行，
-     * 其余版本收进代表行的 versions 数组（含最新版自身，按版本号降序），
-     * 供市场详情页/弹窗做「版本下拉选择」，列表不再平铺展示多个版本。
-     * 输出顺序 = 各插件在原列表中的首次出现顺序（尽量保持原排序语义）。
-     */
-    public static function aggregateVersions(array $rows): array
-    {
-        $groups = [];
-        $names  = [];
-        foreach ($rows as $r) {
-            $n = (string) ($r['name'] ?? '');
-            if (!isset($groups[$n])) {
-                $groups[$n] = [];
-                $names[]    = $n;
-            }
-            $groups[$n][] = $r;
-        }
-        $out = [];
-        foreach ($names as $n) {
-            $vers = $groups[$n];
-            usort($vers, fn ($a, $b) => version_compare((string) ($b['version'] ?? '0'), (string) ($a['version'] ?? '0')));
-            $main             = $vers[0];
-            $main['versions'] = array_map(fn ($v) => [
-                'id'        => $v['id'] ?? 0,
-                'version'   => (string) ($v['version'] ?? ''),
-                'price'     => $v['price'] ?? 0,
-                'update_at' => (int) ($v['update_at'] ?? 0),
-            ], $vers);
-            $out[] = $main;
-        }
-        return $out;
-    }
-
-    /**
-     * 修改已上架插件价格（按插件名维度，同步全部版本行 + 提交记录）。
-     * 后台改价传 developerId=0（不限归属）；开发者中心改价须传本人 developerId（仅能改自己的应用）。
-     * 改价后 bump 目录版本号，市场列表缓存立即失效。
-     * @return int 受影响的版本行数
-     * @throws MarketException
-     */
-    public function updatePrice(string $name, float $price, int $developerId = 0): int
-    {
-        if ($name === '') {
-            throw new MarketException('缺少插件标识', 400);
-        }
-        if ($price < 0 || $price > 999999) {
-            throw new MarketException('价格必须在 0 ~ 999999 之间', 400);
-        }
-        $q = Db::name('appmall_addon_list')->where('name', $name);
-        if ($developerId > 0) {
-            $q->where('developer_id', $developerId);
-        }
-        $rows = $q->select()->toArray();
-        if (empty($rows)) {
-            // 尚未上架（仅有提交记录）也允许改价：只同步 submissions
-            $subExist = Db::name('appmall_addon_submissions')->where('name', $name)
-                ->when($developerId > 0, fn ($w) => $w->where('developer_id', $developerId))
-                ->count();
-            if ($subExist <= 0) {
-                throw new MarketException($developerId > 0 ? '未找到你名下的该插件' : '插件不存在', 404);
-            }
-        }
-        $ids = array_column($rows, 'id');
-        if ($ids) {
-            Db::name('appmall_addon_list')->whereIn('id', $ids)
-                ->update(['price' => $price, 'update_at' => time()]);
-        }
-        // 同步提交记录价格（保持审核台/开发者中心口径一致；仅同步同归属记录）
-        try {
-            $sq = Db::name('appmall_addon_submissions')->where('name', $name);
-            if ($developerId > 0) {
-                $sq->where('developer_id', $developerId);
-            }
-            $sq->update(['price' => $price, 'update_at' => time()]);
-        } catch (\Throwable $e) {
-            // 提交记录同步失败不影响商品改价
-        }
-        self::bumpCatalogVersion();
-        return count($ids);
-    }
-
-    /**
-     * 目录版本号 bump：使 api/Market::lists 的 60s 缓存立即失效（审核发布/改价后调用）。
-     */
-    public static function bumpCatalogVersion(): void
-    {
-        try {
-            Cache::set('appmall:catalog:ver', (string) microtime(true));
-        } catch (\Throwable $e) {
-            // 缓存不可用时静默（列表最多延迟 60s 更新）
-        }
-    }
-
-    /**
-     * 生成唯一授权码
-     */
-    protected function generateLicenseKey(int $uid, int $aid): string
-    {
-        do {
-            $key = strtoupper(sprintf(
-                '%s-%s-%s',
-                substr(md5($uid . $aid . random_bytes(8)), 0, 8),
-                bin2hex(random_bytes(4)),
-                bin2hex(random_bytes(4))
-            ));
-        } while (AddonLicense::where('license_key', $key)->find());
-
-        return $key;
-    }
-}

addon/appmall/upgrade.sql

@@ -1,23 +0,0 @@
--- ============================================================
--- addons/appmall/upgrade.sql
--- 用于已安装插件、但缺少新字段/配置的老库手动升级。
--- 在数据库客户端执行本文件即可。
---
--- 重要说明：
--- 1) 框架「在线升级」(AddonService::onlineUpgrade) 会自动重导 install.sql
---    （CREATE TABLE IF NOT EXISTS 全量幂等），已覆盖 appmall 全部表结构；
---    本文件仅作为 DBA 手动补列 / 历史库修复的参考。
--- 2) 框架插件升级流程的 importsql() 白名单仅允许 CREATE/INSERT，不会自动执行
---    本文件的 ALTER；如需在升级时自动收敛缺失列，请走插件 Addon::upgrade() 钩子
---    （内部用 SchemaGuard::ensureColumn 先探测后追加，重复执行安全）。
--- 3) 纯 ALTER 语句重复执行可能报「列已存在」，属正常，可忽略。
--- ============================================================
-SET NAMES utf8mb4;
-
--- 1. 下载日志表：运营后台下载审计字段（install.sql 已含，此处供老库补齐）
---    注意：本文件为 DBA 手动执行脚本，不会被框架自动替换前缀；
---    执行前请将下方 `__PREFIX__` 替换为当前数据库表前缀（如 wxapp_）。
-ALTER TABLE `__PREFIX__appmall_addon_download_logs`
-    ADD COLUMN `operator_id` int unsigned NOT NULL DEFAULT 0 COMMENT '运营后台下载审计（0=会员自助下载）' AFTER `uid`;
-
--- 2. 未来新增列在此追加（同样直接 ALTER，重复执行忽略报错即可）

addon/appmall/view/backend/addonreview/detail.html

@@ -1,139 +0,0 @@
-<!DOCTYPE html>
-<html lang="zh-CN">
-<!DOCTYPE html>
-<head>
-  <meta charset="utf-8">
-  <title>审核详情 - 应用市场管理</title>
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <link href="/assets/layui/css/layui.css" rel="stylesheet">
-  <link href="/assets/ywxapp/css/wxapp.css" rel="stylesheet">
-  <style>
-    body { background: #f2f3f5; padding: 15px; }
-    .info-card { background: #fff; border-radius: 4px; padding: 15px 20px; margin-bottom: 15px; }
-    .info-card h3 { margin: 0 0 12px; font-size: 15px; border-left: 3px solid #1e9fff; padding-left: 8px; }
-    .info-row { display: flex; flex-wrap: wrap; }
-    .info-item { width: 50%; padding: 6px 0; box-sizing: border-box; }
-    .info-item.full { width: 100%; }
-    .info-item .label { color: #999; margin-right: 6px; }
-    .info-item .value { color: #333; }
-    .step-wrap { background: #fff; border-radius: 4px; padding: 20px; margin-bottom: 15px; }
-    .timeline-empty { color: #999; text-align: center; padding: 20px 0; }
-  </style>
-</head>
-<body>
-  <div class="info-card">
-    <h3>提交信息</h3>
-    <div class="info-row" id="infoRow">
-      <div class="timeline-empty">加载中…</div>
-    </div>
-  </div>
-
-  <div class="step-wrap">
-    <h3 style="margin:0 0 18px;font-size:15px;border-left:3px solid #1e9fff;padding-left:8px;">审核状态流</h3>
-    <div class="layui-row layui-col-space20" id="stepRow">
-      <div class="timeline-empty">加载中…</div>
-    </div>
-  </div>
-
-  <div class="info-card">
-    <h3>审核历史时间线</h3>
-    <ul class="layui-timeline" id="timeline">
-      <li class="layui-timeline-item"><i class="layui-icon layui-timeline-axis layui-icon-loading"></i><div class="layui-timeline-content layui-text"><div class="timeline-empty">加载中…</div></div></li>
-    </ul>
-  </div>
-
-  <script src="/assets/layui/layui.js"></script>
-  <script src="/assets/ywxapp/ywxapp.js" module="{$site.app}"></script>
-  <script>
-    layui.use(['jquery', 'http', 'util'], function () {
-      var $ = layui.jquery, http = layui.http, util = layui.util;
-      var id = {$id};
-
-      function statusText(s) {
-        switch (parseInt(s, 10)) {
-          case 0: return '待审核';
-          case 1: return '已通过';
-          case 2: return '已驳回';
-          default: return '未知(' + s + ')';
-        }
-      }
-      function actionText(a) {
-        switch (a) {
-          case 'submit':  return '提交审核';
-          case 'approve': return '审核通过';
-          case 'reject':  return '审核驳回';
-          default:        return a;
-        }
-      }
-      function fmt(ts) {
-        if (!ts) return '';
-        return util.toDateString(ts * 1000, 'yyyy-MM-dd HH:mm:ss');
-      }
-
-      http.get('detail', { id: id }).then(function (r) {
-        if (r.code !== 0 || !r.data) { $('#infoRow').html('<div class="timeline-empty">加载失败</div>'); return; }
-        var d = r.data;
-        var html = ''
-          + '<div class="info-item"><span class="label">ID：</span><span class="value">' + (d.id || '') + '</span></div>'
-          + '<div class="info-item"><span class="label">标识：</span><span class="value">' + (d.name || '') + '</span></div>'
-          + '<div class="info-item"><span class="label">名称：</span><span class="value">' + (d.title || '') + '</span></div>'
-          + '<div class="info-item"><span class="label">类型：</span><span class="value">' + (d.type === 'template' ? '模板' : '插件') + '</span></div>'
-          + '<div class="info-item"><span class="label">作者：</span><span class="value">' + (d.author || '') + '</span></div>'
-          + '<div class="info-item"><span class="label">版本：</span><span class="value">' + (d.version || '') + '</span></div>'
-          + '<div class="info-item"><span class="label">价格：</span><span class="value">' + (d.price > 0 ? '¥' + d.price : '免费') + '</span></div>'
-          + '<div class="info-item"><span class="label">当前状态：</span><span class="value">' + statusText(d.status) + '</span></div>'
-          + '<div class="info-item"><span class="label">提交时间：</span><span class="value">' + fmt(d.create_at) + '</span></div>'
-          + '<div class="info-item"><span class="label">上架状态：</span><span class="value">' + (d.published ? '已上架' : '未上架') + '</span></div>'
-          + '<div class="info-item full"><span class="label">简介：</span><span class="value">' + (d.description || '-') + '</span></div>'
-          + '<div class="info-item full"><span class="label">驳回原因：</span><span class="value">' + (d.reject_reason || '-') + '</span></div>';
-        $('#infoRow').html(html);
-
-        // 步骤条：提交 → 审核(通过/驳回)
-        var steps = [
-          { title: '提交审核', done: true },
-          { title: '运营审核', done: true, current: d.status != 0, reject: d.status == 2, pass: d.status == 1 }
-        ];
-        var stepHtml = '';
-        steps.forEach(function (s) {
-          var cls = 'layui-bg-blue';
-          if (s.reject) cls = 'layui-bg-red';
-          else if (!s.done) cls = 'layui-bg-gray';
-          var icon = '&#xe605;';
-          if (s.reject) icon = '&#x1006;';
-          else if (!s.done) icon = '&#xe615;';
-          stepHtml += ''
-            + '<div class="layui-col-xs6 layui-col-md6" style="text-align:center;">'
-            + '  <button class="layui-btn layui-btn-circle ' + cls + '">' + icon + '</button>'
-            + '  <div style="margin-top:6px;">' + s.title + '</div>'
-            + '</div>';
-        });
-        $('#stepRow').html('<div class="layui-col-xs12" style="display:flex;align-items:center;justify-content:center;">' + stepHtml + '</div>');
-      }).catch(function () { $('#infoRow').html('<div class="timeline-empty">请求失败</div>'); });
-
-      http.get('history', { id: id }).then(function (r) {
-        var arr = (r.code === 0 && r.data) ? r.data : [];
-        if (!arr.length) {
-          $('#timeline').html('<li class="layui-timeline-item"><i class="layui-icon layui-timeline-axis layui-icon-face-surprised"></i><div class="layui-timeline-content layui-text"><div class="timeline-empty">暂无审核记录</div></div></li>');
-          return;
-        }
-        var html = '';
-        arr.forEach(function (item) {
-          var color = item.action === 'reject' ? '#ff5722' : (item.action === 'approve' ? '#16b777' : '#1e9fff');
-          html += ''
-            + '<li class="layui-timeline-item">'
-            + '  <i class="layui-icon layui-timeline-axis" style="color:' + color + ';">&#xe63f;</i>'
-            + '  <div class="layui-timeline-content layui-text">'
-            + '    <h4>' + actionText(item.action) + ' <span class="layui-badge layui-bg-gray">' + statusText(item.from_status) + ' → ' + statusText(item.to_status) + '</span></h4>'
-            + '    <p>操作人ID：' + (item.operator_id || 0) + (item.reason ? '；意见：' + item.reason : '') + '</p>'
-            + '    <p style="color:#999;">' + fmt(item.create_at) + '</p>'
-            + '  </div>'
-            + '</li>';
-        });
-        $('#timeline').html(html);
-      }).catch(function () {
-        $('#timeline').html('<li class="layui-timeline-item"><i class="layui-icon layui-timeline-axis layui-icon-face-surprised"></i><div class="layui-timeline-content layui-text"><div class="timeline-empty">请求失败</div></div></li>');
-      });
-    });
-  </script>
-</body>
-</html>

addon/appmall/view/backend/addonreview/index.html

@@ -1,121 +0,0 @@
-<!DOCTYPE html>
-<html lang="zh-CN">
-<head>
-  <meta charset="utf-8">
-  <title>插件审核 - 应用市场管理</title>
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <link href="/assets/layui/css/layui.css" rel="stylesheet">
-  <link href="/assets/ywxapp/css/wxapp.css" rel="stylesheet">
-  <style>body{background:#f2f3f5;padding:15px;}</style>
-</head>
-<body>
-  <form class="layui-form" lay-filter="filterForm">
-    <div class="layui-form-item">
-      <div class="layui-inline">
-        <label class="layui-form-label">状态</label>
-        <div class="layui-input-inline" style="width:140px;">
-          <select name="status">
-            <option value="">全部</option>
-            <option value="0">待审核</option>
-            <option value="1">已通过</option>
-            <option value="2">已驳回</option>
-          </select>
-        </div>
-      </div>
-      <button class="layui-btn" lay-submit lay-filter="search">搜索</button>
-    </div>
-  </form>
-
-  <table id="dataTable" lay-filter="dataTable"></table>
-
-  <script type="text/html" id="statusTpl">
-    {{# if(d.status == 0){ }}<span class="layui-badge layui-bg-orange">待审核</span>
-    {{# } else if(d.status == 1){ }}<span class="layui-badge layui-bg-green">已通过</span>
-    {{# } else { }}<span class="layui-badge">已驳回</span>{{# } }}
-  </script>
-
-  <script type="text/html" id="operateTpl">
-    <a class="layui-btn layui-btn-xs" href="download?id={{ d.id }}" target="_blank">下载包</a>
-    {{# if(d.status == 0){ }}
-    <a class="layui-btn layui-btn-xs layui-btn-normal" lay-event="approve">通过并发布</a>
-    <a class="layui-btn layui-btn-xs layui-btn-danger" lay-event="reject">驳回</a>
-    {{# } }}
-    <a class="layui-btn layui-btn-xs layui-btn-warm" lay-event="price">改价</a>
-    <a class="layui-btn layui-btn-xs" lay-event="detail">查看详情</a>
-  </script>
-
-  <script src="/assets/layui/layui.js"></script>
-  <script src="/assets/ywxapp/ywxapp.js" module="{$site.app}"></script>
-  <script>
-    layui.use(['table', 'form', 'layer', 'jquery', 'http'], function () {
-      var table = layui.table, form = layui.form, layer = layui.layer, $ = layui.jquery, http = layui.http;
-
-      table.render({
-        elem: '#dataTable',
-        url: 'index',
-        page: true,
-        limits: [10, 20, 50],
-        limit: 10,
-        cols: [[
-          { field: 'id', title: 'ID', width: 70 },
-                { field: 'name', title: '标识', width: 120 },
-                { field: 'type', title: '类型', width: 80, templet: function (d) {
-                    return d.type === 'template'
-                        ? '<span class="layui-badge" style="background:#722ed1;">模板</span>'
-                        : '<span class="layui-badge layui-bg-blue">插件</span>';
-                } },
-                { field: 'title', title: '名称', minWidth: 140 },
-          { field: 'author', title: '作者', width: 120 },
-          { field: 'version', title: '版本', width: 90 },
-          { field: 'price', title: '价格', width: 90, templet: function (d) { return d.price > 0 ? '¥' + d.price : '免费'; } },
-          { field: 'status', title: '状态', width: 90, templet: '#statusTpl' },
-          { field: 'reject_reason', title: '驳回原因', minWidth: 160 },
-          { field: 'create_at', title: '提交时间', width: 170, templet: function (d) { return d.create_at ? new Date(d.create_at * 1000).toLocaleString() : ''; } },
-          { title: '操作', width: 240, toolbar: '#operateTpl', fixed: 'right' }
-        ]],
-        response: { statusName: 'code', statusCode: 0, msgName: 'message', countName: 'count', dataName: 'data' }
-      });
-
-      form.on('submit(search)', function (data) {
-        table.reload('dataTable', { where: data.field, page: { curr: 1 } });
-        return false;
-      });
-
-      table.on('tool(dataTable)', function (elem) {
-        var d = elem.data;
-        if (elem.event === 'approve') {
-          layer.confirm('确认通过该插件并发布到市场？', function () {
-            http.post('approve', { id: d.id }).then(function (r) {
-                if (r.code === 0) { layer.msg('已通过并发布', { icon: 1 }); table.reload('dataTable'); }
-                else { layer.msg(r.message || '操作失败', { icon: 2 }); }
-              }).catch(function () { layer.msg('请求失败', { icon: 2 }); });
-          });
-        } else if (elem.event === 'reject') {
-          layer.prompt({ title: '驳回原因', formType: 2 }, function (val, idx) {
-            http.post('reject', { id: d.id, reason: val }).then(function (r) {
-                if (r.code === 0) { layer.close(idx); layer.msg('已驳回', { icon: 1 }); table.reload('dataTable'); }
-                else { layer.msg(r.message || '操作失败', { icon: 2 }); }
-              }).catch(function () { layer.msg('请求失败', { icon: 2 }); });
-          });
-        } else if (elem.event === 'detail') {
-          layer.open({
-            type: 2,
-            title: '审核详情 #' + d.id,
-            area: ['720px', '80%'],
-            content: 'detailview?id=' + d.id
-          });
-        } else if (elem.event === 'price') {
-          layer.prompt({ title: '修改「' + d.name + '」价格（0 为免费，同步全部版本）', value: d.price || '0' }, function (val, idx) {
-            var p = parseFloat(val);
-            if (isNaN(p) || p < 0) { layer.msg('请输入不小于 0 的价格', { icon: 2 }); return; }
-            http.post('updatePrice', { name: d.name, price: p }).then(function (r) {
-                if (r.code === 0) { layer.close(idx); layer.msg(r.message || '价格已更新', { icon: 1 }); table.reload('dataTable'); }
-                else { layer.msg(r.message || '操作失败', { icon: 2 }); }
-              }).catch(function () { layer.msg('请求失败', { icon: 2 }); });
-          });
-        }
-      });
-    });
-  </script>
-</body>
-</html>

addon/appmall/view/backend/common/layout.html

@@ -1,77 +0,0 @@
-<!DOCTYPE html>
-<html lang="zh-CN">
-
-<head>
-  <meta charset="UTF-8">
-  {block name="title"}<title>{$title | default='YwxApp'}</title>{/block}
-  <meta name="renderer" content="webkit">
-  <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
-  <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
-  <link href="/assets/layui/css/layui.css" rel="stylesheet">
-  <link href="/assets/ywxapp/css/wxapp.css" rel="stylesheet">
-  <style>
-    html,
-    body {
-      height: 100%;
-      display: flex;
-      flex-direction: column;
-    }
-
-    body {
-      padding-bottom: 64px;
-    }
-
-    .layui-card {
-      flex: 1;
-      display: flex;
-      flex-direction: column;
-    }
-
-    .layui-card-body {
-      display: flex;
-      flex-direction: column;
-      flex: 1;
-    }
-
-    .layui-table-view {
-      display: flex;
-      flex-direction: column;
-      flex: 1;
-    }
-
-    .layui-table-box {
-      display: flex;
-      flex-direction: column;
-      flex: 1;
-    }
-
-    .layui-table-body {
-      display: flex;
-      flex-direction: column;
-      flex: 1;
-    }
-  </style>
-  <script src="/assets/layui/layui.js"></script>
-  <script type="text/javascript">
-    // 全局路径配置：仅注入部署参数，路由方法来自 layui 的 route 模块。
-    // app 为 ThinkPHP 真实应用目录名（backend/member/frontend/home），对应 public/static/<app> 目录。
-   layui.app=  window.APP = {
-      root: "{$site.root|default=''}",
-      assetUrl: "/assets",
-      module: "{$site.module}",
-      realModule: "{$site.app}",
-      routeBase: "{$route_base}",
-      controller: "{$site.controller}",
-      action: "{$site.action}"
-    };
-  </script>
-  <script src="/assets/ywxapp/ywxapp.js" module="{$site.app}"></script>
-</head>
-
-<body>
-  {block name="body"}{/block} 
-  
-{block name="script"}{/block}   
-</body>
-
-</html>

addon/appmall/view/backend/developer/index.html

@@ -1,112 +0,0 @@
-<!DOCTYPE html>
-<html lang="zh-CN">
-<head>
-  <meta charset="utf-8">
-  <title>开发者管理 - 应用市场管理</title>
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <link href="/assets/layui/css/layui.css" rel="stylesheet">
-  <link href="/assets/ywxapp/css/wxapp.css" rel="stylesheet">
-  <style>body{background:#f2f3f5;padding:15px;}</style>
-</head>
-<body>
-  <form class="layui-form" lay-filter="filterForm">
-    <div class="layui-form-item">
-      <div class="layui-inline">
-        <label class="layui-form-label">状态</label>
-        <div class="layui-input-inline" style="width:140px;">
-          <select name="status">
-            <option value="">全部</option>
-            <option value="0">待审核</option>
-            <option value="1">正常</option>
-            <option value="-1">已禁用</option>
-          </select>
-        </div>
-      </div>
-      <button class="layui-btn" lay-submit lay-filter="search">搜索</button>
-    </div>
-  </form>
-
-  <table id="dataTable" lay-filter="dataTable"></table>
-
-  <script type="text/html" id="statusTpl">
-    {{# if(d.status == 0){ }}<span class="layui-badge layui-bg-orange">待审核</span>
-    {{# } else if(d.status == 1){ }}<span class="layui-badge layui-bg-green">正常</span>
-    {{# } else { }}<span class="layui-badge">已禁用</span>{{# } }}
-  </script>
-
-  <script type="text/html" id="operateTpl">
-    {{# if(d.status == 0){ }}
-    <a class="layui-btn layui-btn-xs layui-btn-normal" lay-event="approve">通过</a>
-    {{# } }}
-    {{# if(d.status == 1){ }}
-    <a class="layui-btn layui-btn-xs" lay-event="resend">重发令牌</a>
-    <a class="layui-btn layui-btn-xs layui-btn-warm" lay-event="reset">重置令牌</a>
-    <a class="layui-btn layui-btn-xs layui-btn-danger" lay-event="disable">禁用</a>
-    {{# } }}
-    {{# if(d.status == -1){ }}
-    <a class="layui-btn layui-btn-xs layui-btn-normal" lay-event="approve">启用</a>
-    {{# } }}
-  </script>
-
-  <script src="/assets/layui/layui.js"></script>
-  <script src="/assets/ywxapp/ywxapp.js" module="{$site.app}"></script>
-  <script>
-    layui.use(['table', 'form', 'layer', 'jquery', 'http'], function () {
-      var table = layui.table, form = layui.form, layer = layui.layer, $ = layui.jquery, http = layui.http;
-
-      table.render({
-        elem: '#dataTable',
-        url: 'index',
-        page: true,
-        limits: [10, 20, 50],
-        limit: 10,
-        cols: [[
-          { field: 'id', title: 'ID', width: 70 },
-          { field: 'username', title: '开发者', minWidth: 140 },
-          { field: 'email', title: '邮箱', minWidth: 200 },
-          { field: 'token', title: '令牌', minWidth: 320, templet: function (d) { return '<span style="word-break:break-all;">' + d.token + '</span>'; } },
-          { field: 'status', title: '状态', width: 90, templet: '#statusTpl' },
-          { field: 'created_at', title: '创建时间', width: 170, templet: function (d) { return d.created_at ? new Date(d.created_at * 1000).toLocaleString() : ''; } },
-          { title: '操作', width: 260, toolbar: '#operateTpl', fixed: 'right' }
-        ]],
-        response: { statusName: 'code', statusCode: 0, msgName: 'message', countName: 'count', dataName: 'data' }
-      });
-
-      form.on('submit(search)', function (data) {
-        table.reload('dataTable', { where: data.field, page: { curr: 1 } });
-        return false;
-      });
-
-      table.on('tool(dataTable)', function (elem) {
-        var d = elem.data, id = d.id;
-        if (elem.event === 'approve') {
-          layer.confirm('确认' + (d.status == 0 ? '通过该开发者并邮件下发令牌？' : '启用该开发者？'), function () {
-            http.post('approve', { id: id }).then(function (r) {
-                if (r.code === 0) { layer.msg('操作成功', { icon: 1 }); table.reload('dataTable'); }
-                else { layer.msg(r.message || '操作失败', { icon: 2 }); }
-              }).catch(function () { layer.msg('请求失败', { icon: 2 }); });
-          });
-        } else if (elem.event === 'disable') {
-          layer.confirm('确认禁用该开发者？其令牌将立即失效。', function () {
-            http.post('disable', { id: id }).then(function (r) {
-                if (r.code === 0) { layer.msg('已禁用', { icon: 1 }); table.reload('dataTable'); }
-                else { layer.msg(r.message || '操作失败', { icon: 2 }); }
-              }).catch(function () { layer.msg('请求失败', { icon: 2 }); });
-          });
-        } else if (elem.event === 'resend') {
-          http.post('resend', { id: id }).then(function (r) {
-            layer.msg(r.message || (r.code === 0 ? '已重发' : '失败'), { icon: r.code === 0 ? 1 : 2 });
-          }).catch(function () { layer.msg('请求失败', { icon: 2 }); });
-        } else if (elem.event === 'reset') {
-          layer.confirm('确认重置令牌？旧令牌将失效。', function () {
-            http.post('reset', { id: id }).then(function (r) {
-                if (r.code === 0) { layer.msg('已重置' + (r.data && r.data.token ? '，新令牌：' + r.data.token : ''), { icon: 1, time: 4000 }); table.reload('dataTable'); }
-                else { layer.msg(r.message || '操作失败', { icon: 2 }); }
-              }).catch(function () { layer.msg('请求失败', { icon: 2 }); });
-          });
-        }
-      });
-    });
-  </script>
-</body>
-</html>

addon/appmall/view/backend/framework/index.html

@@ -1,144 +0,0 @@
-
-    <div class="layui-card">
-        <div class="layui-card-header">主框架版本管理（升级服务器）</div>
-        <div class="layui-card-body">
-            <blockquote class="layui-elem-quote layui-quote-nm" style="margin-bottom:12px;">
-                同一版本号可先后上传「整包」「增量补丁」「完整安装包」，三者共存于同一条版本记录；
-                客户端升级时自动择优（正好停在补丁基础版本走补丁，否则走整包），完整安装包供全新部署下载。重新上传任一包后需再次「发布」。
-            </blockquote>
-            <form class="layui-form" id="uploadForm">
-                <div class="layui-form-item">
-                    <div class="layui-inline">
-                        <label class="layui-form-label">版本号</label>
-                        <div class="layui-input-inline">
-                            <input type="text" name="version" placeholder="x.y.z" class="layui-input" required>
-                        </div>
-                    </div>
-                    <div class="layui-inline">
-                        <label class="layui-form-label">标题</label>
-                        <div class="layui-input-inline">
-                            <input type="text" name="title" placeholder="可选，如 安全修复" class="layui-input">
-                        </div>
-                    </div>
-                    <div class="layui-inline">
-                        <label class="layui-form-label">类型</label>
-                        <div class="layui-input-inline">
-                            <select name="type" id="pkgType" class="layui-input">
-                                <option value="0">整包(full)</option>
-                                <option value="1">增量补丁(patch)</option>
-                                <option value="2">完整安装包(install)</option>
-                            </select>
-                        </div>
-                    </div>
-                    <div class="layui-inline">
-                        <label class="layui-form-label">基础版本</label>
-                        <div class="layui-input-inline">
-                            <input type="text" name="from_version" id="fromVersion" placeholder="仅增量补丁需要，如 1.2.0" class="layui-input">
-                        </div>
-                    </div>
-                    <div class="layui-inline">
-                        <button type="button" class="layui-btn" id="btnUpload">
-                            <i class="layui-icon layui-icon-upload"></i> 上传核心包
-                        </button>
-                    </div>
-                </div>
-                <div class="layui-form-item">
-                    <label class="layui-form-label">更新日志</label>
-                    <div class="layui-input-block">
-                        <textarea name="changelog" class="layui-textarea" placeholder="更新内容..."></textarea>
-                    </div>
-                </div>
-            </form>
-            <table class="layui-hide" id="dataTable" lay-filter="dataTable"></table>
-        </div>
-    </div>
- 
-
-<script>
-layui.use(['table', 'upload', 'jquery', 'layer'], function () {
-    var table = layui.table, upload = layui.upload, $ = layui.jquery, layer = layui.layer;
-    table.render({
-        elem: '#dataTable',
-        url: '{:url("/appmall/backend/framework/index")}',
-        page: true,
-        cols: [[
-            {field: 'id', title: 'ID', width: 70},
-            {field: 'version', title: '版本号', width: 120},
-            {title: '包', width: 200, templet: function (d) {
-                var h = '';
-                h += d.file_path ? '<span class="layui-badge layui-bg-blue">整包</span> '
-                                 : '<span class="layui-badge layui-bg-gray">无整包</span> ';
-                h += d.patch_path ? '<span class="layui-badge layui-bg-orange">补丁</span> ' : '';
-                h += d.install_path ? '<span class="layui-badge layui-bg-cyan">安装包</span>' : '';
-                return h;
-            }},
-            {field: 'patch_from', title: '补丁基础版本', width: 110, templet: function (d) {
-                return d.patch_from || d.from_version || '';
-            }},
-            {field: 'title', title: '标题'},
-            {field: 'changelog', title: '更新日志'},
-            {field: 'status', title: '状态', width: 90, templet: function (d) {
-                return d.status == 1
-                    ? '<span class="layui-badge layui-bg-green">已发布</span>'
-                    : '<span class="layui-badge">草稿</span>';
-            }},
-            {field: 'download_count', title: '下载数', width: 90},
-            {title: '操作', width: 360, templet: function (d) {
-                var h = '';
-                if (d.status != 1) h += '<a class="layui-btn layui-btn-xs layui-btn-normal" lay-event="publish">发布</a>';
-                if (d.file_path) h += '<a class="layui-btn layui-btn-xs" lay-event="download">下载整包</a>';
-                if (d.patch_path) h += '<a class="layui-btn layui-btn-xs layui-btn-warm" lay-event="downloadPatch">下载补丁</a>';
-                if (d.install_path) h += '<a class="layui-btn layui-btn-xs layui-bg-cyan" lay-event="downloadInstall">下载安装包</a>';
-                h += '<a class="layui-btn layui-btn-xs layui-btn-danger" lay-event="del">删除</a>';
-                return h;
-            }}
-        ]]
-    });
-    upload.render({
-        elem: '#btnUpload',
-        url: '{:url("/appmall/backend/framework/upload")}',
-        accept: 'file',
-        exts: 'zip',
-        before: function () {
-            if (!$('input[name="version"]').val()) {
-                layer.msg('请先填写版本号'); return false;
-            }
-            if ($('#pkgType').val() == '1' && !$('#fromVersion').val()) {
-                layer.msg('增量补丁必须填写基础版本'); return false;
-            }
-        },
-        data: {
-            version: function () { return $('input[name="version"]').val(); },
-            title: function () { return $('input[name="title"]').val(); },
-            changelog: function () { return $('textarea[name="changelog"]').val(); },
-            type: function () { return $('#pkgType').val(); },
-            from_version: function () { return $('#fromVersion').val(); }
-        },
-        done: function (res) {
-            layer.msg(res.message || '完成');
-            if (res.code === 0) table.reload('dataTable');
-        },
-        error: function () { layer.msg('上传失败'); }
-    });
-    table.on('tool(dataTable)', function (obj) {
-        var d = obj.data;
-        if (obj.event === 'publish') {
-            $.post('{:url("/appmall/backend/framework/publish")}', {id: d.id}, function (r) {
-                layer.msg(r.message); if (r.code === 0) table.reload('dataTable');
-            });
-        } else if (obj.event === 'download') {
-            location.href = '{:url("/appmall/backend/framework/download")}?id=' + d.id + '&type=full';
-        } else if (obj.event === 'downloadPatch') {
-            location.href = '{:url("/appmall/backend/framework/download")}?id=' + d.id + '&type=patch';
-        } else if (obj.event === 'downloadInstall') {
-            location.href = '{:url("/appmall/backend/framework/download")}?id=' + d.id + '&type=install';
-        } else if (obj.event === 'del') {
-            layer.confirm('确定删除该版本？', function () {
-                $.post('{:url("/appmall/backend/framework/delete")}', {id: d.id}, function (r) {
-                    layer.msg(r.message); if (r.code === 0) table.reload('dataTable');
-                });
-            });
-        }
-    });
-});
-</script>

addon/appmall/view/backend/revenue/index.html

@@ -1,51 +0,0 @@
-
-    <div class="layui-card" style="margin:20px;">
-        <div class="layui-card-header">收益账本（开发者分红）</div>
-        <div class="layui-card-body">
-            <div class="layui-row" id="summary" style="margin-bottom:12px;"></div>
-            <table class="layui-hide" id="dataTable" lay-filter="dataTable"></table>
-        </div>
-    </div> 
-
-<script>
-layui.use(['table', 'jquery'], function () {
-    var table = layui.table, $ = layui.jquery;
-    var summaryData = null;
-    table.render({
-        elem: '#dataTable',
-        url: '{:url("/appmall/backend/revenue/index")}',
-        page: true,
-        // Result::success 返回 code:0 / message / data:{list,summary} / count
-        response: { statusName: 'code', msgName: 'message', countName: 'count', dataName: 'data' },
-        parseData: function (res) {
-            summaryData = (res.data && res.data.summary) ? res.data.summary : null;
-            return {
-                code: res.code,
-                msg: res.message,
-                count: res.count || 0,
-                data: (res.data && res.data.list) ? res.data.list : []
-            };
-        },
-        cols: [[
-            {field: 'id', title: 'ID', width: 70},
-            {field: 'developer_id', title: '开发者ID', width: 100},
-            {field: 'aid', title: '商品ID', width: 90},
-            {field: 'uid', title: '购买用户', width: 90},
-            {field: 'amount', title: '订单金额', width: 100},
-            {field: 'commission', title: '平台抽成', width: 100},
-            {field: 'income', title: '开发者收益', width: 110, templet: function(d){return '<b>'+d.income+'</b>';}},
-            {field: 'status', title: '结算', width: 90, templet: function(d){return d.status==1?'<span class="layui-badge layui-bg-green">已结算</span>':'<span class="layui-badge">待结算</span>';}},
-            {field: 'create_at', title: '时间', width: 170, templet: function(d){return layui.util.toDateString(d.create_at*1000);}}
-        ]],
-        done: function () {
-            if (summaryData) {
-                $('#summary').html(
-                    '总销售额：<b>' + summaryData.total_amount + '</b> &nbsp;|&nbsp; ' +
-                    '平台抽成：<b>' + summaryData.total_commission + '</b> &nbsp;|&nbsp; ' +
-                    '开发者收益：<b style="color:#16a34a;">' + summaryData.total_income + '</b>'
-                );
-            }
-        }
-    });
-});
-</script>

addon/appmall/view/backend/revenue/withdrawal.html

@@ -1,48 +0,0 @@
-
-    <div class="layui-card" style="margin:20px;">
-        <div class="layui-card-header">提现管理（开发者分红结算）</div>
-        <div class="layui-card-body">
-            <table class="layui-hide" id="dataTable" lay-filter="dataTable"></table>
-        </div>
-    </div> 
-
-<script>
-layui.use(['table', 'jquery', 'layer'], function () {
-    var table = layui.table, $ = layui.jquery, layer = layui.layer;
-    table.render({
-        elem: '#dataTable',
-        url: '{:url("/appmall/backend/revenue/withdrawals")}',
-        page: true,
-        cols: [[
-            {field: 'id', title: 'ID', width: 70},
-            {field: 'developer_id', title: '开发者ID', width: 100},
-            {field: 'amount', title: '提现金额', width: 110},
-            {field: 'channel', title: '渠道', width: 90},
-            {field: 'account', title: '收款账号', width: 180},
-            {field: 'status', title: '状态', width: 100, templet: function(d){
-                return d.status==1?'<span class="layui-badge layui-bg-green">已打款</span>'
-                    : (d.status==-1?'<span class="layui-badge layui-bg-orange">已驳回</span>'
-                    :'<span class="layui-badge">待处理</span>');
-            }},
-            {field: 'create_at', title: '申请时间', width: 170, templet: function(d){return layui.util.toDateString(d.create_at*1000);}},
-            {title: '操作', width: 160, templet: function(d){
-                if(d.status!=0) return '-';
-                return '<a class="layui-btn layui-btn-xs layui-btn-normal" lay-event="settle">打款</a>'
-                    + '<a class="layui-btn layui-btn-xs layui-btn-danger" lay-event="reject">驳回</a>';
-            }}
-        ]]
-    });
-    table.on('tool(dataTable)', function(obj){
-        var d = obj.data;
-        if(obj.event==='settle'){
-            layer.confirm('确认已向开发者打款？', function(){
-                $.post('{:url("revenue/settle")}', {id:d.id}, function(r){layer.msg(r.message||r.msg);if(r.code===0)table.reload('dataTable');});
-            });
-        } else if(obj.event==='reject'){
-            layer.prompt({title:'驳回原因'}, function(val, index){
-                $.post('{:url("revenue/reject")}', {id:d.id, reason:val}, function(r){layer.msg(r.message||r.msg);if(r.code===0)table.reload('dataTable');layer.close(index);});
-            });
-        }
-    });
-});
-</script>

addon/appmall/view/frontend/developer/console.html

@@ -1,681 +0,0 @@
-<!--
- * @Author: YwxApp <ywx@ywxapp.cn>
- * @Description: 开发者中心控制台（Discuz! 应用中心风格：顶栏 + 左侧菜单 + 内容区）
--->
-<!DOCTYPE html>
-<html lang="zh-CN">
-<head>
-  <meta charset="utf-8">
-  <title>开发者中心 - YwxApp 应用市场</title>
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <link href="/assets/layui/css/layui.css" rel="stylesheet">
-  <link href="/assets/ywxapp/css/wxapp.css" rel="stylesheet">
-  <style>
-    :root {
-      --brand: #1677ff;
-      --brand-dark: #0e5fd8;
-      --bg: #f0f2f5;
-      --card: #fff;
-      --text: #1f2329;
-      --muted: #8a919f;
-      --line: #ebedf0;
-      --ok: #18a058;
-      --warn: #d48806;
-      --danger: #d4380d;
-    }
-    * { box-sizing: border-box; }
-    body { margin: 0; background: var(--bg); color: var(--text); font-family: -apple-system, "Segoe UI", "Microsoft YaHei", sans-serif; font-size: 14px; }
-    a { color: var(--brand); text-decoration: none; }
-
-    /* 顶栏 */
-    .topbar { height: 56px; background: #fff; border-bottom: 1px solid var(--line); display: flex; align-items: center; padding: 0 22px; position: sticky; top: 0; z-index: 10; }
-    .topbar .brand { font-size: 17px; font-weight: 700; color: var(--text); display: flex; align-items: center; gap: 8px; }
-    .topbar .brand .logo { width: 26px; height: 26px; border-radius: 6px; background: linear-gradient(135deg, var(--brand), #36cfc9); color: #fff; display: inline-flex; align-items: center; justify-content: center; font-size: 15px; }
-    .topbar .brand small { font-weight: 400; color: var(--muted); font-size: 13px; margin-left: 2px; }
-    .topbar .spacer { flex: 1; }
-    .topbar .who { color: var(--muted); font-size: 13px; margin-right: 14px; }
-    .topbar .who b { color: var(--text); }
-
-    /* 布局 */
-    .layout { display: flex; min-height: calc(100vh - 56px); }
-    .sidebar { width: 210px; background: #fff; border-right: 1px solid var(--line); padding: 14px 0; flex-shrink: 0; }
-    .sidebar .menu { list-style: none; margin: 0; padding: 0; }
-    .sidebar .menu li { padding: 12px 22px; cursor: pointer; color: #4e5969; display: flex; align-items: center; gap: 10px; font-size: 14px; border-left: 3px solid transparent; transition: all .15s; }
-    .sidebar .menu li .ic { font-size: 16px; width: 18px; text-align: center; }
-    .sidebar .menu li:hover { background: #f7f9fc; color: var(--brand); }
-    .sidebar .menu li.active { background: #eef4ff; color: var(--brand); border-left-color: var(--brand); font-weight: 600; }
-
-    .content { flex: 1; padding: 22px 26px; min-width: 0; }
-    .panel { display: none; }
-    .panel.active { display: block; animation: fade .2s; }
-    @keyframes fade { from { opacity: 0; transform: translateY(4px); } to { opacity: 1; transform: none; } }
-
-    .page-title { font-size: 18px; font-weight: 700; margin: 0 0 4px; }
-    .page-sub { color: var(--muted); margin: 0 0 18px; font-size: 13px; }
-
-    /* 卡片/统计 */
-    .stat-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 14px; margin-bottom: 18px; }
-    .stat-card { background: var(--card); border-radius: 10px; padding: 16px 18px; box-shadow: 0 1px 3px rgba(0,0,0,.04); }
-    .stat-card .lbl { color: var(--muted); font-size: 13px; }
-    .stat-card .num { font-size: 26px; font-weight: 700; margin-top: 6px; }
-    .stat-card .num.ok { color: var(--ok); }
-    .stat-card .num.brand { color: var(--brand); }
-
-    .card { background: var(--card); border-radius: 10px; padding: 18px 20px; box-shadow: 0 1px 3px rgba(0,0,0,.04); margin-bottom: 16px; }
-    .card h3 { margin: 0 0 14px; font-size: 15px; display: flex; align-items: center; gap: 8px; }
-    .card h3 .bar { width: 4px; height: 15px; background: var(--brand); border-radius: 2px; display: inline-block; }
-
-    /* 表格 */
-    table.dev-table { width: 100%; border-collapse: collapse; font-size: 13px; }
-    table.dev-table th, table.dev-table td { text-align: left; padding: 11px 12px; border-bottom: 1px solid var(--line); }
-    table.dev-table th { color: var(--muted); font-weight: 500; background: #fafbfc; }
-    table.dev-table tr:hover td { background: #fafcff; }
-    .app-name { font-weight: 600; }
-    .app-meta { color: var(--muted); font-size: 12px; margin-top: 2px; }
-
-    .tag { display: inline-block; padding: 2px 9px; border-radius: 20px; font-size: 12px; }
-    .tag.up { background: #e8f7ee; color: var(--ok); }
-    .tag.down { background: #f1f2f4; color: var(--muted); }
-    .tag.wait { background: #fff7e6; color: var(--warn); }
-    .tag.reject { background: #fff1f0; color: var(--danger); }
-    .tag.free { background: #eef4ff; color: var(--brand); }
-    .tag.t-addon { background: #eef4ff; color: var(--brand); }
-    .tag.t-tpl { background: #f4eefe; color: #722ed1; }
-
-    .empty { text-align: center; color: var(--muted); padding: 40px 0; }
-
-    /* 令牌闸门 */
-    .gate { max-width: 420px; margin: 12vh auto 0; background: #fff; border-radius: 12px; padding: 34px 36px; box-shadow: 0 4px 20px rgba(0,0,0,.08); }
-    .gate h2 { margin: 0 0 6px; text-align: center; }
-    .gate p { text-align: center; color: var(--muted); margin: 0 0 22px; font-size: 13px; }
-
-    .btn { display: inline-flex; align-items: center; gap: 6px; }
-    .layui-btn { border-radius: 6px; }
-    .toolbar { margin-bottom: 14px; display: flex; justify-content: space-between; align-items: center; }
-    .copybox { background: #f6f8fa; border: 1px dashed #d0d7de; border-radius: 6px; padding: 10px 12px; font-family: monospace; word-break: break-all; margin: 8px 0; }
-    .kv { display: flex; padding: 9px 0; border-bottom: 1px solid var(--line); font-size: 14px; }
-    .kv:last-child { border-bottom: none; }
-    .kv .k { width: 110px; color: var(--muted); flex-shrink: 0; }
-    .kv .v { flex: 1; word-break: break-all; }
-    .hint { color: var(--muted); font-size: 12px; margin-top: 6px; }
-    .hidden { display: none !important; }
-    .act-link { color: var(--brand); cursor: pointer; }
-    @media (max-width: 880px) { .stat-row { grid-template-columns: repeat(2, 1fr); } .sidebar { width: 64px; } .sidebar .menu li span.txt { display: none; } }
-  </style>
-</head>
-<body>
-
-  <!-- 顶栏 -->
-  <div class="topbar" id="topbar">
-    <div class="brand"><span class="logo">Y</span>YwxApp 应用市场<small>开发者中心</small></div>
-    <div class="spacer"></div>
-    <div class="who" id="who"></div>
-    <a href="javascript:;" class="layui-btn layui-btn-sm layui-btn-primary" id="logoutBtn">退出</a>
-  </div>
-
-  <!-- 令牌闸门 -->
-  <div id="gate" class="gate hidden">
-    <h2>开发者令牌登录</h2>
-    <p>请输入你的开发者令牌以进入控制台（可在「查询我的令牌」页取回）</p>
-    <form class="layui-form" id="gateForm">
-      <div class="layui-form-item">
-        <input type="text" name="token" id="gateToken" required lay-verify="required" placeholder="粘贴开发者令牌" class="layui-input">
-      </div>
-      <div class="layui-form-item">
-        <button class="layui-btn layui-btn-fluid layui-btn-normal" lay-submit lay-filter="gate">进入控制台</button>
-      </div>
-    </form>
-    <p class="hint" style="text-align:center;">
-      还没有令牌？<a href="{:url('index')}">立即申请入驻</a> ·
-      <a href="{:url('mine')}">找回令牌</a>
-    </p>
-  </div>
-
-  <!-- 控制台主体 -->
-  <div class="layout hidden" id="console">
-    <div class="sidebar">
-      <ul class="menu" id="menu">
-        <li data-tab="overview" class="active"><span class="ic layui-icon layui-icon-console"></span><span class="txt">概览</span></li>
-        <li data-tab="apps"><span class="ic layui-icon layui-icon-app"></span><span class="txt">我的应用</span></li>
-        <li data-tab="submit"><span class="ic layui-icon layui-icon-upload"></span><span class="txt">提交应用</span></li>
-        <li data-tab="earn"><span class="ic layui-icon layui-icon-rmb"></span><span class="txt">收益账单</span></li>
-        <li data-tab="withdraw"><span class="ic layui-icon layui-icon-transfer"></span><span class="txt">提现</span></li>
-        <li data-tab="account"><span class="ic layui-icon layui-icon-user"></span><span class="txt">账户设置</span></li>
-      </ul>
-    </div>
-    <div class="content">
-
-      <!-- 概览 -->
-      <section class="panel active" id="panel-overview">
-        <h2 class="page-title">概览</h2>
-        <p class="page-sub">你的应用与市场表现一览</p>
-        <div class="stat-row" id="statRow">
-          <div class="stat-card"><div class="lbl">已上架应用</div><div class="num brand" id="stApps">-</div></div>
-          <div class="stat-card"><div class="lbl">待审核提交</div><div class="num warn" id="stPending">-</div></div>
-          <div class="stat-card"><div class="lbl">总下载量</div><div class="num" id="stDl">-</div></div>
-          <div class="stat-card"><div class="lbl">可提现余额</div><div class="num ok" id="stBalance">-</div></div>
-        </div>
-        <div class="card">
-          <h3><span class="bar"></span>近期提交</h3>
-          <table class="dev-table">
-            <thead><tr><th>应用</th><th>版本</th><th>状态</th><th>时间</th></tr></thead>
-            <tbody id="recentBody"><tr><td colspan="4" class="empty">加载中…</td></tr></tbody>
-          </table>
-        </div>
-      </section>
-
-      <!-- 我的应用 -->
-      <section class="panel" id="panel-apps">
-        <h2 class="page-title">我的应用</h2>
-        <p class="page-sub">查看你已上架/下架的应用，以及待审核的提交记录</p>
-        <div class="toolbar">
-          <span class="hint">如需发布新版本，请前往「提交应用」上传 zip 包</span>
-          <a href="javascript:;" class="layui-btn layui-btn-sm layui-btn-normal" data-goto="submit">+ 提交新应用</a>
-        </div>
-        <div class="card">
-          <h3><span class="bar"></span>已上架 / 下架应用</h3>
-          <table class="dev-table">
-            <thead><tr><th>应用</th><th>版本</th><th>价格</th><th>下载</th><th>状态</th><th>更新时间</th><th>操作</th></tr></thead>
-            <tbody id="listedBody"><tr><td colspan="7" class="empty">加载中…</td></tr></tbody>
-          </table>
-        </div>
-        <div class="card">
-          <h3><span class="bar"></span>提交记录</h3>
-          <table class="dev-table">
-            <thead><tr><th>应用</th><th>版本</th><th>状态</th><th>说明</th><th>更新时间</th></tr></thead>
-            <tbody id="subBody"><tr><td colspan="5" class="empty">加载中…</td></tr></tbody>
-          </table>
-        </div>
-      </section>
-
-      <!-- 提交应用 -->
-      <section class="panel" id="panel-submit">
-        <h2 class="page-title">商品提交</h2>
-        <p class="page-sub" id="submitSub">上传插件 zip 包（根目录需含 info.php），提交后等待官方审核</p>
-        <div class="card">
-          <form class="layui-form" id="submitForm">
-            <div class="layui-form-item">
-              <label class="layui-form-label">应用类型</label>
-              <div class="layui-input-inline" style="width:200px;">
-                <select name="type" id="appType">
-                  <option value="addon">插件</option>
-                  <option value="template">模板</option>
-                </select>
-              </div>
-              <div class="layui-form-mid layui-word-aux">插件含 info.php；模板含 templates/名称/template.json</div>
-            </div>
-            <div class="layui-form-item">
-              <label class="layui-form-label">插件标识</label>
-              <div class="layui-input-inline" style="width:260px;">
-                <input type="text" name="name" required lay-verify="required" placeholder="如 mqttbroker（仅字母数字下划线）" class="layui-input">
-              </div>
-              <div class="layui-form-mid layui-word-aux" id="nameHint">与 info.php 中 name 一致</div>
-            </div>
-            <div class="layui-form-item">
-              <label class="layui-form-label">版本号</label>
-              <div class="layui-input-inline" style="width:200px;">
-                <input type="text" name="version" required lay-verify="required" placeholder="如 1.0.0" class="layui-input">
-              </div>
-              <div class="layui-form-mid layui-word-aux">格式 x.y.z，且未重复提交</div>
-            </div>
-            <div class="layui-form-item">
-              <label class="layui-form-label">应用名称</label>
-              <div class="layui-input-block">
-                <input type="text" name="title" required lay-verify="required" placeholder="如 MQTT 消息代理" class="layui-input">
-              </div>
-            </div>
-            <div class="layui-form-item">
-              <label class="layui-form-label">作者</label>
-              <div class="layui-input-block">
-                <input type="text" name="author" placeholder="开发者/工作室名称" class="layui-input">
-              </div>
-            </div>
-            <div class="layui-form-item">
-              <label class="layui-form-label">分类</label>
-              <div class="layui-input-inline" style="width:200px;">
-                <select name="category">
-                  <option value="工具">工具</option>
-                  <option value="电商">电商</option>
-                  <option value="社交">社交</option>
-                  <option value="内容">内容</option>
-                  <option value="教育">教育</option>
-                  <option value="其他">其他</option>
-                </select>
-              </div>
-              <label class="layui-form-label">价格(￥)</label>
-              <div class="layui-input-inline" style="width:140px;">
-                <input type="number" name="price" value="0" step="0.01" min="0" class="layui-input">
-              </div>
-            </div>
-            <div class="layui-form-item">
-              <label class="layui-form-label">标签</label>
-              <div class="layui-input-block">
-                <input type="text" name="tags" placeholder="逗号分隔，如 物联网,通信" class="layui-input">
-              </div>
-            </div>
-            <div class="layui-form-item">
-              <label class="layui-form-label">封面图URL</label>
-              <div class="layui-input-block">
-                <input type="text" name="logo" placeholder="可选，应用封面图地址" class="layui-input">
-              </div>
-            </div>
-            <div class="layui-form-item">
-              <label class="layui-form-label">简介</label>
-              <div class="layui-input-block">
-                <textarea name="description" placeholder="应用简介/功能描述" class="layui-textarea"></textarea>
-              </div>
-            </div>
-            <div class="layui-form-item">
-              <label class="layui-form-label">更新日志</label>
-              <div class="layui-input-block">
-                <textarea name="changelog" placeholder="如：1.0.1 修复某某问题；1.0.0 首次发布" class="layui-textarea"></textarea>
-              </div>
-            </div>
-            <div class="layui-form-item">
-              <label class="layui-form-label">最低框架版本</label>
-              <div class="layui-input-block">
-                <input type="text" name="require_framework" placeholder="如 1.2.0（留空表示不限）" class="layui-input">
-              </div>
-            </div>
-            <div class="layui-form-item">
-              <label class="layui-form-label">插件包</label>
-              <div class="layui-input-block">
-                <input type="file" name="file" id="pkgFile" accept=".zip" required lay-verify="required" class="layui-input">
-                <div class="hint" id="pkgHint">仅支持 .zip，插件包根目录需含 info.php，将进行安全扫描</div>
-              </div>
-            </div>
-            <div class="layui-form-item">
-              <div class="layui-input-block">
-                <button class="layui-btn layui-btn-normal" lay-submit lay-filter="doSubmit">提交审核</button>
-                <button type="reset" class="layui-btn layui-btn-primary">重置</button>
-              </div>
-            </div>
-          </form>
-        </div>
-      </section>
-
-      <!-- 收益账单 -->
-      <section class="panel" id="panel-earn">
-        <h2 class="page-title">收益账单</h2>
-        <p class="page-sub">查看销售收益与结算情况</p>
-        <div class="stat-row">
-          <div class="stat-card"><div class="lbl">可提现余额</div><div class="num ok" id="eaBalance">￥0.00</div></div>
-          <div class="stat-card"><div class="lbl">冻结中（提现待打款）</div><div class="num warn" id="eaFrozen">￥0.00</div></div>
-        </div>
-        <div class="card">
-          <h3><span class="bar"></span>收益明细</h3>
-          <table class="dev-table">
-            <thead><tr><th>订单号</th><th>销售额</th><th>抽成</th><th>应得</th><th>状态</th><th>时间</th></tr></thead>
-            <tbody id="revBody"><tr><td colspan="6" class="empty">加载中…</td></tr></tbody>
-          </table>
-        </div>
-      </section>
-
-      <!-- 提现 -->
-      <section class="panel" id="panel-withdraw">
-        <h2 class="page-title">提现</h2>
-        <p class="page-sub">将可提现余额提现至你的收款账号</p>
-        <div class="card" style="max-width:560px;">
-          <form class="layui-form" id="withdrawForm">
-            <div class="layui-form-item">
-              <label class="layui-form-label">提现金额</label>
-              <div class="layui-input-inline" style="width:200px;">
-                <input type="number" name="amount" step="0.01" min="0.01" required lay-verify="required" placeholder="0.00" class="layui-input">
-              </div>
-              <div class="layui-form-mid layui-word-aux">不可超过可提现余额</div>
-            </div>
-            <div class="layui-form-item">
-              <label class="layui-form-label">提现渠道</label>
-              <div class="layui-input-inline" style="width:200px;">
-                <select name="channel">
-                  <option value="alipay">支付宝</option>
-                  <option value="wechat">微信</option>
-                  <option value="bank">银行卡</option>
-                </select>
-              </div>
-            </div>
-            <div class="layui-form-item">
-              <label class="layui-form-label">收款账号</label>
-              <div class="layui-input-block">
-                <input type="text" name="account" required lay-verify="required" placeholder="支付宝/微信账号或银行卡号" class="layui-input">
-              </div>
-            </div>
-            <div class="layui-form-item">
-              <div class="layui-input-block">
-                <button class="layui-btn layui-btn-normal" lay-submit lay-filter="doWithdraw">提交提现申请</button>
-              </div>
-            </div>
-          </form>
-        </div>
-      </section>
-
-      <!-- 账户设置 -->
-      <section class="panel" id="panel-account">
-        <h2 class="page-title">账户设置</h2>
-        <p class="page-sub">管理你的开发者身份与令牌</p>
-        <div class="card" style="max-width:620px;">
-          <div class="kv"><div class="k">开发者名称</div><div class="v" id="acName">-</div></div>
-          <div class="kv"><div class="k">邮箱</div><div class="v" id="acEmail">-</div></div>
-          <div class="kv"><div class="k">账户状态</div><div class="v" id="acStatus">-</div></div>
-          <div class="kv"><div class="k">开发者令牌</div><div class="v">
-            <div class="copybox" id="acToken">-</div>
-            <button class="layui-btn layui-btn-sm layui-btn-normal" id="copyToken">复制令牌</button>
-            <span class="hint">发布插件到官方市场时需使用此令牌（APPMARKET_DEV_TOKEN）。</span>
-          </div></div>
-          <div class="kv"><div class="k">操作</div><div class="v">
-            <a href="{:url('mine')}">丢失令牌？前往找回</a>
-          </div></div>
-        </div>
-      </section>
-
-    </div>
-  </div>
-
-  <script src="/assets/layui/layui.js"></script>
-  <script src="/assets/ywxapp/ywxapp.js" module="{$site.app}"></script>
-  <script>
-    layui.use(['form', 'jquery', 'layer', 'http'], function () {
-      var form = layui.form, $ = layui.jquery, layer = layui.layer, http = layui.http;
-      var TOKEN_KEY = 'appmall_dev_token';
-      var token = '';
-
-      // ---- 工具 ----
-      function getParam(name) {
-        var m = location.search.match(new RegExp('[?&]' + name + '=([^&]*)'));
-        return m ? decodeURIComponent(m[1]) : '';
-      }
-      function maskToken(t) {
-        if (!t || t.length < 12) return t;
-        return t.substr(0, 6) + '****' + t.substr(-4);
-      }
-      function money(v) { return '￥' + (parseFloat(v || 0)).toFixed(2); }
-      function fmtTime(ts) {
-        if (!ts) return '-';
-        var d = new Date(ts * 1000);
-        return d.getFullYear() + '-' + ('0' + (d.getMonth() + 1)).slice(-2) + '-' + ('0' + d.getDate()).slice(-2)
-          + ' ' + ('0' + d.getHours()).slice(-2) + ':' + ('0' + d.getMinutes()).slice(-2);
-      }
-      // Result 系接口成功 code=0；Market::submit 成功 code=1
-      function req(url, data, successCode) {
-        successCode = (successCode === undefined) ? 0 : successCode;
-        return http.post(url, data).then(function (r) {
-          if (r && r.code === successCode) return r;
-          return Promise.reject((r && r.message) || (r && r.msg) || '请求失败');
-        });
-      }
-
-      // ---- 令牌闸门 ----
-      function showGate() { $('#gate').removeClass('hidden'); $('#console').addClass('hidden'); $('#topbar').addClass('hidden'); }
-      function enterConsole(tk) {
-        token = tk;
-        try { localStorage.setItem(TOKEN_KEY, tk); } catch (e) {}
-        $('#gate').addClass('hidden');
-        $('#topbar').removeClass('hidden');
-        $('#console').removeClass('hidden');
-        loadOverview();
-        loadAccount();
-      }
-
-      // 初始化：URL > localStorage
-      var initToken = getParam('token') || (function () { try { return localStorage.getItem(TOKEN_KEY) || ''; } catch (e) { return ''; } })();
-      if (!initToken) {
-        showGate();
-      } else {
-        // 校验令牌有效性
-        req('/appmall/developer/overview', { token: initToken }).then(function (r) {
-          enterConsole(initToken);
-        }).catch(function (msg) {
-          showGate();
-          layer.msg(msg || '令牌无效', { icon: 2 });
-        });
-      }
-
-      form.on('submit(gate)', function (data) {
-        var tk = (data.field.token || '').trim();
-        if (!tk) { layer.msg('请输入令牌', { icon: 2 }); return false; }
-        layer.load(1);
-        req('/appmall/developer/overview', { token: tk }).then(function () {
-          layer.closeAll();
-          enterConsole(tk);
-        }).catch(function (msg) {
-          layer.closeAll();
-          layer.msg(msg || '令牌无效', { icon: 2 });
-        });
-        return false;
-      });
-
-      $('#logoutBtn').on('click', function () {
-        try { localStorage.removeItem(TOKEN_KEY); } catch (e) {}
-        location.href = '{:url("index")}';
-      });
-
-      // ---- 左侧菜单 ----
-      $('#menu').on('click', 'li', function () {
-        var tab = $(this).data('tab');
-        $('#menu li').removeClass('active');
-        $(this).addClass('active');
-        $('.panel').removeClass('active');
-        $('#panel-' + tab).addClass('active');
-        if (tab === 'overview') loadOverview();
-        else if (tab === 'apps') loadApps();
-        else if (tab === 'earn') loadEarnings();
-        else if (tab === 'account') loadAccount();
-      });
-      $('[data-goto]').on('click', function () {
-        var tab = $(this).data('goto');
-        $('#menu li[data-tab="' + tab + '"]').click();
-      });
-
-      // ---- 概览 ----
-      function loadOverview() {
-        req('/appmall/developer/overview', { token: token }).then(function (r) {
-          var d = r.data || {};
-          $('#who').html('欢迎，<b>' + (d.username || '开发者') + '</b>');
-          $('#stApps').text(d.app_count || 0);
-          $('#stPending').text(d.pending_count || 0);
-          $('#stDl').text(d.total_downloads || 0);
-          $('#stBalance').text(money(d.balance));
-          var rows = d.recent || [];
-          if (!rows.length) {
-            $('#recentBody').html('<tr><td colspan="4" class="empty">暂无提交记录</td></tr>');
-            return;
-          }
-          var html = '';
-          rows.forEach(function (it) {
-            var st = subStatus(it.status);
-            html += '<tr><td class="app-name">' + esc(it.title) + typeTag(it.type) + '</td><td>' + esc(it.version) + '</td><td>' + st + '</td><td>' + fmtTime(it.update_at) + '</td></tr>';
-          });
-          $('#recentBody').html(html);
-        }).catch(function (msg) { layer.msg(msg, { icon: 2 }); });
-      }
-
-      // ---- 我的应用 ----
-      function loadApps() {
-        req('/appmall/developer/apps', { token: token }).then(function (r) {
-          var d = r.data || {};
-          var listed = d.listed || [], subs = d.submissions || [];
-          if (!listed.length) {
-            $('#listedBody').html('<tr><td colspan="7" class="empty">你还没有已上架的应用</td></tr>');
-          } else {
-            var h = '';
-            listed.forEach(function (it) {
-              var price = (parseFloat(it.price) > 0) ? money(it.price) : '<span class="tag free">免费</span>';
-              var st = it.status == 1
-                ? '<span class="tag up">上架中</span>'
-                : '<span class="tag down">已下架</span>';
-              h += '<tr>'
-                + '<td class="app-name">' + esc(it.title) + typeTag(it.type) + '<div class="app-meta">' + esc(it.name) + (it.category ? ' · ' + esc(it.category) : '') + '</div></td>'
-                + '<td>' + esc(it.version) + '</td>'
-                + '<td>' + price + '</td>'
-                + '<td>' + (it.download_count || 0) + '</td>'
-                + '<td>' + st + '</td>'
-                + '<td>' + fmtTime(it.update_at) + '</td>'
-                + '<td><a class="act-link" data-act="price" data-name="' + esc(it.name) + '" data-price="' + (it.price || 0) + '">改价</a></td></tr>';
-            });
-            $('#listedBody').html(h);
-          }
-          if (!subs.length) {
-            $('#subBody').html('<tr><td colspan="5" class="empty">暂无提交记录</td></tr>');
-          } else {
-            var h2 = '';
-            subs.forEach(function (it) {
-              var st = subStatus(it.status);
-              var note = it.status == 2 ? (it.reject_reason ? esc(it.reject_reason) : '已驳回，可重新提交') : '-';
-              h2 += '<tr>'
-                + '<td class="app-name">' + esc(it.title) + typeTag(it.type) + '<div class="app-meta">' + esc(it.name) + '</div></td>'
-                + '<td>' + esc(it.version) + '</td>'
-                + '<td>' + st + '</td>'
-                + '<td>' + note + '</td>'
-                + '<td>' + fmtTime(it.update_at) + '</td></tr>';
-            });
-            $('#subBody').html(h2);
-          }
-        }).catch(function (msg) { layer.msg(msg, { icon: 2 }); });
-      }
-
-      // 改价（无需重新打包/重新提审，同步该应用全部版本，市场即时生效）
-      $('#listedBody').on('click', '[data-act="price"]', function () {
-        var name = $(this).data('name');
-        var cur  = $(this).data('price') || 0;
-        layer.prompt({ title: '修改「' + name + '」价格（0 为免费，同步全部版本）', value: String(cur) }, function (val, idx) {
-          var p = parseFloat(val);
-          if (isNaN(p) || p < 0) { layer.msg('请输入不小于 0 的价格', { icon: 2 }); return; }
-          req('/appmall/developer/price', { token: token, name: name, price: p }).then(function (r) {
-            layer.close(idx);
-            layer.msg(r.message || '价格已更新', { icon: 1 });
-            loadApps();
-          }).catch(function (msg) { layer.msg(msg, { icon: 2 }); });
-        });
-      });
-
-      function subStatus(s) {
-        if (s == 0) return '<span class="tag wait">待审核</span>';
-        if (s == 1) return '<span class="tag up">已通过</span>';
-        if (s == 2) return '<span class="tag reject">已驳回</span>';
-        return '<span class="tag down">未知</span>';
-      }
-      function typeTag(t) {
-        return t === 'template'
-          ? ' <span class="tag t-tpl">模板</span>'
-          : ' <span class="tag t-addon">插件</span>';
-      }
-      // 提交类型切换：动态改写包要求与标识提示
-      $('#appType').on('change', function () {
-        var isTpl = $(this).val() === 'template';
-        $('#submitSub').text(isTpl
-          ? '上传模板 zip 包（须含 templates/名称/template.json），提交后等待官方审核'
-          : '上传插件 zip 包（根目录需含 info.php），提交后等待官方审核');
-        $('#pkgHint').text(isTpl
-          ? '仅支持 .zip，模板包须含 templates/<名称>/template.json，将进行安全扫描（模板包禁含 PHP 文件）'
-          : '仅支持 .zip，插件包根目录需含 info.php，将进行安全扫描');
-        $('#nameHint').text(isTpl ? '与 template.json 中标识(文件夹名)一致' : '与 info.php 中 name 一致');
-      });
-
-      // ---- 提交应用 ----
-      form.on('submit(doSubmit)', function () {
-        var file = document.getElementById('pkgFile').files[0];
-        if (!file) { layer.msg('请选择插件 zip 包', { icon: 2 }); return false; }
-        var fd = new FormData();
-        fd.append('file', file);
-        fd.append('token', token);
-        fd.append('type', $('select[name="type"]').val());
-        fd.append('name', $('input[name="name"]').val());
-        fd.append('version', $('input[name="version"]').val());
-        fd.append('title', $('input[name="title"]').val());
-        fd.append('author', $('input[name="author"]').val());
-        fd.append('category', $('select[name="category"]').val());
-        fd.append('tags', $('input[name="tags"]').val());
-        fd.append('price', $('input[name="price"]').val());
-        fd.append('logo', $('input[name="logo"]').val());
-        fd.append('description', $('textarea[name="description"]').val());
-        fd.append('changelog', $('textarea[name="changelog"]').val());
-        fd.append('require_framework', $('input[name="require_framework"]').val());
-        layer.load(1);
-        http.upload('/appmall/api/addon/submit', file, {
-          token: token,
-          type: $('select[name="type"]').val(),
-          name: $('input[name="name"]').val(),
-          version: $('input[name="version"]').val(),
-          title: $('input[name="title"]').val(),
-          author: $('input[name="author"]').val(),
-          category: $('select[name="category"]').val(),
-          tags: $('input[name="tags"]').val(),
-          price: $('input[name="price"]').val(),
-          logo: $('input[name="logo"]').val(),
-          description: $('textarea[name="description"]').val()
-        }).then(function (r) {
-          layer.closeAll();
-          if (r && r.code === 1) {
-            layer.msg(r.msg || '提交成功，等待审核', { icon: 1 });
-            $('#submitForm')[0].reset();
-            form.render();
-          } else {
-            layer.msg((r && (r.msg || r.message)) || '提交失败', { icon: 2 });
-          }
-        }).catch(function () { layer.closeAll(); layer.msg('请求失败', { icon: 2 }); });
-        return false;
-      });
-
-      // ---- 收益 ----
-      function loadEarnings() {
-        req('/appmall/developer/earnings', { token: token }).then(function (r) {
-          var d = r.data || {};
-          $('#eaBalance').text(money(d.balance));
-          $('#eaFrozen').text(money(d.frozen_balance));
-          var list = d.revenues || [];
-          if (!list.length) {
-            $('#revBody').html('<tr><td colspan="6" class="empty">暂无收益记录</td></tr>');
-            return;
-          }
-          var html = '';
-          list.forEach(function (it) {
-            var st = it.status == 1 ? '<span style="color:#18a058;">已结算</span>' : '<span style="color:#d48806;">待结算</span>';
-            html += '<tr>'
-              + '<td>' + (it.order_id || '-') + '</td>'
-              + '<td>' + money(it.amount) + '</td>'
-              + '<td>' + money(it.commission) + '</td>'
-              + '<td>' + money(it.income) + '</td>'
-              + '<td>' + st + '</td>'
-              + '<td>' + fmtTime(it.create_at) + '</td></tr>';
-          });
-          $('#revBody').html(html);
-        }).catch(function (msg) { layer.msg(msg, { icon: 2 }); });
-      }
-
-      // ---- 提现 ----
-      form.on('submit(doWithdraw)', function (data) {
-        data.field.token = token;
-        var amt = parseFloat(data.field.amount);
-        if (!(amt > 0)) { layer.msg('请输入正确的提现金额', { icon: 2 }); return false; }
-        req('/appmall/developer/withdraw', data.field).then(function (r) {
-          layer.msg(r.message || '提交成功', { icon: 1 });
-          $('#withdrawForm')[0].reset(); form.render();
-          loadEarnings();
-        }).catch(function (msg) { layer.msg(msg, { icon: 2 }); });
-        return false;
-      });
-
-      // ---- 账户 ----
-      function loadAccount() {
-        req('/appmall/developer/overview', { token: token }).then(function (r) {
-          var d = r.data || {};
-          $('#acName').text(d.username || '-');
-          $('#acEmail').text(d.email || '-');
-          $('#acStatus').html('<span class="tag up">正常</span>');
-          $('#acToken').text(token);
-        }).catch(function () {});
-      }
-      $('#copyToken').on('click', function () {
-        var t = document.getElementById('acToken').innerText;
-        var ta = $('<textarea>').val(t).appendTo('body').select();
-        try { document.execCommand('copy'); layer.msg('已复制', { icon: 1 }); } catch (e) { layer.msg('复制失败', { icon: 2 }); }
-        ta.remove();
-      });
-
-      function esc(s) {
-        return $('<div>').text(s == null ? '' : s).html();
-      }
-    });
-  </script>
-</body>
-</html>

addon/appmall/view/frontend/developer/earnings.html

@@ -1,157 +0,0 @@
-<!DOCTYPE html>
-<html lang="zh-CN">
-<head>
-  <meta charset="utf-8">
-  <title>开发者控制台 - YwxApp 应用市场</title>
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <link href="/assets/layui/css/layui.css" rel="stylesheet">
-  <style>
-    body { background: #f2f3f5; color: #333; }
-    .dev-box { max-width: 720px; margin: 40px auto; background: #fff; padding: 28px 32px; border-radius: 8px; box-shadow: 0 2px 12px rgba(0,0,0,.08); }
-    .dev-box h2 { margin-bottom: 4px; }
-    .dev-tip { color: #999; font-size: 13px; margin-bottom: 18px; }
-    .balance-row { display: flex; gap: 16px; margin: 18px 0; }
-    .balance-card { flex: 1; background: #f7f9fc; border-radius: 8px; padding: 16px; text-align: center; }
-    .balance-card .label { color: #888; font-size: 13px; }
-    .balance-card .val { font-size: 24px; font-weight: 700; margin-top: 6px; }
-    .balance-card .val.ok { color: #18a058; }
-    .balance-card .val.free { color: #d48806; }
-    .rev-table { margin-top: 10px; }
-    .hidden { display: none; }
-  </style>
-</head>
-<body>
-  <div class="dev-box">
-    <h2>开发者控制台</h2>
-    <p class="dev-tip">使用开发者令牌查看收益并发起提现（令牌可在「我的令牌」页查询）</p>
-
-    <form class="layui-form" id="authForm">
-      <div class="layui-form-item">
-        <label class="layui-form-label">开发者令牌</label>
-        <div class="layui-input-block">
-          <input type="text" name="token" id="tokenInput" value="{$token|default=''}" required placeholder="粘贴你的开发者令牌" class="layui-input">
-        </div>
-      </div>
-      <div class="layui-form-item">
-        <div class="layui-input-block">
-          <button class="layui-btn" lay-submit lay-filter="load">加载我的收益</button>
-          <a href="{:url('index')}" class="layui-btn layui-btn-primary">返回注册</a>
-        </div>
-      </div>
-    </form>
-
-    <div id="panel" class="hidden">
-      <div class="balance-row">
-        <div class="balance-card">
-          <div class="label">可提现余额</div>
-          <div class="val ok" id="balance">￥0.00</div>
-        </div>
-        <div class="balance-card">
-          <div class="label">冻结中（提现待打款）</div>
-          <div class="val free" id="frozen">￥0.00</div>
-        </div>
-      </div>
-
-      <fieldset class="layui-elem-field layui-field-title" style="margin-top:18px;"><legend>发起提现</legend></fieldset>
-      <form class="layui-form" id="withdrawForm">
-        <input type="hidden" name="token" id="wToken">
-        <div class="layui-form-item">
-          <label class="layui-form-label">提现金额</label>
-          <div class="layui-input-inline">
-            <input type="number" name="amount" step="0.01" min="0.01" required placeholder="0.00" class="layui-input">
-          </div>
-          <div class="layui-form-mid layui-word-aux">不可超过可提现余额</div>
-        </div>
-        <div class="layui-form-item">
-          <label class="layui-form-label">提现渠道</label>
-          <div class="layui-input-inline">
-            <select name="channel">
-              <option value="alipay">支付宝</option>
-              <option value="wechat">微信</option>
-              <option value="bank">银行卡</option>
-            </select>
-          </div>
-        </div>
-        <div class="layui-form-item">
-          <label class="layui-form-label">收款账号</label>
-          <div class="layui-input-block">
-            <input type="text" name="account" required placeholder="支付宝/微信账号或银行卡号" class="layui-input">
-          </div>
-        </div>
-        <div class="layui-form-item">
-          <div class="layui-input-block">
-            <button class="layui-btn layui-btn-normal" lay-submit lay-filter="doWithdraw">提交提现申请</button>
-          </div>
-        </div>
-      </form>
-
-      <fieldset class="layui-elem-field layui-field-title" style="margin-top:24px;"><legend>近期收益</legend></fieldset>
-      <table class="layui-table rev-table">
-        <thead>
-          <tr><th>订单号</th><th>销售额</th><th>抽成</th><th>应得</th><th>状态</th><th>时间</th></tr>
-        </thead>
-        <tbody id="revBody">
-          <tr><td colspan="6" style="text-align:center;color:#999;">暂无收益记录</td></tr>
-        </tbody>
-      </table>
-    </div>
-  </div>
-
-  <script src="/assets/layui/layui.js"></script>
-  <script>
-    layui.use(['form', 'jquery', 'layer', 'http'], function () {
-      var form = layui.form, $ = layui.jquery, layer = layui.layer, http = layui.http;
-
-      form.on('submit(load)', function (data) {
-        http.post('{:url("/appmall/developer/earnings")}', data.field).then(function (r) {
-            if (r.code !== 0) { layer.msg(r.message || '加载失败', { icon: 2 }); return; }
-            var d = r.data || {};
-            $('#balance').text('￥' + parseFloat(d.balance || 0).toFixed(2));
-            $('#frozen').text('￥' + parseFloat(d.frozen_balance || 0).toFixed(2));
-            $('#wToken').val(data.field.token);
-            renderRevenues(d.revenues || []);
-            $('#panel').removeClass('hidden');
-          }).catch(function () { layer.msg('请求失败', { icon: 2 }); });
-        return false;
-      });
-
-      form.on('submit(doWithdraw)', function (data) {
-        var amount = parseFloat(data.field.amount);
-        if (!(amount > 0)) { layer.msg('请输入正确的提现金额', { icon: 2 }); return false; }
-        var avail = parseFloat($('#balance').text().replace(/[^\d.]/g, '')) || 0;
-        if (amount > avail) { layer.msg('提现金额超过可提现余额', { icon: 2 }); return false; }
-        http.post('{:url("/appmall/developer/withdraw")}', data.field).then(function (r) {
-            layer.msg(r.message || '提交完成', { icon: r.code === 0 ? 1 : 2 });
-            if (r.code === 0) { $('#withdrawForm')[0].reset(); form.render(); }
-          }).catch(function () { layer.msg('请求失败', { icon: 2 }); });
-        return false;
-      });
-
-      function renderRevenues(list) {
-        var body = $('#revBody');
-        if (!list.length) {
-          body.html('<tr><td colspan="6" style="text-align:center;color:#999;">暂无收益记录</td></tr>');
-          return;
-        }
-        var html = '';
-        list.forEach(function (it) {
-          var st = it.status == 1 ? '<span style="color:#18a058;">已结算</span>' : '<span style="color:#d48806;">待结算</span>';
-          html += '<tr>'
-            + '<td>' + (it.order_id || '-') + '</td>'
-            + '<td>￥' + parseFloat(it.amount || 0).toFixed(2) + '</td>'
-            + '<td>￥' + parseFloat(it.commission || 0).toFixed(2) + '</td>'
-            + '<td>￥' + parseFloat(it.income || 0).toFixed(2) + '</td>'
-            + '<td>' + st + '</td>'
-            + '<td>' + (it.create_at ? new Date(it.create_at * 1000).toLocaleString() : '-') + '</td>'
-            + '</tr>';
-        });
-        body.html(html);
-      }
-
-      // 若 URL 携带 token，自动加载
-      var tok = $('#tokenInput').val();
-      if (tok) { $('#authForm').find('button[lay-filter="load"]').click(); }
-    });
-  </script>
-</body>
-</html>

addon/appmall/view/frontend/developer/mine.html

@@ -1,95 +0,0 @@
-<!--
- * @Author: YwxApp <ywx@ywxapp.cn>
- * @Date: 2026-07-21 13:40:36
- * @LastEditors: YwxApp <ywx@ywxapp.cn>
- * @LastEditTime: 2026-07-26 15:36:01
- * @Description: 
- * @FilePath: \ywxapp_dev\addon\appmall\view\frontend\developer\mine.html
- * @CustomString: Copyright (c) 2026 YwxApp
--->
-<!DOCTYPE html>
-<html lang="zh-CN">
-<head>
-  <meta charset="utf-8">
-  <title>查询我的令牌 - YwxApp 应用市场</title>
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <link href="/assets/layui/css/layui.css" rel="stylesheet">
-  <link href="/assets/ywxapp/css/wxapp.css" rel="stylesheet">
-  <style>
-    body { background: #f2f3f5; margin: 0; }
-    .topbar { height: 52px; background: #fff; border-bottom: 1px solid #ebedf0; display: flex; align-items: center; padding: 0 22px; }
-    .topbar .brand { font-size: 16px; font-weight: 700; display: flex; align-items: center; gap: 8px; }
-    .topbar .brand .logo { width: 24px; height: 24px; border-radius: 6px; background: linear-gradient(135deg, #1677ff, #36cfc9); color: #fff; display: inline-flex; align-items: center; justify-content: center; font-size: 14px; }
-    .topbar .brand small { font-weight: 400; color: #8a919f; font-size: 13px; }
-    .topbar .spacer { flex: 1; }
-    .dev-box { max-width: 460px; margin: 48px auto; background: #fff; padding: 30px 35px; border-radius: 8px; box-shadow: 0 2px 12px rgba(0,0,0,.08); }
-    .dev-box h2 { text-align: center; margin-bottom: 6px; }
-    .dev-tip { text-align: center; color: #999; margin-bottom: 22px; font-size: 13px; }
-    .dev-token { background: #f4f4f4; padding: 12px; border-radius: 6px; word-break: break-all; font-family: monospace; }
-  </style>
-</head>
-<body>
-  <div class="topbar">
-    <div class="brand"><span class="logo">Y</span>YwxApp 应用市场<small>开发者中心</small></div>
-    <div class="spacer"></div>
-    <a href="{:url('console')}" class="layui-btn layui-btn-sm layui-btn-normal">进入开发者中心</a>
-  </div>
-  <div class="dev-box">
-    <h2>查询我的令牌</h2>
-    <p class="dev-tip">输入注册邮箱，取回你的开发者令牌（若已激活将重新邮件发送）</p>
-
-    <form class="layui-form" id="lookupForm">
-      <div class="layui-form-item">
-        <label class="layui-form-label">邮箱</label>
-        <div class="layui-input-block">
-          <input type="email" name="email" required lay-verify="email" placeholder="注册时填写的邮箱" class="layui-input">
-        </div>
-      </div>
-      <div class="layui-form-item">
-        <div class="layui-input-block">
-          <button class="layui-btn layui-btn-fluid" lay-submit lay-filter="lookup">查询令牌</button>
-        </div>
-      </div>
-    </form>
-    <div id="result" style="display:none; margin-top:20px;">
-      <div id="resultMsg" class="layui-bg-blue" style="padding:10px 12px;border-radius:6px;margin-bottom:12px;"></div>
-      <div id="tokenWrap" style="display:none;">
-        <label class="layui-form-label" style="text-align:left;padding-left:0;">你的开发者令牌</label>
-        <div class="dev-token" id="tokenVal"></div>
-        <button class="layui-btn layui-btn-sm layui-btn-normal" id="copyBtn" style="margin-top:10px;">复制令牌</button>
-      </div>
-    </div>
-    <p class="dev-tip" style="margin-top:18px;"><a href="{:url('index')}">返回开发者注册</a></p>
-  </div>
-
-  <script src="/assets/layui/layui.js"></script>
-  <script src="/assets/ywxapp/ywxapp.js" module="{$site.app}"></script>
-  <script>
-    layui.use(['form', 'jquery', 'layer', 'http'], function () {
-      var form = layui.form, $ = layui.jquery, layer = layui.layer, http = layui.http;
-      form.on('submit(lookup)', function (data) {
-        http.post('{:url("/appmall/developer/lookup")}', data.field).then(function (r) {
-            $('#result').show();
-            $('#resultMsg').text(r.message || '查询完成');
-            if (r.code === 0 && r.data && r.data.token) {
-              $('#tokenWrap').show();
-              $('#tokenVal').text(r.data.token);
-            } else {
-              $('#tokenWrap').hide();
-            }
-            if (r.code !== 0) { layer.msg(r.message || '查询失败', { icon: 2 }); }
-          }).catch(function () { layer.msg('请求失败', { icon: 2 }); });
-        return false;
-      });
-
-      $('#copyBtn').on('click', function () {
-        var t = document.getElementById('tokenVal').innerText;
-        var dummy = $('<textarea>').val(t).appendTo('body').select();
-        document.execCommand('copy');
-        dummy.remove();
-        layer.msg('已复制', { icon: 1 });
-      });
-    });
-  </script>
-</body>
-</html>

addon/appmall/view/frontend/developer/register.html

@@ -1,109 +0,0 @@
-<!--
- * @Author: YwxApp <ywx@ywxapp.cn>
- * @Date: 2026-07-21 13:40:29
- * @LastEditors: YwxApp <ywx@ywxapp.cn>
- * @LastEditTime: 2026-07-28 12:32:45
- * @Description: 
- * @FilePath: \ywxapp_dev\addon\appmall\view\frontend\developer\register.html
- * @CustomString: Copyright (c) 2026 YwxApp
--->
-<!DOCTYPE html>
-<html lang="zh-CN">
-<head>
-  <meta charset="utf-8">
-  <title>开发者注册 - YwxApp 应用市场</title>
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <link href="/assets/layui/css/layui.css" rel="stylesheet">
-  <link href="/assets/ywxapp/css/wxapp.css" rel="stylesheet">
-  <style>
-    body { background: #f2f3f5; margin: 0; }
-    .topbar { height: 52px; background: #fff; border-bottom: 1px solid #ebedf0; display: flex; align-items: center; padding: 0 22px; }
-    .topbar .brand { font-size: 16px; font-weight: 700; display: flex; align-items: center; gap: 8px; }
-    .topbar .brand .logo { width: 24px; height: 24px; border-radius: 6px; background: linear-gradient(135deg, #1677ff, #36cfc9); color: #fff; display: inline-flex; align-items: center; justify-content: center; font-size: 14px; }
-    .topbar .brand small { font-weight: 400; color: #8a919f; font-size: 13px; }
-    .topbar .spacer { flex: 1; }
-    .dev-box { max-width: 460px; margin: 48px auto; background: #fff; padding: 30px 35px; border-radius: 8px; box-shadow: 0 2px 12px rgba(0,0,0,.08); }
-    .dev-box h2 { text-align: center; margin-bottom: 6px; }
-    .dev-tip { text-align: center; color: #999; margin-bottom: 22px; font-size: 13px; }
-    .dev-token { background: #f4f4f4; padding: 12px; border-radius: 6px; word-break: break-all; font-family: monospace; }
-    .closed { text-align:center; color:#c00; padding:30px 0; }
-  </style>
-</head>
-<body>
-  <div class="topbar">
-    <div class="brand"><span class="logo">Y</span>YwxApp 应用市场<small>开发者中心</small></div>
-    <div class="spacer"></div>
-    <a href="{:url('/appmall/Developer/console')}" class="layui-btn layui-btn-sm layui-btn-normal">进入开发者中心</a>
-  </div>
-  <div class="dev-box">
-    <h2>开发者入驻</h2>
-    <p class="dev-tip">注册后获取开发者令牌，用于在你自己的控制台「发布到官方市场」</p>
-
-    {if $register_open}
-    <form class="layui-form" id="regForm">
-      <div class="layui-form-item">
-        <label class="layui-form-label">开发者名称</label>
-        <div class="layui-input-block">
-          <input type="text" name="username" required lay-verify="required" placeholder="如：星河工作室" class="layui-input">
-        </div>
-      </div>
-      <div class="layui-form-item">
-        <label class="layui-form-label">邮箱</label>
-        <div class="layui-input-block">
-          <input type="email" name="email" required lay-verify="email" placeholder="用于接收令牌/审核通知" class="layui-input">
-        </div>
-      </div>
-      <div class="layui-form-item">
-        <div class="layui-input-block">
-          <button class="layui-btn layui-btn-fluid" lay-submit lay-filter="reg">提交申请</button>
-        </div>
-      </div>
-      <p class="dev-tip" style="margin:0;">
-        {if $need_approval}提交后需运营审核，令牌将通过邮件下发{else/}提交后令牌立即通过邮件下发{/if}
-      </p>
-    </form>
-    <div id="result" style="display:none; margin-top:20px;">
-      <div id="resultMsg" class="layui-bg-blue" style="padding:10px 12px;border-radius:6px;margin-bottom:12px;"></div>
-      <div id="tokenWrap" style="display:none;">
-        <label class="layui-form-label" style="text-align:left;padding-left:0;">你的开发者令牌</label>
-        <div class="dev-token" id="tokenVal"></div>
-        <button class="layui-btn layui-btn-sm layui-btn-normal" id="copyBtn" style="margin-top:10px;">复制令牌</button>
-      </div>
-    </div>
-    <p class="dev-tip" style="margin-top:18px;"><a href="{:url('mine')}">已有账号？查询我的令牌</a></p>
-    {else/}
-    <div class="closed">当前未开放自助注册，请联系运营获取开发者令牌。</div>
-    {/if}
-  </div>
-
-  <script src="/assets/layui/layui.js"></script>
-  <script src="/assets/ywxapp/ywxapp.js" module="{$site.app}"></script>
-  <script>
-    layui.use(['form', 'jquery', 'layer', 'http'], function () {
-      var form = layui.form, $ = layui.jquery, layer = layui.layer, http = layui.http;
-      form.on('submit(reg)', function (data) {
-        http.post('{:url("/appmall/developer/save")}', data.field).then(function (r) {
-            $('#result').show();
-            $('#resultMsg').text(r.message || '提交完成');
-            if (r.code === 0 && r.data && r.data.token) {
-              $('#tokenWrap').show();
-              $('#tokenVal').text(r.data.token);
-            } else {
-              $('#tokenWrap').hide();
-            }
-            if (r.code !== 0) { layer.msg(r.message || '提交失败', { icon: 2 }); }
-          }).catch(function () { layer.msg('请求失败', { icon: 2 }); });
-        return false;
-      });
-
-      $('#copyBtn').on('click', function () {
-        var t = document.getElementById('tokenVal').innerText;
-        var dummy = $('<textarea>').val(t).appendTo('body').select();
-        document.execCommand('copy');
-        dummy.remove();
-        layer.msg('已复制', { icon: 1 });
-      });
-    });
-  </script>
-</body>
-</html>

addon/appmall/view/frontend/framework/index.html

@@ -1,137 +0,0 @@
-<!--
- * @Author: YwxApp <ywx@ywxapp.cn>
- * @Description: 主框架发布/下载展示页（公开，仅中心站）
--->
-<!DOCTYPE html>
-<html lang="zh-CN">
-<head>
-  <meta charset="utf-8">
-  <title>主框架下载 - {$market_name}</title>
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <link href="/assets/layui/css/layui.css" rel="stylesheet">
-  <style>
-    :root {
-      --brand: #4f46e5; --brand-2: #7c3aed; --ink: #1f2329;
-      --muted: #8a8f99; --line: #eceef2; --bg: #f5f6fa;
-    }
-    * { box-sizing: border-box; }
-    body {
-      margin: 0; background: var(--bg); color: var(--ink);
-      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "Microsoft YaHei", sans-serif;
-      -webkit-font-smoothing: antialiased;
-    }
-    .brandbar {
-      height: 56px; display: flex; align-items: center; gap: 10px;
-      padding: 0 24px; background: #fff; border-bottom: 1px solid var(--line);
-      position: sticky; top: 0; z-index: 20;
-    }
-    .brandbar .logo {
-      width: 30px; height: 30px; border-radius: 8px;
-      background: linear-gradient(135deg, var(--brand), var(--brand-2));
-      display: grid; place-items: center; color: #fff; font-weight: 700;
-    }
-    .brandbar .name { font-weight: 600; font-size: 16px; }
-    .brandbar .nav { margin-left: auto; display: flex; gap: 22px; font-size: 14px; }
-    .brandbar .nav a { color: var(--muted); text-decoration: none; transition: color .2s; }
-    .brandbar .nav a:hover, .brandbar .nav a.on { color: var(--brand); }
-
-    .hero {
-      padding: 54px 24px 46px; text-align: center; color: #fff;
-      background: linear-gradient(135deg, #4f46e5 0%, #7c3aed 55%, #9333ea 100%);
-      position: relative; overflow: hidden;
-    }
-    .hero::after {
-      content: ""; position: absolute; inset: 0;
-      background:
-        radial-gradient(420px 220px at 12% 0%, rgba(255,255,255,.18), transparent 60%),
-        radial-gradient(380px 200px at 88% 100%, rgba(255,255,255,.12), transparent 60%);
-    }
-    .hero h1 { margin: 0 0 10px; font-size: 32px; position: relative; }
-    .hero p { margin: 0; opacity: .92; font-size: 15px; position: relative; }
-
-    .wrap { max-width: 960px; margin: 36px auto 60px; padding: 0 24px; }
-    .ver-card {
-      background: #fff; border: 1px solid var(--line); border-radius: 16px;
-      padding: 22px 26px; margin-bottom: 18px;
-      transition: transform .22s, box-shadow .22s, border-color .22s;
-    }
-    .ver-card:hover { transform: translateY(-4px); box-shadow: 0 16px 36px rgba(79,70,229,.14); border-color: transparent; }
-    .ver-top { display: flex; align-items: center; justify-content: space-between; flex-wrap: wrap; gap: 8px; }
-    .ver-title { font-size: 20px; font-weight: 600; }
-    .ver-title .v { color: #16a34a; }
-    .ver-date { color: var(--muted); font-size: 13px; }
-    .ver-sub { color: #6b7280; font-size: 14px; margin: 10px 0 14px; }
-    .ver-sub b { color: var(--ink); }
-    .ver-log {
-      background: #f7f8fa; border: 1px solid var(--line); border-radius: 10px;
-      padding: 12px 14px; font-size: 13px; color: #555; white-space: pre-wrap;
-      margin-bottom: 16px; max-height: 160px; overflow: auto;
-    }
-    .dl-btns { display: flex; gap: 10px; flex-wrap: wrap; }
-    .dl-btns a {
-      text-decoration: none; font-size: 13px; color: #fff; padding: 9px 16px; border-radius: 9px;
-      background: linear-gradient(135deg, var(--brand), var(--brand-2)); transition: opacity .2s, transform .1s;
-    }
-    .dl-btns a:hover { opacity: .9; }
-    .dl-btns a:active { transform: scale(.97); }
-    .dl-btns a.install { background: linear-gradient(135deg, #722ed1, #9254de); }
-    .empty { text-align: center; color: var(--muted); padding: 60px 0; }
-    footer { text-align: center; color: var(--muted); font-size: 12px; padding: 26px; }
-  </style>
-</head>
-<body>
-  <div class="brandbar">
-    <div class="logo">Y</div>
-    <div class="name">{$market_name}</div>
-    <div class="nav">
-      <a href="/appmall/store">应用市场</a>
-      <a href="/appmall/framework" class="on">主框架</a>
-    </div>
-  </div>
-
-  <div class="hero">
-    <h1>YwxApp 主框架下载</h1>
-    <p>完整安装包用于全新部署，整包 / 补丁用于已安装站点的在线升级。</p>
-  </div>
-
-  <div class="wrap">
-    {if empty($list)}
-      <div class="empty">暂未发布任何框架版本。</div>
-    {else}
-      {foreach $list as $item}
-      <div class="ver-card">
-        <div class="ver-top">
-          <div class="ver-title">{$item.title|default='主框架'} <span class="v">v{$item.version}</span></div>
-          <div class="ver-date">发布于 {$item.create_at_fmt} · 下载 {$item.download_count} 次</div>
-        </div>
-        {if $item.patch_from}
-        <div class="ver-sub">增量补丁适用基础版本：<b>{$item.patch_from}</b></div>
-        {/if}
-        {if $item.changelog}
-        <div class="ver-log">{$item.changelog}</div>
-        {/if}
-        <div class="dl-btns">
-          {if $item.has_full}
-          <a href="/appmall/api/framework/download?version={$item.version}&type=full">
-            <i class="layui-icon layui-icon-download-circle"></i> 下载整包（升级）
-          </a>
-          {/if}
-          {if $item.has_patch}
-          <a href="/appmall/api/framework/download?version={$item.version}&type=patch">
-            <i class="layui-icon layui-icon-download-circle"></i> 下载补丁（升级）
-          </a>
-          {/if}
-          {if $item.has_install}
-          <a class="install" href="/appmall/api/framework/download?version={$item.version}&type=install">
-            <i class="layui-icon layui-icon-download-circle"></i> 下载完整安装包（全新部署）
-          </a>
-          {/if}
-        </div>
-      </div>
-      {/foreach}
-    {/if}
-  </div>
-
-  <footer>© {:date('Y')} {$market_name} · 由 YwxApp 框架强力驱动</footer>
-</body>
-</html>

addon/appmall/view/frontend/store/detail.html

@@ -1,257 +0,0 @@
-<!--
- * @Author: YwxApp <ywx@ywxapp.cn>
- * @Description: 插件详情页（公开，仅中心站）· 参考 FastAdmin 插件市场详情版式
- *   布局：Hero 标题区 → 左主内容(功能介绍/预览截图/更新日志) + 右 sticky 信息栏(价格/目录)
--->
-<!DOCTYPE html>
-<html lang="zh-CN">
-<head>
-  <meta charset="utf-8">
-  <title>{$addon.title} - 应用市场</title>
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <link href="/assets/layui/css/layui.css" rel="stylesheet">
-  <style>
-    :root {
-      --brand: #4f46e5; --brand-2: #7c3aed; --ink: #1f2329;
-      --muted: #8a8f99; --line: #eceef2; --bg: #f5f6fa;
-    }
-    * { box-sizing: border-box; }
-    body { margin: 0; background: var(--bg); color: var(--ink);
-      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "Microsoft YaHei", sans-serif;
-      -webkit-font-smoothing: antialiased; }
-    a { text-decoration: none; }
-    .brandbar { height: 56px; display: flex; align-items: center; gap: 10px;
-      padding: 0 24px; background: #fff; border-bottom: 1px solid var(--line); position: sticky; top: 0; z-index: 30; }
-    .brandbar .logo { width: 30px; height: 30px; border-radius: 8px;
-      background: linear-gradient(135deg, var(--brand), var(--brand-2)); display: grid; place-items: center; color: #fff; font-weight: 700; }
-    .brandbar .name { font-weight: 600; font-size: 16px; }
-    .brandbar .nav { margin-left: auto; display: flex; gap: 22px; font-size: 14px; }
-    .brandbar .nav a { color: var(--muted); transition: color .2s; }
-    .brandbar .nav a:hover, .brandbar .nav a.on { color: var(--brand); }
-
-    .crumb { max-width: 1120px; margin: 16px auto 0; padding: 0 24px; font-size: 13px; color: var(--muted); }
-    .crumb a { color: var(--muted); }
-    .crumb a:hover { color: var(--brand); }
-
-    /* Hero */
-    .hero { max-width: 1120px; margin: 14px auto 0; padding: 30px 36px; background: #fff; border: 1px solid var(--line); border-radius: 18px;
-      display: flex; gap: 24px; align-items: center; position: relative; overflow: hidden; }
-    .hero::before { content: ""; position: absolute; right: -60px; top: -60px; width: 240px; height: 240px; border-radius: 50%;
-      background: radial-gradient(circle, rgba(124,58,237,.10), transparent 70%); }
-    .hero .ava { width: 88px; height: 88px; border-radius: 20px; flex: none; overflow: hidden; background: #f0f1f5;
-      display: grid; place-items: center; color: var(--brand); font-size: 34px; font-weight: 700; box-shadow: 0 8px 22px rgba(79,70,229,.18); }
-    .hero .ava img { width: 100%; height: 100%; object-fit: cover; }
-    .hero .h-main { min-width: 0; flex: 1; }
-    .hero .h-title { font-size: 26px; font-weight: 700; display: flex; align-items: center; gap: 12px; }
-    .hero .h-title .ver { font-size: 13px; color: #16a34a; background: rgba(22,163,74,.1); border-radius: 6px; padding: 3px 9px; font-weight: 500; }
-    .hero .h-desc { color: #5b606b; font-size: 14px; margin-top: 8px; line-height: 1.7; }
-    .hero .h-actions { display: flex; gap: 12px; margin-top: 16px; flex-wrap: wrap; }
-    .btn-primary { display: inline-flex; align-items: center; gap: 6px; color: #fff; font-size: 14px; font-weight: 600;
-      padding: 11px 22px; border-radius: 11px; background: linear-gradient(135deg, var(--brand), var(--brand-2)); transition: .2s, transform .1s; }
-    .btn-primary:hover { opacity: .92; }
-    .btn-primary:active { transform: scale(.98); }
-    .btn-ghost { display: inline-flex; align-items: center; gap: 6px; color: var(--brand); font-size: 14px; font-weight: 600;
-      padding: 11px 22px; border-radius: 11px; background: #fff; border: 1px solid var(--brand); transition: .2s; }
-    .btn-ghost:hover { background: rgba(79,70,229,.06); }
-
-    /* 主体双栏 */
-    .main { max-width: 1120px; margin: 24px auto 60px; padding: 0 24px; display: grid; gap: 24px;
-      grid-template-columns: 1fr 320px; align-items: start; }
-    .col-right { position: sticky; top: 76px; display: flex; flex-direction: column; gap: 18px; }
-
-    .panel { background: #fff; border: 1px solid var(--line); border-radius: 16px; padding: 24px; }
-    .panel + .panel { margin-top: 24px; }
-    .panel h3 { margin: 0 0 16px; font-size: 17px; display: flex; align-items: center; gap: 9px; }
-    .panel h3::before { content: ""; width: 4px; height: 17px; border-radius: 2px; background: linear-gradient(var(--brand), var(--brand-2)); }
-    .prose { color: #4b515c; font-size: 14px; line-height: 1.9; white-space: pre-wrap; }
-
-    /* 截图 */
-    .cover { width: 100%; aspect-ratio: 16/9; border-radius: 14px; overflow: hidden; background: #f0f1f5;
-      display: grid; place-items: center; color: var(--brand); font-size: 36px; font-weight: 700; }
-    .cover img { width: 100%; height: 100%; object-fit: cover; }
-    .thumbs { display: flex; gap: 10px; margin-top: 12px; flex-wrap: wrap; }
-    .thumbs img { width: 104px; height: 64px; object-fit: cover; border-radius: 9px; border: 2px solid transparent; cursor: pointer; transition: .18s; }
-    .thumbs img:hover, .thumbs img.on { border-color: var(--brand); }
-
-    /* 更新日志时间线 */
-    .timeline { position: relative; padding-left: 22px; }
-    .timeline::before { content: ""; position: absolute; left: 5px; top: 6px; bottom: 6px; width: 2px; background: var(--line); }
-    .tl-item { position: relative; padding-bottom: 22px; }
-    .tl-item:last-child { padding-bottom: 0; }
-    .tl-item::before { content: ""; position: absolute; left: -21px; top: 5px; width: 12px; height: 12px; border-radius: 50%;
-      background: #fff; border: 3px solid var(--brand); }
-    .tl-item.first::before { background: var(--brand); box-shadow: 0 0 0 4px rgba(79,70,229,.18); }
-    .tl-head { display: flex; align-items: center; gap: 10px; }
-    .tl-ver { font-weight: 700; font-size: 14px; }
-    .tl-badge { font-size: 11px; color: #16a34a; background: rgba(22,163,74,.1); border-radius: 6px; padding: 2px 8px; }
-    .tl-date { color: var(--muted); font-size: 12px; margin-left: auto; }
-    .tl-note { color: #5b606b; font-size: 13px; line-height: 1.7; margin-top: 6px; white-space: pre-wrap; }
-
-    /* 右栏：价格卡 + 信息 + 目录 */
-    .price-card { background: linear-gradient(135deg, rgba(79,70,229,.07), rgba(124,58,237,.07));
-      border: 1px solid rgba(124,58,237,.18); border-radius: 14px; padding: 18px 20px; }
-    .price-card .price { font-size: 30px; font-weight: 800; color: var(--brand); }
-    .price-card .price.free { color: #16a34a; }
-    .price-card .sub { color: var(--muted); font-size: 12px; margin-top: 2px; }
-    .buy-btn { display: block; text-align: center; color: #fff; font-weight: 600; font-size: 15px; padding: 13px;
-      border-radius: 11px; background: linear-gradient(135deg, var(--brand), var(--brand-2)); margin-top: 14px; transition: .2s, transform .1s; }
-    .buy-btn:hover { opacity: .92; }
-    .buy-btn:active { transform: scale(.98); }
-    .buy-btn.ghost { background: #fff; color: var(--brand); border: 1px solid var(--brand); margin-top: 10px; }
-
-    .kv { font-size: 13px; }
-    .kv .row { display: flex; justify-content: space-between; padding: 10px 0; border-bottom: 1px dashed var(--line); }
-    .kv .row:last-child { border-bottom: 0; }
-    .kv .k { color: var(--muted); }
-    .kv .v { color: var(--ink); text-align: right; }
-    .stars { color: #f5a623; letter-spacing: 1px; }
-    .stars .off { color: #e2e4ea; }
-    .tags { display: flex; gap: 8px; flex-wrap: wrap; margin-top: 4px; }
-    .tags span { font-size: 12px; color: var(--brand); background: rgba(79,70,229,.1); border-radius: 6px; padding: 4px 10px; }
-
-    .toc { font-size: 13px; }
-    .toc .t { color: var(--muted); font-size: 12px; margin-bottom: 8px; }
-    .toc a { display: block; color: #5b606b; padding: 7px 0; border-left: 2px solid transparent; padding-left: 12px; transition: .18s; }
-    .toc a:hover { color: var(--brand); border-left-color: var(--brand); }
-
-    footer { text-align: center; color: var(--muted); font-size: 12px; padding: 26px; }
-
-    @media (max-width: 900px) {
-      .main { grid-template-columns: 1fr; }
-      .col-right { position: static; }
-    }
-  </style>
-</head>
-<body>
-  <div class="brandbar">
-    <div class="logo">Y</div>
-    <div class="name">{$market_name}</div>
-    <div class="nav">
-      <a href="/appmall/store" class="on">应用市场</a>
-      <a href="/appmall/framework">主框架</a>
-    </div>
-  </div>
-
-  <div class="crumb">
-    <a href="/appmall/store">应用市场</a> / <span>{$addon.title}</span>
-  </div>
-
-  <!-- Hero -->
-  <div class="hero">
-    <div class="ava">
-      {if $addon.logo}<img src="{$addon.logo}" alt="{$addon.title}">{else}{$addon.title|substr=0,1}{/if}
-    </div>
-    <div class="h-main">
-      <div class="h-title">{$addon.title}<span class="ver">v{$addon.version}</span></div>
-      <div class="h-desc">{if $addon.author}by {$addon.author} · {/if}{$addon.category|default='未分类'}</div>
-      <div class="h-actions">
-        <a class="btn-primary" href="#"><i class="layui-icon layui-icon-play"></i> 立即体验</a>
-        <a class="btn-ghost" href="#"><i class="layui-icon layui-icon-cart"></i> 立即购买</a>
-      </div>
-    </div>
-  </div>
-
-  <div class="main">
-    <!-- 左主内容 -->
-    <div class="col-left">
-      <div class="panel" id="intro">
-        <h3>功能介绍</h3>
-        <div class="prose">{$addon.intro|default='暂无介绍'}</div>
-      </div>
-
-      {if $addon.screenshots}
-      <div class="panel" id="shots">
-        <h3>预览截图</h3>
-        <div class="cover" id="cover">
-          <img src="{$addon.screenshots.0}" alt="{$addon.title}">
-        </div>
-        {if count($addon.screenshots) > 1}
-        <div class="thumbs" id="thumbs">
-          {foreach $addon.screenshots as $s}
-          <img src="{$s}" class="{if $s == $addon.screenshots.0}on{/if}" onclick="swap('{$s}', this)">
-          {/foreach}
-        </div>
-        {/if}
-      </div>
-      {/if}
-
-      <div class="panel" id="log">
-        <h3>更新日志</h3>
-        {if empty($addon.versions)}
-        <div class="prose" style="color:var(--muted)">暂无版本记录</div>
-        {else}
-        <div class="timeline">
-          {foreach $addon.versions as $k=>$v}
-          <div class="tl-item {if $k == 0}first{/if}">
-            <div class="tl-head">
-              <span class="tl-ver">v{$v.version}</span>
-              {if $k == 0}<span class="tl-badge">最新版本</span>{/if}
-              <span class="tl-date">{$v.update_fmt}</span>
-            </div>
-            <div class="tl-note">本版本定价：{$v.price_text}</div>
-          </div>
-          {/foreach}
-        </div>
-        {/if}
-      </div>
-    </div>
-
-    <!-- 右 sticky 信息栏 -->
-    <div class="col-right">
-      <div class="panel">
-        <div class="kv">
-          <div class="row"><span class="k">当前版本</span><span class="v">v{$addon.version}</span></div>
-          <div class="row"><span class="k">更新时间</span><span class="v">{$addon.update_fmt}</span></div>
-          <div class="row"><span class="k">下载量</span><span class="v">{$addon.downloads}</span></div>
-          <div class="row"><span class="k">评分</span>
-            <span class="v">
-              <span class="stars">
-                {for start="1" end="6" name="i"}
-                {if $addon.rating >= $i}<i class="layui-icon layui-icon-rate-solid"></i>{else/}<i class="layui-icon layui-icon-rate off"></i>{/if}
-                {/for}
-              </span>
-              {$addon.rating}
-            </span>
-          </div>
-          <div class="row"><span class="k">开发者</span><span class="v">{$addon.author|default='官方'}</span></div>
-          <div class="row"><span class="k">分类</span><span class="v">{$addon.category|default='未分类'}</span></div>
-        </div>
-        {if $addon.tags}
-        <div class="tags">
-          {foreach explode(',', $addon.tags) as $t}
-          <span>{$t}</span>
-          {/foreach}
-        </div>
-        {/if}
-      </div>
-
-      <div class="panel">
-        <div class="toc">
-          <div class="t">本页目录</div>
-          <a href="#intro">功能介绍</a>
-          {if $addon.screenshots}<a href="#shots">预览截图</a>{/if}
-          <a href="#log">更新日志</a>
-        </div>
-      </div>
-    </div>
-  </div>
-
-  <footer>© {:date('Y')} {$market_name} · 由 YwxApp 框架强力驱动</footer>
-
-  <script>
-    function swap(src, el) {
-      document.querySelector('#cover img').src = src;
-      document.querySelectorAll('#thumbs img').forEach(function (im) { im.classList.remove('on'); });
-      el.classList.add('on');
-    }
-    // 锚点平滑滚动 + 目录高亮
-    document.querySelectorAll('.toc a').forEach(function (a) {
-      a.addEventListener('click', function (e) {
-        var id = this.getAttribute('href');
-        var target = document.querySelector(id);
-        if (target) { e.preventDefault(); target.scrollIntoView({ behavior: 'smooth', block: 'start' }); }
-      });
-    });
-  </script>
-</body>
-</html>

addon/appmall/view/frontend/store/index.html

@@ -1,230 +0,0 @@
-<!--
- * @Author: YwxApp <ywx@ywxapp.cn>
- * @Description: 应用商店前台（公开，仅中心站）
--->
-<!DOCTYPE html>
-<html lang="zh-CN">
-<head>
-  <meta charset="utf-8">
-  <title>应用市场 - {$market_name}</title>
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <link href="/assets/layui/css/layui.css" rel="stylesheet">
-  <style>
-    :root {
-      --brand: #4f46e5;
-      --brand-2: #7c3aed;
-      --ink: #1f2329;
-      --muted: #8a8f99;
-      --line: #eceef2;
-      --bg: #f5f6fa;
-    }
-    * { box-sizing: border-box; }
-    body {
-      margin: 0; background: var(--bg); color: var(--ink);
-      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "Microsoft YaHei", sans-serif;
-      -webkit-font-smoothing: antialiased;
-    }
-    .brandbar {
-      height: 56px; display: flex; align-items: center; gap: 10px;
-      padding: 0 24px; background: #fff; border-bottom: 1px solid var(--line);
-      position: sticky; top: 0; z-index: 20;
-    }
-    .brandbar .logo {
-      width: 30px; height: 30px; border-radius: 8px;
-      background: linear-gradient(135deg, var(--brand), var(--brand-2));
-      display: grid; place-items: center; color: #fff; font-weight: 700;
-    }
-    .brandbar .name { font-weight: 600; font-size: 16px; }
-    .brandbar .nav { margin-left: auto; display: flex; gap: 22px; font-size: 14px; }
-    .brandbar .nav a { color: var(--muted); text-decoration: none; transition: color .2s; }
-    .brandbar .nav a:hover, .brandbar .nav a.on { color: var(--brand); }
-
-    .hero {
-      padding: 54px 24px 46px; text-align: center; color: #fff;
-      background: linear-gradient(135deg, #4f46e5 0%, #7c3aed 55%, #9333ea 100%);
-      position: relative; overflow: hidden;
-    }
-    .hero::after {
-      content: ""; position: absolute; inset: 0;
-      background:
-        radial-gradient(420px 220px at 12% 0%, rgba(255,255,255,.18), transparent 60%),
-        radial-gradient(380px 200px at 88% 100%, rgba(255,255,255,.12), transparent 60%);
-    }
-    .hero h1 { margin: 0 0 10px; font-size: 32px; letter-spacing: .5px; position: relative; }
-    .hero p { margin: 0; opacity: .92; font-size: 15px; position: relative; }
-
-    .toolbar {
-      max-width: 1180px; margin: -26px auto 0; padding: 0 24px; position: relative; z-index: 5;
-    }
-    .toolbar .inner {
-      background: #fff; border-radius: 14px; box-shadow: 0 8px 30px rgba(31,35,41,.08);
-      padding: 14px 18px; display: flex; align-items: center; gap: 14px; flex-wrap: wrap;
-    }
-    .search {
-      flex: 1; min-width: 220px; display: flex; align-items: center; gap: 8px;
-      background: #f5f6fa; border-radius: 10px; padding: 9px 14px; color: var(--muted);
-    }
-    .search input {
-      border: 0; background: transparent; outline: none; flex: 1; font-size: 14px; color: var(--ink);
-    }
-    .cats { display: flex; gap: 8px; flex-wrap: wrap; }
-    .cat {
-      border: 1px solid var(--line); background: #fff; color: var(--muted);
-      border-radius: 999px; padding: 6px 14px; font-size: 13px; cursor: pointer; transition: .18s;
-    }
-    .cat:hover { border-color: var(--brand); color: var(--brand); }
-    .cat.on { background: var(--brand); border-color: var(--brand); color: #fff; }
-
-    .grid {
-      max-width: 1180px; margin: 28px auto 60px; padding: 0 24px;
-      display: grid; gap: 20px;
-      grid-template-columns: repeat(auto-fill, minmax(260px, 1fr));
-    }
-    .card {
-      background: #fff; border-radius: 16px; border: 1px solid var(--line);
-      padding: 20px; display: flex; flex-direction: column; gap: 12px;
-      transition: transform .22s ease, box-shadow .22s ease, border-color .22s;
-    }
-    .card:hover {
-      transform: translateY(-6px);
-      box-shadow: 0 18px 40px rgba(79,70,229,.16);
-      border-color: transparent;
-    }
-    .card .head { display: flex; align-items: center; gap: 12px; }
-    .card .ava {
-      width: 52px; height: 52px; border-radius: 14px; flex: none;
-      background: #f0f1f5; object-fit: cover; display: grid; place-items: center;
-      font-weight: 700; color: var(--brand); font-size: 20px; overflow: hidden;
-    }
-    .card .ava img { width: 100%; height: 100%; object-fit: cover; }
-    .card .titles { min-width: 0; }
-    .card .titles .t { font-weight: 600; font-size: 16px; line-height: 1.3; }
-    .card .titles .a { color: var(--muted); font-size: 12px; margin-top: 2px; }
-    .card .desc {
-      color: #5b606b; font-size: 13px; line-height: 1.6; min-height: 42px;
-      display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical; overflow: hidden;
-    }
-    .card .meta { display: flex; align-items: center; gap: 14px; font-size: 12px; color: var(--muted); }
-    .stars { color: #f5a623; letter-spacing: 1px; }
-    .stars .off { color: #e2e4ea; }
-    .dl { display: flex; align-items: center; gap: 5px; }
-    .card .foot { display: flex; align-items: center; justify-content: space-between; margin-top: auto; }
-    .price {
-      font-weight: 700; font-size: 16px; color: var(--brand);
-    }
-    .price.free { color: #16a34a; }
-    .tag {
-      font-size: 11px; color: var(--brand); background: rgba(79,70,229,.1);
-      border-radius: 6px; padding: 3px 8px;
-    }
-    .card .btn {
-      text-decoration: none; font-size: 13px; color: #fff;
-      background: linear-gradient(135deg, var(--brand), var(--brand-2));
-      padding: 8px 16px; border-radius: 9px; transition: opacity .2s, transform .1s;
-    }
-    .card .btn:hover { opacity: .9; }
-    .card .btn:active { transform: scale(.97); }
-
-    .empty { grid-column: 1 / -1; text-align: center; padding: 70px 0; color: var(--muted); }
-    .empty .ic { font-size: 48px; opacity: .5; }
-    .empty p { margin-top: 12px; }
-
-    footer { text-align: center; color: var(--muted); font-size: 12px; padding: 26px; }
-  </style>
-</head>
-<body>
-  <div class="brandbar">
-    <div class="logo">Y</div>
-    <div class="name">{$market_name}</div>
-    <div class="nav">
-      <a href="/appmall/store" class="on">应用市场</a>
-      <a href="/appmall/framework">主框架</a>
-    </div>
-  </div>
-
-  <div class="hero">
-    <h1>发现优质扩展，一键点亮你的站点</h1>
-    <p>插件、模板、工具，覆盖建站全场景 · 由 {$market_name} 官方精选</p>
-  </div>
-
-  <div class="toolbar">
-    <div class="inner">
-      <div class="search">
-        <i class="layui-icon layui-icon-search"></i>
-        <input type="text" placeholder="搜索插件名称、作者或功能…" oninput="filterCards(this.value)">
-      </div>
-      <div class="cats" id="cats">
-        <span class="cat on" data-cat="">全部</span>
-        {foreach $categories as $c}
-        <span class="cat" data-cat="{$c}">{$c}</span>
-        {/foreach}
-      </div>
-    </div>
-  </div>
-
-  <div class="grid" id="grid">
-    {if empty($list)}
-      <div class="empty">
-        <div class="ic"><i class="layui-icon layui-icon-template-1"></i></div>
-        <p>市场暂无插件，敬请期待。</p>
-      </div>
-    {else}
-      {foreach $list as $p}
-      <div class="card" data-name="{$p.name|lower}" data-author="{$p.author|lower}" data-cat="{$p.category}">
-        <div class="head">
-          <div class="ava">
-            {if $p.logo}
-            <img src="{$p.logo}" alt="{$p.title}">
-            {else}
-            {$p.title|substr=0,1}
-            {/if}
-          </div>
-          <div class="titles">
-            <div class="t">{$p.title}{if $p.version} <span style="font-weight:400;color:#aab;font-size:12px;">v{$p.version}</span>{/if}</div>
-            <div class="a">by {$p.author|default='官方'}</div>
-          </div>
-        </div>
-        <div class="desc">{$p.desc|default='暂无描述'}</div>
-        <div class="meta">
-          <span class="stars" title="评分 {$p.rating}">
-            {for start="1" end="6" name="i"}
-            {if $p.rating >= $i}<i class="layui-icon layui-icon-rate-solid"></i>{else/}<i class="layui-icon layui-icon-rate off"></i>{/if}
-            {/for}
-          </span>
-          <span class="dl"><i class="layui-icon layui-icon-download-circle"></i>{$p.downloads} 下载</span>
-        </div>
-        <div class="foot">
-          <div>
-            <span class="price {if $p.price==0}free{/if}">{$p.price_text}</span>
-            {if $p.category}<span class="tag">{$p.category}</span>{/if}
-          </div>
-          <a class="btn" href="/appmall/store/detail/{$p.name}">查看详情</a>
-        </div>
-      </div>
-      {/foreach}
-    {/if}
-  </div>
-
-  <footer>© {:date('Y')} {$market_name} · 由 YwxApp 框架强力驱动</footer>
-
-  <script>
-    function filterCards(kw) {
-      kw = (kw || '').toLowerCase().trim();
-      document.querySelectorAll('#grid .card').forEach(function (el) {
-        var hit = !kw || el.dataset.name.indexOf(kw) > -1 || el.dataset.author.indexOf(kw) > -1;
-        el.style.display = hit ? '' : 'none';
-      });
-    }
-    document.getElementById('cats').addEventListener('click', function (e) {
-      var cat = e.target.closest('.cat');
-      if (!cat) return;
-      document.querySelectorAll('#cats .cat').forEach(function (c) { c.classList.remove('on'); });
-      cat.classList.add('on');
-      var v = cat.dataset.cat;
-      document.querySelectorAll('#grid .card').forEach(function (el) {
-        el.style.display = (!v || el.dataset.cat === v) ? '' : 'none';
-      });
-    });
-  </script>
-</body>
-</html>

addon/articles/Addon.php

@@ -10,39 +10,79 @@ declare (strict_types = 1);
 
 namespace addon\articles;
 
+use addon\articles\library\ArticleSchema;
+use think\facade\Db;
 use ywxapp\AddonBase;
+use ywxapp\service\AddonService;
 
 /**
  * 文章CMS插件启动类
  */
 class Addon extends AddonBase
 {
-    // 插件基本信息
+    /** 插件私有表（不含表前缀） */
+    private const TABLES = [
+        'articles_article',
+        'articles_article_tag',
+        'articles_category',
+        'articles_tag',
+        'articles_comment',
+    ];
+
+    // 插件基本信息（版本号须与 info.php 保持一致）
     public $info = [
         'name'        => 'articles',
         'title'       => '文章CMS',
         'description' => '完整文章类 CMS 插件：文章、分类、标签、评论',
         'status'      => 1,
         'author'      => 'ywxapp',
-        'version'     => '1.0.0',
+        'version'     => '1.0.1',
         'type'        => 1,
     ];
 
     // 插件安装
     public function install()
     {
+        // install.sql 由框架导入（白名单仅 CREATE TABLE / INSERT）；
+        // 这里再兜底一次，确保表齐备且不缺列。
+        ArticleSchema::repair();
         return true;
     }
 
     // 插件卸载
     public function uninstall()
     {
+        $prefix = $this->prefix();
+        foreach (self::TABLES as $table) {
+            try {
+                // 用配置前缀拼接，勿硬编码 wxapp_
+                Db::execute("DROP TABLE IF EXISTS `{$prefix}{$table}`");
+            } catch (\Throwable $e) {
+                // 单表删除失败不阻断整体卸载
+            }
+        }
+
+        // 菜单由框架 deleteMenu() 清理；这里补清「配置残留」
+        // （框架卸载默认不清配置，重装会继承旧值）
+        try {
+            Db::name('common_addonconf')->where('addon', 'articles')->delete();
+        } catch (\Throwable $e) {
+            // 表不存在时忽略
+        }
+        AddonService::clearConfigCache('articles');
+
+        // 清理静态资源：框架卸载只删 public/static/addon/<name>/，
+        // 而本插件资源实际在 public/static/articles/，需自行清理。
+        $this->deleteDirectory(public_path() . 'static' . DIRECTORY_SEPARATOR . 'articles');
+
         return true;
     }
 
     // 插件启用
     public function enable()
     {
+        // 启用时做一次轻量建表兜底（不补列，避免线上长耗时）
+        ArticleSchema::repair(false);
         return true;
     }
 
@@ -51,4 +91,56 @@ class Addon extends AddonBase
     {
         return true;
     }
+
+    /**
+     * 插件升级（覆盖升级 / addon:manage 时由框架回调）
+     *
+     * 注意：install.sql 的 ALTER 会被 importsql 白名单跳过，
+     * 因此「老库补列 + 补索引」必须放在这里（ArticleSchema::repair）。
+     *
+     * @param string $currentVersion 已安装版本号
+     */
+    public function upgrade($currentVersion = '')
+    {
+        ArticleSchema::repair();
+        return true;
+    }
+
+    /**
+     * 递归删除目录（卸载时清理静态资源）
+     */
+    private function deleteDirectory(string $dir): void
+    {
+        if (!is_dir($dir)) {
+            return;
+        }
+
+        $items = scandir($dir);
+        if (!is_array($items)) {
+            return;
+        }
+
+        foreach ($items as $item) {
+            if ($item === '.' || $item === '..') {
+                continue;
+            }
+            $path = $dir . DIRECTORY_SEPARATOR . $item;
+            if (is_dir($path)) {
+                $this->deleteDirectory($path);
+            } else {
+                @unlink($path);
+            }
+        }
+
+        @rmdir($dir);
+    }
+
+    /**
+     * 当前数据库表前缀
+     */
+    private function prefix(): string
+    {
+        $default = (string) config('database.default', 'mysql');
+        return (string) config("database.connections.{$default}.prefix", '');
+    }
 }

addon/articles/common.php

@@ -0,0 +1,18 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+// | 文章CMS插件公共文件
+// |
+// | 由 MultiApp::loadApp() 在请求命中 articles 应用时自动 include_once，
+// | 这里负责加载插件语言包（模板中可用 {:L('Articles')} / L('Articles') 取值）。
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+\think\facade\Lang::load(
+    dirname(__FILE__) . DIRECTORY_SEPARATOR . 'lang' . DIRECTORY_SEPARATOR . 'zh-cn.php'
+);

addon/articles/config.php

@@ -0,0 +1,46 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+// | 文章CMS插件「后台配置表单」字段定义
+// |
+// | 框架自带通用配置页会自动按本文件渲染表单并保存：
+// |   /backend/addon/setting?addon=articles
+// | 读取：AddonService::config('articles') 或 get_addon_config('articles')
+// +----------------------------------------------------------------------
+return [
+    [
+        'name'    => 'comment_audit',
+        'title'   => '评论审核',
+        'type'    => 'select',
+        'value'   => '0',
+        'options' => ['0' => '直接显示', '1' => '先审后发'],
+        'tip'     => '开启「先审后发」后，新评论默认待审核，需在后台评论管理中审核后才公开显示',
+    ],
+    [
+        'name'  => 'comment_interval',
+        'title' => '评论间隔(秒)',
+        'type'  => 'number',
+        'value' => '10',
+        'tip'   => '同一用户两次评论的最小间隔，用于防灌水/刷屏，0 表示不限',
+    ],
+    [
+        'name'  => 'page_size',
+        'title' => '前台每页条数',
+        'type'  => 'number',
+        'value' => '10',
+        'tip'   => '前台列表每页显示的文章数量',
+    ],
+    [
+        'name'    => 'search_fulltext',
+        'title'   => '全文搜索',
+        'type'    => 'select',
+        'value'   => '0',
+        'options' => ['0' => '关闭（LIKE 模糊匹配）', '1' => '开启（FULLTEXT 索引）'],
+        'tip'     => '文章量大时开启可显著提速；需 MySQL 支持全文索引，索引不存在时会自动降级为 LIKE',
+    ],
+];

addon/articles/controller/Article.php

@@ -17,9 +17,14 @@ declare (strict_types = 1);
 
 namespace addon\articles\controller;
 
-use think\facade\Db;
+use think\facade\Cache;
 use addon\articles\model\Article as ArticleModel;
 use addon\articles\model\ArticleComment;
+use addon\articles\model\ArticleLike;
+use addon\articles\service\ContentRenderService;
+use addon\articles\service\FavoriteService;
+use addon\articles\service\LikeService;
+use ywxapp\service\AddonService;
 
 class Article extends ArticlesFrontend
 {
@@ -27,24 +32,77 @@ class Article extends ArticlesFrontend
     {
         $article = ArticleModel::getDetail((int) $id);
         if (!$article) {
-            $this->result->error('文章不存在或已删除');
+            // 软 404 会被搜索引擎收录：显式返回 HTTP 404
+            return $this->result->setStatusCode(404)->error('文章不存在或已删除', 404);
         }
-        // 浏览量 +1
-        ArticleModel::where('id', $id)->inc('view_count')->update();
+        // 浏览量 +1（同访客 5 分钟内去重）
+        $this->bumpViews((int) $article->id);
 
+        // 评论：分页只取顶层评论，回复整体带出（避免分页把父子评论切断）
         $commentsPage = ArticleComment::getByArticle((int) $id, (int) input('page', 1), 10);
+        $topComments  = $commentsPage->items();
+        $replyMap     = ArticleComment::repliesOf(array_column($topComments, 'id'));
+
+        $tree = [];
+        foreach ($topComments as $c) {
+            $c->replies = $replyMap[$c->id] ?? [];
+            $tree[]     = $c;
+        }
+
         $comments = [
-            'data'  => $commentsPage->items(),
+            'data'   => $tree,
             'render' => $commentsPage->render(),
         ];
 
+        // 当前用户对本文的点赞状态
+        $uid = (int) ($this->auth && $this->auth->isLogin ? ($this->auth->info['uid'] ?? 0) : 0);
+
+        // 输出期增强（不改动入库内容）：图片懒加载 + WebP（浏览器支持时）+ 内链（本文标签）
+        $useWebp  = strpos((string) $this->request->header('Accept', ''), 'image/webp') !== false;
+        $keywords = [];
+        foreach ($article->tags as $t) {
+            $keywords[$t->name] = (string) url('articles/search/index', ['keyword' => $t->name]);
+        }
+        $contentHtml = ContentRenderService::render((string) $article->content, $keywords, $useWebp);
+
+        // SEO 结构化数据（JSON-LD）：Article + BreadcrumbList，供搜索引擎/富摘要识别
+        $canonical = request()->domain() . (string) url('articles/read/' . $article->id);
+        $jsonLd    = json_encode([
+            '@context'         => 'https://schema.org',
+            '@type'            => 'Article',
+            'headline'         => (string) $article->title,
+            'description'      => mb_substr((string) (strip_tags((string) ($article->summary ?: $article->content))), 0, 150),
+            'author'           => ['@type' => 'Person', 'name' => (string) ($article->author ?: 'admin')],
+            'datePublished'    => date('c', self::toTs($article->create_at)),
+            'dateModified'     => date('c', self::toTs($article->update_at) ?: self::toTs($article->create_at)),
+            'mainEntityOfPage' => ['@type' => 'WebPage', '@id' => $canonical],
+            'articleSection'   => (string) ($article->category_name ?? ''),
+            'image'            => (string) ($article->cover_image ?: ''),
+        ], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+
+        $breadcrumb = json_encode([
+            '@context' => 'https://schema.org',
+            '@type'    => 'BreadcrumbList',
+            'itemListElement' => [
+                ['@type' => 'ListItem', 'position' => 1, 'name' => '首页', 'item' => request()->domain() . (string) url('articles/index/index')],
+                ['@type' => 'ListItem', 'position' => 2, 'name' => (string) ($article->category_name ?: '未分类'),
+                 'item' => request()->domain() . (string) url('articles/category/index', ['id' => $article->cid])],
+                ['@type' => 'ListItem', 'position' => 3, 'name' => (string) $article->title, 'item' => $canonical],
+            ],
+        ], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+
         $this->view->assign([
             'article' => $article,
             'prev'    => ArticleModel::prev($article->id, $article->cid),
             'next'    => ArticleModel::next($article->id, $article->cid),
+            'contentHtml' => $contentHtml,
+            'favorited'   => FavoriteService::isFavorited($uid, (int) $article->id),
             'related' => ArticleModel::related($article->id, $article->cid, 5),
             'hot'     => ArticleModel::hot(10),
             'comments'=> $comments,
+            'liked'   => LikeService::isLiked($uid, (int) $article->id, ArticleLike::TYPE_ARTICLE),
+            'jsonLd'  => $jsonLd,
+            'breadcrumbLd' => $breadcrumb,
             'nav_active' => $article->cid,
         ]);
         return $this->fetch('article/detail');
@@ -77,22 +135,150 @@ class Article extends ArticlesFrontend
         if (!$this->auth || !$this->auth->isLogin) {
             $this->result->error('请先登录后再评论');
         }
-        $aid = (int) input('aid', 0);
-        $content = trim(input('content', ''));
-        if (!$aid || !$content) {
+        $aid     = (int) input('aid', 0);
+        $pid     = (int) input('pid', 0);
+        $content = trim((string) input('content', ''));
+        if (!$aid || $content === '') {
             $this->result->error('参数错误');
         }
-        $uid = $this->auth->info['uid'] ?? 0;
+
+        // 长度校验：过短视为灌水，过长直接拒绝
+        $len = mb_strlen($content, 'UTF-8');
+        if ($len < 2) {
+            $this->result->error('评论内容太短');
+        }
+        if ($len > 500) {
+            $this->result->error('评论内容不能超过 500 字');
+        }
+
+        // 目标文章必须存在且已发布，否则可给任意 aid 灌评论
+        $article = ArticleModel::where('id', $aid)
+            ->where('status', 1)
+            ->where('delete_at', 0)
+            ->find();
+        if (!$article) {
+            $this->result->error('文章不存在或未发布');
+        }
+
+        // 楼层回复：父评论必须存在且属于同一篇文章
+        if ($pid > 0) {
+            $parent = ArticleComment::where('id', $pid)
+                ->where('aid', $aid)
+                ->where('delete_at', 0)
+                ->find();
+            if (!$parent) {
+                $this->result->error('父评论不存在');
+            }
+        }
+
+        $uid = (int) ($this->auth->info['uid'] ?? 0);
+
+        // 评论策略取自插件配置（后台「插件管理 → 配置」可改）
+        $cfg       = AddonService::config('articles');
+        $needAudit = !empty($cfg['comment_audit']);
+        $interval  = max(0, (int) ($cfg['comment_interval'] ?? 10));
+
+        // 限流：同一用户 N 秒内只发 1 条，防灌水/刷屏（N=0 表示不限）
+        $lockKey = 'articles_comment_lock:' . $uid;
+        if ($interval > 0 && Cache::get($lockKey, 0)) {
+            $this->result->error('评论太频繁，请稍后再试');
+        }
+
         ArticleComment::create([
-            'uid'       => $uid,
-            'aid'       => $aid,
-            'pid'       => 0,
-            'content'   => $content,
-            'status'    => 1,
-            'create_at' => time(),
-            'update_at' => time(),
+            'uid'        => $uid,
+            'aid'        => $aid,
+            'pid'        => $pid,
+            'content'    => $content,
+            // 「先审后发」时为 0（待审核），由后台评论管理审核通过后再公开
+            'status'     => $needAudit ? 0 : 1,
+            'ip'         => (string) $this->request->ip(),
+            'user_agent' => mb_substr((string) $this->request->header('user-agent', ''), 0, 255),
+            'create_at'  => time(),
+            'update_at'  => time(),
         ]);
-        ArticleModel::where('id', $aid)->inc('comment_count')->update();
-        $this->result->success('评论成功');
+
+        // 只有直接显示的评论才累加计数（待审核的等审核通过时再加）
+        if (!$needAudit) {
+            ArticleModel::where('id', $aid)->inc('comment_count')->update();
+        }
+
+        if ($interval > 0) {
+            Cache::set($lockKey, 1, $interval);
+        }
+        $this->result->success($needAudit ? '评论已提交，等待审核' : '评论成功');
+    }
+
+    /**
+     * 点赞 / 取消点赞（文章或评论）
+     *
+     * POST: id=目标ID  target=1(文章)|2(评论)
+     * 返回：{liked: bool, count: int}
+     */
+    public function like()
+    {
+        if (!$this->auth || !$this->auth->isLogin) {
+            $this->result->error('请先登录后再点赞');
+        }
+
+        $uid      = (int) ($this->auth->info['uid'] ?? 0);
+        $targetId = (int) input('id', 0);
+        $type     = (int) input('target', 1);
+
+        if ($targetId <= 0) {
+            $this->result->error('参数错误');
+        }
+
+        $res = $type === ArticleLike::TYPE_COMMENT
+            ? LikeService::toggleComment($uid, $targetId)
+            : LikeService::toggleArticle($uid, $targetId);
+
+        // 计数为 0 且未点赞，说明目标不存在或不可见
+        if (!$res['liked'] && $res['count'] === 0) {
+            $this->result->error('点赞失败：内容不存在或不可见');
+        }
+
+        $this->result->success($res, $res['liked'] ? '已点赞' : '已取消点赞');
+    }
+
+    /**
+     * 收藏 / 取消收藏
+     *
+     * POST: id=文章ID
+     * 返回：{favorited: bool}
+     */
+    public function favorite()
+    {
+        if (!$this->auth || !$this->auth->isLogin) {
+            $this->result->error('请先登录后再收藏');
+        }
+
+        $uid      = (int) ($this->auth->info['uid'] ?? 0);
+        $targetId = (int) input('id', 0);
+
+        if ($targetId <= 0) {
+            $this->result->error('参数错误');
+        }
+
+        $res = FavoriteService::toggle($uid, $targetId);
+        if (!$res['favorited'] && !FavoriteService::isFavorited($uid, $targetId)) {
+            // 目标文章不存在/不可收藏时，toggle 会返回未收藏
+            if (!\addon\articles\model\Article::where('id', $targetId)->where('status', 1)->count()) {
+                $this->result->error('收藏失败：文章不存在或未发布');
+            }
+        }
+
+        $this->result->success($res, $res['favorited'] ? '已收藏' : '已取消收藏');
+    }
+
+    /**
+     * 时间字段转时间戳（模型可能返回日期字符串，取决于类型配置）
+     */
+    private static function toTs($value): int
+    {
+        if (is_numeric($value)) {
+            return (int) $value;
+        }
+        $ts = strtotime((string) $value);
+        return $ts ?: 0;
     }
 }

addon/articles/controller/ArticlesFrontend.php

@@ -18,6 +18,7 @@ declare (strict_types = 1);
 namespace addon\articles\controller;
 
 use ywxapp\controller\FrontendBase;
+use think\facade\Cache;
 use addon\articles\model\Article;
 use addon\articles\model\ArticleCategory;
 use addon\articles\model\ArticleTag;
@@ -38,13 +39,46 @@ class ArticlesFrontend extends FrontendBase
         $isLogin = $this->auth && $this->auth->isLogin;
         $loginUser = $isLogin ? $this->auth->info : null;
 
+        // 分类/标签变动频率低，缓存 5 分钟（缓存数组，避免序列化模型集合）
+        $categories = Cache::remember('articles:categories', function () {
+            return ArticleCategory::allEnable()->toArray();
+        }, 300);
+        $tags = Cache::remember('articles:tags', function () {
+            return ArticleTag::where('delete_at', 0)->order('id', 'desc')->limit(20)->select()->toArray();
+        }, 300);
+
         $this->view->assign([
-            'categories' => ArticleCategory::allEnable(),
-            'tags'       => ArticleTag::where('delete_at', 0)->order('id', 'desc')->limit(20)->select(),
+            'categories' => $categories,
+            'tags'       => $tags,
             'hot'        => Article::hot(10),
             'is_login'   => $isLogin,
             'member'     => $loginUser,
             'nav_active' => '',
         ]);
     }
+
+    /**
+     * 浏览量计数（同一访客同一文章 5 分钟内只算 1 次）
+     *
+     * 用缓存节流而非 Session：前台对游客开放，游客请求未必启动 Session，
+     * 且浏览量属统计类数据，不应强依赖会话。
+     *
+     * @param int $id 文章ID
+     */
+    protected function bumpViews(int $id): void
+    {
+        if ($id <= 0) {
+            return;
+        }
+
+        $fingerprint = md5($this->request->ip() . '|' . (string) $this->request->header('user-agent', ''));
+        $key         = 'articles_view:' . $id . ':' . $fingerprint;
+
+        if (Cache::get($key, 0)) {
+            return; // 5 分钟内已计过
+        }
+
+        Article::where('id', $id)->inc('view_count')->update();
+        Cache::set($key, 1, 300);
+    }
 }

addon/articles/controller/Category.php

@@ -17,7 +17,8 @@ class Category extends ArticlesFrontend
     {
         $category = ArticleCategory::getById((int) $id);
         if (!$category) {
-            $this->result->error('分类不存在');
+            // 软 404 会被搜索引擎收录：显式返回 HTTP 404
+            return $this->result->setStatusCode(404)->error('分类不存在', 404);
         }
         $page = (int) input('page', 1);
         $list = Article::listArticles(['cid' => $id], $page, 10);

addon/articles/controller/Index.php

@@ -24,8 +24,6 @@ class Index extends ArticlesFrontend
 {
     public function index()
     {
-
-       //  dump($this->app->route);die;
         $page = (int) input('page', 1);
         $list = Article::listArticles([], $page, 10);
 

addon/articles/controller/Sitemap.php

@@ -0,0 +1,166 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\controller;
+
+use addon\articles\model\Article;
+use addon\articles\model\ArticleCategory;
+use addon\articles\model\ArticleTopic;
+use think\facade\Request;
+
+/**
+ * 站点地图（前台 SEO 用）
+ *
+ * 文章数 ≤ 5000：sitemap.xml 直接输出全部 URL（urlset）
+ * 文章数 > 5000：sitemap.xml 输出 sitemap index，文章拆到 sitemap-<n>.xml 分片
+ *                （单文件 URL 上限 5 万条、体积 50MB，这里按 5000 条分片留足余量）
+ *
+ * 收录范围：插件首页 / 分类 / 专题 / 已发布且未删除的文章（草稿与待审不收录）
+ *
+ * @author ywxapp <admin@ywxapp.cn>
+ */
+class Sitemap extends ArticlesFrontend
+{
+    /** 单个 sitemap 文件最多包含的 URL 数 */
+    const MAX_PER_FILE = 5000;
+
+    /**
+     * /articles/sitemap.xml
+     */
+    public function index()
+    {
+        $base  = Request::domain();
+        $total = Article::scope('normal')->count();
+
+        // 首页 / 分类 / 专题（条目少，始终放在索引或主文件中）
+        $static = [
+            ['loc' => $base . (string) url('articles/index/index'), 'priority' => '1.0', 'lastmod' => date('Y-m-d')],
+            ['loc' => $base . (string) url('articles/topic/index'),  'priority' => '0.7'],
+        ];
+        foreach (ArticleCategory::allEnable() as $c) {
+            $static[] = [
+                'loc'      => $base . (string) url('articles/category/index', ['id' => $c->id]),
+                'priority' => '0.6',
+            ];
+        }
+        foreach (ArticleTopic::scope('enable')->select() as $t) {
+            $static[] = [
+                'loc'      => $base . (string) url('articles/topic/' . $t->id),
+                'priority' => '0.7',
+            ];
+        }
+
+        // 文章过多 → 输出 sitemap index（静态条目放主文件，文章分片）
+        if ($total > self::MAX_PER_FILE) {
+            $pages = (int) ceil($total / self::MAX_PER_FILE);
+            $maps  = $static;
+            for ($i = 1; $i <= $pages; $i++) {
+                // 分片文件 URL 手工拼接：url() 会追加 .html 后缀，不能用于 .xml
+                $maps[] = [
+                    'loc'      => $base . '/articles/sitemap-' . $i . '.xml',
+                    'lastmod'  => date('Y-m-d'),
+                    'priority' => '0.8',
+                ];
+            }
+            return response(self::renderIndex($maps), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
+        }
+
+        // 常规：单文件输出（静态 + 全部文章）
+        $items = $static;
+        foreach (Article::scope('normal')->field('id,update_at')->order('id', 'desc')->select() as $a) {
+            $items[] = [
+                'loc'      => $base . (string) url('articles/read/' . $a->id),
+                'lastmod'  => date('Y-m-d', (int) $a->update_at ?: time()),
+                'priority' => '0.8',
+            ];
+        }
+
+        return response(self::renderUrlset($items), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
+    }
+
+    /**
+     * 文章分片：/articles/sitemap-<page>.xml
+     */
+    public function chunk($page = 1)
+    {
+        $page  = max(1, (int) $page);
+        $base  = Request::domain();
+        $total = Article::scope('normal')->count();
+
+        $pages = max(1, (int) ceil($total / self::MAX_PER_FILE));
+        if ($page > $pages) {
+            // 越界分片返回空 urlset，避免搜索引擎误判为错误
+            return response(self::renderUrlset([]), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
+        }
+
+        $articles = Article::scope('normal')
+            ->field('id,update_at')
+            ->order('id', 'desc')
+            ->page($page, self::MAX_PER_FILE)
+            ->select();
+
+        $items = [];
+        foreach ($articles as $a) {
+            $items[] = [
+                'loc'      => $base . (string) url('articles/read/' . $a->id),
+                'lastmod'  => date('Y-m-d', (int) $a->update_at ?: time()),
+                'priority' => '0.8',
+            ];
+        }
+
+        return response(self::renderUrlset($items), 200, ['Content-Type' => 'application/xml; charset=utf-8']);
+    }
+
+    /**
+     * 渲染 urlset
+     */
+    private static function renderUrlset(array $items): string
+    {
+        $xml = '<?xml version="1.0" encoding="UTF-8"?>' . "\n"
+            . '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">' . "\n";
+
+        foreach ($items as $item) {
+            $xml .= "  <url>\n";
+            $xml .= '    <loc>' . self::esc($item['loc'] ?? '') . "</loc>\n";
+            if (!empty($item['lastmod'])) {
+                $xml .= '    <lastmod>' . $item['lastmod'] . "</lastmod>\n";
+            }
+            $xml .= '    <priority>' . ($item['priority'] ?? '0.5') . "</priority>\n";
+            $xml .= "  </url>\n";
+        }
+
+        return $xml . '</urlset>';
+    }
+
+    /**
+     * 渲染 sitemap index
+     */
+    private static function renderIndex(array $items): string
+    {
+        $xml = '<?xml version="1.0" encoding="UTF-8"?>' . "\n"
+            . '<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">' . "\n";
+
+        foreach ($items as $item) {
+            $xml .= "  <sitemap>\n";
+            $xml .= '    <loc>' . self::esc($item['loc'] ?? '') . "</loc>\n";
+            if (!empty($item['lastmod'])) {
+                $xml .= '    <lastmod>' . $item['lastmod'] . "</lastmod>\n";
+            }
+            $xml .= "  </sitemap>\n";
+        }
+
+        return $xml . '</sitemapindex>';
+    }
+
+    private static function esc(string $value): string
+    {
+        return htmlspecialchars($value, ENT_XML1 | ENT_QUOTES, 'UTF-8');
+    }
+}

addon/articles/controller/Tag.php

@@ -17,7 +17,8 @@ class Tag extends ArticlesFrontend
     {
         $tag = ArticleTag::where('delete_at', 0)->find($id);
         if (!$tag) {
-            $this->result->error('标签不存在');
+            // 软 404 会被搜索引擎收录：显式返回 HTTP 404
+            return $this->result->setStatusCode(404)->error('标签不存在', 404);
         }
         $page = (int) input('page', 1);
         $list = Article::listArticles(['tid' => $id], $page, 10);

addon/articles/controller/Topic.php

@@ -0,0 +1,92 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\controller;
+
+use addon\articles\model\Article;
+use addon\articles\model\ArticleTopic;
+use addon\articles\model\ArticleTopicArticle;
+use think\facade\Cache;
+
+/**
+ * 前台专题聚合页
+ *
+ * /articles/topic        专题列表
+ * /articles/topic/<id>   专题详情（专题内文章列表）
+ */
+class Topic extends ArticlesFrontend
+{
+    /**
+     * 专题列表
+     */
+    public function index()
+    {
+        $topics = Cache::remember('articles:topics', function () {
+            $list = ArticleTopic::scope('enable')
+                ->order('sort', 'desc')
+                ->order('id', 'desc')
+                ->select();
+
+            $rows = [];
+            foreach ($list as $t) {
+                $rows[] = [
+                    'id'          => $t->id,
+                    'title'       => $t->title,
+                    'alias'       => $t->alias,
+                    'description' => $t->description,
+                    'cover'       => $t->cover,
+                    'count'       => ArticleTopicArticle::where('tid', $t->id)->count(),
+                ];
+            }
+            return $rows;
+        }, 300);
+
+        $this->view->assign([
+            'topics'     => $topics,
+            'nav_active' => '',
+        ]);
+
+        return $this->fetch('topic/index');
+    }
+
+    /**
+     * 专题详情（文章聚合）
+     */
+    public function detail($id = 0)
+    {
+        $topic = ArticleTopic::scope('enable')->find((int) $id);
+        if (!$topic) {
+            return $this->result->setStatusCode(404)->error('专题不存在或已下线', 404);
+        }
+
+        $page = (int) input('page', 1);
+        $ids  = ArticleTopicArticle::articleIdsOf((int) $topic->id);
+
+        $list = [];
+        if ($ids) {
+            // 只取已发布且到点的文章，并保持专题内排序
+            $list = Article::with(['category'])
+                ->field(Article::listFields())
+                ->whereIn('id', $ids)
+                ->scope('normal')
+                ->orderRaw('FIELD(id,' . implode(',', $ids) . ')')
+                ->paginate(['list_rows' => 10, 'page' => $page]);
+        }
+
+        $this->view->assign([
+            'topic'      => $topic,
+            'list'       => $list ? $list->items() : [],
+            'page'       => $list ? $list->render() : '',
+            'nav_active' => '',
+        ]);
+
+        return $this->fetch('topic/detail');
+    }
+}

addon/articles/controller/api/Article.php

@@ -0,0 +1,229 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\controller\api;
+
+// 注意：本类就叫 Article，模型必须起别名，否则「类名已被占用」致命错误
+use addon\articles\model\Article as ArticleModel;
+use addon\articles\model\ArticleCategory;
+use addon\articles\model\ArticleComment;
+use addon\articles\model\ArticleTag;
+use think\facade\Cache;
+use ywxapp\controller\ApiBase;
+use ywxapp\service\AddonService;
+
+/**
+ * 文章CMS 对外 API
+ *
+ * 鉴权：继承 ApiBase（默认需登录）；列表/详情/分类/标签/搜索放行游客，
+ * 评论必须登录（$noNeedLogin 未包含 comment）。
+ *
+ * URL：/articles/api/articles 等（见 route/app.php）
+ */
+class Article extends ApiBase
+{
+    /** 免登录方法（评论不在其中，必须登录） */
+    protected $noNeedLogin = ['index', 'read', 'categories', 'tags', 'search'];
+
+    /**
+     * 文章列表
+     * 参数：page / cid / tid
+     */
+    public function index()
+    {
+        $page = (int) input('page/d', 1);
+        $cid  = (int) input('cid/d', 0);
+        $tid  = (int) input('tid/d', 0);
+
+        $where = [];
+        if ($cid > 0) {
+            $where['cid'] = $cid;
+        }
+        if ($tid > 0) {
+            $where['tid'] = $tid;
+        }
+
+        $list = ArticleModel::listArticles($where, $page, $this->pageSize());
+
+        $rows = [];
+        foreach ($list->items() as $a) {
+            $rows[] = [
+                'id'            => $a->id,
+                'title'         => $a->title,
+                'summary'       => $a->summary,
+                'cover_image'   => $a->cover_image,
+                'cid'           => $a->cid,
+                'category'      => $a->category_name ?? '',
+                'view_count'    => (int) $a->view_count,
+                'comment_count' => (int) $a->comment_count,
+                'create_at'     => $a->create_at,
+            ];
+        }
+
+        $this->apiSuccess($rows, 'success', $list->total());
+    }
+
+    /**
+     * 文章详情（正文已在入库时做过白名单净化，可安全下发）
+     */
+    public function read($id = 0)
+    {
+        $id      = (int) ($id ?: input('id/d', 0));
+        $article = ArticleModel::getDetail($id);
+
+        if (!$article) {
+            $this->apiError('文章不存在或已下线', 404, null, 404);
+        }
+
+        ArticleModel::where('id', $id)->inc('view_count')->update();
+
+        $tags = [];
+        foreach ($article->tags as $t) {
+            $tags[] = ['id' => $t->id, 'name' => $t->name];
+        }
+
+        $this->apiSuccess([
+            'id'            => $article->id,
+            'title'         => $article->title,
+            'content'       => $article->content,
+            'summary'       => $article->summary,
+            'cover_image'   => $article->cover_image,
+            'author'        => $article->author,
+            'cid'           => $article->cid,
+            'category'      => $article->category_name ?? '',
+            'view_count'    => (int) $article->view_count,
+            'comment_count' => (int) $article->comment_count,
+            'create_at'     => $article->create_at,
+            'tags'          => $tags,
+        ]);
+    }
+
+    /**
+     * 分类列表
+     */
+    public function categories()
+    {
+        $rows = [];
+        foreach (ArticleCategory::allEnable() as $c) {
+            $rows[] = [
+                'id'          => $c->id,
+                'name'        => $c->name,
+                'alias'       => $c->alias,
+                'description' => $c->description,
+            ];
+        }
+        $this->apiSuccess($rows, 'success', count($rows));
+    }
+
+    /**
+     * 标签列表
+     */
+    public function tags()
+    {
+        $rows = [];
+        foreach (ArticleTag::where('delete_at', 0)->order('id', 'desc')->select() as $t) {
+            $rows[] = ['id' => $t->id, 'name' => $t->name, 'alias' => $t->alias];
+        }
+        $this->apiSuccess($rows, 'success', count($rows));
+    }
+
+    /**
+     * 搜索
+     */
+    public function search()
+    {
+        $keyword = trim((string) input('keyword/s', ''));
+        $page    = (int) input('page/d', 1);
+
+        $list = ArticleModel::listArticles(['keyword' => $keyword], $page, $this->pageSize());
+
+        $rows = [];
+        foreach ($list->items() as $a) {
+            $rows[] = [
+                'id'      => $a->id,
+                'title'   => $a->title,
+                'summary' => $a->summary,
+                'cid'     => $a->cid,
+                'category' => $a->category_name ?? '',
+                'create_at' => $a->create_at,
+            ];
+        }
+
+        $this->apiSuccess($rows, 'success', $list->total());
+    }
+
+    /**
+     * 发表评论（需登录）
+     */
+    public function comment()
+    {
+        $aid     = (int) input('aid/d', 0);
+        $content = trim((string) input('content/s', ''));
+
+        if ($aid <= 0 || $content === '') {
+            $this->apiError('参数错误');
+        }
+
+        $len = mb_strlen($content, 'UTF-8');
+        if ($len < 2) {
+            $this->apiError('评论内容太短');
+        }
+        if ($len > 500) {
+            $this->apiError('评论内容不能超过 500 字');
+        }
+
+        // 目标文章必须存在且已发布
+        $article = ArticleModel::where('id', $aid)->where('status', 1)->where('delete_at', 0)->find();
+        if (!$article) {
+            $this->apiError('文章不存在或未发布');
+        }
+
+        $cfg       = AddonService::config('articles');
+        $needAudit = !empty($cfg['comment_audit']);
+        $interval  = max(0, (int) ($cfg['comment_interval'] ?? 10));
+
+        $uid     = (int) $this->uid();
+        $lockKey = 'articles_comment_lock:' . $uid;
+        if ($interval > 0 && Cache::get($lockKey, 0)) {
+            $this->apiError('评论太频繁，请稍后再试');
+        }
+
+        ArticleComment::create([
+            'uid'        => $uid,
+            'aid'        => $aid,
+            'pid'        => 0,
+            'content'    => $content,
+            'status'     => $needAudit ? 0 : 1,
+            'ip'         => (string) $this->request->ip(),
+            'user_agent' => mb_substr((string) $this->request->header('user-agent', ''), 0, 255),
+            'create_at'  => time(),
+            'update_at'  => time(),
+        ]);
+
+        if (!$needAudit) {
+            ArticleModel::where('id', $aid)->inc('comment_count')->update();
+        }
+        if ($interval > 0) {
+            Cache::set($lockKey, 1, $interval);
+        }
+
+        $this->apiSuccess(null, $needAudit ? '评论已提交，等待审核' : '评论成功');
+    }
+
+    /**
+     * 每页条数（取自插件配置）
+     */
+    private function pageSize(): int
+    {
+        $cfg = AddonService::config('articles');
+        $size = (int) ($cfg['page_size'] ?? 10);
+        return $size > 0 ? min($size, 50) : 10;
+    }
+}

addon/articles/controller/backend/Article.php

@@ -14,13 +14,16 @@ use think\Validate;
 use ywxapp\controller\BackendBase;
 use addon\articles\model\Article as ArticleModel;
 use addon\articles\model\ArticleCategory;
+use addon\articles\model\ArticleComment;
 use addon\articles\model\ArticleTag;
 use addon\articles\model\ArticleArticleTag;
 use addon\articles\library\ArticleSchema;
+use addon\articles\library\HtmlSanitizer;
 
 class Article extends BackendBase
 {
-    protected $noNeedVerify = ['*'];
+    // 后台写操作走菜单权限节点校验，不放开免校验白名单
+    protected $noNeedVerify = [];
 
     protected function initialize()
     {
@@ -36,7 +39,8 @@ class Article extends BackendBase
         $limit   = Request::param('limit', 15);
 
         if (Request::isAjax()) {
-            $query = ArticleModel::with(['category']);
+            // 列表排除正文（longtext），字段由 listFields() 动态生成
+            $query = ArticleModel::with(['category'])->field(ArticleModel::listFields());
             if ($status !== 'all') {
                 $query->where('status', $status);
             }
@@ -59,10 +63,17 @@ class Article extends BackendBase
                     'view_count'  => (int) $a->view_count,
                     'comment_count' => (int) $a->comment_count,
                     'create_at'   => $a->create_at,
-                    'edit_url'    => (string) url('articles/backend.article/edit', ['id' => $a->id]),
+                    'edit_url'    => (string) url('articles/backend/article/edit', ['id' => $a->id]),
                 ];
             }
-            return json(['code' => 0, 'msg' => '', 'count' => $paginator->total(), 'data' => $rows]);
+            // ↓↓↓ 临时诊断标记（确认 Web 实际加载的是不是本文件 + 真实 SQL），定位后移除
+            $diag = [
+                'mtime' => date('Y-m-d H:i:s', filemtime(__FILE__)),
+                'sql'   => (string) ArticleModel::fetchSql(true)->order('id', 'desc')->limit(1)->select(),
+            ];
+            // ↑↑↑ 临时诊断标记
+
+            return json(['code' => 0, 'msg' => '', 'count' => $paginator->total(), 'data' => $rows, '__diag' => $diag]);
         }
 
         return View::fetch('article/index', ['status' => $status, 'keyword' => $keyword]);
@@ -88,7 +99,8 @@ class Article extends BackendBase
     {
         $article = ArticleModel::with(['tags'])->find($id);
         if (!$article) {
-            return redirect('/articles/backend/article');
+            // 用 url() 生成：绑定独立域名后自动切换，不要硬编码 '/articles/backend/...'
+            return redirect((string) url('articles/backend/article/index'));
         }
         $categories  = ArticleCategory::where('delete_at', 0)->where('status', 1)->select();
         $tags        = ArticleTag::where('delete_at', 0)->select();
@@ -121,6 +133,28 @@ class Article extends BackendBase
             return json(['code' => 0, 'msg' => $validate->getError()]);
         }
 
+        // 定时发布：前端传 "Y-m-d H:i" 字符串，统一转时间戳（0 = 立即发布）
+        if (!empty($data['publish_time'])) {
+            $ts = strtotime((string) $data['publish_time']);
+            $data['publish_time'] = $ts ?: 0;
+        }
+
+        // 正文白名单净化：正文在前台是 |raw 直出（富文本必须原样输出），
+        // 所以必须在入库前净化，防止来源不可信时形成存储型 XSS。
+        if (!empty($data['content'])) {
+            $data['content'] = HtmlSanitizer::clean((string) $data['content']);
+        }
+
+        // 封面图地址校验：必须是 http(s):// 或 / 开头的 URL，避免填成裸字符串导致坏图
+        if (!empty($data['cover_image']) && !preg_match('#^(https?://|/)#i', (string) $data['cover_image'])) {
+            return json(['code' => 0, 'msg' => '封面图地址格式不正确（须为 http(s):// 或 / 开头）']);
+        }
+
+        // 字段白名单：防止通过表单注入 uid / view_count / delete_at 等非表单字段
+        $allow = ['title', 'content', 'summary', 'cover_image', 'uid', 'author',
+                  'cid', 'status', 'is_top', 'is_recommend', 'publish_time',
+                  'create_at', 'update_at'];
+
         // 处理标签
         $tagIds = [];
         if (!empty($data['tags'])) {
@@ -130,31 +164,48 @@ class Article extends BackendBase
                 if ($name === '') {
                     continue;
                 }
-                $tag = ArticleTag::where('delete_at', 0)->where('name', $name)->find()
-                    ?: ArticleTag::create(['name' => $name, 'alias' => $name, 'create_at' => time(), 'update_at' => time()]);
+                $tag = ArticleTag::where('delete_at', 0)->where('name', $name)->find();
+                if (!$tag) {
+                    // alias 用作 URL 标识：中文名不能直接当别名，用稳定的短哈希兜底
+                    $tag = ArticleTag::create([
+                        'name'      => $name,
+                        'alias'     => 'tag-' . substr(md5($name), 0, 8),
+                        'create_at' => time(),
+                        'update_at' => time(),
+                    ]);
+                }
                 $tagIds[] = $tag->id;
             }
         }
 
-        if ($id) {
-            $article = ArticleModel::find($id);
-            if (!$article) {
-                return json(['code' => 0, 'msg' => '文章不存在']);
+        try {
+            if ($id) {
+                $article = ArticleModel::find($id);
+                if (!$article) {
+                    return json(['code' => 0, 'msg' => '文章不存在']);
+                }
+                $article->allowField($allow)->save($data);
+            } else {
+                if (empty($data['uid'])) {
+                    $data['uid'] = $this->auth->info['uid'] ?? 0;
+                }
+                if (empty($data['author'])) {
+                    $data['author'] = $this->auth->info['nickname'] ?? '';
+                }
+                $data['create_at'] = time();
+                $article = ArticleModel::create($data, $allow);
+                $id = $article->id;
             }
-            $article->save($data);
-        } else {
-            if (empty($data['uid'])) {
-                $data['uid'] = $this->auth->info['uid'] ?? 0;
-            }
-            if (empty($data['author'])) {
-                $data['author'] = $this->auth->info['nickname'] ?? '';
-            }
-            $data['create_at'] = time();
-            $article = ArticleModel::create($data);
-            $id = $article->id;
+        } catch (\Throwable $e) {
+            return json(['code' => 0, 'msg' => '保存失败：' . $e->getMessage()]);
         }
+
         ArticleArticleTag::syncTags($id, $tagIds);
-        return json(['code' => 1, 'msg' => '保存成功', 'url' => '/articles/backend/article']);
+        return json([
+            'code' => 1,
+            'msg'  => '保存成功',
+            'url'  => (string) url('articles/backend/article/index'),
+        ]);
     }
 
     public function delete($id = 0)
@@ -163,11 +214,83 @@ class Article extends BackendBase
         $article = ArticleModel::find($id);
         if ($article) {
             $article->delete();
+            // 一并清理标签关联与评论，避免孤儿数据
+            ArticleArticleTag::where('aid', $id)->delete();
+            ArticleComment::where('aid', $id)->delete();
             return json(['code' => 1, 'msg' => '已删除']);
         }
         return json(['code' => 0, 'msg' => '文章不存在']);
     }
 
+    /**
+     * 批量删除（软删 + 清理标签关联与评论）
+     */
+    public function batchDelete()
+    {
+        $ids = (array) Request::post('ids/a', []);
+        $ids = array_values(array_filter(array_map('intval', $ids)));
+        if (!$ids) {
+            return json(['code' => 0, 'msg' => '请选择要删除的文章']);
+        }
+
+        $count = 0;
+        foreach ($ids as $id) {
+            $article = ArticleModel::find($id);
+            if (!$article) {
+                continue;
+            }
+            $article->delete();
+            ArticleArticleTag::where('aid', $id)->delete();
+            ArticleComment::where('aid', $id)->delete();
+            $count++;
+        }
+
+        return json(['code' => 1, 'msg' => '已删除 ' . $count . ' 篇']);
+    }
+
+    /**
+     * 批量设置状态（1=发布 0=草稿）
+     */
+    public function batchStatus()
+    {
+        $ids    = (array) Request::post('ids/a', []);
+        $ids    = array_values(array_filter(array_map('intval', $ids)));
+        $status = (int) Request::post('status', 1);
+
+        if (!$ids) {
+            return json(['code' => 0, 'msg' => '请选择文章']);
+        }
+        if (!in_array($status, [0, 1], true)) {
+            return json(['code' => 0, 'msg' => '状态值不合法']);
+        }
+
+        $count = ArticleModel::whereIn('id', $ids)
+            ->update(['status' => $status, 'update_at' => time()]);
+
+        return json(['code' => 1, 'msg' => '已更新 ' . $count . ' 篇']);
+    }
+
+    /**
+     * 审核前台投稿（pass=1 通过并发布 / pass=0 拒绝并退回草稿）
+     */
+    public function audit()
+    {
+        $id   = (int) Request::post('id', 0);
+        $pass = (int) Request::post('pass', 1);
+
+        $article = ArticleModel::find($id);
+        if (!$article) {
+            return json(['code' => 0, 'msg' => '文章不存在']);
+        }
+        if ((int) $article->status !== 2) {
+            return json(['code' => 0, 'msg' => '该文章不是待审核状态']);
+        }
+
+        $article->save(['status' => $pass ? 1 : 0, 'update_at' => time()]);
+
+        return json(['code' => 1, 'msg' => $pass ? '审核通过，已发布' : '已拒绝，退回草稿']);
+    }
+
     public function recyclebin()
     {
         $page  = Request::param('page', 1);

addon/articles/controller/backend/Attachment.php

@@ -0,0 +1,153 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\controller\backend;
+
+use addon\articles\library\ArticleSchema;
+use addon\articles\model\ArticleAttachment;
+use think\facade\Request;
+use think\facade\View;
+use ywxapp\controller\BackendBase;
+use ywxapp\service\FileStorageService;
+
+/**
+ * 附件管理
+ *
+ * 上传走框架 FileStorageService（与 /upload 同源），这里额外做：
+ *   - 后台专用：类型白名单 + 大小限制
+ *   - 落库记录，便于统一查看与清理
+ */
+class Attachment extends BackendBase
+{
+    protected $noNeedVerify = [];
+
+    /** 允许的文件类型 */
+    private const ALLOW_EXT = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'bmp',
+                               'pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx',
+                               'zip', 'rar', 'txt', 'csv'];
+
+    /** 单文件上限（字节） */
+    private const MAX_SIZE = 10485760; // 10MB
+
+    protected function initialize()
+    {
+        parent::initialize();
+        ArticleSchema::ensure();
+    }
+
+    public function index()
+    {
+        if (Request::isAjax()) {
+            $page  = Request::param('page', 1);
+            $limit = Request::param('limit', 15);
+            $aid   = (int) Request::param('aid', 0);
+
+            $query = ArticleAttachment::order('id', 'desc');
+            if ($aid > 0) {
+                $query->where('aid', $aid);
+            }
+
+            $paginator = $query->paginate(['list_rows' => $limit, 'page' => $page]);
+
+            $rows = [];
+            foreach ($paginator->items() as $f) {
+                $rows[] = [
+                    'id'        => $f->id,
+                    'name'      => $f->name,
+                    'url'       => $f->url,
+                    'ext'       => $f->ext,
+                    'size_text' => $f->size_text,
+                    'aid'       => (int) $f->aid,
+                    'create_at' => $f->create_at,
+                ];
+            }
+
+            return json(['code' => 0, 'msg' => '', 'count' => $paginator->total(), 'data' => $rows]);
+        }
+
+        return View::fetch('attachment/index');
+    }
+
+    /**
+     * 上传并记录
+     */
+    public function upload()
+    {
+        $file = Request::file('file');
+        if (!$file || !$file->isValid()) {
+            return json(['code' => 0, 'msg' => '未获取到上传文件']);
+        }
+
+        $ext = strtolower($file->extension());
+        if (!in_array($ext, self::ALLOW_EXT, true)) {
+            return json(['code' => 0, 'msg' => '不支持的文件类型：' . $ext]);
+        }
+        if ($file->getSize() > self::MAX_SIZE) {
+            return json(['code' => 0, 'msg' => '文件不能超过 ' . (self::MAX_SIZE / 1048576) . 'MB']);
+        }
+
+        // 真实 MIME 二次校验（防改扩展名）
+        $mime = (string) $file->getMime();
+        if ($mime !== '' && preg_match('#^text/(x-)?php#i', $mime)) {
+            return json(['code' => 0, 'msg' => '危险文件类型']);
+        }
+
+        try {
+            $storage = new FileStorageService();
+            $result  = $storage->upload($file, 'articles/' . date('Ymd'));
+
+            $record = ArticleAttachment::record(
+                is_array($result) ? $result : ['url' => (string) $result],
+                (int) ($this->auth->info['uid'] ?? 0),
+                (int) Request::post('aid', 0)
+            );
+
+            return json([
+                'code' => 1,
+                'msg'  => '上传成功',
+                'data' => ['id' => $record->id, 'url' => $record->url],
+            ]);
+        } catch (\Throwable $e) {
+            return json(['code' => 0, 'msg' => '上传失败：' . $e->getMessage()]);
+        }
+    }
+
+    /**
+     * 删除记录并尝试清理物理文件
+     */
+    public function delete($id = 0)
+    {
+        $id  = (int) ($id ?: Request::post('id', 0));
+        $att = ArticleAttachment::find($id);
+        if (!$att) {
+            return json(['code' => 0, 'msg' => '记录不存在']);
+        }
+
+        // 删除物理文件（限定在 public 目录内，防目录穿越）
+        $rel  = ltrim((string) $att->path, '/');
+        $url  = ltrim((string) $att->url, '/');
+        $root = rtrim((string) public_path(), DIRECTORY_SEPARATOR);
+
+        foreach ([$rel, $url] as $candidate) {
+            if ($candidate === '' || strpos($candidate, '..') !== false) {
+                continue;
+            }
+            $full = $root . DIRECTORY_SEPARATOR . $candidate;
+            if (is_file($full)) {
+                @unlink($full);
+                break;
+            }
+        }
+
+        $att->delete();
+
+        return json(['code' => 1, 'msg' => '已删除']);
+    }
+}

addon/articles/controller/backend/Category.php

@@ -8,6 +8,7 @@ declare(strict_types=1);
 
 namespace addon\articles\controller\backend;
 
+use think\facade\Cache;
 use think\facade\Request;
 use think\facade\View;
 use think\Validate;
@@ -51,35 +52,26 @@ class Category extends BackendBase
                 'page'      => $page,
                 'list_rows' => $size,
             ]);
-            $this->result->success($data->items());
+            // 必须回传 count，否则 layui 表格分页失效
+            return json(['code' => 0, 'msg' => '', 'count' => $data->total(), 'data' => $data->items()]);
         }
-        $this->view->assign('title', '登录');
         return $this->view->fetch('category/index');
     }
 
     public function save()
     {
         if (Request::isPost()) {
-            $data = Request::post();
-            $data['status'] = isset($data['status']) ? 1 : 0;
-            
-            $validate = new Validate([
-                'name|名称' => 'require|max:50',
-                'alias|别名' => 'require|max:50',
-            ]);
-            if (!$validate->check($data)) {
-                $this->result->error($validate->getError()); 
-            }
-            ArticleCategory::create($data);
-            $this->result->success();
+            return $this->update(0);
         }
+        // GET：渲染新增表单（原实现无返回值，会输出空白页）
+        return View::fetch('category/edit', ['category' => null]);
     }
 
     public function edit($id = null)
     {
         $category = ArticleCategory::find($id);
         if (!$category) {
-            return redirect('/articles/backend/category');
+            return redirect((string) url('articles/backend/category/index'));
         }
         return View::fetch('category/edit', ['category' => $category]);
     }
@@ -99,17 +91,33 @@ class Category extends BackendBase
             return json(['code' => 0, 'msg' => $validate->getError()]);
         }
 
-        if ($id) {
-            $category = ArticleCategory::find($id);
-            if (!$category) {
-                return json(['code' => 0, 'msg' => '分类不存在']);
+        // 字段白名单（category 表实际列）
+        $allow = ['name', 'alias', 'description', 'cover', 'sort', 'status', 'create_at', 'update_at'];
+
+        try {
+            if ($id) {
+                $category = ArticleCategory::find($id);
+                if (!$category) {
+                    return json(['code' => 0, 'msg' => '分类不存在']);
+                }
+                $category->allowField($allow)->save($data);
+            } else {
+                $data['create_at'] = time();
+                ArticleCategory::create($data, $allow);
             }
-            $category->save($data);
-        } else {
-            $data['create_at'] = time();
-            ArticleCategory::create($data);
+        } catch (\Throwable $e) {
+            // alias 上有唯一键 uk_alias，重复会抛异常，转友好提示
+            return json(['code' => 0, 'msg' => '保存失败：别名可能已存在']);
         }
-        return json(['code' => 0, 'msg' => '保存成功', 'url' => '/articles/backend/category']);
+
+        // 前台侧边栏分类有 5 分钟缓存，写操作后立即失效
+        Cache::delete('articles:categories');
+
+        return json([
+            'code' => 1,
+            'msg'  => '保存成功',
+            'url'  => (string) url('articles/backend/category/index'),
+        ]);
     }
 
     public function delete($id = 0)
@@ -121,7 +129,8 @@ class Category extends BackendBase
                 return json(['code' => 0, 'msg' => '该分类下还有文章，无法删除']);
             }
             $category->delete();
-            return json(['code' => 0, 'msg' => '已删除']);
+            Cache::delete('articles:categories');
+            return json(['code' => 1, 'msg' => '已删除']);
         }
         return json(['code' => 0, 'msg' => '分类不存在']);
     }

addon/articles/controller/backend/Comment.php

@@ -17,7 +17,8 @@ use addon\articles\library\ArticleSchema;
 
 class Comment extends BackendBase
 {
-    protected $noNeedVerify = ['*'];
+    // 后台操作走菜单权限节点校验，不放开免校验白名单
+    protected $noNeedVerify = [];
 
     protected function initialize()
     {
@@ -64,9 +65,13 @@ class Comment extends BackendBase
         $id = $id ?: (int) Request::post('id', 0);
         $comment = ArticleComment::find($id);
         if ($comment) {
+            // 只在「未通过 → 通过」时累加计数：重复审核不会把评论数刷高
+            $wasPending = (int) $comment->status !== 1;
             $comment->status = 1;
             $comment->save();
-            Article::where('id', $comment->aid)->inc('comment_count')->update();
+            if ($wasPending) {
+                Article::where('id', $comment->aid)->inc('comment_count')->update();
+            }
             return json(['code' => 1, 'msg' => '审核通过']);
         }
         return json(['code' => 0, 'msg' => '评论不存在']);
@@ -78,6 +83,8 @@ class Comment extends BackendBase
         $comment = ArticleComment::find($id);
         if ($comment) {
             $comment->delete();
+            // 同步回退文章评论数，保持计数准确
+            Article::where('id', $comment->aid)->where('comment_count', '>', 0)->dec('comment_count')->update();
             return json(['code' => 1, 'msg' => '已删除']);
         }
         return json(['code' => 0, 'msg' => '评论不存在']);

addon/articles/controller/backend/Dashboard.php

@@ -0,0 +1,75 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\controller\backend;
+
+use addon\articles\library\ArticleSchema;
+use addon\articles\model\Article as ArticleModel;
+use addon\articles\model\ArticleCategory;
+use addon\articles\model\ArticleComment;
+use ywxapp\controller\BackendBase;
+
+/**
+ * 文章CMS 后台仪表盘（统计概览）
+ */
+class Dashboard extends BackendBase
+{
+    protected $noNeedVerify = [];
+
+    protected function initialize()
+    {
+        parent::initialize();
+        ArticleSchema::ensure();
+    }
+
+    public function index()
+    {
+        $today = strtotime('today');
+
+        $stats = [
+            'total'            => ArticleModel::count(),
+            'published'        => ArticleModel::where('status', 1)->count(),
+            'draft'            => ArticleModel::where('status', 0)->count(),
+            'pending'          => ArticleModel::scope('pending')->count(),
+            'today'            => ArticleModel::where('create_at', '>=', $today)->count(),
+            'views'            => (int) ArticleModel::sum('view_count'),
+            'comments'         => ArticleComment::count(),
+            'pending_comments' => ArticleComment::where('status', 0)->count(),
+            'trashed'          => ArticleModel::onlyTrashed()->count(),
+        ];
+
+        // 分类分布（Top 10）
+        $dist = [];
+        foreach (ArticleCategory::where('delete_at', 0)->order('sort', 'desc')->select() as $c) {
+            $dist[] = [
+                'id'    => $c->id,
+                'name'  => $c->name,
+                'count' => ArticleModel::where('cid', $c->id)->count(),
+            ];
+        }
+        usort($dist, function ($a, $b) {
+            return $b['count'] <=> $a['count'];
+        });
+        $dist = array_slice($dist, 0, 10);
+
+        // 热门文章 Top 10
+        $hot = ArticleModel::where('status', 1)
+            ->field('id,title,view_count,comment_count')
+            ->order('view_count', 'desc')
+            ->limit(10)
+            ->select();
+
+        return $this->view->fetch('dashboard/index', [
+            'stats' => $stats,
+            'dist'  => $dist,
+            'hot'   => $hot,
+        ]);
+    }
+}

addon/articles/controller/backend/Topic.php

@@ -0,0 +1,151 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\controller\backend;
+
+use addon\articles\library\ArticleSchema;
+use addon\articles\model\Article as ArticleModel;
+use addon\articles\model\ArticleTopic;
+use addon\articles\model\ArticleTopicArticle;
+use think\facade\Cache;
+use think\facade\Request;
+use think\facade\View;
+use think\Validate;
+use ywxapp\controller\BackendBase;
+
+/**
+ * 文章专题管理（运营聚合页）
+ */
+class Topic extends BackendBase
+{
+    protected $noNeedVerify = [];
+
+    protected function initialize()
+    {
+        parent::initialize();
+        ArticleSchema::ensure();
+    }
+
+    public function index()
+    {
+        if (Request::isAjax()) {
+            $page  = Request::param('page', 1);
+            $limit = Request::param('limit', 15);
+
+            $paginator = ArticleTopic::order('sort', 'desc')->order('id', 'desc')
+                ->paginate(['list_rows' => $limit, 'page' => $page]);
+
+            $rows = [];
+            foreach ($paginator->items() as $t) {
+                $rows[] = [
+                    'id'            => $t->id,
+                    'title'         => $t->title,
+                    'alias'         => $t->alias,
+                    'sort'          => (int) $t->sort,
+                    'status'        => $t->status,
+                    'article_count' => ArticleTopicArticle::where('tid', $t->id)->count(),
+                    'create_at'     => $t->create_at,
+                    'edit_url'      => (string) url('articles/backend/topic/edit', ['id' => $t->id]),
+                ];
+            }
+
+            return json(['code' => 0, 'msg' => '', 'count' => $paginator->total(), 'data' => $rows]);
+        }
+
+        return View::fetch('topic/index');
+    }
+
+    public function save()
+    {
+        if (Request::isPost()) {
+            return $this->update(0);
+        }
+        return View::fetch('topic/edit', ['topic' => null, 'picked' => []]);
+    }
+
+    public function edit($id = null)
+    {
+        $topic = ArticleTopic::find($id);
+        if (!$topic) {
+            return redirect((string) url('articles/backend/topic/index'));
+        }
+
+        $ids    = ArticleTopicArticle::articleIdsOf((int) $topic->id);
+        $picked = $ids
+            ? ArticleModel::whereIn('id', $ids)->field('id,title')->select()->toArray()
+            : [];
+
+        return View::fetch('topic/edit', ['topic' => $topic, 'picked' => $picked]);
+    }
+
+    public function update($id = 0)
+    {
+        $data = Request::post();
+        $id   = $id ?: (int) ($data['id'] ?? 0);
+        $data['update_at'] = time();
+        $data['status']    = isset($data['status']) ? 1 : 0;
+
+        $validate = new Validate([
+            'title|标题' => 'require|max:100',
+            'alias|别名' => 'require|max:50',
+        ]);
+        if (!$validate->check($data)) {
+            return json(['code' => 0, 'msg' => $validate->getError()]);
+        }
+
+        // 关联文章：逗号分隔的文章ID（顺序即专题内排序）
+        $articleIds = array_values(array_filter(array_map('intval', explode(',', (string) ($data['article_ids'] ?? '')))));
+
+        $allow = ['title', 'alias', 'description', 'cover', 'sort', 'status', 'create_at', 'update_at'];
+
+        try {
+            if ($id) {
+                $topic = ArticleTopic::find($id);
+                if (!$topic) {
+                    return json(['code' => 0, 'msg' => '专题不存在']);
+                }
+                $topic->allowField($allow)->save($data);
+            } else {
+                $data['create_at'] = time();
+                $topic = ArticleTopic::create($data, $allow);
+                $id    = $topic->id;
+            }
+        } catch (\Throwable $e) {
+            // alias 上有唯一键 uk_alias
+            return json(['code' => 0, 'msg' => '保存失败：别名可能已存在']);
+        }
+
+        ArticleTopicArticle::syncArticles((int) $id, $articleIds);
+
+        // 前台专题聚合页有缓存，写操作后立即失效
+        Cache::delete('articles:topics');
+
+        return json([
+            'code' => 1,
+            'msg'  => '保存成功',
+            'url'  => (string) url('articles/backend/topic/index'),
+        ]);
+    }
+
+    public function delete($id = 0)
+    {
+        $id   = (int) ($id ?: Request::post('id', 0));
+        $topic = ArticleTopic::find($id);
+        if (!$topic) {
+            return json(['code' => 0, 'msg' => '专题不存在']);
+        }
+
+        $topic->delete();
+        ArticleTopicArticle::where('tid', $id)->delete();
+        Cache::delete('articles:topics');
+
+        return json(['code' => 1, 'msg' => '已删除']);
+    }
+}

addon/articles/controller/member/Article.php

@@ -0,0 +1,150 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\controller\member;
+
+use addon\articles\library\HtmlSanitizer;
+use addon\articles\model\Article as ArticleModel;
+use addon\articles\model\ArticleCategory;
+use think\Validate;
+use ywxapp\controller\MemberBase;
+
+/**
+ * 会员中心 · 我的投稿
+ *
+ * 投稿统一写入 status=2（待审核），由后台审核通过后（status=1）才对前台可见。
+ * 会员只能查看/编辑/删除【自己】的文章。
+ */
+class Article extends MemberBase
+{
+    /** 投稿必须登录 */
+    protected $noNeedLogin = [];
+
+    /**
+     * 我的投稿列表
+     */
+    public function index()
+    {
+        $uid  = $this->uid();
+        $list = ArticleModel::where('uid', $uid)
+            ->field(ArticleModel::listFields())
+            ->order('id', 'desc')
+            ->paginate(['list_rows' => 10, 'page' => (int) input('page', 1)]);
+
+        return $this->fetch('article/index', ['list' => $list]);
+    }
+
+    /**
+     * 写新稿件
+     */
+    public function add()
+    {
+        return $this->fetch('article/edit', [
+            'article'    => null,
+            'categories' => $this->categories(),
+        ]);
+    }
+
+    /**
+     * 编辑自己的稿件
+     */
+    public function edit($id = 0)
+    {
+        $article = ArticleModel::where('id', (int) $id)->where('uid', $this->uid())->find();
+        if (!$article) {
+            $this->result->error('文章不存在或不属于你');
+        }
+
+        return $this->fetch('article/edit', [
+            'article'    => $article,
+            'categories' => $this->categories(),
+        ]);
+    }
+
+    /**
+     * 保存投稿（新增或编辑，保存后一律置为待审核）
+     */
+    public function save()
+    {
+        if (!$this->request->isPost()) {
+            return redirect((string) url('articles/member/article/index'));
+        }
+
+        $uid  = $this->uid();
+        $data = $this->request->post();
+        $id   = (int) ($data['id'] ?? 0);
+
+        $validate = new Validate([
+            'title|标题'   => 'require|max:255',
+            'content|内容' => 'require',
+            'cid|分类'     => 'require|number',
+        ]);
+        if (!$validate->check($data)) {
+            $this->result->error($validate->getError());
+        }
+
+        // 正文必须净化（前台来源不可信）
+        $data['content']  = HtmlSanitizer::clean((string) $data['content']);
+        $data['status']   = 2; // 待审核
+        $data['uid']      = $uid;
+        $data['author']   = $this->auth->info['nickname'] ?? '';
+        $data['is_top']   = 0;
+        $data['is_recommend'] = 0;
+        $data['update_at'] = time();
+
+        $allow = ['title', 'content', 'summary', 'cover_image', 'uid', 'author',
+                  'cid', 'status', 'is_top', 'is_recommend', 'create_at', 'update_at'];
+
+        if ($id) {
+            $article = ArticleModel::where('id', $id)->where('uid', $uid)->find();
+            if (!$article) {
+                $this->result->error('文章不存在或不属于你');
+            }
+            $article->allowField($allow)->save($data);
+        } else {
+            $data['create_at'] = time();
+            ArticleModel::create($data, $allow);
+        }
+
+        $this->result->success(null, '投稿已提交，等待管理员审核');
+    }
+
+    /**
+     * 删除自己的稿件（软删）
+     */
+    public function delete($id = 0)
+    {
+        $id      = (int) ($id ?: input('id', 0));
+        $article = ArticleModel::where('id', $id)->where('uid', $this->uid())->find();
+
+        if (!$article) {
+            $this->result->error('文章不存在或不属于你');
+        }
+
+        $article->delete();
+        $this->result->success(null, '已删除');
+    }
+
+    /**
+     * 当前会员UID
+     */
+    private function uid(): int
+    {
+        return (int) ($this->auth->info['uid'] ?? 0);
+    }
+
+    /**
+     * 可选分类
+     */
+    private function categories()
+    {
+        return ArticleCategory::where('delete_at', 0)->where('status', 1)->select();
+    }
+}

addon/articles/info.php

@@ -3,12 +3,15 @@
 return [
     'name' => 'articles',
     'title' => '文章CMS',
+    // intro 为 AddonBase::checkInfo() 校验的六项之一（name/title/intro/author/version/state）
+    'intro' => '完整文章类 CMS 插件：文章、分类、标签、评论，前台套用 layuiSimpleNews 模板',
     'description' => '完整文章类 CMS 插件：文章、分类、标签、评论，前台套用 layuiSimpleNews 模板',
     'status' => 1,
     'author' => 'ywxapp',
     'version' => '1.0.1',
     'type' => 1,
-    'state' => 0,
+    // state=1 启用：框架按 info.php 的 state 过滤加载（路由/事件/配置预热），禁用时全部不生效
+    'state' => 1,
     'install_time' => 1786348115,
     'update_time' => 1786366229,
 ];

addon/articles/install.sql

@@ -4,9 +4,10 @@
 --           （仅允许 CREATE TABLE / INSERT，见 importsql 白名单）。
 -- 表名须为 __PREFIX__articles_*，与插件名一致。
 -- 时间字段统一：create_at / update_at / delete_at（int 时间戳，0=未删）
+--
+-- 注意：不要写 SET NAMES / SET FOREIGN_KEY_CHECKS / DROP / ALTER / UPDATE / DELETE，
+-- 这些语句会被框架白名单跳过（只记 Log::warning），写了等于没执行。
 -- ============================================================
-SET NAMES utf8mb4;
-SET FOREIGN_KEY_CHECKS = 0;
 
 CREATE TABLE IF NOT EXISTS `__PREFIX__articles_article` (
   `id` int unsigned NOT NULL AUTO_INCREMENT,
@@ -17,7 +18,8 @@ CREATE TABLE IF NOT EXISTS `__PREFIX__articles_article` (
   `uid` int NOT NULL DEFAULT 0 COMMENT '作者ID（member_user.uid）',
   `author` varchar(50) DEFAULT '' COMMENT '作者名（冗余）',
   `cid` int NOT NULL DEFAULT 0 COMMENT '分类ID',
-  `status` tinyint(1) DEFAULT 1 COMMENT '状态：1发布 0草稿',
+  `status` tinyint(1) DEFAULT 1 COMMENT '状态：1发布 0草稿 2待审核',
+  `publish_time` int NOT NULL DEFAULT 0 COMMENT '定时发布时间(0=立即发布)',
   `is_top` tinyint(1) DEFAULT 0 COMMENT '是否置顶',
   `is_recommend` tinyint(1) DEFAULT 0 COMMENT '是否推荐',
   `view_count` int DEFAULT 0 COMMENT '浏览次数',
@@ -30,7 +32,13 @@ CREATE TABLE IF NOT EXISTS `__PREFIX__articles_article` (
   KEY `idx_uid` (`uid`),
   KEY `idx_cid` (`cid`),
   KEY `idx_status_create` (`status`,`create_at`),
-  KEY `idx_delete` (`delete_at`)
+  KEY `idx_delete` (`delete_at`),
+  -- 前台列表：status + delete_at 过滤后按 create_at 排序
+  KEY `idx_list` (`status`,`delete_at`,`create_at`),
+  -- 后台列表：order is_top / is_recommend
+  KEY `idx_top` (`is_top`,`is_recommend`),
+  -- 热门文章：order view_count desc
+  KEY `idx_view` (`view_count`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='文章表';
 
 CREATE TABLE IF NOT EXISTS `__PREFIX__articles_category` (
@@ -69,6 +77,17 @@ CREATE TABLE IF NOT EXISTS `__PREFIX__articles_article_tag` (
   KEY `idx_tid` (`tid`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='文章标签关联表';
 
+CREATE TABLE IF NOT EXISTS `__PREFIX__articles_like` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `uid` int NOT NULL DEFAULT 0 COMMENT '用户ID',
+  `target_id` int NOT NULL DEFAULT 0 COMMENT '目标ID（文章ID / 评论ID）',
+  `type` tinyint(1) NOT NULL DEFAULT 1 COMMENT '1=文章点赞 2=评论点赞',
+  `create_at` int NOT NULL DEFAULT 0 COMMENT '创建时间',
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `uk_user_target` (`uid`,`target_id`,`type`),
+  KEY `idx_target` (`target_id`,`type`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='点赞记录表（唯一键防重复点赞）';
+
 CREATE TABLE IF NOT EXISTS `__PREFIX__articles_comment` (
   `id` int unsigned NOT NULL AUTO_INCREMENT,
   `uid` int NOT NULL DEFAULT 0 COMMENT '用户ID（member_user.uid）',
@@ -88,4 +107,85 @@ CREATE TABLE IF NOT EXISTS `__PREFIX__articles_comment` (
   KEY `idx_delete` (`delete_at`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='文章评论表';
 
-SET FOREIGN_KEY_CHECKS = 1;
+CREATE TABLE IF NOT EXISTS `__PREFIX__articles_topic` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `title` varchar(100) NOT NULL DEFAULT '' COMMENT '专题标题',
+  `alias` varchar(50) NOT NULL DEFAULT '' COMMENT '别名（URL 标识，英文/数字）',
+  `description` varchar(500) DEFAULT '' COMMENT '专题描述',
+  `cover` varchar(255) DEFAULT '' COMMENT '封面图',
+  `sort` int DEFAULT 0 COMMENT '排序权重',
+  `status` tinyint(1) DEFAULT 1 COMMENT '状态：1启用 0禁用',
+  `create_at` int NOT NULL DEFAULT 0,
+  `update_at` int NOT NULL DEFAULT 0,
+  `delete_at` int NOT NULL DEFAULT 0,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `uk_alias` (`alias`),
+  KEY `idx_delete` (`delete_at`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='文章专题表';
+
+CREATE TABLE IF NOT EXISTS `__PREFIX__articles_topic_article` (
+  `tid` int NOT NULL COMMENT '专题ID',
+  `aid` int NOT NULL COMMENT '文章ID',
+  `sort` int DEFAULT 0 COMMENT '专题内排序',
+  PRIMARY KEY (`tid`,`aid`),
+  KEY `idx_aid` (`aid`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='专题-文章关联表';
+
+CREATE TABLE IF NOT EXISTS `__PREFIX__articles_favorite` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `uid` int NOT NULL DEFAULT 0 COMMENT '用户ID',
+  `aid` int NOT NULL DEFAULT 0 COMMENT '文章ID',
+  `create_at` int NOT NULL DEFAULT 0 COMMENT '收藏时间',
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `uk_user_article` (`uid`,`aid`),
+  KEY `idx_aid` (`aid`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='文章收藏表';
+
+CREATE TABLE IF NOT EXISTS `__PREFIX__articles_attachment` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `uid` int NOT NULL DEFAULT 0 COMMENT '上传者ID',
+  `name` varchar(255) DEFAULT '' COMMENT '原始文件名',
+  `url` varchar(255) DEFAULT '' COMMENT '访问地址',
+  `path` varchar(255) DEFAULT '' COMMENT '存储相对路径（删除文件用）',
+  `ext` varchar(20) DEFAULT '' COMMENT '扩展名',
+  `mime` varchar(100) DEFAULT '' COMMENT 'MIME类型',
+  `size` int unsigned DEFAULT 0 COMMENT '文件大小（字节）',
+  `aid` int NOT NULL DEFAULT 0 COMMENT '关联文章ID（0=未关联）',
+  `create_at` int NOT NULL DEFAULT 0,
+  PRIMARY KEY (`id`),
+  KEY `idx_aid` (`aid`),
+  KEY `idx_uid` (`uid`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='附件表';
+
+-- ============================================================
+-- 种子数据：让新装站点有一份可直接查看的示例内容
+-- 说明：框架会把 INSERT 改写为 INSERT IGNORE，且 category.alias /
+--       tag.name 上有唯一键，重复导入安全；文章用 NOT EXISTS 判重。
+-- ============================================================
+
+INSERT INTO `__PREFIX__articles_category`
+  (`name`,`alias`,`description`,`sort`,`status`,`create_at`,`update_at`,`delete_at`)
+VALUES
+  ('资讯','news','站点动态与行业资讯',1,1,UNIX_TIMESTAMP(),UNIX_TIMESTAMP(),0),
+  ('教程','tutorial','使用教程与最佳实践',2,1,UNIX_TIMESTAMP(),UNIX_TIMESTAMP(),0);
+
+INSERT INTO `__PREFIX__articles_tag`
+  (`name`,`alias`,`description`,`create_at`,`update_at`,`delete_at`)
+VALUES
+  ('入门','getting-started','新手入门',UNIX_TIMESTAMP(),UNIX_TIMESTAMP(),0),
+  ('进阶','advanced','进阶技巧',UNIX_TIMESTAMP(),UNIX_TIMESTAMP(),0);
+
+INSERT INTO `__PREFIX__articles_article`
+  (`title`,`content`,`summary`,`cid`,`author`,`status`,`create_at`,`update_at`,`delete_at`)
+SELECT
+  '欢迎使用文章CMS',
+  '<p>这是安装后自动生成的示例文章，可在后台「文章管理」中编辑或删除。</p>',
+  '安装后自动生成的示例文章',
+  (SELECT `id` FROM `__PREFIX__articles_category` WHERE `alias` = 'news' LIMIT 1),
+  'admin',
+  1,
+  UNIX_TIMESTAMP(),
+  UNIX_TIMESTAMP(),
+  0
+FROM DUAL
+WHERE NOT EXISTS (SELECT 1 FROM `__PREFIX__articles_article` WHERE `title` = '欢迎使用文章CMS');

addon/articles/lang/zh-cn.php

@@ -0,0 +1,41 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+// | 文章CMS插件语言包（zh-cn）
+// |
+// | 由 addon/articles/common.php 在应用加载时自动载入。
+// | 模板/代码中用 {:L('Articles')} 或 L('Articles') 取值；
+// | 需要其它语种时新增 lang/<langset>.php 即可（键名保持一致）。
+// +----------------------------------------------------------------------
+return [
+    // ===== 前台通用 =====
+    'Articles'         => '文章',
+    'Category'         => '分类',
+    'Tag'              => '标签',
+    'Search'           => '搜索',
+    'Hot Articles'     => '热门文章',
+    'Related Articles' => '相关阅读',
+    'Prev Article'     => '上一篇',
+    'Next Article'     => '下一篇',
+    'No data'          => '暂无数据',
+    'Read more'        => '阅读全文',
+    'Views'            => '阅读',
+    'Comments'         => '评论',
+    'Submit Comment'   => '发表评论',
+    'Login to comment' => '请先登录后再评论',
+    'Comment pending'  => '评论已提交，等待审核',
+
+    // ===== 后台 =====
+    'Article Manage'   => '文章管理',
+    'New Article'      => '新建文章',
+    'Recycle Bin'      => '回收站',
+    'Publish'          => '发布',
+    'Draft'            => '草稿',
+    'Top'              => '置顶',
+    'Recommend'        => '推荐',
+];

addon/articles/library/ArticleSchema.php

@@ -2,27 +2,201 @@
 // +----------------------------------------------------------------------
 // | YwxApp [ WE CAN DO IT JUST THINK ]
 // +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
 // | 文章CMS插件数据表自愈聚合入口
 // +----------------------------------------------------------------------
 declare (strict_types = 1);
 
 namespace addon\articles\library;
 
-use addon\articles\model\Article;
-use addon\articles\model\ArticleCategory;
-use addon\articles\model\ArticleTag;
-use addon\articles\model\ArticleComment;
+use think\facade\Db;
 
+/**
+ * 插件表结构自愈
+ *
+ * 背景（重要）：
+ *   - 框架 install.sql 导入有白名单，只执行 CREATE TABLE / INSERT，
+ *     ALTER / DROP / UPDATE 会被跳过并记日志 → 老库升级缺列只能靠代码补。
+ *   - 早期实现复用 BaseModel::ensureTableFromInstall()，它读的是**核心**
+ *     public/install/install.sql（不含本插件表）→ 恒为空操作，还每请求
+ *     重复 file_get_contents + 正则解析大文件。
+ *
+ * 现方案：本类直接解析**插件自身** addon/articles/install.sql：
+ *   - repair(false)：只建表（轻量，首访兜底，同请求只跑一次）
+ *   - repair(true) ：建表 + 补列 + 补索引（install / upgrade 时调用）
+ */
 class ArticleSchema
 {
+    /** 同一次请求内是否已检查过（避免每请求重复解析 SQL） */
+    private static bool $checked = false;
+
+    /** 需要补齐的性能索引：表名(不含前缀) => [索引名 => 列定义] */
+    private const INDEXES = [
+        'articles_article' => [
+            // 前台列表：status + delete_at 过滤后按 create_at 排序
+            'idx_list' => '`status`,`delete_at`,`create_at`',
+            // 后台列表：order is_top desc / is_recommend
+            'idx_top'  => '`is_top`,`is_recommend`',
+        ],
+    ];
+
     /**
-     * 插件启用/首访时调用，确保全部私有表存在
+     * 首访兜底：确保表存在（不补列，同请求只执行一次）
      */
     public static function ensure(): void
     {
-        Article::ensureSchema();
-        ArticleCategory::ensureSchema();
-        ArticleTag::ensureSchema();
-        ArticleComment::ensureSchema();
+        if (self::$checked) {
+            return;
+        }
+        self::$checked = true;
+        self::repair(false);
+    }
+
+    /**
+     * 完整自愈：建表（+ 补列 + 补索引）
+     *
+     * @param bool $withColumns 是否补列与补索引（升级场景传 true）
+     */
+    public static function repair(bool $withColumns = true): void
+    {
+        $file = dirname(__DIR__) . DIRECTORY_SEPARATOR . 'install.sql';
+        if (!is_file($file)) {
+            return;
+        }
+
+        $content = (string) file_get_contents($file);
+        $prefix  = self::prefix();
+
+        // 解析 CREATE TABLE IF NOT EXISTS `__PREFIX__xxx` ( ... ) ENGINE=...;
+        preg_match_all(
+            '/CREATE TABLE IF NOT EXISTS\s+`__PREFIX__([a-z_]+)`\s*\((.*?)\)\s*ENGINE=[^;]*;/is',
+            $content,
+            $matches,
+            PREG_SET_ORDER
+        );
+
+        foreach ($matches as $m) {
+            $table = $prefix . $m[1];
+            self::ensureTable($table, str_replace('__PREFIX__', $prefix, $m[0]));
+            if ($withColumns) {
+                self::ensureColumns($table, $m[2]);
+            }
+        }
+
+        if ($withColumns) {
+            foreach (self::INDEXES as $table => $indexes) {
+                foreach ($indexes as $name => $cols) {
+                    self::ensureIndex($prefix . $table, $name, $cols);
+                }
+            }
+
+            // 全文索引（可选）：用于加速搜索，不支持时静默降级（搜索仍走 LIKE）
+            self::ensureFulltext($prefix . 'articles_article', 'ft_title_summary', '`title`,`summary`');
+        }
+    }
+
+    /**
+     * 当前数据库表前缀
+     */
+    private static function prefix(): string
+    {
+        $default = (string) config('database.default', 'mysql');
+        return (string) config("database.connections.{$default}.prefix", '');
+    }
+
+    /**
+     * 表不存在则建表
+     */
+    private static function ensureTable(string $table, string $ddl): void
+    {
+        try {
+            $exists = Db::query("SHOW TABLES LIKE '{$table}'");
+            if (empty($exists)) {
+                Db::execute($ddl);
+            }
+        } catch (\Throwable $e) {
+            // 建表失败不阻断访问，交由 install/upgrade 流程暴露
+        }
+    }
+
+    /**
+     * 按 install.sql 的列定义补列（SHOW COLUMNS 比对后 ALTER ADD COLUMN）
+     */
+    private static function ensureColumns(string $table, string $body): void
+    {
+        $exists = [];
+        try {
+            foreach (Db::query("SHOW COLUMNS FROM `{$table}`") as $row) {
+                $exists[strtolower((string) $row['Field'])] = true;
+            }
+        } catch (\Throwable $e) {
+            return; // 表都还没有，交给 ensureTable
+        }
+
+        foreach (preg_split('/\r\n|\r|\n/', $body) as $line) {
+            $line = trim($line);
+            if ($line === '') {
+                continue;
+            }
+            // 跳过键定义行
+            if (preg_match('/^(PRIMARY\s+KEY|UNIQUE\s+KEY|KEY|INDEX|CONSTRAINT|FULLTEXT)\b/i', $line)) {
+                continue;
+            }
+            if (!preg_match('/^`(\w+)`\s+(.+?),?$/s', $line, $m)) {
+                continue;
+            }
+            $col = $m[1];
+            if (isset($exists[strtolower($col)])) {
+                continue;
+            }
+            try {
+                Db::execute('ALTER TABLE `' . $table . '` ADD COLUMN `' . $col . '` ' . rtrim($m[2], ','));
+            } catch (\Throwable $e) {
+                // 单列补失败不影响其它列
+            }
+        }
+    }
+
+    /**
+     * 全文索引不存在则添加（中文优先用 ngram 解析器，失败退回默认解析器，再失败则忽略）
+     */
+    private static function ensureFulltext(string $table, string $name, string $cols): void
+    {
+        try {
+            foreach (Db::query("SHOW INDEX FROM `{$table}`") as $row) {
+                if (($row['Key_name'] ?? '') === $name) {
+                    return;
+                }
+            }
+
+            try {
+                Db::execute("ALTER TABLE `{$table}` ADD FULLTEXT INDEX `{$name}` ({$cols}) WITH PARSER ngram");
+            } catch (\Throwable $e) {
+                // 不支持 ngram（非 MySQL / 版本过旧）：退回默认解析器
+                Db::execute("ALTER TABLE `{$table}` ADD FULLTEXT INDEX `{$name}` ({$cols})");
+            }
+        } catch (\Throwable $e) {
+            // 不支持全文索引：忽略，搜索自动降级为 LIKE
+        }
+    }
+
+    /**
+     * 索引不存在则添加
+     */
+    private static function ensureIndex(string $table, string $name, string $cols): void
+    {
+        try {
+            foreach (Db::query("SHOW INDEX FROM `{$table}`") as $row) {
+                if (($row['Key_name'] ?? '') === $name) {
+                    return;
+                }
+            }
+            Db::execute("ALTER TABLE `{$table}` ADD INDEX `{$name}` ({$cols})");
+        } catch (\Throwable $e) {
+            // 索引已存在或不支持时忽略
+        }
     }
 }

addon/articles/library/HtmlSanitizer.php

@@ -0,0 +1,226 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\library;
+
+/**
+ * 文章正文 HTML 白名单净化器
+ *
+ * 用途：文章正文在前台是 {$article.content|raw} 直出（富文本必须原样输出），
+ * 因此必须在**入库前**做白名单净化，否则一旦内容来自不可信来源
+ * （前台投稿、Word/网页导入、编辑器被绕过）就是存储型 XSS。
+ *
+ * 实现说明：基于 PHP DOM 扩展做「标签白名单 + 属性白名单 + URL 协议白名单」，
+ * 不依赖外部组件（HTMLPurifier）。libxml 不可用时降级为 strip_tags 粗过滤。
+ */
+class HtmlSanitizer
+{
+    /** 允许的标签（小写） */
+    private const ALLOW_TAGS = [
+        'p', 'br', 'div', 'span', 'section', 'article', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
+        'ul', 'ol', 'li', 'dl', 'dt', 'dd', 'blockquote', 'pre', 'code',
+        'strong', 'b', 'em', 'i', 'u', 's', 'del', 'ins', 'sub', 'sup', 'mark', 'small',
+        'a', 'img', 'figure', 'figcaption', 'hr',
+        'table', 'thead', 'tbody', 'tfoot', 'tr', 'td', 'th', 'caption', 'colgroup', 'col',
+    ];
+
+    /** 整块丢弃的标签（连同内部内容一起删除） */
+    private const DROP_TAGS = [
+        'script', 'style', 'iframe', 'frame', 'frameset', 'object', 'embed', 'applet',
+        'form', 'input', 'button', 'select', 'option', 'textarea', 'label',
+        'link', 'meta', 'base', 'noscript', 'svg', 'math', 'audio', 'video', 'source', 'track',
+    ];
+
+    /** 允许保留的属性（小写） */
+    private const ALLOW_ATTR = [
+        'class', 'id', 'style', 'title', 'alt', 'src', 'href', 'target', 'rel',
+        'width', 'height', 'align', 'colspan', 'rowspan',
+    ];
+
+    /**
+     * 净化 HTML
+     *
+     * @param string $html 原始富文本
+     * @return string 净化后的 HTML（可直接入库与直出）
+     */
+    public static function clean(string $html): string
+    {
+        $html = trim($html);
+        if ($html === '') {
+            return '';
+        }
+
+        if (!class_exists('DOMDocument')) {
+            return self::fallback($html);
+        }
+
+        $prev = libxml_use_internal_errors(true);
+        $doc  = new \DOMDocument('1.0', 'UTF-8');
+
+        // 加 XML 编码声明，避免中文被按 ISO-8859-1 解析
+        $loaded = $doc->loadHTML('<?xml encoding="UTF-8">' . $html);
+        libxml_clear_errors();
+        libxml_use_internal_errors($prev);
+
+        if (!$loaded) {
+            return self::fallback($html);
+        }
+
+        $body = $doc->getElementsByTagName('body')->item(0);
+        if (!$body) {
+            return self::fallback($html);
+        }
+
+        self::walk($body);
+
+        $out = '';
+        foreach ($body->childNodes as $child) {
+            $out .= $doc->saveHTML($child);
+        }
+
+        return trim($out);
+    }
+
+    /**
+     * 递归净化节点
+     */
+    private static function walk(\DOMNode $node): void
+    {
+        $children = [];
+        foreach ($node->childNodes as $child) {
+            $children[] = $child;
+        }
+
+        foreach ($children as $child) {
+            // 注释节点一律删除（IE 条件注释可携带脚本）
+            if ($child->nodeType === XML_COMMENT_NODE) {
+                $node->removeChild($child);
+                continue;
+            }
+
+            if ($child->nodeType !== XML_ELEMENT_NODE) {
+                continue;
+            }
+
+            /** @var \DOMElement $child */
+            $tag = strtolower($child->nodeName);
+
+            // 危险标签：连同内容一起丢掉
+            if (in_array($tag, self::DROP_TAGS, true)) {
+                $node->removeChild($child);
+                continue;
+            }
+
+            // 非白名单标签：只拆掉外壳，保留内容（如 font/center 等富文本残留）
+            if (!in_array($tag, self::ALLOW_TAGS, true)) {
+                self::walk($child);
+                self::unwrap($child);
+                continue;
+            }
+
+            self::cleanAttrs($child);
+            self::walk($child);
+        }
+    }
+
+    /**
+     * 拆掉元素外壳，把子节点提到父级
+     */
+    private static function unwrap(\DOMElement $el): void
+    {
+        $parent = $el->parentNode;
+        if (!$parent) {
+            return;
+        }
+
+        $children = [];
+        foreach ($el->childNodes as $c) {
+            $children[] = $c;
+        }
+        foreach ($children as $c) {
+            $parent->insertBefore($c, $el);
+        }
+        $parent->removeChild($el);
+    }
+
+    /**
+     * 属性白名单 + URL 协议校验
+     */
+    private static function cleanAttrs(\DOMElement $el): void
+    {
+        $names = [];
+        foreach ($el->attributes as $attr) {
+            $names[] = $attr->nodeName;
+        }
+
+        foreach ($names as $name) {
+            $lname = strtolower($name);
+            $value = (string) $el->getAttribute($name);
+
+            // on* 事件属性一律删除（白名单里本来也没有，这里是双保险）
+            if (strpos($lname, 'on') === 0) {
+                $el->removeAttribute($name);
+                continue;
+            }
+
+            if (!in_array($lname, self::ALLOW_ATTR, true)) {
+                $el->removeAttribute($name);
+                continue;
+            }
+
+            // src / href 必须走安全协议
+            if (($lname === 'src' || $lname === 'href') && self::isUnsafeUrl($value)) {
+                $el->removeAttribute($name);
+                continue;
+            }
+
+            // style 里禁止 expression / javascript / url() 等可执行写法
+            if ($lname === 'style' && preg_match('/(expression|javascript|vbscript|url\s*\()/i', $value)) {
+                $el->removeAttribute($name);
+                continue;
+            }
+        }
+
+        // 链接统一加 rel：防 window.opener 劫持 + 不向站外传递权重
+        if (strtolower($el->nodeName) === 'a' && $el->getAttribute('href') !== '') {
+            $el->setAttribute('rel', 'nofollow noopener noreferrer');
+        }
+    }
+
+    /**
+     * URL 是否不安全
+     */
+    private static function isUnsafeUrl(string $value): bool
+    {
+        $v = strtolower((string) preg_replace('/[\s\x00-\x1f]/', '', $value));
+        if ($v === '') {
+            return true;
+        }
+        // 可执行协议
+        if (preg_match('/^(javascript|vbscript|file|about|blob):/', $v)) {
+            return true;
+        }
+        // data: 仅允许图片
+        if (preg_match('/^data:/', $v) && !preg_match('/^data:image\//', $v)) {
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * 降级方案（DOM 不可用时）：粗过滤危险标签
+     */
+    private static function fallback(string $html): string
+    {
+        $html = (string) preg_replace('#<\s*(script|style|iframe|object|embed|form)\b[^>]*>.*?<\s*/\s*\1\s*>#is', '', $html);
+        $html = (string) preg_replace('/\son[a-z]+\s*=\s*(".*?"|\'.*?\'|[^\s>]+)/is', '', $html);
+        return strip_tags($html, '<p><br><div><span><h1><h2><h3><h4><h5><h6><ul><ol><li><blockquote><pre><code><strong><b><em><i><u><s><a><img><table><thead><tbody><tr><td><th><hr><figure><figcaption>');
+    }
+}

addon/articles/menu.json

@@ -3,14 +3,28 @@
   "backend": [
   
       
+        {
+          "name": "dashboard",
+          "title": "仪表盘",
+          "icon": "fa fa-dashboard",
+          "type": 2,
+          "sort": 5,
+          "route": "articles/backend/dashboard/index"
+        },
         {
           "name": "article/index",
           "title": "文章列表",
+          "icon": "fa fa-list",
+          "type": 2,
+          "sort": 10,
           "route": "articles/backend/article/index"
         },
         {
-          "name": "article/index/index",
+          "name": "category/index",
           "title": "分类管理",
+          "icon": "fa fa-list",
+          "type": 2,
+          "sort": 20,
           "route": "articles/backend/category/index",
           "child": [
             { "name": "category:add",    "title": "新增分类", "type": 4 },
@@ -23,9 +37,28 @@
           "title": "标签管理",
           "route": "articles/backend/tag/index"
         },
+        {
+          "name": "topic/index",
+          "title": "专题管理",
+          "icon": "fa fa-th-large",
+          "type": 2,
+          "sort": 30,
+          "route": "articles/backend/topic/index"
+        },
+        {
+          "name": "attachment/index",
+          "title": "附件管理",
+          "icon": "fa fa-paperclip",
+          "type": 2,
+          "sort": 40,
+          "route": "articles/backend/attachment/index"
+        },
         {
           "name": "comment/index",
           "title": "评论管理",
+          "icon": "fa fa-comments",
+          "type": 2,
+          "sort": 50,
           "route": "articles/backend/comment/index"
         }
     

addon/articles/middleware.php

@@ -0,0 +1,21 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+/**
+ * articles 插件应用中间件
+ *
+ * 插件被 MultiApp 解析为独立应用，主应用的 middleware.php 不覆盖插件，
+ * 因此后台写操作（文章/分类/标签/评论的增改删）默认没有 CSRF 防护。
+ * 这里注册 VerifyCsrfToken（默认同源校验，不强制 token），
+ * 并须同时把 'articles' 加入 config/csrf.php 的 session_apps 白名单。
+ */
+return [
+    \ywxapp\middleware\VerifyCsrfToken::class,
+];

addon/articles/model/Article.php

@@ -8,6 +8,8 @@ declare (strict_types = 1);
 
 namespace addon\articles\model;
 
+use think\facade\Cache;
+use think\facade\Db;
 use think\model\concern\SoftDelete;
 use ywxapp\model\BaseModel;
 
@@ -31,12 +33,61 @@ class Article extends BaseModel
         'view_count'   => 'integer',
         'comment_count'=> 'integer',
         'like_count'   => 'integer',
+        'publish_time' => 'integer',
     ];
 
-    // 发布中（未删除、已发布）
+    /**
+     * 发布中：未删除 + 已发布 + 已到定时发布时间
+     *
+     * status 语义：1=发布 0=草稿 2=待审核（前台投稿）
+     */
     public function scopeNormal($query)
     {
-        $query->where('delete_at', 0)->where('status', 1);
+        $query->where('delete_at', 0)
+            ->where('status', 1)
+            ->where(function ($q) {
+                // 定时发布：0 表示立即发布，否则到点后才对外可见
+                $q->where('publish_time', 0)->whereOr('publish_time', '<=', time());
+            });
+    }
+
+    /**
+     * 待审核（前台投稿后等待后台审核）
+     */
+    public function scopePending($query)
+    {
+        $query->where('delete_at', 0)->where('status', 2);
+    }
+
+    /**
+     * 列表场景的字段列表（动态生成，排除 longtext content）
+     *
+     * 为什么不写死列名：
+     *   1. 排除式 field('content', true) 与 bind 关联组合时会生成 SELECT `content`，
+     *      列表所有字段变 null（实测踩过）；
+     *   2. 写死列名（如 like_count）在线上老库缺列时直接 Unknown column 报错。
+     * 因此改为按 SHOW COLUMNS 动态取列并排除 content，结果缓存 1 小时。
+     */
+    public static function listFields(): string
+    {
+        $cacheKey = 'articles:list_fields';
+        $fields   = Cache::get($cacheKey);
+
+        if (!is_array($fields) || empty($fields)) {
+            $table = Db::name('articles_article')->getTable();
+            $cols  = Db::query('SHOW COLUMNS FROM `' . $table . '`');
+            $fields = [];
+            foreach ($cols as $col) {
+                $name = $col['Field'] ?? '';
+                if ($name === '' || strtolower($name) === 'content') {
+                    continue;
+                }
+                $fields[] = '`' . $name . '`';
+            }
+            Cache::set($cacheKey, $fields, 3600);
+        }
+
+        return implode(',', $fields);
     }
 
     public function category()
@@ -61,7 +112,8 @@ class Article extends BaseModel
      */
     public static function listArticles(array $where = [], int $page = 1, int $size = 10, string $order = 'is_top desc, create_at desc')
     {
-        $query = self::with(['category'])->scope('normal');
+        // 列表排除正文（longtext），字段由 listFields() 动态生成
+        $query = self::with(['category'])->field(self::listFields())->scope('normal');
 
         if (!empty($where['cid'])) {
             $query->where('cid', $where['cid']);
@@ -72,9 +124,14 @@ class Article extends BaseModel
         }
         if (!empty($where['keyword'])) {
             $kw = $where['keyword'];
-            $query->where(function ($q) use ($kw) {
-                $q->whereLike('title', "%{$kw}%")->whereOr('summary', 'like', "%{$kw}%");
-            });
+            if (self::fulltextAvailable()) {
+                // 全文索引可用：走 MATCH AGAINST（布尔模式 + 前缀通配）
+                $query->whereRaw('MATCH(`title`,`summary`) AGAINST (? IN BOOLEAN MODE)', [$kw . '*']);
+            } else {
+                $query->where(function ($q) use ($kw) {
+                    $q->whereLike('title', "%{$kw}%")->whereOr('summary', 'like', "%{$kw}%");
+                });
+            }
         }
         if (!empty($where['is_recommend'])) {
             $query->where('is_recommend', 1);
@@ -86,6 +143,38 @@ class Article extends BaseModel
         ]);
     }
 
+    /**
+     * 全文索引是否可用（配置开启 + 索引真实存在，结果缓存 1 小时）
+     *
+     * 不可用时搜索自动降级为 LIKE，不会报错。
+     */
+    public static function fulltextAvailable(): bool
+    {
+        $cfg = \ywxapp\service\AddonService::config('articles');
+        if (empty($cfg['search_fulltext'])) {
+            return false;
+        }
+
+        $flag = Cache::get('articles:fulltext');
+        if ($flag === null) {
+            $flag = 0;
+            try {
+                $table = Db::name('articles_article')->getTable();
+                foreach (Db::query("SHOW INDEX FROM `{$table}`") as $row) {
+                    if (($row['Index_type'] ?? '') === 'FULLTEXT') {
+                        $flag = 1;
+                        break;
+                    }
+                }
+            } catch (\Throwable $e) {
+                $flag = 0;
+            }
+            Cache::set('articles:fulltext', $flag, 3600);
+        }
+
+        return (int) $flag === 1;
+    }
+
     public static function getDetail(int $id)
     {
         return self::with(['category', 'tags', 'author'])
@@ -120,22 +209,109 @@ class Article extends BaseModel
             ->select();
     }
 
-    public static function related(int $id, int $cid = 0, int $limit = 5)
+    /**
+     * 相关推荐（打分排序 + 缓存 10 分钟）
+     *
+     * 打分维度：
+     *   - 标签重合：每个共同标签 +10（信号最强）
+     *   - 同分类：+5
+     *   - 新鲜度：30 天内线性衰减，最多 +5
+     *   - 热度：浏览量轻微加成，最多 +3
+     *
+     * 候选池限制在「同分类最近 100 篇 + 有共同标签的最近 200 条关联」，
+     * 并一次性批量取标签（避免 N+1），保证大数据量下也可控。
+     *
+     * @return array 推荐文章数组（id/title/cid/view_count/score）
+     */
+    public static function related(int $id, int $cid = 0, int $limit = 5): array
     {
-        $query = self::scope('normal')->where('id', '<>', $id);
-        if ($cid) {
-            $query->where('cid', $cid);
+        $limit = max(1, min((int) $limit, 20));
+        $key   = 'articles:related:' . $id . ':' . $limit;
+
+        $cached = Cache::get($key);
+        if (is_array($cached)) {
+            return $cached;
         }
-        return $query->order('create_at', 'desc')
-            ->limit($limit)
-            ->field('id,title,cid')
-            ->select();
+
+        $myTags = array_map('intval', ArticleArticleTag::where('aid', $id)->column('tid'));
+
+        // 1) 候选池
+        $pool = [];
+        $sameCat = self::scope('normal')
+            ->where('id', '<>', $id)
+            ->when($cid > 0, function ($q) use ($cid) {
+                $q->where('cid', $cid);
+            })
+            ->field('id,title,cid,create_at,view_count')
+            ->order('create_at', 'desc')
+            ->limit(100)
+            ->select()
+            ->toArray();
+        foreach ($sameCat as $row) {
+            $pool[(int) $row['id']] = $row;
+        }
+
+        if ($myTags) {
+            $aids = ArticleArticleTag::whereIn('tid', $myTags)
+                ->where('aid', '<>', $id)
+                ->limit(200)
+                ->column('aid');
+            if ($aids) {
+                $byTag = self::scope('normal')
+                    ->whereIn('id', $aids)
+                    ->field('id,title,cid,create_at,view_count')
+                    ->select()
+                    ->toArray();
+                foreach ($byTag as $row) {
+                    $pool[(int) $row['id']] = $row;
+                }
+            }
+        }
+
+        if (empty($pool)) {
+            return [];
+        }
+
+        // 2) 批量取候选文章的标签（避免逐篇查询）
+        $tagMap = [];
+        foreach (ArticleArticleTag::whereIn('aid', array_keys($pool))->select()->toArray() as $row) {
+            $tagMap[(int) $row['aid']][] = (int) $row['tid'];
+        }
+
+        // 3) 打分
+        $now    = time();
+        $scored = [];
+        foreach ($pool as $aid => $row) {
+            $common = $myTags ? count(array_intersect($myTags, $tagMap[$aid] ?? [])) : 0;
+
+            $created = $row['create_at'] ?? 0;
+            $ts      = is_numeric($created) ? (int) $created : (int) strtotime((string) $created);
+            $days    = max(0, ($now - $ts) / 86400);
+
+            $score  = $common * 10;
+            $score += ($cid > 0 && (int) $row['cid'] === (int) $cid) ? 5 : 0;
+            $score += max(0, 30 - $days) / 30 * 5;
+            $score += min(((int) ($row['view_count'] ?? 0)) / 100, 3);
+
+            $row['score'] = round($score, 2);
+            $scored[]     = $row;
+        }
+
+        usort($scored, function ($a, $b) {
+            return $b['score'] <=> $a['score'];
+        });
+
+        $result = array_slice($scored, 0, $limit);
+        Cache::set($key, $result, 600);
+
+        return $result;
     }
 
     public static function ensureSchema(): void
     {
-        $prefix = self::currentPrefix();
-        self::ensureTableFromInstall($prefix, 'articles_article');
-        self::ensureTableFromInstall($prefix, 'articles_article_tag');
+        // 统一交给 ArticleSchema：它解析的是**插件自身** install.sql。
+        // 旧的 ensureTableFromInstall() 读的是核心 public/install/install.sql，
+        // 本插件表不在其中，等于空操作。
+        \addon\articles\library\ArticleSchema::ensure();
     }
 }

addon/articles/model/ArticleArticleTag.php

@@ -24,14 +24,21 @@ class ArticleArticleTag extends Pivot
     protected $name = 'articles_article_tag';
     public $autoWriteTimestamp = false;
 
+    /**
+     * 同步文章标签（先删后插）
+     *
+     * 包事务：中途失败会回滚，避免出现「旧标签已删、新标签没插上」的半截状态。
+     */
     public static function syncTags(int $aid, array $tagIds): void
     {
-        self::where('aid', $aid)->delete();
-        $data = array_map(function ($tid) use ($aid) {
-            return ['aid' => $aid, 'tid' => $tid];
-        }, $tagIds);
-        if ($data) {
-            self::insertAll($data);
-        }
+        \think\facade\Db::transaction(function () use ($aid, $tagIds) {
+            self::where('aid', $aid)->delete();
+            $data = array_map(function ($tid) use ($aid) {
+                return ['aid' => $aid, 'tid' => $tid];
+            }, $tagIds);
+            if ($data) {
+                self::insertAll($data);
+            }
+        });
     }
 }

addon/articles/model/ArticleAttachment.php

@@ -0,0 +1,77 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\model;
+
+use ywxapp\model\BaseModel;
+
+/**
+ * 附件模型
+ *
+ * 记录通过上传接口产生的文件（图片/文档等），便于后台统一查看与清理。
+ * 文件本身由框架 FileStorageService 落盘，这里只存元数据。
+ */
+class ArticleAttachment extends BaseModel
+{
+    protected $name = 'articles_attachment';
+
+    protected $autoWriteTimestamp = false;
+
+    protected $type = [
+        'uid'  => 'integer',
+        'size' => 'integer',
+        'aid'  => 'integer',
+    ];
+
+    /**
+     * 记录一次上传
+     *
+     * @param array $file 上传结果（含 url/path/size/mime 等，字段缺失时自动降级）
+     * @param int   $uid  上传者
+     * @param int   $aid  关联文章ID（0=未关联）
+     */
+    public static function record(array $file, int $uid = 0, int $aid = 0): self
+    {
+        $url  = (string) ($file['url'] ?? $file['path'] ?? '');
+        $name = (string) ($file['name'] ?? basename($url));
+
+        return self::create([
+            'uid'       => $uid,
+            'name'      => $name,
+            'url'       => $url,
+            'path'      => (string) ($file['path'] ?? ''),
+            'ext'       => strtolower(pathinfo($name, PATHINFO_EXTENSION)),
+            'mime'      => (string) ($file['mime'] ?? ''),
+            'size'      => (int) ($file['size'] ?? 0),
+            'aid'       => $aid,
+            'create_at' => time(),
+        ]);
+    }
+
+    /**
+     * 人类可读大小
+     */
+    public function getSizeTextAttr(): string
+    {
+        $size = (int) ($this->size ?? 0);
+        if ($size < 1024) {
+            return $size . ' B';
+        }
+        if ($size < 1048576) {
+            return round($size / 1024, 1) . ' KB';
+        }
+        return round($size / 1048576, 2) . ' MB';
+    }
+
+    public static function ensureSchema(): void
+    {
+        \addon\articles\library\ArticleSchema::ensure();
+    }
+}

addon/articles/model/ArticleComment.php

@@ -46,16 +46,55 @@ class ArticleComment extends BaseModel
             ->bind(['nickname', 'avatar']);
     }
 
+    /**
+     * 所属文章（后台评论列表 with(['article']) 依赖此关联）
+     */
+    public function article()
+    {
+        return $this->belongsTo(Article::class, 'aid', 'id');
+    }
+
+    /**
+     * 文章评论（只取顶层评论，回复由 repliesOf() 带出）
+     */
     public static function getByArticle(int $aid, int $page = 1, int $size = 10)
     {
         return self::with(['user'])
             ->where('delete_at', 0)
             ->where('aid', $aid)
             ->where('status', 1)
-            ->order('id', 'asc')
+            ->where('pid', 0)
+            ->order('id', 'desc')
             ->paginate(['list_rows' => $size, 'page' => $page]);
     }
 
+    /**
+     * 取指定父评论下的全部回复，按父评论ID分组
+     *
+     * @param array $parentIds 顶层评论ID数组
+     * @return array [父评论ID => 回复列表]
+     */
+    public static function repliesOf(array $parentIds): array
+    {
+        $parentIds = array_values(array_filter(array_map('intval', $parentIds)));
+        if (empty($parentIds)) {
+            return [];
+        }
+
+        $rows = self::with(['user'])
+            ->whereIn('pid', $parentIds)
+            ->where('delete_at', 0)
+            ->where('status', 1)
+            ->order('id', 'asc')
+            ->select();
+
+        $map = [];
+        foreach ($rows as $r) {
+            $map[(int) $r->pid][] = $r;
+        }
+        return $map;
+    }
+
     public static function ensureSchema(): void
     {
         $prefix = self::currentPrefix();

addon/articles/model/ArticleFavorite.php

@@ -0,0 +1,33 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\model;
+
+use ywxapp\model\BaseModel;
+
+/**
+ * 文章收藏模型（唯一键 uid+aid 防重复收藏）
+ */
+class ArticleFavorite extends BaseModel
+{
+    protected $name = 'articles_favorite';
+
+    protected $autoWriteTimestamp = false;
+
+    protected $type = [
+        'uid' => 'integer',
+        'aid' => 'integer',
+    ];
+
+    public static function ensureSchema(): void
+    {
+        \addon\articles\library\ArticleSchema::ensure();
+    }
+}

addon/articles/model/ArticleLike.php

@@ -0,0 +1,43 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\model;
+
+use ywxapp\model\BaseModel;
+
+/**
+ * 点赞记录模型
+ *
+ * 唯一键 (uid, target_id, type) 保证同一用户对同一目标只能点一次赞；
+ * 计数冗余在 articles_article.like_count / articles_comment.like_count。
+ */
+class ArticleLike extends BaseModel
+{
+    /** 文章点赞 */
+    const TYPE_ARTICLE = 1;
+    /** 评论点赞 */
+    const TYPE_COMMENT = 2;
+
+    protected $name = 'articles_like';
+
+    // 只需记录创建时间，且不自动维护时间戳（由 service 显式写入）
+    protected $autoWriteTimestamp = false;
+
+    protected $type = [
+        'uid'       => 'integer',
+        'target_id' => 'integer',
+        'type'      => 'integer',
+    ];
+
+    public static function ensureSchema(): void
+    {
+        \addon\articles\library\ArticleSchema::ensure();
+    }
+}

addon/articles/model/ArticleTopic.php

@@ -0,0 +1,65 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\model;
+
+use think\model\concern\SoftDelete;
+use ywxapp\model\BaseModel;
+
+/**
+ * 文章专题模型
+ *
+ * 专题 = 人工策划的聚合页：把若干文章归到一个主题下，
+ * 用于运营落地页（如「新手入门」「年度盘点」）。
+ */
+class ArticleTopic extends BaseModel
+{
+    use SoftDelete;
+
+    protected $name = 'articles_topic';
+    protected $deleteTime = 'delete_at';
+    protected $defaultSoftDelete = 0;
+
+    protected $autoWriteTimestamp = true;
+    protected $createTime = 'create_at';
+    protected $updateTime = 'update_at';
+
+    protected $type = [
+        'status' => 'integer',
+        'sort'   => 'integer',
+    ];
+
+    /** 启用中 */
+    public function scopeEnable($query)
+    {
+        $query->where('delete_at', 0)->where('status', 1);
+    }
+
+    /**
+     * 专题下的文章（多对多）
+     */
+    public function articles()
+    {
+        return $this->belongsToMany(Article::class, ArticleTopicArticle::class, 'aid', 'tid');
+    }
+
+    /**
+     * 按别名取启用专题
+     */
+    public static function enabledByAlias(string $alias)
+    {
+        return self::scope('enable')->where('alias', $alias)->find();
+    }
+
+    public static function ensureSchema(): void
+    {
+        \addon\articles\library\ArticleSchema::ensure();
+    }
+}

addon/articles/model/ArticleTopicArticle.php

@@ -0,0 +1,73 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\model;
+
+use think\facade\Db;
+use think\model\Pivot;
+use ywxapp\model\BaseModel;
+
+/**
+ * 专题-文章关联模型
+ */
+class ArticleTopicArticle extends Pivot
+{
+    protected $name = 'articles_topic_article';
+
+    public $autoWriteTimestamp = false;
+
+    /**
+     * 某专题下的文章ID（按专题内排序）
+     */
+    public static function articleIdsOf(int $tid): array
+    {
+        if ($tid <= 0) {
+            return [];
+        }
+        return self::where('tid', $tid)->order('sort', 'asc')->order('aid', 'desc')->column('aid');
+    }
+
+    /**
+     * 某文章所属的专题ID
+     */
+    public static function topicIdsOf(int $aid): array
+    {
+        if ($aid <= 0) {
+            return [];
+        }
+        return self::where('aid', $aid)->column('tid');
+    }
+
+    /**
+     * 同步专题下的文章（先删后插，事务保护）
+     *
+     * @param int   $tid  专题ID
+     * @param array $aids 文章ID数组（顺序即专题内排序）
+     */
+    public static function syncArticles(int $tid, array $aids): void
+    {
+        Db::transaction(function () use ($tid, $aids) {
+            self::where('tid', $tid)->delete();
+
+            $data = [];
+            $sort = 0;
+            foreach ($aids as $aid) {
+                $aid = (int) $aid;
+                if ($aid <= 0) {
+                    continue;
+                }
+                $data[] = ['tid' => $tid, 'aid' => $aid, 'sort' => $sort++];
+            }
+            if ($data) {
+                self::insertAll($data);
+            }
+        });
+    }
+}

addon/articles/route/app.php

@@ -23,25 +23,69 @@ Route::get('category/:id', 'addon\articles\controller\Category@index');
 Route::get('tag/index', 'addon\articles\controller\Tag@index');
 Route::get('tag/:id', 'addon\articles\controller\Tag@index');
 Route::get('search/index', 'addon\articles\controller\Article@search');
+
+// 专题聚合页
+Route::get('topic', 'addon\articles\controller\Topic@index');
+Route::get('topic/index', 'addon\articles\controller\Topic@index');
+Route::get('topic/:id', 'addon\articles\controller\Topic@detail');
 Route::post('article/comment', 'addon\articles\controller\Article@comment');
+Route::post('article/like', 'addon\articles\controller\Article@like');
+Route::post('article/favorite', 'addon\articles\controller\Article@favorite');
 
-// 后台（直接把 backend/ 写进 rule 路径，避免嵌套 Route::group('backend') 产生的歧义）
-// 实测结论：无论用嵌套 Route::group('backend') 还是把 backend 写进 rule 路径，
-// loadAddonRoutes 的外层 Route::group('articles') 都会把 backend 层级拼成「带点」形式
-// → 真实 URL 固定为 /articles/backend.category/index.html（斜杠形式恒 404）。
-// 故后台 URL 统一用带点，menu.json 的 jump 与视图 {:url('articles/backend.xxx/yyy')} 均须用带点。
-// 注意：不能用 wxchat 的 ->prefix('backend/') 写法——articles 后台控制器在 controller/backend/ 子目录，
-// prefix 会让 TP 解析成 backend/backend/Category 导致 500（实测）。
+// SEO：站点地图（文章 > 5000 条时 sitemap.xml 输出 index，文章拆到 sitemap-<n>.xml）
+Route::get('sitemap.xml', 'addon\articles\controller\Sitemap@index');
+Route::get('sitemap-:page.xml', 'addon\articles\controller\Sitemap@chunk');
 
+// 对外 API（/articles/api/...，继承 ApiBase，走 JWT 登录态；游客可访问列表/详情/搜索）
+Route::group('api', function () {
+    Route::get('articles', 'api.Article/index');
+    Route::get('article/:id', 'api.Article/read');
+    Route::get('categories', 'api.Article/categories');
+    Route::get('tags', 'api.Article/tags');
+    Route::get('search', 'api.Article/search');
+    Route::post('comment', 'api.Article/comment');
+});
 
+// 会员中心投稿（/articles/member/article/...，必须登录，投稿后为待审核状态）
+Route::group('member', function () {
+    Route::get('article/index', 'Article/index');
+    Route::get('article/add', 'Article/add');
+    Route::get('article/edit', 'Article/edit');
+    Route::post('article/save', 'Article/save');
+    Route::post('article/delete', 'Article/delete');
+})->layer('member');
 
+// 后台
+// 实测结论（已校准，勿改回点号）：
+//   1. 真实 URL 是【斜杠】形式 —— /articles/backend/article/index.html
+//      （外层 Route::group('articles') 只补插件名前缀，不会把 backend 拼成带点形式）
+//   2. 早期注释里"拼成带点形式 / 斜杠恒 404 / 必须用点号"的说法已过时。点号 URL
+//      （articles/backend.article/index）匹配不到已注册规则 → 走兜底控制器解析：
+//      Windows 下文件名大小写不敏感可能碰巧命中，Linux 必然 404；且兜底不校验 HTTP
+//      方法，会让 Route::post('article/delete') 的方法限制失效（GET 即可删除）。
+//   3. 故：menu.json 的 route、视图 {:url('articles/backend/xxx/yyy')}、
+//      控制器的跳转/返回 url 一律用斜杠形式。
+//   4. 不能用 wxchat 的 ->prefix('backend/') 写法——本插件后台控制器已在
+//      controller/backend/ 子目录，prefix 会让 TP 解析成 backend/backend/Category 导致 500。
+//   5. ->layer('backend') 负责把 'Article/index' 解析到 controller/backend/Article.php。
 
 Route::group('backend', function () {
+    // 无 index 段的等价形态（兼容控制器/模板里的 '/articles/backend/article' 旧跳转）
+    Route::get('article', 'Article/index');
+    Route::get('tag', 'Tag/index');
+    Route::get('category', 'Category/index');
+
+    Route::get('dashboard/index', 'Dashboard/index');
+    Route::get('dashboard', 'Dashboard/index');
+
     Route::get('article/index', 'Article/index');
     Route::any('article/save', 'Article/save');
     Route::get('article/edit', 'Article/edit');
     Route::post('article/update', 'Article/update');
     Route::post('article/delete', 'Article/delete');
+    Route::post('article/batchDelete', 'Article/batchDelete');
+    Route::post('article/batchStatus', 'Article/batchStatus');
+    Route::post('article/audit', 'Article/audit');
     Route::post('article/recyclebin', 'Article/recyclebin');
     Route::post('article/restore', 'Article/restore');
 
@@ -55,6 +99,16 @@ Route::group('backend', function () {
     Route::post('comment/audit', 'Comment/audit');
     Route::post('comment/delete', 'Comment/delete');
 
+    Route::get('topic/index', 'Topic/index');
+    Route::any('topic/save', 'Topic/save');
+    Route::get('topic/edit', 'Topic/edit');
+    Route::post('topic/update', 'Topic/update');
+    Route::post('topic/delete', 'Topic/delete');
+
+    Route::get('attachment/index', 'Attachment/index');
+    Route::post('attachment/upload', 'Attachment/upload');
+    Route::post('attachment/delete', 'Attachment/delete');
+
     Route::get('category/index', 'Category/index');
     Route::any('category/save', 'Category/save');
     Route::get('category/edit', 'Category/edit');

addon/articles/service/ContentRenderService.php

@@ -0,0 +1,163 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\service;
+
+/**
+ * 正文渲染服务（输出期增强，不改动入库内容）
+ *
+ * 三件事：
+ *   1. 图片懒加载：给 <img> 加 loading="lazy" decoding="async"
+ *   2. WebP：浏览器支持时把站内图片替换为 .webp 副本（见 ImageService）
+ *   3. 内链：把命中的关键词（如本文标签）替换为站内链接，利于收录与导流
+ *
+ * 全部基于 DOM 操作，不会破坏原有 HTML 结构；DOM 不可用时原样返回。
+ */
+class ContentRenderService
+{
+    /** 单篇文章最多生成的内链数 */
+    const MAX_LINKS = 5;
+
+    /**
+     * 渲染正文
+     *
+     * @param string $html          已净化的正文
+     * @param array  $linkKeywords  [关键词 => 链接地址]
+     * @param bool   $useWebp       是否启用 WebP 替换
+     */
+    public static function render(string $html, array $linkKeywords = [], bool $useWebp = false): string
+    {
+        $html = trim($html);
+        if ($html === '' || !class_exists('DOMDocument')) {
+            return $html;
+        }
+
+        $prev   = libxml_use_internal_errors(true);
+        $doc    = new \DOMDocument('1.0', 'UTF-8');
+        $loaded = $doc->loadHTML('<?xml encoding="UTF-8">' . $html);
+        libxml_clear_errors();
+        libxml_use_internal_errors($prev);
+
+        if (!$loaded) {
+            return $html;
+        }
+
+        $body = $doc->getElementsByTagName('body')->item(0);
+        if (!$body) {
+            return $html;
+        }
+
+        self::enhanceImages($doc, $useWebp);
+
+        if (!empty($linkKeywords)) {
+            self::linkKeywords($doc, $linkKeywords);
+        }
+
+        $out = '';
+        foreach ($body->childNodes as $child) {
+            $out .= $doc->saveHTML($child);
+        }
+
+        return trim($out);
+    }
+
+    /**
+     * 图片增强：懒加载 + WebP
+     */
+    private static function enhanceImages(\DOMDocument $doc, bool $useWebp): void
+    {
+        $images = [];
+        foreach ($doc->getElementsByTagName('img') as $img) {
+            $images[] = $img;
+        }
+
+        foreach ($images as $img) {
+            $img->setAttribute('loading', 'lazy');
+            $img->setAttribute('decoding', 'async');
+
+            if (!$useWebp) {
+                continue;
+            }
+
+            $src  = (string) $img->getAttribute('src');
+            $webp = ImageService::webpUrl($src);
+            if ($webp !== '') {
+                $img->setAttribute('src', $webp);
+            }
+        }
+    }
+
+    /**
+     * 内链替换（跳过已在 <a> 内的文本，避免链接套链接）
+     */
+    private static function linkKeywords(\DOMDocument $doc, array $keywords): void
+    {
+        $xpath = new \DOMXPath($doc);
+        $nodes = $xpath->query('//text()[not(ancestor::a)]');
+        if (!$nodes || $nodes->length === 0) {
+            return;
+        }
+
+        // 先快照，避免替换过程中结构变化影响遍历
+        $list = [];
+        foreach ($nodes as $node) {
+            $list[] = $node;
+        }
+
+        $used  = [];
+        $count = 0;
+
+        foreach ($list as $node) {
+            if ($count >= self::MAX_LINKS) {
+                break;
+            }
+
+            $text = (string) $node->nodeValue;
+            if (mb_strlen(trim($text), 'UTF-8') < 2) {
+                continue;
+            }
+
+            foreach ($keywords as $kw => $url) {
+                $kw = (string) $kw;
+                if ($count >= self::MAX_LINKS || isset($used[$kw]) || mb_strlen($kw, 'UTF-8') < 2) {
+                    continue;
+                }
+
+                $pos = mb_stripos($text, $kw, 0, 'UTF-8');
+                if ($pos === false) {
+                    continue;
+                }
+
+                $before = mb_substr($text, 0, $pos, 'UTF-8');
+                $after  = mb_substr($text, $pos + mb_strlen($kw, 'UTF-8'), null, 'UTF-8');
+
+                $a = $doc->createElement('a', htmlspecialchars($kw, ENT_QUOTES, 'UTF-8'));
+                $a->setAttribute('href', (string) $url);
+                $a->setAttribute('class', 'article-inner-link');
+
+                $frag = $doc->createDocumentFragment();
+                $frag->appendChild($doc->createTextNode($before));
+                $frag->appendChild($a);
+                $frag->appendChild($doc->createTextNode($after));
+
+                $parent = $node->parentNode;
+                if (!$parent) {
+                    continue;
+                }
+                $parent->replaceChild($frag, $node);
+
+                $used[$kw] = true;
+                $count++;
+
+                break; // 每个文本节点只处理一个关键词
+            }
+        }
+    }
+}

addon/articles/service/FavoriteService.php

@@ -0,0 +1,78 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\service;
+
+use addon\articles\model\Article;
+use addon\articles\model\ArticleFavorite;
+
+/**
+ * 收藏服务
+ */
+class FavoriteService
+{
+    /**
+     * 收藏 / 取消收藏
+     *
+     * @return array ['favorited' => bool]
+     */
+    public static function toggle(int $uid, int $articleId): array
+    {
+        if ($uid <= 0 || $articleId <= 0) {
+            return ['favorited' => false];
+        }
+
+        // 只能收藏已发布且未删除的文章
+        $exists = Article::where('id', $articleId)->where('status', 1)->where('delete_at', 0)->count();
+        if (!$exists) {
+            return ['favorited' => false];
+        }
+
+        $record = ArticleFavorite::where('uid', $uid)->where('aid', $articleId)->find();
+        if ($record) {
+            $record->delete();
+            return ['favorited' => false];
+        }
+
+        ArticleFavorite::create([
+            'uid'       => $uid,
+            'aid'       => $articleId,
+            'create_at' => time(),
+        ]);
+
+        return ['favorited' => true];
+    }
+
+    /**
+     * 是否已收藏
+     */
+    public static function isFavorited(int $uid, int $articleId): bool
+    {
+        if ($uid <= 0 || $articleId <= 0) {
+            return false;
+        }
+        return (bool) ArticleFavorite::where('uid', $uid)->where('aid', $articleId)->count();
+    }
+
+    /**
+     * 我的收藏文章ID（按收藏时间倒序）
+     */
+    public static function articleIds(int $uid, int $limit = 0): array
+    {
+        if ($uid <= 0) {
+            return [];
+        }
+        $query = ArticleFavorite::where('uid', $uid)->order('id', 'desc');
+        if ($limit > 0) {
+            $query->limit($limit);
+        }
+        return $query->column('aid');
+    }
+}

addon/articles/service/ImageService.php

@@ -0,0 +1,104 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\service;
+
+/**
+ * 图片服务（WebP 副本生成）
+ *
+ * 策略：**不覆盖原图**，只在同目录生成 `原文件名.webp` 副本；
+ * 浏览器 Accept 含 image/webp 时才使用副本，否则回落原图。
+ * 依赖 GD（imagewebp）；不支持时自动回落，不影响页面。
+ */
+class ImageService
+{
+    /** WebP 输出质量 */
+    const QUALITY = 80;
+
+    /**
+     * 取 WebP 版本地址（无副本且 GD 可用时现场生成）
+     *
+     * @param string $src 站内相对路径（如 /upload/2026/01/a.jpg）
+     * @return string WebP 地址；不可用返回空串（调用方应回落到原图）
+     */
+    public static function webpUrl(string $src): string
+    {
+        // 只处理站内相对路径，跳过站外 URL、data:、已是 webp 的图
+        if ($src === '' || strpos($src, '/') !== 0) {
+            return '';
+        }
+        if (preg_match('#^data:#i', $src) || preg_match('#\.webp($|\?)#i', $src)) {
+            return '';
+        }
+
+        $root    = rtrim((string) public_path(), DIRECTORY_SEPARATOR);
+        $srcFile = $root . $src;
+        $dst     = $src . '.webp';
+        $dstFile = $root . $dst;
+
+        // 副本已存在直接用
+        if (is_file($dstFile)) {
+            return $dst;
+        }
+        if (!is_file($srcFile) || !function_exists('imagewebp')) {
+            return '';
+        }
+
+        return self::convert($srcFile, $dstFile) ? $dst : '';
+    }
+
+    /**
+     * 转换一张图为 WebP
+     */
+    private static function convert(string $srcFile, string $dstFile): bool
+    {
+        $info = @getimagesize($srcFile);
+        if (!is_array($info) || empty($info['mime'])) {
+            return false;
+        }
+
+        $im = null;
+        switch ($info['mime']) {
+            case 'image/jpeg':
+                $im = @imagecreatefromjpeg($srcFile);
+                break;
+            case 'image/png':
+                $im = @imagecreatefrompng($srcFile);
+                if ($im) {
+                    imagepalettetotruecolor($im);
+                    imagealphablending($im, true);
+                    imagesavealpha($im, true);
+                }
+                break;
+            case 'image/gif':
+                $im = @imagecreatefromgif($srcFile);
+                break;
+            case 'image/webp':
+                $im = @imagecreatefromwebp($srcFile);
+                break;
+            default:
+                return false;
+        }
+
+        if (!$im) {
+            return false;
+        }
+
+        $dir = dirname($dstFile);
+        if (!is_dir($dir)) {
+            @mkdir($dir, 0755, true);
+        }
+
+        $ok = @imagewebp($im, $dstFile, self::QUALITY);
+        imagedestroy($im);
+
+        return $ok && is_file($dstFile);
+    }
+}

addon/articles/service/LikeService.php

@@ -0,0 +1,143 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\service;
+
+use addon\articles\model\Article;
+use addon\articles\model\ArticleComment;
+use addon\articles\model\ArticleLike;
+use think\facade\Db;
+
+/**
+ * 点赞服务（文章 / 评论）
+ *
+ * 规则：
+ *   - 必须登录（游客不允许点赞，避免刷量）
+ *   - 同一用户对同一目标只能赞一次（唯一键保证），再次调用即取消
+ *   - 计数冗余在目标表的 like_count，取消时用 dec 并保证不为负
+ */
+class LikeService
+{
+    /**
+     * 文章点赞/取消
+     *
+     * @return array ['liked' => bool, 'count' => int]
+     */
+    public static function toggleArticle(int $uid, int $articleId): array
+    {
+        if ($uid <= 0 || $articleId <= 0) {
+            return ['liked' => false, 'count' => 0];
+        }
+
+        // 文章必须存在且已发布
+        $exists = Article::where('id', $articleId)->where('status', 1)->where('delete_at', 0)->count();
+        if (!$exists) {
+            return ['liked' => false, 'count' => 0];
+        }
+
+        return self::toggle($uid, $articleId, ArticleLike::TYPE_ARTICLE, 'articles_article', $articleId);
+    }
+
+    /**
+     * 评论点赞/取消
+     *
+     * @return array ['liked' => bool, 'count' => int]
+     */
+    public static function toggleComment(int $uid, int $commentId): array
+    {
+        if ($uid <= 0 || $commentId <= 0) {
+            return ['liked' => false, 'count' => 0];
+        }
+
+        $exists = ArticleComment::where('id', $commentId)->where('delete_at', 0)->count();
+        if (!$exists) {
+            return ['liked' => false, 'count' => 0];
+        }
+
+        return self::toggle($uid, $commentId, ArticleLike::TYPE_COMMENT, 'articles_comment', $commentId);
+    }
+
+    /**
+     * 是否已点赞
+     */
+    public static function isLiked(int $uid, int $targetId, int $type): bool
+    {
+        if ($uid <= 0) {
+            return false;
+        }
+        return (bool) ArticleLike::where('uid', $uid)
+            ->where('target_id', $targetId)
+            ->where('type', $type)
+            ->count();
+    }
+
+    /**
+     * 批量判断文章是否已赞（列表/详情页用，避免 N+1）
+     *
+     * @param array $ids 文章ID数组
+     * @return array 已赞的文章ID => true
+     */
+    public static function likedArticleMap(int $uid, array $ids): array
+    {
+        if ($uid <= 0 || empty($ids)) {
+            return [];
+        }
+        $rows = ArticleLike::where('uid', $uid)
+            ->where('type', ArticleLike::TYPE_ARTICLE)
+            ->whereIn('target_id', $ids)
+            ->column('target_id');
+
+        $map = [];
+        foreach ($rows as $id) {
+            $map[(int) $id] = true;
+        }
+        return $map;
+    }
+
+    /**
+     * 通用切换逻辑
+     */
+    private static function toggle(int $uid, int $targetId, int $type, string $countTable, int $targetKey): array
+    {
+        $record = ArticleLike::where('uid', $uid)
+            ->where('target_id', $targetId)
+            ->where('type', $type)
+            ->find();
+
+        if ($record) {
+            // 已赞 → 取消
+            $record->delete();
+            Db::name($countTable)->where('id', $targetKey)
+                ->where('like_count', '>', 0)
+                ->dec('like_count')
+                ->update();
+
+            return ['liked' => false, 'count' => self::count($countTable, $targetKey)];
+        }
+
+        ArticleLike::create([
+            'uid'       => $uid,
+            'target_id' => $targetId,
+            'type'      => $type,
+            'create_at' => time(),
+        ]);
+        Db::name($countTable)->where('id', $targetKey)->inc('like_count')->update();
+
+        return ['liked' => true, 'count' => self::count($countTable, $targetKey)];
+    }
+
+    /**
+     * 读取最新计数
+     */
+    private static function count(string $table, int $id): int
+    {
+        return (int) Db::name($table)->where('id', $id)->value('like_count');
+    }
+}

addon/articles/view/backend/article/edit.html

@@ -31,10 +31,23 @@
         <div class="layui-form-item">
           <label class="layui-form-label">封面图</label>
           <div class="layui-input-block">
-            <input type="text" name="cover_image" id="cover_image" value="{$article.cover_image|default=''}" class="layui-input">
+            <input type="text" name="cover_image" id="cover_image" value="{$article.cover_image|default=''}" class="layui-input" style="width:calc(100% - 120px);display:inline-block;" placeholder="图片地址，或点右侧上传">
+            <button type="button" class="layui-btn layui-btn-primary" id="cover_upload">上传</button>
+            <div style="margin-top:8px;">
+              <img id="cover_preview" src="{$article.cover_image|default=''}" alt="封面预览" style="max-height:120px;{if condition="empty($article['cover_image'])"}display:none;{/if}">
+            </div>
           </div>
         </div>
 
+        <div class="layui-form-item">
+          <label class="layui-form-label">定时发布</label>
+          <div class="layui-input-inline">
+            <input type="text" name="publish_time" id="publish_time" class="layui-input" placeholder="留空=立即发布"
+                   value="{if isset($article['publish_time']) && $article['publish_time']}{:date('Y-m-d H:i', $article['publish_time'])}{/if}">
+          </div>
+          <div class="layui-form-mid layui-word-aux">到点后自动对前台可见（状态须为「发布」）</div>
+        </div>
+
         <div class="layui-form-item">
           <label class="layui-form-label">摘要</label>
           <div class="layui-input-block">
@@ -66,7 +79,7 @@
         <div class="layui-form-item">
           <div class="layui-input-block">
             <button class="layui-btn" lay-submit lay-filter="save">保存</button>
-            <a href="{:url('articles/backend.article/index')}" class="layui-btn layui-btn-primary">返回</a>
+            <a href="{:url('articles/backend/article/index')}" class="layui-btn layui-btn-primary">返回</a>
           </div>
         </div>
       </form>
@@ -77,8 +90,41 @@
 <script src="/assets/library/ueditor/ueditor.config.js"></script>
 <script src="/assets/library/ueditor/ueditor.all.js"></script>
 <script>
-layui.use(['form', 'jquery'], function () {
-  var form = layui.form, $ = layui.jquery;
+layui.use(['form', 'jquery', 'upload', 'laydate', 'http', 'ywxapp'], function () {
+  var http = layui.http;
+  var form = layui.form, $ = layui.jquery, upload = layui.upload, laydate = layui.laydate;
+
+  laydate.render({ elem: '#publish_time', type: 'datetime' });
+
+  // 封面图上传：对接框架通用上传接口 /upload（字段名 file）
+  upload.render({
+    elem: '#cover_upload',
+    url: '/upload',
+    field: 'file',
+    accept: 'images',
+    acceptMime: 'image/*',
+    exts: 'jpg|jpeg|png|gif|webp',
+    size: 2048,
+    data: { type: 'articles' },
+    done: function (r) {
+      if (String(r.code) !== '0') {
+        layer.msg(r.message || r.msg || '上传失败');
+        return;
+      }
+      var d = r.data || {};
+      // 兼容不同驱动返回的字段名
+      var url = d.url || d.path || d.src || (typeof d === 'string' ? d : '');
+      if (!url) {
+        layer.msg('上传成功但未返回地址');
+        return;
+      }
+      $('#cover_image').val(url);
+      $('#cover_preview').attr('src', url).show();
+    },
+    error: function () {
+      layer.msg('上传失败');
+    }
+  });
 
   var ue = UE.getEditor('editor', {
     UEDITOR_HOME_URL: '/assets/library/ueditor/',
@@ -91,16 +137,10 @@ layui.use(['form', 'jquery'], function () {
 
   form.on('submit(save)', function (data) {
     data.field.content = ue.getContent();
-    $.ajax({
-      url: "{:url('articles/backend.article/update')}",
-      type: 'post',
-      data: data.field,
-      dataType: 'json',
-      success: function (r) {
+    http.post("{:url('articles/backend/article/update')}", data.field).then(function (r) {
         layer.msg(r.msg);
-        if (r.code) { setTimeout(function () { location.href = r.url || "{:url('articles/backend.article/index')}"; }, 800); }
-      }
-    });
+        if (r.code) { setTimeout(function () { location.href = r.url || "{:url('articles/backend/article/index')}"; }, 800); }
+      });
     return false;
   });
 });

addon/articles/view/backend/article/index.html

@@ -9,6 +9,7 @@
               <option value="all">全部状态</option>
               <option value="1">已发布</option>
               <option value="0">草稿</option>
+              <option value="2">待审核</option>
             </select>
           </div>
           <div class="layui-inline">
@@ -16,12 +17,18 @@
           </div>
           <div class="layui-inline">
             <button class="layui-btn" lay-submit lay-filter="search">搜索</button>
-            <a href="{:url('articles/backend.article/save')}" class="layui-btn layui-btn-normal">新建文章</a>
-            <a href="{:url('articles/backend.article/recyclebin')}" class="layui-btn layui-btn-primary">回收站</a>
+            <a href="{:url('articles/backend/article/save')}" class="layui-btn layui-btn-normal">新建文章</a>
+            <a href="{:url('articles/backend/article/recyclebin')}" class="layui-btn layui-btn-primary">回收站</a>
           </div>
         </div>
       </form>
 
+      <script type="text/html" id="batchbar">
+        <button class="layui-btn layui-btn-sm" lay-event="publish">批量发布</button>
+        <button class="layui-btn layui-btn-sm layui-btn-normal" lay-event="draft">转为草稿</button>
+        <button class="layui-btn layui-btn-sm layui-btn-danger" lay-event="batchdel">批量删除</button>
+      </script>
+
       <table class="layui-table" id="table" lay-filter="table"></table>
     </div>
   </div>
@@ -29,19 +36,23 @@
 
 <script type="text/html" id="toolbar">
   <a class="layui-btn layui-btn-xs" lay-event="edit">编辑</a>
+  <a class="layui-btn layui-btn-xs layui-btn-normal" lay-event="audit">审核</a>
   <a class="layui-btn layui-btn-xs layui-btn-danger" lay-event="del">删除</a>
 </script>
 
 <script>
-layui.use(['table', 'form'], function () {
+layui.use(['table', 'form', 'http', 'ywxapp'], function () {
+  var http = layui.http;
   var table = layui.table, form = layui.form, $ = layui.jquery;
   var tableIns = table.render({
     elem: '#table',
-    url: "{:url('articles/backend.article/index')}",
+    url: "{:url('articles/backend/article/index')}",
     method: 'post',
     where: { status: 'all' },
     page: true,
+    toolbar: '#batchbar',
     cols: [[
+      { type: 'checkbox', fixed: 'left', width: 50 },
       { field: 'id', title: 'ID', width: 70 },
       { field: 'title', title: '标题', minWidth: 200 },
       { field: 'category', title: '分类', width: 100 },
@@ -63,14 +74,56 @@ layui.use(['table', 'form'], function () {
   table.on('tool(table)', function (obj) {
     if (obj.event === 'edit') {
       location.href = obj.data.edit_url;
+    } else if (obj.event === 'audit') {
+      layer.confirm('通过选「确定」，拒绝选「取消」后可在列表里改为草稿', { title: '审核该投稿' }, function () {
+        http.post("{:url('articles/backend/article/audit')}", { id: obj.data.id, pass: 1 }).then(function (r) {
+          layer.msg(r.msg);
+          if (r.code) { setTimeout(function () { tableIns.reload(); }, 600); }
+        });
+      }, function () {
+        http.post("{:url('articles/backend/article/audit')}", { id: obj.data.id, pass: 0 }).then(function (r) {
+          layer.msg(r.msg);
+          if (r.code) { setTimeout(function () { tableIns.reload(); }, 600); }
+        });
+      });
     } else if (obj.event === 'del') {
       layer.confirm('确认删除该文章？', function () {
-        $.post("{:url('articles/backend.article/delete')}", { id: obj.data.id }, function (r) {
+        http.post("{:url('articles/backend/article/delete')}", { id: obj.data.id }).then(function (r) {
           layer.msg(r.msg);
           if (r.code) { obj.del(); }
         });
       });
     }
   });
+
+  // 批量操作（表头工具栏）
+  function selectedIds() {
+    var ids = [];
+    layui.each(table.checkStatus('table').data, function (i, row) { ids.push(row.id); });
+    return ids;
+  }
+
+  table.on('toolbar(table)', function (obj) {
+    var ids = selectedIds();
+    if (!ids.length) { layer.msg('请先勾选文章'); return; }
+
+    if (obj.event === 'publish' || obj.event === 'draft') {
+      var status = obj.event === 'publish' ? 1 : 0;
+      http.post("{:url('articles/backend/article/batchStatus')}", { ids: ids, status: status }).then(function (r) {
+        layer.msg(r.msg);
+        if (r.code) { setTimeout(function () { tableIns.reload(); }, 600); }
+      });
+      return;
+    }
+
+    if (obj.event === 'batchdel') {
+      layer.confirm('确认删除选中的 ' + ids.length + ' 篇文章？', function () {
+        http.post("{:url('articles/backend/article/batchDelete')}", { ids: ids }).then(function (r) {
+          layer.msg(r.msg);
+          if (r.code) { setTimeout(function () { tableIns.reload(); }, 600); }
+        });
+      });
+    }
+  });
 });
 </script>

addon/articles/view/backend/article/recyclebin.html

@@ -12,11 +12,12 @@
 </script>
 
 <script>
-layui.use(['table'], function () {
+layui.use(['table', 'http', 'ywxapp'], function () {
+  var http = layui.http;
   var table = layui.table;
   var tableIns = table.render({
     elem: '#table',
-    url: "{:url('articles/backend.article/recyclebin')}",
+    url: "{:url('articles/backend/article/recyclebin')}",
     method: 'post',
     page: true,
     cols: [[
@@ -28,7 +29,7 @@ layui.use(['table'], function () {
   });
   table.on('tool(table)', function (obj) {
     if (obj.event === 'restore') {
-      $.post("{:url('articles/backend.article/restore')}", { id: obj.data.id }, function (r) {
+      http.post("{:url('articles/backend/article/restore')}", { id: obj.data.id }).then(function (r) {
         layer.msg(r.msg); if (r.code) { obj.del(); }
       });
     }

addon/articles/view/backend/attachment/index.html

@@ -0,0 +1,68 @@
+<div class="layui-fluid">
+  <div class="layui-card">
+    <div class="layui-card-header">
+      附件管理
+      <button type="button" class="layui-btn layui-btn-sm layui-btn-normal" id="btnUpload" style="float:right;margin-top:6px;">上传附件</button>
+    </div>
+    <div class="layui-card-body">
+      <table class="layui-table" id="table" lay-filter="table"></table>
+    </div>
+  </div>
+</div>
+
+<script type="text/html" id="toolbar">
+  <a class="layui-btn layui-btn-xs layui-btn-normal" lay-event="view">查看</a>
+  <a class="layui-btn layui-btn-xs layui-btn-danger" lay-event="del">删除</a>
+</script>
+
+<script>
+layui.use(['table', 'upload', 'jquery', 'http', 'ywxapp'], function () {
+  var http = layui.http;
+  var table = layui.table, upload = layui.upload, $ = layui.jquery;
+
+  var tableIns = table.render({
+    elem: '#table',
+    url: "{:url('articles/backend/attachment/index')}",
+    method: 'post',
+    page: true,
+    cols: [[
+      { field: 'id', title: 'ID', width: 70 },
+      { field: 'name', title: '文件名', minWidth: 220 },
+      { field: 'ext', title: '类型', width: 90 },
+      { field: 'size_text', title: '大小', width: 100 },
+      { field: 'aid', title: '关联文章', width: 100 },
+      { field: 'create_at', title: '上传时间', width: 170 },
+      { title: '操作', width: 140, toolbar: '#toolbar' }
+    ]]
+  });
+
+  upload.render({
+    elem: '#btnUpload',
+    url: "{:url('articles/backend/attachment/upload')}",
+    field: 'file',
+    accept: 'file',
+    exts: 'jpg|jpeg|png|gif|webp|bmp|pdf|doc|docx|xls|xlsx|ppt|pptx|zip|rar|txt|csv',
+    size: 10240,
+    done: function (r) {
+      layer.msg(r.msg || '');
+      if (r.code) { setTimeout(function () { tableIns.reload(); }, 600); }
+    },
+    error: function () { layer.msg('上传失败'); }
+  });
+
+  table.on('tool(table)', function (obj) {
+    if (obj.event === 'view') {
+      if (obj.data.url) { window.open(obj.data.url, '_blank'); }
+      return;
+    }
+    if (obj.event === 'del') {
+      layer.confirm('确认删除该附件？（会一并尝试删除物理文件）', function () {
+        http.post("{:url('articles/backend/attachment/delete')}", { id: obj.data.id }).then(function (r) {
+          layer.msg(r.msg);
+          if (r.code) { obj.del(); }
+        });
+      });
+    }
+  });
+});
+</script>

addon/articles/view/backend/category/edit.html

@@ -30,7 +30,7 @@
         <div class="layui-form-item">
           <div class="layui-input-block">
             <button class="layui-btn" lay-submit lay-filter="save">保存</button>
-            <a href="{:url('articles/backend.category/index')}" class="layui-btn layui-btn-primary">返回</a>
+            <a href="{:url('articles/backend/category/index')}" class="layui-btn layui-btn-primary">返回</a>
           </div>
         </div>
       </form>
@@ -39,12 +39,13 @@
 </div>
 
 <script>
-layui.use(['form', 'jquery'], function () {
+layui.use(['form', 'jquery', 'http', 'ywxapp'], function () {
+  var http = layui.http;
   var form = layui.form, $ = layui.jquery;
   form.on('submit(save)', function (data) {
-    $.post("{:url('articles/backend.category/update')}", data.field, function (r) {
+    http.post("{:url('articles/backend/category/update')}", data.field).then(function (r) {
       layer.msg(r.msg); if (r.code) { setTimeout(function () { location.href = r.url; }, 800); }
-    }, 'json');
+    });
     return false;
   });
 });

addon/articles/view/backend/comment/index.html

@@ -30,11 +30,12 @@
 </script>
 
 <script>
-layui.use(['table', 'form'], function () {
+layui.use(['table', 'form', 'http', 'ywxapp'], function () {
+  var http = layui.http;
   var table = layui.table, form = layui.form;
   var tableIns = table.render({
     elem: '#table',
-    url: "{:url('articles/backend.comment/index')}",
+    url: "{:url('articles/backend/comment/index')}",
     method: 'post',
     where: { status: 'all' },
     page: true,
@@ -54,10 +55,10 @@ layui.use(['table', 'form'], function () {
   });
   table.on('tool(table)', function (obj) {
     if (obj.event === 'audit') {
-      $.post("{:url('articles/backend.comment/audit')}", { id: obj.data.id }, function (r) { layer.msg(r.msg); if (r.code) { obj.update({ status: '已审核' }); } });
+      http.post("{:url('articles/backend/comment/audit')}", { id: obj.data.id }).then(function (r) { layer.msg(r.msg); if (r.code) { obj.update({ status: '已审核' }); } });
     } else if (obj.event === 'del') {
       layer.confirm('确认删除该评论？', function () {
-        $.post("{:url('articles/backend.comment/delete')}", { id: obj.data.id }, function (r) { layer.msg(r.msg); if (r.code) obj.del(); });
+        http.post("{:url('articles/backend/comment/delete')}", { id: obj.data.id }).then(function (r) { layer.msg(r.msg); if (r.code) obj.del(); });
       });
     }
   });

addon/articles/view/backend/dashboard/index.html

@@ -0,0 +1,92 @@
+<div class="layui-fluid">
+  <div class="layui-row layui-col-space15">
+    <div class="layui-col-xs6 layui-col-sm4 layui-col-md3">
+      <div class="layui-card">
+        <div class="layui-card-header">文章总数</div>
+        <div class="layui-card-body" style="font-size:26px;">{$stats.total}</div>
+      </div>
+    </div>
+    <div class="layui-col-xs6 layui-col-sm4 layui-col-md3">
+      <div class="layui-card">
+        <div class="layui-card-header">已发布</div>
+        <div class="layui-card-body" style="font-size:26px;color:#5FB878;">{$stats.published}</div>
+      </div>
+    </div>
+    <div class="layui-col-xs6 layui-col-sm4 layui-col-md3">
+      <div class="layui-card">
+        <div class="layui-card-header">待审核</div>
+        <div class="layui-card-body" style="font-size:26px;color:#FFB800;">{$stats.pending}</div>
+      </div>
+    </div>
+    <div class="layui-col-xs6 layui-col-sm4 layui-col-md3">
+      <div class="layui-card">
+        <div class="layui-card-header">草稿</div>
+        <div class="layui-card-body" style="font-size:26px;">{$stats.draft}</div>
+      </div>
+    </div>
+    <div class="layui-col-xs6 layui-col-sm4 layui-col-md3">
+      <div class="layui-card">
+        <div class="layui-card-header">今日新增</div>
+        <div class="layui-card-body" style="font-size:26px;">{$stats.today}</div>
+      </div>
+    </div>
+    <div class="layui-col-xs6 layui-col-sm4 layui-col-md3">
+      <div class="layui-card">
+        <div class="layui-card-header">总浏览</div>
+        <div class="layui-card-body" style="font-size:26px;">{$stats.views}</div>
+      </div>
+    </div>
+    <div class="layui-col-xs6 layui-col-sm4 layui-col-md3">
+      <div class="layui-card">
+        <div class="layui-card-header">评论 / 待审</div>
+        <div class="layui-card-body" style="font-size:26px;">{$stats.comments} <span style="font-size:14px;color:#FF5722;">/ {$stats.pending_comments}</span></div>
+      </div>
+    </div>
+    <div class="layui-col-xs6 layui-col-sm4 layui-col-md3">
+      <div class="layui-card">
+        <div class="layui-card-header">回收站</div>
+        <div class="layui-card-body" style="font-size:26px;">{$stats.trashed}</div>
+      </div>
+    </div>
+  </div>
+
+  <div class="layui-row layui-col-space15" style="margin-top:10px;">
+    <div class="layui-col-md6">
+      <div class="layui-card">
+        <div class="layui-card-header">分类分布（Top 10）</div>
+        <div class="layui-card-body">
+          <table class="layui-table">
+            <thead><tr><th>分类</th><th>文章数</th></tr></thead>
+            <tbody>
+              {volist name='dist' id='d'}
+              <tr><td>{$d.name}</td><td>{$d.count}</td></tr>
+              {/volist}
+              {empty name='dist'}
+              <tr><td colspan="2" style="text-align:center;color:#999;">暂无分类</td></tr>
+              {/empty}
+            </tbody>
+          </table>
+        </div>
+      </div>
+    </div>
+
+    <div class="layui-col-md6">
+      <div class="layui-card">
+        <div class="layui-card-header">热门文章（按浏览）</div>
+        <div class="layui-card-body">
+          <table class="layui-table">
+            <thead><tr><th>标题</th><th>浏览</th><th>评论</th></tr></thead>
+            <tbody>
+              {volist name='hot' id='h'}
+              <tr><td>{$h.title}</td><td>{$h.view_count}</td><td>{$h.comment_count}</td></tr>
+              {/volist}
+              {empty name='hot'}
+              <tr><td colspan="3" style="text-align:center;color:#999;">暂无数据</td></tr>
+              {/empty}
+            </tbody>
+          </table>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>

addon/articles/view/backend/tag/edit.html

@@ -19,7 +19,7 @@
         <div class="layui-form-item">
           <div class="layui-input-block">
             <button class="layui-btn" lay-submit lay-filter="save">保存</button>
-            <a href="{:url('articles/backend.tag/index')}" class="layui-btn layui-btn-primary">返回</a>
+            <a href="{:url('articles/backend/tag/index')}" class="layui-btn layui-btn-primary">返回</a>
           </div>
         </div>
       </form>
@@ -28,12 +28,13 @@
 </div>
 
 <script>
-layui.use(['form', 'jquery'], function () {
+layui.use(['form', 'jquery', 'http', 'ywxapp'], function () {
+  var http = layui.http;
   var form = layui.form, $ = layui.jquery;
   form.on('submit(save)', function (data) {
-    $.post("{:url('articles/backend.tag/update')}", data.field, function (r) {
+    http.post("{:url('articles/backend/tag/update')}", data.field).then(function (r) {
       layer.msg(r.msg); if (r.code) { setTimeout(function () { location.href = r.url; }, 800); }
-    }, 'json');
+    });
     return false;
   });
 });

addon/articles/view/backend/tag/index.html

@@ -13,7 +13,8 @@
 </script>
 
 <script>
-layui.use(['table'], function () {
+layui.use(['table', 'http', 'ywxapp'], function () {
+  var http = layui.http;
   var table = layui.table;
   table.render({
     elem: '#table',
@@ -33,7 +34,7 @@ layui.use(['table'], function () {
     if (obj.event === 'edit') { location.href = obj.data.edit_url; }
     else if (obj.event === 'del') {
       layer.confirm('确认删除该标签？', function () {
-        $.post("{:url('articles/backend.tag/delete')}", { id: obj.data.id }, function (r) {
+        http.post("{:url('articles/backend.tag/delete')}", { id: obj.data.id }).then(function (r) {
           layer.msg(r.msg); if (r.code) { obj.del(); }
         });
       });

addon/articles/view/backend/topic/edit.html

@@ -0,0 +1,94 @@
+<div class="layui-fluid">
+  <div class="layui-card">
+    <div class="layui-card-header">
+      {if $topic}编辑专题{else/}新建专题{/if}
+      <a href="{:url('articles/backend/topic/index')}" class="layui-btn layui-btn-sm layui-btn-primary" style="float:right;margin-top:6px;">返回</a>
+    </div>
+    <div class="layui-card-body">
+      <form class="layui-form">
+        <input type="hidden" name="id" value="{$topic.id|default='0'}">
+
+        <div class="layui-form-item">
+          <label class="layui-form-label">专题名称</label>
+          <div class="layui-input-block">
+            <input type="text" name="title" value="{$topic.title|default=''}" required lay-verify="required" class="layui-input" placeholder="如：新手入门">
+          </div>
+        </div>
+
+        <div class="layui-form-item">
+          <label class="layui-form-label">别名</label>
+          <div class="layui-input-block">
+            <input type="text" name="alias" value="{$topic.alias|default=''}" required lay-verify="required" class="layui-input" placeholder="URL 标识，如 getting-started">
+          </div>
+        </div>
+
+        <div class="layui-form-item">
+          <label class="layui-form-label">描述</label>
+          <div class="layui-input-block">
+            <textarea name="description" class="layui-textarea" placeholder="专题简介（用于聚合页 SEO description）">{$topic.description|default=''}</textarea>
+          </div>
+        </div>
+
+        <div class="layui-form-item">
+          <label class="layui-form-label">封面图</label>
+          <div class="layui-input-block">
+            <input type="text" name="cover" value="{$topic.cover|default=''}" class="layui-input" placeholder="图片地址">
+          </div>
+        </div>
+
+        <div class="layui-form-item">
+          <label class="layui-form-label">包含文章</label>
+          <div class="layui-input-block">
+            <input type="text" name="article_ids" id="article_ids" class="layui-input"
+                   value="{if isset($picked) && $picked}{:implode(',', array_column($picked, 'id'))}{/if}"
+                   placeholder="文章ID，逗号分隔；顺序即专题内展示顺序">
+            <div style="margin-top:8px;color:#666;">
+              {volist name='picked' id='p'}
+              <span class="layui-badge layui-bg-gray">#{$p.id} {$p.title}</span>
+              {/volist}
+              {empty name='picked'}
+              <span style="color:#999;">尚未选择文章（可在文章列表查看 ID）</span>
+              {/empty}
+            </div>
+          </div>
+        </div>
+
+        <div class="layui-form-item">
+          <label class="layui-form-label">排序</label>
+          <div class="layui-input-inline">
+            <input type="number" name="sort" value="{$topic.sort|default='0'}" class="layui-input">
+          </div>
+          <div class="layui-form-mid">越大越靠前</div>
+        </div>
+
+        <div class="layui-form-item">
+          <label class="layui-form-label">状态</label>
+          <div class="layui-input-inline">
+            <input type="checkbox" name="status" value="1" {if isset($topic['status']) ? $topic['status'] : 1}checked{/if} title="启用" lay-skin="switch">
+          </div>
+        </div>
+
+        <div class="layui-form-item">
+          <div class="layui-input-block">
+            <button class="layui-btn" lay-submit lay-filter="save">保存</button>
+            <a href="{:url('articles/backend/topic/index')}" class="layui-btn layui-btn-primary">返回</a>
+          </div>
+        </div>
+      </form>
+    </div>
+  </div>
+</div>
+
+<script>
+layui.use(['form', 'http', 'ywxapp'], function () {
+  var http = layui.http;
+  var form = layui.form;
+  form.on('submit(save)', function (data) {
+    http.post("{:url('articles/backend/topic/update')}", data.field).then(function (r) {
+        layer.msg(r.msg);
+        if (r.code) { setTimeout(function () { location.href = r.url || "{:url('articles/backend/topic/index')}"; }, 800); }
+      });
+    return false;
+  });
+});
+</script>

addon/articles/view/backend/topic/index.html

@@ -0,0 +1,53 @@
+<div class="layui-fluid">
+  <div class="layui-card">
+    <div class="layui-card-header">
+      专题管理
+      <a href="{:url('articles/backend/topic/save')}" class="layui-btn layui-btn-sm layui-btn-normal" style="float:right;margin-top:6px;">新建专题</a>
+    </div>
+    <div class="layui-card-body">
+      <table class="layui-table" id="table" lay-filter="table"></table>
+    </div>
+  </div>
+</div>
+
+<script type="text/html" id="toolbar">
+  <a class="layui-btn layui-btn-xs" lay-event="edit">编辑</a>
+  <a class="layui-btn layui-btn-xs layui-btn-danger" lay-event="del">删除</a>
+</script>
+
+<script>
+layui.use(['table', 'jquery', 'http', 'ywxapp'], function () {
+  var http = layui.http;
+  var table = layui.table, $ = layui.jquery;
+
+  var tableIns = table.render({
+    elem: '#table',
+    url: "{:url('articles/backend/topic/index')}",
+    method: 'post',
+    page: true,
+    cols: [[
+      { field: 'id', title: 'ID', width: 70 },
+      { field: 'title', title: '专题名称', minWidth: 180 },
+      { field: 'alias', title: '别名', width: 140 },
+      { field: 'article_count', title: '文章数', width: 90 },
+      { field: 'sort', title: '排序', width: 80 },
+      { field: 'status', title: '状态', width: 80, templet: function (d) { return d.status ? '<span class="layui-badge layui-bg-green">启用</span>' : '<span class="layui-badge">禁用</span>'; } },
+      { field: 'create_at', title: '创建时间', width: 170 },
+      { title: '操作', width: 140, toolbar: '#toolbar' }
+    ]]
+  });
+
+  table.on('tool(table)', function (obj) {
+    if (obj.event === 'edit') {
+      location.href = obj.data.edit_url;
+    } else if (obj.event === 'del') {
+      layer.confirm('确认删除该专题？（不会删除文章本身）', function () {
+        http.post("{:url('articles/backend/topic/delete')}", { id: obj.data.id }).then(function (r) {
+          layer.msg(r.msg);
+          if (r.code) { obj.del(); }
+        });
+      });
+    }
+  });
+});
+</script>

addon/articles/view/frontend/article/detail.html

@@ -3,11 +3,26 @@
 <head>
   <meta charset="UTF-8">
   <title>{$article.title} - 文章CMS</title>
+  <meta name="keywords" content="{$article.category_name|default=''}">
+  <meta name="description" content="{$article.summary|default=''|substr=0,150}">
+  
+  <link rel="canonical" href="{:url('articles/read/' . $article.id)}">
+  {notempty name='$jsonLd'}
+  <script type="application/ld+json">{$jsonLd|raw}</script>
+  <script type="application/ld+json">{$breadcrumbLd|raw}</script>
+  {/notempty}
   <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=0">
   <link rel="stylesheet" type="text/css" href="/assets/layui/css/layui.css">
   <link rel="stylesheet" type="text/css" href="/static/articles/css/main.css">
 </head>
 <body class="micronews">
+  <!-- 阅读进度条 + 继续上次阅读 -->
+  <div id="readProgressBar" style="position:fixed;top:0;left:0;height:3px;background:#5FB878;width:0;z-index:9999;"></div>
+  <div id="readResume" style="display:none;position:fixed;right:16px;bottom:16px;background:#fff;border:1px solid #eee;padding:8px 12px;box-shadow:0 2px 8px rgba(0,0,0,.12);z-index:9999;font-size:13px;">
+    上次读到 <b id="readResumePct">0</b>% · <a href="javascript:;" id="readResumeGo" style="color:#5FB878;">继续阅读</a>
+    <a href="javascript:;" id="readResumeClose" style="margin-left:8px;color:#999;">×</a>
+  </div>
+
   <div class="micronews-header-wrap">
     <div class="micronews-header w1000 layui-clear">
       <h1 class="logo">
@@ -29,8 +44,8 @@
               <input type="text" name="keyword" placeholder="搜索你要的内容" autocomplete="off" class="layui-input">
               <button class="layui-btn search-btn" formnovalidate><i class="layui-icon layui-icon-search"></i></button>
             </div>
-          </div>-
-        </form>
+          </div>
+          </form>
       </div>
       <div class="login">
         {if $is_login}
@@ -72,6 +87,14 @@
                     <b>{$article.comment_count}</b>条
                   </span>
                 </a>
+                <a href="javascript:;" id="btnLike" class="icon like {if $liked}liked{/if}" title="点赞">
+                  <i class="layui-icon layui-icon-praise"></i>
+                  <b id="likeCount">{$article.like_count|default='0'}</b>
+                </a>
+                <a href="javascript:;" id="btnFav" class="icon fav {if $favorited}on{/if}" title="收藏">
+                  <i class="layui-icon layui-icon-star"></i>
+                  <span id="favText">{if $favorited}已收藏{else/}收藏{/if}</span>
+                </a>
                 <span class="icon time">
                   <i class="layui-icon layui-icon-log"></i>
                   {$article.create_at}
@@ -79,7 +102,7 @@
               </div>
             </div>
             <div class="article">
-              {$article.content|raw}
+              {if isset($contentHtml) && $contentHtml}{$contentHtml|raw}{else/}{$article.content|raw}{/if}
             </div>
             <div class="leave-message" id="message">
               <div class="tit-box">
@@ -105,6 +128,16 @@
                     </div>
                   </form>
                 </div>
+                <!-- 楼层回复框：点击某条评论的「回复」后展开 -->
+                <div class="reply-box" id="replyBox" style="display:none;margin:10px 0;padding:10px;border:1px solid #eee;">
+                  <div class="reply-tip" id="replyTip" style="margin-bottom:6px;color:#888;"></div>
+                  <textarea id="replyContent" class="layui-textarea" placeholder="回复内容"></textarea>
+                  <div style="text-align:right;margin-top:8px;">
+                    <button type="button" class="layui-btn layui-btn-sm layui-btn-primary" id="replyCancel">取消</button>
+                    <button type="button" class="layui-btn layui-btn-sm" id="replySubmit">提交回复</button>
+                  </div>
+                </div>
+
                 <div class="ulCommentList">
                   {volist name='comments.data' id='cm'}
                   <div class="liCont">
@@ -113,7 +146,18 @@
                       <div class="cont">
                         <p><span class="name">{$cm.nickname|default='游客'}</span><span class="time">{$cm.create_at}</span></p>
                         <p class="text">{$cm.content}</p>
+                        <p><a href="javascript:;" class="btn-reply" data-id="{$cm.id}" data-name="{$cm.nickname|default='游客'}">回复</a></p>
                       </div>
+                      {notempty name='$cm.replies'}
+                      <div class="reply-list" style="margin-left:52px;border-left:2px solid #f0f0f0;padding-left:10px;">
+                        {volist name='$cm.replies' id='rp'}
+                        <div class="reply-item">
+                          <p><span class="name">{$rp.nickname|default='游客'}</span><span class="time">{$rp.create_at}</span></p>
+                          <p class="text">{$rp.content}</p>
+                        </div>
+                        {/volist}
+                      </div>
+                      {/notempty}
                     </div>
                   </div>
                   {/volist}
@@ -186,5 +230,90 @@
       index.arrowutil();
     });
   </script>
+
+  <script>
+    // 点赞 / 楼层回复（独立于模板自带 index 模块，避免冲突）
+    layui.use(['jquery', 'layer'], function () {
+      var $ = layui.jquery, layer = layui.layer;
+      var aid        = "{$article.id}";
+      var likeUrl    = "{:url('articles/article/like')}";
+      var commentUrl = "{:url('articles/article/comment')}";
+
+      $('#btnLike').on('click', function () {
+        $.post(likeUrl, { id: aid, target: 1 }, function (r) {
+          if (!r || !r.code) { layer.msg((r && r.message) || '操作失败'); return; }
+          var d = r.data || {};
+          $('#likeCount').text(d.count || 0);
+          $('#btnLike').toggleClass('liked', !!d.liked);
+          layer.msg(r.message || (d.liked ? '已点赞' : '已取消点赞'));
+        });
+        return false;
+      });
+
+      // 收藏
+      $('#btnFav').on('click', function () {
+        $.post("{:url('articles/article/favorite')}", { id: aid }, function (r) {
+          if (!r || !r.code) { layer.msg((r && r.message) || '请先登录'); return; }
+          var on = !!(r.data && r.data.favorited);
+          $('#btnFav').toggleClass('on', on);
+          $('#favText').text(on ? '已收藏' : '收藏');
+          layer.msg(r.message || '');
+        });
+        return false;
+      });
+
+      // 阅读进度（本地记录，无需登录）
+      var bar = document.getElementById('readProgressBar');
+      var pkey = 'articles_progress_' + aid;
+      function progress() {
+        var h = document.documentElement;
+        var top = h.scrollTop || document.body.scrollTop || 0;
+        var max = (h.scrollHeight - h.clientHeight) || 0;
+        return max > 0 ? Math.min(100, Math.round(top / max * 100)) : 0;
+      }
+      window.addEventListener('scroll', function () {
+        var p = progress();
+        if (bar) { bar.style.width = p + '%'; }
+        try { localStorage.setItem(pkey, p); } catch (e) {}
+      });
+
+      var saved = 0;
+      try { saved = parseInt(localStorage.getItem(pkey) || '0', 10); } catch (e) {}
+      if (saved >= 5 && saved <= 90) {
+        $('#readResumePct').text(saved);
+        $('#readResume').show();
+        $('#readResumeGo').on('click', function () {
+          var h = document.documentElement;
+          var max = (h.scrollHeight - h.clientHeight) || 0;
+          window.scrollTo({ top: Math.round(max * saved / 100), behavior: 'smooth' });
+          $('#readResume').hide();
+        });
+        $('#readResumeClose').on('click', function () { $('#readResume').hide(); });
+      }
+
+      var replyPid = 0;
+      $(document).on('click', '.btn-reply', function () {
+        replyPid = $(this).data('id');
+        $('#replyTip').text('回复 @' + ($(this).data('name') || ''));
+        $('#replyBox').show();
+        $('#replyContent').focus();
+      });
+
+      $('#replyCancel').on('click', function () {
+        replyPid = 0;
+        $('#replyBox').hide();
+        $('#replyContent').val('');
+      });
+
+      $('#replySubmit').on('click', function () {
+        var content = $.trim($('#replyContent').val());
+        if (!content) { layer.msg('请输入回复内容'); return; }
+        $.post(commentUrl, { aid: aid, pid: replyPid, content: content }, function (r) {
+          layer.msg((r && r.message) || '已提交');
+          if (r && r.code) { setTimeout(function () { location.reload(); }, 600); }
+        });
+      });
+    });
+  </script>
 </body>
 </html>

addon/articles/view/frontend/category/index.html

@@ -3,6 +3,8 @@
 <head>
   <meta charset="UTF-8">
   <title>{$category.name|default='分类'} - 文章CMS</title>
+  <meta name="description" content="{$category.description|default=''|substr=0,150}">
+  <link rel="canonical" href="{:url('articles/category/index', ['id'=>$category.id])}">
   <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=0">
   <link rel="stylesheet" type="text/css" href="/assets/layui/css/layui.css">
   <link rel="stylesheet" type="text/css" href="/static/articles/css/main.css">

addon/articles/view/frontend/index/index.html

@@ -3,6 +3,8 @@
 <head>
   <meta charset="UTF-8">
   <title>文章CMS - 资讯中心</title>
+  <meta name="description" content="文章CMS 资讯中心">
+  <link rel="canonical" href="{:url('articles/index/index')}">
   <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=0">
   <link rel="stylesheet" type="text/css" href="/assets/layui/css/layui.css">
   <link rel="stylesheet" type="text/css" href="/static/articles/css/main.css">

addon/articles/view/frontend/search/index.html

@@ -3,6 +3,8 @@
 <head>
   <meta charset="UTF-8">
   <title>搜索：{$keyword|default=''} - 文章CMS</title>
+  {* 搜索结果页千变万化且无实质内容，禁止搜索引擎收录 *}
+  <meta name="robots" content="noindex,follow">
   <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=0">
   <link rel="stylesheet" type="text/css" href="/assets/layui/css/layui.css">
   <link rel="stylesheet" type="text/css" href="/static/articles/css/main.css">

addon/articles/view/frontend/tag/index.html

@@ -3,6 +3,7 @@
 <head>
   <meta charset="UTF-8">
   <title>{$tag.name|default='标签'} - 文章CMS</title>
+  <link rel="canonical" href="{:url('articles/tag/index', ['id'=>$tag.id])}">
   <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=0">
   <link rel="stylesheet" type="text/css" href="/assets/layui/css/layui.css">
   <link rel="stylesheet" type="text/css" href="/static/articles/css/main.css">

addon/articles/view/frontend/topic/detail.html

@@ -0,0 +1,79 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+  <meta charset="UTF-8">
+  <title>{$topic.title} - 专题 - 文章CMS</title>
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <meta name="keywords" content="{$topic.title}">
+  <meta name="description" content="{$topic.description|default=$topic.title|substr=0,150}">
+  <link rel="canonical" href="{:url('articles/topic/' . $topic.id)}">
+  <link rel="stylesheet" type="text/css" href="/assets/layui/css/layui.css">
+  <link rel="stylesheet" type="text/css" href="/static/articles/css/main.css">
+</head>
+<body class="micronews">
+  <div class="micronews-header-wrap">
+    <div class="micronews-header w1000 layui-clear">
+      <h1 class="logo">
+        <a href="{:url('articles/index/index')}">
+          <img src="/static/articles/img/LOGO.png" alt="logo">
+          <span class="layui-hide">LOGO</span>
+        </a>
+      </h1>
+      <p class="nav">
+        <a href="{:url('articles/index/index')}">最新</a>
+        <a href="{:url('articles/topic/index')}" class="active">专题</a>
+        {volist name='categories' id='c'}
+        <a href="{:url('articles/category/index', ['id'=>$c.id])}">{$c.name}</a>
+        {/volist}
+      </p>
+      <div class="search-bar">
+        <form class="layui-form" action="{:url('articles/search/index')}">
+          <div class="layui-form-item">
+            <div class="layui-input-block">
+              <input type="text" name="keyword" placeholder="搜索你要的内容" autocomplete="off" class="layui-input">
+              <button class="layui-btn search-btn" formnovalidate><i class="layui-icon layui-icon-search"></i></button>
+            </div>
+          </div>
+        </form>
+      </div>
+    </div>
+  </div>
+
+  <div class="micronews-container w1000">
+    <div class="layui-card">
+      <div class="layui-card-header">
+        <h3>{$topic.title}</h3>
+      </div>
+      <div class="layui-card-body">
+        {notempty name='$topic.description'}
+        <p style="color:#666;margin-bottom:10px;">{$topic.description}</p>
+        {/notempty}
+
+        <ul class="list-box">
+          {volist name='list' id='a'}
+          <li class="list">
+            <a href="{:url('articles/read/' . $a.id)}">{$a.title}</a>
+            <span style="color:#999;font-size:12px;margin-left:8px;">{$a.category_name|default=''} · {$a.view_count} 次阅读</span>
+          </li>
+          {/volist}
+          {empty name='list'}
+          <li class="list" style="color:#999;">该专题下暂无已发布文章</li>
+          {/empty}
+        </ul>
+
+        <div class="page-wrap">{$page|raw}</div>
+      </div>
+    </div>
+  </div>
+
+  <div class="micronews-footer-wrap">
+    <div class="micronews-footer w1000">
+      <div class="Copyright">
+        <span>Copyright&nbsp;</span>&nbsp;&copy;<span>文章CMS&nbsp;&nbsp;</span><span>Powered by YwxApp</span>
+      </div>
+    </div>
+  </div>
+
+  <script type="text/javascript" src="/assets/layui/layui.js"></script>
+</body>
+</html>

addon/articles/view/frontend/topic/index.html

@@ -0,0 +1,80 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+  <meta charset="UTF-8">
+  <title>专题汇总 - 文章CMS</title>
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <meta name="description" content="专题汇总">
+  <link rel="canonical" href="{:url('articles/topic/index')}">
+  <link rel="stylesheet" type="text/css" href="/assets/layui/css/layui.css">
+  <link rel="stylesheet" type="text/css" href="/static/articles/css/main.css">
+</head>
+<body class="micronews">
+  <div class="micronews-header-wrap">
+    <div class="micronews-header w1000 layui-clear">
+      <h1 class="logo">
+        <a href="{:url('articles/index/index')}">
+          <img src="/static/articles/img/LOGO.png" alt="logo">
+          <span class="layui-hide">LOGO</span>
+        </a>
+      </h1>
+      <p class="nav">
+        <a href="{:url('articles/index/index')}">最新</a>
+        <a href="{:url('articles/topic/index')}" class="active">专题</a>
+        {volist name='categories' id='c'}
+        <a href="{:url('articles/category/index', ['id'=>$c.id])}">{$c.name}</a>
+        {/volist}
+      </p>
+      <div class="search-bar">
+        <form class="layui-form" action="{:url('articles/search/index')}">
+          <div class="layui-form-item">
+            <div class="layui-input-block">
+              <input type="text" name="keyword" placeholder="搜索你要的内容" autocomplete="off" class="layui-input">
+              <button class="layui-btn search-btn" formnovalidate><i class="layui-icon layui-icon-search"></i></button>
+            </div>
+          </div>
+        </form>
+      </div>
+    </div>
+  </div>
+
+  <div class="micronews-container w1000">
+    <div class="layui-card">
+      <div class="layui-card-header"><h3>专题汇总</h3></div>
+      <div class="layui-card-body">
+        <div class="layui-row layui-col-space15">
+          {volist name='topics' id='t'}
+          <div class="layui-col-md4 layui-col-sm6">
+            <div class="layui-card">
+              {notempty name='$t.cover'}
+              <div style="height:140px;overflow:hidden;">
+                <img src="{$t.cover}" alt="{$t.title}" style="width:100%;">
+              </div>
+              {/notempty}
+              <div class="layui-card-body">
+                <h3><a href="{:url('articles/topic/' . $t.id)}">{$t.title}</a></h3>
+                <p style="color:#666;margin:6px 0;">{$t.description|default=''|substr=0,60}</p>
+                <span class="layui-badge layui-bg-gray">{$t.count} 篇</span>
+              </div>
+            </div>
+          </div>
+          {/volist}
+          {empty name='topics'}
+          <div class="layui-col-md12" style="text-align:center;color:#999;padding:40px 0;">暂无专题</div>
+          {/empty}
+        </div>
+      </div>
+    </div>
+  </div>
+
+  <div class="micronews-footer-wrap">
+    <div class="micronews-footer w1000">
+      <div class="Copyright">
+        <span>Copyright&nbsp;</span>&nbsp;&copy;<span>文章CMS&nbsp;&nbsp;</span><span>Powered by YwxApp</span>
+      </div>
+    </div>
+  </div>
+
+  <script type="text/javascript" src="/assets/layui/layui.js"></script>
+</body>
+</html>

addon/articles/view/member/article/edit.html

@@ -0,0 +1,92 @@
+<div class="layui-card">
+  <div class="layui-card-header">
+    {if $article}编辑稿件{else/}写文章{/if}
+    <a href="{:url('articles/member/article/index')}" class="layui-btn layui-btn-sm layui-btn-primary" style="float:right;margin-top:6px;">返回列表</a>
+  </div>
+  <div class="layui-card-body">
+    <form class="layui-form" lay-filter="contribute">
+      <input type="hidden" name="id" value="{$article.id|default='0'}">
+
+      <div class="layui-form-item">
+        <label class="layui-form-label">标题</label>
+        <div class="layui-input-block">
+          <input type="text" name="title" value="{$article.title|default=''}" required lay-verify="required" placeholder="文章标题" class="layui-input">
+        </div>
+      </div>
+
+      <div class="layui-form-item">
+        <label class="layui-form-label">分类</label>
+        <div class="layui-input-block">
+          <select name="cid" lay-verify="required">
+            {volist name='categories' id='c'}
+            <option value="{$c.id}" {if isset($article['cid']) && $article['cid'] == $c['id']}selected{/if}>{$c.name}</option>
+            {/volist}
+          </select>
+        </div>
+      </div>
+
+      <div class="layui-form-item">
+        <label class="layui-form-label">摘要</label>
+        <div class="layui-input-block">
+          <textarea name="summary" class="layui-textarea" placeholder="可选，列表页展示">{$article.summary|default=''}</textarea>
+        </div>
+      </div>
+
+      <div class="layui-form-item">
+        <label class="layui-form-label">封面图</label>
+        <div class="layui-input-block">
+          <input type="text" name="cover_image" value="{$article.cover_image|default=''}" class="layui-input" placeholder="图片地址（可留空）">
+        </div>
+      </div>
+
+      <div class="layui-form-item">
+        <label class="layui-form-label">正文</label>
+        <div class="layui-input-block">
+          <textarea id="content" name="content" style="display:none;">{$article.content|default=''}</textarea>
+          <script id="editor" type="text/plain" style="width:100%;height:380px;"></script>
+        </div>
+      </div>
+
+      <div class="layui-form-item">
+        <div class="layui-input-block">
+          <button class="layui-btn" lay-submit lay-filter="contribute">提交投稿</button>
+          <span style="color:#999;margin-left:10px;">提交后进入「待审核」，管理员通过后才会公开显示</span>
+        </div>
+      </div>
+    </form>
+  </div>
+</div>
+
+<script src="/assets/library/ueditor/ueditor.config.js"></script>
+<script src="/assets/library/ueditor/ueditor.all.js"></script>
+<script>
+layui.use(['form', 'jquery'], function () {
+  var form = layui.form, $ = layui.jquery;
+
+  var ue = UE.getEditor('editor', {
+    UEDITOR_HOME_URL: '/assets/library/ueditor/',
+    serverUrl: '/ueditor'
+  });
+  ue.ready(function () {
+    var c = $('#content').val();
+    if (c) { ue.setContent(c); }
+  });
+
+  form.on('submit(contribute)', function (data) {
+    data.field.content = ue.getContent();
+    $.ajax({
+      url: "{:url('articles/member/article/save')}",
+      type: 'post',
+      data: data.field,
+      dataType: 'json',
+      success: function (r) {
+        layer.msg(r.message || r.msg || '');
+        if (r.code === 0 || r.code === '0') {
+          setTimeout(function () { location.href = "{:url('articles/member/article/index')}"; }, 800);
+        }
+      }
+    });
+    return false;
+  });
+});
+</script>

addon/articles/view/member/article/index.html

@@ -0,0 +1,54 @@
+<div class="layui-card">
+  <div class="layui-card-header">
+    我的投稿
+    <a href="{:url('articles/member/article/add')}" class="layui-btn layui-btn-sm layui-btn-normal" style="float:right;margin-top:6px;">写文章</a>
+  </div>
+  <div class="layui-card-body">
+    <table class="layui-table">
+      <thead>
+        <tr><th>ID</th><th>标题</th><th>分类</th><th>状态</th><th>浏览</th><th>时间</th><th>操作</th></tr>
+      </thead>
+      <tbody>
+        {volist name='list' id='a'}
+        <tr>
+          <td>{$a.id}</td>
+          <td>{$a.title}</td>
+          <td>{$a.category_name|default='未分类'}</td>
+          <td>
+            {switch $a.status}
+              {case 1}<span class="layui-badge layui-bg-green">已发布</span>{/case}
+              {case 2}<span class="layui-badge layui-bg-orange">待审核</span>{/case}
+              {default /}<span class="layui-badge">草稿</span>
+            {/switch}
+          </td>
+          <td>{$a.view_count}</td>
+          <td>{$a.create_at}</td>
+          <td>
+            <a href="{:url('articles/member/article/edit', ['id'=>$a.id])}" class="layui-btn layui-btn-xs">编辑</a>
+            <a href="javascript:;" class="layui-btn layui-btn-xs layui-btn-danger btn-del" data-id="{$a.id}">删除</a>
+          </td>
+        </tr>
+        {/volist}
+        {empty name='list'}
+        <tr><td colspan="7" style="text-align:center;color:#999;">还没有投稿，点右上角「写文章」开始吧</td></tr>
+        {/empty}
+      </tbody>
+    </table>
+    <div>{$list->render()|raw}</div>
+  </div>
+</div>
+
+<script>
+layui.use(['jquery', 'layer'], function () {
+  var $ = layui.jquery, layer = layui.layer;
+  $('.btn-del').on('click', function () {
+    var id = $(this).data('id');
+    layer.confirm('确认删除这篇稿件？', function () {
+      $.post("{:url('articles/member/article/delete')}", { id: id }, function (r) {
+        layer.msg(r.message || r.msg || '');
+        if (r.code === 0 || r.code === '0') { setTimeout(function () { location.reload(); }, 600); }
+      });
+    });
+  });
+});
+</script>

addon/blog/Addon.php

@@ -10,44 +10,158 @@ declare (strict_types = 1);
 
 namespace addon\blog;
 
+use addon\blog\library\BlogSchema;
 use think\facade\Db;
 use ywxapp\AddonBase;
+use ywxapp\service\AddonService;
 
 /**
  * Addon 类
  *
+ * 注意：基类是 ywxapp\AddonBase（仓库中不存在名为 addon 的类）。
+ * 写成 extends addon 时，钩子回调会因 class_exists 失败而被静默跳过
+ * （Windows 大小写不敏感可能掩盖，Linux 必然 Class not found）。
+ *
  * @author ywxapp <admin@ywxapp.cn>
  */
-class Addon extends addon
+class Addon extends AddonBase
 {
     /**
      * 安装钩子
      *
-     * 菜单与建表/种子数据由框架统一处理，无需在此手写：
-     *  - 菜单：addon/blog/menu.json
-     *        backend    → wxapp_admin_power（后台权限/菜单，含 addon 归属）
-     *        member     → wxapp_user_rule（module='member'，会员中心）
-     *        frontend   → wxapp_user_rule（module='frontend'，前台）
-     *  - 数据：addon/blog/install.sql（建表，框架 importsql 白名单执行）
-     *
-     * 这里仅保留插件自身的额外初始化钩子（无需可留空）。
+     * 建表与种子数据由 install.sql 负责，这里补做列/索引自愈
+     * （install.sql 的 ALTER 会被框架白名单跳过）。
      */
     public function install()
     {
+        BlogSchema::ensure();
         return true;
     }
 
     /**
      * 卸载钩子
      *
-     * 框架 AddonService::deleteMenu() 只清理 admin_power，
-     * 这里补清 user_rule 中本插件的前端/会员菜单（按 name 前缀），避免残留。
-     * 采用物理删除，防止软删除后唯一键 name 冲突导致重装失败。
+     * 框架 AddonService::deleteMenu() 只清理后台权限表，这里补齐：
+     * 私有表、会员/前台菜单、插件配置、静态资源。
      */
     public function uninstall()
     {
-        Db::execute("DELETE FROM wxapp_user_rule WHERE name LIKE 'blog:%'");
-        Db::execute("DELETE FROM wxapp_admin_power WHERE addon='blog'");
+        $prefix = $this->prefix();
+
+        // 1) 插件私有表（表名从 install.sql 解析，避免硬编码与遗漏）
+        foreach ($this->tableNames() as $table) {
+            try {
+                Db::execute("DROP TABLE IF EXISTS `{$prefix}{$table}`");
+            } catch (\Throwable $e) {
+                // 单表失败不阻断整体卸载
+            }
+        }
+
+        // 2) 菜单残留：框架清后台，这里补会员中心/前台
+        //    （表名用 Db::name 自动加前缀，勿写死 wxapp_）
+        try {
+            Db::name('member_rule')->where('name', 'like', 'blog:%')->delete();
+        } catch (\Throwable $e) {
+            // 表不存在时忽略
+        }
+
+        // 3) 配置残留（框架卸载不清配置，重装会继承旧值）
+        try {
+            Db::name('common_addonconf')->where('addon', 'blog')->delete();
+        } catch (\Throwable $e) {
+            // 表不存在时忽略
+        }
+        AddonService::clearConfigCache('blog');
+
+        // 4) 静态资源（框架只清 public/static/addon/<name>/，清不到实际目录）
+        $this->deleteDirectory(public_path() . 'static' . DIRECTORY_SEPARATOR . 'blog');
+
         return true;
     }
+
+    /**
+     * 启用钩子（轻量自愈）
+     */
+    public function enable()
+    {
+        BlogSchema::ensure();
+        return true;
+    }
+
+    /**
+     * 禁用钩子
+     */
+    public function disable()
+    {
+        return true;
+    }
+
+    /**
+     * 升级钩子（覆盖升级 / addon:manage 时由框架回调）
+     *
+     * install.sql 的 ALTER 会被白名单跳过，所以老库补列补索引必须放这里。
+     *
+     * @param string $currentVersion 已安装版本号
+     */
+    public function upgrade($currentVersion = '')
+    {
+        BlogSchema::ensure();
+        // 清理已从 install.sql 移除的历史遗留表（老库升级时执行）
+        BlogSchema::dropLegacyTables();
+        return true;
+    }
+
+    /**
+     * 从 install.sql 解析插件私有表名（不含前缀）
+     */
+    private function tableNames(): array
+    {
+        $file = dirname(__DIR__) . DIRECTORY_SEPARATOR . 'install.sql';
+        if (!is_file($file)) {
+            return [];
+        }
+
+        $content = (string) file_get_contents($file);
+        preg_match_all('/CREATE TABLE IF NOT EXISTS\s+`__PREFIX__([a-z_]+)`/i', $content, $m);
+
+        return $m[1] ?? [];
+    }
+
+    /**
+     * 当前数据库表前缀
+     */
+    private function prefix(): string
+    {
+        $default = (string) config('database.default', 'mysql');
+        return (string) config("database.connections.{$default}.prefix", '');
+    }
+
+    /**
+     * 递归删除目录（卸载时清理静态资源）
+     */
+    private function deleteDirectory(string $dir): void
+    {
+        if (!is_dir($dir)) {
+            return;
+        }
+
+        $items = scandir($dir);
+        if (!is_array($items)) {
+            return;
+        }
+
+        foreach ($items as $item) {
+            if ($item === '.' || $item === '..') {
+                continue;
+            }
+            $path = $dir . DIRECTORY_SEPARATOR . $item;
+            if (is_dir($path)) {
+                $this->deleteDirectory($path);
+            } else {
+                @unlink($path);
+            }
+        }
+
+        @rmdir($dir);
+    }
 }