fix(ci): 清理悬空 workspace lock + 对齐 registry/unzip 契约

ootb@72e24e7 在 npm install 因 package-lock 残留已删 modules/packages/*
的 link:true 崩溃。同步修复 registry 解析 modules 嵌套、zip 反斜杠路径归一化，
并去重 catalog folder 解析（DRY/LSP）。

Co-authored-by: Shiroha <Tanya7z@users.noreply.github.com>

Author: cursoragent

modules/catalog.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "modules/catalog.json 是本地 mirror；source of truth 为 github:Tanya7z/sfmc-modules/main/index.json。业务模块已全部提取至 Tanya7z/sfmc-modules（最新 modules-v0.4.0）。本仓库 modules/packages/ 不再内置业务包；请用 tools/fetch-module.mjs / sfmc 从 registry 安装到 modules/packages/<id>/。",
+  "_comment": "modules/catalog.json 是本地 mirror；source of truth 为 github:Tanya7z/sfmc-modules/main/index.json。业务模块默认外置；本仓可保留开箱 fixture（如 afk）。安装/卸载后请用 tools/catalog-sync.mjs 或 fetch-module 投影。",
   "version": 1,
   "modules": [
     {

package-lock.json

@@ -54,14 +54,35 @@ function writeCache(cache: RegistryCache): void {
   }
 }
 
+/**
+ * 解析 first-party index.json。
+ * 契约与 tools/fetch-module.mjs 一致：权威映射在 `modules` 字段下
+ * (`{ version, modules: { <folder>: { repo, tag } } }`)，忽略 `_` 前缀元数据键。
+ */
+function parseRegistryIndex(json: unknown): RegistryIndex {
+  if (typeof json !== "object" || json === null || Array.isArray(json)) {
+    throw new Error("registry index must be a JSON object with a 'modules' field");
+  }
+  const root = json as Record<string, unknown>;
+  const modulesRaw = root.modules;
+  if (typeof modulesRaw !== "object" || modulesRaw === null || Array.isArray(modulesRaw)) {
+    throw new Error("registry index must have a 'modules' object mapping id → { repo, tag }");
+  }
+  const filtered: RegistryIndex = {};
+  for (const [k, v] of Object.entries(modulesRaw as Record<string, unknown>)) {
+    if (k.startsWith("_")) continue;
+    if (typeof v !== "object" || v === null || Array.isArray(v)) continue;
+    const entry = v as Record<string, unknown>;
+    if (typeof entry.repo !== "string" || typeof entry.tag !== "string") continue;
+    filtered[k] = { repo: entry.repo, tag: entry.tag };
+  }
+  return filtered;
+}
+
 async function fetchFresh(): Promise<RegistryIndex> {
   const res = await fetch(INDEX_URL, { headers: { "User-Agent": "sfmc-cli" } });
   if (!res.ok) throw new Error(`HTTP ${res.status} for ${INDEX_URL}`);
-  const json = (await res.json()) as unknown;
-  if (typeof json !== "object" || json === null || Array.isArray(json)) {
-    throw new Error("registry index must be a JSON object mapping id → { repo, tag }");
-  }
-  return json as RegistryIndex;
+  return parseRegistryIndex(await res.json());
 }
 
 export interface RegistryResult {

sfmc/src/registry.ts

@@ -14,7 +14,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { readCatalog, syncCatalogFromPackages } from "./lib/catalog.mjs";
-import { scanInstalledPackages } from "./lib/packages.mjs";
+import { folderFromEntryPath, scanInstalledPackages } from "./lib/packages.mjs";
 import { ROOT } from "./lib/paths.mjs";
 import { exists } from "./lib/io.mjs";
 
@@ -62,7 +62,8 @@ function main() {
     const abs = path.join(ROOT, m.entry.path);
     if (!exists(abs)) fail(`${m.id}: entry 不存在: ${m.entry.path}`);
 
-    const folder = String(m.entry.path).replace(/\\/g, "/").split("/")[2];
+    const folder = folderFromEntryPath(m.entry.path);
+    if (!folder) fail(`${m.id}: 无法从 entry.path 解析 packages 目录: ${m.entry.path}`);
     const manifestPath = path.join(ROOT, "modules", "packages", folder, "sapi", "manifest.json");
     if (!exists(manifestPath)) fail(`${m.id}: 缺少 packages/${folder}/sapi/manifest.json`);
     let manifest;

tools/check-modules.mjs

@@ -294,11 +294,13 @@ async function unzip(zipPath, dstDir) {
   const data = await fsp.readFile(zipPath);
   const zip = await JSZip.loadAsync(data);
   for (const e of Object.values(zip.files)) {
-    const out = path.join(dstDir, e.name);
-    if (e.dir) {
-      await fsp.mkdir(out, { recursive: true });
+    // Windows zip 常带 `\`；必须归一成 `/`，否则 Linux 会写出字面量 `sapi\manifest.json`
+    const rel = String(e.name).replace(/\\/g, "/").replace(/^\/+/, "");
+    if (!rel || e.dir || rel.endsWith("/")) {
+      if (rel) await fsp.mkdir(path.join(dstDir, ...rel.replace(/\/$/, "").split("/").filter(Boolean)), { recursive: true });
       continue;
     }
+    const out = path.join(dstDir, ...rel.split("/"));
     await fsp.mkdir(path.dirname(out), { recursive: true });
     await fsp.writeFile(out, await e.async("nodebuffer"));
   }

tools/fetch-module.mjs

@@ -3,7 +3,12 @@
  */
 import { CATALOG_PATH } from "./paths.mjs";
 import { readJson, writeJson } from "./io.mjs";
-import { loadPackageCatalogEntry, projectCatalogEntry, scanInstalledPackages } from "./packages.mjs";
+import {
+  folderFromEntryPath,
+  loadPackageCatalogEntry,
+  projectCatalogEntry,
+  scanInstalledPackages,
+} from "./packages.mjs";
 
 const DEFAULT_COMMENT =
   "modules/catalog.json 是本地 mirror；source of truth 为 github:Tanya7z/sfmc-modules/main/index.json。条目由已安装的 modules/packages/<id>/sapi/manifest.json 投影生成（fetch-module install / catalog-sync）。空数组表示纯 SDK 仓，合法。";
@@ -65,7 +70,7 @@ export function upsertCatalogEntry(folder) {
   if (!entry) throw new Error(`packages/${folder}: 无有效 sapi/manifest.json`);
   const catalog = readCatalog();
   const idx = catalog.modules.findIndex(
-    (m) => m.id === entry.id || (m.entry && folderFromEntry(m.entry.path) === folder)
+    (m) => m.id === entry.id || (m.entry && folderFromEntryPath(m.entry.path) === folder)
   );
   if (idx >= 0) catalog.modules[idx] = entry;
   else catalog.modules.push(entry);
@@ -83,18 +88,10 @@ export function removeCatalogEntry(folderOrId) {
   const catalog = readCatalog();
   const idx = catalog.modules.findIndex((m) => {
     if (m.id === folderOrId) return true;
-    return folderFromEntry(m.entry?.path) === folderOrId;
+    return folderFromEntryPath(m.entry?.path) === folderOrId;
   });
   if (idx < 0) return null;
   const [removed] = catalog.modules.splice(idx, 1);
   writeCatalog(catalog);
   return removed;
 }
-
-/** @param {string | undefined} entryPath */
-function folderFromEntry(entryPath) {
-  const m = String(entryPath || "")
-    .replace(/\\/g, "/")
-    .match(/modules\/packages\/([^/]+)\//);
-  return m ? m[1] : null;
-}

tools/lib/catalog.mjs

@@ -1,6 +1,3 @@
-/**
- * tools/lib/packages.mjs — 扫描 packages/<id>/sapi/manifest.json 并投影为 catalog 条目
- */
 /**
  * tools/lib/packages.mjs — 扫描 packages/<id>/sapi/manifest.json 并投影为 catalog 条目
  */