@oj-module/cli 0.2.1 → 0.2.5

package/src/oj-cert.ts

@@ -11,6 +11,7 @@ import { Buffer } from "node:buffer";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { readOjServerField } from "./oj-config";
 
 /** 默认有效期：3650 天。oj 证书宽限期尽即拒启且无自助续期，短有效期等于时钟炸弹 */
 const DEFAULT_DAYS = 3650;
@@ -51,3 +52,21 @@ export async function mintDevCert(
 		cert: write("cert.jws", `${signingInput}.${signature}\n`),
 	};
 }
+
+/**
+ * dev 起后端前确保开发证书就位：config 声明的 `certificate_path` 文件缺失时现场签发。
+ *
+ * `ojm init` 产出的工程自带证书，但模板仓库本身也是一个可运行工程（不走 init），
+ * 直接 `pnpm dev` 会因 oj 读不到 public.pem 而 fail-fast——故 dev 补这一道。
+ * 证书路径相对 config 文件所在目录解析（与 oj 一致）。
+ */
+export async function ensureDevCert(configPath: string): Promise<boolean> {
+	const rel = readOjServerField(configPath, "certificate_path");
+	if (!rel)
+		return false;
+	const certPath = path.resolve(path.dirname(configPath), rel);
+	if (fs.existsSync(certPath))
+		return false;
+	await mintDevCert(path.dirname(certPath));
+	return true;
+}

package/src/oj-cmd.ts

@@ -6,13 +6,13 @@
  *   2. 用户没给 -c/--config 时补上 <project>/api/config.yaml 的绝对路径。
  *
  * 为什么必须补 -c：这些子命令的 -c 缺省是 `./config.yaml`（相对 CWD），而 ojm
- * 工程的 config 在 api/ 下——从工程根跑就会读不到。oj 的 -d/--db 等都有自动
+ * 工程的 config 在 config/ 下——从工程根跑就会读不到。oj 的 -d/--db 等都有自动
  * 探测（自 config 逐级搜，src 优先），ojm 不去猜，避免替用户做错的决定。
  */
 
 import { execFileSync } from "node:child_process";
 import fs from "node:fs";
-import path from "node:path";
+import { resolveConfigPath } from "./layout";
 import { resolveOjBin } from "./vendor";
 
 /** 接受 -c 配置的子命令；`secret` 不在内（keygen/seal 不需要 config） */
@@ -37,7 +37,7 @@ export function runOjSubcommand(
 
 	const args = [sub, ...userArgs];
 	const hasConfigFlag = userArgs.includes("-c") || userArgs.includes("--config");
-	const configPath = path.join(projectRoot, "api/config.yaml");
+	const configPath = resolveConfigPath(projectRoot);
 	if (CONFIG_SUBCOMMANDS.has(sub) && !hasConfigFlag && fs.existsSync(configPath))
 		args.splice(1, 0, "-c", configPath);
 

package/src/preview.ts

@@ -18,7 +18,7 @@ import path, { normalize } from "node:path";
 import process from "node:process";
 import { proxyApi } from "./dev-proxy";
 import { loadHtmlTransform } from "./html-transform";
-import { resolveLayout } from "./layout";
+import { resolveConfigPath, resolveLayout } from "./layout";
 import { startOj } from "./oj";
 import { readOjApiPrefix } from "./oj-config";
 import { createStaticHandler, decodeReqPath, listenOnFreePort } from "./static-handler";
@@ -42,7 +42,7 @@ export async function previewServer(projectRoot: string, opts: PreviewOptions =
 	const layout = resolveLayout(projectRoot);
 	const siteDir = opts.siteDir ?? layout.distDir;
 	const ojBin = resolveOjBin(projectRoot);
-	const configPath = path.join(projectRoot, "api", "config.yaml");
+	const configPath = resolveConfigPath(projectRoot);
 	const apiDist = path.join(projectRoot, "api", "dist");
 
 	// fail-fast 四查：缺一即提示对应补救（init 幂等补缺 / ojm build 产物）

package/src/publish.ts

@@ -0,0 +1,150 @@
+import { Buffer } from "node:buffer";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { parse as yamlParse, stringify as yamlStringify } from "yaml";
+// ojm publish（P3-5/6/7，作者工具链）：对发布目录的 bundles.yaml + manifests.yaml 索引
+// 重算（P3-6：parse→确定性 stringify，消弭格式漂移、使 sha256 稳定可签）→ 签名（P3-7：detached
+// 侧车 .sig，与 archive .sig 同构）→ 写回目录（本地文件目标；CDN 推送走 resolveCdn 同形）。
+// 复用 sign.ts 签名原语 + 发布方 key（~/.ojm/keys，与 ojm sign 同身份体系）。
+import { isValidKeyId } from "./keygen";
+import { readPrivateKeyPem } from "./lifecycle/keygen";
+import { CANON, exportRawPublicKeyHex, fingerprintOfPublicKey, SIG_ALG, signCanonical, verifyCanonical } from "./lifecycle/sign";
+
+export interface PublishOptions {
+	/** 发布方 key_id（C2-37；.sig 的发布方标识） */
+	id?: string
+	/** 私钥 PEM 文件（缺省 ~/.ojm/keys/<id>/private.pem） */
+	key?: string
+	/** 写完离线自检（verifyCanonical 复核两份签名） */
+	check?: boolean
+	/** 测试注入；缺省 process.cwd() */
+	cwd?: string
+}
+
+export interface PublishResult {
+	bundlesPath: string
+	manifestsPath: string
+	bundlesSigPath: string
+	manifestsSigPath: string
+	keyId: string
+	publicKeyHex: string
+	fingerprint: string
+	/** --check 的自检结果（未传 --check = undefined） */
+	checkPassed?: boolean
+}
+
+/** 索引规范串（P3-7）：`index:<kind>:<sha256hex>`，与验签侧（market/api.ts）逐字一致 */
+export function indexCanonical(kind: "bundles" | "manifests", text: string): string {
+	const sha256 = createHash("sha256").update(Buffer.from(text, "utf8")).digest("hex");
+	return `index:${kind}:${sha256}`;
+}
+
+/** 对单个索引文本签名，产出 detached .sig 五字段（与 archive .sig 同构，契约 §2.11 / C2-35） */
+export function signIndex(kind: "bundles" | "manifests", text: string, privateKeyPem: string, keyId: string): { alg: string, key_id: string, public_key: string, value: string, canon: string } {
+	const value = signCanonical(privateKeyPem, indexCanonical(kind, text));
+	return { alg: SIG_ALG, key_id: keyId, public_key: exportRawPublicKeyHex(privateKeyPem), value, canon: CANON };
+}
+
+/**
+ * 深度按 key 字典序重排（YAML v2 此构建无 sortKeys 原语，故手动对纯对象键序归一化）。
+ * YAML map 顺序无关语义，故重排不改变含义，仅使字节确定化（P3-6：sha256 稳定可签可验）。
+ */
+function sortKeysDeep(v: unknown): unknown {
+	if (Array.isArray(v))
+		return v.map(sortKeysDeep);
+	if (v !== null && typeof v === "object" && !Array.isArray(v)) {
+		const out: Record<string, unknown> = {};
+		for (const k of Object.keys(v as Record<string, unknown>).sort())
+			out[k] = sortKeysDeep((v as Record<string, unknown>)[k]);
+		return out;
+	}
+	return v;
+}
+
+/** 索引重算（P3-6）：parse → 键序归一化 → 确定性 stringify，使字节稳定、sha256 可签可验 */
+export function recomputeIndex(text: string): string {
+	return yamlStringify(sortKeysDeep(yamlParse(text)), { lineWidth: 0 });
+}
+
+export function publishCommand(dir: string, opts: PublishOptions = {}): PublishResult {
+	const cwd = opts.cwd ?? process.cwd();
+	const base = dir ? path.resolve(cwd, dir) : cwd;
+	// key 解析（同 ojm sign）
+	let keyFile: string;
+	let keyId: string;
+	if (opts.key !== undefined) {
+		keyFile = path.resolve(cwd, opts.key);
+		keyId = opts.id ?? "";
+		if (keyId === "")
+			throw new Error("[ojm] --key 指向自定义位置时须同时给 --id <publisher.id>（.sig 的发布方标识；C2-37 命名空间）");
+	}
+	else {
+		keyId = opts.id ?? "";
+		if (keyId === "")
+			throw new Error("[ojm] 缺少签名身份：--id <publisher.id>（从 ~/.ojm/keys/<id>/ 取私钥）或 --key <pem> --id <publisher.id>。先生成：ojm keygen --id <publisher.id>");
+		keyFile = path.join(os.homedir(), ".ojm", "keys", keyId, "private.pem");
+	}
+	if (!isValidKeyId(keyId))
+		throw new Error(`[ojm] key_id 命名空间非法（C2-37）：「${keyId}」`);
+	if (!fs.existsSync(keyFile))
+		throw new Error(`[ojm] 私钥文件不存在：${keyFile}（用 ojm keygen --id ${keyId} 生成，或 --key 指定）`);
+
+	const bundlesPath = path.join(base, "bundles.yaml");
+	const manifestsPath = path.join(base, "manifests.yaml");
+	if (!fs.existsSync(bundlesPath) || !fs.existsSync(manifestsPath))
+		throw new Error(`[ojm] 发布目录须含 bundles.yaml 与 manifests.yaml：${base}`);
+
+	// P3-6 重算索引（deterministic stringify 后写回，publish 即生效，无需额外缓存层）
+	const bundlesText = recomputeIndex(fs.readFileSync(bundlesPath, "utf8"));
+	const manifestsText = recomputeIndex(fs.readFileSync(manifestsPath, "utf8"));
+	fs.writeFileSync(bundlesPath, bundlesText);
+	fs.writeFileSync(manifestsPath, manifestsText);
+
+	// P3-7 签名（detached .sig 侧车，与 archive .sig 同构）
+	const privateKeyPem = readPrivateKeyPem(keyFile);
+	const publicKeyHex = exportRawPublicKeyHex(privateKeyPem);
+	const bundlesSig = signIndex("bundles", bundlesText, privateKeyPem, keyId);
+	const manifestsSig = signIndex("manifests", manifestsText, privateKeyPem, keyId);
+	const bundlesSigPath = `${bundlesPath}.sig`;
+	const manifestsSigPath = `${manifestsPath}.sig`;
+	fs.writeFileSync(bundlesSigPath, `${JSON.stringify(bundlesSig, null, 2)}\n`);
+	fs.writeFileSync(manifestsSigPath, `${JSON.stringify(manifestsSig, null, 2)}\n`);
+	console.log(`[ojm] 索引已重算并签名 → ${path.relative(cwd, bundlesSigPath)} / ${path.relative(cwd, manifestsSigPath)}`);
+	console.log(`[ojm] 发布方 ${keyId}；指纹 ${fingerprintOfPublicKey(publicKeyHex)}`);
+
+	let checkPassed: boolean | undefined;
+	if (opts.check === true) {
+		const bundlesOk = verifyCanonical(publicKeyHex, indexCanonical("bundles", bundlesText), bundlesSig.value);
+		const manifestsOk = verifyCanonical(publicKeyHex, indexCanonical("manifests", manifestsText), manifestsSig.value);
+		checkPassed = bundlesOk && manifestsOk;
+		console.log(checkPassed ? "[ojm] 自检通过：索引签名与内容匹配" : "[ojm] 自检失败：索引签名与内容不匹配——请检查私钥与索引后重签");
+		if (!checkPassed)
+			process.exitCode = 1;
+	}
+	return { bundlesPath, manifestsPath, bundlesSigPath, manifestsSigPath, keyId, publicKeyHex, fingerprint: fingerprintOfPublicKey(publicKeyHex), checkPassed };
+}
+
+/** `ojm publish <dir> [--id <publisher.id>] [--key <pem>] [--check]` 参数解析 */
+export function parsePublishArgs(argv: string[]): { positionals: string[], id?: string, key?: string, check?: boolean } {
+	const values: Record<string, string> = {};
+	let check = false;
+	const positionals: string[] = [];
+	for (let i = 0; i < argv.length; i++) {
+		const a = argv[i]!;
+		if (a === "--check") {
+			check = true;
+			continue;
+		}
+		if (a === "--id" || a === "--key") {
+			values[a] = argv[i + 1] ?? "";
+			i++;
+			continue;
+		}
+		if (!a.startsWith("--"))
+			positionals.push(a);
+	}
+	return { positionals, id: values["--id"], key: values["--key"], check };
+}

package/src/sign.ts

@@ -0,0 +1,128 @@
+import { createHash } from "node:crypto";
+// ojm sign（P2-4，作者工具链）：对方案包 tgz 签 detached 侧车 `.sig`（契约 v1.3 §2.11 / C2-35）。
+// 签名原文 = 规范串 `<name>@<version>:<sha256>`（C2-34）；.sig 五字段
+// {alg,key_id,public_key,value,canon}，与 Form B archive.signature 同源同构。
+// `--check`：写完离线自检（作者不必靠宿主装失败发现签错——先红后绿的第一道防线）。
+// 只出签名不碰包：`ojm build --bundle` 保持只出包不签名（私钥红线见 bundle.ts 入包自检）。
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { isValidKeyId } from "./keygen";
+import { readPrivateKeyPem } from "./lifecycle/keygen";
+import { CANON, canonicalString, exportRawPublicKeyHex, fingerprintOfPublicKey, SIG_ALG, signCanonical, verifyCanonical } from "./lifecycle/sign";
+
+export interface SignOptions {
+	/** 发布方 key_id（C2-37；.sig 的发布方标识） */
+	id?: string
+	/** 私钥 PEM 文件（缺省 ~/.ojm/keys/<id>/private.pem） */
+	key?: string
+	/** 写完离线自检（verifyCanonical 复核） */
+	check?: boolean
+	/** 测试注入；缺省 process.cwd() */
+	cwd?: string
+}
+
+export interface SignResult {
+	sigPath: string
+	keyId: string
+	publicKeyHex: string
+	fingerprint: string
+	sha256: string
+	canonical: string
+	/** --check 的自检结果（未传 --check = undefined） */
+	checkPassed?: boolean
+}
+
+/** 从 --key 路径推导 key_id（~/.ojm/keys/<id>/private.pem 形态）；推导不出返回 null */
+function keyIdFromKeyPath(keyFile: string): string | null {
+	const m = /^\.ojm[\\/]keys[\\/]([^\\/]+)[\\/]private\.pem$/.exec(keyFile) ?? /[/\\]\.ojm[/\\]keys[/\\]([^/\\]+)[/\\]private\.pem$/.exec(keyFile);
+	return m?.[1] ?? null;
+}
+
+export function signCommand(tgz: string, opts: SignOptions = {}): SignResult {
+	if (!tgz.endsWith(".tgz"))
+		throw new Error(`[ojm] 签名目标必须是 .tgz 方案包：${tgz}`);
+	if (!fs.existsSync(tgz))
+		throw new Error(`[ojm] 方案包不存在：${tgz}`);
+	const cwd = opts.cwd ?? process.cwd();
+	// key 解析：--key 显式文件优先；否则 ~/.ojm/keys/<id>/private.pem（--id 必填）
+	let keyFile: string;
+	let keyId: string;
+	if (opts.key !== undefined) {
+		keyFile = path.resolve(cwd, opts.key);
+		keyId = opts.id ?? keyIdFromKeyPath(path.relative(os.homedir(), keyFile)) ?? "";
+		if (keyId === "")
+			throw new Error("[ojm] --key 指向自定义位置时须同时给 --id <publisher.id>（.sig 的发布方标识；C2-37 命名空间）");
+	}
+	else {
+		keyId = opts.id ?? "";
+		if (keyId === "")
+			throw new Error("[ojm] 缺少签名身份：--id <publisher.id>（从 ~/.ojm/keys/<id>/ 取私钥）或 --key <pem> --id <publisher.id>。先生成：ojm keygen --id <publisher.id>");
+		keyFile = path.join(os.homedir(), ".ojm", "keys", keyId, "private.pem");
+	}
+	if (!isValidKeyId(keyId))
+		throw new Error(`[ojm] key_id 命名空间非法（C2-37）：「${keyId}」`);
+	if (!fs.existsSync(keyFile))
+		throw new Error(`[ojm] 私钥文件不存在：${keyFile}（用 ojm keygen --id ${keyId} 生成，或 --key 指定）`);
+
+	const bytes = new Uint8Array(fs.readFileSync(tgz));
+	const sha256 = createHash("sha256").update(bytes).digest("hex");
+	const canonical = canonicalString(deriveName(tgz), deriveVersion(tgz), sha256);
+	const privateKeyPem = readPrivateKeyPem(keyFile);
+	const value = signCanonical(privateKeyPem, canonical);
+	const publicKeyHex = exportRawPublicKeyHex(privateKeyPem);
+	const sig = { alg: SIG_ALG, key_id: keyId, public_key: publicKeyHex, value, canon: CANON };
+	const sigPath = `${tgz}.sig`;
+	fs.writeFileSync(sigPath, `${JSON.stringify(sig, null, 2)}\n`);
+	console.log(`[ojm] 签名完成 → ${sigPath}`);
+	console.log(`[ojm] 发布方 ${keyId}；规范串 ${canonical}`);
+	let checkPassed: boolean | undefined;
+	if (opts.check === true) {
+		checkPassed = verifyCanonical(publicKeyHex, canonical, value);
+		console.log(checkPassed
+			? `[ojm] 自检通过：签名与包体匹配（指纹 ${fingerprintOfPublicKey(publicKeyHex)}）`
+			: "[ojm] 自检失败：签名与包体不匹配——请检查私钥与包体后重签");
+		if (!checkPassed)
+			process.exitCode = 1;
+	}
+	return { sigPath, keyId, publicKeyHex, fingerprint: fingerprintOfPublicKey(publicKeyHex), sha256, canonical, checkPassed };
+}
+
+/** `ojm sign <tgz> [--id <publisher.id>] [--key <pem>] [--check]` 参数解析 */
+export function parseSignArgs(argv: string[]): { positionals: string[], id?: string, key?: string, check?: boolean } {
+	const values: Record<string, string> = {};
+	let check = false;
+	const positionals: string[] = [];
+	for (let i = 0; i < argv.length; i++) {
+		const a = argv[i]!;
+		if (a === "--check") {
+			check = true;
+			continue;
+		}
+		if (a === "--id" || a === "--key") {
+			values[a] = argv[i + 1] ?? "";
+			i++;
+			continue;
+		}
+		if (!a.startsWith("--"))
+			positionals.push(a);
+	}
+	return { positionals, id: values["--id"], key: values["--key"], check };
+}
+
+/** 身份从文件名推导（<name>-<version>.tgz；与 ojm install parseTarget 同规则，Finding C 正则） */
+function deriveIdentity(stem: string): { name: string, version: string } {
+	const m = /^(.+)-(\d[\w.]+(?:-[\w.]+)?)$/.exec(stem);
+	if (m === null)
+		throw new Error(`[ojm] 无法从文件名推导 <name>-<version>：${stem}.tgz——请按 ojm build --bundle 产物命名（或重命名后再签）`);
+	return { name: m[1]!, version: m[2]! };
+}
+
+function deriveName(tgz: string): string {
+	return deriveIdentity(path.basename(tgz).replace(/\.tgz$/, "")).name;
+}
+
+function deriveVersion(tgz: string): string {
+	return deriveIdentity(path.basename(tgz).replace(/\.tgz$/, "")).version;
+}

package/src/site.ts

@@ -0,0 +1,146 @@
+// 站点瘦客户端（P1-13，D6）：ojm install/enable/disable 共用的站点 HTTP 面。
+// 登录（POST /api/auth/login）→ Bearer 注入 → oj 信封解包（{code,msg,data}，code=0 为成）。
+// 凭据只走内存：flag（--user/--pass）> 环境变量（OJM_URL/OJM_USER/OJM_PASS），不落盘不落配置。
+// 轮询对齐服务端消费面（§10.2）：GET task?id= 查询参数形态，800ms 起步指数退避、上限 5s，
+// 总超时对齐 TASK_TIMEOUT_MS（30min）——超时报错退出，不悬挂。
+
+import process from "node:process";
+
+/** 任务记录（线形状镜像；真源 templates/api/src/_platform/_lifecycle/types.ts:65，客户端不 import 模板内部） */
+export interface TaskRecord {
+	/**
+	 * 记录 schema 版本（P2-10 线形状镜像）：缺省（undefined）=旧记录=v1 语义照常渲染；
+	 * 高于 TASK_SCHEMA_VERSION_KNOWN 的高版本 → renderOutcome 降级提示（人话 + 不误渲染成功）。
+	 * 升版纪律见真源 types.ts TaskRecord.schemaVersion 注释。
+	 */
+	schemaVersion?: number
+	id: string
+	name: string
+	version: string
+	status: "running" | "done" | "failed" | "partial" | "needs_trust"
+	stage: string | null
+	progress: number
+	message: string
+	stages: { stage: string, ok: boolean, message: string }[]
+	error?: { reason: string, retryable: boolean, hintKey?: string }
+	/** needs_trust 终态：待确认发布方 key（P2-3；CLI trust confirm 展示与确认） */
+	trust?: { key_id: string, public_key: string, fingerprint: string }
+	appliedSeq?: number
+	startedAt: number
+	finishedAt?: number
+}
+
+/** 模板 serve 缺省端口（templates/api/config.yaml server.port: 9778；host 显式钉 127.0.0.1） */
+export const DEFAULT_SITE_URL = "http://127.0.0.1:9778";
+
+/** 本 CLI 已知的任务记录 schema 版本（P2-10；与服务端 tasks.ts TASK_SCHEMA_VERSION 手工同步，更高版本触发降级提示） */
+export const TASK_SCHEMA_VERSION_KNOWN = 1;
+
+/** 未来版本判定（P2-10 升版纪律读方侧）：undefined=旧记录=已知 v1 语义；数值高于已知版本 → 降级提示 */
+export function isFutureSchema(record: TaskRecord): boolean {
+	return typeof record.schemaVersion === "number" && record.schemaVersion > TASK_SCHEMA_VERSION_KNOWN;
+}
+
+export interface SiteAddressing {
+	url?: string
+	user?: string
+	pass?: string
+}
+
+/** 站点寻址解析：flag > 环境变量 > 缺省；缺凭据即人话报错（不猜测不交互） */
+export function resolveSite(opts: SiteAddressing): { base: string, user: string, pass: string } {
+	const base = (opts.url ?? process.env.OJM_URL ?? DEFAULT_SITE_URL).replace(/\/+$/, "");
+	const user = opts.user ?? process.env.OJM_USER ?? "";
+	const pass = opts.pass ?? process.env.OJM_PASS ?? "";
+	if (user === "" || pass === "")
+		throw new Error(`[ojm] 缺少站点凭据：请用 --user/--pass 或环境变量 OJM_USER/OJM_PASS 提供目标站点超管账号（--url / OJM_URL 指定站点地址，缺省 ${DEFAULT_SITE_URL}；凭据只走内存，不落盘）`);
+	return { base, user, pass };
+}
+
+/** oj 统一信封（AC-D16：{code,msg,data}，code=0 为成） */
+interface OjEnvelope {
+	code?: number
+	msg?: string
+	data?: unknown
+}
+
+/** 文本优先的信封解包（网关 502 HTML / 纯文本常态不炸），code!==0 抛人话 */
+export async function unwrapEnvelope(res: { ok: boolean, status: number, text: () => Promise<string> }): Promise<unknown> {
+	const text = await res.text();
+	let env: OjEnvelope | null = null;
+	try {
+		env = JSON.parse(text) as OjEnvelope;
+	}
+	catch {
+		// 非 JSON 错误体（常态），走下方统一报错
+	}
+	if (env === null || typeof env.code !== "number")
+		throw new Error(`[ojm] 站点响应不可解析（HTTP ${res.status}）：${text.slice(0, 200)}`);
+	if (env.code !== 0)
+		throw new Error(`[ojm] 站点返回错误（code=${env.code}）：${env.msg ?? "未知错误"}`);
+	return env.data;
+}
+
+export async function login(fetchFn: typeof fetch, base: string, user: string, pass: string): Promise<string> {
+	const data = await unwrapEnvelope(await fetchFn(`${base}/api/auth/login`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({ username: user, password: pass }),
+	})) as { access_token?: string };
+	const token = String(data?.access_token ?? "");
+	if (token === "")
+		throw new Error("[ojm] 登录响应缺 access_token——核对站点版本与账号");
+	return token;
+}
+
+/** 携 Bearer 的 JSON 请求（GET body 缺省；POST/PUT 序列化 body） */
+export async function callApi<T>(fetchFn: typeof fetch, base: string, token: string, method: "GET" | "POST" | "DELETE", path: string, body?: unknown): Promise<T> {
+	const res = await fetchFn(`${base}${path}`, {
+		method,
+		headers: {
+			authorization: `Bearer ${token}`,
+			...(body === undefined ? {} : { "content-type": "application/json" }),
+		},
+		...(body === undefined ? {} : { body: JSON.stringify(body) }),
+	});
+	return await unwrapEnvelope(res) as T;
+}
+
+export interface PollOptions {
+	/** 起步间隔 ms（缺省 800，对齐 §10.2 服务端轮询消费面） */
+	interval0?: number
+	/** 间隔上限 ms（缺省 5000） */
+	intervalMax?: number
+	/** 总等待预算 ms（缺省 30min，对齐 TASK_TIMEOUT_MS） */
+	timeoutMs?: number
+	/** 测试注入；缺省真睡 */
+	sleep?: (ms: number) => Promise<void>
+}
+
+/** 终态判定：done/failed/partial；running 继续轮 */
+function isTerminal(status: TaskRecord["status"]): boolean {
+	return status !== "running";
+}
+
+/**
+ * 任务轮询：800ms 起步、×2 指数退避、上限 5s；等待预算按累计睡眠计（注入 sleep 时确定可测），
+ * 预算耗尽即人话报错（对齐服务端 TASK_TIMEOUT_MS 超时判 failed 的口径，R13/B9）。
+ */
+export async function pollTask(fetchFn: typeof fetch, base: string, token: string, taskId: string, opts: PollOptions = {}): Promise<TaskRecord> {
+	const interval0 = opts.interval0 ?? 800;
+	const intervalMax = opts.intervalMax ?? 5000;
+	const timeoutMs = opts.timeoutMs ?? 30 * 60_000;
+	const sleep = opts.sleep ?? (ms => new Promise<void>(r => setTimeout(r, ms)));
+	let interval = interval0;
+	let waited = 0;
+	for (;;) {
+		const record = await callApi<TaskRecord>(fetchFn, base, token, "GET", `/api/_platform/market/task?id=${encodeURIComponent(taskId)}`);
+		if (isTerminal(record.status))
+			return record;
+		if (waited + interval > timeoutMs)
+			throw new Error(`[ojm] 安装任务轮询超时（已等待 ${Math.round(waited / 1000)}s 未达终态，对齐服务端 ${Math.round(timeoutMs / 60000)} 分钟预算）——请到站点任务页查看详情`);
+		await sleep(interval);
+		waited += interval;
+		interval = Math.min(interval * 2, intervalMax);
+	}
+}

package/src/trust.ts

@@ -0,0 +1,116 @@
+// ojm trust（P2-2，C2-38/39，G3 双轨第一轨 / G5）：宿主信任库运维瘦客户端。
+// 子命令：
+//   ojm trust ls                                  —— 列表（GET  /api/_platform/market/trust）
+//   ojm trust add <key_id> <pubkey_hex>           —— 新增信任（POST /api/_platform/market/trust/key）
+//   ojm trust revoke <key_id>                     —— 吊销（DELETE /api/_platform/market/trust/key?key_id=）
+//   ojm trust confirm --task <task_id>            —— TOFU 确认（P2-3）：先展示指纹再调 POST /market/trust
+// 本地零状态，纯转发（uninstall.ts 同款）；operator 由站点侧按登录用户反查，CLI 不传。
+import { Buffer } from "node:buffer";
+import { createHash } from "node:crypto";
+import process from "node:process";
+import { callApi, login, resolveSite } from "./site";
+
+export interface TrustOptions {
+	url?: string
+	user?: string
+	pass?: string
+	/** TOFU 确认目标任务 id（confirm 子命令；--task） */
+	task?: string
+	/** 测试注入；缺省 globalThis.fetch */
+	fetchFn?: typeof fetch
+}
+
+export interface TrustKeyRow {
+	key_id: string
+	public_key: string
+	added_at: number
+}
+
+/** 指纹分组展示（TOFU 人确认的可读形态：每 8 hex 一组，契约 §2.11） */
+export function formatFingerprint(fp: string): string {
+	return (fp.match(/.{1,8}/g) ?? []).join(" ");
+}
+
+/** 指纹 = sha256Hex(publicKey)（契约 §2.11，与 isolate 侧同口径；CLI 在 Node 侧本地计算） */
+function fingerprintOf(publicKeyHex: string): string {
+	return createHash("sha256").update(Buffer.from(publicKeyHex, "hex")).digest("hex");
+}
+
+function printRows(rows: TrustKeyRow[]): void {
+	if (rows.length === 0) {
+		console.log("[ojm] 信任库为空（未信任任何发布方 key_id）");
+		return;
+	}
+	for (const r of rows)
+		console.log(`[ojm] ${r.key_id}  added_at=${new Date(r.added_at).toISOString()}  fp=${formatFingerprint(fingerprintOf(r.public_key))}`);
+}
+
+/**
+ * 子命令分派：ls / add <key_id> <pubkey_hex> / revoke <key_id>。
+ * 站点侧拒（key_id 命名空间/公钥形态 400、撞绑定 409）打印人话 message 并 exitCode 1。
+ */
+export async function trustCommand(sub: string, args: string[], opts: TrustOptions = {}): Promise<void> {
+	// 先校验后登录（uninstall.ts 同纪律：用法错误不发网络）
+	switch (sub) {
+		case "ls":
+			break;
+		case "add": {
+			const [keyId, publicKey] = args;
+			if (!keyId || !publicKey)
+				throw new Error("[ojm] 用法：ojm trust add <key_id> <pubkey_hex>——key_id 形如 <publisher>.<id>（全小写），pubkey_hex 为 64 hex Ed25519 公钥");
+			break;
+		}
+		case "revoke": {
+			const [keyId] = args;
+			if (!keyId)
+				throw new Error("[ojm] 用法：ojm trust revoke <key_id>——吊销该发布方：只阻断新装/升级，不动已装方案");
+			break;
+		}
+		case "confirm": {
+			if (!opts.task || opts.task.trim() === "")
+				throw new Error("[ojm] 用法：ojm trust confirm --task <task_id>——对 needs_trust 安装任务确认未知发布方指纹后入信任库");
+			break;
+		}
+		default:
+			throw new Error(`[ojm] 未知 trust 子命令：${sub || "(空)"}——可用：ls / add <key_id> <pubkey_hex> / revoke <key_id> / confirm --task <task_id>`);
+	}
+	const fetchFn = opts.fetchFn ?? globalThis.fetch;
+	const { base, user, pass } = resolveSite(opts);
+	const token = await login(fetchFn, base, user, pass);
+	switch (sub) {
+		case "ls": {
+			const result = await callApi<{ keys: TrustKeyRow[], note: string | null }>(fetchFn, base, token, "GET", "/api/_platform/market/trust");
+			if (result.note)
+				console.log(`[ojm] 注意：${result.note}`);
+			printRows(result.keys ?? []);
+			break;
+		}
+		case "add": {
+			const [keyId, publicKey] = args;
+			const result = await callApi<{ result: "added" | "exists_same" }>(fetchFn, base, token, "POST", "/api/_platform/market/trust/key", { key_id: keyId, public_key: publicKey });
+			console.log(result.result === "added" ? `[ojm] 已信任发布方：${keyId}` : `[ojm] 该 key_id 已在信任库且公钥一致（无需重复添加）：${keyId}`);
+			break;
+		}
+		case "revoke": {
+			const [keyId] = args;
+			const result = await callApi<{ revoked: boolean }>(fetchFn, base, token, "DELETE", `/api/_platform/market/trust/key?key_id=${encodeURIComponent(keyId)}`);
+			console.log(result.revoked ? `[ojm] 已吊销：${keyId}（已装方案继续运行，新装/升级将被拒）` : `[ojm] 信任库中无此 key_id：${keyId}`);
+			if (!result.revoked)
+				process.exitCode = 1;
+			break;
+		}
+		case "confirm": {
+			const taskId = opts.task!.trim();
+			// 先取任务记录展示指纹（防「确认 A、落 B」：人看到的与服务端入信任库的同源）
+			const rec = await callApi<{ id: string, status: string, name: string, version: string, trust?: { key_id: string, public_key: string, fingerprint: string } }>(fetchFn, base, token, "GET", `/api/_platform/market/task?id=${encodeURIComponent(taskId)}`);
+			if (rec.trust === undefined || rec.status !== "needs_trust")
+				throw new Error(`[ojm] 任务 ${taskId} 不在待信任确认状态（status=${rec.status}）——无需确认`);
+			console.log(`[ojm] 待信任发布方：${rec.trust.key_id}`);
+			console.log(`[ojm] 指纹（sha256(publicKey)，请与发布方公布值逐字核对）：${formatFingerprint(rec.trust.fingerprint)}`);
+			console.log("[ojm] 确认即把该公钥加入宿主信任库（首次绑定不可改；吊销只阻断新装/升级，不动已装方案）");
+			const result = await callApi<{ result: "added" | "exists_same", key_id: string }>(fetchFn, base, token, "POST", "/api/_platform/market/trust", { task_id: taskId });
+			console.log(result.result === "added" ? `[ojm] 已信任发布方：${result.key_id}——重试安装命令即可继续（CDN 源重试自动重下，file 源重传包体与 .sig）` : `[ojm] 该发布方已在信任库：${result.key_id}——直接重试安装即可`);
+			break;
+		}
+	}
+}

package/src/uninstall.ts

@@ -0,0 +1,29 @@
+// ojm uninstall（P1-15a，缺口 B）：卸载瘦客户端——POST /api/_platform/market/uninstall
+// 触发站点侧 runUninstall 四处同删（锁/sidecar/sys_solution_route/modules.json + 权限级联）。
+// 本地零状态，纯转发（enable.ts 同款）；operator 由站点侧按登录用户反查，CLI 不传。
+import process from "node:process";
+import { callApi, login, resolveSite } from "./site";
+
+export interface UninstallOptions {
+	url?: string
+	user?: string
+	pass?: string
+	/** 测试注入；缺省 globalThis.fetch */
+	fetchFn?: typeof fetch
+}
+
+/**
+ * 卸载命令体：登录 → POST uninstall {name} → 打印服务端人话 message。
+ * ok:false = 域逻辑拒绝（未装/空锁拒启），打印 message 并置 exitCode 1。
+ */
+export async function uninstallCommand(name: string, opts: UninstallOptions = {}): Promise<void> {
+	if (name.trim() === "")
+		throw new Error("[ojm] 用法：ojm uninstall <name>——name 为已安装方案名");
+	const fetchFn = opts.fetchFn ?? globalThis.fetch;
+	const { base, user, pass } = resolveSite(opts);
+	const token = await login(fetchFn, base, user, pass);
+	const result = await callApi<{ ok: boolean, message: string }>(fetchFn, base, token, "POST", "/api/_platform/market/uninstall", { name: name.trim() });
+	console.log(`[ojm] ${result.message}`);
+	if (!result.ok)
+		process.exitCode = 1;
+}