@oj-module/cli 0.2.30 → 0.2.43

package/src/market/__tests__/fixture.test.ts

@@ -8,7 +8,23 @@ import { join } from "node:path";
 import { gunzipSync } from "node:zlib";
 import { describe, expect, it } from "vitest";
 
-import { buildEvilZipSlipTgz, buildFixturePackage } from "../fixture";
+import { buildEvilZipSlipTgz, buildFixturePackage, parseFixtureSpec } from "../fixture";
+
+describe("given --fixture 规格含路径穿越 When 解析", () => {
+	it("then 含 .. 的 name 被拒（fail-closed，杜绝 cdn/staging 目录逃逸）", () => {
+		expect(() => parseFixtureSpec("../evil@1.0.0")).toThrow();
+		expect(() => parseFixtureSpec("a/../b@1.0.0")).toThrow();
+	});
+
+	it("then 含路径分隔符的 version 被拒", () => {
+		expect(() => parseFixtureSpec("demo@1.0.0/../../x")).toThrow();
+	});
+
+	it("then 合法 slug/版本仍可解析，缺省补齐", () => {
+		expect(parseFixtureSpec("my-solution@0.2.0")).toEqual({ name: "my-solution", version: "0.2.0" });
+		expect(parseFixtureSpec()).toEqual({ name: "demo-solution", version: "0.1.0" });
+	});
+});
 
 describe("given 合成 fixture 方案树 When 看 migrations 目录", () => {
 	it("then 0.1.0 只有 0001（head 上限 1）", () => {

package/src/market/__tests__/publish.test.ts

@@ -9,12 +9,13 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { describe, expect, it } from "vitest";
 
-import { verifyCanonical } from "../../lifecycle/sign";
+import { CANON, verifyCanonical } from "../../lifecycle/sign";
 import { publishPackage } from "../publish";
 
 const MOUNTS = "  - prefix: /api\n    api: src\n  - prefix: /cdn\n    web: ../cdn\n";
 const CONFIG = `mounts:\n${MOUNTS}server:\n  host: 127.0.0.1\n  port: 9778\n`;
 const KEY_ID = "demo.publisher";
+const REGISTRY_ID = "test.registry";
 
 /** Ed25519 测试身份：私钥只在内存，路径从不落盘 */
 function testIdentity(): { privateKeyPem: string, publicKeyHex: string } {
@@ -38,7 +39,7 @@ describe("given cdn/ 为空 When 发布 fixture", () => {
 		const root = newProject();
 		const identity = testIdentity();
 
-		const result = await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem });
+		const result = await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem, registryId: REGISTRY_ID });
 
 		expect(existsSync(result.tgzPath)).toBe(true);
 		expect(existsSync(result.sigPath)).toBe(true);
@@ -51,12 +52,12 @@ describe("given cdn/ 为空 When 发布 fixture", () => {
 		const root = newProject();
 		const identity = testIdentity();
 
-		const result = await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem });
+		const result = await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem, registryId: REGISTRY_ID });
 		const sig = JSON.parse(readFileSync(result.sigPath, "utf-8")) as { key_id: string, public_key: string, value: string, canon: string };
 
 		expect(sig.key_id).toBe(KEY_ID);
 		expect(sig.public_key).toBe(identity.publicKeyHex);
-		expect(sig.canon).toBe("v1");
+		expect(sig.canon).toBe(CANON);
 		expect(verifyCanonical(sig.public_key, result.canonical, sig.value)).toBe(true);
 	});
 
@@ -64,7 +65,7 @@ describe("given cdn/ 为空 When 发布 fixture", () => {
 		const root = newProject();
 		const identity = testIdentity();
 
-		await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem });
+		await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem, registryId: REGISTRY_ID });
 
 		const pemInCdn = readdirSync(join(root, "cdn")).filter(f => f.endsWith(".pem"));
 		expect(pemInCdn).toEqual([]);
@@ -75,7 +76,7 @@ describe("given 同 name@version 再次发布", () => {
 	it("when 内容一致 Then 幂等覆盖（sha256 不变）", async () => {
 		const root = newProject();
 		const identity = testIdentity();
-		const base = { projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem };
+		const base = { projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem, registryId: REGISTRY_ID };
 
 		const first = await publishPackage(base);
 		const second = await publishPackage(base);
@@ -90,7 +91,7 @@ describe("given 同 name@version 再次发布", () => {
 		const target = join(root, "cdn", "demo-solution-0.1.0.tgz");
 		writeFileSync(target, "not-a-real-tgz-but-different-bytes", "utf-8");
 
-		await expect(publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem }))
+		await expect(publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem, registryId: REGISTRY_ID }))
 			.rejects
 			.toThrow(/version/);
 	});

package/src/market/__tests__/setup.test.ts

@@ -62,7 +62,7 @@ describe("given 站点可直连且凭据未悬挂 When setup", () => {
 		const root = newProject();
 		const site = fakeSite();
 
-		const result = await setupMarketUrl({ projectRoot: root, user: "admin", pass: "123456", url: "http://127.0.0.1:9778", fetchFn: site.fetchFn });
+		const result = await setupMarketUrl({ projectRoot: root, user: "admin", pass: "123456", siteUrl: "http://127.0.0.1:9778", fetchFn: site.fetchFn });
 
 		expect(result.cdnBaseUrl).toBe("http://127.0.0.1:9778/cdn");
 		const put = site.calls.find(c => c.url.endsWith("/api/system/settings"))!;
@@ -77,7 +77,7 @@ describe("given seed admin 处于 must_change 悬挂期 When setup", () => {
 		const root = newProject();
 		const site = fakeSite({ restricted: true });
 
-		const result = await setupMarketUrl({ projectRoot: root, user: "admin", pass: "123456", newPass: "newpass-123", url: "http://127.0.0.1:9778", fetchFn: site.fetchFn });
+		const result = await setupMarketUrl({ projectRoot: root, user: "admin", pass: "123456", newPass: "newpass-123", siteUrl: "http://127.0.0.1:9778", fetchFn: site.fetchFn });
 
 		expect(result.changedPassword).toBe(true);
 		const pwd = site.calls.find(c => c.url.endsWith("/api/auth/password"))!;
@@ -96,7 +96,7 @@ describe("given 站点不可达 When setup", () => {
 		};
 		const fetchFn = failing as unknown as typeof fetch;
 
-		await expect(setupMarketUrl({ projectRoot: root, user: "admin", pass: "123456", url: "http://127.0.0.1:9778", fetchFn }))
+		await expect(setupMarketUrl({ projectRoot: root, user: "admin", pass: "123456", siteUrl: "http://127.0.0.1:9778", fetchFn }))
 			.rejects
 			.toThrow(/ojm dev/);
 	});
@@ -107,7 +107,7 @@ describe("given 改密后写设置仍被拒 When setup", () => {
 		const root = newProject();
 		const site = fakeSite({ restricted: true, rejectSettings: true });
 
-		await expect(setupMarketUrl({ projectRoot: root, user: "admin", pass: "123456", newPass: "newpass-123", url: "http://127.0.0.1:9778", fetchFn: site.fetchFn }))
+		await expect(setupMarketUrl({ projectRoot: root, user: "admin", pass: "123456", newPass: "newpass-123", siteUrl: "http://127.0.0.1:9778", fetchFn: site.fetchFn }))
 			.rejects
 			.toThrow(/must_change|权限|设置/);
 	});

package/src/market/__tests__/sharding.test.ts

@@ -0,0 +1,90 @@
+import type { BuiltSolution } from "../index-builder";
+// packShards spec（REG-CS5 / D3）：装箱策略——整包装箱、累加到上限开新片、超限包才跨连续片。
+// 钉死「索引只取决于目录内容」：同样输入永远同样输出（编号由 build-index 按内容匹配分配，
+// 这里只断言槽位序列与片号映射）。
+import { describe, expect, it } from "vitest";
+import { packShards, SHARD_MAX_VERSIONS } from "../sharding";
+
+function solution(name: string, count: number): BuiltSolution {
+	return {
+		name,
+		latest: `${name}-${count}`,
+		versions: Array.from({ length: count }, (_, i) => ({ name, version: `0.${i}.0`, archive: { file: `${name}-0.${i}.0.tgz` } })),
+	};
+}
+
+function versionsOf(slots: ReturnType<typeof packShards>["slots"], no: number): number {
+	return slots[no - 1]!.versions;
+}
+
+describe("given 一批方案 When 装箱", () => {
+	it("then 整包入片、版本数累加到上限才开新片（1000 条一片）", () => {
+		const packed = packShards([solution("a", 600), solution("b", 400)]);
+		expect(packed.slots).toHaveLength(1);
+		expect(packed.slots[0]!.solutions.map(s => s.name)).toEqual(["a", "b"]);
+		expect(versionsOf(packed.slots, 1)).toBe(SHARD_MAX_VERSIONS);
+		expect(packed.assignment.get("a")).toEqual([1]);
+		expect(packed.assignment.get("b")).toEqual([1]);
+	});
+
+	it("then 放不下就开新片：已有包不换片，只把放不下的挤到新片", () => {
+		const packed = packShards([solution("a", 600), solution("b", 500)]);
+		expect(packed.slots).toHaveLength(2);
+		expect(versionsOf(packed.slots, 1)).toBe(600);
+		expect(versionsOf(packed.slots, 2)).toBe(500);
+		expect(packed.assignment.get("a")).toEqual([1]);
+		expect(packed.assignment.get("b")).toEqual([2]);
+	});
+
+	it("then 空索引也产一个空片（catalog 的 shards 映射不为空，读方口径统一）", () => {
+		const packed = packShards([]);
+		expect(packed.slots).toHaveLength(1);
+		expect(packed.slots[0]!.solutions).toEqual([]);
+		expect(packed.assignment.size).toBe(0);
+	});
+
+	it("then 确定性：同输入两次装箱，槽位逐字节同构", () => {
+		const input = [solution("a", 3), solution("b", 2), solution("c", 1)];
+		expect(JSON.stringify(packShards(input))).toBe(JSON.stringify(packShards(input)));
+	});
+});
+
+describe("given 2500 个版本、1 个包 When 装箱（S2-1 BDD）", () => {
+	it("then 生成 3 个 shard 且每片 ≤1000 条，catalog 可指向该包所在三片", () => {
+		const packed = packShards([solution("mega", 2500)]);
+		expect(packed.slots).toHaveLength(3);
+		expect(versionsOf(packed.slots, 1)).toBe(1000);
+		expect(versionsOf(packed.slots, 2)).toBe(1000);
+		expect(versionsOf(packed.slots, 3)).toBe(500);
+		expect(packed.assignment.get("mega")).toEqual([1, 2, 3]);
+	});
+
+	it("then 最高片装最新版：latest 落在最后一片，安装只请求 1 个 shard", () => {
+		const packed = packShards([solution("mega", 2500)]);
+		const last = packed.slots[2]!;
+		expect(last.solutions[0]!.versions.at(-1)!.version).toBe("0.2499.0");
+		expect(last.solutions[0]!.latest).toBe("mega-2500");
+	});
+});
+
+describe("given 一个包自身超限 When 装箱", () => {
+	it("then 按连续上限切片、占连续片号，片内仍是完整方案条目", () => {
+		const packed = packShards([solution("mega", SHARD_MAX_VERSIONS * 2 + 7), solution("small", 3)]);
+		expect(packed.slots).toHaveLength(4);
+		expect(packed.assignment.get("mega")).toEqual([1, 2, 3]);
+		expect(packed.assignment.get("small")).toEqual([4]);
+		for (const slot of packed.slots.slice(0, 3)) {
+			expect(slot.solutions).toHaveLength(1);
+			expect(slot.solutions[0]!.name).toBe("mega");
+			expect(slot.versions).toBeLessThanOrEqual(SHARD_MAX_VERSIONS);
+		}
+		expect(versionsOf(packed.slots, 3)).toBe(7);
+	});
+
+	it("then 超限包前后的普通包互不挤占", () => {
+		const packed = packShards([solution("before", 10), solution("mega", SHARD_MAX_VERSIONS * 2 + 1), solution("after", 10)]);
+		expect(packed.assignment.get("before")).toEqual([1]);
+		expect(packed.assignment.get("mega")).toEqual([2, 3, 4]);
+		expect(packed.assignment.get("after")).toEqual([5]);
+	});
+});

package/src/market/__tests__/verify.test.ts

@@ -1,21 +1,32 @@
-// ojm market verify spec（T7）：离线验包——不起站点、不装、不要凭据。
+import type { VerifyCheck } from "../verify";
+// ojm market verify spec（T7 + REG-CS5 三级化）：离线验包——不起站点、不装、不要凭据。
 //
 // 钉死两条：① 四类校验分列（完整性 / 包级签 / 索引签 / 结构），篡改任一项都必须在对应项上打叉；
 // ② 结论恒带边界声明——验签过 ≠ 代码无恶意，这一点写错比校验写错更危险。
+//
+// 三级化后的索引面：catalog.yaml（代次真源）+ shards/<n>.yaml（版本明细与 archive.sha256）。
+// 索引验签按文件分列（catalog 一项、每片一项），同代校验单独一项——红队 F2 的中间态
+// （新 catalog 钉旧片）必须在同代项上打叉，且按「运维事故」而不是「被篡改」提示。
 import { Buffer } from "node:buffer";
 import { generateKeyPairSync } from "node:crypto";
 import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { describe, expect, it } from "vitest";
+import { dirname, join } from "node:path";
 
+import { describe, expect, it } from "vitest";
+import { parse, stringify } from "yaml";
+import { createDeterministicTgz } from "../../deterministic-tar";
+import { recomputeIndex, signIndex } from "../../publish";
+import { signCommand } from "../../sign";
 import { buildIndex } from "../build-index";
 import { publishPackage } from "../publish";
+import { readTgz } from "../scan";
 import { verifyMarket } from "../verify";
 
 const MOUNTS = "  - prefix: /api\n    api: src\n  - prefix: /cdn\n    web: ../cdn\n";
 const CONFIG = `mounts:\n${MOUNTS}server:\n  host: 127.0.0.1\n  port: 9778\n`;
 const KEY_ID = "demo.publisher";
+const REGISTRY_ID = "test.registry";
 
 function testPem(): string {
 	return generateKeyPairSync("ed25519").privateKey.export({ type: "pkcs8", format: "pem" }).toString();
@@ -32,15 +43,20 @@ function newProject(): string {
 /** 落一个包并重建索引，返回工程根 */
 async function seed(): Promise<string> {
 	const root = newProject();
-	await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: testPem() });
+	await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: testPem(), registryId: REGISTRY_ID });
 	await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
 	return root;
 }
 
-function itemOf(result: Awaited<ReturnType<typeof verifyMarket>>, name: string): { ok: boolean, detail: string } | undefined {
+function itemOf(result: Awaited<ReturnType<typeof verifyMarket>>, name: string): VerifyCheck | undefined {
 	return result.checks.find(c => c.item === name);
 }
 
+/** 全部「索引签名」项（三级化后按文件分列：catalog 一项 + 每片一项） */
+function sigItems(result: Awaited<ReturnType<typeof verifyMarket>>): VerifyCheck[] {
+	return result.checks.filter(c => c.item === "索引签名");
+}
+
 describe("given 一个正常落地的包 When 离线验包", () => {
 	it("then 四类校验全绿且结论带边界声明", async () => {
 		const root = await seed();
@@ -50,12 +66,57 @@ describe("given 一个正常落地的包 When 离线验包", () => {
 		expect(result.passed).toBe(true);
 		expect(itemOf(result, "完整性")?.ok).toBe(true);
 		expect(itemOf(result, "包级签名")?.ok).toBe(true);
-		expect(itemOf(result, "索引签名")?.ok).toBe(true);
+		// 三级索引：catalog 与 1 号片各签各的，两项都在且全绿
+		const sigs = sigItems(result);
+		expect(sigs.length).toBeGreaterThanOrEqual(2);
+		expect(sigs.every(c => c.ok)).toBe(true);
 		expect(itemOf(result, "manifest 结构")?.ok).toBe(true);
 		expect(result.conclusion).toContain("不构成内容安全性背书");
 	});
 });
 
+describe("given 真实工程包（manifest 按 C2-29 整体省略 archive 占位）When 离线验包", () => {
+	it("then manifest 结构不因此打叉（REG-CS8 回归：ojm build --bundle 不落 archive ≠ 缺必填）", async () => {
+		const root = await seed();
+		const tgz = join(root, "cdn", "demo-solution-0.1.0.tgz");
+		// 解包 → 摘掉根 manifest 的 archive（fixture 有、真实方案无的字段差）→ 确定性重打包 → 重签 → 重建索引
+		const staging = mkdtempSync(join(tmpdir(), "ojm-verify-noarchive-"));
+		for (const e of readTgz(new Uint8Array(readFileSync(tgz)))) {
+			if (e.name.endsWith("/"))
+				continue;
+			const abs = join(staging, e.name);
+			mkdirSync(dirname(abs), { recursive: true });
+			writeFileSync(abs, e.content);
+		}
+		const rootManifestPath = join(staging, "manifest.yaml");
+		const manifest = parse(readFileSync(rootManifestPath, "utf-8")) as Record<string, unknown>;
+		delete manifest.archive;
+		writeFileSync(rootManifestPath, stringify(manifest));
+		await createDeterministicTgz(staging, tgz);
+		signCommand(tgz, { id: KEY_ID, privateKeyPem: testPem(), registryId: REGISTRY_ID });
+		await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
+
+		const result = await verifyMarket({ projectRoot: root });
+
+		expect(itemOf(result, "manifest 结构")?.ok).toBe(true);
+		rmSync(staging, { recursive: true, force: true });
+	});
+});
+
+describe("given 预发布版本（文件名含连字符）包体被篡改 When 离线验包", () => {
+	it("then 完整性仍能检出（不再因文件名解析错配而静默放过，REG-CS1 边界）", async () => {
+		const root = newProject();
+		await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0-rc.1", id: KEY_ID, privateKeyPem: testPem(), registryId: REGISTRY_ID });
+		await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
+		const tgz = join(root, "cdn", "demo-solution-0.1.0-rc.1.tgz");
+		const buf = readFileSync(tgz);
+		buf[buf.length - 1] ^= 0xFF; // 篡改末字节
+		writeFileSync(tgz, buf);
+		const result = await verifyMarket({ projectRoot: root });
+		expect(itemOf(result, "完整性")?.ok).toBe(false);
+	});
+});
+
 describe("given 包体被改了一个字节 When 离线验包", () => {
 	it("then 完整性与包级签名双双打叉（sha256 不符 + 验签不过）", async () => {
 		const root = await seed();
@@ -84,24 +145,176 @@ describe("given 包级签名被删掉 When 离线验包", () => {
 	});
 });
 
-describe("given 索引被手改过 When 离线验包", () => {
-	it("then 索引签名打叉（索引签名是完整性层，篡改必须可见）", async () => {
+describe("given catalog.yaml 被手改过 When 离线验包", () => {
+	it("then 索引签名打叉 index_sig_mismatch（索引签名是完整性层，篡改必须可见）", async () => {
 		const root = await seed();
-		const bundles = join(root, "cdn", "bundles.yaml");
-		writeFileSync(bundles, `${readFileSync(bundles, "utf-8")}\n# tampered\n`);
+		const catalog = join(root, "cdn", "catalog.yaml");
+		writeFileSync(catalog, `${readFileSync(catalog, "utf-8")}\n# tampered\n`);
 
 		const result = await verifyMarket({ projectRoot: root });
 
-		expect(itemOf(result, "索引签名")?.ok).toBe(false);
+		expect(result.passed).toBe(false);
+		expect(sigItems(result).some(c => !c.ok && c.detail.includes("catalog.yaml"))).toBe(true);
+		// REG-CS1：篡改与缺失必须可分（前者是安全事件，后者是发布流程漏了）
+		expect(sigItems(result).find(c => c.detail.includes("catalog.yaml"))?.code).toBe("index_sig_mismatch");
+	});
+});
+
+describe("given 分片正文被手改过 When 离线验包", () => {
+	it("then 该片索引签名打叉 index_sig_mismatch，且完整性同步打叉（sha256 声明已不可信）", async () => {
+		const root = await seed();
+		const shard = join(root, "cdn", "shards", "1.yaml");
+		// 把声明里的 sha256 改掉：片签名失配 + 索引声明的摘要与包体不符，两层都须看见。
+		// 篡改值取带字母的十六进制（f…f）——纯数字串会被 YAML 解析成 number，那是另一种形态的坏索引
+		const before = readFileSync(shard, "utf-8");
+		const text = before.replace(/sha256: [0-9a-f]{64}/, `sha256: ${"f".repeat(64)}`);
+		expect(text).not.toEqual(before); // 确认替换命中（夹具确有该字段）
+		writeFileSync(shard, text);
+
+		const result = await verifyMarket({ projectRoot: root });
+
+		expect(result.passed).toBe(false);
+		expect(sigItems(result).find(c => c.detail.includes("shards/1.yaml"))?.code).toBe("index_sig_mismatch");
+		expect(itemOf(result, "完整性")?.ok).toBe(false);
+	});
+});
+
+describe("given 索引缺 .sig When 离线验包", () => {
+	it("then 索引签名打叉 index_sig_missing 并给两步补签提示（不再「运行期容忍」）", async () => {
+		const root = await seed();
+		rmSync(join(root, "cdn", "catalog.yaml.sig"));
+		rmSync(join(root, "cdn", "shards", "1.yaml.sig"));
+
+		const result = await verifyMarket({ projectRoot: root });
+
+		expect(result.passed).toBe(false);
+		const bad = sigItems(result).filter(c => !c.ok);
+		expect(bad.length).toBeGreaterThanOrEqual(2);
+		expect(bad.every(c => c.code === "index_sig_missing")).toBe(true);
+		expect(bad[0]?.detail).toContain("ojm market build-index");
+		expect(bad[0]?.detail).toContain("ojm publish");
+	});
+});
+
+describe("given 只缺 catalog 的 .sig When 离线验包", () => {
+	it("then catalog 项打叉 index_sig_missing、分片项不受牵连（按文件分列的意义）", async () => {
+		const root = await seed();
+		rmSync(join(root, "cdn", "catalog.yaml.sig"));
+
+		const result = await verifyMarket({ projectRoot: root });
+
+		const sigs = sigItems(result);
+		expect(sigs.find(c => c.detail.includes("catalog.yaml"))?.code).toBe("index_sig_missing");
+		expect(sigs.find(c => c.detail.includes("shards/1.yaml"))?.ok).toBe(true);
+	});
+});
+
+describe("given catalog 正文代次与签名代次不一致 When 离线验包", () => {
+	it("then 同代校验打叉报 index_generation_mismatch 并提示「源正在重建索引」（不是「索引被篡改」）", async () => {
+		const root = await seed();
+		// 改了正文没换签名：正文自称第 7 代、签名还是第 1 代
+		const catalog = join(root, "cdn", "catalog.yaml");
+		writeFileSync(catalog, readFileSync(catalog, "utf-8").replace(/^seq: \d+$/m, "seq: 7"), "utf-8");
+
+		const result = await verifyMarket({ projectRoot: root });
+
+		expect(result.passed).toBe(false);
+		const item = itemOf(result, "索引同代");
+		expect(item?.ok).toBe(false);
+		expect(item?.code).toBe("index_generation_mismatch");
+		expect(item?.detail).toContain("源正在重建索引，请稍后重试");
+		expect(item?.detail).not.toContain("被篡改");
+	});
+});
+
+describe("given catalog 钉的片代次与分片签名不符 When 离线验包（红队 F2 新形态：新目录钉旧片）", () => {
+	it("then 同代校验打叉 index_generation_mismatch（拼不进，按运维事故提示重试）", async () => {
+		const root = await seed();
+		const cdn = join(root, "cdn");
+		// 分片签名重签成第 2 代（签名本身有效），catalog 仍钉第 1 代——「写到一半」的中间态
+		const shardText = recomputeIndex(readFileSync(join(cdn, "shards", "1.yaml"), "utf-8"));
+		writeFileSync(
+			join(cdn, "shards", "1.yaml.sig"),
+			`${JSON.stringify(signIndex("shard", 2, shardText, testPem(), KEY_ID), null, 2)}\n`,
+			"utf-8",
+		);
+
+		const result = await verifyMarket({ projectRoot: root });
+
+		const item = itemOf(result, "索引同代");
+		expect(item?.ok).toBe(false);
+		expect(item?.code).toBe("index_generation_mismatch");
+		expect(item?.detail).toContain("源正在重建索引，请稍后重试");
+	});
+});
+
+describe("given 分片正文没了但 catalog 还钉着它 When 离线验包", () => {
+	it("then 同代校验打叉 index_generation_mismatch（代次不可判定即拒，fail-closed）", async () => {
+		const root = await seed();
+		rmSync(join(root, "cdn", "shards", "1.yaml"));
+		rmSync(join(root, "cdn", "shards", "1.yaml.sig"));
+
+		const result = await verifyMarket({ projectRoot: root });
+
+		const item = itemOf(result, "索引同代");
+		expect(item?.ok).toBe(false);
+		expect(item?.code).toBe("index_generation_mismatch");
+		expect(item?.detail).toContain("正文缺失");
+	});
+});
+
+describe("given 索引的 .sig 是旧格式（不带 seq）When 离线验包", () => {
+	it("then 索引签名打叉并报 index_sig_mismatch（签名未覆盖代次 = 挡不住新旧拼接）", async () => {
+		const root = await seed();
+		const sigPath = join(root, "cdn", "catalog.yaml.sig");
+		const sig = JSON.parse(readFileSync(sigPath, "utf-8")) as Record<string, unknown>;
+		delete sig.seq;
+		writeFileSync(sigPath, JSON.stringify(sig), "utf-8");
+
+		const result = await verifyMarket({ projectRoot: root });
+
+		expect(sigItems(result).find(c => c.detail.includes("catalog.yaml"))?.code).toBe("index_sig_mismatch");
+	});
+});
+
+describe("given 索引已过自声明的失效时刻 When 离线验包", () => {
+	it("then 索引时效打叉报 index_expired（REG-CS2：与站点安装同一判定，CLI/API 一致）", async () => {
+		const root = await seed();
+		const catalogPath = join(root, "cdn", "catalog.yaml");
+		const doc = parse(readFileSync(catalogPath, "utf-8")) as Record<string, unknown>;
+		doc.issued_at = 1;
+		doc.expires_at = 2;
+		writeFileSync(catalogPath, stringify(doc), "utf-8");
+
+		const result = await verifyMarket({ projectRoot: root });
+
+		expect(itemOf(result, "索引时效")?.ok).toBe(false);
+		expect(itemOf(result, "索引时效")?.code).toBe("index_expired");
+	});
+});
+
+describe("given 索引不带时效字段（旧 ojm 产物）When 离线验包", () => {
+	it("then 索引时效打叉（不可判定即按过期处理，不默认当新鲜）", async () => {
+		const root = await seed();
+		const catalogPath = join(root, "cdn", "catalog.yaml");
+		const doc = parse(readFileSync(catalogPath, "utf-8")) as Record<string, unknown>;
+		delete doc.issued_at;
+		delete doc.expires_at;
+		writeFileSync(catalogPath, stringify(doc), "utf-8");
+
+		const result = await verifyMarket({ projectRoot: root });
+
+		expect(itemOf(result, "索引时效")?.ok).toBe(false);
+		expect(itemOf(result, "索引时效")?.code).toBe("index_expired");
 	});
 });
 
 describe("given 落了 tgz 但没重建索引 When 带 --rebuild-check 验包", () => {
 	it("then 报漂移：索引缺该包条目", async () => {
 		const root = newProject();
-		await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: testPem() });
+		await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: testPem(), registryId: REGISTRY_ID });
 		await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
-		await publishPackage({ projectRoot: root, fixture: "other-solution@0.1.0", id: KEY_ID, privateKeyPem: testPem() });
+		await publishPackage({ projectRoot: root, fixture: "other-solution@0.1.0", id: KEY_ID, privateKeyPem: testPem(), registryId: REGISTRY_ID });
 
 		const result = await verifyMarket({ projectRoot: root, rebuildCheck: true });
 
@@ -109,3 +322,14 @@ describe("given 落了 tgz 但没重建索引 When 带 --rebuild-check 验包",
 		expect(result.drift?.join(" ")).toMatch(/other-solution/);
 	});
 });
+
+describe("given 索引声明了某个版本但盘上包没了 When 带 --rebuild-check 验包", () => {
+	it("then 报反向漂移：索引多条目（只查正向会让「答应有、实际没有」漏过去）", async () => {
+		const root = await seed();
+		rmSync(join(root, "cdn", "demo-solution-0.1.0.tgz"));
+
+		const result = await verifyMarket({ projectRoot: root, rebuildCheck: true });
+
+		expect(result.drift?.join(" ")).toMatch(/索引多条目：demo-solution@0\.1\.0/);
+	});
+});

package/src/market/__tests__/yank-ledger.test.ts

@@ -0,0 +1,60 @@
+// ojm market yank 账本单测（REG-CS4）：幂等、审计留痕、不存在版本明确报错、跨重建存活。
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+
+import { markYanked, readYankLedger, yankKey } from "../yank-ledger";
+
+function newProject(): { root: string, cdn: string } {
+	const root = mkdtempSync(join(tmpdir(), "ojm-yank-"));
+	mkdirSync(join(root, "api"), { recursive: true });
+	const cdn = join(root, "cdn");
+	mkdirSync(cdn, { recursive: true });
+	writeFileSync(join(root, "api", "config.yaml"), "mounts:\n  - prefix: /api\n    api: src\n  - prefix: /cdn\n    web: ../cdn\nserver:\n  host: 127.0.0.1\n  port: 9778\n", "utf-8");
+	writeFileSync(join(cdn, "demo-solution-0.1.0.tgz"), "", "utf-8");
+	writeFileSync(join(cdn, "demo-solution-0.2.0.tgz"), "", "utf-8");
+	return { root, cdn };
+}
+
+describe("yank 账本（REG-CS4）", () => {
+	it("markYanked 写盘后 readYankLedger 可回读，含 by/reason/at 审计字段", async () => {
+		const { root } = newProject();
+		markYanked(root, "demo-solution", "0.1.0", { by: "alice", reason: "CVE-2026-1", now: 1_700_000_000 });
+		const ledger = readYankLedger(root);
+		const e = ledger.get(yankKey("demo-solution", "0.1.0"));
+		expect(e).toMatchObject({ name: "demo-solution", version: "0.1.0", by: "alice", reason: "CVE-2026-1", at: 1_700_000_000 });
+	});
+
+	it("重复 yank 幂等：不覆盖既有 by/at/reason，created=false", async () => {
+		const { root } = newProject();
+		markYanked(root, "demo-solution", "0.1.0", { by: "alice", reason: "first", now: 1 });
+		const r = markYanked(root, "demo-solution", "0.1.0", { by: "bob", reason: "second", now: 2 });
+		expect(r.created).toBe(false);
+		const e = readYankLedger(root).get(yankKey("demo-solution", "0.1.0"))!;
+		// 首次写入保活，不被第二次覆盖
+		expect(e).toMatchObject({ by: "alice", reason: "first", at: 1 });
+	});
+
+	it("对 cdn 不存在的版本 yank → 明确报错，账本不动", async () => {
+		const { root } = newProject();
+		let thrown: unknown;
+		try {
+			await markYanked(root, "demo-solution", "9.9.9", { by: "x" });
+		}
+		catch (e) {
+			thrown = e;
+		}
+		expect(thrown).toBeInstanceOf(Error);
+		expect(String((thrown as Error).message)).toContain("无法下线");
+		expect(readYankLedger(root).size).toBe(0);
+	});
+
+	it("账本跨多次索引重建存活（file 不删＝yank 不丢）", async () => {
+		const { root, cdn } = newProject();
+		markYanked(root, "demo-solution", "0.1.0", { by: "alice", now: 5 });
+		// 模拟另一版本发布后重建（账本应原样保留）
+		writeFileSync(join(cdn, "demo-solution-0.3.0.tgz"), "", "utf-8");
+		expect(readYankLedger(root).get(yankKey("demo-solution", "0.1.0"))?.by).toBe("alice");
+	});
+});

package/src/market/bootstrap.ts

@@ -140,11 +140,16 @@ export async function bootstrapIsolatedSite(opts: BootstrapOptions = {}): Promis
 	cfg = cfg.replace("__JWT_SECRET__", randomBytes(32).toString("hex"));
 	// 最小 SPA 挂载：真实部署里前端路由（深检会逐条探活）由站点壳承接；没有 web 挂载时
 	// 这些路径一律 404，深检会判成 anomaly。这里放一个 index.html 就够（不构建前端）。
-	// 挂在 /cdn 之后（前缀特异性匹配，顺序无关，仅为可读）。
 	const siteDir = path.join(root, "site");
 	mkdirSync(siteDir, { recursive: true });
 	writeFileSync(path.join(siteDir, "index.html"), "<!doctype html><html><body>ojm trial site</body></html>\n", "utf-8");
-	cfg = cfg.replace("web: ./cdn", `web: ${cdnDir}\n  - prefix: /\n    web: ${siteDir}\n    spa: true`);
+	// 只改 /cdn 的 web 指向（保留其 headers 缓存头，Q8 yank 120s 设计不能丢），
+	// 再把最小 SPA 挂载作为 /cdn 的同级兄弟追加在 headers 块之后（前缀特异性匹配，顺序无关）。
+	cfg = cfg.replace("web: ./cdn", `web: ${cdnDir}`);
+	cfg = cfg.replace(
+		"      Cache-Control: 'max-age=60, stale-while-revalidate=60'",
+		`      Cache-Control: 'max-age=60, stale-while-revalidate=60'\n  - prefix: /\n    web: ${siteDir}\n    spa: true`,
+	);
 	// 安装目标恒为 release 部署：装好的模块落在 dist/api，dev 形态（--api-path src）发现不了。
 	// 故隔离站点以 dist 起站，platform.root 同步改写（oj 校验 root 必须是生效的 api 挂载目录）。
 	// root 相对 **config 所在目录** 解析——config 在隔离根，产物在 <root>/dist/api，故不能写死
@@ -171,7 +176,7 @@ export async function bootstrapIsolatedSite(opts: BootstrapOptions = {}): Promis
 
 	// 6) 隔离 CDN：落 fixture 包 + 重建索引（publish/buildIndex 直落临时根）
 	mkdirSync(cdnDir, { recursive: true });
-	await publishPackage({ projectRoot: root, fixture: opts.fixture, id: keyId, privateKeyPem: publisher.privateKeyPem });
+	await publishPackage({ projectRoot: root, fixture: opts.fixture, id: keyId, privateKeyPem: publisher.privateKeyPem, registryId: "trial.registry" });
 	await buildIndex({ projectRoot: root, id: keyId, privateKeyPem: publisher.privateKeyPem });
 
 	// 7) 后端构建（dist/api + versions.json；安装与 reloading 都依赖它）