@oj-module/cli 0.2.66 → 0.2.68

package/shell-dist/index.html

@@ -5,8 +5,8 @@
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 		<link rel="icon" href="/favicon.ico" />
 		<title>React Antd Admin · Shell</title>
-		<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self' https://modules.cdn.example.com 'wasm-unsafe-eval' 'nonce-cmxX2YjsUdU97XzeijFvTw=='; script-src-attr 'none'; connect-src 'self' data: https://modules.cdn.example.com; style-src 'self' https://modules.cdn.example.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; frame-src https://ant.design https://react.dev https://condorheroblog.github.io; form-action 'none'; base-uri 'none'; object-src 'none'; upgrade-insecure-requests" />
-		<script type="importmap" nonce="cmxX2YjsUdU97XzeijFvTw==">{
+		<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self' https://modules.cdn.example.com 'wasm-unsafe-eval' 'nonce-36CAd5UpXCtQqxASbhUFfw=='; script-src-attr 'none'; connect-src 'self' data: https://modules.cdn.example.com; style-src 'self' https://modules.cdn.example.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; frame-src https://ant.design https://react.dev https://condorheroblog.github.io; form-action 'none'; base-uri 'none'; object-src 'none'; upgrade-insecure-requests" />
+		<script type="importmap" nonce="36CAd5UpXCtQqxASbhUFfw==">{
   "imports": {
     "react": "/assets/react.1ew63mwts0.js",
     "react/jsx-runtime": "/assets/jsx-runtime.h40xu4o5b0.js",
@@ -16,7 +16,7 @@
     "react-router": "/assets/react-router.2h9rebcv50.js",
     "react-router/dom": "/assets/react-router-dom.3c6zld8h40.js",
     "@tanstack/react-query": "/assets/react-query.3rln45ow00.js",
-    "@oj-module/runtime": "/assets/runtime.1xfsxcajj0.js",
+    "@oj-module/runtime": "/assets/runtime.1xzahckt10.js",
     "@oj-module/runtime/contract": "/assets/contract.3h327o3mj0.js",
     "@oj-module/runtime/contract/errors": "/assets/contract-errors.2o17vz9u50.js",
     "@plane/kit": "/assets/kit.37kr8ui390.js",
@@ -79,7 +79,7 @@
 			.boot-skeleton:after{content:"";width:18px;height:18px;margin-left:8px;border:2px solid #d9d9d9;border-top-color:#1677ff;border-radius:50%;animation:bs-spin .8s linear infinite}
 			@keyframes bs-spin{to{transform:rotate(360deg)}}
 		</style>
-		<script nonce="cmxX2YjsUdU97XzeijFvTw==" data-ojm-preload="/assets/cssinjs.atgmhan7m0.js,/assets/pro-components.2kyot1vcl0.js,/assets/runtime.1xfsxcajj0.js,/assets/react-query.3rln45ow00.js,/assets/antd.uw1coq15l0.js,/assets/react.1ew63mwts0.js,/assets/react-dom-client.ick0v05ob0.js,/assets/react-i18next.auhvjhqv00.js,/assets/react-router.2h9rebcv50.js,/assets/jsx-runtime.h40xu4o5b0.js,/assets/react-dom.2so9uxg3f0.js,/assets/clsx.jotilrt2e0.js,/assets/antd-es-locale-zh_CN.1gjjsvxbf0.js,/assets/dayjs.pa60l6wjo0.js,/assets/ojm-dayjs-locale-zh-cn.3vr3beiyp0.js,/assets/use-sync-external-store-shim.1nz1pi9bb0.js,/assets/icons.159wjwals0.js,/assets/dayjs-plugin-quarterOfYear.2oqo1lcx80.js,/assets/dayjs-plugin-customParseFormat.13xhghv1d0.js,/assets/dayjs-plugin-advancedFormat.3vsyd2eis0.js,/assets/dayjs-plugin-isoWeek.1fn1tw82p0.js,/assets/dayjs-plugin-localeData.2rwbjp9nk0.js,/assets/dayjs-plugin-weekday.2d56a4tml0.js,/assets/dayjs-plugin-weekOfYear.gvn9iph080.js,/assets/dayjs-plugin-relativeTime.2pqs3et4y0.js,/assets/dnd-kit-core.1xyreig6r0.js,/assets/dnd-kit-utilities.1umw4xphb0.js,/assets/dnd-kit-sortable.s94qciuft0.js,/assets/ky.1cgch7gu60.js,/assets/zustand.3gjgzlnqo0.js,/assets/zustand-middleware.1xaxjueme0.js,/assets/react-error-boundary.2dncdfj3b0.js,/assets/antd-locale-en_US.561tozx860.js,/assets/antd-locale-zh_CN.1cmpmgzh70.js,/assets/i18next.33zqofapj0.js,/assets/tailwind-merge.125ehiqjw0.js,/assets/nprogress.2nz76n9ny0.js,/assets/nprogress-css.1cq2pzkre0.js,/assets/react-jss.1ei6dr9e00.js,/assets/ahooks.2l850ymmh0.js,/assets/spin-delay.yjeyj6iwp0.js,/assets/simplebar-react.2g739uvai0.js,/assets/keepalive-for-react.xenu5vam70.js,/assets/zustand-shallow.6cz0yyv9x0.js,/assets/contract-errors.2o17vz9u50.js,/assets/antd-img-crop.196rkty480.js,/assets/icons-es-components-Context.365qmflwg0.js,/assets/dayjs-plugin-weekYear.2u78l3ex10.js,/assets/zustand-vanilla.1mo3ka3g30.js,/assets/zustand-react.9fsl9brxy0.js,/assets/zustand-vanilla-shallow.3424monv50.js,/assets/zustand-react-shallow.pybayv1hx0.js,/assets/ojm-antd-es-modal.bf3tgdh8v0.js,/assets/ojm-antd-es-upload.13gx45e0g0.js,/assets/ojm-antd-es-button.2uriphio50.js,/assets/ojm-antd-es-slider.xyvptuhid0.js" data-ojm-entry="/assets/index.i0kqbxp050.js">(function(){var cs=document.currentScript;try{var ua=(navigator.userAgent||"").toLowerCase(),p=location.pathname;while(p.length>1&&p.charAt(p.length-1)==="/")p=p.slice(0,-1);if(ua.indexOf("wxwork")>=0&&p.slice(-6)==="/login"&&!new URLSearchParams(location.search).get("wecom_ticket")){var a=(typeof window.__OJ_API_BASE__==="string"&&window.__OJ_API_BASE__.trim())||"/api";while(a.length>1&&a.charAt(a.length-1)==="/")a=a.slice(0,-1);location.replace(a+"/auth/wecom/login");return}}catch(e){}var pl=cs.getAttribute("data-ojm-preload");if(pl){var ps=pl.split(",");for(var i=0;i<ps.length;i++){var l=document.createElement("link");l.rel="modulepreload";l.href=ps[i];document.head.appendChild(l);}}var s=document.createElement("script");s.type="module";s.src=cs.getAttribute("data-ojm-entry");document.head.appendChild(s);})();</script>
+		<script nonce="36CAd5UpXCtQqxASbhUFfw==" data-ojm-preload="/assets/cssinjs.atgmhan7m0.js,/assets/pro-components.2kyot1vcl0.js,/assets/runtime.1xzahckt10.js,/assets/react-query.3rln45ow00.js,/assets/antd.uw1coq15l0.js,/assets/react.1ew63mwts0.js,/assets/react-dom-client.ick0v05ob0.js,/assets/react-i18next.auhvjhqv00.js,/assets/react-router.2h9rebcv50.js,/assets/jsx-runtime.h40xu4o5b0.js,/assets/react-dom.2so9uxg3f0.js,/assets/clsx.jotilrt2e0.js,/assets/antd-es-locale-zh_CN.1gjjsvxbf0.js,/assets/dayjs.pa60l6wjo0.js,/assets/ojm-dayjs-locale-zh-cn.3vr3beiyp0.js,/assets/use-sync-external-store-shim.1nz1pi9bb0.js,/assets/icons.159wjwals0.js,/assets/dayjs-plugin-quarterOfYear.2oqo1lcx80.js,/assets/dayjs-plugin-customParseFormat.13xhghv1d0.js,/assets/dayjs-plugin-advancedFormat.3vsyd2eis0.js,/assets/dayjs-plugin-isoWeek.1fn1tw82p0.js,/assets/dayjs-plugin-localeData.2rwbjp9nk0.js,/assets/dayjs-plugin-weekday.2d56a4tml0.js,/assets/dayjs-plugin-weekOfYear.gvn9iph080.js,/assets/dayjs-plugin-relativeTime.2pqs3et4y0.js,/assets/dnd-kit-core.1xyreig6r0.js,/assets/dnd-kit-utilities.1umw4xphb0.js,/assets/dnd-kit-sortable.s94qciuft0.js,/assets/ky.1cgch7gu60.js,/assets/zustand.3gjgzlnqo0.js,/assets/zustand-middleware.1xaxjueme0.js,/assets/react-error-boundary.2dncdfj3b0.js,/assets/antd-locale-en_US.561tozx860.js,/assets/antd-locale-zh_CN.1cmpmgzh70.js,/assets/i18next.33zqofapj0.js,/assets/tailwind-merge.125ehiqjw0.js,/assets/nprogress.2nz76n9ny0.js,/assets/nprogress-css.1cq2pzkre0.js,/assets/react-jss.1ei6dr9e00.js,/assets/ahooks.2l850ymmh0.js,/assets/spin-delay.yjeyj6iwp0.js,/assets/simplebar-react.2g739uvai0.js,/assets/keepalive-for-react.xenu5vam70.js,/assets/zustand-shallow.6cz0yyv9x0.js,/assets/contract-errors.2o17vz9u50.js,/assets/antd-img-crop.196rkty480.js,/assets/icons-es-components-Context.365qmflwg0.js,/assets/dayjs-plugin-weekYear.2u78l3ex10.js,/assets/zustand-vanilla.1mo3ka3g30.js,/assets/zustand-react.9fsl9brxy0.js,/assets/zustand-vanilla-shallow.3424monv50.js,/assets/zustand-react-shallow.pybayv1hx0.js,/assets/ojm-antd-es-modal.bf3tgdh8v0.js,/assets/ojm-antd-es-upload.13gx45e0g0.js,/assets/ojm-antd-es-button.2uriphio50.js,/assets/ojm-antd-es-slider.xyvptuhid0.js" data-ojm-entry="/assets/index.6alqyx6ae0.js">(function(){var cs=document.currentScript;try{var ua=(navigator.userAgent||"").toLowerCase(),p=location.pathname;while(p.length>1&&p.charAt(p.length-1)==="/")p=p.slice(0,-1);if(ua.indexOf("wxwork")>=0&&p.slice(-6)==="/login"&&!new URLSearchParams(location.search).get("wecom_ticket")){var a=(typeof window.__OJ_API_BASE__==="string"&&window.__OJ_API_BASE__.trim())||"/api";while(a.length>1&&a.charAt(a.length-1)==="/")a=a.slice(0,-1);var q=new URLSearchParams(location.search),w=new URLSearchParams(),k=["corp","agent"];for(var i=0;i<k.length;i++){var v=(q.get(k[i])||"").trim();if(v)w.set(k[i],v)}var qs=w.toString();location.replace(a+"/auth/wecom/login"+(qs?"?"+qs:""));return}}catch(e){}var pl=cs.getAttribute("data-ojm-preload");if(pl){var ps=pl.split(",");for(var i=0;i<ps.length;i++){var l=document.createElement("link");l.rel="modulepreload";l.href=ps[i];document.head.appendChild(l);}}var s=document.createElement("script");s.type="module";s.src=cs.getAttribute("data-ojm-entry");document.head.appendChild(s);})();</script>
 	</head>
 	<body>
 		<div id="root"><div class="boot-skeleton">加载中…</div></div>

package/shell-dist/versions.json

@@ -7,9 +7,9 @@
   "react-router": "7.18.2",
   "react-router/dom": "7.18.2",
   "@tanstack/react-query": "5.102.8",
-  "@oj-module/runtime": "0.2.66",
-  "@oj-module/runtime/contract": "0.2.66",
-  "@oj-module/runtime/contract/errors": "0.2.66",
+  "@oj-module/runtime": "0.2.68",
+  "@oj-module/runtime/contract": "0.2.68",
+  "@oj-module/runtime/contract/errors": "0.2.68",
   "@plane/kit": "0.1.20",
   "@plane/editor": "0.1.20",
   "antd": "6.6.1",

package/src/__tests__/cli.test.ts

@@ -21,6 +21,12 @@ let exitSpy: ReturnType<typeof vi.fn>;
 // 提升式 mock：vitest 测试体内注册的 vi.mock 拦不到 cli.ts 的 dynamic import，须 hoisted 顶层注册
 const buildBundleMock = vi.hoisted(() => vi.fn(async () => [{ file: "x.tgz" }]));
 vi.mock("../bundle", () => ({ buildBundle: buildBundleMock }));
+// 脚手架完整性门禁（scaffold-guard）：门禁失败必须先于一切产物写入
+const guardMock = vi.hoisted(() => vi.fn());
+vi.mock("../scaffold-guard", () => ({ assertDefaultModulesUntouched: guardMock }));
+const buildBackendMock = vi.hoisted(() => vi.fn(async () => {}));
+const buildModulesMock = vi.hoisted(() => vi.fn(async () => []));
+vi.mock("../build", () => ({ buildBackend: buildBackendMock, buildModules: buildModulesMock }));
 const vendorCommandMock = vi.hoisted(() => vi.fn(async () => {}));
 vi.mock("../vendor", () => ({ vendorCommand: vendorCommandMock }));
 // REG-CS3 v2：sign 的 --registry-id 曾只被 signCommand 要求、却没在 CLI 上接线，命令成死路
@@ -39,6 +45,9 @@ afterEach(() => {
 	buildBundleMock.mockClear();
 	vendorCommandMock.mockClear();
 	signCommandMock.mockClear();
+	guardMock.mockClear();
+	buildBackendMock.mockClear();
+	buildModulesMock.mockClear();
 });
 
 interface RunResult { out: string, unknown: string[], exitCode: number | undefined }
@@ -215,6 +224,28 @@ describe("参数映射", () => {
 	});
 });
 
+describe("脚手架完整性门禁", () => {
+	it("门禁失败 → 普通 build 不执行（零产物）、exit 1", async () => {
+		guardMock.mockImplementation(() => {
+			throw new Error("[ojm] 框架默认模块与上游模板不一致，已拒绝构建");
+		});
+		const r = await run(["build"], "zh-CN", tmp);
+		expect(guardMock).toHaveBeenCalledWith(tmp);
+		expect(buildBackendMock).not.toHaveBeenCalled();
+		expect(buildModulesMock).not.toHaveBeenCalled();
+		expect(r.exitCode).toBe(1);
+	});
+
+	it("门禁失败 → --bundle 同样不进 buildBundle", async () => {
+		guardMock.mockImplementation(() => {
+			throw new Error("[ojm] 框架默认模块与上游模板不一致，已拒绝构建");
+		});
+		const r = await run(["build", "--bundle", "demo"], "zh-CN", tmp);
+		expect(buildBundleMock).not.toHaveBeenCalled();
+		expect(r.exitCode).toBe(1);
+	});
+});
+
 describe("help 词形", () => {
 	it("ojm help build → build --help", () => {
 		expect(rewriteHelpArgv(["help", "build"])).toEqual(["build", "--help"]);

package/src/__tests__/new-scaffold.test.ts

@@ -56,4 +56,17 @@ describe("ojm new --api 骨架可路由（BDD）", () => {
 			expect(doc[key], `solution.yaml 缺 ${key}（market verify 必填）`).toBeDefined();
 		expect((doc.archive as Record<string, unknown>).file).toBe("crm-0.1.0.tgz");
 	});
+
+	it("给定 createSolution(api: true)，api 段声明 ping 匿名（安装预检 anonymous_residual 防线，20261106 市场线实测）", async () => {
+		const root = projectRoot();
+		const result = createSolution(root, "crm", { api: true, layout: "none" });
+		const { parse: yamlParse } = await import("yaml");
+		const doc = yamlParse(fs.readFileSync(path.join(result.dir, "solution.yaml"), "utf8")) as Record<string, unknown>;
+
+		// Then：ping 匿名可达必须在契约里声明（fixture.ts 同形状）；漏声明 = 真包装不进（preflight 拒）
+		const api = doc.api as Record<string, unknown>;
+		expect(api.module).toBe("crm");
+		expect(api.prefix).toBe("/api/crm");
+		expect(api.anonymous).toEqual(["crm/ping"]);
+	});
 });

package/src/__tests__/publish-keygen.test.ts

@@ -0,0 +1,157 @@
+// BDD：`ojm keygen --credential`（凭证通道，P5）。
+//
+// 三条不可退让的行为：
+//   · 身份只来自凭证——服务端下发什么 key_id 就落什么目录，CLI 不推导；
+//   · 兑换失败不落任何密钥文件（先兑换、后生成，顺序即保证）；
+//   · 不给凭证时逐字节走原离线路径（环境变量残留不得把离线用例带进网络分支）。
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { buildCli } from "../cli";
+import { exchangePublishCredential } from "../keygen";
+
+const TOKEN = "a".repeat(64);
+const KEY_ID = "demo-solution.wecom-everpan";
+
+let tmp: string;
+let logs: string[];
+let exitSpy: ReturnType<typeof vi.fn>;
+let savedCredential: string | undefined;
+let savedSite: string | undefined;
+
+beforeEach(() => {
+	tmp = fs.mkdtempSync(path.join(os.tmpdir(), "ojm-publish-keygen-"));
+	logs = [];
+	exitSpy = vi.fn();
+	vi.spyOn(console, "log").mockImplementation((...args: unknown[]) => logs.push(args.join(" ")));
+	vi.spyOn(console, "error").mockImplementation((...args: unknown[]) => logs.push(args.join(" ")));
+	// E-4：环境变量残留会把离线用例带进网络分支（先例 registry-cli.test.ts）
+	savedCredential = process.env.OJM_PUBLISH_CREDENTIAL;
+	savedSite = process.env.OJM_SITE_URL;
+	delete process.env.OJM_PUBLISH_CREDENTIAL;
+	delete process.env.OJM_SITE_URL;
+});
+
+afterEach(() => {
+	vi.restoreAllMocks();
+	vi.unstubAllGlobals();
+	if (savedCredential === undefined)
+		delete process.env.OJM_PUBLISH_CREDENTIAL;
+	else
+		process.env.OJM_PUBLISH_CREDENTIAL = savedCredential;
+	if (savedSite === undefined)
+		delete process.env.OJM_SITE_URL;
+	else
+		process.env.OJM_SITE_URL = savedSite;
+	fs.rmSync(tmp, { recursive: true, force: true });
+});
+
+/** 站点信封应答（oj 统一 {code,msg,data}） */
+function stubExchange(env: { code: number, msg?: string, data?: unknown }): ReturnType<typeof vi.fn> {
+	const fn = vi.fn(async () => new Response(JSON.stringify(env), { status: 200, headers: { "content-type": "application/json" } }));
+	vi.stubGlobal("fetch", fn);
+	return fn;
+}
+
+/** 跑一次 CLI 并等动作链结束（动态 import 需数百毫秒，同 cli.test.ts 的轮询口径） */
+async function run(argv: string[]): Promise<{ out: string, exitCode: number | undefined }> {
+	const cli = buildCli(tmp, "zh-CN", { exit: exitSpy as unknown as (code: number) => never });
+	cli.parse(["node", "ojm", ...argv], { run: true });
+	try {
+		await vi.waitUntil(() => logs.length > 0 || exitSpy.mock.calls.length > 0, { timeout: 2500, interval: 10 });
+	}
+	catch {
+		// 无输出型动作：兜底继续
+	}
+	await new Promise(r => setTimeout(r, 50));
+	return { out: logs.join("\n"), exitCode: exitSpy.mock.calls[0]?.[0] as number | undefined };
+}
+
+describe("ojm keygen --credential", () => {
+	it("given 有效凭证 When keygen --credential Then 落盘目录名等于服务端下发 key_id", async () => {
+		const fetchFn = stubExchange({ code: 0, data: { key_id: KEY_ID, product: "demo-solution", username: "wecom:everpan", display_name: "张三" } });
+
+		const r = await run(["keygen", "--credential", TOKEN, "--out", path.join(tmp, "keys"), "--yes"]);
+
+		expect(r.exitCode).toBeUndefined();
+		expect(fetchFn).toHaveBeenCalledTimes(1);
+		const [, init] = fetchFn.mock.calls[0] as unknown as [string, RequestInit];
+		expect(JSON.parse(String(init.body))).toEqual({ token: TOKEN });
+		expect(fs.existsSync(path.join(tmp, "keys", "private.pem"))).toBe(true);
+		expect(r.out).toContain(KEY_ID);
+		// 申请人展示带回人话（产品 + 人名），而不是只有一串 key_id
+		expect(r.out).toContain("demo-solution");
+		expect(r.out).toContain("张三");
+	});
+
+	it("given 已用/过期凭证 When keygen --credential Then 非零退出且不落任何密钥", async () => {
+		stubExchange({ code: 400, msg: "发布凭证无效或已失效（可能已兑换、已过期或已撤销）。请到「发布管理」页重新申请" });
+
+		const r = await run(["keygen", "--credential", TOKEN, "--out", path.join(tmp, "keys"), "--yes"]);
+
+		expect(r.exitCode).toBe(1);
+		expect(r.out).toContain("发布管理");
+		expect(fs.existsSync(path.join(tmp, "keys"))).toBe(false);
+	});
+
+	it("given 站点连不上 When keygen --credential Then 报站点地址且不落盘", async () => {
+		vi.stubGlobal("fetch", vi.fn(async () => {
+			throw new Error("ECONNREFUSED");
+		}));
+
+		const r = await run(["keygen", "--credential", TOKEN, "--site-url", "http://10.0.0.1:9778", "--out", path.join(tmp, "keys"), "--yes"]);
+
+		expect(r.exitCode).toBe(1);
+		expect(r.out).toContain("http://10.0.0.1:9778");
+		expect(fs.existsSync(path.join(tmp, "keys"))).toBe(false);
+	});
+
+	it("given 同时给 --credential 与 --id Then exit 2 且文案说明二选一", async () => {
+		const fetchFn = stubExchange({ code: 0, data: { key_id: KEY_ID } });
+
+		const r = await run(["keygen", "--credential", TOKEN, "--id", "acme.market"]);
+
+		expect(r.exitCode).toBe(2);
+		expect(r.out).toContain("不能同时使用");
+		expect(fetchFn).not.toHaveBeenCalled();
+	});
+
+	it("given 未设任何凭证 When keygen Then 走离线路径（既有行为零回归）", async () => {
+		const fetchFn = stubExchange({ code: 0, data: { key_id: KEY_ID } });
+
+		const r = await run(["keygen", "--out", path.join(tmp, "keys"), "--yes"]);
+
+		expect(r.exitCode).toBeUndefined();
+		expect(fetchFn).not.toHaveBeenCalled();
+		expect(r.out).toContain("local.dev");
+		expect(fs.existsSync(path.join(tmp, "keys", "private.pem"))).toBe(true);
+	});
+
+	it("given 环境变量 OJM_PUBLISH_CREDENTIAL When keygen 不带 --credential Then 仍走兑换通道", async () => {
+		process.env.OJM_PUBLISH_CREDENTIAL = TOKEN;
+		const fetchFn = stubExchange({ code: 0, data: { key_id: KEY_ID, product: "demo-solution", username: "u1" } });
+
+		const r = await run(["keygen", "--out", path.join(tmp, "keys"), "--yes"]);
+
+		expect(r.exitCode).toBeUndefined();
+		expect(fetchFn).toHaveBeenCalledTimes(1);
+		expect(r.out).toContain(KEY_ID);
+	});
+
+	it("given 服务端返回越界 key_id When 兑换 Then 拒绝且不落盘（key_id 会拼进密钥目录）", async () => {
+		stubExchange({ code: 0, data: { key_id: "../../etc", product: "x", username: "u" } });
+
+		const r = await run(["keygen", "--credential", TOKEN, "--out", path.join(tmp, "keys"), "--yes"]);
+
+		expect(r.exitCode).toBe(1);
+		expect(r.out).toContain("key_id 非法");
+		expect(fs.existsSync(path.join(tmp, "keys"))).toBe(false);
+	});
+
+	it("given 凭证不是 64 位 hex When 兑换 Then 本地即拒，不发请求", () => {
+		const fetchFn = stubExchange({ code: 0, data: { key_id: KEY_ID } });
+
+		return expect(exchangePublishCredential("short", { fetchFn: fetchFn as unknown as typeof fetch })).rejects.toThrow(/64 位十六进制/).then(() => expect(fetchFn).not.toHaveBeenCalled());
+	});
+});