@oj-module/cli 0.2.69 → 0.2.71

package/src/market/__tests__/bootstrap.test.ts

@@ -5,7 +5,8 @@
 // 冲突都是不可逆后果。故每条断言都直接查文件系统与配置内容，不靠口头约定。
 import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
 import { describe, expect, it, vi } from "vitest";
 
 import { bootstrapIsolatedSite } from "../bootstrap";
@@ -45,11 +46,21 @@ vi.mock("node:child_process", async (importOriginal) => {
 	return { ...actual, execFileSync };
 });
 
-/** 假 oj 进程：不起真进程，ready 立即就绪（与 dev.ts 的 ojStarter 注入同形态） */
+/**
+ * 假 oj 进程：不起真进程，ready 立即就绪（与 dev.ts 的 ojStarter 注入同形态）。
+ *  起站语义顺带模拟 migrate_on_start：建 market_release 目录表（真 oj serve 起站即应用迁移），
+ *  bootstrap 的目录行 seed 依赖该表存在。
+ */
 function fakeStarter() {
 	const started: Array<{ configPath: string, base: string, apiSrc: string }> = [];
 	const starter = (configPath: string, base: string, apiSrc: string) => {
 		started.push({ configPath, base, apiSrc });
+		const db = new DatabaseSync(join(dirname(configPath), "db.sqlite"));
+		db.prepare(
+			"CREATE TABLE IF NOT EXISTS market_release (id INTEGER PRIMARY KEY AUTOINCREMENT, product TEXT NOT NULL, version TEXT NOT NULL, key_id TEXT, sha256 TEXT, size INTEGER, published_at INTEGER NOT NULL, published_at_source TEXT NOT NULL, yanked INTEGER NOT NULL DEFAULT 0, first_seen_at INTEGER NOT NULL, sig_alg TEXT, sig_value TEXT, sig_public_key TEXT, sig_registry_id TEXT, manifest TEXT)",
+		).run();
+		db.prepare("CREATE UNIQUE INDEX IF NOT EXISTS uk_market_release_version ON market_release (product, version)").run();
+		db.close();
 		return {
 			port: Number(/port: (\d+)/.exec(readFileSync(configPath, "utf-8"))?.[1] ?? "0"),
 			ready: Promise.resolve(),
@@ -159,7 +170,7 @@ describe("given 一个装了 oj 二进制的源工程 When 自举隔离站点",
 		await site.cleanup();
 	});
 
-	it("then CDN 目录在临时根内且已落好 fixture 包与索引", async () => {
+	it("then CDN 目录在临时根内且已落好 fixture 包；目录行已 seed 进隔离库", async () => {
 		const src = newSourceProject();
 		const { starter } = fakeStarter();
 
@@ -167,10 +178,16 @@ describe("given 一个装了 oj 二进制的源工程 When 自举隔离站点",
 
 		expect(site.cdnDir.startsWith(site.root)).toBe(true);
 		expect(existsSync(join(site.cdnDir, "demo-solution-0.1.0.tgz"))).toBe(true);
-		// REG-CS5 三级索引：catalog.yaml（提交点）+ shards/<n>.yaml（版本明细）及其 .sig
-		expect(existsSync(join(site.cdnDir, "catalog.yaml"))).toBe(true);
-		expect(existsSync(join(site.cdnDir, "catalog.yaml.sig"))).toBe(true);
-		expect(readdirSync(join(site.cdnDir, "shards")).some(f => /^1\.yaml$/.test(f))).toBe(true);
+		expect(existsSync(join(site.cdnDir, "demo-solution-0.1.0.tgz.sig"))).toBe(true);
+		// A6 DB 目录化：索引文件（catalog.yaml/shards）不再生成——目录真源 = market_release 行
+		expect(existsSync(join(site.cdnDir, "catalog.yaml"))).toBe(false);
+		// 目录行 seed（站点内部通道）：安装解析/index 卡片/releases 的直读数据源
+		const { DatabaseSync } = await import("node:sqlite");
+		const db = new DatabaseSync(site.dbPath);
+		const rows = db.prepare("SELECT product, version, key_id, sig_registry_id FROM market_release").all() as Array<Record<string, unknown>>;
+		db.close();
+		expect(rows).toHaveLength(1);
+		expect(rows[0]).toMatchObject({ product: "demo-solution", version: "0.1.0", key_id: "trial.publisher", sig_registry_id: "trial.registry" });
 		expect(site.cdnBaseUrl).toBe(`${site.baseUrl}/cdn`);
 		await site.cleanup();
 	});

package/src/market/__tests__/failure-playbook.test.ts

@@ -10,7 +10,6 @@ const REQUIRED_CODES = [
 	"tampered", // neg-tamper
 	"unknown_key", // neg-stranger
 	"rollback_guard", // rollback
-	"index_sig", // neg-badindex
 	"zip_slip", // neg-evil
 ] as const;
 

package/src/market/__tests__/remote-push.test.ts

@@ -0,0 +1,228 @@
+/**
+ * `ojm market publish` 远端推送（A6）：签名推送 + sig→tgz 顺序 + 错误映射数据表 + 半成功幂等指引。
+ *
+ * fetch 全 mock：不断真站点、不真推。签名侧用真 Ed25519（generateKeyPair）——
+ * 断言推交流程构造的 canonical 可被服务端口径（实收字节重算 sha256）复算验过。
+ */
+
+import type { RemotePublishResult } from "../remote-push";
+import { createHash } from "node:crypto";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { generateKeyPair } from "../../lifecycle/keygen";
+import { verifyCanonical } from "../../lifecycle/sign";
+import { discoverMarket, remotePublish, remoteYank } from "../remote-push";
+
+interface RecordedCall {
+	url: string
+	method: string
+	keyId: string
+	signature: string
+	bytes: Uint8Array
+}
+
+/** fetch mock：按 URL 分发响应，记录调用序（sig→tgz 顺序断言用） */
+function mockFetch(handler: (call: RecordedCall) => { status: number, body: unknown }) {
+	const calls: RecordedCall[] = [];
+	const fn = async (input: unknown, init?: { method?: string, headers?: Record<string, string>, body?: unknown }) => {
+		const url = String(input);
+		const headers = init?.headers ?? {};
+		const form = init?.body as FormData | undefined;
+		const file = typeof form?.get === "function" ? form.get("file") as Blob | null : null;
+		const call: RecordedCall = {
+			url,
+			method: init?.method ?? "GET",
+			keyId: headers["x-ojm-key-id"] ?? "",
+			signature: headers["x-ojm-signature"] ?? "",
+			bytes: file != null
+				? new Uint8Array(await file.arrayBuffer())
+				: typeof init?.body === "string" ? new TextEncoder().encode(init.body) : new Uint8Array(),
+		};
+		calls.push(call);
+		const r = handler(call);
+		return new Response(JSON.stringify({ code: r.status === 200 ? 0 : r.status, msg: r.status === 200 ? "ok" : String((r.body as { message?: string }).message ?? "err"), data: r.status === 200 ? r.body : undefined }), { status: r.status });
+	};
+	return { fn: fn as typeof fetch, calls };
+}
+
+const SITE = "http://127.0.0.1:9778";
+
+let root: string;
+let kp: ReturnType<typeof generateKeyPair>;
+
+beforeEach(() => {
+	root = mkdtempSync(path.join(tmpdir(), "ojm-remote-push-"));
+	kp = generateKeyPair();
+});
+
+afterEach(() => {
+	rmSync(root, { recursive: true, force: true });
+});
+
+describe("discoverMarket（catalog 探测：registry_id 发现 + 旧站点人话）", () => {
+	it("200 + registry_id → 解析出站点身份", async () => {
+		const { fn } = mockFetch(() => ({ status: 200, body: { api_version: "v1", registry_id: "site.registry" } }));
+		const d = await discoverMarket(fn, SITE);
+		expect(d.registryId).toBe("site.registry");
+		expect(d.apiVersion).toBe("v1");
+	});
+
+	it("registry_id = null → 人话报错指向 vars.registry_id（推送canonical首段必需）", async () => {
+		const { fn } = mockFetch(() => ({ status: 200, body: { api_version: "v1", registry_id: null } }));
+		await expect(discoverMarket(fn, SITE)).rejects.toThrow(/registry_id/);
+	});
+
+	it("catalog API 404 → 「站点版本过旧」人话 + 迁移指南指向（2×2 矩阵新 CLI×旧站点格）", async () => {
+		const { fn } = mockFetch(() => ({ status: 404, body: { message: "not found" } }));
+		await expect(discoverMarket(fn, SITE)).rejects.toThrow(/版本过旧/);
+	});
+
+	it("网络层失败 → 人话（不抛原生 fetch 错）", async () => {
+		const fn = (() => Promise.reject(new TypeError("fetch failed"))) as typeof fetch;
+		await expect(discoverMarket(fn, SITE)).rejects.toThrow(/连不上|无法访问|fetch failed/);
+	});
+});
+
+describe("remotePublish（签名推送：sig→tgz 顺序 + canonical 口径）", () => {
+	it("先推 .sig 旁车再推 tgz（pair 约束：sig 先 tgz 后）；canonical 按实收字节重算口径可验签", async () => {
+		const { fn, calls } = mockFetch(() => ({ status: 200, body: { api_version: "v1", registry_id: "site.registry" } }));
+		const r: RemotePublishResult = await remotePublish({
+			projectRoot: root,
+			fixture: "demo-solution@0.1.0",
+			siteUrl: SITE,
+			id: "test.publisher",
+			privateKeyPem: kp.privateKeyPem,
+			registryId: "pub.registry",
+			fetchFn: fn,
+		});
+		expect(calls).toHaveLength(3); // catalog 探测 + sig + tgz
+		expect(calls[0]!.url).toBe(`${SITE}/api/oj-market/catalog?page=1&size=1`);
+		expect(calls[1]!.url).toContain("/api/oj-market/cdn/upload?name=");
+		expect(calls[1]!.url).toContain(encodeURIComponent(".tgz.sig"));
+		expect(calls[2]!.url).toContain(encodeURIComponent(".tgz"));
+		expect(calls[2]!.url).not.toContain(".sig");
+		// 每请求签名 canonical = cdn-upload:<站点 registry_id>:<文件名>:<实收字节 sha256>（服务端重算口径）
+		for (const call of calls.slice(1)) {
+			const file = decodeURIComponent(call.url.split("name=")[1]!);
+			const sha256 = createHash("sha256").update(call.bytes).digest("hex");
+			const canonical = `cdn-upload:site.registry:${file}:${sha256}`;
+			expect(call.keyId).toBe("test.publisher");
+			expect(verifyCanonical(kp.publicKeyHex, canonical, call.signature)).toBe(true);
+		}
+		// 包内 manifest 与文件名一致（服务端 400 钳制的前置自检面）
+		expect(r.name).toBe("demo-solution");
+		expect(r.version).toBe("0.1.0");
+		expect(r.registryId).toBe("site.registry");
+		expect(r.keyId).toBe("test.publisher");
+	});
+
+	it("缺 --site-url 且环境变量无 → 人话报错（不猜默认站点）", async () => {
+		const { fn } = mockFetch(() => ({ status: 200, body: {} }));
+		const old = process.env.OJM_SITE_URL;
+		delete process.env.OJM_SITE_URL;
+		try {
+			await expect(remotePublish({ projectRoot: root, id: "test.publisher", privateKeyPem: kp.privateKeyPem, registryId: "pub.registry", fetchFn: fn }))
+				.rejects
+				.toThrow(/--site-url/);
+		}
+		finally {
+			if (old !== undefined)
+				process.env.OJM_SITE_URL = old;
+		}
+	});
+});
+
+describe("remotePublish 错误映射数据表（401/403/409/413 + 半成功幂等指引）", () => {
+	async function pushWith(status: number, message: string, failAt: "sig" | "tgz" = "tgz") {
+		const { fn } = mockFetch(call => (call.url.includes("/cdn/upload") && (failAt === "sig") === call.url.includes(".sig")
+			? { status, body: { message } }
+			: { status: 200, body: { api_version: "v1", registry_id: "site.registry" } }));
+		return await remotePublish({
+			projectRoot: root,
+			fixture: "demo-solution@0.1.0",
+			siteUrl: SITE,
+			id: "test.publisher",
+			privateKeyPem: kp.privateKeyPem,
+			registryId: "pub.registry",
+			fetchFn: fn,
+		});
+	}
+
+	it.each([
+		[401, "签名验签失败：服务端按实收字节重算 sha256 重构 canonical 验签——字节被换、registry 身份不符或签名无效，已拒（401）", /签名验签失败/],
+		[403, "发布 key「test.publisher」不在本站点信任库——请站点 superadmin 经市场信任确认（或 ojm trust add）入录后重试", /信任库/],
+		[409, "「demo-solution@0.1.0」已存在且字节不一致——同一版本号只允许一份字节，请升 version 重发", /升 version/],
+		[413, "上传体积超过上限", /体积|413/],
+	] as const)("%i → 人话映射（含下一步指引）", async (status, message, pattern) => {
+		await expect(pushWith(status, message)).rejects.toThrow(pattern);
+	});
+
+	it("sig 已推、tgz 被拒（半成功）→ 错误文案含「重跑本命令幂等补齐」", async () => {
+		await expect(pushWith(409, "「demo-solution@0.1.0」已存在且字节不一致——同一版本号只允许一份字节", "tgz"))
+			.rejects
+			.toThrow(/重跑本命令幂等补齐/);
+	});
+
+	describe("remoteYank（签名下线：market-yank canonical + 发布者授权面）", () => {
+		it("canonical = market-yank:<站点 registry>:<product>:<version> 可验签；body 携带 reason/by/restore", async () => {
+			const { fn, calls } = mockFetch(call => (call.url.includes("/cdn/upload")
+				? { status: 404, body: { message: "n/a" } }
+				: call.url.includes("/yank")
+					? { status: 200, body: { ok: true, product: "demo-solution", version: "0.1.0", yanked: true } }
+					: { status: 200, body: { api_version: "v1", registry_id: "site.registry" } }));
+			const r = await remoteYank({
+				siteUrl: SITE,
+				name: "demo-solution",
+				version: "0.1.0",
+				reason: "有严重缺陷",
+				by: "release-ops",
+				id: "test.publisher",
+				privateKeyPem: kp.privateKeyPem,
+				fetchFn: fn,
+			});
+			expect(calls).toHaveLength(2); // catalog 探测 + yank POST
+			const yank = calls[1]!;
+			expect(yank.url).toBe(`${SITE}/api/oj-market/yank`);
+			expect(yank.method).toBe("POST");
+			expect(verifyCanonical(kp.publicKeyHex, "market-yank:site.registry:demo-solution:0.1.0", yank.signature)).toBe(true);
+			const body = JSON.parse(new TextDecoder().decode(yank.bytes)) as Record<string, unknown>;
+			expect(body).toMatchObject({ product: "demo-solution", version: "0.1.0", reason: "有严重缺陷", by: "release-ops" });
+			expect(body.restore).toBeUndefined();
+			expect(r).toMatchObject({ product: "demo-solution", version: "0.1.0", yanked: true });
+		});
+
+		it("restore 形态 body 带 restore:true；服务端 403（非发布者）→ 人话透出", async () => {
+			const { fn } = mockFetch(call => (call.url.includes("/yank")
+				? { status: 403, body: { message: "key「test.publisher」不是「demo-solution@0.1.0」的发布者" } }
+				: { status: 200, body: { api_version: "v1", registry_id: "site.registry" } }));
+			await expect(remoteYank({
+				siteUrl: SITE,
+				name: "demo-solution",
+				version: "0.1.0",
+				restore: true,
+				id: "test.publisher",
+				privateKeyPem: kp.privateKeyPem,
+				fetchFn: fn,
+			})).rejects.toThrow(/发布者/);
+		});
+	});
+
+	it("幂等重入：服务端返回 idempotent → 视为成功不重抛", async () => {
+		const { fn, calls } = mockFetch(call => (call.url.includes("/cdn/upload")
+			? { status: 200, body: { ok: true, idempotent: true } }
+			: { status: 200, body: { api_version: "v1", registry_id: "site.registry" } }));
+		await remotePublish({
+			projectRoot: root,
+			fixture: "demo-solution@0.1.0",
+			siteUrl: SITE,
+			id: "test.publisher",
+			privateKeyPem: kp.privateKeyPem,
+			registryId: "pub.registry",
+			fetchFn: fn,
+		});
+		expect(calls).toHaveLength(3);
+	});
+});

package/src/market/__tests__/verify.test.ts

@@ -1,12 +1,11 @@
 import type { VerifyCheck } from "../verify";
-// ojm market verify spec（T7 + REG-CS5 三级化）：离线验包——不起站点、不装、不要凭据。
+// ojm market verify spec（A6 瘦身）：离线验包——不起站点、不装、不要凭据。
 //
-// 钉死两条：① 四类校验分列（完整性 / 包级签 / 索引签 / 结构），篡改任一项都必须在对应项上打叉；
-// ② 结论恒带边界声明——验签过 ≠ 代码无恶意，这一点写错比校验写错更危险。
-//
-// 三级化后的索引面：catalog.yaml（代次真源）+ shards/<n>.yaml（版本明细与 archive.sha256）。
-// 索引验签按文件分列（catalog 一项、每片一项），同代校验单独一项——红队 F2 的中间态
-// （新 catalog 钉旧片）必须在同代项上打叉，且按「运维事故」而不是「被篡改」提示。
+// v4 DB 目录化后只剩**包级面**（计划退役清单点名）：包级 detached 验签（信任锚）+
+// manifest 结构（必填字段 / 原生清单 desc / 0001 迁移跨版本一致）。索引面（索引验签 /
+// 同代 / 时效 / 漂移 / 对索引声明的完整性比对）随索引机制整建制退役——目录真源已移交
+// 站点 market_release 表，字节-声明一致性由上传端点服务端重算 sha256 在写通道守住。
+// 结论恒带边界声明——验签过 ≠ 代码无恶意，这一点写错比校验写错更危险。
 import { Buffer } from "node:buffer";
 import { generateKeyPairSync } from "node:crypto";
 import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
@@ -16,9 +15,7 @@ import { dirname, join } from "node:path";
 import { describe, expect, it } from "vitest";
 import { parse, stringify } from "yaml";
 import { createDeterministicTgz } from "../../deterministic-tar";
-import { recomputeIndex, signIndex } from "../../publish";
 import { signCommand } from "../../sign";
-import { buildIndex } from "../build-index";
 import { publishPackage } from "../publish";
 import { readTgz } from "../scan";
 import { verifyMarket } from "../verify";
@@ -40,11 +37,10 @@ function newProject(): string {
 	return root;
 }
 
-/** 落一个包并重建索引，返回工程根 */
+/** 落一个已签名包（本地落盘内部通道——索引重建随 DB 目录化退役），返回工程根 */
 async function seed(): Promise<string> {
 	const root = newProject();
 	await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: testPem(), registryId: REGISTRY_ID });
-	await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
 	return root;
 }
 
@@ -52,24 +48,14 @@ function itemOf(result: Awaited<ReturnType<typeof verifyMarket>>, name: string):
 	return result.checks.find(c => c.item === name);
 }
 
-/** 全部「索引签名」项（三级化后按文件分列：catalog 一项 + 每片一项） */
-function sigItems(result: Awaited<ReturnType<typeof verifyMarket>>): VerifyCheck[] {
-	return result.checks.filter(c => c.item === "索引签名");
-}
-
 describe("given 一个正常落地的包 When 离线验包", () => {
-	it("then 四类校验全绿且结论带边界声明", async () => {
+	it("then 包级面校验全绿（包级签名 + manifest 结构）且结论带边界声明", async () => {
 		const root = await seed();
 
 		const result = await verifyMarket({ projectRoot: root });
 
 		expect(result.passed).toBe(true);
-		expect(itemOf(result, "完整性")?.ok).toBe(true);
 		expect(itemOf(result, "包级签名")?.ok).toBe(true);
-		// 三级索引：catalog 与 1 号片各签各的，两项都在且全绿
-		const sigs = sigItems(result);
-		expect(sigs.length).toBeGreaterThanOrEqual(2);
-		expect(sigs.every(c => c.ok)).toBe(true);
 		expect(itemOf(result, "manifest 结构")?.ok).toBe(true);
 		expect(result.conclusion).toContain("不构成内容安全性背书");
 	});
@@ -79,7 +65,7 @@ describe("given 真实工程包（manifest 按 C2-29 整体省略 archive 占位
 	it("then manifest 结构不因此打叉（REG-CS8 回归：ojm build --bundle 不落 archive ≠ 缺必填）", async () => {
 		const root = await seed();
 		const tgz = join(root, "cdn", "demo-solution-0.1.0.tgz");
-		// 解包 → 摘掉根 manifest 的 archive（fixture 有、真实方案无的字段差）→ 确定性重打包 → 重签 → 重建索引
+		// 解包 → 摘掉根 manifest 的 archive（fixture 有、真实方案无的字段差）→ 确定性重打包 → 重签
 		const staging = mkdtempSync(join(tmpdir(), "ojm-verify-noarchive-"));
 		for (const e of readTgz(new Uint8Array(readFileSync(tgz)))) {
 			if (e.name.endsWith("/"))
@@ -94,7 +80,6 @@ describe("given 真实工程包（manifest 按 C2-29 整体省略 archive 占位
 		writeFileSync(rootManifestPath, stringify(manifest));
 		await createDeterministicTgz(staging, tgz);
 		signCommand(tgz, { id: KEY_ID, privateKeyPem: testPem(), registryId: REGISTRY_ID });
-		await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
 
 		const result = await verifyMarket({ projectRoot: root });
 
@@ -104,21 +89,20 @@ describe("given 真实工程包（manifest 按 C2-29 整体省略 archive 占位
 });
 
 describe("given 预发布版本（文件名含连字符）包体被篡改 When 离线验包", () => {
-	it("then 完整性仍能检出（不再因文件名解析错配而静默放过，REG-CS1 边界）", async () => {
+	it("then 包级签名仍检出篡改（重算 sha256 重构规范串，验签不过——内容寻址不以文件名解析为前提）", async () => {
 		const root = newProject();
 		await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0-rc.1", id: KEY_ID, privateKeyPem: testPem(), registryId: REGISTRY_ID });
-		await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
 		const tgz = join(root, "cdn", "demo-solution-0.1.0-rc.1.tgz");
 		const buf = readFileSync(tgz);
 		buf[buf.length - 1] ^= 0xFF; // 篡改末字节
 		writeFileSync(tgz, buf);
 		const result = await verifyMarket({ projectRoot: root });
-		expect(itemOf(result, "完整性")?.ok).toBe(false);
+		expect(itemOf(result, "包级签名")?.ok).toBe(false);
 	});
 });
 
 describe("given 包体被改了一个字节 When 离线验包", () => {
-	it("then 完整性与包级签名双双打叉（sha256 不符 + 验签不过）", async () => {
+	it("then 包级签名打叉（signature_mismatch：sha256 重算后与签名覆盖值不符）", async () => {
 		const root = await seed();
 		const tgz = join(root, "cdn", "demo-solution-0.1.0.tgz");
 		const bytes = Buffer.from(readFileSync(tgz));
@@ -128,7 +112,6 @@ describe("given 包体被改了一个字节 When 离线验包", () => {
 		const result = await verifyMarket({ projectRoot: root });
 
 		expect(result.passed).toBe(false);
-		expect(itemOf(result, "完整性")?.ok).toBe(false);
 		expect(itemOf(result, "包级签名")?.ok).toBe(false);
 	});
 });
@@ -136,200 +119,55 @@ describe("given 包体被改了一个字节 When 离线验包", () => {
 describe("given 包级签名被删掉 When 离线验包", () => {
 	it("then 包级签名打叉并给出 sig_missing 口径的指引", async () => {
 		const root = await seed();
-		rmSync(join(root, "cdn", "demo-solution-0.1.0.tgz.sig"));
-
-		const result = await verifyMarket({ projectRoot: root });
-
-		expect(itemOf(result, "包级签名")?.ok).toBe(false);
-		expect(itemOf(result, "包级签名")?.detail).toMatch(/sig|签名/);
-	});
-});
-
-describe("given catalog.yaml 被手改过 When 离线验包", () => {
-	it("then 索引签名打叉 index_sig_mismatch（索引签名是完整性层，篡改必须可见）", async () => {
-		const root = await seed();
-		const catalog = join(root, "cdn", "catalog.yaml");
-		writeFileSync(catalog, `${readFileSync(catalog, "utf-8")}\n# tampered\n`);
-
-		const result = await verifyMarket({ projectRoot: root });
-
-		expect(result.passed).toBe(false);
-		expect(sigItems(result).some(c => !c.ok && c.detail.includes("catalog.yaml"))).toBe(true);
-		// REG-CS1：篡改与缺失必须可分（前者是安全事件，后者是发布流程漏了）
-		expect(sigItems(result).find(c => c.detail.includes("catalog.yaml"))?.code).toBe("index_sig_mismatch");
-	});
-});
-
-describe("given 分片正文被手改过 When 离线验包", () => {
-	it("then 该片索引签名打叉 index_sig_mismatch，且完整性同步打叉（sha256 声明已不可信）", async () => {
-		const root = await seed();
-		const shard = join(root, "cdn", "shards", "1.yaml");
-		// 把声明里的 sha256 改掉：片签名失配 + 索引声明的摘要与包体不符，两层都须看见。
-		// 篡改值取带字母的十六进制（f…f）——纯数字串会被 YAML 解析成 number，那是另一种形态的坏索引
-		const before = readFileSync(shard, "utf-8");
-		const text = before.replace(/sha256: [0-9a-f]{64}/, `sha256: ${"f".repeat(64)}`);
-		expect(text).not.toEqual(before); // 确认替换命中（夹具确有该字段）
-		writeFileSync(shard, text);
-
-		const result = await verifyMarket({ projectRoot: root });
-
-		expect(result.passed).toBe(false);
-		expect(sigItems(result).find(c => c.detail.includes("shards/1.yaml"))?.code).toBe("index_sig_mismatch");
-		expect(itemOf(result, "完整性")?.ok).toBe(false);
-	});
-});
-
-describe("given 索引缺 .sig When 离线验包", () => {
-	it("then 索引签名打叉 index_sig_missing 并给两步补签提示（不再「运行期容忍」）", async () => {
-		const root = await seed();
-		rmSync(join(root, "cdn", "catalog.yaml.sig"));
-		rmSync(join(root, "cdn", "shards", "1.yaml.sig"));
-
-		const result = await verifyMarket({ projectRoot: root });
-
-		expect(result.passed).toBe(false);
-		const bad = sigItems(result).filter(c => !c.ok);
-		expect(bad.length).toBeGreaterThanOrEqual(2);
-		expect(bad.every(c => c.code === "index_sig_missing")).toBe(true);
-		expect(bad[0]?.detail).toContain("ojm market build-index");
-		expect(bad[0]?.detail).toContain("ojm publish");
-	});
-});
-
-describe("given 只缺 catalog 的 .sig When 离线验包", () => {
-	it("then catalog 项打叉 index_sig_missing、分片项不受牵连（按文件分列的意义）", async () => {
-		const root = await seed();
-		rmSync(join(root, "cdn", "catalog.yaml.sig"));
-
-		const result = await verifyMarket({ projectRoot: root });
-
-		const sigs = sigItems(result);
-		expect(sigs.find(c => c.detail.includes("catalog.yaml"))?.code).toBe("index_sig_missing");
-		expect(sigs.find(c => c.detail.includes("shards/1.yaml"))?.ok).toBe(true);
-	});
-});
-
-describe("given catalog 正文代次与签名代次不一致 When 离线验包", () => {
-	it("then 同代校验打叉报 index_generation_mismatch 并提示「源正在重建索引」（不是「索引被篡改」）", async () => {
-		const root = await seed();
-		// 改了正文没换签名：正文自称第 7 代、签名还是第 1 代
-		const catalog = join(root, "cdn", "catalog.yaml");
-		writeFileSync(catalog, readFileSync(catalog, "utf-8").replace(/^seq: \d+$/m, "seq: 7"), "utf-8");
-
-		const result = await verifyMarket({ projectRoot: root });
-
-		expect(result.passed).toBe(false);
-		const item = itemOf(result, "索引同代");
-		expect(item?.ok).toBe(false);
-		expect(item?.code).toBe("index_generation_mismatch");
-		expect(item?.detail).toContain("源正在重建索引，请稍后重试");
-		expect(item?.detail).not.toContain("被篡改");
-	});
-});
-
-describe("given catalog 钉的片代次与分片签名不符 When 离线验包（红队 F2 新形态：新目录钉旧片）", () => {
-	it("then 同代校验打叉 index_generation_mismatch（拼不进，按运维事故提示重试）", async () => {
-		const root = await seed();
-		const cdn = join(root, "cdn");
-		// 分片签名重签成第 2 代（签名本身有效），catalog 仍钉第 1 代——「写到一半」的中间态
-		const shardText = recomputeIndex(readFileSync(join(cdn, "shards", "1.yaml"), "utf-8"));
-		writeFileSync(
-			join(cdn, "shards", "1.yaml.sig"),
-			`${JSON.stringify(signIndex("shard", 2, shardText, testPem(), KEY_ID), null, 2)}\n`,
-			"utf-8",
-		);
-
-		const result = await verifyMarket({ projectRoot: root });
-
-		const item = itemOf(result, "索引同代");
-		expect(item?.ok).toBe(false);
-		expect(item?.code).toBe("index_generation_mismatch");
-		expect(item?.detail).toContain("源正在重建索引，请稍后重试");
-	});
-});
-
-describe("given 分片正文没了但 catalog 还钉着它 When 离线验包", () => {
-	it("then 同代校验打叉 index_generation_mismatch（代次不可判定即拒，fail-closed）", async () => {
-		const root = await seed();
-		rmSync(join(root, "cdn", "shards", "1.yaml"));
-		rmSync(join(root, "cdn", "shards", "1.yaml.sig"));
-
-		const result = await verifyMarket({ projectRoot: root });
-
-		const item = itemOf(result, "索引同代");
-		expect(item?.ok).toBe(false);
-		expect(item?.code).toBe("index_generation_mismatch");
-		expect(item?.detail).toContain("正文缺失");
-	});
-});
-
-describe("given 索引的 .sig 是旧格式（不带 seq）When 离线验包", () => {
-	it("then 索引签名打叉并报 index_sig_mismatch（签名未覆盖代次 = 挡不住新旧拼接）", async () => {
-		const root = await seed();
-		const sigPath = join(root, "cdn", "catalog.yaml.sig");
-		const sig = JSON.parse(readFileSync(sigPath, "utf-8")) as Record<string, unknown>;
-		delete sig.seq;
-		writeFileSync(sigPath, JSON.stringify(sig), "utf-8");
+		const tgz = join(root, "cdn", "demo-solution-0.1.0.tgz");
+		rmSync(`${tgz}.sig`);
 
 		const result = await verifyMarket({ projectRoot: root });
 
-		expect(sigItems(result).find(c => c.detail.includes("catalog.yaml"))?.code).toBe("index_sig_mismatch");
+		const check = itemOf(result, "包级签名");
+		expect(check?.ok).toBe(false);
+		expect(check?.code).toBe("sig_missing");
+		expect(check?.detail).toContain("ojm market publish");
 	});
 });
 
-describe("given 索引已过自声明的失效时刻 When 离线验包", () => {
-	it("then 索引时效打叉报 index_expired（REG-CS2：与站点安装同一判定，CLI/API 一致）", async () => {
+describe("given 索引文件被手改/删除 When 离线验包（A6：索引面已退役）", () => {
+	it("then 校验结果不受影响——目录真源在站点 DB，盘上索引文件已非消费面", async () => {
 		const root = await seed();
-		const catalogPath = join(root, "cdn", "catalog.yaml");
-		const doc = parse(readFileSync(catalogPath, "utf-8")) as Record<string, unknown>;
-		doc.issued_at = 1;
-		doc.expires_at = 2;
-		writeFileSync(catalogPath, stringify(doc), "utf-8");
+		// 即便盘上残留旧索引文件（升级未清理），verify 也绝不再消费它们
+		writeFileSync(join(root, "cdn", "catalog.yaml"), "tampered: true\n");
 
 		const result = await verifyMarket({ projectRoot: root });
 
-		expect(itemOf(result, "索引时效")?.ok).toBe(false);
-		expect(itemOf(result, "索引时效")?.code).toBe("index_expired");
+		expect(result.passed).toBe(true);
+		expect(result.checks.some(c => c.item === "索引签名")).toBe(false);
+		expect(result.checks.some(c => c.item === "索引同代")).toBe(false);
+		expect(result.checks.some(c => c.item === "索引时效")).toBe(false);
 	});
 });
 
-describe("given 索引不带时效字段（旧 ojm 产物）When 离线验包", () => {
-	it("then 索引时效打叉（不可判定即按过期处理，不默认当新鲜）", async () => {
+describe("given 同方案两个版本的 0001 迁移不一致 When 离线验包", () => {
+	it("then manifest 结构项打叉（升级链会报迁移缺失，须只增不改）", async () => {
 		const root = await seed();
-		const catalogPath = join(root, "cdn", "catalog.yaml");
-		const doc = parse(readFileSync(catalogPath, "utf-8")) as Record<string, unknown>;
-		delete doc.issued_at;
-		delete doc.expires_at;
-		writeFileSync(catalogPath, stringify(doc), "utf-8");
+		await publishPackage({ projectRoot: root, fixture: "demo-solution@0.2.0", id: KEY_ID, privateKeyPem: testPem(), registryId: REGISTRY_ID });
+		// 篡改 0.2.0 包的 0001 迁移字节（解包重打 + 重签，保持包可解）
+		const tgz = join(root, "cdn", "demo-solution-0.2.0.tgz");
+		const staging = mkdtempSync(join(tmpdir(), "ojm-verify-mig-"));
+		for (const e of readTgz(new Uint8Array(readFileSync(tgz)))) {
+			if (e.name.endsWith("/"))
+				continue;
+			const abs = join(staging, e.name);
+			mkdirSync(dirname(abs), { recursive: true });
+			writeFileSync(abs, /\/migrations\/0001[^/]*\.sql$/.test(e.name) ? `${e.content}-- tampered\n` : e.content);
+		}
+		await createDeterministicTgz(staging, tgz);
+		signCommand(tgz, { id: KEY_ID, privateKeyPem: testPem(), registryId: REGISTRY_ID });
+		rmSync(staging, { recursive: true, force: true });
 
 		const result = await verifyMarket({ projectRoot: root });
 
-		expect(itemOf(result, "索引时效")?.ok).toBe(false);
-		expect(itemOf(result, "索引时效")?.code).toBe("index_expired");
-	});
-});
-
-describe("given 落了 tgz 但没重建索引 When 带 --rebuild-check 验包", () => {
-	it("then 报漂移：索引缺该包条目", async () => {
-		const root = newProject();
-		await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: testPem(), registryId: REGISTRY_ID });
-		await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
-		await publishPackage({ projectRoot: root, fixture: "other-solution@0.1.0", id: KEY_ID, privateKeyPem: testPem(), registryId: REGISTRY_ID });
-
-		const result = await verifyMarket({ projectRoot: root, rebuildCheck: true });
-
-		expect(result.drift?.length ?? 0).toBeGreaterThan(0);
-		expect(result.drift?.join(" ")).toMatch(/other-solution/);
-	});
-});
-
-describe("given 索引声明了某个版本但盘上包没了 When 带 --rebuild-check 验包", () => {
-	it("then 报反向漂移：索引多条目（只查正向会让「答应有、实际没有」漏过去）", async () => {
-		const root = await seed();
-		rmSync(join(root, "cdn", "demo-solution-0.1.0.tgz"));
-
-		const result = await verifyMarket({ projectRoot: root, rebuildCheck: true });
-
-		expect(result.drift?.join(" ")).toMatch(/索引多条目：demo-solution@0\.1\.0/);
+		const mig = result.checks.find(c => c.item === "manifest 结构" && c.detail.includes("0001 迁移在版本"));
+		expect(mig?.ok).toBe(false);
+		expect(mig?.detail).toContain("0.2.0");
 	});
 });