@oj-module/cli 0.2.8 → 0.2.14

package/src/market/__tests__/cdn-layout.test.ts

@@ -0,0 +1,96 @@
+// market CDN 布局 spec（T2）：cdn 目录与 `/cdn` 基址的单一真相。
+//
+// 逐条钉死「不许硬编码」——config 里的主机 / 端口 / 挂载路径任一改动，解析结果必须跟随。
+// 之所以值得单独一组用例：dev 形态下 `/cdn` 只在 oj 子进程（9778）上成立，
+// 一旦有人图省事写相对路径或硬编码端口，市场页拿到的会是 index.html 而不是 YAML
+// （设计 §3.1.1）。合规与否由这组用例兜住，而不是靠注释提醒。
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+
+import { CDN_MOUNT_PREFIX, resolveCdnLayout, resolveCdnLayoutFromConfig } from "../cdn-layout";
+
+// 绝对路径：真实调用里 configPath 是绝对的，这里不能拿相对路径假装（否则 path.resolve 会相对 cwd 解析）
+const PROJECT = resolve("proj", "my-app");
+const CONFIG_PATH = join(PROJECT, "api", "config.yaml");
+
+/** 拼一份 config：默认端口与主机取自模板实际值 */
+function configOf(mounts: string, server = "  host: 127.0.0.1\n  port: 9778"): string {
+	return `mounts:\n${mounts}server:\n${server}\n`;
+}
+
+const STD_MOUNTS = "  - prefix: /api\n    api: src\n  - prefix: /cdn\n    web: ../cdn\n";
+
+describe("resolveCdnLayoutFromConfig：一切取值都跟随 config", () => {
+	it("given 模板默认挂载 When 解析 Then 目录在工程根 cdn/、基址无尾斜杠", () => {
+		const layout = resolveCdnLayoutFromConfig(configOf(STD_MOUNTS), CONFIG_PATH);
+
+		expect(layout.dir).toBe(join(PROJECT, "cdn"));
+		expect(layout.prefix).toBe(CDN_MOUNT_PREFIX);
+		expect(layout.baseUrl).toBe("http://127.0.0.1:9778/cdn");
+	});
+
+	it("given server.port 改成 9799 When 解析 Then 基址端口跟随（不硬编码 9778）", () => {
+		const layout = resolveCdnLayoutFromConfig(configOf(STD_MOUNTS, "  host: 127.0.0.1\n  port: 9799"), CONFIG_PATH);
+
+		expect(layout.baseUrl).toBe("http://127.0.0.1:9799/cdn");
+	});
+
+	it("given server.host 改成 127.0.0.2 When 解析 Then 基址主机跟随", () => {
+		const layout = resolveCdnLayoutFromConfig(configOf(STD_MOUNTS, "  host: 127.0.0.2\n  port: 9778"), CONFIG_PATH);
+
+		expect(layout.baseUrl).toBe("http://127.0.0.2:9778/cdn");
+	});
+
+	it("given 挂载的 web 改成 ../static-cdn When 解析 Then 目录跟随（单一真相在 config）", () => {
+		const mounts = "  - prefix: /cdn\n    web: ../static-cdn\n";
+
+		const layout = resolveCdnLayoutFromConfig(configOf(mounts), CONFIG_PATH);
+
+		expect(layout.dir).toBe(join(PROJECT, "static-cdn"));
+	});
+
+	it("given 挂载前缀带尾斜杠 When 解析 Then 前缀归一化掉尾斜杠（拼接口径统一）", () => {
+		const mounts = "  - prefix: /cdn/\n    web: ../cdn\n";
+
+		const layout = resolveCdnLayoutFromConfig(configOf(mounts), CONFIG_PATH);
+
+		expect(layout.prefix).toBe(CDN_MOUNT_PREFIX);
+		expect(layout.baseUrl).toBe("http://127.0.0.1:9778/cdn");
+	});
+});
+
+describe("resolveCdnLayoutFromConfig：出错要给得出手", () => {
+	it("given mounts 里没有 /cdn 条目 When 解析 Then 抛错且给出要粘回 config 的两行", () => {
+		const mounts = "  - prefix: /api\n    api: src\n";
+
+		expect(() => resolveCdnLayoutFromConfig(configOf(mounts), CONFIG_PATH)).toThrow(/cdn/);
+
+		try {
+			resolveCdnLayoutFromConfig(configOf(mounts), CONFIG_PATH);
+		}
+		catch (error) {
+			// 人话错误里必须给出可直接粘贴的挂载声明，而不是只抱怨
+			expect(String(error)).toContain("prefix: /cdn");
+			expect(String(error)).toContain("web: ../cdn");
+		}
+	});
+
+	it("given server.port 缺失 When 解析 Then 抛人话错误（与 oj-config.readOjPort 同口径）", () => {
+		expect(() => resolveCdnLayoutFromConfig(configOf(STD_MOUNTS, "  host: 127.0.0.1"), CONFIG_PATH)).toThrow(/server\.port/);
+	});
+});
+
+describe("resolveCdnLayout：从工程根出发", () => {
+	it("given 一个带 api/config.yaml 的工程 When 解析 Then 与文本版结果一致", () => {
+		const root = mkdtempSync(join(tmpdir(), "ojm-cdn-layout-"));
+		mkdirSync(join(root, "api"), { recursive: true });
+		writeFileSync(join(root, "api", "config.yaml"), configOf(STD_MOUNTS), "utf-8");
+
+		const layout = resolveCdnLayout(root);
+
+		expect(layout.dir).toBe(join(root, "cdn"));
+		expect(layout.baseUrl).toBe("http://127.0.0.1:9778/cdn");
+	});
+});

package/src/market/__tests__/failure-playbook.test.ts

@@ -0,0 +1,33 @@
+// market/failure-playbook spec（T12 收尾）：失败文案表的 traceability——
+// 每个 neg 场景预期命中的失败码都必须有双段式条目（成因 + 下一步），漏一条即失败。
+import { describe, expect, it } from "vitest";
+
+import { FAILURE_PLAYBOOK } from "../failure-playbook";
+
+/** 各 neg op 预期命中的失败码（补新 neg op 时同步加行，保持可追溯） */
+const REQUIRED_CODES = [
+	"sig_missing", // neg-nosig
+	"tampered", // neg-tamper
+	"unknown_key", // neg-stranger
+	"rollback_guard", // rollback
+	"index_sig", // neg-badindex
+	"zip_slip", // neg-evil
+] as const;
+
+describe("given 失败文案表 When 逐条核对", () => {
+	it("then 每个 neg 场景的预期失败码都有条目，且双段式字段非空", () => {
+		const byCode = new Map(FAILURE_PLAYBOOK.map(e => [e.code, e]));
+		for (const code of REQUIRED_CODES) {
+			const entry = byCode.get(code);
+			expect(entry, `缺失败码 ${code} 的文案条目`).toBeDefined();
+			expect(entry!.stage.trim()).not.toBe("");
+			expect(entry!.cause.trim()).not.toBe("");
+			expect(entry!.next.trim()).not.toBe("");
+		}
+	});
+
+	it("then code 无重复（表是字典不是日志）", () => {
+		const codes = FAILURE_PLAYBOOK.map(e => e.code);
+		expect(new Set(codes).size).toBe(codes.length);
+	});
+});

package/src/market/__tests__/fixture.test.ts

@@ -0,0 +1,48 @@
+// market/fixture spec（T12）：合成方案树的版本差异——迁移阶梯是 upgrade/rollback op 的物理前提。
+//
+// 0.2.0 起（minor ≥ 2）多一段 0002__more.sql：upgrade 必须真的多走一段迁移，
+// rollback 才有「包内最大 seq < 账本 head」可拦。确定性：同 name@version 输出恒同。
+import { mkdtempSync, readdirSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { gunzipSync } from "node:zlib";
+import { describe, expect, it } from "vitest";
+
+import { buildEvilZipSlipTgz, buildFixturePackage } from "../fixture";
+
+describe("given 合成 fixture 方案树 When 看 migrations 目录", () => {
+	it("then 0.1.0 只有 0001（head 上限 1）", () => {
+		const pkg = buildFixturePackage({ stagingDir: mkdtempSync(join(tmpdir(), "ojm-fixture-")), name: "demo-solution", version: "0.1.0" });
+		expect(readdirSync(join(pkg.dir, "api", "demo-solution-0.1.0", "migrations")).sort()).toEqual(["0001__init.sql"]);
+	});
+
+	it("then 0.2.0 多一段 0002（升级真的多走一段迁移）", () => {
+		const pkg = buildFixturePackage({ stagingDir: mkdtempSync(join(tmpdir(), "ojm-fixture-")), name: "demo-solution", version: "0.2.0" });
+		const files = readdirSync(join(pkg.dir, "api", "demo-solution-0.2.0", "migrations")).sort();
+		expect(files).toEqual(["0001__init.sql", "0002__more.sql"]);
+		// 0001 与 0.1.0 逐字节一致（upgrade op 断言依据）
+		const pkg010 = buildFixturePackage({ stagingDir: mkdtempSync(join(tmpdir(), "ojm-fixture-")), name: "demo-solution", version: "0.1.0" });
+		expect(readFileSync(join(pkg.dir, "api", "demo-solution-0.2.0", "migrations", "0001__init.sql")))
+			.toEqual(readFileSync(join(pkg010.dir, "api", "demo-solution-0.1.0", "migrations", "0001__init.sql")));
+	});
+
+	it("then 0002 是合法 ALTER（作用于 fixture 声明的表）", () => {
+		const pkg = buildFixturePackage({ stagingDir: mkdtempSync(join(tmpdir(), "ojm-fixture-")), name: "demo-solution", version: "0.2.0" });
+		const sql = readFileSync(join(pkg.dir, "api", "demo-solution-0.2.0", "migrations", "0002__more.sql"), "utf-8");
+		expect(sql).toContain("ALTER TABLE demo_solution_note");
+	});
+});
+
+describe("given 手造 zip-slip 恶意 tgz When 检查字节", () => {
+	it("then 是合法 gzip/tar 且含 ../ 越界成员，同输入恒同字节（确定性）", () => {
+		const a = join(mkdtempSync(join(tmpdir(), "ojm-evil-")), "evil.tgz");
+		const b = join(mkdtempSync(join(tmpdir(), "ojm-evil-")), "evil.tgz");
+		buildEvilZipSlipTgz(a);
+		buildEvilZipSlipTgz(b);
+		const raw = readFileSync(a);
+		expect([raw[0], raw[1]]).toEqual([0x1F, 0x8B]); // gzip magic
+		expect(readFileSync(b)).toEqual(raw); // 确定性（mtime 置 0）
+		const tar = gunzipSync(raw).toString("utf-8");
+		expect(tar).toContain("../evil.sql"); // R1 必须能检出这个成员
+	});
+});

package/src/market/__tests__/publish.test.ts

@@ -0,0 +1,109 @@
+// ojm market publish spec（T3）：落包到 cdn/ —— 只产出 `.tgz` 与包级 `.tgz.sig`。
+//
+// 钉死 D-1 的职责边界：publish **不碰索引**（不得生成 bundles.yaml / manifests.yaml），
+// 也不得把私钥写进任何目录（私钥是否入盘由隔离场景纪律兜，这里断言 cdn 与暂存区无 PEM）。
+import { Buffer } from "node:buffer";
+import { generateKeyPairSync } from "node:crypto";
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+
+import { verifyCanonical } from "../../lifecycle/sign";
+import { publishPackage } from "../publish";
+
+const MOUNTS = "  - prefix: /api\n    api: src\n  - prefix: /cdn\n    web: ../cdn\n";
+const CONFIG = `mounts:\n${MOUNTS}server:\n  host: 127.0.0.1\n  port: 9778\n`;
+const KEY_ID = "demo.publisher";
+
+/** Ed25519 测试身份：私钥只在内存，路径从不落盘 */
+function testIdentity(): { privateKeyPem: string, publicKeyHex: string } {
+	const kp = generateKeyPairSync("ed25519");
+	return {
+		privateKeyPem: kp.privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+		publicKeyHex: Buffer.from(kp.publicKey.export({ format: "der", type: "spki" }).subarray(-32)).toString("hex"),
+	};
+}
+
+function newProject(): string {
+	const root = mkdtempSync(join(tmpdir(), "ojm-market-publish-"));
+	mkdirSync(join(root, "api"), { recursive: true });
+	writeFileSync(join(root, "api", "config.yaml"), CONFIG, "utf-8");
+	mkdirSync(join(root, "cdn"), { recursive: true });
+	return root;
+}
+
+describe("given cdn/ 为空 When 发布 fixture", () => {
+	it("then 产出包与其包级签名，且不碰索引", async () => {
+		const root = newProject();
+		const identity = testIdentity();
+
+		const result = await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem });
+
+		expect(existsSync(result.tgzPath)).toBe(true);
+		expect(existsSync(result.sigPath)).toBe(true);
+		// D-1：索引不是 publish 的事
+		expect(existsSync(join(root, "cdn", "bundles.yaml"))).toBe(false);
+		expect(existsSync(join(root, "cdn", "manifests.yaml"))).toBe(false);
+	});
+
+	it("then .sig 是可复核的合法 detached 签名（横向复核）", async () => {
+		const root = newProject();
+		const identity = testIdentity();
+
+		const result = await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem });
+		const sig = JSON.parse(readFileSync(result.sigPath, "utf-8")) as { key_id: string, public_key: string, value: string, canon: string };
+
+		expect(sig.key_id).toBe(KEY_ID);
+		expect(sig.public_key).toBe(identity.publicKeyHex);
+		expect(sig.canon).toBe("v1");
+		expect(verifyCanonical(sig.public_key, result.canonical, sig.value)).toBe(true);
+	});
+
+	it("then 私钥不落盘：cdn 与工程根都查不到 PEM", async () => {
+		const root = newProject();
+		const identity = testIdentity();
+
+		await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem });
+
+		const pemInCdn = readdirSync(join(root, "cdn")).filter(f => f.endsWith(".pem"));
+		expect(pemInCdn).toEqual([]);
+	});
+});
+
+describe("given 同 name@version 再次发布", () => {
+	it("when 内容一致 Then 幂等覆盖（sha256 不变）", async () => {
+		const root = newProject();
+		const identity = testIdentity();
+		const base = { projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem };
+
+		const first = await publishPackage(base);
+		const second = await publishPackage(base);
+
+		expect(second.sha256).toBe(first.sha256);
+		expect(second.tgzPath).toBe(first.tgzPath);
+	});
+
+	it("when 已有同版本文件但字节不同 Then 报冲突并提示升版本", async () => {
+		const root = newProject();
+		const identity = testIdentity();
+		const target = join(root, "cdn", "demo-solution-0.1.0.tgz");
+		writeFileSync(target, "not-a-real-tgz-but-different-bytes", "utf-8");
+
+		await expect(publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: identity.privateKeyPem }))
+			.rejects
+			.toThrow(/version/);
+	});
+});
+
+describe("given 签名身份缺失 When 发布", () => {
+	it("then 抛人话错误，不产出半截包", async () => {
+		const root = newProject();
+
+		await expect(publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0" }))
+			.rejects
+			.toThrow(/-id/);
+
+		expect(existsSync(join(root, "cdn", "demo-solution-0.1.0.tgz"))).toBe(false);
+	});
+});

package/src/market/__tests__/report.test.ts

@@ -0,0 +1,51 @@
+// market/report spec（T12 收尾）：报告白黑名单——白名单内容落盘，黑名单字段写盘前被掩码。
+import { mkdtempSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+
+import { FAILURE_PLAYBOOK } from "../failure-playbook";
+import { sanitizeReportText, writeWalkthroughReport } from "../report";
+
+describe("given 含黑名单字段的文本 When 过脱敏", () => {
+	it("then Bearer token / JWT / PEM / jwt_secret 全部被掩码，白名单内容（指纹/sha256/key_id）原样保留", () => {
+		const text = [
+			"authorization: Bearer abc.def-123~",
+			"jwt: eyJhbGciOiJ.eyJzdWI.SflKxw",
+			"-----BEGIN PRIVATE KEY-----\nMIGHAgEAMBMG\n-----END PRIVATE KEY-----",
+			"jwt_secret: hunter2",
+			"fingerprint 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 / key_id demo.publisher / sha256 abc123",
+		].join("\n");
+		const out = sanitizeReportText(text);
+		expect(out).not.toContain("abc.def-123");
+		expect(out).not.toContain("eyJhbGciOiJ");
+		expect(out).not.toContain("MIGHAgEAMBMG");
+		expect(out).not.toContain("hunter2");
+		expect(out).toContain("Bearer ***");
+		expect(out).toContain("9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"); // 白名单原样
+		expect(out).toContain("demo.publisher");
+		// 幂等：二次过检不再变化
+		expect(sanitizeReportText(out)).toBe(out);
+	});
+});
+
+describe("given 一次 walkthrough 的行 When 落盘报告", () => {
+	it("then 写出 AC 表 + 文案表，且 detail 里的 token 被掩码", () => {
+		const dir = mkdtempSync(join(tmpdir(), "ojm-report-"));
+		const file = writeWalkthroughReport({
+			rows: [
+				{ key: "install", title: "安装（11 段）", ok: true, detail: "" },
+				{ key: "neg-x", title: "负向示例", ok: false, detail: "泄漏 Authorization: Bearer leAk.ed-tok~en" },
+			],
+			port: 49999,
+			playbook: FAILURE_PLAYBOOK,
+			logDir: dir,
+		});
+		const text = readFileSync(file, "utf-8");
+		expect(file).toContain(join(dir, "walkthrough-"));
+		expect(text).toContain("| install | PASS | 安装（11 段） |");
+		expect(text).toContain("| neg-x | FAIL |");
+		expect(text).toContain("sig_missing"); // 文案表段在场
+		expect(text).not.toContain("leAk.ed-tok"); // 黑名单兜底生效
+	});
+});

package/src/market/__tests__/setup.test.ts

@@ -0,0 +1,114 @@
+// ojm market setup spec（T5）：首跑打开市场地址。
+//
+// 两条必守：① 写出的地址必须是 config 推导的**绝对 URL**（dev 形态下相对路径会拿到 index.html，
+// 见设计 §3.1.1）；② seed admin 处于 must_change 悬挂期时，登录拿的是限权 token，
+// 必须先改密拿全权 token 才写得了 system 设置——这条不闭环，首跑就直接卡死。
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+
+import { setupMarketUrl } from "../setup";
+
+const MOUNTS = "  - prefix: /api\n    api: src\n  - prefix: /cdn\n    web: ../cdn\n";
+const CONFIG = `mounts:\n${MOUNTS}server:\n  host: 127.0.0.1\n  port: 9778\n`;
+const MARKET_KEY = "framework.market_cdn_url";
+
+interface Call {
+	url: string
+	method: string
+	body?: Record<string, unknown>
+	auth?: string
+}
+
+/** 假站点：可编排 login 是否受限、settings 是否拒绝 */
+function fakeSite(opts: { restricted?: boolean, rejectSettings?: boolean, rejectLogin?: boolean } = {}) {
+	const calls: Call[] = [];
+	const fetchFn = (async (url: string, init?: { method?: string, body?: string, headers?: Record<string, string> }): Promise<Response> => {
+		const method = init?.method ?? "GET";
+		const body = init?.body === undefined ? undefined : JSON.parse(init.body) as Record<string, unknown>;
+		calls.push({ url, method, body, auth: init?.headers?.authorization });
+		if (url.endsWith("/api/auth/login")) {
+			if (opts.rejectLogin === true)
+				return json({ code: 401, msg: "用户名或密码错误", data: null });
+			return json({ code: 0, msg: "ok", data: { access_token: "token-limited", restricted: opts.restricted === true } });
+		}
+		if (url.endsWith("/api/auth/password"))
+			return json({ code: 0, msg: "ok", data: { access_token: "token-full", refresh_token: "r", expires_in: 3600 } });
+		if (url.endsWith("/api/system/settings")) {
+			if (opts.rejectSettings === true)
+				return json({ code: 403, msg: "must_change", data: null });
+			return json({ code: 0, msg: "ok", data: true });
+		}
+		throw new Error(`未预期的请求：${method} ${url}`);
+	}) as unknown as typeof fetch;
+	return { calls, fetchFn };
+}
+
+function json(payload: unknown): Response {
+	return { ok: true, status: 200, text: async () => JSON.stringify(payload) } as unknown as Response;
+}
+
+function newProject(): string {
+	const root = mkdtempSync(join(tmpdir(), "ojm-market-setup-"));
+	mkdirSync(join(root, "api"), { recursive: true });
+	writeFileSync(join(root, "api", "config.yaml"), CONFIG, "utf-8");
+	mkdirSync(join(root, "cdn"), { recursive: true });
+	return root;
+}
+
+describe("given 站点可直连且凭据未悬挂 When setup", () => {
+	it("then 直接写入 config 推导的绝对市场地址", async () => {
+		const root = newProject();
+		const site = fakeSite();
+
+		const result = await setupMarketUrl({ projectRoot: root, user: "admin", pass: "123456", url: "http://127.0.0.1:9778", fetchFn: site.fetchFn });
+
+		expect(result.cdnBaseUrl).toBe("http://127.0.0.1:9778/cdn");
+		const put = site.calls.find(c => c.url.endsWith("/api/system/settings"))!;
+		expect(put.method).toBe("PUT");
+		expect(put.body).toEqual({ key: MARKET_KEY, value: "http://127.0.0.1:9778/cdn" });
+		expect(result.changedPassword).toBe(false);
+	});
+});
+
+describe("given seed admin 处于 must_change 悬挂期 When setup", () => {
+	it("then 先改密换全权 token，再写设置（且后续请求用新 token）", async () => {
+		const root = newProject();
+		const site = fakeSite({ restricted: true });
+
+		const result = await setupMarketUrl({ projectRoot: root, user: "admin", pass: "123456", newPass: "newpass-123", url: "http://127.0.0.1:9778", fetchFn: site.fetchFn });
+
+		expect(result.changedPassword).toBe(true);
+		const pwd = site.calls.find(c => c.url.endsWith("/api/auth/password"))!;
+		expect(pwd.method).toBe("PUT");
+		expect(pwd.body).toEqual({ old_password: "123456", new_password: "newpass-123" });
+		const put = site.calls.find(c => c.url.endsWith("/api/system/settings"))!;
+		expect(put.auth).toBe("Bearer token-full");
+	});
+});
+
+describe("given 站点不可达 When setup", () => {
+	it("then 抛人话错误提示先起站点，不写任何东西", async () => {
+		const root = newProject();
+		const failing = async (): Promise<Response> => {
+			throw new Error("ECONNREFUSED");
+		};
+		const fetchFn = failing as unknown as typeof fetch;
+
+		await expect(setupMarketUrl({ projectRoot: root, user: "admin", pass: "123456", url: "http://127.0.0.1:9778", fetchFn }))
+			.rejects
+			.toThrow(/ojm dev/);
+	});
+});
+
+describe("given 改密后写设置仍被拒 When setup", () => {
+	it("then 抛人话错误而不是静默成功", async () => {
+		const root = newProject();
+		const site = fakeSite({ restricted: true, rejectSettings: true });
+
+		await expect(setupMarketUrl({ projectRoot: root, user: "admin", pass: "123456", newPass: "newpass-123", url: "http://127.0.0.1:9778", fetchFn: site.fetchFn }))
+			.rejects
+			.toThrow(/must_change|权限|设置/);
+	});
+});

package/src/market/__tests__/verify.test.ts

@@ -0,0 +1,111 @@
+// ojm market verify spec（T7）：离线验包——不起站点、不装、不要凭据。
+//
+// 钉死两条：① 四类校验分列（完整性 / 包级签 / 索引签 / 结构），篡改任一项都必须在对应项上打叉；
+// ② 结论恒带边界声明——验签过 ≠ 代码无恶意，这一点写错比校验写错更危险。
+import { Buffer } from "node:buffer";
+import { generateKeyPairSync } from "node:crypto";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+
+import { buildIndex } from "../build-index";
+import { publishPackage } from "../publish";
+import { verifyMarket } from "../verify";
+
+const MOUNTS = "  - prefix: /api\n    api: src\n  - prefix: /cdn\n    web: ../cdn\n";
+const CONFIG = `mounts:\n${MOUNTS}server:\n  host: 127.0.0.1\n  port: 9778\n`;
+const KEY_ID = "demo.publisher";
+
+function testPem(): string {
+	return generateKeyPairSync("ed25519").privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+}
+
+function newProject(): string {
+	const root = mkdtempSync(join(tmpdir(), "ojm-market-verify-"));
+	mkdirSync(join(root, "api"), { recursive: true });
+	writeFileSync(join(root, "api", "config.yaml"), CONFIG, "utf-8");
+	mkdirSync(join(root, "cdn"), { recursive: true });
+	return root;
+}
+
+/** 落一个包并重建索引，返回工程根 */
+async function seed(): Promise<string> {
+	const root = newProject();
+	await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: testPem() });
+	await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
+	return root;
+}
+
+function itemOf(result: Awaited<ReturnType<typeof verifyMarket>>, name: string): { ok: boolean, detail: string } | undefined {
+	return result.checks.find(c => c.item === name);
+}
+
+describe("given 一个正常落地的包 When 离线验包", () => {
+	it("then 四类校验全绿且结论带边界声明", async () => {
+		const root = await seed();
+
+		const result = await verifyMarket({ projectRoot: root });
+
+		expect(result.passed).toBe(true);
+		expect(itemOf(result, "完整性")?.ok).toBe(true);
+		expect(itemOf(result, "包级签名")?.ok).toBe(true);
+		expect(itemOf(result, "索引签名")?.ok).toBe(true);
+		expect(itemOf(result, "manifest 结构")?.ok).toBe(true);
+		expect(result.conclusion).toContain("不构成内容安全性背书");
+	});
+});
+
+describe("given 包体被改了一个字节 When 离线验包", () => {
+	it("then 完整性与包级签名双双打叉（sha256 不符 + 验签不过）", async () => {
+		const root = await seed();
+		const tgz = join(root, "cdn", "demo-solution-0.1.0.tgz");
+		const bytes = Buffer.from(readFileSync(tgz));
+		bytes[bytes.length - 1] = bytes[bytes.length - 1]! ^ 0xFF;
+		writeFileSync(tgz, bytes);
+
+		const result = await verifyMarket({ projectRoot: root });
+
+		expect(result.passed).toBe(false);
+		expect(itemOf(result, "完整性")?.ok).toBe(false);
+		expect(itemOf(result, "包级签名")?.ok).toBe(false);
+	});
+});
+
+describe("given 包级签名被删掉 When 离线验包", () => {
+	it("then 包级签名打叉并给出 sig_missing 口径的指引", async () => {
+		const root = await seed();
+		rmSync(join(root, "cdn", "demo-solution-0.1.0.tgz.sig"));
+
+		const result = await verifyMarket({ projectRoot: root });
+
+		expect(itemOf(result, "包级签名")?.ok).toBe(false);
+		expect(itemOf(result, "包级签名")?.detail).toMatch(/sig|签名/);
+	});
+});
+
+describe("given 索引被手改过 When 离线验包", () => {
+	it("then 索引签名打叉（索引签名是完整性层，篡改必须可见）", async () => {
+		const root = await seed();
+		const bundles = join(root, "cdn", "bundles.yaml");
+		writeFileSync(bundles, `${readFileSync(bundles, "utf-8")}\n# tampered\n`);
+
+		const result = await verifyMarket({ projectRoot: root });
+
+		expect(itemOf(result, "索引签名")?.ok).toBe(false);
+	});
+});
+
+describe("given 落了 tgz 但没重建索引 When 带 --rebuild-check 验包", () => {
+	it("then 报漂移：索引缺该包条目", async () => {
+		const root = newProject();
+		await publishPackage({ projectRoot: root, fixture: "demo-solution@0.1.0", id: KEY_ID, privateKeyPem: testPem() });
+		await buildIndex({ projectRoot: root, id: KEY_ID, privateKeyPem: testPem() });
+		await publishPackage({ projectRoot: root, fixture: "other-solution@0.1.0", id: KEY_ID, privateKeyPem: testPem() });
+
+		const result = await verifyMarket({ projectRoot: root, rebuildCheck: true });
+
+		expect(result.drift?.length ?? 0).toBeGreaterThan(0);
+		expect(result.drift?.join(" ")).toMatch(/other-solution/);
+	});
+});