test(marketplace): prove packaged client contract

tests/unit/pi-product-artifact.test.ts

@@ -15,6 +15,7 @@ import {
   verifyBundledCodingPluginResources,
   defaultProductExecutable,
   validatePiArtifactMetadata,
+  verifyMarketplaceClientArtifact,
 } from '../../scripts/lib/pi-product-artifact.mjs';
 import { parsePiArtifactVerifierArgs } from '../../scripts/verify-pi-product-artifact.mjs';
 
@@ -185,6 +186,49 @@ describe('final Pi product artifact verification', () => {
     });
   });
 
+  it('proves the packaged Marketplace trust, routes, effective snapshot, and Renderer assets', () => {
+    const artifact = Buffer.from([
+      'makelore-plugin-release.v1', 'skill_only', 'plugin_signature_invalid',
+      'signing key is not trusted', '/api/coding/plugin-marketplace',
+      'plugin-marketplace\\/install\\/', 'plugin-marketplace\\/update\\/',
+      'effectiveSkillIds', 'pluginReleaseIds',
+      '/api/coding/plugin-marketplace/catalog', '/api/coding/plugin-marketplace/library',
+      '免费获取', '我的插件',
+    ].join('\n'));
+
+    const trustSource = `export const CODE_OWNED_PLUGIN_SIGNING_KEYS = Object.freeze(
+      {} as Readonly<Record<string, string>>,
+    );`;
+    expect(verifyMarketplaceClientArtifact(artifact, trustSource)).toMatchObject({
+      schema2SkillOnly: true,
+      productionTrust: 'official-key-absent-fail-closed',
+      libraryInstallAndEffectiveRoutes: true,
+      rendererAssets: true,
+      productionKeyIds: [],
+      privateKeyMaterialInTrustSource: false,
+      result: 'pass',
+    });
+  });
+
+  it('rejects a packaged Marketplace missing a required asset or containing a private key', () => {
+    const emptyTrust = 'CODE_OWNED_PLUGIN_SIGNING_KEYS = Object.freeze({} as Readonly<Record<string, string>>);';
+    expect(() => verifyMarketplaceClientArtifact(Buffer.from('makelore-plugin-release.v1'), emptyTrust))
+      .toThrow('Marketplace contract markers');
+
+    const complete = Buffer.from([
+      'makelore-plugin-release.v1', 'skill_only', 'plugin_signature_invalid',
+      'signing key is not trusted', '/api/coding/plugin-marketplace',
+      'plugin-marketplace\\/install\\/', 'plugin-marketplace\\/update\\/',
+      'effectiveSkillIds', 'pluginReleaseIds',
+      '/api/coding/plugin-marketplace/catalog', '/api/coding/plugin-marketplace/library',
+      '免费获取', '我的插件',
+    ].join('\n'));
+    expect(() => verifyMarketplaceClientArtifact(
+      complete,
+      `${emptyTrust}\nprocess.env.PLUGIN_KEY`,
+    )).toThrow('empty code-owned fail-closed store');
+  });
+
   it('rejects a packaged plugin tree that drops an SDK asset or catalog marker', async () => {
     const fixture = await bundledResourceFixture();
     await rm(path.join(