@chatcode/cco-market 1.45.1

package/lib/types/channels.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The market's release channels: which build of ITSELF it offers.
+ *
+ * Only the market follows this. Other plugins are never pulled from a
+ * prerelease on the strength of a setting the user made about the market —
+ * opting into early builds is volunteering to try THIS plugin early, not to
+ * be handed every other author's unreleased work.
+ *
+ * The model lives in its own module because it is the part with rules
+ * rather than plumbing: three channels, one of them hidden, a mapping to
+ * npm dist-tags, and a resolution order that has already been got wrong
+ * once (see `resolveChannel`).
+ */
+/** A channel the market can follow. */
+export type Channel = 'stable' | 'beta' | 'dev';
+/**
+ * The npm dist-tag each channel installs from.
+ *
+ * `dev` is published straight from a branch with no git tag behind it, so a
+ * version carries a timestamp and a short SHA (`1.15.0-dev.20260818-3f1432e`)
+ * and is never reused. That is what makes a dev build disposable: nothing in
+ * the repository's history refers to it.
+ */
+export declare const DIST_TAG: Record<Channel, string>;
+/**
+ * Every channel a user may pick. All three, always.
+ *
+ * `dev` was behind a developer-mode switch for one version, on the reasoning
+ * that a build published straight off a branch should not sit beside
+ * "stable" looking like a third degree of caution. The switch cost more than
+ * it bought: a stored mode, a route to change it, a rule for what happens to
+ * a dev choice when it is turned off, and a control whose own purpose needed
+ * explaining. A plainly labelled option a user can read is simpler than a
+ * hidden one plus the machinery that hides it — the label does the work the
+ * gate was doing.
+ */
+export declare const CHANNELS: readonly Channel[];
+/** Narrow an untrusted value to a Channel, or null. */
+export declare function asChannel(value: unknown): Channel | null;
+/**
+ * Which channel applies right now.
+ *
+ * A choice on record always wins — including "stable" while a prerelease is
+ * running, which is the only way back off a channel. Only the ABSENCE of a
+ * choice is derived, and then from what is actually running: installing
+ * `dshmarket@beta` by hand IS the subscription, and treating that as
+ * "stable" costs updates rather than just clarity — on the stable channel
+ * `latest` (1.13.1) is not newer than an installed 1.14.0-beta.1, so the
+ * market answers "up to date" and the next beta is never offered.
+ *
+ * Which makes `undefined` load-bearing: it has to survive both the settings
+ * schema (no `.default`) and state.json (field omitted) or "never chose"
+ * silently becomes "chose stable".
+ *
+ */
+export declare function resolveChannel(setting: Channel | undefined, version: string): Channel;

package/lib/types/check.d.ts

@@ -0,0 +1,266 @@
+/**
+ * Profile composition diagnostics — issue #98 (phase 1): the check-only
+ * "plugin loading layer and conflict view".
+ *
+ * Pure filesystem analysis of one dsh profile directory; no processes, no
+ * network, no writes. It answers, for the profile the market is serving:
+ *
+ *  1. What is the actual bundle stack (dsh.profile.bundles order) and where
+ *     does each layer come from (official in-box bundle vs community, the
+ *     dependency spec, the resolved directory)?
+ *  2. Which loader entry ids does the composed tree contain, and are any
+ *     duplicated across layers (the "duplicate loader entry id" boot failure
+ *     from #98)? Which rows does a later layer override?
+ *  3. Does any installed plugin pull a DSH host core package
+ *     (@deepseek-ai/dsh, @deepseek-ai/dsh-tools, @deepseek-ai/cordis, …) in
+ *     as an ordinary dependency — the dsh-excel-chat failure mode where the
+ *     plugin's copy gets hoisted to the profile root and shadows the host's
+ *     version (tool calls die, minimal preset fails to mount)?
+ *  4. Are there multiple versions of one core package in the lockfile, and
+ *     do plugin peerDependencies ranges match the resolved core version?
+ *  5. Do effective user/home patch entries reference npm package roots that
+ *     are installed in the profile-visible node_modules ancestry?
+ *
+ * The composition step mirrors @deepseek-ai/dsh-app-boot's applyEntryPatches
+ * (same js-yaml dialect incl. `!!js` scalars), so the rows reported here are
+ * what actually mounts at boot.
+ */
+export { findDshInstallDir } from './dsh-install.ts';
+/** Boot-breaking or confirmed problems vs informational warnings. */
+export interface CheckSummary {
+    ok: boolean;
+    errors: string[];
+    warnings: string[];
+}
+/** One layer of the bundle stack, in `dsh.profile.bundles` order. */
+export interface BundleLayer {
+    name: string;
+    /** Dependency spec from the profile package.json (npm range, git, link:…). */
+    source: string;
+    /** 'official' = in-box dsh bundle; 'community' = everything else. */
+    kind: 'official' | 'community';
+    /** Resolved package directory; null when the package is not installed. */
+    directory: string | null;
+    /** Absolute path of the layer's patch file; null when undeclared/missing. */
+    patchPath: string | null;
+    /**
+     * An in-box bundle whose directory could not be located — a gap in what
+     * this process can see, not a defect in the profile (#369). Distinct from
+     * `error`, which asserts the profile will not boot.
+     */
+    unresolvedInbox?: boolean;
+    /** Why this layer cannot load at boot (missing dir / no dsh.bundle / …). */
+    error: string | null;
+    /** Loader entry ids this bundle's patch inserts. */
+    entries: string[];
+    /** The patch file exists but could not be parsed as the entry-list dialect. */
+    parseError: string | null;
+    /** Author-declared ordering constraints (issue #98 phase 2), when present. */
+    order?: {
+        before?: string[];
+        after?: string[];
+        /** Violated rules for THIS bundle in the current stack order. */
+        conflicts?: Array<{
+            name: string;
+            reason: string;
+        }>;
+    };
+}
+/** One loader row of the composed tree, with the layer that introduced it. */
+export interface LoaderRow {
+    id: string;
+    /** Bundle package name, 'user-patch' (profile cordis.patch.yml) or 'home-patch'. */
+    layer: string;
+    kind: 'insert' | 'patch';
+    name?: string;
+}
+/** An id present in more than one composed row — the #98 duplicate-id boot failure. */
+export interface DuplicateId {
+    id: string;
+    /** Every layer that inserts/defines this id. */
+    layers: string[];
+    count: number;
+}
+/** A non-insert patch row that merged into an existing entry (later layer wins). */
+export interface OverrideRow {
+    id: string;
+    layer: string;
+    /** Layers that introduced the targeted entry earlier in the stack. */
+    overriddenLayers: string[];
+}
+/** A patch row that matched nothing at boot (dsh warns and skips it). */
+export interface OrphanRow {
+    id: string;
+    layer: string;
+    reason: string;
+}
+/** Directional verdict for one confirmed peer mismatch (issue #201 diagnostics). */
+export interface PeerRisk {
+    plugin: string;
+    peer: string;
+    range: string;
+    resolved: string;
+    direction: 'belowMin' | 'aboveMax';
+}
+export interface PeerWarning {
+    plugin: string;
+    peer: string;
+    range: string;
+    resolved: string;
+    reason: 'aboveMax' | 'optional';
+}
+/** classifyPeer result: risk / warning / none — none means informational. */
+export type PeerVerdict = {
+    kind: 'risk';
+    risk: PeerRisk;
+} | {
+    kind: 'warning';
+    warning: PeerWarning;
+} | {
+    kind: 'none';
+};
+/** A plugin peerDependencies range vs the resolved version. */
+export interface PeerMismatch {
+    plugin: string;
+    name: string;
+    range: string;
+    resolved: string | null;
+    /** False = confirmed incompatible; null = could not be evaluated. */
+    satisfied: boolean | null;
+    /**
+     * The declaring plugin marked this peer `optional` in
+     * `peerDependenciesMeta`. Carried so the summary can hold the same line
+     * `classifyPeer` already does: an optional peer that does not match is
+     * the plugin saying "I work without this", not a broken install (#275).
+     */
+    optional?: boolean;
+    /**
+     * The directional verdict, attached by `/dsh-market/check` for rows that
+     * did not match. It is computed on the server because the client cannot
+     * read `peerDependenciesMeta` off disk, and the tiering would otherwise
+     * have to be guessed from the range string (#201).
+     */
+    verdict?: PeerVerdict;
+}
+/**
+ * Loader entries sharing one NAME across DIFFERENT layers — the Loader
+ * registers plugins by name, so a later layer's row with the same name
+ * shadows the earlier one at runtime. Same-layer rows sharing a name are
+ * routine (a bundle defining several entries under one name) and are never
+ * reported here. Unlike duplicate ids (report.duplicates), which fail the
+ * boot outright, shadowing names only decide which entry wins at runtime.
+ */
+export interface DuplicateName {
+    name: string;
+    /** Every layer that inserts/defines a row with this name. */
+    layers: string[];
+    count: number;
+}
+/** Distinct resolved versions of one core package found in the lockfile. */
+export interface MultiVersion {
+    name: string;
+    versions: string[];
+    /** Version hoisted at the profile root, when present. */
+    hoisted: string | null;
+}
+/** The full check report for one profile. */
+export interface CheckReport {
+    profile: string;
+    scannedAt: number;
+    bundles: BundleLayer[];
+    rows: LoaderRow[];
+    duplicates: DuplicateId[];
+    duplicateNames: DuplicateName[];
+    overrides: OverrideRow[];
+    orphans: OrphanRow[];
+    peerMismatches: PeerMismatch[];
+    multiVersion: MultiVersion[];
+    /** Before/after rule conflicts in the CURRENT bundle order (issue #98 phase 2). */
+    orderConflicts: Array<{
+        name: string;
+        reason: string;
+    }>;
+    /** LOOT-style auto-fix: a community order satisfying every declared rule. */
+    suggestedOrder: {
+        ok: true;
+        order: string[];
+    } | {
+        ok: false;
+        cycle: string[];
+    } | null;
+    summary: CheckSummary;
+}
+export interface CheckOptions {
+    /** DSH host install dir; auto-detected from the CLI entry or Desktop resources when omitted. */
+    dshInstallDir?: string;
+    /** ChatCode CLI home for the home-level patch layer; legacy DSH_HOME remains a read-only compatibility input. */
+    homeDir?: string;
+}
+/** Parse entry-list source with the DSH dialect; null when it is not a list. */
+export declare function parsePatchText(text: string): unknown[] | null;
+/** Parse one entry-list patch file with the DSH dialect; null when unreadable. */
+export declare function parsePatchFile(path: string): unknown[] | null;
+/** DSH host core packages: what the dsh installation ships under @deepseek-ai. */
+export declare function corePackageNames(dshInstallDir: string | null): Set<string>;
+/** Compare two semver strings: negative | zero | positive (prerelease < release of same base). */
+export declare function compareSemver(a: string, b: string): number;
+/**
+ * Minimal range matcher for the peer-range check: `*`, exact, ^, ~, >=, >,
+ * <=, <, whitespace-separated pairs, and `||` alternatives. Anything else
+ * returns null (unknown — reported, not asserted).
+ *
+ * Prerelease handling follows npm's semver rule, evaluated at the comparator
+ * SET level (one `||` alternative is one set): a version carrying a
+ * prerelease tag only satisfies a set when at least one comparator in that
+ * set shares the version's [major, minor, patch] tuple AND carries a
+ * prerelease of its own; then every comparator is checked normally. So
+ * `^0.1.0` never matches `0.2.0-rc.1` (nor `0.1.0-rc.5`), while
+ * `>=1.2.3-rc.1 <2.0.0` does match `1.2.3-rc.2` (issue #98 analysis).
+ * Discovery can opt into npm's `includePrerelease` behaviour because every
+ * published DSH host line is itself prerelease; diagnostics retain the npm
+ * default unless a caller explicitly asks for that wider admission.
+ */
+export declare function satisfiesRange(version: string, range: string, options?: {
+    includePrerelease?: boolean;
+}): boolean | null;
+interface ResolvableLoaderRow extends LoaderRow {
+    activation: 'required' | 'conditional';
+}
+export interface LayerInput {
+    label: string;
+    kind: 'bundle' | 'user' | 'home';
+    patches: unknown[];
+    parseError: string | null;
+}
+interface Composed {
+    rows: LoaderRow[];
+    resolvableRows: ResolvableLoaderRow[];
+    duplicates: DuplicateId[];
+    overrides: OverrideRow[];
+    orphans: OrphanRow[];
+}
+/**
+ * Apply the layer stack over an empty root exactly like the dsh boot include.
+ * Exported so the trial-start validation (src/trial.ts) can replay the
+ * composition with a candidate bundle order BEFORE anything is written.
+ */
+export declare function composeLayers(layers: LayerInput[]): Composed;
+/**
+ * Build the bundle layer stack for a profile under a GIVEN bundle order —
+ * the manifest order for analyzeProfile, or a candidate order for trial
+ * validation (src/trial.ts). Bundle resolution mirrors the boot exactly:
+ * the dsh installation anchor first (in-box bundles always come from the
+ * running dsh, never a profile-local copy), then Node's module search from
+ * the profile directory (covers community bundles and pnpm workspace-root
+ * hoisting). A single code path keeps the check report and the trial
+ * validation from ever disagreeing about what a bundle is or where it lives.
+ */
+export declare function buildBundleLayers(profileDirectory: string, bundleNames: string[], specs: Record<string, string>, dshInstallDir: string | null): {
+    bundles: BundleLayer[];
+    layers: LayerInput[];
+};
+/**
+ * Analyze one profile directory (issue #98, phase 1). Pure function of the
+ * directory contents — safe to call on every market open.
+ */
+export declare function analyzeProfile(profileDirectory: string, options?: CheckOptions): CheckReport;

package/lib/types/compatibility.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Host-contract compatibility preflight for #195.
+ *
+ * Pure evaluation of what `analyzeProfile()` already reports: a confirmed
+ * peer mismatch (`satisfied === false`) is translated into a directional
+ * verdict:
+ *
+ * - `belowMin`: the resolved version is older than every alternative's lower
+ *   bound — the environment is too old for the plugin's declared contract.
+ * - `aboveMax`: the resolved version is newer than every alternative's upper
+ *   bound (or the exact pin). This is only a risk when the author expressed
+ *   an explicit upper bound or exact pin; otherwise it is a warning, because
+ *   the ecosystem currently has many sloppy `^0.0.1`-style declarations that
+ *   work in practice.
+ *
+ * Everything else stays informational: `*`, prerelease-vs-`*` artifacts,
+ * unparseable ranges, and optional peers never produce a risk here.
+ */
+import { type CheckOptions, type DuplicateName, type PeerRisk, type PeerWarning, type PeerVerdict } from './check.ts';
+export type CompatibilityRisk = PeerRisk;
+export type CompatibilityWarning = PeerWarning;
+/** Re-exported so consumers can keep importing PeerVerdict from this module. */
+export type { PeerVerdict };
+export interface CompatibilityAssessment {
+    risks: CompatibilityRisk[];
+    warnings: CompatibilityWarning[];
+    /**
+     * Cross-layer duplicate loader NAMES, carried through from the same
+     * `analyzeProfile` run the peer checks already pay for (#230).
+     *
+     * The report has always computed these and deliberately kept them out of
+     * `summary.warnings`, because flagging an already-messy but working
+     * profile is a false positive nobody can act on. Diffing before against
+     * after is what makes them actionable: a collision this operation
+     * INTRODUCED is one the operation can also undo.
+     */
+    duplicateNames: DuplicateName[];
+}
+/** Translate one confirmed peer mismatch into a directional verdict. */
+export declare function classifyPeer(plugin: string, peer: string, range: string, resolved: string | null, optional: boolean): PeerVerdict;
+/** Whether a peer is declared optional in the installed plugin manifest. */
+export declare function isOptionalPeer(profileDirectory: string, plugin: string, peer: string): boolean;
+/** Evaluate the current profile with the same machinery `/dsh-market/check` uses. */
+export declare function assessCompatibility(profileDirectory: string, options?: CheckOptions): CompatibilityAssessment;
+/** Risks present after a mutation but absent before it. */
+export declare function introducedRisks(before: CompatibilityAssessment, after: CompatibilityAssessment): CompatibilityRisk[];
+/**
+ * Cross-layer name collisions present after a mutation but absent before it
+ * (#230 by @dxc-dxc).
+ *
+ * Keyed by NAME alone, not by the layer set: a collision the operation made
+ * worse — same name, now shadowing across one more layer — is still the same
+ * collision the profile already had, and re-reporting it would put the
+ * operator back in front of a problem they did not just cause.
+ *
+ * This is what makes surfacing these safe at all. The underlying
+ * `duplicateNames` is informational precisely because a healthy-but-messy
+ * profile can carry collisions indefinitely; only the newly introduced ones
+ * are attributable to the install that just ran, and therefore undoable by
+ * rolling it back.
+ */
+export declare function introducedDuplicateNames(before: CompatibilityAssessment, after: CompatibilityAssessment): DuplicateName[];
+/** Convenience wrapper matching the profile helper signature. */
+export declare function assessProfile(profile: string, explicitDir?: string): CompatibilityAssessment;

package/lib/types/diagnostics.d.ts

@@ -0,0 +1,29 @@
+/** Versioned, read-only diagnostics shared by the host route and client. */
+export declare const DIAGNOSTIC_SCHEMA: 'dsh-market/diagnostics/v1';
+/** Conservative first set of known, identity-sensitive host contracts. */
+export declare const KNOWN_SHARED_HOST_PACKAGES: readonly ['@deepseek-ai/cordis', '@deepseek-ai/dsh-attachment', '@deepseek-ai/dsh-llm', '@deepseek-ai/dsh-system-prompt', '@deepseek-ai/dsh-tools'];
+export interface PackageManifestFact {
+    packageName: string;
+    manifest: unknown;
+}
+export interface SharedHostPackageDependencyFinding {
+    code: 'shared-host-package-dependency';
+    severity: 'warning';
+    subject: {
+        kind: 'package';
+        name: string;
+    };
+    evidence: {
+        basis: 'manifest-declaration';
+        dependency: string;
+        declaredRange: string;
+        declaredIn: 'dependencies';
+    };
+}
+export type DiagnosticFinding = SharedHostPackageDependencyFinding;
+export interface DiagnosticReportV1 {
+    schema: typeof DIAGNOSTIC_SCHEMA;
+    findings: DiagnosticFinding[];
+}
+/** Build a stable diagnostic envelope from installed package manifests. */
+export declare function diagnosePackageManifests(packages: readonly PackageManifestFact[]): DiagnosticReportV1;

package/lib/types/discovery-compatibility.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Discovery-time DSH compatibility metadata.
+ *
+ * The public catalog does not carry npm manifests. Fetching every manifest
+ * while the market opens would turn one catalog request into more than a
+ * thousand registry requests, so this module supplies a bounded, on-demand
+ * index. Successful public manifest facts are cached beside the market's
+ * profile state; conclusions are never cached because they depend on the DSH
+ * version of the process serving the page.
+ */
+export type HostCompatibilityStatus = 'compatible' | 'incompatible' | 'unknown';
+export type HostCompatibilityBasis = 'manifest' | 'undeclared' | 'unavailable';
+export interface HostRequirementDeclaration {
+    kind: 'engine' | 'peer';
+    /** Present only for a peer-derived declaration. */
+    package?: string;
+    range: string;
+}
+export interface HostCompatibility {
+    status: HostCompatibilityStatus;
+    basis: HostCompatibilityBasis;
+    /** Human-readable intersection of every raw declaration. */
+    requirement: string | null;
+    declarations: HostRequirementDeclaration[];
+}
+export interface NpmManifestFacts {
+    version: string | null;
+    enginesDsh: string | null;
+    peerDependencies: Record<string, string>;
+}
+type FetchLike = (url: string, init?: {
+    signal?: AbortSignal;
+    headers?: Record<string, string>;
+}) => Promise<Response>;
+/** Keep only the small public subset of an npm manifest needed by discovery. */
+export declare function manifestFacts(value: unknown): NpmManifestFacts;
+/**
+ * Derive the current host verdict from raw manifest facts.
+ *
+ * Every valid declaration is conjunctive: an explicit `engines.dsh` and all
+ * host peers must agree. A malformed declaration keeps a passing result
+ * unknown, but cannot erase a definite mismatch from another declaration.
+ */
+export declare function deriveHostCompatibility(facts: NpmManifestFacts | null, hostVersion: string | null, hostPackages: ReadonlySet<string>): HostCompatibility;
+/**
+ * Durable, bounded lookup of npm `latest` manifests.
+ *
+ * Failed requests are intentionally memory-only and short-lived: a mirror
+ * outage must not become a day-long false "undeclared" result on disk.
+ */
+export declare class DiscoveryManifestIndex {
+    private readonly cacheFile;
+    private readonly entries;
+    private readonly failures;
+    private readonly inflight;
+    private readonly fetcher;
+    private readonly now;
+    private readonly ttlMs;
+    private readonly concurrency;
+    private loaded;
+    private consecutiveFailures;
+    private unavailableUntil;
+    private dirty;
+    private activeFetches;
+    private readonly fetchWaiters;
+    constructor(cacheFile: string, options?: {
+        fetcher?: FetchLike;
+        now?: () => number;
+        ttlMs?: number;
+        concurrency?: number;
+    });
+    private load;
+    private persist;
+    /** One semaphore for the whole index, including overlapping HTTP batches. */
+    private withFetchPermit;
+    private fetchOne;
+    /** Look up a bounded batch while never exceeding the configured fan-out. */
+    lookup(names: readonly string[], registry: string): Promise<Record<string, NpmManifestFacts | null>>;
+}
+export {};