npm - @chatcode/cco-market - Versions diffs - 1.45.1 - Mend

@chatcode/cco-market 1.45.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (177) hide show

package/LICENSE +21 -0
package/README.md +146 -0
package/README.zh.md +143 -0
package/UPDATE-API-V1.md +132 -0
package/client/client.js +11534 -0
package/cordis.patch.yml +5 -0
package/lib/accelerate.js +184 -0
package/lib/agents.js +36 -0
package/lib/backup.js +572 -0
package/lib/catalog-local-match.js +126 -0
package/lib/catalog-npm.js +111 -0
package/lib/changelog.js +242 -0
package/lib/channels.js +64 -0
package/lib/check.js +1067 -0
package/lib/compatibility.js +198 -0
package/lib/diagnostics.js +49 -0
package/lib/discovery-compatibility.js +260 -0
package/lib/dsh-cli.js +949 -0
package/lib/dsh-install.js +108 -0
package/lib/gist.js +352 -0
package/lib/groups.js +97 -0
package/lib/home-paths.js +42 -0
package/lib/hot.js +519 -0
package/lib/http.js +39 -0
package/lib/index.js +97 -0
package/lib/install.js +387 -0
package/lib/log.js +197 -0
package/lib/ndjson.js +154 -0
package/lib/net.js +98 -0
package/lib/order.js +284 -0
package/lib/patch.js +521 -0
package/lib/pnpm-compat.js +490 -0
package/lib/presets.js +278 -0
package/lib/profile.js +911 -0
package/lib/region-probe.js +93 -0
package/lib/regions.js +253 -0
package/lib/registry.js +204 -0
package/lib/restart.js +373 -0
package/lib/routes.js +4372 -0
package/lib/settings.js +109 -0
package/lib/skill-market/api.js +119 -0
package/lib/skill-market/config.js +29 -0
package/lib/skill-market/installer.js +352 -0
package/lib/skill-market/runtime.js +13 -0
package/lib/skill-market/tui.js +119 -0
package/lib/skill-market/types.js +1 -0
package/lib/skill-market/web-routes.js +123 -0
package/lib/snapshot.js +500 -0
package/lib/source-migration.js +54 -0
package/lib/sources.js +596 -0
package/lib/store.js +91 -0
package/lib/themes.js +102 -0
package/lib/trial.js +116 -0
package/lib/types/accelerate.d.ts +85 -0
package/lib/types/agents.d.ts +22 -0
package/lib/types/backup.d.ts +131 -0
package/lib/types/catalog-local-match.d.ts +50 -0
package/lib/types/catalog-npm.d.ts +47 -0
package/lib/types/changelog.d.ts +102 -0
package/lib/types/channels.d.ts +56 -0
package/lib/types/check.d.ts +266 -0
package/lib/types/compatibility.d.ts +64 -0
package/lib/types/diagnostics.d.ts +29 -0
package/lib/types/discovery-compatibility.d.ts +80 -0
package/lib/types/dsh-cli.d.ts +324 -0
package/lib/types/dsh-install.d.ts +46 -0
package/lib/types/gist.d.ts +53 -0
package/lib/types/groups.d.ts +34 -0
package/lib/types/home-paths.d.ts +16 -0
package/lib/types/hot.d.ts +221 -0
package/lib/types/http.d.ts +12 -0
package/lib/types/index.d.ts +14 -0
package/lib/types/install.d.ts +172 -0
package/lib/types/log.d.ts +43 -0
package/lib/types/ndjson.d.ts +52 -0
package/lib/types/net.d.ts +58 -0
package/lib/types/order.d.ts +100 -0
package/lib/types/patch.d.ts +129 -0
package/lib/types/pnpm-compat.d.ts +93 -0
package/lib/types/presets.d.ts +90 -0
package/lib/types/profile.d.ts +253 -0
package/lib/types/region-probe.d.ts +50 -0
package/lib/types/regions.d.ts +122 -0
package/lib/types/registry.d.ts +86 -0
package/lib/types/restart.d.ts +194 -0
package/lib/types/routes.d.ts +67 -0
package/lib/types/settings.d.ts +78 -0
package/lib/types/skill-market/api.d.ts +10 -0
package/lib/types/skill-market/config.d.ts +3 -0
package/lib/types/skill-market/installer.d.ts +23 -0
package/lib/types/skill-market/runtime.d.ts +10 -0
package/lib/types/skill-market/tui.d.ts +4 -0
package/lib/types/skill-market/types.d.ts +71 -0
package/lib/types/skill-market/web-routes.d.ts +19 -0
package/lib/types/snapshot.d.ts +93 -0
package/lib/types/source-migration.d.ts +11 -0
package/lib/types/sources.d.ts +216 -0
package/lib/types/store.d.ts +30 -0
package/lib/types/themes.d.ts +40 -0
package/lib/types/trial.d.ts +61 -0
package/lib/types/update-api-v1.d.ts +66 -0
package/lib/types/updates.d.ts +123 -0
package/lib/types/verify.d.ts +139 -0
package/lib/update-api-v1.js +215 -0
package/lib/updates.js +361 -0
package/lib/verify.js +453 -0
package/package.json +121 -0
package/src/accelerate.ts +213 -0
package/src/agents.ts +43 -0
package/src/backup.ts +583 -0
package/src/catalog-local-match.ts +144 -0
package/src/catalog-npm.ts +120 -0
package/src/changelog.ts +282 -0
package/src/channels.ts +70 -0
package/src/check.ts +1239 -0
package/src/client/CommentsModal.tsx +119 -0
package/src/client/Diagnostics.tsx +907 -0
package/src/client/ErrorBoundary.tsx +111 -0
package/src/client/InstallToast.tsx +31 -0
package/src/client/Market.module.css +830 -0
package/src/client/MarketSection.tsx +5301 -0
package/src/client/OperationsPanel.tsx +365 -0
package/src/client/SettingsCard.tsx +621 -0
package/src/client/SkillMarket.module.css +21 -0
package/src/client/SkillMarketSection.tsx +162 -0
package/src/client/comments.ts +54 -0
package/src/client/globals.d.ts +13 -0
package/src/client/index.ts +180 -0
package/src/client/locales.ts +1112 -0
package/src/client/market-data.ts +1321 -0
package/src/client/operations.ts +201 -0
package/src/client/preset-panel.tsx +263 -0
package/src/client/primitives.d.ts +140 -0
package/src/client/self-check.ts +147 -0
package/src/client/snapshot-panel.tsx +244 -0
package/src/compatibility.ts +237 -0
package/src/diagnostics.ts +84 -0
package/src/discovery-compatibility.ts +315 -0
package/src/dsh-cli.ts +1126 -0
package/src/dsh-install.ts +118 -0
package/src/gist.ts +362 -0
package/src/groups.ts +111 -0
package/src/home-paths.ts +53 -0
package/src/hot.ts +628 -0
package/src/http.ts +41 -0
package/src/index.ts +128 -0
package/src/install.ts +420 -0
package/src/log.ts +206 -0
package/src/ndjson.ts +185 -0
package/src/net.ts +106 -0
package/src/order.ts +303 -0
package/src/patch.ts +522 -0
package/src/pnpm-compat.ts +527 -0
package/src/presets.ts +344 -0
package/src/profile.ts +940 -0
package/src/region-probe.ts +97 -0
package/src/regions.ts +310 -0
package/src/registry.ts +250 -0
package/src/restart.ts +396 -0
package/src/routes.ts +4506 -0
package/src/settings.ts +141 -0
package/src/skill-market/api.ts +130 -0
package/src/skill-market/config.ts +32 -0
package/src/skill-market/installer.ts +337 -0
package/src/skill-market/runtime.ts +14 -0
package/src/skill-market/tui.ts +157 -0
package/src/skill-market/types.ts +80 -0
package/src/skill-market/web-routes.ts +132 -0
package/src/snapshot.ts +532 -0
package/src/source-migration.ts +61 -0
package/src/sources.ts +565 -0
package/src/store.ts +89 -0
package/src/themes.ts +125 -0
package/src/trial.ts +156 -0
package/src/update-api-v1.ts +277 -0
package/src/updates.ts +400 -0
package/src/verify.ts +492 -0

package/src/client/self-check.ts ADDED Viewed

@@ -0,0 +1,147 @@
+/**
+ * What the browser can see about the market that the server cannot.
+ *
+ * This exists because of a pattern, not a hypothesis. #293 ("市场显示空白")
+ * and #384 ("lightbox cannot be closed") are both reproducible for their
+ * reporters and for nobody else, on clean profiles, across host versions.
+ * Both investigations then stalled in the same place: I asked the reporter to
+ * open a console and paste the result of an expression. That costs a day per
+ * question, asks a non-developer to run code from a stranger, and is the one
+ * step where a report goes quiet.
+ *
+ * Meanwhile the exported log — which the issue template already asks for, and
+ * which reporters do send — describes only the server: dependencies, bundle
+ * resolution, events. Everything it says was already true of a machine where
+ * the bug does not happen. The interesting half was in a page nobody looked
+ * at.
+ *
+ * So the browser answers the questions I have actually had to ask, in the
+ * artefact people already know how to produce. Nothing here diagnoses
+ * anything on its own; it is evidence, collected before it is needed.
+ */
+import { api } from './market-data.ts'
+import { lastMarketCrash } from './ErrorBoundary.tsx'
+/**
+ * Download the exported log: the server's account plus what only the browser
+ * can see.
+ *
+ * A free function rather than a hook, because the market's error boundary
+ * has to offer it too — a crashed market is exactly when the log matters,
+ * and for months it was exactly when the button did not exist (#293).
+ * @throws when the server half cannot be fetched; callers show their own state.
+ */
+export async function exportMarketLog(): Promise<void> {
+  const res = await fetch(api('/dsh-market/logs'))
+  if (!res.ok) throw new Error(`HTTP ${String(res.status)}`)
+  const serverText = await res.text()
+  const browser = clientDiagnostics()
+  const blob = new Blob(
+    [serverText, ...(browser.length > 0 ? ['## browser\n', browser.join('\n'), '\n'] : [])],
+    { type: 'text/plain;charset=utf-8' },
+  )
+  const url = URL.createObjectURL(blob)
+  const anchor = document.createElement('a')
+  anchor.href = url
+  anchor.download = 'chatcode-cli-market-log.txt'
+  document.body.appendChild(anchor)
+  anchor.click()
+  anchor.remove()
+  URL.revokeObjectURL(url)
+}
+/**
+ * How many times this module has been evaluated in this page.
+ *
+ * Module scope runs once per module instance, so >1 means the market's client
+ * bundle was loaded twice — two React copies, two of every module singleton,
+ * two portal containers. That is a specific hypothesis for #384: two React
+ * roots each attach delegated listeners to their own portal container, and a
+ * click lands on whichever container is last in `body` while the handlers
+ * live on the other one, so the buttons look present and do nothing.
+ *
+ * Counted on `window` rather than in a module variable for the obvious
+ * reason: a module variable would be duplicated along with everything else
+ * and each copy would confidently report 1.
+ */
+const globals = globalThis as typeof globalThis & { __dshmarketClientLoads?: number }
+globals.__dshmarketClientLoads = (globals.__dshmarketClientLoads ?? 0) + 1
+/**
+ * The marks Chrome and Edge leave on `<html>` when they translate a page.
+ *
+ * Both add a `translated-*` class for the direction they rendered into; Edge
+ * also flags the document it worked on. Reported verbatim rather than
+ * reduced to a boolean, because which engine did it is the next question
+ * after "was it translated at all".
+ * @returns the marks found, or null when there are none.
+ */
+function translatedMarks(): string | null {
+  const root = document.documentElement
+  const marks = [
+    ...[...root.classList].filter(name => name.startsWith('translated')),
+    ...(root.hasAttribute('_msthash') ? ['edge (_msthash)'] : []),
+    ...(root.hasAttribute('_msttexthash') ? ['edge (_msttexthash)'] : []),
+  ]
+  return marks.length === 0 ? null : marks.join(', ')
+}
+/** The market crash the error boundary caught, if there was one. */
+function crashLines(): string[] {
+  const crash = lastMarketCrash()
+  if (crash === null) return []
+  return [
+    `market UI crashed at: ${crash.at}`,
+    `market crash message: ${crash.message}`,
+    ...(crash.stack === null ? [] : [`market crash component stack:${crash.stack}`]),
+  ]
+}
+/** Whether `value` looks like a browser environment worth inspecting. */
+const hasDom = (): boolean => typeof document !== 'undefined' && document.body !== null
+/**
+ * The browser-side section of the exported log.
+ *
+ * Deliberately facts, not verdicts. "portal containers: 2" is something a
+ * reporter can paste without judging it, and something I can act on; "your
+ * bundle is double-loaded" would be a guess printed in the user's face, and
+ * wrong the first time a host legitimately renders two markets.
+ * @returns the lines to append, or an empty array outside a browser.
+ */
+export function clientDiagnostics(): string[] {
+  if (!hasDom()) return []
+  const portals = document.querySelectorAll('[data-dsh-market-portal]')
+  const roots = document.querySelectorAll('[data-dsh-market-root]')
+  const last = portals.length > 0 ? portals[portals.length - 1] : null
+  return [
+    // >1 is the double-load signal above. Reported always, so that a normal
+    // page proves the number is being read rather than defaulting.
+    `client bundle evaluations: ${String(globals.__dshmarketClientLoads ?? 0)}`,
+    `market roots in the document: ${String(roots.length)}`,
+    // Asked by hand in #384. A container that is not body's last child sits
+    // under whatever was appended after it, which is the other way a button
+    // can be visible and unclickable.
+    `portal containers: ${String(portals.length)}`
+      + (last === null ? '' : ` (last one is body's last child: ${String(last === document.body.lastElementChild)})`),
+    // Asked by hand in #293: "blank" can mean the section never mounted, or
+    // mounted and rendered nothing. Those have different causes.
+    `plugin cards rendered: ${String(document.querySelectorAll('[data-dsh-market-root] [class*="_card"]').length)}`,
+    // The mount point every /dsh-market/* request is resolved against (#345).
+    // A surprising value here explains a whole class of "nothing loads".
+    // #293: browser page translation replaces text nodes underneath React,
+    // which is the one reported cause of the blank market. Chrome and Edge
+    // mark the document when they do it, so a report can now say so without
+    // the reporter having to notice. A fact, not a verdict — a translated
+    // page is not by itself a fault.
+    `page translated by the browser: ${translatedMarks() ?? 'no'}`,
+    `document baseURI: ${document.baseURI}`,
+    `page URL: ${location.origin}${location.pathname}`,
+    // A crash the error boundary caught. Reported after the DOM facts
+    // because it is the one line that already IS a diagnosis — and when it
+    // is present, it is the first thing worth reading.
+    ...crashLines(),
+    `user agent: ${navigator.userAgent}`,
+  ]
+}

package/src/client/snapshot-panel.tsx ADDED Viewed

@@ -0,0 +1,244 @@
+/**
+ * Diagnostics sub-panel — issue #98 phase 3 (snapshots & rollback).
+ *
+ * Rendered at the bottom of the Diagnostics tab inside a collapsible section
+ * (the parent keeps it mounted and passes `open`, so it lazy-loads on first
+ * expand and keeps its state across collapses). Lists profile snapshots
+ * (GET /dsh-market/snapshots), creates one (POST /dsh-market/snapshots) and
+ * restores one after an inline double confirmation
+ * (POST /dsh-market/restore-snapshot {snapshot}).
+ *
+ * The list payload is read defensively (bare array or {snapshots: [...]});
+ * `files` entries are {path, json|lines} objects, from which only `path` is
+ * displayed.
+ */
+import { useCallback, useEffect, useRef, useState } from 'react'
+import { Button } from '@deepseek-ai/dsh-client-ui-primitives'
+import css from './Market.module.css'
+import { api } from './market-data.ts'
+import type { Translate } from './market-data.ts'
+/** One snapshot from GET /dsh-market/snapshots. */
+export interface Snapshot {
+  id: string
+  createdAt: string | number
+  files: string[]
+}
+interface SnapshotPanelProps {
+  t: Translate
+  /** True while the parent collapsible section is expanded (lazy-load gate). */
+  open: boolean
+  /** Re-fetch the check report after a successful restore. */
+  onRefresh: () => void
+}
+interface JsonBody { ok?: unknown; error?: unknown }
+async function postJson(url: string, body: unknown): Promise<{ status: number; body: JsonBody | null }> {
+  let res: Response
+  try {
+    res = await fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) })
+  } catch {
+    return { status: 0, body: null }
+  }
+  let payload: JsonBody | null = null
+  try { payload = (await res.json()) as JsonBody } catch { /* non-JSON body */ }
+  return { status: res.status, body: payload }
+}
+/** Snapshot file entries may be plain names or {path, json|lines} objects. */
+function fileNames(files: unknown): string[] {
+  if (!Array.isArray(files)) return []
+  const names: string[] = []
+  for (const file of files) {
+    if (typeof file === 'string') {
+      names.push(file)
+    } else if (file !== null && typeof file === 'object') {
+      const path = (file as Record<string, unknown>).path
+      if (typeof path === 'string') names.push(path)
+    }
+  }
+  return names
+}
+function snapshotOf(value: unknown): Snapshot | null {
+  if (value === null || typeof value !== 'object') return null
+  const item = value as Record<string, unknown>
+  if (typeof item.id !== 'string' && typeof item.id !== 'number') return null
+  return {
+    id: String(item.id),
+    createdAt: typeof item.createdAt === 'string' || typeof item.createdAt === 'number' ? item.createdAt : 0,
+    files: fileNames(item.files),
+  }
+}
+function formatTime(value: string | number): string {
+  const date = new Date(value)
+  return Number.isNaN(date.getTime()) ? String(value) : date.toLocaleString()
+}
+export function SnapshotPanel(props: SnapshotPanelProps) {
+  const { t, open, onRefresh } = props
+  const [snapshots, setSnapshots] = useState<Snapshot[] | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const [msg, setMsg] = useState<string | null>(null)
+  const [busy, setBusy] = useState<string | null>(null)
+  /** Snapshot id awaiting the second confirm click (restore), or null. */
+  const [confirmId, setConfirmId] = useState<string | null>(null)
+  /** Snapshot id awaiting the second confirm click (delete), or null. */
+  const [confirmDeleteId, setConfirmDeleteId] = useState<string | null>(null)
+  const loaded = useRef(false)
+  const load = useCallback(() => {
+    fetch(api('/dsh-market/snapshots'), { cache: 'no-store' })
+      .then(res => res.json())
+      .then(body => {
+        const list: unknown[] = Array.isArray(body) ? body : Array.isArray(body.snapshots) ? body.snapshots : []
+        setSnapshots(list.map(snapshotOf).filter((snap): snap is Snapshot => snap !== null))
+        setError(null)
+        // Mark loaded only on success so a transient failure retries on the
+        // next expand (review M3).
+        loaded.current = true
+      })
+      .catch(() => setError(t('snapListFail') + 'network'))
+  }, [t])
+  useEffect(() => {
+    if (open && !loaded.current) {
+      load()
+    }
+  }, [open, load])
+  const create = useCallback(() => {
+    if (busy !== null) return
+    setBusy('create')
+    setMsg(null)
+    setError(null)
+    postJson(api('/dsh-market/snapshots'), {})
+      .then(({ status, body }) => {
+        if (status >= 200 && status < 300 && body?.ok === true) {
+          setMsg(t('snapCreated'))
+          load()
+        } else {
+          const detail = body !== null && typeof body.error === 'string'
+            ? body.error
+            : status === 0 ? 'network error' : `HTTP ${String(status)}`
+          setError(t('snapCreateFail') + detail)
+        }
+      })
+      .catch(() => setError(t('snapCreateFail') + 'network'))
+      .finally(() => setBusy(null))
+  }, [busy, load, t])
+  const restore = useCallback((id: string) => {
+    if (busy !== null) return
+    setBusy('restore')
+    setMsg(null)
+    setError(null)
+    postJson(api('/dsh-market/restore-snapshot'), { snapshot: id })
+      .then(({ status, body }) => {
+        if (status >= 200 && status < 300 && body?.ok === true) {
+          setConfirmId(null)
+          setMsg(t('snapRestored'))
+          onRefresh()
+        } else {
+          const detail = body !== null && typeof body.error === 'string'
+            ? body.error
+            : status === 0 ? 'network error' : `HTTP ${String(status)}`
+          setError(t('snapRestoreFail') + detail)
+        }
+      })
+      .catch(() => setError(t('snapRestoreFail') + 'network'))
+      .finally(() => setBusy(null))
+  }, [busy, onRefresh, t])
+  /** Delete one snapshot after inline double confirmation. */
+  const remove = useCallback((id: string) => {
+    if (busy !== null) return
+    setBusy('delete')
+    setMsg(null)
+    setError(null)
+    postJson(api('/dsh-market/delete-snapshot'), { snapshot: id })
+      .then(({ status, body }) => {
+        if (status >= 200 && status < 300 && body?.ok === true) {
+          setConfirmDeleteId(null)
+          setMsg(t('snapDeleted'))
+          load()
+        } else {
+          const detail = body !== null && typeof body.error === 'string'
+            ? body.error
+            : status === 0 ? 'network error' : `HTTP ${String(status)}`
+          setError(t('snapDeleteFail') + detail)
+        }
+      })
+      .catch(() => setError(t('snapDeleteFail') + 'network'))
+      .finally(() => setBusy(null))
+  }, [busy, load, t])
+  return (
+    <div className={css.orderPanel}>
+      <p className={css.panelNote}>{t('snapHint')}</p>
+      <div className={css.panelActions}>
+        <Button variant="primary" size="sm" disabled={busy !== null} onClick={create}>
+          {busy === 'create' ? t('snapCreating') : t('snapCreate')}
+        </Button>
+      </div>
+      {error !== null && <div className={css.err}>{error}</div>}
+      {snapshots === null || snapshots.length === 0
+        ? <div className={css.diagEmpty}>{t('snapEmpty')}</div>
+        : (
+            <div className={css.snapList}>
+              {snapshots.map(snap => (
+                <div key={snap.id} className={css.snapRow}>
+                  {confirmId === snap.id ? (
+                    <>
+                      <p className={css.snapConfirmText}>{t('snapRestoreConfirmText')}</p>
+                      <div className={css.confirmRow}>
+                        <Button variant="primary" size="sm" disabled={busy !== null} onClick={() => restore(snap.id)}>
+                          {busy === 'restore' ? t('snapRestoring') : t('snapRestoreConfirm')}
+                        </Button>
+                        <Button variant="ghost" size="sm" disabled={busy !== null} onClick={() => setConfirmId(null)}>{t('cancel')}</Button>
+                      </div>
+                    </>
+                  ) : confirmDeleteId === snap.id ? (
+                    <>
+                      <p className={css.snapConfirmText}>{t('snapDeleteConfirmText')}</p>
+                      <div className={css.confirmRow}>
+                        <Button variant="primary" size="sm" disabled={busy !== null} onClick={() => remove(snap.id)}>
+                          {busy === 'delete' ? t('snapDeleting') : t('snapDeleteConfirm')}
+                        </Button>
+                        <Button variant="ghost" size="sm" disabled={busy !== null} onClick={() => setConfirmDeleteId(null)}>{t('cancel')}</Button>
+                      </div>
+                    </>
+                  ) : (
+                    <>
+                      <div className={css.snapMeta}>
+                        <span className={css.diagVal}>{formatTime(snap.createdAt)}</span>
+                        <span className={css.spec}>{snap.id}</span>
+                        {snap.files.length > 0 && (
+                          <span className={css.spec}>{t('snapFiles')}: {snap.files.join(', ')}</span>
+                        )}
+                      </div>
+                      <div className={css.confirmRow}>
+                        <Button variant="outline" size="sm" disabled={busy !== null} onClick={() => setConfirmId(snap.id)}>
+                          {t('snapRestore')}
+                        </Button>
+                        <Button variant="ghost" size="sm" disabled={busy !== null} onClick={() => setConfirmDeleteId(snap.id)}>
+                          {t('snapDelete')}
+                        </Button>
+                      </div>
+                    </>
+                  )}
+                </div>
+              ))}
+            </div>
+          )}
+      {msg !== null && <div className={css.okState}>{msg}</div>}
+    </div>
+  )
+}

package/src/compatibility.ts ADDED Viewed

@@ -0,0 +1,237 @@
+/**
+ * Host-contract compatibility preflight for #195.
+ *
+ * Pure evaluation of what `analyzeProfile()` already reports: a confirmed
+ * peer mismatch (`satisfied === false`) is translated into a directional
+ * verdict:
+ *
+ * - `belowMin`: the resolved version is older than every alternative's lower
+ *   bound — the environment is too old for the plugin's declared contract.
+ * - `aboveMax`: the resolved version is newer than every alternative's upper
+ *   bound (or the exact pin). This is only a risk when the author expressed
+ *   an explicit upper bound or exact pin; otherwise it is a warning, because
+ *   the ecosystem currently has many sloppy `^0.0.1`-style declarations that
+ *   work in practice.
+ *
+ * Everything else stays informational: `*`, prerelease-vs-`*` artifacts,
+ * unparseable ranges, and optional peers never produce a risk here.
+ */
+import { analyzeProfile, compareSemver, type CheckOptions, type DuplicateName, type PeerMismatch, type PeerRisk, type PeerWarning, type PeerVerdict } from './check.ts'
+import { profileDir, readInstalledManifest } from './profile.ts'
+export type CompatibilityRisk = PeerRisk
+export type CompatibilityWarning = PeerWarning
+/** Re-exported so consumers can keep importing PeerVerdict from this module. */
+export type { PeerVerdict }
+export interface CompatibilityAssessment {
+  risks: CompatibilityRisk[]
+  warnings: CompatibilityWarning[]
+  /**
+   * Cross-layer duplicate loader NAMES, carried through from the same
+   * `analyzeProfile` run the peer checks already pay for (#230).
+   *
+   * The report has always computed these and deliberately kept them out of
+   * `summary.warnings`, because flagging an already-messy but working
+   * profile is a false positive nobody can act on. Diffing before against
+   * after is what makes them actionable: a collision this operation
+   * INTRODUCED is one the operation can also undo.
+   */
+  duplicateNames: DuplicateName[]
+}
+interface ParsedComparator {
+  op: 'exact' | '^' | '~' | '>=' | '>' | '<=' | '<'
+  target: string
+}
+interface AlternativeBounds {
+  lower: ParsedComparator | null
+  upper: ParsedComparator | null
+  /** The author wrote an explicit `<`/`<=` bound or an exact pin. */
+  explicitUpper: boolean
+  exact: string | null
+}
+const SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/
+function parseComparator(part: string): ParsedComparator | null {
+  const p = part.trim()
+  const m = /^(\^|~|>=|<=|>|<)?(.*)$/.exec(p)
+  if (m === null) return null
+  const target = (m[2] ?? '').trim()
+  if (!SEMVER.test(target)) return null
+  const raw = m[1] ?? ''
+  return { op: raw === '' ? 'exact' : raw as ParsedComparator['op'], target }
+}
+/** Next breaking bump for `^` / `~`, using `-0` so prereleases compare consistently. */
+function nextBound(target: string, kind: '^' | '~'): string | null {
+  const m = /^(\d+)\.(\d+)\.(\d+)(?:-[0-9A-Za-z.-]+)?$/.exec(target)
+  if (m === null) return null
+  const major = Number(m[1])
+  const minor = Number(m[2])
+  const patch = Number(m[3])
+  if (kind === '^') {
+    if (major > 0) return `${major + 1}.0.0-0`
+    if (minor > 0) return `0.${minor + 1}.0-0`
+    return `0.0.${patch + 1}-0`
+  }
+  return `${major}.${minor + 1}.0-0`
+}
+function boundsFor(range: string): AlternativeBounds[] | null {
+  const alternatives: AlternativeBounds[] = []
+  for (const rawAlternative of range.split('||')) {
+    const parts = rawAlternative.trim().split(/\s+/).filter(Boolean)
+    const parsed = parts.map(parseComparator)
+    if (parsed.some(part => part === null)) return null
+    let lower: ParsedComparator | null = null
+    let upper: ParsedComparator | null = null
+    let explicitUpper = false
+    let exact: string | null = null
+    for (const part of parsed) {
+      const p = part as ParsedComparator
+      if (p.op === 'exact') {
+        exact = p.target
+        continue
+      }
+      if (p.op === '^' || p.op === '~') {
+        const bound = nextBound(p.target, p.op)
+        if (bound === null) return null
+        if (lower === null || compareSemver(p.target, lower.target) > 0) lower = p
+        if (upper === null || compareSemver(bound, upper.target) < 0) upper = { op: '<=', target: bound }
+        continue
+      }
+      if (p.op === '>=' || p.op === '>') {
+        if (lower === null || compareSemver(p.target, lower.target) > 0) lower = p
+      } else {
+        if (upper === null || compareSemver(p.target, upper.target) < 0) upper = p
+        explicitUpper = true
+      }
+    }
+    alternatives.push({ lower, upper, explicitUpper, exact })
+  }
+  return alternatives
+}
+function belowAllMins(resolved: string, bounds: AlternativeBounds[]): boolean {
+  return bounds.every(alternative => {
+    if (alternative.exact !== null) return compareSemver(resolved, alternative.exact) < 0
+    if (alternative.lower === null) return false
+    const lower = alternative.lower
+    return lower.op === '>' ? compareSemver(resolved, lower.target) <= 0 : compareSemver(resolved, lower.target) < 0
+  })
+}
+function aboveAllMaxes(resolved: string, bounds: AlternativeBounds[]): boolean {
+  return bounds.every(alternative => {
+    if (alternative.exact !== null) return compareSemver(resolved, alternative.exact) > 0
+    if (alternative.upper === null) return false
+    const upper = alternative.upper
+    return upper.op === '<' ? compareSemver(resolved, upper.target) >= 0 : compareSemver(resolved, upper.target) > 0
+  })
+}
+function hasExplicitUpperOrExact(bounds: AlternativeBounds[]): boolean {
+  return bounds.every(alternative => alternative.exact !== null || alternative.explicitUpper)
+}
+/** Translate one confirmed peer mismatch into a directional verdict. */
+export function classifyPeer(
+  plugin: string,
+  peer: string,
+  range: string,
+  resolved: string | null,
+  optional: boolean,
+): PeerVerdict {
+  if (resolved === null) return { kind: 'none' }
+  if (optional) {
+    return {
+      kind: 'warning',
+      warning: { plugin, peer, range, resolved, reason: 'optional' },
+    }
+  }
+  const bounds = boundsFor(range)
+  if (bounds === null) return { kind: 'none' }
+  if (belowAllMins(resolved, bounds)) {
+    return {
+      kind: 'risk',
+      risk: { plugin, peer, range, resolved, direction: 'belowMin' },
+    }
+  }
+  if (aboveAllMaxes(resolved, bounds)) {
+    return hasExplicitUpperOrExact(bounds)
+      ? {
+          kind: 'risk',
+          risk: { plugin, peer, range, resolved, direction: 'aboveMax' },
+        }
+      : {
+          kind: 'warning',
+          warning: { plugin, peer, range, resolved, reason: 'aboveMax' },
+        }
+  }
+  return { kind: 'none' }
+}
+/** Whether a peer is declared optional in the installed plugin manifest. */
+export function isOptionalPeer(profileDirectory: string, plugin: string, peer: string): boolean {
+  const manifest = readInstalledManifest('web', plugin, profileDirectory) as {
+    peerDependenciesMeta?: Record<string, { optional?: unknown }>
+  } | null
+  return manifest?.peerDependenciesMeta?.[peer]?.optional === true
+}
+/** Evaluate the current profile with the same machinery `/dsh-market/check` uses. */
+export function assessCompatibility(profileDirectory: string, options?: CheckOptions): CompatibilityAssessment {
+  const report = analyzeProfile(profileDirectory, options)
+  const risks: CompatibilityRisk[] = []
+  const warnings: CompatibilityWarning[] = []
+  for (const mismatch of report.peerMismatches) {
+    if (mismatch.satisfied !== false) continue
+    const optional = isOptionalPeer(profileDirectory, mismatch.plugin, mismatch.name)
+    const verdict = classifyPeer(mismatch.plugin, mismatch.name, mismatch.range, mismatch.resolved, optional)
+    if (verdict.kind === 'risk') risks.push(verdict.risk)
+    else if (verdict.kind === 'warning') warnings.push(verdict.warning)
+  }
+  return { risks, warnings, duplicateNames: report.duplicateNames }
+}
+function riskId(risk: CompatibilityRisk): string {
+  return `${risk.plugin}\u0000${risk.peer}\u0000${risk.direction}`
+}
+/** Risks present after a mutation but absent before it. */
+export function introducedRisks(before: CompatibilityAssessment, after: CompatibilityAssessment): CompatibilityRisk[] {
+  const seen = new Set(before.risks.map(riskId))
+  return after.risks.filter(risk => !seen.has(riskId(risk)))
+}
+/**
+ * Cross-layer name collisions present after a mutation but absent before it
+ * (#230 by @dxc-dxc).
+ *
+ * Keyed by NAME alone, not by the layer set: a collision the operation made
+ * worse — same name, now shadowing across one more layer — is still the same
+ * collision the profile already had, and re-reporting it would put the
+ * operator back in front of a problem they did not just cause.
+ *
+ * This is what makes surfacing these safe at all. The underlying
+ * `duplicateNames` is informational precisely because a healthy-but-messy
+ * profile can carry collisions indefinitely; only the newly introduced ones
+ * are attributable to the install that just ran, and therefore undoable by
+ * rolling it back.
+ */
+export function introducedDuplicateNames(
+  before: CompatibilityAssessment,
+  after: CompatibilityAssessment,
+): DuplicateName[] {
+  const seen = new Set(before.duplicateNames.map(entry => entry.name))
+  return after.duplicateNames.filter(entry => !seen.has(entry.name))
+}
+/** Convenience wrapper matching the profile helper signature. */
+export function assessProfile(profile: string, explicitDir?: string): CompatibilityAssessment {
+  return assessCompatibility(profileDir(profile, explicitDir))
+}