@dsh-triage/signals 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DSH-Addition contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,17 @@
-# Temporary Holding Version
+# @dsh-triage/signals
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Tiered signal adapters. Each adapter produces **evidence**, never a conclusion.
+
+| Adapter | Source | Tier | Licence note |
+|---|---|---|---|
+| `fetchPackument` / `parsePackument` | npm registry metadata | `declared` | registry terms |
+| `fetchInstallVerification` / `projectInstallVerification` | dsh.so install verification | `measured-registry` | **CC BY 4.0 — attribute dsh.so** |
+| `discoverLocalArtifacts` | guard incidents / vet reports / savepoints already on disk | `inferred` until schemas are verified | each tool's own licence |
+
+## Rules
+
+- `fetch` is injected: unit tests never touch the network.
+- Third-party payloads are read defensively; unknown fields go to `raw` and are never guessed into claims.
+- No adapter may emit `measured-local` — only `packages/probe` can, because only probe runs on this machine.
+
+MIT. dsh.so data is CC BY 4.0 and must be attributed wherever it is displayed.

package/dist/dshso.d.ts

@@ -0,0 +1,45 @@
+/**
+ * dsh.so registry adapter.
+ *
+ * Licensing (COMPLIANCE.md §4): dsh.so data is CC BY 4.0. Any surface that shows
+ * it MUST attribute dsh.so, and MUST NOT reword its verdicts (e.g. turning
+ * "L4 sandbox install passed" into "verified working on your machine").
+ *
+ * Blind spot (BS-06): L4/L5 are clean-sandbox measurements on one fixed
+ * environment. They are `measured-registry`, never `measured-local`.
+ */
+import type { Evidence } from '@dsh-triage/core';
+import type { FetchLike, SignalError } from './npm.js';
+export type InstallVerificationState = 'passed' | 'failed' | 'unknown' | 'stale' | 'untested';
+export interface InstallVerification {
+    readonly name: string;
+    readonly version: string | null;
+    readonly dshVersion: string | null;
+    readonly state: InstallVerificationState;
+    /** Highest level reported by the registry, e.g. `L5`. */
+    readonly level: string | null;
+    readonly verifiedAt: string | null;
+    readonly raw: unknown;
+}
+export interface DshSoOptions {
+    readonly baseUrl?: string;
+    readonly fetchImpl?: FetchLike;
+    readonly timeoutMs?: number;
+}
+/**
+ * Read the install-verification record for one plugin.
+ *
+ * The endpoint shape is intentionally treated as untrusted input: unknown fields
+ * are preserved in `raw` and never guessed into strong claims.
+ */
+export declare function fetchInstallVerification(name: string, options?: DshSoOptions): Promise<{
+    ok: true;
+    value: InstallVerification;
+} | {
+    ok: false;
+    error: SignalError;
+}>;
+/** Pure projection with defensive field reading (the API is third-party). */
+export declare function projectInstallVerification(name: string, raw: unknown): InstallVerification;
+export declare function dshSoEvidence(record: InstallVerification, at: string): Evidence;
+//# sourceMappingURL=dshso.d.ts.map

package/dist/dshso.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dshso.d.ts","sourceRoot":"","sources":["../src/dshso.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAEtD,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAA;AAE7F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAA;IACxC,yDAAyD;IACzD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAID;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC,CAyBvF;AAID,6EAA6E;AAC7E,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,mBAAmB,CAe1F;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,GAAG,QAAQ,CAS/E"}

package/dist/dshso.js

@@ -0,0 +1,77 @@
+/**
+ * dsh.so registry adapter.
+ *
+ * Licensing (COMPLIANCE.md §4): dsh.so data is CC BY 4.0. Any surface that shows
+ * it MUST attribute dsh.so, and MUST NOT reword its verdicts (e.g. turning
+ * "L4 sandbox install passed" into "verified working on your machine").
+ *
+ * Blind spot (BS-06): L4/L5 are clean-sandbox measurements on one fixed
+ * environment. They are `measured-registry`, never `measured-local`.
+ */
+const DEFAULT_BASE = 'https://www.dsh.so';
+/**
+ * Read the install-verification record for one plugin.
+ *
+ * The endpoint shape is intentionally treated as untrusted input: unknown fields
+ * are preserved in `raw` and never guessed into strong claims.
+ */
+export async function fetchInstallVerification(name, options = {}) {
+    const base = options.baseUrl ?? DEFAULT_BASE;
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    const encoded = name.startsWith('@') ? name.replace('/', '%2F') : name;
+    const url = `${base}/data/install/${encoded}.json`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 15_000);
+    try {
+        const response = await fetchImpl(url, { signal: controller.signal });
+        if (response.status === 404) {
+            return { ok: false, error: { code: 'not-found', detail: `no install record for ${name}`, source: url } };
+        }
+        if (!response.ok) {
+            return { ok: false, error: { code: 'network-error', detail: `HTTP ${response.status}`, source: url } };
+        }
+        const parsed = JSON.parse(await response.text());
+        return { ok: true, value: projectInstallVerification(name, parsed) };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: { code: 'invalid-json', detail: error instanceof Error ? error.message : String(error), source: url },
+        };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+const STATES = ['passed', 'failed', 'unknown', 'stale', 'untested'];
+/** Pure projection with defensive field reading (the API is third-party). */
+export function projectInstallVerification(name, raw) {
+    const record = raw !== null && typeof raw === 'object' ? raw : {};
+    const stateRaw = record['state'] ?? record['status'];
+    const state = typeof stateRaw === 'string' && STATES.includes(stateRaw)
+        ? stateRaw
+        : 'unknown';
+    return {
+        name,
+        version: stringOrNull(record['version']),
+        dshVersion: stringOrNull(record['dshVersion'] ?? record['dsh']),
+        state,
+        level: stringOrNull(record['level']),
+        verifiedAt: stringOrNull(record['verifiedAt'] ?? record['checkedAt']),
+        raw,
+    };
+}
+export function dshSoEvidence(record, at) {
+    return {
+        id: `dshso-${record.version ?? 'unknown'}`,
+        tier: 'measured-registry',
+        source: `dsh.so:${record.name}${record.version === null ? '' : `@${record.version}`}`,
+        method: 'registry-install-verification',
+        at,
+        detail: `${record.level ?? 'L?'} ${record.state}${record.dshVersion === null ? '' : ` on dsh ${record.dshVersion}`}`,
+    };
+}
+function stringOrNull(value) {
+    return typeof value === 'string' && value !== '' ? value : null;
+}
+//# sourceMappingURL=dshso.js.map

package/dist/dshso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dshso.js","sourceRoot":"","sources":["../src/dshso.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAwBH,MAAM,YAAY,GAAG,oBAAoB,CAAA;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,UAAwB,EAAE;IAE1B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,YAAY,CAAA;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAK,UAAU,CAAC,KAA8B,CAAA;IACjF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtE,MAAM,GAAG,GAAG,GAAG,IAAI,iBAAiB,OAAO,OAAO,CAAA;IAClD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,CAAA;IAC/E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;QACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,yBAAyB,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAA;QAC1G,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAA;QACxG,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;QACzD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,0BAA0B,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAA;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE;SAC7G,CAAA;IACH,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;AACH,CAAC;AAED,MAAM,MAAM,GAAwC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;AAExG,6EAA6E;AAC7E,MAAM,UAAU,0BAA0B,CAAC,IAAY,EAAE,GAAY;IACnE,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9F,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAA;IACpD,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAK,MAA4B,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5F,CAAC,CAAE,QAAqC;QACxC,CAAC,CAAC,SAAS,CAAA;IACb,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxC,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/D,KAAK;QACL,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC;QACrE,GAAG;KACJ,CAAA;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAA2B,EAAE,EAAU;IACnE,OAAO;QACL,EAAE,EAAE,SAAS,MAAM,CAAC,OAAO,IAAI,SAAS,EAAE;QAC1C,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,UAAU,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE;QACrF,MAAM,EAAE,+BAA+B;QACvC,EAAE;QACF,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,UAAU,EAAE,EAAE;KACrH,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACjE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Public surface of `@dsh-triage/signals`.
+ *
+ * Every adapter is (a) network-injected, (b) tier-tagged, (c) explicitly
+ * attributable. No adapter is allowed to produce a `measured-local` tier: only
+ * `packages/probe` can, because only probe runs on this machine.
+ */
+export type { FetchLike, NpmAdapterOptions, NpmPackument, NpmVersionManifest, SignalError, SignalErrorCode } from './npm.js';
+export { encodePackageName, fetchPackument, npmEvidence, parsePackument } from './npm.js';
+export type { DshSoOptions, InstallVerification, InstallVerificationState } from './dshso.js';
+export { dshSoEvidence, fetchInstallVerification, projectInstallVerification } from './dshso.js';
+export type { DiscoverOptions, LocalArtifact, LocalArtifactKind } from './local.js';
+export { discoverLocalArtifacts } from './local.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC5H,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAEzF,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAC7F,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AAEhG,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -0,0 +1,11 @@
+/**
+ * Public surface of `@dsh-triage/signals`.
+ *
+ * Every adapter is (a) network-injected, (b) tier-tagged, (c) explicitly
+ * attributable. No adapter is allowed to produce a `measured-local` tier: only
+ * `packages/probe` can, because only probe runs on this machine.
+ */
+export { encodePackageName, fetchPackument, npmEvidence, parsePackument } from './npm.js';
+export { dshSoEvidence, fetchInstallVerification, projectInstallVerification } from './dshso.js';
+export { discoverLocalArtifacts } from './local.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAGzF,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AAGhG,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA"}

package/dist/local.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Local artifacts produced by *other* tools (guard incidents, vet reports, snapshots).
+ *
+ * Status: discovery only (M0/M1). Nothing here feeds a verdict yet, because the
+ * schemas are third-party and unverified — see `audit/blind_spots.json` BS-04.
+ * Reading them is still useful: `dsh-triage audit` lists what evidence already
+ * exists on this machine, so M2 can start consuming the stable ones.
+ *
+ * Hard rule: read-only, bounded (no recursive walks outside the candidate list),
+ * and tolerant of broken JSON (reported, never thrown).
+ */
+export type LocalArtifactKind = 'guard-incident' | 'vet-result' | 'savepoint' | 'unknown';
+export interface LocalArtifact {
+    readonly path: string;
+    readonly kind: LocalArtifactKind;
+    /** Parsed JSON when available; `null` when the file is not valid JSON. */
+    readonly raw: unknown;
+    readonly bytes: number;
+    readonly note: string;
+}
+export interface DiscoverOptions {
+    /** Directory that contains the artifacts (usually the profile directory). */
+    readonly root: string;
+    readonly maxFiles?: number;
+}
+/** Discover known artifacts under `root`; missing paths are simply absent. */
+export declare function discoverLocalArtifacts(options: DiscoverOptions): Promise<readonly LocalArtifact[]>;
+//# sourceMappingURL=local.d.ts.map

package/dist/local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../src/local.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG,YAAY,GAAG,WAAW,GAAG,SAAS,CAAA;AAEzF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAgBD,8EAA8E;AAC9E,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAoBxG"}

package/dist/local.js

@@ -0,0 +1,82 @@
+/**
+ * Local artifacts produced by *other* tools (guard incidents, vet reports, snapshots).
+ *
+ * Status: discovery only (M0/M1). Nothing here feeds a verdict yet, because the
+ * schemas are third-party and unverified — see `audit/blind_spots.json` BS-04.
+ * Reading them is still useful: `dsh-triage audit` lists what evidence already
+ * exists on this machine, so M2 can start consuming the stable ones.
+ *
+ * Hard rule: read-only, bounded (no recursive walks outside the candidate list),
+ * and tolerant of broken JSON (reported, never thrown).
+ */
+import { readFile, readdir, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+const CANDIDATES = [
+    { relative: '.guard/incidents', kind: 'guard-incident', directory: true },
+    { relative: 'incidents', kind: 'guard-incident', directory: true },
+    { relative: '.vetting/vet-result.json', kind: 'vet-result', directory: false },
+    { relative: '.vetting/vet-report.md', kind: 'vet-result', directory: false },
+    { relative: '.savepoints', kind: 'savepoint', directory: true },
+];
+/** Discover known artifacts under `root`; missing paths are simply absent. */
+export async function discoverLocalArtifacts(options) {
+    const maxFiles = options.maxFiles ?? 40;
+    const found = [];
+    for (const candidate of CANDIDATES) {
+        const path = join(options.root, candidate.relative);
+        if (candidate.directory) {
+            const names = await safeReaddir(path);
+            for (const name of names.sort((a, b) => a.localeCompare(b)).slice(0, maxFiles)) {
+                if (!/\.(json|jsonl|md)$/i.test(name))
+                    continue;
+                const artifact = await readArtifact(join(path, name), candidate.kind);
+                if (artifact !== null)
+                    found.push(artifact);
+            }
+        }
+        else {
+            const artifact = await readArtifact(path, candidate.kind);
+            if (artifact !== null)
+                found.push(artifact);
+        }
+    }
+    return found.sort((a, b) => a.path.localeCompare(b.path));
+}
+async function safeReaddir(path) {
+    try {
+        const entries = await readdir(path, { withFileTypes: true });
+        return entries.filter((entry) => entry.isFile()).map((entry) => entry.name);
+    }
+    catch {
+        return [];
+    }
+}
+async function readArtifact(path, kind) {
+    try {
+        const info = await stat(path);
+        if (!info.isFile() || info.size > 4 * 1024 * 1024) {
+            return {
+                path,
+                kind,
+                raw: null,
+                bytes: info.size,
+                note: 'skipped: not a regular file under 4 MiB',
+            };
+        }
+        const text = await readFile(path, 'utf8');
+        if (/\.md$/i.test(path)) {
+            return { path, kind, raw: null, bytes: info.size, note: 'markdown report (not parsed in M0)' };
+        }
+        try {
+            const parsed = JSON.parse(text);
+            return { path, kind, raw: parsed, bytes: info.size, note: 'parsed json (schema unverified)' };
+        }
+        catch {
+            return { path, kind, raw: null, bytes: info.size, note: 'invalid json; kept for manual inspection only' };
+        }
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=local.js.map

package/dist/local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.js","sourceRoot":"","sources":["../src/local.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAyBhC,MAAM,UAAU,GAAyB;IACvC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE;IACzE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE;IAClE,EAAE,QAAQ,EAAE,0BAA0B,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE;IAC9E,EAAE,QAAQ,EAAE,wBAAwB,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE;IAC5E,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE;CAChE,CAAA;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAwB;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAA;IACvC,MAAM,KAAK,GAAoB,EAAE,CAAA;IAEjC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAA;QACnD,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAA;YACrC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC/E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,SAAQ;gBAC/C,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;gBACrE,IAAI,QAAQ,KAAK,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC7C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACzD,IAAI,QAAQ,KAAK,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAuB;IAC/D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI;gBACJ,IAAI;gBACJ,GAAG,EAAE,IAAI;gBACT,KAAK,EAAE,IAAI,CAAC,IAAI;gBAChB,IAAI,EAAE,yCAAyC;aAChD,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACzC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,oCAAoC,EAAE,CAAA;QAChG,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACxC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAA;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,+CAA+C,EAAE,CAAA;QAC3G,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/npm.d.ts

@@ -0,0 +1,76 @@
+/**
+ * npm registry adapter (metadata only).
+ *
+ * Contract:
+ * - We read `version`, `engines`, `peerDependencies`, `deprecated`, `time`.
+ * - We never download or execute tarballs here; that belongs to `probe`, behind
+ *   an explicit opt-in and the `quarantine/` gate.
+ * - `fetch` is injected so tests never touch the network.
+ *
+ * Evidence tier: `declared` (what the author published), not `measured-*`.
+ */
+import type { Evidence } from '@dsh-triage/core';
+export interface NpmVersionManifest {
+    readonly version: string;
+    readonly engines?: unknown;
+    readonly peerDependencies?: unknown;
+    readonly deprecated?: string;
+}
+export interface NpmPackument {
+    readonly name: string;
+    readonly latest: string | null;
+    readonly versions: ReadonlyMap<string, NpmVersionManifest>;
+    readonly modified: string | null;
+    /**
+     * Every dist-tag the author publishes (`latest`, `next`, `rc`, …).
+     *
+     * WHY (T-109 / CASE-10849): `@deepseek-ai/dsh-tools` had `latest` pointing at
+     * `0.0.1-rc.1` while `0.2.1-rc.x` was already published. A user who installs the
+     * bare name gets the stale build and is then denied by admission — the failure
+     * starts in the tag, not in the range. Reading only `latest` made that invisible.
+     */
+    readonly distTags: Readonly<Record<string, string>>;
+    /** Publish timestamps per version (`time` minus `created`/`modified`), ISO strings. */
+    readonly publishedAt: Readonly<Record<string, string>>;
+}
+export type SignalErrorCode = 'network-error' | 'not-found' | 'invalid-json' | 'invalid-payload' | 'unsupported';
+export interface SignalError {
+    readonly code: SignalErrorCode;
+    readonly detail: string;
+    /** Where the request went, for reporting. */
+    readonly source: string;
+}
+export type FetchLike = (url: string, init?: {
+    readonly signal?: AbortSignal;
+}) => Promise<{
+    readonly ok: boolean;
+    readonly status: number;
+    text(): Promise<string>;
+}>;
+export interface NpmAdapterOptions {
+    readonly registry?: string;
+    readonly fetchImpl?: FetchLike;
+    readonly timeoutMs?: number;
+    /** ISO timestamp for evidence; injected so output stays deterministic. */
+    readonly at: string;
+}
+/** URL-safe encoding for scoped names (`@scope/pkg` -> `@scope%2Fpkg`). */
+export declare function encodePackageName(name: string): string;
+export declare function fetchPackument(name: string, options: NpmAdapterOptions): Promise<{
+    readonly ok: false;
+    readonly error: SignalError;
+} | {
+    ok: true;
+    value: NpmPackument;
+}>;
+/** Pure JSON -> packument projection. Exported for tests and offline fixtures. */
+export declare function parsePackument(text: string): {
+    readonly ok: true;
+    readonly value: NpmPackument;
+} | {
+    readonly ok: false;
+    readonly error: SignalError;
+};
+/** Evidence describing the npm facts that a verdict rested on. */
+export declare function npmEvidence(packument: NpmPackument, version: string, at: string): Evidence;
+//# sourceMappingURL=npm.d.ts.map

package/dist/npm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../src/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAEhD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;IAC1D,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACnD,uFAAuF;IACvF,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACvD;AAED,MAAM,MAAM,eAAe,GAAG,eAAe,GAAG,WAAW,GAAG,cAAc,GAAG,iBAAiB,GAAG,aAAa,CAAA;AAEhH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,KAAK,OAAO,CAAC;IACzF,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACxB,CAAC,CAAA;AAEF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CACpB;AAID,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB;iBAuC1D,KAAK;oBAAkB,WAAW;;;;GALpD;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GACvC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CA4DtD;AAED,kEAAkE;AAClE,wBAAgB,WAAW,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,QAAQ,CAS1F"}

package/dist/npm.js

@@ -0,0 +1,128 @@
+/**
+ * npm registry adapter (metadata only).
+ *
+ * Contract:
+ * - We read `version`, `engines`, `peerDependencies`, `deprecated`, `time`.
+ * - We never download or execute tarballs here; that belongs to `probe`, behind
+ *   an explicit opt-in and the `quarantine/` gate.
+ * - `fetch` is injected so tests never touch the network.
+ *
+ * Evidence tier: `declared` (what the author published), not `measured-*`.
+ */
+const DEFAULT_REGISTRY = 'https://registry.npmjs.org';
+/** URL-safe encoding for scoped names (`@scope/pkg` -> `@scope%2Fpkg`). */
+export function encodePackageName(name) {
+    return name.replace('/', '%2F');
+}
+export async function fetchPackument(name, options) {
+    const registry = options.registry ?? DEFAULT_REGISTRY;
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    const url = `${registry}/${encodePackageName(name)}`;
+    const timeoutMs = options.timeoutMs ?? 15_000;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetchImpl(url, { signal: controller.signal });
+        if (response.status === 404) {
+            return { ok: false, error: { code: 'not-found', detail: `npm has no package ${name}`, source: url } };
+        }
+        if (!response.ok) {
+            return {
+                ok: false,
+                error: { code: 'network-error', detail: `HTTP ${response.status}`, source: url },
+            };
+        }
+        const text = await response.text();
+        const parsed = parsePackument(text);
+        if (!parsed.ok)
+            return parsed;
+        return { ok: true, value: parsed.value };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: {
+                code: 'network-error',
+                detail: error instanceof Error ? error.message : String(error),
+                source: url,
+            },
+        };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Pure JSON -> packument projection. Exported for tests and offline fixtures. */
+export function parsePackument(text) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: { code: 'invalid-json', detail: error instanceof Error ? error.message : String(error), source: 'npm' },
+        };
+    }
+    if (raw === null || typeof raw !== 'object') {
+        return { ok: false, error: { code: 'invalid-payload', detail: 'packument is not an object', source: 'npm' } };
+    }
+    const record = raw;
+    const name = typeof record['name'] === 'string' ? record['name'] : '';
+    const distTagsRaw = record['dist-tags'];
+    const distTags = {};
+    if (distTagsRaw !== null && typeof distTagsRaw === 'object') {
+        for (const [tag, version] of Object.entries(distTagsRaw)) {
+            // `dist-tags` is author-controlled JSON: keep only well-formed entries.
+            if (typeof version === 'string' && version.trim() !== '')
+                distTags[tag] = version.trim();
+        }
+    }
+    const latest = distTags['latest'] ?? null;
+    const versionsRaw = record['versions'];
+    const versions = new Map();
+    if (versionsRaw !== null && typeof versionsRaw === 'object') {
+        for (const [version, manifest] of Object.entries(versionsRaw)) {
+            if (manifest === null || typeof manifest !== 'object')
+                continue;
+            const manifestRecord = manifest;
+            versions.set(version, {
+                version,
+                engines: manifestRecord['engines'],
+                peerDependencies: manifestRecord['peerDependencies'],
+                deprecated: manifestRecord['deprecated'] === undefined
+                    ? undefined
+                    : typeof manifestRecord['deprecated'] === 'string' && manifestRecord['deprecated'].trim() !== ''
+                        ? manifestRecord['deprecated']
+                        : undefined,
+            });
+        }
+    }
+    const time = record['time'];
+    const modified = time !== null && typeof time === 'object' && typeof time['modified'] === 'string'
+        ? time['modified']
+        : null;
+    const publishedAt = {};
+    if (time !== null && typeof time === 'object') {
+        for (const [version, value] of Object.entries(time)) {
+            // `created` / `modified` are package-level keys, not versions.
+            if (version === 'created' || version === 'modified')
+                continue;
+            if (typeof value === 'string' && value.trim() !== '')
+                publishedAt[version] = value;
+        }
+    }
+    return { ok: true, value: { name, latest, versions, modified, distTags, publishedAt } };
+}
+/** Evidence describing the npm facts that a verdict rested on. */
+export function npmEvidence(packument, version, at) {
+    return {
+        id: `npm-${version}`,
+        tier: 'declared',
+        source: `npm:${packument.name}@${version}`,
+        method: 'registry-metadata',
+        at,
+        detail: packument.modified === null ? undefined : `packument modified ${packument.modified}`,
+    };
+}
+//# sourceMappingURL=npm.js.map

package/dist/npm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.js","sourceRoot":"","sources":["../src/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAoDH,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AAErD,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,OAA0B;IAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAA;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAK,UAAU,CAAC,KAA8B,CAAA;IACjF,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAA;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAA;IAC7C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;IAC7D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;QACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAoB,EAAE,MAAM,EAAE,sBAAsB,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAA;QACzH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO;gBACL,EAAE,EAAE,KAAc;gBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,eAAwB,EAAE,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE;aAC1F,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAA;QAC7B,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAc;YAClB,KAAK,EAAE;gBACL,IAAI,EAAE,eAAwB;gBAC9B,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC9D,MAAM,EAAE,GAAG;aACZ;SACF,CAAA;IACH,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,IAAY;IAGzC,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;SAC/G,CAAA;IACH,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAA;IAC/G,CAAC;IACD,MAAM,MAAM,GAAG,GAA8B,CAAA;IAC7C,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,CAAA;IACvC,MAAM,QAAQ,GAA2B,EAAE,CAAA;IAC3C,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAsC,CAAC,EAAE,CAAC;YACpF,wEAAwE;YACxE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;QAC1F,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAA;IAEzC,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAA;IACtD,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5D,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAsC,CAAC,EAAE,CAAC;YACzF,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBAAE,SAAQ;YAC/D,MAAM,cAAc,GAAG,QAAmC,CAAA;YAC1D,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE;gBACpB,OAAO;gBACP,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC;gBAClC,gBAAgB,EAAE,cAAc,CAAC,kBAAkB,CAAC;gBACpD,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC,KAAK,SAAS;oBACpD,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,OAAO,cAAc,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;wBAC9F,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC;wBAC9B,CAAC,CAAC,SAAS;aAChB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,QAAQ,GACZ,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAAgC,CAAC,UAAU,CAAC,KAAK,QAAQ;QAC5G,CAAC,CAAG,IAAgC,CAAC,UAAU,CAAY;QAC3D,CAAC,CAAC,IAAI,CAAA;IAEV,MAAM,WAAW,GAA2B,EAAE,CAAA;IAC9C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YAC/E,+DAA+D;YAC/D,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,UAAU;gBAAE,SAAQ;YAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,WAAW,CAAC,OAAO,CAAC,GAAG,KAAK,CAAA;QACpF,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAA;AACzF,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,WAAW,CAAC,SAAuB,EAAE,OAAe,EAAE,EAAU;IAC9E,OAAO;QACL,EAAE,EAAE,OAAO,OAAO,EAAE;QACpB,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,OAAO,SAAS,CAAC,IAAI,IAAI,OAAO,EAAE;QAC1C,MAAM,EAAE,mBAAmB;QAC3B,EAAE;QACF,MAAM,EAAE,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,SAAS,CAAC,QAAQ,EAAE;KAC7F,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,33 @@
 {
   "name": "@dsh-triage/signals",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Tiered signal adapters for dsh-triage: npm registry, dsh.so registry, hub catalog, and local tool artifacts. Every signal carries provenance; nothing is merged silently.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jjjjjjjjnnjnn/dsh-triage.git",
+    "directory": "packages/signals"
+  },
+  "engines": {
+    "node": ">=22.19"
+  },
+  "dependencies": {
+    "@dsh-triage/core": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsc -b"
+  }
 }