@hanamesh/dsh-app-host 0.6.17 → 0.6.18
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/docs/LICENSES.json +12 -17
- package/docs/PROVENANCE.json +10 -14
- package/package.json +4 -4
package/README.md
CHANGED
|
@@ -185,7 +185,7 @@ rc9 installation-target contract: the library accepts exact 127.0.0.1/localhost
|
|
|
185
185
|
|
|
186
186
|
## 0.4.0 · Devkit normal Git supply / 0.5.0 external provision supply
|
|
187
187
|
|
|
188
|
-
Development installs use Node 24.13.1, pnpm 10.33.0 and the frozen `pnpm-lock.yaml`, with pnpm package-manager self-management disabled.
|
|
188
|
+
Development installs use Node 24.13.1, pnpm 10.33.0 and the frozen `pnpm-lock.yaml`, with pnpm package-manager self-management disabled. `@hanamesh/devkit` (`^0.2.6`, development-only) and `@hanamesh/lib-provision` (`^0.2.1`, bundled into the runtime tarball) are installed from the public npm registry; the lock pins version and sha512 integrity. Source installs need no private Git access or credentials. The package identity is Devkit, never the shared root alias. Run `pnpm run check:devkit-supply` for the public provider contract, installed version range, registry lock form and CLI checks. The four mature tool engines and runtime payload are unchanged. No runtime Devkit dependency or bundled tool code is added.
|
|
189
189
|
|
|
190
190
|
Historical source-Git route (superseded by the fixed archives above for current installs): the upstream Git subdirectory route supports pnpm 10.33.0; npm 11.8.0 cannot install that development dependency. AppHost 0.4.x source Git consumption therefore uses pnpm, with its normal dependency build approval for this package's existing build/prepack lifecycle. A normal npm tarball runtime install remains supported and ignores development dependencies. The previously verified AppHost 0.3.0 source/tag and `^0.3.0` npm route remain byte-identical and outside the 0.4.0 range. Future 0.x minor ranges remain distinct. The independent 0.4.0 release retains the mature inlined lib-provision payload. AppHost 0.5.0 installs lib-provision from `git+https://github.com/yzsnstotz/hanamesh-lib-provision.git#semver:^0.2.1` and removes it from `dist/` and `vendor/`. The lib source candidate has no public Devkit peer or Git installation lifecycle script, so it needs no provision build allowlist; only the existing koffi lifecycle remains approved. A fresh strict two-source installation verifies this boundary. The old 0.2.0 strict peer failure remains in the task evidence; no peer override or disabled strictness is used. Run `pnpm run check:provision-supply` for the source's installed public conformance when affected; unchanged runtime/API/CLI/type checks are reused by byte evidence.
|
|
191
191
|
|
|
@@ -238,4 +238,4 @@ Actions runs on the standard public/free `macos-15` arm64 runner because the exi
|
|
|
238
238
|
|
|
239
239
|
## Core 公开套件声明的测试依赖
|
|
240
240
|
|
|
241
|
-
源码测试通过 `@hanamesh/core/suite` 读取 Core 单源公开命令。`@hanamesh/core` 是仓库声明的 devDependency
|
|
241
|
+
源码测试通过 `@hanamesh/core/suite` 读取 Core 单源公开命令。`@hanamesh/core` 是仓库声明的 devDependency，按 npm 版本范围 `^0.3.28` 从公开 npm 安装，冻结 pnpm 锁记录实际版本与 SRI；许可证记录见 `docs/LICENSES.json`。Core 不成为运行时依赖或 bundled 包。
|
package/docs/LICENSES.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"package": {
|
|
3
3
|
"name": "@hanamesh/dsh-app-host",
|
|
4
|
-
"version": "0.6.
|
|
4
|
+
"version": "0.6.18",
|
|
5
5
|
"license": "SEE LICENSE IN LICENSE",
|
|
6
6
|
"source": "git+https://github.com/yzsnstotz/hanamesh-plugin-app-host.git",
|
|
7
7
|
"purpose": "Application ownership, view leases, Router forwarding, and application library for official DSH"
|
|
@@ -11,16 +11,13 @@
|
|
|
11
11
|
"@hanamesh/lib-provision": {
|
|
12
12
|
"version": "0.2.1",
|
|
13
13
|
"license": "SEE LICENSE IN LICENSE",
|
|
14
|
-
"source": "
|
|
14
|
+
"source": "^0.2.1",
|
|
15
15
|
"purpose": "Runtime provision/remove/ledger API; 随包分发、源仓不变; no inlined copy",
|
|
16
|
-
"sha256": "4217b9fe1be98f6e82437539d1c4c43166ed1f5c292efff100733e0cb09530e9",
|
|
17
16
|
"specs": {
|
|
18
|
-
"dependencies": "
|
|
17
|
+
"dependencies": "^0.2.1"
|
|
19
18
|
},
|
|
20
|
-
"sourceCommit": "
|
|
21
|
-
"distribution": "bundleDependencies; original LICENSE at node_modules/@hanamesh/lib-provision/LICENSE"
|
|
22
|
-
"originalSource": "git+https://github.com/yzsnstotz/hanamesh-lib-provision.git#575d63fb70e08c47e980dbf25f07921a7ba5aa2a",
|
|
23
|
-
"archiveSha256": "4217b9fe1be98f6e82437539d1c4c43166ed1f5c292efff100733e0cb09530e9"
|
|
19
|
+
"sourceCommit": "838cf462de9192fb5f2d63497212e7275f5c6e39",
|
|
20
|
+
"distribution": "bundleDependencies; original LICENSE at node_modules/@hanamesh/lib-provision/LICENSE"
|
|
24
21
|
},
|
|
25
22
|
"zod": {
|
|
26
23
|
"version": "4.5.4",
|
|
@@ -235,27 +232,25 @@
|
|
|
235
232
|
}
|
|
236
233
|
},
|
|
237
234
|
"@hanamesh/devkit": {
|
|
238
|
-
"version": "0.2.
|
|
235
|
+
"version": "0.2.6",
|
|
239
236
|
"license": "SEE LICENSE IN LICENSE",
|
|
240
|
-
"source": "
|
|
237
|
+
"source": "https://registry.npmjs.org/@hanamesh/devkit/-/devkit-0.2.6.tgz",
|
|
241
238
|
"purpose": "Development-only centralized tool execution; never imported by runtime; no public peer",
|
|
242
239
|
"usedAs": [
|
|
243
240
|
"devDependencies"
|
|
244
241
|
],
|
|
245
242
|
"specs": {
|
|
246
|
-
"devDependencies": "
|
|
243
|
+
"devDependencies": "^0.2.6"
|
|
247
244
|
},
|
|
248
|
-
"sourceCommit": "e6ccf710369a77c5fbf9ce4810b182727e4f2aa8",
|
|
249
245
|
"licenseNotice": "# HanaMesh distribution notice\n\nThis package contains HanaMesh-owned code. The project owner confirmed that its\nown code may be distributed (D-2026-10-05-02) and directed correction of outdated\nprivate / UNLICENSED package metadata (D-2026-10-05-16, 2026-10-05).\n\nThis notice records that distribution authorization. It does not assign an SPDX\nlicense identifier, adopt MIT or another standard license, or grant additional\nrelicensing rights. Rights not covered by the owner's recorded distribution\nauthorization remain reserved. See LICENSE_RECORD.md for the package name,\nversion, source, purpose and third-party boundaries.\n\nThird-party components retain their existing licenses. No third-party component\nis relicensed by this notice. This metadata change is not an npm publication or\na change to repository visibility.\n",
|
|
250
|
-
"distributionRecord": "# Devkit license and distribution record\n\n| Name | Version | License / authorization | Source | Purpose |\n| --- | --- | --- | --- | --- |\n| @hanamesh/devkit | 0.2.
|
|
246
|
+
"distributionRecord": "# Devkit license and distribution record\n\n| Name | Version | License / authorization | Source | Purpose |\n| --- | --- | --- | --- | --- |\n| @hanamesh/devkit | 0.2.6 | SEE LICENSE IN LICENSE; HanaMesh-owned distribution authorized in D-2026-10-05-02 and D-2026-10-05-16; no new standard license or relicensing grant | yzsnstotz/hanamesh-server-shared, packages/devkit; baseline b2b5c9bb7faa990e3eb9f99007abd6427d62e88b / rc.1 | Development preflight, mutation execution, package verification and toolchain checks |\n\nThe original rc.1 manifest contained private=true and license=UNLICENSED, with no\nstandalone LICENSE text. Those obsolete metadata fields are superseded for rc.2\nby private=false and this explicit distribution notice. The old tarball and\nrecords remain unchanged. 0.2.0 adds Git tag-range installation and the\n`contract/` supply schema, fixtures and suite under the same authorization;\nit still adds no dependency. This package has no dependency or peerDependency and\nships no third-party runtime or compiler. It uses Node standard-library APIs;\nNode itself is supplied by the consumer and is not bundled here.\n\nAuthority: the project owner's 2026-10-05 instruction to correct lib-provision\nand devkit vendor metadata under D-2026-10-05-02, recorded in D-2026-10-05-16.\nThe notice does not extend that instruction into a new general license.\n",
|
|
251
247
|
"licenseSha256": "242b0b71d3a4a91899ccf38fb70f06d151f3f005c3d7ac7d1e4a6c0461dc0e2d",
|
|
252
248
|
"historicalArtifact": {
|
|
253
249
|
"version": "0.2.0",
|
|
254
250
|
"sha256": "de15f0913dd6de5ba9ce96b8d92ea862ec44489eb698628de963cbbead68bc25",
|
|
255
251
|
"sourceCommit": "8f9bcc69cbacf01d97ffe63bbbade4f865e6dd89"
|
|
256
252
|
},
|
|
257
|
-
"
|
|
258
|
-
"archiveSha256": "40d7ad33b2802677d12111943f3472aa6e4564ba000d48074a32de33ff51c7bb"
|
|
253
|
+
"sourceCommit": "019033b83aa0ede9e0c54d735f1ee5349fe39998"
|
|
259
254
|
},
|
|
260
255
|
"semver": {
|
|
261
256
|
"version": "7.8.5",
|
|
@@ -298,13 +293,13 @@
|
|
|
298
293
|
"@hanamesh/core": {
|
|
299
294
|
"version": "0.3.28",
|
|
300
295
|
"license": "MIT",
|
|
301
|
-
"source": "https://
|
|
296
|
+
"source": "https://registry.npmjs.org/@hanamesh/core/-/core-0.3.28.tgz",
|
|
302
297
|
"purpose": "Development-only public Core suite declaration and provider-owned install command for clean CI; never runtime or bundled",
|
|
303
298
|
"usedAs": [
|
|
304
299
|
"devDependencies"
|
|
305
300
|
],
|
|
306
301
|
"specs": {
|
|
307
|
-
"devDependencies": "
|
|
302
|
+
"devDependencies": "^0.3.28"
|
|
308
303
|
},
|
|
309
304
|
"sourceCommit": "62059ca586be2bffa054b5d392ebde41c51939ec",
|
|
310
305
|
"archiveSha256": "9ef8c250efa3bc46de583dc82103719d71d9f3dcc2233fd49731b4467337efa9",
|
package/docs/PROVENANCE.json
CHANGED
|
@@ -69,35 +69,31 @@
|
|
|
69
69
|
"historicalCandidateLicense": "UNLICENSED; no upstream-license inheritance or open-source grant asserted",
|
|
70
70
|
"developmentArtifacts": {
|
|
71
71
|
"@hanamesh/devkit": {
|
|
72
|
-
"version": "0.2.
|
|
73
|
-
"source": "
|
|
74
|
-
"sourceCommit": "
|
|
75
|
-
"mode": "
|
|
72
|
+
"version": "0.2.6",
|
|
73
|
+
"source": "https://registry.npmjs.org/@hanamesh/devkit/-/devkit-0.2.6.tgz",
|
|
74
|
+
"sourceCommit": "019033b83aa0ede9e0c54d735f1ee5349fe39998",
|
|
75
|
+
"mode": "Public npm package; development-only, excluded from runtime tarball",
|
|
76
76
|
"license": "SEE LICENSE IN LICENSE",
|
|
77
77
|
"distributionNotice": "Canonical LICENSE and LICENSE_RECORD.md copied verbatim to docs/LICENSES.json; no new MIT or relicensing grant",
|
|
78
78
|
"lockfile": {
|
|
79
79
|
"path": "pnpm-lock.yaml",
|
|
80
|
-
"resolution": "
|
|
80
|
+
"resolution": "npm registry version with sha512 integrity, no Git credentials"
|
|
81
81
|
},
|
|
82
82
|
"licenseSha256": "242b0b71d3a4a91899ccf38fb70f06d151f3f005c3d7ac7d1e4a6c0461dc0e2d",
|
|
83
83
|
"historicalArtifact": {
|
|
84
84
|
"version": "0.2.0",
|
|
85
85
|
"sha256": "de15f0913dd6de5ba9ce96b8d92ea862ec44489eb698628de963cbbead68bc25",
|
|
86
86
|
"sourceCommit": "8f9bcc69cbacf01d97ffe63bbbade4f865e6dd89"
|
|
87
|
-
}
|
|
88
|
-
"originalSource": "git+https://github.com/yzsnstotz/hanamesh-server-shared.git#semver:^0.2.0&path:/packages/devkit",
|
|
89
|
-
"sha256": "40d7ad33b2802677d12111943f3472aa6e4564ba000d48074a32de33ff51c7bb"
|
|
87
|
+
}
|
|
90
88
|
}
|
|
91
89
|
},
|
|
92
90
|
"externalArtifacts": {
|
|
93
91
|
"@hanamesh/lib-provision": {
|
|
94
92
|
"version": "0.2.1",
|
|
95
|
-
"source": "
|
|
96
|
-
"
|
|
97
|
-
"
|
|
98
|
-
"
|
|
99
|
-
"license": "SEE LICENSE IN LICENSE",
|
|
100
|
-
"originalSource": "git+https://github.com/yzsnstotz/hanamesh-lib-provision.git#575d63fb70e08c47e980dbf25f07921a7ba5aa2a"
|
|
93
|
+
"source": "https://registry.npmjs.org/@hanamesh/lib-provision/-/lib-provision-0.2.1.tgz",
|
|
94
|
+
"mode": "Public npm package; bundled runtime dependency",
|
|
95
|
+
"sourceCommit": "838cf462de9192fb5f2d63497212e7275f5c6e39",
|
|
96
|
+
"license": "SEE LICENSE IN LICENSE"
|
|
101
97
|
}
|
|
102
98
|
},
|
|
103
99
|
"historicalInputNotice": "Top-level legacy input/runtime/prototype fields below describe the original rc.12 intake only. Current candidate identity and verification are in currentCandidate; they do not inherit legacy host/UI evidence."
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@hanamesh/dsh-app-host",
|
|
3
|
-
"version": "0.6.
|
|
3
|
+
"version": "0.6.18",
|
|
4
4
|
"description": "HanaMesh application ownership, durable view leases, and application library for official DSH 0.2.x",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "SEE LICENSE IN LICENSE",
|
|
@@ -86,7 +86,7 @@
|
|
|
86
86
|
},
|
|
87
87
|
"dependencies": {
|
|
88
88
|
"zod": "4.5.4",
|
|
89
|
-
"@hanamesh/lib-provision": "
|
|
89
|
+
"@hanamesh/lib-provision": "^0.2.1",
|
|
90
90
|
"semver": "7.8.5"
|
|
91
91
|
},
|
|
92
92
|
"peerDependencies": {
|
|
@@ -115,7 +115,7 @@
|
|
|
115
115
|
}
|
|
116
116
|
},
|
|
117
117
|
"devDependencies": {
|
|
118
|
-
"@hanamesh/core": "
|
|
118
|
+
"@hanamesh/core": "^0.3.28",
|
|
119
119
|
"@deepseek-ai/cordis": "4.0.5-alpha.1",
|
|
120
120
|
"@deepseek-ai/dsh-host-webserver": "0.2.1-alpha.2",
|
|
121
121
|
"@deepseek-ai/dsh-scope": "0.2.1-alpha.2",
|
|
@@ -128,7 +128,7 @@
|
|
|
128
128
|
"@deepseek-ai/dsh-storage-json": "0.2.1-alpha.2",
|
|
129
129
|
"@deepseek-ai/schemastery": "3.18.5-alpha.1",
|
|
130
130
|
"typescript": "5.8.3",
|
|
131
|
-
"@hanamesh/devkit": "
|
|
131
|
+
"@hanamesh/devkit": "^0.2.6",
|
|
132
132
|
"@deepseek-ai/dsh-client-ui-renderer": "0.2.1-alpha.2",
|
|
133
133
|
"@hanamesh/release-platform-gate": "file:vendor/hanamesh-release-platform-gate-0.1.10.tgz"
|
|
134
134
|
},
|