dsh-composition-doctor 0.1.2 → 0.2.0

package/dist/client.js

@@ -32,12 +32,16 @@ window.__ModuleLoader__.load({
 		  registration: () => registration
 		});
 		module.exports = __toCommonJS(index_exports);
+		var import_react2 = require("react");
+		
+		// src/client/report-view.ts
+		var import_react = require("react");
 		
 		// src/reports/markdown.ts
 		function formatEvidence(item) {
 		  const subject = item.subject === void 0 ? "" : ` \u2014 ${item.subject}`;
 		  const packageLabel = item.packageName === void 0 ? "" : ` (${item.packageName}${item.version === void 0 ? "" : `@${item.version}`})`;
-		  return `- \`${item.source}\`${subject}${packageLabel}: ${item.detail}`;
+		  return `- [${item.evidenceKind}] \`${item.source}\`${subject}${packageLabel}: ${item.detail}`;
 		}
 		function formatDiagnostic(item) {
 		  const evidence = item.evidence.length === 0 ? "- No concrete source evidence was supplied." : item.evidence.map(formatEvidence).join("\n");
@@ -53,14 +57,19 @@ window.__ModuleLoader__.load({
 		function renderMarkdown(report) {
 		  const summary = ["error", "warning", "info"].map((severity) => `${severity}: ${report.diagnostics.filter((item) => item.severity === severity).length}`).join(", ");
 		  const body = report.diagnostics.length === 0 ? "No diagnostics were produced." : report.diagnostics.map(formatDiagnostic).join("\n\n");
+		  const coverage = report.metadataCoverage === void 0 ? "" : `
+		Metadata coverage: ${report.metadataCoverage.mode}; unscanned: ${report.metadataCoverage.unscannedSurfaces.join("; ")}
+		`;
 		  return `# DSH Composition Doctor Report
 		
-		Schema: ${report.schemaVersion}
+		Schema: ${report.schemaVersion}; evidence schema: ${report.evidenceSchemaVersion}
 		
 		Profile: \`${report.profileDir}\`
 		
 		Generated: ${report.generatedAt}
 		
+		Evidence mode: ${report.evidenceMode}; runtime observed: ${report.runtimeObserved ? "yes" : "no"}
+		${coverage}
 		Summary: ${summary}
 		
 		${body}
@@ -69,6 +78,15 @@ window.__ModuleLoader__.load({
 		
 		// src/client/report-view.ts
 		var clientReportPath = "/dsh-composition-doctor/reports/latest";
+		var downloadRevokeDelayMs = 1e3;
+		function evidenceBadgeLabel(mode, runtimeObserved) {
+		  if (mode === "runtime-observed" && runtimeObserved) return "runtime-observed";
+		  if (mode === "runtime-observed") return "composed; runtime not observed";
+		  if (mode === "composed") return "composed; runtime not observed";
+		  if (mode === "mixed") return runtimeObserved ? "mixed; runtime observed" : "mixed; runtime not observed";
+		  if (mode === "resolved") return "legacy resolved; runtime not observed";
+		  return "static";
+		}
 		function buildConflictGraph(report) {
 		  const nodes = /* @__PURE__ */ new Map();
 		  const edges = [];
@@ -90,6 +108,28 @@ window.__ModuleLoader__.load({
 		  for (const diagnostic of report.diagnostics) counts[diagnostic.severity] += 1;
 		  return { report, counts, graph: buildConflictGraph(report) };
 		}
+		function renderConflictGraph(document, graph) {
+		  const section = document.createElement("section");
+		  section.setAttribute("aria-labelledby", "dsh-composition-doctor-conflict-graph");
+		  const heading = document.createElement("h3");
+		  heading.id = "dsh-composition-doctor-conflict-graph";
+		  heading.textContent = "Conflict graph";
+		  section.append(heading);
+		  const list = document.createElement("ul");
+		  for (const node of graph.nodes) {
+		    const item = document.createElement("li");
+		    const outgoing = graph.edges.filter((edge) => edge.from === node.id).map((edge) => graph.nodes.find((candidate) => candidate.id === edge.to)?.label ?? edge.to);
+		    item.textContent = `${node.label} (${node.source})${outgoing.length === 0 ? "" : ` \u2192 ${outgoing.join(", ")}`}`;
+		    list.append(item);
+		  }
+		  if (graph.nodes.length === 0) {
+		    const item = document.createElement("li");
+		    item.textContent = "No evidence relationships were produced.";
+		    list.append(item);
+		  }
+		  section.append(list);
+		  return section;
+		}
 		function isReport(value) {
 		  if (value === null || typeof value !== "object") return false;
 		  const candidate = value;
@@ -112,12 +152,36 @@ window.__ModuleLoader__.load({
 		  if (!isReport(value)) throw new Error("The latest report has an unsupported schema.");
 		  return value;
 		}
-		function download(document, content, filename, mime) {
+		var browserDownloadHooks = {
+		  createObjectURL: (blob) => URL.createObjectURL(blob),
+		  revokeObjectURL: (url) => URL.revokeObjectURL(url),
+		  schedule: (callback, delay) => globalThis.setTimeout(callback, delay)
+		};
+		function download(document, content, filename, mime, hooks = browserDownloadHooks) {
+		  const blob = new Blob([content], { type: mime });
 		  const link = document.createElement("a");
-		  link.href = URL.createObjectURL(new Blob([content], { type: mime }));
+		  const objectUrl = hooks.createObjectURL(blob);
+		  link.hidden = true;
+		  link.href = objectUrl;
 		  link.download = filename;
-		  link.click();
-		  URL.revokeObjectURL(link.href);
+		  document.body.append(link);
+		  try {
+		    link.click();
+		  } finally {
+		    link.remove();
+		    hooks.schedule(() => hooks.revokeObjectURL(objectUrl), downloadRevokeDelayMs);
+		  }
+		}
+		async function exportReport(document, format, dependencies = {}) {
+		  const report = await fetchReport(dependencies.fetcher);
+		  if (format === "json") {
+		    ;
+		    (dependencies.download ?? download)(document, `${JSON.stringify(report, null, 2)}
+		`, "dsh-composition-doctor-report.json", "application/json");
+		    return;
+		  }
+		  ;
+		  (dependencies.download ?? download)(document, renderMarkdown(report), "dsh-composition-doctor-report.md", "text/markdown");
 		}
 		function createReportView(document = globalThis.document, translate = (key) => ({
 		  title: "DSH Composition Doctor",
@@ -125,7 +189,7 @@ window.__ModuleLoader__.load({
 		  exportMarkdown: "Export Markdown",
 		  loading: "Loading the latest local report\u2026",
 		  unavailable: "The latest report is unavailable."
-		})[key] ?? key) {
+		})[key] ?? key, dependencies = {}) {
 		  const root = document.createElement("section");
 		  root.dataset.plugin = nameForDom;
 		  root.setAttribute("aria-labelledby", "dsh-composition-doctor-title");
@@ -139,30 +203,60 @@ window.__ModuleLoader__.load({
 		  const actions = document.createElement("p");
 		  actions.append(
 		    button(document, translate("exportJson"), () => {
-		      void fetchReport().then((report) => download(document, `${JSON.stringify(report, null, 2)}
-		`, "dsh-composition-doctor-report.json", "application/json")).catch(() => void 0);
+		      void exportReport(document, "json", dependencies).catch(() => void 0);
 		    }),
 		    text(document, " "),
 		    button(document, translate("exportMarkdown"), () => {
-		      void fetchReport().then((report) => download(document, renderMarkdown(report), "dsh-composition-doctor-report.md", "text/markdown")).catch(() => void 0);
+		      void exportReport(document, "markdown", dependencies).catch(() => void 0);
 		    })
 		  );
 		  root.append(actions);
-		  void fetchReport().then((report) => {
+		  void fetchReport(dependencies.fetcher).then((report) => {
 		    const model = toReportViewModel(report);
-		    status.textContent = `Diagnostics: ${model.counts.error} error, ${model.counts.warning} warning, ${model.counts.info} info. Conflict graph: ${model.graph.nodes.length} evidence nodes.`;
+		    const badge = document.createElement("span");
+		    badge.dataset.evidenceKind = report.evidenceMode;
+		    badge.setAttribute("aria-label", "Evidence capability");
+		    badge.textContent = `Evidence: ${evidenceBadgeLabel(report.evidenceMode, report.runtimeObserved === true)}`;
+		    status.textContent = `Generated: ${report.generatedAt}. Profile: ${report.profileDir}. Diagnostics: ${model.counts.error} error, ${model.counts.warning} warning, ${model.counts.info} info.`;
+		    status.append(document.createTextNode(" "), badge);
+		    root.append(renderConflictGraph(document, model.graph));
 		    const list = document.createElement("ul");
 		    for (const diagnostic of report.diagnostics) {
 		      const item = document.createElement("li");
-		      item.textContent = `[${diagnostic.severity}] ${diagnostic.title}`;
+		      const details = document.createElement("details");
+		      const summary = document.createElement("summary");
+		      summary.textContent = `[${diagnostic.severity}] ${diagnostic.title}`;
+		      details.append(summary);
+		      const explanation = document.createElement("p");
+		      explanation.textContent = diagnostic.explanation;
+		      const evidence = document.createElement("pre");
+		      evidence.textContent = diagnostic.evidence.map((entry) => `${entry.source}: ${entry.detail}`).join("\n") || "No concrete evidence.";
+		      const remediation = document.createElement("p");
+		      remediation.textContent = `Remediation: ${diagnostic.remediation}`;
+		      details.append(explanation, evidence, remediation);
+		      item.append(details);
 		      list.append(item);
 		    }
 		    root.append(list);
-		  }).catch((error) => {
-		    status.textContent = error instanceof Error ? error.message : translate("unavailable");
+		  }).catch(() => {
+		    status.textContent = translate("unavailable");
 		  });
 		  return root;
 		}
+		function ReportView({ translate }) {
+		  const host = (0, import_react.useRef)(null);
+		  (0, import_react.useEffect)(() => {
+		    const container = host.current;
+		    if (container === null) return;
+		    const view = createReportView(globalThis.document, translate);
+		    container.replaceChildren(view);
+		    return () => {
+		      view.remove();
+		      container.replaceChildren();
+		    };
+		  }, [translate]);
+		  return (0, import_react.createElement)("div", { className: "dsh-composition-doctor-report-view", ref: host });
+		}
 		var nameForDom = "dsh-composition-doctor";
 		
 		// src/client/index.ts
@@ -170,12 +264,12 @@ window.__ModuleLoader__.load({
 		var registration = Object.freeze({
 		  id: name,
 		  actions: ["export-json", "export-markdown"],
-		  component: () => createReportView()
+		  component: () => (0, import_react2.createElement)(ReportView, { translate: (key) => key })
 		});
 		var apply = Object.assign(
 		  (ctx) => {
 		    const messages = {
-		      zh: { title: "DSH \u7EC4\u5408\u533B\u751F", exportJson: "\u5BFC\u51FA JSON", exportMarkdown: "\u5BFC\u51FA Markdown" },
+		      zh: { title: "DSH Composition Doctor", exportJson: "\u5BFC\u51FA JSON", exportMarkdown: "\u5BFC\u51FA Markdown" },
 		      en: { title: "DSH Composition Doctor", exportJson: "Export JSON", exportMarkdown: "Export Markdown" }
 		    };
 		    const disposeLocale = ctx.locale?.register("dshCompositionDoctor", messages);
@@ -186,7 +280,7 @@ window.__ModuleLoader__.load({
 		      order: 70,
 		      locale: "dshCompositionDoctor",
 		      label: () => t("title")
-		    }, () => createReportView(void 0, t)));
+		    }, () => (0, import_react2.createElement)(ReportView, { translate: t })));
 		    return () => {
 		      if (typeof disposeSlot === "function") disposeSlot();
 		      if (typeof disposeLocale === "function") disposeLocale();

package/dist/core/bundle-inventory.js

@@ -0,0 +1,66 @@
+import { access } from 'node:fs/promises';
+import { inspectInstalledPackage } from './package-provenance.js';
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+function diagnostic(id, title, source, detail) {
+    return {
+        id,
+        severity: 'warning',
+        title,
+        evidence: [{ source, detail, evidenceKind: 'static' }],
+        explanation: detail,
+        remediation: 'Install the declared bundle in the selected profile or provide the missing public manifest/patch metadata.'
+    };
+}
+function bundleNames(manifest) {
+    const dsh = record(manifest.dsh);
+    const profile = record(dsh?.profile);
+    const bundles = profile?.bundles;
+    if (!Array.isArray(bundles))
+        return [];
+    return bundles.flatMap((entry) => {
+        if (typeof entry === 'string')
+            return [{ name: entry }];
+        const object = record(entry);
+        const name = typeof object?.name === 'string' ? object.name : typeof object?.package === 'string' ? object.package : undefined;
+        if (name === undefined)
+            return [];
+        return [{ name, ...(typeof object?.version === 'string' ? { requestedSpec: object.version } : {}) }];
+    });
+}
+export async function inspectBundleInventory(profileDir, packageJsonText) {
+    let manifest;
+    try {
+        manifest = JSON.parse(packageJsonText);
+    }
+    catch {
+        return { packages: [], diagnostics: [diagnostic('bundle-inventory-manifest-invalid', 'Profile package manifest is invalid', 'package.json', 'The profile package.json could not be parsed, so dsh.profile.bundles cannot be inspected.')] };
+    }
+    const packages = [];
+    const diagnostics = [];
+    for (const declared of bundleNames(manifest)) {
+        try {
+            const fact = await inspectInstalledPackage(profileDir, declared.name, declared.requestedSpec);
+            packages.push(fact);
+            if (fact.bundlePatch !== undefined) {
+                try {
+                    await access(fact.bundlePatch);
+                }
+                catch {
+                    diagnostics.push(diagnostic('bundle-patch-missing', 'Bundle patch metadata is missing', fact.packageJsonSource, `${declared.name} declares dsh.bundle.patch at ${fact.bundlePatch}, but that file is not readable.`));
+                }
+            }
+            else {
+                diagnostics.push(diagnostic('bundle-patch-unavailable', 'Bundle patch metadata is unavailable', fact.packageJsonSource, `${declared.name} has no readable dsh.bundle.patch declaration.`));
+            }
+            if (fact.integrity === undefined && fact.gitRef === undefined) {
+                diagnostics.push(diagnostic('bundle-provenance-unavailable', 'Bundle immutable provenance is unavailable', fact.packageJsonSource, `${declared.name} has neither registry integrity nor a fixed Git reference in its readable manifest.`));
+            }
+        }
+        catch (error) {
+            diagnostics.push(diagnostic('bundle-not-installed', 'Declared bundle is not installed or readable', 'package.json', `${declared.name}${declared.requestedSpec === undefined ? '' : `@${declared.requestedSpec}`} could not be resolved from the selected profile: ${error instanceof Error ? error.message : String(error)}`));
+        }
+    }
+    return { packages, diagnostics };
+}

package/dist/core/composition-adapter.js

@@ -1,12 +1,13 @@
 import { parse } from 'yaml';
-function runtimeUnavailableDiagnostic() {
+import { tryDshDump } from './dsh-dump-provider.js';
+function runtimeUnavailableDiagnostic(detail = 'Static YAML was read, but actual resolved composition requires a public provider.') {
     return {
         id: 'runtime-composition-unavailable',
         severity: 'warning',
         title: 'Runtime composition is unavailable',
         evidence: [],
-        explanation: 'Static YAML was read, but actual resolved composition requires a public provider.',
-        remediation: 'Supply a public ResolvedCompositionProvider to resolve runtime composition.'
+        explanation: detail,
+        remediation: 'Install or explicitly provide a compatible public DSH dump provider; static findings remain bounded to the allow-listed metadata.'
     };
 }
 function parseFailedDiagnostic(file, error) {
@@ -14,7 +15,7 @@ function parseFailedDiagnostic(file, error) {
         id: 'composition-parse-failed',
         severity: 'warning',
         title: 'Composition YAML could not be parsed',
-        evidence: [{ source: file.relativePath, detail: error instanceof Error ? error.message : String(error) }],
+        evidence: [{ source: file.relativePath, detail: error instanceof Error ? error.message : String(error), evidenceKind: 'static' }],
         explanation: 'This static composition source was skipped because its YAML is invalid.',
         remediation: 'Correct the YAML syntax and run the static analysis again.'
     };
@@ -26,6 +27,14 @@ function isPlainObject(value) {
     const prototype = Object.getPrototypeOf(value);
     return prototype === Object.prototype || prototype === null;
 }
+function parseYamlValue(text) {
+    return parse(text, {
+        customTags: [
+            { tag: 'tag:yaml.org,2002:js', resolve: (value) => value },
+            { tag: 'tag:yaml.org,2002:js/function', resolve: (value) => value }
+        ]
+    });
+}
 function cloneProviderValue(value, seen = new WeakMap()) {
     if (value === null || typeof value !== 'object')
         return value;
@@ -49,7 +58,7 @@ function cloneProviderValue(value, seen = new WeakMap()) {
     return copy;
 }
 function staticRows(file) {
-    const parsed = parse(file.text);
+    const parsed = parseYamlValue(file.text);
     const entries = Array.isArray(parsed) ? parsed : isRecord(parsed) ? parsed.plugins : undefined;
     if (!Array.isArray(entries))
         return [];
@@ -66,17 +75,55 @@ function staticRows(file) {
         return [row];
     });
 }
+function inventoryFacts(input) {
+    const bundles = [];
+    const peerRequirements = [];
+    const platforms = [];
+    for (const fact of input.installedPackages) {
+        bundles.push({
+            name: fact.name,
+            source: fact.packageJsonSource,
+            evidenceKind: 'static',
+            ...(fact.requestedSpec === undefined ? {} : { requestedSpec: fact.requestedSpec }),
+            ...(fact.installedVersion === undefined ? {} : { version: fact.installedVersion }),
+            ...(fact.gitRef === undefined ? {} : { gitRef: fact.gitRef }),
+            ...(fact.integrity === undefined ? {} : { integrity: fact.integrity }),
+            ...(fact.repository === undefined ? {} : { repository: fact.repository }),
+            ...(fact.modifiedAt === undefined ? {} : { modifiedAt: fact.modifiedAt })
+        });
+        if (fact.peerDsh !== undefined || fact.peerCordis !== undefined || fact.engineNode !== undefined) {
+            peerRequirements.push({ packageName: fact.name, source: fact.packageJsonSource, evidenceKind: 'static', ...(fact.peerDsh === undefined ? {} : { dsh: fact.peerDsh }), ...(fact.peerCordis === undefined ? {} : { cordis: fact.peerCordis }), ...(fact.engineNode === undefined ? {} : { node: fact.engineNode }) });
+        }
+        if (fact.platform !== undefined && fact.platform.length > 0)
+            platforms.push({ packageName: fact.name, source: fact.packageJsonSource, evidenceKind: 'static', supported: fact.platform });
+    }
+    return { bundles, peerRequirements, platforms };
+}
 export async function resolveComposition(input, provider) {
     if (provider) {
         const providedRows = await provider.resolve(input);
         return {
             profileDir: input.profileDir,
-            rows: providedRows.map((row) => ({ ...cloneProviderValue(row), evidenceKind: 'resolved' })),
-            adapterDiagnostics: []
+            rows: providedRows.map((row) => ({ ...cloneProviderValue(row), evidenceKind: 'composed' })),
+            adapterDiagnostics: [...input.inventoryDiagnostics], evidenceMode: 'composed', runtimeObservation: { observed: false, detail: 'A composition provider supplied a resolved tree; no runtime was started.' }, metadataCoverage: input.metadataCoverage, installedPackages: input.installedPackages
+        };
+    }
+    const resolved = await tryDshDump(input);
+    if (resolved !== undefined) {
+        return {
+            profileDir: input.profileDir,
+            rows: resolved.rows,
+            adapterDiagnostics: [...input.inventoryDiagnostics, ...resolved.diagnostics],
+            evidenceMode: 'composed',
+            runtimeObservation: { observed: false, detail: 'dump-config composes configuration without starting third-party runtime code.' },
+            metadataCoverage: input.metadataCoverage,
+            installedPackages: input.installedPackages,
+            ...inventoryFacts(input)
         };
     }
     const rows = [];
-    const adapterDiagnostics = [runtimeUnavailableDiagnostic()];
+    const facts = inventoryFacts(input);
+    const adapterDiagnostics = [...input.inventoryDiagnostics, runtimeUnavailableDiagnostic()];
     for (const file of input.files) {
         if (file.relativePath !== 'cordis.yml' && file.relativePath !== 'cordis.patch.yml')
             continue;
@@ -87,5 +134,5 @@ export async function resolveComposition(input, provider) {
             adapterDiagnostics.push(parseFailedDiagnostic(file, error));
         }
     }
-    return { profileDir: input.profileDir, rows, adapterDiagnostics };
+    return { profileDir: input.profileDir, rows, ...facts, installedPackages: input.installedPackages, adapterDiagnostics, evidenceMode: 'static', runtimeObservation: { observed: false, detail: 'Only allow-listed static metadata was inspected.' }, metadataCoverage: input.metadataCoverage };
 }

package/dist/core/composition-provenance.js

@@ -0,0 +1,8 @@
+export function rowEvidence(row) {
+    return {
+        source: row.source,
+        subject: row.id ?? row.name ?? 'anonymous-row',
+        detail: `${row.layer === undefined ? 'resolved row' : `layer ${row.layer}`} ${row.replacement === true ? 'replaces the previous row' : 'declared'}`,
+        evidenceKind: row.evidenceKind
+    };
+}

package/dist/core/diff.js

@@ -1,18 +1,12 @@
+import { compare as semverCompare } from 'semver';
+import { isSnapshotV2, legacyPlugins } from './snapshot.js';
 function formatChange(change) {
     const before = change.before === undefined ? '' : ` before=${JSON.stringify(change.before)}`;
     const after = change.after === undefined ? '' : ` after=${JSON.stringify(change.after)}`;
     return `- **${change.kind}** \`${change.key}\`${before}${after}`;
 }
-/** Renders the semantic diff without hiding the evidence in a summary-only line. */
 export function renderSnapshotDiffMarkdown(diff) {
-    const sections = [
-        ['Plugins', diff.pluginChanges],
-        ['Cordis rows', diff.rowChanges],
-        ['Tool hooks', diff.hookChanges],
-        ['UI claims', diff.uiConflictChanges],
-        ['Peer requirements', diff.peerChanges],
-        ['Platform requirements', diff.platformChanges]
-    ];
+    const sections = [['Plugins', diff.pluginChanges], ['Cordis rows', diff.rowChanges], ['Tool hooks', diff.hookChanges], ['UI claims', diff.uiConflictChanges], ['Peer requirements', diff.peerChanges], ['Platform requirements', diff.platformChanges]];
     const body = sections.map(([title, values]) => `## ${title}\n\n${values.length === 0 ? 'No changes.' : values.map(formatChange).join('\n')}`).join('\n\n');
     const riskItems = diff.upgradeRisk.items.length === 0 ? '- None.' : diff.upgradeRisk.items.map((item) => `- ${item}`).join('\n');
     return `# DSH Composition Doctor Snapshot Diff\n\n${diff.upgradeRisk.summary}\n\n## Upgrade risk items\n\n${riskItems}\n\n${body}\n`;
@@ -20,50 +14,61 @@ export function renderSnapshotDiffMarkdown(diff) {
 function compareVersions(left, right) {
     if (left === undefined || right === undefined)
         return undefined;
-    const parse = (value) => /^(\d+)\.(\d+)\.(\d+)/.exec(value)?.slice(1).map(Number);
-    const a = parse(left);
-    const b = parse(right);
-    if (a === undefined || b === undefined)
+    try {
+        return semverCompare(left, right, { includePrerelease: true });
+    }
+    catch {
         return undefined;
-    for (let index = 0; index < 3; index += 1)
-        if (a[index] !== b[index])
-            return a[index] < b[index] ? -1 : 1;
-    return 0;
+    }
 }
-function changes(before, after, key) {
-    const previous = new Map(before.map((item) => [key(item), item]));
-    const next = new Map(after.map((item) => [key(item), item]));
+function changes(before, after, beforeKey, afterKey = beforeKey) {
+    const previous = new Map(before.map((item) => [beforeKey(item), item]));
+    const next = new Map(after.map((item) => [afterKey(item), item]));
     const result = [];
-    for (const itemKey of [...new Set([...previous.keys(), ...next.keys()])].sort()) {
-        const left = previous.get(itemKey);
-        const right = next.get(itemKey);
+    for (const key of [...new Set([...previous.keys(), ...next.keys()])].sort()) {
+        const left = previous.get(key);
+        const right = next.get(key);
         if (left === undefined)
-            result.push({ kind: 'added', key: itemKey, after: right });
+            result.push({ kind: 'added', key, after: right });
         else if (right === undefined)
-            result.push({ kind: 'removed', key: itemKey, before: left });
+            result.push({ kind: 'removed', key, before: left });
         else if (JSON.stringify(left) !== JSON.stringify(right))
-            result.push({ kind: 'changed', key: itemKey, before: left, after: right });
+            result.push({ kind: 'changed', key, before: left, after: right });
     }
     return result;
 }
+function normalize(snapshot) {
+    if (isSnapshotV2(snapshot)) {
+        return {
+            plugins: legacyPlugins(snapshot), rows: snapshot.rows, hooks: snapshot.hooks, uiClaims: snapshot.uiClaims,
+            peers: snapshot.packages.map((item) => ({ packageName: item.name, source: item.packageJsonSource, dsh: item.peerDsh, cordis: item.peerCordis, node: item.engineNode })),
+            platforms: snapshot.packages.map((item) => ({ packageName: item.name, source: item.packageJsonSource, supported: item.platform })), identityPrefix: ''
+        };
+    }
+    return { plugins: snapshot.plugins, rows: snapshot.rows, hooks: snapshot.hooks, uiClaims: snapshot.uiClaims, peers: snapshot.peers, platforms: snapshot.platforms, identityPrefix: `${snapshot.profile.path}:${snapshot.profile.packageName ?? ''}:` };
+}
 export function diffSnapshots(before, after) {
-    const pluginChanges = changes(before.plugins, after.plugins, (item) => item.name).map((change) => {
+    const left = normalize(before);
+    const right = normalize(after);
+    const pluginKey = (prefix, item) => `${prefix}${item.name}:${item.source}`;
+    const pluginChanges = changes(left.plugins, right.plugins, (item) => pluginKey(left.identityPrefix, item), (item) => pluginKey(right.identityPrefix, item)).map((change) => {
+        const name = change.before?.name ?? change.after?.name ?? change.key;
         if (change.kind !== 'changed')
-            return { ...change, name: change.key };
+            return { ...change, name };
         const comparison = compareVersions(change.before?.version, change.after?.version);
-        return { ...change, name: change.key, kind: comparison === undefined ? 'changed' : comparison < 0 ? 'upgraded' : comparison > 0 ? 'downgraded' : 'changed' };
+        return { ...change, name, kind: comparison === undefined ? 'changed' : comparison < 0 ? 'upgraded' : comparison > 0 ? 'downgraded' : 'changed' };
     });
-    const rowChanges = changes(before.rows, after.rows, (item) => `${item.source}:${item.id ?? item.name ?? ''}`);
-    const hookChanges = changes(before.hooks, after.hooks, (item) => `${item.source}:${item.hook}:${item.packageName ?? ''}`);
-    const uiConflictChanges = changes(before.uiClaims, after.uiClaims, (item) => `${item.kind}:${item.value}:${item.source}`);
-    const peerChanges = changes(before.peers, after.peers, (item) => `${item.source}:${item.packageName}`);
-    const platformChanges = changes(before.platforms, after.platforms, (item) => `${item.source}:${item.packageName}`);
+    const rowChanges = changes(left.rows, right.rows, (item) => `${item.source}:${item.id ?? item.name ?? ''}`);
+    const hookChanges = changes(left.hooks, right.hooks, (item) => `${item.source}:${item.hook}:${item.packageName ?? ''}`);
+    const uiConflictChanges = changes(left.uiClaims, right.uiClaims, (item) => `${item.kind}:${item.value}:${item.source}`);
+    const peerChanges = changes(left.peers, right.peers, (item) => `${item.source ?? ''}:${item.packageName ?? ''}`);
+    const platformChanges = changes(left.platforms, right.platforms, (item) => `${item.source ?? ''}:${item.packageName ?? ''}`);
     const items = pluginChanges.filter((change) => change.kind === 'downgraded' || change.kind === 'upgraded').map((change) => `${change.kind} plugin ${change.name}`);
     if (hookChanges.length > 0)
-        items.push('hook registrations changed; verify runtime ordering in an isolated fixture');
+        items.push('hook registrations changed; runtime ordering remains unverified');
     if (uiConflictChanges.length > 0)
         items.push('UI claims changed; verify ownership conflicts before upgrade');
     if (peerChanges.length > 0 || platformChanges.length > 0)
         items.push('peer or platform requirements changed; verify supported runtime facts');
-    return { pluginChanges, rowChanges, hookChanges, uiConflictChanges, peerChanges, platformChanges, upgradeRisk: { summary: items.length === 0 ? 'No upgrade risks detected from snapshot metadata.' : `Upgrade risk: ${items.join('; ')}. No migration was executed.`, items } };
+    return { pluginChanges, rowChanges, hookChanges, uiConflictChanges, peerChanges, platformChanges, upgradeRisk: { summary: items.length === 0 ? 'No risk indicators changed within the evidence covered by these snapshots.' : `Risk indicators changed: ${items.join('; ')}. No migration was executed.`, items } };
 }

package/dist/core/dsh-dump-parser.js

@@ -0,0 +1,111 @@
+import { parse } from 'yaml';
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+function rowsFrom(value) {
+    if (Array.isArray(value))
+        return value;
+    const object = record(value);
+    if (object === undefined)
+        return [];
+    for (const key of ['rows', 'plugins', 'composition']) {
+        if (Array.isArray(object[key]))
+            return object[key];
+    }
+    const config = record(object.config);
+    if (config !== undefined && Array.isArray(config.plugins))
+        return config.plugins;
+    return [];
+}
+function configKeys(value) {
+    const object = record(value);
+    return object === undefined ? undefined : Object.keys(object).sort();
+}
+function provenanceByRow(stdout) {
+    const result = [];
+    let current;
+    for (const line of stdout.split(/\r?\n/)) {
+        const comment = line.match(/^\s*#\s*==\s*(.+?)\s*$/);
+        if (comment !== null) {
+            current = comment[1];
+            continue;
+        }
+        if (current !== undefined && /^-\s/.test(line))
+            result.push(current);
+    }
+    return result;
+}
+function provenanceParts(label) {
+    if (label === undefined)
+        return {};
+    const parts = label.split(/,\s*patched by\s+/);
+    const source = parts[0];
+    const patches = parts.slice(1).flatMap((part) => part.split(/,\s+/)).filter(Boolean);
+    return { source, provenance: [source, ...patches] };
+}
+export function parseDshDump(stdout, stderr = '') {
+    let parsed;
+    try {
+        try {
+            parsed = JSON.parse(stdout);
+        }
+        catch {
+            parsed = parse(stdout, {
+                customTags: [
+                    { tag: 'tag:yaml.org,2002:js', resolve: (value) => value },
+                    { tag: 'tag:yaml.org,2002:js/function', resolve: (value) => value }
+                ]
+            });
+        }
+    }
+    catch (error) {
+        return {
+            rows: [],
+            diagnostics: [{
+                    id: 'composed-dump-parse-failed', severity: 'warning', title: 'Composed DSH dump could not be parsed',
+                    evidence: [{ source: '<DSH dump>', detail: error instanceof Error ? error.message : String(error), evidenceKind: 'composed' }],
+                    explanation: 'The public dump-config command returned output that was not valid JSON or YAML.',
+                    remediation: 'Use a verified DSH release whose public dump-config output is supported by this adapter.'
+                }]
+        };
+    }
+    const provenanceHints = provenanceByRow(stdout);
+    const legacyProvenanceHints = stdout.split(/\r?\n/).flatMap((line) => {
+        const match = line.match(/^\s*#\s*(?:source|from|file|layer)\s*[:=]\s*(.+?)\s*$/i);
+        return match === null ? [] : [match[1]];
+    });
+    const rawRows = rowsFrom(parsed);
+    const seenIds = new Map();
+    const rows = rawRows.flatMap((entry, index) => {
+        const object = record(entry);
+        if (object === undefined)
+            return [];
+        const provenance = provenanceParts(typeof object.source === 'string' ? object.source : provenanceHints[index] ?? legacyProvenanceHints[index]);
+        const source = typeof object.source === 'string' ? object.source : provenance.source ?? '<DSH dump>';
+        const config = object.config;
+        const row = {
+            ...(typeof object.id === 'string' ? { id: object.id } : {}),
+            ...(typeof object.name === 'string' ? { name: object.name } : typeof object.plugin === 'string' ? { name: object.plugin } : {}),
+            source,
+            ...(config === undefined ? {} : { config, ...(configKeys(config) === undefined ? {} : { configKeys: configKeys(config) }) }),
+            evidenceKind: 'composed',
+            ...(typeof object.layer === 'string' ? { layer: object.layer } : {}),
+            ...(typeof object.layerOrder === 'number' ? { layerOrder: object.layerOrder } : {}),
+            ...(provenance.provenance === undefined ? {} : { provenance: provenance.provenance }),
+            ...(object.replacement === true || object.overridden === true || (provenance.provenance !== undefined && provenance.provenance.length > 1) || (typeof object.id === 'string' && seenIds.has(object.id) && seenIds.get(object.id) !== source) ? { replacement: true } : {})
+        };
+        if (row.id !== undefined)
+            seenIds.set(row.id, row.source);
+        return [row];
+    });
+    const diagnostics = [];
+    const unmatched = stderr.match(/(?:patch[^\r\n]*(?:unmatched|unknown|not found)|(?:unmatched|unknown|not found)[^\r\n]*(?:patch|row|target))[^\r\n]*/gi) ?? [];
+    for (const detail of unmatched)
+        diagnostics.push({
+            id: 'unmatched-patch-target', severity: 'warning', title: 'Resolved patch target did not match a row',
+            evidence: [{ source: '<DSH stderr>', detail, evidenceKind: 'composed' }],
+            explanation: 'The public DSH dump reported a patch target that did not match a resolved row.',
+            remediation: 'Verify the patch row id against the selected bundle/profile composition.'
+        });
+    return { rows, diagnostics };
+}