dsh-keys-manager 0.2.0 → 0.2.2

package/locale/zh.json

@@ -9,6 +9,12 @@
   "accountProjected": "服务中",
   "accountReauth": "重新认证",
   "accountActivate": "设为当前",
+  "testKey": "测试连接",
+  "testRunning": "测试中…",
+  "testPassed": "连接正常 · {ms} ms",
+  "testFailed": "连接失败：{error}",
+  "testTimedOut": "测试超时，未收到结果",
+  "testFailedUnknown": "测试未完成，未返回原因",
   "keyStatusEmpty": "暂无密钥",
   "noKeysAccount": "还没有账户。添加一个账户后即可使用该 Provider。",
   "loginTitle": "账户登录",
@@ -21,5 +27,15 @@
   "loginReady": "登录成功。",
   "deleteAccountTitle": "删除账户“{alias}”？",
   "deleteAccountBody": "这会从凭证库中删除该账户保存的 OAuth 授权。如果它是当前账户，该 Provider 路由将停用它并回落到 API-key 池；Provider 仍保持接管状态。",
-  "deleteAccountBodyNoKeys": "这会从凭证库中删除该账户保存的 OAuth 授权。该路由没有 API-key 池，删除后将停止服务，直到重新登录账户。"
+  "deleteAccountBodyNoKeys": "这会从凭证库中删除该账户保存的 OAuth 授权。该路由没有 API-key 池，删除后将停止服务，直到重新登录账户。",
+  "transportAccounts": "传输账户",
+  "transportTag": "传输",
+  "transportSignIn": "登录",
+  "transportExpires": "有效期至 {time}",
+  "transportStatusActive": "正常",
+  "transportStatusExpired": "令牌已过期",
+  "transportStatusNeedsReauth": "需重新登录",
+  "transportStatusSignedOut": "未登录",
+  "transportRemoveTitle": "移除 {name} 传输账户？",
+  "transportRemoveBody": "这会从凭证库中删除该传输路由保存的授权，并取消仍在进行的登录；路由自身不会重建它。要恢复服务需要重新登录。"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-keys-manager",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "type": "module",
   "description": "Multi-key management for DSH providers: sticky per-session round-robin, retry failover, cooldown recovery, and searchable extra providers.",
   "repository": {
@@ -54,15 +54,6 @@
       ]
     }
   },
-  "scripts": {
-    "typecheck": "tsc --noEmit && tsc -p tsconfig.client.json --noEmit && tsc -p tsconfig.spec.json --noEmit",
-    "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.client.json && node scripts/build-client.mjs && node scripts/verify-dist.mjs",
-    "build:client": "tsc -p tsconfig.client.json && node scripts/build-client.mjs",
-    "test": "vitest run",
-    "release:prepare": "node scripts/prepare-release.mjs",
-    "prepare": "pnpm run build",
-    "prepack": "pnpm run build"
-  },
   "engines": {
     "node": "^22.19 || >=24"
   },
@@ -80,6 +71,9 @@
     "@deepseek-ai/dsh-typert-registry": "^0.2.1-rc.2",
     "react": "^18.2.0"
   },
+  "dependencies": {
+    "dsh-llm-omp-transports": "^0.2.2"
+  },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.5",
     "@types/node": "^22.20.0",
@@ -87,6 +81,14 @@
     "esbuild": "^0.28.2",
     "react": "^18.3.1",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.8",
+    "yaml": "^2.9.1"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.client.json --noEmit && tsc -p tsconfig.spec.json --noEmit",
+    "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.client.json && node scripts/build-client.mjs && node scripts/verify-dist.mjs",
+    "build:client": "tsc -p tsconfig.client.json && node scripts/build-client.mjs",
+    "test": "vitest run",
+    "release:prepare": "node scripts/prepare-release.mjs"
   }
-}
+}

package/scripts/prepare-release.mjs

@@ -1,24 +1,33 @@
 #!/usr/bin/env node
 /**
- * Release-prep version helper (plan dsh-keys-manager-ci-release, task 2 + 4):
+ * Release-prep version helper (plans dsh-keys-manager-ci-release, task 2 + 4;
+ * omp-transport-cursor-tools, task 5):
  * resolves the target version — explicit `X.Y.Z` / `X.Y.Z-prerelease`
  * argument (e.g. 0.1.1-alpha.1) or an auto patch bump from package.json —
  * refuses already-released versions (existing `v<version>` git tag), aborts
  * when there are no commits since the previous release tag (nothing to
  * release), bumps package.json, inserts the `## [<version>]` section into
- * CHANGELOG.md (from the same git-log notes the workflows use; keeps
- * existing sections, no-op when already present), and prints
- * `VERSION=<version>` for the workflow to capture. Node built-ins only, no
- * new dependencies.
+ * CHANGELOG.md (root only — the transports package has no generated
+ * changelog), and prints the root and transports versions and tags for the
+ * workflow to capture. Node built-ins only, no new dependencies.
+ *
+ * The workspace package `packages/llm-omp` (`dsh-llm-omp-transports`) ships as
+ * part of the same release and always carries the same version: the resolved
+ * version is written to both package.json files, so one version input drives
+ * both tags (`v<version>` and `dsh-llm-omp-transports@<version>`). The
+ * transport version is checked against the tag the Release workflow creates
+ * after publishing, and the version written here is exactly the one
+ * `release.yml` publishes (that workflow skips an already-published version).
  *
  * Usage:
- *   node scripts/prepare-release.mjs            # auto patch bump
- *   node scripts/prepare-release.mjs 0.2.0      # explicit version
- *   node scripts/prepare-release.mjs 0.1.1-alpha.1  # explicit prerelease
+ *   node scripts/prepare-release.mjs           # auto bump
+ *   node scripts/prepare-release.mjs 0.2.0     # explicit version
+ *   node scripts/prepare-release.mjs --dry-run # validate + print, write nothing
  *
- * Exit codes: 0 = bumped and printed VERSION; 1 = rejected (unparseable
- * version, existing tag, no commits since the previous release tag,
- * unparseable current package.json version, or CHANGELOG.md write error).
+ * Exit codes: 0 = bumped (or dry-run resolved) and printed versions; 1 =
+ * rejected (unparseable version, existing tag, no commits since the previous
+ * release tag, unparseable current package.json version, invalid prerelease
+ * dist-tag, or CHANGELOG.md write error).
  */
 
 import { execFileSync } from 'node:child_process'
@@ -28,6 +37,8 @@ import { fileURLToPath } from 'node:url'
 
 const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..')
 const PKG_PATH = join(REPO_ROOT, 'package.json')
+const TRANSPORTS_PKG_PATH = join(REPO_ROOT, 'packages/llm-omp/package.json')
+const TRANSPORT_PACKAGE = 'dsh-llm-omp-transports'
 const CHANGELOG_PATH = join(REPO_ROOT, 'CHANGELOG.md')
 const CHANGELOG_HEADER =
   '# Changelog\n\nAll notable changes to dsh-keys-manager are documented here. Generated from git log by the release-prep workflow.\n'
@@ -53,82 +64,145 @@ function parseVersion(value) {
   }
 }
 
+/**
+ * Refuse a prerelease whose derived npm dist-tag the release workflow would
+ * reject, for either package. The tag is the text between the first '-' and
+ * the first '.' after it ("alpha.1" -> "alpha").
+ */
+function assertPublishablePrerelease(prerelease) {
+  if (prerelease === undefined) return
+  const distTag = prerelease.split('.')[0]
+  if (distTag === 'latest' || !/^[a-z][a-z0-9-]*$/.test(distTag)) {
+    console.error(
+      `Error: prerelease "${prerelease}" maps to invalid npm dist-tag "${distTag}". ` +
+        'Use a prerelease such as alpha.1, beta.1, or rc.1.',
+    )
+    process.exit(1)
+  }
+}
+
 const pkg = JSON.parse(readFileSync(PKG_PATH, 'utf8'))
+const transportsPkg = JSON.parse(readFileSync(TRANSPORTS_PKG_PATH, 'utf8'))
 
-let target
-if (process.argv[2] !== undefined) {
-  target = parseVersion(process.argv[2])
-  if (target === null) {
-    console.error(`Error: invalid version "${process.argv[2]}". Expected X.Y.Z or X.Y.Z-prerelease (e.g. 0.2.0, 0.1.1-alpha.1).`)
-    process.exit(1)
+const { versionArg, dryRun } = parseArgs(process.argv.slice(2))
+
+const target = resolveTarget(versionArg, pkg.version, 'package.json')
+const version = formatVersion(target)
+
+// Validate the npm dist-tag derived by the release workflow. A prerelease
+// identifier like "latest" would move the stable tag, and a numeric one like
+// "1" is not a legal npm tag. Reject both before the release PR is opened.
+assertPublishablePrerelease(target.prerelease)
+
+// The transports package ships from the same version as the root: one input
+// drives both package.json files, so the two can never drift.
+const transportVersion = version
+const transportTag = `${TRANSPORT_PACKAGE}@${transportVersion}`
+
+/**
+ * Parse CLI flags. The first non-flag argument is the target version.
+ */
+function parseArgs(argv) {
+  const parsed = { versionArg: undefined, dryRun: false }
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i]
+    if (arg === '--dry-run') parsed.dryRun = true
+    else if (arg.startsWith('--')) usage(`unknown option "${arg}"`)
+    else if (parsed.versionArg === undefined) parsed.versionArg = arg
+    else usage(`unexpected extra argument "${arg}"`)
+  }
+  return parsed
+}
+
+function usage(message) {
+  console.error(`Error: ${message}.`)
+  console.error(
+    'Usage: node scripts/prepare-release.mjs [X.Y.Z[-prerelease]] [--dry-run]',
+  )
+  process.exit(1)
+}
+
+/**
+ * Resolve an explicit target version, or auto-bump the current one.
+ *
+ * Auto bump (mirrors sibling dsh-llm-fallbacks autoBumpPatch): parse the
+ * current version as X.Y.Z or X.Y.Z-pre, then:
+ *  - formal version X.Y.Z            -> X.Y.(Z+1)       (0.1.2 -> 0.1.3)
+ *  - prerelease with numeric tail    -> bump only the tail, staying on the
+ *    prerelease line (0.1.3-alpha.3 -> 0.1.3-alpha.4)
+ *  - prerelease with non-numeric tail (e.g. 0.1.0-alpha) -> cannot auto
+ *    bump; require an explicit version argument.
+ * The looser regex is deliberate: parseVersion (explicit args) requires a
+ * digit in the suffix, so it cannot tell "alpha" from a malformed version;
+ * this path needs the raw suffix to reject non-numeric tails with the
+ * explicit-version hint.
+ */
+function resolveTarget(explicit, current, label) {
+  if (explicit !== undefined) {
+    const target = parseVersion(explicit)
+    if (target === null) {
+      console.error(
+        `Error: invalid version "${explicit}". Expected X.Y.Z or X.Y.Z-prerelease (e.g. 0.2.0, 0.1.1-alpha.1).`,
+      )
+      process.exit(1)
+    }
+    return target
   }
-} else {
-  // Auto patch bump (mirrors sibling dsh-llm-fallbacks autoBumpPatch): parse
-  // the current version as X.Y.Z or X.Y.Z-pre, then:
-  //  - formal version X.Y.Z            -> X.Y.(Z+1)       (0.1.2 -> 0.1.3)
-  //  - prerelease with numeric tail    -> bump only the tail, staying on the
-  //    prerelease line (0.1.3-alpha.3 -> 0.1.3-alpha.4)
-  //  - prerelease with non-numeric tail (e.g. 0.1.0-alpha) -> cannot auto
-  //    bump; require an explicit version argument.
-  // The looser regex is deliberate: parseVersion (explicit args) requires a
-  // digit in the suffix, so it cannot tell "alpha" from a malformed version;
-  // this path needs the raw suffix to reject non-numeric tails with the
-  // explicit-version hint.
-  const m = /^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/.exec(pkg.version)
+  const m = /^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/.exec(current)
   if (!m) {
-    console.error(`Error: cannot parse current package.json version "${pkg.version}".`)
+    console.error(`Error: cannot parse current ${label} version "${current}".`)
     process.exit(1)
   }
   const [, major, minor, patch, pre] = m
   if (pre === undefined) {
-    target = { major: Number(major), minor: Number(minor), patch: Number(patch) + 1 }
-  } else {
-    const tail = pre.split('.').at(-1)
-    if (tail === undefined || !/^\d+$/.test(tail)) {
-      console.error(
-        `Error: cannot auto-bump "${pkg.version}": prerelease tail "${pre}" is not numeric. ` +
-          'Pass an explicit version instead (e.g. `node scripts/prepare-release.mjs 0.1.1-alpha.1`).',
-      )
-      process.exit(1)
-    }
-    const prefix = pre.slice(0, pre.length - tail.length) // "alpha." for "alpha.1"
-    target = {
-      major: Number(major),
-      minor: Number(minor),
-      patch: Number(patch),
-      prerelease: `${prefix}${Number(tail) + 1}`,
-    }
+    return { major: Number(major), minor: Number(minor), patch: Number(patch) + 1 }
+  }
+  const tail = pre.split('.').at(-1)
+  if (tail === undefined || !/^\d+$/.test(tail)) {
+    console.error(
+      `Error: cannot auto-bump "${current}": prerelease tail "${pre}" is not numeric. ` +
+        'Pass an explicit version instead (e.g. `node scripts/prepare-release.mjs 0.1.1-alpha.1`).',
+    )
+    process.exit(1)
+  }
+  const prefix = pre.slice(0, pre.length - tail.length) // "alpha." for "alpha.1"
+  return {
+    major: Number(major),
+    minor: Number(minor),
+    patch: Number(patch),
+    prerelease: `${prefix}${Number(tail) + 1}`,
   }
 }
 
-const version =
-  target.prerelease === undefined
+function formatVersion(target) {
+  return target.prerelease === undefined
     ? `${target.major}.${target.minor}.${target.patch}`
     : `${target.major}.${target.minor}.${target.patch}-${target.prerelease}`
+}
 
-// Validate the npm dist-tag derived by the release workflow. A prerelease
-// identifier like "latest" would move the stable tag, and a numeric one like
-// "1" is not a legal npm tag. Reject both before the release PR is opened.
-if (target.prerelease !== undefined) {
-  const distTag = target.prerelease.split('.')[0]
-  if (distTag === 'latest' || !/^[a-z][a-z0-9-]*$/.test(distTag)) {
-    console.error(
-      `Error: prerelease "${target.prerelease}" maps to invalid npm dist-tag "${distTag}". ` +
-        'Use a prerelease such as alpha.1, beta.1, or rc.1.',
-    )
-    process.exit(1)
+/** Whether an exact tag ref exists. */
+function tagExists(tag) {
+  try {
+    execFileSync('git', ['rev-parse', '--verify', '--quiet', `refs/tags/${tag}`], {
+      cwd: REPO_ROOT,
+      stdio: 'ignore',
+    })
+    return true
+  } catch {
+    return false
   }
 }
 
-// Reject already-released versions: `git rev-parse v<version>` succeeds iff
-// the tag exists. Works unchanged for prerelease tags (v0.1.1-alpha.1 is a
-// plain tag name). Run from REPO_ROOT so the check is cwd-independent.
-try {
-  execFileSync('git', ['rev-parse', `v${version}`], { cwd: REPO_ROOT, stdio: 'ignore' })
+// Reject already-released versions: the tag exists iff the version was
+// released. Works unchanged for prerelease tags (v0.1.1-alpha.1 is a plain
+// tag name). Run from REPO_ROOT so the check is cwd-independent.
+if (tagExists(`v${version}`)) {
   console.error(`Error: tag v${version} already exists — this version is already released.`)
   process.exit(1)
-} catch {
-  // Tag absent → OK to prepare.
+}
+if (tagExists(transportTag)) {
+  console.error(`Error: tag ${transportTag} already exists — this transport version is already released.`)
+  process.exit(1)
 }
 
 // Fail fast on a no-change release: an empty notes range means no commits
@@ -144,11 +218,17 @@ if (notes === '') {
   process.exit(1)
 }
 
-pkg.version = version
-// Preserve repo formatting: 2-space indent + trailing newline. The version
-// line must be the only diff (verified by `git diff package.json` in the
-// dry-run validation).
-writeFileSync(PKG_PATH, `${JSON.stringify(pkg, null, 2)}\n`, 'utf8')
+// Write only outside a dry run: a dry run validates and prints the resolved
+// versions exactly like a real run, then leaves the working tree untouched.
+if (!dryRun) {
+  pkg.version = version
+  // Preserve repo formatting: 2-space indent + trailing newline. Bumping only
+  // the version keeps `git diff package.json` to that one line.
+  writeFileSync(PKG_PATH, `${JSON.stringify(pkg, null, 2)}\n`, 'utf8')
+
+  transportsPkg.version = transportVersion
+  writeFileSync(TRANSPORTS_PKG_PATH, `${JSON.stringify(transportsPkg, null, 2)}\n`, 'utf8')
+}
 
 /**
  * Resolve the previous release tag (nearest ancestor tag of HEAD; empty
@@ -238,6 +318,13 @@ function updateChangelog(version, notes) {
   }
 }
 
-updateChangelog(version, notes)
+// Root changelog only: the transports package has no generated changelog.
+if (!dryRun) updateChangelog(version, notes)
 
+// The workflow captures VERSION; the remaining lines are informational and
+// let a dry run show both derived tags without touching the tree.
+if (dryRun) console.log('DRY_RUN=1')
 console.log(`VERSION=${version}`)
+console.log(`TAG=v${version}`)
+console.log(`TRANSPORT_VERSION=${transportVersion}`)
+console.log(`TRANSPORT_TAG=${transportTag}`)

package/scripts/verify-install.mjs

@@ -0,0 +1,156 @@
+/**
+ * Install/load integration evidence.
+ *
+ * Proves: packing this repository and installing the root tarball into a fresh
+ * DSH profile yields BOTH bundle components — the profile's node_modules
+ * resolves `dsh-keys-manager` and `dsh-llm-omp-transports`, and the composed
+ * profile tree (`dsh --profile <name> --dump-config`) contains both rows, so
+ * DSH's loader can mount two components from one installed plugin.
+ *
+ * Does NOT prove: the plugin-manager detail page and its enable/disable
+ * toggles (that rendering is DSH's own Web UI), or any Cursor network behavior.
+ *
+ * The run is fully local and needs no registry access: both tarballs come from
+ * `pnpm pack`, the root's `dsh-llm-omp-transports@^0.1.0` dependency is mapped
+ * to the local transports tarball through a profile override, and the profile
+ * keeps `autoInstallPeers: false` (DSH peers are provided by the installation).
+ * On this pnpm 12 the override lives in pnpm-workspace.yaml; the package.json
+ * `pnpm.overrides` copy keeps pnpm 9/10 working.
+ *
+ * Requires `pnpm` and `dsh` on PATH. Usage: node scripts/verify-install.mjs [--keep]
+ */
+import { execFile } from 'node:child_process'
+import { access, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { promisify } from 'node:util'
+
+const execFileAsync = promisify(execFile)
+const repoRoot = dirname(dirname(fileURLToPath(import.meta.url)))
+const transportsDir = join(repoRoot, 'packages/llm-omp')
+const TRANSPORTS = 'dsh-llm-omp-transports'
+const PROFILE = 'install-proof'
+/** The two loader rows the composed profile must carry. */
+const ROWS = [
+  { id: 'dsh-keys-manager', name: 'dsh-keys-manager' },
+  { id: 'llm-omp-transports', name: TRANSPORTS },
+]
+
+async function run(command, args, options = {}) {
+  try {
+    return await execFileAsync(command, args, {
+      encoding: 'utf8',
+      maxBuffer: 64 * 1024 * 1024,
+      ...options,
+    })
+  } catch (error) {
+    const output = [error.stdout, error.stderr].filter(Boolean).join('\n')
+    throw new Error(`${command} ${args.join(' ')} failed (${error.code ?? 'error'}):\n${output}`)
+  }
+}
+
+async function manifestOf(dir) {
+  return JSON.parse(await readFile(join(dir, 'package.json'), 'utf8'))
+}
+
+/** One loader row, quoted or plain, exactly once in the dumped tree. */
+function assertRow(dump, { id, name }) {
+  const row = new RegExp(`^- id: ${id}\\n  name: '?${name}'?$`, 'mu')
+  if (!row.test(dump)) throw new Error(`dump-config is missing the ${id} row:\n${dump}`)
+  const count = dump.split(`- id: ${id}\n`).length - 1
+  if (count !== 1) throw new Error(`dump-config carries the ${id} row ${count} times:\n${dump}`)
+}
+
+let work
+try {
+  for (const command of ['pnpm', 'dsh']) await run(command, ['--version'])
+
+  work = await mkdtemp(join(tmpdir(), 'dsh-install-proof-'))
+  const artifacts = join(work, 'artifacts')
+  await mkdir(artifacts, { recursive: true })
+
+  const root = await manifestOf(repoRoot)
+  const transports = await manifestOf(transportsDir)
+  await run('pnpm', ['pack', '--pack-destination', artifacts], { cwd: repoRoot })
+  await run('pnpm', ['pack', '--pack-destination', artifacts], { cwd: transportsDir })
+  const rootTarball = join(artifacts, `${root.name}-${root.version}.tgz`)
+  const transportsTarball = join(artifacts, `${TRANSPORTS}-${transports.version}.tgz`)
+  await access(rootTarball)
+  await access(transportsTarball)
+
+  // A packed workspace dependency must be a registry range, not `workspace:^`.
+  // The transports package ships from the same release version, so the
+  // expected range follows its manifest rather than a pinned literal.
+  const expectedRange = `^${transports.version}`
+  const packed = JSON.parse((await run('tar', ['-xzOf', rootTarball, 'package/package.json'])).stdout)
+  const pinned = packed.dependencies?.[TRANSPORTS]
+  if (pinned !== expectedRange) {
+    throw new Error(`packed root dependency ${TRANSPORTS} is ${JSON.stringify(pinned)}, expected ${JSON.stringify(expectedRange)}`)
+  }
+  console.log(`install-proof: packed dependency ${TRANSPORTS} -> ${pinned}`)
+
+  // A fresh profile: `dsh plugin install` initializes it (and runs pnpm).
+  const home = join(work, 'home')
+  const profileDir = join(home, 'profiles', PROFILE)
+  const env = { ...process.env, DSH_HOME: home }
+  await run('dsh', ['plugin', '--profile', PROFILE, 'install'], { env })
+
+  // Map the root's registry dependency to the local tarball before installing.
+  const profileManifest = await manifestOf(profileDir)
+  profileManifest.pnpm = {
+    ...profileManifest.pnpm,
+    overrides: { ...profileManifest.pnpm?.overrides, [TRANSPORTS]: `file:${transportsTarball}` },
+  }
+  await writeFile(join(profileDir, 'package.json'), `${JSON.stringify(profileManifest, undefined, 2)}\n`)
+  await writeFile(
+    join(profileDir, 'pnpm-workspace.yaml'),
+    [
+      '# Local tarball mapping for the install proof; the packed root asks for',
+      `# ${TRANSPORTS}@${expectedRange}, which no registry here serves.`,
+      'overrides:',
+      `  ${TRANSPORTS}: ${JSON.stringify(`file:${transportsTarball}`)}`,
+      'packages:',
+      '  - .',
+      '',
+      'nodeLinker: hoisted',
+      'autoInstallPeers: false',
+      '',
+    ].join('\n'),
+  )
+
+  // The alias form (`name@file:...`) is what pnpm 12 accepts for tarballs.
+  await run('dsh', ['plugin', '--profile', PROFILE, 'add', `${root.name}@file:${rootTarball}`], {
+    cwd: work,
+    env,
+  })
+
+  const installed = await manifestOf(profileDir)
+  if (installed.dependencies?.[root.name] !== `file:${rootTarball}`) {
+    throw new Error(`profile does not depend on the packed root: ${JSON.stringify(installed.dependencies)}`)
+  }
+  if (!installed.dsh?.profile?.bundles?.includes(root.name)) {
+    throw new Error(`profile did not select ${root.name} as a bundle: ${JSON.stringify(installed.dsh)}`)
+  }
+  const versions = []
+  for (const name of [root.name, TRANSPORTS]) {
+    const manifest = JSON.parse(await readFile(join(profileDir, 'node_modules', name, 'package.json'), 'utf8'))
+    if (manifest.name !== name) throw new Error(`${name} resolves to ${JSON.stringify(manifest.name)}`)
+    versions.push(`${name}@${manifest.version}`)
+  }
+  console.log(`install-proof: both components installed: ${versions.join(' + ')}`)
+
+  const dump = (await run('dsh', ['--profile', PROFILE, '--dump-config'], { env })).stdout
+  for (const row of ROWS) assertRow(dump, row)
+  console.log('install-proof: dump-config rows:')
+  for (const { id, name } of ROWS) console.log(`  - id: ${id}\n    name: ${name}`)
+  console.log('install-proof: OK')
+} catch (error) {
+  console.error(`install-proof: FAILED: ${error instanceof Error ? error.message : String(error)}`)
+  process.exitCode = 1
+} finally {
+  if (work !== undefined) {
+    if (process.argv.includes('--keep')) console.log(`install-proof: kept ${work}`)
+    else await rm(work, { recursive: true, force: true })
+  }
+}