dsh-plugin-shop 0.7.4 → 0.8.0-beta.0

package/lib/typert.host.js

@@ -55,6 +55,9 @@ const dsh_plugin_shop_shop_catalog_result$schema = z.object({
 })
 const dsh_plugin_shop_shop_installed_result$schema = z.array(z.object({
   'name': z.string(),
+  'source': z.union([z.literal("npm"), z.literal("github")]),
+  'repo': z.union([z.undefined(), z.string()]).optional(),
+  'subdir': z.union([z.undefined(), z.string()]).optional(),
   'installed': z.string(),
   'latest': z.string(),
   'outdated': z.boolean(),
@@ -64,13 +67,16 @@ const dsh_plugin_shop_shop_installStart_parameter_0$schema = z.object({
   'name': z.string(),
   'version': z.string(),
   'acknowledged': z.union([z.undefined(), z.literal(false), z.literal(true)]).optional(),
+  'source': z.union([z.undefined(), z.literal("npm"), z.literal("github")]).optional(),
+  'repo': z.union([z.undefined(), z.string()]).optional(),
+  'subdir': z.union([z.undefined(), z.string()]).optional(),
 })
 const dsh_plugin_shop_shop_installStart_result$schema = z.union([z.object({
   'ok': z.literal(true),
   'installId': z.string(),
 }), z.object({
   'ok': z.literal(false),
-  'code': z.union([z.literal("not-in-catalog"), z.literal("denied"), z.literal("version-mismatch"), z.literal("needs-acknowledgement"), z.literal("tarball-integrity")]),
+  'code': z.union([z.literal("not-in-catalog"), z.literal("denied"), z.literal("version-mismatch"), z.literal("needs-acknowledgement"), z.literal("tarball-integrity"), z.literal("ambiguous-identity")]),
   'detail': z.string(),
 })])
 const dsh_plugin_shop_shop_installStatus_parameter_0$schema = z.object({
@@ -155,7 +161,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopCatalogResult',
         schema: dsh_plugin_shop_shop_catalog_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":577,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":678,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installed',
@@ -170,7 +176,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop#shop/installed:result',
         schema: dsh_plugin_shop_shop_installed_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":763,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":863,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStart',
@@ -196,7 +202,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallResult',
         schema: dsh_plugin_shop_shop_installStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":628,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":726,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStatus',
@@ -221,7 +227,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallStatusResult',
         schema: dsh_plugin_shop_shop_installStatus_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":752,"column":3},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":852,"column":3},
     },
     {
       id: 'dsh-plugin-shop#shop/restart',
@@ -236,7 +242,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopRestartResult',
         schema: dsh_plugin_shop_shop_restart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":913,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":1021,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/setEnabled',
@@ -261,7 +267,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopSetEnabledResult',
         schema: dsh_plugin_shop_shop_setEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":469,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":535,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/uninstallStart',
@@ -287,7 +293,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUninstallResult',
         schema: dsh_plugin_shop_shop_uninstallStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":855,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":956,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/updateStart',
@@ -312,7 +318,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUpdateResult',
         schema: dsh_plugin_shop_shop_updateStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":981,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":1106,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/version',
@@ -327,7 +333,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopVersionResult',
         schema: dsh_plugin_shop_shop_version_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":964,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":1089,"column":9},
     },
   ],
   model: {
@@ -433,11 +439,11 @@ export const TYPERT = {
           },
           {
             "name": "InstallArgs",
-            "declaration": "export interface InstallArgs {\n    name: string;\n    version: string;\n    acknowledged?: boolean;\n}"
+            "declaration": "export interface InstallArgs {\n    name: string;\n    version: string;\n    acknowledged?: boolean;\n    source?: 'npm' | 'github';\n    repo?: string;\n    subdir?: string;\n}"
           },
           {
             "name": "InstallRejectionCode",
-            "declaration": "export type InstallRejectionCode = 'not-in-catalog' | 'denied' | 'version-mismatch' | 'needs-acknowledgement' | 'tarball-integrity';"
+            "declaration": "export type InstallRejectionCode = 'not-in-catalog' | 'denied' | 'version-mismatch' | 'needs-acknowledgement' | 'tarball-integrity' | 'ambiguous-identity';"
           },
           {
             "name": "InstallState",
@@ -457,7 +463,7 @@ export const TYPERT = {
           },
           {
             "name": "ShopInstalledEntry",
-            "declaration": "export interface ShopInstalledEntry {\n    name: string;\n    installed: string;\n    latest: string;\n    outdated: boolean;\n    enabled: boolean;\n}"
+            "declaration": "export interface ShopInstalledEntry {\n    name: string;\n    source: 'npm' | 'github';\n    repo?: string;\n    subdir?: string;\n    installed: string;\n    latest: string;\n    outdated: boolean;\n    enabled: boolean;\n}"
           },
           {
             "name": "ShopInstallResult",

package/lib/typert.remote-client.js

@@ -55,6 +55,9 @@ const dsh_plugin_shop_shop_catalog_result$schema = z.object({
 })
 const dsh_plugin_shop_shop_installed_result$schema = z.array(z.object({
   'name': z.string(),
+  'source': z.union([z.literal("npm"), z.literal("github")]),
+  'repo': z.union([z.undefined(), z.string()]).optional(),
+  'subdir': z.union([z.undefined(), z.string()]).optional(),
   'installed': z.string(),
   'latest': z.string(),
   'outdated': z.boolean(),
@@ -64,13 +67,16 @@ const dsh_plugin_shop_shop_installStart_parameter_0$schema = z.object({
   'name': z.string(),
   'version': z.string(),
   'acknowledged': z.union([z.undefined(), z.literal(false), z.literal(true)]).optional(),
+  'source': z.union([z.undefined(), z.literal("npm"), z.literal("github")]).optional(),
+  'repo': z.union([z.undefined(), z.string()]).optional(),
+  'subdir': z.union([z.undefined(), z.string()]).optional(),
 })
 const dsh_plugin_shop_shop_installStart_result$schema = z.union([z.object({
   'ok': z.literal(true),
   'installId': z.string(),
 }), z.object({
   'ok': z.literal(false),
-  'code': z.union([z.literal("not-in-catalog"), z.literal("denied"), z.literal("version-mismatch"), z.literal("needs-acknowledgement"), z.literal("tarball-integrity")]),
+  'code': z.union([z.literal("not-in-catalog"), z.literal("denied"), z.literal("version-mismatch"), z.literal("needs-acknowledgement"), z.literal("tarball-integrity"), z.literal("ambiguous-identity")]),
   'detail': z.string(),
 })])
 const dsh_plugin_shop_shop_installStatus_parameter_0$schema = z.object({
@@ -152,7 +158,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopCatalogResult',
         schema: dsh_plugin_shop_shop_catalog_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":577,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":678,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installed',
@@ -167,7 +173,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop#shop/installed:result',
         schema: dsh_plugin_shop_shop_installed_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":763,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":863,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStart',
@@ -193,7 +199,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallResult',
         schema: dsh_plugin_shop_shop_installStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":628,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":726,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStatus',
@@ -218,7 +224,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallStatusResult',
         schema: dsh_plugin_shop_shop_installStatus_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":752,"column":3},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":852,"column":3},
     },
     {
       id: 'dsh-plugin-shop#shop/restart',
@@ -233,7 +239,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopRestartResult',
         schema: dsh_plugin_shop_shop_restart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":913,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":1021,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/setEnabled',
@@ -258,7 +264,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopSetEnabledResult',
         schema: dsh_plugin_shop_shop_setEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":469,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":535,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/uninstallStart',
@@ -284,7 +290,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUninstallResult',
         schema: dsh_plugin_shop_shop_uninstallStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":855,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":956,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/updateStart',
@@ -309,7 +315,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUpdateResult',
         schema: dsh_plugin_shop_shop_updateStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":981,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":1106,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/version',
@@ -324,7 +330,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopVersionResult',
         schema: dsh_plugin_shop_shop_version_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":964,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":1089,"column":9},
     },
   ],
 }

package/lib/types/client/index.d.ts

@@ -15,6 +15,9 @@ declare module '@deepseek-ai/dsh-client-ui-slots' {
 }
 /** Dictionary namespace owned by this plugin. */
 export declare const NS = "settings.shop";
+/** How long a stashed catalog may satisfy a plain open. The host applies the
+ * same five-minute freshness window, so the client stash must not outlive it. */
+export declare const WARM_TTL_MS: number;
 /** Services required by the tab registration and the Remote mount.
  *
  * `remote.shop` is deliberately ABSENT: this package both mounts its own

package/lib/types/client/locales.d.ts

@@ -57,6 +57,7 @@ export declare const zh: {
     versionMismatchCode: string;
     needsAcknowledgementCode: string;
     tarballIntegrityCode: string;
+    ambiguousIdentityCode: string;
     npmSource: string;
     githubSource: string;
     installedSection: string;
@@ -148,6 +149,7 @@ export declare const en: {
     versionMismatchCode: string;
     needsAcknowledgementCode: string;
     tarballIntegrityCode: string;
+    ambiguousIdentityCode: string;
     npmSource: string;
     githubSource: string;
     installedSection: string;

package/lib/types/client/present.d.ts

@@ -2,6 +2,7 @@
  * timers, no I/O: every function here maps a value to a value, so fixtures
  * drive all of it. */
 export { isShopLike } from '../shared/shop-like.ts';
+export { identityKey, installedSpecMatches, parseRepoSpec, type EntryIdentity } from '../shared/identity.ts';
 import type { ShopLocaleKey } from './locales.ts';
 import type { CatalogEntry, HotRestartReason, InstallRejectionCode } from '../host/index.ts';
 /** Hot-mount reason code → locale key, so the notice reads in the language
@@ -12,8 +13,9 @@ export declare function restartReasonKey(reason: HotRestartReason | undefined):
 export declare function tierKey(tier: CatalogEntry['tier']): ShopLocaleKey;
 /** The peers the Host said this installation does not provide, or none when it
  * said nothing — a plugin that runs here and one the Host could not judge are
- * both rendered as no warning at all. */
-export declare function missingPeersOf(incompatible: Record<string, string[]>, name: string): string[];
+ * both rendered as no warning at all. The map is keyed by install identity,
+ * never by name, because two entries can share a name. */
+export declare function missingPeersOf(incompatible: Record<string, string[]>, key: string): string[];
 /** Spec §9.3 verbatim — the community-tier acknowledgement. The zh dictionary
  * states the same facts in its own register; never soften this wording. */
 export declare const ACKNOWLEDGEMENT_EN = "Once installed, this plugin holds the same privileges as a built-in one: reading and writing your files, running shell commands, and reading and modifying the requests sent to the model. It has not been reviewed.";

package/lib/types/client/useInstall.d.ts

@@ -21,3 +21,21 @@ export declare function usePollStatus(view: InstallView, setView: Dispatch<SetSt
 export declare function useInstall(install: (args: InstallArgs) => Promise<ShopInstallResult>, installStatus: (args: {
     installId: string;
 }) => Promise<ShopInstallStatusResult>): UseInstallResult;
+/** One entry's install flow, as the tab hands it to a panel. */
+export interface InstallFlow {
+    view: InstallView;
+    start: (args: InstallArgs) => Promise<void>;
+    reset: () => void;
+}
+export interface UseInstallFlows {
+    /** Two panels asking for the same install identity receive one flow. */
+    flowFor: (key: string) => InstallFlow;
+}
+/**
+ * Install flows owned by the tab and keyed by install identity. Keeping the
+ * state above individual cards preserves a running operation when filtering
+ * unmounts its card, and makes the shelf and Outdated panels agree.
+ */
+export declare function useInstallFlows(install: (args: InstallArgs) => Promise<ShopInstallResult>, installStatus: (args: {
+    installId: string;
+}) => Promise<ShopInstallStatusResult>, onSettled?: (key: string) => void): UseInstallFlows;

package/lib/types/host/executor.d.ts

@@ -45,6 +45,22 @@ export declare function installFailureDetail(profile: string, log: readonly stri
  * 2026-09-02 as "Update failed / dsh not found on PATH" on a working install.
  */
 export declare function spawnFailureDetail(code: string | undefined, message: string, dshBin: string, platform: NodeJS.Platform): string;
+/** The failure detail for a command stopped by the shop's deadline. */
+export declare function installTimeoutDetail(profile: string, timeoutMs: number): string;
+/** Kill primitives injected by tests so both platform branches are testable. */
+export interface KillFns {
+    killGroup: (pid: number) => void;
+    killPid: (pid: number) => void;
+    taskkill: (pid: number) => void;
+}
+/** Kill a child and its descendants (process group on POSIX, taskkill tree on Windows). */
+export declare function killTree(pid: number | undefined, platform: NodeJS.Platform, kills?: KillFns): void;
+/** One stream's line assembler, retaining partial UTF-8 and text lines. */
+export interface LineSink {
+    write: (chunk: Buffer) => void;
+    flush: () => void;
+}
+export declare function lineSink(emit: (line: string) => void): LineSink;
 /**
  * Run one `dsh plugin --profile <profile> add <spec>` and track it.
  * When `expectedName` is given, a zero exit is confirmed against the profile
@@ -62,6 +78,7 @@ export declare function startInstall(options: {
         restartReason?: HotRestartReason;
     } | void>;
     onStatus?: (status: InstallStatus) => void;
+    timeoutMs?: number;
 }): RunningInstall;
 /**
  * Run one `dsh plugin --profile <profile> remove <name>` and track it.
@@ -81,5 +98,6 @@ export declare function startUninstall(options: {
         restartReason?: HotRestartReason;
     } | void>;
     onStatus?: (status: InstallStatus) => void;
+    timeoutMs?: number;
 }): RunningInstall;
 export {};

package/lib/types/host/hot.d.ts

@@ -91,6 +91,11 @@ export interface HotFs {
  * nothing in the patch is evaluated. Pure: string in, rows out.
  */
 export declare function parseSimplePatch(patchText: string): HotRow[] | null;
+/** Render the accepted rows with prefixed ids — the exact input file the
+ * Include tree mounts. Only values the line scan accepted are emitted, and
+ * the output is itself a simple patch (round-trips through
+ * parseSimplePatch). */
+export declare function renderRows(rows: HotRow[], prefix: string): string;
 /**
  * Mount one installed package into the running composition through an
  * Include subtree: read its bundle patch, replicate the simple rows under

package/lib/types/host/index.d.ts

@@ -8,7 +8,7 @@ import { type InstallStatus } from './executor.ts';
 import { hotMount, hotUnmount } from './hot.ts';
 import { type RestartOutcome } from './restart.ts';
 import { type RepoPinFs } from './repo-pins.ts';
-import { type PeerResolver } from './peers.ts';
+import { type PeerResolver, type PeerVersionResolver } from './peers.ts';
 export type { InstallArgs, InstallRejectionCode } from './install.ts';
 export type { HotRestartReason } from './hot.ts';
 export type { CatalogEntry } from './types.ts';
@@ -66,6 +66,9 @@ export interface ShopGatewayOptions {
     /** The dsh argv this process was launched with, for `shop/restart`;
      * defaults to the real `process.argv` minus node and the script path. */
     restartArgv?: string[];
+    /** The JS entry `shop/restart` re-runs; defaults to `process.argv[1]`, the
+     * script this dsh was started with. */
+    restartScript?: string;
     /** Test-only injection: the exit the restart calls after the response is
      * delivered. Production uses `process.exit`. */
     exit?: (code?: number) => void;
@@ -97,6 +100,12 @@ export interface ShopGatewayOptions {
     /** Test-only injection: answers whether a peer resolves. Production builds
      * one from the profile anchor. */
     resolvePeer?: PeerResolver;
+    /** Test-only injection: answers which version a peer resolves at, for the
+     * load-time self-check. Production builds one from the profile anchor. */
+    resolvePeerVersion?: PeerVersionResolver;
+    /** Test-only injection: the peer ranges the self-check judges against;
+     * production reads them from the shipped package.json. */
+    peerRanges?: Record<string, string>;
 }
 /** `shop/installStart` result (§7.3): rejections are typed wire values with an
  * author-readable `detail`, not thrown RPC errors. */
@@ -152,14 +161,15 @@ export type ShopUpdateResult = {
     ok: false;
     detail: string;
 };
-/** `shop/installed` entry (§7.3): one installed catalog plugin. `installed`
- * is the profile manifest's dependency spec verbatim (a range, a tag, or
- * `workspace:*`) — for a github entry it is the pinned commit the shop
- * installed, falling back to the `github:owner/slug` spec when the pin is
- * unknown; `outdated` is the Host's verdict that the installed version sits
- * behind the catalog's — the client never does version math. */
+/** `shop/installed` entry (§7.3): one installed catalog plugin. The identity
+ * fields distinguish same-named npm and GitHub rows; `installed` remains the
+ * manifest spec or the recorded GitHub pin, and the client never does version
+ * math. */
 export interface ShopInstalledEntry {
     name: string;
+    source: 'npm' | 'github';
+    repo?: string;
+    subdir?: string;
     installed: string;
     latest: string;
     outdated: boolean;
@@ -192,9 +202,10 @@ export interface ShopCatalogResult {
     /** GitHub star counts by package name; {} when the pointer names no sidecar
      * or the sidecar could not be fetched/verified (§5). */
     stars: Record<string, number>;
-    /** Package name → the declared peers this installation does not provide
-     * (design 2026-09-01). A name is absent when the plugin runs here or when
-     * no verdict could be formed; the client renders nothing for both. */
+    /** Install identity (`npm:<name>` / `github:<repo>#<subdir>`) → the declared
+     * peers this installation does not provide. A key is absent when the plugin
+     * runs here or when no verdict could be formed; same-named entries stay
+     * independent. */
     incompatible: Record<string, string[]>;
 }
 /** Remote-only service exposing the shop Remote methods of §7.3.
@@ -213,6 +224,8 @@ export declare class ShopGateway extends TypertRemoteService {
     /** The argv `shop/restart` re-spawns: the real process argv minus node and
      * the CLI script path, or a test-provided substitute. */
     private readonly restartArgv;
+    /** The script the restart re-runs — this process's own entry. */
+    private readonly restartScript;
     /** The exit the restart calls once the response is out; `process.exit` in
      * production, a spy in tests. */
     private readonly exit;
@@ -242,9 +255,14 @@ export declare class ShopGateway extends TypertRemoteService {
     /** The install gate runs against the last loaded snapshot, never a fresh
      * fetch per request (§7.2: the Host's cached snapshot is the truth). */
     private lastSnapshot;
+    /** A cold-cache catalog load shared by concurrent RPC calls. */
+    private inFlightLoad;
     /** The origin list built for the last-seen `catalogUrl`, memoised so the
      * user's npmrc is read at most once per gateway (see `originsFor`). */
     private originCache;
+    /** The user's own `registry=` from `~/.npmrc`, read at most once per
+     * gateway. A wrapper distinguishes a genuine `null` from an unread value. */
+    private npmRegistryCache;
     /** The incompatibility map already computed for `lastSnapshot`, keyed by
      * that snapshot's own object identity. Design §3 asks for the verdict
      * once per loaded snapshot, not once per RPC call: `loadCatalog` serves
@@ -260,6 +278,13 @@ export declare class ShopGateway extends TypertRemoteService {
     /** Every install id in insertion order, oldest first; finished-record eviction walks this from the front. */
     private readonly installOrder;
     constructor(ctx: Context, options?: ShopGatewayOptions);
+    /**
+     * Warn once, at load, about any declared peer the harness provides outside
+     * its declared range. Advisory by construction: it cannot throw, and it
+     * never refuses the load — losing the whole shop is a worse outcome than
+     * running against a harness that moved.
+     */
+    private checkPeerVersions;
     /** The pins file lives in the shop's own cache, next to the catalog cache. */
     private pinsPath;
     /** The boot's Loader root directory (the active profile's `cordis.yml`
@@ -301,10 +326,17 @@ export declare class ShopGateway extends TypertRemoteService {
         enabled: boolean;
     }): Promise<ShopSetEnabledResult>;
     private rowConfig;
+    /** The user's own registry, read once. The self-update check and catalog
+     * race share this preference so neither path repeatedly touches ~/.npmrc. */
+    private npmRegistry;
     /** The origins to race for this row's catalog. Read once per gateway: the
      * user's npmrc does not change under a running dsh, and re-reading it on
      * every catalog call would put a filesystem read on the hot path. */
     private originsFor;
+    /** Join an in-flight load; refresh requests always start a new load. */
+    private loadCatalogOnce;
+    /** Return the current snapshot, loading it once when needed. */
+    private snapshotNow;
     /** The explicit restart override. Only the row's `config:` sub-object is
      * passed to a plugin — a top-level `allowRestart:` beside `name:` would be
      * silently ignored by the loader (dsh-market README, #227). */
@@ -326,6 +358,8 @@ export declare class ShopGateway extends TypertRemoteService {
      * oldest finished ones (insertion order, oldest first). Running records
      * are never evicted; an id absent from the map reports `found: false`. */
     private evictFinishedInstalls;
+    /** Whether any command this gateway started is still running. */
+    private hasRunningCommand;
     /** Poll one install's progress (§7.2); unknown ids report `found: false`. */
     installStatus(args: {
         installId: string;

package/lib/types/host/install.d.ts

@@ -1,21 +1,24 @@
 /** Install gate: the gate rejection paths of §7.2, as a pure function. */
 import type { CatalogSnapshot } from './catalog.ts';
-export type InstallRejectionCode = 'not-in-catalog' | 'denied' | 'version-mismatch' | 'needs-acknowledgement' | 'tarball-integrity';
+import type { CatalogEntry } from './types.ts';
+export type InstallRejectionCode = 'not-in-catalog' | 'denied' | 'version-mismatch' | 'needs-acknowledgement' | 'tarball-integrity' | 'ambiguous-identity';
 export interface InstallArgs {
     name: string;
     version: string;
     acknowledged?: boolean;
+    /** Optional identity fields keep old clients readable while refusing an
+     * ambiguous name-only request when the catalog has duplicate names. */
+    source?: 'npm' | 'github';
+    repo?: string;
+    subdir?: string;
 }
 export type ValidateResult = {
     ok: true;
+    entry: CatalogEntry;
 } | {
     ok: false;
     code: InstallRejectionCode;
     detail: string;
 };
-/**
- * Decide whether one install request may proceed, against the Host's own
- * snapshot (§5.3). The browser sends a name; nothing the browser says about
- * the package is trusted.
- */
+/** Decide whether an install request may proceed and return the resolved row. */
 export declare function validateInstall(snapshot: CatalogSnapshot, args: InstallArgs): ValidateResult;

package/lib/types/host/npm-origin.d.ts

@@ -5,6 +5,10 @@
  * bytes reach a China-side machine at 12.53 MB/s from npmmirror against
  * 0.03 MB/s from GitHub Pages. */
 import { type CatalogOrigin } from './origin.ts';
+/** Maximum compressed package bytes read from a registry. */
+export declare const MAX_PACKAGE_BYTES: number;
+/** Maximum bytes allowed after gzip inflation. */
+export declare const MAX_INFLATED_BYTES: number;
 /** Normalise to a trailing slash so relative `URL` resolution against a
  * registry that carries a path — every corporate registry, e.g.
  * `https://artifactory.corp/api/npm/npm-repo` — keeps that path instead of

package/lib/types/host/origin.d.ts

@@ -20,7 +20,7 @@ export interface OriginHandle {
     /** One file named by the pointer, by the pointer's own raw url string.
      * Callers pass that string verbatim — never a basename, which would strip
      * a hostile absolute url into a fetchable relative one. */
-    file: (url: string) => Promise<string>;
+    file: (url: string, signal?: AbortSignal) => Promise<string>;
 }
 export interface CatalogOrigin {
     readonly id: string;
@@ -36,5 +36,11 @@ export interface CatalogOrigin {
  * before the string could be inspected, so only comparing the resolved URL's
  * origin to the base's closes every spelling class. */
 export declare function resolveDataUrl(baseUrl: string, url: string): string;
+/** The largest catalog body this host reads into memory. */
+export declare const MAX_BODY_BYTES: number;
+/** Read a response body through a byte cap, converting transport failures. */
+export declare function readCappedBytes(response: Response, label: string, maxBytes?: number): Promise<Buffer>;
+/** Read a capped response body as UTF-8 text. */
+export declare function readCappedText(response: Response, label: string, maxBytes?: number): Promise<string>;
 /** The transport this project has always used: a static `v1/` tree. */
 export declare function httpOrigin(baseUrl: string, fetchImpl: typeof fetch): CatalogOrigin;

package/lib/types/host/peers.d.ts

@@ -1,5 +1,8 @@
 /** Harness compatibility: which declared peers the running installation does
- * not provide (design 2026-09-01-harness-compatibility). */
+ * not provide (design 2026-09-01-harness-compatibility), and — for the
+ * shop's OWN declared peers — which ones it provides at a version outside
+ * the declared range. */
+import { type EntryIdentity } from '../shared/identity.ts';
 /** Answers "can this installation provide `spec`?" — injected so fixtures
  * drive every verdict and exactly one call site touches the filesystem. */
 export type PeerResolver = (spec: string) => boolean;
@@ -19,7 +22,75 @@ export declare function nodeResolver(baseUrl: string): PeerResolver;
  * never read as an accusation, because one false warning teaches a reader to
  * ignore every warning.
  */
-export declare function incompatibilityMap(entries: readonly {
-    name: string;
+export declare function incompatibilityMap(entries: readonly (EntryIdentity & {
     peers?: string[];
-}[], resolve: PeerResolver): Record<string, string[]>;
+})[], resolve: PeerResolver): Record<string, string[]>;
+/**
+ * The same question one step further on: which VERSION does this
+ * installation provide for `spec`? `null` is the no-verdict signal — the
+ * peer is absent, or its manifest could not be read. Injected exactly like
+ * `PeerResolver`, so fixtures drive every verdict and only one call site
+ * touches the filesystem.
+ */
+export type PeerVersionResolver = (spec: string) => string | null;
+/** One declared peer whose provided version is outside its declared range. */
+export interface PeerVersionMismatch {
+    spec: string;
+    /** The range this build declares in `peerDependencies`. */
+    range: string;
+    /** The version the installation actually provides. */
+    found: string;
+}
+/**
+ * The production resolver: `nodeResolver`'s own resolution, kept this time
+ * instead of collapsed to a boolean. Anything that leaves no version to read
+ * answers null — a peer that is absent, one that restricts `./package.json`
+ * in its exports, an unreadable or malformed manifest, a manifest with no
+ * `version`. Absence is deliberately NOT reported as a version violation:
+ * `incompatibilityMap` is what covers a missing peer.
+ */
+export declare function nodeVersionResolver(baseUrl: string): PeerVersionResolver;
+/**
+ * The declared peers whose provided version is outside the declared range,
+ * ordered by peer name. Pure: the module graph arrives through `resolve`.
+ *
+ * `includePrerelease` is load-bearing, not a convenience. The harness ships
+ * nothing but `-rc` versions, so under strict semver `^0.1.1-rc.2` excludes
+ * `0.1.2-rc.1` — the version that is installed and works — and every future
+ * rc bump would raise a false alarm. With it on, the range still excludes an
+ * older prerelease (`0.1.1-rc.1`) and a minor- or major-line move
+ * (`0.2.0-rc.1`, `1.0.0`), which are the moves that actually break a plugin
+ * path. Discrimination on both sides is the whole point: one false warning
+ * teaches a reader to ignore every warning.
+ *
+ * Anything unreadable yields NO verdict for that peer and never a violation:
+ * a resolver that answers null or throws, a found version that is not
+ * semver, a declared range semver cannot parse. The other peers are still
+ * judged.
+ */
+export declare function peerVersionMismatches(ranges: Readonly<Record<string, string>>, resolve: PeerVersionResolver): PeerVersionMismatch[];
+/**
+ * The load-time message for a set of mismatches, or null when there is
+ * nothing to say. Every mismatch is named with its declared range and the
+ * version found, in ONE message: the reader needs the whole picture in the
+ * line they will scroll past, and the message says the shop still loads
+ * because refusing to load would cost them the shop over a diagnostic.
+ */
+export declare function peerVersionWarning(mismatches: readonly PeerVersionMismatch[]): string | null;
+/** What a load-time check needs: the ranges this build declares, a way to
+ * read what the installation provides, and somewhere to say it once. */
+export interface PeerVersionCheckDeps {
+    ranges: Readonly<Record<string, string>>;
+    resolve: PeerVersionResolver;
+    warn: (message: string) => void;
+}
+/**
+ * A self-check that warns AT MOST ONCE, however many times it is called.
+ * The guard is what keeps a diagnostic a diagnostic: a message repeated per
+ * call is noise a reader learns to skip, and the shop's load path is not the
+ * only place that could reasonably ask this question.
+ *
+ * It never throws. A check that could fail a load would be worse than the
+ * mismatch it reports — the user would lose the whole shop over a warning.
+ */
+export declare function createPeerVersionCheck(deps: PeerVersionCheckDeps): () => void;