dsh-plugin-shop 0.8.6 → 0.8.7-beta.1

package/lib/index.js

@@ -21,7 +21,7 @@ import { isMap, isSeq, parseDocument } from "yaml";
 * both the source tree (tests) and the bundled `lib/index.js` sit exactly
 * one level below the package root, so the same relative URL resolves in
 * both. */
-function ownManifest() {
+function ownManifest$1() {
 	return JSON.parse(readFileSync(fileURLToPath(new URL("../package.json", import.meta.url)), "utf8"));
 }
 /**
@@ -48,7 +48,7 @@ function versionAtLoad(read) {
 }
 /** The version of the code in this process, read when the module was first
 * evaluated — at boot, before any self-update could rewrite the file. */
-const runningVersion = versionAtLoad(() => ownManifest().version);
+const runningVersion = versionAtLoad(() => ownManifest$1().version);
 /**
 * Which run of the code this is: drawn when the module is first evaluated,
 * fixed for the life of the process, and different in the next one.
@@ -70,7 +70,7 @@ const bootId = randomUUID();
 * compare against is worth a verdict.
 */
 function ownPeerRanges() {
-	const declared = ownManifest().peerDependencies;
+	const declared = ownManifest$1().peerDependencies;
 	if (declared === null || typeof declared !== "object") return {};
 	const ranges = {};
 	for (const [spec, range] of Object.entries(declared)) if (typeof range === "string") ranges[spec] = range;
@@ -649,9 +649,11 @@ const entrySchema = z.object({
 		profiles: z.array(z.string()).optional()
 	}).optional(),
 	dshPeers: z.record(z.string(), z.string()).optional(),
+	manifestVersion: z.string().optional(),
 	unpackedSize: z.number().int().nonnegative().optional(),
 	installSize: z.number().int().nonnegative().optional(),
-	archived: z.boolean().optional()
+	archived: z.boolean().optional(),
+	forked: z.boolean().optional()
 }).superRefine((entry, ctx) => {
 	if (entry.source === "npm") {
 		if (!NPM_NAME.test(entry.name)) ctx.addIssue({
@@ -1249,20 +1251,35 @@ function unmetProfile(declared, running, templates) {
 * could not tell".
 *
 * The rule is dsh's own (`check`, from the running app-boot), handed the
-* manifest dsh's installer reads before it installs a registry spec — `pnpm
-* view <spec> name version peerDependencies`, measured in dsh-plugin-manager
-* 0.1.7-rc.2 — with the catalog's `dshPeers` for the peers. Those are the
-* only peers the rule reads, verbatim. What this cannot see errs toward
-* silence, never toward a refusal dsh would not make: a malformed peer range
-* elsewhere in the manifest, which dsh rejects only after installing, and
-* the plugins a bundle's patch rows name, which it checks then too. Those
-* reach the reader as the install's own failure (`installFailureDetail`).
-*
-* npm entries only. dsh keys an exemption by the INSTALLED manifest's
-* `name@version`, and a github entry's catalog version is a commit: its
-* exemption status cannot be read, and a refusal named here could never be
-* cleared from the shop. dsh refuses such an install itself, and says how
-* to exempt it.
+* manifest dsh's installer judges (`ownManifest`): the name and version dsh
+* keys an exemption by, with the catalog's `dshPeers` for the peers. Those
+* are the only peers the rule reads, verbatim. Both channels are judged, each
+* by the manifest dsh reads for it:
+*
+* - An npm entry by its catalog `version`. dsh reads that manifest before it
+*   installs a registry spec: `pnpm view <spec> name version
+*   peerDependencies`, measured in dsh-plugin-manager 0.1.7-rc.2.
+* - A github entry by `manifestVersion`, the version of the manifest dsh
+*   installs: at the pinned commit (a subpackage's own), or in the release
+*   asset a rescued entry installs from. dsh skips a git or tarball spec
+*   before pnpm and judges the installed manifest after it, rolling the
+*   install back on a refusal (the same dsh-plugin-manager). The entry's
+*   catalog `version` is a commit or a tag, so without `manifestVersion` it
+*   is not judged at all: judged by its commit instead, it would miss an
+*   exemption the profile holds under its real `name@version`, disabling an
+*   install dsh accepts, and could offer no command, since `allow-version`
+*   records no commit (design 2026-09-28-bundle-components-and-github-peers,
+*   sections 6.1 and 7.3).
+*
+* dsh's key names no channel: an exemption recorded for one `name@version`
+* clears every entry whose manifest carries it, npm or github, here as in
+* dsh.
+*
+* What this cannot see errs toward silence, never toward a refusal dsh would
+* not make: a malformed peer range elsewhere in the manifest, which dsh
+* rejects only after installing, and the plugins a bundle's patch rows name,
+* which it checks then too. Those reach the reader as the install's own
+* failure (`installFailureDetail`).
 *
 * A throw from the check forms no verdict for that entry, as a resolver's
 * throw does in `incompatibilityMap`.
@@ -1270,14 +1287,11 @@ function unmetProfile(declared, running, templates) {
 function peerVerdictsOf(entries, check, exemptions, profile) {
 	const out = {};
 	for (const entry of entries) {
-		if (entry.source !== "npm" || entry.dshPeers === void 0) continue;
+		const manifest = ownManifest(entry);
+		if (manifest === null) continue;
 		let issue;
 		try {
-			issue = check.evaluate({
-				name: entry.name,
-				version: entry.version,
-				peerDependencies: entry.dshPeers
-			}, exemptions);
+			issue = check.evaluate(manifest, exemptions);
 		} catch {
 			continue;
 		}
@@ -1290,6 +1304,28 @@ function peerVerdictsOf(entries, check, exemptions, profile) {
 	}
 	return out;
 }
+/**
+* The manifest dsh judges an entry's install by, as `peerVerdictsOf` hands it
+* to the rule, or null when none can be formed: the entry declares no
+* harness peers, or it is a github entry with no `manifestVersion`. An npm
+* entry's catalog `version` is its manifest's; a github entry's is a commit
+* or a tag, so its manifest's own version is the one recorded beside its
+* peers, and the key is read on github entries only.
+*/
+function ownManifest(entry) {
+	if (entry.dshPeers === void 0) return null;
+	if (entry.source === "npm") return {
+		name: entry.name,
+		version: entry.version,
+		peerDependencies: entry.dshPeers
+	};
+	if (entry.manifestVersion === void 0) return null;
+	return {
+		name: entry.name,
+		version: entry.manifestVersion,
+		peerDependencies: entry.dshPeers
+	};
+}
 /** npm's package-name grammar as dsh's exemption records accept it, verbatim
 * from app-boot 0.1.7-rc.2 (`PACKAGE_NAME` in profile-compatibility). */
 const EXEMPTION_PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
@@ -1671,10 +1707,14 @@ const REFUSAL_WARNING_TAIL = " Running it may cause crashes or data loss.";
 /**
 * dsh's own refusal of an install (0.1.7 on) as one detail, or null when the
 * log holds none. The install was dsh's to refuse, not pnpm's to fail: it
-* refuses before pnpm runs, when it can read the manifest — a registry spec,
-* which the catalog's peer verdict already predicts — and after pnpm
-* succeeded otherwise, restoring the profile. Reading that as a pnpm failure
-* sent the reader to `dsh plugin install`, which repairs nothing.
+* refuses before pnpm runs, when it can read the manifest — a registry spec —
+* and after pnpm succeeded otherwise, restoring the profile. The catalog's
+* peer verdict predicts the first, and the second only for a github entry's
+* own peers, judged by the manifest version the catalog records
+* (`peerVerdictsOf`). It predicts no refusal of a bundle's components, and
+* none of a github entry that carries no usable manifest version: dsh makes
+* those after pnpm all the same. Reading any refusal as a pnpm failure sent
+* the reader to `dsh plugin install`, which repairs nothing.
 *
 * The detail is what dsh refused, what it restored, and the command that
 * records its exact-version exemption, rebuilt from what dsh printed through

package/lib/typert.host.js

@@ -50,9 +50,11 @@ const dsh_plugin_shop_shop_catalog_result$schema = z.object({
   'profiles': z.union([z.undefined(), z.array(z.string())]).optional(),
 })]).optional(),
   'dshPeers': z.union([z.undefined(), z.record(z.string(), z.string())]).optional(),
+  'manifestVersion': z.union([z.undefined(), z.string()]).optional(),
   'unpackedSize': z.union([z.undefined(), z.number()]).optional(),
   'installSize': z.union([z.undefined(), z.number()]).optional(),
   'archived': z.union([z.undefined(), z.literal(false), z.literal(true)]).optional(),
+  'forked': z.union([z.undefined(), z.literal(false), z.literal(true)]).optional(),
 })),
   'denied': z.array(z.object({
   'name': z.string(),
@@ -498,7 +500,7 @@ export const TYPERT = {
           },
           {
             "name": "CatalogEntry",
-            "declaration": "export interface CatalogEntry {\n    name: string;\n    version: string;\n    integrity: string | null;\n    publishedAt: string | null;\n    repository: string | null;\n    license: string | null;\n    tier: 'verified' | 'verified-stale' | 'community';\n    metadata: 'declared' | 'derived';\n    review?: { reviewedVersion?: string; reviewedCommit?: string; reviewedSha256?: string; repo?: string; reviewer: string; reviewCommit: string; notes: string; };\n    catalog?: CatalogSection;\n    source: 'npm' | 'github';\n    publisher?: string;\n    repo?: string;\n    subdir?: string;\n    tarball?: { url: string; sha256: string; };\n    added?: string;\n    peers?: string[];\n    compatibility?: { dsh?: string; profiles?: string[]; };\n    dshPeers?: Record<string, string>;\n    unpackedSize?: number;\n    installSize?: number;\n    archived?: boolean;\n}"
+            "declaration": "export interface CatalogEntry {\n    name: string;\n    version: string;\n    integrity: string | null;\n    publishedAt: string | null;\n    repository: string | null;\n    license: string | null;\n    tier: 'verified' | 'verified-stale' | 'community';\n    metadata: 'declared' | 'derived';\n    review?: { reviewedVersion?: string; reviewedCommit?: string; reviewedSha256?: string; repo?: string; reviewer: string; reviewCommit: string; notes: string; };\n    catalog?: CatalogSection;\n    source: 'npm' | 'github';\n    publisher?: string;\n    repo?: string;\n    subdir?: string;\n    tarball?: { url: string; sha256: string; };\n    added?: string;\n    peers?: string[];\n    compatibility?: { dsh?: string; profiles?: string[]; };\n    dshPeers?: Record<string, string>;\n    manifestVersion?: string;\n    unpackedSize?: number;\n    installSize?: number;\n    archived?: boolean;\n    forked?: boolean;\n}"
           },
           {
             "name": "CatalogSection",

package/lib/typert.remote-client.js

@@ -50,9 +50,11 @@ const dsh_plugin_shop_shop_catalog_result$schema = z.object({
   'profiles': z.union([z.undefined(), z.array(z.string())]).optional(),
 })]).optional(),
   'dshPeers': z.union([z.undefined(), z.record(z.string(), z.string())]).optional(),
+  'manifestVersion': z.union([z.undefined(), z.string()]).optional(),
   'unpackedSize': z.union([z.undefined(), z.number()]).optional(),
   'installSize': z.union([z.undefined(), z.number()]).optional(),
   'archived': z.union([z.undefined(), z.literal(false), z.literal(true)]).optional(),
+  'forked': z.union([z.undefined(), z.literal(false), z.literal(true)]).optional(),
 })),
   'denied': z.array(z.object({
   'name': z.string(),

package/lib/types/client/locales.d.ts

@@ -19,6 +19,14 @@ export declare const zh: {
     all: string;
     catalog: string;
     catalogStats: string;
+    /** The shelf's order control, and the date each card carries under the two
+     * date orders (design 2026-10-12-shelf-orders §4). */
+    sortLabel: string;
+    sortStars: string;
+    sortAdded: string;
+    sortUpdated: string;
+    listedOn: string;
+    updatedOn: string;
     stars: string;
     categoryTool: string;
     categoryProvider: string;
@@ -117,6 +125,13 @@ export declare const zh: {
     nameTakenDetail: string;
     npmSource: string;
     githubSource: string;
+    /** The accessible name and the tooltip of a card's version, which say which
+     * of three things the printed string is (market borrowings §11): the string
+     * alone cannot tell a release tag from a version number, and a short commit
+     * printed with a `v` read as one. */
+    npmVersionLabel: string;
+    commitVersionLabel: string;
+    releaseVersionLabel: string;
     /** The badge and the explanation for an installed github entry no catalog
      * row claims (C10 MVP). The mechanism synthesizes a row for ANY github spec
      * with no catalog row — shadowed by a same-named npm package, an unlisted
@@ -126,6 +141,8 @@ export declare const zh: {
     shadowedBadge: string;
     shadowedDetail: string;
     updatableSection: string;
+    /** `{version}` is the shelf's own version text (`versionLabel`), which
+     * carries the `v` an npm version takes and no other kind does. */
     installedVersion: string;
     latestVersion: string;
     update: string;
@@ -185,6 +202,14 @@ export declare const en: {
     all: string;
     catalog: string;
     catalogStats: string;
+    /** The shelf's order control, and the date each card carries under the two
+     * date orders (design 2026-10-12-shelf-orders §4). */
+    sortLabel: string;
+    sortStars: string;
+    sortAdded: string;
+    sortUpdated: string;
+    listedOn: string;
+    updatedOn: string;
     stars: string;
     categoryTool: string;
     categoryProvider: string;
@@ -259,6 +284,9 @@ export declare const en: {
     nameTakenDetail: string;
     npmSource: string;
     githubSource: string;
+    npmVersionLabel: string;
+    commitVersionLabel: string;
+    releaseVersionLabel: string;
     shadowedBadge: string;
     shadowedDetail: string;
     updatableSection: string;

package/lib/types/client/present.d.ts

@@ -134,10 +134,13 @@ export declare function readsIncompatible(blockers: readonly {
  *
  * The second is the one harness reason that blocks (design
  * 2026-09-26-dsh-017-readiness, B1, amending "warn, never block"): dsh 0.1.7
- * refuses the install itself, before pnpm runs, and the shop cannot install
- * past it. The verdict is dsh's own rule on the profile's own exemptions, so
- * a disabled button is dsh's answer given early, never the shop's opinion —
- * and recording the exemption the card shows is what enables it again.
+ * refuses the install itself, an npm entry before pnpm runs and a github
+ * entry after it, rolling the profile back, and the shop cannot install past
+ * it. The verdict is dsh's own rule on the profile's own exemptions, whichever
+ * channel the entry comes from (design
+ * 2026-09-28-bundle-components-and-github-peers, section 7.3), so a disabled
+ * button is dsh's answer given early, never the shop's opinion — and
+ * recording the exemption the card shows is what enables it again.
  */
 export declare function refusesInstall(blockers: readonly {
     kind: BlockerKind;
@@ -174,16 +177,47 @@ export declare const ACKNOWLEDGEMENT_ZH = "\u5B89\u88C5\u540E\uFF0C\u6B64\u63D2\
 /** Install rejection code → locale key, for the rejected-state code label
  * (§7.2): every rejection the host can return has a human label here. */
 export declare function rejectionCodeKey(code: InstallRejectionCode): ShopLocaleKey;
-/** The version a card displays: full for npm, the short commit for github. */
-export declare function displayVersion(entry: {
-    source: 'npm' | 'github';
-    version: string;
-}): string;
+/** What a shelf version string is (market borrowings §11): a version npm
+ * serves, or the spec a profile manifest holds for one; the commit a github
+ * entry is pinned to; or the tag of the release a rescued github entry
+ * installs from. */
+export type VersionKind = 'npm' | 'commit' | 'release';
+export interface VersionLabel {
+    kind: VersionKind;
+    /** What the shelf prints: `v1.2.3`, `4da5ae8`, `v0.29.10`. */
+    text: string;
+    /** What the accessible name and the tooltip print after the kind's word:
+     * the same string without the `v` the shelf adds to an npm version. */
+    value: string;
+}
+/**
+ * How a version string reads on the shelf, decided by its source and its
+ * shape alone (market borrowings §11).
+ *
+ * Shape, never the entry's `tarball`, because an installed row carries only
+ * the pin the shop recorded at install — the catalog `version` of that moment
+ * — and no `tarball`. The registry pins a commit as forty lowercase hex and a
+ * release by its tag, so the two shapes do not cross; `present.test.ts`
+ * checks that against the committed live catalog.
+ *
+ * - An npm version takes the `v` the shelf has always shown, and only before
+ *   a digit: an installed row reports the manifest's spec, and a range there
+ *   (`^1.2.3`) is not a version to prefix.
+ * - A commit is cut to the seven characters git abbreviates to, with no `v`:
+ *   it is not a version number.
+ * - A release tag prints exactly as tagged, never cut and never prefixed:
+ *   cutting `v0.29.10` to seven characters printed `v0.29.1`, another
+ *   version, and the `v` this function no longer adds doubled the tag's own.
+ */
+export declare function versionLabel(source: 'npm' | 'github', version: string): VersionLabel;
+/** The copy that names a version's kind, for the accessible name and the
+ * tooltip; its `{version}` takes {@link VersionLabel.value}. */
+export declare function versionLabelKey(kind: VersionKind): ShopLocaleKey;
 /** The hash pin a stale line names for a repo or release-rescued entry — the
  * reviewed commit, or the reviewed release tarball sha256 (market borrowings
- * §3.1). Shortened to 7 chars like the card's own version; '' only for a
- * hand-built fixture carrying no pin. The npm form is a version and keeps the
- * version line's `v` prefix instead. */
+ * §3.1). Shortened to 7 chars like a commit on the card; '' only for a
+ * hand-built fixture carrying no pin. The npm form is a version, which
+ * {@link versionLabel} prints instead. */
 export declare function reviewHashPin(review: NonNullable<CatalogEntry['review']>): string;
 /**
  * Whether the license value is the npm idiom `SEE LICENSE IN <file>` — a
@@ -321,6 +355,25 @@ export declare function nextVisibleCount(visible: number, total: number, batch:
  * view is tracking — a status for an install it never started (idle) is an
  * unrelated event and a no-op, like any other event it does not recognize. */
 export declare function reduceInstall(state: InstallView, event: InstallEvent): InstallView;
+/**
+ * Which order the shelf is in (design 2026-10-12-shelf-orders). `stars` is
+ * the default AND the tie-break of both date orders, so the two date orders
+ * are stable re-sorts of it rather than orders with comparators of their own.
+ */
+declare const SHELF_ORDER_KEYS: {
+    readonly stars: "sortStars";
+    readonly added: "sortAdded";
+    readonly updated: "sortUpdated";
+};
+/** The order vocabulary as a type, derived from the map above so the client
+ * never repeats the three literals. */
+export type ShelfOrder = keyof typeof SHELF_ORDER_KEYS;
+/** The three orders in display order (map insertion order). `readonly`: this
+ * is a shared vocabulary, and an order list a caller can push to is a bug
+ * waiting for its second caller. */
+export declare const SHELF_ORDERS: readonly ShelfOrder[];
+/** The locale key naming one order (the toggle's buttons). */
+export declare function shelfOrderLocaleKey(order: ShelfOrder): ShopLocaleKey;
 declare const CATEGORY_KEYS: {
     readonly tool: "categoryTool";
     readonly provider: "categoryProvider";
@@ -427,6 +480,31 @@ export declare function starsOf(entry: CatalogEntry, stars: Record<string, numbe
  * (case-insensitive) on ties (spec 2026-08-26-github-stars-design.md D1).
  * Display-time only — the catalog's own name sort is untouched. */
 export declare function sortByStars(entries: CatalogEntry[], stars: Record<string, number>): CatalogEntry[];
+/**
+ * The entry's sort key under a date order, or undefined when it has no usable
+ * date (design §3): absent, off-form, unparseable, or later than the catalog's
+ * own `builtAt`. Milliseconds since the epoch. `'stars'` carries no date, so
+ * this answers undefined for it.
+ */
+export declare function shelfTime(entry: CatalogEntry, order: ShelfOrder, builtAt: string): number | undefined;
+/**
+ * A UTC calendar day for display: "2026-10-12". Derived from the instant the
+ * sort ranked by, so a card's label and its position cannot disagree. UTC and
+ * never a local getter: a reader in UTC+8 must see the same days the catalog
+ * was built in, the calendar the stats row already prints.
+ */
+export declare function utcDay(ms: number): string;
+/**
+ * The shelf in `order` (design 2026-10-12-shelf-orders §2, §5). `'stars'`
+ * returns the array it was handed, so the default path allocates nothing and
+ * does not invalidate the memos downstream of it.
+ *
+ * Each key is computed ONCE per entry rather than inside the comparator, and
+ * the sort is stable (ES2019), so entries sharing a date keep the star order
+ * they arrived in — which is how the tie-break is defined without a second
+ * comparator that could drift from `sortByStars`.
+ */
+export declare function orderShelf(starOrdered: readonly CatalogEntry[], order: ShelfOrder, builtAt: string): readonly CatalogEntry[];
 /** 999 → "999"; 1000 → "1k"; 1234 → "1.2k"; 1500 → "1.5k"; 99999 → "100k". */
 export declare function formatStars(n: number): string;
 /**

package/lib/types/host/compatibility.d.ts

@@ -181,20 +181,35 @@ export declare function compatibilityMap(entries: readonly (EntryIdentity & {
  * could not tell".
  *
  * The rule is dsh's own (`check`, from the running app-boot), handed the
- * manifest dsh's installer reads before it installs a registry spec — `pnpm
- * view <spec> name version peerDependencies`, measured in dsh-plugin-manager
- * 0.1.7-rc.2 — with the catalog's `dshPeers` for the peers. Those are the
- * only peers the rule reads, verbatim. What this cannot see errs toward
- * silence, never toward a refusal dsh would not make: a malformed peer range
- * elsewhere in the manifest, which dsh rejects only after installing, and
- * the plugins a bundle's patch rows name, which it checks then too. Those
- * reach the reader as the install's own failure (`installFailureDetail`).
+ * manifest dsh's installer judges (`ownManifest`): the name and version dsh
+ * keys an exemption by, with the catalog's `dshPeers` for the peers. Those
+ * are the only peers the rule reads, verbatim. Both channels are judged, each
+ * by the manifest dsh reads for it:
  *
- * npm entries only. dsh keys an exemption by the INSTALLED manifest's
- * `name@version`, and a github entry's catalog version is a commit: its
- * exemption status cannot be read, and a refusal named here could never be
- * cleared from the shop. dsh refuses such an install itself, and says how
- * to exempt it.
+ * - An npm entry by its catalog `version`. dsh reads that manifest before it
+ *   installs a registry spec: `pnpm view <spec> name version
+ *   peerDependencies`, measured in dsh-plugin-manager 0.1.7-rc.2.
+ * - A github entry by `manifestVersion`, the version of the manifest dsh
+ *   installs: at the pinned commit (a subpackage's own), or in the release
+ *   asset a rescued entry installs from. dsh skips a git or tarball spec
+ *   before pnpm and judges the installed manifest after it, rolling the
+ *   install back on a refusal (the same dsh-plugin-manager). The entry's
+ *   catalog `version` is a commit or a tag, so without `manifestVersion` it
+ *   is not judged at all: judged by its commit instead, it would miss an
+ *   exemption the profile holds under its real `name@version`, disabling an
+ *   install dsh accepts, and could offer no command, since `allow-version`
+ *   records no commit (design 2026-09-28-bundle-components-and-github-peers,
+ *   sections 6.1 and 7.3).
+ *
+ * dsh's key names no channel: an exemption recorded for one `name@version`
+ * clears every entry whose manifest carries it, npm or github, here as in
+ * dsh.
+ *
+ * What this cannot see errs toward silence, never toward a refusal dsh would
+ * not make: a malformed peer range elsewhere in the manifest, which dsh
+ * rejects only after installing, and the plugins a bundle's patch rows name,
+ * which it checks then too. Those reach the reader as the install's own
+ * failure (`installFailureDetail`).
  *
  * A throw from the check forms no verdict for that entry, as a resolver's
  * throw does in `incompatibilityMap`.
@@ -202,6 +217,7 @@ export declare function compatibilityMap(entries: readonly (EntryIdentity & {
 export declare function peerVerdictsOf(entries: readonly (EntryIdentity & {
     version: string;
     dshPeers?: Record<string, string>;
+    manifestVersion?: string;
 })[], check: PeerCheck, exemptions: Record<string, string[]>, profile: string): Record<string, PeerVerdict>;
 /**
  * The command that records dsh's exact-version exemption for one refused

package/lib/types/host/types.d.ts

@@ -78,12 +78,26 @@ export interface CatalogEntry {
     /** The package's peers on the harness itself (`@deepseek-ai/dsh` and
      * `@deepseek-ai/dsh-*`) with their ranges verbatim, optional ones and empty
      * ranges included — what dsh 0.1.7 refuses an install on. The host hands
-     * them to the running dsh's own check (`peerVerdictsOf`). npm entries only:
-     * dsh keys the exemption that clears its refusal by the installed
-     * manifest's version, which a github entry's catalog version is not
-     * (registry `Entry.dshPeers`). Absent when the package declares none, or
-     * when its catalog predates the field. */
+     * them to the running dsh's own check (`peerVerdictsOf`) on both channels:
+     * an npm entry is judged by its catalog `version`, a github entry by
+     * {@link manifestVersion}, because dsh keys the exemption that clears its
+     * refusal by the installed manifest's version, which a github entry's
+     * catalog version is not (registry `Entry.dshPeers`; design
+     * 2026-09-28-bundle-components-and-github-peers, section 7.3). Absent when
+     * the package declares none, or when its catalog predates the field; on a
+     * github entry also when its manifest names no usable version, since both
+     * keys drop together, and until the registry re-reads its repository under
+     * the rule that records them. */
     dshPeers?: Record<string, string>;
+    /** A github entry's installed manifest `version` (registry
+     * `Entry.manifestVersion`): the version dsh keys an exemption by, where the
+     * entry's catalog `version` is a commit or a release tag. Present exactly
+     * when a github entry's {@link dshPeers} is. An npm entry's own `version` is
+     * its manifest's, so `peerVerdictsOf` never reads this key on one, and a
+     * github entry without it is not judged at all (design
+     * 2026-09-28-bundle-components-and-github-peers, section 7.3). Absent when
+     * the catalog predates the field. */
+    manifestVersion?: string;
     /** Wire-compatibility key, not a field to read — see {@link installSize},
      * which the catalog parse fills from this one. It names npm's OWN quantity
      * (`dist.unpackedSize`), so it is npm-only and the parse REFUSES one on a
@@ -113,6 +127,11 @@ export interface CatalogEntry {
      * §1.3). github entries only, additive and optional: the shelf badges it
      * and nothing else — install, update, and enable are unchanged. */
     archived?: boolean;
+    /** Whether GitHub reports the repository as a fork (design 2026-10-11
+     * §1.1). github entries only, additive and optional, and informative:
+     * nothing reads it here yet — it is telemetry the catalog publishes, not a
+     * gate, a badge, or an install decision. */
+    forked?: boolean;
 }
 export interface DeniedEntry {
     name: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-shop",
-  "version": "0.8.6",
+  "version": "0.8.7-beta.1",
   "description": "The DeepSeek Harness plugin shop: browse, install, enable, and update dsh plugins from a git-auditable catalog.",
   "keywords": [
     "dsh-plugin",