dsh-standards 0.0.2 → 1.0.0

package/40-checker/src/label.mjs

@@ -0,0 +1,130 @@
+/**
+ * Label primitives: canonical hash, schema-level checks, and effective status.
+ * A label is an immutable evidence record. It is not a grade or a ranking.
+ */
+import crypto from 'node:crypto'
+
+const LEVELS = new Set(['entry', 'flow', 'boost'])
+const STATUS = {
+  entry: new Set(['recognized', 'static', 'runtime', 'blocked', 'failed', 'not-run', 'stale', 'withdrawn', 'not-applicable']),
+  flow: new Set(['manual', 'runtime', 'failed', 'not-run', 'stale', 'withdrawn', 'not-applicable']),
+  boost: new Set(['measured', 'not-measured', 'failed', 'stale', 'withdrawn', 'not-applicable']),
+}
+const CLAIM = new Set(['observation', 'reference', 'advice'])
+const REQUIRED = ['schema', 'subject', 'level', 'status', 'claimLevel', 'scope', 'validity', 'evidence', 'disclaimer', 'verifyUrl', 'issuer', 'recordHash']
+const ALLOWED = new Set([...REQUIRED, 'withdrawn', 'revokedAt', 'supersedes'])
+const DATE = /^\d{4}-\d{2}-\d{2}$/
+const HASH = /^sha256:[0-9a-f]{64}$/
+const COMMIT = /^[0-9a-f]{7,40}$/
+const FORBIDDEN = ['grade', 'score', 'rank', 'recommended', 'official', 'certified', 'secure']
+
+export function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize)
+  if (value && typeof value === 'object') {
+    const out = {}
+    for (const key of Object.keys(value).sort()) out[key] = canonicalize(value[key])
+    return out
+  }
+  return value
+}
+
+export function recordHash(record) {
+  const copy = { ...record }
+  delete copy.recordHash
+  return `sha256:${crypto.createHash('sha256').update(JSON.stringify(canonicalize(copy))).digest('hex')}`
+}
+
+export function normalizeLabel(record) {
+  const computed = recordHash(record)
+  return { ...record, recordHash: computed }
+}
+
+export function labelId(record) {
+  const repo = String(record?.subject?.repo ?? 'unknown').replace(/[^a-zA-Z0-9._-]+/g, '__')
+  const version = String(record?.subject?.version ?? 'unversioned').replace(/[^a-zA-Z0-9._+-]+/g, '_')
+  return `${repo}@${version}`
+}
+
+export function effectiveStatus(record, now = new Date()) {
+  if (record?.withdrawn === true || record?.status === 'withdrawn' || record?.revokedAt) return 'withdrawn'
+  const today = now.toISOString().slice(0, 10)
+  if (String(record?.validity?.expiresAt ?? '') < today) return 'stale'
+  return record?.status ?? 'not-run'
+}
+
+export function validateLabel(record, { requireReference = true } = {}) {
+  const errors = []
+  const warnings = []
+  if (!record || typeof record !== 'object' || Array.isArray(record)) {
+    return { valid: false, errors: ['record must be an object'], warnings, computedHash: null, effective: 'not-run' }
+  }
+  for (const key of Object.keys(record)) {
+    if (!ALLOWED.has(key)) errors.push(`unknown field: ${key}`)
+  }
+  for (const key of REQUIRED) {
+    if (record[key] === undefined || record[key] === null || record[key] === '') errors.push(`missing: ${key}`)
+  }
+  if (record.schema !== 'dsh-market-label/1') errors.push('schema must be dsh-market-label/1')
+  if (!LEVELS.has(record.level)) errors.push(`invalid level: ${record.level}`)
+  if (!STATUS[record.level]?.has(record.status)) errors.push(`invalid status for ${record.level}: ${record.status}`)
+  if (!CLAIM.has(record.claimLevel)) errors.push(`invalid claimLevel: ${record.claimLevel}`)
+  if (requireReference && record.claimLevel !== 'reference') errors.push('directory labels must use claimLevel=reference')
+  const subject = record.subject ?? {}
+  for (const key of ['repo', 'version', 'commit']) {
+    if (typeof subject[key] !== 'string' || subject[key].length === 0) errors.push(`subject.${key} must be a non-empty string`)
+  }
+  if (subject.commit && !COMMIT.test(subject.commit)) errors.push('subject.commit must be 7-40 lowercase hex')
+  for (const key of ['dsh', 'cordis']) {
+    if (typeof record.scope?.[key] !== 'string' || record.scope[key].length === 0) errors.push(`scope.${key} must be a non-empty string`)
+  }
+  for (const key of ['generatedAt', 'expiresAt']) {
+    if (!DATE.test(String(record.validity?.[key] ?? ''))) errors.push(`validity.${key} must be YYYY-MM-DD`)
+  }
+  if (DATE.test(String(record.validity?.generatedAt ?? '')) && DATE.test(String(record.validity?.expiresAt ?? ''))) {
+    if (record.validity.expiresAt < record.validity.generatedAt) errors.push('validity.expiresAt must be >= generatedAt')
+  }
+  if (!Array.isArray(record.evidence) || record.evidence.length === 0) errors.push('evidence must be a non-empty array')
+  else {
+    for (const [index, item] of record.evidence.entries()) {
+      if (!item || typeof item !== 'object' || Array.isArray(item)) { errors.push(`evidence[${index}] must be an object`); continue }
+      for (const key of Object.keys(item)) if (!['url', 'sha256'].includes(key)) errors.push(`evidence[${index}] unknown field: ${key}`)
+      if (typeof item.url !== 'string' || !item.url.startsWith('https://')) errors.push(`evidence[${index}].url must be https://`)
+      if (item.sha256 !== undefined && !/^[0-9a-f]{64}$/.test(String(item.sha256))) errors.push(`evidence[${index}].sha256 must be 64 hex`)
+    }
+  }
+  if (typeof record.disclaimer !== 'string' || record.disclaimer.length < 12) errors.push('disclaimer is too short')
+  else {
+    if (!/非官方|non-official/i.test(record.disclaimer)) errors.push('disclaimer must say 非官方/non-official')
+    if (!/非认证|non-certification/i.test(record.disclaimer)) errors.push('disclaimer must say 非认证/non-certification')
+  }
+  if (typeof record.verifyUrl !== 'string' || !record.verifyUrl.startsWith('https://')) errors.push('verifyUrl must be https://')
+  if (typeof record.issuer !== 'string' || record.issuer.length === 0) errors.push('issuer must be a non-empty string')
+  if (!HASH.test(String(record.recordHash ?? ''))) errors.push('recordHash must be sha256:<64 hex>')
+  const computed = recordHash(record)
+  if (HASH.test(String(record.recordHash ?? '')) && record.recordHash !== computed) errors.push('recordHash does not match the canonical record')
+  for (const key of FORBIDDEN) {
+    if (Object.prototype.hasOwnProperty.call(record, key)) errors.push(`forbidden field: ${key}`)
+    if (Object.prototype.hasOwnProperty.call(record.subject ?? {}, key)) errors.push(`forbidden subject field: ${key}`)
+  }
+  if (record.withdrawn !== undefined && typeof record.withdrawn !== 'boolean') errors.push('withdrawn must be boolean')
+  if (record.revokedAt !== undefined && !DATE.test(String(record.revokedAt))) errors.push('revokedAt must be YYYY-MM-DD')
+  if (record.supersedes !== undefined && !HASH.test(String(record.supersedes))) errors.push('supersedes must be sha256:<64 hex>')
+  const effective = effectiveStatus(record)
+  if (effective === 'stale') warnings.push('label is stale at read time; hide it from the valid view')
+  if (effective === 'withdrawn') warnings.push('label is withdrawn; keep it in history, exclude it from the valid view')
+  return { valid: errors.length === 0, errors, warnings, computedHash: computed, effective }
+}
+
+export function validateIndex(index) {
+  const errors = []
+  if (!index || typeof index !== 'object') return { valid: false, errors: ['index must be an object'] }
+  if (index.schema !== 'dsh-label-index/1') errors.push('index.schema must be dsh-label-index/1')
+  if (!Array.isArray(index.records)) errors.push('index.records must be an array')
+  else {
+    for (const [i, record] of index.records.entries()) {
+      const result = validateLabel(record)
+      for (const error of result.errors) errors.push(`records[${i}]: ${error}`)
+    }
+  }
+  return { valid: errors.length === 0, errors }
+}

package/40-checker/src/manifest.mjs

@@ -0,0 +1,364 @@
+import path from 'node:path'
+import {
+  asArray, exists, isDirectory, isFile, isObject, readJsonMaybe, readText, rootExportTarget,
+} from './util.mjs'
+import { parseVersion, satisfies, validRange } from './semver.mjs'
+import { parseInstallSpec } from './install-spec.mjs'
+import { check, detail, worst } from './result.mjs'
+import { checkClientShape } from './client-shape.mjs'
+
+const PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/
+const PACKAGE_NAME_MAX_LENGTH = 214
+const EXACT_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/
+const COMMIT = /^[0-9a-f]{40}$/
+
+export const DEFAULT_RUNTIME_VERSION = '0.2.2-alpha.2'
+
+export function inferKind(manifest, entryExists) {
+  const declared = manifest?.dsh?.kind
+  if (typeof declared === 'string' && declared !== '') return { kind: declared, inferred: false }
+  if (manifest?.dsh?.bundle?.patch !== undefined) return { kind: 'bundle', inferred: true }
+  if (manifest?.dsh?.client !== undefined) return { kind: 'client', inferred: true }
+  if (entryExists) return { kind: 'plugin', inferred: true }
+  return { kind: 'unknown', inferred: true }
+}
+
+function inside(root, target) {
+  const relative = path.relative(root, target)
+  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative))
+}
+
+export function resolveEntry(dir, manifest) {
+  const candidates = []
+  const exportTarget = rootExportTarget(manifest)
+  if (exportTarget) candidates.push({ source: 'exports["."]', target: exportTarget })
+  if (typeof manifest.main === 'string' && manifest.main.trim() !== '') candidates.push({ source: 'main', target: manifest.main })
+  for (const fallback of ['index.js', 'index.mjs', 'index.cjs', 'index.ts']) candidates.push({ source: 'fallback', target: fallback })
+
+  for (const candidate of candidates) {
+    const absolute = path.resolve(dir, candidate.target)
+    if (!inside(dir, absolute)) {
+      return { exists: false, escape: true, source: candidate.source, target: candidate.target, absolute }
+    }
+    if (isFile(absolute)) {
+      return { exists: true, source: candidate.source, target: candidate.target, absolute, relative: path.relative(dir, absolute).split(path.sep).join('/') }
+    }
+  }
+
+  const sourceCandidates = ['src/index.ts', 'src/index.tsx', 'src/index.js', 'src/index.mjs']
+  const sourceEntry = sourceCandidates.find(relative => isFile(path.join(dir, relative))) ?? null
+  const scripts = isObject(manifest.scripts) ? manifest.scripts : {}
+  const buildHint = Boolean(sourceEntry) || ['build', 'prepare', 'compile'].some(name => typeof scripts[name] === 'string')
+  return { exists: false, escape: false, source: 'none', target: null, absolute: null, sourceEntry, buildHint }
+}
+
+function checkExportShape(entry, kind) {
+  if (!entry?.exists || kind !== 'plugin') return { result: 'NA', reason: 'not a directly loadable plugin entry', evidence: [] }
+  if (entry.related === '.d.ts' || entry.absolute.endsWith('.d.ts')) return { result: 'WARN', reason: 'entry is a declaration file; runtime shape not judged', evidence: [entry.relative] }
+  let text
+  try { text = readText(entry.absolute) } catch { return { result: 'WARN', reason: 'entry is not readable', evidence: [entry.relative] } }
+  const patterns = [
+    /export\s+(?:async\s+)?function\s+apply\s*\(/,
+    /export\s+const\s+apply\s*=/,
+    /export\s+\{[^}]*\bapply\b[^}]*\}/,
+    /export\s+default\s+class\s+/,
+    /module\.exports\s*=/,
+  ]
+  if (patterns.some(pattern => pattern.test(text))) {
+    return { result: 'PASS', reason: 'entry exposes apply or a default class', evidence: [entry.relative] }
+  }
+  return { result: 'WARN', reason: 'no apply/default-class shape found by static scan; L1 is authoritative', evidence: [entry.relative] }
+}
+
+function analyzePatch(dir, manifest) {
+  const raw = manifest?.dsh?.bundle?.patch
+  if (raw === undefined) return { present: false, files: [], problems: [], enabledPluginManagerTools: false }
+  const files = []
+  const problems = []
+  let enabledPluginManagerTools = false
+  for (const entry of asArray(raw)) {
+    if (typeof entry !== 'string' || entry.trim() === '') {
+      problems.push('dsh.bundle.patch must be a non-empty string or string array')
+      continue
+    }
+    if (path.isAbsolute(entry) || entry.startsWith('~') || entry.includes('$') || entry.split(/[\\/]/).includes('..')) {
+      problems.push(`patch path escapes the package: ${entry}`)
+      continue
+    }
+    const absolute = path.resolve(dir, entry)
+    if (!inside(dir, absolute)) {
+      problems.push(`patch path escapes the package: ${entry}`)
+      continue
+    }
+    if (!isFile(absolute)) {
+      problems.push(`patch file is missing: ${entry}`)
+      continue
+    }
+    files.push({ relative: entry, absolute })
+    let text = ''
+    try { text = readText(absolute) } catch { problems.push(`patch file is unreadable: ${entry}`); continue }
+    const lines = text.split('\n')
+    for (let index = 0; index < lines.length; index += 1) {
+      const line = lines[index]
+      const match = /^\s*name:\s*['"]?([^'"\s#]+)['"]?/.exec(line)
+      if (!match) continue
+      const name = match[1]
+      if (path.isAbsolute(name) || name.startsWith('~') || name.includes('$') || name.split(/[\\/]/).includes('..')) {
+        problems.push(`patch row name escapes the package: ${name}`)
+      }
+      if (name === '@deepseek-ai/dsh-plugin-manager/tools') {
+        const window = lines.slice(index, index + 4).join('\n')
+        if (!/disabled:\s*true/.test(window)) enabledPluginManagerTools = true
+      }
+    }
+  }
+  return { present: true, files, problems, enabledPluginManagerTools }
+}
+
+function supplyChain(dir, manifest) {
+  const details = []
+  const dependencies = isObject(manifest.dependencies) ? manifest.dependencies : {}
+  const peers = isObject(manifest.peerDependencies) ? manifest.peerDependencies : {}
+  const all = { ...dependencies, ...peers }
+  for (const [name, value] of Object.entries(all)) {
+    if (typeof value !== 'string') continue
+    if (/^(?:workspace|file|link|portal):/i.test(value)) {
+      details.push(detail('C-3.3', 'WARN', `non-registry dependency ${name}: ${value}`, [`package.json#dependencies.${name}`]))
+      continue
+    }
+    if (/^(?:git\+|git@|github:|gitlab:|bitbucket:|gist:|https?:)/i.test(value)) {
+      if (!/#[0-9a-f]{40}$/.test(value) && !/^https?:\/\/[^#]+\.(?:tgz|tar\.gz)/i.test(value)) {
+        details.push(detail('C-3.3', 'WARN', `non-registry dependency ${name} is not pinned to a commit: ${value}`, [`package.json#dependencies.${name}`]))
+      }
+    }
+  }
+  const scripts = isObject(manifest.scripts) ? manifest.scripts : {}
+  for (const name of ['preinstall', 'install', 'postinstall', 'prepare']) {
+    if (typeof scripts[name] === 'string') {
+      details.push(detail('C-3.4', 'WARN', `install-time build script present: scripts.${name}`, [`package.json#scripts.${name}`]))
+    }
+  }
+  return details
+}
+
+/**
+ * @param {string} dir
+ * @param {{runtimeVersion?: string, installSpec?: string, marketIndex?: string, pluginName?: string}} options
+ */
+export function runManifestChecks(dir, options = {}) {
+  const runtimeVersion = options.runtimeVersion ?? DEFAULT_RUNTIME_VERSION
+  const parsed = readJsonMaybe(path.join(dir, 'package.json'))
+  if (parsed.error) {
+    return {
+      manifest: null,
+      kind: 'unknown',
+      entry: null,
+      patch: null,
+      g4: { hasClient: false, ok: true, result: 'NA', reason: 'manifest unavailable' },
+      checks: [
+        check({ id: 'DSC-01', clause: 'C-1', layer: 'L0', result: 'FAIL', reason: `package.json is missing or invalid: ${parsed.error.message}`, details: [detail('C-1.1', 'FAIL', parsed.error.message)], evidence: ['package.json'] }),
+        check({ id: 'DSC-02', clause: 'C-2', layer: 'L0', result: 'ERROR', coverage: 'not-run', reason: 'manifest unavailable' }),
+        check({ id: 'DSC-03', clause: 'C-3', layer: 'L0', result: 'NA', reason: 'manifest unavailable' }),
+      ],
+    }
+  }
+  const manifest = parsed.value
+  const entry = resolveEntry(dir, manifest)
+  const kindInfo = inferKind(manifest, entry.exists)
+  const kind = kindInfo.kind
+  const patch = analyzePatch(dir, manifest)
+  const g4 = checkClientShape(manifest)
+
+  const manifestDetails = []
+  const name = manifest.name
+  if (typeof name !== 'string' || name.trim() === '' || name.length > PACKAGE_NAME_MAX_LENGTH || !PACKAGE_NAME.test(name)) {
+    manifestDetails.push(detail('C-1.1', 'FAIL', 'name must be a valid npm package name', ['package.json#name']))
+  } else {
+    manifestDetails.push(detail('C-1.1', 'PASS', `name=${name}`))
+  }
+  if (typeof manifest.version !== 'string' || !EXACT_VERSION.test(manifest.version)) {
+    manifestDetails.push(detail('C-1.1', 'FAIL', 'version must be an exact SemVer version', ['package.json#version']))
+  } else {
+    manifestDetails.push(detail('C-1.1', 'PASS', `version=${manifest.version}`))
+  }
+  if (entry.escape) {
+    manifestDetails.push(detail('C-1.2', 'FAIL', `entry escapes the package: ${entry.target}`, ['package.json#exports']))
+  } else if (entry.exists) {
+    manifestDetails.push(detail('C-1.2', 'PASS', `entry resolves via ${entry.source}: ${entry.relative}`, [entry.relative]))
+  } else if (entry.buildHint) {
+    manifestDetails.push(detail('C-1.2', 'WARN', `entry not present in checkout; source/build hint exists (${entry.sourceEntry ?? 'build script'})`, ['package.json#scripts']))
+  } else if (kind === 'bundle' || kind === 'client') {
+    manifestDetails.push(detail('C-1.2', 'WARN', `no runtime entry; ${kind} packages may be patch/client only`, ['package.json#exports']))
+  } else {
+    manifestDetails.push(detail('C-1.2', 'FAIL', 'no resolvable runtime entry', ['package.json#exports', 'package.json#main']))
+  }
+  const shape = checkExportShape(entry, kind)
+  manifestDetails.push(detail('C-1.3', shape.result, shape.reason, shape.evidence))
+  if (!patch.present) {
+    manifestDetails.push(detail('C-1.4', 'PASS', 'no dsh.bundle.patch declared'))
+  } else if (patch.problems.length > 0) {
+    manifestDetails.push(detail('C-1.4', 'FAIL', patch.problems.join('; '), patch.files.map(file => file.relative)))
+  } else {
+    manifestDetails.push(detail('C-1.4', 'PASS', `bundle patch present (${patch.files.length} file(s))`, patch.files.map(file => file.relative)))
+  }
+  if (typeof manifest.license !== 'string' || manifest.license.trim() === '') {
+    manifestDetails.push(detail('C-1.5', 'WARN', 'license is missing', ['package.json#license']))
+  } else {
+    manifestDetails.push(detail('C-1.5', 'PASS', `license=${manifest.license}`))
+  }
+  if (manifest.private === true) {
+    manifestDetails.push(detail('C-1.6', 'WARN', 'private:true; not publishable to a registry', ['package.json#private']))
+  }
+  const manifestResult = worst(manifestDetails.map(item => item.result))
+  const manifestCheck = check({
+    id: 'DSC-01',
+    clause: 'C-1',
+    layer: 'L0',
+    result: manifestResult,
+    reason: manifestDetails.filter(item => item.result !== 'PASS' && item.result !== 'NA').map(item => `${item.item}: ${item.reason}`).join(' | '),
+    details: manifestDetails,
+    evidence: ['package.json'],
+  })
+
+  const compatDetails = []
+  const engines = isObject(manifest.engines) ? manifest.engines : {}
+  const dshEngine = engines.dsh
+  const peers = isObject(manifest.peerDependencies) ? manifest.peerDependencies : {}
+  const dshPeers = Object.entries(peers).filter(([peer]) => peer === '@deepseek-ai/dsh' || peer.startsWith('@deepseek-ai/dsh-'))
+  if (typeof dshEngine === 'string') {
+    if (dshEngine.startsWith('workspace:')) {
+      compatDetails.push(detail('C-2.3', 'FAIL', 'engines.dsh must not be a workspace: range', ['package.json#engines.dsh']))
+    } else if (!validRange(dshEngine)) {
+      compatDetails.push(detail('C-2.1', 'FAIL', `engines.dsh is not a SemVer range: ${dshEngine}`, ['package.json#engines.dsh']))
+    } else if (!satisfies(runtimeVersion, dshEngine)) {
+      compatDetails.push(detail('C-2.2', 'FAIL', `engines.dsh ${dshEngine} does not satisfy runtime ${runtimeVersion}`, ['package.json#engines.dsh']))
+    } else {
+      compatDetails.push(detail('C-2.1', 'PASS', `engines.dsh=${dshEngine}`))
+      compatDetails.push(detail('C-2.2', 'PASS', `runtime ${runtimeVersion} satisfies ${dshEngine}`))
+    }
+    for (const [peer, rangeValue] of dshPeers) {
+      if (typeof rangeValue !== 'string' || rangeValue.startsWith('workspace:')) continue
+      if (validRange(rangeValue) && !satisfies(runtimeVersion, rangeValue)) {
+        compatDetails.push(detail('C-2.4', 'WARN', `peer ${peer} range ${rangeValue} conflicts with engines.dsh`, [`package.json#peerDependencies.${peer}`]))
+      }
+    }
+  } else if (dshPeers.length > 0) {
+    let failed = false
+    for (const [peer, rangeValue] of dshPeers) {
+      if (typeof rangeValue !== 'string') {
+        compatDetails.push(detail('C-2.1', 'FAIL', `peer ${peer} must be a string range`, [`package.json#peerDependencies.${peer}`]))
+        failed = true
+        continue
+      }
+      const effective = /^workspace:(?:\^|~|\*)$/.test(rangeValue) ? runtimeVersion : rangeValue
+      if (!validRange(effective)) {
+        compatDetails.push(detail('C-2.1', 'FAIL', `peer ${peer} is not a SemVer range: ${rangeValue}`, [`package.json#peerDependencies.${peer}`]))
+        failed = true
+      } else if (!satisfies(runtimeVersion, effective)) {
+        compatDetails.push(detail('C-2.2', 'FAIL', `peer ${peer} ${rangeValue} does not satisfy runtime ${runtimeVersion}`, [`package.json#peerDependencies.${peer}`]))
+        failed = true
+      }
+    }
+    compatDetails.push(detail('C-2.1', failed ? 'FAIL' : 'WARN', failed ? 'one or more dsh peers are unsatisfied' : 'no engines.dsh; dsh peer range is the weaker alternate declaration'))
+  } else {
+    compatDetails.push(detail('C-2.1', 'FAIL', 'neither engines.dsh nor a @deepseek-ai/dsh* peer range is declared', ['package.json#engines', 'package.json#peerDependencies']))
+  }
+  const compatResult = worst(compatDetails.map(item => item.result))
+  const compatCheck = check({
+    id: 'DSC-02',
+    clause: 'C-2',
+    layer: 'L0',
+    result: compatResult,
+    reason: compatDetails.filter(item => item.result !== 'PASS' && item.result !== 'NA').map(item => `${item.item}: ${item.reason}`).join(' | '),
+    details: compatDetails,
+    evidence: ['package.json#engines', 'package.json#peerDependencies'],
+  })
+
+  const supplyDetails = supplyChain(dir, manifest)
+  const installDetails = [...supplyDetails]
+  let installResult = 'NA'
+  let installReason = 'install spec not supplied (package profile)'
+  if (typeof options.installSpec === 'string' && options.installSpec.trim() !== '') {
+    try {
+      const spec = parseInstallSpec(options.installSpec)
+      installDetails.push(detail('C-3.1', 'PASS', `parsed kind=${spec.kind}`, ['--install-spec']))
+      installDetails.push(detail('C-3.2', spec.pinned ? 'PASS' : 'WARN', spec.pinned ? 'source is pinned' : 'registry spec is a bare name/tag', ['--install-spec']))
+      installResult = worst(installDetails.map(item => item.result))
+      installReason = installResult === 'PASS' ? '' : 'install spec or supply-chain issue'
+    } catch (error) {
+      installDetails.push(detail('C-3.1', 'FAIL', error.message, ['--install-spec']))
+      installResult = 'FAIL'
+      installReason = error.message
+    }
+  } else if (typeof options.marketIndex === 'string' && options.marketIndex.trim() !== '') {
+    const market = checkMarketEntry(options.marketIndex, options.pluginName)
+    installDetails.push(...market.details)
+    installResult = worst([market.result, ...supplyDetails.map(item => item.result)])
+    installReason = market.reason || (installResult === 'WARN' ? 'market entry is pinned but supply-chain warnings remain' : '')
+  }
+  const installCheck = check({
+    id: 'DSC-03',
+    clause: 'C-3',
+    layer: 'L0',
+    result: installResult,
+    coverage: installResult === 'NA' ? 'not-run' : 'full',
+    reason: installReason,
+    details: installDetails,
+    evidence: ['package.json#dependencies', 'package.json#scripts', options.marketIndex ?? '--install-spec'],
+  })
+
+  return { manifest, kind, kindInferred: kindInfo.inferred, entry, patch, g4, checks: [manifestCheck, compatCheck, installCheck] }
+}
+
+export function checkMarketEntry(indexPath, pluginName) {
+  const details = []
+  let parsed
+  try { parsed = readJsonMaybe(indexPath) } catch (error) {
+    return { result: 'FAIL', reason: error.message, details: [detail('C-3.5', 'FAIL', error.message, [indexPath])] }
+  }
+  if (parsed.error) {
+    return { result: 'FAIL', reason: parsed.error.message, details: [detail('C-3.5', 'FAIL', parsed.error.message, [indexPath])] }
+  }
+  const value = parsed.value
+  if (!isObject(value) || value.format !== 1) {
+    return { result: 'FAIL', reason: 'market index format must be 1', details: [detail('C-3.5', 'FAIL', 'format !== 1', [indexPath])] }
+  }
+  if (!Array.isArray(value.plugins)) {
+    return { result: 'FAIL', reason: 'plugins must be an array', details: [detail('C-3.5', 'FAIL', 'plugins is not an array', [indexPath])] }
+  }
+  const name = pluginName ?? null
+  const plugin = name
+    ? value.plugins.find(entry => isObject(entry) && entry.name === name)
+    : value.plugins.length === 1 ? value.plugins[0] : null
+  if (!isObject(plugin)) {
+    return { result: 'FAIL', reason: name ? `plugin ${name} not found` : 'plugin name is required for a multi-plugin index', details: [detail('C-3.5', 'FAIL', 'plugin not found', [indexPath])] }
+  }
+  if (typeof plugin.name !== 'string' || !PACKAGE_NAME.test(plugin.name)) {
+    details.push(detail('C-3.5', 'FAIL', `invalid plugin name: ${plugin.name}`, [indexPath]))
+  }
+  if (!Array.isArray(plugin.versions) || plugin.versions.length === 0) {
+    details.push(detail('C-3.5', 'FAIL', 'versions must be a non-empty array', [indexPath]))
+  } else {
+    for (const version of plugin.versions) {
+      if (!isObject(version) || typeof version.version !== 'string' || !EXACT_VERSION.test(version.version)) {
+        details.push(detail('C-3.5', 'FAIL', 'version must be an exact SemVer', [indexPath]))
+        continue
+      }
+      if (!isObject(version.source) || !['npm', 'git'].includes(version.source.type)) {
+        details.push(detail('C-3.5', 'FAIL', `source.type must be npm or git for ${version.version}`, [indexPath]))
+        continue
+      }
+      if (version.source.type === 'git' && (typeof version.source.commit !== 'string' || !COMMIT.test(version.source.commit))) {
+        details.push(detail('C-3.5', 'FAIL', `git source must pin a 40-hex commit for ${version.version}`, [indexPath]))
+      }
+      if (isObject(version.engines) && version.engines.dsh !== undefined) {
+        if (typeof version.engines.dsh !== 'string' || version.engines.dsh.startsWith('workspace:') || !validRange(version.engines.dsh)) {
+          details.push(detail('C-3.5', 'FAIL', `engines.dsh invalid for ${version.version}`, [indexPath]))
+        }
+      }
+    }
+  }
+  if (details.length === 0) details.push(detail('C-3.5', 'PASS', `market index entry ${plugin.name}@${plugin.versions?.[0]?.version ?? '?'} is pinned`))
+  const result = worst(details.map(item => item.result))
+  return { result, reason: result === 'PASS' ? '' : 'market index entry failed validation', details }
+}

package/40-checker/src/permissions.mjs

@@ -0,0 +1,60 @@
+/**
+ * T4 field validation: dsh.commitments / dsh.disclosure.
+ *
+ * These fields are declarations, not enforcement. The checker validates their
+ * shape and reports missing/invalid values; it never FAILs C-12 merely because
+ * a commitment is absent (the standard's transition rule).
+ */
+
+export const COMMITMENT_IDS = [
+  'no-session-upload',
+  'no-third-party-proxy',
+  'no-credential-enumeration',
+  'no-silent-prompt-rewrite',
+  'no-adapter-bypass',
+  'no-webhook-auto-session',
+  'no-security-seam-replacement',
+  'third-party-endpoint-disclosure',
+  'no-danger-full-access',
+]
+
+function detail(item, result, reason) {
+  return { item, result, reason, evidence: ['package.json#dsh.commitments'] }
+}
+
+export function validateCommitments(manifest) {
+  const value = manifest?.dsh?.commitments
+  if (value === undefined) return [detail('C-12.6', 'NA', 'dsh.commitments is not declared (optional disclosure)')]
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    return [detail('C-12.6', 'WARN', 'dsh.commitments must be an object')]
+  }
+  const details = []
+  for (const id of COMMITMENT_IDS) {
+    if (!Object.hasOwn(value, id)) details.push(detail('C-12.6', 'WARN', `missing commitment: ${id}`))
+    else if (typeof value[id] !== 'boolean') details.push(detail('C-12.6', 'WARN', `commitment ${id} must be boolean`))
+  }
+  if (details.length === 0) details.push(detail('C-12.6', 'PASS', 'all 9 commitments are declared as booleans'))
+  return details
+}
+
+export function validateDisclosure(manifest) {
+  const value = manifest?.dsh?.disclosure
+  if (value === undefined) return [detail('C-12.7', 'NA', 'dsh.disclosure is not declared (optional disclosure)')]
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    return [detail('C-12.7', 'WARN', 'dsh.disclosure must be an object')]
+  }
+  const details = []
+  if (value.endpoints !== undefined) {
+    if (!Array.isArray(value.endpoints) || value.endpoints.some(endpoint => typeof endpoint !== 'string' || !/^https:\/\//.test(endpoint))) {
+      details.push(detail('C-12.7', 'WARN', 'disclosure.endpoints must be an array of https URLs'))
+    }
+  }
+  if (value.retention !== undefined && typeof value.retention !== 'string') {
+    details.push(detail('C-12.7', 'WARN', 'disclosure.retention must be a string'))
+  }
+  if (value.systemPrompt !== undefined && typeof value.systemPrompt !== 'string') {
+    details.push(detail('C-12.7', 'WARN', 'disclosure.systemPrompt must be a string'))
+  }
+  if (details.length === 0) details.push(detail('C-12.7', 'PASS', 'dsh.disclosure is well-formed'))
+  return details
+}