dsh-standards 0.0.3 → 1.0.1

package/40-checker/src/semver.mjs

@@ -0,0 +1,194 @@
+/**
+ * Minimal SemVer range matcher for the checker.
+ *
+ * It is intentionally small: the host evaluates plugin requirements with
+ * `semver.satisfies(runtime, range, { includePrerelease: true })`
+ * (deepseek-harness/packages/boot/app-boot/src/plugin-compatibility.ts:52).
+ * This module implements the subset that appears in package manifests:
+ * exact versions, `>= > <= <`, `^`, `~`, `*`/`x`, space-separated AND,
+ * and `||` alternatives. It does NOT implement hyphen ranges, `!=`,
+ * or npm's "prerelease only matches same tuple" exclusion; the host uses
+ * includePrerelease, so we include prereleases everywhere.
+ */
+
+const VERSION_RE = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/
+
+export function parseVersion(value) {
+  if (typeof value !== 'string') return null
+  const match = VERSION_RE.exec(value.trim())
+  if (!match) return null
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: match[4] ? match[4].split('.') : [],
+  }
+}
+
+function compareIdentifier(left, right) {
+  const leftNumeric = /^\d+$/.test(left)
+  const rightNumeric = /^\d+$/.test(right)
+  if (leftNumeric && rightNumeric) return Number(left) - Number(right)
+  if (leftNumeric) return -1
+  if (rightNumeric) return 1
+  return left < right ? -1 : left > right ? 1 : 0
+}
+
+export function compareVersions(left, right) {
+  for (const key of ['major', 'minor', 'patch']) {
+    if (left[key] !== right[key]) return left[key] - right[key]
+  }
+  const a = left.prerelease
+  const b = right.prerelease
+  if (a.length === 0 && b.length === 0) return 0
+  if (a.length === 0) return 1
+  if (b.length === 0) return -1
+  const length = Math.max(a.length, b.length)
+  for (let index = 0; index < length; index += 1) {
+    if (a[index] === undefined) return -1
+    if (b[index] === undefined) return 1
+    const result = compareIdentifier(a[index], b[index])
+    if (result !== 0) return result
+  }
+  return 0
+}
+
+function upperForCaret(version) {
+  if (version.major > 0) return { ...version, major: version.major + 1, minor: 0, patch: 0, prerelease: [] }
+  if (version.minor > 0) return { ...version, minor: version.minor + 1, patch: 0, prerelease: [] }
+  return { ...version, patch: version.patch + 1, prerelease: [] }
+}
+
+function upperForTilde(version) {
+  return { ...version, minor: version.minor + 1, patch: 0, prerelease: [] }
+}
+
+function parsePartial(text) {
+  const match = /^v?(\d+)(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(?:-([0-9A-Za-z.-]+))?$/.exec(text.trim())
+  if (!match) return null
+  return {
+    major: Number(match[1]),
+    minor: match[2] === undefined || /[xX*]/.test(match[2]) ? null : Number(match[2]),
+    patch: match[3] === undefined || /[xX*]/.test(match[3]) ? null : Number(match[3]),
+    prerelease: match[4] ? match[4].split('.') : [],
+  }
+}
+
+function fullVersion(partial) {
+  return { major: partial.major, minor: partial.minor ?? 0, patch: partial.patch ?? 0, prerelease: partial.prerelease }
+}
+function nextMinor(partial) { return { major: partial.major, minor: (partial.minor ?? 0) + 1, patch: 0, prerelease: [] } }
+function nextMajor(partial) { return { major: partial.major + 1, minor: 0, patch: 0, prerelease: [] } }
+function fmt(version) {
+  const base = `${version.major}.${version.minor}.${version.patch}`
+  return version.prerelease && version.prerelease.length ? `${base}-${version.prerelease.join('.')}` : base
+}
+
+function expandToken(raw) {
+  if (raw === '*' || raw === 'x' || raw === 'X') return '*'
+  const match = /^(>=|<=|>|<|=|\^|~)?\s*v?(\d+)(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(?:-([0-9A-Za-z.-]+))?$/.exec(raw)
+  if (!match) return null
+  const op = match[1] ?? '='
+  const partial = {
+    major: Number(match[2]),
+    minor: match[3] === undefined || /[xX*]/.test(match[3]) ? null : Number(match[3]),
+    patch: match[4] === undefined || /[xX*]/.test(match[4]) ? null : Number(match[4]),
+    prerelease: match[5] ? match[5].split('.') : [],
+  }
+  const low = fullVersion(partial)
+  const noMinor = partial.minor === null
+  const noPatch = partial.patch === null
+  if (!noMinor && !noPatch) return `${op}${fmt(low)}`
+  switch (op) {
+    case '^':
+    case '~':
+    case '=':
+      return noMinor ? `>=${fmt(low)} <${fmt(nextMajor(partial))}` : `>=${fmt(low)} <${fmt(nextMinor(partial))}`
+    case '>=': return `>=${fmt(low)}`
+    case '>': return noMinor ? `>=${fmt(nextMajor(partial))}` : `>=${fmt(nextMinor(partial))}`
+    case '<': return `<${fmt(low)}`
+    case '<=': return noMinor ? `<${fmt(nextMajor(partial))}` : `<${fmt(nextMinor(partial))}`
+    default: return null
+  }
+}
+
+/** Hyphen ranges and x-ranges are normalized before tokenizing. */
+function expandAlternative(alternative) {
+  const text = alternative.trim()
+  if (text === '' || text === '*' || text === 'x' || text === 'X') return '*'
+  const hyphen = /^(.+?)\s+-\s+(.+)$/.exec(text)
+  if (hyphen) {
+    const left = parsePartial(hyphen[1])
+    const right = parsePartial(hyphen[2])
+    if (!left || !right) return null
+    const low = `>=${fmt(fullVersion(left))}`
+    if (right.minor === null) return `${low} <${fmt(nextMajor(right))}`
+    if (right.patch === null) return `${low} <${fmt(nextMinor(right))}`
+    return `${low} <=${fmt(fullVersion(right))}`
+  }
+  const parts = []
+  for (const raw of text.split(/\s+/)) {
+    const expanded = expandToken(raw)
+    if (expanded === null) return null
+    parts.push(expanded)
+  }
+  return parts.join(' ')
+}
+
+function tokenizeAlternative(alternative) {
+  const expanded = expandAlternative(alternative)
+  if (expanded === null) return null
+  if (expanded === '*') return [{ op: '*', version: null }]
+  const tokens = []
+  for (const raw of expanded.split(/\s+/)) {
+    const match = /^(>=|<=|>|<|=|\^|~)?\s*v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/.exec(raw)
+    if (!match) return null
+    const op = match[1] ?? '='
+    const version = parseVersion(match[2])
+    if (!version) return null
+    tokens.push({ op, version })
+  }
+  return tokens
+}
+
+function satisfiesToken(version, token) {
+  if (token.op === '*') return true
+  const cmp = compareVersions(version, token.version)
+  switch (token.op) {
+    case '=': return cmp === 0
+    case '>': return cmp > 0
+    case '>=': return cmp >= 0
+    case '<': return cmp < 0
+    case '<=': return cmp <= 0
+    case '^': return cmp >= 0 && compareVersions(version, upperForCaret(token.version)) < 0
+    case '~': return cmp >= 0 && compareVersions(version, upperForTilde(token.version)) < 0
+    default: return false
+  }
+}
+
+/**
+ * @param {string} version exact version to test
+ * @param {string} range SemVer range
+ * @returns {boolean}
+ */
+export function satisfies(version, range) {
+  const parsed = parseVersion(version)
+  if (!parsed || typeof range !== 'string') return false
+  if (range.trim() === '') return false
+  const alternatives = range.split('||')
+  for (const alternative of alternatives) {
+    const tokens = tokenizeAlternative(alternative)
+    if (!tokens || tokens.length === 0) continue
+    if (tokens.every(token => satisfiesToken(parsed, token))) return true
+  }
+  return false
+}
+
+/** @returns {boolean} whether `range` is a syntactically usable range for this checker. */
+export function validRange(range) {
+  if (typeof range !== 'string' || range.trim() === '') return false
+  for (const alternative of range.split('||')) {
+    if (!tokenizeAlternative(alternative)) return false
+  }
+  return true
+}

package/40-checker/src/util.mjs

@@ -0,0 +1,148 @@
+import fs from 'node:fs'
+import path from 'node:path'
+
+export const SOURCE_EXTENSIONS = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx'])
+
+export function exists(target) {
+  try { fs.accessSync(target); return true } catch { return false }
+}
+
+export function isFile(target) {
+  try { return fs.statSync(target).isFile() } catch { return false }
+}
+
+export function isDirectory(target) {
+  try { return fs.statSync(target).isDirectory() } catch { return false }
+}
+
+export function readText(target) {
+  return fs.readFileSync(target, 'utf8')
+}
+
+export function readJson(target) {
+  return JSON.parse(readText(target))
+}
+
+export function readJsonMaybe(target) {
+  try { return { value: readJson(target), error: null } } catch (error) {
+    return { value: null, error }
+  }
+}
+
+export function isObject(value) {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+export function asArray(value) {
+  if (value === undefined || value === null) return []
+  return Array.isArray(value) ? value : [value]
+}
+
+export function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+export function posixRelative(from, to) {
+  return path.relative(from, to).split(path.sep).join('/')
+}
+
+const SKIP_DIRECTORIES = new Set([
+  'node_modules', '.git', '.hg', '.svn', 'test', 'tests', '__tests__', 'docs', 'doc',
+  'assets', 'images', 'screenshots', 'coverage', '.github', '.agents', '.claude',
+  'tools', 'scripts', 'examples', 'benchmarks', 'fixtures', 'demo', 'dev', 'deploy', 'quality', 'bench',
+])
+
+const BUILD_FILE = /(?:^|\/)(?:build|esbuild|vite|rollup|webpack)\.config\.[cm]?[jt]s$|(?:^|\/)(?:build|esbuild)\.mjs$|(?:^|\/)(?:make|render|verify|check)-[^/]+\.mjs$/
+
+/**
+ * Collect source files without following symlinks. Deterministic order, bounded.
+ * @param {string} root
+ * @param {{maxFiles?: number, maxBytes?: number}} [options]
+ */
+export function listSourceFiles(root, options = {}) {
+  const maxFiles = options.maxFiles ?? 400
+  const maxBytes = options.maxBytes ?? 2_000_000
+  const files = []
+  let bytes = 0
+  const walk = (directory) => {
+    if (files.length >= maxFiles || bytes >= maxBytes) return
+    let entries
+    try { entries = fs.readdirSync(directory, { withFileTypes: true }) } catch { return }
+    entries.sort((a, b) => a.name.localeCompare(b.name))
+    for (const entry of entries) {
+      if (files.length >= maxFiles || bytes >= maxBytes) return
+      const absolute = path.join(directory, entry.name)
+      if (entry.isDirectory()) {
+        if (SKIP_DIRECTORIES.has(entry.name)) continue
+        if (entry.name.startsWith('.')) continue
+        walk(absolute)
+        continue
+      }
+      if (!entry.isFile()) continue
+      if (!SOURCE_EXTENSIONS.has(path.extname(entry.name))) continue
+      const relative = path.relative(root, absolute).split(path.sep).join('/')
+      if (BUILD_FILE.test(relative)) continue
+      let size = 0
+      try { size = fs.statSync(absolute).size } catch { continue }
+      if (bytes + size > maxBytes) continue
+      bytes += size
+      files.push(absolute)
+    }
+  }
+  walk(root)
+  return files
+}
+
+/** Read all source files once, returning {file, relative, text} records. */
+export function readSources(root, options) {
+  return listSourceFiles(root, options).map(file => ({
+    file,
+    relative: posixRelative(root, file),
+    text: readText(file),
+  }))
+}
+
+export function regexHits(sources, pattern) {
+  const hits = []
+  for (const source of sources) {
+    const re = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`)
+    let match
+    while ((match = re.exec(source.text))) {
+      const before = source.text.slice(0, match.index)
+      const line = before.split('\n').length
+      hits.push({ file: source.relative, line, text: match[0] })
+      if (match[0] === '') re.lastIndex += 1
+    }
+  }
+  return hits
+}
+
+/** Resolve an exports target for the root subpath. Returns a relative path or null. */
+export function rootExportTarget(manifest) {
+  const exportsField = manifest.exports
+  if (exportsField === undefined) return null
+  const pick = (value) => {
+    if (typeof value === 'string') return value
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        const picked = pick(item)
+        if (picked) return picked
+      }
+      return null
+    }
+    if (!isObject(value)) return null
+    for (const key of ['import', 'default', 'node', 'require', 'module-sync', 'browser']) {
+      if (Object.hasOwn(value, key)) {
+        const picked = pick(value[key])
+        if (picked) return picked
+      }
+    }
+    return null
+  }
+  if (typeof exportsField === 'string' || Array.isArray(exportsField)) return pick(exportsField)
+  if (!isObject(exportsField)) return null
+  if (Object.hasOwn(exportsField, '.')) return pick(exportsField['.'])
+  // A conditional object without subpath keys is the root export.
+  if (Object.hasOwn(exportsField, 'import') || Object.hasOwn(exportsField, 'default') || Object.hasOwn(exportsField, 'require')) return pick(exportsField)
+  return null
+}

package/40-checker/test/attestation.test.mjs

@@ -0,0 +1,59 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { validateAttestation } from '../scripts/attestation-check.mjs'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const ROOT = path.resolve(HERE, '..', '..')
+const base = () => JSON.parse(fs.readFileSync(path.join(ROOT, 'publish/attestations/DSH-ATT-2026-001.json'), 'utf8'))
+
+test('attestation: the checked-in example passes', () => {
+  const result = validateAttestation(base())
+  assert.deepEqual(result.errors, [])
+})
+
+test('attestation: a level field is forbidden', () => {
+  const cert = base()
+  cert.level = 'entry'
+  const result = validateAttestation(cert)
+  assert.ok(result.errors.some((e) => /level field/.test(e)))
+})
+
+test('attestation: selfAssessed cannot be verified', () => {
+  const cert = base()
+  cert.claimLevel = 'verified'
+  const result = validateAttestation(cert)
+  assert.ok(result.errors.some((e) => /cannot claim verified/.test(e)))
+})
+
+test('attestation: an expired active attestation fails', () => {
+  const cert = base()
+  cert.status = 'active'
+  cert.issuedAt = '2024-01-01'
+  cert.expiresAt = '2025-01-01'
+  const result = validateAttestation(cert)
+  assert.ok(result.errors.some((e) => /cannot be active/.test(e)))
+})
+
+test('attestation: excluded scope is required', () => {
+  const cert = base()
+  cert.scope.excluded = []
+  const result = validateAttestation(cert)
+  assert.ok(result.errors.some((e) => /scope\.excluded/.test(e)))
+})
+
+test('attestation: evidence needs a URL or hash', () => {
+  const cert = base()
+  cert.evidence[0] = { id: 'A', result: 'PASS' }
+  const result = validateAttestation(cert)
+  assert.ok(result.errors.some((e) => /needs a url or sha256/.test(e)))
+})
+
+test('attestation: disclaimer must deny official/certification', () => {
+  const cert = base()
+  cert.disclaimer = 'A great plugin, approved.'
+  const result = validateAttestation(cert)
+  assert.ok(result.errors.some((e) => /non-official/.test(e)))
+})

package/40-checker/test/checks.test.mjs

@@ -0,0 +1,172 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { runManifestChecks } from '../src/manifest.mjs'
+import { checkCapabilities, checkCredentials, checkLabels } from '../src/declarations.mjs'
+import { readSources } from '../src/util.mjs'
+import { buildReport } from '../src/report.mjs'
+import { parseInstallSpec } from '../src/install-spec.mjs'
+
+const here = path.dirname(fileURLToPath(import.meta.url))
+const good = path.join(here, '..', 'fixtures', 'good')
+const bad = path.join(here, '..', 'fixtures', 'bad')
+
+test('good fixture passes manifest and version checks', () => {
+  const result = runManifestChecks(good)
+  assert.equal(result.kind, 'plugin')
+  assert.equal(result.checks[0].id, 'DSC-01')
+  assert.equal(result.checks[0].result, 'PASS')
+  assert.equal(result.checks[1].result, 'PASS')
+  assert.equal(result.checks[2].result, 'NA')
+})
+
+test('bad fixture fails version and warns licence', () => {
+  const result = runManifestChecks(bad)
+  assert.equal(result.checks[0].result, 'WARN')
+  assert.equal(result.checks[1].result, 'FAIL')
+  assert.match(result.checks[1].reason, /engines\.dsh|peer/)
+})
+
+test('good fixture declarations are consistent', () => {
+  const result = runManifestChecks(good)
+  const sources = readSources(good)
+  const caps = checkCapabilities(result.manifest, sources, result.patch)
+  const creds = checkCredentials(result.manifest, sources)
+  const labels = checkLabels(result.manifest, sources)
+  assert.equal(caps.result, 'PASS', caps.reason)
+  assert.equal(creds.result, 'PASS', creds.reason)
+  assert.equal(labels.result, 'PASS', labels.reason)
+})
+
+test('bad fixture rejects official label and unknown capability', () => {
+  const result = runManifestChecks(bad)
+  const sources = readSources(bad)
+  const caps = checkCapabilities(result.manifest, sources, result.patch)
+  const labels = checkLabels(result.manifest, sources)
+  assert.equal(labels.result, 'FAIL')
+  assert.match(labels.reason, /official|forbidden/)
+  assert.equal(caps.result, 'WARN')
+})
+
+test('parseInstallSpec pins git and rejects floating git', () => {
+  const pinned = parseInstallSpec('github:acme/dsh-greet#0123456789abcdef0123456789abcdef01234567')
+  assert.equal(pinned.kind, 'git')
+  assert.equal(pinned.pinned, true)
+  assert.throws(() => parseInstallSpec('github:acme/dsh-greet'), /pin/)
+  assert.equal(parseInstallSpec('@acme/dsh-greet@1.2.3').pinned, true)
+  assert.equal(parseInstallSpec('@acme/dsh-greet').pinned, false)
+})
+
+test('report marks missing mandatory checks as incomplete', () => {
+  const checks = [
+    { id: 'DSC-01', clause: 'C-1', layer: 'L0', result: 'PASS', coverage: 'full', reason: '', details: [], evidence: [] },
+    { id: 'DSC-02', clause: 'C-2', layer: 'L0', result: 'PASS', coverage: 'full', reason: '', details: [], evidence: [] },
+  ]
+  const report = buildReport({
+    subject: { mode: 'package', profile: 'package', kind: 'plugin', kindInferred: false, name: 'x', version: '1.0.0', path: here },
+    anchor: { repo: 'x', commit: '0'.repeat(40), scanner: 'x', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
+    checks,
+    scope: 'ds-c',
+    profile: 'package',
+    kind: 'plugin',
+  })
+  assert.equal(report.conclusion.status, 'incomplete')
+  assert.equal(report.conclusion.exitCode, 2)
+  assert.equal(report.conclusion.level, null)
+  assert.ok(report.coverage.notRun > 0)
+})
+
+test('report passes when all mandatory checks are full and clean', () => {
+  const checks = ['DSC-01', 'DSC-02', 'DSC-04', 'DSC-05', 'DSC-06', 'DSC-07', 'DSC-08', 'DSC-09', 'DSC-11', 'DSC-12', 'DSC-13']
+    .map(id => ({ id, clause: id.replace('DSC', 'C'), layer: 'L0', result: 'PASS', coverage: 'full', reason: '', details: [], evidence: [] }))
+  const report = buildReport({
+    subject: { mode: 'package', profile: 'package', kind: 'plugin', kindInferred: false, name: 'x', version: '1.0.0', path: here },
+    anchor: { repo: 'x', commit: '0'.repeat(40), scanner: 'x', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
+    checks,
+    scope: 'ds-c',
+    profile: 'package',
+    kind: 'plugin',
+  })
+  assert.equal(report.conclusion.status, 'pass')
+  assert.equal(report.conclusion.exitCode, 0)
+  assert.equal(report.conclusion.level, 'DS-C (package)')
+})
+
+test('static-only M1 report maps L1-L3 to NA and issues DS-C static', () => {
+  const checks = ['DSC-01', 'DSC-02', 'DSC-03', 'DSC-11', 'DSC-12', 'DSC-13']
+    .map(id => ({ id, clause: id.replace('DSC', 'C'), layer: 'L0', result: 'PASS', coverage: 'full', reason: '', details: [], evidence: [] }))
+    .concat(['DSC-04', 'DSC-05', 'DSC-06', 'DSC-07', 'DSC-08', 'DSC-09'].map(id => ({ id, clause: id.replace('DSC', 'C'), layer: 'L1', result: 'ERROR', coverage: 'not-run', reason: 'no runtime', details: [], evidence: [] })))
+  const report = buildReport({
+    subject: { mode: 'listing', profile: 'listing', kind: 'plugin', kindInferred: false, name: 'x', version: '1.0.0', path: here },
+    anchor: { repo: 'x', commit: '0'.repeat(40), scanner: 'x', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
+    checks,
+    scope: 'ds-c',
+    profile: 'listing',
+    kind: 'plugin',
+    staticOnly: true,
+  })
+  assert.equal(report.conclusion.status, 'pass')
+  assert.equal(report.conclusion.level, 'DS-C static')
+  assert.equal(report.conclusion.staticOnly, true)
+  assert.equal(report.checks.find(item => item.id === 'DSC-04').result, 'NA')
+})
+
+function entryChecks(overrides = {}) {
+  const make = (id, clause, result = 'PASS', details = []) => ({ id, clause, layer: 'L0', result, coverage: result === 'ERROR' ? 'not-run' : 'full', reason: '', details, evidence: [] })
+  return [
+    make('DSC-01', 'C-1'),
+    make('DSC-02', 'C-2', overrides.c2Result ?? 'PASS', overrides.c2Details ?? []),
+    make('DSC-11', 'C-11'),
+    make('DSC-12', 'C-12'),
+    make('DSC-13', 'C-13'),
+    make('DSC-14', 'C-14', overrides.runResult ?? 'PASS'),
+  ]
+}
+
+test('entry: C-2.1 only is WARN, runtime level', () => {
+  const report = buildReport({
+    subject: { mode: 'package', profile: 'package', kind: 'plugin', kindInferred: false, name: 'x', version: '1.0.0', path: here },
+    anchor: { repo: 'x', commit: '0'.repeat(40), scanner: 'x', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
+    checks: entryChecks({ c2Result: 'FAIL', c2Details: [{ item: 'C-2.1', result: 'FAIL', reason: 'no engines' }] }),
+    scope: 'entry', profile: 'package', kind: 'plugin',
+  })
+  assert.equal(report.conclusion.status, 'warn')
+  assert.equal(report.conclusion.level, 'DSH-ENTRY runtime (warnings)')
+})
+
+test('entry: C-2.2 remains blocking', () => {
+  const report = buildReport({
+    subject: { mode: 'package', profile: 'package', kind: 'plugin', kindInferred: false, name: 'x', version: '1.0.0', path: here },
+    anchor: { repo: 'x', commit: '0'.repeat(40), scanner: 'x', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
+    checks: entryChecks({ c2Result: 'FAIL', c2Details: [{ item: 'C-2.2', result: 'FAIL', reason: 'peer mismatch' }] }),
+    scope: 'entry', profile: 'package', kind: 'plugin',
+  })
+  assert.equal(report.conclusion.status, 'fail')
+  assert.ok(report.coverage.entryBlocking.failed.includes('C-2.2'))
+})
+
+test('entry: no runtime is incomplete, not static pass', () => {
+  const report = buildReport({
+    subject: { mode: 'package', profile: 'package', kind: 'plugin', kindInferred: false, name: 'x', version: '1.0.0', path: here },
+    anchor: { repo: 'x', commit: '0'.repeat(40), scanner: 'x', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
+    checks: entryChecks({ runResult: 'ERROR' }),
+    scope: 'entry', profile: 'package', kind: 'plugin',
+  })
+  assert.equal(report.conclusion.status, 'incomplete')
+  assert.equal(report.conclusion.exitCode, 2)
+  assert.equal(report.conclusion.level, null)
+})
+
+test('entry: static claim recognizes without runtime', () => {
+  const checks = entryChecks().filter(c => c.id !== 'DSC-14')
+  const report = buildReport({
+    subject: { mode: 'package', profile: 'package', kind: 'plugin', kindInferred: false, name: 'x', version: '1.0.0', path: here },
+    anchor: { repo: 'x', commit: '0'.repeat(40), scanner: 'x', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
+    checks,
+    scope: 'entry', profile: 'package', kind: 'plugin', entryClaim: 'static',
+  })
+  assert.equal(report.conclusion.status, 'pass')
+  assert.equal(report.conclusion.level, 'DSH-ENTRY recognized')
+  assert.equal(report.conclusion.exitCode, 0)
+})

package/40-checker/test/claim.test.mjs

@@ -0,0 +1,28 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { scanText } from '../scripts/claim-check.mjs'
+
+test('claim: an official claim fails', () => {
+  const r = scanText('DSH-ENTRY is an official certification.', 'x.md')
+  assert.equal(r.errors.length, 1)
+})
+
+test('claim: a negated claim passes', () => {
+  const r = scanText('DSH-ENTRY is not an official certification.', 'x.md')
+  assert.deepEqual(r.errors, [])
+})
+
+test('claim: Chinese negation passes', () => {
+  const r = scanText('DSH-ENTRY 不是官方认证，也不做安全审计。', 'x.md')
+  assert.deepEqual(r.errors, [])
+})
+
+test('claim: a mark without a disclaimer warns', () => {
+  const r = scanText('DSH-FLOW manual', 'x.md')
+  assert.equal(r.warnings.length, 1)
+})
+
+test('claim: a mark with a disclaimer does not warn', () => {
+  const r = scanText('DSH-FLOW manual\n非官方 · 非认证 · 非安全审计', 'x.md')
+  assert.deepEqual(r.warnings, [])
+})

package/40-checker/test/client-shape.test.mjs

@@ -0,0 +1,35 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { runManifestChecks } from '../src/manifest.mjs'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const ROOT = path.resolve(HERE, '..')
+
+test('G4: no dsh.client is not-applicable, not failed', () => {
+  const { g4 } = runManifestChecks(path.join(ROOT, 'fixtures/good'))
+  assert.equal(g4.hasClient, false)
+  assert.equal(g4.ok, true)
+  assert.equal(g4.result, 'NA')
+})
+
+test('G4: dsh.client without exports["./client"] fails statically', () => {
+  const { g4 } = runManifestChecks(path.join(ROOT, 'fixtures/client-missing'))
+  assert.equal(g4.hasClient, true)
+  assert.equal(g4.ok, false)
+  assert.equal(g4.result, 'FAIL')
+  assert.match(g4.reason, /exports\["\.\/client"\]/)
+})
+
+test('G4: a client package with the export passes statically', () => {
+  const manifest = JSON.parse(fs.readFileSync(path.join(ROOT, 'fixtures/client-missing/package.json'), 'utf8'))
+  manifest.exports['./client'] = './client.js'
+  const dir = fs.mkdtempSync(path.join(ROOT, 'fixtures', 'client-ok-'))
+  fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify(manifest))
+  const { g4 } = runManifestChecks(dir)
+  assert.equal(g4.ok, true)
+  assert.equal(g4.result, 'PASS')
+  fs.rmSync(dir, { recursive: true, force: true })
+})