dsh-standards 1.0.0 → 1.0.1

package/40-checker/README.md

@@ -3,7 +3,7 @@
 > 版本：0.1.0 ｜ 日期：2026-10-31 ｜ 标准：DS-C v1.0.0 ｜ 许可：Apache-2.0
 > 零依赖，Node ≥ 20。只读目标包；不修改被检对象。
 >
-> **未发布到 npm。** npm 上的 `dsh-plugin-verify` 是另一个项目；`dsh-levels` 也是第三方包。请从本仓运行 `node bin/...`，不要 `npx dsh-plugin-verify` / `npx dsh-levels`。
+> **发行方式**：本仓直接运行时用 `node 40-checker/bin/...`；npm 上通过 `dsh-standards` 包分发（提供 `dsh-standards` 与 `dsh-levels` 两个命令）。不要用 `npx dsh-plugin-verify`、`npx dsh-levels`——npm 上这两个名字属于其他项目。
 
 ## 1. 它做什么
 
@@ -50,7 +50,7 @@ node bin/dsh-plugin-verify.mjs /path/to/plugin --format sarif --out report.sarif
 # package：作者本地
 node bin/dsh-plugin-verify.mjs ./my-plugin
 
-# listing：市场门禁
+# listing：市场条目校验（收录前提醒，不是门禁）
 node bin/dsh-plugin-verify.mjs ./my-plugin \
   --profile listing \
   --market-index ./market.json \

package/40-checker/src/cli.mjs

@@ -13,7 +13,7 @@ const DEFAULT_COMMIT = 'ce7073d51254c26cd63b22a60835b8f948deb447'
 const DEFAULT_CORDIS = '4.0.6-alpha.1'
 
 function usage() {
-  return `dsh-plugin-verify ${VERSION} — DS-C conformance checker (MVP)
+  return `${process.env.DSH_CHECKER_BRAND || 'dsh-plugin-verify ' + VERSION} — DS-C conformance checker (MVP)
 
 Usage:
   dsh-plugin-verify <package-dir> [options]

package/40-checker/src/manifest.mjs

@@ -31,6 +31,19 @@ function inside(root, target) {
 export function resolveEntry(dir, manifest) {
   const candidates = []
   const exportTarget = rootExportTarget(manifest)
+  if (exportTarget) {
+    const absolute = path.resolve(dir, exportTarget)
+    if (!inside(dir, absolute)) {
+      return { exists: false, escape: true, source: 'exports["."]', target: exportTarget, absolute }
+    }
+    if (!isFile(absolute)) {
+      const sourceCandidates = ['src/index.ts', 'src/index.tsx', 'src/index.js', 'src/index.mjs']
+      const sourceEntry = sourceCandidates.find(relative => isFile(path.join(dir, relative))) ?? null
+      const scripts = isObject(manifest.scripts) ? manifest.scripts : {}
+      const buildHint = Boolean(sourceEntry) || ['build', 'prepare', 'compile'].some(name => typeof scripts[name] === 'string')
+      return { exists: false, escape: false, source: 'exports["."]', target: exportTarget, absolute, declaredMissing: true, sourceEntry, buildHint }
+    }
+  }
   if (exportTarget) candidates.push({ source: 'exports["."]', target: exportTarget })
   if (typeof manifest.main === 'string' && manifest.main.trim() !== '') candidates.push({ source: 'main', target: manifest.main })
   for (const fallback of ['index.js', 'index.mjs', 'index.cjs', 'index.ts']) candidates.push({ source: 'fallback', target: fallback })
@@ -183,6 +196,10 @@ export function runManifestChecks(dir, options = {}) {
   }
   if (entry.escape) {
     manifestDetails.push(detail('C-1.2', 'FAIL', `entry escapes the package: ${entry.target}`, ['package.json#exports']))
+  } else if (entry.declaredMissing && entry.buildHint) {
+    manifestDetails.push(detail('C-1.2', 'WARN', `exports["."] target missing; build hint exists (${entry.sourceEntry ?? 'build script'})`, ['package.json#exports']))
+  } else if (entry.declaredMissing) {
+    manifestDetails.push(detail('C-1.2', 'FAIL', `exports["."] points to a missing file: ${entry.target}`, ['package.json#exports']))
   } else if (entry.exists) {
     manifestDetails.push(detail('C-1.2', 'PASS', `entry resolves via ${entry.source}: ${entry.relative}`, [entry.relative]))
   } else if (entry.buildHint) {

package/40-checker/src/semver.mjs

@@ -63,19 +63,85 @@ function upperForTilde(version) {
   return { ...version, minor: version.minor + 1, patch: 0, prerelease: [] }
 }
 
-function tokenizeAlternative(alternative) {
-  const tokens = []
+function parsePartial(text) {
+  const match = /^v?(\d+)(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(?:-([0-9A-Za-z.-]+))?$/.exec(text.trim())
+  if (!match) return null
+  return {
+    major: Number(match[1]),
+    minor: match[2] === undefined || /[xX*]/.test(match[2]) ? null : Number(match[2]),
+    patch: match[3] === undefined || /[xX*]/.test(match[3]) ? null : Number(match[3]),
+    prerelease: match[4] ? match[4].split('.') : [],
+  }
+}
+
+function fullVersion(partial) {
+  return { major: partial.major, minor: partial.minor ?? 0, patch: partial.patch ?? 0, prerelease: partial.prerelease }
+}
+function nextMinor(partial) { return { major: partial.major, minor: (partial.minor ?? 0) + 1, patch: 0, prerelease: [] } }
+function nextMajor(partial) { return { major: partial.major + 1, minor: 0, patch: 0, prerelease: [] } }
+function fmt(version) {
+  const base = `${version.major}.${version.minor}.${version.patch}`
+  return version.prerelease && version.prerelease.length ? `${base}-${version.prerelease.join('.')}` : base
+}
+
+function expandToken(raw) {
+  if (raw === '*' || raw === 'x' || raw === 'X') return '*'
+  const match = /^(>=|<=|>|<|=|\^|~)?\s*v?(\d+)(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(?:-([0-9A-Za-z.-]+))?$/.exec(raw)
+  if (!match) return null
+  const op = match[1] ?? '='
+  const partial = {
+    major: Number(match[2]),
+    minor: match[3] === undefined || /[xX*]/.test(match[3]) ? null : Number(match[3]),
+    patch: match[4] === undefined || /[xX*]/.test(match[4]) ? null : Number(match[4]),
+    prerelease: match[5] ? match[5].split('.') : [],
+  }
+  const low = fullVersion(partial)
+  const noMinor = partial.minor === null
+  const noPatch = partial.patch === null
+  if (!noMinor && !noPatch) return `${op}${fmt(low)}`
+  switch (op) {
+    case '^':
+    case '~':
+    case '=':
+      return noMinor ? `>=${fmt(low)} <${fmt(nextMajor(partial))}` : `>=${fmt(low)} <${fmt(nextMinor(partial))}`
+    case '>=': return `>=${fmt(low)}`
+    case '>': return noMinor ? `>=${fmt(nextMajor(partial))}` : `>=${fmt(nextMinor(partial))}`
+    case '<': return `<${fmt(low)}`
+    case '<=': return noMinor ? `<${fmt(nextMajor(partial))}` : `<${fmt(nextMinor(partial))}`
+    default: return null
+  }
+}
+
+/** Hyphen ranges and x-ranges are normalized before tokenizing. */
+function expandAlternative(alternative) {
   const text = alternative.trim()
-  if (text === '' || text === '*' || text === 'x' || text === 'X') return [{ op: '*', version: null }]
-  // Insert a space between a comparator and its version when written as ">=1.2.3"
-  // (already no space) and split on whitespace.
+  if (text === '' || text === '*' || text === 'x' || text === 'X') return '*'
+  const hyphen = /^(.+?)\s+-\s+(.+)$/.exec(text)
+  if (hyphen) {
+    const left = parsePartial(hyphen[1])
+    const right = parsePartial(hyphen[2])
+    if (!left || !right) return null
+    const low = `>=${fmt(fullVersion(left))}`
+    if (right.minor === null) return `${low} <${fmt(nextMajor(right))}`
+    if (right.patch === null) return `${low} <${fmt(nextMinor(right))}`
+    return `${low} <=${fmt(fullVersion(right))}`
+  }
+  const parts = []
   for (const raw of text.split(/\s+/)) {
-    let token = raw
-    if (token === '*' || token === 'x' || token === 'X') {
-      tokens.push({ op: '*', version: null })
-      continue
-    }
-    const match = /^(>=|<=|>|<|=|\^|~)?\s*v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/.exec(token)
+    const expanded = expandToken(raw)
+    if (expanded === null) return null
+    parts.push(expanded)
+  }
+  return parts.join(' ')
+}
+
+function tokenizeAlternative(alternative) {
+  const expanded = expandAlternative(alternative)
+  if (expanded === null) return null
+  if (expanded === '*') return [{ op: '*', version: null }]
+  const tokens = []
+  for (const raw of expanded.split(/\s+/)) {
+    const match = /^(>=|<=|>|<|=|\^|~)?\s*v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/.exec(raw)
     if (!match) return null
     const op = match[1] ?? '='
     const version = parseVersion(match[2])

package/CHANGELOG.md

@@ -0,0 +1,24 @@
+## 1.0.1 — 2026-11-03
+
+- 打包：`files` 收窄，不再把 `40-checker/results/` 打进 npm 包（此前包含第三方插件结果、截图与本机路径）。
+- 文档：`npx dsh-levels` 会装到第三方包，改为 `npx -p dsh-standards dsh-levels`；修正不存在的 `bin/` 路径；测试数 73→98。
+- CLI：`dsh-standards --help` 首行显示自己的包名与版本。
+- 检查器：`exports["."]` 指向缺失文件时不再回退到 `main`。
+
+# Changelog
+
+## 2026-11-03 — Node 24.9 baseline
+- Require Node >=24.9.0 to match DeepSeek Harness 0.2.2-alpha.3.
+
+## 2026-11-02 — P0–P2, Apache-2.0, and attestation migration
+
+- Renamed certificate → attestation (`dsh-attestation/1`, `DSH-ATT-*`,
+  `publish/attestations/`); historical docs carry a migration banner.
+- Added the gap ledger (43), role governance (44), and three-purpose kits (45).
+- Added `scheme/`, `spec/clauses.json`, `spec/reference-suite.json`,
+  `spec/schemas/report.schema.json`, `evidence/` hash chain.
+- Added G4 static check, clause-map, stale-check, surveillance, dashboard.
+- Added developer/official/market kits and `publish/verify.mjs` / `verify.html`.
+- CI: governance checks, 73 tests, attestation verify, shell syntax, cross-platform matrix.
+- License: text CC BY 4.0 with a required Change Notice; code Apache-2.0 (D-013); marks separate.
+- Cross-repo: portal `f882144`, guide `e75cd9f`, kit `9897213`, catalog `a272d06`, certification `2f27666`, cert-mcp `4f0cf72`.

package/NOTICE

@@ -0,0 +1,14 @@
+DSH standards
+Copyright 2026 PerryLink
+
+Text/specifications/documentation: CC BY 4.0 (LICENSE-CC-BY).
+Modifications must carry a prominent Change Notice (MODIFICATION-POLICY.md).
+Code/scripts/schemas: Apache License 2.0 (LICENSE-APACHE).
+
+Unless required by applicable law or agreed to in writing, software is
+distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND.
+See the applicable license for the specific language.
+
+The words DSH-ENTRY, DSH-FLOW, DSH-BOOST and the level badges are not licensed
+by either license. Their use is governed by governance/mark-policy.md.
+No trademark registration is claimed.

package/README.md

@@ -17,7 +17,7 @@
 
 | 层 | 规范/实践 | 当前状态 |
 |---|---|---|
-| 1 | **DSH-ENTRY 入门规范** | 18/18 `recognized`；base-only 10/18 verified（8 clean + 2 gate-reject）；real web profile 18/18 verified（16 clean + 2 gate-reject）；client 15/15 loaded；18/18 clean 未达成 |
+| 1 | **DSH-ENTRY 入门规范** | 18/18 `recognized`；base-only 10/18 有 runtime 证据（8 clean + 2 reject）；real web profile 16/18 无告警、2 个 host-gate reject（自评，无独立复核）；client 15/15 loaded；18/18 clean 未达成 |
 | 2 | **DSH-FLOW 顺畅规范** | draft；fixture 上 J1/J2/J4/J6 **12 PASS**；J3/J7 fixture runtime；J5/J8 static preflight；10 个真实包 **78 PASS / 4 FAIL / 2 blocked / 66 not-run** |
 | 3 | **DSH-BOOST 加速实践** | draft；LEV-1–8 **8/8 measured**（loader / context / provider-capture / synthetic timer；非生产基线） |
 
@@ -57,21 +57,21 @@
 ```bash
 # Published umbrella (package `dsh-standards`)
 npx dsh-standards <plugin-dir> --scope entry --entry-claim static
-npx dsh-levels audit <dir> --format json
+npx -p dsh-standards dsh-levels <dir> --format json
 
 # From a source checkout
 cd 40-checker
 node --test test/*.test.mjs
 
 # 只做结构识别（不声明运行）
-node bin/dsh-plugin-verify.mjs <plugin-dir> --scope entry --entry-claim static
+node 40-checker/bin/dsh-plugin-verify.mjs <plugin-dir> --scope entry --entry-claim static
 
 # 声明运行（bundle 需要 host）
-node bin/dsh-plugin-verify.mjs <bundle-dir> --scope entry \
+node 40-checker/bin/dsh-plugin-verify.mjs <bundle-dir> --scope entry \
   --host /path/to/@deepseek-ai/dsh-app-boot/lib/index.js
 
 # 三层自检（ENTRY 自动；FLOW/BOOST 证据文件）
-node bin/dsh-levels.mjs audit <dir> --format json
+node bin/dsh-levels.mjs <dir> --format json
 
 # J1 安装/卸载旅程
 node scripts/journey-runtime.mjs --package <dir> --json
@@ -95,7 +95,7 @@ node lev7-bench.mjs 64 20
 - 18 包 base-only runtime：**18/18 有原始 JSON；10/18 G3 verified，8 partial，0 error**；host gate 后 **8 clean + 2 reject + 8 partial**；
 - client runtime：**15/15 `client-module-loaded`**（真实 Chromium）；web-app **4/4 loaded**；
 - 不可用：**0 plugin code FAIL；2 host-gate reject（telemetry/verification）**；
-- 检查器：**73/73 tests**（含治理/DCO/评价记录/声明/验真/链/漂移测试）；
+- 检查器：**98/98 tests**（含治理/DCO/评价记录/声明/验真/链/漂移测试）；
 - J1：**6 PASS + 1 WARN**；LEV-3：volatile **0/20** vs control **20/20** remount；LEV-6：稳定 prefix **100%** vs 易变 **0%**；LEV-7：**8.24×**（合成，非生产基线）。
 
 ## 给插件开发者：什么时候用哪个工具

package/bin/dsh-standards.mjs

@@ -15,4 +15,5 @@ if (argv.includes('--version') || argv.includes('-v')) {
   process.exit(0)
 }
 
+process.env.DSH_CHECKER_BRAND = `dsh-standards ${pkg.version} (checker 0.1.0)`
 await import('../40-checker/bin/dsh-plugin-verify.mjs')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-standards",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "DSH plugin standards and conformance checks: ENTRY/FLOW checks plus BOOST guidance. Non-official; no certification or ranking.",
   "type": "module",
   "main": "40-checker/src/index.mjs",
@@ -13,22 +13,31 @@
     "dsh-levels": "./bin/dsh-levels.mjs"
   },
   "files": [
-    "40-checker",
+    "bin",
+    "40-checker/bin",
+    "40-checker/src",
+    "40-checker/scripts",
+    "40-checker/samples",
+    "40-checker/fixtures",
+    "40-checker/test",
+    "40-checker/package.json",
+    "40-checker/README.md",
     "spec",
     "docs",
-    "bin",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE",
     "LICENSE-APACHE",
     "LICENSE-CC-BY",
-    "NOTICE.md"
+    "NOTICE.md",
+    "NOTICE"
   ],
   "scripts": {
     "test": "node --test 40-checker/test/*.test.mjs",
     "test:fixtures": "node bin/dsh-standards.mjs 40-checker/fixtures/good --scope entry --entry-claim static --format text"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=24.9.0"
   },
   "keywords": [
     "dsh",

package/40-checker/.github/workflows/plugin-verify.yml

@@ -1,70 +0,0 @@
-name: plugin-verify
-on:
-  push:
-  pull_request:
-  workflow_dispatch:
-jobs:
-  l0:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-      - name: unit tests
-        run: node --test
-      - name: good fixture (static-only M1; expect 0)
-        run: |
-          node bin/dsh-plugin-verify.mjs fixtures/good \
-            --static-only \
-            --market-index fixtures/market-index.json \
-            --plugin-name @dsh-fixtures/good-plugin \
-            --format json --out /tmp/good.json
-      - name: bad fixture (expect 1; 0 would be a false green)
-        run: |
-          set +e
-          node bin/dsh-plugin-verify.mjs fixtures/bad --format json --out /tmp/bad.json
-          code=$?
-          test "$code" -eq 1
-      - name: SARIF smoke
-        run: |
-          node bin/dsh-plugin-verify.mjs fixtures/good \
-            --static-only \
-            --market-index fixtures/market-index.json \
-            --plugin-name @dsh-fixtures/good-plugin \
-            --format sarif --out /tmp/good.sarif
-      - uses: actions/upload-artifact@v4
-        with:
-          name: reports
-          path: |
-            /tmp/good.json
-            /tmp/bad.json
-            /tmp/good.sarif
-
-  l1-manual:
-    if: github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-      - name: build host farm (requires a DSH checkout at DSH_HOST)
-        env:
-          DSH_HOST: ${{ vars.DSH_HOST }}
-        run: |
-          test -n "$DSH_HOST"
-          node scripts/host-farm.mjs --plugin fixtures/bundle --farm /tmp/farm --link --quiet
-      - name: L1 on bundle fixture
-        env:
-          DSH_HOST: ${{ vars.DSH_HOST }}
-        run: |
-          node bin/dsh-plugin-verify.mjs /tmp/farm/plugins/bundle \
-            --treat-as-plugin \
-            --runtime "$DSH_HOST/vendor/cordis/lib/index.js" \
-            --runtime-version 0.2.2-alpha.2 \
-            --format json --out /tmp/l1.json
-      - uses: actions/upload-artifact@v4
-        with:
-          name: l1-report
-          path: /tmp/l1.json