dsh-standards 1.2.0 → 1.2.1

package/40-checker/test/level-audit.test.mjs

@@ -1,99 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-import path from 'node:path'
-
-const HERE = path.dirname(fileURLToPath(import.meta.url))
-const STD = path.resolve(HERE, '..', '..')
-const SCRIPT = path.join(STD, '40-checker', 'scripts', 'level-audit.mjs')
-const GOOD = path.join(STD, '40-checker', 'fixtures', 'good')
-
-test('level-audit: static ENTRY is recognized, FLOW/BOOST are not upgraded', () => {
-  const run = spawnSync(process.execPath, [SCRIPT, GOOD, '--format', 'json'], { encoding: 'utf8', timeout: 30_000 })
-  assert.equal(run.status, 0, run.stderr)
-  const result = JSON.parse(run.stdout)
-  assert.equal(result.schema, 'dsh-level-audit/1')
-  assert.equal(result.levelsSpec.schema, 'dsh-levels/1')
-  assert.equal(result.levels.entry.state, 'recognized')
-  assert.equal(result.levels.flow.state, 'not-run')
-  assert.equal(result.levels.boost.state, 'not-measured')
-  assert.deepEqual(result.notClaimed.includes('certification'), true)
-})
-
-test('level-audit: a missing package exits 3 and does not print a fake pass', () => {
-  const run = spawnSync(process.execPath, [SCRIPT, '/no/such/package', '--format', 'json'], { encoding: 'utf8', timeout: 30_000 })
-  assert.equal(run.status, 3)
-  assert.match(run.stderr, /not a package directory/)
-})
-
-import fs from 'node:fs'
-import os from 'node:os'
-
-const BOOST_IDS = ['LEV-1', 'LEV-2', 'LEV-3', 'LEV-4', 'LEV-5', 'LEV-6', 'LEV-7', 'LEV-8']
-
-function writeBoostEvidence(rows) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-boost-evidence-'))
-  const file = path.join(dir, 'boost.json')
-  fs.writeFileSync(file, JSON.stringify(rows))
-  return { dir, file, cleanup: () => fs.rmSync(dir, { recursive: true, force: true }) }
-}
-
-function validCard(expiresAt = '2099-01-01', generatedAt = '2026-11-01') {
-  return {
-    subject: 'fixture@1.0.0',
-    host: 'fixture-host',
-    method: 'fixture',
-    scope: 'fixture',
-    command: 'node fixture.mjs',
-    result: 'pass',
-    negativeControl: 'control fails as expected',
-    generatedAt,
-    expiresAt,
-    recordHash: `sha256:${'a'.repeat(64)}`,
-    claimLevel: 'self-reported',
-    issuer: 'fixture',
-    selfAssessed: true,
-  }
-}
-
-test('level-audit: status-only BOOST rows are not measured without evidence cards', () => {
-  const rows = Object.fromEntries(BOOST_IDS.map(id => [id, { status: 'measured', evidence: 'looks fine' }]))
-  const fixture = writeBoostEvidence(rows)
-  try {
-    const run = spawnSync(process.execPath, [SCRIPT, GOOD, '--format', 'json', '--boost-evidence', fixture.file], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(run.status, 0, run.stderr)
-    const result = JSON.parse(run.stdout)
-    assert.equal(result.levels.boost.state, 'not-measured')
-    assert.equal(result.levels.boost.practices['LEV-1'].card.valid, false)
-  } finally {
-    fixture.cleanup()
-  }
-})
-
-test('level-audit: BOOST is measured only with eight valid evidence cards', () => {
-  const rows = Object.fromEntries(BOOST_IDS.map(id => [id, { status: 'measured', evidenceCard: validCard() }]))
-  const fixture = writeBoostEvidence(rows)
-  try {
-    const run = spawnSync(process.execPath, [SCRIPT, GOOD, '--format', 'json', '--boost-evidence', fixture.file], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(run.status, 0, run.stderr)
-    const result = JSON.parse(run.stdout)
-    assert.equal(result.levels.boost.state, 'measured')
-    assert.equal(result.levels.boost.validCards, 8)
-  } finally {
-    fixture.cleanup()
-  }
-})
-
-test('level-audit: expired BOOST cards are stale, not measured', () => {
-  const rows = Object.fromEntries(BOOST_IDS.map(id => [id, { status: 'measured', evidenceCard: validCard('2020-01-01', '2019-01-01') }]))
-  const fixture = writeBoostEvidence(rows)
-  try {
-    const run = spawnSync(process.execPath, [SCRIPT, GOOD, '--format', 'json', '--boost-evidence', fixture.file], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(run.status, 0, run.stderr)
-    const result = JSON.parse(run.stdout)
-    assert.equal(result.levels.boost.state, 'stale')
-  } finally {
-    fixture.cleanup()
-  }
-})

package/40-checker/test/levels.test.mjs

@@ -1,31 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { readFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
-import path from 'node:path'
-
-const HERE = path.dirname(fileURLToPath(import.meta.url))
-const STD = path.resolve(HERE, '..', '..')
-const levels = JSON.parse(readFileSync(path.join(STD, 'spec', 'levels.json'), 'utf8'))
-
-test('levels: exactly three levels with the expected ids and analogies', () => {
-  assert.equal(levels.schema, 'dsh-levels/1')
-  assert.equal(levels.nonOfficial, true)
-  assert.deepEqual(levels.levels.map(level => level.id), ['entry', 'flow', 'boost'])
-  assert.deepEqual(levels.levels.map(level => level.analogy), ['GB', 'GB/T', 'GB/Z'])
-})
-
-test('levels: ENTRY has G0-G5, FLOW has J1-J8, BOOST has LEV-1..LEV-8', () => {
-  const gates = Object.fromEntries(levels.levels.map(level => [level.id, level.gates.map(gate => gate.id)]))
-  assert.deepEqual(gates.entry, ['G0', 'G1', 'G2', 'G3', 'G4', 'G5'])
-  assert.deepEqual(gates.flow, ['J1', 'J2', 'J3', 'J4', 'J5', 'J6', 'J7', 'J8'])
-  assert.deepEqual(gates.boost, ['LEV-1', 'LEV-2', 'LEV-3', 'LEV-4', 'LEV-5', 'LEV-6', 'LEV-7', 'LEV-8'])
-})
-
-test('levels: evidence states include not-run and never imply a pass', () => {
-  const all = new Set(levels.levels.flatMap(level => level.evidenceStates))
-  assert.equal(all.has('not-run'), true)
-  assert.equal(all.has('runtime'), true)
-  assert.equal(all.has('measured'), true)
-  assert.equal(levels.axes.rules.some(rule => rule.includes('skip is not a pass')), true)
-})

package/40-checker/test/ops.test.mjs

@@ -1,117 +0,0 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { validateClauseMap } from '../scripts/clause-map.mjs'
-import { effective } from '../scripts/stale-check.mjs'
-import { appendRecord, verifyChain } from '../scripts/evidence-chain.mjs'
-import { buildDashboard } from '../scripts/dashboard.mjs'
-import { inspect } from '../scripts/surveillance.mjs'
-
-const HERE = path.dirname(fileURLToPath(import.meta.url))
-const ROOT = path.resolve(HERE, '..', '..')
-const read = (rel) => JSON.parse(fs.readFileSync(path.join(ROOT, rel), 'utf8'))
-
-test('clause map: the checked-in map covers every gate', () => {
-  const result = validateClauseMap({ levels: read('spec/levels.json'), clauses: read('spec/clauses.json') })
-  assert.deepEqual(result.errors, [])
-  assert.deepEqual(result.covered.entry.sort(), ['G0', 'G1', 'G2', 'G3', 'G4', 'G5'])
-})
-
-test('clause map: a missing gate is an error', () => {
-  const levels = read('spec/levels.json')
-  const clauses = read('spec/clauses.json')
-  clauses.clauses = clauses.clauses.filter((c) => !c.gates.includes('G4'))
-  const result = validateClauseMap({ levels, clauses })
-  assert.ok(result.errors.some((e) => /G4/.test(e)))
-})
-
-test('stale: an active expired record is expired', () => {
-  const r = effective({ status: 'active', expiresAt: '2020-01-01' }, new Date('2026-11-01T00:00:00Z'))
-  assert.equal(r.status, 'expired')
-  assert.equal(r.stale, true)
-})
-
-test('stale: a draft is not valid but not “stale”', () => {
-  const r = effective({ status: 'draft', expiresAt: '2030-01-01' }, new Date('2026-11-01T00:00:00Z'))
-  assert.equal(r.status, 'draft')
-  assert.equal(r.stale, false)
-})
-
-test('evidence chain: append then verify', () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-chain-'))
-  const record = path.join(dir, 'record.json')
-  fs.writeFileSync(record, '{"ok":true}')
-  const chain = path.join(dir, 'chain.jsonl')
-  appendRecord({ chain, record, ts: '2026-11-02T00:00:00Z' })
-  appendRecord({ chain, record, ts: '2026-11-02T00:00:01Z' })
-  const result = verifyChain(fs.readFileSync(chain, 'utf8').split('\n'))
-  assert.deepEqual(result.errors, [])
-  assert.equal(result.entries, 2)
-  fs.rmSync(dir, { recursive: true, force: true })
-})
-
-test('evidence chain: tampering is detected', () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-chain-'))
-  const record = path.join(dir, 'record.json')
-  fs.writeFileSync(record, '{"ok":true}')
-  const chain = path.join(dir, 'chain.jsonl')
-  appendRecord({ chain, record, ts: '2026-11-02T00:00:00Z' })
-  const lines = fs.readFileSync(chain, 'utf8').split('\n')
-  lines[0] = lines[0].replace(/("recordSha256":")([0-9a-f])/, (m, a, b) => a + (b === '0' ? '1' : '0'))
-  const result = verifyChain(lines)
-  assert.ok(result.errors.length > 0)
-  fs.rmSync(dir, { recursive: true, force: true })
-})
-
-test('dashboard: never claims official/security/production', () => {
-  const d = buildDashboard(ROOT)
-  assert.equal(d.schema, 'dsh-dashboard/1')
-  assert.ok(d.notClaimed.includes('security audit'))
-  assert.equal(d.flow.packages, 10)
-})
-
-test('surveillance: expired record becomes an issue', () => {
-  const report = inspect({ attestations: [{ attestationId: 'DSH-ATT-2020-001', status: 'active', expiresAt: '2020-01-01', verifyUrl: 'https://example.com', claimLevel: 'self-reported' }] }, new Date('2026-11-01T00:00:00Z'))
-  assert.ok(report.issues.some((i) => i.issues.includes('expired')))
-})
-
-test('round-robin: independent matching runs are comparable', async () => {
-  const { compare } = await import('../scripts/round-robin.mjs')
-  const expected = { good: { expected: 'warn' }, bad: { expected: 'fail' } }
-  const r = compare({
-    a: { runner: 'runner-a', results: { good: { status: 'warn' }, bad: { status: 'fail' } } },
-    b: { runner: 'runner-b', results: { good: { status: 'warn' }, bad: { status: 'fail' } } },
-    expected,
-  })
-  assert.equal(r.comparable, true)
-})
-
-test('round-robin: two not-run results are not comparable', async () => {
-  const { compare } = await import('../scripts/round-robin.mjs')
-  const r = compare({
-    a: { runner: 'runner-a', results: { good: { status: 'not-run' } } },
-    b: { runner: 'runner-b', results: { good: { status: 'not-run' } } },
-    expected: { good: { expected: 'warn' } },
-  })
-  assert.equal(r.comparable, false)
-})
-
-test('flow index: aggregates result files without upgrading a verdict', async () => {
-  const { buildFlowIndex } = await import('../scripts/flow-index.mjs')
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-flow-index-'))
-  const row = (id, pass, fail) => ({
-    schema: 'dsh-flow-real/1', id, package: id, version: '1.0.0', source: 'fixture', why: 'test',
-    verdicts: { J1: pass ? 'pass' : 'fail', J2: 'not-run', J4: 'not-run', J6: 'not-run' },
-    classification: 'clean', conclusion: 'partial', caveats: [], summary: { checks: { pass, fail, blocked: 0, notRun: 6 }, verdicts: { pass: pass ? 1 : 0, fail: fail, blocked: 0, partial: 0, notRun: 3 } },
-  })
-  fs.writeFileSync(path.join(dir, 'a.json'), JSON.stringify(row('a', 1, 0)))
-  fs.writeFileSync(path.join(dir, 'b.json'), JSON.stringify(row('b', 0, 1)))
-  const index = buildFlowIndex(dir)
-  assert.equal(index.totals.packages, 2)
-  assert.equal(index.totals.checks.fail, 1)
-  assert.equal(index.totals.verdicts.fail, 1)
-  fs.rmSync(dir, { recursive: true, force: true })
-})

package/40-checker/test/permissions.test.mjs

@@ -1,40 +0,0 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-import { checkCredentials } from '../src/declarations.mjs'
-import { validateCommitments, validateDisclosure, COMMITMENT_IDS } from '../src/permissions.mjs'
-
-const manifest = {
-  dsh: {
-    commitmentsVersion: 1,
-    commitments: Object.fromEntries(COMMITMENT_IDS.map(id => [id, true])),
-    disclosure: {
-      endpoints: ['https://api.example.com'],
-      retention: 'none',
-      systemPrompt: 'unchanged',
-    },
-    capabilities: ['network:egress'],
-  },
-}
-
-test('all 9 commitments validate as booleans', () => {
-  const details = validateCommitments(manifest)
-  assert.equal(details.length, 1)
-  assert.equal(details[0].result, 'PASS')
-})
-
-test('missing commitment is a warning, not a failure', () => {
-  const details = validateCommitments({ dsh: { commitments: { 'no-session-upload': true } } })
-  assert.ok(details.some(item => item.result === 'WARN' && item.reason.includes('missing commitment')))
-})
-
-test('disclosure endpoints must be https URLs', () => {
-  const details = validateDisclosure({ dsh: { disclosure: { endpoints: ['http://insecure.example.com'] } } })
-  assert.ok(details.some(item => item.result === 'WARN'))
-})
-
-test('checkCredentials reads both declaration fields', () => {
-  const check = checkCredentials(manifest, [])
-  assert.equal(check.result, 'PASS')
-  assert.ok(check.details.some(item => item.item === 'C-12.6' && item.result === 'PASS'))
-  assert.ok(check.details.some(item => item.item === 'C-12.7' && item.result === 'PASS'))
-})

package/40-checker/test/remediation.test.mjs

@@ -1,300 +0,0 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import remediationSpec from '../../spec/remediation.json' with { type: 'json' }
-import packageJson from '../../package.json' with { type: 'json' }
-import { DOCS_BASE, joinAdvice } from '../src/remediation.mjs'
-import { buildReport } from '../src/report.mjs'
-import { runManifestChecks } from '../src/manifest.mjs'
-import { checkCapabilities, checkCredentials, checkImportTimeAdvisory, checkLabels } from '../src/declarations.mjs'
-import { readSources } from '../src/util.mjs'
-
-const here = path.dirname(fileURLToPath(import.meta.url))
-const srcDir = path.join(here, '..', 'src')
-const fixturesDir = path.join(here, '..', 'fixtures')
-const guideDocs = process.env.DSH_GUIDE_DOCS
-  ? path.resolve(process.env.DSH_GUIDE_DOCS)
-  : path.resolve(here, '..', '..', '..', 'dsh-plugin-guide', 'docs')
-const RULES = remediationSpec
-
-function slugify(text) {
-  return String(text)
-    .trim()
-    .toLowerCase()
-    .replace(/[^\p{L}\p{N}\s_-]/gu, '')
-    .replace(/\s+/g, '-')
-}
-
-function headingSlugs(text) {
-  const slugs = new Set()
-  let fence = null
-  for (const line of text.split(/\r?\n/)) {
-    const fenceMatch = /^\s*(```+|~~~+)/.exec(line)
-    if (fenceMatch) {
-      if (fence === null) fence = fenceMatch[1][0]
-      else if (fence === fenceMatch[1][0]) fence = null
-      continue
-    }
-    if (fence !== null) continue
-    // Explicit HTML anchors are valid targets too (older docs predate heading-only slugs).
-    const explicit = /<a\s+id="([^"]+)"/.exec(line)
-    if (explicit) slugs.add(explicit[1])
-    const match = /^(#{1,6})\s+(.+?)\s*#*\s*$/.exec(line)
-    if (match) slugs.add(slugify(match[2]))
-  }
-  return slugs
-}
-
-/** The key set the checker can emit: C-x[.y] literals, clause values, G0-G4. */
-function checkerUniverse() {
-  const keys = new Set()
-  for (const file of fs.readdirSync(srcDir).filter(name => name.endsWith('.mjs'))) {
-    const text = fs.readFileSync(path.join(srcDir, file), 'utf8')
-    for (const match of text.matchAll(/'((?:C-\d+)(?:\.\d+)*)'/g)) keys.add(match[1])
-    for (const match of text.matchAll(/item:\s*'(G[0-4])'/g)) keys.add(match[1])
-  }
-  for (const gate of ['G0', 'G1', 'G2', 'G3', 'G4']) keys.add(gate)
-  return keys
-}
-
-function runtimeNotRun() {
-  const meta = {
-    'DSC-04': ['C-4', 'L1'], 'DSC-05': ['C-5', 'L1'], 'DSC-06': ['C-6', 'L1+L2'],
-    'DSC-07': ['C-7', 'L2'], 'DSC-08': ['C-8', 'L3'], 'DSC-09': ['C-9', 'L1'],
-  }
-  return Object.entries(meta).map(([id, [clause, layer]]) => ({
-    id, clause, layer, method: 'M', advisory: false,
-    result: 'ERROR', coverage: 'not-run', reason: 'test: runtime not run', details: [], evidence: [],
-  }))
-}
-
-function staticReportFor(dir) {
-  const result = runManifestChecks(dir)
-  const sources = readSources(dir)
-  const declaration = result.manifest
-    ? [
-        checkCapabilities(result.manifest, sources, result.patch),
-        checkCredentials(result.manifest, sources),
-        checkLabels(result.manifest, sources),
-      ].map(item => (item.result === 'WARN' && ['DSC-11', 'DSC-13'].includes(item.id) ? { ...item, advisory: true } : item))
-    : [
-        { id: 'DSC-11', clause: 'C-11', layer: 'L0', method: 'M', advisory: false, result: 'ERROR', coverage: 'not-run', reason: 'manifest unavailable', details: [], evidence: [] },
-        { id: 'DSC-12', clause: 'C-12', layer: 'L0', method: 'M', advisory: false, result: 'ERROR', coverage: 'not-run', reason: 'manifest unavailable', details: [], evidence: [] },
-        { id: 'DSC-13', clause: 'C-13', layer: 'L0', method: 'M', advisory: false, result: 'ERROR', coverage: 'not-run', reason: 'manifest unavailable', details: [], evidence: [] },
-      ]
-  const checks = [
-    ...result.checks,
-    ...runtimeNotRun(),
-    { id: 'DSC-14', clause: 'C-14', layer: 'L1', method: 'M', advisory: false, result: 'ERROR', coverage: 'not-run', reason: 'test: runtime not run', details: [], evidence: [] },
-    checkImportTimeAdvisory(sources, result.entry?.relative),
-    ...declaration,
-  ]
-  if (result.g4?.result === 'FAIL') {
-    const dsc01 = checks.find(item => item.id === 'DSC-01')
-    if (dsc01 && dsc01.result !== 'FAIL') {
-      dsc01.result = 'FAIL'
-      dsc01.reason = dsc01.reason ? `${dsc01.reason}; ${result.g4.reason}` : result.g4.reason
-      dsc01.details = [...(dsc01.details ?? []), { item: 'G4', result: 'FAIL', reason: result.g4.reason }]
-    }
-  }
-  return buildReport({
-    subject: {
-      mode: 'package', profile: 'package', kind: result.kind, kindInferred: true,
-      name: result.manifest?.name ?? null, version: result.manifest?.version ?? null, path: dir,
-    },
-    anchor: { repo: 'test', commit: '0'.repeat(40), scanner: 'test', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
-    checks,
-    g4: result.g4,
-    scope: 'ds-c',
-    profile: 'package',
-    kind: result.kind,
-  })
-}
-
-test('remediation table covers every checker key exactly', () => {
-  const universe = checkerUniverse()
-  const keys = new Set(Object.keys(RULES))
-  const missing = [...universe].filter(key => !keys.has(key)).sort()
-  const extra = [...keys].filter(key => !universe.has(key)).sort()
-  assert.deepEqual(missing, [], `missing remediation rules: ${missing.join(', ')}`)
-  assert.deepEqual(extra, [], `stale remediation rules: ${extra.join(', ')}`)
-  assert.ok(universe.size > 0)
-})
-
-test('remediation rules have the required shape', () => {
-  assert.equal(DOCS_BASE, 'https://github.com/PerryLink/dsh-plugin-guide/blob/v0.4.4/')
-  assert.equal(packageJson.version, '1.2.0')
-  assert.ok(Object.keys(RULES).length > 0)
-  for (const [key, rule] of Object.entries(RULES)) {
-    assert.match(key, /^(?:C-\d+(?:\.\d+)*|G[0-4])$/)
-    for (const field of ['title', 'why', 'fix']) {
-      assert.equal(typeof rule[field], 'string', `${key}.${field}`)
-      assert.ok(rule[field].trim().length > 0, `${key}.${field} is empty`)
-    }
-    assert.match(rule.docs, /^docs\/[a-z]+\.md#[a-z0-9-]+$/, `${key}.docs`)
-    assert.ok(['fail', 'warn', 'advisory'].includes(rule.severityHint), `${key}.severityHint`)
-  }
-})
-
-test('advice on every fixture has a rule (no ruleMissing)', () => {
-  const dirs = fs.readdirSync(fixturesDir, { withFileTypes: true })
-    .filter(entry => entry.isDirectory())
-    .map(entry => path.join(fixturesDir, entry.name))
-    .filter(dir => fs.existsSync(path.join(dir, 'package.json')))
-  assert.ok(dirs.length >= 20, `expected fixture packages, got ${dirs.length}`)
-  let total = 0
-  for (const dir of dirs) {
-    const report = staticReportFor(dir)
-    assert.ok(Array.isArray(report.advice), `${path.basename(dir)}: advice is not an array`)
-    const missing = report.advice.filter(item => item.ruleMissing)
-    assert.deepEqual(missing.map(item => `${item.source}:${item.key}`), [], `${path.basename(dir)}: ruleMissing`)
-    for (const item of report.advice) {
-      assert.ok(item.docsUrl, `${path.basename(dir)}: ${item.key} has no docsUrl`)
-      assert.equal(item.docsUrl, `${DOCS_BASE}${RULES[item.key].docs}`, `${path.basename(dir)}: ${item.key} docsUrl`)
-      assert.equal(item.version, packageJson.version)
-      assert.ok(['FAIL', 'WARN'].includes(item.severity))
-    }
-    total += report.advice.length
-  }
-  assert.ok(total > 0, 'fixtures produced no advice; the test would be vacuous')
-})
-
-test('runtime FAIL without details falls back to check.clause', () => {
-  const checks = [
-    {
-      id: 'DSC-04', clause: 'C-4', layer: 'L1', result: 'FAIL', coverage: 'full',
-      reason: 'load failed: boom', details: [], evidence: ['index.mjs:1'], method: 'M', advisory: false,
-    },
-    {
-      id: 'DSC-14', clause: 'C-14', layer: 'L1', result: 'FAIL', coverage: 'full',
-      reason: 'runtime failed', details: [], evidence: ['index.mjs:1'], method: 'M', advisory: false,
-    },
-  ]
-  const report = buildReport({
-    subject: { mode: 'package', profile: 'package', kind: 'plugin', kindInferred: false, name: 'x', version: '1.0.0', path: here },
-    anchor: { repo: 'x', commit: '0'.repeat(40), scanner: 'x', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
-    checks,
-    scope: 'ds-c',
-    profile: 'package',
-    kind: 'plugin',
-  })
-  const c4 = report.advice.find(item => item.source === 'DSC-04')
-  const c14 = report.advice.find(item => item.source === 'DSC-14')
-  assert.equal(c4.key, 'C-4')
-  assert.equal(c4.severity, 'FAIL')
-  assert.equal(c4.version, '1.2.0')
-  assert.deepEqual(c4.evidence, ['index.mjs:1'])
-  assert.equal(c4.docsUrl, `${DOCS_BASE}docs/levels.md#entry`)
-  assert.equal(c14.key, 'C-14')
-  assert.equal(c14.docsUrl, `${DOCS_BASE}docs/entry.md#the-two-claims`)
-})
-
-test('advice uses detail severity even when the check was adjusted to WARN', () => {
-  const checks = [
-    { id: 'DSC-01', clause: 'C-1', layer: 'L0', result: 'PASS', coverage: 'full', reason: '', details: [], evidence: [] },
-    {
-      id: 'DSC-02', clause: 'C-2', layer: 'L0', result: 'FAIL', coverage: 'full', reason: '',
-      details: [{ item: 'C-2.1', result: 'FAIL', reason: 'no engines', evidence: ['package.json#engines'] }],
-      evidence: [], advisory: false,
-    },
-    { id: 'DSC-11', clause: 'C-11', layer: 'L0', result: 'PASS', coverage: 'full', reason: '', details: [], evidence: [] },
-    { id: 'DSC-12', clause: 'C-12', layer: 'L0', result: 'PASS', coverage: 'full', reason: '', details: [], evidence: [] },
-    { id: 'DSC-13', clause: 'C-13', layer: 'L0', result: 'PASS', coverage: 'full', reason: '', details: [], evidence: [] },
-    { id: 'DSC-14', clause: 'C-14', layer: 'L1', result: 'PASS', coverage: 'full', reason: '', details: [], evidence: [] },
-  ]
-  const report = buildReport({
-    subject: { mode: 'package', profile: 'package', kind: 'plugin', kindInferred: false, name: 'x', version: '1.0.0', path: here },
-    anchor: { repo: 'x', commit: '0'.repeat(40), scanner: 'x', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
-    checks,
-    scope: 'entry',
-    profile: 'package',
-    kind: 'plugin',
-  })
-  assert.equal(report.checks.find(item => item.id === 'DSC-02').result, 'WARN')
-  const item = report.advice.find(entry => entry.key === 'C-2.1')
-  assert.equal(item.severity, 'FAIL')
-  assert.equal(item.source, 'DSC-02')
-  assert.match(item.reason, /no engines/)
-})
-
-test('duplicate details merge evidence and count once per check and key', () => {
-  const checks = [{
-    id: 'DSC-11', clause: 'C-11', layer: 'L0', result: 'WARN', coverage: 'full', reason: '',
-    details: [
-      { item: 'C-11.2', result: 'WARN', reason: 'trigger tools', evidence: ['a.mjs:1'] },
-      { item: 'C-11.1', result: 'WARN', reason: 'missing capabilities', evidence: ['package.json#dsh.capabilities'] },
-      { item: 'C-11.2', result: 'WARN', reason: 'trigger web', evidence: ['b.mjs:2'] },
-    ],
-    evidence: [], advisory: true,
-  }]
-  const report = buildReport({
-    subject: { mode: 'package', profile: 'package', kind: 'plugin', kindInferred: false, name: 'x', version: '1.0.0', path: here },
-    anchor: { repo: 'x', commit: '0'.repeat(40), scanner: 'x', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
-    checks,
-    scope: 'ds-c',
-    profile: 'package',
-    kind: 'plugin',
-  })
-  const merged = report.advice.find(item => item.key === 'C-11.2')
-  assert.ok(merged)
-  assert.equal(merged.occurrences, 2)
-  assert.deepEqual(merged.evidence, ['a.mjs:1', 'b.mjs:2'])
-  assert.equal(merged.advisory, true)
-  assert.equal(report.advice.filter(item => item.source === 'DSC-11').length, 2)
-})
-
-test('buildReport includes advice by default and omits it on advice:false', () => {
-  const base = {
-    subject: { mode: 'package', profile: 'package', kind: 'plugin', kindInferred: false, name: 'x', version: '1.0.0', path: here },
-    anchor: { repo: 'x', commit: '0'.repeat(40), scanner: 'x', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
-    checks: [],
-    scope: 'ds-c',
-    profile: 'package',
-    kind: 'plugin',
-  }
-  const on = buildReport(base)
-  const off = buildReport({ ...base, advice: false })
-  assert.ok(Array.isArray(on.advice))
-  assert.equal(on.advice.length, 0)
-  assert.equal(Object.hasOwn(off, 'advice'), false)
-})
-
-test('every rule docs anchor exists in the local guide repository', t => {
-  if (!fs.existsSync(guideDocs)) {
-    t.skip(`guide docs not checked out at ${guideDocs}`)
-    return
-  }
-  const cache = new Map()
-  for (const [key, rule] of Object.entries(RULES)) {
-    const hash = rule.docs.indexOf('#')
-    const file = rule.docs.slice(0, hash)
-    const anchor = rule.docs.slice(hash + 1)
-    assert.ok(hash > 0 && !anchor.includes('#'), `${key}: docs must be <file>#<anchor>`)
-    const relative = file.replace(/^docs\//, '')
-    const absolute = path.join(guideDocs, relative)
-    assert.ok(fs.existsSync(absolute), `${key}: missing guide file ${file}`)
-    if (!cache.has(file)) cache.set(file, headingSlugs(fs.readFileSync(absolute, 'utf8')))
-    assert.ok(cache.get(file).has(anchor), `${key}: missing anchor ${rule.docs}`)
-  }
-})
-
-test('joinAdvice is pure and leaves the report untouched', () => {
-  const checks = [{
-    id: 'DSC-04', clause: 'C-4', layer: 'L1', result: 'FAIL', coverage: 'full',
-    reason: 'load failed', details: [], evidence: ['index.mjs'], method: 'M', advisory: false,
-  }]
-  const report = {
-    checks,
-    standard: { id: 'DS-C', version: '1.0.0' },
-  }
-  const snapshot = JSON.stringify(report)
-  const advice = joinAdvice(report, remediationSpec, DOCS_BASE)
-  assert.equal(JSON.stringify(report), snapshot)
-  assert.equal(advice.length, 1)
-  assert.equal(advice[0].key, 'C-4')
-  // A flat rule map (no version metadata) still gets the package version.
-  const bare = joinAdvice(report, RULES, DOCS_BASE)
-  assert.equal(bare[0].version, packageJson.version)
-})

package/40-checker/test/semver.test.mjs

@@ -1,32 +0,0 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-import { compareVersions, parseVersion, satisfies, validRange } from '../src/semver.mjs'
-
-test('parseVersion accepts exact semver and prerelease', () => {
-  assert.deepEqual(parseVersion('0.2.2-alpha.2'), { major: 0, minor: 2, patch: 2, prerelease: ['alpha', '2'] })
-  assert.equal(parseVersion('^0.2.2'), null)
-})
-
-test('compareVersions orders release above prerelease', () => {
-  assert.equal(compareVersions(parseVersion('0.2.2'), parseVersion('0.2.2-alpha.2')), 1)
-  assert.equal(compareVersions(parseVersion('0.2.2-alpha.2'), parseVersion('0.2.2-alpha.1')), 1)
-  assert.equal(compareVersions(parseVersion('0.2.0-rc.2'), parseVersion('0.2.0-0')), 1)
-})
-
-test('satisfies handles the ranges used by real plugins', () => {
-  assert.equal(satisfies('0.2.2-alpha.2', '>=0.2.2-alpha.2 <0.3.0'), true)
-  assert.equal(satisfies('0.2.2-alpha.2', '>=0.1.5-rc.1 <0.2.0-0 || >=0.2.0-rc.2 <0.3.0-0'), true)
-  assert.equal(satisfies('0.2.2-alpha.2', '^0.2.2-alpha.2'), true)
-  assert.equal(satisfies('0.2.2-alpha.2', '~0.2.2'), false)
-  assert.equal(satisfies('0.2.2-alpha.2', '^0.2.2'), false)
-  assert.equal(satisfies('0.2.2-alpha.2', '>=0.3.0'), false)
-  assert.equal(satisfies('0.2.2-alpha.2', 'workspace:^'), false)
-  assert.equal(satisfies('24.0.0', '^22.19.0 || >=24.0.0'), true)
-})
-
-test('validRange rejects empty and malformed ranges', () => {
-  assert.equal(validRange('>=0.2.2 <0.3.0'), true)
-  assert.equal(validRange(''), false)
-  assert.equal(validRange('workspace:^'), false)
-  assert.equal(validRange('not-a-range'), false)
-})