dsh-standards 1.2.2 → 1.4.0

package/40-checker/src/cli.mjs

@@ -4,33 +4,45 @@ import { fileURLToPath } from 'node:url'
 import { runManifestChecks, DEFAULT_RUNTIME_VERSION } from './manifest.mjs'
 import { checkCapabilities, checkCredentials, checkImportTimeAdvisory, checkLabels } from './declarations.mjs'
 import { runRuntimeChecks } from './runtime.mjs'
+import { runStaticBundleChecks } from './bundle-static.mjs'
 import { spawn, spawnSync } from 'node:child_process'
 import { sanitizedEnv } from './sandbox-env.mjs'
-import { readSources } from './util.mjs'
+import { readSourcesWithStats } from './util.mjs'
 import { buildReport, writeReport } from './report.mjs'
 
 const VERSION = '0.1.0'
 const DEFAULT_COMMIT = 'ce7073d51254c26cd63b22a60835b8f948deb447'
 const DEFAULT_CORDIS = '4.0.6-alpha.1'
+const HOST_RUNTIME_TIMEOUT_MS = 5000
+
+function binName() {
+  const brand = process.env.DSH_CHECKER_BRAND
+  if (typeof brand === 'string' && brand.trim() !== '') return brand.trim().split(/\s+/)[0]
+  return 'dsh-plugin-verify'
+}
 
 function usage() {
+  const bin = binName()
   return `${process.env.DSH_CHECKER_BRAND || 'dsh-plugin-verify ' + VERSION} — DS-C conformance checker (MVP)
 
 Usage:
-  dsh-plugin-verify <package-dir> [options]
+  ${bin} check [dir] [--json] [--html <file>]  author-facing report (Markdown by default)
+  ${bin} <package-dir> [options]                raw conformance report
 
 Options:
   --format text|json|sarif   output format (default: text)
   --scope mvp|ds-c|entry     mvp = 8 MVP ids; ds-c = full claim (default); entry = compatibility gate
   --profile package|listing|both  evaluation profile (default: package; listing if --market-index is set)
   --runtime <path>           path to a built @deepseek-ai/cordis lib/index.js; enables L1-L3
-  --runtime-version <v>      dsh runtime version used for C-2 (default: ${DEFAULT_RUNTIME_VERSION})
+  --runtime-version <v>      dsh runtime version used for C-2 (default: host via \`dsh --version\`, else ${DEFAULT_RUNTIME_VERSION})
   --cordis-version <v>       cordis version recorded in the anchor (default: ${DEFAULT_CORDIS})
   --commit <sha>             harness commit recorded in the anchor (default: ${DEFAULT_COMMIT.slice(0, 12)})
   --install-spec <spec>      recommended install spec for C-3 (listing/install check)
   --market-index <file>      format-1 market index JSON for C-3 listing mode
   --plugin-name <name>       plugin name inside the market index
   --timeout <ms>             L1-L3 timeout (default: 10000)
+  --max-files <n>            source scan file budget (default: 400)
+  --max-bytes <n>            source scan byte budget (default: 2000000)
   --no-exec                  skip L1-L3 entirely (reported as not-run/NA, never PASS)
   --static-only              M1 mode: listing profile, only C-1/C-2/C-3/C-11/C-12/C-13; C-4..C-9 are out of scope
   --treat-as-plugin          run L1-L3 on a bundle's server entry (lib/index.js, index.js, lib/public-entry.js, src/index.ts)
@@ -61,13 +73,15 @@ function parseArgs(argv) {
     scope: 'ds-c',
     profile: null,
     runtime: null,
-    runtimeVersion: DEFAULT_RUNTIME_VERSION,
+    runtimeVersion: null,
     cordisVersion: DEFAULT_CORDIS,
     commit: DEFAULT_COMMIT,
     installSpec: null,
     marketIndex: null,
     pluginName: null,
     timeoutMs: 10_000,
+    maxFiles: 400,
+    maxBytes: 2_000_000,
     noExec: false,
     staticOnly: false,
     treatAsPlugin: false,
@@ -111,6 +125,8 @@ function parseArgs(argv) {
       case '--market-index': options.marketIndex = value(); break
       case '--plugin-name': options.pluginName = value(); break
       case '--timeout': options.timeoutMs = Number(value()); break
+      case '--max-files': options.maxFiles = Number(value()); break
+      case '--max-bytes': options.maxBytes = Number(value()); break
       case '--out': options.out = value(); break
       case '--no-exec': options.noExec = true; break
       case '--static-only': options.staticOnly = true; break
@@ -135,6 +151,8 @@ function parseArgs(argv) {
   if (!['package', 'listing', 'both'].includes(options.profile)) throw new Error(`unsupported --profile: ${options.profile}`)
   if (options.staticOnly && options.treatAsPlugin) throw new Error('--static-only and --treat-as-plugin are mutually exclusive')
   if (!Number.isFinite(options.timeoutMs) || options.timeoutMs < 100 || options.timeoutMs > 120_000) throw new Error('--timeout must be between 100 and 120000 ms')
+  if (!Number.isInteger(options.maxFiles) || options.maxFiles < 1 || options.maxFiles > 200_000) throw new Error('--max-files must be an integer between 1 and 200000')
+  if (!Number.isInteger(options.maxBytes) || options.maxBytes < 1000 || options.maxBytes > 2_000_000_000) throw new Error('--max-bytes must be an integer between 1000 and 2000000000')
   if (options.target === null) options.target = '.'
   return options
 }
@@ -223,14 +241,66 @@ async function entryRunCheck(kind, runtimeChecks, options, dir) {
   return { ...base, result: 'ERROR', coverage: 'not-run', reason: c4?.reason || 'no runtime evidence' }
 }
 
-function anchorOf(options, runtime) {
+/**
+ * Read the runtime version the host actually runs. The anchor used to be a
+ * hard-coded `0.2.2-alpha.2`, which manufactured dozens of C-2.2 failures on a
+ * host that had already moved on. Detection is best-effort: when `dsh` is not
+ * usable the anchor falls back to the checked-in constant and says so.
+ */
+export function detectHostRuntime({ bin = process.env.DSH_BIN || (process.platform === 'win32' ? 'dsh.cmd' : 'dsh'), timeoutMs = HOST_RUNTIME_TIMEOUT_MS } = {}) {
+  const run = spawnSync(bin, ['--version'], { encoding: 'utf8', timeout: timeoutMs })
+  if (run.error || run.status !== 0) return { version: null, bin, error: run.error?.message ?? `exit ${run.status}` }
+  const text = `${run.stdout ?? ''}\n${run.stderr ?? ''}`
+  const match = /(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)/.exec(text)
+  if (!match) return { version: null, bin, error: 'no semver in `dsh --version` output' }
+  return { version: match[1], bin, error: null }
+}
+
+/**
+ * Resolve what `anchor.dsh` means:
+ *   cli       the caller passed --runtime-version; suspect when it differs from the host
+ *   host      no flag: the host version is the anchor, so it cannot be suspect
+ *   fallback  dsh unavailable: keep the constant, flagged as not host-derived
+ */
+export function resolveRuntimeAnchor(requestedVersion = null, hostVersion = null) {
+  if (typeof requestedVersion === 'string' && requestedVersion.trim() !== '') {
+    const requested = requestedVersion.trim()
+    return {
+      dsh: requested,
+      runtimeSource: 'cli',
+      hostVersion: hostVersion ?? null,
+      suspect: typeof hostVersion === 'string' && hostVersion !== '' && hostVersion !== requested,
+    }
+  }
+  if (typeof hostVersion === 'string' && hostVersion !== '') {
+    return { dsh: hostVersion, runtimeSource: 'host', hostVersion, suspect: false }
+  }
+  return { dsh: DEFAULT_RUNTIME_VERSION, runtimeSource: 'fallback', hostVersion: null, suspect: false }
+}
+
+/** The five optional declaration surfaces, counted but never scored. */
+export function declarationsOf(manifest) {
+  const dsh = manifest?.dsh ?? {}
+  const present = []
+  if (Array.isArray(dsh.capabilities) && dsh.capabilities.length > 0) present.push('capabilities')
+  if (Array.isArray(dsh.labels) && dsh.labels.length > 0) present.push('labels')
+  if (dsh.commitments && typeof dsh.commitments === 'object' && !Array.isArray(dsh.commitments)) present.push('commitments')
+  if (dsh.disclosure && typeof dsh.disclosure === 'object' && !Array.isArray(dsh.disclosure)) present.push('disclosure')
+  if (typeof manifest?.engines?.dsh === 'string' && manifest.engines.dsh.trim() !== '') present.push('engines.dsh')
+  return { total: 5, present }
+}
+
+function anchorOf(options, runtimeInfo, runtimePath) {
   return {
     repo: 'deepseek-ai/deepseek-harness',
     commit: options.commit,
     scanner: `dsh-plugin-verify@${VERSION}`,
-    dsh: options.runtimeVersion,
+    dsh: runtimeInfo.dsh,
     cordis: options.cordisVersion,
-    runtime: runtime ? path.resolve(runtime) : null,
+    runtime: runtimePath ? path.resolve(runtimePath) : null,
+    runtimeSource: runtimeInfo.runtimeSource,
+    hostVersion: runtimeInfo.hostVersion,
+    suspect: runtimeInfo.suspect,
   }
 }
 
@@ -261,15 +331,23 @@ export async function main(argv = process.argv.slice(2)) {
     return 3
   }
 
+  const host = detectHostRuntime()
+  const runtimeInfo = resolveRuntimeAnchor(options.runtimeVersion, host.version)
+
   const { manifest, kind, kindInferred, entry, patch, g4, checks: manifestChecks } = runManifestChecks(dir, {
-    runtimeVersion: options.runtimeVersion,
+    runtimeVersion: runtimeInfo.dsh,
     installSpec: options.installSpec,
     marketIndex: options.marketIndex,
     pluginName: options.pluginName,
   })
 
   let sources = []
-  try { sources = readSources(dir) } catch { sources = [] }
+  let scan = null
+  try {
+    const read = readSourcesWithStats(dir, { maxFiles: options.maxFiles, maxBytes: options.maxBytes })
+    sources = read.sources
+    scan = read.scan
+  } catch { sources = [] }
   const declarationChecks = manifest ? [
     checkCapabilities(manifest, sources, patch),
     checkCredentials(manifest, sources),
@@ -280,7 +358,7 @@ export async function main(argv = process.argv.slice(2)) {
     { id: 'DSC-13', clause: 'C-13', layer: 'L0', result: 'ERROR', coverage: 'not-run', reason: 'manifest unavailable', details: [], evidence: [], method: 'M', advisory: false },
   ]
   const declarationAdjusted = declarationChecks.map(item => (item.result === 'WARN' && ['DSC-11', 'DSC-13'].includes(item.id) ? { ...item, advisory: true } : item))
-  const advisoryChecks = [checkImportTimeAdvisory(sources, entry?.relative)]
+  const advisoryChecks = [checkImportTimeAdvisory(sources, entry?.relative, scan)]
 
   if (options.scope === 'entry' && options.entryRuntime === 'server-entry' && kind !== 'plugin') options.treatAsPlugin = true
   let runtimeKind = kind
@@ -311,6 +389,16 @@ export async function main(argv = process.argv.slice(2)) {
     })
   }
 
+  // A bundle/client has no plugin entry for L1-L3. Instead of leaving all six
+  // runtime checks NA, cover their statically decidable part explicitly and
+  // mark the coverage partial (the report says what still needs --host/--runtime).
+  const runtimeUsable = runtimeChecks.some(item => ['PASS', 'WARN', 'FAIL'].includes(item.result))
+  if (manifest && ['bundle', 'client'].includes(kind) && !runtimeUsable) {
+    const staticChecks = runStaticBundleChecks({ manifest, kind, entry, patch, sources, g4, scan, dir })
+    const staticById = new Map(staticChecks.map(item => [item.id, item]))
+    runtimeChecks = runtimeChecks.map(item => staticById.get(item.id) ?? item)
+  }
+
   const runCheck = await entryRunCheck(kind, runtimeChecks, options, dir)
   const checks = [
     manifestChecks[0], manifestChecks[1], manifestChecks[2],
@@ -341,7 +429,7 @@ export async function main(argv = process.argv.slice(2)) {
   }
   const report = buildReport({
     subject,
-    anchor: anchorOf(options, options.runtime),
+    anchor: anchorOf(options, runtimeInfo, options.runtime),
     checks,
     g4,
     scope: options.scope,
@@ -351,6 +439,7 @@ export async function main(argv = process.argv.slice(2)) {
     entryRuntime: options.entryRuntime,
     entryClaim: options.entryClaim,
     advice: options.advice,
+    declarations: declarationsOf(manifest),
   })
   const output = writeReport(report, options.format)
   if (options.out) {

package/40-checker/src/client-shape.mjs

@@ -1,11 +1,28 @@
 /**
  * Static G4 check: when `dsh.client` exists, the package must expose
- * `exports["./client"]` and declare the client at the package root.
+ * `exports["./client"]` and that target must exist in the package.
  *
  * This is a static shape check. It does not prove the client module loads or
  * renders; that is a runtime/UI probe and is reported separately.
  */
-export function checkClientShape(manifest) {
+import path from 'node:path'
+import { isFile } from './util.mjs'
+
+function clientTarget(exported) {
+  if (typeof exported === 'string') return exported
+  if (exported && typeof exported === 'object' && !Array.isArray(exported)) {
+    for (const key of ['default', 'import', 'require', 'node', 'browser']) {
+      if (typeof exported[key] === 'string') return exported[key]
+    }
+    for (const value of Object.values(exported)) {
+      const nested = clientTarget(value)
+      if (nested) return nested
+    }
+  }
+  return null
+}
+
+export function checkClientShape(manifest, dir = null) {
   const hasClient = manifest?.dsh?.client !== undefined
   if (!hasClient) {
     return {
@@ -28,10 +45,23 @@ export function checkClientShape(manifest) {
       reason: 'dsh.client exists but exports["./client"] is missing; a package-root row cannot resolve it',
     }
   }
+  const target = clientTarget(exported)
+  if (target && typeof dir === 'string' && dir !== '' && !target.includes('*')) {
+    const absolute = path.resolve(dir, target)
+    const relative = path.relative(dir, absolute)
+    if (relative.startsWith('..') || path.isAbsolute(relative) || !isFile(absolute)) {
+      return {
+        hasClient: true,
+        ok: false,
+        result: 'FAIL',
+        reason: `exports["./client"] points to a missing file: ${target}`,
+      }
+    }
+  }
   return {
     hasClient: true,
     ok: true,
     result: 'PASS',
-    reason: 'dsh.client + exports["./client"] present (static only)',
+    reason: 'dsh.client + exports["./client"] present and resolvable (static only)',
   }
 }

package/40-checker/src/declarations.mjs

@@ -424,13 +424,28 @@ function collectSideEffectHits(ast, file, hits) {
   })
 }
 
-function analyseImportClosure(sources, entryRelative) {
+function analyseImportClosure(sources, entryRelative, scan = null) {
   const byRelative = new Map()
   for (const source of sources) byRelative.set(normalizeRelative(source.relative), source)
   const queue = []
   if (entryRelative) {
     const entry = normalizeRelative(entryRelative)
-    if (!byRelative.has(entry)) return { error: `entry module ${entryRelative} was not found among scanned sources` }
+    if (!byRelative.has(entry)) {
+      // A bounded scan can stop before the entry module. That is missing
+      // coverage, not proof that the package has no entry.
+      if (scan?.truncated) {
+        return {
+          entryOutsideScan: true,
+          truncated: scan,
+          visited: new Set(),
+          hits: [],
+          parseErrors: [],
+          coverage: [],
+          localEdges: [],
+        }
+      }
+      return { error: `entry module ${entryRelative} was not found among scanned sources` }
+    }
     queue.push(entry)
   } else {
     // Programmatic callers without an entry: keep the legacy "all sources" shape.
@@ -483,23 +498,30 @@ function hitEvidence(hits, limit = 3) {
   return hits.slice(0, limit).map(hit => `${hit.file}:${hit.line}`)
 }
 
+/** The exact bounded-scan statement the report must carry when it truncates. */
+export function scanTruncationReason(scan) {
+  if (!scan?.truncated) return ''
+  return `truncated at ${scan.maxFiles} files / ${scan.maxBytes} bytes; entry may be beyond the scan (scanned ${scan.files} files / ${scan.bytes} bytes)`
+}
+
 /** DSC-10: advisory only; never FAIL. */
-export function checkImportTimeAdvisory(sources, entryRelative = null) {
+export function checkImportTimeAdvisory(sources, entryRelative = null, scan = null) {
   if (sources.length === 0) {
+    const truncation = scanTruncationReason(scan)
     return check({
       id: 'DSC-10',
       clause: 'C-10',
       layer: 'L0',
       result: 'NA',
       advisory: true,
-      coverage: 'not-run',
-      reason: 'no source files scanned; C-10 not-run',
-      details: [],
+      coverage: truncation ? 'partial' : 'not-run',
+      reason: truncation ? `partial: ${truncation}; C-10 not-run` : 'no source files scanned; C-10 not-run',
+      details: truncation ? [detail('C-10.3', 'NA', `not-run: ${truncation}`, [])] : [],
       evidence: [],
     })
   }
 
-  const analysis = analyseImportClosure(sources, entryRelative)
+  const analysis = analyseImportClosure(sources, entryRelative, scan)
   if (analysis.error) {
     const evidence = normalizeRelative(entryRelative)
     return check({
@@ -515,12 +537,32 @@ export function checkImportTimeAdvisory(sources, entryRelative = null) {
     })
   }
 
+  if (analysis.entryOutsideScan) {
+    const truncation = scanTruncationReason(analysis.truncated)
+    const entry = normalizeRelative(entryRelative)
+    return check({
+      id: 'DSC-10',
+      clause: 'C-10',
+      layer: 'L0',
+      result: 'NA',
+      advisory: true,
+      coverage: 'partial',
+      reason: `partial: ${truncation}; C-10 not-run`,
+      details: [detail('C-10.3', 'NA', `not-run: ${truncation}; entry module ${entryRelative} is outside the scanned set`, [entry])],
+      evidence: [entry],
+    })
+  }
+
+  const truncation = scanTruncationReason(scan)
   const { visited, hits, parseErrors, coverage, localEdges } = analysis
   const details = hits.slice(0, 20).map(hit => detail(hit.clause, 'WARN', `${hit.pattern} at ${hit.file}:${hit.line}`, [`${hit.file}:${hit.line}`]))
   details.push(...coverage.slice(0, 10))
   if (localEdges.length > 0) {
     details.push(detail('C-10.3', 'PASS', `local relative import closure analysed (${visited.size} module(s))`, [...visited].slice(0, 5)))
   }
+  if (truncation) {
+    details.push(detail('C-10.3', 'NA', `not-run: ${truncation}; the local import closure is incomplete`, []))
+  }
   for (const error of parseErrors) {
     details.push(detail('C-10', 'ERROR', `not-run: AST parse failed in ${error.file}:${error.line} (${error.message})`, [`${error.file}:${error.line}`]))
   }
@@ -538,6 +580,9 @@ export function checkImportTimeAdvisory(sources, entryRelative = null) {
     result = 'PASS'
     reason = ''
   }
+  if (truncation) {
+    reason = reason ? `${reason}; partial: ${truncation}` : `partial: ${truncation}`
+  }
 
   const evidence = hits.length > 0
     ? hitEvidence(hits)
@@ -551,7 +596,7 @@ export function checkImportTimeAdvisory(sources, entryRelative = null) {
     layer: 'L0',
     result,
     advisory: true,
-    coverage: result === 'ERROR' ? 'not-run' : 'full',
+    coverage: result === 'ERROR' ? 'not-run' : truncation ? 'partial' : 'full',
     reason,
     details,
     evidence,

package/40-checker/src/flow-evidence.mjs

@@ -25,7 +25,9 @@
  */
 import crypto from 'node:crypto'
 import fs from 'node:fs'
+import os from 'node:os'
 import path from 'node:path'
+import { spawnSync } from 'node:child_process'
 
 export const FLOW_IDS = ['J1', 'J2', 'J3', 'J4', 'J5', 'J6', 'J7', 'J8']
 export const FLOW_EVIDENCE_SCHEMA = 'dsh-flow-evidence/2'
@@ -144,6 +146,103 @@ export function treeSha256(dir, { exclude = [] } = {}) {
   return { hash: sha256Value(rows.join('\n')), files: rows.length, bytes }
 }
 
+const NPM = process.platform === 'win32' ? 'npm.cmd' : 'npm'
+
+function subjectFields(subject) {
+  if (!isPlainObject(subject)) return null
+  return {
+    name: subject.name ?? null,
+    version: subject.version ?? null,
+    integrity: subject.integrity ?? null,
+    tarballSha256: subject.tarballSha256 ?? null,
+    treeSha256: subject.treeSha256 ?? null,
+    commit: subject.commit ?? null,
+  }
+}
+
+/**
+ * Recompute the subject binding from a package directory: package.json
+ * name/version, the deterministic tree hash, and the npm-pack tarball hash +
+ * integrity. npm packs the same tree byte-identically, so this is the same
+ * binding `dsh-flow-collect` recorded.
+ */
+export function recomputeSubject(dir, { exclude = [], timeoutMs = 120_000 } = {}) {
+  const root = path.resolve(dir)
+  const manifest = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'))
+  const tree = treeSha256(root, { exclude })
+  const destination = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-subject-'))
+  try {
+    const run = spawnSync(NPM, ['pack', '--ignore-scripts', '--json', '--pack-destination', destination], {
+      cwd: root, encoding: 'utf8', timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024,
+    })
+    if (run.error) throw new Error(`npm pack failed to start: ${run.error.message}`)
+    if (run.status !== 0) throw new Error(`npm pack failed (exit ${run.status}): ${String(run.stderr ?? '').replace(/\s+/g, ' ').slice(0, 300)}`)
+    let parsed
+    try { parsed = JSON.parse(run.stdout) } catch { throw new Error('npm pack did not print JSON') }
+    const info = Array.isArray(parsed) ? parsed[0] : parsed
+    if (!info?.filename) throw new Error('npm pack did not report a tarball filename')
+    return {
+      name: typeof manifest.name === 'string' ? manifest.name : null,
+      version: typeof manifest.version === 'string' ? manifest.version : null,
+      treeSha256: tree.hash,
+      tarballSha256: sha256File(path.join(destination, info.filename)),
+      integrity: typeof info.integrity === 'string' ? info.integrity : null,
+    }
+  } finally {
+    fs.rmSync(destination, { recursive: true, force: true })
+  }
+}
+
+/**
+ * Bind a flow-evidence document to a package directory. Any mismatch in
+ * name/version/treeSha256/tarballSha256 (or a declared integrity) is a hard
+ * failure: the audit must not accept evidence for a different subject.
+ */
+export function bindEvidenceSubject(document, dir, options = {}) {
+  const declared = isPlainObject(document?.subject) ? document.subject : null
+  const base = { dir: path.resolve(dir), declared: subjectFields(declared), recomputed: null, mismatches: [], errors: [] }
+  if (!declared) return { ...base, ok: false, errors: ['subject is missing'] }
+  let recomputed
+  try {
+    recomputed = recomputeSubject(dir, {
+      exclude: Array.isArray(declared.treeExclude) ? declared.treeExclude : [],
+      timeoutMs: options.timeoutMs,
+    })
+  } catch (error) {
+    return { ...base, ok: false, errors: [error.message] }
+  }
+  const mismatches = []
+  for (const key of ['name', 'version', 'treeSha256', 'tarballSha256']) {
+    if (declared[key] !== recomputed[key]) {
+      mismatches.push(`${key}: declared ${declared[key] ?? 'null'} != recomputed ${recomputed[key] ?? 'null'}`)
+    }
+  }
+  if (typeof declared.integrity === 'string' && recomputed.integrity !== null && declared.integrity !== recomputed.integrity) {
+    mismatches.push('integrity: declared value != recomputed value')
+  }
+  return { ...base, ok: mismatches.length === 0, recomputed, mismatches }
+}
+
+/**
+ * Plain CI attribution for display. These fields are read from the runner
+ * environment and are self-declared: CI attribution is not proof.
+ */
+export function ciAttribution(env = process.env) {
+  const read = key => (typeof env?.[key] === 'string' ? env[key].trim() : '')
+  const runId = read('GITHUB_RUN_ID')
+  const repository = read('GITHUB_REPOSITORY')
+  const commit = read('GITHUB_SHA')
+  if (!runId && !repository && !commit) return null
+  const server = (read('GITHUB_SERVER_URL') || 'https://github.com').replace(/\/+$/, '')
+  return {
+    provider: 'github-actions',
+    runId: runId || null,
+    repository: repository || null,
+    commit: commit || null,
+    runUrl: runId && repository ? `${server}/${repository}/actions/runs/${runId}` : null,
+  }
+}
+
 export function isIsoTimestamp(value) {
   return typeof value === 'string' && ISO_RE.test(value) && Number.isFinite(Date.parse(value))
 }
@@ -279,9 +378,15 @@ function validateV2(document) {
     if ('kind' in document.producer && document.producer.kind !== null && !['local', 'ci', 'sandbox', 'sandbox-degraded'].includes(document.producer.kind)) {
       errors.push('producer.kind must be local, ci, sandbox, or sandbox-degraded')
     }
-    for (const key of ['runner', 'actor', 'runUrl']) {
+    for (const key of ['runner', 'actor', 'runUrl', 'provider', 'runId', 'repository', 'commit']) {
       if (key in document.producer && document.producer[key] !== null) requireString(document.producer[key], `producer.${key}`)
     }
+    if (typeof document.producer.commit === 'string' && !COMMIT_RE.test(document.producer.commit)) {
+      errors.push('producer.commit must be a 40-hex commit')
+    }
+    if (typeof document.producer.runUrl === 'string' && !/^https:\/\//.test(document.producer.runUrl)) {
+      errors.push('producer.runUrl must be an https URL')
+    }
   }
 
   if (requireObject(document.subject, 'subject')) {

package/40-checker/src/index.mjs

@@ -1,11 +1,13 @@
 /** Programmatic API for dsh-plugin-verify. */
-export { main, parseArgs, usage, VERSION } from './cli.mjs'
+export { main, parseArgs, usage, VERSION, detectHostRuntime, resolveRuntimeAnchor, declarationsOf } from './cli.mjs'
 export { runManifestChecks, checkMarketEntry, DEFAULT_RUNTIME_VERSION, inferKind, resolveEntry } from './manifest.mjs'
-export { checkCapabilities, checkCredentials, checkLabels, checkImportTimeAdvisory, CAPABILITIES, LABELS } from './declarations.mjs'
+export { checkCapabilities, checkCredentials, checkLabels, checkImportTimeAdvisory, scanTruncationReason, CAPABILITIES, LABELS } from './declarations.mjs'
+export { readSources, readSourcesWithStats, listSourceFiles, scanSourceFiles } from './util.mjs'
 export { runRuntimeChecks } from './runtime.mjs'
-export { buildReport, formatText, formatSarif, writeReport } from './report.mjs'
+export { runStaticBundleChecks } from './bundle-static.mjs'
+export { buildReport, formatText, formatSarif, writeReport, summarizeBlocking, DECLARATION_CHECKS } from './report.mjs'
 export { joinAdvice, DOCS_BASE } from './remediation.mjs'
 export { satisfies, validRange, parseVersion, compareVersions } from './semver.mjs'
 export { parseInstallSpec } from './install-spec.mjs'
-export { FLOW_IDS, FLOW_EVIDENCE_SCHEMA, evidenceHash, finalizeEvidence, journeyAggregate, isSandboxAttested, treeSha256, validateFlowEvidence } from './flow-evidence.mjs'
+export { FLOW_IDS, FLOW_EVIDENCE_SCHEMA, evidenceHash, finalizeEvidence, journeyAggregate, isSandboxAttested, treeSha256, validateFlowEvidence, recomputeSubject, bindEvidenceSubject, ciAttribution } from './flow-evidence.mjs'
 export { sanitizedEnv, scrubProcessEnv, isSecretEnvName, isAllowedEnvName, envPolicy } from './sandbox-env.mjs'