dsh-standards 1.3.0 → 1.4.0

package/40-checker/src/author-report.mjs

@@ -65,6 +65,7 @@ function adviceRows(report) {
 const BUCKETS = [
   { key: 'blocking', title: 'Blocking (FAIL)' },
   { key: 'hygiene', title: 'Hygiene (WARN)' },
+  { key: 'partial', title: 'Partly checked (static subset)' },
   { key: 'notChecked', title: 'Not checked (NA / not-run / ERROR)' },
 ]
 
@@ -142,13 +143,19 @@ export function renderMarkdown(report) {
   lines.push('')
 
   const notChecked = bucketRows(report, 'notChecked')
+  const partial = bucketRows(report, 'partial')
   lines.push('## What this report does not check')
   lines.push('')
-  if (notChecked.length === 0) {
+  if (notChecked.length === 0 && partial.length === 0) {
     lines.push('- No check was skipped in this run.')
   } else {
     for (const row of notChecked) {
       lines.push(`- ${text(row.id)}${row.clause ? ` (${text(row.clause)})` : ''}: ${text(row.reason) || 'not checked'}`)
+      if (row.howToEnable) lines.push(`  - enable: ${text(row.howToEnable)}`)
+    }
+    for (const row of partial) {
+      lines.push(`- ${text(row.id)}${row.clause ? ` (${text(row.clause)})` : ''}: partial coverage${row.reason ? ` — ${text(row.reason)}` : ''}`)
+      if (row.howToEnable) lines.push(`  - still needs: ${text(row.howToEnable)}`)
     }
   }
   lines.push(`- Runtime execution beyond the checks listed above is not observed by this report${anchor.suspect ? '; the anchor differs from the host and is flagged suspect' : ''}.`)
@@ -171,6 +178,7 @@ export function renderHtml(report) {
   const advice = adviceRows(report)
   const passed = passedIds(report)
   const notChecked = bucketRows(report, 'notChecked')
+  const partial = bucketRows(report, 'partial')
 
   const table = (key) => {
     const rows = bucketRows(report, key)
@@ -195,9 +203,12 @@ export function renderHtml(report) {
     ? '<p class="none">None.</p>'
     : `<ul>${advice.map(item => `<li><strong>${escapeHtml(text(item.severity))} ${escapeHtml(text(item.key))}</strong> (${escapeHtml(text(item.source))}${item.ruleMissing ? ' [ruleMissing]' : ''}): ${escapeHtml(text(item.fix ?? item.title ?? ''))}${item.docsUrl ? ` ${link(item.docsUrl)}` : ''}</li>`).join('\n')}</ul>`
 
-  const notCheckedList = notChecked.length === 0
+  const notCheckedList = notChecked.length === 0 && partial.length === 0
     ? '<li>No check was skipped in this run.</li>'
-    : notChecked.map(row => `<li><strong>${escapeHtml(text(row.id))}</strong>${row.clause ? ` (${escapeHtml(text(row.clause))})` : ''}: ${escapeHtml(text(row.reason) || 'not checked')}</li>`).join('\n')
+    : [
+        ...notChecked.map(row => `<li><strong>${escapeHtml(text(row.id))}</strong>${row.clause ? ` (${escapeHtml(text(row.clause))})` : ''}: ${escapeHtml(text(row.reason) || 'not checked')}${row.howToEnable ? ` <span class="muted">enable: ${escapeHtml(text(row.howToEnable))}</span>` : ''}</li>`),
+        ...partial.map(row => `<li><strong>${escapeHtml(text(row.id))}</strong>${row.clause ? ` (${escapeHtml(text(row.clause))})` : ''}: partial coverage${row.reason ? ` — ${escapeHtml(text(row.reason))}` : ''}${row.howToEnable ? ` <span class="muted">still needs: ${escapeHtml(text(row.howToEnable))}</span>` : ''}</li>`),
+      ].join('\n')
 
   return `<!doctype html>
 <html lang="en">

package/40-checker/src/bundle-static.mjs

@@ -0,0 +1,181 @@
+/**
+ * Static partial coverage for the L1-L3 checks (DSC-04..DSC-09) when a bundle
+ * or client package cannot be executed.
+ *
+ * These checks are NOT a runtime verdict. They cover the statically decidable
+ * part of each clause (manifest/patch/entry/exports declarations, static
+ * provide/effect/teardown clues and declaration consistency) and always report
+ * `coverage: "partial"`. The report keeps them in the partial bucket and lists
+ * what still needs `--host` / `--runtime`.
+ */
+import path from 'node:path'
+import { check, detail, worst } from './result.mjs'
+import { isFile, regexHits } from './util.mjs'
+
+const PRIVATE_SURFACE = /(?:ctx\.events\._hooks|ctx\.reflect\.store|ctx\.registry\._internal|fiber\._disposables)\s*(?:\.|\[)[^\n]{0,40}=/g
+const EFFECT_REGISTRATION = /\bctx\.(?:effect|on)\s*\(|\.effect\s*\(/g
+const TEARDOWN = /\b(?:onDispose|dispose|disposed)\b|\.dispose\s*\(/g
+const RESTART = /\brestart\b|_revision|\.restart\s*\(/g
+const PROVIDE_DECLARATION = /(?:^|\n)\s*(?:export\s+)?(?:const|let|var)\s+provide\s*=|export\s*\{[^}]*\bprovide\b[^}]*\}/g
+const CTX_PROVIDE = /\bctx\.provide\s*\(/g
+
+function packageNameOf(name) {
+  if (typeof name !== 'string') return ''
+  if (name.startsWith('@')) {
+    const parts = name.split('/')
+    return parts.length >= 2 ? `${parts[0]}/${parts[1]}` : name
+  }
+  return name.split('/')[0]
+}
+
+function runtimeNeed(kind) {
+  if (kind === 'bundle') {
+    return 'bundle G0-G3 needs --host <dir>; L1-L3 need --treat-as-plugin --runtime <path>'
+  }
+  return 'L1-L3 need --treat-as-plugin --runtime <path>'
+}
+
+function liveResult(details) {
+  const live = details.filter(item => item.result === 'FAIL' || item.result === 'WARN')
+  return live.length === 0 ? 'PASS' : worst(live.map(item => item.result))
+}
+
+function staticCheck({ id, clause, layer, details, kind, scan, extra = '' }) {
+  const result = liveResult(details)
+  const failures = details
+    .filter(item => item.result === 'FAIL' || item.result === 'WARN')
+    .map(item => `${item.item}: ${item.reason}`)
+  const truncation = scan?.truncated
+    ? `source scan truncated at ${scan.maxFiles} files / ${scan.maxBytes} bytes`
+    : ''
+  const reasonParts = []
+  if (failures.length > 0) reasonParts.push(failures.join(' | '))
+  else reasonParts.push(`static subset passed${extra ? `: ${extra}` : ''}`)
+  reasonParts.push(runtimeNeed(kind))
+  if (truncation) reasonParts.push(truncation)
+  return check({
+    id,
+    clause,
+    layer,
+    result,
+    coverage: 'partial',
+    reason: reasonParts.join('; '),
+    details,
+    evidence: details.flatMap(item => item.evidence ?? []).slice(0, 5),
+  })
+}
+
+/** @returns {object[]} the six DSC-04..DSC-09 checks with coverage "partial". */
+export function runStaticBundleChecks({ manifest, kind, entry, patch, sources = [], g4 = null, scan = null, dir = null }) {
+  const name = manifest?.name ?? null
+  const deps = new Set([
+    ...Object.keys(manifest?.dependencies ?? {}),
+    ...Object.keys(manifest?.peerDependencies ?? {}),
+    ...Object.keys(manifest?.optionalDependencies ?? {}),
+  ])
+  const self = packageNameOf(name)
+
+  // C-4: entry / patch / client export shape, all statically resolvable.
+  const c4 = []
+  if (entry?.escape) c4.push(detail('C-4', 'FAIL', `entry escapes the package: ${entry.target}`, ['package.json#exports']))
+  else if (entry?.declaredMissing) c4.push(detail('C-4', 'FAIL', `declared entry is missing: ${entry.target}`, ['package.json#exports']))
+  else if (entry?.exists) c4.push(detail('C-4', 'PASS', `declared entry resolves: ${entry.relative}`, [entry.relative]))
+  else if (kind === 'bundle' && patch?.present) c4.push(detail('C-4', 'PASS', 'patch-only bundle; dsh.bundle.patch is the carrier'))
+  else c4.push(detail('C-4', 'NA', 'no runtime entry declared'))
+  if (patch?.present) {
+    if (patch.problems?.length > 0) {
+      c4.push(detail('C-4', 'FAIL', `bundle patch problems: ${patch.problems.join('; ')}`, patch.files?.map(file => file.relative) ?? []))
+    } else {
+      c4.push(detail('C-4', 'PASS', `bundle patch parsed (${patch.files?.length ?? 0} file(s), ${patch.rows?.length ?? 0} row(s))`))
+    }
+  }
+  if (g4?.hasClient) {
+    if (g4.result === 'FAIL') c4.push(detail('C-4', 'FAIL', g4.reason ?? 'dsh.client shape failed'))
+    else if (g4.result === 'PASS') c4.push(detail('C-4', 'PASS', 'dsh.client + exports["./client"] resolvable'))
+  }
+  const c4Check = staticCheck({ id: 'DSC-04', clause: 'C-4', layer: 'L1', details: c4, kind, scan, extra: 'entry/export/patch shape' })
+
+  // C-5: can a static provide declaration be enumerated?
+  const c5 = []
+  const provideDecl = regexHits(sources, PROVIDE_DECLARATION)
+  const ctxProvide = regexHits(sources, CTX_PROVIDE)
+  if (provideDecl.length > 0) {
+    c5.push(detail('C-5.1', 'PASS', `static provide declaration found (${provideDecl.length} site(s))`, provideDecl.slice(0, 3).map(hit => `${hit.file}:${hit.line}`)))
+  } else if (ctxProvide.length > 0) {
+    c5.push(detail('C-5.1', 'PASS', `ctx.provide registration found (${ctxProvide.length} site(s))`, ctxProvide.slice(0, 3).map(hit => `${hit.file}:${hit.line}`)))
+  } else {
+    c5.push(detail('C-5.1', 'NA', 'no static provide declaration or ctx.provide call found; service ownership needs runtime'))
+  }
+  const c5Check = staticCheck({ id: 'DSC-05', clause: 'C-5', layer: 'L1', details: c5, kind, scan, extra: 'provide declarations enumerated' })
+
+  // C-6: static private-surface writes; effect registration is runtime-only.
+  const c6 = []
+  const privateHits = regexHits(sources, PRIVATE_SURFACE)
+  if (privateHits.length > 0) {
+    c6.push(detail('C-6.1', 'FAIL', 'static write to a Cordis private registration surface', privateHits.slice(0, 3).map(hit => `${hit.file}:${hit.line}`)))
+  } else if (sources.length > 0) {
+    c6.push(detail('C-6.1', 'PASS', 'no static write to a private registration surface'))
+  }
+  const effectHits = regexHits(sources, EFFECT_REGISTRATION)
+  if (effectHits.length > 0) {
+    c6.push(detail('C-6.2', 'PASS', `${effectHits.length} static effect registration site(s); effect lifetime needs runtime`, effectHits.slice(0, 3).map(hit => `${hit.file}:${hit.line}`)))
+  } else {
+    c6.push(detail('C-6.2', 'NA', 'effect registration/lifetime needs runtime'))
+  }
+  const c6Check = staticCheck({ id: 'DSC-06', clause: 'C-6', layer: 'L1+L2', details: c6, kind, scan, extra: 'no private-surface writes found' })
+
+  // C-7: static teardown clue; effect/store/registry baselines need runtime.
+  const c7 = []
+  const teardownHits = regexHits(sources, TEARDOWN)
+  if (teardownHits.length > 0) {
+    c7.push(detail('C-7.1', 'PASS', `${teardownHits.length} static teardown site(s); dispose baseline needs runtime`, teardownHits.slice(0, 3).map(hit => `${hit.file}:${hit.line}`)))
+  } else {
+    c7.push(detail('C-7.1', 'NA', 'dispose/effect baseline needs runtime'))
+  }
+  const c7Check = staticCheck({ id: 'DSC-07', clause: 'C-7', layer: 'L2', details: c7, kind, scan, extra: 'teardown references enumerated' })
+
+  // C-8: static restart/remount clue; repeatability needs runtime.
+  const c8 = []
+  const restartHits = regexHits(sources, RESTART)
+  if (restartHits.length > 0) {
+    c8.push(detail('C-8.1', 'PASS', `${restartHits.length} static restart/revision site(s); repeatability needs runtime`, restartHits.slice(0, 3).map(hit => `${hit.file}:${hit.line}`)))
+  } else {
+    c8.push(detail('C-8.1', 'NA', 'restart/remount repeatability needs runtime'))
+  }
+  const c8Check = staticCheck({ id: 'DSC-08', clause: 'C-8', layer: 'L3', details: c8, kind, scan, extra: 'restart references enumerated' })
+
+  // C-9: declaration consistency that is decidable from the manifest + patch.
+  const c9 = []
+  const mismatched = []
+  for (const row of patch?.rows ?? []) {
+    if (!row.name || row.disabled) continue
+    // A patch row may mount a local module (a bundle's own server entry) rather
+    // than a registry package. Verify the file; do not compare it to deps.
+    if (row.name.startsWith('.') || path.isAbsolute(row.name)) {
+      const absolute = dir ? path.resolve(dir, row.name) : null
+      if (!absolute || !isFile(absolute)) mismatched.push(`${row.name} (missing local module)`)
+      continue
+    }
+    const target = packageNameOf(row.name)
+    if (!target || target === self || deps.has(target) || target.startsWith('@deepseek-ai/')) continue
+    mismatched.push(row.name)
+  }
+  if (mismatched.length > 0) {
+    c9.push(detail('C-9.2', 'WARN', `patch mounts package(s) that are not declared in dependencies/peerDependencies: ${[...new Set(mismatched)].join(', ')}`, patch.files?.map(file => file.relative) ?? []))
+  } else if (patch?.present) {
+    c9.push(detail('C-9.1', 'PASS', 'patch mount targets match package.json declarations or host-provided @deepseek-ai packages'))
+  }
+  const inject = Array.isArray(manifest?.dsh?.client?.inject) ? manifest.dsh.client.inject : []
+  const unread = []
+  for (const service of inject) {
+    if (typeof service !== 'string' || !/^[A-Za-z_$][\w$]*$/.test(service)) continue
+    if (regexHits(sources, new RegExp(`\\bctx\\.${service.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`, 'g')).length === 0) unread.push(service)
+  }
+  if (unread.length > 0) {
+    c9.push(detail('C-9.3', 'WARN', `dsh.client.inject declares service(s) with no static ctx.<service> read: ${unread.join(', ')}`))
+  }
+  if (c9.length === 0) c9.push(detail('C-9.1', 'NA', 'no statically decidable declaration mismatch found'))
+  const c9Check = staticCheck({ id: 'DSC-09', clause: 'C-9', layer: 'L1', details: c9, kind, scan, extra: 'declaration cross-check' })
+
+  return [c4Check, c5Check, c6Check, c7Check, c8Check, c9Check]
+}

package/40-checker/src/cli.mjs

@@ -4,9 +4,10 @@ import { fileURLToPath } from 'node:url'
 import { runManifestChecks, DEFAULT_RUNTIME_VERSION } from './manifest.mjs'
 import { checkCapabilities, checkCredentials, checkImportTimeAdvisory, checkLabels } from './declarations.mjs'
 import { runRuntimeChecks } from './runtime.mjs'
+import { runStaticBundleChecks } from './bundle-static.mjs'
 import { spawn, spawnSync } from 'node:child_process'
 import { sanitizedEnv } from './sandbox-env.mjs'
-import { readSources } from './util.mjs'
+import { readSourcesWithStats } from './util.mjs'
 import { buildReport, writeReport } from './report.mjs'
 
 const VERSION = '0.1.0'
@@ -40,6 +41,8 @@ Options:
   --market-index <file>      format-1 market index JSON for C-3 listing mode
   --plugin-name <name>       plugin name inside the market index
   --timeout <ms>             L1-L3 timeout (default: 10000)
+  --max-files <n>            source scan file budget (default: 400)
+  --max-bytes <n>            source scan byte budget (default: 2000000)
   --no-exec                  skip L1-L3 entirely (reported as not-run/NA, never PASS)
   --static-only              M1 mode: listing profile, only C-1/C-2/C-3/C-11/C-12/C-13; C-4..C-9 are out of scope
   --treat-as-plugin          run L1-L3 on a bundle's server entry (lib/index.js, index.js, lib/public-entry.js, src/index.ts)
@@ -77,6 +80,8 @@ function parseArgs(argv) {
     marketIndex: null,
     pluginName: null,
     timeoutMs: 10_000,
+    maxFiles: 400,
+    maxBytes: 2_000_000,
     noExec: false,
     staticOnly: false,
     treatAsPlugin: false,
@@ -120,6 +125,8 @@ function parseArgs(argv) {
       case '--market-index': options.marketIndex = value(); break
       case '--plugin-name': options.pluginName = value(); break
       case '--timeout': options.timeoutMs = Number(value()); break
+      case '--max-files': options.maxFiles = Number(value()); break
+      case '--max-bytes': options.maxBytes = Number(value()); break
       case '--out': options.out = value(); break
       case '--no-exec': options.noExec = true; break
       case '--static-only': options.staticOnly = true; break
@@ -144,6 +151,8 @@ function parseArgs(argv) {
   if (!['package', 'listing', 'both'].includes(options.profile)) throw new Error(`unsupported --profile: ${options.profile}`)
   if (options.staticOnly && options.treatAsPlugin) throw new Error('--static-only and --treat-as-plugin are mutually exclusive')
   if (!Number.isFinite(options.timeoutMs) || options.timeoutMs < 100 || options.timeoutMs > 120_000) throw new Error('--timeout must be between 100 and 120000 ms')
+  if (!Number.isInteger(options.maxFiles) || options.maxFiles < 1 || options.maxFiles > 200_000) throw new Error('--max-files must be an integer between 1 and 200000')
+  if (!Number.isInteger(options.maxBytes) || options.maxBytes < 1000 || options.maxBytes > 2_000_000_000) throw new Error('--max-bytes must be an integer between 1000 and 2000000000')
   if (options.target === null) options.target = '.'
   return options
 }
@@ -333,7 +342,12 @@ export async function main(argv = process.argv.slice(2)) {
   })
 
   let sources = []
-  try { sources = readSources(dir) } catch { sources = [] }
+  let scan = null
+  try {
+    const read = readSourcesWithStats(dir, { maxFiles: options.maxFiles, maxBytes: options.maxBytes })
+    sources = read.sources
+    scan = read.scan
+  } catch { sources = [] }
   const declarationChecks = manifest ? [
     checkCapabilities(manifest, sources, patch),
     checkCredentials(manifest, sources),
@@ -344,7 +358,7 @@ export async function main(argv = process.argv.slice(2)) {
     { id: 'DSC-13', clause: 'C-13', layer: 'L0', result: 'ERROR', coverage: 'not-run', reason: 'manifest unavailable', details: [], evidence: [], method: 'M', advisory: false },
   ]
   const declarationAdjusted = declarationChecks.map(item => (item.result === 'WARN' && ['DSC-11', 'DSC-13'].includes(item.id) ? { ...item, advisory: true } : item))
-  const advisoryChecks = [checkImportTimeAdvisory(sources, entry?.relative)]
+  const advisoryChecks = [checkImportTimeAdvisory(sources, entry?.relative, scan)]
 
   if (options.scope === 'entry' && options.entryRuntime === 'server-entry' && kind !== 'plugin') options.treatAsPlugin = true
   let runtimeKind = kind
@@ -375,6 +389,16 @@ export async function main(argv = process.argv.slice(2)) {
     })
   }
 
+  // A bundle/client has no plugin entry for L1-L3. Instead of leaving all six
+  // runtime checks NA, cover their statically decidable part explicitly and
+  // mark the coverage partial (the report says what still needs --host/--runtime).
+  const runtimeUsable = runtimeChecks.some(item => ['PASS', 'WARN', 'FAIL'].includes(item.result))
+  if (manifest && ['bundle', 'client'].includes(kind) && !runtimeUsable) {
+    const staticChecks = runStaticBundleChecks({ manifest, kind, entry, patch, sources, g4, scan, dir })
+    const staticById = new Map(staticChecks.map(item => [item.id, item]))
+    runtimeChecks = runtimeChecks.map(item => staticById.get(item.id) ?? item)
+  }
+
   const runCheck = await entryRunCheck(kind, runtimeChecks, options, dir)
   const checks = [
     manifestChecks[0], manifestChecks[1], manifestChecks[2],

package/40-checker/src/client-shape.mjs

@@ -1,11 +1,28 @@
 /**
  * Static G4 check: when `dsh.client` exists, the package must expose
- * `exports["./client"]` and declare the client at the package root.
+ * `exports["./client"]` and that target must exist in the package.
  *
  * This is a static shape check. It does not prove the client module loads or
  * renders; that is a runtime/UI probe and is reported separately.
  */
-export function checkClientShape(manifest) {
+import path from 'node:path'
+import { isFile } from './util.mjs'
+
+function clientTarget(exported) {
+  if (typeof exported === 'string') return exported
+  if (exported && typeof exported === 'object' && !Array.isArray(exported)) {
+    for (const key of ['default', 'import', 'require', 'node', 'browser']) {
+      if (typeof exported[key] === 'string') return exported[key]
+    }
+    for (const value of Object.values(exported)) {
+      const nested = clientTarget(value)
+      if (nested) return nested
+    }
+  }
+  return null
+}
+
+export function checkClientShape(manifest, dir = null) {
   const hasClient = manifest?.dsh?.client !== undefined
   if (!hasClient) {
     return {
@@ -28,10 +45,23 @@ export function checkClientShape(manifest) {
       reason: 'dsh.client exists but exports["./client"] is missing; a package-root row cannot resolve it',
     }
   }
+  const target = clientTarget(exported)
+  if (target && typeof dir === 'string' && dir !== '' && !target.includes('*')) {
+    const absolute = path.resolve(dir, target)
+    const relative = path.relative(dir, absolute)
+    if (relative.startsWith('..') || path.isAbsolute(relative) || !isFile(absolute)) {
+      return {
+        hasClient: true,
+        ok: false,
+        result: 'FAIL',
+        reason: `exports["./client"] points to a missing file: ${target}`,
+      }
+    }
+  }
   return {
     hasClient: true,
     ok: true,
     result: 'PASS',
-    reason: 'dsh.client + exports["./client"] present (static only)',
+    reason: 'dsh.client + exports["./client"] present and resolvable (static only)',
   }
 }

package/40-checker/src/declarations.mjs

@@ -424,13 +424,28 @@ function collectSideEffectHits(ast, file, hits) {
   })
 }
 
-function analyseImportClosure(sources, entryRelative) {
+function analyseImportClosure(sources, entryRelative, scan = null) {
   const byRelative = new Map()
   for (const source of sources) byRelative.set(normalizeRelative(source.relative), source)
   const queue = []
   if (entryRelative) {
     const entry = normalizeRelative(entryRelative)
-    if (!byRelative.has(entry)) return { error: `entry module ${entryRelative} was not found among scanned sources` }
+    if (!byRelative.has(entry)) {
+      // A bounded scan can stop before the entry module. That is missing
+      // coverage, not proof that the package has no entry.
+      if (scan?.truncated) {
+        return {
+          entryOutsideScan: true,
+          truncated: scan,
+          visited: new Set(),
+          hits: [],
+          parseErrors: [],
+          coverage: [],
+          localEdges: [],
+        }
+      }
+      return { error: `entry module ${entryRelative} was not found among scanned sources` }
+    }
     queue.push(entry)
   } else {
     // Programmatic callers without an entry: keep the legacy "all sources" shape.
@@ -483,23 +498,30 @@ function hitEvidence(hits, limit = 3) {
   return hits.slice(0, limit).map(hit => `${hit.file}:${hit.line}`)
 }
 
+/** The exact bounded-scan statement the report must carry when it truncates. */
+export function scanTruncationReason(scan) {
+  if (!scan?.truncated) return ''
+  return `truncated at ${scan.maxFiles} files / ${scan.maxBytes} bytes; entry may be beyond the scan (scanned ${scan.files} files / ${scan.bytes} bytes)`
+}
+
 /** DSC-10: advisory only; never FAIL. */
-export function checkImportTimeAdvisory(sources, entryRelative = null) {
+export function checkImportTimeAdvisory(sources, entryRelative = null, scan = null) {
   if (sources.length === 0) {
+    const truncation = scanTruncationReason(scan)
     return check({
       id: 'DSC-10',
       clause: 'C-10',
       layer: 'L0',
       result: 'NA',
       advisory: true,
-      coverage: 'not-run',
-      reason: 'no source files scanned; C-10 not-run',
-      details: [],
+      coverage: truncation ? 'partial' : 'not-run',
+      reason: truncation ? `partial: ${truncation}; C-10 not-run` : 'no source files scanned; C-10 not-run',
+      details: truncation ? [detail('C-10.3', 'NA', `not-run: ${truncation}`, [])] : [],
       evidence: [],
     })
   }
 
-  const analysis = analyseImportClosure(sources, entryRelative)
+  const analysis = analyseImportClosure(sources, entryRelative, scan)
   if (analysis.error) {
     const evidence = normalizeRelative(entryRelative)
     return check({
@@ -515,12 +537,32 @@ export function checkImportTimeAdvisory(sources, entryRelative = null) {
     })
   }
 
+  if (analysis.entryOutsideScan) {
+    const truncation = scanTruncationReason(analysis.truncated)
+    const entry = normalizeRelative(entryRelative)
+    return check({
+      id: 'DSC-10',
+      clause: 'C-10',
+      layer: 'L0',
+      result: 'NA',
+      advisory: true,
+      coverage: 'partial',
+      reason: `partial: ${truncation}; C-10 not-run`,
+      details: [detail('C-10.3', 'NA', `not-run: ${truncation}; entry module ${entryRelative} is outside the scanned set`, [entry])],
+      evidence: [entry],
+    })
+  }
+
+  const truncation = scanTruncationReason(scan)
   const { visited, hits, parseErrors, coverage, localEdges } = analysis
   const details = hits.slice(0, 20).map(hit => detail(hit.clause, 'WARN', `${hit.pattern} at ${hit.file}:${hit.line}`, [`${hit.file}:${hit.line}`]))
   details.push(...coverage.slice(0, 10))
   if (localEdges.length > 0) {
     details.push(detail('C-10.3', 'PASS', `local relative import closure analysed (${visited.size} module(s))`, [...visited].slice(0, 5)))
   }
+  if (truncation) {
+    details.push(detail('C-10.3', 'NA', `not-run: ${truncation}; the local import closure is incomplete`, []))
+  }
   for (const error of parseErrors) {
     details.push(detail('C-10', 'ERROR', `not-run: AST parse failed in ${error.file}:${error.line} (${error.message})`, [`${error.file}:${error.line}`]))
   }
@@ -538,6 +580,9 @@ export function checkImportTimeAdvisory(sources, entryRelative = null) {
     result = 'PASS'
     reason = ''
   }
+  if (truncation) {
+    reason = reason ? `${reason}; partial: ${truncation}` : `partial: ${truncation}`
+  }
 
   const evidence = hits.length > 0
     ? hitEvidence(hits)
@@ -551,7 +596,7 @@ export function checkImportTimeAdvisory(sources, entryRelative = null) {
     layer: 'L0',
     result,
     advisory: true,
-    coverage: result === 'ERROR' ? 'not-run' : 'full',
+    coverage: result === 'ERROR' ? 'not-run' : truncation ? 'partial' : 'full',
     reason,
     details,
     evidence,

package/40-checker/src/index.mjs

@@ -1,8 +1,10 @@
 /** Programmatic API for dsh-plugin-verify. */
 export { main, parseArgs, usage, VERSION, detectHostRuntime, resolveRuntimeAnchor, declarationsOf } from './cli.mjs'
 export { runManifestChecks, checkMarketEntry, DEFAULT_RUNTIME_VERSION, inferKind, resolveEntry } from './manifest.mjs'
-export { checkCapabilities, checkCredentials, checkLabels, checkImportTimeAdvisory, CAPABILITIES, LABELS } from './declarations.mjs'
+export { checkCapabilities, checkCredentials, checkLabels, checkImportTimeAdvisory, scanTruncationReason, CAPABILITIES, LABELS } from './declarations.mjs'
+export { readSources, readSourcesWithStats, listSourceFiles, scanSourceFiles } from './util.mjs'
 export { runRuntimeChecks } from './runtime.mjs'
+export { runStaticBundleChecks } from './bundle-static.mjs'
 export { buildReport, formatText, formatSarif, writeReport, summarizeBlocking, DECLARATION_CHECKS } from './report.mjs'
 export { joinAdvice, DOCS_BASE } from './remediation.mjs'
 export { satisfies, validRange, parseVersion, compareVersions } from './semver.mjs'