universal-dev-standards 6.3.1 → 6.3.2

package/bundled/locales/zh-CN/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.3.1
-translation_version: 6.3.1
+source_version: 6.3.2
+translation_version: 6.3.2
 last_synced: 2026-08-06
 status: current
 ---
@@ -17,6 +17,12 @@ status: current
 
 ## [Unreleased]
 
+## [6.3.2] - 2026-08-06
+
+### 修复
+
+- **`uds deps` 断言了一个它无从得知的出货渠道。** 报告结尾写着「consumers resolve the range themselves, because a published package does not ship a lockfile」，第三列标为 `users get=`。对一个以 `npm ci` 构建、出货 Docker image 的产品，这两句都是错的——它的用户拿到的正是 `tested=` 那一列，而解析出的那一列实际代表的是「下一次 lockfile 重新生成时会被无人审阅地拉进来的东西」。发现方式是拿这个命令去跑一个出货 Docker image、根本没发到 npm 的闭源产品。列名改为 `resolves=`，报告同时陈述两种读法——因为单独读一行时，它不能说出与事实相反的话。这与 1.1.0 对 Lock Strategy 条目所做的修正是同一件事：在一句误导的话下面补「但是……」，那句话仍然误导，而报告和标准表格一样，多半是一次读一行。现在有三个测试把措辞钉住，此前一个都没有。
+
 ## [6.3.1] - 2026-08-06
 
 ### 修复

package/bundled/locales/zh-CN/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **语言**: [English](../../README.md) | [繁體中文](../zh-TW/README.md) | 简体中文
 
-**版本**: 6.3.1 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.3.2 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
 
 语言无关、框架无关的软件项目文档标准。通过 AI 原生工作流，确保不同技术栈之间的一致性、质量和可维护性。
 

package/bundled/locales/zh-TW/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.3.1
-translation_version: 6.3.1
+source_version: 6.3.2
+translation_version: 6.3.2
 last_synced: 2026-08-06
 status: current
 ---
@@ -17,6 +17,12 @@ status: current
 
 ## [Unreleased]
 
+## [6.3.2] - 2026-08-06
+
+### 修復
+
+- **`uds deps` 斷言了一個它無從得知的出貨管道。** 報告結尾寫著「consumers resolve the range themselves, because a published package does not ship a lockfile」，第三欄標為 `users get=`。對一個以 `npm ci` 建置、出貨 Docker image 的產品，這兩句都是錯的——它的使用者拿到的正是 `tested=` 那一欄，而解析出的那一欄實際代表的是「下一次 lockfile 重新產生時會被無人審閱地拉進來的東西」。發現方式是拿這個指令去跑一個出貨 Docker image、根本沒發到 npm 的閉源產品。欄位改為 `resolves=`，報告同時陳述兩種讀法——因為單獨讀一列時，它不能說出與事實相反的話。這與 1.1.0 對 Lock Strategy 條目所做的修正是同一件事：在一句誤導的話下面補「但是……」，那句話仍然誤導，而報告和標準表格一樣，多半是一次讀一行。現在有三個測試把措辭釘住，先前一個都沒有。
+
 ## [6.3.1] - 2026-08-06
 
 ### 修復

package/bundled/locales/zh-TW/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **語言**: [English](../../README.md) | 繁體中文 | [简体中文](../zh-CN/README.md)
 
-**版本**: 6.3.1 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.3.2 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
 
 語言無關、框架無關的軟體專案文件標準。透過 AI 原生工作流，確保不同技術堆疊之間的一致性、品質和可維護性。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-dev-standards",
-  "version": "6.3.1",
+  "version": "6.3.2",
   "description": "CLI tool for adopting Universal Development Standards",
   "keywords": [
     "documentation",

package/src/commands/deps.js

@@ -23,7 +23,7 @@ import { measureResolutionDrift } from '../utils/dependency-resolution.js';
  * denominator is still printed, because "no drift" and "nothing was checked"
  * produce the same silence otherwise, and only one of them is good news.
  */
-function render(result) {
+export function render(result) {
   const lines = [];
   const label = result.packageName ? chalk.bold(result.packageName) : result.root;
 
@@ -40,12 +40,31 @@ function render(result) {
     for (const d of result.drifted) {
       lines.push(
         `    ${chalk.bold(d.name)}  ${chalk.dim(d.range)}` +
-          `  tested=${chalk.cyan(d.locked)}  users get=${chalk.yellow(d.resolved)}`
+          `  tested=${chalk.cyan(d.locked)}  resolves=${chalk.yellow(d.resolved)}`
       );
     }
     lines.push('');
-    lines.push(chalk.dim('  Your lockfile pins the tested column; consumers resolve the range'));
-    lines.push(chalk.dim('  themselves, because a published package does not ship a lockfile.'));
+    // Which of these two readings applies depends on how the project ships,
+    // and this command cannot know that — so it states both rather than
+    // asserting one. The first draft said only "consumers resolve the range
+    // themselves, because a published package does not ship a lockfile",
+    // which is plainly false for a product distributed as a container image
+    // built with `npm ci`. The standard this command implements scopes itself
+    // to published artifacts; the command did not, and a check that overstates
+    // its own conclusion is the thing it exists to catch.
+    // The column is labelled `resolves=`, not `users get=`. The second reads
+    // correctly on its own only for a published package; for a container image
+    // its users get the `tested=` column exactly, and a row read alone would
+    // then say the opposite of the truth. Leaving the label and explaining it
+    // underneath is the "but note…" this project's own supply-chain standard
+    // was rewritten to stop doing — a line of a report, like a line of a
+    // standards table, is mostly read one line at a time.
+    lines.push(chalk.dim('  Your lockfile pins the tested column.'));
+    lines.push(chalk.dim('  If you publish this package, that column reaches nobody — a published'));
+    lines.push(chalk.dim('  package ships no lockfile, so consumers resolve the ranges themselves.'));
+    lines.push(chalk.dim('  If instead you ship the lockfile with the artifact (a container image,'));
+    lines.push(chalk.dim('  a deployed service), the third column is what the next lockfile'));
+    lines.push(chalk.dim('  regeneration pulls in — unreviewed, and by whoever happens to run it.'));
   }
 
   if (result.unpinnedNative.length > 0) {
@@ -62,7 +81,7 @@ function render(result) {
     lines.push(chalk.dim('  promise about native ABI compatibility, and this ecosystem has'));
     lines.push(chalk.dim('  broken it inside a minor range. A range that matches one published'));
     lines.push(chalk.dim('  version is safe because upstream has not published again — waiting'));
-    lines.push(chalk.dim('  for drift means waiting until your users already have it.'));
+    lines.push(chalk.dim('  for drift means waiting until it is already inside something you ship.'));
   }
 
   if (result.unverifiable.length > 0) {

package/src/utils/dependency-resolution.js

@@ -2,10 +2,20 @@
  * Shipped dependency resolution integrity. // implements XSPEC-366 R1
  *
  * **The problem this measures.** A published npm package does not carry its
- * lockfile. Your CI tests the versions `package-lock.json` pins; your users get
- * whatever the declared ranges resolve to at their install time. When those two
- * differ, the entire test suite is green about a combination nobody installs —
- * and that green is indistinguishable from a real one.
+ * lockfile. Your CI tests the versions `package-lock.json` pins; whoever
+ * installs the package gets whatever the declared ranges resolve to at their
+ * install time. When those two differ, the entire test suite is green about a
+ * combination nobody installs — and that green is indistinguishable from a
+ * real one.
+ *
+ * **Who "whoever" is depends on how the project ships, and this module cannot
+ * know that.** For a published package it is every consumer. For a product
+ * distributed as a container image built with `npm ci`, its users get the
+ * pinned column exactly, and the resolved column is instead what the next
+ * lockfile regeneration will pull in — unreviewed, whenever someone happens to
+ * run it. Both are worth knowing; neither is safe to assert as the other. The
+ * report says both rather than picking one, and labels the column `resolves=`
+ * for the same reason.
  *
  * This is not hypothetical. `engramgraph` declared
  * `"tree-sitter-c-sharp": "^0.23.1"`. Three published versions satisfy that

package/standards-registry.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "6.3.1",
+  "version": "6.3.2",
   "lastUpdated": "2026-05-13",
   "description": "Standards registry for universal-dev-standards with integrated skills and AI-optimized formats",
   "formats": {
@@ -58,14 +58,14 @@
     "standards": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
-      "version": "6.3.1"
+      "version": "6.3.2"
     },
     "skills": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
       "localPath": "skills",
       "rawUrl": "https://raw.githubusercontent.com/AsiaOstrich/universal-dev-standards/main/skills",
-      "version": "6.3.1",
+      "version": "6.3.2",
       "note": "Skills are now included in the main repository under skills/"
     }
   },
@@ -2236,7 +2236,7 @@
       "id": "license-compliance",
       "name": "License Compliance Standards",
       "nameZh": "授權合規標準",
-      "version": "6.3.1",
+      "version": "6.3.2",
       "source": {
         "human": "core/license-compliance.md",
         "ai": "ai/standards/license-compliance.ai.yaml"
@@ -2248,7 +2248,7 @@
       "id": "verification-oracle",
       "name": "Verification Oracle Standards",
       "nameZh": "驗證 Oracle 標準",
-      "version": "6.3.1",
+      "version": "6.3.2",
       "source": {
         "human": "core/verification-oracle.md",
         "ai": "ai/standards/verification-oracle.ai.yaml"
@@ -2260,7 +2260,7 @@
       "id": "model-provenance",
       "name": "Model Provenance Policy Standards",
       "nameZh": "模型來源政策標準",
-      "version": "6.3.1",
+      "version": "6.3.2",
       "source": {
         "human": "core/model-provenance.md",
         "ai": "ai/standards/model-provenance.ai.yaml"
@@ -2272,7 +2272,7 @@
       "id": "resource-cost-boundary",
       "name": "Resource / Cost Boundary Declaration Standards",
       "nameZh": "資源／成本邊界宣告標準",
-      "version": "6.3.1",
+      "version": "6.3.2",
       "source": {
         "human": "core/resource-cost-boundary.md",
         "ai": "ai/standards/resource-cost-boundary.ai.yaml"