upstream-radar 0.40.0 → 0.41.0

package/dist/src/semver.js

@@ -120,7 +120,13 @@ export function satisfiesSemverRange(versionValue, rangeValue) {
     if (version === undefined)
         return undefined;
     const normalized = rangeValue.trim().replace(/^workspace:/, '');
-    if (normalized === '^' || normalized === '~' || normalized === '*')
+    // npm's bare wildcard is an explicit unconstrained range. Treating it as
+    // indeterminate made every resolved `peerDependencies: { name: "*" }`
+    // contract look like missing evidence even though any semantic version is
+    // a mathematical match.
+    if (normalized === '*')
+        return true;
+    if (normalized === '^' || normalized === '~')
         return undefined;
     let sawUnknown = false;
     for (const branch of normalized.split('||')) {

package/dist/src/semver.js.map

@@ -1 +1 @@
-{"version":3,"file":"semver.js","sourceRoot":"","sources":["../../src/semver.ts"],"names":[],"mappings":"AAOA,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AACpD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,YAAY,GAAG,KAAK;IAC7D,MAAM,KAAK,GAAG,uGAAuG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACxI,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACpC,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IACzF,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;KAC7E,CAAA;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAa;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IAChG,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACvG,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACxE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1H,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAQ;QACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACvG,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,CAAA;QAC3C,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAA;QAC3C,OAAO,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtC,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,UAAkB;IACvE,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;IACnC,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;IACrC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC/D,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AACnC,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,KAAa;IACvD,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAA;IAChC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAA;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACjD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,IAAI,EAAE,OAAO,UAAU,IAAI,CAAC,CAAA;QACjC,KAAK,IAAI,EAAE,OAAO,UAAU,IAAI,CAAC,CAAA;QACjC,KAAK,GAAG,EAAE,OAAO,UAAU,GAAG,CAAC,CAAA;QAC/B,KAAK,GAAG,EAAE,OAAO,UAAU,GAAG,CAAC,CAAA;QAC/B,KAAK,GAAG,EAAE,OAAO,UAAU,KAAK,CAAC,CAAA;QACjC,SAAS,OAAO,SAAS,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,KAAa;IAClD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACtC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,MAAM,KAAK,GAAW,KAAK,CAAC,KAAK,GAAG,CAAC;QACnC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE;QAChE,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;YACf,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE;YAChE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;IACpE,OAAO,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;AAChF,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,KAAa;IAClD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACtC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,MAAM,KAAK,GAAW,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;IAC9F,OAAO,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,SAAiB;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;IAC/B,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5E,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1C,MAAM,QAAQ,GAAG,yDAAyD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvF,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7H,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QACpH,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QACpH,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QACpH,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACzE,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAClC,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAChD,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QAClC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,GAAG,IAAI,CAAA;IAC1C,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;AACnC,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,oBAAoB,CAAC,YAAoB,EAAE,UAAkB;IAC3E,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,CAAA;IACzC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;IAC/D,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IACpF,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC7C,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAChC,IAAI,MAAM,KAAK,SAAS;YAAE,UAAU,GAAG,IAAI,CAAA;IAC7C,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,aAAqB,EAAE,cAAsB;IAC1F,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,CAAA;IAC7C,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9G,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACnD,OAAO,QAAQ,CAAC,KAAK,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,CAAA;AACnE,CAAC"}
+{"version":3,"file":"semver.js","sourceRoot":"","sources":["../../src/semver.ts"],"names":[],"mappings":"AAOA,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AACpD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,YAAY,GAAG,KAAK;IAC7D,MAAM,KAAK,GAAG,uGAAuG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACxI,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACpC,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IACzF,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;KAC7E,CAAA;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAa;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IAChG,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACvG,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACxE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1H,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAQ;QACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACvG,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,CAAA;QAC3C,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAA;QAC3C,OAAO,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtC,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,UAAkB;IACvE,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;IACnC,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;IACrC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC/D,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AACnC,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,KAAa;IACvD,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAA;IAChC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAA;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACjD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,IAAI,EAAE,OAAO,UAAU,IAAI,CAAC,CAAA;QACjC,KAAK,IAAI,EAAE,OAAO,UAAU,IAAI,CAAC,CAAA;QACjC,KAAK,GAAG,EAAE,OAAO,UAAU,GAAG,CAAC,CAAA;QAC/B,KAAK,GAAG,EAAE,OAAO,UAAU,GAAG,CAAC,CAAA;QAC/B,KAAK,GAAG,EAAE,OAAO,UAAU,KAAK,CAAC,CAAA;QACjC,SAAS,OAAO,SAAS,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,KAAa;IAClD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACtC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,MAAM,KAAK,GAAW,KAAK,CAAC,KAAK,GAAG,CAAC;QACnC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE;QAChE,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;YACf,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE;YAChE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;IACpE,OAAO,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;AAChF,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,KAAa;IAClD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACtC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,MAAM,KAAK,GAAW,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;IAC9F,OAAO,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,SAAiB;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;IAC/B,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5E,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1C,MAAM,QAAQ,GAAG,yDAAyD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvF,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7H,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QACpH,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QACpH,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QACpH,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACzE,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAClC,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAChD,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QAClC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,GAAG,IAAI,CAAA;IAC1C,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;AACnC,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,oBAAoB,CAAC,YAAoB,EAAE,UAAkB;IAC3E,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,CAAA;IACzC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;IAC/D,yEAAyE;IACzE,sEAAsE;IACtE,0EAA0E;IAC1E,wBAAwB;IACxB,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IAC9D,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC7C,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAChC,IAAI,MAAM,KAAK,SAAS;YAAE,UAAU,GAAG,IAAI,CAAA;IAC7C,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,aAAqB,EAAE,cAAsB;IAC1F,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,CAAA;IAC7C,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9G,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACnD,OAAO,QAAQ,CAAC,KAAK,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,CAAA;AACnE,CAAC"}

package/dist/src/version.d.ts

@@ -1,2 +1,2 @@
-export declare const TOOL_VERSION = "0.40.0";
+export declare const TOOL_VERSION = "0.41.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/src/version.js

@@ -1,2 +1,2 @@
-export const TOOL_VERSION = '0.40.0';
+export const TOOL_VERSION = '0.41.0';
 //# sourceMappingURL=version.js.map

package/docs/README.zh-CN.md

@@ -98,7 +98,7 @@ FIRST EPSS estimated exploitation probability: 97.2% (percentile 100.0%)
 想立即检查一个真实发布的 DSH 插件，可以在空目录直接运行：
 
 ```bash
-npx --yes upstream-radar@0.40.0 inspect dsh-feishu-bot@0.15.8 --deep
+npx --yes upstream-radar@0.41.0 inspect dsh-feishu-bot@0.15.8 --deep
 ```
 
 它会直接输出简短的准入结论、覆盖情况、依赖数量、漏洞数量和下一步，不需要先
@@ -111,7 +111,7 @@ npx --yes upstream-radar@0.40.0 inspect dsh-feishu-bot@0.15.8 --deep
 npm 解析环境中目前无法建立完整依赖图：
 
 ```bash
-npx --yes upstream-radar@0.40.0 inspect \
+npx --yes upstream-radar@0.41.0 inspect \
   @sanqi-normal/dsh-webui-market-plugin@0.5.4 \
   --deep --fail-on never
 ```
@@ -122,7 +122,8 @@ profile、插件执行或 LLM。完整证据见[作者修复报告](../examples/
 这条案例已经闭环：维护者确认了宿主依赖约定，并提交了[修复
 `8b32828`](https://github.com/Sanqi-normal/dsh-webui-market-plugin/commit/8b328289ce5268451bd4414fa3ae41ee2f515649)；
 我在该源码提交上用禁用脚本的干净解析重新验证，已经不再拉取 `dsh-compact`。
-npm 发布物还没有更新，所以报告仍明确区分“源码已修复”和“发布版本待跟进”。
+后续发布的 `0.5.5` 也已用精确 npm tarball 复核：严格依赖解析建立了 69 个包的
+完整必需依赖图，原 issue 已作为“发布物修复验证通过”关闭。
 
 如果你手里的是公开 DSH 插件仓库，不需要先手动 clone：
 
@@ -336,9 +337,9 @@ npm：     dsh-feishu-bot@0.15.8
 会继续显示为 `incomplete`，不会被当成已经确认的故障。
 
 ```bash
-npx --yes upstream-radar@0.40.0 graph reverse ./plugin-reports \
+npx --yes upstream-radar@0.41.0 graph reverse ./plugin-reports \
   --output ./reverse-dependency-index.json
-npx --yes upstream-radar@0.40.0 observe ./targets.yml \
+npx --yes upstream-radar@0.41.0 observe ./targets.yml \
   --reverse-index ./reverse-dependency-index.json \
   --state ./observations.json --report ./upstream-radar-observer.md
 ```
@@ -376,7 +377,7 @@ Radar 会在三层目录内自动找到它；npm 名称和源码 manifest 不一
 想明确选择锁文件时再加 `--lockfile`：
 
 ```bash
-npx --yes upstream-radar@0.40.0 observe \
+npx --yes upstream-radar@0.41.0 observe \
   https://github.com/PlutoKeating/dsh-lark-bot \
   --state ./observations.json --report ./upstream-radar-observer.md
 ```
@@ -399,7 +400,7 @@ workspace 边保留为未解析证据；不会安装或启动 DSH。
 会额外指定 `--package`：
 
 ```bash
-npx --yes upstream-radar@0.40.0 observe \
+npx --yes upstream-radar@0.41.0 observe \
   https://github.com/PlutoKeating/dsh-lark-bot \
   --package dsh-feishu-bot \
   --lockfile pnpm-lock.yaml --lockfile-type pnpm \
@@ -408,8 +409,9 @@ npx --yes upstream-radar@0.40.0 observe \
 
 提交的 targets 示例还包含一个没有锁文件的真实案例
 [`Sanqi-normal/dsh-webui-market-plugin`](../examples/upstream-observer/targets.yml)。
-它的 peer 修复先进入源码，npm 仍是 `0.5.4` 时 observer 不会冒充“发布物已修复”，
-而是留下待处理任务；完整结果见[observer 重放报告](../examples/upstream-observer/reports/sanqi-maintainer-repair-live.md)。
+它的 peer 修复先进入源码、npm 仍是 `0.5.4` 时，observer 没有冒充“发布物已修复”，
+而是留下待处理任务；`0.5.5` 发布后又进入 maintained isolated matrix。完整时间线见
+[observer 重放报告](../examples/upstream-observer/reports/sanqi-maintainer-repair-live.md)。
 
 执行一次检查：
 
@@ -677,7 +679,7 @@ cd my-dsh-plugin
 pnpm install --ignore-scripts
 
 # 把插件放进 DSH profile 前，先读取精确依赖图。
-pnpm dlx --package=upstream-radar@0.40.0 upstream-radar graph pnpm-lock pnpm-lock.yaml --json
+pnpm dlx --package=upstream-radar@0.41.0 upstream-radar graph pnpm-lock pnpm-lock.yaml --json
 ```
 
 这棵图会保留精确的 DSH 包版本，也会把未解析的可选 peer 明确显示出来；它不会加载生成的插件，也不会运行 lifecycle script。审查后，把下面这个完整 workflow 复制到 `.github/workflows/upstream-radar.yml`：
@@ -699,7 +701,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: MicroMilo/upstream-radar@v0.40.0
+      - uses: MicroMilo/upstream-radar@v0.41.0
         with:
           fail-on: high
           fail-on-compatibility: breaking
@@ -710,7 +712,7 @@ Action 会自动识别唯一的 `pnpm-lock.yaml`，检查同一棵精确依赖
 也可以直接检查一个真实发布的 DSH 包：
 
 ```bash
-npx --yes upstream-radar@0.40.0 inspect dsh-feishu-bot@0.15.8 --deep
+npx --yes upstream-radar@0.41.0 inspect dsh-feishu-bot@0.15.8 --deep
 ```
 
 这次检查的结论是 `REVIEW`：registry 完整性、签名、provenance 和 89 个已解析包都
@@ -723,7 +725,7 @@ npx --yes upstream-radar@0.40.0 inspect dsh-feishu-bot@0.15.8 --deep
 如果不想分别执行 `inspect`、打包和 `probe`，可以用一个命令完成一次 DSH 插件审查：
 
 ```bash
-pnpm dlx --package=upstream-radar@0.40.0 upstream-radar review dsh-plugin \
+pnpm dlx --package=upstream-radar@0.41.0 upstream-radar review dsh-plugin \
   dsh-cloudflare-browser-run@0.1.1 \
   --dsh-version 0.1.0-rc.6,0.1.0-rc.7
 ```
@@ -889,7 +891,7 @@ pnpm run try:dsh
 在把项目接入兼容性门禁前，可以先运行离线规则 benchmark：
 
 ```bash
-pnpm dlx --package=upstream-radar@0.40.0 upstream-radar benchmark compatibility
+pnpm dlx --package=upstream-radar@0.41.0 upstream-radar benchmark compatibility
 ```
 
 它覆盖六类契约：安全补丁、只需要项目分析的变化、不兼容的 DSH peer、发布者明确声明 breaking、候选传递依赖漏洞，以及候选依赖图不完整。这个命令不会联网、安装包、加载插件或启动 DSH；它验证的是 Radar 的确定性规则以及 `breaking`/`any` 门禁行为，不是运行时兼容性证明。
@@ -902,7 +904,7 @@ pnpm dlx --package=upstream-radar@0.40.0 upstream-radar benchmark compatibility
 # 打包精确版本，并明确不运行它的 lifecycle script。
 npm pack --ignore-scripts dsh-plugin@1.2.3
 
-pnpm dlx --package=upstream-radar@0.40.0 upstream-radar probe dsh-load \
+pnpm dlx --package=upstream-radar@0.41.0 upstream-radar probe dsh-load \
   ./dsh-plugin-1.2.3.tgz \
   --dsh-version 0.1.0-rc.6
 ```
@@ -928,7 +930,7 @@ pnpm run showcase:dsh-probe
 如果要比较多个 DSH 版本，可以使用矩阵入口：
 
 ```bash
-pnpm dlx --package=upstream-radar@0.40.0 upstream-radar probe dsh-matrix \
+pnpm dlx --package=upstream-radar@0.41.0 upstream-radar probe dsh-matrix \
   ./dsh-plugin-1.2.3.tgz \
   --dsh-version 0.1.0-rc.3 \
   --dsh-version 0.1.0-rc.6 \
@@ -946,7 +948,7 @@ JSON 结果结构见[矩阵结果 schema](../schemas/dsh-load-matrix.schema.json
 ```yaml
 steps:
   - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-  - uses: MicroMilo/upstream-radar@v0.40.0
+  - uses: MicroMilo/upstream-radar@v0.41.0
     with:
       fail-on: high
       # 可选：把确定性的 DSH/插件兼容性破坏也作为 CI 失败条件
@@ -955,12 +957,12 @@ steps:
       threat-intel: true
 ```
 
-这个 Action 只是 `radar check --frozen --state :memory: --fail-on high --fail-on-compatibility breaking --json` 的薄封装。`--frozen` 是有意的：它只使用配置文件里的依赖图，不会尝试读取 runner 上不存在的本地 DSH profile。`threat-intel` 默认是 `false`，这样普通 CI 门禁不会因为额外查询变重；设置为 `true` 后，Job Summary 和原始 JSON 会包含 CISA KEV 与 FIRST EPSS 的优先级证据。每次运行彼此独立；发现达到阈值的漏洞或选择的兼容性变化时返回 `2`，运行或漏洞源出错时返回 `1`。`breaking` 只拦截有 confirmed/strong 信号的兼容性事件，`any` 会拦截所有活动兼容性事件，默认值是 `never`。除了原始 JSON 日志，Action 还会把经过转义的简短摘要写入 GitHub Job Summary，定时任务失败时可以直接看到受影响的包、准确依赖路径、已经发布的修复版本（如果有）、一行优先级证据和建议的下一步。这个入口不会投递 DSH Agent 任务，也不会修改分支；需要持续监控和项目级分析时，仍使用原生 DSH bundle。建议把 Action 固定到类似 `v0.40.0` 的发布标签，并根据团队策略固定 checkout Action。
+这个 Action 只是 `radar check --frozen --state :memory: --fail-on high --fail-on-compatibility breaking --json` 的薄封装。`--frozen` 是有意的：它只使用配置文件里的依赖图，不会尝试读取 runner 上不存在的本地 DSH profile。`threat-intel` 默认是 `false`，这样普通 CI 门禁不会因为额外查询变重；设置为 `true` 后，Job Summary 和原始 JSON 会包含 CISA KEV 与 FIRST EPSS 的优先级证据。每次运行彼此独立；发现达到阈值的漏洞或选择的兼容性变化时返回 `2`，运行或漏洞源出错时返回 `1`。`breaking` 只拦截有 confirmed/strong 信号的兼容性事件，`any` 会拦截所有活动兼容性事件，默认值是 `never`。除了原始 JSON 日志，Action 还会把经过转义的简短摘要写入 GitHub Job Summary，定时任务失败时可以直接看到受影响的包、准确依赖路径、已经发布的修复版本（如果有）、一行优先级证据和建议的下一步。这个入口不会投递 DSH Agent 任务，也不会修改分支；需要持续监控和项目级分析时，仍使用原生 DSH bundle。建议把 Action 固定到类似 `v0.41.0` 的发布标签，并根据团队策略固定 checkout Action。
 
 如果仓库还没有提交 Radar 配置，最短接入方式是省略 `config`、`pnpm-lock` 和 `npm-lock`。checkout 之后，Action 会自动使用唯一存在的 `pnpm-lock.yaml` 或 `package-lock.json`，生成临时的审查清单，再执行同一个 frozen 检查：
 
 ```yaml
-- uses: MicroMilo/upstream-radar@v0.40.0
+- uses: MicroMilo/upstream-radar@v0.41.0
   with:
     fail-on: high
 ```
@@ -970,7 +972,7 @@ steps:
 如果要在插件进入 DSH 前审查精确发布物，可以增加 `inspect-package`：
 
 ```yaml
-- uses: MicroMilo/upstream-radar@v0.40.0
+- uses: MicroMilo/upstream-radar@v0.41.0
   with:
     inspect-package: dsh-cloudflare-browser-run@0.1.1
     # review 是安全默认值；只有允许覆盖不完整时才使用 block
@@ -982,7 +984,7 @@ steps:
 如果仓库只有 pnpm 锁文件，还没有提交 Radar 配置，可以让 Action 在同一个 job 中生成配置；可直接复制[pnpm workflow 示例](../examples/github-actions/upstream-radar-pnpm.yml)：
 
 ```yaml
-- uses: MicroMilo/upstream-radar@v0.40.0
+- uses: MicroMilo/upstream-radar@v0.41.0
   with:
     pnpm-lock: pnpm-lock.yaml
     fail-on: high
@@ -996,7 +998,7 @@ npm 项目可以改用 `npm-lock: package-lock.json`；`pnpm-lock` 和 `npm-lock
 调用方需要先 checkout 仓库。这个 Action 不会安装项目依赖，也不会执行项目的 lifecycle script；它只读取提交到仓库的依赖图并查询配置中的上游漏洞源。如果需要完全显式的底层命令，等价写法是：
 
 ```bash
-pnpm dlx --package=upstream-radar@0.40.0 upstream-radar radar check \
+pnpm dlx --package=upstream-radar@0.41.0 upstream-radar radar check \
   ./upstream-radar.config.json --frozen --state :memory: --fail-on high \
   --fail-on-compatibility breaking --json
 ```
@@ -1004,7 +1006,7 @@ pnpm dlx --package=upstream-radar@0.40.0 upstream-radar radar check \
 如果还要检查一个已发布插件能否跨多个 DSH 版本加载，可以增加三个 input：
 
 ```yaml
-- uses: MicroMilo/upstream-radar@v0.40.0
+- uses: MicroMilo/upstream-radar@v0.41.0
   id: radar
   with:
     config: upstream-radar.config.json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "upstream-radar",
-  "version": "0.40.0",
+  "version": "0.41.0",
   "description": "Always-on dependency and compatibility monitoring for DeepSeek Harness plugins, including exact paths, upstream changes, and isolated install/load evidence.",
   "type": "module",
   "license": "Apache-2.0",

package/schemas/dsh-compatibility-ir.schema.json

@@ -0,0 +1,89 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/MicroMilo/upstream-radar/blob/main/schemas/dsh-compatibility-ir.schema.json",
+  "title": "Upstream Radar DSH compatibility IR",
+  "description": "Normalized direct plugin-to-DSH-host compatibility relations produced from isolated observations.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "cells", "relations"],
+  "properties": {
+    "schema": { "const": "upstream-radar.dsh-compatibility-ir/v1alpha1" },
+    "cells": {
+      "type": "array",
+      "maxItems": 500,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "caseId", "targetId", "observedAt", "result", "plugin", "runtime", "evidence"],
+        "properties": {
+          "id": { "type": "string", "minLength": 1, "maxLength": 80 },
+          "caseId": { "type": "string", "minLength": 1, "maxLength": 64 },
+          "targetId": { "type": "string", "minLength": 1, "maxLength": 64 },
+          "observedAt": { "type": "string", "format": "date-time" },
+          "result": { "enum": ["compatible", "runtime-incompatible", "peer-contract-incompatible", "install-failed", "load-failed", "unknown"] },
+          "plugin": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["name", "version", "staticFingerprint"],
+            "properties": {
+              "name": { "type": "string", "minLength": 1, "maxLength": 214 },
+              "version": { "type": "string", "minLength": 1, "maxLength": 256 },
+              "artifactSha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+              "staticFingerprint": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
+            }
+          },
+          "runtime": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["dshVersion", "nodeMajor", "nodeVersion", "platform", "architecture", "contractFingerprint"],
+            "properties": {
+              "dshVersion": { "type": "string", "minLength": 1, "maxLength": 256 },
+              "nodeMajor": { "type": "integer", "minimum": 16, "maximum": 40 },
+              "nodeVersion": { "type": "string", "minLength": 1, "maxLength": 256 },
+              "platform": { "type": "string", "minLength": 1, "maxLength": 64 },
+              "architecture": { "type": "string", "minLength": 1, "maxLength": 64 },
+              "pnpmVersion": { "type": "string", "minLength": 1, "maxLength": 256 },
+              "contractFingerprint": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
+            }
+          },
+          "evidence": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "runtimeGraphDigest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+              "runtimeGraphNodes": { "type": "integer", "minimum": 0, "maximum": 100000 },
+              "runtimeGraphEdges": { "type": "integer", "minimum": 0, "maximum": 250000 },
+              "requiredUnresolved": { "type": "integer", "minimum": 0, "maximum": 250000 },
+              "declaredPeerContracts": { "type": "integer", "minimum": 0, "maximum": 64 }
+            }
+          }
+        }
+      }
+    },
+    "relations": {
+      "type": "array",
+      "maxItems": 32000,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "cellId", "dependency"],
+        "properties": {
+          "id": { "type": "string", "minLength": 1, "maxLength": 80 },
+          "cellId": { "type": "string", "minLength": 1, "maxLength": 80 },
+          "dependency": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["name", "required", "status", "staticUsage"],
+            "properties": {
+              "name": { "type": "string", "minLength": 1, "maxLength": 214 },
+              "required": { "type": "string", "minLength": 1, "maxLength": 512 },
+              "status": { "enum": ["satisfied", "mismatched", "indeterminate", "missing"] },
+              "staticUsage": { "enum": ["runtime-import-observed", "type-only-reference-observed", "no-literal-reference-observed", "scan-incomplete"] },
+              "resolvedVersion": { "type": "string", "minLength": 1, "maxLength": 256 }
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/schemas/dsh-install-observation.schema.json

@@ -5,7 +5,7 @@
   "description": "Bounded process, network and filesystem evidence from installing and loading one exact npm artifact under one exact DSH version in an externally supplied disposable environment.",
   "type": "object",
   "additionalProperties": false,
-  "required": ["schema", "tool", "probe", "scope", "startedAt", "completedAt", "dshVersion", "runtime", "artifact", "stages", "observations", "filesystem", "result", "reason", "boundary"],
+  "required": ["schema", "tool", "probe", "scope", "startedAt", "completedAt", "dshVersion", "runtime", "artifact", "stages", "observations", "filesystem", "resolution", "result", "reason", "boundary"],
   "properties": {
     "schema": { "const": "upstream-radar.dsh-install-observation/v1alpha1" },
     "tool": {
@@ -21,6 +21,7 @@
     "scope": { "const": "install-and-load-behavior" },
     "startedAt": { "type": "string", "format": "date-time" },
     "completedAt": { "type": "string", "format": "date-time" },
+    "caseId": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$" },
     "dshVersion": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[0-9A-Za-z.-]+)?$" },
     "runtime": {
       "type": "object",
@@ -73,7 +74,8 @@
         "load": { "$ref": "#/$defs/filesystemDiff" }
       }
     },
-    "result": { "enum": ["compatible", "runtime-incompatible", "install-failed", "load-failed", "unknown"] },
+    "resolution": { "$ref": "#/$defs/resolution" },
+    "result": { "enum": ["compatible", "runtime-incompatible", "peer-contract-incompatible", "install-failed", "load-failed", "unknown"] },
     "reason": { "type": "string", "maxLength": 4096 },
     "boundary": {
       "type": "object",
@@ -118,6 +120,137 @@
         }
       }
     },
+    "resolution": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "profileLockfile": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["sha256", "bytes"],
+          "properties": {
+            "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+            "bytes": { "type": "integer", "minimum": 0, "maximum": 16777216 },
+            "graphDigest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+            "nodes": { "type": "integer", "minimum": 0, "maximum": 100000 },
+            "edges": { "type": "integer", "minimum": 0, "maximum": 250000 },
+            "unresolved": { "type": "integer", "minimum": 0, "maximum": 250000 },
+            "unresolvedDependencies": {
+              "type": "array",
+              "maxItems": 32,
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["from", "name", "spec", "kind"],
+                "properties": {
+                  "from": { "type": "string", "minLength": 1, "maxLength": 512 },
+                  "name": { "type": "string", "minLength": 1, "maxLength": 214 },
+                  "spec": { "type": "string", "minLength": 1, "maxLength": 512 },
+                  "kind": { "enum": ["runtime", "development", "optional", "peer", "host-runtime"] }
+                }
+              }
+            }
+          }
+        },
+        "runtimeGraph": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["digest", "nodes", "edges", "unresolved", "pluginPeerContracts"],
+          "properties": {
+            "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+            "nodes": { "type": "integer", "minimum": 0, "maximum": 100000 },
+            "edges": { "type": "integer", "minimum": 0, "maximum": 250000 },
+            "unresolved": { "type": "integer", "minimum": 0, "maximum": 250000 },
+            "unresolvedDependencies": {
+              "type": "array",
+              "maxItems": 32,
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["from", "name", "spec", "kind"],
+                "properties": {
+                  "from": { "type": "string", "minLength": 1, "maxLength": 512 },
+                  "name": { "type": "string", "minLength": 1, "maxLength": 214 },
+                  "spec": { "type": "string", "minLength": 1, "maxLength": 512 },
+                  "kind": { "enum": ["runtime", "development", "optional", "peer", "host-runtime"] }
+                }
+              }
+            },
+            "optionalUnavailable": { "type": "integer", "minimum": 0, "maximum": 250000 },
+            "optionalUnavailableDependencies": {
+              "type": "array",
+              "maxItems": 32,
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["from", "name", "spec", "kind"],
+                "properties": {
+                  "from": { "type": "string", "minLength": 1, "maxLength": 512 },
+                  "name": { "type": "string", "minLength": 1, "maxLength": 214 },
+                  "spec": { "type": "string", "minLength": 1, "maxLength": 512 },
+                  "kind": { "enum": ["runtime", "development", "optional", "peer", "host-runtime"] }
+                }
+              }
+            },
+            "pluginPeerContracts": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["declared", "satisfied", "mismatched", "indeterminate", "missing", "relations"],
+              "properties": {
+                "declared": { "type": "integer", "minimum": 0, "maximum": 100000 },
+                "satisfied": { "type": "integer", "minimum": 0, "maximum": 100000 },
+                "mismatched": { "type": "integer", "minimum": 0, "maximum": 100000 },
+                "indeterminate": { "type": "integer", "minimum": 0, "maximum": 100000 },
+                "missing": { "type": "integer", "minimum": 0, "maximum": 100000 },
+                "relations": {
+                  "type": "array",
+                  "maxItems": 64,
+                  "items": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["name", "required", "status", "staticUsage"],
+                    "properties": {
+                      "name": { "type": "string", "minLength": 1, "maxLength": 214 },
+                      "required": { "type": "string", "minLength": 1, "maxLength": 512 },
+                      "status": { "enum": ["satisfied", "mismatched", "indeterminate", "missing"] },
+                      "staticUsage": { "enum": ["runtime-import-observed", "type-only-reference-observed", "no-literal-reference-observed", "scan-incomplete"] },
+                      "resolvedVersion": { "type": "string", "minLength": 1, "maxLength": 256 }
+                    }
+                  }
+                },
+                "issues": {
+                  "type": "array",
+                  "maxItems": 32,
+                  "items": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["name", "required", "status", "staticUsage"],
+                    "properties": {
+                      "name": { "type": "string", "minLength": 1, "maxLength": 214 },
+                      "required": { "type": "string", "minLength": 1, "maxLength": 512 },
+                      "status": { "enum": ["mismatched", "indeterminate", "missing"] },
+                      "staticUsage": { "enum": ["runtime-import-observed", "type-only-reference-observed", "no-literal-reference-observed", "scan-incomplete"] },
+                      "resolvedVersion": { "type": "string", "minLength": 1, "maxLength": 256 }
+                    }
+                  }
+                }
+              }
+            },
+            "hostRuntime": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["source", "resolvedNodes"],
+              "properties": {
+                "source": { "enum": ["dsh-profile-fallback", "dsh-process"] },
+                "resolvedNodes": { "type": "integer", "minimum": 0, "maximum": 100000 },
+                "dshVersion": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[0-9A-Za-z.-]+)?$" }
+              }
+            }
+          }
+        },
+        "runtimeGraphError": { "type": "string", "minLength": 1, "maxLength": 512 }
+      }
+    },
     "stage": {
       "type": "object",
       "additionalProperties": false,