Keep namespaced package changes distinct

[John-David Dalton (jdalton)]

LLM Description written by Codex:GPT-6

Keep distinct npm scopes and Maven groups in dependency-change reports.

Root Cause

Package lists deduplicated by ecosystem, name, and version, dropping the namespace. For example, @one/widget@1.0.0 and @two/widget@1.0.0 collapsed into one row.

Fix

• Include the existing namespace in each package identity.
• Preserve server order, direct-dependency filtering, and first-occurrence handling for true duplicates.
• Keep the four change categories separate.

Builds on #403. No output schema or release changes.

Validation

55 focused and related identity/URL tests pass with the real CLI core and SDK against a local HTTP fixture. Scoped Ruff lint, test formatting, and diff checks pass. Independent source review found no blockers. Core retains pre-existing whole-file formatting differences.

Public Changelog

Preserve distinct package scopes and groups in dependency-change reports.

---

Note

Medium Risk
Changes how package rows are deduplicated in diff/JSON reports; behavior is narrower in scope but affects what CI and reviewers see for dependency changes.

Overview
Dependency-change deduplication now includes namespace, so scoped npm packages and Maven groups with the same name/version no longer merge into a single row in JSON and other diff outputs.

create_diff_report replaces the old ecosystem/name@version string key with a (ecosystem, namespace, name, version) identity (treating missing and empty namespace the same). First occurrence still wins for true duplicates within a bucket; added/updated/removed/replaced lists stay separate, and direct-only filtering is unchanged.

New transport tests cover diff-scan and streaming fallback paths, PURLs/URLs per scope, and cross-bucket behavior.

^{Reviewed by Cursor Bugbot for commit 60183b1. Configure here.}