@bounded-systems/conformance-kit 0.2.0

package/provenance.json

@@ -0,0 +1,41 @@
+{
+  "name": "@bounded-systems/conformance-kit",
+  "note": "Extraction provenance: which source repo + commit each tool in this kit was generalized from. The tools here are now the canonical, site-agnostic versions; site-specific values are injected by the consumer (see README). A consuming site vendors this kit hash-pinned via the `vendor.example.json` shape.",
+  "extractedFrom": [
+    {
+      "source": "https://github.com/bdelanghe/site",
+      "commit": "24213f7d2fb8069f1df6137789769912eddd3546",
+      "fetched": "2026-06-27",
+      "files": [
+        "gates/sbom/gen-sbom.mjs        ← scripts/gen-sbom.mjs",
+        "gates/sbom/check-sbom.mjs      ← scripts/check-sbom.mjs",
+        "gates/shacl-runner.mjs         ← scripts/shacl-gate.mjs",
+        "gates/seo-gate.mjs             ← scripts/seo-gate.mjs",
+        "gates/commonmark-runner.mjs    ← scripts/commonmark-gate.mjs",
+        "gates/readability-gate.mjs     ← scripts/readability-gate.mjs",
+        "gates/semantic/gate.ts         ← semantic/gate.ts",
+        "gates/semantic/deno.json       ← semantic/deno.json",
+        "generators/gen-cid.mjs         ← scripts/gen-cid.mjs",
+        "generators/gen-identity.mjs    ← scripts/gen-identity.mjs",
+        "generators/openapi.mjs         ← scripts/gen-api.mjs (generic core)",
+        "emitters/index.mjs             ← build.mjs (security.txt / web manifest / Repr-Digest / .md siblings)",
+        "lib/schema-validate.mjs        ← schema-validate.mjs",
+        "integrity/http-probe.mjs       ← vendor/integrity/http-probe.mjs"
+      ]
+    },
+    {
+      "source": "https://github.com/bounded-systems/site",
+      "commit": "c27e1af25110f1ec95eb5b4872e675253430abb6",
+      "path": "integrity/",
+      "fetched": "2026-06-27",
+      "files": [
+        "integrity/verify-site.mjs               ← integrity/verify-site.mjs",
+        "integrity/verify/verify.mjs             ← integrity/verify/verify.mjs",
+        "integrity/gen-sitemanifest.mjs          ← integrity/scripts/gen-sitemanifest.mjs",
+        "integrity/gen-provenance.mjs            ← integrity/scripts/gen-provenance.mjs",
+        "integrity/structure-audit/audit.mjs     ← integrity/structure-audit/audit.mjs",
+        "integrity/structure-audit/package.json  ← integrity/structure-audit/package.json"
+      ]
+    }
+  ]
+}

package/vendor.example.json

@@ -0,0 +1,25 @@
+{
+  "source": "https://github.com/bounded-systems/conformance-kit",
+  "ref": "REPLACE_WITH_PINNED_COMMIT_SHA",
+  "commit": "REPLACE_WITH_PINNED_COMMIT_SHA",
+  "fetched": "YYYY-MM-DD",
+  "note": "Vendored, hash-pinned copy of bounded-systems/conformance-kit. This is the shape a consuming site writes to vendor/conformance-kit/provenance.json (mirrors bdelanghe/site vendor/integrity/provenance.json). Re-vendor by copying the kit at the pinned commit; verify before use by re-hashing each file and comparing to these sha256 values. Generate the files map with, e.g.: `for f in $(git -C kit ls-files); do printf '\"%s\": \"sha256:%s\",\\n' \"$f\" $(sha256sum kit/$f | cut -d' ' -f1); done`",
+  "files": {
+    "integrity/verify-site.mjs": "sha256:<fill-in>",
+    "integrity/gen-sitemanifest.mjs": "sha256:<fill-in>",
+    "integrity/gen-provenance.mjs": "sha256:<fill-in>",
+    "integrity/http-probe.mjs": "sha256:<fill-in>",
+    "integrity/structure-audit/audit.mjs": "sha256:<fill-in>",
+    "gates/sbom/gen-sbom.mjs": "sha256:<fill-in>",
+    "gates/sbom/check-sbom.mjs": "sha256:<fill-in>",
+    "gates/shacl-runner.mjs": "sha256:<fill-in>",
+    "gates/seo-gate.mjs": "sha256:<fill-in>",
+    "gates/readability-gate.mjs": "sha256:<fill-in>",
+    "gates/commonmark-runner.mjs": "sha256:<fill-in>",
+    "generators/gen-cid.mjs": "sha256:<fill-in>",
+    "generators/gen-identity.mjs": "sha256:<fill-in>",
+    "generators/openapi.mjs": "sha256:<fill-in>",
+    "emitters/index.mjs": "sha256:<fill-in>",
+    "lib/schema-validate.mjs": "sha256:<fill-in>"
+  }
+}