@growth-labs/conformance 0.3.1 → 0.5.0

package/src/schema.ts

@@ -33,6 +33,7 @@ export const REQUIRED_NEGATIVE_FIXTURE_CODES = {
 	'missing-max-image-preview-large': 'metadata.robots.missing_max_image_preview_large',
 	'crawler-public-cache-key-collision': 'cache.crawler_public_key_collision',
 	'runtime-canonical-override-not-applied': 'metadata.canonical.runtime_override_not_applied',
+	'llms-runtime-static-shadow': 'publication.surface.static_shadow',
 } as const
 
 export type RequiredNegativeFixtureId = keyof typeof REQUIRED_NEGATIVE_FIXTURE_CODES
@@ -62,6 +63,21 @@ export const surfaceResponseSchema = z.object({
 	body: z.string().optional(),
 })
 
+export const publicationSurfaceOwnerSchema = z.enum(['runtime', 'static', 'na'])
+
+export const publicationSurfaceOwnerReceiptSchema = z.object({
+	collector: z.string().regex(/^[a-z0-9][a-z0-9:._-]*@[0-9]+$/i, {
+		message: 'collector must be a versioned identifier such as tool-name@1',
+	}),
+	observedAt: z
+		.string()
+		.regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/, {
+			message: 'observedAt must be an ISO date-time with timezone, e.g. 2026-07-15T23:30:00Z',
+		})
+		.optional(),
+	signalHash: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+})
+
 export const publicationSurfaceSchema = z.object({
 	name: z.string().min(1),
 	status: z.enum(['present', 'missing', 'na']),
@@ -71,6 +87,12 @@ export const publicationSurfaceSchema = z.object({
 	bodyBytes: z.number().int().nonnegative().optional(),
 	capabilityBoundary: z.string().min(1).optional(),
 	evidence: z.string().min(1).optional(),
+	intendedOwner: publicationSurfaceOwnerSchema.optional(),
+	observedOwner: publicationSurfaceOwnerSchema.optional(),
+	ownerReceipt: publicationSurfaceOwnerReceiptSchema.optional(),
+	staticEntryCount: z.number().int().nonnegative().optional(),
+	observedCount: z.number().int().nonnegative().optional(),
+	minimumCount: z.number().int().nonnegative().optional(),
 })
 
 export const cacheVariantSchema = z.object({
@@ -85,7 +107,7 @@ export const cacheVariantSchema = z.object({
 export const securityFunctionalProbeReceiptSchema = z.object({
 	name: z.string().min(1),
 	status: checkStatusSchema,
-	checkedAt: z.string().min(1).optional(),
+	checkedAt: z.string().datetime({ offset: true }),
 	evidence: z.string().min(1).optional(),
 	capabilityBoundary: z.string().min(1).optional(),
 })
@@ -93,7 +115,7 @@ export const securityFunctionalProbeReceiptSchema = z.object({
 export const cspReportReceiptSchema = z.object({
 	name: z.string().min(1),
 	status: checkStatusSchema,
-	checkedAt: z.string().min(1).optional(),
+	checkedAt: z.string().datetime({ offset: true }),
 	evidence: z.string().min(1).optional(),
 	endpoint: z.string().min(1).optional(),
 	capabilityBoundary: z.string().min(1).optional(),
@@ -119,7 +141,7 @@ export const securityReceiptsSchema = z
 export const buildEvidenceSchema = z.object({
 	commitSha: z.string().min(7).optional(),
 	artifactId: z.string().min(1).optional(),
-	generatedAt: z.string().min(1).optional(),
+	generatedAt: z.string().datetime({ offset: true }).optional(),
 	packageVersions: z.record(z.string().min(1)).default({}),
 	staticHeaderPolicy: z.boolean().default(false),
 	ssrHeaderPolicy: z.boolean().default(false),
@@ -268,6 +290,8 @@ export type Audience = z.infer<typeof audienceSchema>
 export type RenderMode = z.infer<typeof renderModeSchema>
 export type HeaderMap = z.infer<typeof headerMapSchema>
 export type SurfaceResponse = z.infer<typeof surfaceResponseSchema>
+export type PublicationSurfaceOwner = z.infer<typeof publicationSurfaceOwnerSchema>
+export type PublicationSurfaceOwnerReceipt = z.infer<typeof publicationSurfaceOwnerReceiptSchema>
 export type PublicationSurfaceEvidence = z.infer<typeof publicationSurfaceSchema>
 export type CacheVariant = z.infer<typeof cacheVariantSchema>
 export type SecurityFunctionalProbeReceipt = z.infer<typeof securityFunctionalProbeReceiptSchema>