@kungfu-tech/buildchain 2.3.1-alpha.0 → 2.3.1-alpha.1

package/packages/core/release-passport.js

@@ -183,6 +183,26 @@ function parseJsonInput(value, fallback = undefined) {
   return JSON.parse(input);
 }
 
+function parseJsonInputWithMeta(value, fallback = undefined) {
+  const input = String(value || "").trim();
+  if (!input) {
+    return { value: fallback, path: "", sha256: "" };
+  }
+  if (fs.existsSync(input)) {
+    return {
+      value: readJsonFile(input),
+      path: input,
+      sha256: sha256File(input),
+    };
+  }
+  const parsed = JSON.parse(input);
+  return {
+    value: parsed,
+    path: "",
+    sha256: sha256Text(stableJson(parsed)),
+  };
+}
+
 function discoverAssetsFromDir(dir) {
   if (!dir || !fs.existsSync(dir)) {
     return [];
@@ -214,6 +234,214 @@ function readPackageVersion(cwd) {
   }
 }
 
+function normalizePackageEntry(entry = {}) {
+  return {
+    name: optionalString(entry.name),
+    version: optionalString(entry.version || entry.ref),
+    distTag: optionalString(entry.distTag || entry.dist_tag),
+    digest: optionalString(entry.digest || entry.integrity || entry.sha256 || entry.shasum),
+    registry: optionalString(entry.registry),
+    platform: optionalString(entry.platform),
+    action: optionalString(entry.action),
+  };
+}
+
+function normalizePackageSet(value = undefined, { packageName = "", packageVersion = "", publish = {} } = {}) {
+  if (!value) {
+    return undefined;
+  }
+  const rawMain = value.main || value.mainPackage || {
+    name: value.main_package || packageName,
+    version: value.version || packageVersion,
+    distTag: value.distTag || value.dist_tag || publish.distTag,
+  };
+  const platforms = Array.isArray(value.platforms)
+    ? value.platforms.map((entry) => normalizePackageEntry(entry)).filter((entry) => entry.name || entry.version)
+    : [];
+  return {
+    order: optionalString(value.order || value.packageSetOrder || value.package_set_order || publish.packageSetOrder),
+    registry: optionalString(value.registry || publish.registry),
+    main: normalizePackageEntry(rawMain),
+    platforms,
+  };
+}
+
+function normalizeAnchorManifest(meta) {
+  const value = meta?.value;
+  if (!value) {
+    return undefined;
+  }
+  return {
+    path: optionalString(value.path || meta.path),
+    sha256: optionalString(value.sha256 || meta.sha256),
+    fields: value.fields && typeof value.fields === "object" && !Array.isArray(value.fields)
+      ? value.fields
+      : value,
+  };
+}
+
+function normalizeEvidenceDocument(meta, label) {
+  const value = meta?.value;
+  if (!value) {
+    return undefined;
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be a JSON object`);
+  }
+  return {
+    path: optionalString(meta.path),
+    sha256: optionalString(meta.sha256),
+    fields: value,
+  };
+}
+
+function normalizePlatformArtifactManifest(meta, index = 0) {
+  const normalized = normalizeEvidenceDocument(meta, `platformArtifactManifests[${index}]`);
+  if (!normalized) {
+    return undefined;
+  }
+  const fields = normalized.fields || {};
+  return {
+    ...normalized,
+    platform: optionalString(fields.platform?.id || fields.platformId || fields.platform || ""),
+    artifactName: optionalString(fields.artifactName || fields.links?.artifactName || ""),
+  };
+}
+
+function normalizePublishArtifact(artifact = {}, index = 0) {
+  const name = nonEmptyString(artifact.name, `publishEvidence.artifacts[${index}].name`);
+  return {
+    group: optionalString(artifact.group),
+    kind: optionalString(artifact.kind),
+    name,
+    ref: optionalString(artifact.ref || artifact.version),
+    digest: optionalString(artifact.digest || artifact.sha256 || artifact.integrity || artifact.shasum),
+    evidence: optionalString(artifact.evidence),
+  };
+}
+
+function normalizePublishEvidence(value = undefined) {
+  if (!value) {
+    return undefined;
+  }
+  return {
+    schema: Number(value.schema || value.schemaVersion || 1),
+    version: optionalString(value.version),
+    channel: optionalString(value.channel),
+    sourceSha: optionalString(value.source_sha || value.sourceSha),
+    releaseSha: optionalString(value.release_sha || value.releaseSha),
+    targetRef: optionalString(value.target_ref || value.targetRef),
+    releaseMaterialSha: optionalString(value.release_material_sha || value.releaseMaterialSha),
+    publishToolingSha: optionalString(value.publish_tooling_sha || value.publishToolingSha),
+    artifacts: Array.isArray(value.artifacts)
+      ? value.artifacts.map((artifact, index) => normalizePublishArtifact(artifact, index))
+      : [],
+  };
+}
+
+function packageSetEntries(packageSet = undefined) {
+  if (!packageSet) {
+    return [];
+  }
+  return [
+    ...(packageSet.main?.name ? [{ role: "main", ...packageSet.main }] : []),
+    ...((packageSet.platforms || []).map((entry) => ({ role: "platform", ...entry }))),
+  ];
+}
+
+function normalizePublishSummary({ packageSet = undefined, publishEvidence = undefined, publish = {} } = {}) {
+  const packages = packageSetEntries(packageSet);
+  if (packages.length === 0) {
+    return undefined;
+  }
+  const artifacts = publishEvidence?.artifacts || [];
+  const artifactByPackage = new Map(artifacts.map((artifact) => [
+    [artifact.name, artifact.ref || artifact.version || ""].join("\0"),
+    artifact,
+  ]));
+  const normalizedPackages = packages.map((entry) => {
+    const artifact = artifactByPackage.get([entry.name, entry.version].join("\0")) || {};
+    return {
+      role: entry.role,
+      name: entry.name,
+      publishedVersion: entry.version,
+      distTag: entry.distTag,
+      digest: entry.digest || artifact.digest || "",
+      registry: entry.registry || packageSet.registry || publish.registry || "",
+      platform: entry.platform || "",
+      action: entry.action || artifact.action || "",
+    };
+  });
+  const distTags = [...new Set(normalizedPackages.map((entry) => entry.distTag).filter(Boolean))];
+  return {
+    registry: optionalString(packageSet.registry || publish.registry),
+    channel: optionalString(publishEvidence?.channel || publish.channel),
+    distTag: distTags.length === 1 ? distTags[0] : "",
+    source: "packageSet+publishEvidence",
+    packages: normalizedPackages,
+  };
+}
+
+function normalizeTrustedPublishing(value = undefined, { workflow = {}, publish = {} } = {}) {
+  if (!value && publish.auth !== "trusted-publishing") {
+    return undefined;
+  }
+  const raw = value || {};
+  return {
+    provider: optionalString(raw.provider || "npm"),
+    enabled: raw.enabled === undefined ? publish.auth === "trusted-publishing" : Boolean(raw.enabled),
+    auth: optionalString(raw.auth || publish.auth),
+    workflowRunId: optionalString(raw.workflowRunId || raw.workflow_run_id || workflow.runId),
+    workflowRunAttempt: optionalString(raw.workflowRunAttempt || raw.workflow_run_attempt || workflow.runAttempt),
+    evidence: optionalString(raw.evidence),
+  };
+}
+
+function normalizeTransactionResult(value = {}) {
+  const result = {};
+  if (value.command) {
+    result.command = optionalString(value.command);
+  }
+  if (value.validation && typeof value.validation === "object" && !Array.isArray(value.validation)) {
+    result.validation = {
+      valid: Boolean(value.validation.valid),
+      errors: Array.isArray(value.validation.errors) ? value.validation.errors : [],
+    };
+  }
+  if (value.recovery && typeof value.recovery === "object" && !Array.isArray(value.recovery)) {
+    result.recovery = value.recovery;
+  }
+  if (value.publishAction || value.distTag) {
+    result.publish = {
+      action: optionalString(value.publishAction),
+      distTag: optionalString(value.distTag),
+    };
+  }
+  return Object.keys(result).length > 0 ? result : undefined;
+}
+
+function normalizeTransaction(value = undefined) {
+  if (!value) {
+    return undefined;
+  }
+  const raw = value.transaction && typeof value.transaction === "object" ? value.transaction : value;
+  return {
+    id: optionalString(raw.id || value.id),
+    version: optionalString(raw.version || value.version),
+    state: optionalString(raw.state || value.state),
+    previousState: optionalString(raw.previous_state || raw.previousState),
+    exactTag: optionalString(raw.exact_tag || raw.exactTag || value.exactTag),
+    releaseSha: optionalString(raw.release_sha || raw.releaseSha || value.releaseSha),
+    releaseMaterialSha: optionalString(raw.release_material_sha || raw.releaseMaterialSha || value.releaseMaterialSha),
+    stateRef: optionalString(raw.state_ref || raw.stateRef || value.stateRef),
+    statePath: optionalString(raw.state_path || raw.statePath || value.statePath),
+    stateSha: optionalString(value.stateSha || value.state_sha || value.durable?.sha),
+    evidencePath: optionalString(raw.evidence_path || raw.evidencePath || value.evidencePath),
+    updatedAt: optionalString(raw.updated_at || raw.updatedAt),
+    result: normalizeTransactionResult(value),
+  };
+}
+
 export function createArtifactEvidence({ assets = [], repository = "", tag = "", sourceSha = "", workflow = {} } = {}) {
   const normalizedAssets = assets.map((asset, index) => normalizeAsset(asset, index));
   return {
@@ -254,6 +482,7 @@ export function createReleasePassport({
   tag = "",
   sourceSha = "",
   line = "",
+  productName = "Buildchain",
   packageName = "@kungfu-tech/buildchain",
   packageVersion = "",
   productMechanismPath = "product-mechanism.json",
@@ -261,17 +490,59 @@ export function createReleasePassport({
   impactPath = "impact.json",
   agentIndexPath = "agent-index.json",
   checkReportPath = "check-report.json",
+  publishEvidencePath = "",
+  transactionStatePath = "",
   assets = [],
+  packageSet = undefined,
+  anchorManifest = undefined,
+  publishEvidence = undefined,
+  trustedPublishing = undefined,
+  transaction = undefined,
+  buildSummary = undefined,
+  platformArtifactManifests = [],
+  distTagPromotionEvidence = undefined,
+  release = {},
+  publish = {},
   workflow = {},
 } = {}) {
   const normalizedTag = nonEmptyString(tag, "tag");
   const artifactEvidence = createArtifactEvidence({ assets, repository, tag: normalizedTag, sourceSha, workflow });
+  const normalizedPublishEvidence = normalizePublishEvidence(publishEvidence);
+  const normalizedPackageSet = normalizePackageSet(packageSet, { packageName, packageVersion, publish });
+  const normalizedTrustedPublishing = normalizeTrustedPublishing(trustedPublishing, { workflow, publish });
+  const normalizedTransaction = normalizeTransaction(transaction);
+  const normalizedBuildSummary = buildSummary ? normalizeEvidenceDocument(buildSummary, "buildSummary") : undefined;
+  const normalizedPlatformArtifactManifests = (platformArtifactManifests || [])
+    .map((manifest, index) => normalizePlatformArtifactManifest(manifest, index))
+    .filter(Boolean);
+  const normalizedDistTagPromotionEvidence = distTagPromotionEvidence
+    ? normalizeEvidenceDocument(distTagPromotionEvidence, "distTagPromotionEvidence")
+    : undefined;
+  const publishArtifacts = normalizedPublishEvidence?.artifacts || [];
+  const normalizedPublishSummary = normalizePublishSummary({
+    packageSet: normalizedPackageSet,
+    publishEvidence: normalizedPublishEvidence,
+    publish,
+  });
+  const releaseMaterialSha = optionalString(
+    release.releaseMaterialSha ||
+    release.release_material_sha ||
+    normalizedPublishEvidence?.releaseMaterialSha ||
+    normalizedTransaction?.releaseMaterialSha,
+  );
+  const releaseSha = optionalString(
+    release.releaseSha ||
+    release.release_sha ||
+    normalizedPublishEvidence?.releaseSha ||
+    normalizedTransaction?.releaseSha,
+  );
+  const targetRef = optionalString(release.targetRef || release.target_ref || normalizedPublishEvidence?.targetRef);
   return {
     schemaVersion: 1,
     contract: RELEASE_PASSPORT_CONTRACT,
     generatedAt: nowIso(),
     product: {
-      name: "Buildchain",
+      name: optionalString(productName || "Buildchain"),
       repository: optionalString(repository),
       mechanism: productMechanismPath,
     },
@@ -279,6 +550,22 @@ export function createReleasePassport({
       tag: normalizedTag,
       line: optionalString(line),
       sourceSha: optionalString(sourceSha),
+      channel: optionalString(release.channel || normalizedPublishEvidence?.channel || publish.channel),
+      targetRef,
+      releaseSha,
+      releaseMaterialSha,
+      publishToolingSha: optionalString(
+        release.publishToolingSha ||
+        release.publish_tooling_sha ||
+        normalizedPublishEvidence?.publishToolingSha,
+      ),
+      releaseStateRef: optionalString(
+        release.releaseStateRef ||
+        release.release_state_ref ||
+        normalizedTransaction?.stateRef ||
+        (normalizedTag ? `refs/heads/buildchain/release-state/${normalizedTag.replace(/^v/, "").replace(/[^0-9A-Za-z]+/g, "-")}` : ""),
+      ),
+      releaseStateSha: optionalString(release.releaseStateSha || release.release_state_sha || normalizedTransaction?.stateSha),
       package: {
         name: packageName,
         version: packageVersion || readPackageVersion(cwd),
@@ -296,15 +583,47 @@ export function createReleasePassport({
       compatibilityFixture: "self-hosted",
       note: "Runner facts are recorded in artifact evidence; the protocol does not require self-hosted runners.",
     },
-    artifacts: artifactEvidence.artifacts.map((asset) => ({
-      name: asset.name,
-      platform: asset.platform,
-      sha256: asset.sha256,
-      evidence: artifactEvidencePath,
-      url: asset.url,
-    })),
+    ...(normalizedPackageSet ? { packageSet: normalizedPackageSet } : {}),
+    ...(normalizedPublishSummary ? { publish: normalizedPublishSummary } : {}),
+    ...(anchorManifest ? { anchorManifest } : {}),
+    ...(normalizedTrustedPublishing ? { trustedPublishing: normalizedTrustedPublishing } : {}),
+    ...(normalizedTransaction ? { transaction: normalizedTransaction } : {}),
+    ...(normalizedBuildSummary ? { buildSummary: normalizedBuildSummary } : {}),
+    ...(normalizedPlatformArtifactManifests.length > 0 ? { platformArtifactManifests: normalizedPlatformArtifactManifests } : {}),
+    ...(normalizedDistTagPromotionEvidence ? { distTagPromotion: normalizedDistTagPromotionEvidence } : {}),
+    artifacts: [
+      ...artifactEvidence.artifacts.map((asset) => ({
+        group: "release",
+        kind: asset.kind || "release-asset",
+        name: asset.name,
+        platform: asset.platform,
+        ref: normalizedTag,
+        sha256: asset.sha256,
+        digest: asset.sha256 ? `sha256:${asset.sha256}` : "",
+        evidence: artifactEvidencePath,
+        url: asset.url,
+      })),
+      ...publishArtifacts.map((artifact) => ({
+        group: artifact.group,
+        kind: artifact.kind,
+        name: artifact.name,
+        ref: artifact.ref,
+        digest: artifact.digest,
+        evidence: publishEvidencePath || artifact.evidence || artifactEvidencePath,
+      })),
+    ],
     evidence: {
       artifactEvidence: artifactEvidencePath,
+      publishEvidence: publishEvidencePath,
+      transactionState: transactionStatePath,
+      buildSummary: normalizedBuildSummary?.path || "",
+      platformArtifactManifests: normalizedPlatformArtifactManifests.map((manifest) => ({
+        path: manifest.path,
+        sha256: manifest.sha256,
+        platform: manifest.platform,
+        artifactName: manifest.artifactName,
+      })),
+      distTagPromotionEvidence: normalizedDistTagPromotionEvidence?.path || "",
       impact: impactPath,
       checkReport: checkReportPath,
       agentIndex: agentIndexPath,
@@ -329,10 +648,32 @@ export function collectGitHubReleasePassport({
   productName = "Buildchain",
   packageName = "@kungfu-tech/buildchain",
   packageVersion = "",
+  packageSetJson = "",
+  publishEvidenceJson = "",
+  trustedPublishingJson = "",
+  transactionJson = "",
+  anchorManifestJson = "",
+  buildSummaryJson = "",
+  platformManifestJsons = [],
+  distTagEvidenceJson = "",
+  releaseJsonExtra = "",
+  publishJson = "",
   workflow = {},
 } = {}) {
   const release = parseJsonInput(releaseJson, {});
+  const releaseExtra = parseJsonInput(releaseJsonExtra, {});
   const assetsFromJson = parseJsonInput(assetsJson, []);
+  const packageSet = parseJsonInput(packageSetJson, undefined);
+  const publishEvidenceMeta = parseJsonInputWithMeta(publishEvidenceJson, undefined);
+  const trustedPublishing = parseJsonInput(trustedPublishingJson, undefined);
+  const transactionMeta = parseJsonInputWithMeta(transactionJson, undefined);
+  const anchorManifest = normalizeAnchorManifest(parseJsonInputWithMeta(anchorManifestJson, undefined));
+  const buildSummaryMeta = parseJsonInputWithMeta(buildSummaryJson, undefined);
+  const platformManifestMetas = (platformManifestJsons || [])
+    .filter(Boolean)
+    .map((manifestJson) => parseJsonInputWithMeta(manifestJson, undefined));
+  const distTagEvidenceMeta = parseJsonInputWithMeta(distTagEvidenceJson, undefined);
+  const publish = parseJsonInput(publishJson, {});
   const assets = [
     ...(Array.isArray(release.assets) ? release.assets : []),
     ...(Array.isArray(assetsFromJson) ? assetsFromJson : []),
@@ -350,14 +691,43 @@ export function collectGitHubReleasePassport({
     tag: resolvedTag,
     sourceSha,
     line,
+    productName,
     packageName,
     packageVersion,
     assets,
+    packageSet,
+    anchorManifest,
+    publishEvidence: publishEvidenceMeta.value,
+    trustedPublishing,
+    transaction: transactionMeta.value,
+    buildSummary: buildSummaryMeta.value
+      ? {
+          ...buildSummaryMeta,
+          path: buildSummaryMeta.path ? path.relative(resolvedOutputDir, buildSummaryMeta.path).split(path.sep).join("/") : "",
+        }
+      : undefined,
+    platformArtifactManifests: platformManifestMetas
+      .filter((meta) => meta.value)
+      .map((meta) => ({
+        ...meta,
+        path: meta.path ? path.relative(resolvedOutputDir, meta.path).split(path.sep).join("/") : "",
+      })),
+    distTagPromotionEvidence: distTagEvidenceMeta.value
+      ? {
+          ...distTagEvidenceMeta,
+          path: distTagEvidenceMeta.path ? path.relative(resolvedOutputDir, distTagEvidenceMeta.path).split(path.sep).join("/") : "",
+        }
+      : undefined,
+    release: releaseExtra,
+    publish,
+    publishEvidencePath: publishEvidenceMeta.path ? path.relative(resolvedOutputDir, publishEvidenceMeta.path).split(path.sep).join("/") : "",
+    transactionStatePath: transactionMeta.path ? path.relative(resolvedOutputDir, transactionMeta.path).split(path.sep).join("/") : "",
     workflow,
   });
   const checkReport = createReleaseCheckReport({
     passport,
     artifactEvidence,
+    publishEvidence: publishEvidenceMeta.value,
     impact,
     agentIndex,
     productMechanism,
@@ -414,9 +784,73 @@ function resolveSiblingJson(basePath, relativePath) {
   return readJsonFile(candidate);
 }
 
+function artifactDigestValue(artifact = {}) {
+  return optionalString(artifact.digest || artifact.sha256 || artifact.integrity || artifact.shasum);
+}
+
+function equivalentDigest(left, right) {
+  if (!left || !right) {
+    return false;
+  }
+  return left === right || left === `sha256:${right}` || `sha256:${left}` === right;
+}
+
+function artifactEvidenceKeys(artifact = {}) {
+  const name = optionalString(artifact.name);
+  if (!name) {
+    return [];
+  }
+  const group = optionalString(artifact.group);
+  const kind = optionalString(artifact.kind);
+  const ref = optionalString(artifact.ref || artifact.version);
+  const keys = [];
+  if (group || kind || ref) {
+    keys.push(["structured", group, kind, name, ref].join("\0"));
+  }
+  if (kind || ref) {
+    keys.push(["structured", "", kind, name, ref].join("\0"));
+  }
+  if (kind) {
+    keys.push(["structured", "", kind, name, ""].join("\0"));
+  }
+  keys.push(["name", name].join("\0"));
+  return keys;
+}
+
+function indexEvidenceArtifacts(artifacts = []) {
+  const index = new Map();
+  for (const artifact of artifacts) {
+    for (const key of artifactEvidenceKeys(artifact)) {
+      const entries = index.get(key) || [];
+      entries.push(artifact);
+      index.set(key, entries);
+    }
+  }
+  return index;
+}
+
+function findEvidenceForArtifact(artifact, evidenceIndex) {
+  const artifactDigest = artifactDigestValue(artifact);
+  for (const key of artifactEvidenceKeys(artifact)) {
+    const entries = evidenceIndex.get(key) || [];
+    if (entries.length === 0) {
+      continue;
+    }
+    const matchingDigest = entries.find((entry) => equivalentDigest(artifactDigest, artifactDigestValue(entry)));
+    if (matchingDigest) {
+      return matchingDigest;
+    }
+    if (!key.startsWith("name\0") || entries.length === 1) {
+      return entries[0];
+    }
+  }
+  return undefined;
+}
+
 export function createReleaseCheckReport({
   passport,
   artifactEvidence,
+  publishEvidence,
   impact,
   agentIndex,
   productMechanism,
@@ -437,27 +871,146 @@ export function createReleaseCheckReport({
     issues.push(issue("warning", "release.sourceSha", "release.sourceSha is recommended"));
   }
   const artifacts = Array.isArray(passport?.artifacts) ? passport.artifacts : [];
-  const evidenceArtifacts = Array.isArray(artifactEvidence?.artifacts) ? artifactEvidence.artifacts : [];
+  const normalizedPublishEvidence = normalizePublishEvidence(publishEvidence);
+  const publishEvidenceSupplied =
+    Boolean(passport?.evidence?.publishEvidence) ||
+    (publishEvidence && typeof publishEvidence === "object" && Object.keys(publishEvidence).length > 0);
+  const evidenceArtifacts = [
+    ...(Array.isArray(artifactEvidence?.artifacts) ? artifactEvidence.artifacts : []),
+    ...(normalizedPublishEvidence?.artifacts || []),
+  ];
+  if (publishEvidenceSupplied || passport?.packageSet) {
+    const checkPublishField = (value, label) => {
+      if (!value) {
+        issues.push(issue("error", `publishEvidence.${label}`, `publishEvidence.${label} is required`));
+      }
+    };
+    if (Number(normalizedPublishEvidence?.schema) !== 1) {
+      issues.push(issue("error", "publishEvidence.schema", "publishEvidence.schema must be 1"));
+    }
+    checkPublishField(normalizedPublishEvidence?.version, "version");
+    checkPublishField(normalizedPublishEvidence?.channel, "channel");
+    checkPublishField(normalizedPublishEvidence?.sourceSha, "sourceSha");
+    checkPublishField(normalizedPublishEvidence?.releaseSha, "releaseSha");
+    checkPublishField(normalizedPublishEvidence?.targetRef, "targetRef");
+    checkPublishField(normalizedPublishEvidence?.releaseMaterialSha, "releaseMaterialSha");
+    checkPublishField(normalizedPublishEvidence?.publishToolingSha, "publishToolingSha");
+    if (!Array.isArray(normalizedPublishEvidence?.artifacts) || normalizedPublishEvidence.artifacts.length === 0) {
+      issues.push(issue("error", "publishEvidence.artifacts", "publishEvidence.artifacts must include published artifacts"));
+    }
+    if (passport?.release?.sourceSha && normalizedPublishEvidence?.sourceSha && passport.release.sourceSha !== normalizedPublishEvidence.sourceSha) {
+      issues.push(issue("error", "publishEvidence.sourceSha.mismatch", "publishEvidence.sourceSha must match passport.release.sourceSha"));
+    }
+    if (passport?.release?.releaseSha && normalizedPublishEvidence?.releaseSha && passport.release.releaseSha !== normalizedPublishEvidence.releaseSha) {
+      issues.push(issue("error", "publishEvidence.releaseSha.mismatch", "publishEvidence.releaseSha must match passport.release.releaseSha"));
+    }
+    if (passport?.release?.targetRef && normalizedPublishEvidence?.targetRef && passport.release.targetRef !== normalizedPublishEvidence.targetRef) {
+      issues.push(issue("error", "publishEvidence.targetRef.mismatch", "publishEvidence.targetRef must match passport.release.targetRef"));
+    }
+  }
   if (artifacts.length === 0) {
     issues.push(issue("error", "artifacts.empty", "release passport must list at least one artifact"));
   }
-  const evidenceByName = new Map(evidenceArtifacts.map((artifact) => [artifact.name, artifact]));
+  const evidenceIndex = indexEvidenceArtifacts(evidenceArtifacts);
   for (const artifact of artifacts) {
     if (!artifact.name) {
       issues.push(issue("error", "artifact.name", "artifact name is required"));
       continue;
     }
-    const evidence = evidenceByName.get(artifact.name);
+    const evidence = findEvidenceForArtifact(artifact, evidenceIndex);
     if (!evidence) {
       issues.push(issue("error", "artifact.evidence.missing", `artifact ${artifact.name} is missing evidence`));
       continue;
     }
-    if (!/^[0-9a-f]{64}$/i.test(String(evidence.sha256 || ""))) {
-      issues.push(issue("error", "artifact.sha256", `artifact ${artifact.name} must have a sha256 digest`));
+    const evidenceDigest = artifactDigestValue(evidence);
+    if (!evidenceDigest) {
+      issues.push(issue("error", "artifact.digest", `artifact ${artifact.name} must have a digest`));
     }
     if (artifact.sha256 && evidence.sha256 && artifact.sha256 !== evidence.sha256) {
       issues.push(issue("error", "artifact.sha256.mismatch", `artifact ${artifact.name} digest differs between passport and evidence`));
     }
+    if (artifact.digest && evidenceDigest && artifact.digest !== evidenceDigest && artifact.digest !== `sha256:${evidenceDigest}`) {
+      issues.push(issue("error", "artifact.digest.mismatch", `artifact ${artifact.name} digest differs between passport and evidence`));
+    }
+  }
+  if (passport?.packageSet) {
+    const main = passport.packageSet.main || {};
+    const checkPackageEntry = (entry, label, role) => {
+      if (!entry.name || !entry.version) {
+        issues.push(issue("error", `${label}.identity`, `${label} must include name and version`));
+      }
+      if (!entry.distTag) {
+        issues.push(issue("error", `${label}.distTag`, `${label} must include distTag`));
+      }
+      if (!entry.digest) {
+        issues.push(issue("error", `${label}.digest`, `${label} must include digest`));
+      }
+      if (entry.name && entry.version) {
+        const artifact = findEvidenceForArtifact({
+          group: "node",
+          kind: "npm",
+          name: entry.name,
+          ref: entry.version,
+          digest: entry.digest,
+        }, evidenceIndex);
+        if (!artifact) {
+          issues.push(issue("error", `${label}.artifact`, `${label} must have matching npm artifact evidence`, {
+            role,
+            name: entry.name,
+            version: entry.version,
+          }));
+        }
+      }
+    };
+    checkPackageEntry(main, "packageSet.main", "main");
+    const platforms = Array.isArray(passport.packageSet.platforms) ? passport.packageSet.platforms : [];
+    if (platforms.length < 3) {
+      issues.push(issue("error", "packageSet.platforms", "packageSet must include at least three platform packages"));
+    }
+    for (const [index, entry] of platforms.entries()) {
+      checkPackageEntry(entry, `packageSet.platforms[${index}]`, "platform");
+    }
+    if (!Array.isArray(passport?.publish?.packages) || passport.publish.packages.length !== 1 + platforms.length) {
+      issues.push(issue("error", "publish.packages", "publish.packages must summarize main and platform packages"));
+    }
+  }
+  if (passport?.trustedPublishing) {
+    if (!passport.trustedPublishing.provider) {
+      issues.push(issue("error", "trustedPublishing.provider", "trustedPublishing.provider is required"));
+    }
+    if (passport.trustedPublishing.auth !== "trusted-publishing") {
+      issues.push(issue("error", "trustedPublishing.auth", "trustedPublishing.auth must be trusted-publishing"));
+    }
+    if (passport.trustedPublishing.enabled !== true) {
+      issues.push(issue("error", "trustedPublishing.enabled", "trusted publishing evidence must be enabled"));
+    }
+  }
+  if (passport?.transaction) {
+    if (!passport.transaction.state) {
+      issues.push(issue("error", "transaction.state", "transaction.state is required"));
+    } else if (passport.transaction.state !== "complete") {
+      issues.push(issue("error", "transaction.state", "release passport transaction state must be complete"));
+    }
+    if (!passport.transaction.exactTag) {
+      issues.push(issue("error", "transaction.exactTag", "transaction.exactTag is required"));
+    }
+    if (!passport.transaction.releaseSha) {
+      issues.push(issue("error", "transaction.releaseSha", "transaction.releaseSha is required"));
+    }
+    if (!passport.transaction.releaseMaterialSha) {
+      issues.push(issue("error", "transaction.releaseMaterialSha", "transaction.releaseMaterialSha is required"));
+    }
+    if (!passport.transaction.stateRef) {
+      issues.push(issue("error", "transaction.stateRef", "transaction.stateRef is required"));
+    }
+  }
+  if (passport?.anchorManifest) {
+    if (!passport.anchorManifest.sha256) {
+      issues.push(issue("error", "anchorManifest.sha256", "anchorManifest.sha256 is required"));
+    }
+    if (!passport.anchorManifest.fields || typeof passport.anchorManifest.fields !== "object" || Array.isArray(passport.anchorManifest.fields)) {
+      issues.push(issue("error", "anchorManifest.fields", "anchorManifest.fields must be an object"));
+    }
   }
   if (!passport?.runnerPolicy?.productionDefault) {
     issues.push(issue("warning", "runnerPolicy.productionDefault", "runner policy should record the production default"));
@@ -472,6 +1025,15 @@ export function createReleaseCheckReport({
     completeness: {
       artifactCount: artifacts.length,
       evidenceArtifactCount: evidenceArtifacts.length,
+      packageSetPresent: Boolean(passport?.packageSet),
+      trustedPublishingPresent: Boolean(passport?.trustedPublishing),
+      transactionPresent: Boolean(passport?.transaction),
+      anchorManifestPresent: Boolean(passport?.anchorManifest),
+      buildSummaryPresent: Boolean(passport?.buildSummary),
+      platformArtifactManifestCount: Array.isArray(passport?.platformArtifactManifests)
+        ? passport.platformArtifactManifests.length
+        : 0,
+      distTagPromotionEvidencePresent: Boolean(passport?.distTagPromotion),
       impactPresent: Boolean(impact),
       agentIndexPresent: Boolean(agentIndex),
       productMechanismPresent: Boolean(productMechanism),
@@ -514,6 +1076,7 @@ export async function readJsonFromLocation(location) {
 export async function verifyReleasePassport({
   passportLocation,
   artifactEvidenceLocation = "",
+  publishEvidenceLocation = "",
   impactLocation = "",
   agentIndexLocation = "",
   productMechanismLocation = "",
@@ -524,6 +1087,10 @@ export async function verifyReleasePassport({
     artifactEvidenceLocation
       ? await readJsonFromLocation(artifactEvidenceLocation)
       : resolveSiblingJson(basePath, passport.evidence?.artifactEvidence) || {};
+  const publishEvidence =
+    publishEvidenceLocation
+      ? await readJsonFromLocation(publishEvidenceLocation)
+      : resolveSiblingJson(basePath, passport.evidence?.publishEvidence) || {};
   const impact =
     impactLocation
       ? await readJsonFromLocation(impactLocation)
@@ -539,6 +1106,7 @@ export async function verifyReleasePassport({
   return createReleaseCheckReport({
     passport,
     artifactEvidence,
+    publishEvidence,
     impact,
     agentIndex,
     productMechanism,