@plasius/schema 1.3.1 → 1.4.1

package/README.md

@@ -45,6 +45,46 @@ uses `dist-cjs/*.js` with `type: module`, it must generate
 `dist-cjs/package.json` with `{ "type": "commonjs" }` and validate this in
 `pack:check` before publish.
 
+### Private-artifact policy
+
+Signed contributor agreements and contributor acceptance records belong only
+in the approved access-controlled system outside source control. The
+zero-dependency repository gate inspects path metadata without opening,
+hashing, copying, or logging suspected private artifacts:
+
+```bash
+npm run privacy:check
+npm run test:privacy
+npm run build
+npm run pack:check
+```
+
+`privacy:check` checks both filesystem metadata and the proposed Git index. It
+rejects CSV files, contributor/CLA registry variants, contributor acceptance,
+signature, and submission record categories, signed CLA/contributor agreement
+storage, and paths that combine privacy and registry markers. Explicit public
+process, template, schema, validator, and policy files remain allowed only as
+terminal path components; matching private-record categories used as
+directories fail closed regardless of their descendants.
+Unicode compatibility normalization occurs before separator folding so
+hierarchical, case-variant, and compatibility-separated protected paths cannot
+evade the same path-only classification. An unstaged deletion remains a
+failure until the deletion is staged. Invalid Git worktree metadata, symbolic
+links, and non-regular entries fail closed, and failures report only rule IDs
+and counts.
+
+`pack:check` requires the exact `dist`, `THIRD_PARTY_NOTICES.md`, and `unicode`
+`package.json.files` entries, then retains prefix-stripped raw member identities
+and cardinality while comparing the canonical `npm pack --dry-run` manifest
+with the package's exact public allowlist. Duplicate members, raw aliases, and
+many-to-one normalization collisions fail without logging member values. The
+same zero-dependency inventory policy runs over the digest-verified sealed
+tarball immediately before publication. The isolated npm cache is removed
+whether the check passes or fails. CI runs the repository gate before
+dependency installation; release preparation and publication repeat the gate.
+These path controls are defense in depth and do not replace secret scanning,
+access controls, or incident response.
+
 ---
 
 ## Player-system event contracts
@@ -74,6 +114,7 @@ reporting:
 ```ts
 import {
   FeedbackBugPacketSchema,
+  FeedbackCommittedAcceptanceEvidenceSchema,
   FeedbackPublicSummarySchema,
   FeedbackRichTextAstSchema,
   FeedbackReviewPacketSchema,
@@ -152,6 +193,12 @@ build-time dependency `@unicode/unicode-15.1.0@1.6.17`; run
 [ADR-0007](./docs/adrs/adr-0007-pinned-unicode-feedback-profile.md) and
 [third-party notices](./THIRD_PARTY_NOTICES.md).
 
+The three typed feedback subpaths publish both modern `exports.types` entries
+and exact `typesVersions` fallbacks. This keeps their declarations resolvable
+for consumers that still compile CommonJS with classic TypeScript
+`moduleResolution: "node"`, without opening a wildcard route for unknown
+subpaths.
+
 Validated reusable fragments retain exact `type` and `version` metadata when
 embedded in parent contracts. This makes the output of the encrypted-envelope,
 derived-analysis, and game-diagnostics schemas directly composable into their
@@ -181,6 +228,21 @@ hours and review suppression at 30 days; acceptance receipts distinguish bugs
 from reviews and accept only the five-step bug ladder or exact 30-day review
 period.
 
+`FeedbackCommittedAcceptanceEvidenceSchema` is a separate, durable proof that
+the control-plane commit for one immutable packet completed. It contains only
+the canonical packet UUID, `bug`/`review` kind, and the packet's canonical
+server-owned UTC acceptance time. Canonical timestamp validation rejects
+impossible calendar or clock values as ordinary closed validation failures; it
+does not expose the rejected value or a native date exception. It cannot
+express a control-state key, reservation, idempotency value, reporter
+pseudonym, request metadata, Blob locator, content hash, narrative, ciphertext,
+or pixels, and its PII audit is empty. Only a trusted delivery worker may
+construct this evidence after an atomic control-plane commit; it is not an
+intake request. Report processors must select packets through this evidence
+rather than by enumerating packet storage, preventing an immutable Blob written
+before a failed commit from entering aggregates. See
+[ADR-0011](./docs/adrs/adr-0011-identifier-free-feedback-acceptance-evidence.md).
+
 All feedback contracts opt in to recursive unknown-field rejection, including
 direct references and arrays of references. Unshaped references admit only
 `type` and `id`; shaped references admit only those keys plus their declared
@@ -485,8 +547,9 @@ prerelease identity, artifact digests, or npm registry integrity differ.
 The read-only validation job installs dependencies, validates the package,
 builds an SBOM, and seals an immutable tarball. The `production` job runs no
 package lifecycle or dependency code; it verifies the exact artifact hand-off
-and publishes that tarball through npm OIDC with provenance. No npm write token
-or fallback is configured. The trusted publisher must be bound to
-`Plasius-LTD/schema`, `cd.yml`, `production`, and `npm publish`. Rollback is to
-disable `cd.yml`; never restore token-based publication.
+and rechecks the collision-free exact raw-member inventory before publishing
+that tarball through npm OIDC with provenance. No npm write token or fallback
+is configured. The trusted publisher must be bound to `Plasius-LTD/schema`,
+`cd.yml`, `production`, and `npm publish`. Rollback is to disable `cd.yml`;
+never restore token-based publication.
 <!-- END PLASIUS RELEASE INTEGRITY -->

package/dist/index.cjs

@@ -53,6 +53,7 @@ __export(index_exports, {
   FeedbackAnalysisReceiptSchema: () => FeedbackAnalysisReceiptSchema,
   FeedbackBugPacketSchema: () => FeedbackBugPacketSchema,
   FeedbackBugSubmissionRequestSchema: () => FeedbackBugSubmissionRequestSchema,
+  FeedbackCommittedAcceptanceEvidenceSchema: () => FeedbackCommittedAcceptanceEvidenceSchema,
   FeedbackContextSchema: () => FeedbackContextSchema,
   FeedbackDailySatisfactionReportSchema: () => FeedbackDailySatisfactionReportSchema,
   FeedbackDerivedAnalysisSchema: () => FeedbackDerivedAnalysisSchema,
@@ -3614,6 +3615,7 @@ var BASE64URL_ALPHABET2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0
 var BUG_HOUR_WINDOW_PATTERN = /^\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])T(?:[01]\d|2[0-3])$/;
 var REVIEW_DAY_WINDOW_PATTERN = /^\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$/;
 var RECONCILIATION_WINDOW_PATTERN = /^\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])T(?:[01]\d|2[0-3]):(?:[0-5]\d)$/;
+var CANONICAL_SERVER_UTC_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
 var strictOptions = {
   version: FEEDBACK_CONTRACT_VERSION,
   piiEnforcement: "strict",
@@ -3621,6 +3623,16 @@ var strictOptions = {
   identity: "exact"
 };
 var uuidField = () => field.string().validator((value) => OPAQUE_UUID_V4_PATTERN.test(value)).description("Opaque UUID generated for the feedback workflow");
+var isCanonicalServerUtc = (value) => {
+  if (typeof value !== "string" || !CANONICAL_SERVER_UTC_PATTERN.test(value)) {
+    return false;
+  }
+  const timestamp = Date.parse(value);
+  return Number.isFinite(timestamp) && new Date(timestamp).toISOString() === value;
+};
+var canonicalServerUtcField = () => field.dateTimeISO().validator(isCanonicalServerUtc).description(
+  "Canonical millisecond-precision UTC timestamp supplied by the trusted server"
+);
 var draftIdField = () => field.string().validator((value) => OPAQUE_UUID_V4_PATTERN.test(value)).description("Opaque identifier for one short-lived structured draft").PID({
   classification: "low",
   action: "none",
@@ -4284,6 +4296,15 @@ var FeedbackReviewPacketSchema = createSchema(
     schemaValidator: (value) => value.analysis === void 0 || isAnalysisProjectionConsistent(value.analysis)
   }
 );
+var FeedbackCommittedAcceptanceEvidenceSchema = createSchema(
+  {
+    packetId: uuidField(),
+    packetKind: field.string().enum(["bug", "review"]),
+    acceptedAt: canonicalServerUtcField()
+  },
+  "feedback-committed-acceptance-evidence",
+  strictOptions
+);
 var FeedbackGameReconstructionManifestSchema = createSchema(
   {
     reconstructionId: uuidField(),
@@ -4775,6 +4796,7 @@ var FeedbackMaterializationManifestSchema = createSchema(
   FeedbackAnalysisReceiptSchema,
   FeedbackBugPacketSchema,
   FeedbackBugSubmissionRequestSchema,
+  FeedbackCommittedAcceptanceEvidenceSchema,
   FeedbackContextSchema,
   FeedbackDailySatisfactionReportSchema,
   FeedbackDerivedAnalysisSchema,