@qijenchen/design-system 0.1.0-beta.110 → 0.1.0-beta.111

package/ds-canonical/fork/consumer/lock.json

@@ -3,8 +3,8 @@
   "schemaVersion": 1,
   "role": "template-consumer",
   "release": {
-    "designSystem": "0.1.0-beta.110",
-    "storybookConfig": "0.1.0-beta.110"
+    "designSystem": "0.1.0-beta.111",
+    "storybookConfig": "0.1.0-beta.111"
   },
   "upgradeTrust": {
     "schemaVersion": 1,
@@ -42,10 +42,10 @@
     "implementationSha256": "98b74118fb5b410b77ad2994aa9105fa7609c7353822f8c5213cce54d94f0af4"
   },
   "payload": {
-    "forkCorpusLockSha256": "aedc7698f22b0762f672bcc7abd005e7ae3e7fa5b74ea659317743504597a634",
+    "forkCorpusLockSha256": "1701d6110458eb7b99787f344cd667e44fae966209febe5d08528abeb96fbfb9",
     "discoveryPolicySha256": "fba289aeeb5a3f11139b9589f7ab08b5e8c8799c7bdf8f0ea57ebfeb8e7c9da6",
     "providerMaterializersSha256": "732e85b01a12e7dd19469e26e4427f0e0cfe5117a78fc9f69c2f0f89702f463a",
-    "providerLifecycleSha256": "12d735f89b49b79afdb9580d8dc5e79296aa7d3ca27db9f0639805492c8b94b6",
+    "providerLifecycleSha256": "7514e068c425bb0fd0deec81a93a5dcefb48c52d41be5cded39cf1ad9076b49d",
     "providerInventorySha256": "00adf1c4f6b3367055a9cc3fdfe658660771b4c9931f696e12761a95076ad92c",
     "executionRuntimeSha256": "d9377cc45308731f287d7b1711b7c38fc4e02ff8f84729bcbbf01bb52d136904",
     "commonInstructionSha256": "6b9aa8747d9ddc9bd9a78de88a0c3d65f5b100ea917c4dd69be4d889b8299438",
@@ -128,7 +128,7 @@
       "scripts/sync-exact-workspace-dependencies.mjs": "29ce6aaab16fd7a939eff6e556e8548291fad28df88d578627153c9508bf6e31",
       "scripts/verify-consumer-css-entry.mjs": "a16545ea8d4f5224d8133f0bb0b68d5489d8e106fe7594488a78e0e5718b99cc",
       "scripts/verify-upgrade-evidence.mjs": "f4452640d34cb28dbddbca9919f4bc5d3caec7c35879f9e69fd5f6c8485b2ffc",
-      "scripts/verify-upgrade-provenance.mjs": "1902716115df20d4b8831e7c497abc82f9d3b848a06ca6b7cc1fe64def37a31b",
+      "scripts/verify-upgrade-provenance.mjs": "8a643a60eaf64bf131a2a4da197d5670a52e4705d11402b53fb32ae93302f6ef",
       "scripts/workflow-static-validation.mjs": "8e12bf2d73fc5e1200ddc6cc8437b27433fcd71f7d85d79b56756dcaac667305"
     }
   },

package/ds-canonical/fork/consumer/managed-files/794bb911ba8ebef58ab0d44a55b9968a19d2c62bcfb310b1ee3a84166f087f21.blob

@@ -403,23 +403,27 @@ function collectVerifiedPayloads(value, payloads, visited = new Set()) {
   }
 }
 
-export function verifiedProvenanceStatement(auditReport, expected) {
+// npm 11.19 `audit signatures --json` emits only the closed `{invalid, missing}`
+// failure sets — there is no `verified` bundle array in the JSON output (the
+// human formatter's "verified" line is CLI-only). The audit report therefore
+// gates registry signature/attestation FAILURES, while the per-package SLSA
+// provenance bundles are read back directly from the canonical registry
+// attestations endpoint and passed in by the caller.
+export function verifiedProvenanceStatement(auditReport, expected, attestationReadback) {
   if (!auditReport || !Array.isArray(auditReport.invalid) || !Array.isArray(auditReport.missing)) {
     throw new Error('npm signature audit JSON has an invalid closed result shape')
   }
   if (auditReport.invalid.length || auditReport.missing.length) {
     throw new Error('npm signature audit contains invalid or missing registry evidence')
   }
-  if (!Array.isArray(auditReport.verified)) {
-    throw new Error('npm signature audit lacks --json verified provenance bundles')
+  if (attestationReadback?.registry !== 'https://registry.npmjs.org/') {
+    throw new Error(`${expected.name}@${expected.version}: attestation readback came from a non-canonical registry`)
   }
-  const matches = auditReport.verified.filter((item) => item?.name === expected.name && item?.version === expected.version)
-  if (matches.length !== 1) throw new Error(`${expected.name}@${expected.version}: expected exactly one verified npm attestation entry`)
-  if (matches[0].registry !== 'https://registry.npmjs.org/') {
-    throw new Error(`${expected.name}@${expected.version}: verified attestation came from a non-canonical registry`)
+  if (!Array.isArray(attestationReadback.attestations) || attestationReadback.attestations.length === 0) {
+    throw new Error(`${expected.name}@${expected.version}: canonical registry returned no attestation bundles`)
   }
   const payloads = new Set()
-  collectVerifiedPayloads(matches[0].attestationBundles, payloads)
+  collectVerifiedPayloads(attestationReadback.attestations, payloads)
   const statements = []
   for (const payload of payloads) {
     let statement
@@ -673,6 +677,18 @@ async function fetchOk(fetchImpl, url, options, label) {
   return response
 }
 
+// Canonical-registry attestation readback for one exact package release. npm's
+// own `audit signatures --json` never exposes the verified bundles, so the SLSA
+// provenance statements are read back from the registry attestations endpoint
+// and validated with the same DSSE/predicate closure as before.
+export async function fetchNpmAttestationReadback({ name, version }, { fetchImpl = fetch } = {}) {
+  const registry = 'https://registry.npmjs.org/'
+  const url = `${registry}-/npm/v1/attestations/${encodeURIComponent(name)}@${encodeURIComponent(version)}`
+  const response = await fetchOk(fetchImpl, url, { headers: { Accept: 'application/json' } }, `${name}@${version} npm attestation`)
+  const body = await response.json()
+  return { registry, attestations: body?.attestations }
+}
+
 export async function resolveImmutableReleaseSnapshot({
   repository,
   tag,
@@ -859,7 +875,7 @@ export async function resolveImmutableReleaseSnapshot({
   }
 }
 
-export async function verifyUpgradeProvenance({ auditReport, packages, version, policy, releaseLookup = resolveImmutableReleaseSnapshot, ordinaryRelease = false }) {
+export async function verifyUpgradeProvenance({ auditReport, packages, version, policy, releaseLookup = resolveImmutableReleaseSnapshot, ordinaryRelease = false, attestationLookup = fetchNpmAttestationReadback }) {
   validateUpgradeTrustPolicy(policy)
   if (!Array.isArray(packages) || packages.length !== policy.upgradePackages.length) {
     throw new Error('upgrade provenance requires the exact trusted package set')
@@ -879,7 +895,8 @@ export async function verifyUpgradeProvenance({ auditReport, packages, version,
   })
   const immutable = validateImmutableReleaseSnapshot({ ...snapshot, packages, version, policy, ordinaryRelease })
   for (const item of packages) {
-    const statement = verifiedProvenanceStatement(auditReport, item)
+    const attestationReadback = await attestationLookup(item)
+    const statement = verifiedProvenanceStatement(auditReport, item, attestationReadback)
     validateProvenanceStatement(statement, {
       ...item,
       repository: policy.repository,

package/ds-canonical/fork/governance.lock

@@ -431,7 +431,7 @@
     {
       "schemaVersion": 1,
       "file": "consumer/managed-files/794bb911ba8ebef58ab0d44a55b9968a19d2c62bcfb310b1ee3a84166f087f21.blob",
-      "sha256": "1902716115df20d4b8831e7c497abc82f9d3b848a06ca6b7cc1fe64def37a31b",
+      "sha256": "8a643a60eaf64bf131a2a4da197d5670a52e4705d11402b53fb32ae93302f6ef",
       "source": "scripts/verify-upgrade-provenance.mjs",
       "classification": null,
       "destination": "scripts/verify-upgrade-provenance.mjs"
@@ -919,7 +919,7 @@
     {
       "schemaVersion": 1,
       "file": "manifest.json",
-      "sha256": "ead54445e3f603b23077854a2cc030c75cf64d23393a47f7275f1e63613df8e8",
+      "sha256": "ec1cc2b6e94de26ad90d38b01f16986d9e1d9af0066719bd2166cc5c6f364a4f",
       "source": null,
       "classification": null,
       "destination": null

package/ds-canonical/fork/manifest.json

@@ -104,20 +104,20 @@
   },
   "providerLifecycle": {
     "schemaVersion": 4,
-    "releaseVersion": "0.1.0-beta.110",
+    "releaseVersion": "0.1.0-beta.111",
     "immutableHead": {
       "providerInventorySha256": "86e9d0668cb54ad1bf05c36e78b4aa80417d5f468c929dd3ddcf69c1afbf32e4",
-      "releaseVersion": "0.1.0-beta.109",
-      "snapshotSha256": "172fb0f27392b68d6399c5f658cde49e51446f1a9e0094fb359fcf306c3ef161"
+      "releaseVersion": "0.1.0-beta.110",
+      "snapshotSha256": "b11dad6b99dbfcdf0963a136768bb3d6dda9a746b5500bccdf35d3dacb7b0667"
     },
-    "ledgerSha256": "b99b6c6424f880a417446b8e1f08324b60e806fcb05104791d253d115afbb9da",
-    "previousSnapshotSha256": "172fb0f27392b68d6399c5f658cde49e51446f1a9e0094fb359fcf306c3ef161",
-    "currentSnapshotSha256": "b11dad6b99dbfcdf0963a136768bb3d6dda9a746b5500bccdf35d3dacb7b0667",
+    "ledgerSha256": "870ceb67947449a9963b50e261e457f66b17ab84b4c78984781b63aaadc00488",
+    "previousSnapshotSha256": "b11dad6b99dbfcdf0963a136768bb3d6dda9a746b5500bccdf35d3dacb7b0667",
+    "currentSnapshotSha256": "185564b0f73305abe0a1604537f20af8cd1f372ca1ac8d9fe062b5c8c226fc00",
     "currentProviderInventorySha256": "86e9d0668cb54ad1bf05c36e78b4aa80417d5f468c929dd3ddcf69c1afbf32e4",
     "retiredProviders": [],
     "currentSnapshot": {
-      "releaseVersion": "0.1.0-beta.110",
-      "previousSnapshotSha256": "172fb0f27392b68d6399c5f658cde49e51446f1a9e0094fb359fcf306c3ef161",
+      "releaseVersion": "0.1.0-beta.111",
+      "previousSnapshotSha256": "b11dad6b99dbfcdf0963a136768bb3d6dda9a746b5500bccdf35d3dacb7b0667",
       "providers": [
         {
           "id": "claude",
@@ -193,8 +193,8 @@
       "retiredProviders": []
     },
     "immutableHeadSnapshot": {
-      "releaseVersion": "0.1.0-beta.109",
-      "previousSnapshotSha256": "f00be4d7d86479e34e595d5e6e224b6fa34176303b92fa083eeada9d6ac87a26",
+      "releaseVersion": "0.1.0-beta.110",
+      "previousSnapshotSha256": "172fb0f27392b68d6399c5f658cde49e51446f1a9e0094fb359fcf306c3ef161",
       "providers": [
         {
           "id": "claude",

package/package.json

@@ -4,7 +4,7 @@
     "type": "git",
     "url": "git+https://github.com/ajenchen/design-system.git"
   },
-  "version": "0.1.0-beta.110",
+  "version": "0.1.0-beta.111",
   "private": false,
   "description": "World-class design system — components, patterns, tokens, hooks (single source of truth for team distribution).",
   "type": "module",