border-customs 0.3.2 → 0.4.1

package/dist/assets/residue-src/npm.ts

@@ -28,6 +28,7 @@ import { EngineRunError, type EngineOptions } from "../engines/support.ts";
 import { LIFECYCLE_SCRIPT_KEYS, parseNpmManifest, unexpectedEntries } from "./manifestDiff.ts";
 import { residueFindings, scanNpmLifecycleHook, sweepResidueNpmArtifact } from "./residue.ts";
 import { RESIDUE_T1_RULE } from "../rules/residueMatchers.ts";
+import { npmPackCoherenceFindings } from "../rules/releaseCoherence.ts";
 import {
   NPM_LIFECYCLE_RULE,
   NPM_PUBLINT_RULE,
@@ -197,6 +198,19 @@ export async function runNpmArtifactStage(o: NpmStageOptions): Promise<NpmStageR
     // not the working tree — npm may rewrite package.json inside the tarball.
     const packedManifest = parseNpmManifest(readFileSync(join(extractDir, packedManifestRel), "utf8"));
 
+    // W4.1 release coherence: packed package.json ↔ a packed package-lock.json (root +
+    // packages[""]). ABSENT-SOURCE BOUNDARY (load-bearing): locks are usually NOT in the
+    // tarball (files whitelist) — an unpacked lock is not drift and never a finding;
+    // false-positive gates just train users to pass --force. See rules/releaseCoherence.ts.
+    const lockRel = `${root}/package-lock.json`;
+    findings.push(...npmPackCoherenceFindings({
+      packedVersion: packedManifest.version,
+      lockText: relPaths.includes(lockRel) ? readFileSync(join(extractDir, lockRel), "utf8") : null,
+      lockRelPath: lockRel,
+      identity,
+      ...(o.sanitizer !== undefined ? { sanitizer: o.sanitizer } : {}),
+    }));
+
     // RESIDUE-CONTRACT §1.6/§3 (R2): a hook is downgraded to MEDIUM ONLY when the
     // classifier matches closed signature #1 in full; every other outcome — unknown
     // grammar, unreadable target, out-of-signature literal — keeps the 0.2.0

package/dist/assets/residue-src/pypi.ts

@@ -40,6 +40,7 @@ import { basename, dirname, join, relative, resolve } from "node:path";
 import { extractArchive, removeSandbox } from "./extract.ts";
 import { residueFindings } from "./residue.ts";
 import { residuePypiHits } from "./residuePy.ts";
+import { pypiArtifactCoherenceFindings } from "../rules/releaseCoherence.ts";
 import type { Finding } from "../findings.ts";
 import { globToRegExp } from "../rules/artifactMatchers.ts";
 import { scanTree } from "../engines/gitleaks.ts";
@@ -316,6 +317,25 @@ export async function scanPyPiArtifacts(o: PypiInput): Promise<PypiScanResult> {
           identity: basename(artifact.path),
           ...(o.sanitizer !== undefined ? { sanitizer: o.sanitizer } : {}),
         })) absorb(f, f.path ?? "");
+        // W4.1 release coherence: every version source inside THIS artifact — wheel:
+        // filename ↔ dist-info dir ↔ METADATA Version ↔ __version__ literals (the aihr
+        // replay is caught from the wheel bytes alone); sdist: pyproject/setup.* ↔
+        // PKG-INFO ↔ __version__. Regex-text probes only, nothing executed; a source
+        // absent from the tree is NOT drift (releaseCoherence.ts header boundary).
+        for (const f of pypiArtifactCoherenceFindings({
+          kind: artifact.kind,
+          archiveName: basename(artifact.path),
+          files: rest,
+          read: (rel: string) => {
+            try {
+              return readFileSync(join(scanRoot, rel), "utf8");
+            } catch {
+              return null;
+            }
+          },
+          identity: basename(artifact.path),
+          ...(o.sanitizer !== undefined ? { sanitizer: o.sanitizer } : {}),
+        })) absorb(f, f.path ?? "");
         if (artifact.kind === "sdist") for (const f of manifestFindings(o, rest, target)) absorb(f, f.path ?? "");
       } finally {
         removeSandbox(sandbox);

package/dist/assets/residue-src/rubygems.ts

@@ -32,6 +32,7 @@ import { BORDER_STATE_DIR, ensureStateDir } from "../check/lock.ts";
 import { extractArchive, removeSandbox } from "./extract.ts";
 import { type ResidueHit, residueFindings } from "./residue.ts";
 import { residueGemHits } from "./residueGem.ts";
+import { gemCoherenceFindings } from "../rules/releaseCoherence.ts";
 import { scanTree } from "../engines/gitleaks.ts";
 import { scanPaths, type SecretlintMode } from "../engines/secretlint.ts";
 import { EngineMissingError, EngineRunError, type EngineOptions } from "../engines/support.ts";
@@ -265,6 +266,17 @@ export async function runRubygemsArtifactStage(o: GemStageOptions): Promise<GemS
       })) {
         findings.push(f);
       }
+      // W4.1 release coherence: metadata.gz is the shipped bytes' own Gem::Specification —
+      // reconcile it against the built filename. NOT vacuous: gemspec.ts's GEMSPEC_VERSION
+      // regex takes the FIRST literal s.version= while Ruby assignment order makes the LAST
+      // win, so a twice-assigned literal drifts border's filename from the real spec.
+      findings.push(...gemCoherenceFindings({
+        specName: identity.name,
+        specVersion: identity.version,
+        metadataText: metadata,
+        identity: gemName,
+        ...(o.sanitizer !== undefined ? { sanitizer: o.sanitizer } : {}),
+      }));
     }
   } finally {
     removeSandbox(extractDir);