depcurfew 1.5.0 → 1.5.1

package/README.md

@@ -91,9 +91,9 @@ node dist/cli.js doctor /path/to/your/repository
 
 ### Verifying a release
 
-Every release is built and published from its git tag by the [Release workflow](https://github.com/DevXord/depcurfew/blob/main/.github/workflows/release.yml) with npm trusted publishing, so the npm page of each version shows its provenance: the repository, the workflow and the commit it was built from. After installing, `npm audit signatures` checks the registry signature and the provenance attestation of every installed package, depcurfew included.
+Every release is built and published from its git tag by the [Release workflow](https://github.com/DevXord/depcurfew/blob/main/.github/workflows/release.yml) with npm trusted publishing, so the npm page of each version shows its provenance: the repository, the workflow and the commit it was built from. One job of the workflow installs, tests and packs the package without the right to publish it; a second job, which runs no code of the repository or of its dependencies, stages exactly the file the first one packed, after comparing its SHA-512 checksum. After installing, `npm audit signatures` checks the registry signature and the provenance attestation of every installed package, depcurfew included.
 
-The package contains nothing but the build of that commit, and anyone can check it: check out the tag, build it and compare the checksum with the one the registry serves, here for the release the [GitHub Action](#github-action) example uses:
+The package contains nothing but the build of that commit, and anyone can check it: check out the tag, build it and compare the checksum with the one the registry serves, here for 1.4.1:
 
 <!-- BEGIN GENERATED: verify-release -->
 ```bash
@@ -106,7 +106,7 @@ npm view depcurfew@1.4.1 dist.shasum
 ```
 <!-- END GENERATED: verify-release -->
 
-The two checksums are the same. The [Verify release workflow](https://github.com/DevXord/depcurfew/blob/main/.github/workflows/verify-release.yml) does this for the newest version on npm every day and on demand, and its runs are public in the Actions tab of the repository.
+The two checksums are the same. For 1.5.0 they differ: its JavaScript files are the build of the tag byte for byte, but its declaration file `dist/index.d.ts` lists the properties of the policy types in another order, which a build that ran right after the tests produced; later releases write those types out, so every build gives the same file. The [Verify release workflow](https://github.com/DevXord/depcurfew/blob/main/.github/workflows/verify-release.yml) does this for the newest version on npm every day and on demand, and its runs are public in the Actions tab of the repository.
 
 ## Step-by-step guide
 
@@ -734,7 +734,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: DevXord/depcurfew@7ad4fa864789f5f266cc99cf2d58538597b8238e # v1.4.1
+      - uses: DevXord/depcurfew@2c45b13c38b5fbae4b3b7ce71d57e7cee084610e # v1.5.0
 ```
 <!-- END GENERATED: action-workflow -->
 

package/dist/index.d.ts

@@ -1551,6 +1551,11 @@ type FetchLike = (url: string, init: {
  * fetches and reads each document once (decision D-113).
  */
 type LookupCache = Map<string, Promise<unknown>>;
+interface Issue {
+  /** Path to the field, e.g. `cooldown.exclude[2]`; `(root)` for the document itself. */
+  path: string;
+  message: string;
+}
 interface Duration {
   /** The duration as written in the policy. */
   text: string;
@@ -1566,105 +1571,65 @@ type DurationResult = {
 /** Writes minutes with the largest unit that represents them exactly, e.g. 2160 → "36h". */
 export declare function formatDuration(minutes: number): string;
 export declare function parseDuration(input: string): DurationResult;
-interface Issue {
-  /** Path to the field, e.g. `cooldown.exclude[2]`; `(root)` for the document itself. */
-  path: string;
-  message: string;
-}
-type Path = readonly (string | number)[];
-type JsonType = 'object' | 'array' | 'string' | 'number' | 'boolean' | 'null';
-/** The JSON Schema keywords this module emits. */
-interface JsonSchema {
-  type?: 'object' | 'array' | 'string' | 'integer' | 'number';
-  description?: string;
-  const?: string | number;
-  enum?: readonly string[];
-  pattern?: string;
-  examples?: readonly unknown[];
-  default?: unknown;
-  properties?: Record<string, JsonSchema>;
-  required?: string[];
-  additionalProperties?: false;
-  items?: JsonSchema;
-  uniqueItems?: true;
-  minItems?: number;
-  anyOf?: JsonSchema[];
-}
-type ParseResult<T> = {
-  ok: true;
-  value: T;
-} | {
-  ok: false;
-};
-interface Shape<In, Out = In> {
-  /** How the shape is named in messages: `must be ${label}`. */
-  readonly label: string;
-  /** JSON types this shape can accept; a union picks its branch by the type of the value. */
-  readonly jsonTypes: readonly JsonType[];
-  /** Candidate values for "did you mean" suggestions. */
-  readonly suggestions?: readonly string[];
-  parse(value: unknown, path: Path, issues: Issue[]): ParseResult<Out>;
-  toJsonSchema(): JsonSchema;
-  /** Type-level only: the input type. */
-  readonly __input?: In;
-}
-type Input<S> = S extends Shape<infer In, unknown> ? In : never;
-type Output<S> = S extends Shape<unknown, infer Out> ? Out : never;
 /** Which findings make depcurfew doctor exit with 1 (decision D-112). */
 declare const FAIL_ON_LEVELS: readonly ["error", "warning"];
-declare const policyShape: Shape<{
-  version: 1;
+type Access = 'allow' | 'deny';
+/**
+ * The policy as written in depcurfew.json. Written out instead of inferred from policyShape: the declaration file would
+ * otherwise list the inferred properties in an order that depends on the order TypeScript happens to check the files
+ * in, so two builds of the same commit could differ (decision D-174). The annotation of policyShape keeps it in step.
+ */
+interface Policy {
   $schema?: string;
+  version: 1;
   cooldown?: {
     minimum: string;
     exclude?: readonly string[];
-    securityUpdates?: "bypass" | "delay";
+    securityUpdates?: 'bypass' | 'delay';
   };
   installScripts?: {
-    default: "allow" | "deny";
+    default: Access;
     allow?: readonly string[];
     deny?: readonly string[];
   };
   sources?: {
-    git?: "allow" | "deny";
-    remoteTarball?: "allow" | "deny";
-    file?: "allow" | "deny";
-    directory?: "allow" | "deny";
+    git?: Access;
+    remoteTarball?: Access;
+    file?: Access;
+    directory?: Access;
   };
-  targets?: "auto" | readonly ToolId[];
+  targets?: 'auto' | readonly ToolId[];
   projects?: readonly string[];
   doctor?: {
-    failOn?: "error" | "warning";
+    failOn?: (typeof FAIL_ON_LEVELS)[number];
   };
-}, {
-  version: 1;
-  targets: "auto" | readonly ToolId[];
-  projects: readonly string[];
+}
+/** The policy after validation: defaults filled in, durations parsed. */
+interface ResolvedPolicy {
   $schema?: string;
+  version: 1;
   cooldown?: {
     minimum: Duration;
     exclude: readonly string[];
-    securityUpdates: "bypass" | "delay";
+    securityUpdates: 'bypass' | 'delay';
   };
   installScripts?: {
-    default: "allow" | "deny";
+    default: Access;
     allow: readonly string[];
     deny: readonly string[];
   };
   sources?: {
-    git?: "allow" | "deny";
-    remoteTarball?: "allow" | "deny";
-    file?: "allow" | "deny";
-    directory?: "allow" | "deny";
+    git?: Access;
+    remoteTarball?: Access;
+    file?: Access;
+    directory?: Access;
   };
+  targets: 'auto' | readonly ToolId[];
+  projects: readonly string[];
   doctor?: {
-    failOn?: "error" | "warning";
+    failOn?: (typeof FAIL_ON_LEVELS)[number];
   };
-}>;
-/** The policy as written in depcurfew.json. */
-type Policy = Input<typeof policyShape>;
-/** The policy after validation: defaults filled in, durations parsed. */
-type ResolvedPolicy = Output<typeof policyShape>;
+}
 interface SimilarName {
   /** The popular package the name resembles. */
   match: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "depcurfew",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "One supply-chain security policy for npm, pnpm, Yarn, Bun, Deno, uv, pip, Poetry, PDM, Pipenv, Composer, Bundler, Renovate and Dependabot, plus a doctor that finds config that silently does nothing.",
   "license": "MIT",
   "author": "depcurfew",