owlrunkit 0.19.2 → 0.21.0

package/scripts/runkit-contract/sync-release-identity.mjs

@@ -126,6 +126,77 @@ function requireSurface(condition, surface) {
   }
 }
 
+const REGISTRY_GATED_POLICY_V2_FIELDS = Object.freeze([
+  "artifactVersion",
+  "authorizationGranted",
+  "embeddedAttestComponentVersion",
+  "exactVersionRequired",
+  "forbiddenAdoptionSources",
+  "foreignProjectWriteAuthorized",
+  "githubActionRequired",
+  "packageName",
+  "registry",
+  "registryEvidenceMustBeExternal",
+  "registryEvidenceSchemaVersion",
+  "registryRequiredBeforeAdoption",
+  "requiredRegistryBindings",
+  "rollbackRelease",
+  "schemaVersion",
+  "signatureRequired",
+  "standaloneAttestPublicationRequired",
+  "status",
+]);
+
+function exactStringArray(actual, expected) {
+  return Array.isArray(actual)
+    && actual.length === expected.length
+    && actual.every((value, index) => value === expected[index]);
+}
+
+function registryGatedPolicyV2Exact(policy, core) {
+  const rollback = policy?.rollbackRelease;
+  return policy?.schemaVersion === "OwlCodaRunKitRegistryReleasePolicyV2"
+    && Object.keys(policy).sort().join("\n") === REGISTRY_GATED_POLICY_V2_FIELDS.join("\n")
+    && policy.status === "release_artifact_registry_gated"
+    && policy.packageName === "owlrunkit"
+    && policy.artifactVersion === core.coreVersion
+    && policy.registry === "https://registry.npmjs.org"
+    && policy.registryRequiredBeforeAdoption === true
+    && policy.exactVersionRequired === true
+    && exactStringArray(policy.requiredRegistryBindings, [
+      "packageName",
+      "version",
+      "shasum",
+      "integrity",
+      "tarballUrl",
+    ])
+    && exactStringArray(policy.forbiddenAdoptionSources, [
+      "directory",
+      "file",
+      "git",
+      "local_tarball",
+      "symlink",
+      "workspace",
+    ])
+    && rollback?.packageName === "owlrunkit"
+    && /^\d+\.\d+\.\d+$/u.test(rollback?.version ?? "")
+    && rollback.version !== core.coreVersion
+    && /^[a-f0-9]{40}$/u.test(rollback?.shasum ?? "")
+    && /^sha512-[A-Za-z0-9+/]+={0,2}$/u.test(rollback?.integrity ?? "")
+    && rollback.tarballUrl
+      === `https://registry.npmjs.org/owlrunkit/-/owlrunkit-${rollback.version}.tgz`
+    && Object.keys(rollback).sort().join("\n")
+      === ["integrity", "packageName", "shasum", "tarballUrl", "version"].join("\n")
+    && policy.registryEvidenceMustBeExternal === true
+    && policy.registryEvidenceSchemaVersion === "OwlCodaRunKitRegistryReleaseEvidenceV1"
+    && policy.embeddedAttestComponentVersion === "0.2.0"
+    && policy.standaloneAttestPublicationRequired === false
+    && policy.signatureRequired === false
+    && policy.githubActionRequired === false
+    && policy.foreignProjectWriteAuthorized === false
+    && policy.authorizationGranted === false;
+}
+
 export function verifyReleaseIdentitySurfacesV1(input) {
   const core = input?.core;
   requireSurface(
@@ -155,6 +226,7 @@ export function verifyReleaseIdentitySurfacesV1(input) {
   };
   const releasePolicy = input.releasePolicy ?? null;
   const candidateUnpublished = releasePolicy?.status === "release_candidate_unpublished";
+  const registryGatedArtifact = releasePolicy?.status === "release_artifact_registry_gated";
   if (candidateUnpublished) {
     requireSurface(
       releasePolicy?.packageName === "owlrunkit"
@@ -167,6 +239,8 @@ export function verifyReleaseIdentitySurfacesV1(input) {
         && releasePolicy.currentPublishedRelease.version !== core.coreVersion,
       "release_policy",
     );
+  } else if (registryGatedArtifact) {
+    requireSurface(registryGatedPolicyV2Exact(releasePolicy, core), "release_policy");
   }
   const skillExact = (markdown) => {
     if (typeof markdown !== "string") return false;
@@ -175,6 +249,19 @@ export function verifyReleaseIdentitySurfacesV1(input) {
       && hashes[0] === core.coreManifestSha256
       && markdown.includes(`Core \`${core.coreVersion}\``);
     if (!identityExact) return false;
+    if (registryGatedArtifact) {
+      const rollback = releasePolicy.rollbackRelease.version;
+      return markdown.includes(
+        `Bundled release artifact: standalone \`owlrunkit@${core.coreVersion}\``,
+      )
+        && markdown.includes(
+          `provenance for \`owlrunkit@${core.coreVersion}\` is independently verified`,
+        )
+        && markdown.includes(
+          `published rollback baseline for this artifact is \`owlrunkit@${rollback}\``,
+        )
+        && !/(?:candidate is not published|current published release remains|already published|is published|registry publication pending|unpublished release candidate)/iu.test(markdown);
+    }
     if (!candidateUnpublished) {
       return markdown.includes(
         `Bundled release: standalone \`owlrunkit@${core.coreVersion}\``,