prefix-safe-json 0.4.1 → 0.4.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +11 -0
- package/package.json +3 -1
package/README.md
CHANGED
|
@@ -25,6 +25,17 @@ development and release jobs remain on Node 22/24 because the development
|
|
|
25
25
|
toolchain and the exact `ai@7.0.77` lifecycle proof require newer Node; those
|
|
26
26
|
requirements do not apply to the package's runtime dependency graph.
|
|
27
27
|
|
|
28
|
+
## Supply-chain verification
|
|
29
|
+
|
|
30
|
+
Verify releases independently rather than relying on publisher claims. The
|
|
31
|
+
`0.4.1` npm artifact has npm provenance from this repository's GitHub Actions
|
|
32
|
+
publish workflow, and its tarball can be rebuilt and compared with the release
|
|
33
|
+
tag by running `npm run verify:published-release -- 0.4.1` from a clone with
|
|
34
|
+
tags fetched. See the command-driven [maintainer audit](docs/MAINTAINER_AUDIT.md),
|
|
35
|
+
the exact [release/hash mapping](docs/RELEASE_INTEGRITY.md), the
|
|
36
|
+
[runtime dependency graph](docs/RUNTIME_DEPENDENCIES.md), and the
|
|
37
|
+
[execution-critical source map](docs/EXECUTION_AUDIT_SURFACE.md).
|
|
38
|
+
|
|
28
39
|
## Recommended AI SDK boundary
|
|
29
40
|
|
|
30
41
|
Lock the local tool definitions before the AI SDK sees them, feed the real
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "prefix-safe-json",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.2",
|
|
4
4
|
"description": "Fail-closed execution integrity for streamed LLM tool calls — reject truncated or unconfirmed arguments before side effects",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"json",
|
|
@@ -61,6 +61,8 @@
|
|
|
61
61
|
"test:fuzz": "vitest run test/fuzz/",
|
|
62
62
|
"bench": "vitest bench --run",
|
|
63
63
|
"validate-corpus": "tsx scripts/validate-corpus.ts",
|
|
64
|
+
"verify:package-policy": "node scripts/verify-package-policy.mjs",
|
|
65
|
+
"verify:published-release": "node scripts/verify-published-release.mjs",
|
|
64
66
|
"clean": "rimraf dist coverage .vitest",
|
|
65
67
|
"pack:check": "pnpm pack --dry-run",
|
|
66
68
|
"example:anthropic": "node examples/anthropic-truncation-safety.mjs",
|