gamertan
6df87bc958
Publish the exact sanitized Agent Skill and VS Code preview source tree with independent license boundaries, deterministic provenance manifests, and no private development history. Material design and implementation assistance was provided by OpenAI Codex. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
32 lines
1.3 KiB
JavaScript
32 lines
1.3 KiB
JavaScript
// SPDX-License-Identifier: AGPL-3.0-only
|
|
'use strict';
|
|
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
|
|
const root = path.join(__dirname, '..');
|
|
const manifest = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
|
|
const lock = JSON.parse(fs.readFileSync(path.join(root, 'package-lock.json'), 'utf8'));
|
|
if (lock.lockfileVersion !== 3) throw new Error('package-lock must use lockfileVersion 3');
|
|
|
|
for (const group of ['dependencies', 'devDependencies']) {
|
|
for (const [name, version] of Object.entries(manifest[group] || {})) {
|
|
if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
|
|
throw new Error(`${group} must pin ${name} to an exact version`);
|
|
}
|
|
}
|
|
}
|
|
|
|
const productionLicenses = new Set(['MIT', 'ISC']);
|
|
for (const [name, pkg] of Object.entries(lock.packages || {})) {
|
|
if (!name.startsWith('node_modules/')) continue;
|
|
if (!pkg.version || !pkg.integrity || !pkg.resolved?.startsWith('https://registry.npmjs.org/')) {
|
|
throw new Error(`unverifiable registry dependency: ${name}`);
|
|
}
|
|
if (!pkg.dev && !productionLicenses.has(pkg.license)) {
|
|
throw new Error(`unreviewed production dependency license: ${name} (${pkg.license || 'missing'})`);
|
|
}
|
|
}
|
|
|
|
console.log('lockfile integrity, exact direct pins, registry origins, and production licenses verified');
|