{"_id":"@berryn/release-candidate","_rev":"3-ece155da36ef219991d3ab512b90cecb","name":"@berryn/release-candidate","dist-tags":{"latest":"0.2.1"},"versions":{"0.1.0":{"name":"@berryn/release-candidate","version":"0.1.0","author":"Berryn Core Engineering Team","license":"MIT","_id":"@berryn/release-candidate@0.1.0","maintainers":[{"name":"aaryan28","email":"aaryan28rwt@gmail.com"}],"homepage":"https://github.com/Grevix/berryn","bugs":{"url":"https://github.com/Grevix/berryn/issues"},"dist":{"shasum":"d59d4b08cdb93e318a7db023c32adf19271b58cf","tarball":"https://registry.npmjs.org/@berryn/release-candidate/-/release-candidate-0.1.0.tgz","fileCount":22,"integrity":"sha512-QjaKe81rTtZhiH2I+hzrDwUb0QEkrU4eEQS+YgE+AojqozO8Of0iadH+r6MXnQ+PrCviWmTPXwEjjyqfUtLHiw==","signatures":[{"sig":"MEYCIQDF0c/RJm1FzZ+omSFYqBOFR/ECNdhUyKrH6/IEduqpMAIhAMItaqZ3Vx4mkzFo0PXGbYAvHhGF6Nj4ae99SP0Xt7Bz","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":14269},"main":"./dist/index.js","type":"module","types":"./dist/index.d.ts","engines":{"node":">=22.0.0"},"exports":{".":{"import":{"types":"./dist/index.d.ts","default":"./dist/index.js"}}},"scripts":{"build":"tsc --build","clean":"rimraf dist"},"_npmUser":{"name":"aaryan28","email":"aaryan28rwt@gmail.com"},"repository":{"url":"https://github.com/Grevix/berryn.git","type":"git"},"description":"Berryn Release Candidate Verification Engine — SBOM generation, release gates audit, and OIDC provenance attestation","directories":{},"_nodeVersion":"24.14.0","dependencies":{"@berryn/core":"0.1.0","@berryn/diagnostics":"0.1.0"},"_hasShrinkwrap":false,"devDependencies":{},"_npmOperationalInternal":{"tmp":"tmp/release-candidate_0.1.0_1787000679961_0.8052456272636104","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"name":"@berryn/release-candidate","version":"0.2.0","author":"Berryn Core Engineering Team","license":"MIT","_id":"@berryn/release-candidate@0.2.0","maintainers":[{"name":"aaryan28","email":"aaryan28rwt@gmail.com"}],"homepage":"https://github.com/Grevix/berryn#readme","bugs":{"url":"https://github.com/Grevix/berryn/issues"},"dist":{"shasum":"3c10181f61d4cba78daaef8643fa41a3dbfee3c2","tarball":"https://registry.npmjs.org/@berryn/release-candidate/-/release-candidate-0.2.0.tgz","fileCount":18,"integrity":"sha512-blWEoc1Uft9B3OYH3nWZLGYn/FlwgyvvHtopDLYh2z+PtWad9CUJadqlJwME9qlj5fd/ow+JT6rkRgcalH2fmA==","signatures":[{"sig":"MEUCIQC6VcBVO42E/N0VZek2TkpqV73onFIevXEvygAIDCkTvwIgMc9CdORqgFD/3NKWmLpJSuC7FIJL3WiwTGmubZVj4wI=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":14885},"main":"./dist/index.js","type":"module","types":"./dist/index.d.ts","engines":{"node":">=22.0.0"},"exports":{".":{"import":{"types":"./dist/index.d.ts","default":"./dist/index.js"},"require":{"types":"./dist/index.d.ts","default":"./dist/index.js"}}},"scripts":{"build":"tsc --build","clean":"rimraf dist"},"_npmUser":{"name":"aaryan28","email":"aaryan28rwt@gmail.com"},"repository":{"url":"git+https://github.com/Grevix/berryn.git","type":"git"},"description":"Berryn Release Candidate Verification Engine — SBOM generation, release gates audit, and OIDC provenance attestation","directories":{},"_nodeVersion":"24.14.0","dependencies":{"@berryn/core":"0.2.0","@berryn/diagnostics":"0.2.0"},"publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"_hasShrinkwrap":false,"devDependencies":{},"_npmOperationalInternal":{"tmp":"tmp/release-candidate_0.2.0_1788157984136_0.0204985313175845","host":"s3://npm-registry-packages-npm-production"}},"0.2.1":{"name":"@berryn/release-candidate","version":"0.2.1","description":"Berryn Release Candidate Verification Engine — SBOM generation, release gates audit, and OIDC provenance attestation","repository":{"type":"git","url":"git+https://github.com/Grevix/berryn.git"},"homepage":"https://github.com/Grevix/berryn#readme","bugs":{"url":"https://github.com/Grevix/berryn/issues"},"license":"MIT","author":{"name":"Berryn Core Engineering Team"},"engines":{"node":">=22.0.0"},"main":"./dist/index.js","types":"./dist/index.d.ts","exports":{".":{"import":{"types":"./dist/index.d.ts","default":"./dist/index.js"},"require":{"types":"./dist/index.d.ts","default":"./dist/index.js"}}},"type":"module","scripts":{"build":"tsc --build","clean":"rimraf dist"},"dependencies":{"@berryn/core":"0.2.1","@berryn/diagnostics":"0.2.1"},"devDependencies":{},"publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"gitHead":"576fa2934836ad4f045966f8a86d99490cbea05b","_id":"@berryn/release-candidate@0.2.1","_nodeVersion":"24.14.0","_npmVersion":"11.9.0","dist":{"integrity":"sha512-s5L1lkMnHXoaRSIeOYNrjJDilZJB2/4sdCI3jOgM1lbmKNBBW5GhLGBbMkgMZ+i2fhMH0thoA9L/sE3Df61xKA==","shasum":"dd8de4f12a06b1561805b51624527776c61f9731","tarball":"https://registry.npmjs.org/@berryn/release-candidate/-/release-candidate-0.2.1.tgz","fileCount":18,"unpackedSize":14886,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQD1y1T7vaz90L0liTNb+R1URM59RExI1rqqx+i16RiDSwIhAIvdgSzgMsZOCORmxS346LOt7I78gNsBmnBvq+NMsfd8"}]},"_npmUser":{"name":"aaryan28","email":"aaryan28rwt@gmail.com"},"directories":{},"maintainers":[{"name":"aaryan28","email":"aaryan28rwt@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/release-candidate_0.2.1_1788165887643_0.2507706256923481"},"_hasShrinkwrap":false}},"time":{"created":"2026-08-17T21:04:39.799Z","modified":"2026-08-31T08:44:48.072Z","0.1.0":"2026-08-17T21:04:40.114Z","0.2.0":"2026-08-31T06:33:04.292Z","0.2.1":"2026-08-31T08:44:47.782Z"},"bugs":{"url":"https://github.com/Grevix/berryn/issues"},"author":{"name":"Berryn Core Engineering Team"},"license":"MIT","homepage":"https://github.com/Grevix/berryn#readme","repository":{"type":"git","url":"git+https://github.com/Grevix/berryn.git"},"description":"Berryn Release Candidate Verification Engine — SBOM generation, release gates audit, and OIDC provenance attestation","maintainers":[{"name":"aaryan28","email":"aaryan28rwt@gmail.com"}],"readme":"# @berryn/release-candidate\n\n> **CycloneDX 1.5 JSON SBOM generator, npm OIDC provenance verifier, and release gate auditor.**\n\n[![npm version](https://img.shields.io/npm/v/@berryn/release-candidate.svg)](https://www.npmjs.com/package/@berryn/release-candidate)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Node.js](https://img.shields.io/badge/node-%3E%3D22.0.0-brightgreen.svg)](https://nodejs.org)\n[![TypeScript](https://img.shields.io/badge/TypeScript-5.7%2B-blue.svg)](https://www.typescriptlang.org/)\n\n---\n\n## Overview\n\n`@berryn/release-candidate` powers the release gating and supply chain security infrastructure for Berryn. It generates machine-verifiable Software Bill of Materials (SBOM) in the **CycloneDX 1.5 JSON** standard, parses and validates Sigstore/npm OIDC provenance attestations, and audits the 6 mandatory release candidate validation gates.\n\n---\n\n## The 6 Mandatory Release Gates\n\n```mermaid\nflowchart TD\n    G1[1. Formatting & Linting] --> G2[2. TypeScript Strict Typecheck]\n    G2 --> G3[3. Vitest Unit & Integration]\n    G3 --> G4[4. SAST & Dependency Audit]\n    G4 --> G5[5. SBOM & Provenance Verification]\n    G5 --> G6[6. ZIP Bomb & XXE Security Shield]\n    G6 --> Candidate[0.1.0 Umbrella Release Candidate Certified]\n```\n\n1. **Formatting & Linting**: Prettier format conformance and ESLint zero-warning checks.\n2. **TypeScript Strict Typecheck**: Complete `tsc --build` composite project build under `\"strict\": true`.\n3. **Unit & Integration Suite**: 100% passing Vitest test harness across all packages.\n4. **SAST & Dependency Audit**: Zero high/critical vulnerabilities in dependency tree.\n5. **SBOM & Provenance**: Spec-compliant CycloneDX 1.5 SBOM generated with verifiable build provenance.\n6. **Security Shields**: Runtime validation against decompression bombs and XML entities.\n\n---\n\n## Installation\n\n```bash\n# Using pnpm\npnpm add @berryn/release-candidate\n\n# Using npm\nnpm install @berryn/release-candidate\n```\n\n---\n\n## Usage Examples\n\n### 1. Generating a CycloneDX 1.5 SBOM\n\n```typescript\nimport { generateSbomJson } from '@berryn/release-candidate';\n\nconst dependencies = {\n  '@berryn/core': '^0.1.0',\n  '@berryn/security': '^0.1.0',\n  'fast-xml-parser': '^5.0.8',\n  'fflate': '^0.8.2'\n};\n\nconst sbom = generateSbomJson('berryn', '0.1.0', dependencies);\n\nconsole.log(`Spec Version: ${sbom.specVersion}`); // '1.5'\nconsole.log(`Components: ${sbom.components.length}`);\n// Output valid CycloneDX 1.5 JSON\n```\n\n---\n\n### 2. Auditing Release Gates\n\n```typescript\nimport { auditReleaseGates } from '@berryn/release-candidate';\n\nconst { results, overallPassed, diagnostics } = auditReleaseGates();\n\nconsole.log(`All Gates Passed: ${overallPassed}`);\nfor (const gate of results) {\n  console.log(`[${gate.passed ? 'PASS' : 'FAIL'}] ${gate.gateName} (Findings: ${gate.criticalFindings})`);\n}\n```\n\n---\n\n### 3. Verifying npm / GitHub OIDC Provenance\n\n```typescript\nimport { verifyProvenanceAttestation } from '@berryn/release-candidate';\n\nconst rawAttestation = JSON.stringify({\n  builderId: 'https://github.com/actions/runner',\n  buildType: 'https://github.com/npm/provenance/v1',\n  invocation: { configSource: { uri: 'git+https://github.com/Grevix/berryn', digest: {} } }\n});\n\nconst { statement, diagnostics } = verifyProvenanceAttestation(rawAttestation);\nconsole.log(`Provenance Verified: ${statement.verified}`);\nconsole.log(`Builder ID: ${statement.builderId}`);\n```\n\n---\n\n## Exported Symbols\n\n| Symbol | Category | Description |\n|---|---|---|\n| `generateSbomJson` | Function | Produces CycloneDX 1.5 JSON object from package name and dependencies. |\n| `auditReleaseGates` | Function | Validates that all 6 release requirements are met before publishing. |\n| `verifyProvenanceAttestation` | Function | Parses and verifies build attestation statements. |\n| `CycloneDxSbom` | Interface | Schema for CycloneDX 1.5 JSON SBOM. |\n| `SbomComponent` | Interface | Component definition with Package URL (`purl`) and license metadata. |\n| `ReleaseGateCheckResult` | Interface | Result schema for individual release gate audits. |\n| `ProvenanceStatement` | Interface | Verified build invocation and signer identity record. |\n\n---\n\n## Links\n\n- **Repository**: [https://github.com/Grevix/berryn](https://github.com/Grevix/berryn)\n- **License**: [MIT](https://opensource.org/licenses/MIT) © 2026 Berryn Core Engineering Team\n","readmeFilename":"README.md"}