Update protobuf to 2.15.0 and validate bundled npm dependencies

apps/site/package.json

@@ -13,7 +13,7 @@
     "@arcforges/api-client": "1.0.0-ci.25.1",
     "@arcforges/proto": "1.0.0-ci.25.1",
     "@arcforges/web-ui": "0.0.0",
-    "@bufbuild/protobuf": "2.14.1",
+    "@bufbuild/protobuf": "2.15.0",
     "react": "19.3.0",
     "react-dom": "19.3.0",
     "react-router": "8.4.0",

docs/development.md

@@ -33,6 +33,8 @@ Open `win.slnx` with a Visual Studio release supporting the JavaScript project S
 
 Use exact direct versions and commit the root `package-lock.json` after intentional dependency changes. Keep React/DOM/types and Router packages aligned. Keep protobuf/Connect versions compatible with the published Contracts packages. Do not replace pinned Contracts versions with `latest`, Git URLs, local paths or floating ranges. Update the pins and lock through a reviewed PR; Dependabot groups related updates and the full pipeline validates them.
 
+Lock provenance checks require npm registry URLs and SHA-512 integrity for downloaded artifacts. npm's `inBundle` entries are extracted from an enclosing package tarball and may omit their own URL/hash; the check traces them to that verified artifact, including nested bundles. Orphaned entries and workspace links cannot substitute for a registry artifact. Keep this metadata when Dependabot adds it; see the [npm lockfile format](https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json/#packages).
+
 Node runtime and `@types/node` stay on major 24. Updating Node also requires `.node-version`, engines and `packageManager` to remain consistent. Keep Playwright browser binaries aligned with its package version.
 
 If a dependency update changes license packaging, review `third-party/README.md` and update the generated-notice handling. Build failures for missing licenses are deliberate rather than silently discarding notices.

tests/unit/lock-provenance.test.ts

@@ -0,0 +1,77 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+import { expect, test } from "vitest";
+import { verifyLockProvenance } from "../../tooling/project.ts";
+
+const registry = {
+  resolved: "https://registry.npmjs.org/outer/-/outer-1.0.0.tgz",
+  integrity: `sha512-${Buffer.alloc(64).toString("base64")}`,
+};
+const bundled = { inBundle: true };
+
+test("accepts the bundled optional dependency layout reported by Dependabot", () => {
+  // Preserve the failing layout as a fixture even if a future Tailwind release stops bundling it.
+  expect(() =>
+    verifyLockProvenance({
+      "node_modules/@tailwindcss/oxide-wasm32-wasi": {
+        resolved:
+          "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz",
+        integrity:
+          "sha512-jx1+rPhY/5Ympkktd656HBWEBLxP7dH06losBLjjf5vgCODXvi9KhtftWcMIwTFIDqBr7cRnQkdLnAG+IOlGvQ==",
+      },
+      "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": bundled,
+    }),
+  ).not.toThrow();
+});
+
+test("nested bundled dependencies inherit the enclosing registry artifact", () => {
+  expect(() =>
+    verifyLockProvenance({
+      "node_modules/outer": registry,
+      "node_modules/outer/node_modules/@scope/inner": bundled,
+      "node_modules/outer/node_modules/@scope/inner/node_modules/leaf": bundled,
+    }),
+  ).not.toThrow();
+});
+
+test("rejects orphaned bundles, workspace ancestors and incomplete or foreign artifacts", () => {
+  for (const packages of [
+    { "node_modules/leaf": bundled },
+    { "node_modules/missing/node_modules/leaf": bundled },
+    {
+      "node_modules/outer": { resolved: registry.resolved },
+      "node_modules/outer/node_modules/leaf": bundled,
+    },
+    {
+      "node_modules/outer": { ...registry, resolved: "https://example.com/outer.tgz" },
+      "node_modules/outer/node_modules/leaf": bundled,
+    },
+    {
+      "node_modules/outer": { link: true, resolved: "apps/site" },
+      "node_modules/outer/node_modules/leaf": bundled,
+    },
+    {
+      "node_modules/outer": registry,
+      "node_modules/outer/node_modules/leaf": {
+        ...bundled,
+        ...registry,
+        resolved: "https://example.com/leaf.tgz",
+      },
+    },
+  ])
+    expect(() => verifyLockProvenance(packages)).toThrow();
+});
+
+test("ordinary downloads and workspace links keep their provenance requirements", () => {
+  expect(() =>
+    verifyLockProvenance({
+      "node_modules/outer": registry,
+      "node_modules/@arcforges/web-site": { link: true, resolved: "apps/site" },
+    }),
+  ).not.toThrow();
+  for (const entry of [
+    { resolved: registry.resolved },
+    { ...registry, resolved: "https://example.com/outer.tgz" },
+    { link: true, resolved: "../other-repo" },
+  ])
+    expect(() => verifyLockProvenance({ "node_modules/outer": entry })).toThrow();
+});

third-party/README.md

@@ -2,7 +2,7 @@
 
 The published protobuf and Connect runtime tarballs contain copyright/license headers but omit their repository-level license files. Preserve the upstream files here, and include them alongside the headers in generated public notices:
 
-- `protobuf-es-LICENSE.txt`: https://github.com/bufbuild/protobuf-es/blob/v2.14.1/LICENSE
+- `protobuf-es-LICENSE.txt`: https://github.com/bufbuild/protobuf-es/blob/v2.15.0/LICENSE (verified identical to v2.14.1, which remains in the published Contracts dependency closure)
 - `connect-es-LICENSE.txt`: https://github.com/connectrpc/connect-es/blob/v2.2.0/LICENSE
 
 The protobuf runtime also contains Google's BSD-3-Clause varint implementation. The build copies its complete original notice from `dist/esm/wire/varint.js`, plus the Buf copyright header. Connect copyright headers are copied from the installed packages. Review these sources when updating the corresponding dependency family. These files remain under their upstream licenses.

tooling/project.ts

@@ -237,6 +237,47 @@ async function build() {
     `Verified candidate ${version} at ${source}${dirty ? " (local changes; not deployable)" : ""}`,
   );
 }
+type LockEntry = { link?: boolean; inBundle?: boolean; integrity?: string; resolved?: string };
+
+function requireRegistryArtifact(path: string, entry: LockEntry) {
+  assert(
+    entry.integrity?.startsWith("sha512-") &&
+      entry.resolved?.startsWith("https://registry.npmjs.org/"),
+    `Unverified registry dependency: ${path}`,
+  );
+}
+
+export function verifyLockProvenance(packages: Record<string, LockEntry>) {
+  for (const [path, entry] of Object.entries(packages)) {
+    if (!path.includes("node_modules/")) continue;
+    if (entry.link) {
+      assert(!entry.inBundle, `Bundled dependency cannot be a workspace link: ${path}`);
+      assert(
+        ["apps/site", "packages/ui"].includes(entry.resolved ?? ""),
+        "Unexpected workspace link",
+      );
+      continue;
+    }
+    let artifactPath = path;
+    let artifact = entry;
+    // npm extracts inBundle entries from their enclosing tarball. Its hash covers them.
+    while (artifact.inBundle) {
+      if (artifact.resolved !== undefined || artifact.integrity !== undefined)
+        requireRegistryArtifact(artifactPath, artifact);
+      const boundary = artifactPath.lastIndexOf("/node_modules/");
+      const parentPath = artifactPath.slice(0, boundary);
+      const parent = packages[parentPath];
+      assert(
+        boundary > 0 && parent && !parent.link,
+        `Bundled dependency has no registry package ancestor: ${path}`,
+      );
+      artifactPath = parentPath;
+      artifact = parent;
+    }
+    requireRegistryArtifact(artifactPath, artifact);
+  }
+}
+
 async function policy() {
   assert.equal(
     process.version,
@@ -258,23 +299,7 @@ async function policy() {
   }
   const lock = await json(join(root, "package-lock.json"));
   assert.equal(lock.lockfileVersion, 3);
-  for (const [path, entry] of Object.entries(lock.packages) as [
-    string,
-    { link?: boolean; integrity?: string; resolved?: string },
-  ][]) {
-    if (!path.includes("node_modules/")) continue;
-    if (entry.link)
-      assert(
-        ["apps/site", "packages/ui"].includes(entry.resolved ?? ""),
-        "Unexpected workspace link",
-      );
-    else
-      assert(
-        entry.integrity?.startsWith("sha512-") &&
-          entry.resolved?.startsWith("https://registry.npmjs.org/"),
-        `Unverified registry dependency: ${path}`,
-      );
-  }
+  verifyLockProvenance(lock.packages);
   assert.equal((await json(join(root, "wrangler.json"))).assets.not_found_handling, "404-page");
   assert.equal(
     (await json(join(root, "package.json"))).packageManager,