# Tasks — enterprise-slsa

> Closed 2026-04-19 — landed alongside this change; all tasks completed unless noted.

## Package scaffolding

- [x] Move from `src/lib/*.ts` flat layout to co-located four-file
      feature modules.
- [x] Rewrite `package.json` with per-feature subpath `exports`.
- [x] Rewrite `vite.config.ts` for preserveModules + workspace externals.
- [x] Drop legacy `tsconfig.json`; keep `tsconfig.lib.json` only.
- [x] Rewrite `vitest.config.ts` with istanbul provider and
      polyfills setup file.
- [x] Create `tests/setup/polyfills.ts` to polyfill WebCrypto under
      Node.

## Dependencies

- [x] Add `@suaveplan/error` (workspace).
- [x] Add `@suaveplan/types` (workspace).
- [x] Add `@suaveplan/crypto` (workspace).
- [x] Add `@suaveplan/crypto-hash` (workspace).
- [x] Add `@suaveplan/crypto-utils` (workspace).
- [x] Add `@suaveplan/serialize` (workspace).
- [x] Add `@opentelemetry/api` (catalog:observability).
- [x] Add `zod` (catalog:forms).

## Errors

- [x] Create `SLSA_CODES` registry via `defineCodes`.
- [x] Create `SlsaError` base class.
- [x] Create `InvalidProvenanceError`.
- [x] Create `InvalidSbomError`.
- [x] Create `VerificationFailedError`.
- [x] Create `PolicyViolationError`.
- [x] Create `RekorUploadError`.
- [x] Create `RekorInclusionError`.
- [x] Create `AttestationInvalidError`.
- [x] Create `EnvironmentUnsupportedError`.
- [x] Co-located tests, md, and barrel.

## Schemas

- [x] Provenance schemas (`ProvenanceStatementSchema` and descendants).
- [x] SBOM schemas (`SbomSchema`, `SbomInputSchema`, components).
- [x] Verification schemas (`VerificationPolicySchema`,
      `VerificationResultSchema`, assessment).
- [x] Attestation schemas (`DsseEnvelopeSchema`, `RekorEntrySchema`,
      `InclusionProofSchema`).
- [x] `parseProvenance` / `parseSbom` with structured error output.
- [x] `parseProvenance` / `parseSbom` tests.

## OTel

- [x] `SlsaEventAttributes` typed attribute bag.
- [x] `SlsaOtelAdapter` interface + `createSlsaOtelAdapter` factory.
- [x] `noopSlsaOtelAdapter` default.
- [x] Co-located tests, md.

## Provenance

- [x] `canonicalize` (sorted-key JSON).
- [x] `computeDigest` via `@suaveplan/crypto-hash`.
- [x] `generateProvenance` with Zod-compatible inputs.
- [x] Validation via structured errors.
- [x] `serializeProvenance`, `hashProvenance`.
- [x] OTel `slsa.provenance.generated` event wiring.
- [x] Co-located tests, md.

## Verification

- [x] Split `checks.ts` rule file.
- [x] Add `checkBuildAge`, `checkSourceRepoPrefix`, `allowedBuilders`.
- [x] `verifyProvenance` with injectable clock and OTel adapter.
- [x] Co-located tests, md.

## SBOM

- [x] `generateSbom` with injectable clock + serial.
- [x] Structured `InvalidSbomError` on missing fields.
- [x] `serializeSbom`, `hashSbom`, `buildPurl`.
- [x] Co-located tests, md.

## Assessment

- [x] `assessSlsaLevel` with optional Rekor inclusion signal.
- [x] `detectEnvironment` reading `SLSA_*` env vars.
- [x] Co-located tests, md.

## Attestation (DSSE)

- [x] `encodeDssePae` per DSSE spec.
- [x] `wrapInDsse`.
- [x] `verifyDsseEnvelope` (ed25519, keyid scoping).
- [x] Co-located tests, md.

## Rekor

- [x] `verifyRfc6962InclusionProof` with odd-size carry-up.
- [x] `rfc6962LeafHash` utility.
- [x] `RekorClient` with injectable `fetch`.
- [x] `uploadHashedrekord` v0.0.1.
- [x] `uploadIntoto` v0.0.2 (computes payload sha256 automatically).
- [x] `getEntryByUuid`, `getEntryByLogIndex`.
- [x] `verifyInclusionProof` emits
      `slsa.rekor.inclusion_verified` OTel event.
- [x] Response envelope flattening + Zod validation.
- [x] Co-located tests (no live Rekor), md.

## Policy

- [x] `evaluatePolicy` layering provenance verification + DSSE
      signatures + Rekor inclusion + min SLSA level.
- [x] OTel `slsa.policy.violation` on failures.
- [x] Co-located tests, md.

## Docs

- [x] Co-located `.md` for every `.ts` implementation file.
- [x] Root `README.md` rewritten with Modules section.

## Verification

- [x] `bunx turbo typecheck --filter=@suaveplan/slsa` green.
- [x] `bunx turbo lint --filter=@suaveplan/slsa` green.
- [x] `bunx turbo test --filter=@suaveplan/slsa` green (170 tests).
- [x] `bunx turbo test:coverage --filter=@suaveplan/slsa` meets 95%
      threshold on every axis.
- [x] `bunx turbo build --filter=@suaveplan/slsa` green.