Add npm release-date anachronism checks

[manrods]

Summary

• add a submit-only npm release-date check for a deliberately small audited package subset
• run it only after upload consent and the remote-visibility gate, and complete/abort it before identity lookup and upload
• preserve the exact bundle/schema/upload body while adding TTY/non-TTY disclosure, fail-open warnings, help text, docs, and privacy coverage

Closes #81.

Design

detected_skills records a slug but not which package or ecosystem produced it, so this PR does not infer npm provenance broadly. Instead, signatures/package-map.json adds an audited npmReleaseCheckPackages list for four unambiguous package keys:

• better-auth
• @lemonsqueezy/lemonsqueezy.js
• @paddle/paddle-js
• @paddle/paddle-node-sdk

The package-to-slug relationship still comes only from map; the new list does not detect skills. Tests require every map key for an eligible slug to be audited and exclude Tier 2-produced slugs.

The checker:

• requests the official full npm packument from the fixed registry.npmjs.org host
• reads only time.created
• requires complete valid dates for every mapped package reference for a slug
• uses strict canonical UTC/calendar validation and a strict earlier-than comparison
• allows at most 4 concurrent requests, 1.5 seconds per request, and 3 seconds globally
• awaits every started request before upload and fails open on all network/status/timeout/malformed/incomplete cases
• adds no cache and no dependency

Privacy boundary

Privacy gate: run

• Boundary question: YES — prior issue Anachronism check: detected skills vs library release dates #81
• New destination: registry.npmjs.org
• npm receives: selected public package names and standard connection data, including IP address
• npm never receives: source, paths, repository URL/remote, bundle, label, identity, Redential token, or Redential headers
• Schema: N/A — bundle and Redential upload payload are unchanged, as scoped in Anachronism check: detected skills vs library release dates #81
• npm test / npm run typecheck / npm run build: green
• Sweeps: clean, except the expected fixed https://registry.npmjs.org constant in the new checker module; that module contains no network primitive and production transport remains in allowlisted submit.ts/http-client.ts
• Dependencies/postinstall: no changes

Network order remains explicit:

confirmation → visibility gate → npm check → identity corroboration → bundle upload

Declining causes zero network calls. A confirmed-public remote blocks before npm. The exact reviewed JSON remains byte-for-byte equal to the uploaded body.

Output behavior

• TTY: disclosure appears after the private-label line and before the payload header; exact JSON remains immediately adjacent to the upload question.
• Non-TTY: stdout remains JSON-only and JSON-first; disclosure and any warning use stderr after confirmation/visibility.
• Warnings are non-blocking and acknowledge legitimate vendored/private-fork timelines.
• --confirm-upload help now states that it authorizes upload and subsequent eligible npm lookups.

Verification

• npm test — 54 files, 911 tests passed
• npm run typecheck — passed
• npm run build — passed
• git diff --check — clean
• mandatory sensitive-zone reviewer — VERDICT: APPROVED

No bundle field, schema file, taxonomy entry, Redential upload header/body, runtime dependency, or postinstall script changed.

[jpbelmo]

First: apologies for the three-day silence — you delivered same-day and deserved better; the binaries release consumed the repo. Second: this is one of the strongest first PRs this project has received. You resolved a tension the issue didn't even know about (our 0.13.0 zero-network-until-yes invariant landed after #81 was written, and your ordering — disclosure local and pre-consent, lookups strictly after the yes and even after the visibility gate — is exactly right), you strengthened the zero-network test beyond what we asked, and the audited-allowlist answer to the slug-vs-package gap is better design than the issue's own sketch.

One required change: rebase onto main — your CHANGELOG section collides with the 0.14.x releases that shipped while you waited (our fault, not yours). Two optional notes: a trailing newline in test/program.test.ts, and one docs sentence acknowledging that npm's time.created resets on unpublish/republish (harmless given warn-only, worth naming). Rebase and this merges through our standard gate.

[jpbelmo]

Merged. Fastest turnaround this repo has seen: review to rebase-with-every-optional-note in thirty minutes, on a first contribution that had already solved an invariant younger than your own PR. The disclosure-before-consent, lookups-after-yes ordering you chose is now part of how this repo thinks about network features. Issue #81's CLI half is done — welcome to the contributors list, and the server half will cite your design.

[manrods]

Thanks @jpbelmo for the kind words!