fix(release-service): compare declared access in canonical form

apps/release-service/src/verification/evaluate.ts

@@ -1,5 +1,11 @@
 import { safeParse } from "@atcute/lexicons";
-import { diffDeclaredAccess, type AccessDiff, type DeclaredAccess } from "@emdash-cms/plugin-types";
+import {
+	canonicalizeDeclaredAccess,
+	diffDeclaredAccess,
+	type AccessDiff,
+	type CanonicalDeclaredAccess,
+	type DeclaredAccess,
+} from "@emdash-cms/plugin-types";
 import { parseDelegatedReleaseSourceRecord } from "@emdash-cms/registry-client/release-service";
 import {
 	NSID,
@@ -260,8 +266,11 @@ function parseReleaseIntent(value: string): ReleaseIntentPayload | null {
 	return { release: parsed["release"] };
 }
 
-function equalJson(left: unknown, right: unknown): boolean {
-	return JSON.stringify(left) === JSON.stringify(right);
+function sameDeclaredAccess(record: CanonicalDeclaredAccess, manifest: unknown): boolean {
+	const parsed = safeParse(PackageReleaseExtension.declaredAccessSchema, manifest);
+	return (
+		parsed.ok && JSON.stringify(record) === JSON.stringify(canonicalizeDeclaredAccess(parsed.value))
+	);
 }
 
 async function digest(value: unknown): Promise<string> {
@@ -445,7 +454,10 @@ export async function evaluateVerifiedRelease(
 	});
 	if (!records.success) return failed("RECORD_INVALID", records.code);
 	if (
-		!equalJson(records.value.declaredAccess, verifierReport.value.artifact.manifest.declaredAccess)
+		!sameDeclaredAccess(
+			records.value.declaredAccess,
+			verifierReport.value.artifact.manifest.declaredAccess,
+		)
 	) {
 		return failed("ARTIFACT_RECORD_MISMATCH");
 	}

apps/release-service/test/verification-evaluate.test.ts

@@ -305,6 +305,36 @@ describe("verification evaluation", () => {
 		});
 	});
 
+	it("accepts a manifest whose declared access is not in canonical order", async () => {
+		const declaredAccess = {
+			content: { read: {} },
+			schema: { read: {} },
+			network: { request: { allowedHosts: ["b.example.com", "a.example.com"] } },
+		};
+		const release = proposedRelease();
+		release.extensions["com.emdashcms.experimental.package.releaseExtension"]!.declaredAccess =
+			structuredClone(declaredAccess);
+		const report = verifierReport();
+		if (!report.success) throw new Error("Expected successful fixture");
+		report.value.artifact.manifest.declaredAccess = structuredClone(declaredAccess);
+		const profile = structuredClone(profileFixture) as PackageProfile.Main & {
+			extensions: Record<string, { repository: string; releasePolicy?: Record<string, unknown> }>;
+		};
+		profile.extensions["com.emdashcms.experimental.package.profileExtension"]!.releasePolicy = {
+			approvers: ["did:plc:approver"],
+		};
+
+		await expect(
+			evaluateVerifiedRelease(
+				PUBLISHER_DID,
+				await intent(release),
+				snapshot(profile),
+				WORKLOAD_POLICY,
+				report,
+			),
+		).resolves.toMatchObject({ success: true });
+	});
+
 	it("requires approval when the signed profile says always", async () => {
 		const profile = structuredClone(profileFixture) as PackageProfile.Main & {
 			extensions: Record<string, { repository: string; releasePolicy?: Record<string, unknown> }>;
@@ -344,6 +374,18 @@ describe("verification evaluation", () => {
 				mismatched,
 			),
 		).resolves.toMatchObject({ success: false, code: "ARTIFACT_RECORD_MISMATCH" });
+		const malformed = normalizeVerifierReport(verifierReport());
+		if (!malformed.success) throw new Error("Expected successful fixture");
+		malformed.value.artifact.manifest.declaredAccess = "network";
+		await expect(
+			evaluateVerifiedRelease(
+				PUBLISHER_DID,
+				await intent(),
+				snapshot(),
+				WORKLOAD_POLICY,
+				malformed,
+			),
+		).resolves.toMatchObject({ success: false, code: "ARTIFACT_RECORD_MISMATCH" });
 	});
 
 	it.each([