release: bridge legacy installations to ForgeFlow-Public

src/shared/release-policy.cjs

@@ -0,0 +1,27 @@
+'use strict';
+
+function windowsReleaseAssetNames(version) {
+  return [
+    ...['Setup', 'Portable'].flatMap((kind) => {
+      const name = `ForgeFlow-${kind}-${version}-win-x64.exe`;
+      return [name, `${name}.sha256`];
+    }),
+    `ForgeFlow-${version}-provenance.json`,
+    `ForgeFlow-${version}-sbom.cdx.json`,
+    `ForgeFlow-${version}-release-manifest.json`,
+    `ForgeFlow-${version}-release-manifest.json.sig`
+  ];
+}
+
+function existingReleaseState(release, version, commit) {
+  if (release.target_commitish !== commit) {
+    throw new Error(`Release v${version} already targets ${release.target_commitish}; refusing assets from ${commit}. Bump the version for a new source commit.`);
+  }
+  if (release.draft) return 'draft';
+  const names = new Set((release.assets || []).map((asset) => asset.name));
+  const missing = windowsReleaseAssetNames(version).filter((name) => !names.has(name));
+  if (missing.length) throw new Error(`Published release v${version} is missing: ${missing.join(', ')}.`);
+  return 'published';
+}
+
+module.exports = { windowsReleaseAssetNames, existingReleaseState };