@kungfu-tech/buildchain 2.11.10 → 2.11.11-alpha.1

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.11.10",
+    "version": "2.11.11-alpha.1",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -235,7 +235,7 @@
         "release-state SHA is recorded as a durable audit entrance"
       ],
       "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
-      "auditDigest": "sha256:f458470154bed291a4adcd703f0fe810897d95d4e939793da676cc526a5a80bb"
+      "auditDigest": "sha256:8d5a050df580d9bb7bbf3300b8fa4d22df8478bc1028de08b5af7a902d38448d"
     },
     {
       "contractVersion": 1,
@@ -284,7 +284,7 @@
         "prose-only public claims downgrade the release trust passport audit"
       ],
       "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
-      "auditDigest": "sha256:f458470154bed291a4adcd703f0fe810897d95d4e939793da676cc526a5a80bb"
+      "auditDigest": "sha256:8d5a050df580d9bb7bbf3300b8fa4d22df8478bc1028de08b5af7a902d38448d"
     },
     {
       "contractVersion": 1,
@@ -456,9 +456,9 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:1cda1562ba9b386200aa9ae5b5c349ee921e4dbff9419c868b8af33754a7e424"
+      "auditDigest": "sha256:e9f0e3de042dfa569990493c31e089173a8f49dbf30b3b6177f9a587305ab5dd"
     }
   ],
   "compatibilityDigest": "sha256:967df7e854fdf582294ddfb6403eff25c00db9518a24051e7d47cbd75527c785",
-  "contractDigest": "sha256:1dc9f204a2ef991935f064a7e3705115a916741b24737355ed22bacc24af5f8a"
+  "contractDigest": "sha256:247ee859aec524b408facb05f2229e53bdc2a1ef51cd6dadf572289cb3da6a0b"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-10T03:21:44.776Z",
-  "publishedAt": "2026-07-10T03:21:44.776Z",
+  "generatedAt": "2026-07-10T03:53:38.587Z",
+  "publishedAt": "2026-07-10T03:53:38.587Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "20774d17657b0c67b7728b6d3eec403bb251ece3",
+  "sourceRevision": "490349dd838357f1abe270cebffe89f5bcf905c4",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.10",
+    "version": "2.11.11-alpha.1",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.10",
+    "version": "2.11.11-alpha.1",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -216,7 +216,7 @@
       "specifier": "@kungfu-tech/buildchain/publication-package",
       "export": "./publication-package",
       "target": "./packages/core/publication-package.js",
-      "digest": "sha256:3c96b1a7483eda44c1a89a7af1a1b262fb40cce8a4bcf81f5ad048b69664db67",
+      "digest": "sha256:72ad7e591fd9e3fc06cc75930742653feb4e067df9fde7430d7481822d930429",
       "summary": "Publication npm package synthesis APIs for Buildchain-managed paper release presets.",
       "capabilityGroup": "reusable-build",
       "audience": [
@@ -255,7 +255,7 @@
       "specifier": "@kungfu-tech/buildchain/release-passport",
       "export": "./release-passport",
       "target": "./packages/core/release-passport.js",
-      "digest": "sha256:f458470154bed291a4adcd703f0fe810897d95d4e939793da676cc526a5a80bb",
+      "digest": "sha256:8d5a050df580d9bb7bbf3300b8fa4d22df8478bc1028de08b5af7a902d38448d",
       "summary": "Release passport collection, verification, explanation, and evidence APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-10T03:21:44.776Z",
-  "publishedAt": "2026-07-10T03:21:44.776Z",
+  "generatedAt": "2026-07-10T03:53:38.587Z",
+  "publishedAt": "2026-07-10T03:53:38.587Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "20774d17657b0c67b7728b6d3eec403bb251ece3",
+  "sourceRevision": "490349dd838357f1abe270cebffe89f5bcf905c4",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.10",
+    "version": "2.11.11-alpha.1",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-10T03:21:44.776Z",
-  "publishedAt": "2026-07-10T03:21:44.776Z",
+  "generatedAt": "2026-07-10T03:53:38.587Z",
+  "publishedAt": "2026-07-10T03:53:38.587Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "20774d17657b0c67b7728b6d3eec403bb251ece3",
+  "sourceRevision": "490349dd838357f1abe270cebffe89f5bcf905c4",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.10",
+    "version": "2.11.11-alpha.1",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.11.10",
+  "version": "2.11.11-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/publication-package.js

@@ -17,6 +17,23 @@ function readJson(filePath) {
   return JSON.parse(fs.readFileSync(filePath, "utf8"));
 }
 
+function sourceRepositoryMetadata(sourcePackage) {
+  const repository = sourcePackage.repository;
+  if (typeof repository === "string") {
+    return repository.trim() || undefined;
+  }
+  if (
+    repository &&
+    typeof repository === "object" &&
+    !Array.isArray(repository) &&
+    typeof repository.url === "string" &&
+    repository.url.trim()
+  ) {
+    return { ...repository, url: repository.url.trim() };
+  }
+  return undefined;
+}
+
 function copyFilePreservingPath({ cwd, outputDir, relPath, copied }) {
   const source = path.resolve(cwd, relPath);
   if (!fs.existsSync(source) || !fs.statSync(source).isFile()) {
@@ -142,12 +159,19 @@ export function preparePublicationNpmPackage({
   const sourcePackage = fs.existsSync(path.join(resolvedCwd, "package.json"))
     ? readJson(path.join(resolvedCwd, "package.json"))
     : {};
+  const repository = sourceRepositoryMetadata(sourcePackage);
+  if (facts.package.auth === "trusted-publishing" && !repository) {
+    throw new Error(
+      "publication npm package with trusted-publishing requires source package.json repository metadata",
+    );
+  }
   const packageJson = {
     name: facts.package.name,
     version: facts.package.version,
     private: false,
     description: `${facts.publication.title} publication artifact package.`,
     license: sourcePackage.license || "UNLICENSED",
+    repository,
     type: "module",
     files: [
       ".buildchain/publication/",

package/packages/core/release-passport.js

@@ -364,6 +364,9 @@ function mergeAuthoritativeImpactBase(impact, basePassport = undefined) {
     return impact;
   }
   const merged = { ...impact };
+  if (optionalString(impact?.release?.version)) {
+    return merged;
+  }
   if (basePassport.versionImpact && typeof basePassport.versionImpact === "object" && !Array.isArray(basePassport.versionImpact)) {
     merged.versionImpact = {
       ...(impact.versionImpact && typeof impact.versionImpact === "object" && !Array.isArray(impact.versionImpact) ? impact.versionImpact : {}),