@kungfu-tech/buildchain 2.11.13 → 2.11.14-alpha.1

package/bin/buildchain.mjs

@@ -180,6 +180,9 @@ function usage() {
   buildchain kfd 2 schema [--schema <name>] [--json]
   buildchain kfd 2 taxonomy --entry-json <file-or-json>... [--kind residualRisk|downgradeReason] [--json]
   buildchain kfd 2 claims [--cwd <dir>] [--output-dir <dir>] [--json]
+  buildchain kfd 2 product-claims <check|write|render> [--cwd <dir>] [--registry <path>]
+                                      [--output-dir <dir>] [--version <version>]
+                                      [--channel <channel>] [--tag <tag>] [--source-sha <sha>] [--json]
   buildchain kfd 2 trust-claims [--claims-json <file-or-json>] [--json]
   buildchain kfd 2 trust-assessment [--assessment-json <file-or-json>] [--json]
   buildchain kfd 3 ...
@@ -779,6 +782,34 @@ function runKfd2Cli(args = []) {
     }
     return;
   }
+  if (action === "product-claims") {
+    const mode = !rest[0] || rest[0].startsWith("--") ? "check" : rest[0];
+    const productArgs = mode === rest[0] ? rest.slice(1) : rest;
+    const options = {
+      cwd,
+      ...(readFlag(productArgs, "registry", "") ? { registryPath: readFlag(productArgs, "registry", "") } : {}),
+      ...(readFlag(productArgs, "output-dir", "") ? { outputDir: readFlag(productArgs, "output-dir", "") } : {}),
+      version: readFlag(productArgs, "version", ""),
+      channel: readFlag(productArgs, "channel", ""),
+      tag: readFlag(productArgs, "tag", ""),
+      sourceSha: readFlag(productArgs, "source-sha", ""),
+    };
+    let result;
+    if (mode === "check") result = kfd2.checkProductClaimOutputs(options);
+    else if (mode === "write") result = kfd2.writeProductClaimOutputs(options);
+    else if (mode === "render") result = kfd2.renderProductClaimOutputs(options);
+    else throw new Error("usage: buildchain kfd 2 product-claims <check|write|render> ...");
+    if (json || mode === "render") {
+      printJson(result);
+    } else {
+      process.stdout.write(`kfd 2 product-claims ${mode}: ${result.ok ? "ok" : "failed"} (${result.summary.claimCount} claims, ${result.status || "rendered"})\n`);
+      for (const entry of result.issues || []) {
+        process.stdout.write(`- ${entry.level || "error"}: ${entry.code}: ${entry.message}\n`);
+      }
+    }
+    if (!result.ok) process.exitCode = 1;
+    return;
+  }
   if (action === "trust-claims") {
     const document = readFlag(rest, "claims-json", "")
       ? readJsonInput(readFlag(rest, "claims-json", ""), { cwd, label: "kfd-2 trust claims" })
@@ -823,7 +854,7 @@ function runKfd2Cli(args = []) {
     }
     return;
   }
-  throw new Error("usage: buildchain kfd 2 <schema|taxonomy|claims|trust-claims|trust-assessment> ...");
+  throw new Error("usage: buildchain kfd 2 <schema|taxonomy|claims|product-claims|trust-claims|trust-assessment> ...");
 }
 
 async function runKfdCli(args = []) {

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.11.13",
+    "version": "2.11.14-alpha.1",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -92,7 +92,7 @@
         "GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
       ],
       "breakingDigest": "sha256:403d2fcdb0c5eabe749e89102defad69745f70a1556707bec7831fcc2e9fa8f8",
-      "auditDigest": "sha256:1d12801725d7fb1849be6eb92bf4b08842c0260f3a2a09c87548870a3c50ae3e"
+      "auditDigest": "sha256:9e5def8447c148bdbb14029fe1ea77b055b9a61483dceee1e080ac03e08d7ec0"
     },
     {
       "contractVersion": 1,
@@ -344,7 +344,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:c41e3e069f70d038537fc7d399eabb01bc33873cc361e20798cac7a7c9ce3e31"
+      "auditDigest": "sha256:5431da4333bb46ed59a8f3ed3abc3c8595140e3159cb72529bff17042d2d8467"
     },
     {
       "contractVersion": 1,
@@ -434,7 +434,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:8a609696e6fa8ff6be710ea9649054b9ce257f24014e0fcced0a7e7e41e7825b"
+      "auditDigest": "sha256:a79631837d756175e5f3c1071b72b6c1b11c2bdd6f32a082191a0d3a944c99b9"
     },
     {
       "contractVersion": 1,
@@ -456,9 +456,9 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:e9f0e3de042dfa569990493c31e089173a8f49dbf30b3b6177f9a587305ab5dd"
+      "auditDigest": "sha256:4754455d100bb473a24d084920a84b165e3203f9bbb34ee1c6cc5eca230d22b5"
     }
   ],
   "compatibilityDigest": "sha256:967df7e854fdf582294ddfb6403eff25c00db9518a24051e7d47cbd75527c785",
-  "contractDigest": "sha256:ccaf30dea1fc96675059498ccac0f8095b8ddf8669f7387380cfbfcb694d44c4"
+  "contractDigest": "sha256:7ccbfa755ce856b1610da1ca509eb995e1d5a243a61302b1f9025fa291be6356"
 }