@kungfu-tech/buildchain 2.11.14-alpha.1 → 2.11.14-alpha.2

package/scripts/publication-registry-hydrate.mjs

@@ -0,0 +1,216 @@
+#!/usr/bin/env node
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { loadBuildchainConfig } from "../packages/core/buildchain-config.js";
+
+const DEFAULT_REGISTRY = "https://registry.npmjs.org/";
+
+function semverParts(value) {
+  const match = String(value || "")
+    .trim()
+    .match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/);
+  if (!match) return undefined;
+  return {
+    core: match.slice(1, 4).map(Number),
+    prerelease: match[4] ? match[4].split(".") : [],
+  };
+}
+
+export function compareSemver(left, right) {
+  const a = semverParts(left);
+  const b = semverParts(right);
+  if (!a || !b) throw new Error(`invalid semver comparison: ${left}, ${right}`);
+  for (let index = 0; index < 3; index += 1) {
+    if (a.core[index] !== b.core[index]) return a.core[index] - b.core[index];
+  }
+  if (a.prerelease.length === 0 || b.prerelease.length === 0) {
+    return a.prerelease.length === b.prerelease.length
+      ? 0
+      : a.prerelease.length === 0
+        ? 1
+        : -1;
+  }
+  const length = Math.max(a.prerelease.length, b.prerelease.length);
+  for (let index = 0; index < length; index += 1) {
+    const av = a.prerelease[index];
+    const bv = b.prerelease[index];
+    if (av === undefined || bv === undefined) return av === undefined ? -1 : 1;
+    if (av === bv) continue;
+    const an = /^\d+$/.test(av);
+    const bn = /^\d+$/.test(bv);
+    if (an && bn) return Number(av) - Number(bv);
+    if (an !== bn) return an ? -1 : 1;
+    return av.localeCompare(bv);
+  }
+  return 0;
+}
+
+function run(command, args, options = {}) {
+  return execFileSync(command, args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    ...options,
+  }).trim();
+}
+
+function packageVersions(packageName, registry, commandRunner) {
+  try {
+    const output = commandRunner("npm", [
+      "view",
+      packageName,
+      "versions",
+      "--json",
+      `--registry=${registry}`,
+    ]);
+    const parsed = JSON.parse(output || "[]");
+    return Array.isArray(parsed) ? parsed : parsed ? [parsed] : [];
+  } catch (error) {
+    const detail = [error?.message, error?.stderr, error?.stdout]
+      .filter(Boolean)
+      .join("\n");
+    if (/E404|404 Not Found|is not in this registry/i.test(detail)) {
+      return [];
+    }
+    throw error;
+  }
+}
+
+export function hydratePublishedPublicationRegistry({
+  cwd = process.cwd(),
+  outputDir = ".buildchain/publication/registry-inputs",
+  evidencePath = ".buildchain/publication/registry-hydration.json",
+  registry = DEFAULT_REGISTRY,
+  commandRunner = run,
+} = {}) {
+  const resolvedCwd = path.resolve(cwd);
+  const config = loadBuildchainConfig(resolvedCwd).config;
+  const packageName =
+    config.publish?.package || config.publish?.mainPackage || "";
+  const currentVersion = config.publication?.version || "";
+  const registryPath = config.publication?.archive?.registryPath || "";
+  const resolvedOutputDir = path.resolve(resolvedCwd, outputDir);
+  fs.rmSync(resolvedOutputDir, { recursive: true, force: true });
+  fs.mkdirSync(resolvedOutputDir, { recursive: true });
+  if (!packageName || !currentVersion || !registryPath) {
+    return {
+      status: "not-configured",
+      packageName,
+      currentVersion,
+      inputDir: path
+        .relative(resolvedCwd, resolvedOutputDir)
+        .split(path.sep)
+        .join("/"),
+      sources: [],
+    };
+  }
+  const publishedVersions = packageVersions(
+    packageName,
+    registry,
+    commandRunner,
+  )
+    .filter(
+      (version) =>
+        semverParts(version) && compareSemver(version, currentVersion) < 0,
+    )
+    .sort(compareSemver);
+  const sources = [];
+  for (const version of publishedVersions) {
+    const packageDir = path.join(resolvedOutputDir, `.package-${version}`);
+    fs.mkdirSync(packageDir, { recursive: true });
+    const packed = JSON.parse(
+      commandRunner(
+        "npm",
+        [
+          "pack",
+          `${packageName}@${version}`,
+          "--json",
+          "--ignore-scripts",
+          "--pack-destination",
+          packageDir,
+          `--registry=${registry}`,
+        ],
+        { cwd: resolvedCwd },
+      ),
+    );
+    const pack = Array.isArray(packed) ? packed[0] : packed;
+    if (!pack?.filename || !pack?.integrity) {
+      throw new Error(
+        `npm pack did not report filename and integrity for ${packageName}@${version}`,
+      );
+    }
+    const tarball = path.resolve(packageDir, pack.filename);
+    const archiveRegistryPath = `package/${registryPath}`;
+    const archiveEntries = commandRunner("tar", ["-tzf", tarball]).split(/\r?\n/);
+    if (!archiveEntries.includes(archiveRegistryPath)) {
+      sources.push({
+        package: packageName,
+        version,
+        integrity: pack.integrity,
+        status: "registry-not-present",
+      });
+      continue;
+    }
+    const target = path.join(resolvedOutputDir, `${version}.json`);
+    const registryJson = commandRunner("tar", ["-xOzf", tarball, archiveRegistryPath]);
+    fs.writeFileSync(target, `${registryJson}\n`);
+    sources.push({
+      package: packageName,
+      version,
+      integrity: pack.integrity,
+      status: "accepted-input",
+      registryPath: path
+        .relative(resolvedCwd, target)
+        .split(path.sep)
+        .join("/"),
+    });
+  }
+  for (const entry of fs.readdirSync(resolvedOutputDir)) {
+    if (entry.startsWith(".package-")) {
+      fs.rmSync(path.join(resolvedOutputDir, entry), {
+        recursive: true,
+        force: true,
+      });
+    }
+  }
+  const evidence = {
+    schemaVersion: 1,
+    contract: "kungfu-buildchain-publication-registry-hydration",
+    status: sources.some((source) => source.status === "accepted-input")
+      ? "hydrated"
+      : "bootstrap",
+    authentication: "npm-registry-https-plus-package-integrity",
+    registry,
+    packageName,
+    currentVersion,
+    inputDir: path
+      .relative(resolvedCwd, resolvedOutputDir)
+      .split(path.sep)
+      .join("/"),
+    sources,
+  };
+  const resolvedEvidencePath = path.resolve(resolvedCwd, evidencePath);
+  fs.mkdirSync(path.dirname(resolvedEvidencePath), { recursive: true });
+  fs.writeFileSync(
+    resolvedEvidencePath,
+    `${JSON.stringify(evidence, null, 2)}\n`,
+  );
+  return evidence;
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  try {
+    const cwdIndex = process.argv.indexOf("--cwd");
+    const result = hydratePublishedPublicationRegistry({
+      cwd: cwdIndex === -1 ? process.cwd() : process.argv[cwdIndex + 1],
+    });
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  } catch (error) {
+    console.error(`publication-registry-hydrate: ${error.message}`);
+    process.exitCode = 1;
+  }
+}

package/scripts/run-lifecycle-core.mjs

@@ -446,6 +446,9 @@ export function runLifecycle({
 
   if (command.trim()) {
     commandSource = "workflow-input";
+    const lifecycle = loadedConfig?.config?.lifecycle || {};
+    const configuredStage = stageName ? lifecycle[stageName] : undefined;
+    const commandShell = configuredStage?.shell || true;
     const startedAt = Date.now();
     userLog.info("lifecycle.command.start", {
       attributes: {
@@ -457,6 +460,8 @@ export function runLifecycle({
     try {
       const commandEnv = {
         ...process.env,
+        ...(lifecycle.env || {}),
+        ...(configuredStage?.env || {}),
         ...(resolvedLogPath
           ? {
               BUILDCHAIN_LOG_PATH: resolvedLogPath,
@@ -469,7 +474,7 @@ export function runLifecycle({
           command,
           cwd: resolvedCwd,
           env: commandEnv,
-          shell: true,
+          shell: commandShell,
           label: `lifecycle-${stageName || "command"}`,
           processSummaryPath: resolvedProcessSummaryPath,
           processSamplesPath: resolvedProcessSamplesPath,
@@ -480,7 +485,7 @@ export function runLifecycle({
         execSync(command, {
           cwd: resolvedCwd,
           env: commandEnv,
-          shell: true,
+          shell: commandShell,
           stdio: "inherit",
         });
       }

package/scripts/web-surface-core.mjs

@@ -1099,6 +1099,33 @@ export function planWebSurfaceDeploy({
   };
 }
 
+export function verifyWebSurfaceArtifactChannelFacts({ cwd = process.cwd(), plan } = {}) {
+  const resolvedPlan = assertDeployPlan(plan);
+  const artifactRoot = path.resolve(cwd, resolvedPlan.artifact.path);
+  const expectedHosts = new Set((resolvedPlan.manifest?.surfaceBindings || []).map((binding) => {
+    try { return new URL(binding.url).host; } catch { return ""; }
+  }).filter(Boolean));
+  const observed = [];
+  for (const filePath of listFiles(artifactRoot, artifactRoot).filter((entry) => entry.endsWith(".json"))) {
+    let value;
+    try { value = JSON.parse(fs.readFileSync(filePath, "utf8")); } catch { continue; }
+    if (!value || typeof value !== "object" || Array.isArray(value) || !String(value.contract || "").includes("manifest")) continue;
+    const facts = [];
+    if (typeof value.canonicalHost === "string" && value.canonicalHost.trim()) facts.push({ field: "canonicalHost", host: value.canonicalHost.trim() });
+    if (Array.isArray(value.pages)) {
+      for (const [index, page] of value.pages.entries()) {
+        if (typeof page?.host === "string" && page.host.trim()) facts.push({ field: `pages[${index}].host`, host: page.host.trim() });
+      }
+    }
+    for (const fact of facts) observed.push({ path: toPosix(path.relative(cwd, filePath)), ...fact });
+  }
+  const mismatches = observed.filter((fact) => !expectedHosts.has(fact.host));
+  if (mismatches.length > 0) {
+    throw new Error(`web-surface artifact channel facts mismatch for ${resolvedPlan.channel}: ${mismatches.map((fact) => `${fact.path}#${fact.field}=${fact.host}`).join(", ")}`);
+  }
+  return { channel: resolvedPlan.channel, expectedHosts: [...expectedHosts].sort(), observed };
+}
+
 export function applyWebSurfaceDeploy({
   cwd = process.cwd(),
   channel = "preview",
@@ -1125,6 +1152,7 @@ export function applyWebSurfaceDeploy({
         dryRun: true,
         deployedAt: appliedAt,
       });
+  verifyWebSurfaceArtifactChannelFacts({ cwd, plan: resolvedPlan });
   const loadedConfig = loadBuildchainConfig(cwd);
   const config = assertWebSurfaceConfig(loadedConfig);
   const deployConfig = config.deploy?.[resolvedPlan.channel];