@kungfu-tech/buildchain 2.11.8-alpha.1 → 2.11.8

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.11.8-alpha.1",
+    "version": "2.11.8",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -235,7 +235,7 @@
         "release-state SHA is recorded as a durable audit entrance"
       ],
       "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
-      "auditDigest": "sha256:e4218271c4e24ea9b4a5bab04b4d0364c92774075a07d474e05a234eaceae2b1"
+      "auditDigest": "sha256:188279a8b94e9e9de331936881329720deee6788c2e052ae9208e811945d4122"
     },
     {
       "contractVersion": 1,
@@ -284,7 +284,7 @@
         "prose-only public claims downgrade the release trust passport audit"
       ],
       "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
-      "auditDigest": "sha256:e4218271c4e24ea9b4a5bab04b4d0364c92774075a07d474e05a234eaceae2b1"
+      "auditDigest": "sha256:188279a8b94e9e9de331936881329720deee6788c2e052ae9208e811945d4122"
     },
     {
       "contractVersion": 1,
@@ -456,9 +456,9 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:7b380d62fe8844c8fbf8d9a233559bfffa1457e9d664ed1bbf46da87cf225d46"
+      "auditDigest": "sha256:db2738592b80be42f0ff3d2be1161fd09467cf45e9dc4bba7d039aea0808880b"
     }
   ],
   "compatibilityDigest": "sha256:967df7e854fdf582294ddfb6403eff25c00db9518a24051e7d47cbd75527c785",
-  "contractDigest": "sha256:a55c534c589ba36e1b9acec36c39db4923bd3c3c55fcbd956d1016510af35988"
+  "contractDigest": "sha256:9e3222825e5f3860d9e800588e8e2ce577f3ef275290953ac77268c1f7f5bd09"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-10T00:10:44.453Z",
-  "publishedAt": "2026-07-10T00:10:44.453Z",
+  "generatedAt": "2026-07-10T00:46:23.553Z",
+  "publishedAt": "2026-07-10T00:46:23.553Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "ea1c5e133772c99e31eb4d68fa459608598e66da",
+  "sourceRevision": "fee907db41bd64ca1523db86adcc241e51ffd507",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.8-alpha.1",
+    "version": "2.11.8",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.8-alpha.1",
+    "version": "2.11.8",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -255,7 +255,7 @@
       "specifier": "@kungfu-tech/buildchain/release-passport",
       "export": "./release-passport",
       "target": "./packages/core/release-passport.js",
-      "digest": "sha256:e4218271c4e24ea9b4a5bab04b4d0364c92774075a07d474e05a234eaceae2b1",
+      "digest": "sha256:188279a8b94e9e9de331936881329720deee6788c2e052ae9208e811945d4122",
       "summary": "Release passport collection, verification, explanation, and evidence APIs.",
       "capabilityGroup": "release-passport-trust",
       "audience": [

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-10T00:10:44.453Z",
-  "publishedAt": "2026-07-10T00:10:44.453Z",
+  "generatedAt": "2026-07-10T00:46:23.553Z",
+  "publishedAt": "2026-07-10T00:46:23.553Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "ea1c5e133772c99e31eb4d68fa459608598e66da",
+  "sourceRevision": "fee907db41bd64ca1523db86adcc241e51ffd507",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.8-alpha.1",
+    "version": "2.11.8",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-10T00:10:44.453Z",
-  "publishedAt": "2026-07-10T00:10:44.453Z",
+  "generatedAt": "2026-07-10T00:46:23.553Z",
+  "publishedAt": "2026-07-10T00:46:23.553Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "ea1c5e133772c99e31eb4d68fa459608598e66da",
+  "sourceRevision": "fee907db41bd64ca1523db86adcc241e51ffd507",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.11.8-alpha.1",
+    "version": "2.11.8",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.11.8-alpha.1",
+  "version": "2.11.8",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/release-passport.js

@@ -134,6 +134,26 @@ function readJsonFile(filePath) {
   return JSON.parse(fs.readFileSync(filePath, "utf8"));
 }
 
+function resolveJsonInputPath(input, { cwd = process.cwd() } = {}) {
+  const normalized = String(input || "").trim();
+  if (!normalized) {
+    return "";
+  }
+  if (path.isAbsolute(normalized)) {
+    return fs.existsSync(normalized) ? normalized : "";
+  }
+  const cwdCandidate = cwd ? path.resolve(cwd, normalized) : "";
+  if (cwdCandidate && fs.existsSync(cwdCandidate)) {
+    return cwdCandidate;
+  }
+  return fs.existsSync(normalized) ? path.resolve(normalized) : "";
+}
+
+function jsonInputError({ input, label, cwd, cause }) {
+  const suffix = cwd ? ` or an existing JSON file path relative to ${cwd}` : " or an existing JSON file path";
+  return new Error(`${label} must be valid JSON${suffix}; received ${JSON.stringify(input)}`, { cause });
+}
+
 function writeJsonFile(filePath, value) {
   fs.mkdirSync(path.dirname(filePath), { recursive: true });
   fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`);
@@ -252,30 +272,41 @@ function defaultLlmsText({ tag = "", passportPath = "buildchain.release.json" }
   ].join("\n");
 }
 
-function parseJsonInput(value, fallback = undefined) {
+function parseJsonInput(value, fallback = undefined, { cwd = process.cwd(), label = "JSON input" } = {}) {
   const input = String(value || "").trim();
   if (!input) {
     return fallback;
   }
-  if (fs.existsSync(input)) {
-    return readJsonFile(input);
+  const filePath = resolveJsonInputPath(input, { cwd });
+  if (filePath) {
+    return readJsonFile(filePath);
+  }
+  try {
+    return JSON.parse(input);
+  } catch (error) {
+    throw jsonInputError({ input, label, cwd, cause: error });
   }
-  return JSON.parse(input);
 }
 
-function parseJsonInputWithMeta(value, fallback = undefined) {
+function parseJsonInputWithMeta(value, fallback = undefined, { cwd = process.cwd(), label = "JSON input" } = {}) {
   const input = String(value || "").trim();
   if (!input) {
     return { value: fallback, path: "", sha256: "" };
   }
-  if (fs.existsSync(input)) {
+  const filePath = resolveJsonInputPath(input, { cwd });
+  if (filePath) {
     return {
-      value: readJsonFile(input),
+      value: readJsonFile(filePath),
       path: input,
-      sha256: sha256File(input),
+      sha256: sha256File(filePath),
     };
   }
-  const parsed = JSON.parse(input);
+  let parsed;
+  try {
+    parsed = JSON.parse(input);
+  } catch (error) {
+    throw jsonInputError({ input, label, cwd, cause: error });
+  }
   return {
     value: parsed,
     path: "",
@@ -1179,41 +1210,41 @@ export function collectGitHubReleasePassport({
   publishJson = "",
   workflow = {},
 } = {}) {
-  const release = parseJsonInput(releaseJson, {});
-  const releaseExtra = parseJsonInput(releaseJsonExtra, {});
-  const assetsFromJson = parseJsonInput(assetsJson, []);
-  const packageSet = parseJsonInput(packageSetJson, undefined);
-  const publishEvidenceMeta = parseJsonInputWithMeta(publishEvidenceJson, undefined);
-  const trustedPublishing = parseJsonInput(trustedPublishingJson, undefined);
-  const transactionMeta = parseJsonInputWithMeta(transactionJson, undefined);
-  const anchorManifest = normalizeAnchorManifest(parseJsonInputWithMeta(anchorManifestJson, undefined));
-  const impactMeta = parseJsonInputWithMeta(impactJson, undefined);
-  const buildSummaryMeta = parseJsonInputWithMeta(buildSummaryJson, undefined);
+  const release = parseJsonInput(releaseJson, {}, { cwd, label: "releaseJson" });
+  const releaseExtra = parseJsonInput(releaseJsonExtra, {}, { cwd, label: "releaseJsonExtra" });
+  const assetsFromJson = parseJsonInput(assetsJson, [], { cwd, label: "assetsJson" });
+  const packageSet = parseJsonInput(packageSetJson, undefined, { cwd, label: "packageSetJson" });
+  const publishEvidenceMeta = parseJsonInputWithMeta(publishEvidenceJson, undefined, { cwd, label: "publishEvidenceJson" });
+  const trustedPublishing = parseJsonInput(trustedPublishingJson, undefined, { cwd, label: "trustedPublishingJson" });
+  const transactionMeta = parseJsonInputWithMeta(transactionJson, undefined, { cwd, label: "transactionJson" });
+  const anchorManifest = normalizeAnchorManifest(parseJsonInputWithMeta(anchorManifestJson, undefined, { cwd, label: "anchorManifestJson" }));
+  const impactMeta = parseJsonInputWithMeta(impactJson, undefined, { cwd, label: "impactJson" });
+  const buildSummaryMeta = parseJsonInputWithMeta(buildSummaryJson, undefined, { cwd, label: "buildSummaryJson" });
   const buildFactMetas = (buildFactsJsons || [])
     .filter(Boolean)
-    .map((buildFactsJson) => parseJsonInputWithMeta(buildFactsJson, undefined))
+    .map((buildFactsJson) => parseJsonInputWithMeta(buildFactsJson, undefined, { cwd, label: "buildFactsJsons entry" }))
     .filter((meta) => meta.value);
   const platformManifestMetas = (platformManifestJsons || [])
     .filter(Boolean)
-    .map((manifestJson) => parseJsonInputWithMeta(manifestJson, undefined));
-  const distTagEvidenceMeta = parseJsonInputWithMeta(distTagEvidenceJson, undefined);
+    .map((manifestJson) => parseJsonInputWithMeta(manifestJson, undefined, { cwd, label: "platformManifestJsons entry" }));
+  const distTagEvidenceMeta = parseJsonInputWithMeta(distTagEvidenceJson, undefined, { cwd, label: "distTagEvidenceJson" });
   const kfd1WitnessMetas = (kfd1WitnessJsons || [])
     .filter(Boolean)
-    .map((witnessJson) => parseJsonInputWithMeta(witnessJson, undefined))
+    .map((witnessJson) => parseJsonInputWithMeta(witnessJson, undefined, { cwd, label: "kfd1WitnessJsons entry" }))
     .filter((meta) => meta.value);
   const kfd2ClaimMetas = (kfd2ClaimJsons || [])
     .filter(Boolean)
-    .map((claimJson) => parseJsonInputWithMeta(claimJson, undefined))
+    .map((claimJson) => parseJsonInputWithMeta(claimJson, undefined, { cwd, label: "kfd2ClaimJsons entry" }))
     .filter((meta) => meta.value);
   const kfd3PrebuildWitnessMetas = (kfd3PrebuildWitnessJsons || [])
     .filter(Boolean)
-    .map((witnessJson) => parseJsonInputWithMeta(witnessJson, undefined))
+    .map((witnessJson) => parseJsonInputWithMeta(witnessJson, undefined, { cwd, label: "kfd3PrebuildWitnessJsons entry" }))
     .filter((meta) => meta.value);
   const kfd3ArtifactWitnessMetas = (kfd3ArtifactWitnessJsons || [])
     .filter(Boolean)
-    .map((witnessJson) => parseJsonInputWithMeta(witnessJson, undefined))
+    .map((witnessJson) => parseJsonInputWithMeta(witnessJson, undefined, { cwd, label: "kfd3ArtifactWitnessJsons entry" }))
     .filter((meta) => meta.value);
-  const basePassportMeta = parseJsonInputWithMeta(basePassportJson, undefined);
+  const basePassportMeta = parseJsonInputWithMeta(basePassportJson, undefined, { cwd, label: "basePassportJson" });
   const kfd3ArtifactCommandMeta = parseJsonCommandOutput({
     command: kfd3ArtifactVerifyCommand,
     cwd,
@@ -1223,7 +1254,7 @@ export function collectGitHubReleasePassport({
     ...kfd3ArtifactWitnessMetas.map((meta) => meta.value),
     ...(kfd3ArtifactCommandMeta.value ? [kfd3ArtifactCommandMeta.value] : []),
   ];
-  const publish = parseJsonInput(publishJson, {});
+  const publish = parseJsonInput(publishJson, {}, { cwd, label: "publishJson" });
   const assets = [
     ...(Array.isArray(release.assets) ? release.assets : []),
     ...(Array.isArray(assetsFromJson) ? assetsFromJson : []),