@kungfu-tech/buildchain 2.12.7-alpha.12 → 2.12.7-alpha.14

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.12",
+    "version": "2.12.7-alpha.14",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -1930,7 +1930,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:3f76502666069c2727d23efcfdb08fb80f89ced1955a69e29f11525ae88aca1d",
-      "auditDigest": "sha256:53dfff0c1fbe8b8a06a7536d4f1dee30829db35c266d2b180c8c3ce3f3678b84"
+      "auditDigest": "sha256:f83405748e500d31a237240438f7f410c1bb2b4ef39ab7323131fa54f38c1a59"
     },
     {
       "contractVersion": 1,
@@ -2674,5 +2674,5 @@
     }
   ],
   "compatibilityDigest": "sha256:af162b86ab4506e9b5f1d3c59b41f3fd57fbad79ff4d749a7f12ff16460517f8",
-  "contractDigest": "sha256:923a59dab80c05c75371d7bf9f5b3248bc534fa618102a64b5af374a8ca132cd"
+  "contractDigest": "sha256:74f2c7d82a73953aea28bcfb254627068e09def983d12a454d9edec33953db1c"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-15T03:41:26.618Z",
-  "publishedAt": "2026-07-15T03:41:26.618Z",
+  "generatedAt": "2026-07-15T04:39:13.621Z",
+  "publishedAt": "2026-07-15T04:39:13.621Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "9cc5ad9800e3fe0421628ec8caefe48192e7e82a",
+  "sourceRevision": "4c1508ab38cceec6d181a1a220690a3608d19749",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.12",
+    "version": "2.12.7-alpha.14",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.12",
+    "version": "2.12.7-alpha.14",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-15T03:41:26.618Z",
-  "publishedAt": "2026-07-15T03:41:26.618Z",
+  "generatedAt": "2026-07-15T04:39:13.621Z",
+  "publishedAt": "2026-07-15T04:39:13.621Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "9cc5ad9800e3fe0421628ec8caefe48192e7e82a",
+  "sourceRevision": "4c1508ab38cceec6d181a1a220690a3608d19749",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.12",
+    "version": "2.12.7-alpha.14",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-15T03:41:26.618Z",
-  "publishedAt": "2026-07-15T03:41:26.618Z",
+  "generatedAt": "2026-07-15T04:39:13.621Z",
+  "publishedAt": "2026-07-15T04:39:13.621Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "9cc5ad9800e3fe0421628ec8caefe48192e7e82a",
+  "sourceRevision": "4c1508ab38cceec6d181a1a220690a3608d19749",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.12",
+    "version": "2.12.7-alpha.14",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.12.7-alpha.12",
+  "version": "2.12.7-alpha.14",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/publication-artifact-candidate.mjs

@@ -22,27 +22,16 @@ function requiredFlag(name) {
   return value;
 }
 
-function filesNamed(root, name) {
-  const matches = [];
-  const pending = [path.resolve(root)];
-  while (pending.length > 0) {
-    const current = pending.pop();
-    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
-      const full = path.join(current, entry.name);
-      if (entry.isDirectory()) pending.push(full);
-      else if (entry.isFile() && entry.name === name) matches.push(full);
-    }
+function exactJson(root, relativePath) {
+  const absoluteRoot = path.resolve(root);
+  const absolutePath = path.resolve(absoluteRoot, relativePath);
+  if (!absolutePath.startsWith(`${absoluteRoot}${path.sep}`)) {
+    throw new Error(`publication evidence path escapes artifact root: ${relativePath}`);
   }
-  return matches.sort();
-}
-
-function oneJson(root, name) {
-  const matches = filesNamed(root, name);
-  if (matches.length !== 1)
-    throw new Error(
-      `expected exactly one ${name} under ${root}, found ${matches.length}`,
-    );
-  return JSON.parse(fs.readFileSync(matches[0], "utf8"));
+  if (!fs.existsSync(absolutePath) || !fs.statSync(absolutePath).isFile()) {
+    throw new Error(`expected publication evidence at ${relativePath}`);
+  }
+  return JSON.parse(fs.readFileSync(absolutePath, "utf8"));
 }
 
 function collectFiles(root) {
@@ -84,12 +73,15 @@ export function buildPublicationArtifactCandidate({
     sourceSha,
     sourceTreeSha,
     runtimeSha,
-    manifest: oneJson(resolvedArtifactRoot, "publication-artifact.json"),
-    passport: oneJson(
+    manifest: exactJson(
+      resolvedArtifactRoot,
+      ".buildchain/publication/publication-artifact.json",
+    ),
+    passport: exactJson(
       resolvedArtifactRoot,
-      "publication-artifact-passport.json",
+      ".buildchain/publication/publication-artifact-passport.json",
     ),
-    controllerReceipt: oneJson(resolvedControllerRoot, "receipt.json"),
+    controllerReceipt: exactJson(resolvedControllerRoot, "receipt.json"),
     files: collectFiles(resolvedArtifactRoot),
   };
   const candidate = createPublicationArtifactCandidate(evidence);