@kungfu-tech/buildchain 2.12.7-alpha.13 → 2.12.7-alpha.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/site/buildchain-contract.json +2 -2
  2. package/dist/site/buildchain-site.json +4 -4
  3. package/dist/site/kfd-upstream-aggregate.json +1 -1
  4. package/dist/site/publication-registry.json +4 -4
  5. package/dist/site/site-manifest.json +4 -4
  6. package/package.json +1 -1
  7. package/scripts/publication-artifact-candidate.mjs +16 -24
package/dist/site/buildchain-contract.json CHANGED
@@ -4,7 +4,7 @@
4
4
  "product": {
5
5
  "name": "Buildchain",
6
6
  "package": "@kungfu-tech/buildchain",
7
- "version": "2.12.7-alpha.13",
7
+ "version": "2.12.7-alpha.14",
8
8
  "repository": "https://github.com/kungfu-systems/buildchain"
9
9
  },
10
10
  "majorLine": "v2",
@@ -2674,5 +2674,5 @@
2674
2674
  }
2675
2675
  ],
2676
2676
  "compatibilityDigest": "sha256:af162b86ab4506e9b5f1d3c59b41f3fd57fbad79ff4d749a7f12ff16460517f8",
2677
- "contractDigest": "sha256:65ee05202d5669fcff10dc1559ac11d41a7aa78be3b2e43f1cdb5c9061552145"
2677
+ "contractDigest": "sha256:74f2c7d82a73953aea28bcfb254627068e09def983d12a454d9edec33953db1c"
2678
2678
  }
package/dist/site/buildchain-site.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 1,
3
3
  "contract": "kungfu-buildchain-site-bundle",
4
- "generatedAt": "2026-07-15T04:11:46.237Z",
5
- "publishedAt": "2026-07-15T04:11:46.237Z",
4
+ "generatedAt": "2026-07-15T04:39:13.621Z",
5
+ "publishedAt": "2026-07-15T04:39:13.621Z",
6
6
  "reproducible": true,
7
7
  "timestampPolicy": "ci-injected",
8
8
  "deterministicInputs": [
@@ -19,7 +19,7 @@
19
19
  "declared Buildchain surface manifest contract"
20
20
  ],
21
21
  "sourceDateEpoch": "0",
22
- "sourceRevision": "436ed91a40bdbf1d49bda0adf5da5ee148e2603e",
22
+ "sourceRevision": "4c1508ab38cceec6d181a1a220690a3608d19749",
23
23
  "timestampPolicyDetails": {
24
24
  "contract": "kungfu-buildchain-surface-timestamp-policy",
25
25
  "timestampFields": [
@@ -37,7 +37,7 @@
37
37
  },
38
38
  "package": {
39
39
  "name": "@kungfu-tech/buildchain",
40
- "version": "2.12.7-alpha.13",
40
+ "version": "2.12.7-alpha.14",
41
41
  "versionSource": "package.json#version"
42
42
  },
43
43
  "source": {
package/dist/site/kfd-upstream-aggregate.json CHANGED
@@ -4,7 +4,7 @@
4
4
  "product": {
5
5
  "id": "kungfu-tech-buildchain",
6
6
  "name": "@kungfu-tech/buildchain",
7
- "version": "2.12.7-alpha.13",
7
+ "version": "2.12.7-alpha.14",
8
8
  "repository": "https://github.com/kungfu-systems/buildchain"
9
9
  },
10
10
  "source": {
package/dist/site/publication-registry.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 1,
3
3
  "contract": "kungfu-buildchain-publication-release-registry",
4
- "generatedAt": "2026-07-15T04:11:46.237Z",
5
- "publishedAt": "2026-07-15T04:11:46.237Z",
4
+ "generatedAt": "2026-07-15T04:39:13.621Z",
5
+ "publishedAt": "2026-07-15T04:39:13.621Z",
6
6
  "reproducible": true,
7
7
  "timestampPolicy": "ci-injected",
8
8
  "deterministicInputs": [
@@ -19,7 +19,7 @@
19
19
  "declared Buildchain surface manifest contract"
20
20
  ],
21
21
  "sourceDateEpoch": "0",
22
- "sourceRevision": "436ed91a40bdbf1d49bda0adf5da5ee148e2603e",
22
+ "sourceRevision": "4c1508ab38cceec6d181a1a220690a3608d19749",
23
23
  "timestampPolicyDetails": {
24
24
  "contract": "kungfu-buildchain-surface-timestamp-policy",
25
25
  "timestampFields": [
@@ -32,7 +32,7 @@
32
32
  },
33
33
  "package": {
34
34
  "name": "@kungfu-tech/buildchain",
35
- "version": "2.12.7-alpha.13",
35
+ "version": "2.12.7-alpha.14",
36
36
  "versionSource": "package.json#version"
37
37
  },
38
38
  "sourceKind": "package-site-bundle",
package/dist/site/site-manifest.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 1,
3
3
  "contract": "kungfu-buildchain-site-manifest",
4
- "generatedAt": "2026-07-15T04:11:46.237Z",
5
- "publishedAt": "2026-07-15T04:11:46.237Z",
4
+ "generatedAt": "2026-07-15T04:39:13.621Z",
5
+ "publishedAt": "2026-07-15T04:39:13.621Z",
6
6
  "reproducible": true,
7
7
  "timestampPolicy": "ci-injected",
8
8
  "deterministicInputs": [
@@ -19,7 +19,7 @@
19
19
  "declared Buildchain surface manifest contract"
20
20
  ],
21
21
  "sourceDateEpoch": "0",
22
- "sourceRevision": "436ed91a40bdbf1d49bda0adf5da5ee148e2603e",
22
+ "sourceRevision": "4c1508ab38cceec6d181a1a220690a3608d19749",
23
23
  "timestampPolicyDetails": {
24
24
  "contract": "kungfu-buildchain-surface-timestamp-policy",
25
25
  "timestampFields": [
@@ -37,7 +37,7 @@
37
37
  },
38
38
  "package": {
39
39
  "name": "@kungfu-tech/buildchain",
40
- "version": "2.12.7-alpha.13",
40
+ "version": "2.12.7-alpha.14",
41
41
  "versionSource": "package.json#version"
42
42
  },
43
43
  "entrypoint": "buildchain-site.json",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@kungfu-tech/buildchain",
3
- "version": "2.12.7-alpha.13",
3
+ "version": "2.12.7-alpha.14",
4
4
  "private": false,
5
5
  "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
6
6
  "repository": "https://github.com/kungfu-systems/buildchain",
package/scripts/publication-artifact-candidate.mjs CHANGED
@@ -22,27 +22,16 @@ function requiredFlag(name) {
22
22
  return value;
23
23
  }
24
24
 
25
- function filesNamed(root, name) {
26
- const matches = [];
27
- const pending = [path.resolve(root)];
28
- while (pending.length > 0) {
29
- const current = pending.pop();
30
- for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
31
- const full = path.join(current, entry.name);
32
- if (entry.isDirectory()) pending.push(full);
33
- else if (entry.isFile() && entry.name === name) matches.push(full);
34
- }
25
+ function exactJson(root, relativePath) {
26
+ const absoluteRoot = path.resolve(root);
27
+ const absolutePath = path.resolve(absoluteRoot, relativePath);
28
+ if (!absolutePath.startsWith(`${absoluteRoot}${path.sep}`)) {
29
+ throw new Error(`publication evidence path escapes artifact root: ${relativePath}`);
35
30
  }
36
- return matches.sort();
37
- }
38
-
39
- function oneJson(root, name) {
40
- const matches = filesNamed(root, name);
41
- if (matches.length !== 1)
42
- throw new Error(
43
- `expected exactly one ${name} under ${root}, found ${matches.length}`,
44
- );
45
- return JSON.parse(fs.readFileSync(matches[0], "utf8"));
31
+ if (!fs.existsSync(absolutePath) || !fs.statSync(absolutePath).isFile()) {
32
+ throw new Error(`expected publication evidence at ${relativePath}`);
33
+ }
34
+ return JSON.parse(fs.readFileSync(absolutePath, "utf8"));
46
35
  }
47
36
 
48
37
  function collectFiles(root) {
@@ -84,12 +73,15 @@ export function buildPublicationArtifactCandidate({
84
73
  sourceSha,
85
74
  sourceTreeSha,
86
75
  runtimeSha,
87
- manifest: oneJson(resolvedArtifactRoot, "publication-artifact.json"),
88
- passport: oneJson(
76
+ manifest: exactJson(
77
+ resolvedArtifactRoot,
78
+ ".buildchain/publication/publication-artifact.json",
79
+ ),
80
+ passport: exactJson(
89
81
  resolvedArtifactRoot,
90
- "publication-artifact-passport.json",
82
+ ".buildchain/publication/publication-artifact-passport.json",
91
83
  ),
92
- controllerReceipt: oneJson(resolvedControllerRoot, "receipt.json"),
84
+ controllerReceipt: exactJson(resolvedControllerRoot, "receipt.json"),
93
85
  files: collectFiles(resolvedArtifactRoot),
94
86
  };
95
87
  const candidate = createPublicationArtifactCandidate(evidence);