@kungfu-tech/buildchain 2.12.7-alpha.8 → 2.12.7-alpha.9

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.8",
+    "version": "2.12.7-alpha.9",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -549,7 +549,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:4af45bd66f45b92607ed69840834c57ff157f57c66fe65d1645a5e83eaca8108"
+      "auditDigest": "sha256:6cb094e42fb35ae6a3b166fbe179a4663f019737cd82bad6279ffaf690110737"
     },
     {
       "contractVersion": 1,
@@ -2674,5 +2674,5 @@
     }
   ],
   "compatibilityDigest": "sha256:af162b86ab4506e9b5f1d3c59b41f3fd57fbad79ff4d749a7f12ff16460517f8",
-  "contractDigest": "sha256:95e8044b7a42060dd0476f6a4957e810431d57e7982abbc4000c1693396498c7"
+  "contractDigest": "sha256:a773ef118ff98b52ff14a78b0bcc7efbda77d5e5e7a552a31fe6791a4c7d4d76"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-07-15T01:31:56.311Z",
-  "publishedAt": "2026-07-15T01:31:56.311Z",
+  "generatedAt": "2026-07-15T01:57:21.646Z",
+  "publishedAt": "2026-07-15T01:57:21.646Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "a2f11bfd2bae6539f0196ef8fd9571130a809918",
+  "sourceRevision": "eb671ea63ee94e0dc91adfa6e8f722e5acc5af45",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.8",
+    "version": "2.12.7-alpha.9",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.8",
+    "version": "2.12.7-alpha.9",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/node-api-registry.json

@@ -8,7 +8,7 @@
       "specifier": "@kungfu-tech/buildchain",
       "export": ".",
       "target": "./packages/core/index.js",
-      "digest": "sha256:1957a1a155a03d136bab9eedc7cf5f74ffcf23899684885217064a605d17bed3",
+      "digest": "sha256:07013ab68f7947772ec5bee502f97bae4b2c2f87235188f2f28f6fbb2dc5cb23",
       "summary": "Root toolkit export for Buildchain's public Node API.",
       "capabilityGroup": "api-cli-reference",
       "audience": [
@@ -47,7 +47,7 @@
       "specifier": "@kungfu-tech/buildchain/core",
       "export": "./core",
       "target": "./packages/core/index.js",
-      "digest": "sha256:1957a1a155a03d136bab9eedc7cf5f74ffcf23899684885217064a605d17bed3",
+      "digest": "sha256:07013ab68f7947772ec5bee502f97bae4b2c2f87235188f2f28f6fbb2dc5cb23",
       "summary": "Alias for the root public toolkit export.",
       "capabilityGroup": "api-cli-reference",
       "audience": [

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-15T01:31:56.311Z",
-  "publishedAt": "2026-07-15T01:31:56.311Z",
+  "generatedAt": "2026-07-15T01:57:21.646Z",
+  "publishedAt": "2026-07-15T01:57:21.646Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "a2f11bfd2bae6539f0196ef8fd9571130a809918",
+  "sourceRevision": "eb671ea63ee94e0dc91adfa6e8f722e5acc5af45",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.8",
+    "version": "2.12.7-alpha.9",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-15T01:31:56.311Z",
-  "publishedAt": "2026-07-15T01:31:56.311Z",
+  "generatedAt": "2026-07-15T01:57:21.646Z",
+  "publishedAt": "2026-07-15T01:57:21.646Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "a2f11bfd2bae6539f0196ef8fd9571130a809918",
+  "sourceRevision": "eb671ea63ee94e0dc91adfa6e8f722e5acc5af45",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.12.7-alpha.8",
+    "version": "2.12.7-alpha.9",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.12.7-alpha.8",
+  "version": "2.12.7-alpha.9",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/index.js

@@ -157,6 +157,7 @@ export {
   PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT,
   createPublicationArtifactCandidate,
   publicationArtifactCandidateDigest,
+  resolvePublicationCandidateFile,
 } from "./publication-artifact-candidate.js";
 
 export {

package/packages/core/publication-artifact-candidate.js

@@ -20,6 +20,18 @@ export function publicationArtifactCandidateDigest(value) {
   return crypto.createHash("sha256").update(stableJson(value)).digest("hex");
 }
 
+export function resolvePublicationCandidateFile(files = [], candidatePath) {
+  const normalizedPath = requiredString(candidatePath, "candidatePath").replaceAll("\\", "/");
+  if (normalizedPath.startsWith("/") || normalizedPath.split("/").includes("..")) {
+    throw new Error(`publication artifact candidate contains an unsafe path: ${normalizedPath}`);
+  }
+  const matches = files.filter((entry) => entry.path === normalizedPath);
+  if (matches.length !== 1) {
+    throw new Error(`expected exactly one publication candidate file at ${normalizedPath}, found ${matches.length}`);
+  }
+  return matches[0].path;
+}
+
 function requiredString(value, label) {
   const normalized = String(value || "").trim();
   if (!normalized) throw new Error(`${label} must be a non-empty string`);

package/scripts/publication-artifact-candidate.mjs

@@ -4,7 +4,12 @@ import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 
-import { createPublicationArtifactCandidate } from "../packages/core/publication-artifact-candidate.js";
+import {
+  createPublicationArtifactCandidate,
+  resolvePublicationCandidateFile,
+} from "../packages/core/publication-artifact-candidate.js";
+
+export { resolvePublicationCandidateFile };
 
 function flag(name, fallback = "") {
   const index = process.argv.indexOf(`--${name}`);