@kungfu-tech/buildchain 2.8.17 → 2.9.0

package/README.md

@@ -101,6 +101,8 @@ Repositories can also generate README status badges from Buildchain-owned facts
 instead of hand-maintaining badge Markdown:
 
 ```bash
+buildchain badges bundle --check
+buildchain badges bundle --write
 buildchain badges readme --check
 buildchain badges readme --write
 ```

package/bin/buildchain.mjs

@@ -31,9 +31,12 @@ import {
   verifyArtifactPassport,
 } from "../packages/core/artifact-passport.js";
 import {
+  checkBadgeBundleBlock,
   checkReadmeBadgeBlock,
+  collectBadgeBundleFacts,
   collectReadmeBadgeFacts,
   readReadme,
+  updateBadgeBundleBlock,
   updateReadmeBadgeBlock,
 } from "../packages/core/readme-badges.js";
 import {
@@ -50,6 +53,13 @@ import {
   summarizeProcessSamples,
   validateAnchoredPackageRelease,
 } from "../packages/core/diagnostics.js";
+import {
+  aggregateBuildFacts,
+  collectModuleBuildFacts,
+  verifyBuildFacts,
+  writeBuildFacts,
+  writeKungfuBuildInfoProjection,
+} from "../packages/core/build-facts.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const embeddedPackageVersion = process.env.BUILDCHAIN_EMBEDDED_PACKAGE_VERSION || "";
@@ -86,6 +96,7 @@ function usage() {
                                     [--anchor-manifest-json <json-or-path>]
                                     [--impact-json <json-or-path>]
                                     [--build-summary-json <json-or-path>]
+                                    [--build-facts-json <json-or-path>]...
                                     [--platform-manifest-json <json-or-path>]...
                                     [--dist-tag-evidence-json <json-or-path>]
                                     [--kfd-1-witness-json <json-or-path>]...
@@ -116,6 +127,13 @@ function usage() {
   buildchain log summary [--path <jsonl>] [--json]
   buildchain diagnostics summary <diagnostics.json>... [--artifact <file>]...
                                       [--output <file>] [--json]
+  buildchain facts module [--cwd <dir>] [--module <id>] [--module-root <path>]
+                          [--version-source <id>] [--output <file>]
+                          [--output-path <path>]... [--legacy-kungfu-buildinfo <file>] [--json]
+  buildchain facts aggregate [--cwd <dir>] [--product <id>]
+                             [--module-fact <file>]... [--artifact <path>]...
+                             [--output <file>] [--json]
+  buildchain facts verify [--cwd <dir>] --fact <file> [--json]
   buildchain sample process-tree [--interval-ms <n>] [--label <name>]
                                  [--output <jsonl>] [--summary-output <json>]
                                  [--requested-parallelism <n>] [--json]
@@ -128,6 +146,7 @@ function usage() {
   buildchain infra-contract ...
   buildchain release-propagation <plan|write-lock> ...
   buildchain badges readme [--cwd <dir>] [--readme <path>] [--check] [--write] [--json]
+  buildchain badges bundle [--cwd <dir>] [--readme <path>] [--claims <csv>] [--check] [--write] [--json]
   buildchain homebrew update-formula --package <name> --release-passport <file-or-url> [--write] [--json]
   buildchain homebrew check [--cwd <dir>] [--package <name>] [--release-passport <file-or-url>] [--json]
   buildchain publish-source <lock|manifest|verify-lock|verify-channel-ref|validate-anchored-release> ...
@@ -294,13 +313,20 @@ function writeJsonFile(filePath, value) {
 
 async function runReadmeBadgesCli(args = []) {
   const [subcommand = "", surface = "", ...badgeArgs] = args;
-  if (subcommand !== "readme" || (surface && surface.startsWith("--") === false)) {
-    throw new Error("usage: buildchain badges readme [--cwd <dir>] [--readme <path>] [--check] [--write] [--json]");
+  if (!["readme", "bundle"].includes(subcommand) || (surface && surface.startsWith("--") === false)) {
+    throw new Error("usage: buildchain badges <readme|bundle> [--cwd <dir>] [--readme <path>] [--claims <csv>] [--check] [--write] [--json]");
   }
   const effectiveArgs = surface ? [surface, ...badgeArgs] : badgeArgs;
   const cwd = path.resolve(readFlag(effectiveArgs, "cwd", process.cwd()));
   const readmePath = readFlag(effectiveArgs, "readme", "README.md");
-  const facts = await collectReadmeBadgeFacts({ cwd });
+  const claims = readFlag(effectiveArgs, "claims", "");
+  const isBundle = subcommand === "bundle";
+  const facts = isBundle
+    ? await collectBadgeBundleFacts({ cwd, claims })
+    : await collectReadmeBadgeFacts({ cwd });
+  const checkBlock = isBundle ? checkBadgeBundleBlock : checkReadmeBadgeBlock;
+  const updateBlock = isBundle ? updateBadgeBundleBlock : updateReadmeBadgeBlock;
+  const commandLabel = `buildchain badges ${subcommand}`;
   if (readBooleanFlag(effectiveArgs, "json") && !readBooleanFlag(effectiveArgs, "check") && !readBooleanFlag(effectiveArgs, "write")) {
     printJson(facts);
     return;
@@ -309,13 +335,13 @@ async function runReadmeBadgesCli(args = []) {
   if (!readmeText) {
     throw new Error(`README not found: ${path.join(cwd, readmePath)}`);
   }
-  const check = checkReadmeBadgeBlock({ readmeText, facts });
+  const check = checkBlock({ readmeText, facts });
   if (readBooleanFlag(effectiveArgs, "write")) {
-    const next = updateReadmeBadgeBlock({ readmeText, facts });
+    const next = updateBlock({ readmeText, facts });
     fs.writeFileSync(path.join(cwd, readmePath), next);
     const result = {
       schemaVersion: 1,
-      contract: "kungfu-buildchain-readme-badge-write",
+      contract: isBundle ? "kungfu-buildchain-badge-bundle-write" : "kungfu-buildchain-readme-badge-write",
       ok: true,
       changed: next !== readmeText,
       readmePath,
@@ -324,7 +350,7 @@ async function runReadmeBadgesCli(args = []) {
     if (readBooleanFlag(effectiveArgs, "json")) {
       printJson(result);
     } else {
-      process.stdout.write(`buildchain badges readme: ${result.changed ? "updated" : "current"}\n`);
+      process.stdout.write(`${commandLabel}: ${result.changed ? "updated" : "current"}\n`);
     }
     return;
   }
@@ -332,7 +358,7 @@ async function runReadmeBadgesCli(args = []) {
     if (readBooleanFlag(effectiveArgs, "json")) {
       printJson(check);
     } else {
-      process.stdout.write(`buildchain badges readme: ${check.ok ? "ok" : "failed"}\n`);
+      process.stdout.write(`${commandLabel}: ${check.ok ? "ok" : "failed"}\n`);
       if (!check.ok) {
         process.stdout.write(`${check.message}\n`);
       }
@@ -417,6 +443,85 @@ async function runHomebrewCli(args = []) {
   throw new Error("usage: buildchain homebrew <update-formula|check> ...");
 }
 
+async function runBuildFactsCli(args = []) {
+  const [subcommand = "", ...factArgs] = args;
+  const cwd = path.resolve(readFlag(factArgs, "cwd", process.cwd()));
+  if (subcommand === "module") {
+    const fact = collectModuleBuildFacts({
+      cwd,
+      moduleId: readFlag(factArgs, "module", ""),
+      moduleRoot: readFlag(factArgs, "module-root", ""),
+      versionSourceId: readFlag(factArgs, "version-source", ""),
+      outputs: readRepeatedFlag(factArgs, "output-path"),
+      lifecycle: readFlag(factArgs, "lifecycle", ""),
+      platform: readFlag(factArgs, "platform", "") || undefined,
+    });
+    const output = readFlag(factArgs, "output", "");
+    const writeResult = output ? writeBuildFacts({ cwd, fact, output }) : undefined;
+    const legacyOutput = readFlag(factArgs, "legacy-kungfu-buildinfo", "");
+    const legacyProjection = legacyOutput
+      ? writeKungfuBuildInfoProjection({ cwd, moduleFact: fact, output: legacyOutput })
+      : undefined;
+    const result = {
+      ...fact,
+      ...(writeResult ? { written: writeResult } : {}),
+      ...(legacyProjection ? { legacyProjection: { path: legacyProjection.path, digest: legacyProjection.digest } } : {}),
+    };
+    if (readBooleanFlag(factArgs, "json") || !output) {
+      printJson(result);
+    } else {
+      process.stdout.write(`buildchain facts module: ${fact.verification.ok ? "ok" : "failed"} ${writeResult.path}\n`);
+    }
+    if (!fact.verification.ok) {
+      process.exitCode = 1;
+    }
+    return;
+  }
+  if (subcommand === "aggregate") {
+    const fact = aggregateBuildFacts({
+      cwd,
+      productId: readFlag(factArgs, "product", ""),
+      moduleFacts: readRepeatedFlag(factArgs, "module-fact"),
+      artifacts: readRepeatedFlag(factArgs, "artifact"),
+    });
+    const output = readFlag(factArgs, "output", "");
+    const writeResult = output ? writeBuildFacts({ cwd, fact, output }) : undefined;
+    const result = {
+      ...fact,
+      ...(writeResult ? { written: writeResult } : {}),
+    };
+    if (readBooleanFlag(factArgs, "json") || !output) {
+      printJson(result);
+    } else {
+      process.stdout.write(`buildchain facts aggregate: ${fact.verification.ok ? "ok" : "failed"} ${writeResult.path}\n`);
+    }
+    if (!fact.verification.ok) {
+      process.exitCode = 1;
+    }
+    return;
+  }
+  if (subcommand === "verify") {
+    const factPath = readFlag(factArgs, "fact", "");
+    if (!factPath) {
+      throw new Error("usage: buildchain facts verify --fact <file>");
+    }
+    const result = verifyBuildFacts({ cwd, factPath });
+    if (readBooleanFlag(factArgs, "json")) {
+      printJson(result);
+    } else {
+      process.stdout.write(`buildchain facts verify: ${result.ok ? "ok" : "failed"}\n`);
+      for (const issue of result.issues) {
+        process.stdout.write(`- ${issue.level}: ${issue.id}: ${issue.message}\n`);
+      }
+    }
+    if (!result.ok) {
+      process.exitCode = 1;
+    }
+    return;
+  }
+  throw new Error("usage: buildchain facts <module|aggregate|verify> ...");
+}
+
 function appendJsonLine(filePath, value) {
   if (!filePath) {
     return "";
@@ -697,6 +802,11 @@ async function main(argv = process.argv.slice(2)) {
     return;
   }
 
+  if (command === "facts") {
+    await runBuildFactsCli(args);
+    return;
+  }
+
   if (command === "sample") {
     const [subcommand = "", ...sampleArgs] = args;
     if (subcommand !== "process-tree") {
@@ -878,6 +988,7 @@ async function main(argv = process.argv.slice(2)) {
       anchorManifestJson: readFlag(collectArgs, "anchor-manifest-json", ""),
       impactJson: readFlag(collectArgs, "impact-json", ""),
       buildSummaryJson: readFlag(collectArgs, "build-summary-json", ""),
+      buildFactsJsons: readRepeatedFlag(collectArgs, "build-facts-json"),
       platformManifestJsons: readRepeatedFlag(collectArgs, "platform-manifest-json"),
       distTagEvidenceJson: readFlag(collectArgs, "dist-tag-evidence-json", ""),
       kfd1WitnessJsons: readRepeatedFlag(collectArgs, "kfd-1-witness-json"),

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "2.8.17",
+    "version": "2.9.0",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v2",
@@ -235,7 +235,7 @@
         "release-state SHA is recorded as a durable audit entrance"
       ],
       "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
-      "auditDigest": "sha256:e4a79237c0363b60fe084393068f6bc7da526bb9c5912b60d747b75364506b32"
+      "auditDigest": "sha256:ce36cc21cfd3e0508a2a816292863dc2e11f19146b2624ef066fc9aaa4f4190e"
     },
     {
       "contractVersion": 1,
@@ -284,7 +284,7 @@
         "prose-only public claims downgrade the release trust passport audit"
       ],
       "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
-      "auditDigest": "sha256:e4a79237c0363b60fe084393068f6bc7da526bb9c5912b60d747b75364506b32"
+      "auditDigest": "sha256:ce36cc21cfd3e0508a2a816292863dc2e11f19146b2624ef066fc9aaa4f4190e"
     },
     {
       "contractVersion": 1,
@@ -344,7 +344,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:b7cd109f1c81166fb912eced4b6d9aaa838ac537242197efd221e209da638d79"
+      "auditDigest": "sha256:114de9f5a2cd5602bec3ff7599aae1a09858ff53a96b562ebe542d501d37eb46"
     },
     {
       "contractVersion": 1,
@@ -412,7 +412,7 @@
         "CLI and JavaScript callers use the same Node API implementation"
       ],
       "breakingDigest": "sha256:bcd72ad6dfba8013c96f8b2f7b0a307d2e7713972a1219348f0d5ecc493939a0",
-      "auditDigest": "sha256:35c42750bbdede7d85b71444d1d09cd6c7ce40ecd8868c86d869855764dad0c2"
+      "auditDigest": "sha256:3d4b61918f31a24de8fb11b15a9544df2c9696f6bd8c7efb1e373f0745cb3ce0"
     },
     {
       "contractVersion": 1,
@@ -434,7 +434,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:f3bb661b2260d2be500d8707bdb01b623e8125cdb36e874dc217bc0873422b39"
+      "auditDigest": "sha256:cd21906acf183b9f5b456f7013581dd55e493b904551f00475cf6ea2f0030098"
     },
     {
       "contractVersion": 1,
@@ -456,9 +456,9 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:b92a9b199a69ac78e55da9bc28e6bd2922233861b70205a2de45eed65cfc81c6"
+      "auditDigest": "sha256:10855957c6eac44c41c59518e1d1310e6efd735ed3b5e1eddff4f98296352717"
     }
   ],
   "compatibilityDigest": "sha256:407d6d5ee6a96a34d2cc30db9ac64cf4b1819ab6d77bd7a57a07a124f22101ca",
-  "contractDigest": "sha256:590724458a59dfed521c876c24cedec43124409b4be79f4ce839ce26ce9f98de"
+  "contractDigest": "sha256:45c8a3198664e76e58ff881befcac450a7db6cfd6bffb5bcd3db747a895c551e"
 }