@kungfu-tech/buildchain 3.0.2-alpha.1 → 3.0.2-alpha.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (78) hide show
  1. package/README.md +4 -2
  2. package/actions/github-artifact-attestation/README.md +10 -0
  3. package/actions/promote-buildchain-ref/README.md +7 -0
  4. package/bin/buildchain.mjs +5 -0
  5. package/bin/internal/trust-release-cli.mjs +74 -3
  6. package/contracts/auditable-demo-media-profiles-v1.json +168 -0
  7. package/contracts/evidence/auditable-demo-web-delivery-v1.json +103 -0
  8. package/contracts/fixtures/auditable-demo-web-delivery-v1/complete-transcript.txt +2 -0
  9. package/contracts/fixtures/auditable-demo-web-delivery-v1/public-projection.json +16 -0
  10. package/contracts/fixtures/auditable-demo-web-delivery-v1/scene.json +12 -0
  11. package/dist/site/artifact-schemas.json +5 -1
  12. package/dist/site/buildchain-contract.json +103 -34
  13. package/dist/site/buildchain-site.json +159 -40
  14. package/dist/site/capability-registry.json +13 -12
  15. package/dist/site/cli-registry.json +12 -0
  16. package/dist/site/controller-registry.json +48 -4
  17. package/dist/site/kfd-claims.json +320 -20
  18. package/dist/site/kfd-upstream-aggregate.json +1 -1
  19. package/dist/site/manual-registry.json +24 -9
  20. package/dist/site/node-api-registry.json +75 -10
  21. package/dist/site/page-registry.json +135 -25
  22. package/dist/site/public-surface-audit.json +197 -21
  23. package/dist/site/publication-authority-registry.json +72 -2
  24. package/dist/site/publication-registry.json +4 -4
  25. package/dist/site/release-model.json +2 -1
  26. package/dist/site/release-passport-check-manifest.json +1 -0
  27. package/dist/site/release-provenance.json +5 -0
  28. package/dist/site/schemas/release-passport-v1.schema.json +6 -0
  29. package/dist/site/site-manifest.json +21 -13
  30. package/dist/site/workflow-registry.json +161 -13
  31. package/docs/MAP.md +5 -1
  32. package/docs/auditable-demo.md +55 -3
  33. package/docs/binary-distribution.md +7 -0
  34. package/docs/cli.md +9 -0
  35. package/docs/dev-alpha-candidate-patrol.md +111 -0
  36. package/docs/github-artifact-attestation.md +219 -0
  37. package/docs/release-governance.md +32 -0
  38. package/docs/release-passport.md +13 -0
  39. package/docs/reusable-build-surface.md +83 -61
  40. package/docs/runtime-train-validation.md +21 -0
  41. package/docs/versioning.md +1 -0
  42. package/package.json +7 -1
  43. package/packages/core/artifact-signing-result.js +228 -0
  44. package/packages/core/artifact-signing.js +412 -0
  45. package/packages/core/buildchain-config.js +58 -0
  46. package/packages/core/buildchain-contract.js +14 -0
  47. package/packages/core/buildchain-kfd-claims.js +5 -0
  48. package/packages/core/buildchain-publication-authority.js +3 -0
  49. package/packages/core/channel-candidate.js +186 -0
  50. package/packages/core/detached-artifact-signature.js +121 -0
  51. package/packages/core/github-artifact-attestation.js +642 -0
  52. package/packages/core/github-governance-authority.js +6 -0
  53. package/packages/core/index.js +52 -0
  54. package/packages/core/publication-authority.js +1 -1
  55. package/packages/core/release-passport-contract.js +2 -0
  56. package/packages/core/release-passport.js +60 -3
  57. package/scripts/auditable-demo.mjs +520 -28
  58. package/scripts/build-contract-core.mjs +31 -0
  59. package/scripts/buildchain-channel-router.mjs +8 -2
  60. package/scripts/check-inventory.mjs +9 -0
  61. package/scripts/create-github-artifact-attestation-policy.mjs +62 -0
  62. package/scripts/dev-alpha-candidate-patrol.mjs +864 -0
  63. package/scripts/dispatch-artifact-signing-authority.mjs +152 -0
  64. package/scripts/finalize-native-artifact-signing-result.mjs +96 -0
  65. package/scripts/generate-channel-promotion-workflow.mjs +6 -0
  66. package/scripts/generate-site-bundle.mjs +19 -0
  67. package/scripts/import-artifact-signing-results.mjs +76 -0
  68. package/scripts/inspect-artifact-signing-requests.mjs +101 -0
  69. package/scripts/materialize-artifact-signing-request.mjs +66 -0
  70. package/scripts/merge-artifact-signing-results.mjs +76 -0
  71. package/scripts/publish-github-artifact-attestation-evidence.mjs +201 -0
  72. package/scripts/release-candidate-resolver.mjs +12 -0
  73. package/scripts/release-line-policy.mjs +27 -0
  74. package/scripts/runtime-ref-core.mjs +10 -6
  75. package/scripts/seal-artifact-signing-requests.mjs +368 -0
  76. package/scripts/sign-detached-artifact-requests.mjs +237 -0
  77. package/scripts/stage-github-artifact-attestation-inputs.mjs +65 -0
  78. package/scripts/verify-artifact-signing-results.mjs +99 -0
package/dist/site/node-api-registry.json CHANGED
@@ -8,7 +8,7 @@
8
8
  "specifier": "@kungfu-tech/buildchain",
9
9
  "export": ".",
10
10
  "target": "./packages/core/index.js",
11
- "digest": "sha256:3274ea5fc0ce782bcaa29db5de5111b71198c7bee893e477c49dcceb61ee59cd",
11
+ "digest": "sha256:d9ae3dea43788f32b8a65bcc50044bb29fb268a354b5b1fe3558cb4250e2b83b",
12
12
  "summary": "Root toolkit export for Buildchain's public Node API.",
13
13
  "capabilityGroup": "api-cli-reference",
14
14
  "audience": [
@@ -47,7 +47,7 @@
47
47
  "specifier": "@kungfu-tech/buildchain/core",
48
48
  "export": "./core",
49
49
  "target": "./packages/core/index.js",
50
- "digest": "sha256:3274ea5fc0ce782bcaa29db5de5111b71198c7bee893e477c49dcceb61ee59cd",
50
+ "digest": "sha256:d9ae3dea43788f32b8a65bcc50044bb29fb268a354b5b1fe3558cb4250e2b83b",
51
51
  "summary": "Alias for the root public toolkit export.",
52
52
  "capabilityGroup": "api-cli-reference",
53
53
  "audience": [
@@ -82,6 +82,58 @@
82
82
  ],
83
83
  "maturity": "stable"
84
84
  },
85
+ {
86
+ "specifier": "@kungfu-tech/buildchain/github-artifact-attestation",
87
+ "export": "./github-artifact-attestation",
88
+ "target": "./packages/core/github-artifact-attestation.js",
89
+ "digest": "sha256:f71887cd7d73e11a763153720c6242e700ce49e66a6e5ca01ea6cf488948e265",
90
+ "summary": "GitHub keyless artifact attestation policy, predicate, provider evidence, and fail-closed verification APIs.",
91
+ "capabilityGroup": "release-passport-trust",
92
+ "audience": [
93
+ "developer",
94
+ "agent"
95
+ ],
96
+ "maturity": "stable"
97
+ },
98
+ {
99
+ "specifier": "@kungfu-tech/buildchain/artifact-signing",
100
+ "export": "./artifact-signing",
101
+ "target": "./packages/core/artifact-signing.js",
102
+ "digest": "sha256:2314a3858214ea7f573510208b97042545931d4b6c505575f62bc46168de757c",
103
+ "summary": "Credential-free artifact signing declarations, source-bound requests, authority receipts, profile resolution, and fail-closed validation APIs.",
104
+ "capabilityGroup": "reusable-build",
105
+ "audience": [
106
+ "developer",
107
+ "agent"
108
+ ],
109
+ "maturity": "stable"
110
+ },
111
+ {
112
+ "specifier": "@kungfu-tech/buildchain/artifact-signing-result",
113
+ "export": "./artifact-signing-result",
114
+ "target": "./packages/core/artifact-signing-result.js",
115
+ "digest": "sha256:6ae646862ccddb717f59d29549e518ca698cb56dc68556775b6bb49ae4b0435c",
116
+ "summary": "Immutable signed-result, final-payload, receipt, evidence-root, and provider-verification binding APIs.",
117
+ "capabilityGroup": "release-passport-trust",
118
+ "audience": [
119
+ "developer",
120
+ "agent"
121
+ ],
122
+ "maturity": "stable"
123
+ },
124
+ {
125
+ "specifier": "@kungfu-tech/buildchain/detached-artifact-signature",
126
+ "export": "./detached-artifact-signature",
127
+ "target": "./packages/core/detached-artifact-signature.js",
128
+ "digest": "sha256:336bc9e1386b2252ade7ce91af21eb2e53072768db4cb8f20c4e79b23c4fd945",
129
+ "summary": "Buildchain-authority Ed25519 detached signature and verification APIs for arbitrary binary artifacts.",
130
+ "capabilityGroup": "release-passport-trust",
131
+ "audience": [
132
+ "developer",
133
+ "agent"
134
+ ],
135
+ "maturity": "stable"
136
+ },
85
137
  {
86
138
  "specifier": "@kungfu-tech/buildchain/anchored-version-material",
87
139
  "export": "./anchored-version-material",
@@ -99,7 +151,7 @@
99
151
  "specifier": "@kungfu-tech/buildchain/buildchain-contract",
100
152
  "export": "./buildchain-contract",
101
153
  "target": "./packages/core/buildchain-contract.js",
102
- "digest": "sha256:5772ad10d66e8fbbc07c06f4df521c7d60b631b0505b47540ce05804bcb576b0",
154
+ "digest": "sha256:79a3b4109777e3e13ac936a04e09e2d71fd8f93f50544ead4d51ed41f3fdf3e8",
103
155
  "summary": "Runtime contract world and compatibility digest APIs for floating-ref drift checks.",
104
156
  "capabilityGroup": "governance-versioning",
105
157
  "audience": [
@@ -121,6 +173,19 @@
121
173
  ],
122
174
  "maturity": "stable"
123
175
  },
176
+ {
177
+ "specifier": "@kungfu-tech/buildchain/channel-candidate",
178
+ "export": "./channel-candidate",
179
+ "target": "./packages/core/channel-candidate.js",
180
+ "digest": "sha256:4f667440dc1d3df1663fba13afe68358aa3fc0c9316d1393e760bd932cec8a45",
181
+ "summary": "Exact-source channel candidate decisions, same-SHA workflow evidence validation, and deterministic source-lock reference APIs.",
182
+ "capabilityGroup": "governance-versioning",
183
+ "audience": [
184
+ "developer",
185
+ "agent"
186
+ ],
187
+ "maturity": "stable"
188
+ },
124
189
  {
125
190
  "specifier": "@kungfu-tech/buildchain/cache-evidence",
126
191
  "export": "./cache-evidence",
@@ -333,7 +398,7 @@
333
398
  "specifier": "@kungfu-tech/buildchain/publication-authority",
334
399
  "export": "./publication-authority",
335
400
  "target": "./packages/core/publication-authority.js",
336
- "digest": "sha256:10a33dae7768c9fced757c7d75c673adbd016b149064dce39d9f42df5c84073e",
401
+ "digest": "sha256:c1b9e696669d4e6ee661ec0528244509b6b0f832ec4fad16386344b90ad91367",
337
402
  "summary": "Sealed publication authority registry, runner provenance, control-plane audit, admission, and independent verification APIs.",
338
403
  "capabilityGroup": "release-passport-trust",
339
404
  "audience": [
@@ -359,7 +424,7 @@
359
424
  "specifier": "@kungfu-tech/buildchain/buildchain-publication-authority",
360
425
  "export": "./buildchain-publication-authority",
361
426
  "target": "./packages/core/buildchain-publication-authority.js",
362
- "digest": "sha256:85f524a61cfc9931cae24158f8ff718ef0eae3a2a839670ab01744cbdfdd10c3",
427
+ "digest": "sha256:0e5db6d66ed48d5eb57be1e4f1c3de92a2fc4c72a70b5764df6b21f78026a731",
363
428
  "summary": "Buildchain-owned closed-world publication authority descriptor registry.",
364
429
  "capabilityGroup": "release-passport-trust",
365
430
  "audience": [
@@ -372,7 +437,7 @@
372
437
  "specifier": "@kungfu-tech/buildchain/github-governance-authority",
373
438
  "export": "./github-governance-authority",
374
439
  "target": "./packages/core/github-governance-authority.js",
375
- "digest": "sha256:68f1bca0873f715f4909994c81a97bdc0559879972b1f2026d4e5bbdaf304251",
440
+ "digest": "sha256:548c64ca8f23945cdbdd6c06bc6ed85854a46ea308c490376a8736677d7c1936",
376
441
  "summary": "Fail-closed GitHub ownership, effective-policy, managed-zone admission, rollout-plan, and immutable receipt APIs.",
377
442
  "capabilityGroup": "governance-versioning",
378
443
  "audience": [
@@ -424,7 +489,7 @@
424
489
  "specifier": "@kungfu-tech/buildchain/release-passport",
425
490
  "export": "./release-passport",
426
491
  "target": "./packages/core/release-passport.js",
427
- "digest": "sha256:842f7f1e60a8de253225ada03cf238948ce527481eb640bc6f14c6cc0ef38880",
492
+ "digest": "sha256:aad90c2b39ce3fd7d2d4df5833f388c3090f5eeaecfd97d03276d375eed9459b",
428
493
  "summary": "Release passport collection, verification, explanation, and evidence APIs.",
429
494
  "capabilityGroup": "release-passport-trust",
430
495
  "audience": [
@@ -437,7 +502,7 @@
437
502
  "specifier": "@kungfu-tech/buildchain/release-passport-contract",
438
503
  "export": "./release-passport-contract",
439
504
  "target": "./packages/core/release-passport-contract.js",
440
- "digest": "sha256:5623da00b6355cfafc7564deb9206d36f7b2dafb24e29fec77c35deee5de5f6b",
505
+ "digest": "sha256:d633f8037d43db2c72662186f797d0914471540077d7163368c22779aae7eee9",
441
506
  "summary": "Standalone release passport JSON Schema, ownership/check manifest, and structural validation APIs.",
442
507
  "capabilityGroup": "release-passport-trust",
443
508
  "audience": [
@@ -489,7 +554,7 @@
489
554
  "specifier": "@kungfu-tech/buildchain/buildchain-kfd-claims",
490
555
  "export": "./buildchain-kfd-claims",
491
556
  "target": "./packages/core/buildchain-kfd-claims.js",
492
- "digest": "sha256:f3a719c64881e650a6ef68e3e0d4acd40878722b0eb76b88d30081db77ad92c8",
557
+ "digest": "sha256:14c595f8ab51f64c2fcde3c46729fe3ba6e7b20fcd89159780aa55e341013f75",
493
558
  "summary": "Buildchain self KFD claim registry, witnesses, and public claim APIs.",
494
559
  "capabilityGroup": "kfd-trust",
495
560
  "audience": [
@@ -503,7 +568,7 @@
503
568
  {
504
569
  "id": "cli-and-node-package",
505
570
  "path": "docs/cli.md",
506
- "digest": "sha256:47be88f5e5fd14124d03510b807722215034d34eefcebdfe2599a310350b7697"
571
+ "digest": "sha256:49da688f9f8b726a9169a3e4b246cb6ef07c6c626ea15c22f0b26ba1a37a58b4"
507
572
  },
508
573
  {
509
574
  "id": "build-facts",