@kungfu-tech/buildchain 3.0.2 → 3.0.3-alpha.1

package/packages/core/public-surface-audit.js

@@ -77,6 +77,9 @@ function commandId(first = "", second = "", third = "") {
   if (head === "publication-artifact") return "publication-artifact";
   if (head === "publication" && sub) return `publication-artifact-${sub}`;
   if (head === "publication") return "publication-artifact";
+  if (head === "paper" && sub === "bootstrap" && normalizedLeaf === "npm") return "paper-bootstrap-npm";
+  if (head === "paper" && sub) return `paper-${sub}`;
+  if (head === "paper") return "paper";
   if (head === "build-contract") return "build-contract";
   if (head === "infra-contract") return "infra-contract";
   if (head === "web-surface") return "web-surface";

package/packages/core/publication-artifact.js

@@ -253,7 +253,7 @@ export function createPublicationSourceBundle({
 } = {}) {
   const outputPath = path.resolve(cwd, output);
   fs.mkdirSync(path.dirname(outputPath), { recursive: true });
-  const paths = sourcePaths.length > 0 ? sourcePaths : ["."];
+  const paths = [...(sourcePaths.length > 0 ? sourcePaths : ["."])].sort();
   execFileSync("git", [
     "archive",
     "--format=tar.gz",
@@ -501,11 +501,6 @@ function mergePublicationRegistryVersions({ registries = [], publicationId }) {
     if (registry.publication?.id !== publicationId) {
       throw new Error(`publication archive registry id mismatch: expected ${publicationId}, got ${registry.publication?.id || "(missing)"}`);
     }
-    if (registry.historyPolicy === "cumulative-authenticated-hydration") {
-      const declaredVersions = new Set(registry.versions.map((record) => String(record?.version || "")));
-      const missingVersions = [...versions.keys()].filter((version) => !declaredVersions.has(version));
-      if (missingVersions.length > 0) throw new Error(`cumulative publication archive registry dropped accepted versions: ${missingVersions.join(", ")}`);
-    }
     for (const record of registry.versions) {
       const version = String(record?.version || "").trim();
       if (!version) throw new Error("publication archive registry record is missing version");

package/packages/core/publication-authority.js

@@ -649,6 +649,7 @@ function validatePublicationEvidence(publicationEvidence, admission) {
     platformMatrix: passport.platformMatrix,
     buildchain: passport.buildchain,
     ...(passport.gateProfileEvidence ? { gateProfileEvidence: passport.gateProfileEvidence } : {}),
+    ...(passport.familyEvidence ? { familyEvidence: passport.familyEvidence } : {}),
     ...(passport.controllerReceipts ? { controllerReceipts: passport.controllerReceipts } : {}),
   });
   if (normalizeDigest(passport.candidateHash, "releaseCandidatePassport.candidateHash") !== candidateHash) {

package/packages/core/publication-control-plane-audit.js

@@ -10,6 +10,34 @@ export const BUILDCHAIN_RELEASE_RECONCILIATION_PATHS = Object.freeze([
   "package.json",
 ]);
 
+function deploymentPatternExpression(pattern) {
+  let expression = "";
+  for (let index = 0; index < pattern.length; index += 1) {
+    const character = pattern[index];
+    if (character === "*") {
+      if (pattern[index + 1] === "*") {
+        expression += ".*";
+        index += 1;
+      } else {
+        expression += "[^/]*";
+      }
+    } else {
+      expression += character.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${expression}$`);
+}
+
+export function matchesGithubDeploymentPolicy(policy, { ref, refType = "branch" } = {}) {
+  const normalizedRef = String(ref || "");
+  const normalizedType = String(refType || "");
+  const policyName = String(policy?.name || "");
+  const policyType = String(policy?.type || "");
+  if (!normalizedRef || !["branch", "tag"].includes(normalizedType)) return false;
+  if (policyType !== normalizedType || !policyName) return false;
+  return deploymentPatternExpression(policyName).test(normalizedRef);
+}
+
 export function evaluateBuildchainReleaseReconciliation({
   repository,
   publicationVersion,