@kungfu-tech/buildchain 3.0.4-alpha.2 → 3.0.4-alpha.3

package/bin/internal/trust-release-verification-handlers.mjs

@@ -0,0 +1,306 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { verifyInfraContractEvidenceBundle } from "../../scripts/infra-contract-core.mjs";
+import { verifyBuildchainLogEvents } from "../../packages/core/logging.js";
+import {
+  explainReleaseLineDryRun,
+  formatReleaseLineDryRun,
+} from "../../packages/core/release-line-dry-run.js";
+import {
+  planReleaseLineBootstrap,
+  writeReleaseLineBootstrapVersionState,
+} from "../../packages/core/release-line-bootstrap.js";
+import {
+  collectGitHubReleasePassport,
+  explainReleasePassport,
+  verifyReleasePassport,
+} from "../../packages/core/release-passport.js";
+import {
+  createPublicationAdmission,
+  createRunnerProvenance,
+  verifyPublicationAdmission,
+} from "../../packages/core/publication-authority.js";
+import {
+  createGitHubArtifactAttestationPolicy,
+  createGitHubArtifactAttestationVerificationPlan,
+  verifyGitHubArtifactAttestationEvidence,
+} from "../../packages/core/github-artifact-attestation.js";
+import {
+  explainArtifactPassport,
+  verifyArtifactPassport,
+} from "../../packages/core/artifact-passport.js";
+import {
+  projectArtifactVerificationEnvelopeToKfx,
+  verifyArtifactVerificationEnvelope,
+} from "../../packages/core/artifact-verification-envelope.js";
+import {
+  artifactEnvelopeOptions,
+  printJson,
+  readBooleanFlag,
+  readFlag,
+  readJsonInput,
+  readRepeatedFlag,
+  writeJsonFile,
+} from "./cli-options.mjs";
+
+async function verifyGitHubArtifactAttestationCommand({
+  location,
+  verifyArgs,
+}) {
+  if (!location) {
+    throw new Error(
+      "usage: buildchain verify github-artifact-attestation <artifact> --evidence <file> --bundle <file> --platform-manifest <file> --release-passport <file>",
+    );
+  }
+  const requiredPath = (name) => {
+    const value = readFlag(verifyArgs, name, "");
+    if (!value) {
+      throw new Error(
+        `buildchain verify github-artifact-attestation requires --${name} <file>`,
+      );
+    }
+    return path.resolve(value);
+  };
+  const evidencePath = requiredPath("evidence");
+  const bundlePath = requiredPath("bundle");
+  const platformManifestPath = requiredPath("platform-manifest");
+  const releasePassportPath = requiredPath("release-passport");
+  const evidence = readJsonInput(evidencePath, { label: "evidence" });
+  const plan = createGitHubArtifactAttestationVerificationPlan({
+    artifactPath: location,
+    bundlePath,
+    evidence,
+  });
+  const verified = spawnSync(plan.command, plan.args, {
+    cwd: process.cwd(),
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024,
+  });
+  if (verified.error) throw verified.error;
+  if (verified.status !== 0) {
+    throw new Error(
+      `gh attestation verify failed: ${(verified.stderr || verified.stdout || "unknown error").trim()}`,
+    );
+  }
+  let verificationResults;
+  try {
+    verificationResults = JSON.parse(verified.stdout);
+  } catch (error) {
+    throw new Error(
+      `gh attestation verify returned invalid JSON: ${error.message}`,
+    );
+  }
+  const report = verifyGitHubArtifactAttestationEvidence({
+    artifactPath: path.resolve(location),
+    platformManifestPath,
+    releasePassportPath,
+    bundlePath,
+    evidence,
+    verificationResults,
+  });
+  if (readBooleanFlag(verifyArgs, "json")) {
+    printJson(report);
+  } else {
+    process.stdout.write(`GitHub artifact attestation: ${report.outcome}\n`);
+    for (const entry of report.issues) {
+      process.stdout.write(`- ${entry.code}: ${entry.message}\n`);
+    }
+  }
+  process.exitCode = report.ok ? 0 : 1;
+  return;
+}
+
+async function verifyPublicationAdmissionCommand({ location, verifyArgs }) {
+  if (!location) {
+    throw new Error(
+      "usage: buildchain verify publication-admission <file-or-json> --registry-json <file-or-json> --runner-json <file-or-json> --control-plane-audit-json <file-or-json> --publication-evidence-json <file-or-json>",
+    );
+  }
+  const requiredInput = (name) => {
+    const value = readFlag(verifyArgs, name, "");
+    if (!value)
+      throw new Error(
+        `buildchain verify publication-admission requires --${name} <file-or-json>`,
+      );
+    return readJsonInput(value, { label: name });
+  };
+  const expectedInput = readFlag(verifyArgs, "expected-json", "");
+  const capability = verifyPublicationAdmission({
+    admission: readJsonInput(location, { label: "publication admission" }),
+    registry: requiredInput("registry-json"),
+    runnerProvenance: requiredInput("runner-json"),
+    controlPlaneAudit: requiredInput("control-plane-audit-json"),
+    publicationEvidence: requiredInput("publication-evidence-json"),
+    expected: expectedInput
+      ? readJsonInput(expectedInput, { label: "expected-json" })
+      : {},
+    usedNonces: readRepeatedFlag(verifyArgs, "used-nonce"),
+  });
+  if (readBooleanFlag(verifyArgs, "json")) {
+    printJson(capability);
+  } else {
+    process.stdout.write(`publication admission: ${capability.decision}\n`);
+    process.stdout.write(`capability digest: ${capability.capabilityDigest}\n`);
+    process.stdout.write(`expires at: ${capability.expiresAt}\n`);
+  }
+  return;
+}
+
+async function verifyArtifactCommand({ location, verifyArgs }) {
+  if (!location) {
+    throw new Error("usage: buildchain verify artifact <subject>");
+  }
+  const report = await verifyArtifactPassport({
+    subject: location,
+    cwd: process.cwd(),
+    passportLocation: readFlag(verifyArgs, "passport", ""),
+    locatorConfig: readFlag(verifyArgs, "locator-config", ""),
+    repository: readFlag(verifyArgs, "repository", ""),
+    tag: readFlag(verifyArgs, "tag", ""),
+    githubReleaseBaseUrl: readFlag(verifyArgs, "github-release-base-url", ""),
+    subjectDigest: readFlag(verifyArgs, "subject-digest", ""),
+    subjectKind: readFlag(verifyArgs, "subject-kind", ""),
+    npmRegistryBaseUrl: readFlag(verifyArgs, "npm-registry", ""),
+  });
+  if (readBooleanFlag(verifyArgs, "json")) {
+    printJson(report);
+  } else {
+    process.stdout.write(`artifact: ${report.outcome}\n`);
+    process.stdout.write(`subject: ${report.subject?.name || location}\n`);
+    process.stdout.write(
+      `passport: ${report.passport?.location || report.discovery?.passportLocation || "unresolved"}\n`,
+    );
+    for (const entry of report.issues) {
+      process.stdout.write(
+        `- ${entry.level}: ${entry.code}: ${entry.message}\n`,
+      );
+    }
+  }
+  process.exitCode = report.ok ? 0 : 1;
+  return;
+}
+
+async function verifyArtifactEnvelopeCommand({ location, verifyArgs }) {
+  if (!location) {
+    throw new Error(
+      "usage: buildchain verify artifact-envelope <file-or-json>",
+    );
+  }
+  const report = verifyArtifactVerificationEnvelope({
+    envelope: readJsonInput(location, {
+      label: "artifact verification envelope",
+    }),
+    ...artifactEnvelopeOptions(verifyArgs),
+  });
+  if (readBooleanFlag(verifyArgs, "json")) {
+    printJson(report);
+  } else {
+    process.stdout.write(`artifact verification envelope: ${report.outcome}\n`);
+    process.stdout.write(`root: ${report.envelopeRoot || "unresolved"}\n`);
+    for (const entry of report.issues) {
+      process.stdout.write(
+        `- ${entry.level}: ${entry.code}: ${entry.message}\n`,
+      );
+    }
+  }
+  process.exitCode = report.ok ? 0 : 1;
+  return;
+}
+
+async function verifyObservabilityLogCommand({ location, verifyArgs }) {
+  if (!location) {
+    throw new Error("usage: buildchain verify observability-log <jsonl>");
+  }
+  const report = verifyBuildchainLogEvents({
+    path: location,
+    minEvents: Number(readFlag(verifyArgs, "min-events", "1")),
+    allowErrors: readBooleanFlag(verifyArgs, "allow-errors"),
+    requirePhases: readRepeatedFlag(verifyArgs, "require-phase"),
+    requireComponents: readRepeatedFlag(verifyArgs, "require-component"),
+    requireEvents: readRepeatedFlag(verifyArgs, "require-event"),
+  });
+  if (readBooleanFlag(verifyArgs, "json")) {
+    printJson(report);
+  } else {
+    process.stdout.write(`observability log: ${report.ok ? "ok" : "failed"}\n`);
+    process.stdout.write(`events: ${report.summary.eventCount}\n`);
+    for (const entry of report.issues) {
+      process.stdout.write(
+        `- ${entry.level}: ${entry.code}: ${entry.message}\n`,
+      );
+    }
+  }
+  process.exitCode = report.ok ? 0 : 1;
+  return;
+}
+
+async function verifyInfraContractEvidenceBundleCommand({
+  location,
+  verifyArgs,
+}) {
+  if (!location) {
+    throw new Error(
+      "usage: buildchain verify infra-contract-evidence-bundle <file>",
+    );
+  }
+  const bundle = JSON.parse(fs.readFileSync(path.resolve(location), "utf8"));
+  const report = verifyInfraContractEvidenceBundle(bundle);
+  if (readBooleanFlag(verifyArgs, "json")) {
+    printJson(report);
+  } else {
+    process.stdout.write(
+      `infra contract evidence bundle: ${report.ok ? "ok" : "failed"}\n`,
+    );
+    process.stdout.write(`artifact: ${report.artifactHash || "unknown"}\n`);
+    for (const entry of report.issues) {
+      process.stdout.write(
+        `- ${entry.level}: ${entry.code}: ${entry.message}\n`,
+      );
+    }
+  }
+  process.exitCode = report.ok ? 0 : 1;
+  return;
+}
+
+async function verifyReleasePassportCommand({ location, verifyArgs }) {
+  if (!location)
+    throw new Error("usage: buildchain verify release-passport <file-or-url>");
+  const report = await verifyReleasePassport({ passportLocation: location });
+  if (readBooleanFlag(verifyArgs, "json")) {
+    printJson(report);
+  } else {
+    process.stdout.write(`release passport: ${report.ok ? "ok" : "failed"}\n`);
+    process.stdout.write(`artifacts: ${report.completeness.artifactCount}\n`);
+    for (const entry of report.issues) {
+      process.stdout.write(
+        `- ${entry.level}: ${entry.code}: ${entry.message}\n`,
+      );
+    }
+  }
+  process.exitCode = report.ok ? 0 : 1;
+  return;
+}
+
+const VERIFY_COMMAND_HANDLERS = Object.freeze({
+  "github-artifact-attestation": verifyGitHubArtifactAttestationCommand,
+  "publication-admission": verifyPublicationAdmissionCommand,
+  artifact: verifyArtifactCommand,
+  "artifact-envelope": verifyArtifactEnvelopeCommand,
+  "observability-log": verifyObservabilityLogCommand,
+  "infra-contract-evidence-bundle": verifyInfraContractEvidenceBundleCommand,
+  "release-passport": verifyReleasePassportCommand,
+});
+
+async function handleVerifyCommand({ args }) {
+  const [subcommand = "", location = "", ...verifyArgs] = args;
+  const handler = VERIFY_COMMAND_HANDLERS[subcommand];
+  if (!handler) {
+    throw new Error(
+      "usage: buildchain verify <github-artifact-attestation|publication-admission|artifact|artifact-envelope|observability-log|infra-contract-evidence-bundle|release-passport> ...",
+    );
+  }
+  return handler({ location, verifyArgs });
+}
+
+export { handleVerifyCommand };

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "3.0.4-alpha.2",
+    "version": "3.0.4-alpha.3",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v3",
@@ -52,7 +52,7 @@
         "retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
       ],
       "breakingDigest": "sha256:dfbedd543ae0c067982b5c8c02d98dd2f7f7df88752be97fb330da6b0ba30faa",
-      "auditDigest": "sha256:5ae0793e1da87242a56d7fdf29a2d1d7d24ca50f68429797a7d78bcba605b797"
+      "auditDigest": "sha256:1fff20be18b0ed638a02c2ae00258ee5a0052f466dd2338fe6f4935a31f94dfe"
     },
     {
       "contractVersion": 1,
@@ -510,7 +510,7 @@
         "release-state SHA is recorded as a durable audit entrance"
       ],
       "breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
-      "auditDigest": "sha256:f177e3a60a1463db9a83b04a00f5cf0a015d68281da0d545245760856f6dfaf0"
+      "auditDigest": "sha256:7d91592c518277646154ef5c7fde27d7101c87a0d7f69c90911ac0c7583c20ec"
     },
     {
       "contractVersion": 1,
@@ -559,7 +559,7 @@
         "prose-only public claims downgrade the release trust passport audit"
       ],
       "breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
-      "auditDigest": "sha256:f177e3a60a1463db9a83b04a00f5cf0a015d68281da0d545245760856f6dfaf0"
+      "auditDigest": "sha256:7d91592c518277646154ef5c7fde27d7101c87a0d7f69c90911ac0c7583c20ec"
     },
     {
       "contractVersion": 1,
@@ -619,7 +619,7 @@
         "README badge block checks and writes are generated from machine-readable repository facts"
       ],
       "breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
-      "auditDigest": "sha256:0546ff18ae7c6a23122a13e7de3364a48ea3d106539a7f1471363218c5d2a561"
+      "auditDigest": "sha256:2011241d29b5636c751a0a03c5be0fd43e90e7f5d246f651975cab2d7ebcead3"
     },
     {
       "contractVersion": 1,
@@ -709,7 +709,7 @@
         "manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
       ],
       "breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
-      "auditDigest": "sha256:6b1b53b7b444144e3a7698909000d1c63ddc3814661b52d98529a585631b9f4a"
+      "auditDigest": "sha256:e6948b309515f693f4a264500184bcf2670b025e8e5d45e0b999d305483bd3bd"
     },
     {
       "contractVersion": 1,
@@ -731,7 +731,7 @@
         "agents can discover supported Node APIs without importing internal file paths"
       ],
       "breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
-      "auditDigest": "sha256:db0fe262bcfc34ea78f8b9b36333b93ab9388548a46b4616b2105156b3f1173a"
+      "auditDigest": "sha256:b7862559002c267b6ab56df3e45cb15248e4179db9a04cd0963117c312a73069"
     },
     {
       "contractVersion": 1,
@@ -782,7 +782,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
-        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
+        "registryDigest": "sha256:365541ae05fb807ed5ca3e80662ea5fa3b1d0cd13db5b56e444a4596b7b899f2",
         "inputClassifications": {
           "buildchain-ref": {
             "classification": "included",
@@ -961,7 +961,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:2e4c9e9af2162de2333c9b57bffcff77a76e9ed384b9f001ab8ef63d527197f9",
-        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
+        "registryDigest": "sha256:365541ae05fb807ed5ca3e80662ea5fa3b1d0cd13db5b56e444a4596b7b899f2",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1340,7 +1340,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:6b8d38e92b2c67b5bc83fae0a3fd95bfa47582fbc176e6cdeebe7630a57534cb",
-      "auditDigest": "sha256:5ae0793e1da87242a56d7fdf29a2d1d7d24ca50f68429797a7d78bcba605b797"
+      "auditDigest": "sha256:1fff20be18b0ed638a02c2ae00258ee5a0052f466dd2338fe6f4935a31f94dfe"
     },
     {
       "contractVersion": 1,
@@ -1476,7 +1476,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:105eed3eb8f772d4ed93d43e7da404d849b92eafab1b461c7a9b7cb94a8a6b3b",
-        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
+        "registryDigest": "sha256:365541ae05fb807ed5ca3e80662ea5fa3b1d0cd13db5b56e444a4596b7b899f2",
         "inputClassifications": {
           "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
             "classification": "redacted",
@@ -1933,7 +1933,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d",
-        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
+        "registryDigest": "sha256:365541ae05fb807ed5ca3e80662ea5fa3b1d0cd13db5b56e444a4596b7b899f2",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2150,7 +2150,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
-        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
+        "registryDigest": "sha256:365541ae05fb807ed5ca3e80662ea5fa3b1d0cd13db5b56e444a4596b7b899f2",
         "inputClassifications": {
           "artifact-path": {
             "classification": "digest-only",
@@ -2394,7 +2394,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
-        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
+        "registryDigest": "sha256:365541ae05fb807ed5ca3e80662ea5fa3b1d0cd13db5b56e444a4596b7b899f2",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2576,7 +2576,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
-        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
+        "registryDigest": "sha256:365541ae05fb807ed5ca3e80662ea5fa3b1d0cd13db5b56e444a4596b7b899f2",
         "inputClassifications": {
           "artifact-name": {
             "classification": "included",
@@ -2892,7 +2892,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:f54bccee97644d190b450e4ed810b516af64ed5d265ea76cd541a11cbbd51cdb",
-        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
+        "registryDigest": "sha256:365541ae05fb807ed5ca3e80662ea5fa3b1d0cd13db5b56e444a4596b7b899f2",
         "inputClassifications": {
           "BUILDCHAIN_ISSUE_APP_ID": {
             "classification": "redacted",
@@ -3349,7 +3349,8 @@
         "capabilities": [
           "release-propagation-plan",
           "downstream-lock",
-          "pull-request-handoff"
+          "agent-native-work-envelope",
+          "resumable-production-handoff"
         ],
         "evidenceRequirements": [
           "propagation-plan",
@@ -3359,6 +3360,8 @@
         "inputClassificationPolicy": "buildchain-controller-input-policy/v1"
       },
       "optionalInputs": [
+        "agent-work-context-json",
+        "agent-work-mode",
         "buildchain-ref",
         "buildchain-repository",
         "downstream-base-ref",
@@ -3380,9 +3383,17 @@
       ],
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
-        "digest": "sha256:aff7a9f6bcf96d7a9d406e490868288f3acef104e53eddddc5782b8a2b5b4fa5",
-        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
+        "digest": "sha256:660579b5561e8e33375a3f3b1fefbb8a5bd8241a55ba43374d786fb772c24a12",
+        "registryDigest": "sha256:365541ae05fb807ed5ca3e80662ea5fa3b1d0cd13db5b56e444a4596b7b899f2",
         "inputClassifications": {
+          "agent-work-context-json": {
+            "classification": "digest-only",
+            "source": "workflow-call-input"
+          },
+          "agent-work-mode": {
+            "classification": "included",
+            "source": "workflow-call-input"
+          },
           "buildchain-ref": {
             "classification": "included",
             "source": "workflow-call-input"
@@ -3463,8 +3474,8 @@
         "redacted input values are never serialized and digest-only input values are never emitted in plaintext",
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
-      "breakingDigest": "sha256:d7a1f15990ce8bd13149474888232c7d4451dd2a49bebf4d4ce1336695da430e",
-      "auditDigest": "sha256:9304ed3bc65ab5a0082554889796201fd8d2f4f290a4137ca92905f5ff696e52"
+      "breakingDigest": "sha256:b873ceb65618972bea615afcb9c616c138ce834b3246ec7237ef87c1618d68bd",
+      "auditDigest": "sha256:ef845b25978cd63c0fc6cbc83271e30b245f9d8605c2c25ae7e87c13a35b1302"
     },
     {
       "contractVersion": 1,
@@ -3508,7 +3519,7 @@
       "controllerDescriptor": {
         "contract": "buildchain.controller-descriptor/v1",
         "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
-        "registryDigest": "sha256:3564f3c38f8c070280ea9cf5dee810d466b40e72ce80104b15776365dfdf9b60",
+        "registryDigest": "sha256:365541ae05fb807ed5ca3e80662ea5fa3b1d0cd13db5b56e444a4596b7b899f2",
         "inputClassifications": {}
       },
       "guarantees": [
@@ -3521,6 +3532,6 @@
       "auditDigest": "sha256:d07482cd66413a2fb3781a3b76f960b8151b6231841799647fe237820de2fde6"
     }
   ],
-  "compatibilityDigest": "sha256:61af7d0871220bc0909008bdc571905ad500cccf853e7841bc5d462a34b2d436",
-  "contractDigest": "sha256:52a759d10606f84efc0e1c25d5eb9afd4ad55835403d6a376a40dadd7f4648c4"
+  "compatibilityDigest": "sha256:3bbcaf835844260ed98414d3bd176667245d12131e13fc748e4c2fae12399691",
+  "contractDigest": "sha256:3f17015215af1c964187e535ffd1b332ddc54808198104703397c5a7bd908fbd"
 }