@kungfu-tech/buildchain 3.0.5-alpha.7 → 3.0.5-alpha.8

package/dist/site/public-surface-audit.json

@@ -7119,7 +7119,7 @@
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "c070e7bff9d1cb65a08daacd936f3567871af7844e88fa6ffcb05ea59579c15f",
     "workflowRegistryDigest": "dff218a0f6f03602912c4f2e238cc79a1304ee2d0f6d1e3f3bae8514302f4706",
-    "pageRegistryDigest": "1270adac7acf01d2d1467feed70432c0d61c581925cad4af503b7db98c224d3f"
+    "pageRegistryDigest": "fcc0611c778caa08e36f91d3d5bd36f61aa90a165fb98388ade07d3ac236716f"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-02T13:42:28.157Z",
-  "publishedAt": "2026-08-02T13:42:28.157Z",
+  "generatedAt": "2026-08-02T14:27:56.260Z",
+  "publishedAt": "2026-08-02T14:27:56.260Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "b5a8cb26691966378ee01f12e83d362fded9e47c",
+  "sourceRevision": "4e62e4e0e7e2dec5316b12ab0ca7bef3e7804fbc",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.7",
+    "version": "3.0.5-alpha.8",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-02T13:42:28.157Z",
-  "publishedAt": "2026-08-02T13:42:28.157Z",
+  "generatedAt": "2026-08-02T14:27:56.260Z",
+  "publishedAt": "2026-08-02T14:27:56.260Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "b5a8cb26691966378ee01f12e83d362fded9e47c",
+  "sourceRevision": "4e62e4e0e7e2dec5316b12ab0ca7bef3e7804fbc",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.7",
+    "version": "3.0.5-alpha.8",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -237,7 +237,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:c67e43ac62b7771c997c089da1541e573b7bb3202bdef01816a782b876e403c3"
+      "digest": "sha256:deab508284ed365a830894205a4d293c524281d6da7126094cf8e9eea8efe223"
     },
     {
       "id": "build-facts",

package/docs/node-api-reference.md

@@ -199,8 +199,8 @@ Target: `./packages/core/index.js`. Public symbols: 547.
 | `createKfdBadgeSpecsFromStandards` | function: function createKfdBadgeSpecsFromStandards(standardsMetadata) | standardsMetadata | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKfdBadgeSpecsFromStandards } from "@kungfu-tech/buildchain";` | `packages/core/readme-badges.js:126` |
 | `createKfdSupportProjection` | function: function createKfdSupportProjection({ matrix, matrixRoot = "", gateResults = [], authorityPath = ".buildchain/kfd/support-matrix.json", expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {}) | { matrix, matrixRoot = "", gateResults = [], authorityPath = ".buildchain/kfd/support-matrix.json", expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKfdSupportProjection } from "@kungfu-tech/buildchain";` | `packages/core/kfd-product-gates.js:716` |
 | `createKungfuBuildInfoProjection` | function: function createKungfuBuildInfoProjection({ moduleFact, cwd = process.cwd(), now = nowIso() } = {}) | { moduleFact, cwd = process.cwd(), now = nowIso() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKungfuBuildInfoProjection } from "@kungfu-tech/buildchain";` | `packages/core/build-facts.js:520` |
-| `createManualUpstreamPickupCapture` | function: function createManualUpstreamPickupCapture({ plan, expectedDownstreamBaseSha, }) | { plan, expectedDownstreamBaseSha, } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createManualUpstreamPickupCapture } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-pickup.js:360` |
-| `createManualUpstreamPickupPlan` | function: function createManualUpstreamPickupPlan({ config: configInput, sourceId, channel, currentVersion, upstreamRelease, }) | { config: configInput, sourceId, channel, currentVersion, upstreamRelease, } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createManualUpstreamPickupPlan } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-pickup.js:302` |
+| `createManualUpstreamPickupCapture` | function: function createManualUpstreamPickupCapture({ plan, expectedDownstreamBaseSha, }) | { plan, expectedDownstreamBaseSha, } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createManualUpstreamPickupCapture } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-pickup.js:361` |
+| `createManualUpstreamPickupPlan` | function: function createManualUpstreamPickupPlan({ config: configInput, sourceId, channel, currentVersion, upstreamRelease, }) | { config: configInput, sourceId, channel, currentVersion, upstreamRelease, } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createManualUpstreamPickupPlan } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-pickup.js:303` |
 | `createPackageReleasePropagationCapture` | function: function createPackageReleasePropagationCapture({ config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {}) | { config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPackageReleasePropagationCapture } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-capture.js:101` |
 | `createPaperAlphaPlan` | function: function createPaperAlphaPlan({ cwd = process.cwd(), sourceRef = "", targetRef = "", } = {}) | { cwd = process.cwd(), sourceRef = "", targetRef = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperAlphaPlan } from "@kungfu-tech/buildchain";` | `packages/core/paper.js:2655` |
 | `createPaperBuildPlan` | function: function createPaperBuildPlan({ cwd = process.cwd(), sourceSha = "", pullToolchain = true, } = {}) | { cwd = process.cwd(), sourceSha = "", pullToolchain = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperBuildPlan } from "@kungfu-tech/buildchain";` | `packages/core/paper.js:2592` |
@@ -799,8 +799,8 @@ Target: `./packages/core/index.js`. Public symbols: 547.
 | `createKfdBadgeSpecsFromStandards` | function: function createKfdBadgeSpecsFromStandards(standardsMetadata) | standardsMetadata | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKfdBadgeSpecsFromStandards } from "@kungfu-tech/buildchain/core";` | `packages/core/readme-badges.js:126` |
 | `createKfdSupportProjection` | function: function createKfdSupportProjection({ matrix, matrixRoot = "", gateResults = [], authorityPath = ".buildchain/kfd/support-matrix.json", expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {}) | { matrix, matrixRoot = "", gateResults = [], authorityPath = ".buildchain/kfd/support-matrix.json", expectedSourceSha = "", checkedAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKfdSupportProjection } from "@kungfu-tech/buildchain/core";` | `packages/core/kfd-product-gates.js:716` |
 | `createKungfuBuildInfoProjection` | function: function createKungfuBuildInfoProjection({ moduleFact, cwd = process.cwd(), now = nowIso() } = {}) | { moduleFact, cwd = process.cwd(), now = nowIso() } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createKungfuBuildInfoProjection } from "@kungfu-tech/buildchain/core";` | `packages/core/build-facts.js:520` |
-| `createManualUpstreamPickupCapture` | function: function createManualUpstreamPickupCapture({ plan, expectedDownstreamBaseSha, }) | { plan, expectedDownstreamBaseSha, } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createManualUpstreamPickupCapture } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-pickup.js:360` |
-| `createManualUpstreamPickupPlan` | function: function createManualUpstreamPickupPlan({ config: configInput, sourceId, channel, currentVersion, upstreamRelease, }) | { config: configInput, sourceId, channel, currentVersion, upstreamRelease, } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createManualUpstreamPickupPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-pickup.js:302` |
+| `createManualUpstreamPickupCapture` | function: function createManualUpstreamPickupCapture({ plan, expectedDownstreamBaseSha, }) | { plan, expectedDownstreamBaseSha, } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createManualUpstreamPickupCapture } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-pickup.js:361` |
+| `createManualUpstreamPickupPlan` | function: function createManualUpstreamPickupPlan({ config: configInput, sourceId, channel, currentVersion, upstreamRelease, }) | { config: configInput, sourceId, channel, currentVersion, upstreamRelease, } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createManualUpstreamPickupPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-pickup.js:303` |
 | `createPackageReleasePropagationCapture` | function: function createPackageReleasePropagationCapture({ config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {}) | { config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPackageReleasePropagationCapture } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-capture.js:101` |
 | `createPaperAlphaPlan` | function: function createPaperAlphaPlan({ cwd = process.cwd(), sourceRef = "", targetRef = "", } = {}) | { cwd = process.cwd(), sourceRef = "", targetRef = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperAlphaPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/paper.js:2655` |
 | `createPaperBuildPlan` | function: function createPaperBuildPlan({ cwd = process.cwd(), sourceSha = "", pullToolchain = true, } = {}) | { cwd = process.cwd(), sourceSha = "", pullToolchain = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPaperBuildPlan } from "@kungfu-tech/buildchain/core";` | `packages/core/paper.js:2592` |
@@ -1903,8 +1903,8 @@ Target: `./packages/core/release-propagation.js`. Public symbols: 31.
 | --- | --- | --- | --- | --- | --- | --- | --- |
 | `claimReleasePropagationWork` | function: function claimReleasePropagationWork({ work, expectedWorkRoot, authority, familyState, } = {}) | { work, expectedWorkRoot, authority, familyState, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { claimReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work-transitions.js:17` |
 | `completeReleasePropagationWork` | function: function completeReleasePropagationWork({ work, expectedWorkRoot, receipt, completionDecision, } = {}) | { work, expectedWorkRoot, receipt, completionDecision, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { completeReleasePropagationWork } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-work-transitions.js:110` |
-| `createManualUpstreamPickupCapture` | function: function createManualUpstreamPickupCapture({ plan, expectedDownstreamBaseSha, }) | { plan, expectedDownstreamBaseSha, } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createManualUpstreamPickupCapture } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-pickup.js:360` |
-| `createManualUpstreamPickupPlan` | function: function createManualUpstreamPickupPlan({ config: configInput, sourceId, channel, currentVersion, upstreamRelease, }) | { config: configInput, sourceId, channel, currentVersion, upstreamRelease, } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createManualUpstreamPickupPlan } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-pickup.js:302` |
+| `createManualUpstreamPickupCapture` | function: function createManualUpstreamPickupCapture({ plan, expectedDownstreamBaseSha, }) | { plan, expectedDownstreamBaseSha, } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createManualUpstreamPickupCapture } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-pickup.js:361` |
+| `createManualUpstreamPickupPlan` | function: function createManualUpstreamPickupPlan({ config: configInput, sourceId, channel, currentVersion, upstreamRelease, }) | { config: configInput, sourceId, channel, currentVersion, upstreamRelease, } | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createManualUpstreamPickupPlan } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-pickup.js:303` |
 | `createPackageReleasePropagationCapture` | function: function createPackageReleasePropagationCapture({ config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {}) | { config: configInput, upstreamRelease: upstreamReleaseInput, expectedBaseShas = {}, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPackageReleasePropagationCapture } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation-capture.js:101` |
 | `createReleasePropagationLock` | function: function createReleasePropagationLock({ graph, edge, sourceNode, targetNode, upstreamRelease, downstreamChannel, } = {}) | { graph, edge, sourceNode, targetNode, upstreamRelease, downstreamChannel, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createReleasePropagationLock } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation.js:199` |
 | `createReleasePropagationReceipt` | function: function createReleasePropagationReceipt({ plan, target = "", lockResult, prOutcome, stagingState = "pending", productionState = "not-requested", observedAt = "", } = {}) | { plan, target = "", lockResult, prOutcome, stagingState = "pending", productionState = "not-requested", observedAt = "", } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createReleasePropagationReceipt } from "@kungfu-tech/buildchain/release-propagation";` | `packages/core/release-propagation.js:371` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.5-alpha.7",
+  "version": "3.0.5-alpha.8",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/release-propagation-pickup.js

@@ -206,7 +206,8 @@ export function resolveNpmRegistryRelease({
       "npm SLSA statement predicate type disagrees with its envelope",
     );
   }
-  const expectedSubject = `pkg:npm/${encodeURIComponent(source.package)}@${version}`;
+  const purlName = encodeURIComponent(source.package).replace("%2F", "/");
+  const expectedSubject = `pkg:npm/${purlName}@${version}`;
   const subject = (statement.subject || []).find(
     (entry) => entry.name === expectedSubject,
   );