@kungfu-tech/buildchain 3.0.6-alpha.6 → 3.0.6

package/dist/site/controller-registry.json

@@ -1899,6 +1899,10 @@
           "classification": "digest-only",
           "source": "workflow-call-input"
         },
+        "publication-gate-controller-sha": {
+          "classification": "included",
+          "source": "workflow-call-input"
+        },
         "publication-package-name": {
           "classification": "included",
           "source": "workflow-call-input"
@@ -2189,7 +2193,7 @@
           "controller-receipt"
         ]
       },
-      "digest": "sha256:bc03b3ac295e33b738fe5168e14ebf4d0fabf2325b4ae4a3d2b3c12afe816068"
+      "digest": "sha256:bb49305be1f2176c47920532d414954e1d058156abf3411ae66cc97ba526d186"
     },
     {
       "schemaVersion": 1,
@@ -2382,5 +2386,5 @@
       "digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555"
     }
   ],
-  "digest": "sha256:cc205cd0abe4ba5023d8afc38dea9d3f17c06f4a3622a6b8ccd3fc90b10e3fb7"
+  "digest": "sha256:6c9eab44f162f2c142827c63bcd7c14cb92ba92e6021ffdc0bdf7baee7ffad8c"
 }

package/dist/site/kfd-claims.json

@@ -21,7 +21,7 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "f0099a2560409b08718139a629a96c6aa25480c02e7aa12b76f1bae0fde855ac",
+    "sha256": "e37f94305762bde4ecad076297dedd212f015f12ffc5c0a524f1350969ad00d1",
     "summary": {
       "cliCommandCount": 112,
       "workflowCount": 64,
@@ -246,7 +246,7 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "f0099a2560409b08718139a629a96c6aa25480c02e7aa12b76f1bae0fde855ac",
+      "sha256": "e37f94305762bde4ecad076297dedd212f015f12ffc5c0a524f1350969ad00d1",
       "summary": {
         "cliCommandCount": 112,
         "workflowCount": 64,
@@ -3545,7 +3545,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 34,
+          "inputCount": 37,
           "inputs": [
             "admission-json",
             "authority-workflow-path",
@@ -3555,6 +3555,9 @@
             "buildchain-ref",
             "buildchain-repository",
             "consumer-gate-command",
+            "consumer-gate-controller-sha",
+            "consumer-gate-evidence-source-sha",
+            "consumer-gate-evidence-source-tree",
             "consumer-predicate-digest",
             "consumer-predicate-id",
             "consumer-qualification-required",
@@ -3594,7 +3597,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 106,
+          "inputCount": 107,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -3640,6 +3643,7 @@
             "publication-expected-json",
             "publication-gate-aggregate-json",
             "publication-gate-command",
+            "publication-gate-controller-sha",
             "publication-package-name",
             "publication-product",
             "publication-publisher-workflow-path",
@@ -4857,7 +4861,7 @@
           "visibility": "public",
           "participantFacing": true,
           "public": true,
-          "inputCount": 98,
+          "inputCount": 99,
           "inputs": [
             "allow-repository",
             "artifact-name",
@@ -4895,6 +4899,7 @@
             "publication-expected-json",
             "publication-gate-aggregate-json",
             "publication-gate-command",
+            "publication-gate-controller-sha",
             "publication-package-name",
             "publication-product",
             "publication-publisher-workflow-path",

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.6-alpha.6",
+    "version": "3.0.6",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/manual-registry.json

@@ -136,7 +136,7 @@
       "title": "Release Candidate Passport",
       "path": "docs/release-candidate.md",
       "plane": "verify",
-      "digest": "sha256:9cb06463e0cbb06180ae4e9ed3258a9e7466237916ffc766c548ef5faa730651",
+      "digest": "sha256:d76bbd75aab3c4dd94756c1c64562a125e74369c7c8b97342dbcacc5d7561602",
       "capabilityGroup": "reusable-build",
       "audience": [
         "release-operator",
@@ -332,7 +332,7 @@
       "title": "Generated Node API reference",
       "path": "docs/node-api-reference.md",
       "plane": "use",
-      "digest": "sha256:f8ae86b9182811d9f980b3ae1f1a42d2c84cd6c133003c996946848f938099a8",
+      "digest": "sha256:f5592359584e98ab4283d56b0262fdcf9c5da61f48033cecad1b0404aa95bd2e",
       "capabilityGroup": "api-cli-reference",
       "audience": [
         "agent",
@@ -430,7 +430,7 @@
       "title": "Release governance",
       "path": "docs/release-governance.md",
       "plane": "why",
-      "digest": "sha256:481640f398d966dca4f1f2e29a8100f0f479315ee19e65b0e259720f2b61213f",
+      "digest": "sha256:34fb81d1dd9f913cbed6ee76ac9f0bdb095669e55c1bee67389601fd494470cf",
       "capabilityGroup": "governance-versioning",
       "audience": [
         "maintainer",

package/dist/site/node-api-registry.json

@@ -13650,7 +13650,7 @@
       ],
       "source": {
         "path": "packages/core/publication-sealed-bundle.js",
-        "line": 75
+        "line": 84
       },
       "example": "import { createPublicationSealedBundle } from \"@kungfu-tech/buildchain\";",
       "maturity": "stable",
@@ -13703,7 +13703,7 @@
       ],
       "source": {
         "path": "packages/core/publication-sealed-bundle.js",
-        "line": 124
+        "line": 133
       },
       "example": "import { verifyPublicationSealedBundle } from \"@kungfu-tech/buildchain\";",
       "maturity": "stable",
@@ -14780,6 +14780,39 @@
         "agent"
       ]
     },
+    {
+      "id": "packages/core/release-candidate-recovery.js#rebindPublicationGateAggregateForEquivalentTree",
+      "name": "rebindPublicationGateAggregateForEquivalentTree",
+      "kind": "function",
+      "signature": "function rebindPublicationGateAggregateForEquivalentTree(gateAggregate, { evidenceSourceSha = \"\", targetSourceSha = \"\", targetSourceTreeSha = \"\", expectedSourceTreeSha = \"\" } = {})",
+      "parameters": [
+        {
+          "name": "gateAggregate",
+          "signature": "gateAggregate"
+        },
+        {
+          "name": "parameter2",
+          "signature": "{ evidenceSourceSha = \"\", targetSourceSha = \"\", targetSourceTreeSha = \"\", expectedSourceTreeSha = \"\" } = {}"
+        }
+      ],
+      "returns": "unknown",
+      "errors": [
+        "May throw an Error on rejected input or failed operations; follow the linked source contract."
+      ],
+      "sideEffects": [
+        "none-detected-by-static-source-scan"
+      ],
+      "source": {
+        "path": "packages/core/release-candidate-recovery.js",
+        "line": 18
+      },
+      "example": "import { rebindPublicationGateAggregateForEquivalentTree } from \"@kungfu-tech/buildchain/release-candidate-recovery\";",
+      "maturity": "stable",
+      "audience": [
+        "developer",
+        "agent"
+      ]
+    },
     {
       "id": "packages/core/release-candidate-recovery.js#recoveryFailure",
       "name": "recoveryFailure",
@@ -14800,7 +14833,7 @@
       ],
       "source": {
         "path": "packages/core/release-candidate-recovery.js",
-        "line": 441
+        "line": 529
       },
       "example": "import { recoveryFailure } from \"@kungfu-tech/buildchain\";",
       "maturity": "stable",
@@ -14824,7 +14857,7 @@
       ],
       "source": {
         "path": "packages/core/release-candidate-recovery.js",
-        "line": 11
+        "line": 15
       },
       "example": "import { RELEASE_CANDIDATE_RECOVERY_CONTRACT } from \"@kungfu-tech/buildchain\";",
       "maturity": "stable",
@@ -14848,7 +14881,7 @@
       ],
       "source": {
         "path": "packages/core/release-candidate-recovery.js",
-        "line": 18
+        "line": 56
       },
       "example": "import { ReleaseCandidateRecoveryError } from \"@kungfu-tech/buildchain\";",
       "maturity": "stable",
@@ -14857,6 +14890,35 @@
         "agent"
       ]
     },
+    {
+      "id": "packages/core/release-candidate-recovery.js#validateRecoveryTargetRef",
+      "name": "validateRecoveryTargetRef",
+      "kind": "function",
+      "signature": "function validateRecoveryTargetRef({ targetSha, observedTargetSha, expectedTransactionId = \"\", existingTransaction = undefined, ancestry = undefined, } = {})",
+      "parameters": [
+        {
+          "name": "parameter1",
+          "signature": "{ targetSha, observedTargetSha, expectedTransactionId = \"\", existingTransaction = undefined, ancestry = undefined, } = {}"
+        }
+      ],
+      "returns": "unknown",
+      "errors": [
+        "Errors from called operations may propagate; no narrower throw contract is declared in source."
+      ],
+      "sideEffects": [
+        "none-detected-by-static-source-scan"
+      ],
+      "source": {
+        "path": "packages/core/release-candidate-recovery.js",
+        "line": 134
+      },
+      "example": "import { validateRecoveryTargetRef } from \"@kungfu-tech/buildchain/release-candidate-recovery\";",
+      "maturity": "stable",
+      "audience": [
+        "developer",
+        "agent"
+      ]
+    },
     {
       "id": "packages/core/release-candidate-recovery.js#validateReleaseCandidateRecoveryReceipt",
       "name": "validateReleaseCandidateRecoveryReceipt",
@@ -14877,7 +14939,7 @@
       ],
       "source": {
         "path": "packages/core/release-candidate-recovery.js",
-        "line": 96
+        "line": 176
       },
       "example": "import { validateReleaseCandidateRecoveryReceipt } from \"@kungfu-tech/buildchain/release-candidate-recovery\";",
       "maturity": "stable",
@@ -14890,11 +14952,11 @@
       "id": "packages/core/release-candidate-recovery.js#verifyReleaseCandidateRecovery",
       "name": "verifyReleaseCandidateRecovery",
       "kind": "function",
-      "signature": "function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = \"\", expectedCandidateRoot = \"\", expectedRuntimeSha, expectedTransactionId = \"\", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = \"\", currentToolingSha, recoveryRunId = \"\", createdAt = new Date().toISOString(), } = {})",
+      "signature": "function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = \"\", expectedCandidateRoot = \"\", expectedRuntimeSha, expectedTransactionId = \"\", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = \"\", currentToolingSha, recoveryRunId = \"\", createdAt = new Date().toISOString(), } = {})",
       "parameters": [
         {
           "name": "parameter1",
-          "signature": "{ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetTree, expectedSourceTree = \"\", expectedCandidateRoot = \"\", expectedRuntimeSha, expectedTransactionId = \"\", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = \"\", currentToolingSha, recoveryRunId = \"\", createdAt = new Date().toISOString(), } = {}"
+          "signature": "{ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = \"\", expectedCandidateRoot = \"\", expectedRuntimeSha, expectedTransactionId = \"\", existingTransaction = undefined, run, workflow, pullRequest, ancestry, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = \"\", currentToolingSha, recoveryRunId = \"\", createdAt = new Date().toISOString(), } = {}"
         }
       ],
       "returns": "unknown",
@@ -14906,7 +14968,7 @@
       ],
       "source": {
         "path": "packages/core/release-candidate-recovery.js",
-        "line": 318
+        "line": 398
       },
       "example": "import { verifyReleaseCandidateRecovery } from \"@kungfu-tech/buildchain\";",
       "maturity": "stable",
@@ -19830,7 +19892,7 @@
       "specifier": "@kungfu-tech/buildchain/publication-sealed-bundle",
       "export": "./publication-sealed-bundle",
       "target": "./packages/core/publication-sealed-bundle.js",
-      "digest": "sha256:9b1405a04548c9a87863c2cf410224f6cd7b44e06b76e0de0f7b8052029bc92d",
+      "digest": "sha256:0b912deace895b3f99e7a77b77678d35a7c22a68b3d18eb31aff2995fb66a51e",
       "summary": "Build-once publication bundle manifests and exact-byte resume verification APIs.",
       "capabilityGroup": "reusable-build",
       "audience": [
@@ -20133,18 +20195,20 @@
       "specifier": "@kungfu-tech/buildchain/release-candidate-recovery",
       "export": "./release-candidate-recovery",
       "target": "./packages/core/release-candidate-recovery.js",
-      "digest": "sha256:d495ef85f9e56a5c0e7ab9234b3e0a6471179386693f9e825b2cf4f384087f45",
+      "digest": "sha256:d863601bcd5be9cfbf4455961d1183486e6d191ce34dc7c6a14f2ad71146b175",
       "summary": "Fail-closed verification and immutable receipts for reusing a successful sealed candidate run without rebuilding product payloads.",
       "capabilityGroup": "release-passport-trust",
       "audience": [
         "developer",
         "agent"
       ],
-      "symbolCount": 5,
+      "symbolCount": 7,
       "symbolIds": [
+        "packages/core/release-candidate-recovery.js#rebindPublicationGateAggregateForEquivalentTree",
         "packages/core/release-candidate-recovery.js#recoveryFailure",
         "packages/core/release-candidate-recovery.js#RELEASE_CANDIDATE_RECOVERY_CONTRACT",
         "packages/core/release-candidate-recovery.js#ReleaseCandidateRecoveryError",
+        "packages/core/release-candidate-recovery.js#validateRecoveryTargetRef",
         "packages/core/release-candidate-recovery.js#validateReleaseCandidateRecoveryReceipt",
         "packages/core/release-candidate-recovery.js#verifyReleaseCandidateRecovery"
       ],
@@ -20425,7 +20489,7 @@
     {
       "id": "node-api-reference",
       "path": "docs/node-api-reference.md",
-      "digest": "sha256:f8ae86b9182811d9f980b3ae1f1a42d2c84cd6c133003c996946848f938099a8"
+      "digest": "sha256:f5592359584e98ab4283d56b0262fdcf9c5da61f48033cecad1b0404aa95bd2e"
     },
     {
       "id": "build-facts",