@kungfu-tech/buildchain 4.0.1-alpha.33 → 4.0.1-alpha.35

package/dist/site/buildchain-contract.json

@@ -4,7 +4,7 @@
   "product": {
     "name": "Buildchain",
     "package": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.33",
+    "version": "4.0.1-alpha.35",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "majorLine": "v4",
@@ -1646,7 +1646,7 @@
         "resume-from-candidate-run is fail-closed and uses a fresh caller event instead of rerunning a frozen startup graph"
       ],
       "breakingDigest": "sha256:9db8dd07152855d03ff30f9c571438593c689d3e8139fa45431d000f548242f5",
-      "auditDigest": "sha256:50da0716d65b488b0fae6f3d8f486754eb3769ff79ffb91bc0c110e0b2d709c8",
+      "auditDigest": "sha256:6d18173f1048d68196da4729a078f77b85781ecbae0e34aadc1f862a5d83897a",
       "compatibleBreakingDigests": [
         "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0"
       ],
@@ -5082,7 +5082,7 @@
         "missing receipts are non-qualifying and must not be represented as a successful controller run"
       ],
       "breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
-      "auditDigest": "sha256:50da0716d65b488b0fae6f3d8f486754eb3769ff79ffb91bc0c110e0b2d709c8"
+      "auditDigest": "sha256:6d18173f1048d68196da4729a078f77b85781ecbae0e34aadc1f862a5d83897a"
     },
     {
       "contractVersion": 1,
@@ -5308,5 +5308,5 @@
   "compatibilityFactCutRoot": "sha256:f61b975d4a96c921cc4bd37fb3ed9a0596b47004fe34dc7219979d697e3707f9",
   "compatibilityProofRegistryRoot": "sha256:b7194b811e4d3af2df4390bc4d1731e16a86215bd64ee18cb630dd5492f4fb63",
   "compatibilityDigest": "sha256:5de1c69386510b74b17eb70141b8bdd07063d62c504f91db5e84b67c6d4b64a2",
-  "contractDigest": "sha256:8ad0b8d13fb0e05f336598e0f660866a7c3c44bad26581317aa4e0c7b533fa0f"
+  "contractDigest": "sha256:bac35cbb0ea2f0ff54f9efbf0a9c60d40cba615d3198e3af65d551a50bee0617"
 }

package/dist/site/buildchain-site.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-bundle",
-  "generatedAt": "2026-08-23T21:19:58.618Z",
-  "publishedAt": "2026-08-23T21:19:58.618Z",
+  "generatedAt": "2026-08-24T01:19:23.921Z",
+  "publishedAt": "2026-08-24T01:19:23.921Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "d5d1fee8815f9e720c55f510e1acdadeedd5255c",
+  "sourceRevision": "19f2fb7f6f72710295cb89a7ed7b19f27adb6ca8",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.33",
+    "version": "4.0.1-alpha.35",
     "versionSource": "package.json#version"
   },
   "source": {

package/dist/site/kfd-claims.json

@@ -21,7 +21,7 @@
     "contract": "kungfu-buildchain-public-surface-reverse-audit",
     "path": "dist/site/public-surface-audit.json",
     "status": "passed",
-    "sha256": "68f2e2e6cd163c1f62a3e5a29eed4c63653273f000b3b6740e34afcc2db65a72",
+    "sha256": "e4ebc61161a297767d5a6001e0adc3410f5adcc2a5dac0492322cf685bce33a0",
     "summary": {
       "cliCommandCount": 117,
       "workflowCount": 76,
@@ -246,7 +246,7 @@
       "contract": "kungfu-buildchain-public-surface-reverse-audit",
       "path": "dist/site/public-surface-audit.json",
       "status": "passed",
-      "sha256": "68f2e2e6cd163c1f62a3e5a29eed4c63653273f000b3b6740e34afcc2db65a72",
+      "sha256": "e4ebc61161a297767d5a6001e0adc3410f5adcc2a5dac0492322cf685bce33a0",
       "summary": {
         "cliCommandCount": 117,
         "workflowCount": 76,

package/dist/site/kfd-upstream-aggregate.json

@@ -4,7 +4,7 @@
   "product": {
     "id": "kungfu-tech-buildchain",
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.33",
+    "version": "4.0.1-alpha.35",
     "repository": "https://github.com/kungfu-systems/buildchain"
   },
   "source": {

package/dist/site/public-surface-audit.json

@@ -8846,7 +8846,7 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "ea47a31ce7ef3577f23e22055ab7be7715c3af494bcef63f76b426f2883086aa",
-    "workflowRegistryDigest": "9234f299162c84e43807f0d6dd7a9eb547b4753c45eea217c416575f215d0e75",
+    "workflowRegistryDigest": "2a28dcd5a1acaa78e3c88c935823a9d14b6f99fa668a7c45808465bb9b19dde2",
     "pageRegistryDigest": "619910e5c57fb8e94ea1525de1fb7699c412a8dafd7269bc9354cc6c4fe83f48"
   },
   "comparison": {

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-23T21:19:58.618Z",
-  "publishedAt": "2026-08-23T21:19:58.618Z",
+  "generatedAt": "2026-08-24T01:19:23.921Z",
+  "publishedAt": "2026-08-24T01:19:23.921Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "d5d1fee8815f9e720c55f510e1acdadeedd5255c",
+  "sourceRevision": "19f2fb7f6f72710295cb89a7ed7b19f27adb6ca8",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.33",
+    "version": "4.0.1-alpha.35",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-23T21:19:58.618Z",
-  "publishedAt": "2026-08-23T21:19:58.618Z",
+  "generatedAt": "2026-08-24T01:19:23.921Z",
+  "publishedAt": "2026-08-24T01:19:23.921Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "d5d1fee8815f9e720c55f510e1acdadeedd5255c",
+  "sourceRevision": "19f2fb7f6f72710295cb89a7ed7b19f27adb6ca8",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.1-alpha.33",
+    "version": "4.0.1-alpha.35",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",

package/dist/site/workflow-registry.json

@@ -2027,7 +2027,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.33",
+      "introducedVersion": "4.0.1-alpha.35",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2048,7 +2048,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.33",
+      "introducedVersion": "4.0.1-alpha.35",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2069,7 +2069,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.33",
+      "introducedVersion": "4.0.1-alpha.35",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -2119,7 +2119,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.1-alpha.33",
+      "introducedVersion": "4.0.1-alpha.35",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.1-alpha.33",
+  "version": "4.0.1-alpha.35",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/resume-from-candidate-run.mjs

@@ -41,10 +41,7 @@ import {
   verifyV4RuntimeAuthorizationReceipt,
 } from "../packages/core/v4-runtime-ref-resume-authority.js";
 
-function env(name, fallback = "") {
-  return process.env[name] || fallback;
-}
-
+function env(name, fallback = "") { return process.env[name] || fallback; }
 function requiredEnv(name) {
   const value = env(name).trim();
   if (!value) throw new Error(`${name} is required for candidate recovery`);
@@ -57,9 +54,7 @@ function splitRepository(repository) {
   return { owner: match[1], repo: match[2], fullName: `${match[1]}/${match[2]}` };
 }
 
-function splitPatterns(value = "") {
-  return String(value || "").split(/\r?\n|,/).map((entry) => entry.trim()).filter(Boolean);
-}
+function splitPatterns(value = "") { return String(value || "").split(/\r?\n|,/).map((entry) => entry.trim()).filter(Boolean); }
 
 function patternMatcher(pattern) {
   const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*");
@@ -700,14 +695,26 @@ export function createRecoveredPublicationCandidate({
   };
   return { ...payload, candidateDigest: publicationArtifactCandidateDigest(payload) };
 }
-
-export function createRecoveredPublication({ downloads, bundleRoot, repository, passport, candidateRuntimeSha, publishArtifactKind, publishPackageMain, releasePatterns, platformManifests }) {
-  const allFiles = downloads.flatMap((download) => download.files.map((file) => ({
-    path: path.relative(bundleRoot, file.absolutePath).split(path.sep).join("/"),
-    size: file.size,
-    sha256: file.sha256.replace(/^sha256:/, ""),
-    absolutePath: file.absolutePath,
-  }))).sort((left, right) => left.path.localeCompare(right.path));
+export function resolveRecoveredPublicationVersion({ artifactVersion, channel, rematerializeOnResume = false } = {}) {
+  const version = String(artifactVersion || "").trim(), match = version.match(/^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u);
+  if (!match) throw new Error(`recovered npm artifact has invalid publication version: ${version || "<empty>"}`);
+  return channel === "release" && rematerializeOnResume ? match[1] : version;
+}
+export function resolveRecoveredCandidateVersion({ artifactVersion, publicationVersion, channel, rematerializeOnResume = false, targetRef = "", candidateRef = "" } = {}) {
+  const version = String(artifactVersion || "").trim(), target = String(targetRef || "").replace(/^refs\/heads\//u, ""), candidate = String(candidateRef || "").replace(/^refs\/heads\//u, "");
+  if (channel !== "release" || !rematerializeOnResume) return version;
+  const prefix = `publish-gate/${target}/`;
+  if (!target || !candidate.startsWith(prefix)) throw new Error(`stable recovery candidate ref must descend from ${prefix || "publish-gate/<target>/"}`);
+  const candidateVersion = candidate.slice(prefix.length);
+  if (!/^\d+\.\d+\.\d+-alpha\.\d+$/u.test(candidateVersion)) throw new Error(`stable recovery candidate ref must bind an exact alpha version, got ${candidateVersion || "<empty>"}`);
+  if (candidateVersion.replace(/-alpha\.\d+$/u, "") !== publicationVersion) throw new Error(`stable recovery candidate ${candidateVersion} does not match publication ${publicationVersion || "<empty>"}`);
+  if (![candidateVersion, publicationVersion].includes(version)) throw new Error(`recovered npm artifact version ${version || "<empty>"} is not bound to candidate ${candidateVersion} or publication ${publicationVersion}`);
+  return candidateVersion;
+}
+export function createRecoveredPublication({ downloads, bundleRoot, repository, passport, candidateRuntimeSha, publishArtifactKind, publishPackageMain, releasePatterns, platformManifests, channel, targetRef = "", candidateRef = "", rematerializeOnResume = false }) {
+  const allFiles = downloads.flatMap((download) => download.files.map((file) => ({ path: path.relative(bundleRoot, file.absolutePath).split(path.sep).join("/"),
+    size: file.size, sha256: file.sha256.replace(/^sha256:/, ""), absolutePath: file.absolutePath })))
+    .sort((left, right) => left.path.localeCompare(right.path));
   const kind = String(publishArtifactKind || "npm");
   const releaseMatchers = splitPatterns(releasePatterns).map(patternMatcher);
   const releaseAssets = allFiles.filter((file) => releaseMatchers.some((matcher) => matcher.test(path.basename(file.path))));
@@ -715,12 +722,8 @@ export function createRecoveredPublication({ downloads, bundleRoot, repository,
     createRecoveredPublicationCandidate({ allFiles, repository, passport, candidateRuntimeSha });
     const version = String(passport.target?.version || "").trim();
     if (!version) throw new Error("candidate recovery requires a passport publication version");
-    return {
-      manifest: undefined,
-      npmArtifacts: [],
-      allFiles,
-      releaseAssets,
-      version,
+    return { manifest: undefined, npmArtifacts: [], allFiles, releaseAssets,
+      version, candidateVersion: version,
       publishRequiredArtifacts: generatePublishRequiredArtifacts({ manifests: platformManifests, version, kind }),
     };
   }
@@ -732,12 +735,9 @@ export function createRecoveredPublication({ downloads, bundleRoot, repository,
   const npmReleaseAssets = allFiles.filter((file) => releaseMatchers.length
     ? releaseMatchers.some((matcher) => matcher.test(path.basename(file.path)))
     : file.path.toLowerCase().endsWith(".tgz"));
-  const candidate = createRecoveredPublicationCandidate({
-    allFiles,
-    repository,
-    passport,
-    candidateRuntimeSha,
-  });
+  const publicationVersion = resolveRecoveredPublicationVersion({ artifactVersion: main.metadata.ref, channel, rematerializeOnResume });
+  const candidateVersion = resolveRecoveredCandidateVersion({ artifactVersion: main.metadata.ref, publicationVersion, channel, rematerializeOnResume, targetRef, candidateRef });
+  const candidate = createRecoveredPublicationCandidate({ allFiles, repository, passport, candidateRuntimeSha });
   const manifest = createPublicationSealedBundle({
     candidate,
     packageName: main.metadata.name,
@@ -751,12 +751,12 @@ export function createRecoveredPublication({ downloads, bundleRoot, repository,
     npmArtifacts,
     allFiles,
     releaseAssets: npmReleaseAssets,
-    version: manifest.npm.version,
+    version: publicationVersion, candidateVersion,
     publishRequiredArtifacts: generatePublishRequiredArtifacts({
       kind: "npm",
       tarballPaths: npmArtifacts.map((entry) => entry.file.absolutePath),
       mainPackage: publishPackageMain,
-    }),
+    }).map((artifact) => rematerializeOnResume ? { ...artifact, ref: publicationVersion } : artifact),
   };
 }
 
@@ -832,9 +832,9 @@ export async function resolveRecoveryTransaction({
       })
     : undefined;
   if (!transaction) {
-    transaction = await readExistingTransactionById({
-      repoInfo, apiUrl, token, fetchImpl, transactionId,
-    });
+    transaction = transactionId
+      ? await readExistingTransactionById({ repoInfo, apiUrl, token, fetchImpl, transactionId })
+      : undefined;
   }
   return { version: transaction?.version || publicationVersion, transaction };
 }
@@ -865,7 +865,7 @@ export async function resumeFromCandidateRun({
   channel, targetRef, targetSha,
   expectedSourceTree = "", expectedCandidateRoot = "",
   candidateRuntimeSha, runtimeSha,
-  transactionId = "", artifactName = "", artifactPatterns = "", releasePatterns = "",
+  transactionId = "", artifactName = "", artifactPatterns = "", releasePatterns = "", rematerializeOnResume = false,
   requiredArtifactCount = 0,
   publishArtifactKind = "npm", publishPackageMain = "",
   outputDir = ".buildchain/release-candidate-recovery",
@@ -908,7 +908,7 @@ export async function resumeFromCandidateRun({
       publishArtifactKind,
       publishPackageMain,
       releasePatterns,
-      platformManifests: platformManifestEvidence.manifests,
+      platformManifests: platformManifestEvidence.manifests, channel, targetRef, candidateRef: pullRequest.head?.ref || "", rematerializeOnResume,
     });
     const stageCapsules = resolveRecoveredStageCapsules({
       candidateRuntimeSha,
@@ -918,7 +918,7 @@ export async function resumeFromCandidateRun({
       downloads,
     });
     const {
-      version: candidateVersion,
+      version: publicationVersion,
       transaction: existingTransaction,
     } = await resolveRecoveryTransaction({
       repoInfo,
@@ -976,7 +976,7 @@ export async function resumeFromCandidateRun({
       platformManifestEvidence: platformManifestEvidence.evidence,
       productPayloadManifests,
       artifacts: downloads.map((download) => download.record),
-      publicationVersion: candidateVersion,
+      publicationVersion,
       currentToolingSha: runtimeSha,
       recoveryRunId,
     });
@@ -992,7 +992,7 @@ export async function resumeFromCandidateRun({
           repoInfo,
           targetRef,
           runtimeSha,
-          version: candidateVersion,
+          version: publicationVersion,
           passport,
           sidecar: stageCapsuleSidecar,
           stageCapsules,
@@ -1007,7 +1007,7 @@ export async function resumeFromCandidateRun({
       repository: repoInfo.fullName,
       run: { id: runId, url: run.html_url || "", name: run.name },
       artifacts: { passport: selected.passport.name, summary: selected.summary.name, payloads: chosen.map((artifact) => artifact.name), sourceSha: selected.sourceSha },
-      version: candidateVersion,
+      version: publicationVersion, candidateVersion: publication.candidateVersion,
       candidateRoot: recovery.receipt.recovered.candidateRoot,
       artifactRoot: recovery.receipt.recovered.artifactRoot,
       receipt: recovery.receipt,
@@ -1048,7 +1048,7 @@ export async function resumeFromCandidateRunCli() {
       expectedCandidateRoot: env("BUILDCHAIN_RESUME_EXPECTED_CANDIDATE_ROOT"),
       candidateRuntimeSha: requiredEnv("BUILDCHAIN_RESUME_EXPECTED_CANDIDATE_RUNTIME_SHA"),
       runtimeSha: requiredEnv("BUILDCHAIN_RESUME_RUNTIME_SHA"),
-      transactionId: env("BUILDCHAIN_RESUME_TRANSACTION_ID"),
+      transactionId: env("BUILDCHAIN_RESUME_TRANSACTION_ID"), rematerializeOnResume: env("BUILDCHAIN_PUBLISH_REMATERIALIZE_ON_RESUME") === "true",
       artifactName: env("BUILDCHAIN_ARTIFACT_NAME"),
       artifactPatterns: env("BUILDCHAIN_ARTIFACT_PATTERNS"),
       releasePatterns: env("BUILDCHAIN_GITHUB_RELEASE_PAYLOAD_PATTERNS"),
@@ -1062,7 +1062,7 @@ export async function resumeFromCandidateRunCli() {
       "release-candidate-action": result.action,
       "release-candidate-passport-path": result.paths.passport,
       "release-candidate-build-summary-path": result.paths.buildSummary,
-      "release-candidate-version": result.version,
+      "release-candidate-version": result.candidateVersion, "release-candidate-publication-version": result.version,
       "release-candidate-source-sha": result.artifacts.sourceSha,
       "release-candidate-artifact": result.artifacts.passport,
       "release-candidate-build-summary-artifact": result.artifacts.summary,