@kungfu-tech/buildchain 4.0.1-alpha.5 → 4.0.1-alpha.55

package/packages/core/v4-publication-rehearsal.js

@@ -0,0 +1,481 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+import {
+  executeReleaseTailTransaction,
+  releaseTailRoot,
+  validateReleaseTailTransaction,
+} from "./release-tail-provider-plane.js";
+import {
+  V4_PUBLICATION_REHEARSAL_AUTHORITY_CONTRACT,
+  V4_PUBLICATION_REHEARSAL_CAPSULE_CONTRACT,
+  V4_PUBLICATION_REHEARSAL_CORE_VERSION,
+  V4_PUBLICATION_REHEARSAL_EVIDENCE_CONTRACT,
+  V4_PUBLICATION_REHEARSAL_PROVIDER_POLICY_CONTRACT,
+  V4PublicationRehearsalFault,
+  assertPublicationRehearsalExactKeys as exactKeys,
+  createV4PublicationRehearsalCapsule,
+  createV4PublicationRehearsalProviderPolicy,
+  publicationRehearsalFault as fault,
+  publicationRehearsalRoot,
+  validateV4PublicationRehearsalCapsule,
+  validateV4PublicationRehearsalProviderBindings,
+} from "./v4-publication-rehearsal-capsule.js";
+
+export {
+  V4_PUBLICATION_REHEARSAL_AUTHORITY_CONTRACT,
+  V4_PUBLICATION_REHEARSAL_CAPSULE_CONTRACT,
+  V4_PUBLICATION_REHEARSAL_CORE_VERSION,
+  V4_PUBLICATION_REHEARSAL_EVIDENCE_CONTRACT,
+  V4_PUBLICATION_REHEARSAL_PROVIDER_POLICY_CONTRACT,
+  V4PublicationRehearsalFault,
+  createV4PublicationRehearsalCapsule,
+  createV4PublicationRehearsalProviderPolicy,
+  validateV4PublicationRehearsalCapsule,
+  validateV4PublicationRehearsalProviderBindings,
+};
+
+const ROOT = /^sha256:[0-9a-f]{64}$/u;
+const MODES = new Set(["simulate", "replay", "provider"]);
+
+function fileRoot(filePath) {
+  const hash = crypto.createHash("sha256");
+  const descriptor = fs.openSync(filePath, "r");
+  const buffer = Buffer.allocUnsafe(8 * 1024 * 1024);
+  try {
+    for (;;) {
+      const count = fs.readSync(descriptor, buffer, 0, buffer.length, null);
+      if (count === 0) break;
+      hash.update(buffer.subarray(0, count));
+    }
+  } finally {
+    fs.closeSync(descriptor);
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
+
+function resolveCandidateFile(candidateRootPath, relative, location) {
+  const base = fs.realpathSync(candidateRootPath);
+  const resolved = path.resolve(base, relative);
+  if (!resolved.startsWith(`${base}${path.sep}`))
+    fault(
+      "publication-rehearsal-path-escape",
+      location,
+      "candidate path escapes the explicit root",
+    );
+  if (
+    !fs.existsSync(resolved) ||
+    !fs.statSync(resolved).isFile() ||
+    fs.lstatSync(resolved).isSymbolicLink() ||
+    !fs.realpathSync(resolved).startsWith(`${base}${path.sep}`)
+  )
+    fault(
+      "publication-rehearsal-file-missing",
+      location,
+      "regular in-root file required",
+    );
+  return resolved;
+}
+
+function resolveCandidateOutput(candidateRootPath, relative, location) {
+  const base = fs.realpathSync(candidateRootPath);
+  const resolved = path.resolve(base, relative);
+  if (!resolved.startsWith(`${base}${path.sep}`))
+    fault(
+      "publication-rehearsal-path-escape",
+      location,
+      "candidate output escapes the explicit root",
+    );
+  for (
+    let current = path.dirname(resolved);
+    current !== base;
+    current = path.dirname(current)
+  ) {
+    if (!fs.existsSync(current)) continue;
+    if (
+      fs.lstatSync(current).isSymbolicLink() ||
+      !fs.statSync(current).isDirectory() ||
+      !fs.realpathSync(current).startsWith(`${base}${path.sep}`)
+    )
+      fault(
+        "publication-rehearsal-path-escape",
+        location,
+        "candidate output ancestor is not a regular in-root directory",
+      );
+  }
+  if (
+    fs.existsSync(resolved) &&
+    (fs.lstatSync(resolved).isSymbolicLink() ||
+      !fs.statSync(resolved).isFile() ||
+      !fs.realpathSync(resolved).startsWith(`${base}${path.sep}`))
+  )
+    fault(
+      "publication-rehearsal-path-escape",
+      location,
+      "candidate output is not a regular in-root file",
+    );
+  return resolved;
+}
+
+export function verifyV4PublicationRehearsalCapsule({
+  capsule,
+  candidateRoot: candidateRootPath,
+}) {
+  const normalized = validateV4PublicationRehearsalCapsule(capsule);
+  if (!path.isAbsolute(candidateRootPath || ""))
+    fault(
+      "publication-rehearsal-implicit-root-forbidden",
+      "$/candidateRoot",
+      "explicit absolute candidate root required",
+    );
+  if (
+    !fs.existsSync(candidateRootPath) ||
+    !fs.statSync(candidateRootPath).isDirectory()
+  )
+    fault(
+      "publication-rehearsal-candidate-missing",
+      "$/candidateRoot",
+      "candidate directory required",
+    );
+  for (const entry of normalized.files) {
+    const resolved = resolveCandidateFile(
+      candidateRootPath,
+      entry.path,
+      `$/files/${entry.path}`,
+    );
+    if (
+      fs.statSync(resolved).size !== entry.size ||
+      fileRoot(resolved) !== entry.root
+    )
+      fault(
+        "publication-rehearsal-file-tampered",
+        `$/files/${entry.path}`,
+        "candidate bytes do not match the capsule",
+      );
+  }
+  return normalized;
+}
+
+export function resolveV4PublicationRehearsalProviderBindings({
+  capsule,
+  candidateRoot: candidateRootPath,
+  providerBindings = capsule?.providerBindings,
+}) {
+  const normalized = verifyV4PublicationRehearsalCapsule({
+    capsule,
+    candidateRoot: candidateRootPath,
+  });
+  const supplied =
+    validateV4PublicationRehearsalProviderBindings(providerBindings);
+  if (
+    releaseTailRoot(supplied) !== normalized.providerBindingsRoot ||
+    JSON.stringify(supplied) !== JSON.stringify(normalized.providerBindings)
+  )
+    fault(
+      "publication-rehearsal-provider-bindings-root-mismatch",
+      "$/providerBindings",
+      "external provider bindings do not match the capsule",
+    );
+  return {
+    schema: supplied.schema,
+    artifacts: Object.fromEntries(
+      Object.entries(supplied.artifacts).map(([role, binding]) => [
+        role,
+        {
+          ...binding,
+          path: resolveCandidateFile(
+            candidateRootPath,
+            binding.path,
+            `$/providerBindings/artifacts/${role}/path`,
+          ),
+        },
+      ]),
+    ),
+    documents: Object.fromEntries(
+      Object.entries(supplied.documents).map(([capabilityId, binding]) => [
+        capabilityId,
+        {
+          ...binding,
+          path: resolveCandidateFile(
+            candidateRootPath,
+            binding.path,
+            `$/providerBindings/documents/${capabilityId}/path`,
+          ),
+        },
+      ]),
+    ),
+    evidence: {
+      inputs: supplied.evidence.inputs.map((inputPath, index) =>
+        resolveCandidateFile(
+          candidateRootPath,
+          inputPath,
+          `$/providerBindings/evidence/inputs/${index}`,
+        ),
+      ),
+      output: resolveCandidateOutput(
+        candidateRootPath,
+        supplied.evidence.output,
+        "$/providerBindings/evidence/output",
+      ),
+    },
+  };
+}
+
+function simulatedAdapters(declaration, transcript) {
+  const applied = new Set();
+  return Object.fromEntries(
+    declaration.capabilities.map((capability) => [
+      capability.adapter,
+      {
+        async readback(effect) {
+          const response = applied.has(effect.operationId)
+            ? {
+                outcome: "observed",
+                subjectRoot: effect.subjectRoot,
+                targetRoot: effect.targetRoot,
+                evidenceRoots: [effect.targetRoot],
+                providerCode: "simulation-observed",
+              }
+            : {
+                outcome: "absent",
+                subjectRoot: "",
+                targetRoot: "",
+                evidenceRoots: [],
+                providerCode: "simulation-absent",
+              };
+          transcript.push({
+            operationId: effect.operationId,
+            method: "readback",
+            requestRoot: effect.effectRoot,
+            response,
+          });
+          return response;
+        },
+        async apply(effect) {
+          applied.add(effect.operationId);
+          transcript.push({
+            operationId: effect.operationId,
+            method: "apply",
+            requestRoot: effect.effectRoot,
+            response: { outcome: "simulated", code: "effect-disabled" },
+          });
+        },
+      },
+    ]),
+  );
+}
+
+function observationAdapters(capsule, transcript, adapters, mode) {
+  const records = new Map(
+    capsule.expectedObservations.entries.map((entry) => [
+      entry.operationId,
+      { ...entry, index: 0 },
+    ]),
+  );
+  return Object.fromEntries(
+    capsule.declaration.capabilities.map((capability) => {
+      const provided = adapters?.[capability.adapter];
+      if (
+        mode === "provider" &&
+        (!provided ||
+          typeof provided.readback !== "function" ||
+          typeof provided.apply !== "function")
+      )
+        fault(
+          "publication-rehearsal-provider-adapter-missing",
+          "$/adapters",
+          `adapter missing: ${capability.adapter}`,
+        );
+      return [
+        capability.adapter,
+        {
+          async readback(effect) {
+            const record = records.get(effect.operationId);
+            const expected = record?.readbacks[record.index++];
+            if (!expected)
+              fault(
+                "publication-rehearsal-observation-exhausted",
+                "$/expectedObservations",
+                `readback missing for ${effect.operationId}`,
+              );
+            const response =
+              mode === "replay"
+                ? structuredClone(expected)
+                : await provided.readback(effect);
+            if (JSON.stringify(response) !== JSON.stringify(expected))
+              fault(
+                "publication-rehearsal-provider-readback-mismatch",
+                "$/expectedObservations",
+                `provider readback drifted for ${effect.operationId}`,
+              );
+            transcript.push({
+              operationId: effect.operationId,
+              method: "readback",
+              requestRoot: effect.effectRoot,
+              response: structuredClone(response),
+            });
+            return response;
+          },
+          async apply(effect) {
+            const record = records.get(effect.operationId);
+            if (!record)
+              fault(
+                "publication-rehearsal-observation-exhausted",
+                "$/expectedObservations",
+                `apply missing for ${effect.operationId}`,
+              );
+            if (mode === "provider") await provided.apply(effect);
+            transcript.push({
+              operationId: effect.operationId,
+              method: "apply",
+              requestRoot: effect.effectRoot,
+              response: structuredClone(record.apply),
+            });
+            if (record.apply.outcome !== "applied") {
+              const error = new Error(
+                "expected provider apply did not succeed",
+              );
+              error.releaseTailCode = record.apply.code;
+              error.releaseTailClass = record.apply.classification;
+              throw error;
+            }
+          },
+        },
+      ];
+    }),
+  );
+}
+
+export function createV4PublicationRehearsalAuthority(
+  capsule,
+  { authorizationRoot } = {},
+) {
+  const normalized = validateV4PublicationRehearsalCapsule(capsule);
+  const body = {
+    schema: V4_PUBLICATION_REHEARSAL_AUTHORITY_CONTRACT,
+    mode: "provider-rehearsal",
+    capsuleRoot: normalized.capsuleRoot,
+    providerPolicyRoot: normalized.providerPolicy.root,
+    providerBindingsRoot: normalized.providerBindingsRoot,
+    authorizationRoot: publicationRehearsalRoot(
+      authorizationRoot,
+      "$/authorizationRoot",
+    ),
+    productionAuthority: false,
+  };
+  return { ...body, authorityRoot: releaseTailRoot(body) };
+}
+
+function validateAuthority(value, capsule) {
+  exactKeys(
+    value,
+    [
+      "schema",
+      "mode",
+      "capsuleRoot",
+      "providerPolicyRoot",
+      "providerBindingsRoot",
+      "authorizationRoot",
+      "productionAuthority",
+      "authorityRoot",
+    ],
+    "$/authority",
+  );
+  const body = { ...value };
+  delete body.authorityRoot;
+  if (
+    value.schema !== V4_PUBLICATION_REHEARSAL_AUTHORITY_CONTRACT ||
+    value.mode !== "provider-rehearsal" ||
+    value.productionAuthority !== false ||
+    value.capsuleRoot !== capsule.capsuleRoot ||
+    value.providerPolicyRoot !== capsule.providerPolicy.root ||
+    value.providerBindingsRoot !== capsule.providerBindingsRoot ||
+    !ROOT.test(value.authorizationRoot) ||
+    value.authorityRoot !== releaseTailRoot(body)
+  )
+    fault(
+      "publication-rehearsal-authority-mismatch",
+      "$/authority",
+      "exact rehearsal-only authority required",
+    );
+  return structuredClone(value);
+}
+
+export async function executeV4PublicationRehearsal({
+  capsule,
+  candidateRoot: candidateRootPath,
+  mode = "simulate",
+  adapters = {},
+  authority = null,
+  transaction = null,
+  checkpoint,
+} = {}) {
+  if (!MODES.has(mode))
+    fault(
+      "invalid-publication-rehearsal-mode",
+      "$/mode",
+      "simulate, replay, or provider required",
+    );
+  const normalized = verifyV4PublicationRehearsalCapsule({
+    capsule,
+    candidateRoot: candidateRootPath,
+  });
+  const providerAuthority =
+    mode === "provider" ? validateAuthority(authority, normalized) : null;
+  const current = transaction
+    ? structuredClone(transaction)
+    : structuredClone(normalized.transaction);
+  const validation = validateReleaseTailTransaction(current);
+  if (
+    !validation.valid ||
+    current.transactionRoot !== normalized.transaction.transactionRoot ||
+    current.declarationRoot !== normalized.transaction.declarationRoot ||
+    current.planRoot !== normalized.transaction.planRoot
+  )
+    fault(
+      "publication-rehearsal-transaction-mismatch",
+      "$/transaction",
+      "transaction is not bound to this capsule",
+    );
+  const transcript = [];
+  const selectedAdapters =
+    mode === "simulate"
+      ? simulatedAdapters(normalized.declaration, transcript)
+      : observationAdapters(normalized, transcript, adapters, mode);
+  const result = await executeReleaseTailTransaction(current, {
+    adapters: selectedAdapters,
+    checkpoint,
+  });
+  const body = {
+    schema: V4_PUBLICATION_REHEARSAL_EVIDENCE_CONTRACT,
+    mode,
+    truth:
+      mode === "provider"
+        ? "provider-observed"
+        : mode === "replay"
+          ? "recorded-replay"
+          : "simulation-only",
+    capsuleRoot: normalized.capsuleRoot,
+    sourceRoot: normalized.source.root,
+    candidateRoot: normalized.candidate.root,
+    manifestRoot: normalized.manifest.root,
+    configRoot: normalized.config.root,
+    providerBindingsRoot: normalized.providerBindingsRoot,
+    providerPolicyRoot: normalized.providerPolicy.root,
+    expectedObservationRoot: normalized.expectedObservations.root,
+    coreVersion: normalized.coreVersion,
+    transactionRoot: result.transactionRoot,
+    stateRoot: result.stateRoot,
+    receiptRoots: result.receipts.map(({ receiptRoot }) => receiptRoot),
+    transcript,
+    transcriptRoot: releaseTailRoot(transcript),
+    authorityRoot: providerAuthority?.authorityRoot || null,
+    productionAuthority: false,
+    releasePassport: null,
+  };
+  return {
+    transaction: result,
+    evidence: { ...body, evidenceRoot: releaseTailRoot(body) },
+  };
+}

package/packages/core/workflow-yaml-contract.js

@@ -67,8 +67,7 @@ function directEntries(lines, parentLine) {
     const trimmed = line.trim();
     const indent = indentation(line);
     if (trimmed && indent <= parentIndent) break;
-    if (!trimmed || trimmed.startsWith("#") || indent !== childIndent)
-      continue;
+    if (!trimmed || trimmed.startsWith("#") || indent !== childIndent) continue;
     const match = line.match(/^\s*([A-Za-z0-9_.-]+):(?:\s*(.*))?$/);
     if (match) {
       entries.push({
@@ -263,6 +262,28 @@ export function parseWorkflowCallJobs(text) {
     .filter((job) => job.uses);
 }
 
+export function parseWorkflowJobs(text) {
+  const lines = String(text || "").split(/\r?\n/);
+  const jobs = topLevelEntry(lines, "jobs");
+  if (!jobs) return [];
+  return directEntries(lines, jobs.line)
+    .map((job) => {
+      const properties = directEntries(lines, job.line);
+      const property = (name) =>
+        properties.find((entry) => entry.key === name) || null;
+      return {
+        id: job.key,
+        name: unquote(property("name")?.value || job.key),
+        uses: unquote(property("uses")?.value || ""),
+        runsOn: unquote(property("runs-on")?.value || ""),
+        timeoutMinutes: property("timeout-minutes")
+          ? scalar(property("timeout-minutes").value)
+          : null,
+      };
+    })
+    .sort((left, right) => compareCodeUnits(left.id, right.id));
+}
+
 function blockScalarIndent(lines, lineIndex, parentIndent) {
   for (let index = lineIndex + 1; index < lines.length; index += 1) {
     if (!lines[index].trim()) continue;
@@ -315,6 +336,7 @@ export function parseWorkflowDocument(text) {
   return {
     triggers: parseTriggers(String(text || "").split(/\r?\n/)),
     interface: parseReusableWorkflowInterface(text),
+    jobs: parseWorkflowJobs(text),
     callJobs: parseWorkflowCallJobs(text),
   };
 }

package/scripts/artifact-signing-controller-core.mjs

@@ -374,6 +374,7 @@ export function assertArtifactSigningControlRequestContext(
 export function artifactSigningControlRequestOutputs(request) {
   const value = validateArtifactSigningControlRequest(request);
   return {
+    "source-run-attempt": String(value.source.runAttempt),
     "request-count": String(value.request.count),
     "request-artifact": value.request.artifact,
     "request-root": value.request.root,
@@ -384,7 +385,6 @@ export function artifactSigningControlRequestOutputs(request) {
     "runtime-sha": value.runtime.sha,
   };
 }
-
 export function normalizeControllerStatus(value) {
   const normalized = required(value, "authority status");
   if (

package/scripts/audit-publication-control-plane.mjs

@@ -11,10 +11,9 @@ import {
 
 const GITHUB_JSON_MAX_BUFFER = 16 * 1024 * 1024;
 
-function flag(name, fallback = "") {
-  const index = process.argv.indexOf(`--${name}`);
-  return index === -1 ? fallback : String(process.argv[index + 1] || "");
-}
+const flag = (name, fallback = "") => process.argv.includes(`--${name}`)
+  ? String(process.argv[process.argv.indexOf(`--${name}`) + 1] || "")
+  : fallback;
 
 function commandJson(command, args, label, { publicReadFallback = false } = {}) {
   const options = {
@@ -42,13 +41,9 @@ function commandJson(command, args, label, { publicReadFallback = false } = {})
   }
 }
 
-function githubJson(apiPath, label, { publicReadFallback = false } = {}) {
-  return commandJson("gh", ["api", apiPath, "-H", "Accept: application/vnd.github+json"], label, { publicReadFallback });
-}
+const githubJson = (apiPath, label, { publicReadFallback = false } = {}) => commandJson("gh", ["api", apiPath, "-H", "Accept: application/vnd.github+json"], label, { publicReadFallback });
 
-function githubPublicJson(apiPath, label) {
-  return githubJson(apiPath, label, { publicReadFallback: true });
-}
+const githubPublicJson = (apiPath, label) => githubJson(apiPath, label, { publicReadFallback: true });
 
 function githubJsonOptional(apiPath, label, fallback, fallbackPattern = /404|not found/i) {
   const result = spawnSyncCommand("gh", ["api", apiPath, "-H", "Accept: application/vnd.github+json"], {
@@ -68,9 +63,7 @@ function githubJsonOptional(apiPath, label, fallback, fallbackPattern = /404|not
   }
 }
 
-function githubJsonReadLimited(apiPath, label, fallback) {
-  return githubJsonOptional(apiPath, label, fallback, /401|403|404|unauthorized|forbidden|not found/i);
-}
+const githubJsonReadLimited = (apiPath, label, fallback) => githubJsonOptional(apiPath, label, fallback, /401|403|404|unauthorized|forbidden|not found/i);
 
 function rulesetIncludesBranch(ruleset, branch, defaultBranch) {
   const includes = ruleset.conditions?.ref_name?.include || [];
@@ -102,7 +95,7 @@ function normalizeRulesetBranchPolicy(rulesets, branch, defaultBranch) {
   };
 }
 
-function jobBlock(workflowText, jobId) {
+function jobBlock(workflowText, jobId, delegated = false) {
   const lines = String(workflowText).split(/\r?\n/);
   const jobsIndex = lines.findIndex((line) => /^jobs:\s*$/.test(line));
   if (jobsIndex === -1) return "";
@@ -115,14 +108,21 @@ function jobBlock(workflowText, jobId) {
       break;
     }
   }
-  return lines.slice(start, end).join("\n");
+  const block = lines.slice(start, end).join("\n");
+  if (delegated) return block;
+  const declarations = [...block.matchAll(/^ {4}# buildchain-publication-authority-job:\s*([A-Za-z0-9_-]+)\s*$/gm)];
+  if (declarations.length > 1 || declarations[0]?.[1] === jobId) throw new Error(`publication authority job delegation is invalid: ${jobId}`);
+  if (!declarations.length) return block;
+  const delegatedJobId = declarations[0][1];
+  const delegatedBlock = jobBlock(workflowText, delegatedJobId, true);
+  if (!delegatedBlock) throw new Error(`delegated publication workflow job is missing: ${delegatedJobId}`);
+  return delegatedBlock;
 }
 
 function first(value, keys) {
   for (const key of keys) {
-    const parts = key.split(".");
     let current = value;
-    for (const part of parts) current = current && typeof current === "object" ? current[part] : undefined;
+    for (const part of key.split(".")) current = current && typeof current === "object" ? current[part] : undefined;
     if (current !== undefined && current !== null && current !== "") return current;
   }
   return undefined;

package/scripts/buildchain-cli-help.mjs

@@ -8,6 +8,11 @@ export const BUILDCHAIN_USAGE = `Usage:
   buildchain architecture qualify --authority-revision <git-revision>
                                       [--candidate-revision <git-revision>]
                                       [--cwd <dir>] [--json]
+  buildchain adopter-delivery run --input <json-or-path> [--output <path>]
+  buildchain adopter-delivery verify --input <json-or-path>
+                                      --readback <json-or-path> [--output <path>]
+  buildchain adopter-delivery bootstrap --input <json-or-path> [--output <path>]
+  buildchain adopter-delivery archive --input <json-or-path> [--output <path>]
   buildchain portable-cache plan --manifest <file-or-json> [--output <file>]
                                  [--github-output <file>] [--json]
   buildchain portable-cache receipt --plan <file-or-json> [--matched-key <key>]
@@ -44,6 +49,13 @@ export const BUILDCHAIN_USAGE = `Usage:
   buildchain release-tail init --declaration <json-or-path> [--state <path>]
   buildchain release-tail <status|verify> [--state <path>] [--output <path>]
   buildchain release-tail compat --hooks-json <json-or-path> [--output <path>]
+  buildchain release-tail rehearse --capsule <absolute-path>
+                                      --candidate-root <absolute-path>
+                                      [--capsule-root <absolute-path>]
+                                      [--environment-json <empty-json-or-path>]
+                                      --mode <simulate|replay>
+                                      --state <absolute-path>
+                                      --evidence <absolute-path>
   buildchain tail-reseal plan --request <request.json> [--output <plan.json>]
   buildchain tail-reseal admit --request <request.json> [--output <admission.json>]
   buildchain tail-reseal verify-platform --request <request.json> --platform <id>
@@ -60,6 +72,7 @@ export const BUILDCHAIN_USAGE = `Usage:
   buildchain release <inspect|recover|finalize|abort> ...
   buildchain transaction inspect ...
   buildchain collect github-release --tag <tag> [--repository <owner/repo>]
+                                    [--adopter-delivery-json <legacy-json-or-path>]
                                     [--assets-dir <dir>] [--assets-json <json-or-path>]
                                     [--release-json <json-or-path>] [--package-set-json <json-or-path>]
                                     [--product-name <name>]