@kungfu-tech/buildchain 4.0.2-alpha.4 → 4.0.2-alpha.41

package/packages/core/v4-canonical-contracts.js

@@ -1,4 +1,4 @@
-import crypto from "node:crypto";
+import { V4DomainWasmFault, invokeV4DomainWasm } from "./v4-domain-wasm.js";
 
 export const V4_CANONICAL_JSON_CONTRACT = "buildchain-canonical-json/v1";
 export const V4_EVENT_ENVELOPE_CONTRACT = "buildchain-v4-event-envelope/v1";
@@ -28,6 +28,7 @@ const ROOT_DOMAINS = new Set([
   "stage-capsule-quarantine",
   "stage-capsule-resume-observation",
   "stage-capsule-resume-plan",
+  "source-verification-evidence",
   "stage-capsule-artifact-manifest",
   "stage-capsule-artifact-content",
   "stage-capsule-fault-campaign",
@@ -56,6 +57,10 @@ const ROOT_DOMAINS = new Set([
   "stable-publication-fence",
   "partial-mutation-recovery-checkpoint",
   "partial-mutation-recovery-plan",
+  "v4-product-required-artifacts",
+  "v4-product-publication-intent",
+  "v4-product-publication-operation",
+  "v4-product-publication-plan",
   "tail-reseal-plan",
   "tail-reseal-admission",
   "tail-reseal-artifact-files",
@@ -106,89 +111,23 @@ function exactKeys(value, keys, path) {
     fault("invalid-envelope-shape", path, `${path} keys are not canonical`);
 }
 
-function canonicalize(value, path, active) {
-  if (value === null || typeof value === "boolean") return value;
-  if (typeof value === "string") {
-    for (let index = 0; index < value.length; index += 1) {
-      const code = value.charCodeAt(index);
-      if (code >= 0xd800 && code <= 0xdbff) {
-        const next = value.charCodeAt(index + 1);
-        if (!(next >= 0xdc00 && next <= 0xdfff))
-          fault(
-            "unsupported-string",
-            path,
-            `${path} contains an unpaired surrogate`,
-          );
-        index += 1;
-      } else if (code >= 0xdc00 && code <= 0xdfff) {
-        fault(
-          "unsupported-string",
-          path,
-          `${path} contains an unpaired surrogate`,
-        );
-      }
-    }
-    return value;
-  }
-  if (typeof value === "number") {
-    if (!Number.isSafeInteger(value) || Object.is(value, -0))
-      fault(
-        "unsupported-number",
-        path,
-        `${path} must be a safe base-10 integer and must not be negative zero`,
-      );
-    return value;
-  }
-  if (!value || typeof value !== "object")
-    fault("unsupported-json-value", path, `${path} is not a JSON value`);
-  if (active.has(value))
-    fault("cyclic-json-value", path, `${path} contains a cycle`);
-  active.add(value);
+function wasm(operation, payload) {
   try {
-    if (Array.isArray(value))
-      return Array.from(value, (entry, index) =>
-        canonicalize(entry, `${path}/${index}`, active),
-      );
-    const prototype = Object.getPrototypeOf(value);
-    if (prototype !== Object.prototype && prototype !== null)
-      fault("unsupported-json-value", path, `${path} must be a plain object`);
-    const result = Object.create(null);
-    for (const key of Object.keys(value).sort((left, right) =>
-      left < right ? -1 : left > right ? 1 : 0,
-    )) {
-      if (!ASCII_KEY_PATTERN.test(key))
-        fault(
-          "unsupported-object-key",
-          `${path}/${key}`,
-          "object keys must be non-empty printable ASCII",
-        );
-      result[key] = canonicalize(value[key], `${path}/${key}`, active);
+    return invokeV4DomainWasm(operation, payload);
+  } catch (error) {
+    if (error instanceof V4DomainWasmFault) {
+      fault(error.code, error.path, error.message);
     }
-    return result;
-  } finally {
-    active.delete(value);
+    throw error;
   }
 }
 
 export function v4CanonicalBytes(value) {
-  return Buffer.from(
-    `${JSON.stringify(canonicalize(value, "$", new Set()))}\n`,
-    "utf8",
-  );
+  return Buffer.from(wasm("canonical-json", value).canonicalUtf8, "utf8");
 }
 
 export function v4ContentRoot(domain, value) {
-  if (!ROOT_DOMAINS.has(domain))
-    fault(
-      "unsupported-root-domain",
-      "$.domain",
-      `unsupported root domain: ${domain}`,
-    );
-  const hash = crypto.createHash("sha256");
-  hash.update(domain, "ascii");
-  hash.update(Buffer.from([0]));
-  hash.update(v4CanonicalBytes(value));
-  return `sha256:${hash.digest("hex")}`;
+  return wasm("content-root", { domain, value }).root;
 }
 
 export function validateV4Root(value, path = "$.root") {

package/packages/core/v4-domain-wasm-artifact.js

@@ -0,0 +1,7 @@
+// Generated by scripts/build-v4-domain-wasm.mjs.
+export const V4_DOMAIN_WASM_ABI_VERSION = 1;
+export const V4_DOMAIN_WASM_RUSTC = "rustc 1.96.0 (ac68faa20 2026-05-25)";
+export const V4_DOMAIN_WASM_SOURCE_SHA256 =
+  "07d45b2767e22007d3d41fa32c8a2dba28d9c88c11a2b28863e82d54be3a2933";
+export const V4_DOMAIN_WASM_SHA256 =
+  "b37c330e9366b7e9cf9dc4b7573b1e9495212dd9520e8b8ec6cdc3fd0ab7cafd";

package/packages/core/v4-domain-wasm.js

@@ -0,0 +1,216 @@
+import fs from "node:fs";
+import { createHash } from "node:crypto";
+
+import {
+  V4_DOMAIN_WASM_ABI_VERSION,
+  V4_DOMAIN_WASM_SHA256,
+} from "./v4-domain-wasm-artifact.js";
+
+export const V4_DOMAIN_WASM_REQUEST_CONTRACT =
+  "kungfu-buildchain-v4-domain-wasm-request/v1";
+export const V4_DOMAIN_WASM_RESPONSE_CONTRACT =
+  "kungfu-buildchain-v4-domain-wasm-response/v1";
+
+const WASM_URL = new URL("./buildchain-v4-domain.wasm", import.meta.url);
+const REQUIRED_EXPORTS = [
+  "memory",
+  "buildchain_v4_wasm_abi_version",
+  "buildchain_v4_wasm_alloc",
+  "buildchain_v4_wasm_dealloc",
+  "buildchain_v4_wasm_invoke",
+  "buildchain_v4_wasm_response_pointer",
+  "buildchain_v4_wasm_response_length",
+];
+
+let loaded;
+
+export class V4DomainWasmFault extends Error {
+  constructor(fault) {
+    super(fault?.message || "Rust/WASM domain request failed");
+    this.name = "V4DomainWasmFault";
+    this.fault = fault;
+    this.code = fault?.code || "rust-wasm-domain-failed";
+    this.path = fault?.path || "$";
+    this.retry = fault?.retry || "stop";
+  }
+}
+
+function failClosed(message, cause) {
+  const error = new Error(`Buildchain v4 Rust/WASM authority: ${message}`);
+  error.code = "rust-wasm-authority-unavailable";
+  error.cause = cause;
+  throw error;
+}
+
+function invalidTransport(code, path, message) {
+  throw new V4DomainWasmFault({ code, path, message, retry: "stop" });
+}
+
+function validateJsonTransport(value, path, active) {
+  if (value === null || typeof value === "boolean") return;
+  if (typeof value === "string") {
+    for (let index = 0; index < value.length; index += 1) {
+      const code = value.charCodeAt(index);
+      if (code >= 0xd800 && code <= 0xdbff) {
+        const next = value.charCodeAt(index + 1);
+        if (!(next >= 0xdc00 && next <= 0xdfff)) {
+          invalidTransport(
+            "unsupported-string",
+            path,
+            `${path} contains an unpaired surrogate`,
+          );
+        }
+        index += 1;
+      } else if (code >= 0xdc00 && code <= 0xdfff) {
+        invalidTransport(
+          "unsupported-string",
+          path,
+          `${path} contains an unpaired surrogate`,
+        );
+      }
+    }
+    return;
+  }
+  if (typeof value === "number") {
+    if (!Number.isSafeInteger(value) || Object.is(value, -0)) {
+      invalidTransport(
+        "unsupported-number",
+        path,
+        `${path} must be a safe base-10 integer and must not be negative zero`,
+      );
+    }
+    return;
+  }
+  if (!value || typeof value !== "object") {
+    invalidTransport(
+      "unsupported-json-value",
+      path,
+      `${path} is not a JSON value`,
+    );
+  }
+  if (active.has(value)) {
+    invalidTransport("cyclic-json-value", path, `${path} contains a cycle`);
+  }
+  active.add(value);
+  try {
+    if (Array.isArray(value)) {
+      for (let index = 0; index < value.length; index += 1) {
+        validateJsonTransport(value[index], `${path}/${index}`, active);
+      }
+      return;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      invalidTransport(
+        "unsupported-json-value",
+        path,
+        `${path} must be a plain object`,
+      );
+    }
+    for (const key of Object.keys(value)) {
+      if (!/^[\x20-\x7e]+$/u.test(key)) {
+        invalidTransport(
+          "unsupported-object-key",
+          `${path}/${key}`,
+          "object keys must be non-empty printable ASCII",
+        );
+      }
+      validateJsonTransport(value[key], `${path}/${key}`, active);
+    }
+  } finally {
+    active.delete(value);
+  }
+}
+
+function loadAuthority() {
+  if (loaded) return loaded;
+  let bytes;
+  try {
+    bytes = fs.readFileSync(WASM_URL);
+  } catch (error) {
+    failClosed(`cannot read ${WASM_URL.pathname}`, error);
+  }
+  const observedSha256 = createHash("sha256").update(bytes).digest("hex");
+  if (observedSha256 !== V4_DOMAIN_WASM_SHA256) {
+    failClosed(
+      `artifact digest mismatch (expected ${V4_DOMAIN_WASM_SHA256}, observed ${observedSha256})`,
+    );
+  }
+  let instance;
+  try {
+    instance = new WebAssembly.Instance(new WebAssembly.Module(bytes), {});
+  } catch (error) {
+    failClosed("artifact compilation or instantiation failed", error);
+  }
+  const missing = REQUIRED_EXPORTS.filter(
+    (name) => instance.exports[name] === undefined,
+  );
+  if (missing.length > 0) {
+    failClosed(`artifact is missing exports: ${missing.join(", ")}`);
+  }
+  const abiVersion = instance.exports.buildchain_v4_wasm_abi_version();
+  if (abiVersion !== V4_DOMAIN_WASM_ABI_VERSION) {
+    failClosed(
+      `ABI mismatch (expected ${V4_DOMAIN_WASM_ABI_VERSION}, observed ${abiVersion})`,
+    );
+  }
+  loaded = instance.exports;
+  return loaded;
+}
+
+export function invokeV4DomainWasm(operation, payload) {
+  if (
+    ["canonical-json", "content-root", "release-tail-root"].includes(operation)
+  ) {
+    validateJsonTransport(payload, "$/payload", new Set());
+  }
+  const authority = loadAuthority();
+  const input = new TextEncoder().encode(
+    JSON.stringify({
+      schema: V4_DOMAIN_WASM_REQUEST_CONTRACT,
+      operation,
+      payload,
+    }),
+  );
+  const inputPointer = authority.buildchain_v4_wasm_alloc(input.byteLength);
+  try {
+    new Uint8Array(authority.memory.buffer, inputPointer, input.byteLength).set(
+      input,
+    );
+    try {
+      authority.buildchain_v4_wasm_invoke(inputPointer, input.byteLength);
+    } catch (error) {
+      failClosed(`operation '${operation}' trapped`, error);
+    }
+    const responsePointer = authority.buildchain_v4_wasm_response_pointer();
+    const responseLength = authority.buildchain_v4_wasm_response_length();
+    let response;
+    try {
+      const responseBytes = new Uint8Array(
+        authority.memory.buffer,
+        responsePointer,
+        responseLength,
+      );
+      response = JSON.parse(new TextDecoder().decode(responseBytes));
+    } catch (error) {
+      failClosed(
+        `operation '${operation}' returned an invalid response`,
+        error,
+      );
+    }
+    if (
+      response?.schema !== V4_DOMAIN_WASM_RESPONSE_CONTRACT ||
+      typeof response.ok !== "boolean"
+    ) {
+      failClosed(`operation '${operation}' returned an unsupported response`);
+    }
+    if (!response.ok) throw new V4DomainWasmFault(response.fault);
+    return response.value;
+  } finally {
+    authority.buildchain_v4_wasm_dealloc(inputPointer, input.byteLength);
+  }
+}
+
+export function v4DomainWasmInfo() {
+  return invokeV4DomainWasm("abi-info", {});
+}

package/packages/core/v4-floating-consumer-evidence.js

@@ -10,7 +10,7 @@ export const V4_FLOATING_CONSUMER_CERTIFICATION =
 const SHA256_ROOT = /^sha256:[0-9a-f]{64}$/u;
 const ALPHA_RECOVERY_BOOTSTRAP = Object.freeze({
   repository: "kungfu-systems/buildchain",
-  sourcePath: ".github/workflows/buildchain-ref-promotion-recovery.yml",
+  sourcePath: ".github/workflows/self-ops-promotion-recovery.yml",
   workflow: ".github/workflows/.release-candidate-promote.yml",
   selector: "alpha/v4/v4.0",
 });

package/packages/core/v4-floating-consumer-policy.js

@@ -28,7 +28,7 @@ const BUILDCHAIN_REPOSITORY = "kungfu-systems/buildchain";
 const CHANNELS = Object.freeze({ v4: "stable", "v4-alpha": "alpha" });
 const ALPHA_RECOVERY_BOOTSTRAP = Object.freeze({
   selector: "alpha/v4/v4.0",
-  sourcePath: ".github/workflows/buildchain-ref-promotion-recovery.yml",
+  sourcePath: ".github/workflows/self-ops-promotion-recovery.yml",
   workflow: ".github/workflows/.release-candidate-promote.yml",
 });
 const DEFAULT_STABLE_LOCK_PATH = ".buildchain/contract-lock.json";