@kungfu-tech/buildchain 4.0.2-alpha.45 → 4.0.2-alpha.46

package/dist/site/public-surface-audit.json

@@ -10933,8 +10933,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "fbc23073bbae240489a2f826b2c26daadc58e704050c5f8df366509f5c5a1c3e",
-    "workflowRegistryDigest": "e1bacd3ffb652ab8ef5c62986c4048d618e28ff43d4d03b61827adcce0e027be",
-    "pageRegistryDigest": "178bc7609c831a63cecdb5baa817672a53393bb7d40f43b25fc8a736d94e2e9d"
+    "workflowRegistryDigest": "cc88d63b25d61394b3bbc28cb81b72f3c7786d85bf7c5f68ab6baa426b9a552b",
+    "pageRegistryDigest": "6c4a4be1b2bc15c7842aa958b128f76ec405b9585f403e5cc604c16781a40afc"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-06T14:38:45.000Z",
-  "publishedAt": "2026-09-06T14:38:45.000Z",
+  "generatedAt": "2026-09-06T15:52:10.000Z",
+  "publishedAt": "2026-09-06T15:52:10.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "7f41a21e534d41655d1c956bdc688e3167c2d340",
+  "sourceRevision": "53db887810f830c27680040bc35969238b5d2a88",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.45",
+    "version": "4.0.2-alpha.46",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-06T14:38:45.000Z",
-  "publishedAt": "2026-09-06T14:38:45.000Z",
+  "generatedAt": "2026-09-06T15:52:10.000Z",
+  "publishedAt": "2026-09-06T15:52:10.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "7f41a21e534d41655d1c956bdc688e3167c2d340",
+  "sourceRevision": "53db887810f830c27680040bc35969238b5d2a88",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.45",
+    "version": "4.0.2-alpha.46",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -253,7 +253,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:48232d47023b85063e7f779f053850e38149359ea3b2a5acd5126ff81f423ff4"
+      "digest": "sha256:69f4e87e7cbf154f4b3241269e806e7998f9a517fb8ada64f120239c49abbd78"
     },
     {
       "id": "build-facts",
@@ -309,7 +309,7 @@
       "path": "docs/publish-transaction.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:635de0da30769e4e6f956748ec9758338a1ae7921bce73268c2d914ae240693d"
+      "digest": "sha256:713f4fd2b9e67cefdd394170eea49ddb92e803c2e6adac20d6f3b8b1e431b960"
     },
     {
       "id": "release-tail-contract",

package/dist/site/workflow-registry.json

@@ -2746,7 +2746,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.45",
+      "introducedVersion": "4.0.2-alpha.46",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -3943,7 +3943,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.45",
+      "introducedVersion": "4.0.2-alpha.46",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -5970,7 +5970,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.45",
+      "introducedVersion": "4.0.2-alpha.46",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6001,7 +6001,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.45",
+      "introducedVersion": "4.0.2-alpha.46",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6032,7 +6032,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.45",
+      "introducedVersion": "4.0.2-alpha.46",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/docs/node-api-reference.md

@@ -233,7 +233,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `createPublicationControlPlaneAudit` | function: function createPublicationControlPlaneAudit({ repository, workflowPath, publisherWorkflowPath, environment, facts = [], observedAt, expiresAt, } = {}) | { repository, workflowPath, publisherWorkflowPath, environment, facts = [], observedAt, expiresAt, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createPublicationControlPlaneAudit } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:208` |
 | `createPublicationGateDecision` | function: function createPublicationGateDecision({ sourceSha, profile, required = false, rationale, policy = {}, } = {}) | { sourceSha, profile, required = false, rationale, policy = {}, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createPublicationGateDecision } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:280` |
 | `createPublicationQualificationReceipt` | function: function createPublicationQualificationReceipt({ capability, gateAggregate, consumerDecision, now = new Date(), } = {}) | { capability, gateAggregate, consumerDecision, now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationQualificationReceipt } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:1035` |
-| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:84` |
+| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:97` |
 | `createPublicationSourceBundle` | function: function createPublicationSourceBundle({ cwd = process.cwd(), sourcePaths = [], output = ".buildchain/publication/source.tar.gz", } = {}) | { cwd = process.cwd(), sourcePaths = [], output = ".buildchain/publication/source.tar.gz", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { createPublicationSourceBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-artifact.js:249` |
 | `createReadmeBadgeEndpointRegistry` | function: function createReadmeBadgeEndpointRegistry({ kfdSpecs = undefined, kfdStandards = undefined } = {}) | { kfdSpecs = undefined, kfdStandards = undefined } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createReadmeBadgeEndpointRegistry } from "@kungfu-tech/buildchain";` | `packages/core/readme-badges.js:133` |
 | `createReleaseActivationReceiptSet` | function: function createReleaseActivationReceiptSet({ transaction, receipts = [], } = {}) | { transaction, receipts = [], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createReleaseActivationReceiptSet } from "@kungfu-tech/buildchain";` | `packages/core/release-activation-transaction.js:311` |
@@ -456,7 +456,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `PUBLICATION_NPM_PACKAGE_CONTRACT` | constant: const PUBLICATION_NPM_PACKAGE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_NPM_PACKAGE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/publication-package.js:6` |
 | `PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT` | constant: const PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:22` |
 | `PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT` | constant: const PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/publication-reproducibility.js:12` |
-| `PUBLICATION_SEALED_BUNDLE_CONTRACT` | constant: const PUBLICATION_SEALED_BUNDLE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_SEALED_BUNDLE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:10` |
+| `PUBLICATION_SEALED_BUNDLE_CONTRACT` | constant: const PUBLICATION_SEALED_BUNDLE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_SEALED_BUNDLE_CONTRACT } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:11` |
 | `publicationArtifactCandidateDigest` | function: function publicationArtifactCandidateDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { publicationArtifactCandidateDigest } from "@kungfu-tech/buildchain";` | `packages/core/publication-artifact-candidate.js:19` |
 | `publicationAuthorityDigest` | function: function publicationAuthorityDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { publicationAuthorityDigest } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:72` |
 | `publicationGateAggregateBindings` | function: function publicationGateAggregateBindings(gateAggregate) | gateAggregate | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { publicationGateAggregateBindings } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:408` |
@@ -639,7 +639,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `verifyPublicationAdmission` | function: function verifyPublicationAdmission({ admission, registry, runnerProvenance, controlPlaneAudit, publicationEvidence, expected = {}, usedNonces = [], now = new Date(), } = {}) | { admission, registry, runnerProvenance, controlPlaneAudit, publicationEvidence, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationAdmission } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:791` |
 | `verifyPublicationQualificationReceipt` | function: function verifyPublicationQualificationReceipt({ receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {}) | { receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationQualificationReceipt } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:1096` |
 | `verifyPublicationReproducibility` | function: function verifyPublicationReproducibility({ cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {}) | { cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain";` | `packages/core/publication-reproducibility.js:869` |
-| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:133` |
+| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:189` |
 | `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, anchorProvenance = undefined, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, anchorProvenance = undefined, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain";` | `packages/core/release-candidate-recovery.js:444` |
 | `verifyReleasePassport` | function: async function verifyReleasePassport({ passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdAdopterManifestLocation = "", kfdAdopterManifestGateLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {}) | { passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdAdopterManifestLocation = "", kfdAdopterManifestGateLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleasePassport } from "@kungfu-tech/buildchain";` | `packages/core/release-passport.js:2729` |
 | `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work.js:486` |
@@ -922,7 +922,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `createPublicationControlPlaneAudit` | function: function createPublicationControlPlaneAudit({ repository, workflowPath, publisherWorkflowPath, environment, facts = [], observedAt, expiresAt, } = {}) | { repository, workflowPath, publisherWorkflowPath, environment, facts = [], observedAt, expiresAt, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createPublicationControlPlaneAudit } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:208` |
 | `createPublicationGateDecision` | function: function createPublicationGateDecision({ sourceSha, profile, required = false, rationale, policy = {}, } = {}) | { sourceSha, profile, required = false, rationale, policy = {}, } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createPublicationGateDecision } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:280` |
 | `createPublicationQualificationReceipt` | function: function createPublicationQualificationReceipt({ capability, gateAggregate, consumerDecision, now = new Date(), } = {}) | { capability, gateAggregate, consumerDecision, now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationQualificationReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:1035` |
-| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:84` |
+| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:97` |
 | `createPublicationSourceBundle` | function: function createPublicationSourceBundle({ cwd = process.cwd(), sourcePaths = [], output = ".buildchain/publication/source.tar.gz", } = {}) | { cwd = process.cwd(), sourcePaths = [], output = ".buildchain/publication/source.tar.gz", } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | local-filesystem-write, subprocess | `import { createPublicationSourceBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-artifact.js:249` |
 | `createReadmeBadgeEndpointRegistry` | function: function createReadmeBadgeEndpointRegistry({ kfdSpecs = undefined, kfdStandards = undefined } = {}) | { kfdSpecs = undefined, kfdStandards = undefined } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createReadmeBadgeEndpointRegistry } from "@kungfu-tech/buildchain/core";` | `packages/core/readme-badges.js:133` |
 | `createReleaseActivationReceiptSet` | function: function createReleaseActivationReceiptSet({ transaction, receipts = [], } = {}) | { transaction, receipts = [], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createReleaseActivationReceiptSet } from "@kungfu-tech/buildchain/core";` | `packages/core/release-activation-transaction.js:311` |
@@ -1145,7 +1145,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `PUBLICATION_NPM_PACKAGE_CONTRACT` | constant: const PUBLICATION_NPM_PACKAGE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_NPM_PACKAGE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-package.js:6` |
 | `PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT` | constant: const PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_QUALIFICATION_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:22` |
 | `PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT` | constant: const PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_REPRODUCIBILITY_RECEIPT_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-reproducibility.js:12` |
-| `PUBLICATION_SEALED_BUNDLE_CONTRACT` | constant: const PUBLICATION_SEALED_BUNDLE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_SEALED_BUNDLE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:10` |
+| `PUBLICATION_SEALED_BUNDLE_CONTRACT` | constant: const PUBLICATION_SEALED_BUNDLE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_SEALED_BUNDLE_CONTRACT } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:11` |
 | `publicationArtifactCandidateDigest` | function: function publicationArtifactCandidateDigest(value) | value | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { publicationArtifactCandidateDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-artifact-candidate.js:19` |
 | `publicationAuthorityDigest` | function: function publicationAuthorityDigest(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { publicationAuthorityDigest } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:72` |
 | `publicationGateAggregateBindings` | function: function publicationGateAggregateBindings(gateAggregate) | gateAggregate | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { publicationGateAggregateBindings } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:408` |
@@ -1328,7 +1328,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `verifyPublicationAdmission` | function: function verifyPublicationAdmission({ admission, registry, runnerProvenance, controlPlaneAudit, publicationEvidence, expected = {}, usedNonces = [], now = new Date(), } = {}) | { admission, registry, runnerProvenance, controlPlaneAudit, publicationEvidence, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationAdmission } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:791` |
 | `verifyPublicationQualificationReceipt` | function: function verifyPublicationQualificationReceipt({ receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {}) | { receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationQualificationReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:1096` |
 | `verifyPublicationReproducibility` | function: function verifyPublicationReproducibility({ cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {}) | { cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-reproducibility.js:869` |
-| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:133` |
+| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:189` |
 | `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, anchorProvenance = undefined, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, anchorProvenance = undefined, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain/core";` | `packages/core/release-candidate-recovery.js:444` |
 | `verifyReleasePassport` | function: async function verifyReleasePassport({ passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdAdopterManifestLocation = "", kfdAdopterManifestGateLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {}) | { passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdAdopterManifestLocation = "", kfdAdopterManifestGateLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleasePassport } from "@kungfu-tech/buildchain/core";` | `packages/core/release-passport.js:2729` |
 | `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work.js:486` |
@@ -2315,9 +2315,9 @@ Target: `./packages/core/publication-sealed-bundle.js`. Public symbols: 3.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:84` |
-| `PUBLICATION_SEALED_BUNDLE_CONTRACT` | constant: const PUBLICATION_SEALED_BUNDLE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_SEALED_BUNDLE_CONTRACT } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:10` |
-| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:133` |
+| `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:97` |
+| `PUBLICATION_SEALED_BUNDLE_CONTRACT` | constant: const PUBLICATION_SEALED_BUNDLE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_SEALED_BUNDLE_CONTRACT } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:11` |
+| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:189` |
 
 ## `@kungfu-tech/buildchain/paper`
 
@@ -2569,10 +2569,10 @@ Target: `./packages/core/next-development-transition.js`. Public symbols: 13.
 
 | Symbol | Kind and signature | Parameters | Return | Errors | Side effects | Example | Source |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| `advanceNextDevelopmentTransition` | function: function advanceNextDevelopmentTransition(record, input = {}) | record, input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { advanceNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:344` |
-| `bindNextDevelopmentAnchor` | function: function bindNextDevelopmentAnchor(record, input = {}) | record, input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { bindNextDevelopmentAnchor } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:305` |
-| `createNextDevelopmentTransition` | function: function createNextDevelopmentTransition(input = {}) | input = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:253` |
-| `materializeNextDevelopmentTransition` | function: function materializeNextDevelopmentTransition({ cwd = process.cwd(), request, write = false, } = {}) | { cwd = process.cwd(), request, write = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { materializeNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:472` |
+| `advanceNextDevelopmentTransition` | function: function advanceNextDevelopmentTransition(record, input = {}) | record, input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { advanceNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:343` |
+| `bindNextDevelopmentAnchor` | function: function bindNextDevelopmentAnchor(record, input = {}) | record, input = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { bindNextDevelopmentAnchor } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:304` |
+| `createNextDevelopmentTransition` | function: function createNextDevelopmentTransition(input = {}) | input = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { createNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:252` |
+| `materializeNextDevelopmentTransition` | function: function materializeNextDevelopmentTransition({ cwd = process.cwd(), request, write = false, } = {}) | { cwd = process.cwd(), request, write = false, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { materializeNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:471` |
 | `NEXT_DEVELOPMENT_ADR` | constant: const NEXT_DEVELOPMENT_ADR | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_ADR } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:20` |
 | `NEXT_DEVELOPMENT_INVARIANT` | constant: const NEXT_DEVELOPMENT_INVARIANT | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_INVARIANT } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:22` |
 | `NEXT_DEVELOPMENT_REQUEST_CONTRACT` | constant: const NEXT_DEVELOPMENT_REQUEST_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_REQUEST_CONTRACT } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:18` |
@@ -2580,8 +2580,8 @@ Target: `./packages/core/next-development-transition.js`. Public symbols: 13.
 | `NEXT_DEVELOPMENT_TRANSITION_CONTRACT` | constant: const NEXT_DEVELOPMENT_TRANSITION_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_TRANSITION_CONTRACT } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:16` |
 | `NEXT_DEVELOPMENT_VERSION_MODELS` | constant: const NEXT_DEVELOPMENT_VERSION_MODELS | none | value | Import does not declare a throw contract. | none-on-import | `import { NEXT_DEVELOPMENT_VERSION_MODELS } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:32` |
 | `nextDevelopmentRoot` | function: function nextDevelopmentRoot(value) | value | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { nextDevelopmentRoot } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:63` |
-| `recordNextDevelopmentMaterialization` | function: function recordNextDevelopmentMaterialization(record, { materialization, evidenceRoot, recordedAt } = {}) | record, { materialization, evidenceRoot, recordedAt } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { recordNextDevelopmentMaterialization } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:416` |
-| `validateNextDevelopmentTransition` | function: function validateNextDevelopmentTransition(record) | record | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { validateNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:729` |
+| `recordNextDevelopmentMaterialization` | function: function recordNextDevelopmentMaterialization(record, { materialization, evidenceRoot, recordedAt } = {}) | record, { materialization, evidenceRoot, recordedAt } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | may-write-or-invoke-external-actions | `import { recordNextDevelopmentMaterialization } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:415` |
+| `validateNextDevelopmentTransition` | function: function validateNextDevelopmentTransition(record) | record | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { validateNextDevelopmentTransition } from "@kungfu-tech/buildchain/next-development-transition";` | `packages/core/next-development-transition.js:728` |
 
 ## `@kungfu-tech/buildchain/next-development-controller`
 

package/docs/publish-transaction.md

@@ -8,11 +8,11 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-08-06
+last_reviewed: 2026-09-06
 ai_provenance:
-  model_family: GPT-5
+  model_family: GPT-6
   product: Codex
-  generated_at: 2026-07-31
+  generated_at: 2026-09-06
   invisible_context: not asserted
 ---
 
@@ -113,6 +113,39 @@ a missing or different id fails before provider mutation. An absent transaction
 is created only when no expected existing identity was requested. See
 [Release Candidate: Resume from an existing candidate run](release-candidate.md#resume-from-an-existing-candidate-run).
 
+## V4 sealed npm package sets
+
+The v4 alpha provider accepts a sealed set of 2–64 npm tarballs with one main
+package and same-version platform packages. The candidate resolver records each
+package's name, version, role, relative path, size, SHA-256, and npm integrity in
+the candidate root. QUALIFY passes the set into the Rust/WASM publication
+planner, which binds every package to its own operation and orders platform
+packages by name before the main package. A single package retains the existing
+operation identity.
+
+Use `publish-package-main` to name the main package. The optional
+`publish-package-set-order: platforms-first-main-last` input states the same
+ordering. Omit legacy `publish-mode` and `publish-command` inputs: the v4 provider
+publishes the sealed tarballs through npm trusted publishing. It does not run a
+consumer publish command.
+
+Before any provider effect, APPLY checks the complete package inventory,
+tarball package identities, bytes, and integrity against the rooted intent.
+Each package receives independent registry readback and a Release Tail receipt.
+After an interrupted attempt, existing matching versions are observed without
+republishing; conflicting integrity stops the transaction. Release refs follow
+only after every package is confirmed.
+
+Anchored alpha versions such as `22.22.3-kf.5-alpha.4` remain unchanged. For
+`anchored/manual` repositories, successful publication leaves next development
+in `waiting-anchor`; it does not invent the next upstream anchor. Multi-package
+stable rematerialization is not supported by this provider and fails before
+publication. The existing singleton stable flow remains available.
+
+The contract is exercised by `v4-product-publication-topology.test.mjs`,
+`v4-product-provider-adapters.test.mjs`, and
+`v4-alpha-next-development-provider.test.mjs` under `tests/`.
+
 ## Lifecycle
 
 Repositories declare publish work in `.buildchain/buildchain.toml`:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.2-alpha.45",
+  "version": "4.0.2-alpha.46",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/next-development-transition.js

@@ -159,15 +159,14 @@ function normalizeModel(value = {}) {
   return model;
 }
 
-function normalizeCompletedAlpha(value = {}) {
+function normalizeCompletedAlpha(value = {}, model) {
   const version = String(value.version || "").trim();
-  if (!ALPHA.test(version))
+  const expression = model?.strategy === "anchored" ? /-alpha\.(0|[1-9]\d*)$/u : ALPHA;
+  if (!SEMVER.test(version) || !expression.test(version))
     throw new Error("completedAlpha.version must be an alpha semantic version");
   const exactTag = String(value.exactTag || "").trim();
   if (exactTag !== `v${version}`)
-    throw new Error(
-      "completedAlpha.exactTag must match completedAlpha.version",
-    );
+    throw new Error("completedAlpha.exactTag must match completedAlpha.version");
   const normalized = {
     outcome: String(value.outcome || "").trim(),
     version,
@@ -251,8 +250,8 @@ function initialStateRoot(status, idempotencyKey) {
 }
 
 export function createNextDevelopmentTransition(input = {}) {
-  const completedAlpha = normalizeCompletedAlpha(input.completedAlpha);
   const model = normalizeModel(input.model);
+  const completedAlpha = normalizeCompletedAlpha(input.completedAlpha, model);
   const adapter = normalizeAdapter(input);
   const declaredPaths = [
     ...adapter.sourcePaths,

package/packages/core/publication-sealed-bundle.js

@@ -1,4 +1,5 @@
 import crypto from "node:crypto";
+import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 
@@ -19,7 +20,10 @@ function requiredString(value, label) {
 
 function safeRelativePath(value, label) {
   const normalized = requiredString(value, label).replaceAll("\\", "/");
-  if (normalized.startsWith("/") || normalized.split("/").some((part) => part === ".." || part === "")) {
+  if (
+    normalized.startsWith("/") ||
+    normalized.split("/").some((part) => part === ".." || part === "")
+  ) {
     throw new Error(`${label} must be a safe relative path`);
   }
   return normalized;
@@ -41,7 +45,8 @@ function sha256File(filePath) {
   const chunk = Buffer.allocUnsafe(8 * 1024 * 1024);
   try {
     let bytesRead = 0;
-    while ((bytesRead = fs.readSync(descriptor, chunk, 0, chunk.length, null)) > 0) hash.update(chunk.subarray(0, bytesRead));
+    while ((bytesRead = fs.readSync(descriptor, chunk, 0, chunk.length, null)) > 0)
+      hash.update(chunk.subarray(0, bytesRead));
   } finally {
     fs.closeSync(descriptor);
   }
@@ -60,8 +65,16 @@ function normalizeFile(entry, label) {
   };
 }
 
+function fileInventory(files, label) {
+  return (files || []).map((entry, index) => normalizeFile(entry, `${label}[${index}]`))
+    .sort((left, right) => left.path.localeCompare(right.path));
+}
+
 function candidatePayload(candidate) {
-  if (candidate?.contract !== PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT || Number(candidate?.schemaVersion) !== 1) {
+  if (
+    candidate?.contract !== PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT ||
+    Number(candidate?.schemaVersion) !== 1
+  ) {
     throw new Error("publication artifact candidate contract mismatch");
   }
   const { candidateDigest: _candidateDigest, ...payload } = candidate;
@@ -91,9 +104,7 @@ export function createPublicationSealedBundle({
   githubReleaseRequired = true,
 } = {}) {
   const { digest } = candidatePayload(candidate);
-  const files = (candidate.files || [])
-    .map((entry, index) => normalizeFile(entry, `candidate.files[${index}]`))
-    .sort((left, right) => left.path.localeCompare(right.path));
+  const files = fileInventory(candidate.files, "candidate.files");
   if (new Set(files.map((entry) => entry.path)).size !== files.length) {
     throw new Error("publication sealed bundle candidate paths must be unique");
   }
@@ -119,6 +130,7 @@ export function createPublicationSealedBundle({
       sha256: npmTarball.sha256,
       integrity: requiredString(npmIntegrity, "npmIntegrity"),
     },
+    ...(candidate.npmPackages ? { npmPackages: candidate.npmPackages } : {}),
     releaseAssets,
     completion: {
       githubReleaseRequired: Boolean(githubReleaseRequired),
@@ -130,8 +142,55 @@ export function createPublicationSealedBundle({
   };
 }
 
+function verifyNpmPackageSet(manifest, files, resolvedRoot) {
+  const npmPackages = manifest.npmPackages;
+  if (JSON.stringify(npmPackages) !== JSON.stringify(manifest.candidate.npmPackages)) {
+    throw new Error("publication sealed bundle npm package inventory differs from candidate");
+  }
+  if (npmPackages) {
+    if (
+      !Array.isArray(npmPackages) ||
+      npmPackages.length < 2 ||
+      new Set(npmPackages.map((entry) => entry.name)).size !== npmPackages.length ||
+      new Set(npmPackages.map((entry) => entry.path)).size !== npmPackages.length
+    ) {
+      throw new Error("publication sealed bundle npm package inventory must be unique");
+    }
+    for (const entry of npmPackages) {
+      const file = selectFile(files, entry.path, "npmPackages.path");
+      const absolutePath = path.resolve(resolvedRoot, file.path);
+      const metadata = JSON.parse(
+        execFileSync("tar", ["-xOf", absolutePath, "package/package.json"], {
+          encoding: "utf8",
+        }),
+      );
+      const integrity = `sha512-${crypto.createHash("sha512").update(fs.readFileSync(absolutePath)).digest("base64")}`;
+      if (
+        entry.name !== metadata.name ||
+        entry.version !== metadata.version ||
+        entry.size !== file.size ||
+        entry.sha256 !== file.sha256 ||
+        entry.integrity !== integrity
+      ) {
+        throw new Error("publication sealed bundle npm package identity or integrity mismatch");
+      }
+    }
+    const main = npmPackages.filter((entry) => entry.role === "main");
+    if (
+      main.length !== 1 ||
+      Object.keys(manifest.npm).some((key) => main[0][key] !== manifest.npm[key])
+    ) {
+      throw new Error("publication sealed bundle npm main package mismatch");
+    }
+  }
+  return npmPackages;
+}
+
 export function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) {
-  if (manifest?.contract !== PUBLICATION_SEALED_BUNDLE_CONTRACT || Number(manifest?.schemaVersion) !== 1) {
+  if (
+    manifest?.contract !== PUBLICATION_SEALED_BUNDLE_CONTRACT ||
+    Number(manifest?.schemaVersion) !== 1
+  ) {
     throw new Error("publication sealed bundle contract mismatch");
   }
   const resolvedRoot = path.resolve(requiredString(bundleRoot, "bundleRoot"));
@@ -139,12 +198,8 @@ export function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) {
   if (normalizeSha256(manifest.root, "manifest.root") !== digest) {
     throw new Error("publication sealed bundle root mismatch");
   }
-  const files = (manifest.files || [])
-    .map((entry, index) => normalizeFile(entry, `manifest.files[${index}]`))
-    .sort((left, right) => left.path.localeCompare(right.path));
-  const candidateFiles = (manifest.candidate.files || [])
-    .map((entry, index) => normalizeFile(entry, `candidate.files[${index}]`))
-    .sort((left, right) => left.path.localeCompare(right.path));
+  const files = fileInventory(manifest.files, "manifest.files");
+  const candidateFiles = fileInventory(manifest.candidate.files, "candidate.files");
   if (JSON.stringify(files) !== JSON.stringify(candidateFiles)) {
     throw new Error("publication sealed bundle file inventory differs from candidate");
   }
@@ -169,6 +224,7 @@ export function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) {
   ) {
     throw new Error("publication sealed bundle npm tarball inventory mismatch");
   }
+  const npmPackages = verifyNpmPackageSet(manifest, files, resolvedRoot);
   const releaseAssets = (manifest.releaseAssets || []).map((entry, index) => {
     const selected = selectFile(files, entry.path, `manifest.releaseAssets[${index}].path`);
     const normalized = normalizeFile(entry, `manifest.releaseAssets[${index}]`);
@@ -194,6 +250,14 @@ export function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) {
       ...entry,
       absolutePath: path.resolve(resolvedRoot, entry.path),
     })),
+    ...(npmPackages
+      ? {
+          npmPackages: npmPackages.map((entry) => ({
+            ...entry,
+            absolutePath: path.resolve(resolvedRoot, entry.path),
+          })),
+        }
+      : {}),
     manifest,
   };
 }

package/packages/core/v4-domain-wasm-artifact.js

@@ -2,6 +2,6 @@
 export const V4_DOMAIN_WASM_ABI_VERSION = 1;
 export const V4_DOMAIN_WASM_RUSTC = "rustc 1.96.0 (ac68faa20 2026-05-25)";
 export const V4_DOMAIN_WASM_SOURCE_SHA256 =
-  "7297279bce5344b8fc58688be5c1933a823306c82dac7dccfabdf07de41d652f";
+  "bec17d9c47ab0ab8bdc379827f4bfb98fc95d41ee538c0558be538b86e06c775";
 export const V4_DOMAIN_WASM_SHA256 =
-  "3a4909bb4b2bbd2676eac83f259c22faf1ce43479036992c5e53d5e2dcc512ce";
+  "76600d4a9cfba5ac318c9b3be69e2a4e304faee714d2e72b1fba288f945c09f0";

package/packages/core/v4-product-publication.js

@@ -13,6 +13,7 @@ export function selectV4ProductPublicationIntent({
   repository,
   artifactKind = "npm",
   packageName,
+  npmPackages,
   distTag,
   sealedBundleRoot,
   requiredArtifactsRoot,
@@ -27,6 +28,7 @@ export function selectV4ProductPublicationIntent({
     sourceTimestamp,
     repository,
     artifactKind,
+    ...(npmPackages === undefined ? {} : { npmPackages }),
     ...(packageName === undefined ? {} : { packageName }),
     ...(distTag === undefined ? {} : { distTag }),
     ...(sealedBundleRoot === undefined ? {} : { sealedBundleRoot }),

package/scripts/publication-candidate-sealer.mjs

@@ -70,7 +70,7 @@ export function createResolvedPublicationSealedBundle({
   });
   const main = resolvedNpmArtifacts.find((entry) => entry.metadata.role === "main")
     || (resolvedNpmArtifacts.length === 1 ? resolvedNpmArtifacts[0] : undefined);
-  if (!main) throw new Error("candidate npm payload set has no unique main package tarball");
+  if (!main || resolvedNpmArtifacts.filter((entry) => entry.metadata.role === "main").length > 1) throw new Error("candidate npm payload set has no unique main package tarball");
   const selectedReleaseAssets = (releaseAssetPaths.length > 0
     ? releaseAssetPaths
     : resolvedNpmArtifacts.map((entry) => entry.file.absolutePath))
@@ -89,6 +89,12 @@ export function createResolvedPublicationSealedBundle({
     releaseCandidateRoot: `sha256:${normalizeSha256(releaseCandidateRoot, "releaseCandidateRoot")}`,
     files: files.map(({ path: filePath, size, sha256 }) => ({ path: filePath, size, sha256 })),
   };
+  if (resolvedNpmArtifacts.length > 1) {
+    candidatePayload.npmPackages = resolvedNpmArtifacts.map(({file, metadata}) => ({
+      name: metadata.name, version: metadata.ref, role: metadata.role,
+      path: file.path, size: file.size, sha256: file.sha256, integrity: metadata.integrity,
+    }));
+  }
   const candidate = {
     ...candidatePayload,
     candidateDigest: publicationArtifactCandidateDigest(candidatePayload),

package/scripts/v4-product-publication-intent.mjs

@@ -80,6 +80,14 @@ export function resolveV4ProductPublicationIntent() {
     repository: env("BUILDCHAIN_REPOSITORY", true),
     artifactKind,
     packageName: name,
+    ...(manifest?.npmPackages
+      ? {
+          npmPackages: manifest.npmPackages.map((entry) => ({
+            ...entry,
+            sha256: `sha256:${entry.sha256}`,
+          })),
+        }
+      : {}),
     distTag:
       env("BUILDCHAIN_PUBLISH_DIST_TAG") ||
       (channel === "alpha" ? "alpha" : "latest"),