@kungfu-tech/buildchain 4.0.2-alpha.5 → 4.0.2-alpha.50

package/packages/core/publication-sealed-bundle.js

@@ -1,4 +1,5 @@
 import crypto from "node:crypto";
+import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 
@@ -19,7 +20,10 @@ function requiredString(value, label) {
 
 function safeRelativePath(value, label) {
   const normalized = requiredString(value, label).replaceAll("\\", "/");
-  if (normalized.startsWith("/") || normalized.split("/").some((part) => part === ".." || part === "")) {
+  if (
+    normalized.startsWith("/") ||
+    normalized.split("/").some((part) => part === ".." || part === "")
+  ) {
     throw new Error(`${label} must be a safe relative path`);
   }
   return normalized;
@@ -41,7 +45,8 @@ function sha256File(filePath) {
   const chunk = Buffer.allocUnsafe(8 * 1024 * 1024);
   try {
     let bytesRead = 0;
-    while ((bytesRead = fs.readSync(descriptor, chunk, 0, chunk.length, null)) > 0) hash.update(chunk.subarray(0, bytesRead));
+    while ((bytesRead = fs.readSync(descriptor, chunk, 0, chunk.length, null)) > 0)
+      hash.update(chunk.subarray(0, bytesRead));
   } finally {
     fs.closeSync(descriptor);
   }
@@ -60,8 +65,16 @@ function normalizeFile(entry, label) {
   };
 }
 
+function fileInventory(files, label) {
+  return (files || []).map((entry, index) => normalizeFile(entry, `${label}[${index}]`))
+    .sort((left, right) => left.path.localeCompare(right.path));
+}
+
 function candidatePayload(candidate) {
-  if (candidate?.contract !== PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT || Number(candidate?.schemaVersion) !== 1) {
+  if (
+    candidate?.contract !== PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT ||
+    Number(candidate?.schemaVersion) !== 1
+  ) {
     throw new Error("publication artifact candidate contract mismatch");
   }
   const { candidateDigest: _candidateDigest, ...payload } = candidate;
@@ -91,9 +104,7 @@ export function createPublicationSealedBundle({
   githubReleaseRequired = true,
 } = {}) {
   const { digest } = candidatePayload(candidate);
-  const files = (candidate.files || [])
-    .map((entry, index) => normalizeFile(entry, `candidate.files[${index}]`))
-    .sort((left, right) => left.path.localeCompare(right.path));
+  const files = fileInventory(candidate.files, "candidate.files");
   if (new Set(files.map((entry) => entry.path)).size !== files.length) {
     throw new Error("publication sealed bundle candidate paths must be unique");
   }
@@ -119,6 +130,7 @@ export function createPublicationSealedBundle({
       sha256: npmTarball.sha256,
       integrity: requiredString(npmIntegrity, "npmIntegrity"),
     },
+    ...(candidate.npmPackages ? { npmPackages: candidate.npmPackages } : {}),
     releaseAssets,
     completion: {
       githubReleaseRequired: Boolean(githubReleaseRequired),
@@ -130,8 +142,56 @@ export function createPublicationSealedBundle({
   };
 }
 
+function verifyNpmPackageSet(manifest, files, resolvedRoot) {
+  const npmPackages = manifest.npmPackages;
+  if (JSON.stringify(npmPackages) !== JSON.stringify(manifest.candidate.npmPackages)) {
+    throw new Error("publication sealed bundle npm package inventory differs from candidate");
+  }
+  if (npmPackages) {
+    if (
+      !Array.isArray(npmPackages) ||
+      npmPackages.length < 2 ||
+      new Set(npmPackages.map((entry) => entry.name)).size !== npmPackages.length ||
+      new Set(npmPackages.map((entry) => entry.path)).size !== npmPackages.length
+    ) {
+      throw new Error("publication sealed bundle npm package inventory must be unique");
+    }
+    for (const entry of npmPackages) {
+      const file = selectFile(files, entry.path, "npmPackages.path");
+      const absolutePath = path.resolve(resolvedRoot, file.path);
+      const metadata = JSON.parse(
+        execFileSync("tar", ["-xOf", path.basename(absolutePath), "package/package.json"], {
+          cwd: path.dirname(absolutePath),
+          encoding: "utf8",
+        }),
+      );
+      const integrity = `sha512-${crypto.createHash("sha512").update(fs.readFileSync(absolutePath)).digest("base64")}`;
+      if (
+        entry.name !== metadata.name ||
+        entry.version !== metadata.version ||
+        entry.size !== file.size ||
+        entry.sha256 !== file.sha256 ||
+        entry.integrity !== integrity
+      ) {
+        throw new Error("publication sealed bundle npm package identity or integrity mismatch");
+      }
+    }
+    const main = npmPackages.filter((entry) => entry.role === "main");
+    if (
+      main.length !== 1 ||
+      Object.keys(manifest.npm).some((key) => main[0][key] !== manifest.npm[key])
+    ) {
+      throw new Error("publication sealed bundle npm main package mismatch");
+    }
+  }
+  return npmPackages;
+}
+
 export function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) {
-  if (manifest?.contract !== PUBLICATION_SEALED_BUNDLE_CONTRACT || Number(manifest?.schemaVersion) !== 1) {
+  if (
+    manifest?.contract !== PUBLICATION_SEALED_BUNDLE_CONTRACT ||
+    Number(manifest?.schemaVersion) !== 1
+  ) {
     throw new Error("publication sealed bundle contract mismatch");
   }
   const resolvedRoot = path.resolve(requiredString(bundleRoot, "bundleRoot"));
@@ -139,12 +199,8 @@ export function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) {
   if (normalizeSha256(manifest.root, "manifest.root") !== digest) {
     throw new Error("publication sealed bundle root mismatch");
   }
-  const files = (manifest.files || [])
-    .map((entry, index) => normalizeFile(entry, `manifest.files[${index}]`))
-    .sort((left, right) => left.path.localeCompare(right.path));
-  const candidateFiles = (manifest.candidate.files || [])
-    .map((entry, index) => normalizeFile(entry, `candidate.files[${index}]`))
-    .sort((left, right) => left.path.localeCompare(right.path));
+  const files = fileInventory(manifest.files, "manifest.files");
+  const candidateFiles = fileInventory(manifest.candidate.files, "candidate.files");
   if (JSON.stringify(files) !== JSON.stringify(candidateFiles)) {
     throw new Error("publication sealed bundle file inventory differs from candidate");
   }
@@ -169,6 +225,7 @@ export function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) {
   ) {
     throw new Error("publication sealed bundle npm tarball inventory mismatch");
   }
+  const npmPackages = verifyNpmPackageSet(manifest, files, resolvedRoot);
   const releaseAssets = (manifest.releaseAssets || []).map((entry, index) => {
     const selected = selectFile(files, entry.path, `manifest.releaseAssets[${index}].path`);
     const normalized = normalizeFile(entry, `manifest.releaseAssets[${index}]`);
@@ -194,6 +251,14 @@ export function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) {
       ...entry,
       absolutePath: path.resolve(resolvedRoot, entry.path),
     })),
+    ...(npmPackages
+      ? {
+          npmPackages: npmPackages.map((entry) => ({
+            ...entry,
+            absolutePath: path.resolve(resolvedRoot, entry.path),
+          })),
+        }
+      : {}),
     manifest,
   };
 }

package/packages/core/release-line-dry-run.js

@@ -201,7 +201,7 @@ function explainReleaseLineDryRun({
     );
     plan.branchUpdates.push(
       { ref: targetRef, action: "would move to alpha version-state commit" },
-      { ref: `dev/v${rule.major}/v${rule.major}.${rule.minor}`, action: "would align dev with the published alpha state" },
+      { ref: `dev/v${rule.major}/v${rule.major}.${rule.minor}`, action: rule.major === 4 ? "would prepare the next alpha version on dev through a separate protected PR after publication" : "would align dev with the published alpha state" },
     );
     plan.versionState.targetVersions = [exactAlpha.replace(/^next v?/, "").replace(/^v/, "")];
     plan.notes.push("Alpha promotion opens or advances the test channel; it does not move production refs.");

package/packages/core/release-passport-contract.js

@@ -405,7 +405,7 @@ export function prepareReleasePassportKfdSections({ kfd1, kfd2Claims, kfd3, kfdA
   };
 }
 
-export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], comparisonMatrix, sourceSha = "", checkedAt } = {}) {
+export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], comparisonMatrix, expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", sourceSha = "", checkedAt } = {}) {
   if (!manifest) {
     if (comparisonMatrix || gateResults.length > 0) {
       throw new Error("KFD support and product-gate inputs require --kfd-adopter-manifest-json; --kfd-support-matrix-json is comparison-only");
@@ -414,7 +414,7 @@ export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], c
   }
   const manifestGate = createKfdAdopterManifestGate({
     manifest, packageArtifactRoot: installedKfdPackageArtifactRoot(), gateResults,
-    expectedSourceSha: sourceSha, checkedAt,
+    expectedAdopterId, expectedSourceRepository, expectedSourceSha: sourceSha, checkedAt,
   });
   const legacyProjection = createKfdLegacySupportMatrixProjection({ manifest, manifestGate });
   if (comparisonMatrix) {
@@ -425,18 +425,18 @@ export function collectKfdAdopterReleaseEvidence({ manifest, gateResults = [], c
   }
   return {
     manifest, manifestGate, legacyProjection,
-    binding: createKfdAdopterReleaseBinding({ manifest, manifestGate, legacyProjection, expectedSourceSha: sourceSha }),
+    binding: createKfdAdopterReleaseBinding({ manifest, manifestGate, legacyProjection, expectedAdopterId, expectedSourceRepository, expectedSourceSha: sourceSha }),
   };
 }
 
-export function validateKfdAdopterReleaseEvidence({ binding, artifactBinding, manifest, manifestGate, legacyProjection, passportLegacyProjection, expectedSourceSha = "" } = {}) {
+export function validateKfdAdopterReleaseEvidence({ binding, artifactBinding, manifest, manifestGate, legacyProjection, passportLegacyProjection, expectedAdopterId = "kungfu-systems/buildchain", expectedSourceRepository = "", expectedSourceSha = "" } = {}) {
   if (!binding) {
     return passportLegacyProjection
       ? [{ code: "kfdSupport.authority", message: "legacy KFD support projection requires the standard adopter manifest binding" }]
       : [];
   }
   const issues = validateKfdAdopterReleaseBinding(binding, {
-    manifest, manifestGate, legacyProjection, expectedSourceSha,
+    manifest, manifestGate, legacyProjection, expectedAdopterId, expectedSourceRepository, expectedSourceSha,
   }).issues.map((entry) => ({ code: `kfdAdopter.${entry.path || entry.code}`, message: entry.message, details: entry }));
   if (!artifactBinding || passportStableJson(artifactBinding) !== passportStableJson(binding)) {
     issues.push({ code: "kfdAdopter.artifactEvidence", message: "release passport and artifact evidence must bind the same exact KFD adopter closure" });

package/packages/core/release-passport.js

@@ -1431,7 +1431,7 @@ export function createReleasePassport(options = {}) {
   };
 }
 
-function collectKfdAdopterReleaseInputs({ cwd, manifestJson, supportMatrixJson, productGateJsons, sourceSha, checkedAt }) {
+function collectKfdAdopterReleaseInputs({ cwd, manifestJson, supportMatrixJson, productGateJsons, repository, sourceSha, checkedAt }) {
   const manifestMeta = parseJsonInputWithMeta(manifestJson, undefined, { cwd, label: "kfdAdopterManifestJson" });
   const supportMatrixMeta = parseJsonInputWithMeta(supportMatrixJson, undefined, { cwd, label: "kfdSupportMatrixJson" });
   const productGateMetas = (productGateJsons || [])
@@ -1442,7 +1442,7 @@ function collectKfdAdopterReleaseInputs({ cwd, manifestJson, supportMatrixJson,
     manifest: manifestMeta.value,
     gateResults: productGateMetas.map((meta) => meta.value),
     comparisonMatrix: supportMatrixMeta.value,
-    sourceSha,
+    expectedAdopterId: repository || "kungfu-systems/buildchain", expectedSourceRepository: repository, sourceSha,
     checkedAt,
   });
 }
@@ -1620,7 +1620,7 @@ export function collectGitHubReleasePassport({
   const productMechanism = defaultProductMechanism({ repository, productName });
   const kfdAdopterEvidence = collectKfdAdopterReleaseInputs({
     cwd, manifestJson: kfdAdopterManifestJson, supportMatrixJson: kfdSupportMatrixJson,
-    productGateJsons: kfdProductGateJsons, sourceSha, checkedAt: resolvedCheckedAt,
+    productGateJsons: kfdProductGateJsons, repository, sourceSha, checkedAt: resolvedCheckedAt,
   });
   const {
     manifest: kfdAdopterManifest,
@@ -2060,7 +2060,8 @@ function validateReleaseEvidenceContracts({
     manifestGate: kfdAdopterManifestGate,
     legacyProjection: kfdSupportEvidence,
     passportLegacyProjection: passport?.kfdSupport,
-    expectedSourceSha: optionalString(passport?.release?.sourceSha),
+    expectedAdopterId: optionalString(passport?.product?.repository) || "kungfu-systems/buildchain",
+    expectedSourceRepository: optionalString(passport?.product?.repository), expectedSourceSha: optionalString(passport?.release?.sourceSha),
   })) {
     issues.push(issue("error", entry.code, entry.message, entry.details));
   }

package/packages/core/release-tail-product-capabilities.js

@@ -0,0 +1,38 @@
+export const RELEASE_TAIL_PRODUCT_CAPABILITIES = Object.freeze([
+  Object.freeze({
+    id: "product.version-state.materialize",
+    executor: "provider-adapter",
+    adapter: "github-version-state",
+    effectKind: "product-version-state-materialization",
+    observationKind: "product-version-state-readback",
+    receiptKind: "product-version-state",
+    transactionState: "preparing",
+  }),
+  Object.freeze({
+    id: "product.package.publish",
+    executor: "provider-adapter",
+    adapter: "npm-trusted-publishing",
+    effectKind: "product-package-publication",
+    observationKind: "product-package-readback",
+    receiptKind: "product-package-publication",
+    transactionState: "publishing",
+  }),
+  Object.freeze({
+    id: "product.oci.publish",
+    executor: "provider-adapter",
+    adapter: "oci-image-family",
+    effectKind: "oci-family-publication",
+    observationKind: "oci-family-readback",
+    receiptKind: "oci-family-publication",
+    transactionState: "publishing",
+  }),
+  Object.freeze({
+    id: "product.release-refs.converge",
+    executor: "provider-adapter",
+    adapter: "github-release-refs",
+    effectKind: "product-release-ref-convergence",
+    observationKind: "product-release-ref-readback",
+    receiptKind: "product-release-ref-convergence",
+    transactionState: "committing",
+  }),
+]);