@kungfu-tech/buildchain 4.0.2-alpha.5 → 4.0.2-alpha.50

package/scripts/publication-candidate-kind.mjs

@@ -0,0 +1,93 @@
+import fs from "node:fs";
+import path from "node:path";
+import { ociPublicationTag } from "../packages/core/oci-publication-graph.js";
+import { verifyOciPublicationBundle } from "../packages/core/oci-publication-bundle.js";
+
+export function resolveOciCandidate({ payloadRoot, passport }) {
+  const matches = [];
+  function visit(directory) {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      if (entry.isSymbolicLink())
+        throw new Error("OCI candidate cannot contain symlinks");
+      const file = path.join(directory, entry.name);
+      if (entry.isDirectory()) visit(file);
+      else if (entry.name === "oci-family.json") matches.push(file);
+    }
+  }
+  visit(payloadRoot);
+  if (matches.length !== 1)
+    throw new Error("OCI candidate requires exactly one sealed image family");
+  const manifest = JSON.parse(fs.readFileSync(matches[0]));
+  const bundleRoot = path.dirname(matches[0]);
+  const verified = verifyOciPublicationBundle({
+    bundleRoot,
+    manifest,
+    repository: passport.repository,
+    sourceSha: passport.source.headSha,
+    version: passport.target.version,
+  });
+  return {
+    root: bundleRoot,
+    manifest: verified.manifest,
+    requiredArtifacts: manifest.images.map((image) => ({
+      kind: "oci",
+      name: image.repository,
+      ref: ociPublicationTag(image, manifest.version),
+      digest: image.digest,
+      platform: image.platform,
+      required: true,
+    })),
+  };
+}
+
+export function resolveRecoveredPublicationVersion({
+  artifactVersion,
+  channel,
+  rematerializeOnResume = false,
+} = {}) {
+  const version = String(artifactVersion || "").trim(),
+    match = version.match(
+      /^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u,
+    );
+  if (!match)
+    throw new Error(
+      `recovered npm artifact has invalid publication version: ${version || "<empty>"}`,
+    );
+  return channel === "release" && rematerializeOnResume ? match[1] : version;
+}
+export function resolveRecoveredCandidateVersion({
+  artifactVersion,
+  publicationVersion,
+  channel,
+  rematerializeOnResume = false,
+  targetRef = "",
+  candidateRef = "",
+} = {}) {
+  const version = String(artifactVersion || "").trim(),
+    target = String(targetRef || "").replace(/^refs\/heads\//u, ""),
+    candidate = String(candidateRef || "").replace(/^refs\/heads\//u, "");
+  if (channel !== "release" || !rematerializeOnResume) return version;
+  const prefix = `publish-gate/${target}/`;
+  if (!target || !candidate.startsWith(prefix))
+    throw new Error(
+      `stable recovery candidate ref must descend from ${prefix || "publish-gate/<target>/"}`,
+    );
+  const candidateVersion = candidate.slice(prefix.length);
+  if (!/^\d+\.\d+\.\d+-alpha\.\d+$/u.test(candidateVersion))
+    throw new Error(
+      `stable recovery candidate ref must bind an exact alpha version, got ${candidateVersion || "<empty>"}`,
+    );
+  if (candidateVersion.replace(/-alpha\.\d+$/u, "") !== publicationVersion)
+    throw new Error(
+      `stable recovery candidate ${candidateVersion} does not match publication ${publicationVersion || "<empty>"}`,
+    );
+  if (
+    (version.match(
+      /^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u,
+    )?.[1] || "") !== publicationVersion
+  )
+    throw new Error(
+      `recovered npm artifact version ${version || "<empty>"} does not match publication ${publicationVersion}`,
+    );
+  return candidateVersion;
+}

package/scripts/publication-candidate-sealer.mjs

@@ -1,3 +1,4 @@
+import { resolveOciCandidate } from "./publication-candidate-kind.mjs";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
@@ -69,7 +70,7 @@ export function createResolvedPublicationSealedBundle({
   });
   const main = resolvedNpmArtifacts.find((entry) => entry.metadata.role === "main")
     || (resolvedNpmArtifacts.length === 1 ? resolvedNpmArtifacts[0] : undefined);
-  if (!main) throw new Error("candidate npm payload set has no unique main package tarball");
+  if (!main || resolvedNpmArtifacts.filter((entry) => entry.metadata.role === "main").length > 1) throw new Error("candidate npm payload set has no unique main package tarball");
   const selectedReleaseAssets = (releaseAssetPaths.length > 0
     ? releaseAssetPaths
     : resolvedNpmArtifacts.map((entry) => entry.file.absolutePath))
@@ -88,6 +89,12 @@ export function createResolvedPublicationSealedBundle({
     releaseCandidateRoot: `sha256:${normalizeSha256(releaseCandidateRoot, "releaseCandidateRoot")}`,
     files: files.map(({ path: filePath, size, sha256 }) => ({ path: filePath, size, sha256 })),
   };
+  if (resolvedNpmArtifacts.length > 1) {
+    candidatePayload.npmPackages = resolvedNpmArtifacts.map(({file, metadata}) => ({
+      name: metadata.name, version: metadata.ref, role: metadata.role,
+      path: file.path, size: file.size, sha256: file.sha256, integrity: metadata.integrity,
+    }));
+  }
   const candidate = {
     ...candidatePayload,
     candidateDigest: publicationArtifactCandidateDigest(candidatePayload),
@@ -102,3 +109,11 @@ export function createResolvedPublicationSealedBundle({
   });
   return { root: resolvedRoot, manifest, npmArtifacts: resolvedNpmArtifacts, files };
 }
+
+export function resolveCandidatePublicationBundle({ kind, payloadDir, passport, runtimeSha, npmArtifacts, releaseAssetPaths }) {
+  if (kind === "oci") return resolveOciCandidate({ payloadRoot: payloadDir, passport });
+  if (kind !== "npm") return undefined;
+  return createResolvedPublicationSealedBundle({ bundleRoot: payloadDir, repository: passport.repository,
+    sourceSha: passport.source?.headSha, sourceTreeSha: passport.source?.treeHash,
+    runtimeSha, releaseCandidateRoot: passport.candidateHash, npmArtifacts, releaseAssetPaths });
+}

package/scripts/release-asset-client.mjs

@@ -0,0 +1,91 @@
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import {
+  reconcileImmutableReleaseAssets,
+  uniqueReleaseAssets,
+} from "../actions/promote-buildchain-ref/reuse-complete-release.js";
+
+export function releaseAssetClient(
+  repository,
+  { execute = execFileSync, token } = {},
+) {
+  if (!/^[\w.-]+\/[\w.-]+$/u.test(repository))
+    throw new Error("exact repository required");
+  const [owner, repo] = repository.split("/");
+  const raw = (endpoint, args = []) =>
+    execute("gh", ["api", endpoint, ...args], {
+      maxBuffer: 128 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "pipe"],
+      ...(token ? { env: { ...process.env, GH_TOKEN: token } } : {}),
+    });
+  const json = (endpoint) => JSON.parse(raw(endpoint));
+  const assetBytes = (asset) =>
+    raw(`repos/${repository}/releases/assets/${asset.id}`, [
+      "-H",
+      "Accept: application/octet-stream",
+    ]);
+  return {
+    json,
+    assetBytes,
+    release: (tag) =>
+      json(`repos/${repository}/releases/tags/${encodeURIComponent(tag)}`),
+    async publish(release, files) {
+      const octokit = {
+        rest: {
+          repos: {
+            getReleaseAsset: async ({ asset_id }) => ({
+              data: assetBytes({ id: asset_id }),
+            }),
+          },
+        },
+      };
+      const result = await reconcileImmutableReleaseAssets({
+        octokit,
+        owner,
+        repo,
+        releaseId: release.id,
+        remoteAssets: uniqueReleaseAssets(release.assets || []),
+        assetPaths: files,
+        uploadReleaseAsset: async ({ name }) => {
+          const file = files.find((file) => path.basename(file) === name);
+          return JSON.parse(
+            raw(
+              `https://uploads.github.com/repos/${repository}/releases/${release.id}/assets?name=${encodeURIComponent(name)}`,
+              [
+                "--method",
+                "POST",
+                "--input",
+                file,
+                "-H",
+                "Content-Type: application/octet-stream",
+              ],
+            ),
+          );
+        },
+      });
+      // A successful upload response alone is not the provider readback.
+      const observed = this.release(release.tag_name);
+      await reconcileImmutableReleaseAssets({
+        octokit,
+        owner,
+        repo,
+        releaseId: release.id,
+        remoteAssets: uniqueReleaseAssets(observed.assets || []),
+        assetPaths: files,
+        uploadReleaseAsset: async () => {
+          throw new Error("uploaded release asset missing on readback");
+        },
+      });
+      return result.map(({ action, name, digest }) => ({
+        action,
+        name,
+        digest,
+      }));
+    },
+    write(file, value) {
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+    },
+  };
+}

package/scripts/release-candidate-resolver.mjs

@@ -7,13 +7,12 @@ import { execFileSync } from "node:child_process";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { pathToFileURL } from "node:url";
-import { createResolvedPublicationSealedBundle } from "./publication-candidate-sealer.mjs";
+import { resolveCandidatePublicationBundle } from "./publication-candidate-sealer.mjs";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 import { v4ContentRoot } from "../packages/core/v4-canonical-contracts.js";
 import { v4PublicationQualificationRoot, validateV4PublicationQualificationReceipt } from "../packages/core/v4-publication-qualification.js";
 
-const DEFAULT_WORKFLOW_FILE = "build-surface-fixture.yml";
-
+const DEFAULT_WORKFLOW_FILE = "self-build-fixture.yml";
 function env(name, fallback = "") {
   return process.env[name] || fallback;
 }
@@ -21,7 +20,6 @@ function env(name, fallback = "") {
 export function releaseCandidateDownloadEnabled(value = "true") {
   return String(value || "true").trim().toLowerCase() !== "false";
 }
-
 function splitRepository(repository) {
   const match = String(repository || "").trim().match(/^([^/\s]+)\/([^/\s]+)$/);
   if (!match) {
@@ -44,7 +42,9 @@ function assertSha(value, label = "sha") {
 
 export const releaseCandidateRuntimeSha = (passport) =>
   assertSha(passport?.buildchain?.sha, "release candidate Passport Buildchain runtime SHA").toLowerCase();
-
+export const resolveFreshPublicationVersion = ({ sealedBundle, candidateVersion = "" } = {}) =>
+  String(sealedBundle?.manifest?.npm?.version || candidateVersion || "").trim();
+const optionalText = (value) => String(value || "");
 function githubHeaders(token) {
   const headers = {
     accept: "application/vnd.github+json",
@@ -263,17 +263,17 @@ export function selectReleaseAssetPaths({
       `release candidate payload patterns matched no files: ${splitPatterns(patterns).join(", ")}`,
     );
   }
-  const basenames = new Set();
+  const selectedByBasename = new Map();
+  const digest = (filePath) => digestFileSync(filePath, "sha256", "hex");
   for (const filePath of files) {
     const basename = path.basename(filePath);
-    if (basenames.has(basename)) {
-      throw new Error(
-        `release candidate public asset basename is not unique: ${basename}`,
-      );
-    }
-    basenames.add(basename);
+    const existing = selectedByBasename.get(basename);
+    if (!existing) selectedByBasename.set(basename, filePath);
+    else if (digest(existing) !== digest(filePath))
+      throw new Error(`release candidate public asset basename is not unique: ${basename}`);
   }
-  return files;
+  // Repeated paths are safe only when they name the same immutable bytes.
+  return [...selectedByBasename.values()];
 }
 
 function packageNameFromArtifactPath(filePath) {
@@ -725,34 +725,21 @@ export async function resolveReleaseCandidateArtifacts({
     const noun = publishArtifactKind === "npm" ? "npm package tarballs" : "platform manifests";
     throw new Error(`expected at least ${minimumPayloadCount} downloaded ${noun}, found ${downloadedRequiredArtifactCount}`);
   }
-  const sealedBundle = publishArtifactKind === "npm"
-    ? createResolvedPublicationSealedBundle({
-        bundleRoot: payloadDir,
-        repository: repoInfo.fullName,
-        sourceSha: passport.source?.headSha,
-        sourceTreeSha: passport.source?.treeHash,
-        runtimeSha: releaseCandidateRuntimeSha(passport),
-        releaseCandidateRoot: passport.candidateHash,
-        npmArtifacts: npmTarballPaths.map((tarballPath) => ({
-          path: tarballPath,
-          ...readNpmPackageArtifact({ tarballPath, mainPackage: publishPackageMain }),
-        })),
-        releaseAssetPaths,
-      })
-    : undefined;
-  const manifests = platformManifestPaths.map((manifestPath) => JSON.parse(fs.readFileSync(manifestPath, "utf8")));
-  const generatedRequiredArtifacts = generatePublishRequiredArtifacts({
+  const sealedBundle = resolveCandidatePublicationBundle({ kind: publishArtifactKind, payloadDir, passport,
+    runtimeSha: releaseCandidateRuntimeSha(passport), releaseAssetPaths,
+    npmArtifacts: npmTarballPaths.map((tarballPath) => ({ path: tarballPath,
+      ...readNpmPackageArtifact({ tarballPath, mainPackage: publishPackageMain }) })) });
+  const manifests = platformManifestPaths.map((manifestPath) => JSON.parse(fs.readFileSync(manifestPath, "utf8"))), publicationVersion = resolveFreshPublicationVersion({ sealedBundle, candidateVersion: passport.target?.version });
+  const generatedRequiredArtifacts = sealedBundle?.requiredArtifacts || generatePublishRequiredArtifacts({
     manifests,
-    version: [sealedBundle?.manifest?.npm?.version, passport.target?.version, ""].find(Boolean),
+    version: publicationVersion,
     kind: publishArtifactKind,
     tarballPaths: npmTarballPaths,
     mainPackage: publishPackageMain,
   });
   const requiredArtifactsPath = path.join(resolvedOutput, "publish-required-artifacts.json");
   fs.writeFileSync(requiredArtifactsPath, `${JSON.stringify(generatedRequiredArtifacts, null, 2)}\n`);
-  const sealedBundleManifestPath = sealedBundle
-    ? path.join(resolvedOutput, "sealed-bundle.json")
-    : "";
+  const sealedBundleManifestPath = sealedBundle ? path.join(resolvedOutput, "sealed-bundle.json") : "";
   if (sealedBundleManifestPath) {
     fs.writeFileSync(sealedBundleManifestPath, `${JSON.stringify(sealedBundle.manifest, null, 2)}\n`);
   }
@@ -772,6 +759,7 @@ export async function resolveReleaseCandidateArtifacts({
       sealedBundleManifest: sealedBundleManifestPath ? outputPath(sealedBundleManifestPath) : "",
     },
     version: passport.target?.version || "",
+    publicationVersion,
     candidateHash: passport.candidateHash || "",
     payloadCount: payloadArtifacts.length,
     platformManifestCount: platformManifestPaths.length,
@@ -811,6 +799,7 @@ export async function resolveReleaseCandidateArtifactsCli() {
     "release-candidate-publication-qualification-path": result.paths?.publicationQualification || "",
     "release-candidate-publication-qualification-root": result.publicationQualificationRoot || "",
     "release-candidate-version": result.version || "",
+    "release-candidate-publication-version": optionalText(result.publicationVersion),
     "release-candidate-source-sha": result.artifacts?.sourceSha || "",
     "release-candidate-artifact": result.artifacts?.passport || "",
     "release-candidate-build-summary-artifact": result.artifacts?.summary || "",
@@ -843,7 +832,6 @@ export async function resolveReleaseCandidateArtifactsCli() {
   console.log(JSON.stringify(result, null, 2));
   return result;
 }
-
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   try {
     await resolveReleaseCandidateArtifactsCli();

package/scripts/resume-from-candidate-run.mjs

@@ -6,6 +6,8 @@ import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
+import { resolveOciCandidate, resolveRecoveredPublicationVersion, resolveRecoveredCandidateVersion } from "./publication-candidate-kind.mjs";
+export { resolveRecoveredPublicationVersion, resolveRecoveredCandidateVersion } from "./publication-candidate-kind.mjs";
 import { writeGitHubOutputs } from "./build-contract-core.mjs";
 import { compareSemver } from "./publication-registry-hydrate.mjs";
 import { normalizeAnchorProvenance, normalizeCandidateRun, recoverCandidateProvenance } from "./release-candidate-anchor-provenance.mjs";
@@ -695,22 +697,6 @@ export function createRecoveredPublicationCandidate({
   };
   return { ...payload, candidateDigest: publicationArtifactCandidateDigest(payload) };
 }
-export function resolveRecoveredPublicationVersion({ artifactVersion, channel, rematerializeOnResume = false } = {}) {
-  const version = String(artifactVersion || "").trim(), match = version.match(/^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u);
-  if (!match) throw new Error(`recovered npm artifact has invalid publication version: ${version || "<empty>"}`);
-  return channel === "release" && rematerializeOnResume ? match[1] : version;
-}
-export function resolveRecoveredCandidateVersion({ artifactVersion, publicationVersion, channel, rematerializeOnResume = false, targetRef = "", candidateRef = "" } = {}) {
-  const version = String(artifactVersion || "").trim(), target = String(targetRef || "").replace(/^refs\/heads\//u, ""), candidate = String(candidateRef || "").replace(/^refs\/heads\//u, "");
-  if (channel !== "release" || !rematerializeOnResume) return version;
-  const prefix = `publish-gate/${target}/`;
-  if (!target || !candidate.startsWith(prefix)) throw new Error(`stable recovery candidate ref must descend from ${prefix || "publish-gate/<target>/"}`);
-  const candidateVersion = candidate.slice(prefix.length);
-  if (!/^\d+\.\d+\.\d+-alpha\.\d+$/u.test(candidateVersion)) throw new Error(`stable recovery candidate ref must bind an exact alpha version, got ${candidateVersion || "<empty>"}`);
-  if (candidateVersion.replace(/-alpha\.\d+$/u, "") !== publicationVersion) throw new Error(`stable recovery candidate ${candidateVersion} does not match publication ${publicationVersion || "<empty>"}`);
-  if ((version.match(/^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u)?.[1] || "") !== publicationVersion) throw new Error(`recovered npm artifact version ${version || "<empty>"} does not match publication ${publicationVersion}`);
-  return candidateVersion;
-}
 export function createRecoveredPublication({ downloads, bundleRoot, repository, passport, candidateRuntimeSha, publishArtifactKind, publishPackageMain, releasePatterns, platformManifests, channel, targetRef = "", candidateRef = "", rematerializeOnResume = false }) {
   const allFiles = downloads.flatMap((download) => download.files.map((file) => ({ path: path.relative(bundleRoot, file.absolutePath).split(path.sep).join("/"),
     size: file.size, sha256: file.sha256.replace(/^sha256:/, ""), absolutePath: file.absolutePath })))
@@ -718,6 +704,13 @@ export function createRecoveredPublication({ downloads, bundleRoot, repository,
   const kind = String(publishArtifactKind || "npm");
   const releaseMatchers = splitPatterns(releasePatterns).map(patternMatcher);
   const releaseAssets = allFiles.filter((file) => releaseMatchers.some((matcher) => matcher.test(path.basename(file.path))));
+  if (kind === "oci") {
+    createRecoveredPublicationCandidate({ allFiles, repository, passport, candidateRuntimeSha });
+    const sealed = resolveOciCandidate({ payloadRoot: bundleRoot, passport });
+    return { manifest: sealed.manifest, bundleRoot: sealed.root, npmArtifacts: [], allFiles, releaseAssets,
+      version: sealed.manifest.version, candidateVersion: sealed.manifest.version,
+      publishRequiredArtifacts: sealed.requiredArtifacts };
+  }
   if (kind !== "npm") {
     createRecoveredPublicationCandidate({ allFiles, repository, passport, candidateRuntimeSha });
     const version = String(passport.target?.version || "").trim();
@@ -821,7 +814,7 @@ export async function resolveRecoveryTransaction({
   transactionId,
   publicationVersion,
 }) {
-  let transaction = publicationVersion
+  let transaction = transactionId && publicationVersion
     ? await readExistingTransaction({
         repoInfo,
         apiUrl,
@@ -1019,7 +1012,7 @@ export async function resumeFromCandidateRun({
         npmTarballs: tarballs,
         releaseAssets: publication.releaseAssets.map((asset) => outputPath(asset.absolutePath)),
         publishRequiredArtifacts: outputPath(requiredArtifactsPath),
-        sealedBundleRoot: publication.manifest ? outputPath(bundleRoot) : "",
+        sealedBundleRoot: publication.manifest ? outputPath(publication.bundleRoot || bundleRoot) : "",
         sealedBundleManifest: publication.manifest ? outputPath(sealedManifestPath) : "",
         recoveryReceipt: outputPath(recoveryReceiptPath),
         stageCapsules: stageCapsuleFile ? outputPath(stageCapsuleFile.absolutePath) : "",

package/scripts/site-capability-metadata.mjs

@@ -206,6 +206,7 @@ export function nodeApiMeta(exportName) {
     "./publication-artifact": { group: "reusable-build", summary: "Publication artifact manifest, source bundle, and publication passport APIs." },
     "./publication-package": { group: "reusable-build", summary: "Publication npm package synthesis APIs for Buildchain-managed paper release presets." },
     "./publication-reproducibility": { group: "reusable-build", summary: "Two-clean-build publication byte reproducibility receipt APIs." },
+    "./oci-publication": { group: "reusable-build", summary: "Sealed OCI image family verification, provenance, and smoke evidence APIs." },
     "./publication-sealed-bundle": { group: "reusable-build", summary: "Build-once publication bundle manifests and exact-byte resume verification APIs." },
     "./paper": { group: "reusable-build", summary: "Unified Paper work, fleet, scaffold, preflight, npm bootstrap, build, Alpha, status, and resume planning APIs." },
     "./publication-authority": { group: "release-passport-trust", summary: "Sealed publication authority registry, runner provenance, control-plane audit, admission, and independent verification APIs." },