@kungfu-tech/buildchain 4.0.2 → 4.0.3-alpha.0

package/packages/core/publication-sealed-bundle.js

@@ -1,4 +1,5 @@
 import crypto from "node:crypto";
+import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 
@@ -19,7 +20,10 @@ function requiredString(value, label) {
 
 function safeRelativePath(value, label) {
   const normalized = requiredString(value, label).replaceAll("\\", "/");
-  if (normalized.startsWith("/") || normalized.split("/").some((part) => part === ".." || part === "")) {
+  if (
+    normalized.startsWith("/") ||
+    normalized.split("/").some((part) => part === ".." || part === "")
+  ) {
     throw new Error(`${label} must be a safe relative path`);
   }
   return normalized;
@@ -41,7 +45,8 @@ function sha256File(filePath) {
   const chunk = Buffer.allocUnsafe(8 * 1024 * 1024);
   try {
     let bytesRead = 0;
-    while ((bytesRead = fs.readSync(descriptor, chunk, 0, chunk.length, null)) > 0) hash.update(chunk.subarray(0, bytesRead));
+    while ((bytesRead = fs.readSync(descriptor, chunk, 0, chunk.length, null)) > 0)
+      hash.update(chunk.subarray(0, bytesRead));
   } finally {
     fs.closeSync(descriptor);
   }
@@ -60,8 +65,16 @@ function normalizeFile(entry, label) {
   };
 }
 
+function fileInventory(files, label) {
+  return (files || []).map((entry, index) => normalizeFile(entry, `${label}[${index}]`))
+    .sort((left, right) => left.path.localeCompare(right.path));
+}
+
 function candidatePayload(candidate) {
-  if (candidate?.contract !== PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT || Number(candidate?.schemaVersion) !== 1) {
+  if (
+    candidate?.contract !== PUBLICATION_ARTIFACT_CANDIDATE_CONTRACT ||
+    Number(candidate?.schemaVersion) !== 1
+  ) {
     throw new Error("publication artifact candidate contract mismatch");
   }
   const { candidateDigest: _candidateDigest, ...payload } = candidate;
@@ -91,9 +104,7 @@ export function createPublicationSealedBundle({
   githubReleaseRequired = true,
 } = {}) {
   const { digest } = candidatePayload(candidate);
-  const files = (candidate.files || [])
-    .map((entry, index) => normalizeFile(entry, `candidate.files[${index}]`))
-    .sort((left, right) => left.path.localeCompare(right.path));
+  const files = fileInventory(candidate.files, "candidate.files");
   if (new Set(files.map((entry) => entry.path)).size !== files.length) {
     throw new Error("publication sealed bundle candidate paths must be unique");
   }
@@ -119,6 +130,7 @@ export function createPublicationSealedBundle({
       sha256: npmTarball.sha256,
       integrity: requiredString(npmIntegrity, "npmIntegrity"),
     },
+    ...(candidate.npmPackages ? { npmPackages: candidate.npmPackages } : {}),
     releaseAssets,
     completion: {
       githubReleaseRequired: Boolean(githubReleaseRequired),
@@ -130,8 +142,56 @@ export function createPublicationSealedBundle({
   };
 }
 
+function verifyNpmPackageSet(manifest, files, resolvedRoot) {
+  const npmPackages = manifest.npmPackages;
+  if (JSON.stringify(npmPackages) !== JSON.stringify(manifest.candidate.npmPackages)) {
+    throw new Error("publication sealed bundle npm package inventory differs from candidate");
+  }
+  if (npmPackages) {
+    if (
+      !Array.isArray(npmPackages) ||
+      npmPackages.length < 2 ||
+      new Set(npmPackages.map((entry) => entry.name)).size !== npmPackages.length ||
+      new Set(npmPackages.map((entry) => entry.path)).size !== npmPackages.length
+    ) {
+      throw new Error("publication sealed bundle npm package inventory must be unique");
+    }
+    for (const entry of npmPackages) {
+      const file = selectFile(files, entry.path, "npmPackages.path");
+      const absolutePath = path.resolve(resolvedRoot, file.path);
+      const metadata = JSON.parse(
+        execFileSync("tar", ["-xOf", path.basename(absolutePath), "package/package.json"], {
+          cwd: path.dirname(absolutePath),
+          encoding: "utf8",
+        }),
+      );
+      const integrity = `sha512-${crypto.createHash("sha512").update(fs.readFileSync(absolutePath)).digest("base64")}`;
+      if (
+        entry.name !== metadata.name ||
+        entry.version !== metadata.version ||
+        entry.size !== file.size ||
+        entry.sha256 !== file.sha256 ||
+        entry.integrity !== integrity
+      ) {
+        throw new Error("publication sealed bundle npm package identity or integrity mismatch");
+      }
+    }
+    const main = npmPackages.filter((entry) => entry.role === "main");
+    if (
+      main.length !== 1 ||
+      Object.keys(manifest.npm).some((key) => main[0][key] !== manifest.npm[key])
+    ) {
+      throw new Error("publication sealed bundle npm main package mismatch");
+    }
+  }
+  return npmPackages;
+}
+
 export function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) {
-  if (manifest?.contract !== PUBLICATION_SEALED_BUNDLE_CONTRACT || Number(manifest?.schemaVersion) !== 1) {
+  if (
+    manifest?.contract !== PUBLICATION_SEALED_BUNDLE_CONTRACT ||
+    Number(manifest?.schemaVersion) !== 1
+  ) {
     throw new Error("publication sealed bundle contract mismatch");
   }
   const resolvedRoot = path.resolve(requiredString(bundleRoot, "bundleRoot"));
@@ -139,12 +199,8 @@ export function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) {
   if (normalizeSha256(manifest.root, "manifest.root") !== digest) {
     throw new Error("publication sealed bundle root mismatch");
   }
-  const files = (manifest.files || [])
-    .map((entry, index) => normalizeFile(entry, `manifest.files[${index}]`))
-    .sort((left, right) => left.path.localeCompare(right.path));
-  const candidateFiles = (manifest.candidate.files || [])
-    .map((entry, index) => normalizeFile(entry, `candidate.files[${index}]`))
-    .sort((left, right) => left.path.localeCompare(right.path));
+  const files = fileInventory(manifest.files, "manifest.files");
+  const candidateFiles = fileInventory(manifest.candidate.files, "candidate.files");
   if (JSON.stringify(files) !== JSON.stringify(candidateFiles)) {
     throw new Error("publication sealed bundle file inventory differs from candidate");
   }
@@ -169,6 +225,7 @@ export function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) {
   ) {
     throw new Error("publication sealed bundle npm tarball inventory mismatch");
   }
+  const npmPackages = verifyNpmPackageSet(manifest, files, resolvedRoot);
   const releaseAssets = (manifest.releaseAssets || []).map((entry, index) => {
     const selected = selectFile(files, entry.path, `manifest.releaseAssets[${index}].path`);
     const normalized = normalizeFile(entry, `manifest.releaseAssets[${index}]`);
@@ -194,6 +251,14 @@ export function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) {
       ...entry,
       absolutePath: path.resolve(resolvedRoot, entry.path),
     })),
+    ...(npmPackages
+      ? {
+          npmPackages: npmPackages.map((entry) => ({
+            ...entry,
+            absolutePath: path.resolve(resolvedRoot, entry.path),
+          })),
+        }
+      : {}),
     manifest,
   };
 }

package/packages/core/release-activation-shadow.js

@@ -0,0 +1,32 @@
+import { ContractFault } from "./canonical-contracts.js";
+import { DomainWasmFault, invokeDomainWasm } from "./domain-wasm.js";
+
+export const RELEASE_ACTIVATION_REQUEST_CONTRACT =
+  "buildchain-v4-release-activation-request/v1";
+export const RELEASE_ACTIVATION_PLAN_CONTRACT =
+  "buildchain-v4-release-activation-plan/v1";
+export const RELEASE_ACTIVATION_STATE_CONTRACT =
+  "buildchain-v4-release-activation-state/v1";
+
+function project(request) {
+  try {
+    return invokeDomainWasm("release-activation", request);
+  } catch (error) {
+    if (error instanceof DomainWasmFault) {
+      throw new ContractFault(error.code, error.path, error.message);
+    }
+    throw error;
+  }
+}
+
+export function planReleaseActivation(request) {
+  return project(request).plan;
+}
+
+export function foldReleaseActivation(request) {
+  return project(request).state;
+}
+
+export function projectReleaseActivation(request) {
+  return project(request);
+}

package/packages/core/release-candidate.js

@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-import { verifyV4FloatingConsumerPolicyReceipt } from "./v4-floating-consumer-policy.js";
+import { verifyFloatingConsumerPolicyReceipt } from "./floating-consumer-policy.js";
 import { normalizeControllerReceiptReferences, validateControllerReceiptReference } from "./controller-evidence.js";
 
 export const RELEASE_CANDIDATE_PASSPORT_CONTRACT = "kungfu-buildchain-release-candidate-passport";
@@ -172,7 +172,7 @@ function normalizeGateProfileEvidence(gateAggregate = undefined) {
   };
 }
 
-function isV4BuildchainRuntime(buildchain = {}) {
+function isBuildchainRuntime(buildchain = {}) {
   return [buildchain.ref, buildchain.workflowShellRef]
     .some((value) => /^v4(?:-alpha)?$/u.test(String(value || "")))
     || /^4\./u.test(String(buildchain.version || ""));
@@ -184,7 +184,7 @@ function normalizeConsumerPolicyEvidence(value, expected = {}) {
     throw new Error("consumerPolicyReceipt must be an object");
   }
   const receipt = value.receipt || value;
-  const verification = verifyV4FloatingConsumerPolicyReceipt({
+  const verification = verifyFloatingConsumerPolicyReceipt({
     receipt,
     receiptRoot: value.receiptRoot || "",
     repository: expected.repository,
@@ -198,11 +198,11 @@ function normalizeConsumerPolicyEvidence(value, expected = {}) {
 }
 
 function validateConsumerPolicyEvidence(passport, check) {
-  if (isV4BuildchainRuntime(passport.buildchain)) {
+  if (isBuildchainRuntime(passport.buildchain)) {
     check(Boolean(passport.consumerPolicy), "Buildchain v4 release candidate requires consumer policy evidence");
   }
   if (!passport.consumerPolicy) return;
-  const verification = verifyV4FloatingConsumerPolicyReceipt({
+  const verification = verifyFloatingConsumerPolicyReceipt({
     receipt: passport.consumerPolicy.receipt,
     receiptRoot: passport.consumerPolicy.receiptRoot,
     repository: passport.repository,
@@ -406,7 +406,7 @@ export function createReleaseCandidatePassport({
     sourceSha: normalizedSummary.publishSource?.ref === "publish-gate/anchor" ? (consumerPolicyReceipt?.receipt || consumerPolicyReceipt)?.caller?.sourceSha : sourceSha,
     runtimeSha: resolvedBuildchain.sha,
   });
-  if (isV4BuildchainRuntime(resolvedBuildchain) && !normalizedConsumerPolicy) {
+  if (isBuildchainRuntime(resolvedBuildchain) && !normalizedConsumerPolicy) {
     throw new Error("Buildchain v4 release candidate passport requires a valid floating consumer policy receipt");
   }
   const controllerReceiptEvidence = normalizeControllerReceiptReferences({

package/packages/core/{v4-release-invocation.js → release-invocation.js}

@@ -1,39 +1,39 @@
-import { V4ContractFault } from "./v4-canonical-contracts.js";
-import { V4DomainWasmFault, invokeV4DomainWasm } from "./v4-domain-wasm.js";
+import { ContractFault } from "./canonical-contracts.js";
+import { DomainWasmFault, invokeDomainWasm } from "./domain-wasm.js";
 
-export const V4_RELEASE_INVOCATION_CONTRACT =
+export const RELEASE_INVOCATION_CONTRACT =
   "kungfu-buildchain-v4-release-invocation/v1";
-export const V4_RELEASE_INVOCATION_ADAPTER_CONTRACT =
+export const RELEASE_INVOCATION_ADAPTER_CONTRACT =
   "kungfu-buildchain-v4-release-invocation-adapter/v1";
-export const V4_RELEASE_TRANSACTION_CONTRACT =
+export const RELEASE_TRANSACTION_CONTRACT =
   "kungfu-buildchain-v4-release-transaction/v1";
-export const V4_RELEASE_RECEIPT_CONTRACT =
+export const RELEASE_RECEIPT_CONTRACT =
   "kungfu-buildchain-v4-release-receipt/v1";
-export const V4_RELEASE_PROVIDER_CONTRACT =
+export const RELEASE_PROVIDER_CONTRACT =
   "kungfu-buildchain-release-tail-provider/v1";
 
 function invoke(operation, payload) {
   try {
-    return invokeV4DomainWasm(operation, payload);
+    return invokeDomainWasm(operation, payload);
   } catch (error) {
-    if (error instanceof V4DomainWasmFault) {
-      throw new V4ContractFault(error.code, error.path, error.message);
+    if (error instanceof DomainWasmFault) {
+      throw new ContractFault(error.code, error.path, error.message);
     }
     throw error;
   }
 }
 
-export function createV4ReleaseInvocation(value) {
+export function createReleaseInvocation(value) {
   const projected = invoke("release-invocation", value);
   return { ...projected, invocation: value };
 }
 
-export function adaptV4ReleaseInvocation(value) {
+export function adaptReleaseInvocation(value) {
   const projected = invoke("release-invocation-adapter", value);
   return { ...projected, invocation: value.invocation };
 }
 
-export function planV4ReleaseRoute({
+export function planReleaseRoute({
   requestedSha,
   observedSha,
   comparisonStatus,
@@ -55,10 +55,10 @@ export function planV4ReleaseRoute({
   );
 }
 
-export function createV4ReleaseTransaction(value) {
+export function createDomainReleaseTransaction(value) {
   return invoke("release-transaction", value);
 }
 
-export function createV4ReleaseReceipt(value) {
+export function createReleaseReceipt(value) {
   return invoke("release-receipt", value);
 }

package/packages/core/release-passport.js

@@ -33,20 +33,20 @@ import { normalizeControllerReceiptReferences } from "./controller-evidence.js";
 import {
   normalizeGitHubArtifactAttestationPolicy,
 } from "./github-artifact-attestation.js";
-import { verifyV4FloatingConsumerPolicyCertification } from "./v4-floating-consumer-evidence.js";
+import { verifyFloatingConsumerPolicyCertification } from "./floating-consumer-evidence.js";
 import {
   normalizePromotionEvidence,
   normalizePromotionRouting,
-  normalizeV4RuntimeResumeEvidence,
-  isV4PromotionRouting,
+  normalizeRuntimeResumeEvidence,
+  isPromotionRouting,
   releasePassportCertificationVerificationOptions,
-  requireV4ConsumerPolicyCertification,
-  resolveV4ConsumerPolicyCertificationIdentity,
-} from "./v4-floating-consumer-release-passport.js";
+  requireConsumerPolicyCertification,
+  resolveConsumerPolicyCertificationIdentity,
+} from "./floating-consumer-release-passport.js";
 import {
-  verifyV4RuntimeAuthorizationReceipt,
-  verifyV4RuntimeResumeLineage,
-} from "./v4-runtime-ref-resume-authority.js";
+  verifyRuntimeAuthorizationReceipt,
+  verifyRuntimeResumeLineage,
+} from "./runtime-ref-resume-authority.js";
 
 export { RELEASE_CHECK_REPORT_CONTRACT, RELEASE_PASSPORT_CONTRACT };
 export const ARTIFACT_EVIDENCE_CONTRACT = "kungfu-buildchain-artifact-evidence";
@@ -1204,9 +1204,9 @@ export function createReleasePassport(options = {}) {
   kfdSupportEvidencePath = "",
   invariantPassports = undefined,
   releaseEvidence = [],
-  v4ConsumerPolicyCertification = undefined,
-  v4ConsumerPolicyCertificationRoot = "",
-  v4RuntimeResumeEvidence = undefined,
+  v4ConsumerPolicyCertification: domainConsumerPolicyCertification = undefined,
+  v4ConsumerPolicyCertificationRoot: domainConsumerPolicyCertificationRoot = "",
+  domainRuntimeResumeEvidence = undefined,
   kfdAgentHubEvidence = undefined,
   kfdAgentHubEvidencePath = "",
   controllerReceipts = [],
@@ -1223,9 +1223,9 @@ export function createReleasePassport(options = {}) {
   const normalizedTrustedPublishing = normalizeTrustedPublishing(trustedPublishing, { workflow, publish });
   const normalizedTransaction = normalizeTransaction(transaction);
   const { promotion, buildEvidence } = preparePromotionBuild(options);
-  const normalizedV4RuntimeResume = normalizeV4RuntimeResumeEvidence(v4RuntimeResumeEvidence, {
+  const normalizedRuntimeResume = normalizeRuntimeResumeEvidence(domainRuntimeResumeEvidence, {
     repository,
-    sourceSha: v4RuntimeResumeSourceSha(release, sourceSha),
+    sourceSha: runtimeResumeSourceSha(release, sourceSha),
     resumeRuntimeSha: promotion.routing?.runtime?.resolvedSha || "",
     consumerPolicyReceiptRoot: promotion.consumerPolicy?.certification?.receiptRoot || "",
   });
@@ -1374,7 +1374,7 @@ export function createReleasePassport(options = {}) {
       ["invariantPassports", invariantPassports],
       ["releaseEvidence", releaseEvidence],
       ["v4ConsumerPolicy", promotion.consumerPolicy],
-      ["v4RuntimeResume", normalizedV4RuntimeResume],
+      ["v4RuntimeResume", normalizedRuntimeResume],
       ["controllerReceipts", normalizedControllerReceipts],
       ["githubArtifactAttestations", normalizedGitHubArtifactAttestations],
     ]),
@@ -1497,9 +1497,9 @@ export function collectGitHubReleasePassport({
   invariantPassportJsons = [],
   invariantPassportCommand = "",
   releaseEvidenceJsons = [],
-  v4ConsumerPolicyCertificationJson = "",
-  v4ConsumerPolicyCertificationRoot = "",
-  v4RuntimeResumeEvidenceJson = "",
+  v4ConsumerPolicyCertificationJson: domainConsumerPolicyCertificationJson = "",
+  v4ConsumerPolicyCertificationRoot: domainConsumerPolicyCertificationRoot = "",
+  v4RuntimeResumeEvidenceJson: domainRuntimeResumeEvidenceJson = "",
   kfdAgentHubEvidenceJson = "",
   controllerReceiptReferences = [],
   githubArtifactAttestationPolicyJsons = [],
@@ -1575,9 +1575,9 @@ export function collectGitHubReleasePassport({
       }),
     )
     .filter((meta) => meta.value);
-  const v4ConsumerPolicyCertificationMeta =
-    parseV4ConsumerPolicyCertification(v4ConsumerPolicyCertificationJson, cwd);
-  const v4RuntimeResumeEvidence = parseJsonInput(v4RuntimeResumeEvidenceJson, undefined, {
+  const consumerPolicyCertificationMeta =
+    parseConsumerPolicyCertification(domainConsumerPolicyCertificationJson, cwd);
+  const domainRuntimeResumeEvidence = parseJsonInput(domainRuntimeResumeEvidenceJson, undefined, {
     cwd,
     label: "v4RuntimeResumeEvidenceJson",
   });
@@ -1706,9 +1706,9 @@ export function collectGitHubReleasePassport({
     kfdSupportEvidencePath: kfdSupport ? "kfd-support.json" : "",
     invariantPassports,
     releaseEvidence: releaseEvidenceAttachments.map(({ reference }) => reference),
-    v4ConsumerPolicyCertification: v4ConsumerPolicyCertificationMeta.value,
-    v4ConsumerPolicyCertificationRoot,
-    v4RuntimeResumeEvidence,
+    v4ConsumerPolicyCertification: consumerPolicyCertificationMeta.value,
+    v4ConsumerPolicyCertificationRoot: domainConsumerPolicyCertificationRoot,
+    domainRuntimeResumeEvidence,
     kfdAgentHubEvidence: kfdAgentHubEvidenceMeta.value
       ? { ...kfdAgentHubEvidenceMeta, path: "kfd-agent-hub-evidence.json" }
       : undefined,
@@ -2650,8 +2650,8 @@ export function createReleaseCheckReport({
     releaseEvidenceDocuments,
     issues,
   });
-  validateV4ConsumerPolicyPassportSection({ passport, issues });
-  validateV4RuntimeResumePassportSection({ passport, issues });
+  validateConsumerPolicyPassportSection({ passport, issues });
+  validateRuntimeResumePassportSection({ passport, issues });
   validatePublishEvidenceSection({ passport, publishEvidence, normalizedPublishEvidence, issues });
   const evidenceIndex = indexEvidenceArtifacts(evidenceArtifacts);
   validateReleaseArtifacts({ artifacts, evidenceIndex, issues });
@@ -2805,14 +2805,14 @@ export function makeReleasePassportFixtureAssets(dir) {
 export function validateKnownReleasePassportContracts() {
   return [...CONTRACTS];
 }
-function parseV4ConsumerPolicyCertification(input, cwd) {
+function parseConsumerPolicyCertification(input, cwd) {
   return parseJsonInputWithMeta(input, undefined, {
     cwd,
     label: "v4ConsumerPolicyCertificationJson",
   });
 }
 
-function v4RuntimeResumeSourceSha(release, fallback = "") {
+function runtimeResumeSourceSha(release, fallback = "") {
   const builtSourceSha = releaseField(
     release || {},
     "builtSourceSha",
@@ -2824,10 +2824,10 @@ function v4RuntimeResumeSourceSha(release, fallback = "") {
 }
 
 
-function validateV4ConsumerPolicyPassportSection({ passport, issues }) {
+function validateConsumerPolicyPassportSection({ passport, issues }) {
   const routing = passport?.promotionRouting;
   const evidence = passport?.v4ConsumerPolicy;
-  if (isV4PromotionRouting(routing) && !evidence) {
+  if (isPromotionRouting(routing) && !evidence) {
     issues.push(issue(
       "error",
       "v4ConsumerPolicy.missing",
@@ -2836,7 +2836,7 @@ function validateV4ConsumerPolicyPassportSection({ passport, issues }) {
     return;
   }
   if (!evidence) return;
-  const verification = verifyV4FloatingConsumerPolicyCertification(
+  const verification = verifyFloatingConsumerPolicyCertification(
     releasePassportCertificationVerificationOptions({
       evidence,
       passport,
@@ -2848,26 +2848,26 @@ function validateV4ConsumerPolicyPassportSection({ passport, issues }) {
   }
 }
 
-function validateV4RuntimeResumePassportSection({ passport, issues }) {
+function validateRuntimeResumePassportSection({ passport, issues }) {
   const evidence = passport?.v4RuntimeResume;
   if (!evidence) return;
   const consumerPolicyReceiptRoot = passport?.v4ConsumerPolicy?.certification?.receiptRoot || "";
-  const authorization = verifyV4RuntimeAuthorizationReceipt({
+  const authorization = verifyRuntimeAuthorizationReceipt({
     receipt: evidence.authorization,
     receiptRoot: evidence.authorizationRoot,
     repository: passport?.product?.repository || "",
-    sourceSha: v4RuntimeResumeSourceSha(passport?.release, passport?.release?.sourceSha || ""),
+    sourceSha: runtimeResumeSourceSha(passport?.release, passport?.release?.sourceSha || ""),
     runtimeSha: passport?.promotionRouting?.runtime?.resolvedSha || "",
     consumerPolicyReceiptRoot,
   });
   for (const failure of authorization.failures) {
     issues.push(issue("error", `v4RuntimeResume.authorization.${failure}`, failure));
   }
-  const lineage = verifyV4RuntimeResumeLineage({
+  const lineage = verifyRuntimeResumeLineage({
     lineage: evidence.lineage,
     lineageRoot: evidence.lineageRoot,
     repository: passport?.product?.repository || "",
-    sourceSha: v4RuntimeResumeSourceSha(passport?.release, passport?.release?.sourceSha || ""),
+    sourceSha: runtimeResumeSourceSha(passport?.release, passport?.release?.sourceSha || ""),
     resumeRuntimeSha: passport?.promotionRouting?.runtime?.resolvedSha || "",
     consumerPolicyReceiptRoot,
   });

package/packages/core/release-tail-product-capabilities.js

@@ -17,6 +17,15 @@ export const RELEASE_TAIL_PRODUCT_CAPABILITIES = Object.freeze([
     receiptKind: "product-package-publication",
     transactionState: "publishing",
   }),
+  Object.freeze({
+    id: "product.oci.publish",
+    executor: "provider-adapter",
+    adapter: "oci-image-family",
+    effectKind: "oci-family-publication",
+    observationKind: "oci-family-readback",
+    receiptKind: "oci-family-publication",
+    transactionState: "publishing",
+  }),
   Object.freeze({
     id: "product.release-refs.converge",
     executor: "provider-adapter",

package/packages/core/release-tail-provider-plane.js

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 
-import { invokeV4DomainWasm } from "./v4-domain-wasm.js";
+import { invokeDomainWasm } from "./domain-wasm.js";
 import { RELEASE_TAIL_PRODUCT_CAPABILITIES } from "./release-tail-product-capabilities.js";
 
 export const RELEASE_TAIL_DECLARATION_CONTRACT =
@@ -71,12 +71,12 @@ export const RELEASE_TAIL_CAPABILITY_REGISTRY = Object.freeze([
 ]);
 
 export function releaseTailStableJson(value) {
-  const canonical = invokeV4DomainWasm("canonical-json", value).canonicalUtf8;
+  const canonical = invokeDomainWasm("canonical-json", value).canonicalUtf8;
   return canonical.endsWith("\n") ? canonical.slice(0, -1) : canonical;
 }
 
 export function releaseTailRoot(value) {
-  return invokeV4DomainWasm("release-tail-root", value).root;
+  return invokeDomainWasm("release-tail-root", value).root;
 }
 
 export function parseReleaseTailDeclaration(input) {
@@ -90,26 +90,26 @@ export function parseReleaseTailDeclaration(input) {
       );
     }
   }
-  return invokeV4DomainWasm("release-tail-parse", value);
+  return invokeDomainWasm("release-tail-parse", value);
 }
 
 export function compileReleaseTailDeclaration(input) {
-  return invokeV4DomainWasm(
+  return invokeDomainWasm(
     "release-tail-compile",
     typeof input === "string" ? JSON.parse(input) : input,
   );
 }
 
 export function validateReleaseTailEffectPlan(plan) {
-  return invokeV4DomainWasm("release-tail-validate-plan", plan);
+  return invokeDomainWasm("release-tail-validate-plan", plan);
 }
 
 export function createReleaseTailTransaction(input) {
-  return invokeV4DomainWasm("release-tail-create", input);
+  return invokeDomainWasm("release-tail-create", input);
 }
 
 export function validateReleaseTailTransaction(transaction) {
-  return invokeV4DomainWasm("release-tail-validate-transaction", transaction);
+  return invokeDomainWasm("release-tail-validate-transaction", transaction);
 }
 
 export function readReleaseTailTransaction(filePath) {
@@ -173,7 +173,7 @@ export async function executeReleaseTailTransaction(
   transaction,
   { adapters, checkpoint } = {},
 ) {
-  let exchange = invokeV4DomainWasm(
+  let exchange = invokeDomainWasm(
     "release-tail-execution-start",
     transaction,
   );
@@ -214,7 +214,7 @@ export async function executeReleaseTailTransaction(
         `unsupported Rust/WASM release-tail instruction '${instruction.action}'`,
       );
     }
-    exchange = invokeV4DomainWasm("release-tail-execution-advance", {
+    exchange = invokeDomainWasm("release-tail-execution-advance", {
       transaction: exchange.transaction,
       cursor: exchange.cursor,
       signal,