@kungfu-tech/buildchain 4.1.3-alpha.9 → 4.1.4-alpha.0

package/packages/core/adoption/cli/support.mjs

@@ -9,8 +9,6 @@ import {
   readBooleanFlag,
   readFlag,
   readJsonInput,
-  readRepeatedFlag,
-  readRepeatedJsonInputs,
   writeJsonFile,
 } from "../../contracts/cli/options.mjs";
 

package/packages/core/adoption/cli/surface-register.mjs

@@ -10,9 +10,7 @@ import {
   printJson,
   readBooleanFlag,
   readFlag,
-  readJsonInput,
   readRepeatedFlag,
-  readRepeatedJsonInputs,
   writeJsonFile,
 } from "../../contracts/cli/options.mjs";
 

package/packages/core/adoption/commands/init-repo.mjs

@@ -2,407 +2,28 @@
 import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
-import { BUILDCHAIN_CONFIG_PATH } from "../../contracts/buildchain-layout.js";
-import { detectPackageManager, assertPackageManager } from "../../build/package-manager.js";
 import {
-  appendNextDevelopmentToml,
-  mergeNextDevelopmentAgentInstructions,
-  nextDevelopmentWorkflowHeader,
-} from "../../release/next-development-projection.js";
-
-const BUILDCHAIN_WORKFLOW_REF = "kungfu-systems/buildchain/.github/workflows/build.yml@v4";
-const DEFAULT_PUBLICATION_LATEX_IMAGE = "ghcr.io/kungfu-systems/build-images/latex-pdf-builder";
-const DEFAULT_PUBLICATION_LATEX_DIGEST = "sha256:c20f3809e96836c1c78e97c76939d12f1de3fed0ea9b7c40c43332ec2ea480f8";
-const DEFAULT_PUBLICATION_LATEX_COMMAND = "latexmk -pdf -outdir=_build paper/main.tex";
-
-function posixPath(value) {
-  return String(value || "").split(path.sep).join("/");
-}
-
-function repoName(cwd) {
-  return path.basename(path.resolve(cwd));
-}
-
-function detectOrDefaultPackageManager(cwd, requested) {
-  if (requested) {
-    return assertPackageManager(requested);
-  }
-  try {
-    return detectPackageManager(cwd).name;
-  } catch {
-    return "pnpm";
-  }
-}
-
-function packageLifecycle(manager) {
-  if (manager === "npm") {
-    return {
-      install: "npm ci",
-      build: "npm run build",
-      verify: "npm run check",
-    };
-  }
-  if (manager === "yarn") {
-    return {
-      install: "corepack yarn install --immutable",
-      build: "corepack yarn run build",
-      verify: "corepack yarn run check",
-    };
-  }
-  return {
-    install: "corepack pnpm install --frozen-lockfile",
-    build: "corepack pnpm run build",
-    verify: "corepack pnpm run check",
-  };
-}
-
-function packageToml(cwd, manager) {
-  const lifecycle = packageLifecycle(manager);
-  const hasPackageJson = fs.existsSync(path.join(cwd, "package.json"));
-  const versionFiles = hasPackageJson
-    ? `
-[[version.files]]
-type = "json"
-path = "package.json"
-key = "version"
-`
-    : "";
-  return `schema = 1
-
-[project]
-type = "package"
-name = "${repoName(cwd)}"
-
-[version]
-required = ${hasPackageJson ? "true" : "false"}
-strategy = "semver"
-next = "auto"
-${versionFiles}
-[lifecycle.install]
-command = "${lifecycle.install}"
-
-[lifecycle.build]
-command = "${lifecycle.build}"
-
-[lifecycle.verify]
-command = "${lifecycle.verify}"
-`;
-}
-
-function nativeToml(cwd) {
-  return `schema = 1
-
-[project]
-type = "package"
-name = "${repoName(cwd)}"
-
-[version]
-required = false
-strategy = "semver"
-next = "auto"
-
-[[version.files]]
-type = "regex"
-path = "CMakeLists.txt"
-pattern = 'project\\([^)]* VERSION (?<version>[^ )]+)'
-replacement = '\${version}'
-
-[lifecycle.configure]
-commands = [
-  "cmake -S . -B build -DCMAKE_BUILD_TYPE=Release",
-]
-
-[lifecycle.build]
-commands = [
-  "cmake --build build --config Release",
-]
-
-[lifecycle.verify]
-commands = [
-  "ctest --test-dir build --output-on-failure",
-]
-
-[diagnostics.native]
-enabled = true
-sample_process_tree = false
-compiler_cache = "auto"
-expected_tools = ["ccache", "sccache", "clang", "cl", "cmake", "ninja"]
-artifact_dirs = ["build", "dist"]
-`;
-}
-
-function anchoredPackageToml(cwd, manager) {
-  const lifecycle = packageLifecycle(manager);
-  return `schema = 1
-
-[project]
-type = "package"
-name = "${repoName(cwd)}"
-
-[version]
-required = true
-strategy = "anchored"
-next = "manual"
-manifest = "release.json"
-
-[[version.files]]
-type = "json"
-path = "package.json"
-key = "version"
-
-[lifecycle.install]
-command = "${lifecycle.install}"
-
-[lifecycle.build]
-command = "${lifecycle.build}"
-
-[lifecycle.verify]
-command = "${lifecycle.verify}"
-`;
-}
-
-function webSurfaceToml(cwd) {
-  const name = repoName(cwd);
-  return `schema = 1
-
-[project]
-type = "web-surface"
-name = "${name}"
-site = "${name}"
-
-[channels.preview]
-url_pattern = "https://{alias}.preview.example.com"
-visibility = "ephemeral"
-requires_auth = false
-noindex = true
-
-[channels.staging]
-url = "https://staging.example.com"
-visibility = "protected"
-access_control = "managed-network"
-edge_auth = "none"
-noindex = true
-promotable = true
-
-[channels.production]
-url = "https://example.com"
-visibility = "public"
-requires_auth = false
-noindex = false
-canonical = true
-
-[deploy.preview]
-adapter = "aws-s3-cloudfront"
-artifact_path = "dist"
-bucket_ref = "AWS_PREVIEW_BUCKET"
-distribution_ref = "AWS_PREVIEW_DISTRIBUTION"
-
-[deploy.staging]
-adapter = "aws-s3-cloudfront"
-artifact_path = "dist"
-bucket_ref = "AWS_STAGING_BUCKET"
-distribution_ref = "AWS_STAGING_DISTRIBUTION"
-
-[deploy.production]
-adapter = "aws-s3-cloudfront"
-artifact_path = "dist"
-bucket_ref = "AWS_PRODUCTION_BUCKET"
-distribution_ref = "AWS_PRODUCTION_DISTRIBUTION"
-
-[security.staging]
-noindex = true
-isolated_providers = true
-
-[lifecycle.build]
-command = "corepack pnpm run build"
-
-[lifecycle.verify]
-command = "corepack pnpm run check"
-`;
-}
-
-function infraContractToml(cwd) {
-  const name = repoName(cwd);
-  return `schema = 1
-
-[project]
-type = "infra-contract"
-name = "${name}"
-
-[infra]
-adapter = "manual-observed"
-adoption_mode = "manual-observed"
-apply = "disabled"
-environment = "staging"
-desired = ["infra/desired.json"]
-contract = ["infra/outputs.json"]
-
-[[consumers]]
-repo = "kungfu-systems/site-example"
-path = "infra/outputs.json"
-source = "infra/outputs.json"
-
-[lifecycle.verify]
-command = "buildchain infra-contract --mode ci"
-`;
-}
-
-function publicationArtifactToml(cwd) {
-  const name = repoName(cwd);
-  return `schema = 1
-
-[project]
-type = "publication-artifact"
-name = "${name}"
-
-[publication]
-kind = "paper"
-title = "${name}"
-primary_artifact = "_build/main.pdf"
-artifact_paths = ["_build/main.pdf"]
-metadata_paths = ["README.md", "docs/MAP.md"]
-source_paths = ["paper", "README.md", "LICENSE", "Makefile"]
-site_consumers = ["papers-site"]
-manifest_path = ".buildchain/publication/publication-artifact.json"
-source_bundle_path = ".buildchain/publication/source.tar.gz"
-
-[publication.toolchain]
-type = "latex-docker"
-image = "${DEFAULT_PUBLICATION_LATEX_IMAGE}"
-digest = "${DEFAULT_PUBLICATION_LATEX_DIGEST}"
-command = "${DEFAULT_PUBLICATION_LATEX_COMMAND}"
-
-[lifecycle.build]
-command = "make pdf"
-
-[lifecycle.verify]
-command = "make check"
-`;
-}
-
-function infraContractDesiredJson(cwd) {
-  return `${JSON.stringify({
-    service: repoName(cwd),
-    environment: "staging",
-    resources: [
-      {
-        kind: "static-site",
-        name: repoName(cwd),
-        desiredState: {
-          hostname: "staging.example.com",
-          accessControl: "managed-network",
-          owner: "platform",
-        },
-      },
-    ],
-  }, null, 2)}\n`;
-}
-
-function infraContractOutputsJson(cwd) {
-  return `${JSON.stringify({
-    service: repoName(cwd),
-    environment: "staging",
-    observedMode: "manual-observed",
-    outputs: {
-      hostname: "staging.example.com",
-      distributionId: "observed-distribution-id",
-      bucket: "observed-bucket-name",
-    },
-  }, null, 2)}\n`;
-}
-
-function workflowArtifactPaths(type) {
-  if (type === "infra-contract") {
-    return `.buildchain/infra-contract-validate.json
-        .buildchain/infra-contract-plan.json
-        .buildchain/buildchain.infra-contract.json
-        .buildchain/infra-contract-propagation.json
-        .buildchain/infra-contract-propagation-apply.json
-        .buildchain/infra-contract-evidence-bundle.json
-        .buildchain/infra-contract-evidence-verification.json`;
-  }
-  if (type === "publication-artifact") {
-    return `_build/main.pdf
-        .buildchain/publication/publication-artifact.json
-        .buildchain/publication/publication-artifact-passport.json
-        .buildchain/publication/source.tar.gz`;
-  }
-  return `dist
-        build/stage`;
-}
-
-function publicationWorkflowYaml() {
-  return `${nextDevelopmentWorkflowHeader()}# Commit both .buildchain/contract-lock.json and .buildchain/alpha-contract-lock.json.
-# Persist only @v4 or @v4-alpha; pass temporary train/SHA runtimes through workflow_dispatch.
-name: Build
-
-on:
-  workflow_dispatch:
-    inputs:
-      runtime-ref:
-        description: "Temporary Buildchain runtime ref for trusted manual validation"
-        required: false
-        default: ""
-  pull_request:
-  push:
-    branches:
-      - "dev/**"
-      - "alpha/**"
-      - "release/**"
-
-permissions:
-  contents: read
-  issues: write
-
-jobs:
-  publication:
-    uses: kungfu-systems/buildchain/.github/workflows/public-build-publication.yml@v4
-    with:
-      runtime-ref: \${{ inputs.runtime-ref || '' }}
-      toolchain-type: config
-      verify-command: make check
-      artifact-name: publication-artifact
-`;
-}
-
-function workflowYaml() {
-  return `${nextDevelopmentWorkflowHeader()}# Project build settings live only in .buildchain/buildchain.toml.
-# Commit .buildchain/contract-lock.json and .buildchain/alpha-contract-lock.json.
-# The called ref selects the runtime; architecture/platform-stage-checkpoints.json owns checkpoint projections.
-name: Build
-
-on:
-  workflow_dispatch:
-  pull_request:
-  push:
-    branches: ["dev/**", "alpha/**", "release/**"]
-
-permissions:
-  actions: read
-  contents: read
-  issues: write
-  id-token: write
-
-jobs:
-  build:
-    uses: ${BUILDCHAIN_WORKFLOW_REF}
-`;
-}
-
-function writeIfAllowed(filePath, content, { force }) {
-  if (fs.existsSync(filePath) && !force) {
-    throw new Error(`${posixPath(filePath)} already exists; pass --force to overwrite`);
+  consumerAgentInstructions,
+  planConsumerInitialization,
+} from "../consumer-init.js";
+import { PIPELINE_ENTRY } from "../../consumer/contract/entries.js";
+
+function assertWritable(cwd, relative, force) {
+  const parts = relative.split("/");
+  for (let index = 1; index <= parts.length; index++) {
+    const name = path.join(cwd, ...parts.slice(0, index));
+    const stat = fs.lstatSync(name, { throwIfNoEntry: false });
+    if (!stat) continue;
+    if (
+      stat.isSymbolicLink() ||
+      (index < parts.length ? !stat.isDirectory() : !stat.isFile())
+    )
+      throw new Error(
+        `${relative}: initialization requires regular files and directories`,
+      );
+    if (index === parts.length && !force)
+      throw new Error(`${relative} already exists; pass --force to overwrite`);
   }
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  fs.writeFileSync(filePath, content);
-  return filePath;
-}
-
-function writeManagedAgentEntry(filePath, current) {
-  const content = mergeNextDevelopmentAgentInstructions(current);
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  fs.writeFileSync(filePath, content);
-  return filePath;
 }
 
 export function initBuildchainRepo({
@@ -413,104 +34,75 @@ export function initBuildchainRepo({
   runnerPreset = "github-hosted",
   artifactName = "",
 } = {}) {
-  const resolvedCwd = path.resolve(cwd);
-  const manager = detectOrDefaultPackageManager(resolvedCwd, packageManager);
-  let toml = appendNextDevelopmentToml((() => {
-    if (type === "package") {
-      return packageToml(resolvedCwd, manager);
-    }
-    if (type === "native") {
-      return nativeToml(resolvedCwd);
-    }
-    if (type === "web-surface") {
-      return webSurfaceToml(resolvedCwd);
-    }
-    if (type === "infra-contract") {
-      return infraContractToml(resolvedCwd);
-    }
-    if (type === "publication-artifact") {
-      return publicationArtifactToml(resolvedCwd);
-    }
-    if (type === "anchored-package") {
-      return anchoredPackageToml(resolvedCwd, manager);
-    }
-    throw new Error("init --type must be one of package, native, web-surface, infra-contract, publication-artifact, or anchored-package");
-  })());
-
-
-  if (type !== "publication-artifact") {
-    const paths = workflowArtifactPaths(type).split("\n").map((entry) => entry.trim());
-    toml += `
-[build]
-environment = ${JSON.stringify(runnerPreset)}
-
-[build.artifacts]
-name = ${JSON.stringify(artifactName || repoName(resolvedCwd))}
-paths = ${JSON.stringify(paths)}
-`;
-  }
-
-  const agentsPath = path.join(resolvedCwd, "AGENTS.md");
-  const currentAgents = fs.existsSync(agentsPath)
-    ? fs.readFileSync(agentsPath, "utf8")
-    : "";
-
-  const written = [
-    writeIfAllowed(path.join(resolvedCwd, BUILDCHAIN_CONFIG_PATH), toml, { force }),
-    writeIfAllowed(
-      path.join(resolvedCwd, ".github", "workflows", "build.yml"),
-      type === "publication-artifact"
-        ? publicationWorkflowYaml()
-        : workflowYaml({
-            type,
-            runnerPreset,
-            artifactName,
-          }),
-      { force },
-    ),
-    writeManagedAgentEntry(agentsPath, currentAgents),
-  ];
-
-  if (type === "anchored-package" && !fs.existsSync(path.join(resolvedCwd, "release.json"))) {
-    written.push(writeIfAllowed(path.join(resolvedCwd, "release.json"), "{\n  \"upstream\": \"\",\n  \"version\": \"0.0.0\"\n}\n", { force }));
-  }
-
-  if (type === "infra-contract") {
-    written.push(
-      writeIfAllowed(path.join(resolvedCwd, "infra", "desired.json"), infraContractDesiredJson(resolvedCwd), { force }),
-      writeIfAllowed(path.join(resolvedCwd, "infra", "outputs.json"), infraContractOutputsJson(resolvedCwd), { force }),
+  const resolvedCwd = fs.realpathSync(cwd);
+  if (runnerPreset !== "github-hosted")
+    throw new Error(
+      "schema-2 init uses platform declarations; runner presets are internal runtime policy",
     );
+  const planned = planConsumerInitialization({
+    cwd: resolvedCwd,
+    type,
+    requestedManager: packageManager,
+    artifactName,
+  });
+  // Validate the entire write set first: a later conflict must not leave partial wiring.
+  for (const relative of Object.keys(planned.files))
+    assertWritable(resolvedCwd, relative, force);
+  const workflows = path.join(resolvedCwd, ".github/workflows");
+  if (fs.existsSync(workflows))
+    for (const file of fs.readdirSync(workflows))
+      if (
+        /\.ya?ml$/iu.test(file) &&
+        !Object.hasOwn(planned.files, `.github/workflows/${file}`)
+      )
+        throw new Error(
+          `Existing workflow ${file} is outside the generated consumer pair; migrate its product commands before initialization`,
+        );
+  assertWritable(resolvedCwd, "AGENTS.md", true);
+  const agents = path.join(resolvedCwd, "AGENTS.md");
+  planned.files["AGENTS.md"] = consumerAgentInstructions(
+    fs.existsSync(agents) ? fs.readFileSync(agents, "utf8") : "",
+  );
+  for (const [relative, bytes] of Object.entries(planned.files)) {
+    const file = path.join(resolvedCwd, relative);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, bytes);
   }
-
   return {
-    schemaVersion: 1,
+    schemaVersion: 2,
     type,
+    productType: planned.productType,
     cwd: resolvedCwd,
-    packageManager: manager,
-    workflowRef: BUILDCHAIN_WORKFLOW_REF,
-    written: written.map((filePath) => posixPath(path.relative(resolvedCwd, filePath))),
+    packageManager: planned.manager,
+    workflowRef: `kungfu-systems/buildchain/${PIPELINE_ENTRY}@v4`,
+    written: Object.keys(planned.files),
   };
 }
 
 function readArg(name, fallback = "") {
   const index = process.argv.indexOf(`--${name}`);
-  if (index === -1) {
-    return fallback;
-  }
-  return process.argv[index + 1] || "";
+  return index === -1 ? fallback : process.argv[index + 1] || "";
 }
-
-if (!process.env.BUILDCHAIN_EMBEDDED_ENTRYPOINT && process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (
+  !process.env.BUILDCHAIN_EMBEDDED_ENTRYPOINT &&
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
   try {
-    const result = initBuildchainRepo({
-      cwd: readArg("cwd", process.cwd()),
-      type: readArg("type", "package"),
-      force: process.argv.includes("--force"),
-      packageManager: readArg("package-manager", ""),
-      runnerPreset: readArg("runner-preset", "github-hosted"),
-      artifactName: readArg("artifact-name", ""),
-    });
-    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    console.log(
+      JSON.stringify(
+        initBuildchainRepo({
+          cwd: readArg("cwd", process.cwd()),
+          type: readArg("type", "package"),
+          force: process.argv.includes("--force"),
+          packageManager: readArg("package-manager"),
+          runnerPreset: readArg("runner-preset", "github-hosted"),
+          artifactName: readArg("artifact-name"),
+        }),
+        null,
+        2,
+      ),
+    );
   } catch (error) {
     console.error(`init-repo: ${error.message}`);
     process.exitCode = 1;