@kungfu-tech/buildchain 4.1.3-alpha.9 → 4.1.4-alpha.0

package/packages/core/paper/operations/bootstrap.js

@@ -1,75 +0,0 @@
-import { readNpmPackResult } from "../../publication/npm/pack-result.js";
-import path from "node:path";
-import fs from "node:fs";
-import { jsonText, extractUrls, safeParseJson, toPosix } from "./files.js";
-import {
-  NPM_REGISTRY,
-  DEFAULT_BOOTSTRAP_VERSION,
-  PAPER_NPM_BOOTSTRAP_CONTRACT,
-} from "./identity.js";
-import { executePaperNpmBootstrap as executePaperNpmBootstrapOperation } from "../paper-npm-bootstrap.js";
-import {
-  PAPER_PATHS,
-  commandResult,
-  normalizeRepository,
-  paperConfig,
-  resolvePaperRepository,
-} from "../paper-repository.js";
-import os from "node:os";
-import {
-  expectedPaperTrustedPublisher,
-  validatePaperProvisioningAuthority,
-} from "./provisioning-validation.js";
-import {
-  liveNpmAuthObservation,
-  liveNpmPackageObservation,
-  liveNpmTrustObservation,
-} from "./npm-observation.js";
-import { normalizePackageName } from "./runtime.js";
-export function writePaperReceipt(cwd, relativePath, value) {
-  const target = path.resolve(cwd, relativePath);
-  fs.mkdirSync(path.dirname(target), { recursive: true });
-  fs.writeFileSync(target, jsonText(value));
-  return relativePath;
-}
-export function bootstrapPackageShape({ packageName, version }) {
-  return {
-    name: packageName,
-    version,
-    private: false,
-    license: "Apache-2.0",
-    description: "Bootstrap package for npm Trusted Publishing setup.",
-    publishConfig: {
-      access: "public",
-      registry: NPM_REGISTRY,
-    },
-  };
-}
-export function executePaperNpmBootstrap(options = {}) {
-  return executePaperNpmBootstrapOperation(options, {
-    DEFAULT_BOOTSTRAP_VERSION,
-    NPM_REGISTRY,
-    PAPER_NPM_BOOTSTRAP_CONTRACT,
-    PAPER_PATHS,
-    bootstrapPackageShape,
-    commandResult,
-    expectedPaperTrustedPublisher,
-    extractUrls,
-    fs,
-    jsonText,
-    liveNpmAuthObservation,
-    liveNpmPackageObservation,
-    liveNpmTrustObservation,
-    normalizePackageName,
-    normalizeRepository,
-    os,
-    paperConfig,
-    path,
-    resolvePaperRepository,
-    safeParseJson,
-    readNpmPackResult,
-    toPosix,
-    validatePaperProvisioningAuthority,
-    writePaperReceipt,
-  });
-}

package/packages/core/paper/operations/plans.js

@@ -1,213 +0,0 @@
-import path from "node:path";
-import {
-  paperConfig,
-  gitValue,
-  PAPER_PATHS,
-  parsePaperVersion,
-  resolvePaperRepository,
-} from "../paper-repository.js";
-import {
-  PAPER_BUILD_PLAN_CONTRACT,
-  GIT_SHA_PATTERN,
-  PAPER_ALPHA_PLAN_CONTRACT,
-  PAPER_RESUME_PLAN_CONTRACT,
-} from "./identity.js";
-import { collectPaperStatus } from "./status.js";
-export function createPaperBuildPlan({
-  cwd = process.cwd(),
-  sourceSha = "",
-  pullToolchain = true,
-} = {}) {
-  const resolvedCwd = path.resolve(cwd);
-  const configResult = paperConfig(resolvedCwd);
-  if (configResult.error) throw new Error(configResult.error);
-  const resolvedSha = sourceSha || gitValue(resolvedCwd, ["rev-parse", "HEAD"]);
-  return {
-    schemaVersion: 1,
-    contract: PAPER_BUILD_PLAN_CONTRACT,
-    ok: GIT_SHA_PATTERN.test(resolvedSha),
-    cwd: resolvedCwd,
-    dryRun: true,
-    sourceSha: resolvedSha,
-    toolchain: configResult.loaded.config.publication.toolchain,
-    pullToolchain,
-    output: PAPER_PATHS.reproducibilityReceipt,
-    promotion: "first-byte-identical-clean-build",
-    delegatesTo: "buildchain publication-artifact reproducibility --promote",
-    nextActions: [
-      {
-        id: "execute-build",
-        command: "buildchain paper build --execute --json",
-        description:
-          "Run two independent clean builds and promote only byte-identical qualifying outputs.",
-      },
-    ],
-  };
-}
-export function resolvePaperChannelRef(cwd, ref) {
-  const candidates = [
-    {
-      observedRef: `refs/remotes/origin/${ref}`,
-      observation: "origin-tracking-ref",
-    },
-    {
-      observedRef: `refs/heads/${ref}`,
-      observation: "local-branch-ref",
-    },
-  ];
-  for (const candidate of candidates) {
-    const sha = gitValue(cwd, [
-      "rev-parse",
-      "--verify",
-      `${candidate.observedRef}^{commit}`,
-    ]);
-    if (GIT_SHA_PATTERN.test(sha)) {
-      return {
-        sha,
-        ...candidate,
-      };
-    }
-  }
-  return {
-    sha: "",
-    observedRef: "",
-    observation: "unresolved",
-  };
-}
-export function createPaperAlphaPlan({
-  cwd = process.cwd(),
-  sourceRef = "",
-  targetRef = "",
-} = {}) {
-  const resolvedCwd = path.resolve(cwd);
-  const configResult = paperConfig(resolvedCwd);
-  if (configResult.error) throw new Error(configResult.error);
-  const publication = configResult.loaded.config.publication;
-  const parsed = parsePaperVersion(publication.version);
-  const line = `v${parsed.major}.${parsed.minor}`;
-  const source = sourceRef || `dev/v${parsed.major}/${line}`;
-  const target = targetRef || `alpha/v${parsed.major}/${line}`;
-  const repository = resolvePaperRepository(resolvedCwd);
-  const sourceObservation = resolvePaperChannelRef(resolvedCwd, source);
-  const targetObservation = resolvePaperChannelRef(resolvedCwd, target);
-  const currentBranch = gitValue(resolvedCwd, ["branch", "--show-current"]);
-  return {
-    schemaVersion: 1,
-    contract: PAPER_ALPHA_PLAN_CONTRACT,
-    ok: Boolean(repository && source && target && source !== target),
-    cwd: resolvedCwd,
-    dryRun: true,
-    repository,
-    package: configResult.loaded.config.publish?.package || "",
-    publicationVersion: parsed.version,
-    channel: "alpha",
-    source: {
-      ref: source,
-      ...sourceObservation,
-    },
-    target: {
-      ref: target,
-      ...targetObservation,
-    },
-    currentBranch,
-    mutation: {
-      kind: "github-protected-channel-pr",
-      directPublish: false,
-      directMerge: false,
-      command: `gh pr create --repo ${repository || "<owner/repo>"} --base ${target} --head ${source}`,
-    },
-    gates: [
-      "source is the protected dev channel for the configured semver line",
-      "target is the protected alpha channel",
-      "the paper release workflow seals exact bytes and uses npm OIDC",
-      "this command opens a PR but never merges it or publishes directly",
-    ],
-    nextActions: [
-      {
-        id: "open-alpha-pr",
-        command: "buildchain paper alpha --execute --json",
-        description: "Open or reuse the protected dev-to-alpha publication PR.",
-      },
-    ],
-  };
-}
-export function createPaperResumePlan({
-  cwd = process.cwd(),
-  runtimeRef = "",
-} = {}) {
-  const resolvedCwd = path.resolve(cwd);
-  const status = collectPaperStatus({ cwd: resolvedCwd });
-  const transaction = status.transaction;
-  if (!transaction) {
-    return {
-      schemaVersion: 1,
-      contract: PAPER_RESUME_PLAN_CONTRACT,
-      ok: false,
-      cwd: resolvedCwd,
-      dryRun: true,
-      resumable: false,
-      reason: "no-release-transaction",
-      transaction: null,
-      nextActions: [
-        {
-          id: "start-alpha",
-          command: "buildchain paper alpha --json",
-          description:
-            "No transaction exists; plan the protected Alpha publication first.",
-        },
-      ],
-    };
-  }
-  if (
-    ["alpha-complete", "release-complete"].includes(
-      transaction.publicationState,
-    )
-  ) {
-    return {
-      schemaVersion: 1,
-      contract: PAPER_RESUME_PLAN_CONTRACT,
-      ok: true,
-      cwd: resolvedCwd,
-      dryRun: true,
-      resumable: false,
-      reason: "transaction-complete",
-      transaction,
-      nextActions: [],
-    };
-  }
-  const targetRef = transaction.targetRef;
-  const command = [
-    "gh workflow run .github/workflows/public-release-paper.yml",
-    targetRef ? `--ref ${targetRef}` : "",
-    runtimeRef ? `-f runtime-ref=${runtimeRef}` : "",
-  ]
-    .filter(Boolean)
-    .join(" ");
-  return {
-    schemaVersion: 1,
-    contract: PAPER_RESUME_PLAN_CONTRACT,
-    ok: Boolean(targetRef),
-    cwd: resolvedCwd,
-    dryRun: true,
-    resumable: Boolean(targetRef),
-    reason: targetRef
-      ? "rerun-sealed-paper-release"
-      : "transaction-target-ref-missing",
-    transaction,
-    mutation: {
-      kind: "github-workflow-dispatch",
-      directPublish: false,
-      command,
-    },
-    nextActions: targetRef
-      ? [
-          {
-            id: "dispatch-resume",
-            command: "buildchain paper resume --execute --json",
-            description:
-              "Dispatch the thin repository workflow against the exact transaction target ref.",
-          },
-        ]
-      : [],
-  };
-}

package/packages/core/paper/operations/provisioning.js

@@ -1,113 +0,0 @@
-import { PAPER_PATHS, sha256Text, stableJson } from "../paper-repository.js";
-import { PAPER_AGENT_ENTRY_CONTRACT } from "../paper-agent-entry.js";
-import path from "node:path";
-import {
-  PAPER_PROVISIONING_CONTRACT,
-  NPM_REGISTRY,
-  DEFAULT_BOOTSTRAP_VERSION,
-} from "./identity.js";
-export function paperProvisioningPolicy() {
-  return {
-    repositoryActions: {
-      defaultWorkflowPermissions: "read",
-      canApprovePullRequestReviews: false,
-    },
-    generatedWrites: {
-      preferredAuthority: "github-app",
-      compatibilityAuthority: "narrow-token",
-      githubTokenFallback: false,
-      permissions: ["checks:write", "contents:write", "pull-requests:write"],
-      tokenPersistence: "runtime-only",
-    },
-    release: {
-      protectedReviewRequired: true,
-      versionState: "not-required",
-      identityOnlyPullRequests: false,
-      manualVersionStateRepairPullRequests: false,
-    },
-    roles: {
-      actor: "repository-development-role",
-      pusher: "repository-development-role",
-      reviewer: "independent-review-role",
-      generatedWriteAuthority: "github-app-or-narrow-token",
-    },
-  };
-}
-export function createPaperProvisioningAuthority({
-  repository,
-  packageName,
-  buildchainVersion,
-  buildchainSha,
-  contractLock,
-  buildWorkflow,
-  verifyWorkflow,
-  releaseWorkflow,
-  agentEntry,
-  agentInstructions,
-  environment = "",
-}) {
-  const policy = paperProvisioningPolicy();
-  const payload = {
-    schemaVersion: 1,
-    contract: PAPER_PROVISIONING_CONTRACT,
-    repository,
-    package: {
-      name: packageName,
-      registry: NPM_REGISTRY,
-      bootstrapVersion: DEFAULT_BOOTSTRAP_VERSION,
-    },
-    runtime: {
-      repository: "kungfu-systems/buildchain",
-      version: buildchainVersion,
-      ref: buildchainSha,
-      resolvedSha: buildchainSha,
-    },
-    workflows: {
-      build: {
-        path: PAPER_PATHS.buildWorkflow,
-        sourceDigest: sha256Text(buildWorkflow),
-        reusablePath: ".github/workflows/public-build-publication.yml",
-        reusableRef: buildchainSha,
-      },
-      verify: {
-        path: PAPER_PATHS.verifyWorkflow,
-        sourceDigest: sha256Text(verifyWorkflow),
-        reusablePath: ".github/workflows/public-build-check.yml",
-        reusableRef: buildchainSha,
-      },
-      release: {
-        path: PAPER_PATHS.releaseWorkflow,
-        sourceDigest: sha256Text(releaseWorkflow),
-        reusablePath: ".github/workflows/public-release-paper.yml",
-        reusableRef: buildchainSha,
-      },
-    },
-    agentEntry: {
-      contract: PAPER_AGENT_ENTRY_CONTRACT,
-      policyPath: PAPER_PATHS.agentEntry,
-      policyDigest: sha256Text(agentEntry),
-      instructionsPath: PAPER_PATHS.agentInstructions,
-      instructionsDigest: sha256Text(agentInstructions),
-    },
-    admission: {
-      contractLockPath: PAPER_PATHS.contractLock,
-      contractLockDigest: sha256Text(contractLock),
-      acceptedRef: buildchainSha,
-      acceptedSha: buildchainSha,
-    },
-    trustedPublisher: {
-      type: "github",
-      repository,
-      workflow: path.posix.basename(PAPER_PATHS.releaseWorkflow),
-      environment,
-    },
-    policy: {
-      ...policy,
-      policyDigest: sha256Text(stableJson(policy)),
-    },
-  };
-  return {
-    ...payload,
-    authorityDigest: sha256Text(stableJson(payload)),
-  };
-}

package/packages/core/paper/operations/scaffold-config.js

@@ -1,77 +0,0 @@
-import { appendNextDevelopmentToml } from "../../release/next-development-projection.js";
-import {
-  DEFAULT_TOOLCHAIN_IMAGE,
-  DEFAULT_TOOLCHAIN_DIGEST,
-  DEFAULT_TOOLCHAIN_COMMAND,
-} from "./identity.js";
-export function tomlString(value) {
-  return JSON.stringify(String(value || ""));
-}
-export function joinUrl(base, suffix = "") {
-  const normalizedBase = String(base || "")
-    .trim()
-    .replace(/\/+$/, "");
-  const normalizedSuffix = String(suffix || "")
-    .trim()
-    .replace(/^\/+|\/+$/g, "");
-  if (!normalizedBase) return "";
-  return normalizedSuffix
-    ? `${normalizedBase}/${normalizedSuffix}/`
-    : `${normalizedBase}/`;
-}
-export function scaffoldConfig({
-  name,
-  title,
-  packageName,
-  version,
-  siteBaseUrl,
-}) {
-  const archiveId = name.replace(/^paper-/, "");
-  const canonicalUrl = joinUrl(siteBaseUrl, archiveId);
-  const archive = canonicalUrl
-    ? `
-[publication.archive]
-id = ${tomlString(archiveId)}
-canonical_url = ${tomlString(canonicalUrl)}
-latest_url = ${tomlString(joinUrl(canonicalUrl, "latest"))}
-latest_evidence_url = ${tomlString(`${joinUrl(canonicalUrl, "latest")}buildchain.release.json`)}
-immutable_base_url = ${tomlString(joinUrl(siteBaseUrl, "archive").replace(/\/$/, ""))}
-registry_path = ".buildchain/publication/publication-registry.json"
-`
-    : "";
-  return appendNextDevelopmentToml(`schema = 1
-
-[project]
-type = "publication-artifact"
-name = ${tomlString(name)}
-
-[publication]
-kind = "paper"
-title = ${tomlString(title)}
-version = ${tomlString(version)}
-primary_artifact = "_build/main.pdf"
-artifact_paths = ["_build/main.pdf"]
-metadata_paths = ["README.md", "docs/MAP.md"]
-source_paths = ["paper", "README.md", "LICENSE", "Makefile"]
-site_consumers = ${siteBaseUrl ? `[${tomlString(siteBaseUrl)}]` : "[]"}
-manifest_path = ".buildchain/publication/publication-artifact.json"
-source_bundle_path = ".buildchain/publication/source.tar.gz"
-${archive}
-[publication.toolchain]
-type = "latex-docker"
-image = "${DEFAULT_TOOLCHAIN_IMAGE}"
-digest = "${DEFAULT_TOOLCHAIN_DIGEST}"
-command = "${DEFAULT_TOOLCHAIN_COMMAND}"
-
-[publish]
-kind = "npm-paper-package"
-package = ${tomlString(packageName)}
-auth = "trusted-publishing"
-
-[lifecycle.build]
-command = "make pdf"
-
-[lifecycle.verify]
-command = "make check"
-`);
-}

package/packages/core/paper/operations/scaffold-workflows.js

@@ -1,116 +0,0 @@
-import { nextDevelopmentWorkflowHeader } from "../../release/next-development-projection.js";
-export function scaffoldBuildWorkflow(
-  entryRef,
-  { artifactName = "paper-publication" } = {},
-) {
-  return `${nextDevelopmentWorkflowHeader()}name: Build
-
-on:
-  workflow_dispatch:
-    inputs:
-      runtime-ref:
-        description: Transient execution runtime; empty selects the consumer lock.
-        required: false
-        default: ""
-  pull_request:
-  push:
-    branches:
-      - "dev/**"
-      - "alpha/**"
-      - "release/**"
-
-permissions:
-  contents: read
-  issues: write
-
-jobs:
-  publication:
-    uses: kungfu-systems/buildchain/.github/workflows/public-build-publication.yml@${entryRef}
-    with:
-      runtime-ref: \${{ inputs.runtime-ref || '' }}
-      contract-lock: .buildchain/contract-lock.json
-      toolchain-type: config
-      verify-command: make check
-      artifact-name: ${JSON.stringify(artifactName)}
-`;
-}
-export function scaffoldVerifyWorkflow(entryRef) {
-  return `${nextDevelopmentWorkflowHeader()}name: Verify
-
-on:
-  pull_request:
-  push:
-    branches:
-      - "dev/v*/v*"
-      - "alpha/v*/v*"
-      - "release/v*/v*"
-  workflow_dispatch:
-    inputs:
-      runtime-ref:
-        description: Transient execution runtime; empty selects the consumer lock.
-        required: false
-        default: ""
-
-permissions:
-  actions: read
-  contents: read
-  pull-requests: read
-
-jobs:
-  check:
-    uses: kungfu-systems/buildchain/.github/workflows/public-build-check.yml@${entryRef}
-    with:
-      runtime-ref: \${{ inputs.runtime-ref || '' }}
-      require-version-state: true
-      upload-artifacts: true
-`;
-}
-export function scaffoldReleaseWorkflow(
-  entryRef,
-  { artifactPaths = "_build/main.pdf", releasePassportProductName = "" } = {},
-) {
-  const passportInput = releasePassportProductName
-    ? `      release-passport-product-name: ${JSON.stringify(releasePassportProductName)}\n`
-    : "";
-  return `${nextDevelopmentWorkflowHeader()}name: Paper Release
-
-on:
-  workflow_dispatch:
-    inputs:
-      runtime-ref:
-        description: Transient execution runtime; empty selects the consumer lock.
-        required: false
-        default: ""
-  push:
-    branches:
-      - "alpha/**"
-      - "release/**"
-
-permissions:
-  contents: read
-
-jobs:
-  paper-release:
-    uses: kungfu-systems/buildchain/.github/workflows/public-release-paper.yml@${entryRef}
-    permissions:
-      actions: read
-      checks: write
-      contents: read
-      id-token: write
-      issues: write
-      pull-requests: write
-    with:
-      runtime-ref: \${{ inputs.runtime-ref || '' }}
-      contract-lock: .buildchain/contract-lock.json
-      publisher-workflow-path: .github/workflows/public-release-paper.yml
-      toolchain-type: config
-      verify-command: make check
-      artifact-paths: ${JSON.stringify(artifactPaths)}
-${passportInput}    secrets:
-      KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY: \${{ secrets.KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY }}
-      BUILDCHAIN_GENERATED_WRITE_APP_CLIENT_ID: \${{ secrets.BUILDCHAIN_GENERATED_WRITE_APP_CLIENT_ID }}
-      BUILDCHAIN_GENERATED_WRITE_APP_PRIVATE_KEY: \${{ secrets.BUILDCHAIN_GENERATED_WRITE_APP_PRIVATE_KEY }}
-      BUILDCHAIN_GENERATED_WRITE_TOKEN: \${{ secrets.BUILDCHAIN_GENERATED_WRITE_TOKEN }}
-      BUILDCHAIN_PROMOTION_TOKEN: \${{ secrets.BUILDCHAIN_PROMOTION_TOKEN }}
-`;
-}

package/packages/core/paper/operations/workspace.js

@@ -1,60 +0,0 @@
-import { BUILDCHAIN_PACKAGE_NAME } from "./identity.js";
-export function paperPnpmWorkspace(current, buildchainVersion) {
-  const entry = `${BUILDCHAIN_PACKAGE_NAME}@${buildchainVersion}`;
-  const source = String(current || "");
-  const lines = source ? source.replace(/\r\n/g, "\n").split("\n") : [];
-  if (lines.at(-1) === "") lines.pop();
-  const keyLines = lines
-    .map((line, index) =>
-      /^minimumReleaseAgeExclude:\s*(?:#.*)?$/.test(line) ? index : -1,
-    )
-    .filter((index) => index >= 0);
-  const unsupportedKey = lines.some(
-    (line) =>
-      /^minimumReleaseAgeExclude\s*:/.test(line) &&
-      !/^minimumReleaseAgeExclude:\s*(?:#.*)?$/.test(line),
-  );
-  if (unsupportedKey || keyLines.length > 1) {
-    throw new Error(
-      "paper migration requires minimumReleaseAgeExclude to be one top-level block sequence",
-    );
-  }
-  if (keyLines.length === 0) {
-    const prefix = lines.length > 0 ? [...lines, ""] : [];
-    return `${[...prefix, "minimumReleaseAgeExclude:", `  - '${entry}'`].join(
-      "\n",
-    )}\n`;
-  }
-  const keyIndex = keyLines[0];
-  let blockEnd = lines.length;
-  for (let index = keyIndex + 1; index < lines.length; index += 1) {
-    if (/^[^\s#]/.test(lines[index])) {
-      blockEnd = index;
-      break;
-    }
-  }
-  const retained = [];
-  for (const line of lines.slice(keyIndex + 1, blockEnd)) {
-    if (!line.trim() || /^\s*#/.test(line)) {
-      retained.push(line);
-      continue;
-    }
-    const item = line.match(/^\s*-\s+(.+?)\s*(?:#.*)?$/);
-    if (!item) {
-      throw new Error(
-        "paper migration requires minimumReleaseAgeExclude to contain scalar package entries",
-      );
-    }
-    const value = item[1]
-      .trim()
-      .replace(/^'(.*)'$/, "$1")
-      .replace(/^"(.*)"$/, "$1");
-    if (!value.startsWith(`${BUILDCHAIN_PACKAGE_NAME}@`)) retained.push(line);
-  }
-  return `${[
-    ...lines.slice(0, keyIndex + 1),
-    ...retained,
-    `  - '${entry}'`,
-    ...lines.slice(blockEnd),
-  ].join("\n")}\n`;
-}