release-skill 0.4.2 → 0.5.1

package/src/artifacts/entry.mjs

@@ -16,6 +16,7 @@ import { join } from 'node:path';
 import { promisify } from 'node:util';
 import { execFile } from 'node:child_process';
 import { canonicalJson, sha256Hex } from '../core/digest.mjs';
+import { digestDocument } from 'skill-family-contracts';
 import { ReleaseError, PATH_UNSAFE } from '../core/errors.mjs';
 
 const execFileAsync = promisify(execFile);
@@ -151,10 +152,12 @@ async function enumerateTreeEntries(root, dirPath, relBase) {
  * @returns {string} `sha256:<hex>` digest.
  */
 export function digestEntryManifest(entries) {
+  // 纯 JSON 投影（path/type/mode/size/sha256 定字段），直接委托 Foundation
+  // digestDocument（= sha256(contracts canonicalJson)，与迁移前字节一致）。
   const canonical = entries.map(({ path, type, mode, sha256, size }) => ({
     path, type, mode, size, sha256,
   }));
-  return `sha256:${sha256Hex(canonicalJson(canonical))}`;
+  return `sha256:${digestDocument(canonical)}`;
 }
 
 // ---------------------------------------------------------------------------

package/src/artifacts/producer-registry.mjs

@@ -14,10 +14,10 @@ import { readFile, readdir, stat, mkdir, writeFile, rm } from 'node:fs/promises'
 import { join } from 'node:path';
 import { mkdtemp } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { createHash } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 
 import { canonicalJson, sha256Hex } from '../core/digest.mjs';
+import { digestBytes } from 'skill-family-harness-node';
 import {
   ReleaseError,
   ARTIFACT_POLICY_INVALID,
@@ -155,11 +155,14 @@ export async function createBuiltInProducerRegistry() {
  * @returns {string}
  */
 export function computeImplDigest(sourceBytes) {
-  const h = createHash('sha256');
-  for (const buf of sourceBytes) h.update(buf);
-  h.update(`node:${process.version}`);
-  h.update('locale:en-US timezone:UTC');
-  return `sha256:${h.digest('hex')}`;
+  // 多段哈希（源字节 + node 版本 + 固定 locale/timezone）等价于对拼接字节
+  // 的 sha256，委托 Foundation digestBytes 实现，字节逐位一致。
+  const bytes = Buffer.concat([
+    ...sourceBytes,
+    Buffer.from(`node:${process.version}`),
+    Buffer.from('locale:en-US timezone:UTC'),
+  ]);
+  return `sha256:${digestBytes(bytes)}`;
 }
 
 // ---------------------------------------------------------------------------