@xemahq/biome-supply-chain 0.1.0 → 0.1.2

package/LICENSE

@@ -9,7 +9,7 @@ Parameters
 
 Licensor:  Neuralchowder Inc.
 
-Licensed Work:  Xema. The Licensed Work is (c) 2026 Neuralchowder Inc..
+Licensed Work:  Xema. The Licensed Work is (c) 2026 Neuralchowder Inc.
 
   The Licensed Work includes, without limitation, Xema Core, Xema Runtime,
   Xema Kernel, Xema control plane, Xema application runtime, Xema biome

package/README.md

@@ -4,7 +4,7 @@ This package belongs to Layer 1 — a framework-free runtime SDK utility.
 
 Shared cosign supply-chain verification for Xema biomes. It centralizes the two
 things that were previously copy-pasted between `biome-fetcher-api` (OCI bundle
-verification) and `@xemahq/biome-package` (the packaging CLI):
+verification) and `xema-store-api`:
 
 - the single cosign CLI invocation (`ensureCosignAvailable`,
   `verifyCosignSignature`, `verifyCosignAttestation`, `verifyCosignBlob`), and
@@ -49,3 +49,9 @@ if (outcome === CosignVerifyOutcome.Verified) {
 Artifact resolution (resolving an OCI ref, or fetching + writing a blob to a
 temp file) stays with each consumer; this package owns only the cosign exec and
 the verdict enums.
+
+## License
+
+Business Source License 1.1 (BSL-1.1) — source-available; converts to MPL-2.0
+four years after each release. © Xema — [xema.dev](https://xema.dev). See
+the [repository LICENSE](../../../LICENSE).

package/dist/lib/cosign-exec.d.ts

@@ -3,30 +3,30 @@ export declare function ensureCosignAvailable(bin?: string): Promise<void>;
 export interface VerifyCosignSignatureInput {
     readonly ociRef: string;
     readonly trustedIdentities: readonly string[];
-    readonly oidcIssuer?: string;
-    readonly keyPath?: string;
-    readonly bin?: string;
+    readonly oidcIssuer?: string | undefined;
+    readonly keyPath?: string | undefined;
+    readonly bin?: string | undefined;
 }
 export declare function verifyCosignSignature(input: VerifyCosignSignatureInput): Promise<void>;
 export interface VerifyCosignAttestationInput {
     readonly ociRef: string;
     readonly predicateType: string;
     readonly trustedIdentities: readonly string[];
-    readonly oidcIssuer?: string;
-    readonly keyPath?: string;
-    readonly bin?: string;
+    readonly oidcIssuer?: string | undefined;
+    readonly keyPath?: string | undefined;
+    readonly bin?: string | undefined;
 }
 export declare function verifyCosignAttestation(input: VerifyCosignAttestationInput): Promise<void>;
 export interface VerifyCosignBlobInput {
     readonly artifactPath: string;
     readonly bundlePath: string;
     readonly trustedIdentityRegexps: readonly string[];
-    readonly oidcIssuer?: string;
-    readonly bin?: string;
+    readonly oidcIssuer?: string | undefined;
+    readonly bin?: string | undefined;
 }
 export interface VerifyCosignBlobResult {
     readonly outcome: CosignVerifyOutcome;
-    readonly matchedIdentity?: string;
+    readonly matchedIdentity?: string | undefined;
 }
 export declare function verifyCosignBlob(input: VerifyCosignBlobInput): Promise<VerifyCosignBlobResult>;
 //# sourceMappingURL=cosign-exec.d.ts.map

package/dist/lib/cosign-exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cosign-exec.d.ts","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAoCjD,wBAAsB,qBAAqB,CACzC,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAOD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAEtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AASD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CAuBjC"}
+{"version":3,"file":"cosign-exec.d.ts","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAoCjD,wBAAsB,qBAAqB,CACzC,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAOD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAMD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAEtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C;AASD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CAuBjC"}

package/dist/lib/verdicts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verdicts.d.ts","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":"AAgBA,oBAAY,gBAAgB;IAC1B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB;AAGD,oBAAY,iBAAiB;IAC3B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,oBAAY,eAAe;IACzB,gBAAgB,4BAA4B;IAC5C,gBAAgB,4BAA4B;IAC5C,kBAAkB,yCAAyC;IAC3D,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;CAC/C;AAOD,oBAAY,mBAAmB;IAC7B,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAGD,eAAO,MAAM,8BAA8B,EACzC,gCAAyC,CAAC"}
+{"version":3,"file":"verdicts.d.ts","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":"AAqBA,oBAAY,gBAAgB;IAC1B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB;AAGD,oBAAY,iBAAiB;IAC3B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,oBAAY,eAAe;IACzB,gBAAgB,4BAA4B;IAC5C,gBAAgB,4BAA4B;IAC5C,kBAAkB,yCAAyC;IAC3D,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;CAC/C;AAOD,oBAAY,mBAAmB;IAC7B,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAGD,eAAO,MAAM,8BAA8B,EACzC,gCAAyC,CAAC"}

package/dist/lib/verdicts.js.map

@@ -1 +1 @@
-{"version":3,"file":"verdicts.js","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":";;;AAgBA,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,mCAAe,CAAA;IACf,uCAAmB,CAAA;IACnB,yCAAqB,CAAA;AACvB,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAGD,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,oCAAe,CAAA;IACf,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;AACrB,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B;AAGD,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,+DAA4C,CAAA;IAC5C,+DAA4C,CAAA;IAC5C,8EAA2D,CAAA;IAC3D,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;AAChD,CAAC,EAPW,eAAe,+BAAf,eAAe,QAO1B;AAOD,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,4CAAqB,CAAA;IACrB,wCAAiB,CAAA;AACnB,CAAC,EAHW,mBAAmB,mCAAnB,mBAAmB,QAG9B;AAGY,QAAA,8BAA8B,GACzC,gCAAyC,CAAC"}
+{"version":3,"file":"verdicts.js","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":";;;AAqBA,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,mCAAe,CAAA;IACf,uCAAmB,CAAA;IACnB,yCAAqB,CAAA;AACvB,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAGD,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,oCAAe,CAAA;IACf,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;AACrB,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B;AAGD,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,+DAA4C,CAAA;IAC5C,+DAA4C,CAAA;IAC5C,8EAA2D,CAAA;IAC3D,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;AAChD,CAAC,EAPW,eAAe,+BAAf,eAAe,QAO1B;AAOD,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,4CAAqB,CAAA;IACrB,wCAAiB,CAAA;AACnB,CAAC,EAHW,mBAAmB,mCAAnB,mBAAmB,QAG9B;AAGY,QAAA,8BAA8B,GACzC,gCAAyC,CAAC"}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@xemahq/biome-supply-chain",
-  "version": "0.1.0",
-  "description": "Shared cosign supply-chain verification for Xema biomes: the single cosign CLI exec + the signature/provenance verdict enums used by biome-fetcher-api (OCI bundles) and @xemahq/biome-package (packaging CLI). Node-builtins only.",
-  "license": "Apache-2.0",
+  "version": "0.1.2",
+  "description": "Shared cosign supply-chain verification for Xema biomes: the single cosign CLI exec + the signature/provenance verdict enums used by biome-fetcher-api (OCI bundle verification) and xema-store-api. Node-builtins only.",
+  "license": "LicenseRef-Xema-BSL-1.1",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
   "homepage": "https://xema.dev",
   "repository": {
@@ -33,10 +33,8 @@
     "src"
   ],
   "devDependencies": {
-    "@types/node": "^20.0.0",
-    "jest": "^29.0.0",
-    "ts-jest": "^29.0.0",
-    "typescript": "^5.0.0"
+    "@types/node": "25.2.3",
+    "typescript": "5.9.3"
   },
   "keywords": [
     "xema",
@@ -48,9 +46,9 @@
     "signature-verification"
   ],
   "scripts": {
-    "build": "tsc",
-    "type-check": "tsc --noEmit",
-    "lint": "tsc --noEmit",
-    "test": "jest --passWithNoTests"
+    "build": "tsc -p tsconfig.build.json",
+    "test": "tsc -p tsconfig.json && node --test \"dist-test/test/**/*.test.js\"",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "clean": "rm -rf dist dist-test"
   }
 }

package/src/lib/cosign-exec.ts

@@ -56,10 +56,10 @@ export interface VerifyCosignSignatureInput {
   readonly ociRef: string;
   /** Exact keyless certificate-identity URIs (any one may match). */
   readonly trustedIdentities: readonly string[];
-  readonly oidcIssuer?: string;
+  readonly oidcIssuer?: string | undefined;
   /** Keyed verification: path to the public key (mutually exclusive w/ keyless). */
-  readonly keyPath?: string;
-  readonly bin?: string;
+  readonly keyPath?: string | undefined;
+  readonly bin?: string | undefined;
 }
 
 /**
@@ -98,9 +98,9 @@ export interface VerifyCosignAttestationInput {
   readonly ociRef: string;
   readonly predicateType: string;
   readonly trustedIdentities: readonly string[];
-  readonly oidcIssuer?: string;
-  readonly keyPath?: string;
-  readonly bin?: string;
+  readonly oidcIssuer?: string | undefined;
+  readonly keyPath?: string | undefined;
+  readonly bin?: string | undefined;
 }
 
 /**
@@ -143,14 +143,14 @@ export interface VerifyCosignBlobInput {
   readonly bundlePath: string;
   /** Keyless certificate-identity REGEXPS (any one may match). */
   readonly trustedIdentityRegexps: readonly string[];
-  readonly oidcIssuer?: string;
-  readonly bin?: string;
+  readonly oidcIssuer?: string | undefined;
+  readonly bin?: string | undefined;
 }
 
 export interface VerifyCosignBlobResult {
   readonly outcome: CosignVerifyOutcome;
   /** The identity regexp that matched, when Verified. */
-  readonly matchedIdentity?: string;
+  readonly matchedIdentity?: string | undefined;
 }
 
 /**

package/src/lib/verdicts.ts

@@ -2,10 +2,15 @@
  * Shared cosign supply-chain verdict vocabulary.
  *
  * This is the single source of truth for the lowercase verdict/error enums
- * that `biome-fetcher-api` (OCI bundle verification) and `@xemahq/biome-package`
- * (the packaging CLI) previously duplicated locally. They are value-identical
- * to those former copies, so adopting this package is a pure de-duplication
- * with no wire/behaviour change.
+ * that `biome-fetcher-api` (OCI bundle verification) previously duplicated
+ * locally. They are value-identical to that former copy, so adopting this
+ * package is a pure de-duplication with no wire/behaviour change.
+ *
+ * (`@xemahq/biome-package` was a second consumer until 2026-08-01, when it was
+ * deleted: it emitted a 4-layer OCI artifact whose layers carry no
+ * `org.opencontainers.image.title`, so the fetcher's `oras pull` skipped every
+ * one of them and materialised nothing. `xema biome publish` is now the single
+ * biome packager.)
  *
  * NOTE: `xema-store-api` keeps its OWN UPPERCASE `SignatureVerdict` /
  * `ProvenanceVerdict` (persisted + OpenAPI + cross-service event wire); it