@xemahq/biome-supply-chain 0.1.1 → 0.1.2

package/LICENSE

@@ -9,7 +9,7 @@ Parameters
 
 Licensor:  Neuralchowder Inc.
 
-Licensed Work:  Xema. The Licensed Work is (c) 2026 Neuralchowder Inc..
+Licensed Work:  Xema. The Licensed Work is (c) 2026 Neuralchowder Inc.
 
   The Licensed Work includes, without limitation, Xema Core, Xema Runtime,
   Xema Kernel, Xema control plane, Xema application runtime, Xema biome

package/README.md

@@ -4,7 +4,7 @@ This package belongs to Layer 1 — a framework-free runtime SDK utility.
 
 Shared cosign supply-chain verification for Xema biomes. It centralizes the two
 things that were previously copy-pasted between `biome-fetcher-api` (OCI bundle
-verification) and `@xemahq/biome-package` (the packaging CLI):
+verification) and `xema-store-api`:
 
 - the single cosign CLI invocation (`ensureCosignAvailable`,
   `verifyCosignSignature`, `verifyCosignAttestation`, `verifyCosignBlob`), and
@@ -49,3 +49,9 @@ if (outcome === CosignVerifyOutcome.Verified) {
 Artifact resolution (resolving an OCI ref, or fetching + writing a blob to a
 temp file) stays with each consumer; this package owns only the cosign exec and
 the verdict enums.
+
+## License
+
+Business Source License 1.1 (BSL-1.1) — source-available; converts to MPL-2.0
+four years after each release. © Xema — [xema.dev](https://xema.dev). See
+the [repository LICENSE](../../../LICENSE).

package/dist/lib/verdicts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verdicts.d.ts","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":"AAgBA,oBAAY,gBAAgB;IAC1B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB;AAGD,oBAAY,iBAAiB;IAC3B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,oBAAY,eAAe;IACzB,gBAAgB,4BAA4B;IAC5C,gBAAgB,4BAA4B;IAC5C,kBAAkB,yCAAyC;IAC3D,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;CAC/C;AAOD,oBAAY,mBAAmB;IAC7B,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAGD,eAAO,MAAM,8BAA8B,EACzC,gCAAyC,CAAC"}
+{"version":3,"file":"verdicts.d.ts","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":"AAqBA,oBAAY,gBAAgB;IAC1B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB;AAGD,oBAAY,iBAAiB;IAC3B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAGD,oBAAY,eAAe;IACzB,gBAAgB,4BAA4B;IAC5C,gBAAgB,4BAA4B;IAC5C,kBAAkB,yCAAyC;IAC3D,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;IAC9C,iBAAiB,6BAA6B;CAC/C;AAOD,oBAAY,mBAAmB;IAC7B,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAGD,eAAO,MAAM,8BAA8B,EACzC,gCAAyC,CAAC"}

package/dist/lib/verdicts.js.map

@@ -1 +1 @@
-{"version":3,"file":"verdicts.js","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":";;;AAgBA,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,mCAAe,CAAA;IACf,uCAAmB,CAAA;IACnB,yCAAqB,CAAA;AACvB,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAGD,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,oCAAe,CAAA;IACf,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;AACrB,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B;AAGD,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,+DAA4C,CAAA;IAC5C,+DAA4C,CAAA;IAC5C,8EAA2D,CAAA;IAC3D,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;AAChD,CAAC,EAPW,eAAe,+BAAf,eAAe,QAO1B;AAOD,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,4CAAqB,CAAA;IACrB,wCAAiB,CAAA;AACnB,CAAC,EAHW,mBAAmB,mCAAnB,mBAAmB,QAG9B;AAGY,QAAA,8BAA8B,GACzC,gCAAyC,CAAC"}
+{"version":3,"file":"verdicts.js","sourceRoot":"","sources":["../../src/lib/verdicts.ts"],"names":[],"mappings":";;;AAqBA,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,mCAAe,CAAA;IACf,uCAAmB,CAAA;IACnB,yCAAqB,CAAA;AACvB,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAGD,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,oCAAe,CAAA;IACf,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;AACrB,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B;AAGD,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,+DAA4C,CAAA;IAC5C,+DAA4C,CAAA;IAC5C,8EAA2D,CAAA;IAC3D,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;IAC9C,iEAA8C,CAAA;AAChD,CAAC,EAPW,eAAe,+BAAf,eAAe,QAO1B;AAOD,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,4CAAqB,CAAA;IACrB,wCAAiB,CAAA;AACnB,CAAC,EAHW,mBAAmB,mCAAnB,mBAAmB,QAG9B;AAGY,QAAA,8BAA8B,GACzC,gCAAyC,CAAC"}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@xemahq/biome-supply-chain",
-  "version": "0.1.1",
-  "description": "Shared cosign supply-chain verification for Xema biomes: the single cosign CLI exec + the signature/provenance verdict enums used by biome-fetcher-api (OCI bundles) and @xemahq/biome-package (packaging CLI). Node-builtins only.",
-  "license": "Apache-2.0",
+  "version": "0.1.2",
+  "description": "Shared cosign supply-chain verification for Xema biomes: the single cosign CLI exec + the signature/provenance verdict enums used by biome-fetcher-api (OCI bundle verification) and xema-store-api. Node-builtins only.",
+  "license": "LicenseRef-Xema-BSL-1.1",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
   "homepage": "https://xema.dev",
   "repository": {
@@ -33,10 +33,8 @@
     "src"
   ],
   "devDependencies": {
-    "@types/node": "^20.0.0",
-    "jest": "^29.0.0",
-    "ts-jest": "^29.0.0",
-    "typescript": "^5.0.0"
+    "@types/node": "25.2.3",
+    "typescript": "5.9.3"
   },
   "keywords": [
     "xema",
@@ -48,9 +46,9 @@
     "signature-verification"
   ],
   "scripts": {
-    "build": "tsc",
-    "type-check": "tsc --noEmit",
-    "lint": "tsc --noEmit",
-    "test": "jest --passWithNoTests"
+    "build": "tsc -p tsconfig.build.json",
+    "test": "tsc -p tsconfig.json && node --test \"dist-test/test/**/*.test.js\"",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "clean": "rm -rf dist dist-test"
   }
 }

package/src/lib/verdicts.ts

@@ -2,10 +2,15 @@
  * Shared cosign supply-chain verdict vocabulary.
  *
  * This is the single source of truth for the lowercase verdict/error enums
- * that `biome-fetcher-api` (OCI bundle verification) and `@xemahq/biome-package`
- * (the packaging CLI) previously duplicated locally. They are value-identical
- * to those former copies, so adopting this package is a pure de-duplication
- * with no wire/behaviour change.
+ * that `biome-fetcher-api` (OCI bundle verification) previously duplicated
+ * locally. They are value-identical to that former copy, so adopting this
+ * package is a pure de-duplication with no wire/behaviour change.
+ *
+ * (`@xemahq/biome-package` was a second consumer until 2026-08-01, when it was
+ * deleted: it emitted a 4-layer OCI artifact whose layers carry no
+ * `org.opencontainers.image.title`, so the fetcher's `oras pull` skipped every
+ * one of them and materialised nothing. `xema biome publish` is now the single
+ * biome packager.)
  *
  * NOTE: `xema-store-api` keeps its OWN UPPERCASE `SignatureVerdict` /
  * `ProvenanceVerdict` (persisted + OpenAPI + cross-service event wire); it