@xemahq/contracts 0.83.0 → 0.84.0

package/dist/store-package/index.d.ts

@@ -0,0 +1,3 @@
+export { StorePackageRefusalCode, StorePackageRefusalCodeSchema, type AdmittedStorePackage, type StorePackageRefusal, type StorePackageSigner, type StorePackageSignaturesVerdict, type StorePackageVerdict, } from './lib/store-package-verdict';
+export { gradeStorePackageSignerTrust, verifyStorePackageSignatures, type VerifyStorePackageSignaturesInput, } from './lib/store-package-signatures';
+//# sourceMappingURL=index.d.ts.map

package/dist/store-package/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/store-package/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,EAC5B,KAAK,iCAAiC,GACvC,MAAM,gCAAgC,CAAC"}

package/dist/store-package/index.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyStorePackageSignatures = exports.gradeStorePackageSignerTrust = exports.StorePackageRefusalCodeSchema = exports.StorePackageRefusalCode = void 0;
+var store_package_verdict_1 = require("./lib/store-package-verdict");
+Object.defineProperty(exports, "StorePackageRefusalCode", { enumerable: true, get: function () { return store_package_verdict_1.StorePackageRefusalCode; } });
+Object.defineProperty(exports, "StorePackageRefusalCodeSchema", { enumerable: true, get: function () { return store_package_verdict_1.StorePackageRefusalCodeSchema; } });
+var store_package_signatures_1 = require("./lib/store-package-signatures");
+Object.defineProperty(exports, "gradeStorePackageSignerTrust", { enumerable: true, get: function () { return store_package_signatures_1.gradeStorePackageSignerTrust; } });
+Object.defineProperty(exports, "verifyStorePackageSignatures", { enumerable: true, get: function () { return store_package_signatures_1.verifyStorePackageSignatures; } });
+//# sourceMappingURL=index.js.map

package/dist/store-package/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/store-package/index.ts"],"names":[],"mappings":";;;AAGA,qEAQqC;AAPnC,gIAAA,uBAAuB,OAAA;AACvB,sIAAA,6BAA6B,OAAA;AAO/B,2EAIwC;AAHtC,wIAAA,4BAA4B,OAAA;AAC5B,wIAAA,4BAA4B,OAAA"}

package/dist/store-package/lib/store-package-signatures.d.ts

@@ -0,0 +1,22 @@
+import { type ArtifactSignerTrust } from '../../deployment';
+import type { PackageImageLock } from '../../distribution';
+import { type OidcCertificateArtifactSigner, type PackageSignatureVerifier } from '../../distribution';
+import { refuse, type StorePackageSignaturesVerdict } from './store-package-verdict';
+type ExactStorePackagesSigner = OidcCertificateArtifactSigner & {
+    readonly identity: {
+        readonly exact: string;
+    };
+};
+export interface VerifyStorePackageSignaturesInput {
+    readonly lock: PackageImageLock;
+    readonly trust: ArtifactSignerTrust;
+    readonly readLayer: (path: string) => Uint8Array | undefined;
+    readonly verifier: PackageSignatureVerifier;
+}
+export declare function gradeStorePackageSignerTrust(trust: ArtifactSignerTrust): {
+    readonly ok: true;
+    readonly signers: readonly ExactStorePackagesSigner[];
+} | ReturnType<typeof refuse>;
+export declare function verifyStorePackageSignatures(input: VerifyStorePackageSignaturesInput): Promise<StorePackageSignaturesVerdict>;
+export {};
+//# sourceMappingURL=store-package-signatures.d.ts.map

package/dist/store-package/lib/store-package-signatures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-package-signatures.d.ts","sourceRoot":"","sources":["../../../src/store-package/lib/store-package-signatures.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,mBAAmB,EACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAEL,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,MAAM,EACN,KAAK,6BAA6B,EACnC,MAAM,yBAAyB,CAAC;AAgBjC,KAAK,wBAAwB,GAAG,6BAA6B,GAAG;IAC9D,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C,CAAC;AAEF,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAEhC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC;CAC7C;AAuBD,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,mBAAmB,GAExB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAA;CAAE,GAC5E,UAAU,CAAC,OAAO,MAAM,CAAC,CAe5B;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,6BAA6B,CAAC,CAsBxC"}

package/dist/store-package/lib/store-package-signatures.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gradeStorePackageSignerTrust = gradeStorePackageSignerTrust;
+exports.verifyStorePackageSignatures = verifyStorePackageSignatures;
+const deployment_1 = require("../../deployment");
+const distribution_1 = require("../../distribution");
+const store_package_verdict_1 = require("./store-package-verdict");
+function invalidStoreSignerReason(signer) {
+    if (signer.kind !== deployment_1.SignerKind.OidcCertificate) {
+        return `a ${deployment_1.ArtifactSignerScope.StorePackages} signer must be an ${deployment_1.SignerKind.OidcCertificate} signer; public key ${signer.publicKey.sha256} cannot identify a publisher`;
+    }
+    if (!('exact' in signer.identity)) {
+        return `the ${deployment_1.ArtifactSignerScope.StorePackages} signer via ${signer.oidcIssuer} matches identity by regexp, and a store package signer must be one exact identity`;
+    }
+    const exact = signer.identity.exact;
+    if (!deployment_1.StorePublisherIdentitySchema.safeParse(exact).success) {
+        return `the ${deployment_1.ArtifactSignerScope.StorePackages} signer identity ${exact} is not an accepted store publisher identity (a pull-request ref or a malformed subject)`;
+    }
+    return undefined;
+}
+function gradeStorePackageSignerTrust(trust) {
+    const declared = (0, deployment_1.trustedSignersFor)(trust, deployment_1.ArtifactSignerScope.StorePackages);
+    if (declared.length === 0) {
+        return (0, store_package_verdict_1.refuse)(store_package_verdict_1.StorePackageRefusalCode.SignerTrustEmpty, `the deployment declares no ${deployment_1.ArtifactSignerScope.StorePackages} signer, so it admits no store package`);
+    }
+    for (const signer of declared) {
+        const invalid = invalidStoreSignerReason(signer);
+        if (invalid !== undefined) {
+            return (0, store_package_verdict_1.refuse)(store_package_verdict_1.StorePackageRefusalCode.SignerTrustInvalid, invalid);
+        }
+    }
+    return { ok: true, signers: declared };
+}
+async function verifyStorePackageSignatures(input) {
+    const graded = gradeStorePackageSignerTrust(input.trust);
+    if (!graded.ok)
+        return graded;
+    const { lock, readLayer, verifier } = input;
+    for (const signer of graded.signers) {
+        const verdict = await (0, distribution_1.verifyPackageImageSignatures)({ lock, trust: [signer], readLayer, verifier });
+        if (verdict.ok) {
+            return { ok: true, signer: { oidcIssuer: signer.oidcIssuer, identity: signer.identity.exact } };
+        }
+    }
+    const combined = await (0, distribution_1.verifyPackageImageSignatures)({ lock, trust: input.trust, readLayer, verifier });
+    if (combined.ok) {
+        return (0, store_package_verdict_1.refuse)(store_package_verdict_1.StorePackageRefusalCode.ImageSignerNotLockSigner, `the lock and the images of ${lock.biomeId}@${lock.version} each verify against a trusted ${deployment_1.ArtifactSignerScope.StorePackages} signer, but not against one and the same signer`);
+    }
+    return (0, store_package_verdict_1.refuse)(store_package_verdict_1.StorePackageRefusalCode.ImageSignerUntrusted, combined.reason, combined.componentKey);
+}
+//# sourceMappingURL=store-package-signatures.js.map

package/dist/store-package/lib/store-package-signatures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-package-signatures.js","sourceRoot":"","sources":["../../../src/store-package/lib/store-package-signatures.ts"],"names":[],"mappings":";;AAmEA,oEAmBC;AAED,oEAwBC;AAhHD,iDAO0B;AAE1B,qDAI4B;AAC5B,mEAIiC;AA6BjC,SAAS,wBAAwB,CAAC,MAAsB;IACtD,IAAI,MAAM,CAAC,IAAI,KAAK,uBAAU,CAAC,eAAe,EAAE,CAAC;QAC/C,OAAO,KAAK,gCAAmB,CAAC,aAAa,sBAAsB,uBAAU,CAAC,eAAe,uBAAuB,MAAM,CAAC,SAAS,CAAC,MAAM,8BAA8B,CAAC;IAC5K,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,OAAO,gCAAmB,CAAC,aAAa,eAAe,MAAM,CAAC,UAAU,oFAAoF,CAAC;IACtK,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;IACpC,IAAI,CAAC,yCAA4B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3D,OAAO,OAAO,gCAAmB,CAAC,aAAa,oBAAoB,KAAK,0FAA0F,CAAC;IACrK,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAQD,SAAgB,4BAA4B,CAC1C,KAA0B;IAI1B,MAAM,QAAQ,GAAG,IAAA,8BAAiB,EAAC,KAAK,EAAE,gCAAmB,CAAC,aAAa,CAAC,CAAC;IAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAA,8BAAM,EACX,+CAAuB,CAAC,gBAAgB,EACxC,8BAA8B,gCAAmB,CAAC,aAAa,wCAAwC,CACxG,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,IAAA,8BAAM,EAAC,+CAAuB,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAA+C,EAAE,CAAC;AAChF,CAAC;AAEM,KAAK,UAAU,4BAA4B,CAChD,KAAwC;IAExC,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,IAAA,2CAA4B,EAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnG,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QAClG,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAA,2CAA4B,EAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvG,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,IAAA,8BAAM,EACX,+CAAuB,CAAC,wBAAwB,EAChD,8BAA8B,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,kCAAkC,gCAAmB,CAAC,aAAa,kDAAkD,CAChL,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,8BAAM,EACX,+CAAuB,CAAC,oBAAoB,EAC5C,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,YAAY,CACtB,CAAC;AACJ,CAAC"}

package/dist/store-package/lib/store-package-verdict.d.ts

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+import type { PackageImageLock } from '../../distribution';
+export declare enum StorePackageRefusalCode {
+    LockMissing = "package-image-lock-missing",
+    LockUnexpected = "package-image-lock-unexpected",
+    LockInvalid = "package-image-lock-invalid",
+    LockMismatch = "package-image-lock-mismatch",
+    LockIncomplete = "package-image-lock-incomplete",
+    SignerTrustEmpty = "store-signer-trust-empty",
+    SignerTrustInvalid = "store-signer-trust-invalid",
+    ClusterFactsMissing = "cluster-facts-missing",
+    ImagePlatformMissing = "image-platform-missing",
+    ImageSignerUntrusted = "image-signer-untrusted",
+    ImageSignerNotLockSigner = "image-signer-not-lock-signer"
+}
+export declare const StorePackageRefusalCodeSchema: z.ZodEnum<typeof StorePackageRefusalCode>;
+declare const admittedStorePackageBrand: unique symbol;
+export interface StorePackageSigner {
+    readonly oidcIssuer: string;
+    readonly identity: string;
+}
+export type AdmittedStorePackage = {
+    readonly lock: PackageImageLock;
+    readonly imageLockDigest: string;
+    readonly signer: StorePackageSigner;
+} & {
+    readonly [admittedStorePackageBrand]: true;
+};
+export type StorePackageRefusal = {
+    readonly ok: false;
+    readonly code: StorePackageRefusalCode;
+    readonly reason: string;
+    readonly componentKey?: string | undefined;
+};
+export type StorePackageSignaturesVerdict = {
+    readonly ok: true;
+    readonly signer: StorePackageSigner;
+} | StorePackageRefusal;
+export type StorePackageVerdict = {
+    readonly ok: true;
+    readonly admitted: AdmittedStorePackage | null;
+} | StorePackageRefusal;
+export declare function refuse(code: StorePackageRefusalCode, reason: string, componentKey?: string): StorePackageRefusal;
+export declare function brandAdmitted(value: {
+    readonly lock: PackageImageLock;
+    readonly imageLockDigest: string;
+    readonly signer: StorePackageSigner;
+}): AdmittedStorePackage;
+export {};
+//# sourceMappingURL=store-package-verdict.d.ts.map

package/dist/store-package/lib/store-package-verdict.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-package-verdict.d.ts","sourceRoot":"","sources":["../../../src/store-package/lib/store-package-verdict.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAO3D,oBAAY,uBAAuB;IAEjC,WAAW,+BAA+B;IAE1C,cAAc,kCAAkC;IAEhD,WAAW,+BAA+B;IAE1C,YAAY,gCAAgC;IAE5C,cAAc,kCAAkC;IAEhD,gBAAgB,6BAA6B;IAE7C,kBAAkB,+BAA+B;IAEjD,mBAAmB,0BAA0B;IAE7C,oBAAoB,2BAA2B;IAE/C,oBAAoB,2BAA2B;IAE/C,wBAAwB,iCAAiC;CAC1D;AAED,eAAO,MAAM,6BAA6B,2CAAwC,CAAC;AAEnF,OAAO,CAAC,MAAM,yBAAyB,EAAE,OAAO,MAAM,CAAC;AAGvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAQD,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;CACrC,GAAG;IAAE,QAAQ,CAAC,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAEnD,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,6BAA6B,GACrC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAC1D,mBAAmB,CAAC;AAExB,MAAM,MAAM,mBAAmB,GAC3B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAElB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;CAChD,GACD,mBAAmB,CAAC;AAExB,wBAAgB,MAAM,CACpB,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,GACpB,mBAAmB,CAErB;AAGD,wBAAgB,aAAa,CAAC,KAAK,EAAE;IACnC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;CACrC,GAAG,oBAAoB,CAEvB"}

package/dist/store-package/lib/store-package-verdict.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StorePackageRefusalCodeSchema = exports.StorePackageRefusalCode = void 0;
+exports.refuse = refuse;
+exports.brandAdmitted = brandAdmitted;
+const zod_1 = require("zod");
+var StorePackageRefusalCode;
+(function (StorePackageRefusalCode) {
+    StorePackageRefusalCode["LockMissing"] = "package-image-lock-missing";
+    StorePackageRefusalCode["LockUnexpected"] = "package-image-lock-unexpected";
+    StorePackageRefusalCode["LockInvalid"] = "package-image-lock-invalid";
+    StorePackageRefusalCode["LockMismatch"] = "package-image-lock-mismatch";
+    StorePackageRefusalCode["LockIncomplete"] = "package-image-lock-incomplete";
+    StorePackageRefusalCode["SignerTrustEmpty"] = "store-signer-trust-empty";
+    StorePackageRefusalCode["SignerTrustInvalid"] = "store-signer-trust-invalid";
+    StorePackageRefusalCode["ClusterFactsMissing"] = "cluster-facts-missing";
+    StorePackageRefusalCode["ImagePlatformMissing"] = "image-platform-missing";
+    StorePackageRefusalCode["ImageSignerUntrusted"] = "image-signer-untrusted";
+    StorePackageRefusalCode["ImageSignerNotLockSigner"] = "image-signer-not-lock-signer";
+})(StorePackageRefusalCode || (exports.StorePackageRefusalCode = StorePackageRefusalCode = {}));
+exports.StorePackageRefusalCodeSchema = zod_1.z.nativeEnum(StorePackageRefusalCode);
+function refuse(code, reason, componentKey) {
+    return { ok: false, code, reason, componentKey };
+}
+function brandAdmitted(value) {
+    return value;
+}
+//# sourceMappingURL=store-package-verdict.js.map

package/dist/store-package/lib/store-package-verdict.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-package-verdict.js","sourceRoot":"","sources":["../../../src/store-package/lib/store-package-verdict.ts"],"names":[],"mappings":";;;AA6EA,wBAMC;AAGD,sCAMC;AA5FD,6BAAwB;AASxB,IAAY,uBAuBX;AAvBD,WAAY,uBAAuB;IAEjC,qEAA0C,CAAA;IAE1C,2EAAgD,CAAA;IAEhD,qEAA0C,CAAA;IAE1C,uEAA4C,CAAA;IAE5C,2EAAgD,CAAA;IAEhD,wEAA6C,CAAA;IAE7C,4EAAiD,CAAA;IAEjD,wEAA6C,CAAA;IAE7C,0EAA+C,CAAA;IAE/C,0EAA+C,CAAA;IAE/C,oFAAyD,CAAA;AAC3D,CAAC,EAvBW,uBAAuB,uCAAvB,uBAAuB,QAuBlC;AAEY,QAAA,6BAA6B,GAAG,OAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;AA2CnF,SAAgB,MAAM,CACpB,IAA6B,EAC7B,MAAc,EACd,YAAqB;IAErB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACnD,CAAC;AAGD,SAAgB,aAAa,CAAC,KAI7B;IACC,OAAO,KAA6B,CAAC;AACvC,CAAC"}

package/dist/store-package/server/index.d.ts

@@ -0,0 +1,17 @@
+import type { ArtifactSignerTrust, OciPlatform } from '../../deployment';
+import type { BiomeManifest } from '../../biome';
+import { type PackageImageLockEntry } from '../../distribution';
+import { type PackageSignatureVerifier } from '../../distribution';
+import { type StorePackageVerdict } from '../lib/store-package-verdict';
+export interface VerifyStorePackageInput {
+    readonly manifest: BiomeManifest;
+    readonly bundleLockRaw: unknown | undefined;
+    readonly sealedLockDigest: string | undefined;
+    readonly namedEntries: readonly PackageImageLockEntry[] | undefined;
+    readonly trust: ArtifactSignerTrust;
+    readonly nodePlatforms: readonly OciPlatform[] | undefined;
+    readonly readLayer: (path: string) => Uint8Array | undefined;
+    readonly verifier: PackageSignatureVerifier;
+}
+export declare function verifyStorePackage(input: VerifyStorePackageInput): Promise<StorePackageVerdict>;
+//# sourceMappingURL=index.d.ts.map

package/dist/store-package/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/store-package/server/index.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAKL,KAAK,qBAAqB,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,oBAAoB,CAAC;AAM5B,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IAEjC,QAAQ,CAAC,aAAa,EAAE,OAAO,GAAG,SAAS,CAAC;IAE5C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9C,QAAQ,CAAC,YAAY,EAAE,SAAS,qBAAqB,EAAE,GAAG,SAAS,CAAC;IAEpE,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IAEpC,QAAQ,CAAC,aAAa,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC;CAC7C;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAqF9B"}

package/dist/store-package/server/index.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyStorePackage = verifyStorePackage;
+const content_address_1 = require("../../content-address");
+const distribution_1 = require("../../distribution");
+const distribution_2 = require("../../distribution");
+const server_1 = require("../../distribution/server");
+const store_package_signatures_1 = require("../lib/store-package-signatures");
+const store_package_verdict_1 = require("../lib/store-package-verdict");
+async function verifyStorePackage(input) {
+    const { manifest, bundleLockRaw, sealedLockDigest, namedEntries } = input;
+    const biome = `${manifest.xema.id}@${manifest.version}`;
+    const buildsImages = (0, distribution_1.requiredPackageImages)(manifest).length > 0;
+    if (!buildsImages) {
+        if (bundleLockRaw !== undefined || sealedLockDigest !== undefined || namedEntries !== undefined) {
+            return (0, store_package_verdict_1.refuse)(store_package_verdict_1.StorePackageRefusalCode.LockUnexpected, `${biome} builds no image, yet an image lock was sent or named for it`);
+        }
+        return { ok: true, admitted: null };
+    }
+    if (bundleLockRaw === undefined || sealedLockDigest === undefined) {
+        return (0, store_package_verdict_1.refuse)(store_package_verdict_1.StorePackageRefusalCode.LockMissing, bundleLockRaw === undefined
+            ? `${biome} builds images and its bundle carries no image lock`
+            : `${biome} builds images and the install names no sealed image lock digest`);
+    }
+    const parsed = distribution_1.PackageImageLockSchema.safeParse(bundleLockRaw);
+    if (!parsed.success) {
+        return (0, store_package_verdict_1.refuse)(store_package_verdict_1.StorePackageRefusalCode.LockInvalid, `the image lock of ${biome} is invalid: ${parsed.error.issues.map((issue) => issue.message).join('; ')}`);
+    }
+    const lock = parsed.data;
+    const imageLockDigest = (0, server_1.packageImageLockDigest)(lock);
+    if (imageLockDigest !== sealedLockDigest) {
+        return (0, store_package_verdict_1.refuse)(store_package_verdict_1.StorePackageRefusalCode.LockMismatch, `the image lock of ${biome} digests to ${imageLockDigest}, not the sealed ${sealedLockDigest}`);
+    }
+    if (namedEntries !== undefined &&
+        (0, content_address_1.canonicalJsonStringify)(namedEntries) !== (0, content_address_1.canonicalJsonStringify)(lock.entries)) {
+        return (0, store_package_verdict_1.refuse)(store_package_verdict_1.StorePackageRefusalCode.LockMismatch, `the image lock entries of ${biome} differ from the entries the install names`);
+    }
+    const grade = (0, distribution_1.gradePackageImageLock)(manifest, lock);
+    if (!grade.ok) {
+        return (0, store_package_verdict_1.refuse)(grade.code === distribution_1.PackageImageRefusalCode.LockMismatch
+            ? store_package_verdict_1.StorePackageRefusalCode.LockMismatch
+            : store_package_verdict_1.StorePackageRefusalCode.LockIncomplete, grade.reason);
+    }
+    const trust = (0, store_package_signatures_1.gradeStorePackageSignerTrust)(input.trust);
+    if (!trust.ok)
+        return trust;
+    const platforms = (0, distribution_2.gradePackageImagePlatforms)(lock, input.nodePlatforms);
+    if (!platforms.ok) {
+        return (0, store_package_verdict_1.refuse)(input.nodePlatforms === undefined
+            ? store_package_verdict_1.StorePackageRefusalCode.ClusterFactsMissing
+            : store_package_verdict_1.StorePackageRefusalCode.ImagePlatformMissing, platforms.reason, platforms.componentKey);
+    }
+    const signatures = await (0, store_package_signatures_1.verifyStorePackageSignatures)({
+        lock,
+        trust: input.trust,
+        readLayer: input.readLayer,
+        verifier: input.verifier,
+    });
+    if (!signatures.ok)
+        return signatures;
+    return {
+        ok: true,
+        admitted: (0, store_package_verdict_1.brandAdmitted)({ lock, imageLockDigest, signer: signatures.signer }),
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/store-package/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/store-package/server/index.ts"],"names":[],"mappings":";;AAuDA,gDAuFC;AA/HD,2DAA+D;AAC/D,qDAM4B;AAC5B,qDAG4B;AAC5B,sDAAmE;AACnE,8EAGyC;AACzC,wEAKsC;AAkB/B,KAAK,UAAU,kBAAkB,CACtC,KAA8B;IAE9B,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC1E,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;IACxD,MAAM,YAAY,GAAG,IAAA,oCAAqB,EAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,IAAI,aAAa,KAAK,SAAS,IAAI,gBAAgB,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAChG,OAAO,IAAA,8BAAM,EACX,+CAAuB,CAAC,cAAc,EACtC,GAAG,KAAK,8DAA8D,CACvE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,aAAa,KAAK,SAAS,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO,IAAA,8BAAM,EACX,+CAAuB,CAAC,WAAW,EACnC,aAAa,KAAK,SAAS;YACzB,CAAC,CAAC,GAAG,KAAK,qDAAqD;YAC/D,CAAC,CAAC,GAAG,KAAK,kEAAkE,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,qCAAsB,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,IAAA,8BAAM,EACX,+CAAuB,CAAC,WAAW,EACnC,qBAAqB,KAAK,gBAAgB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,MAAM,eAAe,GAAG,IAAA,+BAAsB,EAAC,IAAI,CAAC,CAAC;IACrD,IAAI,eAAe,KAAK,gBAAgB,EAAE,CAAC;QACzC,OAAO,IAAA,8BAAM,EACX,+CAAuB,CAAC,YAAY,EACpC,qBAAqB,KAAK,eAAe,eAAe,oBAAoB,gBAAgB,EAAE,CAC/F,CAAC;IACJ,CAAC;IACD,IACE,YAAY,KAAK,SAAS;QAC1B,IAAA,wCAAsB,EAAC,YAAqB,CAAC,KAAK,IAAA,wCAAsB,EAAC,IAAI,CAAC,OAAgB,CAAC,EAC/F,CAAC;QACD,OAAO,IAAA,8BAAM,EACX,+CAAuB,CAAC,YAAY,EACpC,6BAA6B,KAAK,4CAA4C,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,oCAAqB,EAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,IAAA,8BAAM,EACX,KAAK,CAAC,IAAI,KAAK,sCAAuB,CAAC,YAAY;YACjD,CAAC,CAAC,+CAAuB,CAAC,YAAY;YACtC,CAAC,CAAC,+CAAuB,CAAC,cAAc,EAC1C,KAAK,CAAC,MAAM,CACb,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,uDAA4B,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAE5B,MAAM,SAAS,GAAG,IAAA,yCAA0B,EAAC,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IACxE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,IAAA,8BAAM,EACX,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,+CAAuB,CAAC,mBAAmB;YAC7C,CAAC,CAAC,+CAAuB,CAAC,oBAAoB,EAChD,SAAS,CAAC,MAAM,EAChB,SAAS,CAAC,YAAY,CACvB,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,IAAA,uDAA4B,EAAC;QACpD,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC;IAEtC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,IAAA,qCAAa,EAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/contracts",
-  "version": "0.83.0",
+  "version": "0.84.0",
   "description": "Consolidated Xema kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework deps; the one runtime dependency beside zod is the OpenFGA syntax transformer the authorization-module composer runs.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -37,6 +37,16 @@
     "./edition-protocol/edition-protocol.json": "./dist/edition-protocol/edition-protocol.json",
     "./edition-protocol/edition-contract.schema.json": "./dist/edition-protocol/edition-contract.schema.json",
     "./conformance/*.vectors.json": "./dist/conformance/*.vectors.json",
+    "./store-package": {
+      "types": "./dist/store-package/index.d.ts",
+      "xema-source": "./src/store-package/index.ts",
+      "default": "./dist/store-package/index.js"
+    },
+    "./store-package/server": {
+      "types": "./dist/store-package/server/index.d.ts",
+      "xema-source": "./src/store-package/server/index.ts",
+      "default": "./dist/store-package/server/index.js"
+    },
     "./*": {
       "types": "./dist/*/index.d.ts",
       "xema-source": "./src/*/index.ts",
@@ -58,6 +68,6 @@
     "test:authorization-models": "node scripts/run-authorization-model-tests.mjs"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:a2d893862e89f6f7be52f42fb55146285295dff07421247e2e3bbd501af80517"
+    "sourceDigest": "sha256:60dbdb033c85aecbf9dee30ad95b8400795b434d1d72c654d1c229e1b3ba896c"
   }
 }