@xemahq/edition-tooling 0.0.0-stage → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (219) hide show
  1. package/LICENSE +175 -0
  2. package/dist/cli.d.ts +7 -0
  3. package/dist/cli.d.ts.map +1 -0
  4. package/dist/cli.js +47 -0
  5. package/dist/cli.js.map +1 -0
  6. package/dist/commands/edition.d.ts +4 -0
  7. package/dist/commands/edition.d.ts.map +1 -0
  8. package/dist/commands/edition.js +58 -0
  9. package/dist/commands/edition.js.map +1 -0
  10. package/dist/edition/verify-image-evidence.bundle.mjs +72104 -0
  11. package/dist/edition/verify-image-evidence.bundle.provenance.json +4119 -0
  12. package/dist/lib/exit-codes.d.ts +6 -0
  13. package/dist/lib/exit-codes.d.ts.map +1 -0
  14. package/dist/lib/exit-codes.js +21 -0
  15. package/dist/lib/exit-codes.js.map +1 -0
  16. package/dist/runtime/edition/run-entry.d.ts +10 -0
  17. package/dist/runtime/edition/run-entry.d.ts.map +1 -0
  18. package/dist/runtime/edition/run-entry.js +49 -0
  19. package/dist/runtime/edition/run-entry.js.map +1 -0
  20. package/dist/runtime/edition/verb-map.d.ts +70 -0
  21. package/dist/runtime/edition/verb-map.d.ts.map +1 -0
  22. package/dist/runtime/edition/verb-map.js +166 -0
  23. package/dist/runtime/edition/verb-map.js.map +1 -0
  24. package/edition/README.md +291 -0
  25. package/edition/adapter-bundled-versions.mjs +128 -0
  26. package/edition/adapter-host-versions.mjs +76 -0
  27. package/edition/assemble-producer-input.mjs +1423 -0
  28. package/edition/assemble-third-party-input.mjs +348 -0
  29. package/edition/authored-source-check.mjs +141 -0
  30. package/edition/authority-binding.mjs +23 -0
  31. package/edition/authorization-base.mjs +357 -0
  32. package/edition/biome-content.mjs +327 -0
  33. package/edition/build-biome-index.mjs +180 -0
  34. package/edition/build-ledger-completeness.mjs +67 -0
  35. package/edition/build-ledger.mjs +107 -0
  36. package/edition/build-platform-service-index.mjs +292 -0
  37. package/edition/build-runtime-image-source-index.mjs +1197 -0
  38. package/edition/built-verifier.mjs +55 -0
  39. package/edition/candidate-edition.mjs +735 -0
  40. package/edition/canonical-evidence-json.mjs +82 -0
  41. package/edition/canonical-repository-url.mjs +61 -0
  42. package/edition/catalogue-edition.mjs +49 -0
  43. package/edition/catalogue-evidence.mjs +228 -0
  44. package/edition/catalogue-fetch.mjs +124 -0
  45. package/edition/catalogue-lock-field.mjs +41 -0
  46. package/edition/catalogue-pin.mjs +71 -0
  47. package/edition/catalogue.mjs +237 -0
  48. package/edition/chart-set-source-commit.mjs +97 -0
  49. package/edition/check-committed-image-evidence.mjs +412 -0
  50. package/edition/checkout-indexed-source-repositories.mjs +283 -0
  51. package/edition/collected-refusals.mjs +59 -0
  52. package/edition/comment-blanker.mjs +75 -0
  53. package/edition/connector-source-authority.mjs +60 -0
  54. package/edition/contract-authority.mjs +122 -0
  55. package/edition/cosign-certificate-constraints.mjs +50 -0
  56. package/edition/cross-repo-build-inputs.mjs +158 -0
  57. package/edition/customer-definition.mjs +72 -0
  58. package/edition/customer-edition-verbs.mjs +610 -0
  59. package/edition/customer-flags.mjs +15 -0
  60. package/edition/definition-checkout.mjs +96 -0
  61. package/edition/develop-build-record.mjs +122 -0
  62. package/edition/develop-catalogue-free-resolve.mjs +282 -0
  63. package/edition/develop-catalogue-free-vendor.mjs +118 -0
  64. package/edition/develop-channel-evidence.mjs +23 -0
  65. package/edition/develop-channel-record.mjs +49 -0
  66. package/edition/develop-channel-satellites.mjs +65 -0
  67. package/edition/develop-chart-roster.mjs +96 -0
  68. package/edition/develop-chart-set.mjs +147 -0
  69. package/edition/develop-current-resolution.mjs +29 -0
  70. package/edition/develop-edition-invariants.mjs +142 -0
  71. package/edition/develop-edition-resolve.mjs +250 -0
  72. package/edition/develop-edition.mjs +332 -0
  73. package/edition/develop-engine-image.mjs +97 -0
  74. package/edition/develop-freeze.mjs +304 -0
  75. package/edition/develop-git-bundles.mjs +296 -0
  76. package/edition/develop-graph.mjs +34 -0
  77. package/edition/develop-image-coordinate.mjs +85 -0
  78. package/edition/develop-image-probe.mjs +122 -0
  79. package/edition/develop-image-record.mjs +260 -0
  80. package/edition/develop-resolve-report.mjs +159 -0
  81. package/edition/develop-select-records.mjs +90 -0
  82. package/edition/develop-selection-line.mjs +29 -0
  83. package/edition/develop-selection-pins.mjs +36 -0
  84. package/edition/develop-snapshot-inputs.mjs +112 -0
  85. package/edition/develop-store-root.mjs +20 -0
  86. package/edition/dispatched-runtime-components.mjs +172 -0
  87. package/edition/dist-check.mjs +1174 -0
  88. package/edition/distribution-evidence-set.mjs +1064 -0
  89. package/edition/distribution-paths.mjs +191 -0
  90. package/edition/edition-artifact.mjs +529 -0
  91. package/edition/edition-biome-manifests.mjs +85 -0
  92. package/edition/edition-ceiling.mjs +182 -0
  93. package/edition/edition-channel.mjs +27 -0
  94. package/edition/edition-chart-set.mjs +104 -0
  95. package/edition/edition-config.mjs +374 -0
  96. package/edition/edition-constants.mjs +110 -0
  97. package/edition/edition-contract-parse.mjs +179 -0
  98. package/edition/edition-contract.json +100 -0
  99. package/edition/edition-image-seal.mjs +115 -0
  100. package/edition/edition-kind.mjs +10 -0
  101. package/edition/edition-list.mjs +35 -0
  102. package/edition/edition-locks.mjs +78 -0
  103. package/edition/edition-pin-verbs.mjs +183 -0
  104. package/edition/edition-pin.mjs +17 -0
  105. package/edition/edition-pinned-inputs.mjs +116 -0
  106. package/edition/edition-protocol.mjs +285 -0
  107. package/edition/edition-publisher.mjs +21 -0
  108. package/edition/edition-seal.mjs +257 -0
  109. package/edition/edition-source-pins.mjs +211 -0
  110. package/edition/edition-unpin.mjs +16 -0
  111. package/edition/edition-workspace.mjs +205 -0
  112. package/edition/evidence-checkout.mjs +439 -0
  113. package/edition/evidence-grammars.mjs +18 -0
  114. package/edition/evidence-input-mode.mjs +136 -0
  115. package/edition/evidence-trust-pin.mjs +392 -0
  116. package/edition/evidence-trust-policy.mjs +374 -0
  117. package/edition/external-source-walk.mjs +486 -0
  118. package/edition/first-party-source-ids.mjs +62 -0
  119. package/edition/fleet-coordinate-finality.mjs +363 -0
  120. package/edition/fulcio-certificate-extensions.mjs +278 -0
  121. package/edition/git-json.mjs +54 -0
  122. package/edition/git-source-auth.mjs +131 -0
  123. package/edition/image-delivery-entitlement-descriptor.mjs +106 -0
  124. package/edition/image-evidence-replay-state.mjs +242 -0
  125. package/edition/image-evidence.mjs +1328 -0
  126. package/edition/image-lock-service-rows.mjs +26 -0
  127. package/edition/image-subject-identity.mjs +19 -0
  128. package/edition/images-from-record.mjs +216 -0
  129. package/edition/indexes-at-pins.mjs +13 -0
  130. package/edition/infra-images-lock.mjs +105 -0
  131. package/edition/kernel-capability-domain.mjs +30 -0
  132. package/edition/kernel-contract-authority.mjs +526 -0
  133. package/edition/kernel-contract-source-path-set.mjs +96 -0
  134. package/edition/kernel-package.mjs +237 -0
  135. package/edition/kernel-pin-source.mjs +63 -0
  136. package/edition/kernel-protocol-choice.mjs +239 -0
  137. package/edition/kernel-signer-kind.mjs +23 -0
  138. package/edition/lib.mjs +3322 -0
  139. package/edition/locked-bundle-signer.mjs +297 -0
  140. package/edition/map-with-concurrency.mjs +19 -0
  141. package/edition/no-follow-file.mjs +94 -0
  142. package/edition/oci-evidence-verbs.mjs +421 -0
  143. package/edition/oci-image-source-evidence.mjs +377 -0
  144. package/edition/operation-grant-admission.mjs +285 -0
  145. package/edition/operation-requirements.mjs +282 -0
  146. package/edition/oras-process.mjs +35 -0
  147. package/edition/oras.mjs +664 -0
  148. package/edition/pin-source.mjs +242 -0
  149. package/edition/pinned-cosign.mjs +86 -0
  150. package/edition/plan-image-evidence-refresh.mjs +428 -0
  151. package/edition/platform-lock-readability.mjs +903 -0
  152. package/edition/platform-service-class.mjs +85 -0
  153. package/edition/platform-service-ownership.mjs +91 -0
  154. package/edition/platform-service-source-authority.mjs +105 -0
  155. package/edition/positive-closure.mjs +162 -0
  156. package/edition/previous-image-lock.mjs +25 -0
  157. package/edition/produce-distribution-completeness-evidence.mjs +317 -0
  158. package/edition/produce-edition-catalogue-evidence.mjs +252 -0
  159. package/edition/produce-image-delivery-entitlement-evidence.mjs +302 -0
  160. package/edition/produce-image-source-evidence.mjs +788 -0
  161. package/edition/producer-evidence-bundle.mjs +201 -0
  162. package/edition/producer-evidence-index-file.mjs +4 -0
  163. package/edition/record-refused.mjs +11 -0
  164. package/edition/registry-client-factory.mjs +21 -0
  165. package/edition/registry-credentials.mjs +225 -0
  166. package/edition/release-catalogue.mjs +48 -0
  167. package/edition/release-channel-guard.mjs +108 -0
  168. package/edition/release-edition-artifact.mjs +152 -0
  169. package/edition/release-edition.mjs +54 -0
  170. package/edition/remedy-command.mjs +89 -0
  171. package/edition/repin-evidence-trust.mjs +109 -0
  172. package/edition/required-resource-provider.mjs +58 -0
  173. package/edition/resolve-chart-set.mjs +376 -0
  174. package/edition/resolve-customer-edition.mjs +374 -0
  175. package/edition/resolve-distribution.mjs +2642 -0
  176. package/edition/resolve-edition.mjs +192 -0
  177. package/edition/resolve-images.mjs +2344 -0
  178. package/edition/resolve-infra-images.mjs +88 -0
  179. package/edition/seal-image-digests.mjs +954 -0
  180. package/edition/sealed-distribution-lock.mjs +22 -0
  181. package/edition/sealed-evidence-accept.mjs +82 -0
  182. package/edition/shallow-checkout.mjs +18 -0
  183. package/edition/sigstore-bundle-media-type.mjs +4 -0
  184. package/edition/source-authority.mjs +713 -0
  185. package/edition/source-closure.mjs +115 -0
  186. package/edition/store-publisher-trust.mjs +40 -0
  187. package/edition/strict-json.mjs +121 -0
  188. package/edition/string-order.mjs +5 -0
  189. package/edition/third-party-admission.mjs +118 -0
  190. package/edition/third-party-bundle-registry.mjs +349 -0
  191. package/edition/third-party-certificate-extensions.mjs +58 -0
  192. package/edition/third-party-image-pins.mjs +41 -0
  193. package/edition/third-party-pins-trusted.mjs +24 -0
  194. package/edition/third-party-producer-evidence.mjs +76 -0
  195. package/edition/third-party-source-check.mjs +28 -0
  196. package/edition/third-party-source-context.mjs +41 -0
  197. package/edition/third-party-source-evidence.mjs +326 -0
  198. package/edition/third-party-source-flags.mjs +148 -0
  199. package/edition/third-party-source-pins.mjs +270 -0
  200. package/edition/third-party-source-uniqueness.mjs +54 -0
  201. package/edition/third-party-source-walk.mjs +118 -0
  202. package/edition/third-party-source-writer.mjs +228 -0
  203. package/edition/third-party-subjects.mjs +128 -0
  204. package/edition/trust-policy-arming-verb.mjs +60 -0
  205. package/edition/trust-policy-arming.mjs +144 -0
  206. package/edition/trust-policy-image-ownership.mjs +85 -0
  207. package/edition/trusted-executable.mjs +166 -0
  208. package/edition/verifier-binding.mjs +45 -0
  209. package/edition/verifier-digest-pin.mjs +17 -0
  210. package/edition/verifier-files.mjs +8 -0
  211. package/edition/verifier-kernel-schemas.mjs +22 -0
  212. package/edition/verifier-provenance.mjs +64 -0
  213. package/edition/verify-catalogue-evidence.mjs +247 -0
  214. package/edition/verify-image-evidence.mjs +493 -0
  215. package/edition/verify-image-platforms.mjs +523 -0
  216. package/edition/why.mjs +56 -0
  217. package/edition/workspace-sections.mjs +287 -0
  218. package/package.json +83 -4
  219. package/README.md +0 -3
package/LICENSE ADDED
@@ -0,0 +1,175 @@
1
+ Xema Business Source License 1.1
2
+
3
+ License text copyright (c) 2020 MariaDB Corporation Ab, All Rights Reserved.
4
+ "Business Source License" is a trademark of MariaDB Corporation Ab.
5
+
6
+ -----------------------------------------------------------------------------
7
+
8
+ Parameters
9
+
10
+ Licensor: Neuralchowder Inc.
11
+
12
+ Licensed Work: Xema. The Licensed Work is (c) 2026 Neuralchowder Inc.
13
+
14
+ The Licensed Work includes, without limitation, Xema Core, Xema Runtime,
15
+ Xema Kernel, Xema control plane, Xema application runtime, Xema biome
16
+ runtime, Xema biome registry, Xema store services, Xema orchestration
17
+ services, Xema agents, Xema skills, Xema memory services, Xema APIs, Xema
18
+ user interfaces, Xema command-line tools, Xema deployment artifacts, Xema
19
+ templates, Xema specifications, Xema schemas, Xema manifests, Xema
20
+ documentation, Xema examples, and all source code, object code, binaries,
21
+ packages, modules, configuration files, manifests, schemas, examples,
22
+ templates, documentation, and derivative works included in or distributed
23
+ as part of the Xema software project.
24
+
25
+ The Licensed Work does not include any third-party software, libraries,
26
+ dependencies, packages, assets, or components that are distributed with the
27
+ Licensed Work but are governed by their own separate license terms. Such
28
+ third-party materials remain subject to their respective licenses.
29
+
30
+ A specific file, package, component, or directory may state that it is
31
+ governed by a different license. In that case, that specific file, package,
32
+ component, or directory is governed by the license expressly stated therein.
33
+
34
+ Additional Use Grant:
35
+
36
+ You may make production use of the Licensed Work, provided that your use
37
+ does not include offering, providing, making available, distributing,
38
+ hosting, managing, embedding, reselling, white-labeling, sublicensing,
39
+ commercializing, or otherwise making the Licensed Work, or any modified
40
+ version or derivative work of the Licensed Work, available to Third Parties
41
+ as part of a Competitive Offering.
42
+
43
+ The following definitions and clarifications form part of, and govern
44
+ the interpretation of, the Additional Use Grant set out above.
45
+
46
+ 1. "Production Use" means any use of the Licensed Work other than for
47
+ development, testing, evaluation, demonstration, experimentation,
48
+ benchmarking, or other non-production purposes.
49
+
50
+ 2. "Affiliate" means any entity that, directly or indirectly,
51
+ controls, is controlled by, or is under common control with you,
52
+ where "control" means ownership of more than fifty percent (50%) of
53
+ the voting interests of the entity, or the power to direct its
54
+ management.
55
+
56
+ 3. "Third Party" means any natural person or legal entity other than
57
+ you and your Affiliates.
58
+
59
+ 4. "Competitive Offering" means any product or service, made available
60
+ to one or more Third Parties for a fee or other consideration
61
+ (including without limitation on a paid, subscription,
62
+ advertising-supported, hosted, or managed-service basis), that is
63
+ offered or marketed as, or that competes with, a software platform,
64
+ runtime, orchestration system, agent or automation system,
65
+ extension or distribution marketplace, or other software system
66
+ that provides, in substantial part, the same or substantially
67
+ similar capabilities as those provided by the Licensed Work. A
68
+ product or service is a Competitive Offering whether the Licensed
69
+ Work is provided in whole or in part, alone or bundled with other
70
+ software, and whether modified or unmodified.
71
+
72
+ 5. Providing, hosting, or managing the Licensed Work for a Third Party,
73
+ or otherwise making the Licensed Work available to a Third Party as
74
+ a hosted or managed service such that the Third Party obtains the
75
+ principal value or functionality of the Licensed Work, is a
76
+ Competitive Offering and is not permitted by the Additional Use
77
+ Grant.
78
+
79
+ 6. Subject to the foregoing, the Additional Use Grant permits you to
80
+ make Production Use of the Licensed Work for your own internal
81
+ business purposes and to build, operate, and provide your own
82
+ products and services to Third Parties, provided that the Licensed
83
+ Work itself (whether modified or unmodified) is not the product or
84
+ service, and is not a Competitive Offering, made available to those
85
+ Third Parties.
86
+
87
+ 7. You may modify the Licensed Work and create derivative works for
88
+ any purpose permitted by this License. Any Production Use of such
89
+ modified or derivative works remains subject to the same
90
+ restrictions as the Licensed Work, including the prohibition on
91
+ Competitive Offerings.
92
+
93
+ 8. Use of the Licensed Work by your own employees, contractors, and
94
+ agents, acting on your behalf and for your benefit, is not by
95
+ itself making the Licensed Work available to a Third Party.
96
+
97
+ 9. Embedding or distributing the Licensed Work as a component of your
98
+ own product or service is permitted only where the Licensed Work
99
+ does not constitute the principal value of that product or service
100
+ and the product or service is not a Competitive Offering.
101
+
102
+ 10. Nothing in this Additional Use Grant grants any right to use any
103
+ name, trademark, service mark, or logo of the Licensor or its
104
+ Affiliates, except as reasonably required for customary
105
+ attribution.
106
+
107
+ 11. The rights stated in this Additional Use Grant are the maximum
108
+ rights granted for Production Use prior to the Change Date. Any
109
+ Production Use not expressly permitted requires a separate
110
+ commercial license from the Licensor.
111
+
112
+ 12. If any provision of this Additional Use Grant is held invalid or
113
+ unenforceable, that provision shall be limited or eliminated to
114
+ the minimum extent necessary so that the remainder of this
115
+ Additional Use Grant, and of this License, remains in full force
116
+ and effect. The Licensor reserves all rights not expressly granted
117
+ by this License.
118
+
119
+
120
+ Change Date: Four years from the date the specific version of the Licensed
121
+ Work is first publicly released by Licensor.
122
+
123
+ Change License: Mozilla Public License, Version 2.0
124
+
125
+ For information about alternative licensing arrangements, commercial
126
+ licensing, enterprise licensing, OEM licensing, appliance licensing, managed
127
+ service licensing, cloud provider licensing, or other commercial use of the
128
+ Licensed Work, please contact: licensing@neuralchowder.com
129
+
130
+ -----------------------------------------------------------------------------
131
+
132
+ Notice
133
+
134
+ Business Source License 1.1
135
+
136
+ Terms
137
+
138
+ The Licensor hereby grants you the right to copy, modify, create derivative
139
+ works, redistribute, and make non-production use of the Licensed Work. The
140
+ Licensor may make an Additional Use Grant, above, permitting limited
141
+ production use.
142
+
143
+ Effective on the Change Date, or the fourth anniversary of the first publicly
144
+ available distribution of a specific version of the Licensed Work under this
145
+ License, whichever comes first, the Licensor hereby grants you rights under
146
+ the terms of the Change License, and the rights granted in the paragraph above
147
+ terminate.
148
+
149
+ If your use of the Licensed Work does not comply with the requirements
150
+ currently in effect as described in this License, you must purchase a
151
+ commercial license from the Licensor, its affiliated entities, or authorized
152
+ resellers, or you must refrain from using the Licensed Work.
153
+
154
+ All copies of the original and modified Licensed Work, and derivative works of
155
+ the Licensed Work, are subject to this License. This License applies separately
156
+ for each version of the Licensed Work and the Change Date may vary for each
157
+ version of the Licensed Work released by Licensor.
158
+
159
+ You must conspicuously display this License on each original or modified copy
160
+ of the Licensed Work. If you receive the Licensed Work in original or modified
161
+ form from a third party, the terms and conditions set forth in this License
162
+ apply to your use of that work.
163
+
164
+ Any use of the Licensed Work in violation of this License will automatically
165
+ terminate your rights under this License for the current and all other
166
+ versions of the Licensed Work.
167
+
168
+ This License does not grant you any right in any trademark or logo of Licensor
169
+ or its affiliates, provided that you may use a trademark or logo of Licensor
170
+ as expressly required by this License.
171
+
172
+ TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN
173
+ "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, EXPRESS
174
+ OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS
175
+ FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND TITLE.
package/dist/cli.d.ts ADDED
@@ -0,0 +1,7 @@
1
+ import { Command } from 'commander';
2
+ export { registerEditionCommand, registerVerbs } from './commands/edition';
3
+ export { captureEditionVerb } from './runtime/edition/run-entry';
4
+ export { EditionVerb } from './runtime/edition/verb-map';
5
+ export declare function buildProgram(): Command;
6
+ export declare function main(argv?: ReadonlyArray<string>): Promise<void>;
7
+ //# sourceMappingURL=cli.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAE3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,wBAAgB,YAAY,IAAI,OAAO,CAUtC;AAED,wBAAsB,IAAI,CAAC,IAAI,GAAE,aAAa,CAAC,MAAM,CAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpF"}
package/dist/cli.js ADDED
@@ -0,0 +1,47 @@
1
+ #!/usr/bin/env node
2
+ "use strict";
3
+ Object.defineProperty(exports, "__esModule", { value: true });
4
+ exports.EditionVerb = exports.captureEditionVerb = exports.registerVerbs = exports.registerEditionCommand = void 0;
5
+ exports.buildProgram = buildProgram;
6
+ exports.main = main;
7
+ const node_fs_1 = require("node:fs");
8
+ const node_path_1 = require("node:path");
9
+ const commander_1 = require("commander");
10
+ const edition_1 = require("./commands/edition");
11
+ const exit_codes_1 = require("./lib/exit-codes");
12
+ function readVersion() {
13
+ const manifest = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, '..', 'package.json'), 'utf8'));
14
+ const version = manifest.version;
15
+ if (typeof version !== 'string' || version.length === 0) {
16
+ throw new Error('@xemahq/edition-tooling: no "version" in its package.json');
17
+ }
18
+ return version;
19
+ }
20
+ var edition_2 = require("./commands/edition");
21
+ Object.defineProperty(exports, "registerEditionCommand", { enumerable: true, get: function () { return edition_2.registerEditionCommand; } });
22
+ Object.defineProperty(exports, "registerVerbs", { enumerable: true, get: function () { return edition_2.registerVerbs; } });
23
+ var run_entry_1 = require("./runtime/edition/run-entry");
24
+ Object.defineProperty(exports, "captureEditionVerb", { enumerable: true, get: function () { return run_entry_1.captureEditionVerb; } });
25
+ var verb_map_1 = require("./runtime/edition/verb-map");
26
+ Object.defineProperty(exports, "EditionVerb", { enumerable: true, get: function () { return verb_map_1.EditionVerb; } });
27
+ function buildProgram() {
28
+ const program = new commander_1.Command();
29
+ program
30
+ .name('xema-edition')
31
+ .description('Xema edition pipeline: resolve, seal, check and develop-snapshot an edition; build and verify image evidence.')
32
+ .version(readVersion(), '-v, --version', 'print the tooling version')
33
+ .showHelpAfterError(true)
34
+ .configureHelp({ sortSubcommands: true });
35
+ (0, edition_1.registerVerbs)(program);
36
+ return program;
37
+ }
38
+ async function main(argv = process.argv) {
39
+ await buildProgram().parseAsync([...argv]);
40
+ }
41
+ if (require.main === module) {
42
+ void main().catch((err) => {
43
+ console.error(`xema-edition: ${err instanceof Error ? err.message : String(err)}`);
44
+ process.exit(exit_codes_1.EditionExitCode.GenericError);
45
+ });
46
+ }
47
+ //# sourceMappingURL=cli.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;AA2BA,oCAUC;AAED,oBAEC;AArCD,qCAAuC;AACvC,yCAAiC;AAEjC,yCAAoC;AAEpC,gDAAmD;AACnD,iDAAmD;AAEnD,SAAS,WAAW;IAElB,MAAM,QAAQ,GAAY,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAClG,MAAM,OAAO,GAAI,QAAkC,CAAC,OAAO,CAAC;IAC5D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8CAA2E;AAAlE,iHAAA,sBAAsB,OAAA;AAAE,wGAAA,aAAa,OAAA;AAE9C,yDAAiE;AAAxD,+GAAA,kBAAkB,OAAA;AAC3B,uDAAyD;AAAhD,uGAAA,WAAW,OAAA;AAEpB,SAAgB,YAAY;IAC1B,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;IAC9B,OAAO;SACJ,IAAI,CAAC,cAAc,CAAC;SACpB,WAAW,CAAC,+GAA+G,CAAC;SAC5H,OAAO,CAAC,WAAW,EAAE,EAAE,eAAe,EAAE,2BAA2B,CAAC;SACpE,kBAAkB,CAAC,IAAI,CAAC;SACxB,aAAa,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAA,uBAAa,EAAC,OAAO,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC;AACjB,CAAC;AAEM,KAAK,UAAU,IAAI,CAAC,OAA8B,OAAO,CAAC,IAAI;IACnE,MAAM,YAAY,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC;AAGD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACjC,OAAO,CAAC,KAAK,CAAC,iBAAiB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,4BAAe,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC"}
@@ -0,0 +1,4 @@
1
+ import type { Command } from 'commander';
2
+ export declare function registerVerbs(parent: Command, invocation?: string): void;
3
+ export declare function registerEditionCommand(program: Command): void;
4
+ //# sourceMappingURL=edition.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"edition.d.ts","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0DzC,wBAAgB,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,GAAE,MAAuB,GAAG,IAAI,CAgBxF;AAGD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAE7D"}
@@ -0,0 +1,58 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.registerVerbs = registerVerbs;
4
+ exports.registerEditionCommand = registerEditionCommand;
5
+ const exit_codes_1 = require("../lib/exit-codes");
6
+ const run_entry_1 = require("../runtime/edition/run-entry");
7
+ const verb_map_1 = require("../runtime/edition/verb-map");
8
+ const VERB_SUMMARY = {
9
+ [verb_map_1.EditionVerb.Resolve]: 'Resolve the whole release lock set of an edition: xema-edition resolve <id> [--check]; or a customer edition against the catalogue pinned in catalogue.pin.json beside the definition: xema-edition resolve --definition <file> --channel release --out <dir> (a develop customer edition is resolved by xema-edition develop resolve --definition) [--source-image <source>=<registry>/<prefix>]...',
10
+ [verb_map_1.EditionVerb.Seal]: 'Seal one exact resolved RELEASE edition (kind resolved, pulled by the caller): xema-edition seal --resolved <repository>@sha256:<digest> --manifest <file> --artifact <dir> --out <dir> --cosign <abs path> --resolve-workflow-sha <40-hex> [--local] --data-root <dir> --editions-root <dir> --kernel <dir>; cosign-verifies it offline against the contract issuer and the resolve publisher (only the data root edition-workspace.json editionPublishers.resolved.release, in the repository the edition provenance records; undeclared is refused), then writes its layers unchanged plus a kind sealed release descriptor naming it as sealOf, refused unless the evidence trust policy is armed on release',
11
+ [verb_map_1.EditionVerb.ResolveDigests]: 'Resolve the image digests of an edition: xema-edition resolve-digests <id> [--definition <file>] (a customer edition resolves them against the release catalogue pinned in catalogue.pin.json beside the definition)',
12
+ [verb_map_1.EditionVerb.Develop]: 'Resolve a develop edition snapshot: xema-edition develop <resolve|target|choose-kernel|freeze-graph|freeze-sources|check-existing|check-overrides|select-records|image-record> ... (the channel lane: resolve --engine-image <repo>@sha256:<digest> --images-from <record> --channel <tag>; no signature is verified); or a customer develop edition (catalogue pinned in catalogue.pin.json beside the definition): xema-edition develop <resolve|target|check-existing|freeze-sources> --definition <file> ... (resolve: --pins <file> --out <dir> --registry <root> --engine-image <repo>@sha256:<digest> [--source-image <source>=<registry>/<prefix>]...; target: --pins <file> --registry <root> --engine-image <repo>@sha256:<digest> [--source-image ...]; check-existing: --pins <file> --artifact <dir> --engine-image <repo>@sha256:<digest> [--source-image ...]). The develop tag is sha256 of the @xemahq/edition-tooling version, the engine image, the pins and the source-image map.',
13
+ [verb_map_1.EditionVerb.Release]: 'Resolve a customer release edition (catalogue pinned for release in catalogue.pin.json beside the definition): xema-edition release <freeze-sources|target|check-existing|resolve> --definition <file> ... (freeze-sources: --out <pins.json>, each source at its declared ref; resolve: --pins <file> --out <dir> --registry <root> --engine-image <repo>@sha256:<digest> [--source-image <source>=<registry>/<prefix>]...; target: --pins <file> --registry <root> --engine-image <repo>@sha256:<digest> [--source-image ...]; resolve and check-existing are refused until the release catalogue evidence is verified)',
14
+ [verb_map_1.EditionVerb.Artifact]: 'Write the OCI artifact files of a release edition from the committed sealed locks: xema-edition artifact <id> --channel release --registry <root> --coordinate <tag> --engine-image <repo>@sha256:<digest> --out <dir>',
15
+ [verb_map_1.EditionVerb.Catalogue]: 'Write the catalogue.json of a release offering from its committed sealed locks: xema-edition catalogue <id> --out <dir>',
16
+ [verb_map_1.EditionVerb.Index]: `Rebuild a catalogue index: xema-edition index <${Object.values(verb_map_1.EditionIndexKind).join('|')}> [--check]; xema-edition index runtime-image-source --repin-contract-authority --kernel-commit <40-hex> replaces only the contract authority of the committed index with the kernel checkout's at the stated commit (its HEAD must equal it); xema-edition index runtime-image-source --trusted-write --third-party <name> verifies a third-party source offline against the OCI registry and the trusted cosign (flags and --check-third-party in edition/README.md), commits its evidence and pin, and requires xema-edition repin-evidence-trust to follow`,
17
+ [verb_map_1.EditionVerb.Check]: 'Check the committed edition locks and catalogue indices; prints every active per-edition hold (sourcePins) with its exit condition',
18
+ [verb_map_1.EditionVerb.CheckAuthored]: 'Check the authored distribution source offline (the develop gate): the definitions, the indexes, the trust policy, the data-root readers, the chart-set pin and the ownership self-tests; resolves no edition and reads no lock content and no source checkout at a pinned commit: xema-edition check-authored --data-root <dir> --editions-root <dir> --sources-root <dir> --kernel <dir>',
19
+ [verb_map_1.EditionVerb.Why]: 'Explain why a biome is in an edition: xema-edition why <id> <biome>',
20
+ [verb_map_1.EditionVerb.VerifyPlatforms]: 'Prove the registry serves every required platform of an edition: xema-edition verify-platforms <id>',
21
+ [verb_map_1.EditionVerb.CheckoutSources]: 'Check out the source repositories the runtime image source index names',
22
+ [verb_map_1.EditionVerb.RepinEvidenceTrust]: 'Pin the data root evidence trust policy and this CLI verifier: xema-edition repin-evidence-trust --data-root <dir> --kernel <dir>',
23
+ [verb_map_1.EditionVerb.VerifyEvidence]: 'Verify the signed image evidence of an edition with the pinned verifier bundle: xema-edition verify-evidence <id> --evidence-root <dir> --descriptor <path> --state <path> --cosign <path> --git <path> [--json] --data-root <dir> --editions-root <dir> --kernel <dir>',
24
+ [verb_map_1.EditionVerb.Evidence]: `Build, accept and plan image evidence (never signs): xema-edition evidence <${Object.values(verb_map_1.EditionEvidenceKind).join('|')}> …; a third-party publisher's GitHub-hosted refs/heads/main workflow assembles the producer input of one image on public inputs only (this CLI, the @xemahq/contracts it ships, its own checkout at GITHUB_WORKSPACE and registry credentials): xema-edition evidence assemble-third-party-input --bundle <oci repository>@sha256:<hex> --contract-authority <file> --image <image repository>@sha256:<hex> --subject-id <component image name> --provenance <absolute exported SLSA v1 predicate> --registry-credentials <file> --output <path> [--ttl-seconds <n>]; it then runs statement producer <stage|accept> and oci <attach-plan|validate> with --contract-authority <file> in place of --data-root/--kernel (public-input mode; the CLI's bundled @xemahq/contracts must be that authority)`,
25
+ [verb_map_1.EditionVerb.ContractAuthority]: 'Print the full kernel contract authority (KernelContractAuthoritySchema) of the @xemahq/contracts this CLI ships, as canonical JSON: the --contract-authority <file> of a third-party publisher\'s public-input run. No root flags: xema-edition contract-authority > contract-authority.json. Read from the kernel\'s own published dist/edition-protocol/contract-authority.json (sourceCommit is the commit as the kernel release states it, carried, not proven; contentDigest and sourcePaths are proven against the package), refused unless its contentDigest is the bundled edition protocol digest and the bundled kernel is that authority; a kernel without the file (a dev build) is refused',
26
+ [verb_map_1.EditionVerb.List]: 'Print the offering ids of an editions root as JSON: xema-edition list --editions-root <dir>',
27
+ [verb_map_1.EditionVerb.Locks]: 'Print the validated locks of an edition as JSON: xema-edition locks <id> --channel <release|develop> --data-root <dir> --editions-root <dir> --kernel <dir>',
28
+ [verb_map_1.EditionVerb.ChartSet]: `Pin the chart set of the editions to the charts the registry serves: xema-edition chart-set <${Object.values(verb_map_1.EditionChartSetOperation).join('|')}> [--check] --data-root <dir> --editions-root <dir> --kernel <dir>; source-commit prints the commit each publisher closed its locked set at (--data-root, --kernel)`,
29
+ [verb_map_1.EditionVerb.BiomeManifests]: 'Print the pinned xema-biome.json of every biome of an edition as JSON: xema-edition biome-manifests <id> --json --data-root <dir> --editions-root <dir> --sources-root <dir> --kernel <dir>',
30
+ [verb_map_1.EditionVerb.Arming]: 'Print whether the data root evidence trust policy is armed on one channel as one JSON line, exiting 0 only when armed: xema-edition arming --channel <release|develop> --data-root <dir> --kernel <dir>',
31
+ [verb_map_1.EditionVerb.Pin]: 'Hold one repository of a vendor edition at an exact commit, then re-resolve the edition (the commit must exist, be contained in origin/main and be built; a pin equal to the shared repository pin is not a hold): xema-edition pin <edition> <repo> <ref> --until "<exit condition>" --data-root <dir> --editions-root <dir> --sources-root <dir> --kernel <dir>',
32
+ [verb_map_1.EditionVerb.Unpin]: 'Release one hold (or all holds) of a vendor edition, then re-resolve the edition: xema-edition unpin <edition> [<repo>] --data-root <dir> --editions-root <dir> --sources-root <dir> --kernel <dir>',
33
+ [verb_map_1.EditionVerb.SourceClosure]: 'Print the source tree hash and workspace closure of a source directory at a commit as JSON: xema-edition source-closure --repo <repo> --path <dir> --commit <sha> --sources-root <dir> --kernel <dir>',
34
+ [verb_map_1.EditionVerb.Ceiling]: 'Print the dev ceiling (DevelopCeilingSchema) of a distribution at a distributions commit as JSON: the selection from the definition and indexes at that commit, the process facts from each producer manifest and ledger at its stated commit: xema-edition ceiling --distribution <id> --at <distributions sha> --producer-commit <owner/repo>=<sha> [--producer-commit ...] --data-root <dir> --sources-root <dir> --kernel <dir>',
35
+ };
36
+ const BIN_INVOCATION = 'xema-edition';
37
+ function registerVerbs(parent, invocation = BIN_INVOCATION) {
38
+ for (const verb of Object.values(verb_map_1.EditionVerb)) {
39
+ parent
40
+ .command(verb)
41
+ .description(VERB_SUMMARY[verb].replaceAll(BIN_INVOCATION, invocation))
42
+ .argument('[args...]', 'the verb\'s arguments and the root flags, passed through')
43
+ .allowUnknownOption()
44
+ .action((args) => {
45
+ try {
46
+ const { exitCode } = (0, run_entry_1.runEditionVerb)(verb, args);
47
+ process.exit(exitCode);
48
+ }
49
+ catch (error) {
50
+ (0, exit_codes_1.exitWith)(exit_codes_1.EditionExitCode.GenericError, error instanceof Error ? error.message : String(error));
51
+ }
52
+ });
53
+ }
54
+ }
55
+ function registerEditionCommand(program) {
56
+ registerVerbs(program.command('edition').summary('Resolve, seal and check editions'), 'xema edition');
57
+ }
58
+ //# sourceMappingURL=edition.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"edition.js","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":";;AA8DA,sCAgBC;AAGD,wDAEC;AAnFD,kDAA8D;AAC9D,4DAA8D;AAC9D,0DAA2H;AAW3H,MAAM,YAAY,GAA0C;IAC1D,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,sYAAsY;IACxY,CAAC,sBAAW,CAAC,IAAI,CAAC,EAChB,krBAAkrB;IACprB,CAAC,sBAAW,CAAC,cAAc,CAAC,EAAE,sNAAsN;IACpP,CAAC,sBAAW,CAAC,OAAO,CAAC,EAAE,u8BAAu8B;IAC99B,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,2lBAA2lB;IAC7lB,CAAC,sBAAW,CAAC,QAAQ,CAAC,EACpB,wNAAwN;IAC1N,CAAC,sBAAW,CAAC,SAAS,CAAC,EAAE,yHAAyH;IAClJ,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,kDAAkD,MAAM,CAAC,MAAM,CAAC,2BAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,giBAAgiB;IAChpB,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,oIAAoI;IACzJ,CAAC,sBAAW,CAAC,aAAa,CAAC,EACzB,4XAA4X;IAC9X,CAAC,sBAAW,CAAC,GAAG,CAAC,EAAE,qEAAqE;IACxF,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,qGAAqG;IACpI,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,wEAAwE;IACvG,CAAC,sBAAW,CAAC,kBAAkB,CAAC,EAAE,mIAAmI;IACrK,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,yQAAyQ;IAC3Q,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,+EAA+E,MAAM,CAAC,MAAM,CAAC,8BAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,wwBAAwwB;IAC35B,CAAC,sBAAW,CAAC,iBAAiB,CAAC,EAC7B,0qBAA0qB;IAC5qB,CAAC,sBAAW,CAAC,IAAI,CAAC,EAAE,6FAA6F;IACjH,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,6JAA6J;IAClL,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,gGAAgG,MAAM,CAAC,MAAM,CAAC,mCAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qKAAqK;IAC9U,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,6LAA6L;IAC/L,CAAC,sBAAW,CAAC,MAAM,CAAC,EAClB,yMAAyM;IAC3M,CAAC,sBAAW,CAAC,GAAG,CAAC,EACf,mWAAmW;IACrW,CAAC,sBAAW,CAAC,KAAK,CAAC,EACjB,qMAAqM;IACvM,CAAC,sBAAW,CAAC,aAAa,CAAC,EACzB,uMAAuM;IACzM,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,qaAAqa;CACxa,CAAC;AAGF,MAAM,cAAc,GAAG,cAAc,CAAC;AAMtC,SAAgB,aAAa,CAAC,MAAe,EAAE,aAAqB,cAAc;IAChF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,sBAAW,CAAC,EAAE,CAAC;QAC9C,MAAM;aACH,OAAO,CAAC,IAAI,CAAC;aACb,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;aACtE,QAAQ,CAAC,WAAW,EAAE,0DAA0D,CAAC;aACjF,kBAAkB,EAAE;aACpB,MAAM,CAAC,CAAC,IAAc,EAAE,EAAE;YACzB,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAA,0BAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,qBAAQ,EAAC,4BAAe,CAAC,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAGD,SAAgB,sBAAsB,CAAC,OAAgB;IACrD,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,EAAE,cAAc,CAAC,CAAC;AACxG,CAAC"}