@xemahq/xema 0.29.0 → 0.30.0

package/edition/kernel-package.mjs

@@ -0,0 +1,193 @@
+// kernel-package — the customer edition's kernel: `@xemahq/contracts` taken from public npm.
+//
+// A catalogue names its kernel package (`kernel: {name, version, integrity}`, catalogue.mjs). This module is
+// the ONE place that touches npm: it downloads that exact tarball (public, no credential, no .npmrc, no
+// npm/pnpm process), holds it by the catalogue's integrity BEFORE anything is extracted, extracts it with the
+// system `tar`, links its runtime dependencies to the copies this CLI itself ships, and proves the package is
+// the contract authority the catalogue was resolved under: first by its edition protocol identity (data, no
+// code executed), and only then, by loading its schemas, by the constants the authority was derived with.
+
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, symlinkSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+
+import { readKernelEditionProtocol } from './edition-protocol.mjs';
+import { cacheDir, stateKernelPackageDir } from './edition-workspace.mjs';
+import { loadKernelDistributionSchemas } from './lib.mjs';
+
+export const KERNEL_PACKAGE_NAME = '@xemahq/contracts';
+const MAX_TARBALL_BYTES = 64 * 1024 * 1024;
+const DEPENDENCY_NAME = /^(?:@[a-z0-9~-][a-z0-9._~-]*\/)?[a-z0-9~-][a-z0-9._~-]*$/;
+const EXACT = /^(\d+)\.(\d+)\.(\d+)$/;
+const CARET = /^\^(\d+)\.(\d+)\.(\d+)$/;
+
+export class KernelPackageError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'KernelPackageError';
+  }
+}
+
+export const kernelTarballUrl = (version) => `https://registry.npmjs.org/${KERNEL_PACKAGE_NAME}/-/contracts-${version}.tgz`;
+
+/** The npm integrity string of `bytes`: `sha512-<base64>`. */
+export const integrityOf = (bytes) => `sha512-${createHash('sha512').update(bytes).digest('base64')}`;
+
+/** The published tarball of `@xemahq/contracts@version`, bounded in size. */
+export async function fetchKernelTarball(version, { fetch = globalThis.fetch } = {}) {
+  const url = kernelTarballUrl(version);
+  const response = await fetch(url);
+  if (response.status === 404) {
+    throw new KernelPackageError(`${KERNEL_PACKAGE_NAME}@${version} is not published on npm (${url}): a catalogue names a published kernel`);
+  }
+  if (!response.ok) {throw new KernelPackageError(`${url} answered HTTP ${response.status}`);}
+  const declared = Number(response.headers.get('content-length') ?? 0);
+  if (declared > MAX_TARBALL_BYTES) {throw new KernelPackageError(`${url} declares ${declared} bytes, over the ${MAX_TARBALL_BYTES} byte bound`);}
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of response.body) {
+    size += chunk.length;
+    if (size > MAX_TARBALL_BYTES) {throw new KernelPackageError(`${url} is over the ${MAX_TARBALL_BYTES} byte bound`);}
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+
+/**
+ * Does `version` (exactly x.y.z) satisfy `range`? Exactly two range forms are supported: `x.y.z`, and
+ * `^x.y.z` (x > 0: >=x.y.z <(x+1).0.0; 0.y.z: >=0.y.z <0.(y+1).0). Any other form is refused.
+ */
+export function satisfiesDeclaredRange(version, range) {
+  const have = EXACT.exec(version)?.slice(1).map(Number);
+  if (have === undefined) {throw new KernelPackageError(`version ${JSON.stringify(version)} is not an exact x.y.z version`);}
+  const exact = EXACT.exec(range)?.slice(1).map(Number);
+  if (exact !== undefined) {return isDeepStrictEqual(have, exact);}
+  const caret = CARET.exec(range)?.slice(1).map(Number);
+  if (caret === undefined) {throw new KernelPackageError(`range ${JSON.stringify(range)} is not x.y.z or ^x.y.z, the only forms a kernel dependency may declare`);}
+  const compare = (a, b) => a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+  const upper = caret[0] > 0 ? [caret[0] + 1, 0, 0] : [0, caret[1] + 1, 0];
+  return compare(have, caret) >= 0 && compare(have, upper) < 0;
+}
+
+/** The directory of `name` as this CLI itself ships it: its own resolution first, then its installed kernel's. */
+function shippedPackageDir(name) {
+  const own = createRequire(import.meta.url);
+  const attempts = [() => own, () => createRequire(realpathSync(own.resolve(`${KERNEL_PACKAGE_NAME}/package.json`)))];
+  for (const requireFrom of attempts) {
+    try {
+      return dirname(realpathSync(requireFrom().resolve(`${name}/package.json`)));
+    } catch (error) {
+      if (error?.code !== 'MODULE_NOT_FOUND' && error?.code !== 'ERR_PACKAGE_PATH_NOT_EXPORTED') {throw error;}
+    }
+  }
+  return undefined;
+}
+
+function linkRuntimeDependencies(packageDir) {
+  const manifest = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf8'));
+  const nodeModules = dirname(manifest.name.startsWith('@') ? dirname(packageDir) : packageDir);
+  for (const [name, range] of Object.entries(manifest.dependencies ?? {})) {
+    if (!DEPENDENCY_NAME.test(name)) {throw new KernelPackageError(`${KERNEL_PACKAGE_NAME} declares a dependency named ${JSON.stringify(name)}, which is not a package name`);}
+    const shipped = shippedPackageDir(name);
+    if (shipped === undefined) {throw new KernelPackageError(`${KERNEL_PACKAGE_NAME} depends on ${name}@${range}, which this CLI does not ship`);}
+    const version = JSON.parse(readFileSync(join(shipped, 'package.json'), 'utf8')).version;
+    let ok;
+    try {
+      ok = satisfiesDeclaredRange(version, range);
+    } catch (error) {
+      throw new KernelPackageError(`${KERNEL_PACKAGE_NAME} dependency ${name}: ${error.message} (this CLI ships ${version})`);
+    }
+    if (!ok) {throw new KernelPackageError(`${KERNEL_PACKAGE_NAME} depends on ${name}@${range}, but this CLI ships ${name}@${version}`);}
+    const link = join(nodeModules, name);
+    mkdirSync(dirname(link), { recursive: true });
+    symlinkSync(shipped, link, 'dir');
+  }
+}
+
+/**
+ * Download the catalogue's kernel, hold it to `kernel.integrity` (refused before anything is written), extract it
+ * under `<cacheDir>/kernel-npm/<version>-<16 hex of the sha512>/node_modules/@xemahq/contracts` (fresh every run)
+ * and link its runtime dependencies. Returns the package directory.
+ */
+export async function materializeKernelPackage({ kernel, cacheDir, fetchTarball = fetchKernelTarball }) {
+  const bytes = await fetchTarball(kernel.version);
+  const actual = integrityOf(bytes);
+  if (actual !== kernel.integrity) {
+    throw new KernelPackageError(`${KERNEL_PACKAGE_NAME}@${kernel.version} integrity ${actual} is not the catalogue's kernel.integrity ${kernel.integrity}`);
+  }
+  const hex = createHash('sha512').update(bytes).digest('hex').slice(0, 16);
+  const root = join(cacheDir, 'kernel-npm', `${kernel.version}-${hex}`);
+  const packageDir = join(root, 'node_modules', ...KERNEL_PACKAGE_NAME.split('/'));
+  rmSync(root, { recursive: true, force: true });
+  mkdirSync(packageDir, { recursive: true });
+  const extracted = spawnSync('tar', ['-xzf', '-', '-C', packageDir, '--strip-components', '1'], { input: bytes, stdio: ['pipe', 'ignore', 'pipe'] });
+  if (extracted.error !== undefined) {throw new KernelPackageError(`tar could not run: ${extracted.error.message}`);}
+  if (extracted.status !== 0) {throw new KernelPackageError(`tar failed extracting ${KERNEL_PACKAGE_NAME}@${kernel.version}: ${extracted.stderr.toString().trim()}`);}
+  const manifest = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf8'));
+  if (manifest.name !== KERNEL_PACKAGE_NAME || manifest.version !== kernel.version) {
+    throw new KernelPackageError(`the tarball holds ${manifest.name}@${manifest.version}, not ${KERNEL_PACKAGE_NAME}@${kernel.version}`);
+  }
+  linkRuntimeDependencies(packageDir);
+  return packageDir;
+}
+
+const refuse = (field, wanted, got) => new KernelPackageError(`the kernel package is not the catalogue's contract authority: ${field} is ${JSON.stringify(got)}, the catalogue states ${JSON.stringify(wanted)}`);
+
+/**
+ * The kernel package at `kernelPackageDir` is the contract authority of `catalogue`. First its identity, read as
+ * data (final, which the protocol read refuses otherwise, and the catalogue's digest); only then are its schemas loaded and held to the authority's constants.
+ * `sourceCommit` is provenance and is not compared. Returns the loaded schemas.
+ */
+export async function assertKernelPackageIsCatalogueAuthority({ catalogue, kernelPackageDir, loadSchemas }) {
+  const authority = catalogue.contractAuthority;
+  const identity = readKernelEditionProtocol(kernelPackageDir);
+  if (identity.contentDigest !== authority.contentDigest) {throw refuse('contentDigest', authority.contentDigest, identity.contentDigest);}
+  const schemas = await loadSchemas();
+  if (!isDeepStrictEqual(authority.sourcePaths, schemas.XEMA_KERNEL_CONTRACT_SOURCE_PATHS)) {
+    throw refuse('sourcePaths', authority.sourcePaths, schemas.XEMA_KERNEL_CONTRACT_SOURCE_PATHS);
+  }
+  const constants = [
+    ['generatorIdentity', schemas.XEMA_KERNEL_CONTRACT_AUTHORITY_GENERATOR],
+    ['repositoryUrl', schemas.XEMA_KERNEL_CONTRACT_REPOSITORY_URL],
+    ['contentHashAlgorithm', schemas.KernelContractContentHashAlgorithm.LengthFramedGitPathModeBlobV1],
+  ];
+  for (const [field, kernelValue] of constants) {
+    if (authority[field] !== kernelValue) {throw refuse(field, authority[field], kernelValue);}
+  }
+  return schemas;
+}
+
+/**
+ * The `kernel` row a VENDOR catalogue carries: the published `@xemahq/contracts` the vendor's own kernel
+ * (`kernelPackageDir`) is, taken from npm, proved to be `contractAuthority` and held by its integrity.
+ * An unpublished version is refused. The downloaded package is extracted to a temporary directory and removed.
+ */
+export async function kernelPackageOfAuthority({ kernelPackageDir, contractAuthority, fetchTarball = fetchKernelTarball, loadSchemas = loadKernelDistributionSchemas }) {
+  const manifest = JSON.parse(readFileSync(join(kernelPackageDir, 'package.json'), 'utf8'));
+  if (manifest.name !== KERNEL_PACKAGE_NAME) {throw new KernelPackageError(`the vendor kernel is ${manifest.name}, not ${KERNEL_PACKAGE_NAME}`);}
+  const bytes = await fetchTarball(manifest.version);
+  const kernel = { name: KERNEL_PACKAGE_NAME, version: manifest.version, integrity: integrityOf(bytes) };
+  const scratch = mkdtempSync(join(tmpdir(), 'xema-kernel-npm-'));
+  try {
+    const packageDir = await materializeKernelPackage({ kernel, cacheDir: scratch, fetchTarball: async () => bytes });
+    await assertKernelPackageIsCatalogueAuthority({ catalogue: { contractAuthority }, kernelPackageDir: packageDir, loadSchemas });
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+  }
+  return kernel;
+}
+
+/**
+ * A customer verb's one step between fetching its catalogue and using any kernel schema: the catalogue's kernel is
+ * downloaded into the cache root, stated as the workspace's Kernel root, and proved to be the catalogue's contract
+ * authority. Returns the kernel's distribution schemas.
+ */
+export async function adoptCatalogueKernel(catalogue) {
+  const kernelPackageDir = await materializeKernelPackage({ kernel: catalogue.kernel, cacheDir: cacheDir() });
+  stateKernelPackageDir(kernelPackageDir);
+  return assertKernelPackageIsCatalogueAuthority({ catalogue, kernelPackageDir, loadSchemas: loadKernelDistributionSchemas });
+}

package/edition/lib.mjs

@@ -14,6 +14,9 @@ import { createRequire } from 'node:module';
 import { isIP } from 'node:net';
 import { join } from 'node:path';
 
+import { parse as parseYaml } from 'yaml';
+
+import { ADAPTER_HOST_BIOME_ID, readHostPackageVersions } from './adapter-host-versions.mjs';
 import { readBiomeAuthorizationModuleAt } from './authorization-base.mjs';
 import {
   isAuthoritativeProductionBiomeSource,
@@ -688,6 +691,18 @@ export async function loadKernelDistributionSchemas() {
         `Underlying error: ${err.message}`,
     );
   }
+  // The Node-only half of the distribution contracts (`distribution/server`): the lock digest and the
+  // predicate checks that recompute it.
+  let server;
+  try {
+    server = await import(`file://${kernelDistPath('distribution', 'server', 'index.js')}`);
+  } catch (err) {
+    throw new Error(
+      `Cannot load the built kernel distribution/server module from ${kernelDistPath('distribution', 'server', 'index.js')}. ` +
+        `Rebuild the kernel checkout (${kernelRepoDir()}). Underlying error: ${err.message}`,
+    );
+  }
+  const { distributionLockDigest, distributionImagesPredicateLockRefusal, imageDeliveryEntitlementRefusal } = server;
   const {
     parseDistribution,
     parseDistributionLock,
@@ -695,6 +710,8 @@ export async function loadKernelDistributionSchemas() {
     parseUnsealedDistributionLock,
     parseCustomerEditionDefinition,
     customerTrustCeilingIssues,
+    customerLockCeilingIssues,
+    biomeOriginsOfLock,
     sealDistributionLock,
     unsealedProjection,
     UNSEALED_DISTRIBUTION_LOCK_SCHEMA,
@@ -714,6 +731,7 @@ export async function loadKernelDistributionSchemas() {
     SigstoreEvidenceDescriptorSchema,
     parsePlatformServiceSourceIndex,
     parseRuntimeImageSourceIndex,
+    producerWorkflowPinRefusal,
     resolveRuntimeImagePlatforms,
     BiomeInstallPolicy,
     BiomeLaunchMode,
@@ -749,6 +767,7 @@ export async function loadKernelDistributionSchemas() {
     describeProvenance,
     describeHop,
     deriveWorkflowSubjects,
+    distributionImagesPredicateChannelRefusal,
   } = mod;
   let topology;
   try {
@@ -791,6 +810,7 @@ export async function loadKernelDistributionSchemas() {
     typeof SigstoreEvidenceDescriptorSchema?.parse !== 'function' ||
     typeof parsePlatformServiceSourceIndex !== 'function' ||
     typeof parseRuntimeImageSourceIndex !== 'function' ||
+    typeof producerWorkflowPinRefusal !== 'function' ||
     typeof resolveRuntimeImagePlatforms !== 'function' ||
     typeof resolveFirstPartyCapabilityDomains !== 'function' ||
     typeof DistributionVisibility !== 'object' ||
@@ -837,6 +857,12 @@ export async function loadKernelDistributionSchemas() {
     // A biome's workflow subjects and its edition trust ceiling, each written
     // through the kernel's one derivation (`@xemahq/contracts` >= 0.71.0).
     typeof deriveWorkflowSubjects !== 'function' ||
+    // Predicate v2 checks (`@xemahq/contracts` >= 0.78.0): the channel the verifying policy row states and
+    // the lock digest the predicates bind.
+    typeof distributionImagesPredicateChannelRefusal !== 'function' ||
+    typeof distributionImagesPredicateLockRefusal !== 'function' ||
+    typeof distributionLockDigest !== 'function' ||
+    typeof imageDeliveryEntitlementRefusal !== 'function' ||
     typeof deriveTrustCeiling !== 'function' ||
     // The trust-domain vocabulary a customer edition is bounded by: the vendor's
     // own domain, a biome's default domain, and the two ceiling grammars a
@@ -867,6 +893,8 @@ export async function loadKernelDistributionSchemas() {
     parseUnsealedDistributionLock,
     parseCustomerEditionDefinition,
     customerTrustCeilingIssues,
+    customerLockCeilingIssues,
+    biomeOriginsOfLock,
     sealDistributionLock,
     unsealedProjection,
     UNSEALED_DISTRIBUTION_LOCK_SCHEMA,
@@ -926,6 +954,11 @@ export async function loadKernelDistributionSchemas() {
     FIRST_PARTY_TRUST_DOMAIN,
     ProcessTrustPolicySchema,
     DistributionTrustPolicySchema,
+    distributionLockDigest,
+    distributionImagesPredicateChannelRefusal,
+    distributionImagesPredicateLockRefusal,
+    imageDeliveryEntitlementRefusal,
+    producerWorkflowPinRefusal,
   };
 }
 
@@ -1086,6 +1119,10 @@ function listBiomeManifestsAt(directory, repo, commit) {
       rel,
       repo,
       path,
+      // The manifest's directory in its repository, and a reader of any file of
+      // that repository at the SAME pinned commit (the host's pnpm-lock.yaml).
+      manifestDirectory,
+      readRepositoryText: (repoRelativePath) => readGitTextAtCommitOrNull(directory, repoRelativePath, commit),
       ...(authorizationModule === null ? {} : { authorizationModule }),
     });
   }
@@ -2058,6 +2095,16 @@ export async function manifestToIndexEntry({ raw, generatedIndex, rel, repo, pat
                     .filter((name) => typeof name === 'string' && name.length > 0),
                 ),
               ].sort(compareStrings),
+              // The capabilities the signed biome declares (a delegation
+              // origination may lend only these): the manifest's
+              // `xema.exposesCapabilities`; `requires*` are what it asks for.
+              declaredCapabilities: [
+                ...new Set(
+                  (Array.isArray(xema.exposesCapabilities) ? xema.exposesCapabilities : []).filter(
+                    (ref) => typeof ref === 'string' && ref.length > 0,
+                  ),
+                ),
+              ].sort(compareStrings),
             },
           },
         }
@@ -2263,6 +2310,26 @@ export function validateServiceDependencyOwnerParity(
   return entries;
 }
 
+/**
+ * The adapter host's resolved `@xemahq/contracts` / `@xemahq/biome-sdk` versions, read from its source
+ * repository's pnpm-lock.yaml at the pinned commit. An INDEX field only: the distribution lock never carries it.
+ */
+function adapterHostPackageVersions(manifest) {
+  const services = (manifest.raw.xema.components ?? []).filter(
+    (component) => component?.kind === 'service' && component.artifact?.kind === 'oci-image',
+  );
+  if (services.length !== 1) {
+    throw new Error(`${manifest.rel}: the adapter host declares ${services.length} oci-image service components; exactly one carries its package`);
+  }
+  const lockfilePath = 'pnpm-lock.yaml';
+  return readHostPackageVersions({
+    lockfileText: manifest.readRepositoryText(lockfilePath),
+    importer: `${manifest.manifestDirectory}/${services[0].artifact.path}`,
+    lockfilePath: `${manifest.repo}/${lockfilePath}`,
+    parseYaml,
+  });
+}
+
 export async function buildBiomeIndex(
   platformServiceIndex,
   sourceRepositories = distributionBiomeSourceRepositories(),
@@ -2275,7 +2342,12 @@ export async function buildBiomeIndex(
     });
   const entries = [];
   for (const manifest of await committedBiomeManifests(sourceRepositories, authority)) {
-    entries.push(await manifestToIndexEntry(manifest));
+    const entry = await manifestToIndexEntry(manifest);
+    entries.push(
+      entry.id === ADAPTER_HOST_BIOME_ID
+        ? { ...entry, hostPackageVersions: adapterHostPackageVersions(manifest) }
+        : entry,
+    );
   }
   resolveServiceDependencyOwners(entries, platformServiceIndex);
   assertDeclaredDatabasesUnowned(entries);

package/edition/oci-evidence-verbs.mjs

@@ -32,7 +32,7 @@ import {
   isEntryModule,
 } from './edition-workspace.mjs';
 import { SHA256_DIGEST_PATTERN } from './evidence-grammars.mjs';
-import { canonicalJson, loadValidatedLocks } from './image-evidence.mjs';
+import { canonicalJson, loadValidatedImageLocks } from './image-evidence.mjs';
 import { compareStrings, loadKernelDistributionSchemas, serializeJson } from './lib.mjs';
 import {
   IMAGE_SOURCE_EVIDENCE_ARTIFACT_TYPE,
@@ -230,7 +230,7 @@ export async function planOciEvidenceBackfill({
   const missingGit = new Map();
   for (const distributionId of distributionIds) {
     assertCanonicalDistributionId(distributionId);
-    const { imageLock, repositoryPins } = await loadValidatedLocks(distributionId, data, schemas, {
+    const { imageLock, repositoryPins } = await loadValidatedImageLocks(distributionId, data, schemas, {
       editionsRoot: editions,
     });
     for (const subject of imageLock.subjects) {

package/edition/oras.mjs

@@ -20,8 +20,9 @@
 //   * before oras ever receives a credential, the registry's own `/v2/`
 //     challenge is probed and a token realm on another origin is refused;
 //   * a digest-addressed read whose bytes do not hash to the requested digest
-//     throws; a tag read is resolved to a descriptor first, then read by digest,
-//     so its bytes are always hash-checked;
+//     throws; a tag read and a digest read are both resolved to the registry's
+//     descriptor first, and the manifest media type is the descriptor's, never
+//     the manifest body's optional `mediaType` (Helm's has none);
 //   * descriptor sizes are checked BEFORE the fetch, actual lengths after it;
 //   * a registry status is read only from oras's own error forms; any other
 //     failure carries no status and is thrown as undecided;
@@ -554,11 +555,11 @@ export class OrasRegistry {
   }
 
   /**
-   * Fetch a manifest by TAG: resolve the descriptor, then read by digest, so the
-   * bytes are always hash-checked against what the registry said the tag is.
+   * The descriptor the registry reports for a manifest reference, refused when
+   * its media type is not an accepted manifest type or it declares more than
+   * the manifest size cap.
    */
-  async getManifestByTag(repository, tag) {
-    const ref = `${this.#ref(repository)}:${tag}`;
+  async #manifestDescriptor(ref) {
     const out = await this.#oras(['manifest', 'fetch'], ['--descriptor'], ref);
     const descriptor = this.#parseDescriptor(out, ref);
     if (!ACCEPTED_MANIFEST_MEDIA_TYPES.includes(descriptor.mediaType)) {
@@ -569,12 +570,33 @@ export class OrasRegistry {
     if (descriptor.size > MAX_MANIFEST_BYTES) {
       throw new Error(`${ref} declares ${descriptor.size} bytes, exceeding ${MAX_MANIFEST_BYTES}`);
     }
+    return descriptor;
+  }
+
+  /**
+   * Fetch a manifest by TAG: resolve the descriptor, then read by digest, so the
+   * bytes are always hash-checked against what the registry said the tag is.
+   */
+  async getManifestByTag(repository, tag) {
+    const descriptor = await this.#manifestDescriptor(`${this.#ref(repository)}:${tag}`);
     return this.#manifestByDigest(repository, descriptor.digest, descriptor.mediaType);
   }
 
-  /** Fetch a manifest by DIGEST; the bytes must hash to exactly that digest. */
+  /**
+   * Fetch a manifest by DIGEST: the media type is the one the registry reports
+   * for that digest (a manifest body's own `mediaType` is optional, and Helm's
+   * has none), and the bytes must hash to exactly that digest.
+   */
   async getManifestByDigest(repository, digest) {
-    return this.#manifestByDigest(repository, digest, null);
+    if (!SHA256_DIGEST_PATTERN.test(digest)) {
+      throw new Error(`"${digest}" is not a canonical lowercase sha256 digest`);
+    }
+    const ref = `${this.#ref(repository)}@${digest}`;
+    const descriptor = await this.#manifestDescriptor(ref);
+    if (descriptor.digest !== digest) {
+      throw new Error(`${ref} described ${descriptor.digest}, not the requested ${digest}`);
+    }
+    return this.#manifestByDigest(repository, digest, descriptor.mediaType);
   }
 
   async #manifestByDigest(repository, digest, expectedMediaType) {
@@ -629,10 +651,10 @@ function decodeManifest(bytes, expectedMediaType, ref) {
   if (typeof document !== 'object' || document === null || Array.isArray(document)) {
     throw new Error(`${ref} returned a manifest that is not a JSON object`);
   }
-  const mediaType = expectedMediaType ?? document.mediaType;
+  const mediaType = expectedMediaType;
   if (!ACCEPTED_MANIFEST_MEDIA_TYPES.includes(mediaType)) {
     throw new Error(
-      `${ref} returned unsupported manifest media type "${mediaType || '(none)'}"`,
+      `${ref} returned unsupported manifest media type "${mediaType}"`,
     );
   }
   if (typeof document.mediaType === 'string' && document.mediaType !== mediaType) {

package/edition/plan-image-evidence-refresh.mjs

@@ -66,7 +66,7 @@ import {
 } from './edition-workspace.mjs';
 import {
   canonicalJson,
-  loadValidatedLocks,
+  loadValidatedImageLocks,
 } from './image-evidence.mjs';
 import { assertKernelContractAuthorityEqual } from './kernel-contract-authority.mjs';
 import { compareStrings, loadKernelDistributionSchemas } from './lib.mjs';
@@ -142,7 +142,7 @@ export async function planImageEvidenceRefresh({
 
   const subjects = [];
   for (const distributionId of [...distributionIds].sort(compareStrings)) {
-    const { imageLock, repositoryPins, runtimeSourceIndex } = await loadValidatedLocks(
+    const { imageLock, repositoryPins, runtimeSourceIndex } = await loadValidatedImageLocks(
       distributionId,
       dataRootDirectory,
       schemas,

package/edition/produce-distribution-completeness-evidence.mjs

@@ -21,6 +21,7 @@ import {
   assertPinnedCosignVersion,
   buildDistributionImageEvidenceSet,
   buildDistributionImagesStatement,
+  evidenceChannelOfSigner,
   loadPinnedTrustPolicy,
   parseEvidenceCliFlags,
   resolveProducerEvidence,
@@ -59,6 +60,8 @@ export function githubWorkflowSigner({ repository, ref, path }) {
 
 /** The producer evidence and the completeness statement these inputs resolve to; deterministic. */
 async function deriveCompleteness(options, { outputRoot }) {
+  // The channel the signer signs for is the channel the lock is read on.
+  const channel = evidenceChannelOfSigner(options.signer, options.schemas);
   const resolution = {
     distributionId: options.distributionId,
     dataRoot: options.dataRoot,
@@ -66,6 +69,7 @@ async function deriveCompleteness(options, { outputRoot }) {
     schemas: options.schemas,
     expectedContractAuthority: options.expectedContractAuthority,
     registryClientFactory: options.registryClientFactory,
+    channel,
   };
   const staged = outputRoot === null
     ? await resolveProducerEvidence(resolution)
@@ -74,6 +78,7 @@ async function deriveCompleteness(options, { outputRoot }) {
     distributionLock: staged.distributionLock,
     imageLock: staged.imageLock,
     images: staged.images,
+    channel,
     releaseSequence: options.releaseSequence,
     releaseSourceCommit: options.releaseSourceCommit,
     runId: options.runId,

package/edition/produce-image-delivery-entitlement-evidence.mjs

@@ -18,6 +18,7 @@ import {
   acceptSignedEvidenceStatement,
   assertPinnedCosignVersion,
   buildImageDeliveryEntitlementStatement,
+  evidenceChannelOfSigner,
   loadPinnedTrustPolicy,
   parseEvidenceCliFlags,
   stageEvidenceStatement,
@@ -26,10 +27,11 @@ import {
   WorkspaceRoot,
   configureEditionWorkspaceFromArgv,
   dataRoot,
+  editionsRoot,
   isEntryModule,
 } from './edition-workspace.mjs';
 import { ENTITLEMENT_DESCRIPTOR_FILE, entitlementDescriptorDocument } from './image-delivery-entitlement-descriptor.mjs';
-import { canonicalJsonBytes, readCanonicalJsonFromRoot } from './image-evidence.mjs';
+import { canonicalJsonBytes, readCanonicalJsonFromRoot, readEditionDistributionLock } from './image-evidence.mjs';
 import { serializeJson } from './lib.mjs';
 import { githubWorkflowSigner } from './produce-distribution-completeness-evidence.mjs';
 import {
@@ -81,6 +83,12 @@ function deriveEntitlement(options) {
     schemas: options.schemas,
   });
   const statement = buildImageDeliveryEntitlementStatement({
+    distributionLock: readEditionDistributionLock(
+      options.editionsRoot,
+      options.distributionId,
+      options.schemas,
+      evidenceChannelOfSigner(options.signer, options.schemas),
+    ),
     distributionId: options.distributionId,
     completenessStatementDigest,
     customerId: options.customerId,
@@ -226,6 +234,7 @@ const SHARED_FLAGS = Object.freeze([
 async function main() {
   const [phase, ...args] = configureEditionWorkspaceFromArgv(process.argv.slice(2), [
     WorkspaceRoot.Data,
+    WorkspaceRoot.Editions,
     WorkspaceRoot.Kernel,
   ]);
   if (phase !== 'stage' && phase !== 'accept') {
@@ -240,6 +249,7 @@ async function main() {
   const options = {
     distributionId: flags.require('distribution'),
     evidenceRoot: resolve(flags.require('evidence-root')),
+    editionsRoot: editionsRoot(),
     stagingDirectory: resolve(flags.require('staging')),
     schemas,
     policy: loadPinnedTrustPolicy({ dataRoot: dataRoot(), schemas }),

package/edition/release-catalogue.mjs

@@ -5,14 +5,15 @@ import { readFileSync } from 'node:fs';
 import { biomeSourceTreeIds } from './biome-content.mjs';
 import { buildCatalogue } from './catalogue.mjs';
 import { EditionChannel } from './edition-constants.mjs';
-import { biomeIndexPath, platformServiceIndexPath, runtimeImageSourceIndexPath } from './edition-workspace.mjs';
+import { biomeIndexPath, kernelPackageDir, platformServiceIndexPath, runtimeImageSourceIndexPath } from './edition-workspace.mjs';
+import { kernelPackageOfAuthority } from './kernel-package.mjs';
 import { loadKernelDistributionSchemas } from './lib.mjs';
 import { loadEditionManifest } from './resolve-distribution.mjs';
 import { externalSourceTrees, sourceTreeLocator } from './resolve-images.mjs';
 import { committedRepositoryPins, createPinnedSourceAuthority } from './source-authority.mjs';
 
 /** The catalogue of release offering `id`, from the committed locks (`locks` as `readCommittedEdition` returns them). */
-export async function releaseCatalogue(id, locks) {
+export async function releaseCatalogue(id, locks, { fetchKernelTarball } = {}) {
   const schemas = await loadKernelDistributionSchemas();
   const authority = createPinnedSourceAuthority({ pins: committedRepositoryPins() });
   // The WRITER of the catalogue's tree ids: the real `git rev-parse <commit>:<path>` of every biome.
@@ -23,6 +24,7 @@ export async function releaseCatalogue(id, locks) {
     locate: sourceTreeLocator(externalSourceTrees(locks.distributionLock)),
     vendoredCommit: (repo) => authority.vendoredSourceCommitForRepository(repo),
   });
+  const contractAuthority = schemas.parseRuntimeImageSourceIndex(JSON.parse(readFileSync(runtimeImageSourceIndexPath(), 'utf8'))).contractAuthority;
   return buildCatalogue({
     sourceTreeIds,
     offeringId: id,
@@ -32,7 +34,12 @@ export async function releaseCatalogue(id, locks) {
     chartSetLock: locks.chartSetLock,
     biomeIndex: JSON.parse(readFileSync(biomeIndexPath(), 'utf8')),
     platformServiceIndex: schemas.parsePlatformServiceSourceIndex(JSON.parse(readFileSync(platformServiceIndexPath(), 'utf8'))),
-    contractAuthority: schemas.parseRuntimeImageSourceIndex(JSON.parse(readFileSync(runtimeImageSourceIndexPath(), 'utf8'))).contractAuthority,
+    contractAuthority,
+    kernel: await kernelPackageOfAuthority({
+      kernelPackageDir: kernelPackageDir(),
+      contractAuthority,
+      ...(fetchKernelTarball === undefined ? {} : { fetchTarball: fetchKernelTarball }),
+    }),
     leaf: loadEditionManifest(schemas.parseDistribution, id),
   });
 }

package/edition/resolve-chart-set.mjs

@@ -82,7 +82,7 @@ import {
 } from './registry-credentials.mjs';
 
 if (isEntryModule(import.meta.url)) {
-  configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Deploy, WorkspaceRoot.Kernel]);
+  configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Kernel], { refuseOthers: true });
 }
 
 export const CHART_SET_LOCK_FILE = 'chart-set.lock.json';