@xemahq/xema 0.29.1 → 0.30.0

package/edition/kernel-package.mjs

@@ -0,0 +1,193 @@
+// kernel-package — the customer edition's kernel: `@xemahq/contracts` taken from public npm.
+//
+// A catalogue names its kernel package (`kernel: {name, version, integrity}`, catalogue.mjs). This module is
+// the ONE place that touches npm: it downloads that exact tarball (public, no credential, no .npmrc, no
+// npm/pnpm process), holds it by the catalogue's integrity BEFORE anything is extracted, extracts it with the
+// system `tar`, links its runtime dependencies to the copies this CLI itself ships, and proves the package is
+// the contract authority the catalogue was resolved under: first by its edition protocol identity (data, no
+// code executed), and only then, by loading its schemas, by the constants the authority was derived with.
+
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, symlinkSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+
+import { readKernelEditionProtocol } from './edition-protocol.mjs';
+import { cacheDir, stateKernelPackageDir } from './edition-workspace.mjs';
+import { loadKernelDistributionSchemas } from './lib.mjs';
+
+export const KERNEL_PACKAGE_NAME = '@xemahq/contracts';
+const MAX_TARBALL_BYTES = 64 * 1024 * 1024;
+const DEPENDENCY_NAME = /^(?:@[a-z0-9~-][a-z0-9._~-]*\/)?[a-z0-9~-][a-z0-9._~-]*$/;
+const EXACT = /^(\d+)\.(\d+)\.(\d+)$/;
+const CARET = /^\^(\d+)\.(\d+)\.(\d+)$/;
+
+export class KernelPackageError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'KernelPackageError';
+  }
+}
+
+export const kernelTarballUrl = (version) => `https://registry.npmjs.org/${KERNEL_PACKAGE_NAME}/-/contracts-${version}.tgz`;
+
+/** The npm integrity string of `bytes`: `sha512-<base64>`. */
+export const integrityOf = (bytes) => `sha512-${createHash('sha512').update(bytes).digest('base64')}`;
+
+/** The published tarball of `@xemahq/contracts@version`, bounded in size. */
+export async function fetchKernelTarball(version, { fetch = globalThis.fetch } = {}) {
+  const url = kernelTarballUrl(version);
+  const response = await fetch(url);
+  if (response.status === 404) {
+    throw new KernelPackageError(`${KERNEL_PACKAGE_NAME}@${version} is not published on npm (${url}): a catalogue names a published kernel`);
+  }
+  if (!response.ok) {throw new KernelPackageError(`${url} answered HTTP ${response.status}`);}
+  const declared = Number(response.headers.get('content-length') ?? 0);
+  if (declared > MAX_TARBALL_BYTES) {throw new KernelPackageError(`${url} declares ${declared} bytes, over the ${MAX_TARBALL_BYTES} byte bound`);}
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of response.body) {
+    size += chunk.length;
+    if (size > MAX_TARBALL_BYTES) {throw new KernelPackageError(`${url} is over the ${MAX_TARBALL_BYTES} byte bound`);}
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+
+/**
+ * Does `version` (exactly x.y.z) satisfy `range`? Exactly two range forms are supported: `x.y.z`, and
+ * `^x.y.z` (x > 0: >=x.y.z <(x+1).0.0; 0.y.z: >=0.y.z <0.(y+1).0). Any other form is refused.
+ */
+export function satisfiesDeclaredRange(version, range) {
+  const have = EXACT.exec(version)?.slice(1).map(Number);
+  if (have === undefined) {throw new KernelPackageError(`version ${JSON.stringify(version)} is not an exact x.y.z version`);}
+  const exact = EXACT.exec(range)?.slice(1).map(Number);
+  if (exact !== undefined) {return isDeepStrictEqual(have, exact);}
+  const caret = CARET.exec(range)?.slice(1).map(Number);
+  if (caret === undefined) {throw new KernelPackageError(`range ${JSON.stringify(range)} is not x.y.z or ^x.y.z, the only forms a kernel dependency may declare`);}
+  const compare = (a, b) => a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+  const upper = caret[0] > 0 ? [caret[0] + 1, 0, 0] : [0, caret[1] + 1, 0];
+  return compare(have, caret) >= 0 && compare(have, upper) < 0;
+}
+
+/** The directory of `name` as this CLI itself ships it: its own resolution first, then its installed kernel's. */
+function shippedPackageDir(name) {
+  const own = createRequire(import.meta.url);
+  const attempts = [() => own, () => createRequire(realpathSync(own.resolve(`${KERNEL_PACKAGE_NAME}/package.json`)))];
+  for (const requireFrom of attempts) {
+    try {
+      return dirname(realpathSync(requireFrom().resolve(`${name}/package.json`)));
+    } catch (error) {
+      if (error?.code !== 'MODULE_NOT_FOUND' && error?.code !== 'ERR_PACKAGE_PATH_NOT_EXPORTED') {throw error;}
+    }
+  }
+  return undefined;
+}
+
+function linkRuntimeDependencies(packageDir) {
+  const manifest = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf8'));
+  const nodeModules = dirname(manifest.name.startsWith('@') ? dirname(packageDir) : packageDir);
+  for (const [name, range] of Object.entries(manifest.dependencies ?? {})) {
+    if (!DEPENDENCY_NAME.test(name)) {throw new KernelPackageError(`${KERNEL_PACKAGE_NAME} declares a dependency named ${JSON.stringify(name)}, which is not a package name`);}
+    const shipped = shippedPackageDir(name);
+    if (shipped === undefined) {throw new KernelPackageError(`${KERNEL_PACKAGE_NAME} depends on ${name}@${range}, which this CLI does not ship`);}
+    const version = JSON.parse(readFileSync(join(shipped, 'package.json'), 'utf8')).version;
+    let ok;
+    try {
+      ok = satisfiesDeclaredRange(version, range);
+    } catch (error) {
+      throw new KernelPackageError(`${KERNEL_PACKAGE_NAME} dependency ${name}: ${error.message} (this CLI ships ${version})`);
+    }
+    if (!ok) {throw new KernelPackageError(`${KERNEL_PACKAGE_NAME} depends on ${name}@${range}, but this CLI ships ${name}@${version}`);}
+    const link = join(nodeModules, name);
+    mkdirSync(dirname(link), { recursive: true });
+    symlinkSync(shipped, link, 'dir');
+  }
+}
+
+/**
+ * Download the catalogue's kernel, hold it to `kernel.integrity` (refused before anything is written), extract it
+ * under `<cacheDir>/kernel-npm/<version>-<16 hex of the sha512>/node_modules/@xemahq/contracts` (fresh every run)
+ * and link its runtime dependencies. Returns the package directory.
+ */
+export async function materializeKernelPackage({ kernel, cacheDir, fetchTarball = fetchKernelTarball }) {
+  const bytes = await fetchTarball(kernel.version);
+  const actual = integrityOf(bytes);
+  if (actual !== kernel.integrity) {
+    throw new KernelPackageError(`${KERNEL_PACKAGE_NAME}@${kernel.version} integrity ${actual} is not the catalogue's kernel.integrity ${kernel.integrity}`);
+  }
+  const hex = createHash('sha512').update(bytes).digest('hex').slice(0, 16);
+  const root = join(cacheDir, 'kernel-npm', `${kernel.version}-${hex}`);
+  const packageDir = join(root, 'node_modules', ...KERNEL_PACKAGE_NAME.split('/'));
+  rmSync(root, { recursive: true, force: true });
+  mkdirSync(packageDir, { recursive: true });
+  const extracted = spawnSync('tar', ['-xzf', '-', '-C', packageDir, '--strip-components', '1'], { input: bytes, stdio: ['pipe', 'ignore', 'pipe'] });
+  if (extracted.error !== undefined) {throw new KernelPackageError(`tar could not run: ${extracted.error.message}`);}
+  if (extracted.status !== 0) {throw new KernelPackageError(`tar failed extracting ${KERNEL_PACKAGE_NAME}@${kernel.version}: ${extracted.stderr.toString().trim()}`);}
+  const manifest = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf8'));
+  if (manifest.name !== KERNEL_PACKAGE_NAME || manifest.version !== kernel.version) {
+    throw new KernelPackageError(`the tarball holds ${manifest.name}@${manifest.version}, not ${KERNEL_PACKAGE_NAME}@${kernel.version}`);
+  }
+  linkRuntimeDependencies(packageDir);
+  return packageDir;
+}
+
+const refuse = (field, wanted, got) => new KernelPackageError(`the kernel package is not the catalogue's contract authority: ${field} is ${JSON.stringify(got)}, the catalogue states ${JSON.stringify(wanted)}`);
+
+/**
+ * The kernel package at `kernelPackageDir` is the contract authority of `catalogue`. First its identity, read as
+ * data (final, which the protocol read refuses otherwise, and the catalogue's digest); only then are its schemas loaded and held to the authority's constants.
+ * `sourceCommit` is provenance and is not compared. Returns the loaded schemas.
+ */
+export async function assertKernelPackageIsCatalogueAuthority({ catalogue, kernelPackageDir, loadSchemas }) {
+  const authority = catalogue.contractAuthority;
+  const identity = readKernelEditionProtocol(kernelPackageDir);
+  if (identity.contentDigest !== authority.contentDigest) {throw refuse('contentDigest', authority.contentDigest, identity.contentDigest);}
+  const schemas = await loadSchemas();
+  if (!isDeepStrictEqual(authority.sourcePaths, schemas.XEMA_KERNEL_CONTRACT_SOURCE_PATHS)) {
+    throw refuse('sourcePaths', authority.sourcePaths, schemas.XEMA_KERNEL_CONTRACT_SOURCE_PATHS);
+  }
+  const constants = [
+    ['generatorIdentity', schemas.XEMA_KERNEL_CONTRACT_AUTHORITY_GENERATOR],
+    ['repositoryUrl', schemas.XEMA_KERNEL_CONTRACT_REPOSITORY_URL],
+    ['contentHashAlgorithm', schemas.KernelContractContentHashAlgorithm.LengthFramedGitPathModeBlobV1],
+  ];
+  for (const [field, kernelValue] of constants) {
+    if (authority[field] !== kernelValue) {throw refuse(field, authority[field], kernelValue);}
+  }
+  return schemas;
+}
+
+/**
+ * The `kernel` row a VENDOR catalogue carries: the published `@xemahq/contracts` the vendor's own kernel
+ * (`kernelPackageDir`) is, taken from npm, proved to be `contractAuthority` and held by its integrity.
+ * An unpublished version is refused. The downloaded package is extracted to a temporary directory and removed.
+ */
+export async function kernelPackageOfAuthority({ kernelPackageDir, contractAuthority, fetchTarball = fetchKernelTarball, loadSchemas = loadKernelDistributionSchemas }) {
+  const manifest = JSON.parse(readFileSync(join(kernelPackageDir, 'package.json'), 'utf8'));
+  if (manifest.name !== KERNEL_PACKAGE_NAME) {throw new KernelPackageError(`the vendor kernel is ${manifest.name}, not ${KERNEL_PACKAGE_NAME}`);}
+  const bytes = await fetchTarball(manifest.version);
+  const kernel = { name: KERNEL_PACKAGE_NAME, version: manifest.version, integrity: integrityOf(bytes) };
+  const scratch = mkdtempSync(join(tmpdir(), 'xema-kernel-npm-'));
+  try {
+    const packageDir = await materializeKernelPackage({ kernel, cacheDir: scratch, fetchTarball: async () => bytes });
+    await assertKernelPackageIsCatalogueAuthority({ catalogue: { contractAuthority }, kernelPackageDir: packageDir, loadSchemas });
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+  }
+  return kernel;
+}
+
+/**
+ * A customer verb's one step between fetching its catalogue and using any kernel schema: the catalogue's kernel is
+ * downloaded into the cache root, stated as the workspace's Kernel root, and proved to be the catalogue's contract
+ * authority. Returns the kernel's distribution schemas.
+ */
+export async function adoptCatalogueKernel(catalogue) {
+  const kernelPackageDir = await materializeKernelPackage({ kernel: catalogue.kernel, cacheDir: cacheDir() });
+  stateKernelPackageDir(kernelPackageDir);
+  return assertKernelPackageIsCatalogueAuthority({ catalogue, kernelPackageDir, loadSchemas: loadKernelDistributionSchemas });
+}

package/edition/lib.mjs

@@ -14,6 +14,9 @@ import { createRequire } from 'node:module';
 import { isIP } from 'node:net';
 import { join } from 'node:path';
 
+import { parse as parseYaml } from 'yaml';
+
+import { ADAPTER_HOST_BIOME_ID, readHostPackageVersions } from './adapter-host-versions.mjs';
 import { readBiomeAuthorizationModuleAt } from './authorization-base.mjs';
 import {
   isAuthoritativeProductionBiomeSource,
@@ -688,6 +691,18 @@ export async function loadKernelDistributionSchemas() {
         `Underlying error: ${err.message}`,
     );
   }
+  // The Node-only half of the distribution contracts (`distribution/server`): the lock digest and the
+  // predicate checks that recompute it.
+  let server;
+  try {
+    server = await import(`file://${kernelDistPath('distribution', 'server', 'index.js')}`);
+  } catch (err) {
+    throw new Error(
+      `Cannot load the built kernel distribution/server module from ${kernelDistPath('distribution', 'server', 'index.js')}. ` +
+        `Rebuild the kernel checkout (${kernelRepoDir()}). Underlying error: ${err.message}`,
+    );
+  }
+  const { distributionLockDigest, distributionImagesPredicateLockRefusal, imageDeliveryEntitlementRefusal } = server;
   const {
     parseDistribution,
     parseDistributionLock,
@@ -695,6 +710,8 @@ export async function loadKernelDistributionSchemas() {
     parseUnsealedDistributionLock,
     parseCustomerEditionDefinition,
     customerTrustCeilingIssues,
+    customerLockCeilingIssues,
+    biomeOriginsOfLock,
     sealDistributionLock,
     unsealedProjection,
     UNSEALED_DISTRIBUTION_LOCK_SCHEMA,
@@ -714,6 +731,7 @@ export async function loadKernelDistributionSchemas() {
     SigstoreEvidenceDescriptorSchema,
     parsePlatformServiceSourceIndex,
     parseRuntimeImageSourceIndex,
+    producerWorkflowPinRefusal,
     resolveRuntimeImagePlatforms,
     BiomeInstallPolicy,
     BiomeLaunchMode,
@@ -749,6 +767,7 @@ export async function loadKernelDistributionSchemas() {
     describeProvenance,
     describeHop,
     deriveWorkflowSubjects,
+    distributionImagesPredicateChannelRefusal,
   } = mod;
   let topology;
   try {
@@ -791,6 +810,7 @@ export async function loadKernelDistributionSchemas() {
     typeof SigstoreEvidenceDescriptorSchema?.parse !== 'function' ||
     typeof parsePlatformServiceSourceIndex !== 'function' ||
     typeof parseRuntimeImageSourceIndex !== 'function' ||
+    typeof producerWorkflowPinRefusal !== 'function' ||
     typeof resolveRuntimeImagePlatforms !== 'function' ||
     typeof resolveFirstPartyCapabilityDomains !== 'function' ||
     typeof DistributionVisibility !== 'object' ||
@@ -837,6 +857,12 @@ export async function loadKernelDistributionSchemas() {
     // A biome's workflow subjects and its edition trust ceiling, each written
     // through the kernel's one derivation (`@xemahq/contracts` >= 0.71.0).
     typeof deriveWorkflowSubjects !== 'function' ||
+    // Predicate v2 checks (`@xemahq/contracts` >= 0.78.0): the channel the verifying policy row states and
+    // the lock digest the predicates bind.
+    typeof distributionImagesPredicateChannelRefusal !== 'function' ||
+    typeof distributionImagesPredicateLockRefusal !== 'function' ||
+    typeof distributionLockDigest !== 'function' ||
+    typeof imageDeliveryEntitlementRefusal !== 'function' ||
     typeof deriveTrustCeiling !== 'function' ||
     // The trust-domain vocabulary a customer edition is bounded by: the vendor's
     // own domain, a biome's default domain, and the two ceiling grammars a
@@ -867,6 +893,8 @@ export async function loadKernelDistributionSchemas() {
     parseUnsealedDistributionLock,
     parseCustomerEditionDefinition,
     customerTrustCeilingIssues,
+    customerLockCeilingIssues,
+    biomeOriginsOfLock,
     sealDistributionLock,
     unsealedProjection,
     UNSEALED_DISTRIBUTION_LOCK_SCHEMA,
@@ -926,6 +954,11 @@ export async function loadKernelDistributionSchemas() {
     FIRST_PARTY_TRUST_DOMAIN,
     ProcessTrustPolicySchema,
     DistributionTrustPolicySchema,
+    distributionLockDigest,
+    distributionImagesPredicateChannelRefusal,
+    distributionImagesPredicateLockRefusal,
+    imageDeliveryEntitlementRefusal,
+    producerWorkflowPinRefusal,
   };
 }
 
@@ -1086,6 +1119,10 @@ function listBiomeManifestsAt(directory, repo, commit) {
       rel,
       repo,
       path,
+      // The manifest's directory in its repository, and a reader of any file of
+      // that repository at the SAME pinned commit (the host's pnpm-lock.yaml).
+      manifestDirectory,
+      readRepositoryText: (repoRelativePath) => readGitTextAtCommitOrNull(directory, repoRelativePath, commit),
       ...(authorizationModule === null ? {} : { authorizationModule }),
     });
   }
@@ -2058,6 +2095,16 @@ export async function manifestToIndexEntry({ raw, generatedIndex, rel, repo, pat
                     .filter((name) => typeof name === 'string' && name.length > 0),
                 ),
               ].sort(compareStrings),
+              // The capabilities the signed biome declares (a delegation
+              // origination may lend only these): the manifest's
+              // `xema.exposesCapabilities`; `requires*` are what it asks for.
+              declaredCapabilities: [
+                ...new Set(
+                  (Array.isArray(xema.exposesCapabilities) ? xema.exposesCapabilities : []).filter(
+                    (ref) => typeof ref === 'string' && ref.length > 0,
+                  ),
+                ),
+              ].sort(compareStrings),
             },
           },
         }
@@ -2263,6 +2310,26 @@ export function validateServiceDependencyOwnerParity(
   return entries;
 }
 
+/**
+ * The adapter host's resolved `@xemahq/contracts` / `@xemahq/biome-sdk` versions, read from its source
+ * repository's pnpm-lock.yaml at the pinned commit. An INDEX field only: the distribution lock never carries it.
+ */
+function adapterHostPackageVersions(manifest) {
+  const services = (manifest.raw.xema.components ?? []).filter(
+    (component) => component?.kind === 'service' && component.artifact?.kind === 'oci-image',
+  );
+  if (services.length !== 1) {
+    throw new Error(`${manifest.rel}: the adapter host declares ${services.length} oci-image service components; exactly one carries its package`);
+  }
+  const lockfilePath = 'pnpm-lock.yaml';
+  return readHostPackageVersions({
+    lockfileText: manifest.readRepositoryText(lockfilePath),
+    importer: `${manifest.manifestDirectory}/${services[0].artifact.path}`,
+    lockfilePath: `${manifest.repo}/${lockfilePath}`,
+    parseYaml,
+  });
+}
+
 export async function buildBiomeIndex(
   platformServiceIndex,
   sourceRepositories = distributionBiomeSourceRepositories(),
@@ -2275,7 +2342,12 @@ export async function buildBiomeIndex(
     });
   const entries = [];
   for (const manifest of await committedBiomeManifests(sourceRepositories, authority)) {
-    entries.push(await manifestToIndexEntry(manifest));
+    const entry = await manifestToIndexEntry(manifest);
+    entries.push(
+      entry.id === ADAPTER_HOST_BIOME_ID
+        ? { ...entry, hostPackageVersions: adapterHostPackageVersions(manifest) }
+        : entry,
+    );
   }
   resolveServiceDependencyOwners(entries, platformServiceIndex);
   assertDeclaredDatabasesUnowned(entries);

package/edition/oci-evidence-verbs.mjs

@@ -32,7 +32,7 @@ import {
   isEntryModule,
 } from './edition-workspace.mjs';
 import { SHA256_DIGEST_PATTERN } from './evidence-grammars.mjs';
-import { canonicalJson, loadValidatedLocks } from './image-evidence.mjs';
+import { canonicalJson, loadValidatedImageLocks } from './image-evidence.mjs';
 import { compareStrings, loadKernelDistributionSchemas, serializeJson } from './lib.mjs';
 import {
   IMAGE_SOURCE_EVIDENCE_ARTIFACT_TYPE,
@@ -230,7 +230,7 @@ export async function planOciEvidenceBackfill({
   const missingGit = new Map();
   for (const distributionId of distributionIds) {
     assertCanonicalDistributionId(distributionId);
-    const { imageLock, repositoryPins } = await loadValidatedLocks(distributionId, data, schemas, {
+    const { imageLock, repositoryPins } = await loadValidatedImageLocks(distributionId, data, schemas, {
       editionsRoot: editions,
     });
     for (const subject of imageLock.subjects) {

package/edition/plan-image-evidence-refresh.mjs

@@ -66,7 +66,7 @@ import {
 } from './edition-workspace.mjs';
 import {
   canonicalJson,
-  loadValidatedLocks,
+  loadValidatedImageLocks,
 } from './image-evidence.mjs';
 import { assertKernelContractAuthorityEqual } from './kernel-contract-authority.mjs';
 import { compareStrings, loadKernelDistributionSchemas } from './lib.mjs';
@@ -142,7 +142,7 @@ export async function planImageEvidenceRefresh({
 
   const subjects = [];
   for (const distributionId of [...distributionIds].sort(compareStrings)) {
-    const { imageLock, repositoryPins, runtimeSourceIndex } = await loadValidatedLocks(
+    const { imageLock, repositoryPins, runtimeSourceIndex } = await loadValidatedImageLocks(
       distributionId,
       dataRootDirectory,
       schemas,

package/edition/produce-distribution-completeness-evidence.mjs

@@ -21,6 +21,7 @@ import {
   assertPinnedCosignVersion,
   buildDistributionImageEvidenceSet,
   buildDistributionImagesStatement,
+  evidenceChannelOfSigner,
   loadPinnedTrustPolicy,
   parseEvidenceCliFlags,
   resolveProducerEvidence,
@@ -59,6 +60,8 @@ export function githubWorkflowSigner({ repository, ref, path }) {
 
 /** The producer evidence and the completeness statement these inputs resolve to; deterministic. */
 async function deriveCompleteness(options, { outputRoot }) {
+  // The channel the signer signs for is the channel the lock is read on.
+  const channel = evidenceChannelOfSigner(options.signer, options.schemas);
   const resolution = {
     distributionId: options.distributionId,
     dataRoot: options.dataRoot,
@@ -66,6 +69,7 @@ async function deriveCompleteness(options, { outputRoot }) {
     schemas: options.schemas,
     expectedContractAuthority: options.expectedContractAuthority,
     registryClientFactory: options.registryClientFactory,
+    channel,
   };
   const staged = outputRoot === null
     ? await resolveProducerEvidence(resolution)
@@ -74,6 +78,7 @@ async function deriveCompleteness(options, { outputRoot }) {
     distributionLock: staged.distributionLock,
     imageLock: staged.imageLock,
     images: staged.images,
+    channel,
     releaseSequence: options.releaseSequence,
     releaseSourceCommit: options.releaseSourceCommit,
     runId: options.runId,

package/edition/produce-image-delivery-entitlement-evidence.mjs

@@ -18,6 +18,7 @@ import {
   acceptSignedEvidenceStatement,
   assertPinnedCosignVersion,
   buildImageDeliveryEntitlementStatement,
+  evidenceChannelOfSigner,
   loadPinnedTrustPolicy,
   parseEvidenceCliFlags,
   stageEvidenceStatement,
@@ -26,10 +27,11 @@ import {
   WorkspaceRoot,
   configureEditionWorkspaceFromArgv,
   dataRoot,
+  editionsRoot,
   isEntryModule,
 } from './edition-workspace.mjs';
 import { ENTITLEMENT_DESCRIPTOR_FILE, entitlementDescriptorDocument } from './image-delivery-entitlement-descriptor.mjs';
-import { canonicalJsonBytes, readCanonicalJsonFromRoot } from './image-evidence.mjs';
+import { canonicalJsonBytes, readCanonicalJsonFromRoot, readEditionDistributionLock } from './image-evidence.mjs';
 import { serializeJson } from './lib.mjs';
 import { githubWorkflowSigner } from './produce-distribution-completeness-evidence.mjs';
 import {
@@ -81,6 +83,12 @@ function deriveEntitlement(options) {
     schemas: options.schemas,
   });
   const statement = buildImageDeliveryEntitlementStatement({
+    distributionLock: readEditionDistributionLock(
+      options.editionsRoot,
+      options.distributionId,
+      options.schemas,
+      evidenceChannelOfSigner(options.signer, options.schemas),
+    ),
     distributionId: options.distributionId,
     completenessStatementDigest,
     customerId: options.customerId,
@@ -226,6 +234,7 @@ const SHARED_FLAGS = Object.freeze([
 async function main() {
   const [phase, ...args] = configureEditionWorkspaceFromArgv(process.argv.slice(2), [
     WorkspaceRoot.Data,
+    WorkspaceRoot.Editions,
     WorkspaceRoot.Kernel,
   ]);
   if (phase !== 'stage' && phase !== 'accept') {
@@ -240,6 +249,7 @@ async function main() {
   const options = {
     distributionId: flags.require('distribution'),
     evidenceRoot: resolve(flags.require('evidence-root')),
+    editionsRoot: editionsRoot(),
     stagingDirectory: resolve(flags.require('staging')),
     schemas,
     policy: loadPinnedTrustPolicy({ dataRoot: dataRoot(), schemas }),

package/edition/release-catalogue.mjs

@@ -5,14 +5,15 @@ import { readFileSync } from 'node:fs';
 import { biomeSourceTreeIds } from './biome-content.mjs';
 import { buildCatalogue } from './catalogue.mjs';
 import { EditionChannel } from './edition-constants.mjs';
-import { biomeIndexPath, platformServiceIndexPath, runtimeImageSourceIndexPath } from './edition-workspace.mjs';
+import { biomeIndexPath, kernelPackageDir, platformServiceIndexPath, runtimeImageSourceIndexPath } from './edition-workspace.mjs';
+import { kernelPackageOfAuthority } from './kernel-package.mjs';
 import { loadKernelDistributionSchemas } from './lib.mjs';
 import { loadEditionManifest } from './resolve-distribution.mjs';
 import { externalSourceTrees, sourceTreeLocator } from './resolve-images.mjs';
 import { committedRepositoryPins, createPinnedSourceAuthority } from './source-authority.mjs';
 
 /** The catalogue of release offering `id`, from the committed locks (`locks` as `readCommittedEdition` returns them). */
-export async function releaseCatalogue(id, locks) {
+export async function releaseCatalogue(id, locks, { fetchKernelTarball } = {}) {
   const schemas = await loadKernelDistributionSchemas();
   const authority = createPinnedSourceAuthority({ pins: committedRepositoryPins() });
   // The WRITER of the catalogue's tree ids: the real `git rev-parse <commit>:<path>` of every biome.
@@ -23,6 +24,7 @@ export async function releaseCatalogue(id, locks) {
     locate: sourceTreeLocator(externalSourceTrees(locks.distributionLock)),
     vendoredCommit: (repo) => authority.vendoredSourceCommitForRepository(repo),
   });
+  const contractAuthority = schemas.parseRuntimeImageSourceIndex(JSON.parse(readFileSync(runtimeImageSourceIndexPath(), 'utf8'))).contractAuthority;
   return buildCatalogue({
     sourceTreeIds,
     offeringId: id,
@@ -32,7 +34,12 @@ export async function releaseCatalogue(id, locks) {
     chartSetLock: locks.chartSetLock,
     biomeIndex: JSON.parse(readFileSync(biomeIndexPath(), 'utf8')),
     platformServiceIndex: schemas.parsePlatformServiceSourceIndex(JSON.parse(readFileSync(platformServiceIndexPath(), 'utf8'))),
-    contractAuthority: schemas.parseRuntimeImageSourceIndex(JSON.parse(readFileSync(runtimeImageSourceIndexPath(), 'utf8'))).contractAuthority,
+    contractAuthority,
+    kernel: await kernelPackageOfAuthority({
+      kernelPackageDir: kernelPackageDir(),
+      contractAuthority,
+      ...(fetchKernelTarball === undefined ? {} : { fetchTarball: fetchKernelTarball }),
+    }),
     leaf: loadEditionManifest(schemas.parseDistribution, id),
   });
 }

package/edition/resolve-chart-set.mjs

@@ -82,7 +82,7 @@ import {
 } from './registry-credentials.mjs';
 
 if (isEntryModule(import.meta.url)) {
-  configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Deploy, WorkspaceRoot.Kernel]);
+  configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Kernel], { refuseOthers: true });
 }
 
 export const CHART_SET_LOCK_FILE = 'chart-set.lock.json';

package/edition/resolve-customer-edition.mjs

@@ -18,6 +18,7 @@ import { mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 
+import { adapterHostRow, assertAdapterBundlesMatchHost, fetchRegistryManifest } from './adapter-bundled-versions.mjs';
 import { AUTHORIZATION_LOCK_FILENAME, writeAuthorizationLock } from './authorization-base.mjs';
 import { CATALOGUE_FILE, CatalogueError } from './catalogue.mjs';
 import {
@@ -29,8 +30,8 @@ import {
 import { assertRosteredChartSetLock } from './edition-chart-set.mjs';
 import { EditionLockFile } from './edition-constants.mjs';
 import { editionsRoot } from './edition-workspace.mjs';
-import { validateKernelContractAuthorityFromGit } from './kernel-contract-authority.mjs';
-import { compareStrings, loadKernelDistributionSchemas, serializeJson, validateImmutableImageLock } from './lib.mjs';
+import { adoptCatalogueKernel } from './kernel-package.mjs';
+import { compareStrings, serializeJson, validateImmutableImageLock } from './lib.mjs';
 import { pinnedSource, snapshotPinSource } from './pin-source.mjs';
 import { composeAuthorizationBase, composeManifest, resolveDistributionWithIndex, UnknownSelectionError } from './resolve-distribution.mjs';
 import { resolveImageRows } from './resolve-images.mjs';
@@ -63,11 +64,22 @@ function catalogueCeiling(catalogue, schemas) {
   return { trustPolicy: read('trustPolicy', schemas.DistributionTrustPolicySchema), trustCeiling: read('trustCeiling', schemas.ProcessTrustPolicySchema) };
 }
 
+/** A catalogue whose ceiling states no trust-domain assignments reserves no domain: the kernel's required ceiling argument is the empty policy. */
+const NO_CATALOGUE_TRUST_CEILING = Object.freeze({ assignments: [] });
+
+/** The kernel's `customerLockCeilingIssues` is the one check of a customer lock against the catalogue's ceiling. */
+function assertLockWithinCatalogueCeiling({ catalogue, definition, lock, schemas }) {
+  const issues = schemas.customerLockCeilingIssues(catalogueCeiling(catalogue, schemas).trustCeiling, lock.biomes);
+  if (issues.length > 0) {
+    throw new CatalogueCeilingError(`catalogue "${catalogue.offeringId}" (${catalogue.channel}): "${definition.id}" is outside the catalogue's trustCeiling: ${issues.join('; ')}`);
+  }
+}
+
 /**
  * The ceiling policy the customer's lock is written under: the catalogue's assignments, then
  * the definition's for what the catalogue leaves open. An assignment of the definition that
  * names a domain the catalogue assigns, or a biome the catalogue places, is not carried: the
- * catalogue's reading stands, and `assertWithinCatalogueCeiling` refuses the difference.
+ * catalogue's reading stands, and the kernel's `customerLockCeilingIssues` refuses the difference in the lock.
  */
 function ceilingUnderCatalogue(catalogueTrustCeiling, definitionTrustCeiling) {
   if (catalogueTrustCeiling === undefined) {return definitionTrustCeiling;}
@@ -80,25 +92,6 @@ function ceilingUnderCatalogue(catalogueTrustCeiling, definitionTrustCeiling) {
   return { assignments: [...catalogueTrustCeiling.assignments, ...open] };
 }
 
-/**
- * Every customer-source biome sits in the domain its definition names, and that is the domain
- * the catalogue's ceiling admits for it: the lock row carries the kernel's derivation
- * (`deriveTrustCeiling`) under `ceilingUnderCatalogue`, so a definition that reaches into a
- * domain the catalogue assigns, or moves a biome the catalogue places, differs from it here.
- */
-function assertWithinCatalogueCeiling({ catalogue, definition, lock, schemas }) {
-  const stated = new Map((definition.trustCeiling?.assignments ?? []).flatMap((assignment) => assignment.biomes.map((biome) => [biome, assignment.domain])));
-  for (const biome of lock.biomes.filter((candidate) => candidate.source !== undefined)) {
-    const admitted = biome.trustCeiling ?? schemas.defaultTrustDomain(biome.id, biome.origin);
-    if (stated.get(biome.id) !== admitted) {
-      throw new CatalogueCeilingError(
-        `catalogue "${catalogue.offeringId}" (${catalogue.channel}): "${definition.id}" assigns biome "${biome.id}" to trust domain ` +
-          `"${stated.get(biome.id)}", and the catalogue's trustCeiling admits "${admitted}" for it`,
-      );
-    }
-  }
-}
-
 /** `{name -> {imageRegistry, imageNamePrefix}}` from repeated `<source>=<registry>/<prefix>` values; the prefix is the text after the last "/". */
 export function parseSourceImages(values) {
   const byName = new Map();
@@ -247,8 +240,10 @@ export async function resolveCustomerImages({ id, catalogue, lock, composed, sch
   if (ownBiomes.length > 0) {
     const ownLock = { ...lock, biomes: ownBiomes, platformServices: [] };
     const runtimeImageSourceIndex = {
+      schemaVersion: 2,
       contractAuthority: catalogue.contractAuthority,
       repositoryPins: [],
+      producerWorkflowPins: [],
       platformServiceBindings: [],
       supplementalSubjects: [],
       crossRepoBuildInputs: [],
@@ -278,14 +273,9 @@ export async function resolveCustomerImages({ id, catalogue, lock, composed, sch
   return merged;
 }
 
-/** The kernel at --kernel must carry the contract the catalogue's offering was resolved under. */
-export async function assertKernelAtCatalogueAuthority(catalogue, schemas) {
-  await validateKernelContractAuthorityFromGit({ authority: catalogue.contractAuthority, schemas, requireHeadMatch: false });
-}
-
 /**
  * The distribution and authorization locks of the customer edition `rawDefinition`
- * against `catalogue`. `catalogueDigest` is the digest of `catalogue`, written into the lock. `verifyAuthority` and `materialize` are injectable for the test suites.
+ * against `catalogue`. `catalogueDigest` is the digest of `catalogue`, written into the lock. `adoptKernel` (the catalogue's kernel from npm, proved its contract authority; returns the kernel schemas) and `materialize` are injectable for the test suites.
  */
 export async function resolveCustomerDistribution({
   rawDefinition,
@@ -294,10 +284,11 @@ export async function resolveCustomerDistribution({
   sourceImages,
   pins,
   materialize,
-  verifyAuthority = assertKernelAtCatalogueAuthority,
+  adoptKernel = adoptCatalogueKernel,
+  fetchManifest = fetchRegistryManifest,
 }) {
   if (catalogueDigest === undefined) {throw new CatalogueError('a customer resolve names the digest of its catalogue');}
-  const schemas = await loadKernelDistributionSchemas();
+  const schemas = await adoptKernel(catalogue);
   const { definition, mirror } = parseCustomerDefinition(schemas, rawDefinition);
   const composed = composeCustomerEdition({ schemas, definition, mirror, catalogue, sourceImages, pins });
   const id = composed.leaf.id;
@@ -312,9 +303,14 @@ export async function resolveCustomerDistribution({
     throw error;
   }
   const { lock, index } = resolved;
-  assertTrustCeilingAssignsCustomerBiomes(schemas, definition, lock.biomes.filter((biome) => biome.source !== undefined).map((biome) => biome.id));
-  assertWithinCatalogueCeiling({ catalogue, definition, lock, schemas });
-  await verifyAuthority(catalogue, schemas);
+  assertTrustCeilingAssignsCustomerBiomes(
+    schemas,
+    definition,
+    lock.biomes.filter((biome) => biome.source !== undefined).map((biome) => biome.id),
+    catalogueCeiling(catalogue, schemas).trustCeiling ?? NO_CATALOGUE_TRUST_CEILING,
+  );
+  assertLockWithinCatalogueCeiling({ catalogue, definition, lock, schemas });
+  await assertAdapterBundlesMatchHost({ lock, hostRow: adapterHostRow(catalogue.biomes), fetchManifest });
   const authorizationLock = await composeAuthorizationBase(id, lock, index);
   // A customer lock names the catalogue it was resolved against; seal and verify refuse any other.
   return { id, schemas, composed, inputs, lock: { ...lock, catalogueDigest }, authorizationLock };