@xemahq/xema 0.29.1 → 0.31.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +60 -389
- package/dist/cli.d.ts.map +1 -1
- package/dist/cli.js +1 -1
- package/dist/cli.js.map +1 -1
- package/dist/commands/edition.js +3 -3
- package/dist/commands/edition.js.map +1 -1
- package/dist/dev/infra-preflight.js +1 -1
- package/dist/dev/infra-preflight.js.map +1 -1
- package/dist/edition/verify-image-evidence.bundle.mjs +10030 -1491
- package/dist/edition/verify-image-evidence.bundle.provenance.json +953 -419
- package/dist/runtime/runner/helm-cli.d.ts.map +1 -1
- package/dist/runtime/runner/helm-cli.js.map +1 -1
- package/dist/runtime/store-submit.d.ts.map +1 -1
- package/dist/runtime/store-submit.js.map +1 -1
- package/edition/README.md +50 -271
- package/edition/adapter-bundled-versions.mjs +107 -0
- package/edition/adapter-host-versions.mjs +41 -0
- package/edition/assemble-producer-input.mjs +1 -1
- package/edition/authorization-base.mjs +18 -9
- package/edition/biome-content.mjs +6 -0
- package/edition/build-platform-service-index.mjs +2 -0
- package/edition/build-runtime-image-source-index.mjs +97 -9
- package/edition/catalogue.mjs +20 -13
- package/edition/checkout-indexed-source-repositories.mjs +41 -6
- package/edition/customer-definition.mjs +3 -20
- package/edition/develop-customer-edition.mjs +2 -2
- package/edition/develop-edition-resolve.mjs +10 -2
- package/edition/develop-edition.mjs +56 -62
- package/edition/develop-freeze.mjs +14 -3
- package/edition/dispatched-runtime-components.mjs +82 -0
- package/edition/dist-check.mjs +1 -0
- package/edition/distribution-evidence-set.mjs +32 -5
- package/edition/edition-channel.mjs +15 -1
- package/edition/edition-locks.mjs +16 -6
- package/edition/edition-protocol.mjs +30 -8
- package/edition/edition-workspace.mjs +8 -0
- package/edition/external-source-walk.mjs +1 -1
- package/edition/image-evidence.mjs +134 -26
- package/edition/kernel-capability-domain.mjs +30 -0
- package/edition/kernel-package.mjs +193 -0
- package/edition/lib.mjs +192 -4
- package/edition/oci-evidence-verbs.mjs +2 -2
- package/edition/operation-grant-admission.mjs +70 -0
- package/edition/operation-requirements.mjs +128 -0
- package/edition/plan-image-evidence-refresh.mjs +2 -2
- package/edition/platform-lock-readability.mjs +2 -2
- package/edition/platform-service-class.mjs +42 -0
- package/edition/platform-service-ownership.mjs +78 -0
- package/edition/produce-distribution-completeness-evidence.mjs +5 -0
- package/edition/produce-image-delivery-entitlement-evidence.mjs +11 -1
- package/edition/release-catalogue.mjs +10 -3
- package/edition/remedy-command.mjs +2 -2
- package/edition/resolve-chart-set.mjs +1 -1
- package/edition/resolve-customer-edition.mjs +33 -34
- package/edition/resolve-distribution.mjs +70 -16
- package/edition/resolve-edition.mjs +3 -2
- package/edition/resolve-images.mjs +65 -4
- package/edition/seal-image-digests.mjs +17 -5
- package/edition/trust-policy-arming-verb.mjs +2 -10
- package/edition/verify-image-evidence.mjs +1 -0
- package/examples/README.md +3 -2
- package/package.json +4 -4
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"helm-cli.d.ts","sourceRoot":"","sources":["../../../src/runtime/runner/helm-cli.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"helm-cli.d.ts","sourceRoot":"","sources":["../../../src/runtime/runner/helm-cli.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAiB7C,eAAO,MAAM,uBAAuB,kCAAkC,CAAC;AAEvE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,qBAAa,OAAO;IAClB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;gBAEpC,IAAI,GAAE,cAAmB;IAMrC,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ9C,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAItD,OAAO,CAAC,GAAG;IAiBL,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IASnD,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAM7B,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC;IAS5B,iBAAiB,IAAI,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC;IAoBzD,gBAAgB,CACpB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IA4BvC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA6B9E,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoC9D,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD;AAMD,oBAAY,iBAAiB;IAC3B,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,WAAW,gBAAgB;IAC3B,UAAU,eAAe;IACzB,MAAM,WAAW;IACjB,YAAY,iBAAiB;IAC7B,cAAc,oBAAoB;IAClC,cAAc,oBAAoB;IAClC,eAAe,qBAAqB;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;CACpC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"helm-cli.js","sourceRoot":"","sources":["../../../src/runtime/runner/helm-cli.ts"],"names":[],"mappings":";;;AAAA,2DAAqD;
|
|
1
|
+
{"version":3,"file":"helm-cli.js","sourceRoot":"","sources":["../../../src/runtime/runner/helm-cli.ts"],"names":[],"mappings":";;;AAAA,2DAAqD;AAsBxC,QAAA,sBAAsB,GAAG,MAAM,CAAC;AAiBhC,QAAA,uBAAuB,GAAG,+BAA+B,CAAC;AAQvE,MAAa,OAAO;IACD,GAAG,CAAS;IAEpB,SAAS,CAAS;IACV,UAAU,CAAqB;IAEhD,YAAY,OAAuB,EAAE;QACnC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,8BAAsB,CAAC;QACxF,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED,IAAI,CAAC,IAAuB;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAMD,YAAY,CAAC,IAAuB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;IAEO,GAAG,CAAC,IAAuB;QACjC,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAA,6BAAQ,EAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBAC1F,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBACpF,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,SAAS,CAAC,IAAuB;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAGD,KAAK,CAAC,SAAS;QACb,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACzD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/B,CAAC;IAGD,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACjE,CAAC;IAOD,KAAK,CAAC,iBAAiB;QACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;YAC1B,MAAM;YACN,aAAa;YACb,IAAI,CAAC,SAAS;YACd,IAAI;YACJ,MAAM;SACP,CAAC,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IAOD,KAAK,CAAC,gBAAgB,CACpB,OAAe;QAEf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;YAC1B,KAAK;YACL,QAAQ;YACR,OAAO;YACP,aAAa;YACb,IAAI,CAAC,SAAS;YACd,IAAI;YACJ,MAAM;SACP,CAAC,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAEpB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,mBAAmB,OAAO,iCAAiC,CAC5D,CAAC;QACJ,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAOD,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,OAAe,EAAE,WAAmB;QAC1D,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9F,CAAC;IA2BD,KAAK,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QAClD,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EACjB,IAAI,CAAC,GAAG,EACR,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,CAAC,EACvE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,CACzC,CAAC;YACF,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACxC,MAAM,IAAI,KAAK,CAAC;YAClB,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,OAAO,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,IAAI,CAAC,GAAG,mBAAmB,IAAI,iBAAiB,MAAM,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CACrF,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAChC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,SAAS,CAAC,OAAe;QAC7B,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACzE,CAAC;CACF;AAvLD,0BAuLC;AAMD,IAAY,iBAUX;AAVD,WAAY,iBAAiB;IAC3B,wCAAmB,CAAA;IACnB,0CAAqB,CAAA;IACrB,gDAA2B,CAAA;IAC3B,8CAAyB,CAAA;IACzB,sCAAiB,CAAA;IACjB,kDAA6B,CAAA;IAC7B,uDAAkC,CAAA;IAClC,uDAAkC,CAAA;IAClC,yDAAoC,CAAA;AACtC,CAAC,EAVW,iBAAiB,iCAAjB,iBAAiB,QAU5B;AASD,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,QAAQ,GACZ,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACjC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACtC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACtB,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,CAAC,MAAM,KAAK,CAAC;QACjB,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,MAAM,KAAK,CAAC;QACtB,OAAO,MAAM,KAAK,QAAQ;QAC1B,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACxD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,MAAM,CACpC,CAAC;IACF,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,SAAS,IAAI,GAAG,CACrE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,SAAS;QACT,QAAQ,EAAE,QAAkB;QAC5B,MAAM,EAAE,YAAY;KACrB,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"store-submit.d.ts","sourceRoot":"","sources":["../../src/runtime/store-submit.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAI5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAUnD,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,GAAG,QAAQ;CACZ;AAkBD,eAAO,MAAM,6BAA6B,gBAAgB,CAAC;AAG3D,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;
|
|
1
|
+
{"version":3,"file":"store-submit.d.ts","sourceRoot":"","sources":["../../src/runtime/store-submit.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAI5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAUnD,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,GAAG,QAAQ;CACZ;AAkBD,eAAO,MAAM,6BAA6B,gBAAgB,CAAC;AAG3D,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAiBD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAWnE;AA+CD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AA+CD,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE;IACL,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GACA,OAAO,CAAC,YAAY,CAAC,CAavB;AAGD,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IACL,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAC1D,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxD,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB,GACA,OAAO,CAAC,gBAAgB,CAAC,CAiB3B"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"store-submit.js","sourceRoot":"","sources":["../../src/runtime/store-submit.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"store-submit.js","sourceRoot":"","sources":["../../src/runtime/store-submit.ts"],"names":[],"mappings":";;;AA6EA,wEAWC;AAmGD,4CAoBC;AAGD,oDA8BC;AA/ND,wDAA4E;AAC5E,kDAA8D;AAC9D,kDAAuD;AAYvD,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,gCAAW,CAAA;AACb,CAAC,EAHW,iBAAiB,iCAAjB,iBAAiB,QAG5B;AAkBY,QAAA,6BAA6B,GAAG,aAAa,CAAC;AAG3D,MAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AALD,sDAKC;AAiBD,SAAgB,8BAA8B,CAAC,MAAc;IAC3D,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,qBAAqB,CAC7B,qEAAqE;YACnE,qEAAqE;YACrE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,kCAAkC,CACrC,CAAC;IACJ,CAAC;AACH,CAAC;AAkED,KAAK,UAAU,KAAK,CAClB,MAA0B,EAC1B,IAAY,EACZ,IAAa;IAEb,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;IACvC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,GAAG,IAAA,2BAAW,EAAC,MAAM,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACvE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,IAAA,qBAAQ,EACb,4BAAe,CAAC,YAAY,EAC5B,6BAA6B,GAAG,KAAK,MAAM,EAAE,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,IAAA,qBAAQ,EACb,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,4BAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,4BAAe,CAAC,YAAY,EAC5E,mBAAmB,IAAI,MAAM,GAAG,CAAC,MAAM,IAAI;YACzC,IAAA,+BAAkB,EAAC,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAM,CAAC;AACxD,CAAC;AAGM,KAAK,UAAU,gBAAgB,CACpC,MAA0B,EAC1B,KAIC;IAED,MAAM,IAAI,GAAsB;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,iBAAiB,CAAC,GAAG;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,MAAM,EACN,WAAW,EACX,IAAI,CACL,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAGM,KAAK,UAAU,oBAAoB,CACxC,MAA0B,EAC1B,SAAiB,EACjB,KASC;IAED,MAAM,IAAI,GAAsB;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,MAAM,EACN,aAAa,kBAAkB,CAAC,SAAS,CAAC,WAAW,EACrD,IAAI,CACL,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC"}
|
package/edition/README.md
CHANGED
|
@@ -16,7 +16,7 @@ no defaults.
|
|
|
16
16
|
| `--data-root` | catalogue indices (`biome-index.json`, `platform-service-index.json`, `runtime-image-source-index.json`), `chart-set.lock.json`, and `edition-workspace.json` |
|
|
17
17
|
| `--editions-root` | the `<edition-id>/` definitions and locks |
|
|
18
18
|
| `--sources-root` | source checkouts at `repos/<r>` and `submodules/<r>` |
|
|
19
|
-
| `--kernel` | the BUILT `kernel-contracts` package directory |
|
|
19
|
+
| `--kernel` | the BUILT `kernel-contracts` package directory (vendor verbs only; a customer verb takes none) |
|
|
20
20
|
| `--deploy-root` | the `xema-deploy` checkout |
|
|
21
21
|
| `--cache-dir` | a writable directory for fetched artifacts |
|
|
22
22
|
|
|
@@ -28,7 +28,7 @@ Each takes the roots below plus its own arguments (`--check`, an edition id, ...
|
|
|
28
28
|
| --- | --- |
|
|
29
29
|
| `resolve-distribution.mjs` | data, editions, sources, kernel |
|
|
30
30
|
| `resolve-images.mjs` | data, editions, sources, kernel, cache |
|
|
31
|
-
| `resolve-chart-set.mjs` | data, editions,
|
|
31
|
+
| `resolve-chart-set.mjs` | data, editions, kernel |
|
|
32
32
|
| `edition-biome-manifests.mjs` | data, editions, sources, kernel |
|
|
33
33
|
| `seal-image-digests.mjs` | data, editions, kernel |
|
|
34
34
|
| `verify-image-platforms.mjs` | data, editions, kernel |
|
|
@@ -59,292 +59,71 @@ Read strictly: every key is required, an unknown key or a duplicate key is refus
|
|
|
59
59
|
}
|
|
60
60
|
```
|
|
61
61
|
|
|
62
|
-
- `imageRegistry`: `<host>/<namespace
|
|
63
|
-
- `chartRegistry
|
|
64
|
-
- `
|
|
65
|
-
- `
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
- `armed`: the data root declares a policy, the policy hashes to its data-root pin, this CLI's verifier is the pinned one, and the policy is ARMED on the channel of the edition.
|
|
85
|
-
- `not-armed`: a develop edition only, whose data root declares no policy or one that is not armed on the develop channel. A release edition never records `not-armed`.
|
|
86
|
-
|
|
87
|
-
Arming is judged for ONE channel, the channel of the edition being checked, sealed or written: a channel is ARMED when the policy authorizes a signer for each of the three predicates on that channel and pins the cosign and the git binary. The signers of the other channel count for nothing, so a policy with release signers only is ARMED for a release edition. The develop channel admits not-armed: a develop edition is written when its channel has no signer, and prints one line on stderr (`develop channel: trust policy not armed, evidence is not signature-verified`). A verification of signed develop evidence is satisfied by develop signers only.
|
|
88
|
-
|
|
89
|
-
A release edition requires an armed evidence trust policy, with no switch: while the policy is not armed on the release channel (none declared, or declared but UNARMED or PARTIALLY ARMED there), writing a release descriptor or artifact (`xema edition artifact`) is REFUSED with `EvidenceTrustRequiredError`, code `EVIDENCE_TRUST_REQUIRED_UNARMED`, message "a release edition requires an armed evidence trust policy". The descriptor builder itself refuses a release descriptor that is not `armed`, so no route writes one. A channel that is PARTIALLY ARMED is refused on either channel. Both `artifact` and `develop resolve` (and `develop check-existing`) hold the policy to its pin and the verifier to the pinned one before recording a state: a policy edited after pinning or a drifted verifier is refused.
|
|
90
|
-
|
|
91
|
-
`xema edition check` runs one evidence-trust gate, and it FAILS when the editions tree holds a release edition while the policy is not ARMED on the release channel (none declared, UNARMED or PARTIAL): the refusal names the release editions and the repair, and states that no release edition of the data root can be published as an artifact (written by `xema edition artifact`) until the policy is armed on the release channel. A release edition is an edition directory (one holding `xema-distribution.json`) that holds a release lock (`distribution.lock.json` or `authorization.lock.json`); a develop resolve writes nothing into an editions tree. A tree holding no release edition passes for develop-only use with the same statement as a notice. `xema edition seal` is not gated by the policy: nothing sealed leaves without `xema edition artifact`. With no policy declared the gate also refuses a data root that holds an
|
|
92
|
-
undeclared policy (a top-level `*.json` the kernel parses as an offline trust policy, or a
|
|
93
|
-
`trust/` directory). With one declared it parses the policy with the kernel schema, checks the
|
|
94
|
-
Sigstore trusted root the policy itself names (`trustedRootPath`, resolved against the data root,
|
|
95
|
-
and `trustedRootDigest`), checks the pin file, and classifies the authority configuration of each channel: no
|
|
96
|
-
signer on the channel is UNARMED (on the release channel it fails when the tree holds a release edition and otherwise passes with the notice; on the develop channel it passes with the not-armed line), mixed is PARTIAL (refused on either channel, with
|
|
97
|
-
what is unmet), complete is ARMED.
|
|
98
|
-
|
|
99
|
-
The pin file (strict JSON, exact keys) is reviewed data:
|
|
100
|
-
|
|
101
|
-
```json
|
|
102
|
-
{ "schemaVersion": 2,
|
|
103
|
-
"policyDigest": "sha256:<canonical-json digest of the parsed policy>",
|
|
104
|
-
"verifier": { "bundleDigest": "sha256:<bytes>", "provenanceDigest": "sha256:<bytes>" },
|
|
105
|
-
"kernelContractAuthority": { "sourceCommit": "<40 hex>", "digest": "sha256:<canonical-json digest of the whole authority>" },
|
|
106
|
-
"trustedOrasBinaryDigests": ["sha256:<bytes of an oras binary>"] }
|
|
62
|
+
- `imageRegistry`: `<host>/<namespace>` where first-party images are addressed.
|
|
63
|
+
- `chartRegistry`, `chartPublishers`: where chart-set indexes and charts are published. Vendor only; declare both or neither.
|
|
64
|
+
- `sourceRepositoryUrlPrefix`, `sourceAuthUsername`: the prefix every first-party source URL must match and the git username source tokens authenticate as. The token is read from `EVIDENCE_REPOSITORIES_TOKEN` and sent only to repositories under the prefix.
|
|
65
|
+
- `evidenceTrustPolicy`: `{policy, pin}` (data-root-relative paths) or `null` for a data root that declares no policy. A `null` data root serves develop editions only.
|
|
66
|
+
|
|
67
|
+
## Common commands
|
|
68
|
+
|
|
69
|
+
```bash
|
|
70
|
+
xema edition resolve <id> [--check] # write or verify the lock set
|
|
71
|
+
xema edition seal <id> # seal image digests
|
|
72
|
+
xema edition check # committed locks and indices are current
|
|
73
|
+
xema edition why <id> <biome> # why a biome is in an edition
|
|
74
|
+
xema edition list --editions-root <dir>
|
|
75
|
+
xema edition locks <id> --channel <release|develop> # validated locks as JSON; an unsealed distribution lock is read on develop only
|
|
76
|
+
xema edition artifact <id> --channel release --registry <ns> --coordinate <tag> --engine-image <repo>@sha256:<digest> --out <dir>
|
|
77
|
+
xema edition develop <freeze-sources|resolve|target|check-existing> ...
|
|
78
|
+
xema edition develop check-overrides --overrides <json> --data-root <dir> # data root only
|
|
79
|
+
xema edition chart-set <resolve|source-commit> ...
|
|
80
|
+
xema edition arming --channel <release|develop> --data-root <dir> --kernel <dir>
|
|
81
|
+
xema edition verify-evidence <id> --descriptor <abs path> [--json]
|
|
82
|
+
xema edition evidence <assemble-input|check-committed|plan-refresh|statement|assemble-set|oci> ...
|
|
107
83
|
```
|
|
108
84
|
|
|
109
|
-
`xema edition
|
|
110
|
-
declared policy, THIS CLI's built verifier and the kernel contract authority the data root's
|
|
111
|
-
`runtime-image-source-index.json` states. A drifted policy or a verifier that is not the pinned
|
|
112
|
-
one is refused by the check, and a missing built bundle is refused, never skipped.
|
|
113
|
-
|
|
114
|
-
- **Kernel contract authority.** Evidence is held to the authority the PIN records. The index
|
|
115
|
-
states it; an index that states another authority is refused
|
|
116
|
-
(`KERNEL_CONTRACT_AUTHORITY_NOT_PINNED_ONE`), and a data root that declares no evidence trust
|
|
117
|
-
has no authority to hold evidence to (`KERNEL_CONTRACT_AUTHORITY_UNPINNED`): no evidence verb
|
|
118
|
-
runs there. The verifier checks the same pin before it reads a statement.
|
|
119
|
-
- **oras is a trusted executable.** On a data root that declares evidence trust, the `oras`
|
|
120
|
-
binary (`XEMA_ORAS_BIN`, else the first on `PATH`, symbolic links resolved) must hash to one of
|
|
121
|
-
`trustedOrasBinaryDigests`; a private copy of exactly those bytes is what runs, re-checked on
|
|
122
|
-
every use. Without the flag a re-pin keeps the reviewed list; a first pin requires it. A data
|
|
123
|
-
root that declares no evidence trust has no pin: there oras is held to its version only, and
|
|
124
|
-
the run says so. oras always runs under a scrubbed environment (`HOME` an empty temporary
|
|
125
|
-
directory, `PATH=/usr/bin:/bin`, `LANG`, `LC_ALL`, `TZ`).
|
|
126
|
-
- **Known limits of the registry reader.** (1) A registry whose Bearer token realm is on another
|
|
127
|
-
host than the registry itself is refused with the coded error
|
|
128
|
-
`REGISTRY_TOKEN_REALM_CROSS_HOST` (`RegistryTokenRealmError`), so the pull credential is never
|
|
129
|
-
sent to a third host. Customer registries that delegate tokens to a separate auth host (for
|
|
130
|
-
example Docker Hub, or a Harbor or GitLab registry with an external token service) cannot be
|
|
131
|
-
read; there is no setting that allows it. (2) Because the environment is scrubbed, a proxy or
|
|
132
|
-
a private CA stated only in environment variables (`HTTPS_PROXY`, `SSL_CERT_FILE`) does not
|
|
133
|
-
reach oras.
|
|
134
|
-
- **Registry status.** A registry status (404, 401, 403, …) is read only from oras's own error
|
|
135
|
-
line; any other failure of the run is undecided and is thrown, never read as "absent".
|
|
136
|
-
|
|
137
|
-
### Why the verifier can be trusted (the binding)
|
|
138
|
-
|
|
139
|
-
The code under review must be the code that runs. The verifier is ONE file, the bundle
|
|
140
|
-
`dist/edition/verify-image-evidence.bundle.mjs`, built at CLI build time (`scripts/build-evidence-verifier.mjs`,
|
|
141
|
-
exact-pinned esbuild) from the CLI's own sources and its locked `@xemahq/contracts` and `zod`.
|
|
142
|
-
It ships in the npm tarball, which is immutable and integrity-addressed, so anyone can recompute
|
|
143
|
-
its digest from `@xemahq/xema@<version>`; `...bundle.provenance.json` lists every bundled input as
|
|
144
|
-
`{package, version, path in that package, sha256}` and is deterministic (building twice gives
|
|
145
|
-
identical bytes). The reviewed data root PINS the bundle's and the provenance's digests, so
|
|
146
|
-
changing the verifier needs a reviewed data-root commit. At run (`xema edition verify-evidence`,
|
|
147
|
-
which launches the built bundle with a reduced environment) the bundle refuses unless:
|
|
148
|
-
|
|
149
|
-
1. its own file (realpath of `argv[1]`) and its provenance hash to the data-root pin;
|
|
150
|
-
2. its install path and every ancestor are not group/world writable nor foreign-owned;
|
|
151
|
-
3. the environment carries no `NODE_OPTIONS`, `NODE_PATH`, `DYLD_*`, `LD_*`, `GIT_*`;
|
|
152
|
-
4. the `--kernel` it is given (the built kernel `xema edition check` proves against the authority
|
|
153
|
-
in `runtime-image-source-index.json`) declares exactly the edition protocol compiled into the
|
|
154
|
-
bundle, and this CLI supports that protocol (`edition-protocol.mjs`); nothing else about the
|
|
155
|
-
kernel is compared;
|
|
156
|
-
5. the data root and the editions root are clean git checkouts at an exact HEAD, every file read
|
|
157
|
-
from them bound to its HEAD blob, graded with a digest-pinned git binary (the completeness
|
|
158
|
-
signature is bound to the editions checkout's HEAD).
|
|
159
|
-
|
|
160
|
-
Not here, vendor-side: `require-verified-image-evidence.mjs`, `deliver-images.mjs`,
|
|
161
|
-
`delta-build-plan.mjs`, the evidence producers, and `edition-pin.mjs` (publish plane).
|
|
162
|
-
|
|
163
|
-
### Product-data sections
|
|
164
|
-
|
|
165
|
-
The library owns the protocol (the edition schema, the resolution algorithm, the closed
|
|
166
|
-
`installationClass` vocabulary, lock and seal rules, the digest format, the trust-policy
|
|
167
|
-
schema) and never product data. Every product fact below is the data root's, in the same
|
|
168
|
-
file, strictly parsed (unknown, missing or mistyped keys are refused, naming the section).
|
|
169
|
-
A section may be absent where a data root legitimately has none; the operation that needs
|
|
170
|
-
it refuses by name when it runs, and never skips.
|
|
171
|
-
|
|
172
|
-
| Section | Holds | Needed by |
|
|
173
|
-
| --- | --- | --- |
|
|
174
|
-
| `firstPartySources` | `{ "<repos/\|submodules/ handle>": "<declared source id>" }` | naming a composed-process subject after its source |
|
|
175
|
-
| `platformServiceSources` | per platform service: `name`, `tier`, `installationClass?`, `repo`, `manifestPath`, `manifestName`, `imageKey`, `runtimeBinding` (`null` or `{subjectKind, subjectId}`) | the platform service index (derived from these rows; no edition is read), image subjects, the runtime image source index |
|
|
176
|
-
| `connectorSources` | `repository`, `bindings[{id, path}]`, `nonProductionIds`, `buildInput{consumerRepo, consumerService, destinationRoot}` | biome discovery and the connector cross-repo inputs; absent means no connector repository |
|
|
177
|
-
| `runtimeImageSources` | `supplementalSources` (the host image, standing services, runtime components), `crossRepoBuildInputs`, `buildStepContextDirectories`; the `host`-kind source's repo is the one repo web biomes are delivered from | the runtime image source index, web-biome deliverability |
|
|
178
|
-
| `pinRoles` | the snapshot pin key of the `data`, `kernel` and `deploy` roles | develop snapshots |
|
|
179
|
-
| `confinedBiomes` | `[{biomeId, holds, consequence, admittedEditions}]` | the confinement check; absent means nothing is confined |
|
|
180
|
-
|
|
181
|
-
`schemaVersion` stays 1: the sections are additive, and a file written for this library is
|
|
182
|
-
refused by a library that predates them (unknown key), never mis-read.
|
|
85
|
+
Results are JSON on stdout and diagnostics on stderr. Exit 0 is success and 1 is a refusal. `xema edition <verb> --help` names the roots and flags each verb takes.
|
|
183
86
|
|
|
184
|
-
|
|
185
|
-
`--deploy-sha` (they were `--distributions-sha`, `--kernel-contracts-sha`,
|
|
186
|
-
`--xema-deploy-sha`; no aliases).
|
|
187
|
-
|
|
188
|
-
## Evidence verbs (consumed by vendor-ops)
|
|
189
|
-
|
|
190
|
-
The edition library builds, validates and verifies evidence statements. It NEVER signs: it holds no key, requests no OIDC token, and its cosign runner refuses every subcommand except `verify-blob-attestation`. A caller (vendor-ops) runs `cosign attest-blob`, `oras`, `git` and writes its own step outputs; it reads the JSON these verbs print and never parses a lock, a statement or a policy itself.
|
|
191
|
-
|
|
192
|
-
Common to all verbs: root flags `--data-root`, `--editions-root`, `--sources-root`, `--kernel` (each verb names the ones it needs); JSON results go to stdout, diagnostics to stderr; exit 0 on success, 1 on any refusal (plus 2 for `plan-refresh` when a refresh is due). The kernel contract authority every statement binds is the one the data root's evidence-trust pin records (see Evidence trust); the trust policy is the one `edition-workspace.json` declares, held to its pin.
|
|
193
|
-
|
|
194
|
-
| Verb | Arguments | Result |
|
|
195
|
-
|---|---|---|
|
|
196
|
-
| `xema edition chart-set resolve [--check]` | roots `--data-root --editions-root --deploy-root --kernel` | what `node resolve-chart-set.mjs` did: pins `chart-set.lock.json` and every edition's copy to the charts the registry serves; `--check` writes nothing and fails when the pin is stale. The index chart is pinned by the manifest digest the registry served at resolve, and every later read is by that digest; WHO signed the index is not verified by the CLI (the control is the reviewed lock commit) |
|
|
197
|
-
| `xema edition chart-set source-commit` | roots `--data-root --kernel`, env the registry credential variables the data root declares | read-only: for each publisher of the committed `chart-set.lock.json` it fetches the index chart by the LOCKED `indexDigest` (a develop publisher, `indexDigest: null`, is refused) and prints `{"schema":"xema.edition-chart-set-source/v1","publishers":[{"index","repo","version","sourceCommit"}]}` (the `xema.dev/chart-set-source-sha` annotation). It prints nothing and exits non-zero when the registry serves another digest, when the annotation is absent or not 40 lowercase hex, or when the index's roster differs from the charts the lock records for that publisher |
|
|
198
|
-
| `xema edition biome-manifests <id> --json` | `--data-root --editions-root --sources-root --kernel` | `{"schema":"xema.edition-biome-manifests/v1","distributionId","biomes":[{"id","repo","sourceCommit","manifest"}]}` sorted by id: each biome's `xema-biome.json` read at the commit its lock pins; an absent lock or an unreadable manifest is refused with nothing on stdout |
|
|
199
|
-
| `xema edition arming --channel <release\|develop>` | `--data-root --kernel` | read-only: `{"channel","state":"armed\|unarmed\|partial","unmet":[…]}` on one stdout line; exits 0 only when the declared evidence trust policy is `armed` on that channel, 1 otherwise (each unmet entry on stderr; a data root declaring no policy is `unarmed`), 2 for a usage error |
|
|
200
|
-
| `xema edition list` | `--editions-root` | `{"schemaVersion":1,"editions":["<id>",…]}`; an empty root is refused |
|
|
201
|
-
| `xema edition locks <id>` | `--data-root --editions-root --kernel` | `{"schemaVersion":1,"distributionId","contractAuthority","distributionLock","imageLock","repositoryPins":[…]}`, validated as the verifier validates them |
|
|
202
|
-
| `xema edition evidence assemble-input` | `--output <file> --image-repository --manifest-digest --subject-kind --subject-id --source-repo --source-path --source-commit --provenance <file> [--source-manifest-hash] [--source-tree-hash] [--ttl-seconds]`, roots `--data-root --sources-root --kernel`, env `GITHUB_*` workflow context and the registry credential variables the data root declares | writes the producer-input JSON (mode 0600, never overwrites); reads the registry with the pinned oras |
|
|
203
|
-
| `xema edition evidence check-committed` | `--input <file> --repository-root <dir> [--github-output <file>] [--now <epoch-ms>]`, roots `--data-root --kernel` | prints `REUSE`/`PRODUCE <directory>: <reason>`; with `--github-output` appends `reusable`, `evidence-directory`, `reason` |
|
|
204
|
-
| `xema edition evidence plan-refresh` | `--distribution <id>… [--horizon-seconds] [--now] [--github-output <file>] [--kernel-checkout exact\|preview]`, roots `--data-root --editions-root --kernel` | prints the plan; exit 2 when a refresh is due; `--github-output` appends `refresh-due`, `due-subjects`, `total-subjects`, `due-repositories`; producer evidence is read only from the OCI referrers of each locked image. `--kernel-checkout exact` (default) loads the kernel from a clean checkout at the pinned authority commit; `preview` uses the kernel built at `--kernel`, held to no commit: it prints `LOCAL PREVIEW` and refuses `--github-output` |
|
|
205
|
-
| `xema edition evidence statement producer stage` | `--input <file> --staging <abs dir> --github-repository --github-ref --github-sha --github-workflow-ref`, roots `--data-root --kernel` | creates the staging directory with `statements/<stem>.json`; prints the signing plan |
|
|
206
|
-
| `xema edition evidence statement producer accept` | the `stage` flags plus `--output <abs dir> --cosign <abs path>` | verifies each bundle, builds the output from the statements the input derives and the canonical verified bundles ONLY (the staging must hold exactly what `stage` recorded), writes `producer-evidence.json`, and removes the staging whether it succeeds or refuses; the cosign version is the trust policy's `cosignVersion`; prints `{"schemaVersion":1,"kind":"producer","outputDirectory","producerEvidence":[…]}` |
|
|
207
|
-
| `xema edition evidence statement completeness stage` | `--distribution --staging <abs dir> --release-sequence --release-source-commit --run-id --run-attempt --issued-at --expires-at --signer-repository --signer-ref --signer-workflow-path --github-repository --github-ref --github-sha --github-workflow-ref `, roots `--data-root --editions-root --kernel` | stages the edition's producer evidence under `producers/` and `completeness/statement.json`; prints the signing plan |
|
|
208
|
-
| `xema edition evidence assemble-set` | the completeness `stage` flags plus `--evidence-root <abs dir> --cosign <abs path>` | re-resolves the producer evidence (it must equal the staged copy), verifies the signed completeness bundle, writes `evidence-set.json`, builds the evidence root from the derived files ONLY (the staging must hold exactly what `stage` recorded) and removes the staging whether it succeeds or refuses; prints `{"schemaVersion":1,"kind":"evidence-set","distributionId","evidenceRoot","evidenceSetPath","producerBundles","completenessStatementDigest"}` |
|
|
209
|
-
| `xema edition evidence statement entitlement stage` | `--distribution --evidence-root <dir> --staging <abs dir> --customer --mode [--target-registry] --idempotency-key --run-id --run-attempt --issued-at --expires-at --signer-repository --signer-ref --signer-workflow-path --github-repository --github-ref --github-sha --github-workflow-ref`, roots `--data-root --kernel` | writes `entitlement/statement.json`; prints the signing plan |
|
|
210
|
-
| `xema edition evidence statement entitlement accept` | the `stage` flags plus `--output <abs dir> --cosign <abs path>` | verifies the bundle, writes `entitlement.json`, builds the output from the derived files ONLY (the staging must hold exactly what `stage` recorded) and removes the staging whether it succeeds or refuses; prints `{"schemaVersion":1,"kind":"entitlement",…,"evidence":{…}}` |
|
|
211
|
-
| `xema edition evidence oci attach-plan` | `--evidence-directory <abs dir> [--input <file>]`, roots `--data-root --kernel` | validates a produced evidence directory (with `--input`, against the statements that input builds) and prints `{"schemaVersion":1,"kind":"oci-attach-plan","evidenceDirectory","imageRepository","subjectDigest","subject","artifactType","distributionSpec","annotations":{…},"files":[{"path","mediaType"}]}`: the operands of `oras attach`, run from the evidence directory |
|
|
212
|
-
| `xema edition evidence oci validate` | `--evidence-directory <abs dir> --manifest <file> --subject-digest <digest> [--input <file> --cosign <abs path> [--now <epoch-ms>]]`, roots `--data-root --kernel` | holds a pulled artifact (`oras pull`) to its manifest (`oras manifest fetch`); prints `{"schemaVersion":1,"kind":"oci-evidence","subjectDigest","created","subjects":[…],"matchesInput","remainingSeconds","reusable"}`. The last three are `null` without `--input`; with it every bundle is verified against the input's signer and a bundle that does not verify is a refusal |
|
|
213
|
-
| `xema edition evidence oci backfill-plan` | `--distribution <id>… --producer-repository-root <abs dir>…`, roots `--data-root --editions-root --kernel`, env the registry credential variables the data root declares | prints `{"schemaVersion":1,"kind":"oci-backfill-plan","items":[{"status":"missing-git\|present\|missing","subjectKind","subjectId","imageRepository","subjectDigest","artifactDigest","attach"?}]}`; a `missing` item carries its attach plan; exit 2 unless every item is `present` |
|
|
214
|
-
| `xema edition index runtime-image-source --repin-contract-authority --kernel-commit <40-hex>` | roots `--data-root --sources-root --kernel`; `--kernel-commit` REQUIRED (the kernel commit the authority moves to; refused with the usage when absent); `[--kernel-root <absolute-checkout>]` | replaces ONLY `contractAuthority` of the committed `runtime-image-source-index.json` with the authority read from the kernel checkout AT THE STATED COMMIT: the checkout must be clean, at the expected origin, and its HEAD must equal `--kernel-commit` (else refused, naming both commits), and that commit is what `contractAuthority.sourceCommit` records and what `xema edition repin-evidence-trust` then pins as `kernelContractAuthority.sourceCommit`. A bootstrap `--trusted-write` (no committed contract authority) chooses a commit the same way and takes the same required flag; every other mode refuses it. It validates and rewrites the index; every repository pin and subject is identical before and after. It writes the move on stdout and the owed follow-ups on stderr: `xema edition repin-evidence-trust`, re-resolving every edition (each `images.lock.json` carries the authority), and that signed producer statements made under the old authority no longer verify. `--kernel-commit` holds the checkout's HEAD to the stated commit and nothing more: there is NO ancestry or remote check, so a never-pushed local commit passes if its SHA is stated; the control is the reviewed data-root diff that carries the new `sourceCommit` |
|
|
215
|
-
| `xema edition source-closure` | `--repo <repo> --path <dir> --commit <40 hex>`, roots `--sources-root --kernel` (the hash implementation is held to the kernel) | `{"schemaVersion":1,"repo","directory","commit","treeAlgorithm","treeHash","buildable","lockfileBlobId","closure":[{"directory","treeHash"}]}`: the facts a content coordinate is framed from |
|
|
216
|
-
| `xema edition verify-evidence <id>` | see Evidence trust; `--descriptor <absolute path of the edition descriptor being verified>` (required: its `distributionId` must be the requested id and its `provenance.channel` is the channel whose signers may vouch for the evidence; it is held outside the graded checkouts like `--state`); plus `[--json]` (stdout is then exactly one `{"schema":"xema.edition-evidence-verification/v1","distributionId","channel","releaseSequence","statements":[{"predicateType","subject","statementDigest"}]}` document, where `statementDigest` is the digest of the verified statement, not of the image; the human text goes to stderr, and a failed verification prints no JSON); plus, given together or not at all, `--entitlement <evidence-root-relative path of an entitlement.json> --entitlement-workflow-sha <40-hex git sha> --customer <id> --mode <mode>` and optionally `--target-registry <registry>`: the delivery entitlement `accept` wrote is verified with the release (`--entitlement-workflow-sha` is the exact commit of the workflow run that signed the entitlement, the one its certificate is held to; it is stated by the caller and never read from the evidence; the statement and bundle are read from the directory holding `entitlement.json`), and the verification document then ends with the entitlement statement | the in-repository gate and the release-checkout grading are this verifier; there is no second one. Its result is its exit status, the advanced replay state and, with `--json`, the verification document on stdout: it writes no "already verified" file and has no file-output flag. A delivery entitlement verifies only as part of this run: a refused entitlement refuses the whole verification and the replay state does not advance. `entitlement.json` is `{schemaVersion: 2, distributionId, customerId, mode, targetRegistry, idempotencyKey, distributionStatementDigest, evidence}` with exactly those keys (`evidence` is the Sigstore evidence descriptor); every field but `evidence` is an unauthenticated convenience that must agree with the flags and the verified completeness statement, and the signed statement stays the authority |
|
|
87
|
+
## Evidence trust
|
|
217
88
|
|
|
218
|
-
The
|
|
89
|
+
The edition library builds, validates and verifies evidence statements; it never signs. Signing is done by the caller with `cosign`.
|
|
219
90
|
|
|
220
|
-
|
|
221
|
-
|
|
222
|
-
|
|
223
|
-
|
|
224
|
-
```
|
|
91
|
+
- An edition descriptor records `evidenceTrustPolicy` as `armed` or `not-armed`. A release edition requires `armed`; writing one otherwise is refused.
|
|
92
|
+
- A policy is armed on a channel when it authorizes a signer for each predicate on that channel and pins `cosign` and `git`. The develop channel admits `not-armed`.
|
|
93
|
+
- The pin file (`image-evidence-trust-policy.pin.json`) binds the policy, the built verifier bundle, the kernel contract authority and the trusted `oras` binaries. Write it with `xema edition repin-evidence-trust [--trusted-oras-digest sha256:<64 hex>]`.
|
|
94
|
+
- `oras` is located with `XEMA_ORAS_BIN` or `PATH` and must hash to a pinned digest. It runs with a scrubbed environment, so proxy and CA variables do not reach it.
|
|
225
95
|
|
|
226
|
-
|
|
96
|
+
## Kernel protocol and pins
|
|
227
97
|
|
|
228
|
-
|
|
98
|
+
The CLI is coupled to the kernel's edition protocol, not to the kernel package. `@xemahq/contracts` exports the protocol identity as data (`dist/edition-protocol/edition-protocol.json`: `{contentDigest, provisional, version}`). This CLI supports exactly protocol v5 and REFUSES an identity with `provisional: true`; every loader that executes the kernel, `xema edition check` first, and the evidence verifier compare only that identity and refuse an unsupported one, naming the supported and the declared versions. A protocol change needs a CLI release first; only then does the data root repin its kernel authority.
|
|
229
99
|
|
|
230
|
-
`
|
|
231
|
-
|
|
232
|
-
CLI's own installed `@xemahq/contracts`; nothing is supplied from outside and no test
|
|
233
|
-
skips. The two sealing cases run the real openfga/cli v0.8.1 and FAIL, naming
|
|
234
|
-
`XEMA_FGA_CLI`, when it is unset (CI installs it by checksum). `no-vendor-literals.test.mjs` fails on any organisation or
|
|
235
|
-
registry literal in a shipped file.
|
|
100
|
+
- `xema edition evidence statement entitlement stage` writes entitlement predicate v2 (`lockDigest`, `catalogueDigest`, read from the edition's committed locks), so it takes `--editions-root` besides `--data-root` and `--kernel`.
|
|
101
|
+
- The runtime image source index is v2 and carries operator-stated `producerWorkflowPins` (the workflow commit a producer certificate must be signed from, per repository). `xema edition index runtime-image-source [--producer-workflow-pin <owner/repo>=<40-hex>]...` preserves the committed pins exactly; each flag sets one repository's pin (repeatable; a repeated or non-GitHub `owner/repo` is refused; only `--trusted-write` writes an index, so the flag with any other mode, `--check-sources` included, is refused); a bootstrap index with none writes `[]`. A v1 index is not read: re-index the data root.
|
|
236
102
|
|
|
237
103
|
## Customer editions
|
|
238
104
|
|
|
239
|
-
A customer edition is resolved against a
|
|
240
|
-
(`xema.edition-catalogue/v1`: `offeringId`, `channel` (provenance only), `biomes`, `platformServices`, `images`,
|
|
241
|
-
`chartSet`, `contractAuthority`, `ceiling`). The catalogue is the ceiling: it supplies availability, pins, digests and
|
|
242
|
-
the chart-set, and never adds a component. The resolved set is the customer's `{biome}` selections, every
|
|
243
|
-
`installationClass: core` entry and the transitive declared dependencies.
|
|
244
|
-
|
|
245
|
-
xema edition resolve --definition <file> --channel <release|develop> \
|
|
246
|
-
--data-root <dir> --sources-root <dir> --kernel <dir> --cache-dir <dir> --out <dir> \
|
|
247
|
-
--source-image <source>=<registry>/<prefix> [--catalogue-username <u> --catalogue-token-env <VAR>]
|
|
248
|
-
|
|
249
|
-
The catalogue is the one pinned for the channel in `catalogue.pin.json`, in the SAME directory as the definition file:
|
|
250
|
-
`{"schemaVersion": 1, "develop": "oci://<repository>@sha256:<64 hex>" | null, "release": "oci://<repository>@sha256:<64 hex>" | null}`
|
|
251
|
-
(exact keys, both channel keys present, null = not produced on that channel; the repository of the reference under a key must be
|
|
252
|
-
that channel's repository). A null pin for the requested channel is refused. There is no `--catalogue` flag; passing one is an unknown-flag error.
|
|
253
|
-
`catalogue.pin.json` is written by the customer (or for it, by a commit to its repository), and until the kernel repin the
|
|
254
|
-
catalogue it names carries no vendor signature and no identity check: the digest in the pin is the only thing that binds it.
|
|
255
|
-
`develop freeze-sources --definition` asks only source URLs that are canonical HTTPS repository URLs under the data root's
|
|
256
|
-
`sourceRepositoryUrlPrefix`; a definition naming any other origin is refused before a network call, so the source token is never sent there.
|
|
257
|
-
A definition source carrying `authTokenEnv` or `authUsername` is refused on every path that fetches it: source credentials are declared only by the data root (`sourceRepositoryUrlPrefix` + `sourceAuthUsername`, token `EVIDENCE_REPOSITORIES_TOKEN`), and `resolve` fetches a source outside the prefix with no credential.
|
|
258
|
-
`--registry` refuses a root with a `.` or `..` path segment.
|
|
105
|
+
A customer edition is resolved against a catalogue pinned in `catalogue.pin.json` beside the definition file. The catalogue is the ceiling: it supplies availability, pins and digests and never adds a component. It also names the kernel: `kernel` is `{name, version, integrity}` (`@xemahq/contracts`, an exact `x.y.z`, the npm `sha512-` integrity of that tarball), and a catalogue without it is refused.
|
|
259
106
|
|
|
260
|
-
|
|
261
|
-
|
|
262
|
-
|
|
263
|
-
|
|
264
|
-
|
|
265
|
-
|
|
266
|
-
Ownership rules of the definition (the kernel's `parseCustomerEditionDefinition` and `customerTrustCeilingIssues`; `customer-definition.mjs` only calls them):
|
|
267
|
-
`sources[].ref` is required and names a branch or a tag; a commit id (any full 40- or 64-hex git object id) is refused,
|
|
268
|
-
because the seal records the resolved commit in the lock (the develop `--pins` file still supplies commits). `trustCeiling`
|
|
269
|
-
is required when the definition declares `sources[]` and refused when it does not. It must assign every customer-source
|
|
270
|
-
biome (a biome drawn from the definition's own `sources[]`) exactly once: a missing biome, a biome assigned twice and an
|
|
271
|
-
extra biome that is not customer-sourced are refused.
|
|
272
|
-
|
|
273
|
-
The vendor's trust domain is closed to a customer edition, by three refusals the CLI makes:
|
|
274
|
-
- a `trustCeiling` assignment whose domain is the kernel's first-party domain is refused when the definition is parsed, naming the biomes and the domain;
|
|
275
|
-
- a biome drawn from a declared `sources[]` entry (of any edition) whose manifest declares an origin other than third-party (`xema.trustTier`) is refused, naming the source and the biome;
|
|
276
|
-
- the catalogue's `ceiling` bounds the resolve. Its `trustPolicy` (origin allow list), when stated, is the one the resolve applies to every biome of the lock.
|
|
277
|
-
Its `trustCeiling`, when stated, is written onto the vendor's rows of the customer lock, and for a customer-source biome it admits one domain: the domain the catalogue
|
|
278
|
-
assigns that biome when it names it, otherwise any domain the catalogue assigns to nothing. A definition that names another domain is refused, naming the biome and both domains.
|
|
279
|
-
A `null` member of `ceiling` bounds nothing.
|
|
280
|
-
|
|
281
|
-
Handoff to the customer's registry: `oras cp` the catalogue artifact and the vendor images by digest, pin the mirrored
|
|
282
|
-
catalogue in `catalogue.pin.json`, and declare `imageRegistryMirror: {complete: true, map: [{source, target}]}`. Prefixes match whole
|
|
283
|
-
path segments; the digest never changes and no signature is re-verified at the mirrored ref (the customer's seal is the
|
|
284
|
-
trust anchor and deploy is digest-anchored).
|
|
285
|
-
|
|
286
|
-
The chart-set is copied whole from the catalogue: it states which deploy charts are available, not which components are
|
|
287
|
-
selected, so it adds no component. `trustCeiling` has the kernel shape `{assignments: [{domain, biomes}]}`.
|
|
288
|
-
|
|
289
|
-
### Locks, sealing and the catalogue's tree ids
|
|
290
|
-
|
|
291
|
-
`resolve` writes the UNSEALED lock (`unsealedSchema`); `seal` attaches each biome's `biomeContentHash` and stamps
|
|
292
|
-
`schemaVersion` 5, the only grammar. The hash is recomputed by `seal` AND by the verify step from the biome's
|
|
293
|
-
`sourceManifestHash`, its git tree id at the pinned commit and the sorted image subject digests, through the kernel's
|
|
294
|
-
`computeBiomeContentHash`; a mismatch (a tampered hash, 64 arbitrary hex digits, a changed manifest, tree id or image
|
|
295
|
-
digest) is refused, naming the biome. `resolve --check` compares the unsealed projection byte for byte.
|
|
296
|
-
|
|
297
|
-
A customer holds no checkout of the vendor's sources. `catalogue.json` therefore carries `sourceTreeIds` (each vendor
|
|
298
|
-
biome's tree id at its pinned commit, written from the real tree by `edition catalogue` / `edition artifact`), and the
|
|
299
|
-
customer's seal takes that tree id as an INPUT ON THE CATALOGUE'S AUTHORITY: it is not source verification, and the
|
|
300
|
-
refusal text says so. A vendor biome absent from the catalogue is refused, not skipped.
|
|
107
|
+
```bash
|
|
108
|
+
xema edition resolve --definition <file> --channel <release|develop> \
|
|
109
|
+
--data-root <dir> --sources-root <dir> --cache-dir <dir> --out <dir> \
|
|
110
|
+
--source-image <source>=<registry>/<prefix> [--catalogue-username <u> --catalogue-token-env <VAR>]
|
|
111
|
+
xema edition seal <id> --definition <file> --data-root <dir> --editions-root <dir> --sources-root <dir> --cache-dir <dir>
|
|
112
|
+
```
|
|
301
113
|
|
|
302
|
-
|
|
303
|
-
--data-root <dir> --editions-root <dir> --sources-root <dir> --kernel <dir> --cache-dir <dir>
|
|
114
|
+
To use a customer's own registry, copy the catalogue artifact and vendor images by digest with `oras cp`, pin the mirrored catalogue in `catalogue.pin.json`, and declare `imageRegistryMirror: {complete: true, map: [{source, target}]}` in the definition.
|
|
304
115
|
|
|
305
|
-
|
|
306
|
-
customer's registry. 2. Pin the mirrored catalogue digest in `catalogue.pin.json`. 3. Declare
|
|
307
|
-
`imageRegistryMirror: {complete: true, map: [{source, target}]}` (whole path segments; `complete: true` refuses a vendor row no
|
|
308
|
-
entry covers). 4. Resolve and seal: digests are unchanged, so the seal's hashes are unchanged; no signature is
|
|
309
|
-
re-verified at the mirrored ref.
|
|
116
|
+
A customer verb takes no `--kernel` (it is refused) and needs no kernel checkout and no credential for the kernel. After it fetches its catalogue it downloads `@xemahq/contracts@<catalogue.kernel.version>` from registry.npmjs.org into `<--cache-dir>/kernel-npm/`, holds the tarball to the catalogue's npm integrity before extracting it, and proves the package is the catalogue's contract authority (final protocol identity carrying `contractAuthority.contentDigest`) before it loads any schema.
|
|
310
117
|
|
|
311
|
-
### Develop customer edition
|
|
312
118
|
|
|
313
|
-
|
|
314
|
-
`develop` pin of `catalogue.pin.json` beside it.
|
|
119
|
+
### Adapter bundles against the adapter host
|
|
315
120
|
|
|
316
|
-
|
|
317
|
-
xema edition develop kernel-commit --definition <file> [--catalogue-username <u> --catalogue-token-env <VAR>] --data-root <dir>
|
|
318
|
-
xema edition develop resolve --definition <file> --pins <file> --out <dir> --registry <root> --engine-image <repository>@sha256:<digest> \
|
|
319
|
-
--data-root <dir> --editions-root <dir> --sources-root <dir> --kernel <dir> --cache-dir <dir> \
|
|
320
|
-
[--source-image <source>=<registry>/<prefix>]... [--catalogue-username <u> --catalogue-token-env <VAR>] [--local]
|
|
321
|
-
xema edition develop target --definition <file> --pins <file> --registry <root>
|
|
322
|
-
xema edition develop check-existing --definition <file> --pins <file> --artifact <dir> --engine-image <repository>@sha256:<digest> \
|
|
323
|
-
--data-root <dir> --kernel <dir>
|
|
121
|
+
The adapter host refuses at mount an adapter whose packed `package.json` `xemaBundled` entry for `@xemahq/contracts` or `@xemahq/biome-sdk` is missing or not caret-compatible with the host's own resolved copy (same major; same minor too while the major is 0; an unparsable version is incompatible). The edition build refuses the same first, in `adapter-bundled-versions.mjs`: every lock biome host module of the `xema-adapter-host` ABI must carry an npm bundle source, whose published manifest is read from `https://registry.npmjs.org/<name>/<version>` without a credential. The host's versions are the `hostPackageVersions` of the `biome-adapter-host` row of the biome index (read from the host source's `pnpm-lock.yaml` when the index is built; the distribution lock never carries it) and, for a customer, of the same row in the catalogue. Resolve (vendor, develop, customer) and seal (vendor and `--definition`) run the check and report all refusals together, each with one of `adapter-bundle-version-mismatch`, `adapter-host-unpinned` (no host row or no `hostPackageVersions`), `adapter-not-published` (the registry answers 404) or `unsupported-bundle-source` (not npm).
|
|
324
122
|
|
|
325
|
-
|
|
326
|
-
the head of `refs/heads/develop` of each source repository, resolved once (token from `EVIDENCE_REPOSITORIES_TOKEN`).
|
|
327
|
-
`kernel-commit` fetches the pinned develop catalogue and prints its `contractAuthority.sourceCommit` (one 40-hex line): the commit
|
|
328
|
-
a workflow checks the kernel contracts out at; it needs no `--kernel` and no `--sources-root`. `target` prints the develop target
|
|
329
|
-
(the tag covers the pinned catalogue digest). `check-existing` does for a customer artifact what it does for a vendor one, and
|
|
330
|
-
additionally refuses a descriptor whose `catalogue` provenance pin is not the pinned develop catalogue digest.
|
|
123
|
+
## Tests
|
|
331
124
|
|
|
332
|
-
|
|
333
|
-
|
|
334
|
-
|
|
335
|
-
`--editions-root`, `--sources-root`, `--kernel` and `--cache-dir`, and refuses any other root flag (for example `--deploy-root`),
|
|
336
|
-
naming the roots it takes. A customer whose sources build images also commits `image-registry-credentials.json` in its editions root
|
|
337
|
-
(the registries its own images are verified against); when its own image rows are sealed and that file is absent, the resolve
|
|
338
|
-
is refused naming the file and the root. A customer with no sources, or whose sources build no image, needs no file in its
|
|
339
|
-
editions root. A customer verb refuses a root flag it does not take, naming the roots it takes (`target` takes none).
|
|
125
|
+
```bash
|
|
126
|
+
pnpm run test:edition # node --test "edition/*.test.mjs" "edition/*-contract-tests.mjs"
|
|
127
|
+
```
|
|
340
128
|
|
|
341
|
-
The
|
|
342
|
-
definition declares (the customer's own repositories; the vendor's pins are the catalogue's). The digest of the catalogue
|
|
343
|
-
artifact is frozen into the descriptor's `provenance.pins` as `catalogue: "sha256:<64 hex>"` (typed per key: every other
|
|
344
|
-
pin is a 40-hex commit), so the snapshot-hash tag covers it. The artifact is the one edition layout (`xema.edition/v1`,
|
|
345
|
-
the descriptor plus the four locks) at `<root>/<develop segment>/xema-edition-<id>`. Vendor image rows arrive sealed from the
|
|
346
|
-
catalogue and are neither re-homed nor re-verified; only the customer's own rows are re-homed to the develop image repositories,
|
|
347
|
-
verified there for their required platforms and sealed with the digest the registry served. The images lock is parsed once, as
|
|
348
|
-
the merged lock (vendor rows plus own rows). On the release channel the own rows stay unsealed in the merged lock. A customer artifact is not an
|
|
349
|
-
offering and carries no `catalogue.json`. `edition-contract.json` lists `catalogue.json` under `offeringLayers` (a layer
|
|
350
|
-
of an offering artifact, not a lock) and the `catalogue` pin under `provenancePins`.
|
|
129
|
+
The sealing tests run the real `openfga` CLI and fail, naming `XEMA_FGA_CLI`, when it is unset.
|
|
@@ -0,0 +1,107 @@
|
|
|
1
|
+
// adapter-bundled-versions — the edition build refuses what the adapter host
|
|
2
|
+
// would refuse at mount, before it ships.
|
|
3
|
+
//
|
|
4
|
+
// The adapter host (xema-base `biome-adapter-host`) refuses at mount an adapter
|
|
5
|
+
// whose packed package.json `xemaBundled` entry for `@xemahq/contracts` or
|
|
6
|
+
// `@xemahq/biome-sdk` is missing or not caret-compatible with the host's own
|
|
7
|
+
// resolved copy. The mount check stays the last line; this is the first.
|
|
8
|
+
|
|
9
|
+
import { ADAPTER_HOST_BIOME_ID, BUNDLED_PACKAGES, isCaretCompatible } from './adapter-host-versions.mjs';
|
|
10
|
+
import { loadKernelBiomeContracts } from './lib.mjs';
|
|
11
|
+
import { compareStrings } from './string-order.mjs';
|
|
12
|
+
|
|
13
|
+
export const AdapterBundleVersionErrorCode = Object.freeze({
|
|
14
|
+
VersionMismatch: 'adapter-bundle-version-mismatch',
|
|
15
|
+
Unpinned: 'adapter-host-unpinned',
|
|
16
|
+
NotPublished: 'adapter-not-published',
|
|
17
|
+
UnsupportedSource: 'unsupported-bundle-source',
|
|
18
|
+
});
|
|
19
|
+
|
|
20
|
+
export class AdapterBundleVersionError extends Error {
|
|
21
|
+
constructor({ code, biomeId, packageName, bundled, host }) {
|
|
22
|
+
super(
|
|
23
|
+
`${code}: biome "${biomeId}" package "${packageName}" bundled ${JSON.stringify(bundled)} ` +
|
|
24
|
+
`against host ${JSON.stringify(host)}`,
|
|
25
|
+
);
|
|
26
|
+
this.name = 'AdapterBundleVersionError';
|
|
27
|
+
this.code = code;
|
|
28
|
+
this.biomeId = biomeId;
|
|
29
|
+
this.packageName = packageName;
|
|
30
|
+
this.bundled = bundled;
|
|
31
|
+
this.host = host;
|
|
32
|
+
}
|
|
33
|
+
}
|
|
34
|
+
|
|
35
|
+
/** The adapter host's row of a biome index or catalogue (undefined when the edition does not carry it). */
|
|
36
|
+
export function adapterHostRow(rows) {
|
|
37
|
+
return rows.find((row) => row.id === ADAPTER_HOST_BIOME_ID);
|
|
38
|
+
}
|
|
39
|
+
|
|
40
|
+
/** Does the lock mount any adapter host module? */
|
|
41
|
+
export function lockMountsAdapters(lock) {
|
|
42
|
+
const adapterAbi = loadKernelBiomeContracts().BiomeComponentHostAbi.AdapterHost;
|
|
43
|
+
return (lock.biomes ?? []).some((biome) => (biome.hostModules ?? []).some((hostModule) => hostModule.hostAbi?.name === adapterAbi));
|
|
44
|
+
}
|
|
45
|
+
|
|
46
|
+
/** Fetch a package version's manifest from the public registry (no credential); null when unpublished. */
|
|
47
|
+
export async function fetchRegistryManifest(name, version, fetchImpl = fetch) {
|
|
48
|
+
const response = await fetchImpl(
|
|
49
|
+
`https://registry.npmjs.org/${name.replace('/', '%2F')}/${encodeURIComponent(version)}`,
|
|
50
|
+
{ headers: { accept: 'application/json' } },
|
|
51
|
+
);
|
|
52
|
+
if (response.status === 404) {return null;}
|
|
53
|
+
if (!response.ok) {
|
|
54
|
+
throw new Error(`npm registry answered ${response.status} for ${name}@${version}`);
|
|
55
|
+
}
|
|
56
|
+
return response.json();
|
|
57
|
+
}
|
|
58
|
+
|
|
59
|
+
/**
|
|
60
|
+
* Refuse every adapter host module whose packed bundle the host would refuse at
|
|
61
|
+
* mount. `fetchManifest(name, version)` resolves the manifest or null (unpublished).
|
|
62
|
+
* All refusals are collected and thrown together, sorted.
|
|
63
|
+
*/
|
|
64
|
+
export async function assertAdapterBundlesMatchHost({ lock, hostRow, fetchManifest }) {
|
|
65
|
+
const adapterAbi = loadKernelBiomeContracts().BiomeComponentHostAbi.AdapterHost;
|
|
66
|
+
const refusals = [];
|
|
67
|
+
const manifests = new Map();
|
|
68
|
+
const hostVersions = hostRow?.hostPackageVersions;
|
|
69
|
+
for (const biome of lock.biomes ?? []) {
|
|
70
|
+
for (const hostModule of biome.hostModules ?? []) {
|
|
71
|
+
if (hostModule.hostAbi?.name !== adapterAbi) {continue;}
|
|
72
|
+
const base = { biomeId: biome.id, bundled: null, host: null };
|
|
73
|
+
if (hostVersions === undefined) {
|
|
74
|
+
refusals.push({ ...base, code: AdapterBundleVersionErrorCode.Unpinned, packageName: ADAPTER_HOST_BIOME_ID });
|
|
75
|
+
continue;
|
|
76
|
+
}
|
|
77
|
+
const source = hostModule.bundleSource;
|
|
78
|
+
if (source?.kind !== 'npm') {
|
|
79
|
+
refusals.push({ ...base, code: AdapterBundleVersionErrorCode.UnsupportedSource, packageName: String(source?.kind) });
|
|
80
|
+
continue;
|
|
81
|
+
}
|
|
82
|
+
const key = `${source.name}@${source.version}`;
|
|
83
|
+
if (!manifests.has(key)) {
|
|
84
|
+
manifests.set(key, fetchManifest(source.name, source.version));
|
|
85
|
+
}
|
|
86
|
+
const manifest = await manifests.get(key);
|
|
87
|
+
if (manifest === null) {
|
|
88
|
+
refusals.push({ ...base, code: AdapterBundleVersionErrorCode.NotPublished, packageName: key });
|
|
89
|
+
continue;
|
|
90
|
+
}
|
|
91
|
+
for (const name of BUNDLED_PACKAGES) {
|
|
92
|
+
const bundled = manifest.xemaBundled?.[name] ?? null;
|
|
93
|
+
if (!isCaretCompatible(bundled, hostVersions[name])) {
|
|
94
|
+
refusals.push({ ...base, code: AdapterBundleVersionErrorCode.VersionMismatch, packageName: name, bundled, host: hostVersions[name] });
|
|
95
|
+
}
|
|
96
|
+
}
|
|
97
|
+
}
|
|
98
|
+
}
|
|
99
|
+
if (refusals.length === 0) {return;}
|
|
100
|
+
const errors = refusals
|
|
101
|
+
.map((fields) => new AdapterBundleVersionError(fields))
|
|
102
|
+
.sort((a, b) => compareStrings(a.message, b.message));
|
|
103
|
+
const thrown = new AdapterBundleVersionError(errors[0]);
|
|
104
|
+
thrown.message = errors.map((error) => error.message).join('\n');
|
|
105
|
+
thrown.refusals = errors;
|
|
106
|
+
throw thrown;
|
|
107
|
+
}
|