@xemahq/xema 0.31.0 → 0.31.1

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -2203,211 +2203,211 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:bbeac7ff01376cb89ed2140526d4795d8e559b3f01612b404a701f19aaa24c6a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:161f522eb39e3db705bc709f8512988dd3e6752851d972521354eeccffd8075d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:fbda500315d45e35eb974f4701bbf36729c3b642a5d735bc1b07085c91d25b23"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:e3997bd9a0082e02d01760868b2a4f41ed3081e904126b30fdf86e7938dc6137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:71ae51028847ab3430ffec9b229b0516a7705b75a6de1fcfa665f5e1abf8e9bb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:c575e96b70bda82899931eb0b18567988e2e13e664fa498bcbef96b571dcabb4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:aa1a05f1728813a7bdb1e02d9305e9adf641d695e6767305210c67a1d81b38a7"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:2940a0ee8662970722aa2618a1635f8d5b4f5e54b85f09667f71ccf7c2c81b03"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:f7267e93fd7dc07cf65fb8cac2c4439d28a72c1e0acbdeca1648c6859440eb32"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:b9dd5c01903394436530783614efb0cd357d982ed2befd844a39328479773cbc"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:3192b411d52f8ce7e32d3f8cba977692ce021a00ad1b7f72248a747ef3a8d45c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:20abdde62a7b037c01ea9bbe1ff1e6094e6b0efd0add2f656f1938a04409bf82"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/lib.mjs",
-      "sha256": "sha256:d24ca1785f5d4c37dad0cdd760e6aa4c87591885f7406d3a7651bdfd9f4bad7e"
+      "sha256": "sha256:f7da6a34588354e12c44196287e130b9098190fbde57b38c3a87dfeafee5cb7d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:ffe6fdc9da6b2974270fc86c11be0c41d0bc6d85c8e3c137d3c3bc00a72fc4f6"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:4e64d25b7aacec344253d1963f419f946998f36e8c269eea58b8c848e0f35e52"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:2351d47a32ee865720a675f1ecd336b00cdce4aa34713219a1aa23920ac7b60f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:62f83f8bb835f360535402d12657156d2c9d6e651b426c2b30a04a2dc2f8d3e8"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:058c849767434e9ba911d9310092bede42e3ef959c75bbd35ff8879dc21ce3ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.31.0",
+      "version": "0.31.1",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/edition/README.md

@@ -98,7 +98,7 @@ The edition library builds, validates and verifies evidence statements; it never
 The CLI is coupled to the kernel's edition protocol, not to the kernel package. `@xemahq/contracts` exports the protocol identity as data (`dist/edition-protocol/edition-protocol.json`: `{contentDigest, provisional, version}`). This CLI supports exactly protocol v5 and REFUSES an identity with `provisional: true`; every loader that executes the kernel, `xema edition check` first, and the evidence verifier compare only that identity and refuse an unsupported one, naming the supported and the declared versions. A protocol change needs a CLI release first; only then does the data root repin its kernel authority.
 
 - `xema edition evidence statement entitlement stage` writes entitlement predicate v2 (`lockDigest`, `catalogueDigest`, read from the edition's committed locks), so it takes `--editions-root` besides `--data-root` and `--kernel`.
-- The runtime image source index is v2 and carries operator-stated `producerWorkflowPins` (the workflow commit a producer certificate must be signed from, per repository). `xema edition index runtime-image-source [--producer-workflow-pin <owner/repo>=<40-hex>]...` preserves the committed pins exactly; each flag sets one repository's pin (repeatable; a repeated or non-GitHub `owner/repo` is refused; only `--trusted-write` writes an index, so the flag with any other mode, `--check-sources` included, is refused); a bootstrap index with none writes `[]`. A v1 index is not read: re-index the data root.
+- The runtime image source index is v2 and carries operator-stated `producerWorkflowPins` (the workflow commit a producer certificate must be signed from, per repository). `xema edition index runtime-image-source [--producer-workflow-pin <owner/repo>=<40-hex>]...` preserves the committed pins exactly; each flag sets one repository's pin (repeatable; a repeated or non-GitHub `owner/repo` is refused; only `--trusted-write` writes an index, so the flag with any other mode, `--check-sources` included, is refused); a bootstrap index with none writes `[]`. A v1 index is refused, never migrated: delete it and bootstrap a new one with `--kernel-commit`.
 
 ## Customer editions
 

package/edition/build-runtime-image-source-index.mjs

@@ -204,9 +204,7 @@ function assertVendoredSourcesResolve(crossRepoBuildInputs, resolveIdentity) {
   }
 }
 
-const LEGACY_INDEX_SCHEMA_VERSION = 1;
 const CURRENT_INDEX_SCHEMA_VERSION = 2;
-const KNOWN_INDEX_SCHEMA_VERSIONS = Object.freeze([LEGACY_INDEX_SCHEMA_VERSION, CURRENT_INDEX_SCHEMA_VERSION]);
 
 /**
  * The kernel-contract authority for a pin regeneration.
@@ -255,9 +253,9 @@ const KNOWN_INDEX_SCHEMA_VERSIONS = Object.freeze([LEGACY_INDEX_SCHEMA_VERSION,
  * HEAD must equal it. Stating a commit when a committed authority exists is
  * refused: it would be read by nobody.
  *
- * A committed index of schemaVersion 1 carries an authority a current kernel
- * cannot validate, so it counts as having NO committed authority: it is
- * migrated by bootstrap, which writes a schemaVersion 2 index. Any other
+ * A committed index of any schemaVersion but the current one is refused by name,
+ * never migrated: a schemaVersion 1 index is re-indexed by deleting it and
+ * running bootstrap. Any other
  * schemaVersion is refused by name, never read as one of these.
  */
 async function resolveContractAuthority(schemas, kernelRoot, kernelCommit) {
@@ -265,13 +263,14 @@ async function resolveContractAuthority(schemas, kernelRoot, kernelCommit) {
   const committed = existsSync(runtimeImageSourceIndexPath())
     ? readJson(runtimeImageSourceIndexPath())
     : undefined;
-  if (committed !== undefined && !KNOWN_INDEX_SCHEMA_VERSIONS.includes(committed.schemaVersion)) {
+  if (committed !== undefined && committed.schemaVersion !== CURRENT_INDEX_SCHEMA_VERSION) {
     throw new Error(
       `${runtimeImageSourceIndexPath()} has schemaVersion ${JSON.stringify(committed.schemaVersion)}; ` +
-        `this command reads ${KNOWN_INDEX_SCHEMA_VERSIONS.join(' or ')}`,
+        `this command reads only schemaVersion ${CURRENT_INDEX_SCHEMA_VERSION} and does not migrate older indexes: ` +
+        `delete the index and re-run with ${KERNEL_COMMIT_FLAG} <40-hex> to bootstrap a new one`,
     );
   }
-  if (committed === undefined || committed.schemaVersion === LEGACY_INDEX_SCHEMA_VERSION || !committed.contractAuthority) {
+  if (committed === undefined || !committed.contractAuthority) {
     return buildTrustedKernelContractAuthority({
       ...(repositoryDirectory === undefined ? {} : { repositoryDirectory }),
       schemas,

package/edition/dist-check.mjs

@@ -52,7 +52,9 @@ import { checkEvidenceTrustPolicy } from './evidence-trust-policy.mjs';
 import {
   compareIndexEntries,
   comparableDistributionLock,
+  isUnsealedDistributionLock,
   loadKernelDistributionSchemas,
+  parseResolvedDistributionLock,
   serializeJson,
   validateImmutableBiomeIndex,
   validateImmutableDistributionLock,
@@ -263,13 +265,15 @@ function imageStructure(lock) {
  * subjects as stale on a clean tree and send the reader to re-resolve, which
  * is the operation that destroys the seal.
  */
-async function checkImagesLock(id, checkSourceEvidence) {
+export async function checkImagesLock(id, checkSourceEvidence) {
   const imageLockPath = join(editionsRoot(), id, 'images.lock.json');
   try {
     const schemas = await loadKernelDistributionSchemas();
-    // A pure READ of the committed lock: the tolerant reader, never the writer.
+    // A pure READ of the committed lock: the shape-dispatching reader (unsealed
+    // on develop, sealed v5 otherwise), never the writer.
     const distributionLock = validateImmutableDistributionLock(
-      schemas.parseDistributionLockForReading(
+      parseResolvedDistributionLock(
+        schemas,
         JSON.parse(
           readFileSync(
             join(editionsRoot(), id, 'distribution.lock.json'),
@@ -851,12 +855,15 @@ function checkConfinementScope(ids) {
  * digests, and a mismatch is refused naming the biome. The kernel cannot do
  * this ("sealed" is only a field). Returns true on green.
  */
-async function checkBiomeContentHashes(id) {
+export async function checkBiomeContentHashes(id) {
   try {
     const schemas = await loadKernelDistributionSchemas();
-    const lock = schemas.parseDistributionLock(
-      JSON.parse(readFileSync(join(editionsRoot(), id, 'distribution.lock.json'), 'utf8')),
-    );
+    const rawLock = JSON.parse(readFileSync(join(editionsRoot(), id, 'distribution.lock.json'), 'utf8'));
+    if (isUnsealedDistributionLock(rawLock)) {
+      console.log(`[dist:check] ${id}: unsealed lock, no biome content hashes to verify until sealed.`);
+      return true;
+    }
+    const lock = schemas.parseDistributionLock(rawLock);
     const imageLock = schemas.parseImageLock(
       JSON.parse(readFileSync(join(editionsRoot(), id, 'images.lock.json'), 'utf8')),
     );
@@ -981,7 +988,9 @@ async function main() {
   console.log('[dist:check] all distributions green.');
 }
 
-main().catch((err) => {
-  console.error(`[dist:check] ${err.message}`);
-  process.exit(1);
-});
+if (isEntryModule(import.meta.url)) {
+  main().catch((err) => {
+    console.error(`[dist:check] ${err.message}`);
+    process.exit(1);
+  });
+}

package/edition/lib.mjs

@@ -2789,6 +2789,16 @@ export function validateImmutableBiomeIndex(index) {
   return index;
 }
 
+/**
+ * Whether a raw distribution lock DECLARES the unsealed shape (carries
+ * `unsealedSchema`). Dispatch is on the declared shape only, never on a parse
+ * failure: a sealed (schemaVersion 5) lock that is incomplete stays sealed and
+ * is refused by the sealed parsers.
+ */
+export function isUnsealedDistributionLock(raw) {
+  return raw !== null && typeof raw === 'object' && 'unsealedSchema' in raw;
+}
+
 /**
  * The distribution lock as the resolve pipeline reads it: the UNSEALED
  * document a resolve just wrote, or the SEALED v5 lock a prior seal committed.
@@ -2797,7 +2807,7 @@ export function validateImmutableBiomeIndex(index) {
  * A pre-v5 lock is refused by the kernel (`unsupported-schema-version`).
  */
 export function parseResolvedDistributionLock(schemas, raw) {
-  return raw !== null && typeof raw === 'object' && 'unsealedSchema' in raw
+  return isUnsealedDistributionLock(raw)
     ? schemas.parseUnsealedDistributionLock(raw)
     : schemas.parseDistributionLockForReading(raw);
 }
@@ -2812,7 +2822,7 @@ export function parseResolvedDistributionLock(schemas, raw) {
  */
 export function comparableDistributionLock(schemas, raw) {
   const unsealed = schemas.parseUnsealedDistributionLock(
-    raw !== null && typeof raw === 'object' && 'unsealedSchema' in raw
+    isUnsealedDistributionLock(raw)
       ? raw
       : schemas.unsealedProjection(schemas.parseDistributionLock(raw)),
   );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.31.0",
+  "version": "0.31.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:2fc7a76e728752cf14eeb410921fb5c89cbffc9c3c398116a3c37dcd740587ea"
+    "sourceDigest": "sha256:fb84f9a32012146ed5af8e2ddc1327fff42293fc57b72ca58bc082cf5502839f"
   }
 }