@xemahq/xema 0.33.4 → 0.33.6

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -2203,229 +2203,229 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:bbeac7ff01376cb89ed2140526d4795d8e559b3f01612b404a701f19aaa24c6a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:e8a391938c88398f63f86fdf413582d3a18eb20c219784a01fa84794bbd22e38"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:cea98292ffc8bfe2afcc01f327172bc9071a83ef9b62a4e56236f2029d2699a9"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:e3997bd9a0082e02d01760868b2a4f41ed3081e904126b30fdf86e7938dc6137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:71ae51028847ab3430ffec9b229b0516a7705b75a6de1fcfa665f5e1abf8e9bb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:c575e96b70bda82899931eb0b18567988e2e13e664fa498bcbef96b571dcabb4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:aa1a05f1728813a7bdb1e02d9305e9adf641d695e6767305210c67a1d81b38a7"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:2940a0ee8662970722aa2618a1635f8d5b4f5e54b85f09667f71ccf7c2c81b03"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b2190ace174a29875e2a9bd7209460b0ef6de186aca9b31bcd45dc17af57c1ba"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:f7267e93fd7dc07cf65fb8cac2c4439d28a72c1e0acbdeca1648c6859440eb32"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:b9dd5c01903394436530783614efb0cd357d982ed2befd844a39328479773cbc"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/git-json.mjs",
       "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:09945712ecc6524d5f52cfd82141ef4cade45be35210777f6e32818792068881"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:20abdde62a7b037c01ea9bbe1ff1e6094e6b0efd0add2f656f1938a04409bf82"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/lib.mjs",
       "sha256": "sha256:0e9045632a14cb1a035bce7aac3ad26e7b2211daa3f9c2cd27a55dfd772e3b6b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:ffe6fdc9da6b2974270fc86c11be0c41d0bc6d85c8e3c137d3c3bc00a72fc4f6"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:fbaa6dffbdf4a262a13127bcf37bca791234fae74e327ac250e56ff4b78c1244"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:858b607dde94e2abd00a341f569e18cfa567d4bff139c64a2d60abbb7de4c85e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:62f83f8bb835f360535402d12657156d2c9d6e651b426c2b30a04a2dc2f8d3e8"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:058c849767434e9ba911d9310092bede42e3ef959c75bbd35ff8879dc21ce3ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.4",
+      "version": "0.33.6",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/edition/platform-lock-readability.mjs

@@ -503,6 +503,15 @@ export function lockedSdkVersions({ repoRoot = sourcesRoot(), repo, commit }) {
   return [...versions].sort();
 }
 
+/**
+ * Does comment-blanked executable source CALL the tolerant reader? Both the source form `parseDistributionLockForReading(x)`
+ * and the compiled CommonJS form `(0, mod.parseDistributionLockForReading)(x)` are calls; a bare reference (an export, a
+ * re-export) is not, and a docblock mention is blanked before this runs.
+ */
+export function callsReader(executable) {
+  return /\bparseDistributionLockForReading\s*(?:\)\s*)?\(/u.test(executable);
+}
+
 /**
  * Does the PUBLISHED SDK at `version` parse the lock with the kernel READER?
  * Asked of the tarball's own executable source (comments blanked), so a
@@ -528,7 +537,7 @@ export function sdkReadsWithReader(version) {
     );
   }
   const executable = blankAllComments(readFileSync(module, 'utf8'));
-  const readsWithReader = /\bparseDistributionLockForReading\s*\(/u.test(executable);
+  const readsWithReader = callsReader(executable);
   sdkModeCache.set(version, readsWithReader);
   return readsWithReader;
 }

package/edition/seal-image-digests.mjs

@@ -470,22 +470,17 @@ function replaceLocksTogether(documents) {
 }
 
 /**
- * The seal of one edition's two locks, as ONE write.
- *
- * `digests` (`kind:id` -> registry digest) are the image digests this run seals
- * into the images lock. Each biome's `biomeContentHash` is then RECOMPUTED from
- * its sources over that sealed images lock, and the unsealed distribution lock
- * the resolver wrote is turned into the v5 lock by the kernel's
- * `sealDistributionLock`. A distribution lock that is already sealed is VERIFIED
- * instead: every hash is recomputed and a mismatch is refused, naming the biome.
- *
- * Nothing is written until both documents exist in memory, and the distribution
- * lock is renamed LAST: a seal that fails for any reason before that leaves the
- * committed pair as it was, and the one state a crash between the two renames
- * can leave (images sealed, distribution unsealed) is refused by every reader of
- * a sealed edition.
+ * The lock the images of an edition will actually READ, built IN MEMORY: the committed lock sealed against the image lock
+ * carrying `digests`. Nothing is written. The readability grader asks its question of THIS, never of the committed
+ * unsealed form, which every contracts reader refuses for want of a `schemaVersion` whatever the repositories do.
  */
-export async function sealEditionLocks({ distributionId, root, digests = new Map(), check = false, label = 'dist:seal-digests', vendoredCommit, catalogue, catalogueDigest, fetchManifest = fetchRegistryManifest }) {
+export async function buildSealedEditionLock(options) {
+  const { prepared } = await prepareEditionSeal({ ...options, checkAdapters: false, check: false });
+  return prepared.result.lock;
+}
+
+/** The shared in-memory half of the seal: reads both locks, applies `digests`, seals or verifies. Writes nothing. */
+async function prepareEditionSeal({ distributionId, root, digests = new Map(), check = false, vendoredCommit, catalogue, catalogueDigest, fetchManifest = fetchRegistryManifest, checkAdapters = true }) {
   const schemas = await loadKernelDistributionSchemas();
   const lockPath = join(root, distributionId, 'distribution.lock.json');
   const imagesPath = join(root, distributionId, 'images.lock.json');
@@ -514,7 +509,7 @@ export async function sealEditionLocks({ distributionId, root, digests = new Map
   const editionInputs = catalogue === undefined && vendoredCommit === undefined ? await editionPinnedInputs(distributionId, { schemas }) : undefined;
   const pinned = vendoredCommit ?? ((repo) => createPinnedSourceAuthority({ pins: editionInputs?.repositoryPins ?? committedRepositoryPins() }).vendoredSourceCommitForRepository(repo));
   const lockDocument = raw !== null && typeof raw === 'object' && 'unsealedSchema' in raw ? schemas.parseUnsealedDistributionLock(raw) : schemas.parseDistributionLock(raw);
-  if (lockMountsAdapters(lockDocument)) {
+  if (checkAdapters && lockMountsAdapters(lockDocument)) {
     // The adapter host's row: the verified catalogue's for a customer, the data root's biome index for the vendor.
     const rows = catalogue !== undefined ? catalogue.biomes : (editionInputs?.biomeIndex ?? JSON.parse(readFileSync(biomeIndexPath(), 'utf8')));
     await assertAdapterBundlesMatchHost({ lock: lockDocument, hostRow: adapterHostRow(rows), fetchManifest });
@@ -530,6 +525,28 @@ export async function sealEditionLocks({ distributionId, root, digests = new Map
     check,
     lockPath,
   });
+  return { prepared: { result, rawImages, applied, lockPath, imagesPath } };
+}
+
+/**
+ * The seal of one edition's two locks, as ONE write.
+ *
+ * `digests` (`kind:id` -> registry digest) are the image digests this run seals
+ * into the images lock. Each biome's `biomeContentHash` is then RECOMPUTED from
+ * its sources over that sealed images lock, and the unsealed distribution lock
+ * the resolver wrote is turned into the v5 lock by the kernel's
+ * `sealDistributionLock`. A distribution lock that is already sealed is VERIFIED
+ * instead: every hash is recomputed and a mismatch is refused, naming the biome.
+ *
+ * Nothing is written until both documents exist in memory, and the distribution
+ * lock is renamed LAST: a seal that fails for any reason before that leaves the
+ * committed pair as it was, and the one state a crash between the two renames
+ * can leave (images sealed, distribution unsealed) is refused by every reader of
+ * a sealed edition.
+ */
+export async function sealEditionLocks({ distributionId, root, digests = new Map(), check = false, label = 'dist:seal-digests', vendoredCommit, catalogue, catalogueDigest, fetchManifest = fetchRegistryManifest }) {
+  const { prepared } = await prepareEditionSeal({ distributionId, root, digests, check, vendoredCommit, catalogue, catalogueDigest, fetchManifest });
+  const { result, rawImages, applied, lockPath, imagesPath } = prepared;
   replaceLocksTogether([
     ...(applied > 0 ? [{ path: imagesPath, text: `${JSON.stringify(rawImages, null, 2)}\n` }] : []),
     ...(result.sealed ? [{ path: lockPath, text: serializeJson(result.lock) }] : []),
@@ -760,10 +777,22 @@ async function main() {
   //
   // The practical rule for anything added below: the distribution lock may be
   // regenerated to answer a question; the image lock may not.
+  const { writes, unchanged } = planDigestSeal({
+    subjects: imageLock.subjects,
+    verified: report.subjects,
+  });
+
+  const planned = new Map();
+  for (const w of writes) {planned.set(w.key, w.digest);}
   await assertPlatformCanParseLock({
-    lock: JSON.parse(
-      readFileSync(join(root, distributionId, 'distribution.lock.json'), 'utf8'),
-    ),
+    // The lock the images will READ: sealed in memory with this run's digests, never the committed unsealed form.
+    lock: await buildSealedEditionLock({
+      distributionId,
+      root,
+      digests: planned,
+      catalogue,
+      catalogueDigest,
+    }),
     imageLock,
     distributionId,
     // A vendor edition grades the pins it RESOLVES at (a held repository is graded at the held commit);
@@ -774,11 +803,6 @@ async function main() {
         : JSON.parse(readFileSync(runtimeImageSourceIndexPath(), 'utf8')),
   });
 
-  const { writes, unchanged } = planDigestSeal({
-    subjects: imageLock.subjects,
-    verified: report.subjects,
-  });
-
   const label = check ? 'dist:seal-digests --check' : 'dist:seal-digests';
   console.log(
     `[${label}] "${distributionId}": ${report.subjectCount} subjects verified against ` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.33.4",
+  "version": "0.33.6",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -51,7 +51,7 @@
     "@nestjs/platform-express": "^11.1.28",
     "@xemahq/biome-sdk": "^18.1.0",
     "@xemahq/biome-supply-chain": "^0.5.0",
-    "@xemahq/distribution-source-hash": "^0.3.0",
+    "@xemahq/distribution-source-hash": "^0.2.2",
     "@xemahq/dsl": "^0.23.0",
     "@xemahq/identity-client": "^0.16.0",
     "@xemahq/contracts": "^0.80.0",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:a8780b8b95054688b280033f5aec97bbdb0d4bc211513d09a992a3c025af653e"
+    "sourceDigest": "sha256:bca9f14b3a57c3f6ea1a8a66b2a5e1e78772127b6e443a820f081d35e9dfc405"
   }
 }