@xemahq/xema 0.33.6 → 0.34.0

package/edition/resolve-distribution.mjs

@@ -78,7 +78,6 @@ import { resolveDispatchedRuntimeComponents } from './dispatched-runtime-compone
 import { fleetChartSetLockPath, writeEditionChartSet } from './edition-chart-set.mjs';
 import { workspaceSection } from './edition-config.mjs';
 import { editionPinnedInputs } from './edition-pinned-inputs.mjs';
-import { splitEditionDefinition } from './edition-source-pins.mjs';
 import { WorkspaceRoot, configureEditionWorkspaceFromProcess, editionsRoot, isEntryModule, kernelPackageDir } from './edition-workspace.mjs';
 import { walkDeclaredSources } from './external-source-walk.mjs';
 import {
@@ -105,6 +104,7 @@ import { closureBiomeFacts } from './positive-closure.mjs';
 import { assertReleaseContent, assertReleaseEditionTree } from './release-channel-guard.mjs';
 import { commandFor } from './remedy-command.mjs';
 import { soleResourceProvider } from './required-resource-provider.mjs';
+import { readStorePublisherTrust } from './store-publisher-trust.mjs';
 import { readStrictJsonFile } from './strict-json.mjs';
 import { RuntimeSubjectKind } from './workspace-sections.mjs';
 
@@ -262,7 +262,8 @@ export function loadEditionManifest(parseDistribution, id) {
         "(core class, the classes the edition's include names, and services a shipped biome's API requires)",
     );
   }
-  const manifest = parseDistribution(splitEditionDefinition(raw, id).document);
+  // `sourcePins` reaches the kernel unchanged: its Distribution schema validates it.
+  const manifest = parseDistribution(raw);
   if (manifest.id !== id) {
     throw new Error(`distribution at ${path} declares id "${manifest.id}", but it was addressed as "${id}"`);
   }
@@ -1366,6 +1367,17 @@ export function resolveDistributionFromInputs(
     const resourceProviderCandidates = index.filter(
       (e) => isDeliverable(e, composed?.webProducerRepos) && entrySourceAdmissible(e, declaredSourceNames),
     );
+    // service name -> the server biomes that own it, for the contract-edge
+    // exclusion check below.
+    const serverOwnersOfService = new Map();
+    for (const candidate of index) {
+      if (candidate.target !== 'server') {continue;}
+      for (const service of candidate.services) {
+        const owners = serverOwnersOfService.get(service) ?? [];
+        owners.push(candidate);
+        serverOwnersOfService.set(service, owners);
+      }
+    }
     const requireBiomeOwner = (consumer, edge) => {
       const owner = edge.owner;
       if (owner.target !== 'server') {
@@ -1549,6 +1561,28 @@ export function resolveDistributionFromInputs(
           }
         }
       }
+      // A REQUIRED dependency-contract edge (the kernel's
+      // `contractRequiredServiceTargets`) needs its target service in the
+      // edition whether or not a `requiresServices` edge states it. Refuse an
+      // excluded owner; never pull one in here.
+      if (entry.dependencyContract !== undefined) {
+        for (const target of schemas.contractRequiredServiceTargets(entry.dependencyContract)) {
+          if (excludedPlatformServices.has(target)) {
+            throw new Error(
+              `distribution "${id}": biome "${entry.id}" dependency contract requires service ` +
+                `"${target}", but the distribution explicitly excludes it`,
+            );
+          }
+          for (const owner of serverOwnersOfService.get(target) ?? []) {
+            if (excludedBiomes.has(owner.id)) {
+              throw new Error(
+                `distribution "${id}": biome "${entry.id}" dependency contract requires service ` +
+                  `"${target}" owned by explicitly excluded biome "${owner.id}"`,
+              );
+            }
+          }
+        }
+      }
       for (const edge of entry.serviceDependencies ?? []) {
         if (!entry.services.includes(edge.consumerService)) {
           throw new Error(
@@ -2157,6 +2191,10 @@ export function resolveDistributionFromInputs(
   // carries exactly the bytes it always did. Not in `inputHash`: derived from
   // the selected biomes, whose `sourceManifestHash` the hash already covers.
   if (nexusBindings.length > 0) {lock.nexusBindings = nexusBindings;}
+  // Store publisher trust — written ONLY when the data root states it, appended
+  // last for the same reason: an edition without it carries exactly the bytes it
+  // always did. Not in `inputHash`; the kernel lock schema validates it.
+  if (composed?.storePublisherTrust !== undefined) {lock.storePublisherTrust = composed.storePublisherTrust;}
 
   // (7) Re-derive the ownership index through the KERNEL so the table this
   //     resolver emits is validated by the exact code every consumer will read
@@ -2172,7 +2210,9 @@ export function resolveDistributionFromInputs(
   const parsed = schemas.parseUnsealedDistributionLock(lock);
   // (9) Admit every declared service-to-service operation requirement; a
   //     refusal throws, so a lock with one is never returned to be written.
-  assertOperationGrantsAdmitted(schemas, parsed);
+  //     An optional operation left ungranted is reported, one line each, and
+  //     never fails (the resolve and `edition check` both run through here).
+  assertOperationGrantsAdmitted(schemas, parsed, { report: (line) => console.log(`[operations] ${line}`) });
   assertOrganizationSweepsAdmitted(schemas, parsed);
   return validateImmutableDistributionLock(lock);
 }
@@ -2238,11 +2278,17 @@ export async function resolveDistributionWithIndex(id, { materialize, inputs, re
     ...(materialize === undefined ? {} : { materialize }),
   });
   const index = mergeExternalSourceEntries(platformIndex, entries, platformServiceIndex);
+  // A caller that injects inputs states the trust itself (a customer edition
+  // states none); otherwise the data root's file is read.
+  const storePublisherTrust =
+    inputs !== undefined && Object.hasOwn(inputs, 'storePublisherTrust')
+      ? inputs.storePublisherTrust
+      : readStorePublisherTrust();
   const lock = resolveDistributionFromInputs(
     id,
     index,
     schemas,
-    { ...composed, sourceRecords },
+    { ...composed, sourceRecords, storePublisherTrust },
     new Date().toISOString(),
     platformServiceIndex,
   );

package/edition/seal-image-digests.mjs

@@ -116,6 +116,7 @@ import { adapterHostRow, assertAdapterBundlesMatchHost, fetchRegistryManifest, l
 import { sealLock, verifyBiomeContentHashes } from './biome-content.mjs';
 import { fetchCatalogue } from './catalogue-fetch.mjs';
 import { readCataloguePin } from './catalogue-pin.mjs';
+import { parseCustomerDefinition } from './customer-definition.mjs';
 import { CATALOGUE_TOKEN_ENV_FLAG, CATALOGUE_USERNAME_FLAG, DEFINITION_FLAG } from './customer-flags.mjs';
 import { EditionChannel } from './edition-constants.mjs';
 import { editionPinnedInputs } from './edition-pinned-inputs.mjs';
@@ -133,6 +134,7 @@ import { assertReleaseEditionTree } from './release-channel-guard.mjs';
 import { commandForSelf } from './remedy-command.mjs';
 import { externalSourceTrees, sourceTreeLocator } from './resolve-images.mjs';
 import { committedRepositoryPins, createPinnedSourceAuthority } from './source-authority.mjs';
+import { readStrictJsonFile } from './strict-json.mjs';
 import {
   loadImageLockForVerification,
   verifyDistributionPlatforms,
@@ -480,7 +482,7 @@ export async function buildSealedEditionLock(options) {
 }
 
 /** The shared in-memory half of the seal: reads both locks, applies `digests`, seals or verifies. Writes nothing. */
-async function prepareEditionSeal({ distributionId, root, digests = new Map(), check = false, vendoredCommit, catalogue, catalogueDigest, fetchManifest = fetchRegistryManifest, checkAdapters = true }) {
+async function prepareEditionSeal({ distributionId, root, digests = new Map(), check = false, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys, fetchManifest = fetchRegistryManifest, checkAdapters = true }) {
   const schemas = await loadKernelDistributionSchemas();
   const lockPath = join(root, distributionId, 'distribution.lock.json');
   const imagesPath = join(root, distributionId, 'images.lock.json');
@@ -522,6 +524,7 @@ async function prepareEditionSeal({ distributionId, root, digests = new Map(), c
     vendoredCommit: pinned,
     catalogue,
     catalogueDigest,
+    storePublisherAnchorKeys,
     check,
     lockPath,
   });
@@ -544,8 +547,8 @@ async function prepareEditionSeal({ distributionId, root, digests = new Map(), c
  * can leave (images sealed, distribution unsealed) is refused by every reader of
  * a sealed edition.
  */
-export async function sealEditionLocks({ distributionId, root, digests = new Map(), check = false, label = 'dist:seal-digests', vendoredCommit, catalogue, catalogueDigest, fetchManifest = fetchRegistryManifest }) {
-  const { prepared } = await prepareEditionSeal({ distributionId, root, digests, check, vendoredCommit, catalogue, catalogueDigest, fetchManifest });
+export async function sealEditionLocks({ distributionId, root, digests = new Map(), check = false, label = 'dist:seal-digests', vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys, fetchManifest = fetchRegistryManifest }) {
+  const { prepared } = await prepareEditionSeal({ distributionId, root, digests, check, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys, fetchManifest });
   const { result, rawImages, applied, lockPath, imagesPath } = prepared;
   replaceLocksTogether([
     ...(applied > 0 ? [{ path: imagesPath, text: `${JSON.stringify(rawImages, null, 2)}\n` }] : []),
@@ -564,14 +567,14 @@ export async function sealEditionLocks({ distributionId, root, digests = new Map
  * The decision, with no files: an UNSEALED lock is sealed (refused under `check`); a SEALED lock is VERIFIED -
  * every hash recomputed, a mismatch refused naming the biome.
  */
-export async function sealOrVerifyLock({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, check = false, lockPath = 'distribution.lock.json' }) {
+export async function sealOrVerifyLock({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys, check = false, lockPath = 'distribution.lock.json' }) {
   if ('unsealedSchema' in lock) {
     if (check) {
       throw new Error(`${lockPath} is unsealed (no biomeContentHash); run \`xema edition seal ${lock.distributionId}\``);
     }
-    return { sealed: true, lock: await sealLock({ schemas, unsealed: lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest }) };
+    return { sealed: true, lock: await sealLock({ schemas, unsealed: lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys }) };
   }
-  await verifyBiomeContentHashes({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest });
+  await verifyBiomeContentHashes({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys });
   return { sealed: false, lock };
 }
 
@@ -689,7 +692,11 @@ async function main() {
   const catalogue = fetched?.catalogue;
   const catalogueDigest = fetched?.digest;
   // A customer seal reads the kernel of its catalogue (from npm), proved its contract authority, before any kernel schema is loaded.
-  if (catalogue !== undefined) {await adoptCatalogueKernel(catalogue);}
+  // Its definition's Store publisher selection is what the lock's `storePublisherTrust` is checked against (biome-content.mjs).
+  const storePublisherAnchorKeys =
+    catalogue === undefined
+      ? undefined
+      : parseCustomerDefinition(await adoptCatalogueKernel(catalogue), readStrictJsonFile(catalogueFlags.get(DEFINITION_FLAG))).definition.storePublisherAnchorKeys;
   const imageLock = await loadImageLockForVerification(distributionId, root);
 
   // Throws on ANY unresolvable subject or missing required platform, before a
@@ -812,7 +819,7 @@ async function main() {
 
   if (writes.length === 0) {
     console.log(`[${label}] lock is fully sealed and agrees with the registry.`);
-    await sealEditionLocks({ distributionId, root, check, label, catalogue, catalogueDigest });
+    await sealEditionLocks({ distributionId, root, check, label, catalogue, catalogueDigest, storePublisherAnchorKeys });
     return;
   }
 
@@ -898,6 +905,7 @@ async function main() {
     label,
     catalogue,
     catalogueDigest,
+    storePublisherAnchorKeys,
   });
 }
 

package/edition/store-publisher-trust.mjs

@@ -0,0 +1,40 @@
+// The Store publishers a vendor edition's data root trusts: read from
+// `store-publisher-identities.json` and written to the lock as
+// `storePublisherTrust`. The kernel lock schema is the ONE validator (non-empty,
+// sorted by anchorKey, unique, https issuer, no refs/pull/); it runs at the
+// resolver's `parseUnsealedDistributionLock` step, so nothing here re-checks it.
+
+import { existsSync } from 'node:fs';
+
+import { storePublisherIdentitiesPath } from './edition-workspace.mjs';
+import { readStrictJsonFile } from './strict-json.mjs';
+
+/** The data root's trusted Store publishers, or `undefined` when it holds no such file. */
+export function readStorePublisherTrust() {
+  const path = storePublisherIdentitiesPath();
+  if (!existsSync(path)) {return undefined;}
+  const document = readStrictJsonFile(path);
+  if (document === null || typeof document !== 'object' || Array.isArray(document)) {
+    throw new Error(`${path}: must be a JSON object`);
+  }
+  const unknown = Object.keys(document).filter((key) => key !== 'schemaVersion' && key !== 'publishers');
+  if (unknown.length > 0) {
+    throw new Error(`${path}: unknown top-level key ${unknown.map((key) => JSON.stringify(key)).join(', ')}`);
+  }
+  if (document.schemaVersion === 1) {
+    throw new Error(
+      `${path}: schemaVersion 1 states no signer; move the file to schemaVersion 2 (\`oidcIssuer\` and \`identity\` per anchor)`,
+    );
+  }
+  if (document.schemaVersion !== 2) {
+    throw new Error(`${path}: schemaVersion must be 2, got ${JSON.stringify(document.schemaVersion)}`);
+  }
+  const { publishers } = document;
+  if (!Array.isArray(publishers) || publishers.some((row) => row === null || typeof row !== 'object' || Array.isArray(row))) {
+    throw new Error(`${path}: publishers must be an array of objects`);
+  }
+  // Only `sourceRepositories` (vendor-ops' key) is dropped; every other key reaches the kernel's
+  // strict schema unchanged, so a stray or misspelt key is refused there, never dropped here.
+  return publishers.map(({ sourceRepositories: _vendorOps, ...row }) => row);
+}
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.33.6",
+  "version": "0.34.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -52,9 +52,9 @@
     "@xemahq/biome-sdk": "^18.1.0",
     "@xemahq/biome-supply-chain": "^0.5.0",
     "@xemahq/distribution-source-hash": "^0.2.2",
-    "@xemahq/dsl": "^0.23.0",
+    "@xemahq/dsl": "^0.24.0",
     "@xemahq/identity-client": "^0.16.0",
-    "@xemahq/contracts": "^0.80.0",
+    "@xemahq/contracts": "^0.83.0",
     "@xemahq/kernel-state-runtime": "^0.8.0",
     "@xemahq/license-verifier": "^0.2.0",
     "@xemahq/service-registry-nest": "^0.12.2",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:bca9f14b3a57c3f6ea1a8a66b2a5e1e78772127b6e443a820f081d35e9dfc405"
+    "sourceDigest": "sha256:86028f64405f33d817413fe305f1263168fe9aa57714b65d43a2ff27e304b1c4"
   }
 }