@xemahq/xema 0.33.6 → 0.34.1

package/edition/resolve-distribution.mjs

@@ -78,7 +78,6 @@ import { resolveDispatchedRuntimeComponents } from './dispatched-runtime-compone
 import { fleetChartSetLockPath, writeEditionChartSet } from './edition-chart-set.mjs';
 import { workspaceSection } from './edition-config.mjs';
 import { editionPinnedInputs } from './edition-pinned-inputs.mjs';
-import { splitEditionDefinition } from './edition-source-pins.mjs';
 import { WorkspaceRoot, configureEditionWorkspaceFromProcess, editionsRoot, isEntryModule, kernelPackageDir } from './edition-workspace.mjs';
 import { walkDeclaredSources } from './external-source-walk.mjs';
 import {
@@ -105,6 +104,7 @@ import { closureBiomeFacts } from './positive-closure.mjs';
 import { assertReleaseContent, assertReleaseEditionTree } from './release-channel-guard.mjs';
 import { commandFor } from './remedy-command.mjs';
 import { soleResourceProvider } from './required-resource-provider.mjs';
+import { readStorePublisherTrust } from './store-publisher-trust.mjs';
 import { readStrictJsonFile } from './strict-json.mjs';
 import { RuntimeSubjectKind } from './workspace-sections.mjs';
 
@@ -262,7 +262,8 @@ export function loadEditionManifest(parseDistribution, id) {
         "(core class, the classes the edition's include names, and services a shipped biome's API requires)",
     );
   }
-  const manifest = parseDistribution(splitEditionDefinition(raw, id).document);
+  // `sourcePins` reaches the kernel unchanged: its Distribution schema validates it.
+  const manifest = parseDistribution(raw);
   if (manifest.id !== id) {
     throw new Error(`distribution at ${path} declares id "${manifest.id}", but it was addressed as "${id}"`);
   }
@@ -1366,6 +1367,17 @@ export function resolveDistributionFromInputs(
     const resourceProviderCandidates = index.filter(
       (e) => isDeliverable(e, composed?.webProducerRepos) && entrySourceAdmissible(e, declaredSourceNames),
     );
+    // service name -> the server biomes that own it, for the contract-edge
+    // exclusion check below.
+    const serverOwnersOfService = new Map();
+    for (const candidate of index) {
+      if (candidate.target !== 'server') {continue;}
+      for (const service of candidate.services) {
+        const owners = serverOwnersOfService.get(service) ?? [];
+        owners.push(candidate);
+        serverOwnersOfService.set(service, owners);
+      }
+    }
     const requireBiomeOwner = (consumer, edge) => {
       const owner = edge.owner;
       if (owner.target !== 'server') {
@@ -1549,6 +1561,28 @@ export function resolveDistributionFromInputs(
           }
         }
       }
+      // A REQUIRED dependency-contract edge (the kernel's
+      // `contractRequiredServiceTargets`) needs its target service in the
+      // edition whether or not a `requiresServices` edge states it. Refuse an
+      // excluded owner; never pull one in here.
+      if (entry.dependencyContract !== undefined) {
+        for (const target of schemas.contractRequiredServiceTargets(entry.dependencyContract)) {
+          if (excludedPlatformServices.has(target)) {
+            throw new Error(
+              `distribution "${id}": biome "${entry.id}" dependency contract requires service ` +
+                `"${target}", but the distribution explicitly excludes it`,
+            );
+          }
+          for (const owner of serverOwnersOfService.get(target) ?? []) {
+            if (excludedBiomes.has(owner.id)) {
+              throw new Error(
+                `distribution "${id}": biome "${entry.id}" dependency contract requires service ` +
+                  `"${target}" owned by explicitly excluded biome "${owner.id}"`,
+              );
+            }
+          }
+        }
+      }
       for (const edge of entry.serviceDependencies ?? []) {
         if (!entry.services.includes(edge.consumerService)) {
           throw new Error(
@@ -2157,6 +2191,10 @@ export function resolveDistributionFromInputs(
   // carries exactly the bytes it always did. Not in `inputHash`: derived from
   // the selected biomes, whose `sourceManifestHash` the hash already covers.
   if (nexusBindings.length > 0) {lock.nexusBindings = nexusBindings;}
+  // Store publisher trust — written ONLY when the data root states it, appended
+  // last for the same reason: an edition without it carries exactly the bytes it
+  // always did. Not in `inputHash`; the kernel lock schema validates it.
+  if (composed?.storePublisherTrust !== undefined) {lock.storePublisherTrust = composed.storePublisherTrust;}
 
   // (7) Re-derive the ownership index through the KERNEL so the table this
   //     resolver emits is validated by the exact code every consumer will read
@@ -2172,7 +2210,9 @@ export function resolveDistributionFromInputs(
   const parsed = schemas.parseUnsealedDistributionLock(lock);
   // (9) Admit every declared service-to-service operation requirement; a
   //     refusal throws, so a lock with one is never returned to be written.
-  assertOperationGrantsAdmitted(schemas, parsed);
+  //     An optional operation left ungranted is reported, one line each, and
+  //     never fails (the resolve and `edition check` both run through here).
+  assertOperationGrantsAdmitted(schemas, parsed, { report: (line) => console.log(`[operations] ${line}`) });
   assertOrganizationSweepsAdmitted(schemas, parsed);
   return validateImmutableDistributionLock(lock);
 }
@@ -2238,11 +2278,17 @@ export async function resolveDistributionWithIndex(id, { materialize, inputs, re
     ...(materialize === undefined ? {} : { materialize }),
   });
   const index = mergeExternalSourceEntries(platformIndex, entries, platformServiceIndex);
+  // A caller that injects inputs states the trust itself (a customer edition
+  // states none); otherwise the data root's file is read.
+  const storePublisherTrust =
+    inputs !== undefined && Object.hasOwn(inputs, 'storePublisherTrust')
+      ? inputs.storePublisherTrust
+      : readStorePublisherTrust();
   const lock = resolveDistributionFromInputs(
     id,
     index,
     schemas,
-    { ...composed, sourceRecords },
+    { ...composed, sourceRecords, storePublisherTrust },
     new Date().toISOString(),
     platformServiceIndex,
   );

package/edition/seal-image-digests.mjs

@@ -98,8 +98,9 @@
 //                     state a pin advance leaves, owner ruling 2026-09-29), as
 //                     ONE line on stdout, exit 0. A malformed, empty or
 //                     PARTIALLY sealed lock exits 1: a broken artifact.
-//                     OFFLINE and structural: it reads the lock and nothing
-//                     else. That is deliberate rather than a shortcut — a
+//                     OFFLINE and structural: it reads the locks and nothing
+//                     else (the distribution lock through the built kernel,
+//                     `--kernel`, only when the images lock is PUBLISHABLE). That is deliberate rather than a shortcut — a
 //                     publication gate that needs a registry credential can
 //                     fail for reasons that have nothing to do with the artifact
 //                     being published, and a gate people learn to re-run is a
@@ -116,6 +117,7 @@ import { adapterHostRow, assertAdapterBundlesMatchHost, fetchRegistryManifest, l
 import { sealLock, verifyBiomeContentHashes } from './biome-content.mjs';
 import { fetchCatalogue } from './catalogue-fetch.mjs';
 import { readCataloguePin } from './catalogue-pin.mjs';
+import { parseCustomerDefinition } from './customer-definition.mjs';
 import { CATALOGUE_TOKEN_ENV_FLAG, CATALOGUE_USERNAME_FLAG, DEFINITION_FLAG } from './customer-flags.mjs';
 import { EditionChannel } from './edition-constants.mjs';
 import { editionPinnedInputs } from './edition-pinned-inputs.mjs';
@@ -132,7 +134,9 @@ import { assertPlatformCanParseLock } from './platform-lock-readability.mjs';
 import { assertReleaseEditionTree } from './release-channel-guard.mjs';
 import { commandForSelf } from './remedy-command.mjs';
 import { externalSourceTrees, sourceTreeLocator } from './resolve-images.mjs';
+import { readSealedDistributionLock } from './sealed-distribution-lock.mjs';
 import { committedRepositoryPins, createPinnedSourceAuthority } from './source-authority.mjs';
+import { readStrictJsonFile } from './strict-json.mjs';
 import {
   loadImageLockForVerification,
   verifyDistributionPlatforms,
@@ -304,10 +308,10 @@ export const PublicationVerdict = Object.freeze({
  *     some services by digest and silently leave the rest un-pinned.
  *
  * IT CHECKS SHAPE AS WELL AS PRESENCE. This gate reads the lock with
- * `JSON.parse` because the publication workflow checks out this repository
- * ALONE, with no built kernel to parse through, so the kernel's digest regex is
- * not upstream of it and this file's own `SHA256_DIGEST` is the only rule on
- * this path.
+ * `JSON.parse`, so the kernel's digest regex is not upstream of it and this
+ * file's own `SHA256_DIGEST` is the only rule on the images lock. (The sealed
+ * grammar of the distribution lock is the kernel's, asked of it separately once
+ * the images lock reads PUBLISHABLE.)
  */
 export function classifyPublicationState({
   distributionId,
@@ -480,7 +484,7 @@ export async function buildSealedEditionLock(options) {
 }
 
 /** The shared in-memory half of the seal: reads both locks, applies `digests`, seals or verifies. Writes nothing. */
-async function prepareEditionSeal({ distributionId, root, digests = new Map(), check = false, vendoredCommit, catalogue, catalogueDigest, fetchManifest = fetchRegistryManifest, checkAdapters = true }) {
+async function prepareEditionSeal({ distributionId, root, digests = new Map(), check = false, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys, fetchManifest = fetchRegistryManifest, checkAdapters = true }) {
   const schemas = await loadKernelDistributionSchemas();
   const lockPath = join(root, distributionId, 'distribution.lock.json');
   const imagesPath = join(root, distributionId, 'images.lock.json');
@@ -522,6 +526,7 @@ async function prepareEditionSeal({ distributionId, root, digests = new Map(), c
     vendoredCommit: pinned,
     catalogue,
     catalogueDigest,
+    storePublisherAnchorKeys,
     check,
     lockPath,
   });
@@ -544,8 +549,8 @@ async function prepareEditionSeal({ distributionId, root, digests = new Map(), c
  * can leave (images sealed, distribution unsealed) is refused by every reader of
  * a sealed edition.
  */
-export async function sealEditionLocks({ distributionId, root, digests = new Map(), check = false, label = 'dist:seal-digests', vendoredCommit, catalogue, catalogueDigest, fetchManifest = fetchRegistryManifest }) {
-  const { prepared } = await prepareEditionSeal({ distributionId, root, digests, check, vendoredCommit, catalogue, catalogueDigest, fetchManifest });
+export async function sealEditionLocks({ distributionId, root, digests = new Map(), check = false, label = 'dist:seal-digests', vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys, fetchManifest = fetchRegistryManifest }) {
+  const { prepared } = await prepareEditionSeal({ distributionId, root, digests, check, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys, fetchManifest });
   const { result, rawImages, applied, lockPath, imagesPath } = prepared;
   replaceLocksTogether([
     ...(applied > 0 ? [{ path: imagesPath, text: `${JSON.stringify(rawImages, null, 2)}\n` }] : []),
@@ -564,14 +569,14 @@ export async function sealEditionLocks({ distributionId, root, digests = new Map
  * The decision, with no files: an UNSEALED lock is sealed (refused under `check`); a SEALED lock is VERIFIED -
  * every hash recomputed, a mismatch refused naming the biome.
  */
-export async function sealOrVerifyLock({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, check = false, lockPath = 'distribution.lock.json' }) {
+export async function sealOrVerifyLock({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys, check = false, lockPath = 'distribution.lock.json' }) {
   if ('unsealedSchema' in lock) {
     if (check) {
       throw new Error(`${lockPath} is unsealed (no biomeContentHash); run \`xema edition seal ${lock.distributionId}\``);
     }
-    return { sealed: true, lock: await sealLock({ schemas, unsealed: lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest }) };
+    return { sealed: true, lock: await sealLock({ schemas, unsealed: lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys }) };
   }
-  await verifyBiomeContentHashes({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest });
+  await verifyBiomeContentHashes({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, storePublisherAnchorKeys });
   return { sealed: false, lock };
 }
 
@@ -595,19 +600,12 @@ async function main() {
     );
   }
 
-  // PUBLICATION GATE — offline and structural. It returns BEFORE any call that
-  // would load the built kernel contracts, so it needs no sibling repository, no
-  // credential and no `node_modules`.
+  // PUBLICATION GATE — offline (no network, no credential) and structural. The images lock is
+  // classified with no kernel at all. A PUBLISHABLE verdict then also reads the distribution lock
+  // through the BUILT kernel (`readSealedDistributionLock`, the predicate `xema edition artifact`
+  // uses), so the publication workflow provisions the built kernel before it asks (`--kernel`).
+  // It returns BEFORE `loadImageLockForVerification`, which needs sibling repositories and the registry.
   //
-  // The distinction is the IMPORT versus the CALL, and getting it wrong once
-  // cost a needless refactor: importing `verify-image-platforms.mjs`,
-  // `oras.mjs` and `lib.mjs` is all FINE without a kernel —
-  // measured, all three load in a flat checkout — because
-  // `loadKernelDistributionSchemas()` is invoked at USE time, not at module
-  // load. What fails in the publication checkout is CALLING
-  // `loadImageLockForVerification`. So the fix is to not call it, which is what
-  // this early return does; making the imports dynamic bought nothing and was
-  // reverted.
   // EVERY mode, the offline publication verdict included: a release edition
   // never carries develop content, whatever the sealer is asked to do with it.
   assertReleaseEditionTree(join(editionsRoot(), distributionId));
@@ -624,6 +622,13 @@ async function main() {
     // including an empty stdout from a crash — is a failure there, never a
     // withhold. The human explanation goes to stderr.
     if (state.verdict === PublicationVerdict.Publishable) {
+      // The artifact verb reads the distribution lock through this same predicate; a verdict that
+      // passed an unsealed one would be the first thing `xema edition artifact` contradicts.
+      readSealedDistributionLock({
+        schemas: await loadKernelDistributionSchemas(),
+        lockPath: join(editionsRoot(), distributionId, 'distribution.lock.json'),
+        distributionId,
+      });
       console.error(
         `[dist:seal-digests --publication-verdict] "${distributionId}": all ` +
           `${state.subjectCount} subject(s) carry a canonical imageDigest; publishable. ` +
@@ -689,7 +694,11 @@ async function main() {
   const catalogue = fetched?.catalogue;
   const catalogueDigest = fetched?.digest;
   // A customer seal reads the kernel of its catalogue (from npm), proved its contract authority, before any kernel schema is loaded.
-  if (catalogue !== undefined) {await adoptCatalogueKernel(catalogue);}
+  // Its definition's Store publisher selection is what the lock's `storePublisherTrust` is checked against (biome-content.mjs).
+  const storePublisherAnchorKeys =
+    catalogue === undefined
+      ? undefined
+      : parseCustomerDefinition(await adoptCatalogueKernel(catalogue), readStrictJsonFile(catalogueFlags.get(DEFINITION_FLAG))).definition.storePublisherAnchorKeys;
   const imageLock = await loadImageLockForVerification(distributionId, root);
 
   // Throws on ANY unresolvable subject or missing required platform, before a
@@ -812,7 +821,7 @@ async function main() {
 
   if (writes.length === 0) {
     console.log(`[${label}] lock is fully sealed and agrees with the registry.`);
-    await sealEditionLocks({ distributionId, root, check, label, catalogue, catalogueDigest });
+    await sealEditionLocks({ distributionId, root, check, label, catalogue, catalogueDigest, storePublisherAnchorKeys });
     return;
   }
 
@@ -898,6 +907,7 @@ async function main() {
     label,
     catalogue,
     catalogueDigest,
+    storePublisherAnchorKeys,
   });
 }
 

package/edition/sealed-distribution-lock.mjs

@@ -0,0 +1,22 @@
+// sealed-distribution-lock — the one predicate for "this committed distribution.lock.json is the SEALED grammar".
+// `xema edition artifact` and the `xema edition seal --publication-verdict` gate both ask it, so the verdict can
+// never say PUBLISHABLE for a lock the artifact verb then refuses.
+
+import { readFileSync } from 'node:fs';
+
+/**
+ * Parse the committed distribution lock at `lockPath` as the sealed grammar; an unsealed (or otherwise
+ * unparseable) lock is refused, naming the file. Returns the parsed sealed lock.
+ */
+export function readSealedDistributionLock({ schemas, lockPath, distributionId }) {
+  const raw = JSON.parse(readFileSync(lockPath, 'utf8'));
+  try {
+    return { raw, sealed: schemas.parseDistributionLock(raw) };
+  } catch (error) {
+    throw new Error(
+      `${lockPath} is not a sealed distribution lock, so nothing is published from it. ` +
+        `Run \`xema edition seal ${distributionId}\` first. (${error.message})`,
+      { cause: error },
+    );
+  }
+}

package/edition/store-publisher-trust.mjs

@@ -0,0 +1,40 @@
+// The Store publishers a vendor edition's data root trusts: read from
+// `store-publisher-identities.json` and written to the lock as
+// `storePublisherTrust`. The kernel lock schema is the ONE validator (non-empty,
+// sorted by anchorKey, unique, https issuer, no refs/pull/); it runs at the
+// resolver's `parseUnsealedDistributionLock` step, so nothing here re-checks it.
+
+import { existsSync } from 'node:fs';
+
+import { storePublisherIdentitiesPath } from './edition-workspace.mjs';
+import { readStrictJsonFile } from './strict-json.mjs';
+
+/** The data root's trusted Store publishers, or `undefined` when it holds no such file. */
+export function readStorePublisherTrust() {
+  const path = storePublisherIdentitiesPath();
+  if (!existsSync(path)) {return undefined;}
+  const document = readStrictJsonFile(path);
+  if (document === null || typeof document !== 'object' || Array.isArray(document)) {
+    throw new Error(`${path}: must be a JSON object`);
+  }
+  const unknown = Object.keys(document).filter((key) => key !== 'schemaVersion' && key !== 'publishers');
+  if (unknown.length > 0) {
+    throw new Error(`${path}: unknown top-level key ${unknown.map((key) => JSON.stringify(key)).join(', ')}`);
+  }
+  if (document.schemaVersion === 1) {
+    throw new Error(
+      `${path}: schemaVersion 1 states no signer; move the file to schemaVersion 2 (\`oidcIssuer\` and \`identity\` per anchor)`,
+    );
+  }
+  if (document.schemaVersion !== 2) {
+    throw new Error(`${path}: schemaVersion must be 2, got ${JSON.stringify(document.schemaVersion)}`);
+  }
+  const { publishers } = document;
+  if (!Array.isArray(publishers) || publishers.some((row) => row === null || typeof row !== 'object' || Array.isArray(row))) {
+    throw new Error(`${path}: publishers must be an array of objects`);
+  }
+  // Only `sourceRepositories` (vendor-ops' key) is dropped; every other key reaches the kernel's
+  // strict schema unchanged, so a stray or misspelt key is refused there, never dropped here.
+  return publishers.map(({ sourceRepositories: _vendorOps, ...row }) => row);
+}
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.33.6",
+  "version": "0.34.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -52,9 +52,9 @@
     "@xemahq/biome-sdk": "^18.1.0",
     "@xemahq/biome-supply-chain": "^0.5.0",
     "@xemahq/distribution-source-hash": "^0.2.2",
-    "@xemahq/dsl": "^0.23.0",
+    "@xemahq/dsl": "^0.24.0",
     "@xemahq/identity-client": "^0.16.0",
-    "@xemahq/contracts": "^0.80.0",
+    "@xemahq/contracts": "^0.83.0",
     "@xemahq/kernel-state-runtime": "^0.8.0",
     "@xemahq/license-verifier": "^0.2.0",
     "@xemahq/service-registry-nest": "^0.12.2",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:bca9f14b3a57c3f6ea1a8a66b2a5e1e78772127b6e443a820f081d35e9dfc405"
+    "sourceDigest": "sha256:f36703385f5feb7476f762f26e0b8e5b6740dab8c59225abc4cdf14d32f0c48e"
   }
 }