@xemahq/xema 0.40.1 → 0.40.2

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -2383,229 +2383,229 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:bbeac7ff01376cb89ed2140526d4795d8e559b3f01612b404a701f19aaa24c6a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:287e4cf042626963e07396c706350e9668adbcacd238a7ad4db1d68bba3858b2"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:f9f16b58279c8c2619a39c5cc92bdbc334543d1a324304cd5d3b120d66dc8f3a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:e3997bd9a0082e02d01760868b2a4f41ed3081e904126b30fdf86e7938dc6137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:71ae51028847ab3430ffec9b229b0516a7705b75a6de1fcfa665f5e1abf8e9bb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:c575e96b70bda82899931eb0b18567988e2e13e664fa498bcbef96b571dcabb4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:aa1a05f1728813a7bdb1e02d9305e9adf641d695e6767305210c67a1d81b38a7"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:c488ac72ff3f23c0f28f8db159bf84d2c86ec5cda3633db1fe91ca3f21b12214"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b141474fff33b06734fb62cd2552752b991c8267bb1c9bccb22a81dd80e91c6c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:18ba727e6b13ca252def25cc6bd9adf894cbc2018198c41ce522637eeac7f871"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:b9dd5c01903394436530783614efb0cd357d982ed2befd844a39328479773cbc"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/git-json.mjs",
       "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:433202eb2db84510acd11de6fe5ede81c8d96b8bc72991444940f7f84a48897f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:20abdde62a7b037c01ea9bbe1ff1e6094e6b0efd0add2f656f1938a04409bf82"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/lib.mjs",
       "sha256": "sha256:862a21a357f5219dc6d549fe83209267a5010461f1f7889bf63d0baa6423de2e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:e7fed25747ee92be84cdc864ca35a723356df5b3d08923cf71f4bc66a791eb5d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:a23fef4698ef66ba9de4a1aabe3eebe6487d1f105f3fc161bafc5a33b99a2440"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:858b607dde94e2abd00a341f569e18cfa567d4bff139c64a2d60abbb7de4c85e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:62f83f8bb835f360535402d12657156d2c9d6e651b426c2b30a04a2dc2f8d3e8"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:383f37ce066ea5573c30cedf124022095bf94d050f0a266a5881f587cff0ced0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.40.1",
+      "version": "0.40.2",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/edition/build-runtime-image-source-index.mjs

@@ -322,6 +322,11 @@ async function resolveContractAuthority(schemas, kernelRoot, kernelCommit) {
  *
  * A repository this index does not source is a REFUSAL, never a silent no-op —
  * a typo that quietly rewrote nothing would read in review as "the refresh ran".
+ *
+ * A declared source repository with NO committed pin JOINS the index through the
+ * same scope: every committed pin is preserved verbatim and only the named
+ * repository is resolved (at `--at`, which must be published). It needs no
+ * full `--trusted-write`, which would re-derive and drift every other pin.
  */
 export function preserveOtherRepositoryPins(
   repoScope,
@@ -343,12 +348,6 @@ export function preserveOtherRepositoryPins(
       'the committed runtime image source index declares no repositoryPins to preserve',
     );
   }
-  if (!pins.some((pin) => pin.repo === repoScope)) {
-    throw new Error(
-      `--repo "${repoScope}" has no committed pin to refresh. A repository ` +
-        `joining this index is a full --trusted-write, not a scoped refresh.`,
-    );
-  }
   return pins
     .filter((pin) => pin.repo !== repoScope)
     .map((pin) => ({
@@ -463,6 +462,13 @@ export async function buildTrustedIndex(
   const getRepositoryIdentity = (repo) => {
     let identity = repositoryIdentities.get(repo);
     if (!identity) {
+      if (repoScope !== undefined && repo !== repoScope) {
+        throw new Error(
+          `source repository "${repo}" has no committed pin and is not the --repo scope ` +
+            `"${repoScope}". A scoped write adds one repository; resolving "${repo}" live ` +
+            `would re-pin a repository nobody asked about. Add it with its own --repo ${repo} --at <sha>.`,
+        );
+      }
       identity = repositoryIdentity(repo, sourceAuthority);
       repositoryIdentities.set(repo, identity);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.40.1",
+  "version": "0.40.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:7d0a83c0865bae61ba3862a0f1e1d73a90ee6cef5e13af81e1a0a9deb4b11c96"
+    "sourceDigest": "sha256:7354d3fd083104ce7289eb00634ebdd7dea0aefb38bd527bce4ab63dd52114aa"
   }
 }