@xemahq/xema 0.41.0 → 0.41.1

package/dist/edition/verify-image-evidence.bundle.mjs

@@ -62924,6 +62924,14 @@ function resetEditionWorkspaceConfig() {
   cached = void 0;
 }
 
+// edition/string-order.mjs
+function compareStrings(a, b) {
+  if (a === b) {
+    return 0;
+  }
+  return a < b ? -1 : 1;
+}
+
 // edition/evidence-grammars.mjs
 var COMMIT_PATTERN = /^[a-f0-9]{40}$/;
 var SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/;
@@ -62939,16 +62947,6 @@ var requireFromHere2 = createRequire2(import.meta.url);
 
 // edition/operation-requirements.mjs
 import { createRequire as createRequire3 } from "node:module";
-
-// edition/string-order.mjs
-function compareStrings(a, b) {
-  if (a === b) {
-    return 0;
-  }
-  return a < b ? -1 : 1;
-}
-
-// edition/operation-requirements.mjs
 var requireFromHere3 = createRequire3(import.meta.url);
 var PRINCIPAL_PRIVILEGE_FIELDS = Object.freeze(["requiresOperations", "optionalOperations", "requiresOrganizationSweeps"]);
 

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "artifactSha256": "sha256:4acede935bc574c1d35a03eac3e9f47ad2338f0065bdf046b9b1ddc9cd10e4ea",
+  "artifactSha256": "sha256:5966f006186455653ee4f41c2d1b9995d5af4e1e2956d6f7395f7479a73f252f",
   "esbuild": {
     "version": "0.28.2"
   },
@@ -2383,247 +2383,253 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:bbeac7ff01376cb89ed2140526d4795d8e559b3f01612b404a701f19aaa24c6a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
+      "path": "edition/dispatched-runtime-components.mjs",
+      "sha256": "sha256:32a972640de9cc004d2c44e6667a2eaceea7c7ff2b2a5754854723ff5bdbe9c3"
+    },
+    {
+      "package": "@xemahq/xema",
+      "version": "0.41.1",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:282b6d5e70736f7e41cff41167d2cd99b7d0127dcc2b712132888dcfc82e36cd"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:f9f16b58279c8c2619a39c5cc92bdbc334543d1a324304cd5d3b120d66dc8f3a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:e3997bd9a0082e02d01760868b2a4f41ed3081e904126b30fdf86e7938dc6137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:d3747ca300f38832796521b47d12076bdba7f214199a1dec52c9384ab3dde394"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:c575e96b70bda82899931eb0b18567988e2e13e664fa498bcbef96b571dcabb4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:af7c88854007e63e4e77863cf72610f59ff838959dbd381087ec50ba782ae0e1"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:c488ac72ff3f23c0f28f8db159bf84d2c86ec5cda3633db1fe91ca3f21b12214"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b141474fff33b06734fb62cd2552752b991c8267bb1c9bccb22a81dd80e91c6c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:2bca85f534474d12f161a76d29e2efbe18e25a326066360122ae392bf9b27dab"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:65077589d1d9bd129c175c03a6dca6bb4eaf277fa29d6391e1065654fe8cc246"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/git-json.mjs",
       "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:8ccbd4e7ce482cbb25521e893ac047d31ca1da782e87ee2179629e8911aa6aa3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:20abdde62a7b037c01ea9bbe1ff1e6094e6b0efd0add2f656f1938a04409bf82"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/lib.mjs",
-      "sha256": "sha256:c1a354fd8e88429adfe65641267744be555d5957c814fe56b05189010dae8c0d"
+      "sha256": "sha256:840ab735e6cc0ca415efb7646eb591847646f83b1b16327d7aa04350fa74d48e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:e7fed25747ee92be84cdc864ca35a723356df5b3d08923cf71f4bc66a791eb5d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:a23fef4698ef66ba9de4a1aabe3eebe6487d1f105f3fc161bafc5a33b99a2440"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/sigstore-bundle-media-type.mjs",
       "sha256": "sha256:e0aa5a3992f0385ddbbe69eb0307d642ac428ef516c8394816ac4fd52e0ac39c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:9c351f60e8ea838f445f89c3709c60b7f13b021b78d6e40eaef91350a793f0ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/trust-policy-arming.mjs",
       "sha256": "sha256:6f6f192118407e71a744087caea988bcf3d33aca9803217bceb8134d7e2b9120"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/verify-catalogue-evidence.mjs",
       "sha256": "sha256:d7e42efc9edced97e4330cddc46183445a870ba22f57896a7ea6bc600d369137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:396936f3d9e0ed68902b8b03c6fa02479e439357e6194ac8ce0e0991be834706"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:383f37ce066ea5573c30cedf124022095bf94d050f0a266a5881f587cff0ced0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.41.0",
+      "version": "0.41.1",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/edition/dispatched-runtime-components.mjs

@@ -1,5 +1,70 @@
 import { compareStrings } from './string-order.mjs';
 
+/** A `runtime-image` edge target that is neither `{biomeId, componentKey}` nor `{supplementalRuntimeComponentId}`, or is both. */
+export class DispatchedEdgeError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'DispatchedEdgeError';
+  }
+}
+
+/** A dispatched `supplemental:<id>` the runtime-image source index does not declare as a supplemental subject. */
+export class UndeclaredSupplementalRuntimeComponentError extends Error {
+  constructor(supplementalRuntimeComponentId, dispatchingBiomes, context) {
+    super(
+      `${context}: supplemental runtime component "${supplementalRuntimeComponentId}", dispatched by biome ` +
+        `${dispatchingBiomes.map((id) => `"${id}"`).join(', ')}, is not declared as a runtime-component subject ` +
+        'by the runtime image source index — refusing rather than shipping the dispatcher without the image it launches.',
+    );
+    this.name = 'UndeclaredSupplementalRuntimeComponentError';
+    this.supplementalRuntimeComponentId = supplementalRuntimeComponentId;
+    this.dispatchingBiomes = dispatchingBiomes;
+  }
+}
+
+// The `supplementalRuntimeComponentId` field is read as plain data: this CLI is on
+// @xemahq/contracts 0.83, which does not type it. XEMA-171 (CLI edition protocol
+// v9) adopts the typed field from @xemahq/contracts >= 0.91.
+const isNonEmptyString = (value) => typeof value === 'string' && value.length > 0;
+
+/** True for the supplemental form of a projected edge. */
+export const isSupplementalEdge = (edge) => edge.supplementalRuntimeComponentId !== undefined;
+
+/** The identity of a projected edge: `supplemental:<id>` or `<biomeId>\0<componentKey>`. */
+export const dispatchedEdgeIdentity = (edge) =>
+  isSupplementalEdge(edge)
+    ? `supplemental:${edge.supplementalRuntimeComponentId}`
+    : `${edge.biomeId}\0${edge.componentKey}`;
+
+/**
+ * Project one generated-index `runtime-image` edge target into the typed union
+ * the index entry carries. A target that is neither form, or both, is refused
+ * naming the dispatching biome; no `undefined` identity can form.
+ */
+export function projectDispatchedTarget(dispatchingBiomeId, target) {
+  const supplemental = target?.supplementalRuntimeComponentId;
+  const biomeForm = target?.biomeId !== undefined || target?.componentKey !== undefined;
+  if (supplemental !== undefined) {
+    if (biomeForm || !isNonEmptyString(supplemental)) {
+      throw new DispatchedEdgeError(
+        `biome "${dispatchingBiomeId}" has a runtime-image edge target that mixes supplementalRuntimeComponentId with ` +
+          'biomeId/componentKey, or names an empty id — a target is exactly one form',
+      );
+    }
+    return { supplementalRuntimeComponentId: supplemental };
+  }
+  if (!isNonEmptyString(target?.biomeId) || !isNonEmptyString(target?.componentKey)) {
+    throw new DispatchedEdgeError(
+      `biome "${dispatchingBiomeId}" has a runtime-image edge target that is neither { biomeId, componentKey } nor ` +
+        '{ supplementalRuntimeComponentId }',
+    );
+  }
+  return { biomeId: target.biomeId, componentKey: target.componentKey };
+}
+
+const edgeLabel = (edge) =>
+  isSupplementalEdge(edge) ? `supplemental:${edge.supplementalRuntimeComponentId}` : `${edge.biomeId}/${edge.componentKey}`;
+
 /**
  * The runtime components an edition must carry because a biome it rosters
  * DISPATCHES them: the kernel's `runtime-image` edges, projected per biome into
@@ -21,6 +86,10 @@ import { compareStrings } from './string-order.mjs';
  * no biome drawn from a declared source. A biome drawn from a declared source
  * that dispatches is refused for the same reason.
  *
+ * A supplemental edge (`{supplementalRuntimeComponentId}`) names no biome: it
+ * is carried as a row `{ supplementalRuntimeComponentId, consumers }` without
+ * a biome lookup.
+ *
  * Returns one row per distinct (target biome, component key), sorted, with the
  * rostered biomes that dispatch it. Every unresolvable edge is refused, naming
  * the consumer and the target.
@@ -37,12 +106,24 @@ export function resolveDispatchedRuntimeComponents(context, consumers, index) {
     if (consumer.source !== undefined) {
       throw new Error(
         `${context}: biome "${consumer.id}", drawn from declared source "${consumer.source}", dispatches ` +
-          `runtime components (${edges.map((edge) => `${edge.biomeId}/${edge.componentKey}`).join(', ')}). ` +
+          `runtime components (${edges.map(edgeLabel).join(', ')}). ` +
           'A dispatched image is resolved from the first-party biome index, which carries no biome from a ' +
           'declared source — refusing rather than shipping the dispatcher without the images it launches.',
       );
     }
     for (const edge of edges) {
+      if (isSupplementalEdge(edge)) {
+        // Carried as a requirement owned by the dispatching biome. Whether the
+        // runtime image source index declares it is the image plane's refusal.
+        const supplementalKey = dispatchedEdgeIdentity(edge);
+        const row = rows.get(supplementalKey) ?? {
+          supplementalRuntimeComponentId: edge.supplementalRuntimeComponentId,
+          consumers: [],
+        };
+        if (!row.consumers.includes(consumer.id)) {row.consumers.push(consumer.id);}
+        rows.set(supplementalKey, row);
+        continue;
+      }
       const edgeText = `biome "${consumer.id}" dispatches runtime component "${edge.componentKey}" of biome "${edge.biomeId}"`;
       const candidates = index.filter(
         (entry) => entry.id === edge.biomeId && entry.target === 'server' && entry.source === undefined,
@@ -80,3 +161,11 @@ export function resolveDispatchedRuntimeComponents(context, consumers, index) {
     .sort(([a], [b]) => compareStrings(a, b))
     .map(([, row]) => row);
 }
+
+/** Sort order of projected edges: biome edges by (biomeId, componentKey), then supplemental edges by id. */
+export function compareDispatchedEdges(a, b) {
+  if (isSupplementalEdge(a) !== isSupplementalEdge(b)) {return isSupplementalEdge(a) ? 1 : -1;}
+  return isSupplementalEdge(a)
+    ? compareStrings(a.supplementalRuntimeComponentId, b.supplementalRuntimeComponentId)
+    : compareStrings(a.biomeId, b.biomeId) || compareStrings(a.componentKey, b.componentKey);
+}

package/edition/lib.mjs

@@ -20,6 +20,12 @@ import { readBiomeAuthorizationModuleAt } from './authorization-base.mjs';
 import {
   isAuthoritativeProductionBiomeSource,
 } from './connector-source-authority.mjs';
+import {
+  compareDispatchedEdges,
+  dispatchedEdgeIdentity,
+  isSupplementalEdge,
+  projectDispatchedTarget,
+} from './dispatched-runtime-components.mjs';
 import { assertKernelEditionProtocol } from './edition-protocol.mjs';
 import {
   kernelDistPath,
@@ -2037,16 +2043,10 @@ export async function manifestToIndexEntry({ raw, generatedIndex, rel, repo, pat
     ...new Map(
       parsedIndex.biome.edges
         .filter((edge) => edge.kind === kernelBiome.BiomeGeneratedEdgeKind.RuntimeImage)
-        .map((edge) => [
-          `${edge.target.biomeId}\0${edge.target.componentKey}`,
-          { biomeId: edge.target.biomeId, componentKey: edge.target.componentKey },
-        ]),
+        .map((edge) => projectDispatchedTarget(id, edge.target))
+        .map((target) => [dispatchedEdgeIdentity(target), target]),
     ).values(),
-  ].sort(
-    (a, b) =>
-      compareStrings(a.biomeId, b.biomeId) ||
-      compareStrings(a.componentKey, b.componentKey),
-  );
+  ].sort(compareDispatchedEdges);
 
   // Optional server biomes a web biome can integrate with but does not require
   // (never cause an ORPHANED resolution). Carried separately from `requires`.
@@ -2795,10 +2795,12 @@ export function validateImmutableBiomeIndex(index) {
     }
     const dispatched = new Set();
     for (const edge of biome.dispatchesRuntimeComponents ?? []) {
-      const edgeKey = `${edge.biomeId}\0${edge.componentKey}`;
+      const edgeKey = dispatchedEdgeIdentity(projectDispatchedTarget(biome.id, edge));
       if (dispatched.has(edgeKey)) {
         throw new Error(
-          `biome "${biome.id}" dispatches runtime component "${edge.componentKey}" of biome "${edge.biomeId}" more than once`,
+          isSupplementalEdge(edge)
+            ? `biome "${biome.id}" dispatches ${edgeKey} more than once`
+            : `biome "${biome.id}" dispatches runtime component "${edge.componentKey}" of biome "${edge.biomeId}" more than once`,
         );
       }
       dispatched.add(edgeKey);

package/edition/resolve-images.mjs

@@ -40,7 +40,10 @@ import { setImmediate as yieldToEventLoop } from 'node:timers/promises';
 import { assertBuildLedgerComplete } from './build-ledger-completeness.mjs';
 import { BUILD_LEDGER_FILE, readBuildLedger } from './build-ledger.mjs';
 import { CROSS_REPO_BUILD_INPUTS_PATH, crossRepoInputKey, resolveCrossRepoVendoredInputs } from './cross-repo-build-inputs.mjs';
-import { resolveDispatchedRuntimeComponents } from './dispatched-runtime-components.mjs';
+import {
+  resolveDispatchedRuntimeComponents,
+  UndeclaredSupplementalRuntimeComponentError,
+} from './dispatched-runtime-components.mjs';
 import {
   assertCanonicalDistributionId,
   distributionOutputPath,
@@ -681,6 +684,28 @@ export function resolveImageStructure(
     dispatchers,
     biomeIndex,
   )) {
+    if (dispatched.supplementalRuntimeComponentId !== undefined) {
+      // THE REFUSAL: a dispatched supplemental runtime component must be one the
+      // runtime image source index declares as a runtime-component subject.
+      // Every image lock is produced here, so this is the one place it is checked.
+      const declared = runtimeSourceIndex.supplementalSubjects.find(
+        (subject) =>
+          subject.kind === enums.RuntimeImageSubjectKind.RuntimeComponent &&
+          subject.id === dispatched.supplementalRuntimeComponentId,
+      );
+      if (declared === undefined) {
+        throw new UndeclaredSupplementalRuntimeComponentError(
+          dispatched.supplementalRuntimeComponentId,
+          dispatched.consumers,
+          `distribution "${lock.distributionId}"`,
+        );
+      }
+      addSupplementalSubject(
+        declared,
+        dispatched.consumers.map((biomeId) => ({ kind: enums.RuntimeImageOwnerKind.Biome, biomeId })),
+      );
+      continue;
+    }
     const { target } = dispatched;
     addSubject(subjects, {
       kind: enums.RuntimeImageSubjectKind.RuntimeComponent,
@@ -717,6 +742,16 @@ export function resolveImageStructure(
   const boundSubjects = new Set(
     runtimeSourceIndex.platformServiceBindings.map((binding) => bindingKey(binding)),
   );
+  // A biome's `supplemental:<id>` dispatch edge also carries the subject: the
+  // catalogue check reads the whole first-party index, not this roster, so a
+  // subject reached only by a dispatch is not "unreachable" in any edition.
+  const dispatchedSubjects = new Set(
+    biomeIndex
+      .filter((entry) => entry.source === undefined)
+      .flatMap((entry) => entry.dispatchesRuntimeComponents ?? [])
+      .filter((edge) => edge.supplementalRuntimeComponentId !== undefined)
+      .map((edge) => `${enums.RuntimeImageSubjectKind.RuntimeComponent}\0${edge.supplementalRuntimeComponentId}`),
+  );
   const launchers = new Map(
     supplementalSources
       .filter((source) => source.launchedBy !== undefined)
@@ -733,11 +768,11 @@ export function resolveImageStructure(
   for (const [key, supplemental] of supplementalSubjects) {
     const launcher = launchers.get(key);
     if (launcher === undefined) {
-      if (!boundSubjects.has(key)) {
+      if (!boundSubjects.has(key) && !dispatchedSubjects.has(key)) {
         throw new Error(
-          `supplemental subject "${supplemental.kind}:${supplemental.id}" has neither a launchedBy nor a ` +
-            'platform-service binding, so no edition could ever carry it — declare what launches it ' +
-            '(runtimeImageSources.supplementalSources[].launchedBy) or bind it to a platform service',
+          `supplemental subject "${supplemental.kind}:${supplemental.id}" has neither a launchedBy, a ` +
+            'platform-service binding nor a biome dispatching it, so no edition could ever carry it — declare what launches it ' +
+            '(runtimeImageSources.supplementalSources[].launchedBy), bind it to a platform service or dispatch it from a biome',
         );
       }
       continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.41.0",
+  "version": "0.41.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:322929ee2999d155d5d612f17bb786adef52f44c46cee82b9bc9b11ecc792758"
+    "sourceDigest": "sha256:7e8af916b8cd5c8de331d7e274a7022071e6b6ac0d9d54042c2e55461ad46bab"
   }
 }