@xemahq/xema 0.44.0 → 0.44.1

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -2419,277 +2419,277 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:bbeac7ff01376cb89ed2140526d4795d8e559b3f01612b404a701f19aaa24c6a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/canonical-repository-url.mjs",
       "sha256": "sha256:91e7590afba782a3ee2fa64084e7c715e6a5b52c11e8a9cc68c64397f181b888"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/develop-graph.mjs",
       "sha256": "sha256:319db77e708dd73a9dd4a81a963d86e52b030cad3346b104c0862af4e38a2237"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/dispatched-runtime-components.mjs",
       "sha256": "sha256:9712823d183a60108cd002b2d36a9e5c0867b9d576dd02825264a18f7b8ece69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:282b6d5e70736f7e41cff41167d2cd99b7d0127dcc2b712132888dcfc82e36cd"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:f9f16b58279c8c2619a39c5cc92bdbc334543d1a324304cd5d3b120d66dc8f3a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:7604e79a480c9b9db1d1c256155f05298adf6caa49da95ad232f6be581f3c72e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:d3747ca300f38832796521b47d12076bdba7f214199a1dec52c9384ab3dde394"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:c575e96b70bda82899931eb0b18567988e2e13e664fa498bcbef96b571dcabb4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:af7c88854007e63e4e77863cf72610f59ff838959dbd381087ec50ba782ae0e1"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:1f10ece5f34b6a6b0dbe169b6cbabe4b1b0778a1bc136c9c5c29b54181b1f546"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b141474fff33b06734fb62cd2552752b991c8267bb1c9bccb22a81dd80e91c6c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:892b360f9f80d2308b0b12f9b99658ae06173878d9b71cf5d6fc8bd717b3c86e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:65077589d1d9bd129c175c03a6dca6bb4eaf277fa29d6391e1065654fe8cc246"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/first-party-source-ids.mjs",
       "sha256": "sha256:20cb1ad7cfb8c6e6686a6be5a51289da4bba76c20b58d9c1b5b6b3813a38dc1c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/git-json.mjs",
       "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/git-source-auth.mjs",
       "sha256": "sha256:c1b32aa6f7d59798db58238d632cafeadbd4f07376396a31acdeb5f0ac56dcac"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:8ccbd4e7ce482cbb25521e893ac047d31ca1da782e87ee2179629e8911aa6aa3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:20abdde62a7b037c01ea9bbe1ff1e6094e6b0efd0add2f656f1938a04409bf82"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/lib.mjs",
       "sha256": "sha256:2cf8f4b52f9532f536a27c8bf6736cc760d7026754945209b1cf5be23391ef49"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:92656c5e920fca2a5a75c0b8db133d551ba044c84a149f33435479248b3dff8b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:32fa918729a83587b4d3bca6e5fe381f5a525397ebc49d52729ec1f8cf216c37"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/sigstore-bundle-media-type.mjs",
       "sha256": "sha256:e0aa5a3992f0385ddbbe69eb0307d642ac428ef516c8394816ac4fd52e0ac39c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:9c351f60e8ea838f445f89c3709c60b7f13b021b78d6e40eaef91350a793f0ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/trust-policy-arming.mjs",
       "sha256": "sha256:6f6f192118407e71a744087caea988bcf3d33aca9803217bceb8134d7e2b9120"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/verify-catalogue-evidence.mjs",
       "sha256": "sha256:d7e42efc9edced97e4330cddc46183445a870ba22f57896a7ea6bc600d369137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:396936f3d9e0ed68902b8b03c6fa02479e439357e6194ac8ce0e0991be834706"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:18c28e9fa2a6b7d8589c8434fc6ed9f1e93954d41339813e711ed0fbbcf5c61d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.44.0",
+      "version": "0.44.1",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/edition/image-lock-service-rows.mjs

@@ -0,0 +1,24 @@
+// image-lock-service-rows — the one answer to "which image row serves this service or runtime component of this biome".
+//
+// A schemaVersion-4 images lock gives a service composed into a process NO subject of its own: it is a
+// `members[]` entry (`{service, packageDir}`) of a `composed-process` subject whose `owners` are the member biomes.
+// Every CLI read that asks whether a lock or catalogue carries the image of a biome's service goes through here, so
+// no reader can miss the composed form.
+
+/** Whether `subject` is owned by the biome `biomeId`. */
+function isOwnedByBiome(subject, biomeId, enums) {
+  return subject.owners.some((owner) => owner.kind === enums.RuntimeImageOwnerKind.Biome && owner.biomeId === biomeId);
+}
+
+/**
+ * The subject carrying the image of `kind:id` for the biome `biomeId`, or undefined.
+ * A service is served by (a) a Service subject with that id owned by the biome, or (b) a subject owned by the biome
+ * whose `members[]` names the service. The biome's own `services` list supplies `id`, and contracts guarantees member
+ * service names are unique within a subject, so the owner check pairs the member with the biome.
+ */
+export function subjectServingBiome(subjects, biomeId, kind, id, enums) {
+  const owned = subjects.filter((subject) => isOwnedByBiome(subject, biomeId, enums));
+  const own = owned.find((subject) => subject.kind === kind && subject.id === id);
+  if (own !== undefined || kind !== enums.RuntimeImageSubjectKind.Service) {return own;}
+  return owned.find((subject) => (subject.members ?? []).some((member) => member.service === id));
+}

package/edition/resolve-customer-edition.mjs

@@ -36,6 +36,7 @@ import {
 import { assertRosteredChartSetLock } from './edition-chart-set.mjs';
 import { EditionLockFile } from './edition-constants.mjs';
 import { editionsRoot } from './edition-workspace.mjs';
+import { subjectServingBiome } from './image-lock-service-rows.mjs';
 import { adoptCatalogueKernel } from './kernel-package.mjs';
 import { compareStrings, imageLockWriteSchemaVersion, serializeJson, validateImmutableImageLock } from './lib.mjs';
 import { pinnedSource, snapshotPinSource } from './pin-source.mjs';
@@ -142,7 +143,6 @@ export function projectVendorImages(catalogue, lock, enums) {
     );
     if (owners.length > 0) {subjects.push({ ...subject, owners });}
   }
-  const have = new Set(subjects.filter((s) => s.owners.some((o) => o.kind === enums.RuntimeImageOwnerKind.Biome)).flatMap((s) => s.owners.map((o) => `${o.biomeId}\0${s.kind}\0${s.id}`)));
   for (const biome of lock.biomes.filter((b) => b.source === undefined && b.target !== 'web')) {
     const shared = new Set(Object.keys(biome.workerImages ?? {}));
     const wanted = [
@@ -150,7 +150,7 @@ export function projectVendorImages(catalogue, lock, enums) {
       ...(biome.runtimeComponents ?? []).map((id) => [enums.RuntimeImageSubjectKind.RuntimeComponent, id]),
     ];
     for (const [kind, id] of wanted) {
-      if (!have.has(`${biome.id}\0${kind}\0${id}`)) {
+      if (subjectServingBiome(subjects, biome.id, kind, id, enums) === undefined) {
         throw new CatalogueCeilingError(`the catalogue carries no image row for ${kind}:${id} of selected biome "${biome.id}"`);
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.44.0",
+  "version": "0.44.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:72008b3d37f2cbcef3c5ec25e2d85989198ebc1f9bc1f481b8b767965813d5aa"
+    "sourceDigest": "sha256:68b1703a9457c36f912b5d8e3793d727b2e90e84034007bdadb6bbacbedd04e3"
   }
 }