@xemahq/xema 0.44.0 → 0.45.0

package/edition/README.md

@@ -142,7 +142,7 @@ The edition library builds, validates and verifies evidence statements; it never
 
 ## Kernel protocol and pins
 
-The CLI is coupled to the kernel's edition protocol, not to the kernel package. `@xemahq/contracts` exports the protocol identity as data (`dist/edition-protocol/edition-protocol.json`: `{contentDigest, provisional, version}`). This CLI supports protocols v9 to v14, each pinned to its digest and vendored (v10 to v14 grow the kernel source closure only; a data root whose pinned kernel speaks v8 stays on CLI 0.41.x, v5 on 0.33.x) and REFUSES an identity with `provisional: true`; every loader that executes the kernel, `xema edition check` first, and the evidence verifier compare only that identity and refuse an unsupported one, naming the supported and the declared versions. A protocol change needs a CLI release first; only then does the data root repin its kernel authority.
+The CLI is coupled to the kernel's edition protocol, not to the kernel package. `@xemahq/contracts` exports the protocol identity as data (`dist/edition-protocol/edition-protocol.json`: `{contentDigest, provisional, version}`). This CLI supports protocols v9 to v16 and v19 to v20 (the versions the kernel declared and contracts published), each pinned to its digest and vendored (v10 to v20 grow the kernel source closure only; a data root whose pinned kernel speaks v8 stays on CLI 0.41.x, v5 on 0.33.x) and REFUSES an identity with `provisional: true`; every loader that executes the kernel, `xema edition check` first, and the evidence verifier compare only that identity and refuse an unsupported one, naming the supported and the declared versions. A protocol change needs a CLI release first; only then does the data root repin its kernel authority.
 
 A develop edition does not take the kernel's develop head blindly: `xema edition develop choose-kernel --kernel <package dir> [--kernel-pin <40-hex>] --out <file>` reads the declared protocol of each commit on the checkout's first-parent history (from source, unbuilt) and chooses the newest one this CLI supports. It writes `{chosenSha, headSha, held, reason}` (`reason`: `head-supported` | `head-ahead` | `explicit-pin`; `held` is `head-ahead`), and when held prints `kernel held at v<N> (<sha12>), head at v<M> (<sha12>): raise the CLI` (stdout only, never persisted). The head is the checkout's `refs/remotes/origin/develop` (a full-history checkout). An explicit pin wins but is still checked, and must be on that head's first-parent history (`not-on-develop` otherwise); when no commit is supported it refuses (`EditionProtocolMismatchError`, `no-supported-commit`; the walk ends at the first commit with no declaration file) and never falls back to the head; a declaration that exists but does not parse, at the head or any walked commit, is refused by name (`unparseable`), never skipped. `freeze-graph` applies the same check to `--kernel-sha`.
 

package/edition/edition-protocol.mjs

@@ -28,7 +28,7 @@ import { realpathSync } from 'node:fs';
 
 import { readBoundedNoFollowFile } from './no-follow-file.mjs';
 
-/** The edition protocols this library interprets: version -> content digest. v10..v14 grow the kernel
+/** The edition protocols this library interprets: version -> content digest. v10..v20 grow the kernel
  * source closure only (entry subpaths and hashing unchanged), so one library speaks every row. */
 export const SUPPORTED_EDITION_PROTOCOLS = Object.freeze([
   Object.freeze({ version: 9, contentDigest: '7cd6d760e7e7caaec3634a08c739debbdeeeaac4f1bad6791246a12f4f248e37' }),
@@ -37,6 +37,10 @@ export const SUPPORTED_EDITION_PROTOCOLS = Object.freeze([
   Object.freeze({ version: 12, contentDigest: 'cff51ea06b6ba7d95d02dcd6305b6a55061b428da48ae74dcbff8a5c8107ce41' }),
   Object.freeze({ version: 13, contentDigest: '5f69fe73d1dea1650ef1757204a53ccd4030ade78bfa91959c2d01c937fc0e16' }),
   Object.freeze({ version: 14, contentDigest: '403b6a491b5922df1a423ba8a2d6ae3d3900bb1caff4e8c0caa48de90a47eb9b' }),
+  Object.freeze({ version: 15, contentDigest: 'c66191703abfd9b532d8b6c15476bede2a5752af5bea5032e839fb9d6303a2d1' }),
+  Object.freeze({ version: 16, contentDigest: '2e65c280a399304ebb438e4e9829bcb4688f36a3c6a5e8b35b679cf69c689f55' }),
+  Object.freeze({ version: 19, contentDigest: '66dab3dcf18c3a587f073808cc91165cc513eabb237b35439ff6cfe2b312b127' }),
+  Object.freeze({ version: 20, contentDigest: '22c0e4ba6ee2771e91516ea78806117b5e3e60b76e085b9a9b98e993c1de79f8' }),
 ]);
 
 /** Where a kernel package publishes its identity and its contract, package-relative. */

package/edition/image-lock-service-rows.mjs

@@ -0,0 +1,24 @@
+// image-lock-service-rows — the one answer to "which image row serves this service or runtime component of this biome".
+//
+// A schemaVersion-4 images lock gives a service composed into a process NO subject of its own: it is a
+// `members[]` entry (`{service, packageDir}`) of a `composed-process` subject whose `owners` are the member biomes.
+// Every CLI read that asks whether a lock or catalogue carries the image of a biome's service goes through here, so
+// no reader can miss the composed form.
+
+/** Whether `subject` is owned by the biome `biomeId`. */
+function isOwnedByBiome(subject, biomeId, enums) {
+  return subject.owners.some((owner) => owner.kind === enums.RuntimeImageOwnerKind.Biome && owner.biomeId === biomeId);
+}
+
+/**
+ * The subject carrying the image of `kind:id` for the biome `biomeId`, or undefined.
+ * A service is served by (a) a Service subject with that id owned by the biome, or (b) a subject owned by the biome
+ * whose `members[]` names the service. The biome's own `services` list supplies `id`, and contracts guarantees member
+ * service names are unique within a subject, so the owner check pairs the member with the biome.
+ */
+export function subjectServingBiome(subjects, biomeId, kind, id, enums) {
+  const owned = subjects.filter((subject) => isOwnedByBiome(subject, biomeId, enums));
+  const own = owned.find((subject) => subject.kind === kind && subject.id === id);
+  if (own !== undefined || kind !== enums.RuntimeImageSubjectKind.Service) {return own;}
+  return owned.find((subject) => (subject.members ?? []).some((member) => member.service === id));
+}

package/edition/resolve-customer-edition.mjs

@@ -36,6 +36,7 @@ import {
 import { assertRosteredChartSetLock } from './edition-chart-set.mjs';
 import { EditionLockFile } from './edition-constants.mjs';
 import { editionsRoot } from './edition-workspace.mjs';
+import { subjectServingBiome } from './image-lock-service-rows.mjs';
 import { adoptCatalogueKernel } from './kernel-package.mjs';
 import { compareStrings, imageLockWriteSchemaVersion, serializeJson, validateImmutableImageLock } from './lib.mjs';
 import { pinnedSource, snapshotPinSource } from './pin-source.mjs';
@@ -142,7 +143,6 @@ export function projectVendorImages(catalogue, lock, enums) {
     );
     if (owners.length > 0) {subjects.push({ ...subject, owners });}
   }
-  const have = new Set(subjects.filter((s) => s.owners.some((o) => o.kind === enums.RuntimeImageOwnerKind.Biome)).flatMap((s) => s.owners.map((o) => `${o.biomeId}\0${s.kind}\0${s.id}`)));
   for (const biome of lock.biomes.filter((b) => b.source === undefined && b.target !== 'web')) {
     const shared = new Set(Object.keys(biome.workerImages ?? {}));
     const wanted = [
@@ -150,7 +150,7 @@ export function projectVendorImages(catalogue, lock, enums) {
       ...(biome.runtimeComponents ?? []).map((id) => [enums.RuntimeImageSubjectKind.RuntimeComponent, id]),
     ];
     for (const [kind, id] of wanted) {
-      if (!have.has(`${biome.id}\0${kind}\0${id}`)) {
+      if (subjectServingBiome(subjects, biome.id, kind, id, enums) === undefined) {
         throw new CatalogueCeilingError(`the catalogue carries no image row for ${kind}:${id} of selected biome "${biome.id}"`);
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -54,7 +54,7 @@
     "@xemahq/distribution-source-hash": "^0.2.2",
     "@xemahq/dsl": "^0.24.0",
     "@xemahq/identity-client": "^0.16.0",
-    "@xemahq/contracts": "^0.94.0",
+    "@xemahq/contracts": "^0.102.0",
     "@xemahq/kernel-state-runtime": "^0.8.0",
     "@xemahq/license-verifier": "^0.2.0",
     "@xemahq/service-registry-nest": "^0.12.2",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:72008b3d37f2cbcef3c5ec25e2d85989198ebc1f9bc1f481b8b767965813d5aa"
+    "sourceDigest": "sha256:97a574d113d6c30640832ec00008c3788c449ec45456db7b5d117c98460340cc"
   }
 }