@xemahq/xema 0.46.0 → 0.47.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/edition/verify-image-evidence.bundle.mjs +872 -821
- package/dist/edition/verify-image-evidence.bundle.provenance.json +469 -463
- package/dist/runtime/lock-loader.d.ts.map +1 -1
- package/dist/runtime/lock-loader.js +3 -3
- package/dist/runtime/lock-loader.js.map +1 -1
- package/edition/edition-protocol.mjs +2 -1
- package/edition/image-lock-service-rows.mjs +7 -5
- package/edition/lib.mjs +3 -0
- package/package.json +3 -3
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"lock-loader.d.ts","sourceRoot":"","sources":["../../src/runtime/lock-loader.ts"],"names":[],"mappings":"AAEA,OAAO,
|
|
1
|
+
{"version":3,"file":"lock-loader.d.ts","sourceRoot":"","sources":["../../src/runtime/lock-loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EAE1B,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAqD,KAAK,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAarG,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,sBAAsB,CASlF;AAQD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAQ7B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC7D;AAED,MAAM,WAAW,eAAe;IAQ9B,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AA0BD,wBAAgB,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,CAwBpE"}
|
|
@@ -22,9 +22,9 @@ function loadImageLock(opts) {
|
|
|
22
22
|
const imagesByService = new Map();
|
|
23
23
|
for (const subject of lock.subjects) {
|
|
24
24
|
subjectsByKey.set(subjectKey(subject.kind, subject.id), subject);
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
25
|
+
}
|
|
26
|
+
for (const [service, subject] of (0, distribution_1.serviceImageSubjects)(lock.subjects)) {
|
|
27
|
+
imagesByService.set(service, toImageEntry(subject));
|
|
28
28
|
}
|
|
29
29
|
for (const binding of lock.platformServiceBindings) {
|
|
30
30
|
const subject = subjectsByKey.get(subjectKey(binding.subjectKind, binding.subjectId));
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"lock-loader.js","sourceRoot":"","sources":["../../src/runtime/lock-loader.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"lock-loader.js","sourceRoot":"","sources":["../../src/runtime/lock-loader.ts"],"names":[],"mappings":";;AAoCA,oDASC;AAyDD,sCAwBC;AA9HD,qCAAuC;AAEvC,iEAQwC;AAExC,mCAAqG;AAwBrG,SAAgB,oBAAoB,CAAC,IAAqB;IACxD,MAAM,UAAU,GAAG,IAAA,mCAA2B,EAAC;QAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAA,8CAA+B,EAAC,GAAG,CAAC,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAyDD,SAAgB,aAAa,CAAC,IAAqB;IACjD,MAAM,UAAU,GAAG,IAAA,4BAAoB,EAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAA,6BAAc,EAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC7D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,IAAA,mCAAoB,EAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACtF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,8BAA8B,UAAU,CAAC,IAAI,qBAAqB;gBAChE,IAAI,OAAO,CAAC,eAAe,eAAe,OAAO,CAAC,WAAW,WAAW;gBACxE,IAAI,OAAO,CAAC,SAAS,+CAA+C,CACvE,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,IAA6B,EAAE,EAAU;IAC3D,OAAO,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,YAAY,CAAC,OAA4B;IAChD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC"}
|
|
@@ -28,7 +28,7 @@ import { realpathSync } from 'node:fs';
|
|
|
28
28
|
|
|
29
29
|
import { readBoundedNoFollowFile } from './no-follow-file.mjs';
|
|
30
30
|
|
|
31
|
-
/** The edition protocols this library interprets: version -> content digest. v10..
|
|
31
|
+
/** The edition protocols this library interprets: version -> content digest. v10..v28 grow the kernel
|
|
32
32
|
* source closure only (entry subpaths and hashing unchanged), so one library speaks every row. */
|
|
33
33
|
export const SUPPORTED_EDITION_PROTOCOLS = Object.freeze([
|
|
34
34
|
Object.freeze({ version: 9, contentDigest: '7cd6d760e7e7caaec3634a08c739debbdeeeaac4f1bad6791246a12f4f248e37' }),
|
|
@@ -48,6 +48,7 @@ export const SUPPORTED_EDITION_PROTOCOLS = Object.freeze([
|
|
|
48
48
|
Object.freeze({ version: 25, contentDigest: '79916e652836c7f6c31a7284c083c4f11249c6f21ef0b1bf79efc9dc23684d4a' }),
|
|
49
49
|
Object.freeze({ version: 26, contentDigest: '8d1dcfca5c59ff7b5eee6ea84fec3d9d62a48f3260f4ddb27b6665c25056f968' }),
|
|
50
50
|
Object.freeze({ version: 27, contentDigest: 'd4807f6464508c1abb32f7de9754f2e1f12cd7f2be5fbf939b6a5175c01dd90b' }),
|
|
51
|
+
Object.freeze({ version: 28, contentDigest: 'f7795478b1bfe9a41bcbea9efe496011fcd209a56c90294029a08801e84cf92c' }),
|
|
51
52
|
]);
|
|
52
53
|
|
|
53
54
|
/** Where a kernel package publishes its identity and its contract, package-relative. */
|
|
@@ -13,12 +13,14 @@ function isOwnedByBiome(subject, biomeId, enums) {
|
|
|
13
13
|
/**
|
|
14
14
|
* The subject carrying the image of `kind:id` for the biome `biomeId`, or undefined.
|
|
15
15
|
* A service is served by (a) a Service subject with that id owned by the biome, or (b) a subject owned by the biome
|
|
16
|
-
* whose `members[]` names the service. The
|
|
17
|
-
*
|
|
16
|
+
* whose `members[]` names the service. The member-to-subject step is the kernel's `serviceImageSubjects`
|
|
17
|
+
* (`enums.serviceImageSubjects`), the same rule the launcher's `loadImageLock` applies; this file adds only the
|
|
18
|
+
* biome-owner filter. The biome's own `services` list supplies `id`.
|
|
18
19
|
*/
|
|
19
20
|
export function subjectServingBiome(subjects, biomeId, kind, id, enums) {
|
|
20
21
|
const owned = subjects.filter((subject) => isOwnedByBiome(subject, biomeId, enums));
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
22
|
+
if (kind !== enums.RuntimeImageSubjectKind.Service) {
|
|
23
|
+
return owned.find((subject) => subject.kind === kind && subject.id === id);
|
|
24
|
+
}
|
|
25
|
+
return enums.serviceImageSubjects(owned).get(id);
|
|
24
26
|
}
|
package/edition/lib.mjs
CHANGED
|
@@ -800,6 +800,7 @@ export async function loadKernelDistributionSchemas() {
|
|
|
800
800
|
parseOciDigest,
|
|
801
801
|
parseGitTreeId,
|
|
802
802
|
parseImageLock,
|
|
803
|
+
serviceImageSubjects,
|
|
803
804
|
IMAGE_LOCK_WRITE_SCHEMA_VERSION,
|
|
804
805
|
ImageLockSchemaVersion,
|
|
805
806
|
parseImageProducerStatement,
|
|
@@ -892,6 +893,7 @@ export async function loadKernelDistributionSchemas() {
|
|
|
892
893
|
typeof parseOciDigest !== 'function' ||
|
|
893
894
|
typeof parseGitTreeId !== 'function' ||
|
|
894
895
|
typeof parseImageLock !== 'function' ||
|
|
896
|
+
typeof serviceImageSubjects !== 'function' ||
|
|
895
897
|
typeof parseImageProducerStatement !== 'function' ||
|
|
896
898
|
typeof parseDistributionImagesStatement !== 'function' ||
|
|
897
899
|
typeof parseImageDeliveryEntitlementStatement !== 'function' ||
|
|
@@ -1020,6 +1022,7 @@ export async function loadKernelDistributionSchemas() {
|
|
|
1020
1022
|
parseOciDigest,
|
|
1021
1023
|
parseGitTreeId,
|
|
1022
1024
|
parseImageLock,
|
|
1025
|
+
serviceImageSubjects,
|
|
1023
1026
|
IMAGE_LOCK_WRITE_SCHEMA_VERSION,
|
|
1024
1027
|
ImageLockSchemaVersion,
|
|
1025
1028
|
parseImageProducerStatement,
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/xema",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.47.0",
|
|
4
4
|
"repository": {
|
|
5
5
|
"type": "git",
|
|
6
6
|
"url": "git+https://github.com/xema-dev/xema-cli.git",
|
|
@@ -54,7 +54,7 @@
|
|
|
54
54
|
"@xemahq/distribution-source-hash": "^0.2.2",
|
|
55
55
|
"@xemahq/dsl": "^0.24.0",
|
|
56
56
|
"@xemahq/identity-client": "^0.16.0",
|
|
57
|
-
"@xemahq/contracts": "^0.110.
|
|
57
|
+
"@xemahq/contracts": "^0.110.2",
|
|
58
58
|
"@xemahq/kernel-state-runtime": "^0.8.0",
|
|
59
59
|
"@xemahq/license-verifier": "^0.2.0",
|
|
60
60
|
"@xemahq/service-registry-nest": "^0.12.2",
|
|
@@ -92,6 +92,6 @@
|
|
|
92
92
|
"typecheck": "tsc --noEmit"
|
|
93
93
|
},
|
|
94
94
|
"xemaRelease": {
|
|
95
|
-
"sourceDigest": "sha256:
|
|
95
|
+
"sourceDigest": "sha256:7c50b1499876697b28ff4a9c5cc2d1517bc1cfca2a9ccf9c019411b6e3b0edcd"
|
|
96
96
|
}
|
|
97
97
|
}
|