@xemahq/xema 0.47.1 → 0.48.0

package/edition/README.md

@@ -143,7 +143,7 @@ The edition library builds, validates and verifies evidence statements; it never
 
 ## Kernel protocol and pins
 
-The CLI is coupled to the kernel's edition protocol, not to the kernel package. `@xemahq/contracts` exports the protocol identity as data (`dist/edition-protocol/edition-protocol.json`: `{contentDigest, provisional, version}`). This CLI supports protocols v28 and v30 (no published kernel declares v29; a CLI lists a protocol only while every kernel published under it exports what the CLI imports; v27 and older kernels lack `serviceImageSubjects`, so a data root whose pinned kernel speaks v27 or older stays on an earlier CLI), pinned to its digest and vendored, and REFUSES an identity with `provisional: true`; every loader that executes the kernel, `xema edition check` first, and the evidence verifier compare only that identity and refuse an unsupported one, naming the supported and the declared versions. A protocol change needs a CLI release first; only then does the data root repin its kernel authority.
+The CLI is coupled to the kernel's edition protocol, not to the kernel package. `@xemahq/contracts` exports the protocol identity as data (`dist/edition-protocol/edition-protocol.json`: `{contentDigest, provisional, version}`). This CLI supports protocols v28, v30 and v31 (no published kernel declares v29; a CLI lists a protocol only while every kernel published under it exports what the CLI imports; v27 and older kernels lack `serviceImageSubjects`, so a data root whose pinned kernel speaks v27 or older stays on an earlier CLI), pinned to its digest and vendored, and REFUSES an identity with `provisional: true`; every loader that executes the kernel, `xema edition check` first, and the evidence verifier compare only that identity and refuse an unsupported one, naming the supported and the declared versions. A protocol change needs a CLI release first; only then does the data root repin its kernel authority.
 
 A develop edition does not take the kernel's develop head blindly: `xema edition develop choose-kernel --kernel <package dir> [--kernel-pin <40-hex>] --out <file>` reads the declared protocol of each commit on the checkout's first-parent history (from source, unbuilt) and chooses the newest one this CLI supports. It writes `{chosenSha, headSha, held, reason}` (`reason`: `head-supported` | `head-ahead` | `explicit-pin`; `held` is `head-ahead`), and when held prints `kernel held at v<N> (<sha12>), head at v<M> (<sha12>): raise the CLI` (stdout only, never persisted). The head is the checkout's `refs/remotes/origin/develop` (a full-history checkout). An explicit pin wins but is still checked, and must be on that head's first-parent history (`not-on-develop` otherwise); when no commit is supported it refuses (`EditionProtocolMismatchError`, `no-supported-commit`; the walk ends at the first commit with no declaration file) and never falls back to the head; a declaration that exists but does not parse, at the head or any walked commit, is refused by name (`unparseable`), never skipped. `freeze-graph` applies the same check to `--kernel-sha`.
 

package/edition/edition-protocol.mjs

@@ -31,10 +31,11 @@ import { readBoundedNoFollowFile } from './no-follow-file.mjs';
 /** The edition protocols this library interprets: version -> content digest. A protocol is listed only
  * while every kernel published under it exports what this library imports (`kernel-export-coverage.test.mjs`):
  * v27 and older kernels lack `serviceImageSubjects` (first exported by the v28 kernel), so they are not listed.
- * No published kernel declares v29 (0.110.2 is v28, 0.110.3 is v30), so v29 is not listed either. */
+ * No published kernel declares v29 (0.110.2 is v28, 0.110.3 is v30, 0.111.0 is v31), so v29 is not listed either. */
 export const SUPPORTED_EDITION_PROTOCOLS = Object.freeze([
   Object.freeze({ version: 28, contentDigest: 'f7795478b1bfe9a41bcbea9efe496011fcd209a56c90294029a08801e84cf92c' }),
   Object.freeze({ version: 30, contentDigest: '91e3cdff255778b5aa94b64ca9316d031be549ead2267a9a9311ff06d4f1db2c' }),
+  Object.freeze({ version: 31, contentDigest: 'b2026847fdd202e7b9e05815cdc2c9819b60be7007c789cc5b5f291c9c682fdd' }),
 ]);
 
 /** Where a kernel package publishes its identity and its contract, package-relative. */

package/edition/oci-image-source-evidence.mjs

@@ -205,7 +205,7 @@ export function writeInvalidReferrerReport(skipped) {
  * An artifact that is not valid evidence under `expectedAuthorityCommit`
  * (a manifest that is not the exact subject's, RAW statements stating another authority commit, a
  * failed strict parse, a statement whose contract authority is not exactly
- * `expectedContractAuthority` when one is given) is refused with `InvalidEvidenceReferrerError`; a
+ * `expectedContractAuthority`, which is required) is refused with `InvalidEvidenceReferrerError`; a
  * registry that cannot answer, or bytes that do not match their digests
  * (`EvidenceIntegrityError`, a tampering signal), still throw.
  */
@@ -216,9 +216,12 @@ export async function readImageSourceEvidenceArtifact({
   artifactDigest,
   schemas,
   expectedAuthorityCommit,
-  expectedContractAuthority = undefined,
+  expectedContractAuthority,
 }) {
   assertExpectedAuthorityCommit(expectedAuthorityCommit);
+  if (!expectedContractAuthority) {
+    throw new Error('the expected kernel contract authority is required');
+  }
   const fetched = await client.getManifestByDigest(repository, artifactDigest);
   const invalid = (error) =>
     new InvalidEvidenceReferrerError({
@@ -269,11 +272,9 @@ export async function readImageSourceEvidenceArtifact({
       // The wire schema checks the shape of an authority's sourcePaths only
       // (contracts 0.110.3), so a statement naming the expected commit with
       // another path set or digest parses: it is not evidence under the pin.
-      if (expectedContractAuthority !== undefined) {
-        for (const record of evidence.records) {
-          if (canonicalJson(record.statement.predicate.contractAuthority) !== canonicalJson(expectedContractAuthority)) {
-            throw new Error(`${record.key} statement's kernel contract authority is not exactly the expected one at ${expectedAuthorityCommit}`);
-          }
+      for (const record of evidence.records) {
+        if (canonicalJson(record.statement.predicate.contractAuthority) !== canonicalJson(expectedContractAuthority)) {
+          throw new Error(`${record.key} statement's kernel contract authority is not exactly the expected one at ${expectedAuthorityCommit}`);
         }
       }
       return { ...evidence, artifactDigest, created };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.47.1",
+  "version": "0.48.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -54,7 +54,7 @@
     "@xemahq/distribution-source-hash": "^0.2.2",
     "@xemahq/dsl": "^0.24.0",
     "@xemahq/identity-client": "^0.16.0",
-    "@xemahq/contracts": "^0.110.3",
+    "@xemahq/contracts": "^0.111.0",
     "@xemahq/kernel-state-runtime": "^0.8.0",
     "@xemahq/license-verifier": "^0.2.0",
     "@xemahq/service-registry-nest": "^0.12.2",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:2b843d3e1dc948c293196fe5a9ac1bcfc4ad91c5563778a8454d6064470584e2"
+    "sourceDigest": "sha256:5f6bd75aa0d1bdc9a141a6f9f31be0957f7a8e5aa967695362db0ced936cac5a"
   }
 }