@xemahq/xema 0.49.0 → 0.50.0

package/edition/dist-check.mjs

@@ -64,7 +64,7 @@ import {
   validateServiceDependencyOwnerParity,
 } from './lib.mjs';
 import { commandFor } from './remedy-command.mjs';
-import { resolveDistributionWithIndex } from './resolve-distribution.mjs';
+import { assertReleaseGitSourcesDeclareNoBundle, resolveDistributionWithIndex } from './resolve-distribution.mjs';
 import {
   resolveDistributionDeclaredSources,
   resolveDistributionRequiredPlatforms,
@@ -160,6 +160,7 @@ export async function checkDistributionLock(id) {
   const lockPath = join(editionsRoot(), id, 'distribution.lock.json');
   try {
     const { lock: fresh, index } = await resolveDistributionWithIndex(id);
+    assertReleaseGitSourcesDeclareNoBundle(fresh, index);
     const verdict = await compareCommittedLock(lockPath, fresh);
     if (verdict === LockCheck.MISSING) {
       console.error(

package/edition/locked-bundle-signer.mjs

@@ -3,7 +3,8 @@
 // Every `bundleSource: {kind: 'oci'}` row of a lock (a biome's, or one of its host modules') states WHO signs its bundle:
 // `bundleSigner: {policyId, signer}`, the kernel's `lockedBundleSignerOf` projection of ONE row of the data root's evidence
 // trust policy. The row is selected, never defaulted:
-//   - a third-party row by its pin (`third-party-source-pins.json`), whose `bundle.signerPolicyId` names an
+//   - a git-sourced row (one with a lock `source`) carries no OCI bundle at all, and a lock stating one is refused;
+//   - a third-party row (no `source`, `isThirdPartyOciRow`) by its pin (`third-party-source-pins.json`), whose `bundle.signerPolicyId` names an
 //     `oidc-certificate` row held to the checks `thirdPartySignerRow` makes;
 //   - a first-party row by the data root's `firstPartyBundleSigner.policyId`, a `public-key` row whose key is bound to
 //     no other row.
@@ -20,7 +21,7 @@ import { dataRoot, kernelDistPath, kernelPackageDir } from './edition-workspace.
 import { loadPinnedDeclaredTrustPolicy } from './evidence-trust-pin.mjs';
 import { loadTrustedThirdPartySourcePins } from './third-party-pins-trusted.mjs';
 import { thirdPartySignerRow } from './third-party-source-evidence.mjs';
-import { OCI_BUNDLE_SOURCE_KIND, isThirdPartyOciEntry } from './third-party-subjects.mjs';
+import { OCI_BUNDLE_SOURCE_KIND, isThirdPartyOciRow } from './third-party-subjects.mjs';
 
 const requireFromHere = createRequire(import.meta.url);
 
@@ -47,6 +48,10 @@ export class BundleSignerKeyBoundElsewhereError extends BundleSignerError {}
 export class BundleSignerPolicyNotSelectedError extends BundleSignerError {}
 /** An OCI row of a lock states no `bundleSigner`. */
 export class BundleSignerMissingError extends BundleSignerError {}
+/** A lock row drawn from a git `source` states an OCI `bundleSource`: a git-sourced biome is built from that source, never pulled as a bundle. */
+export class BundleSourceOnGitRowError extends BundleSignerError {}
+/** A resolve found an OCI host-module bundle on a git-sourced biome: such a bundle reaches an edition only through an `oci` source. */
+export class GitSourcedHostModuleBundleError extends BundleSignerError {}
 /** The loaded kernel does not export what the bundle signer plane needs. */
 export class BundleSignerKernelUnsupportedError extends BundleSignerError {}
 
@@ -71,6 +76,16 @@ export function loadBundleSignerKernel() {
 const describeSubject = ({ biomeId, componentKey }) =>
   componentKey === undefined ? `biome "${biomeId}"` : `host module "${componentKey}" of biome "${biomeId}"`;
 
+/** A git-sourced row carries no OCI bundle (resolve omits it), so no signer is selected for one; a lock stating one is refused. */
+function assertNotGitSourced(subject) {
+  if (subject.source !== undefined) {
+    throw new BundleSourceOnGitRowError(
+      `${describeSubject(subject)} is drawn from git source "${subject.source?.name ?? subject.source}" and states an OCI bundleSource; a git-sourced biome carries none ` +
+        '(a third-party biome is an OCI bundle only as an `oci` source with a third-party pin)',
+    );
+  }
+}
+
 const rowsOf = (policy, policyId) => policy.policies.filter((row) => row.policyId === policyId);
 
 /**
@@ -93,7 +108,7 @@ export function createBundleSignerSelection({ policy, thirdPartyPins, firstParty
   function requireKind(subject, row, kind) {
     if (row.kind !== kind) {
       throw new BundleSignerKindMismatchError(
-        `${describeSubject(subject)}: trust policy row "${row.policyId}" is of kind ${JSON.stringify(row.kind)}, but a ${isThirdPartyOciEntry(subject) ? 'third-party' : 'first-party'} bundle is signed by a "${kind}" row`,
+        `${describeSubject(subject)}: trust policy row "${row.policyId}" is of kind ${JSON.stringify(row.kind)}, but a ${isThirdPartyOciRow(subject) ? 'third-party' : 'first-party'} bundle is signed by a "${kind}" row`,
       );
     }
   }
@@ -137,8 +152,9 @@ export function createBundleSignerSelection({ policy, thirdPartyPins, firstParty
   }
 
   function selectedRow(subject) {
+    assertNotGitSourced(subject);
     requirePolicy(subject);
-    return isThirdPartyOciEntry(subject) ? thirdPartyRow(subject) : firstPartyRow(subject);
+    return isThirdPartyOciRow(subject) ? thirdPartyRow(subject) : firstPartyRow(subject);
   }
 
   const signerFor = (subject) => {
@@ -199,12 +215,12 @@ const isOci = (row) => row.bundleSource?.kind === OCI_BUNDLE_SOURCE_KIND;
 /** Every OCI subject of a lock: each biome and each host module whose `bundleSource` is OCI, with the biome's origin and repo. */
 export function lockBundleSubjects(lock) {
   return lock.biomes.flatMap((biome) => [
-    ...(isOci(biome) ? [{ row: biome, subject: { biomeId: biome.id, origin: biome.origin, repo: biome.repo, bundleSource: biome.bundleSource } }] : []),
+    ...(isOci(biome) ? [{ row: biome, subject: { biomeId: biome.id, origin: biome.origin, repo: biome.repo, source: biome.source, bundleSource: biome.bundleSource } }] : []),
     ...(biome.hostModules ?? [])
       .filter(isOci)
       .map((hostModule) => ({
         row: hostModule,
-        subject: { biomeId: biome.id, componentKey: hostModule.componentKey, origin: biome.origin, repo: biome.repo, bundleSource: hostModule.bundleSource },
+        subject: { biomeId: biome.id, componentKey: hostModule.componentKey, origin: biome.origin, repo: biome.repo, source: biome.source, bundleSource: hostModule.bundleSource },
       })),
   ]);
 }
@@ -219,6 +235,7 @@ export function assertLockBundleSigners({ lock, selection, schemas }) {
   if (subjects.length === 0) {return;}
   const chosen = selection ?? loadBundleSignerSelection({ dataRoot: dataRoot(), schemas });
   for (const { row, subject } of subjects) {
+    assertNotGitSourced(subject);
     chosen.assertSealed(subject, row.bundleSigner);
   }
 }

package/edition/resolve-distribution.mjs

@@ -95,7 +95,7 @@ import {
   validateImmutableDistributionLock,
   validateServiceDependencyOwnerParity,
 } from './lib.mjs';
-import { BundleSignerPolicyAbsentError, loadBundleSignerSelection } from './locked-bundle-signer.mjs';
+import { BundleSignerPolicyAbsentError, GitSourcedHostModuleBundleError, loadBundleSignerSelection } from './locked-bundle-signer.mjs';
 import {
   assertInstalledOperationCeilingAdmitted,
   assertOperationGrantsAdmitted,
@@ -1805,11 +1805,29 @@ export function resolveDistributionFromInputs(
     }
     return composed.bundleSigners.signerFor(subject);
   };
-  const bundleSignerFor = (e) => (e.bundleSource?.kind === 'oci' ? { bundleSigner: bundleSignerOf(e, e.bundleSource) } : {});
-  const hostModulesOf = (e) =>
-    (Array.isArray(e.hostModules) ? e.hostModules : []).map((hostModule) =>
-      hostModule.bundleSource?.kind === 'oci' ? { ...hostModule, bundleSigner: bundleSignerOf(e, hostModule.bundleSource, hostModule.componentKey) } : hostModule,
-    );
+  // A row drawn from a GIT source carries no OCI bundle (biome-level; an OCI host-module bundle is refused below), hence no bundleSigner: it is built
+  // from the pinned source, and the manifest's `bundleSource` names a release artifact not built from this commit.
+  // Omitted here, at the copy point. (An entry of a declared `oci` source has a stamp but no record: not git.)
+  const isGitSourced = (e) => e.source !== undefined && sourceRecords.has(e.source);
+  const bundleSourceOf = (e) => (e.bundleSource === undefined || isGitSourced(e) ? {} : { bundleSource: e.bundleSource });
+  const bundleSignerFor = (e) => (e.bundleSource?.kind === 'oci' && !isGitSourced(e) ? { bundleSigner: bundleSignerOf(e, e.bundleSource) } : {});
+  const hostModuleOf = (e, hostModule) => {
+    if (isGitSourced(e)) {
+      // The lock schema requires a host module's bundleSource, so an OCI one cannot be omitted: it is refused, in every
+      // channel. A non-OCI one (npm, ...) is untouched.
+      if (hostModule.bundleSource?.kind === 'oci') {
+        throw new GitSourcedHostModuleBundleError(
+          `host module "${hostModule.componentKey}" of biome "${e.id}" (git source "${e.source}") declares an OCI bundleSource (${hostModule.bundleSource.ociRef}); ` +
+            'such a host module bundle reaches an edition only through an `oci` source with a third-party source pin',
+        );
+      }
+      return hostModule;
+    }
+    return hostModule.bundleSource?.kind === 'oci'
+      ? { ...hostModule, bundleSigner: bundleSignerOf(e, hostModule.bundleSource, hostModule.componentKey) }
+      : hostModule;
+  };
+  const hostModulesOf = (e) => (Array.isArray(e.hostModules) ? e.hostModules : []).map((hostModule) => hostModuleOf(e, hostModule));
 
   // (5d) Dispatched runtime components — every `runtime-image` edge of a
   // shipped biome must resolve to a runtime component of a biome in the index.
@@ -1994,7 +2012,7 @@ export function resolveDistributionFromInputs(
       // unconditional key would move the bytes of every committed lock for a
       // fact none of their entries carries. A lock in which SOME biome carries
       // it still is the one v5 grammar once sealed.
-      ...(e.bundleSource === undefined ? {} : { bundleSource: e.bundleSource }),
+      ...bundleSourceOf(e),
       ...bundleSignerFor(e),
       serviceDependencies: Array.isArray(e.serviceDependencies)
         ? e.serviceDependencies
@@ -2401,6 +2419,29 @@ export async function resolveDistributionWithIndex(id, { materialize, inputs, re
   return { lock, index };
 }
 
+/**
+ * A release carries a third-party biome only as an `oci` source with a third-party pin. A git-sourced third-party biome
+ * whose manifest declares an OCI bundleSource (biome-level or host module) names a main-release artifact that is not
+ * built from the pinned commit, so a release resolve refuses it. `lock` is the resolved lock (a git row carries
+ * `source`), `index` the index it was resolved from (which still holds the manifest's bundleSource).
+ */
+export function assertReleaseGitSourcesDeclareNoBundle(lock, index) {
+  const byId = new Map(index.map((entry) => [entry.id, entry]));
+  for (const biome of lock.biomes) {
+    if (biome.source === undefined) {continue;}
+    const entry = byId.get(biome.id);
+    const declared = [entry?.bundleSource, ...(entry?.hostModules ?? []).map((hostModule) => hostModule.bundleSource)].find(
+      (bundleSource) => bundleSource?.kind === 'oci',
+    );
+    if (declared !== undefined) {
+      throw new Error(
+        `biome "${biome.id}" is drawn from git source "${biome.source.name}" and declares an OCI bundleSource (${declared.ociRef}); ` +
+          'a release does not carry it: declare the biome as an `oci` source with a third-party source pin instead',
+      );
+    }
+  }
+}
+
 /**
  * Resolve and persist one distribution lock. The CLI and the plane refresh use
  * this exact writer so an in-process refresh cannot drift from the standalone
@@ -2410,6 +2451,7 @@ export async function writeResolvedDistribution(id, { log = true, materialize, f
   const { lock, index } = await resolveDistributionWithIndex(id, { materialize });
   await assertAdapterBundlesMatchHost({ lock, hostRow: adapterHostRow(index), fetchManifest });
   const outPath = join(editionsRoot(), id, 'distribution.lock.json');
+  assertReleaseGitSourcesDeclareNoBundle(lock, index);
   assertReleaseContent(lock, `the distribution lock for "${id}"`);
   assertReleaseEditionTree(join(editionsRoot(), id));
   mkdirSync(join(editionsRoot(), id), { recursive: true });

package/edition/third-party-subjects.mjs

@@ -32,7 +32,8 @@ export const isThirdPartyOciEntry = (entry) => hasOciBundleSource(entry) && isTh
 /**
  * Refuse an OCI `bundleSource` on a row whose origin is not third-party: only a third-party biome is pulled from an OCI
  * bundle by digest, so the vendor's origin on such a row would place an unevidenced bundle in the vendor's trust domain.
- * A row drawn from a git `source` is held by the source walk and is not this key.
+ * A row drawn from a git `source` is not this key and carries no OCI `bundleSource` at all: resolve omits the manifest's
+ * (it names a release artifact not built from the pinned commit), and a lock stating one is refused (`locked-bundle-signer.mjs`).
  */
 export function assertOciBundleSourceOrigin(row, label) {
   if (row.source === undefined && hasOciBundleSource(row) && !isThirdPartyOrigin(row)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.49.0",
+  "version": "0.50.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:b0bda6e99522eaf8d1c8c8ad73de127d4c28dd617ca90a3563cbb150a0a980f8"
+    "sourceDigest": "sha256:b773e64002a4791ce49ea6b379942d02a68268b8cc6000f2d7f9fe6886732cb4"
   }
 }