@xemahq/xema 0.51.0 → 0.53.0

package/edition/lib.mjs

@@ -1524,6 +1524,53 @@ export function signedBiomeDeclaredCapabilities(indexBiome, xema) {
   return [...new Set([...shipped, ...requiredForService])].sort(compareStrings);
 }
 
+/**
+ * The components of a biome manifest that are image workloads: a service or worker with its own `oci-image`, or a
+ * worker running its sibling service's image with its own entry module (`shared-oci-image`). Such a worker is a
+ * standing workload like any other image component (rostered, with process facts, task queues and peers); it just
+ * builds no image of its own, and `workerImages` in {@link manifestToIndexEntry} records whose it runs.
+ */
+export function biomeImageComponents(components) {
+  return components.filter(
+    (component) =>
+      component !== null &&
+      typeof component === 'object' &&
+      (component.kind === 'service' || component.kind === 'worker') &&
+      (component.artifact?.kind === 'oci-image' ||
+        (component.kind === 'worker' && component.artifact?.kind === 'shared-oci-image')),
+  );
+}
+
+/**
+ * The image name of one image component of biome `id` (manifest `rel`, `target`), claimed in `taken` (the names the
+ * manifest's earlier image components claimed). A `service` registers under `protocol.serviceName`; a `worker` never
+ * registers with the service registry, so its image name is the component key. Same rule the producing repo's build
+ * plane applies: the image name is the SERVICE build arg either way. Refused: no image name, a web biome owning a
+ * deployable image, and one image name declared twice.
+ */
+export function claimBiomeImageName(component, { rel, id, target, taken }) {
+  const protocol = component.protocol !== null && typeof component.protocol === 'object' ? component.protocol : {};
+  const name = component.kind === 'service' ? protocol.serviceName : component.key;
+  if (typeof name !== 'string' || name.length === 0) {
+    throw new Error(
+      `${rel}: xema.components[] kind "${component.kind}" component ` +
+        `"${String(component.key)}" has no image name — a service declares ` +
+        `protocol.serviceName, a worker a non-empty key`,
+    );
+  }
+  if (target !== 'server') {
+    throw new Error(`${rel}: web biome "${id}" cannot own deployable image "${name}"`);
+  }
+  if (taken.has(name)) {
+    throw new Error(`${rel}: xema.components[] declares image "${name}" more than once`);
+  }
+  taken.add(name);
+  return name;
+}
+
+/** An image component launched per allocation (`scheduler: "runtime"`): a runtime component, never a rostered service. */
+export const isRuntimeImageComponent = (component) => component.scheduler === 'runtime';
+
 export async function manifestToIndexEntry({ raw, generatedIndex, rel, repo, path, authorizationModule }) {
   const xema = raw?.xema;
   if (!xema || typeof xema !== 'object') {
@@ -1691,19 +1738,7 @@ export async function manifestToIndexEntry({ raw, generatedIndex, rel, repo, pat
     }
     bundleSource = parsed.data;
   }
-  const imageComponents = components.filter(
-    (component) =>
-      component !== null &&
-      typeof component === 'object' &&
-      (component.kind === 'service' || component.kind === 'worker') &&
-      (component.artifact?.kind === 'oci-image' ||
-        // A worker running its sibling service's image with its own entry
-        // module is a standing workload like any other image component — it is
-        // rostered, has process facts, task queues and peers — it just builds
-        // no image of its own. `workerImages` below records whose it runs.
-        (component.kind === 'worker' &&
-          component.artifact?.kind === 'shared-oci-image')),
-  );
+  const imageComponents = biomeImageComponents(components);
   // A worker is a standing workload that runs an image: its own oci-image or a
   // sibling service's (shared-oci-image, validated by `sharedImageWorker`).
   // A worker with neither would be rostered by nothing and ship no image.
@@ -1807,34 +1842,13 @@ export async function manifestToIndexEntry({ raw, generatedIndex, rel, repo, pat
   // service's image — see `sharedImageWorker`.
   const workerImages = {};
   if (imageComponents.length > 0) {
+    const imageNames = new Set();
     for (const component of imageComponents) {
       const protocol =
         component.protocol !== null && typeof component.protocol === 'object'
           ? component.protocol
           : {};
-      // A `service` registers under `protocol.serviceName`; a `worker` never
-      // registers with the service registry, so its image name is the component
-      // key. Same rule the producing repo's build plane applies — the image name
-      // is the SERVICE build arg either way.
-      const name =
-        component.kind === 'service' ? protocol.serviceName : component.key;
-      if (typeof name !== 'string' || name.length === 0) {
-        throw new Error(
-          `${rel}: xema.components[] kind "${component.kind}" component ` +
-            `"${String(component.key)}" has no image name — a service declares ` +
-            `protocol.serviceName, a worker a non-empty key`,
-        );
-      }
-      if (target !== 'server') {
-        throw new Error(
-          `${rel}: web biome "${id}" cannot own deployable image "${name}"`,
-        );
-      }
-      if (services.includes(name) || runtimeComponents.includes(name)) {
-        throw new Error(
-          `${rel}: xema.components[] declares image "${name}" more than once`,
-        );
-      }
+      const name = claimBiomeImageName(component, { rel, id, target, taken: imageNames });
       const where = `${rel}: xema.components[] "${name}"`;
       const requirements = parseComponentResourceDeclaration(
         'ResourceRequirementsSchema',
@@ -1847,7 +1861,7 @@ export async function manifestToIndexEntry({ raw, generatedIndex, rel, repo, pat
         `${where} protocol.providesResources`,
       );
       const nexus = componentNexusDeclarations(component, name, protocol, where);
-      if (component.scheduler === 'runtime') {
+      if (isRuntimeImageComponent(component)) {
         // A Nexus binding names the provider COMPONENT the deploy plane points
         // an endpoint at, which must be a rostered image; a component launched
         // per allocation is not one. Refused rather than dropped.

package/edition/oci-evidence-verbs.mjs

@@ -7,6 +7,9 @@
 //                 [--input <file> --cosign <abs path> [--now <epoch-ms>]]
 //   backfill-plan --distribution <id>… --producer-repository-root <abs dir>…
 //
+// attach-plan and validate take --data-root <dir> --kernel <dir> (vendor mode) or --contract-authority <file>
+// (public-input mode: a publisher's run with the kernel this CLI bundles); backfill-plan is vendor mode only.
+//
 // The library reads and decides; it never writes to a registry. `attach-plan`
 // validates a produced evidence directory and prints the exact `oras attach`
 // operands; `validate` holds a pulled artifact to its manifest (and, with
@@ -32,6 +35,7 @@ import {
   isEntryModule,
 } from './edition-workspace.mjs';
 import { SHA256_DIGEST_PATTERN } from './evidence-grammars.mjs';
+import { EvidenceInputMode, configureEvidenceInputMode } from './evidence-input-mode.mjs';
 import { canonicalJson, loadValidatedImageLocks } from './image-evidence.mjs';
 import { compareStrings, loadKernelDistributionSchemas, serializeJson } from './lib.mjs';
 import {
@@ -320,12 +324,24 @@ const readJsonFile = (path, label) => {
   }
 };
 
+/**
+ * `attach-plan` and `validate` in one of the two input modes: the vendor's pinned authority and kernel checkout, or
+ * a publisher's `--contract-authority` file with the kernel this CLI bundles.
+ */
+async function ociInputMode(argv, operation) {
+  const mode = await configureEvidenceInputMode(argv, { verb: `oci ${operation}` });
+  if (mode.mode === EvidenceInputMode.PublicInput) {
+    return { rest: mode.rest, schemas: mode.schemas, expectedContractAuthority: mode.contractAuthority };
+  }
+  const schemas = await loadKernelDistributionSchemas();
+  return { rest: mode.rest, schemas, expectedContractAuthority: readPinnedContractAuthority({ dataRoot: dataRoot(), schemas }) };
+}
+
 async function main() {
   const [operation, ...argv] = process.argv.slice(2);
   if (operation === 'attach-plan') {
-    const rest = configureEditionWorkspaceFromArgv(argv, [WorkspaceRoot.Data, WorkspaceRoot.Kernel]);
+    const { rest, schemas, expectedContractAuthority } = await ociInputMode(argv, operation);
     const flags = parseEvidenceCliFlags(rest, { single: ['evidence-directory', 'input'] });
-    const schemas = await loadKernelDistributionSchemas();
     const input = flags.optional('input');
     process.stdout.write(
       serializeJson(
@@ -333,18 +349,17 @@ async function main() {
           evidenceDirectory: flags.require('evidence-directory'),
           input: input === undefined ? undefined : readJsonFile(input, 'producer input'),
           schemas,
-          expectedContractAuthority: readPinnedContractAuthority({ dataRoot: dataRoot(), schemas }),
+          expectedContractAuthority,
         }),
       ),
     );
     return;
   }
   if (operation === 'validate') {
-    const rest = configureEditionWorkspaceFromArgv(argv, [WorkspaceRoot.Data, WorkspaceRoot.Kernel]);
+    const { rest, schemas, expectedContractAuthority } = await ociInputMode(argv, operation);
     const flags = parseEvidenceCliFlags(rest, {
       single: ['evidence-directory', 'manifest', 'subject-digest', 'input', 'cosign', 'now'],
     });
-    const schemas = await loadKernelDistributionSchemas();
     const input = flags.optional('input');
     const cosign = flags.optional('cosign');
     const now = flags.optional('now');
@@ -362,7 +377,7 @@ async function main() {
           subjectDigest: flags.require('subject-digest'),
           schemas,
           input: input === undefined ? undefined : readJsonFile(input, 'producer input'),
-          expectedContractAuthority: readPinnedContractAuthority({ dataRoot: dataRoot(), schemas }),
+          expectedContractAuthority,
           runCosign: cosign === undefined ? undefined : createCosignVerifier(cosign).runCosign,
           now: now === undefined ? Date.now() : Number(now),
         }),

package/edition/operation-requirements.mjs

@@ -60,6 +60,7 @@ function loadKernelAudienceGrammars() {
   kernelAudienceGrammars = {
     ExactAudienceSchema: elementSchema('requiresAudiences'),
     AudienceNamespaceSchema: elementSchema('ownsAudienceNamespaces'),
+    PeerServiceNameSchema: elementSchema('optionalPeers'),
   };
   return kernelAudienceGrammars;
 }
@@ -162,6 +163,16 @@ export function componentOwnedAudienceNamespaces(component, where) {
   return declaredPrivilegeList(component, where, 'ownsAudienceNamespaces', AudienceNamespaceSchema, 'audience namespace');
 }
 
+/**
+ * The peer services one platform service uses only when they are served
+ * (`optionalPeers`, edition protocol v38), each graded by the kernel's peer
+ * service name grammar. Declared INTENT only; `null` when undeclared.
+ */
+export function componentOptionalPeers(component, where) {
+  const { PeerServiceNameSchema } = loadKernelAudienceGrammars();
+  return declaredPrivilegeList(component, where, 'optionalPeers', PeerServiceNameSchema, 'peer service name');
+}
+
 /**
  * The event subscription clauses one workload component declares
  * (`subscribesEvents`), each graded by the kernel's clause grammar and returned

package/edition/oras.mjs

@@ -197,8 +197,9 @@ const noticesGiven = new WeakSet();
 /**
  * Prepare the oras binary for use. With `trustedDigests` (an array) the binary
  * must hash to one of them and a private copy of exactly those bytes is what
- * runs; an empty list trusts no binary. With `trustedDigests: null` (a data
- * root that declares no evidence trust) the binary is held to its version only,
+ * runs; an empty list trusts no binary. With `trustedDigests: null` (no
+ * evidence trust in force: a publisher's run with no data root, or a data root
+ * that declares none) the binary is held to its version only,
  * and the run says so once.
  *
  * @returns {{version: string, pinned: boolean, path: () => string, dispose: () => void}}
@@ -215,8 +216,8 @@ export function prepareTrustedOras({ env = process.env, trustedDigests, notice =
       if (!noticesGiven.has(notice)) {
         noticesGiven.add(notice);
         notice(
-          `[oras] ${located} is held to its version (${version}) only: this data root declares no evidence-trust pin, ` +
-            'so there are no trustedOrasBinaryDigests to hold it to.',
+          `[oras] ${located} is held to its version (${version}) only: no evidence-trust pin is in force ` +
+            '(a publisher run, or a data root that declares none), so there are no trustedOrasBinaryDigests to hold it to.',
         );
       }
       return {

package/edition/platform-service-class.mjs

@@ -1,5 +1,5 @@
 import { isKernelCapabilityDomain } from './kernel-capability-domain.mjs';
-import { componentAudienceRequirements, componentOperationRequirements, componentOwnedAudienceNamespaces } from './operation-requirements.mjs';
+import { componentAudienceRequirements, componentOperationRequirements, componentOptionalPeers, componentOwnedAudienceNamespaces } from './operation-requirements.mjs';
 import { compareStrings } from './string-order.mjs';
 
 /**
@@ -58,7 +58,7 @@ export function sourceOwnedCapabilityDomains(sourceManifest, where) {
 /**
  * What a platform service declares it requires and owns, as the index carries it, read from the
  * same declaration as {@link sourceOwnedCapabilityDomains} (the `xema` block of its source manifest):
- * `requiresOperations`, `requiresAudiences` and `ownsAudienceNamespaces`. Each is sorted, unique and
+ * `requiresOperations`, `requiresAudiences`, `ownsAudienceNamespaces` and `optionalPeers`. Each is sorted, unique and
  * non-empty, or no key at all. Declared INTENT: the lock admits or refuses each
  * (`admitOperationGrants`, `admitExactAudiences`).
  *
@@ -70,10 +70,12 @@ export function sourceDeclaredRequirements(sourceManifest, where) {
   const requiresOperations = componentOperationRequirements(xema, where);
   const requiresAudiences = componentAudienceRequirements(xema, where);
   const ownsAudienceNamespaces = componentOwnedAudienceNamespaces(xema, where);
+  const optionalPeers = componentOptionalPeers(xema, where);
   return {
     ...(requiresOperations === null ? {} : { requiresOperations }),
     ...(requiresAudiences === null ? {} : { requiresAudiences }),
     ...(ownsAudienceNamespaces === null ? {} : { ownsAudienceNamespaces }),
+    ...(optionalPeers === null ? {} : { optionalPeers }),
   };
 }
 

package/edition/produce-image-source-evidence.mjs

@@ -28,14 +28,13 @@ import { pathToFileURL } from 'node:url';
 import { certificateConstraintArgs } from './cosign-certificate-constraints.mjs';
 import { editionWorkspaceConfig } from './edition-config.mjs';
 import {
-  WorkspaceRoot,
-  configureEditionWorkspaceFromArgv,
   dataRoot,
   isEntryModule,
   kernelDistPath,
   kernelRepoDir,
 } from './edition-workspace.mjs';
 import { COMMIT_PATTERN, GITHUB_REF_PATTERN, GITHUB_REPOSITORY_PATTERN, SHA256_DIGEST_PATTERN } from './evidence-grammars.mjs';
+import { EvidenceInputMode, configureEvidenceInputMode } from './evidence-input-mode.mjs';
 import {
   KERNEL_CONTRACT_AUTHORITY_NOT_PINNED_ONE,
   KernelContractAuthorityPinError,
@@ -610,7 +609,12 @@ export function stageImageSourceEvidence({
  * later step to pick up; a successful accept removes it too. Only the argument
  * refusals above the first read leave it in place.
  *
- * `cosignVersion` is the trust policy's pinned version.
+ * `inputMode` (EvidenceInputMode) decides the cosign version check. In vendor
+ * mode `cosignVersion` is the trust policy's pinned version and the cosign that
+ * verifies must be it. In public-input mode there is no vendor trust policy and
+ * no version is held (`cosignVersion` must be null): the vendor's admission
+ * re-verifies every bundle with its own pinned cosign, and that is the
+ * authority. The signature verification itself runs in both modes.
  */
 export function acceptImageSourceEvidence({
   input,
@@ -618,6 +622,7 @@ export function acceptImageSourceEvidence({
   outputDirectory,
   schemas,
   expectedContractAuthority,
+  inputMode,
   cosignVersion,
   readCosignVersion,
   runCosign,
@@ -625,6 +630,12 @@ export function acceptImageSourceEvidence({
   if (!isAbsolute(stagingDirectory) || !isAbsolute(outputDirectory)) {
     throw new Error('the staging and output directories must be absolute paths');
   }
+  if (!Object.values(EvidenceInputMode).includes(inputMode)) {
+    throw new Error(`accept needs an input mode, one of ${Object.values(EvidenceInputMode).join(', ')} (got ${String(inputMode)})`);
+  }
+  if (inputMode === EvidenceInputMode.PublicInput && cosignVersion !== null) {
+    throw new Error('public-input accept holds no cosign version: the vendor admission re-verifies with its pinned cosign');
+  }
   if (typeof readCosignVersion !== 'function' || typeof runCosign !== 'function') {
     throw new Error('cosign seams are required');
   }
@@ -634,7 +645,9 @@ export function acceptImageSourceEvidence({
     sealing,
     outputDirectory,
     build: () => {
-      exactCosignVersion(readCosignVersion(), cosignVersion);
+      if (inputMode === EvidenceInputMode.Vendor) {
+        exactCosignVersion(readCosignVersion(), cosignVersion);
+      }
       const statements = buildImageSourceStatements(input, schemas, expectedContractAuthority);
       assertStagedExactly(
         stagingDirectory,
@@ -695,7 +708,7 @@ const USAGE =
   'usage: xema edition evidence statement producer <stage|accept> --input <json> --staging <absolute-directory> ' +
   '--github-repository <owner/repo> --github-ref <ref> --github-sha <commit> ' +
   '--github-workflow-ref <owner/repo/path@ref> [accept: --output <absolute-directory> --cosign <absolute-binary>] ' +
-  '--data-root <dir> --kernel <dir>';
+  '(--data-root <dir> --kernel <dir> | --contract-authority <file>)';
 
 function parseFlags(args, known) {
   const flags = new Map();
@@ -717,20 +730,19 @@ function parseFlags(args, known) {
 }
 
 async function main() {
-  const [phase, ...args] = configureEditionWorkspaceFromArgv(process.argv.slice(2), [
-    WorkspaceRoot.Data,
-    WorkspaceRoot.Kernel,
-  ]);
-  const context = ['github-repository', 'github-ref', 'github-sha', 'github-workflow-ref'];
+  const [phase, ...argv] = process.argv.slice(2);
   if (phase !== 'stage' && phase !== 'accept') {
     throw new Error(USAGE);
   }
+  const mode = await configureEvidenceInputMode(argv, { verb: `statement producer ${phase}` });
+  const context = ['github-repository', 'github-ref', 'github-sha', 'github-workflow-ref'];
   const flags = parseFlags(
-    args,
+    mode.rest,
     phase === 'stage' ? ['input', 'staging', ...context] : ['input', 'staging', 'output', 'cosign', ...context],
   );
   const input = JSON.parse(readFileSync(resolve(flags.get('input')), 'utf8'));
-  const { schemas, contractAuthority } = await loadProducerKernelSchemas({ dataRoot: dataRoot() });
+  const { schemas, contractAuthority } =
+    mode.mode === EvidenceInputMode.PublicInput ? mode : await loadProducerKernelSchemas({ dataRoot: dataRoot() });
   assertProducerInput(input, contractAuthority);
   assertGitHubProducerContext(input, {
     repository: flags.get('github-repository'),
@@ -754,11 +766,15 @@ async function main() {
     outputDirectory: flags.get('output'),
     schemas,
     expectedContractAuthority: contractAuthority,
-    cosignVersion: loadPinnedDeclaredTrustPolicy({
-      dataRoot: dataRoot(),
-      declaration: editionWorkspaceConfig().evidenceTrustPolicy,
-      schemas,
-    }).cosignVersion,
+    inputMode: mode.mode,
+    cosignVersion:
+      mode.mode === EvidenceInputMode.PublicInput
+        ? null
+        : loadPinnedDeclaredTrustPolicy({
+            dataRoot: dataRoot(),
+            declaration: editionWorkspaceConfig().evidenceTrustPolicy,
+            schemas,
+          }).cosignVersion,
     ...createCosignVerifier(flags.get('cosign')),
   });
   process.stdout.write(serializeJson({ schemaVersion: 1, kind: 'producer', outputDirectory: flags.get('output'), producerEvidence: evidence }));

package/edition/registry-credentials.mjs

@@ -127,6 +127,28 @@ export function loadRegistryCredentialDeclarations(
       { cause: error },
     );
   }
+  return parseRegistryCredentialDeclarations(text, REGISTRY_CREDENTIALS_FILE);
+}
+
+/**
+ * A registry credential declaration file the CALLER names, in the same strict
+ * schema: a third-party publisher states its own registries this way
+ * (`evidence assemble-third-party-input --registry-credentials <file>`). A
+ * missing file is refused; there is no default declaration.
+ */
+export function loadRegistryCredentialDeclarationsFile(path) {
+  let text;
+  try {
+    text = readFileSync(path, 'utf8');
+  } catch (error) {
+    if (error?.code !== 'ENOENT') {throw error;}
+    throw new Error(`the registry credential declaration ${path} does not exist`, { cause: error });
+  }
+  return parseRegistryCredentialDeclarations(text, path);
+}
+
+/** The declarations of one credential declaration file's text, strict schema v1, by authority. */
+function parseRegistryCredentialDeclarations(text, label) {
   const raw = JSON.parse(text);
   const keys = Object.keys(raw ?? {}).sort().join(',');
   if (
@@ -141,14 +163,14 @@ export function loadRegistryCredentialDeclarations(
       (!Array.isArray(raw.$comment) ||
         raw.$comment.some((line) => typeof line !== 'string')))
   ) {
-    throw new Error(`${REGISTRY_CREDENTIALS_FILE} is not strict schema v1`);
+    throw new Error(`${label} is not strict schema v1`);
   }
   const byAuthority = new Map();
   for (const [index, entry] of raw.registries.entries()) {
     assertCredentialDeclaration(entry, index);
     if (byAuthority.has(entry.authority)) {
       throw new Error(
-        `${REGISTRY_CREDENTIALS_FILE} declares "${entry.authority}" more than once`,
+        `${label} declares "${entry.authority}" more than once`,
       );
     }
     byAuthority.set(entry.authority, entry);

package/edition/third-party-source-evidence.mjs

@@ -10,7 +10,7 @@
 //   evidence/sha256-<image manifest hex>/producer-evidence.json (+ statements/, bundles/)
 //       the image-source/v2 evidence, stored the way a first-party producer commits it.
 
-import { decodeExactUtf8, evidenceDirectoryForDigest, verifySigstoreEvidenceDescriptor } from './image-evidence.mjs';
+import { assertProducerTtlCeiling, decodeExactUtf8, evidenceDirectoryForDigest, verifySigstoreEvidenceDescriptor } from './image-evidence.mjs';
 import { assertKernelContractAuthorityEqual } from './kernel-contract-authority.mjs';
 import { readBoundedNoFollowFile } from './no-follow-file.mjs';
 import { PRODUCER_EVIDENCE_INDEX_FILE } from './producer-evidence-index-file.mjs';
@@ -234,6 +234,13 @@ function verifiedImageEvidence({ source, image, evidenceRoot, context, hold, bun
     throw new Error(`${label}: ${error.message}`);
   }
   assertImageStatementBindsPin({ statement: verified.statement, source, image, expectedContractAuthority: context.expectedContractAuthority, label });
+  // The ceiling is held here, at the publisher's door, as well as by verify-evidence: a too-long lifetime is never pinned.
+  assertProducerTtlCeiling({
+    issuedAt: verified.statement.predicate.producerRun.issuedAt,
+    expiresAt: verified.statement.predicate.producerRun.expiresAt,
+    maxTtlSeconds: context.policy.maxProducerTtlSeconds,
+    label,
+  });
   const bundleBytes = readEvidenceFile(evidenceRoot, descriptor.bundlePath, `${label} bundle`, 16 * 1024 * 1024).bytes;
   assertCertificateExtensions({ bundle: JSON.parse(decodeExactUtf8(bundleBytes, `${label} bundle`)), source, label });
   return verified.statement;

package/edition/third-party-source-flags.mjs

@@ -61,7 +61,7 @@ function matching(flag, value, pattern, expectation) {
   return value;
 }
 
-const OCI_REPOSITORY_AT_DIGEST = /^[^@\s]+@sha256:[a-f0-9]{64}$/u;
+export const OCI_REPOSITORY_AT_DIGEST = /^[^@\s]+@sha256:[a-f0-9]{64}$/u;
 const NUMERIC_ID = /^[1-9][0-9]*$/u;
 
 function parseImage(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.51.0",
+  "version": "0.53.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -57,7 +57,7 @@
     "@xemahq/distribution-source-hash": "^0.2.2",
     "@xemahq/dsl": "^0.28.0",
     "@xemahq/identity-client": "^0.36.0",
-    "@xemahq/contracts": "^0.112.0",
+    "@xemahq/contracts": "^0.116.0",
     "@xemahq/kernel-state-runtime": "^0.8.0",
     "@xemahq/license-verifier": "^0.2.0",
     "@xemahq/release-policy": "^17.6.0",
@@ -96,6 +96,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:74f62d9a75483f8cdeec9b7264e56eb043e010e06b39b129c5598565765b1230"
+    "sourceDigest": "sha256:86b6ce1a0758e2ed6ab8e9a2cd84c29c52f72582ff30c670e16e8e5982038894"
   }
 }