@xemahq/xema 0.52.0 → 0.54.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -0
- package/dist/cli.d.ts.map +1 -1
- package/dist/cli.js +2 -0
- package/dist/cli.js.map +1 -1
- package/dist/commands/auth.d.ts +9 -0
- package/dist/commands/auth.d.ts.map +1 -0
- package/dist/commands/auth.js +66 -0
- package/dist/commands/auth.js.map +1 -0
- package/dist/commands/edition.d.ts.map +1 -1
- package/dist/commands/edition.js +1 -0
- package/dist/commands/edition.js.map +1 -1
- package/dist/edition/verify-image-evidence.bundle.mjs +1013 -870
- package/dist/edition/verify-image-evidence.bundle.provenance.json +501 -495
- package/dist/runtime/edition/verb-map.d.ts +2 -1
- package/dist/runtime/edition/verb-map.d.ts.map +1 -1
- package/dist/runtime/edition/verb-map.js +2 -0
- package/dist/runtime/edition/verb-map.js.map +1 -1
- package/edition/README.md +54 -2
- package/edition/adapter-bundled-versions.mjs +2 -1
- package/edition/authorization-base.mjs +9 -8
- package/edition/biome-content.mjs +23 -29
- package/edition/candidate-edition.mjs +692 -0
- package/edition/checkout-indexed-source-repositories.mjs +6 -8
- package/edition/collected-refusals.mjs +59 -0
- package/edition/contract-authority.mjs +122 -0
- package/edition/cosign-certificate-constraints.mjs +18 -8
- package/edition/customer-edition-verbs.mjs +30 -8
- package/edition/develop-chart-set.mjs +7 -6
- package/edition/develop-edition-invariants.mjs +2 -1
- package/edition/develop-edition-resolve.mjs +109 -31
- package/edition/develop-edition.mjs +49 -8
- package/edition/develop-engine-image.mjs +95 -0
- package/edition/develop-image-probe.mjs +2 -1
- package/edition/develop-resolve-report.mjs +159 -0
- package/edition/develop-snapshot-inputs.mjs +4 -3
- package/edition/develop-verify-image-record.mjs +23 -4
- package/edition/edition-artifact.mjs +17 -7
- package/edition/edition-protocol.mjs +8 -2
- package/edition/evidence-input-mode.mjs +4 -22
- package/edition/images-from-record.mjs +362 -0
- package/edition/lib.mjs +1 -19
- package/edition/locked-bundle-signer.mjs +15 -3
- package/edition/operation-grant-admission.mjs +51 -9
- package/edition/operation-requirements.mjs +11 -0
- package/edition/platform-service-class.mjs +4 -2
- package/edition/resolve-distribution.mjs +95 -82
- package/edition/resolve-images.mjs +12 -5
- package/edition/shallow-checkout.mjs +18 -0
- package/edition/workspace-sections.mjs +23 -3
- package/package.json +7 -3
package/README.md
CHANGED
|
@@ -71,6 +71,7 @@ xema down # stop (add --purge to delete data vo
|
|
|
71
71
|
| `xema plan\|apply\|export\|import -f xema.yaml` | Declarative stacks (`--stack`, `--auto-approve` on apply). |
|
|
72
72
|
| `xema installation init\|validate\|plan\|apply\|verify\|status\|support-bundle` | Manage a `XemaInstallation` (`xema.installation.yaml`). |
|
|
73
73
|
| `xema login`, `logout`, `whoami` | Authenticate against a platform. |
|
|
74
|
+
| `xema auth token` | Print the signed-in access token (refreshed if needed). It is a bearer credential: keep it out of shell history, logs and config files; use it as `TOKEN=$(xema auth token)` passed directly to the consumer. |
|
|
74
75
|
|
|
75
76
|
`xema <command> --help` lists every option.
|
|
76
77
|
|
package/dist/cli.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkDpC,wBAAgB,YAAY,IAAI,OAAO,CAyFtC;AAED,wBAAsB,IAAI,CACxB,IAAI,GAAE,aAAa,CAAC,MAAM,CAAgB,GACzC,OAAO,CAAC,IAAI,CAAC,CAMf"}
|
package/dist/cli.js
CHANGED
|
@@ -7,6 +7,7 @@ const node_fs_1 = require("node:fs");
|
|
|
7
7
|
const node_path_1 = require("node:path");
|
|
8
8
|
const commander_1 = require("commander");
|
|
9
9
|
const apply_1 = require("./commands/apply");
|
|
10
|
+
const auth_1 = require("./commands/auth");
|
|
10
11
|
const biome_1 = require("./commands/biome");
|
|
11
12
|
const canopy_1 = require("./commands/canopy");
|
|
12
13
|
const config_1 = require("./commands/config");
|
|
@@ -51,6 +52,7 @@ function buildProgram() {
|
|
|
51
52
|
.configureHelp({ sortSubcommands: true });
|
|
52
53
|
(0, init_1.registerCommand)(program);
|
|
53
54
|
(0, login_1.registerCommand)(program);
|
|
55
|
+
(0, auth_1.registerCommand)(program);
|
|
54
56
|
(0, license_1.registerCommand)(program);
|
|
55
57
|
(0, installation_1.registerCommand)(program);
|
|
56
58
|
(0, onboard_1.registerCommand)(program);
|
package/dist/cli.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;AA4DA,oCAyFC;AAED,oBAQC;AAxJD,qCAAuC;AACvC,yCAAiC;AAEjC,yCAAoC;AAEpC,4CAAoE;AACpE,0CAAkE;AAClE,4CAAoE;AACpE,8CAAsE;AACtE,8CAAsE;AACtE,wCAAgE;AAChE,8CAAsE;AACtE,0CAAkE;AAClE,gDAAwE;AACxE,8CAAsE;AACtE,8CAAsE;AACtE,0CAAkE;AAClE,0DAAkF;AAClF,gDAAwE;AACxE,4CAAoE;AACpE,0CAAkE;AAClE,gDAAwE;AACxE,gDAAwE;AACxE,0CAAkE;AAClE,wCAAgE;AAChE,4CAAoE;AACpE,4CAAoE;AACpE,8CAAsE;AACtE,8CAAsE;AACtE,sCAA8D;AAC9D,iDAAmD;AACnD,wDAA4D;AAS5D,SAAS,cAAc;IACrB,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAC3D,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,YAAY,EAAE,MAAM,CAAC,CAEhE,CAAC;IACF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;AAErC,SAAgB,YAAY;IAC1B,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;IAC9B,OAAO;SACJ,IAAI,CAAC,MAAM,CAAC;SACZ,WAAW,CAAC,iDAAiD,CAAC;SAC9D,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,uBAAuB,CAAC;SAC9D,kBAAkB,CAAC,IAAI,CAAC;SACxB,aAAa,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,IAAA,sBAAY,EAAC,OAAO,CAAC,CAAC;IACtB,IAAA,uBAAa,EAAC,OAAO,CAAC,CAAC;IACvB,IAAA,sBAAY,EAAC,OAAO,CAAC,CAAC;IACtB,IAAA,yBAAe,EAAC,OAAO,CAAC,CAAC;IACzB,IAAA,8BAAoB,EAAC,OAAO,CAAC,CAAC;IAC9B,IAAA,yBAAe,EAAC,OAAO,CAAC,CAAC;IACzB,IAAA,oBAAU,EAAC,OAAO,CAAC,CAAC;IACpB,IAAA,sBAAY,EAAC,OAAO,CAAC,CAAC;IACtB,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAC;IACxB,IAAA,sBAAY,EAAC,OAAO,CAAC,CAAC;IACtB,IAAA,qBAAW,EAAC,OAAO,CAAC,CAAC;IACrB,IAAA,yBAAe,EAAC,OAAO,CAAC,CAAC;IACzB,IAAA,uBAAa,EAAC,OAAO,CAAC,CAAC;IACvB,IAAA,uBAAa,EAAC,OAAO,CAAC,CAAC;IACvB,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAC;IACxB,IAAA,sBAAY,EAAC,OAAO,CAAC,CAAC;IACtB,IAAA,uBAAa,EAAC,OAAO,CAAC,CAAC;IACvB,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAC;IACxB,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAC;IACxB,IAAA,qBAAW,EAAC,OAAO,CAAC,CAAC;IACrB,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAC;IACxB,IAAA,uBAAa,EAAC,OAAO,CAAC,CAAC;IACvB,IAAA,yBAAe,EAAC,OAAO,CAAC,CAAC;IACzB,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAC;IACxB,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAC;IAMxB,MAAM,OAAO,GAAG,IAAA,0BAAe,GAAE,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC;YAC5D,IAAI,GAAG,EAAE,CAAC;gBAIP,GAAuC,CAAC,OAAO,GAAG,IAAI,CAAC;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IAcD,OAAO,CAAC,WAAW,CACjB,OAAO,EACP,OAAO;QACL,CAAC,CAAC;YACE,EAAE;YACF,2DAA2D;YAC3D,6DAA6D;YAC7D,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC;QACd,CAAC,CAAC;YACE,EAAE;YACF,kBAAkB;YAClB,2EAA2E;YAC3E,iEAAiE;YACjE,6DAA6D;YAC7D,sDAAsD;YACtD,EAAE;YACF,+DAA+D;YAC/D,6DAA6D;YAC7D,yEAAyE;YACzE,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACjB,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAEM,KAAK,UAAU,IAAI,CACxB,OAA8B,OAAO,CAAC,IAAI;IAE1C,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAI/B,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AACtC,CAAC;AASD,SAAS,kBAAkB;IACzB,MAAM,IAAI,GAAG,CAAC,GAAY,EAAS,EAAE;QACnC,IACE,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG;YAC9B,GAAG,YAAY,KAAK;YACpB,GAAG,CAAC,KAAK,KAAK,SAAS,EACvB,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,KAAK,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,4BAAe,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAID,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,kBAAkB,EAAE,CAAC;IACrB,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,4BAAe,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
import { type DeviceFlowDeps } from '../runtime/auth/device-flow';
|
|
2
|
+
import type { Command } from 'commander';
|
|
3
|
+
interface AuthTokenOptions {
|
|
4
|
+
issuer?: string;
|
|
5
|
+
}
|
|
6
|
+
export declare function registerCommand(program: Command): void;
|
|
7
|
+
export declare function runAuthToken(opts: AuthTokenOptions, deps?: DeviceFlowDeps, path?: string, write?: (text: string) => void): Promise<void>;
|
|
8
|
+
export {};
|
|
9
|
+
//# sourceMappingURL=auth.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAaA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,6BAA6B,CAAC;AAUrC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,UAAU,gBAAgB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0BtD;AAUD,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,IAAI,GAAE,cAAwC,EAC9C,IAAI,GAAE,MAAqB,EAC3B,KAAK,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAA2C,GACnE,OAAO,CAAC,IAAI,CAAC,CA4Cf"}
|
|
@@ -0,0 +1,66 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.registerCommand = registerCommand;
|
|
4
|
+
exports.runAuthToken = runAuthToken;
|
|
5
|
+
const exit_codes_1 = require("../lib/exit-codes");
|
|
6
|
+
const device_flow_1 = require("../runtime/auth/device-flow");
|
|
7
|
+
const session_auth_1 = require("../runtime/auth/session-auth");
|
|
8
|
+
const session_store_1 = require("../runtime/auth/session-store");
|
|
9
|
+
const LOGIN_HINT = 'Run `xema login` to sign in again.';
|
|
10
|
+
function registerCommand(program) {
|
|
11
|
+
const auth = program
|
|
12
|
+
.command('auth')
|
|
13
|
+
.summary('Use the signed-in Xema session')
|
|
14
|
+
.description('Commands that expose the session created by `xema login`.');
|
|
15
|
+
auth
|
|
16
|
+
.command('token')
|
|
17
|
+
.description("Print the signed-in user's access token (refreshing it if needed)")
|
|
18
|
+
.addHelpText('after', [
|
|
19
|
+
'',
|
|
20
|
+
'The printed token is a bearer credential: keep it out of shell history,',
|
|
21
|
+
'logs and config files. Use it in a pipe or command substitution, e.g.',
|
|
22
|
+
'`TOKEN=$(xema auth token)`, passed directly to the consumer.',
|
|
23
|
+
'',
|
|
24
|
+
].join('\n'))
|
|
25
|
+
.option('--issuer <url>', 'Realm URL the token must come from; fails if it is not the session issuer')
|
|
26
|
+
.action(async (opts) => {
|
|
27
|
+
await runAuthToken(opts);
|
|
28
|
+
});
|
|
29
|
+
}
|
|
30
|
+
function normalizeIssuer(issuer) {
|
|
31
|
+
return issuer.replace(/\/+$/, '');
|
|
32
|
+
}
|
|
33
|
+
async function runAuthToken(opts, deps = (0, device_flow_1.defaultDeviceFlowDeps)(), path = session_store_1.SESSION_FILE, write = (text) => process.stdout.write(text)) {
|
|
34
|
+
let stored;
|
|
35
|
+
try {
|
|
36
|
+
stored = (0, session_store_1.readSession)(path);
|
|
37
|
+
}
|
|
38
|
+
catch (err) {
|
|
39
|
+
const detail = err instanceof Error ? err.message : String(err);
|
|
40
|
+
return (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, detail);
|
|
41
|
+
}
|
|
42
|
+
if (stored === undefined) {
|
|
43
|
+
return (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.NotFound, 'Not signed in. Run `xema login`.');
|
|
44
|
+
}
|
|
45
|
+
if (opts.issuer !== undefined &&
|
|
46
|
+
normalizeIssuer(opts.issuer) !== normalizeIssuer(stored.issuer)) {
|
|
47
|
+
return (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, `The signed-in session was issued by ${stored.issuer}, not ${opts.issuer} ` +
|
|
48
|
+
'(compared exactly, ignoring trailing slashes). Run `xema login` against that issuer.');
|
|
49
|
+
}
|
|
50
|
+
let session;
|
|
51
|
+
try {
|
|
52
|
+
session = await (0, session_auth_1.ensureUsableSession)(stored, deps, path);
|
|
53
|
+
}
|
|
54
|
+
catch (err) {
|
|
55
|
+
if (err instanceof device_flow_1.DeviceFlowError || err instanceof session_auth_1.SessionExpiredError) {
|
|
56
|
+
const hint = err.message.includes('xema login') ? '' : ` ${LOGIN_HINT}`;
|
|
57
|
+
return (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.GenericError, `${err.message}${hint}`);
|
|
58
|
+
}
|
|
59
|
+
throw err;
|
|
60
|
+
}
|
|
61
|
+
if (session === undefined) {
|
|
62
|
+
return (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.NotFound, 'Not signed in. Run `xema login`.');
|
|
63
|
+
}
|
|
64
|
+
write(`${session.accessToken}\n`);
|
|
65
|
+
}
|
|
66
|
+
//# sourceMappingURL=auth.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":";;AAmCA,0CA0BC;AAUD,oCAiDC;AA5GD,kDAA8D;AAC9D,6DAIqC;AACrC,+DAGsC;AACtC,iEAGuC;AAQvC,MAAM,UAAU,GAAG,oCAAoC,CAAC;AAExD,SAAgB,eAAe,CAAC,OAAgB;IAC9C,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,OAAO,CAAC,gCAAgC,CAAC;SACzC,WAAW,CAAC,2DAA2D,CAAC,CAAC;IAE5E,IAAI;SACD,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,mEAAmE,CAAC;SAChF,WAAW,CACV,OAAO,EACP;QACE,EAAE;QACF,yEAAyE;QACzE,uEAAuE;QACvE,8DAA8D;QAC9D,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;SACA,MAAM,CACL,gBAAgB,EAChB,2EAA2E,CAC5E;SACA,MAAM,CAAC,KAAK,EAAE,IAAsB,EAAE,EAAE;QACvC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACP,CAAC;AAMD,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,IAAsB,EACtB,OAAuB,IAAA,mCAAqB,GAAE,EAC9C,OAAe,4BAAY,EAC3B,QAAgC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;IAEpE,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,2BAAW,EAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,IAAA,qBAAQ,EAAC,4BAAe,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAA,qBAAQ,EACb,4BAAe,CAAC,QAAQ,EACxB,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAED,IACE,IAAI,CAAC,MAAM,KAAK,SAAS;QACzB,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAC/D,CAAC;QACD,OAAO,IAAA,qBAAQ,EACb,4BAAe,CAAC,kBAAkB,EAClC,uCAAuC,MAAM,CAAC,MAAM,SAAS,IAAI,CAAC,MAAM,GAAG;YACzE,sFAAsF,CACzF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAA,kCAAmB,EAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,6BAAe,IAAI,GAAG,YAAY,kCAAmB,EAAE,CAAC;YACzE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;YACxE,OAAO,IAAA,qBAAQ,EAAC,4BAAe,CAAC,YAAY,EAAE,GAAG,GAAG,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAA,qBAAQ,EACb,4BAAe,CAAC,QAAQ,EACxB,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;AACpC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"edition.d.ts","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"edition.d.ts","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmDzC,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiBtD"}
|
package/dist/commands/edition.js
CHANGED
|
@@ -21,6 +21,7 @@ const VERB_SUMMARY = {
|
|
|
21
21
|
[verb_map_1.EditionVerb.RepinEvidenceTrust]: 'Pin the data root evidence trust policy and this CLI verifier: xema edition repin-evidence-trust --data-root <dir> --kernel <dir>',
|
|
22
22
|
[verb_map_1.EditionVerb.VerifyEvidence]: 'Verify the signed image evidence of an edition with the pinned verifier bundle: xema edition verify-evidence <id> --evidence-root <dir> --descriptor <path> --state <path> --cosign <path> --git <path> [--json] --data-root <dir> --editions-root <dir> --kernel <dir>',
|
|
23
23
|
[verb_map_1.EditionVerb.Evidence]: `Build, accept and plan image evidence (never signs): xema edition evidence <${Object.values(verb_map_1.EditionEvidenceKind).join('|')}> …; a third-party publisher's GitHub-hosted refs/heads/main workflow assembles the producer input of one image on public inputs only (this CLI, the @xemahq/contracts it ships, its own checkout at GITHUB_WORKSPACE and registry credentials): xema edition evidence assemble-third-party-input --bundle <oci repository>@sha256:<hex> --contract-authority <file> --image <image repository>@sha256:<hex> --subject-id <component image name> --provenance <absolute exported SLSA v1 predicate> --registry-credentials <file> --output <path> [--ttl-seconds <n>]; it then runs statement producer <stage|accept> and oci <attach-plan|validate> with --contract-authority <file> in place of --data-root/--kernel (public-input mode; the CLI's bundled @xemahq/contracts must be that authority)`,
|
|
24
|
+
[verb_map_1.EditionVerb.ContractAuthority]: 'Print the full kernel contract authority (KernelContractAuthoritySchema) of the @xemahq/contracts this CLI ships, as canonical JSON: the --contract-authority <file> of a third-party publisher\'s public-input run. No root flags: xema edition contract-authority > contract-authority.json. Read from the kernel\'s own published dist/edition-protocol/contract-authority.json (sourceCommit is the commit as the kernel release states it, carried, not proven; contentDigest and sourcePaths are proven against the package), refused unless its contentDigest is the bundled edition protocol digest and the bundled kernel is that authority; a kernel without the file (a dev build) is refused',
|
|
24
25
|
[verb_map_1.EditionVerb.List]: 'Print the offering ids of an editions root as JSON: xema edition list --editions-root <dir>',
|
|
25
26
|
[verb_map_1.EditionVerb.Locks]: 'Print the validated locks of an edition as JSON: xema edition locks <id> --channel <release|develop> --data-root <dir> --editions-root <dir> --kernel <dir>',
|
|
26
27
|
[verb_map_1.EditionVerb.ChartSet]: `Pin the chart set of the editions to the charts the registry serves: xema edition chart-set <${Object.values(verb_map_1.EditionChartSetOperation).join('|')}> [--check] --data-root <dir> --editions-root <dir> --kernel <dir>; source-commit prints the commit each publisher closed its locked set at (--data-root, --kernel)`,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"edition.js","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"edition.js","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":";;AAuDA,0CAiBC;AAxED,kDAA8D;AAC9D,4DAA8D;AAC9D,0DAA2H;AAW3H,MAAM,YAAY,GAA0C;IAC1D,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,0TAA0T;IAC5T,CAAC,sBAAW,CAAC,IAAI,CAAC,EAChB,krBAAkrB;IACprB,CAAC,sBAAW,CAAC,cAAc,CAAC,EAAE,sNAAsN;IACpP,CAAC,sBAAW,CAAC,OAAO,CAAC,EAAE,g0BAAg0B;IACv1B,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,2lBAA2lB;IAC7lB,CAAC,sBAAW,CAAC,QAAQ,CAAC,EACpB,wNAAwN;IAC1N,CAAC,sBAAW,CAAC,SAAS,CAAC,EAAE,yHAAyH;IAClJ,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,kDAAkD,MAAM,CAAC,MAAM,CAAC,2BAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,giBAAgiB;IAChpB,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,oIAAoI;IACzJ,CAAC,sBAAW,CAAC,aAAa,CAAC,EACzB,4XAA4X;IAC9X,CAAC,sBAAW,CAAC,GAAG,CAAC,EAAE,qEAAqE;IACxF,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,qGAAqG;IACpI,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,wEAAwE;IACvG,CAAC,sBAAW,CAAC,kBAAkB,CAAC,EAAE,mIAAmI;IACrK,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,yQAAyQ;IAC3Q,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,+EAA+E,MAAM,CAAC,MAAM,CAAC,8BAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,wwBAAwwB;IAC35B,CAAC,sBAAW,CAAC,iBAAiB,CAAC,EAC7B,0qBAA0qB;IAC5qB,CAAC,sBAAW,CAAC,IAAI,CAAC,EAAE,6FAA6F;IACjH,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,6JAA6J;IAClL,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,gGAAgG,MAAM,CAAC,MAAM,CAAC,mCAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qKAAqK;IAC9U,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,6LAA6L;IAC/L,CAAC,sBAAW,CAAC,MAAM,CAAC,EAClB,yMAAyM;IAC3M,CAAC,sBAAW,CAAC,GAAG,CAAC,EACf,mWAAmW;IACrW,CAAC,sBAAW,CAAC,KAAK,CAAC,EACjB,qMAAqM;IACvM,CAAC,sBAAW,CAAC,aAAa,CAAC,EACzB,uMAAuM;IACzM,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,qaAAqa;CACxa,CAAC;AAEF,SAAgB,eAAe,CAAC,OAAgB;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACvF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,sBAAW,CAAC,EAAE,CAAC;QAC9C,OAAO;aACJ,OAAO,CAAC,IAAI,CAAC;aACb,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;aAC/B,QAAQ,CAAC,WAAW,EAAE,0DAA0D,CAAC;aACjF,kBAAkB,EAAE;aACpB,MAAM,CAAC,CAAC,IAAc,EAAE,EAAE;YACzB,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAA,0BAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,qBAAQ,EAAC,4BAAe,CAAC,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC;AACH,CAAC"}
|