@xemahq/xema 0.58.0 → 0.59.0

package/dist/commands/edition.js

@@ -5,7 +5,7 @@ const exit_codes_1 = require("../lib/exit-codes");
 const run_entry_1 = require("../runtime/edition/run-entry");
 const verb_map_1 = require("../runtime/edition/verb-map");
 const VERB_SUMMARY = {
-    [verb_map_1.EditionVerb.Resolve]: 'Resolve the whole release lock set of an edition: xema edition resolve <id> [--check]; or a customer edition against the catalogue pinned in catalogue.pin.json beside the definition: xema edition resolve --definition <file> --channel <release|develop> --out <dir> [--source-image <source>=<registry>/<prefix>]...',
+    [verb_map_1.EditionVerb.Resolve]: 'Resolve the whole release lock set of an edition: xema edition resolve <id> [--check]; or a customer edition against the catalogue pinned in catalogue.pin.json beside the definition: xema edition resolve --definition <file> --channel release --out <dir> (a develop customer edition is resolved by xema edition develop resolve --definition) [--source-image <source>=<registry>/<prefix>]...',
     [verb_map_1.EditionVerb.Seal]: 'Seal one exact resolved RELEASE edition (kind resolved, pulled by the caller): xema edition seal --resolved <repository>@sha256:<digest> --manifest <file> --artifact <dir> --out <dir> --cosign <abs path> --resolve-workflow-sha <40-hex> [--local] --data-root <dir> --editions-root <dir> --kernel <dir>; cosign-verifies it offline against the contract issuer and the resolve publisher (only the data root edition-workspace.json editionPublishers.resolved.release, in the repository the edition provenance records; undeclared is refused), then writes its layers unchanged plus a kind sealed release descriptor naming it as sealOf, refused unless the evidence trust policy is armed on release',
     [verb_map_1.EditionVerb.ResolveDigests]: 'Resolve the image digests of an edition: xema edition resolve-digests <id> [--definition <file>] (a customer edition resolves them against the release catalogue pinned in catalogue.pin.json beside the definition)',
     [verb_map_1.EditionVerb.Develop]: 'Resolve a develop edition snapshot: xema edition develop <resolve|target|choose-kernel|freeze-graph|freeze-sources|check-existing|check-overrides|select-records|verify-image-record|coverage> ...; or a customer develop edition (catalogue pinned in catalogue.pin.json beside the definition): xema edition develop <resolve|target|check-existing|freeze-sources> --definition <file> ... (resolve: --pins <file> --out <dir> --registry <root> --engine-image <repo>@sha256:<digest> [--source-image <source>=<registry>/<prefix>]...; target: --pins <file> --registry <root> --engine-image <repo>@sha256:<digest> [--source-image ...]; check-existing: --pins <file> --artifact <dir> --engine-image <repo>@sha256:<digest> [--source-image ...]). The develop tag is sha256 of the CLI version, the engine image, the pins and the source-image map.',

package/dist/commands/edition.js.map

@@ -1 +1 @@
-{"version":3,"file":"edition.js","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":";;AAuDA,0CAiBC;AAxED,kDAA8D;AAC9D,4DAA8D;AAC9D,0DAA2H;AAW3H,MAAM,YAAY,GAA0C;IAC1D,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,0TAA0T;IAC5T,CAAC,sBAAW,CAAC,IAAI,CAAC,EAChB,krBAAkrB;IACprB,CAAC,sBAAW,CAAC,cAAc,CAAC,EAAE,sNAAsN;IACpP,CAAC,sBAAW,CAAC,OAAO,CAAC,EAAE,g0BAAg0B;IACv1B,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,2lBAA2lB;IAC7lB,CAAC,sBAAW,CAAC,QAAQ,CAAC,EACpB,wNAAwN;IAC1N,CAAC,sBAAW,CAAC,SAAS,CAAC,EAAE,yHAAyH;IAClJ,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,kDAAkD,MAAM,CAAC,MAAM,CAAC,2BAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,giBAAgiB;IAChpB,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,oIAAoI;IACzJ,CAAC,sBAAW,CAAC,aAAa,CAAC,EACzB,4XAA4X;IAC9X,CAAC,sBAAW,CAAC,GAAG,CAAC,EAAE,qEAAqE;IACxF,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,qGAAqG;IACpI,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,wEAAwE;IACvG,CAAC,sBAAW,CAAC,kBAAkB,CAAC,EAAE,mIAAmI;IACrK,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,yQAAyQ;IAC3Q,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,+EAA+E,MAAM,CAAC,MAAM,CAAC,8BAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,wwBAAwwB;IAC35B,CAAC,sBAAW,CAAC,iBAAiB,CAAC,EAC7B,0qBAA0qB;IAC5qB,CAAC,sBAAW,CAAC,IAAI,CAAC,EAAE,6FAA6F;IACjH,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,6JAA6J;IAClL,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,gGAAgG,MAAM,CAAC,MAAM,CAAC,mCAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qKAAqK;IAC9U,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,6LAA6L;IAC/L,CAAC,sBAAW,CAAC,MAAM,CAAC,EAClB,yMAAyM;IAC3M,CAAC,sBAAW,CAAC,GAAG,CAAC,EACf,mWAAmW;IACrW,CAAC,sBAAW,CAAC,KAAK,CAAC,EACjB,qMAAqM;IACvM,CAAC,sBAAW,CAAC,aAAa,CAAC,EACzB,uMAAuM;IACzM,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,qaAAqa;CACxa,CAAC;AAEF,SAAgB,eAAe,CAAC,OAAgB;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACvF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,sBAAW,CAAC,EAAE,CAAC;QAC9C,OAAO;aACJ,OAAO,CAAC,IAAI,CAAC;aACb,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;aAC/B,QAAQ,CAAC,WAAW,EAAE,0DAA0D,CAAC;aACjF,kBAAkB,EAAE;aACpB,MAAM,CAAC,CAAC,IAAc,EAAE,EAAE;YACzB,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAA,0BAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,qBAAQ,EAAC,4BAAe,CAAC,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC;AACH,CAAC"}
+{"version":3,"file":"edition.js","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":";;AAuDA,0CAiBC;AAxED,kDAA8D;AAC9D,4DAA8D;AAC9D,0DAA2H;AAW3H,MAAM,YAAY,GAA0C;IAC1D,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,sYAAsY;IACxY,CAAC,sBAAW,CAAC,IAAI,CAAC,EAChB,krBAAkrB;IACprB,CAAC,sBAAW,CAAC,cAAc,CAAC,EAAE,sNAAsN;IACpP,CAAC,sBAAW,CAAC,OAAO,CAAC,EAAE,g0BAAg0B;IACv1B,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,2lBAA2lB;IAC7lB,CAAC,sBAAW,CAAC,QAAQ,CAAC,EACpB,wNAAwN;IAC1N,CAAC,sBAAW,CAAC,SAAS,CAAC,EAAE,yHAAyH;IAClJ,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,kDAAkD,MAAM,CAAC,MAAM,CAAC,2BAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,giBAAgiB;IAChpB,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,oIAAoI;IACzJ,CAAC,sBAAW,CAAC,aAAa,CAAC,EACzB,4XAA4X;IAC9X,CAAC,sBAAW,CAAC,GAAG,CAAC,EAAE,qEAAqE;IACxF,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,qGAAqG;IACpI,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,wEAAwE;IACvG,CAAC,sBAAW,CAAC,kBAAkB,CAAC,EAAE,mIAAmI;IACrK,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,yQAAyQ;IAC3Q,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,+EAA+E,MAAM,CAAC,MAAM,CAAC,8BAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,wwBAAwwB;IAC35B,CAAC,sBAAW,CAAC,iBAAiB,CAAC,EAC7B,0qBAA0qB;IAC5qB,CAAC,sBAAW,CAAC,IAAI,CAAC,EAAE,6FAA6F;IACjH,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,6JAA6J;IAClL,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,gGAAgG,MAAM,CAAC,MAAM,CAAC,mCAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qKAAqK;IAC9U,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,6LAA6L;IAC/L,CAAC,sBAAW,CAAC,MAAM,CAAC,EAClB,yMAAyM;IAC3M,CAAC,sBAAW,CAAC,GAAG,CAAC,EACf,mWAAmW;IACrW,CAAC,sBAAW,CAAC,KAAK,CAAC,EACjB,qMAAqM;IACvM,CAAC,sBAAW,CAAC,aAAa,CAAC,EACzB,uMAAuM;IACzM,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,qaAAqa;CACxa,CAAC;AAEF,SAAgB,eAAe,CAAC,OAAgB;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACvF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,sBAAW,CAAC,EAAE,CAAC;QAC9C,OAAO;aACJ,OAAO,CAAC,IAAI,CAAC;aACb,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;aAC/B,QAAQ,CAAC,WAAW,EAAE,0DAA0D,CAAC;aACjF,kBAAkB,EAAE;aACpB,MAAM,CAAC,CAAC,IAAc,EAAE,EAAE;YACzB,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAA,0BAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,qBAAQ,EAAC,4BAAe,CAAC,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC;AACH,CAAC"}

package/dist/edition/verify-image-evidence.bundle.mjs

@@ -65684,6 +65684,38 @@ function assertDescriptorVocabulary(contract) {
     }
   }
 }
+var CustomerPinForm = Object.freeze({ Catalogue: "catalogue", CatalogueFree: "catalogue-free" });
+function assertProvenancePins(contract) {
+  const pins = contract.provenancePins;
+  const texts = ["catalogue", "definition"];
+  if (!isObject(pins) || !sameSet(Object.keys(pins), [...texts, "customerForms"]) || !texts.every((key) => typeof pins[key] === "string" && pins[key] !== "")) {
+    throw new Error('edition-contract.json: "provenancePins" must be exactly {catalogue, definition, customerForms}');
+  }
+  const forms = pins.customerForms;
+  const formNames = Object.values(CustomerPinForm);
+  if (!isObject(forms) || !sameSet(Object.keys(forms), ["names", "vendorMemberPinPattern", ...formNames]) || typeof forms.names !== "string" || forms.names === "") {
+    throw new Error(`edition-contract.json: provenancePins.customerForms must be exactly {names, vendorMemberPinPattern, ${formNames.join(", ")}}`);
+  }
+  assertAnchoredPattern(forms.vendorMemberPinPattern, "provenancePins.customerForms.vendorMemberPinPattern");
+  const channelsOf = { [EditionKind.Resolved]: Object.values(EditionChannel), [EditionKind.Sealed]: [contract.sealOf.channel] };
+  for (const name of formNames) {
+    const form = forms[name];
+    if (!isObject(form) || !sameSet(Object.keys(form), ["pins", "kinds"]) || typeof form.pins !== "string" || form.pins === "" || !isObject(form.kinds)) {
+      throw new Error(`edition-contract.json: provenancePins.customerForms.${name} must be exactly {pins, kinds}`);
+    }
+    for (const [kind, channels] of Object.entries(form.kinds)) {
+      const own = channelsOf[kind];
+      if (own === void 0 || !Array.isArray(channels) || channels.length === 0 || new Set(channels).size !== channels.length || !channels.every((channel) => own.includes(channel))) {
+        throw new Error(`edition-contract.json: provenancePins.customerForms.${name}.kinds.${kind} must be a non-empty set of the channels of a ${kind} edition`);
+      }
+    }
+  }
+  for (const [kind, own] of Object.entries(channelsOf)) {
+    if (!sameSet(forms[CustomerPinForm.Catalogue].kinds[kind], own)) {
+      throw new Error(`edition-contract.json: provenancePins.customerForms.catalogue.kinds.${kind} must name every channel of a ${kind} edition (${own.join(" | ")}): the catalogue form is the default form`);
+    }
+  }
+}
 var SEGMENT = /^[a-z0-9][a-z0-9.-]*$/;
 function parseEditionContract(contract) {
   if (contract === null || typeof contract !== "object" || Array.isArray(contract)) {
@@ -65723,6 +65755,7 @@ function parseEditionContract(contract) {
     throw new Error("edition-contract.json: the channels' namespace segments must differ");
   }
   assertDescriptorVocabulary(contract);
+  assertProvenancePins(contract);
   return contract;
 }
 
@@ -65764,7 +65797,24 @@ var edition_contract_default = {
   },
   provenancePins: {
     catalogue: "the sha256 digest (sha256:<64 hex>) of the offering artifact a customer edition was resolved against",
-    definition: "the sha256 digest (sha256:<64 hex>) of the canonical JSON of the customer definition a customer edition was resolved from (vendor selection, image registry mirror, Store publisher anchors, sources); every other pin is a 40-hex commit"
+    definition: "the sha256 digest (sha256:<64 hex>) of the canonical JSON of the customer definition a customer edition was resolved from (vendor selection, image registry mirror, Store publisher anchors, sources); every other pin is a 40-hex commit",
+    customerForms: {
+      names: "a customer edition is one whose pins carry the definition pin. It records its vendor side in exactly one form, closed per kind and channel: the catalogue form, or the catalogue-free form. Every other edition carries neither form's marker: no catalogue pin. The kinds and channels each form admits are enforced by the writers and this CLI's readers (the descriptor parse); the catalogue-free form being develop only also rests on only the develop resolve identity being able to sign one. The deploy root's admission does not enforce the forms: it re-vendors this contract and reads neither provenancePins nor the forms",
+      catalogue: {
+        pins: "the catalogue pin, the definition pin, and a sources/<name> commit per source the definition declares; nothing else. The distribution lock names the catalogue artifact by catalogueDigest, never by catalogueContentDigest",
+        kinds: {
+          resolved: ["develop", "release"],
+          sealed: ["release"]
+        }
+      },
+      "catalogue-free": {
+        pins: 'no catalogue pin: the vendor side was resolved from the vendor members in the same call, so the edition records the vendor member pins (keys matching vendorMemberPinPattern, at least one) as 40-hex commits, beside the definition pin, the "definition-repository" commit (the commit of the customer definition repository the definition was read at), the sources/<name> commits and the other 40-hex pins of the resolve. The catalogue the vendor step wrote is named in the distribution lock only, by catalogueContentDigest (sha256 of its exact catalogue.json bytes, kernel edition protocol v37), never by catalogueDigest: no catalogue artifact exists',
+        kinds: {
+          resolved: ["develop"]
+        }
+      },
+      vendorMemberPinPattern: "^(?:repos|submodules)/[a-z0-9][a-z0-9-]*$"
+    }
   },
   imageNamespaceSegment: "dev",
   evidenceTrust: {
@@ -65841,7 +65891,15 @@ var DEFINITION_PIN_KEY = "definition";
 if (!(DEFINITION_PIN_KEY in EDITION_CONTRACT.provenancePins)) {
   throw new Error("edition-contract.json provenancePins does not declare the definition pin");
 }
+var DEFINITION_REPOSITORY_PIN_KEY = "definition-repository";
+if (!EDITION_CONTRACT.provenancePins.customerForms["catalogue-free"].pins.includes(`"${DEFINITION_REPOSITORY_PIN_KEY}"`)) {
+  throw new Error(`edition-contract.json provenancePins.customerForms["catalogue-free"].pins does not name the "${DEFINITION_REPOSITORY_PIN_KEY}" pin`);
+}
 var DIGEST_PIN_KEYS = Object.freeze([CATALOGUE_PIN_KEY, DEFINITION_PIN_KEY]);
+var VENDOR_MEMBER_PIN_PATTERN = new RegExp(EDITION_CONTRACT.provenancePins.customerForms.vendorMemberPinPattern);
+function customerPinFormAdmitted(form, kind, channel) {
+  return EDITION_CONTRACT.provenancePins.customerForms[form].kinds[kind]?.includes(channel) === true;
+}
 var EditionLockFile = Object.freeze({
   Distribution: "distribution.lock.json",
   Images: "images.lock.json",
@@ -66964,6 +67022,10 @@ var SnapshotPinNamespace = Object.freeze({
   EditionsRoot: "editions-root",
   Source: "source"
 });
+var SOURCE_PIN_PREFIX = "sources/";
+function isSourcePinKey(key) {
+  return key.startsWith(SOURCE_PIN_PREFIX) && key.length > SOURCE_PIN_PREFIX.length;
+}
 var PUBLISHED_PIN_SOURCE = Object.freeze({ kind: PinSourceKind.Published });
 
 // edition/edition-artifact.mjs
@@ -66996,6 +67058,32 @@ var exactKeys = (value, keys, where) => {
     throw new Error(`${where} must be exactly {${keys.join(", ")}}`);
   }
 };
+function assertCustomerPinForm(kind, channel, pins, distributionId) {
+  if (!(DEFINITION_PIN_KEY in pins)) {
+    if (CATALOGUE_PIN_KEY in pins) {
+      throw new Error(`${EDITION_DESCRIPTOR_FILE}: the ${kind} ${channel} edition "${distributionId}" carries the catalogue pin without the definition pin: only a customer edition (the definition pin) records the catalogue it was resolved against`);
+    }
+    return;
+  }
+  const where = `${EDITION_DESCRIPTOR_FILE}: the customer ${kind} ${channel} edition "${distributionId}"`;
+  if (CATALOGUE_PIN_KEY in pins) {
+    if (!customerPinFormAdmitted(CustomerPinForm.Catalogue, kind, channel)) {
+      throw new Error(`${where} carries the catalogue pin, but the contract admits the catalogue form on no ${kind} ${channel} edition`);
+    }
+    const stray = Object.keys(pins).filter((key) => key !== CATALOGUE_PIN_KEY && key !== DEFINITION_PIN_KEY && !isSourcePinKey(key));
+    if (stray.length > 0) {
+      throw new Error(`${where} carries the catalogue pin and also ${stray.map((key) => JSON.stringify(key)).join(", ")}: the catalogue form pins only the catalogue, the definition and sources/<name>`);
+    }
+    return;
+  }
+  if (!customerPinFormAdmitted(CustomerPinForm.CatalogueFree, kind, channel)) {
+    throw new Error(`${where} carries no catalogue pin: only a ${catalogueFreeAdmissions()} customer edition may be resolved catalogue-free`);
+  }
+  if (!Object.keys(pins).some((key) => VENDOR_MEMBER_PIN_PATTERN.test(key))) {
+    throw new Error(`${where} carries neither the catalogue pin nor a vendor member pin: a catalogue-free edition records the vendor member pins it was resolved from`);
+  }
+}
+var catalogueFreeAdmissions = () => Object.values(EditionKind).flatMap((kind) => Object.values(EditionChannel).filter((channel) => customerPinFormAdmitted(CustomerPinForm.CatalogueFree, kind, channel)).map((channel) => `${kind} ${channel}`)).join(" or ");
 function parseEditionDescriptor(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     throw new Error(`${EDITION_DESCRIPTOR_FILE} must be a JSON object`);
@@ -67034,6 +67122,7 @@ function parseEditionDescriptor(value) {
       );
     }
   }
+  assertCustomerPinForm(value.kind, value.provenance.channel, pins, value.distributionId);
   exactKeys(workflow, ["repository", "runId"], `${EDITION_DESCRIPTOR_FILE} provenance.workflow`);
   if (!workflow.repository || !workflow.runId || typeof workflow.repository !== "string" || typeof workflow.runId !== "string") {
     throw new Error(`${EDITION_DESCRIPTOR_FILE}: provenance.workflow is {repository, runId}, both non-empty strings`);

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "artifactSha256": "sha256:da9d5bed0e7286a885aa8475ed43c7d008c6e571241607a3d42ca8abdab46dbf",
+  "artifactSha256": "sha256:be45731ef072c0271f8e380afa35360a9e956f271135c4d19393807552ffd495",
   "esbuild": {
     "version": "0.28.2"
   },
@@ -2599,355 +2599,355 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:815c9be9f71731dcc805d85da2d733350ddb6fbdf32b6f1cf34f228ce6381c7c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/canonical-evidence-json.mjs",
       "sha256": "sha256:3b32f6786c9fb1c0deadf2f687077356a503b0db766392d2e0254aa1ab78feec"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/canonical-repository-url.mjs",
       "sha256": "sha256:f36e4f7cbe7849789422ec2f0ebce2d62f7dc3684afecc3ac51a32560e72d8a1"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/collected-refusals.mjs",
       "sha256": "sha256:ae21c069dbff0afa9aca18b7b909d5de405df2277f6431bc3fda20528115bcd1"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/cosign-certificate-constraints.mjs",
       "sha256": "sha256:bb9ba7038f1de9211c9cbcf99f02255f3623ce72d86c71fdcfa146a4e0edbd9a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/develop-graph.mjs",
       "sha256": "sha256:decebd437c9f4c8bdd6bee3baabfdc340fd7b9d175aca7e702cb330e912708d5"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/dispatched-runtime-components.mjs",
       "sha256": "sha256:9712823d183a60108cd002b2d36a9e5c0867b9d576dd02825264a18f7b8ece69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/edition-artifact.mjs",
-      "sha256": "sha256:3b588c9c50f64f3e7a45b954fe7b5fc67e11fc8ce3e7b323727af4541d29ae7f"
+      "sha256": "sha256:937f9e2fd289fc704bf7b2115e0567a22ed70ba4dd3c0f9fd86e71143a894dfa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:f9f16b58279c8c2619a39c5cc92bdbc334543d1a324304cd5d3b120d66dc8f3a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:58af55e9a2b36ca23485246d44a295260afa240bcdc0649c697563b36085ddaa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/edition-constants.mjs",
-      "sha256": "sha256:217fa5b1fa25cb50ee4e1b46ea5e086061ff1f44e00198e1dc28f52376f236a0"
+      "sha256": "sha256:c86da7209e072b85128dc4b84f3bc78dac5d5390eaa26365e8af794699aa0c70"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/edition-contract-parse.mjs",
-      "sha256": "sha256:e2c6e66378f878499f44b62d060ae50197f40757b2044d9ce05290e367dfe21d"
+      "sha256": "sha256:68b5a47cdfac33419546c8955f7753fafbd15c8f3207cb084002e65feb75d66c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/edition-contract.json",
-      "sha256": "sha256:566a17301ad15b94a06fef12b26bbe39e292ed2bf30a2659a9bf07ce5ce487e0"
+      "sha256": "sha256:578913058d4341bb1ae197b45c52b2a0eb8c59980464973c45233d4062b2c7a6"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/edition-kind.mjs",
       "sha256": "sha256:b4f3358ffa81bbafb8c37d158b9e01032a7358c38b9d6e5aca409091f989e47a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:f02ea6427e2fd7ceea2c3cb49f3fa6d85b982870e487082a7466f8037cd2bed9"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/edition-publisher.mjs",
       "sha256": "sha256:8803b41067d81acbc35a8974426f606b5b8168b7a9c2581c16586a86f36db50f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b141474fff33b06734fb62cd2552752b991c8267bb1c9bccb22a81dd80e91c6c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:892b360f9f80d2308b0b12f9b99658ae06173878d9b71cf5d6fc8bd717b3c86e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4bea69437af5a36c139b5b41d0ecf2d1ddcf3f871e10c78e3d351f608eedca3b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:eb46e4d6a79dfac5536b7a439ab9df7dd4b03af369bdcfa9fcdd522aa1aab8dd"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/first-party-source-ids.mjs",
       "sha256": "sha256:20cb1ad7cfb8c6e6686a6be5a51289da4bba76c20b58d9c1b5b6b3813a38dc1c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/fulcio-certificate-extensions.mjs",
       "sha256": "sha256:6f1f5a8ea110a489f7aff4bfb8e0b2d058919fe3e8ba4a1e5e8396fca24861b7"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/git-json.mjs",
       "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/git-source-auth.mjs",
       "sha256": "sha256:c1b32aa6f7d59798db58238d632cafeadbd4f07376396a31acdeb5f0ac56dcac"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/image-evidence.mjs",
-      "sha256": "sha256:c6a202f3fc8efe97f00c7e69532c656646bdc5c93365d68676046c3aabd33233"
+      "sha256": "sha256:9258d05e03d797cb1fbed8651b9738990ebf106a142a5bd633a98ef4a1136aad"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/image-subject-identity.mjs",
       "sha256": "sha256:6a64e44f9865f68484540e3264a1d87040ae021dfa6ee4b79239e66805754ac1"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:9de2645dca22274cad9fa68d0364bf57e4de704e9d49a8bbadde0e322ae317df"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/kernel-contract-source-path-set.mjs",
       "sha256": "sha256:bc4756f217d80fd8f802932f47da71ab14e782873fa9fa977002a94e058d8a9e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/kernel-package.mjs",
       "sha256": "sha256:e97a9491991d8332a4feed14ac48fe393e44d12c63bdfec89fac8b5b4ea2a574"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/lib.mjs",
       "sha256": "sha256:f98c9eb6c50dbaf6c89c5fa9d42f682042265a2d41687a9d2b35f16c0b139326"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:d3b6807953f162ab4204dcd1a0f752e0f9b447726fc17a12534d28abe8e570b0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/pin-source.mjs",
-      "sha256": "sha256:32fa918729a83587b4d3bca6e5fe381f5a525397ebc49d52729ec1f8cf216c37"
+      "sha256": "sha256:0b2bc0de8e2fb2a39a3604434d2eb35a7470562c9363bc631511cec809e3ec13"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/sigstore-bundle-media-type.mjs",
       "sha256": "sha256:e0aa5a3992f0385ddbbe69eb0307d642ac428ef516c8394816ac4fd52e0ac39c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:9c351f60e8ea838f445f89c3709c60b7f13b021b78d6e40eaef91350a793f0ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/third-party-admission.mjs",
       "sha256": "sha256:7e32f631a8948e2b93a5cfa163390d52d2a8d9ade87a637c7fe1fc6351fe5974"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/third-party-certificate-extensions.mjs",
       "sha256": "sha256:3293267b09452199f605001d8c14070d1c822b77390caee4088e17b059b7b05d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/third-party-source-pins.mjs",
       "sha256": "sha256:6f12feb9061bd4ea3e5aeab3f369c081ab58da335c0d281e21b250251e1c0dd9"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/trust-policy-arming.mjs",
       "sha256": "sha256:f6ed96ee1d0b7698b1eea5066ba10abef1babeede8403a7c481bba53636cb1a5"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/trust-policy-image-ownership.mjs",
       "sha256": "sha256:be0c787c6a75124f0143fc0ce3b127a94e3bb7f6aa64e282c91dd84e566e550e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/verify-catalogue-evidence.mjs",
       "sha256": "sha256:156d0ee39210658ec489609629c5b9cddd3ce5b3938d8980dcf8282ae4be60bb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:958360f7889985c48abb048852c5bbba349cd7353ce4b532c4511b4902380fac"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:1d2aff08bcd9e94b644c85c5b55c90c05b6b02bab662731fe3fcd53fcdf86e93"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.58.0",
+      "version": "0.59.0",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },