@xemahq/xema 0.59.0 → 0.59.1

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -2599,355 +2599,355 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:815c9be9f71731dcc805d85da2d733350ddb6fbdf32b6f1cf34f228ce6381c7c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/canonical-evidence-json.mjs",
       "sha256": "sha256:3b32f6786c9fb1c0deadf2f687077356a503b0db766392d2e0254aa1ab78feec"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/canonical-repository-url.mjs",
       "sha256": "sha256:f36e4f7cbe7849789422ec2f0ebce2d62f7dc3684afecc3ac51a32560e72d8a1"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/collected-refusals.mjs",
       "sha256": "sha256:ae21c069dbff0afa9aca18b7b909d5de405df2277f6431bc3fda20528115bcd1"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/cosign-certificate-constraints.mjs",
       "sha256": "sha256:bb9ba7038f1de9211c9cbcf99f02255f3623ce72d86c71fdcfa146a4e0edbd9a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/develop-graph.mjs",
       "sha256": "sha256:decebd437c9f4c8bdd6bee3baabfdc340fd7b9d175aca7e702cb330e912708d5"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/dispatched-runtime-components.mjs",
       "sha256": "sha256:9712823d183a60108cd002b2d36a9e5c0867b9d576dd02825264a18f7b8ece69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:937f9e2fd289fc704bf7b2115e0567a22ed70ba4dd3c0f9fd86e71143a894dfa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:f9f16b58279c8c2619a39c5cc92bdbc334543d1a324304cd5d3b120d66dc8f3a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:58af55e9a2b36ca23485246d44a295260afa240bcdc0649c697563b36085ddaa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:c86da7209e072b85128dc4b84f3bc78dac5d5390eaa26365e8af794699aa0c70"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:68b5a47cdfac33419546c8955f7753fafbd15c8f3207cb084002e65feb75d66c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:578913058d4341bb1ae197b45c52b2a0eb8c59980464973c45233d4062b2c7a6"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/edition-kind.mjs",
       "sha256": "sha256:b4f3358ffa81bbafb8c37d158b9e01032a7358c38b9d6e5aca409091f989e47a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:f02ea6427e2fd7ceea2c3cb49f3fa6d85b982870e487082a7466f8037cd2bed9"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/edition-publisher.mjs",
       "sha256": "sha256:8803b41067d81acbc35a8974426f606b5b8168b7a9c2581c16586a86f36db50f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b141474fff33b06734fb62cd2552752b991c8267bb1c9bccb22a81dd80e91c6c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:892b360f9f80d2308b0b12f9b99658ae06173878d9b71cf5d6fc8bd717b3c86e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4bea69437af5a36c139b5b41d0ecf2d1ddcf3f871e10c78e3d351f608eedca3b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:eb46e4d6a79dfac5536b7a439ab9df7dd4b03af369bdcfa9fcdd522aa1aab8dd"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/first-party-source-ids.mjs",
       "sha256": "sha256:20cb1ad7cfb8c6e6686a6be5a51289da4bba76c20b58d9c1b5b6b3813a38dc1c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/fulcio-certificate-extensions.mjs",
       "sha256": "sha256:6f1f5a8ea110a489f7aff4bfb8e0b2d058919fe3e8ba4a1e5e8396fca24861b7"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/git-json.mjs",
       "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/git-source-auth.mjs",
       "sha256": "sha256:c1b32aa6f7d59798db58238d632cafeadbd4f07376396a31acdeb5f0ac56dcac"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:9258d05e03d797cb1fbed8651b9738990ebf106a142a5bd633a98ef4a1136aad"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/image-subject-identity.mjs",
       "sha256": "sha256:6a64e44f9865f68484540e3264a1d87040ae021dfa6ee4b79239e66805754ac1"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:9de2645dca22274cad9fa68d0364bf57e4de704e9d49a8bbadde0e322ae317df"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/kernel-contract-source-path-set.mjs",
       "sha256": "sha256:bc4756f217d80fd8f802932f47da71ab14e782873fa9fa977002a94e058d8a9e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/kernel-package.mjs",
       "sha256": "sha256:e97a9491991d8332a4feed14ac48fe393e44d12c63bdfec89fac8b5b4ea2a574"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/lib.mjs",
       "sha256": "sha256:f98c9eb6c50dbaf6c89c5fa9d42f682042265a2d41687a9d2b35f16c0b139326"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:d3b6807953f162ab4204dcd1a0f752e0f9b447726fc17a12534d28abe8e570b0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:0b2bc0de8e2fb2a39a3604434d2eb35a7470562c9363bc631511cec809e3ec13"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/sigstore-bundle-media-type.mjs",
       "sha256": "sha256:e0aa5a3992f0385ddbbe69eb0307d642ac428ef516c8394816ac4fd52e0ac39c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:9c351f60e8ea838f445f89c3709c60b7f13b021b78d6e40eaef91350a793f0ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/third-party-admission.mjs",
       "sha256": "sha256:7e32f631a8948e2b93a5cfa163390d52d2a8d9ade87a637c7fe1fc6351fe5974"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/third-party-certificate-extensions.mjs",
       "sha256": "sha256:3293267b09452199f605001d8c14070d1c822b77390caee4088e17b059b7b05d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/third-party-source-pins.mjs",
       "sha256": "sha256:6f12feb9061bd4ea3e5aeab3f369c081ab58da335c0d281e21b250251e1c0dd9"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/trust-policy-arming.mjs",
       "sha256": "sha256:f6ed96ee1d0b7698b1eea5066ba10abef1babeede8403a7c481bba53636cb1a5"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/trust-policy-image-ownership.mjs",
       "sha256": "sha256:be0c787c6a75124f0143fc0ce3b127a94e3bb7f6aa64e282c91dd84e566e550e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/verify-catalogue-evidence.mjs",
       "sha256": "sha256:156d0ee39210658ec489609629c5b9cddd3ce5b3938d8980dcf8282ae4be60bb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:958360f7889985c48abb048852c5bbba349cd7353ce4b532c4511b4902380fac"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:1d2aff08bcd9e94b644c85c5b55c90c05b6b02bab662731fe3fcd53fcdf86e93"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.59.0",
+      "version": "0.59.1",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/edition/assemble-producer-input.mjs

@@ -475,6 +475,9 @@ export async function deriveSubjectSourceIdentity({
   // The kernel's `RuntimeImageSubjectKind.ComposedProcess`, passed in for the
   // reason `platformSubjectKind` is. Undefined: no subject is a composed one.
   composedProcessSubjectKind = undefined,
+  // The kernel's `DEFAULT_COMPOSED_IMAGE_CLASS`: the class directory a
+  // composed-process image is declared in. Required with `composedProcessSubjectKind`.
+  defaultComposedImageClass = undefined,
   declaration,
 }) {
   const { kind, id, repo, path, sourceCommit } = declaration;
@@ -524,13 +527,18 @@ export async function deriveSubjectSourceIdentity({
     };
   } else if (composedProcessSubjectKind !== undefined && kind === composedProcessSubjectKind) {
     // The composed-process image of one build: a Dockerfile-only image at the
-    // repository's `infra/composed-process/`, whose declaration is its
-    // `image-build-inputs.json` — exactly the shape resolve-images.mjs names
-    // in the lock (`readComposedProcessDeclarations`).
-    if (path !== `${repo}/${COMPOSED_PROCESS_IMAGE_PATH}`) {
+    // repository's `infra/composed-process/<default class>/` (or, at a commit
+    // that predates the per-class layout, the legacy `infra/composed-process/`),
+    // whose declaration is its `image-build-inputs.json` — exactly the shape
+    // resolve-images.mjs names in the lock (`readComposedProcessDeclarations`).
+    const composedPaths = [
+      `${repo}/${COMPOSED_PROCESS_IMAGE_PATH}/${defaultComposedImageClass}`,
+      `${repo}/${COMPOSED_PROCESS_IMAGE_PATH}`,
+    ];
+    if (!composedPaths.includes(path)) {
       throw new Error(
         `subject ${kind}:${id} declares source path "${path}", but a composed-process ` +
-          `image is built from "${repo}/${COMPOSED_PROCESS_IMAGE_PATH}"`,
+          `image is built from "${composedPaths.join('" or "')}"`,
       );
     }
     const expectedId = composedProcessSubjectId(firstPartySourceId(repo));
@@ -539,7 +547,7 @@ export async function deriveSubjectSourceIdentity({
         `subject ${kind}:${id} is not the composed-process subject of "${repo}" ("${expectedId}")`,
       );
     }
-    manifestRepoRelativePath = `${COMPOSED_PROCESS_IMAGE_PATH}/${COMPOSED_PROCESS_DECLARATION_FILE}`;
+    manifestRepoRelativePath = `${path.slice(repo.length + 1)}/${COMPOSED_PROCESS_DECLARATION_FILE}`;
     subjectForServicePath = {
       ...subjectForServicePath,
       sourceManifestPath: manifestRepoRelativePath,
@@ -1177,6 +1185,7 @@ export async function assembleProducerInput({
       ),
     platformSubjectKind: schemas.RuntimeImageSubjectKind.Platform,
     composedProcessSubjectKind: schemas.RuntimeImageSubjectKind.ComposedProcess,
+    defaultComposedImageClass: schemas.DEFAULT_COMPOSED_IMAGE_CLASS,
     declaration: {
       kind: subjectKind,
       id: subjectId,

package/edition/resolve-images.mjs

@@ -947,16 +947,24 @@ export function structureSubjects(structure) {
  * entrypoint, owned by the biomes whose services it carries. Neither the kernel
  * nor the SDK fixes WHERE a repository builds it, so this plane does, once:
  *
- *   - the image directory is `infra/composed-process/` at the repository root,
- *     holding its own `Dockerfile` and an `image-build-inputs.json` whose
+ *   - the image directory is the per-class directory
+ *     `infra/composed-process/<class>/` at the repository root (`<class>` a
+ *     kernel `ComposedImageClass`; an edition addresses one composed subject
+ *     per repository, of the kernel's `DEFAULT_COMPOSED_IMAGE_CLASS`). A commit
+ *     that predates the per-class layout declares it at the legacy root
+ *     `infra/composed-process/`, which stays readable because committed release
+ *     locks still pin such commits. Both at once, or a declaration in another
+ *     class directory, is refused (`composedProcessDeclarationDir`). The
+ *     directory holds its own `Dockerfile` and an `image-build-inputs.json` whose
  *     `workspacePackages` lists every member service's workspace package
  *     directory — the Dockerfile-only image shape `hashImageBuildInputs`
  *     already reads (`opencode-worker` is the other one). Its tag is therefore
  *     an ordinary `xema-image-input-sha256-v2` key, computed by the one
  *     implementation every producer uses, with `SERVICE` = the subject id and
  *     `SERVICE_PATH` = this directory;
- *   - the DECLARATION is that `image-build-inputs.json` existing at the pinned
- *     commit. A repository that declares none has no composed image, and an
+ *   - the DECLARATION is that `image-build-inputs.json` existing in that
+ *     directory at the pinned commit. A repository that declares none (and has
+ *     no `infra/composed-process/` tree at all) has no composed image, and an
  *     edition carries no composed subject for it — which the deploy plane
  *     reports as "the producer builds no composed-process image at that
  *     commit". That is an honest absence, not a skipped subject: a DECLARED
@@ -1045,8 +1053,8 @@ function declaredImageClass(declared, subject, enums) {
   return parsed.data;
 }
 
-function composedProcessCarriage(structure, enums, repo, sourceCommit, locate) {
-  const inputsPath = `${COMPOSED_PROCESS_IMAGE_PATH}/${COMPOSED_PROCESS_DECLARATION_FILE}`;
+function composedProcessCarriage(structure, enums, repo, sourceCommit, locate, declarationDir) {
+  const inputsPath = `${declarationDir}/${COMPOSED_PROCESS_DECLARATION_FILE}`;
   const { dir } = locate(repo);
   let members;
   try {
@@ -1098,6 +1106,60 @@ function composedProcessCarriage(structure, enums, repo, sourceCommit, locate) {
     .sort((a, b) => compareStrings(a.biomeId, b.biomeId));
 }
 
+function gitPathExistsAtCommit(dir, sourceCommit, repoPath) {
+  try {
+    execFileSync('git', ['-C', dir, 'cat-file', '-e', `${sourceCommit}:${repoPath}`], {
+      stdio: ['ignore', 'ignore', 'ignore'],
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The repo-relative directory holding a repository's composed-process
+ * DECLARATION at one commit, or null when it declares none. The default class's
+ * directory and the legacy root are the two places an edition reads; a
+ * declaration it cannot address (both present, another class, an
+ * `infra/composed-process/` tree without a recognised one) is refused, because
+ * a declaration the resolver cannot find must never read as "declares nothing".
+ */
+function composedProcessDeclarationDir(dir, sourceCommit, enums) {
+  const defaultClass = enums.DEFAULT_COMPOSED_IMAGE_CLASS;
+  const classDir = `${COMPOSED_PROCESS_IMAGE_PATH}/${defaultClass}`;
+  const declares = (candidate) =>
+    gitPathExistsAtCommit(dir, sourceCommit, `${candidate}/${COMPOSED_PROCESS_DECLARATION_FILE}`);
+  const inClassDir = declares(classDir);
+  const atLegacyRoot = declares(COMPOSED_PROCESS_IMAGE_PATH);
+  if (inClassDir && atLegacyRoot) {
+    throw new ComposedProcessInputsError(
+      `ambiguous composed-process declaration at ${sourceCommit}: both "${classDir}/${COMPOSED_PROCESS_DECLARATION_FILE}" ` +
+        `and the legacy "${COMPOSED_PROCESS_IMAGE_PATH}/${COMPOSED_PROCESS_DECLARATION_FILE}" exist`,
+    );
+  }
+  const otherClasses = enums.ComposedImageClassSchema.options
+    .filter((candidate) => candidate !== defaultClass)
+    .filter((candidate) => declares(`${COMPOSED_PROCESS_IMAGE_PATH}/${candidate}`));
+  if (otherClasses.length > 0) {
+    throw new ComposedProcessInputsError(
+      `composed-process declaration at ${sourceCommit} is in the "${otherClasses.join('", "')}" class ` +
+        `director${otherClasses.length > 1 ? 'ies' : 'y'}, but an edition addresses one composed-process subject per ` +
+        `repository, of the default class "${defaultClass}"; a "${otherClasses[0]}" image has no subject naming yet`,
+    );
+  }
+  if (inClassDir) {return classDir;}
+  if (atLegacyRoot) {return COMPOSED_PROCESS_IMAGE_PATH;}
+  if (gitPathExistsAtCommit(dir, sourceCommit, COMPOSED_PROCESS_IMAGE_PATH)) {
+    throw new ComposedProcessInputsError(
+      `"${COMPOSED_PROCESS_IMAGE_PATH}" exists at ${sourceCommit} but declares no composed-process image the edition can ` +
+        `read: looked at "${classDir}/${COMPOSED_PROCESS_DECLARATION_FILE}" and ` +
+        `"${COMPOSED_PROCESS_IMAGE_PATH}/${COMPOSED_PROCESS_DECLARATION_FILE}"`,
+    );
+  }
+  return null;
+}
+
 /**
  * Read each repository's composed-process DECLARATION at the commit the
  * edition builds its services from. Only repositories that contribute a
@@ -1119,7 +1181,6 @@ export function readComposedProcessDeclarations(
   const declarations = [];
   for (const [repo, sourceCommit] of [...commits].sort(([a], [b]) => compareStrings(a, b))) {
     const { dir, base } = locate(repo);
-    const declarationPath = `${COMPOSED_PROCESS_IMAGE_PATH}/${COMPOSED_PROCESS_DECLARATION_FILE}`;
     // ABSENCE IS ONLY AN ANSWER ABOUT A COMMIT THAT WAS READ. A repository
     // missing from this layout, or one lacking the pinned commit, would
     // otherwise read as "declares nothing", and `dist-check` would grade a lock
@@ -1135,21 +1196,17 @@ export function readComposedProcessDeclarations(
           'before resolving',
       );
     }
-    try {
-      execFileSync('git', ['-C', dir, 'cat-file', '-e', `${sourceCommit}:${declarationPath}`], {
-        stdio: ['ignore', 'ignore', 'ignore'],
-      });
-    } catch {
-      continue; // declares no composed-process image at this commit
-    }
+    const declarationDir = composedProcessDeclarationDir(dir, sourceCommit, enums);
+    if (declarationDir === null) {continue;} // declares no composed-process image at this commit
+    const declarationPath = `${declarationDir}/${COMPOSED_PROCESS_DECLARATION_FILE}`;
     const sourceId = sourceIds.get(repo);
     const repoRelative = relative(base, dir).split(sep).join('/');
     declarations.push({
       repo,
       sourceId,
       sourceCommit,
-      carriage: composedProcessCarriage(structure, enums, repo, sourceCommit, locate),
-      path: `${repoRelative}/${COMPOSED_PROCESS_IMAGE_PATH}`,
+      carriage: composedProcessCarriage(structure, enums, repo, sourceCommit, locate, declarationDir),
+      path: `${repoRelative}/${declarationDir}`,
       sourceManifestPath: `${repoRelative}/${declarationPath}`,
       sourceManifestHash: exactSourceManifestHash(dir, declarationPath, sourceCommit),
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.59.0",
+  "version": "0.59.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -100,7 +100,7 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:bdd50b327d2da70bdc17c4cdcfce8ed38500fbd68aea8f23029c53d45ddbcb86",
-    "sha": "9e648fd62243cb0fc9df74680ce6c2a110a901ad"
+    "sourceDigest": "sha256:f02866c7d95e9f1f32bbbf2879720aa6c6a4ff30ea4c7ac306047775483f31bd",
+    "sha": "36535b2452d6413f38a32eafc2544ba463c41f62"
   }
 }