@xemahq/xema 0.59.0 → 0.60.1

package/edition/edition-protocol.mjs

@@ -1,277 +0,0 @@
-// The edition protocol this library speaks, and the check that a kernel speaks
-// it too.
-//
-// The kernel (`@xemahq/contracts/edition-protocol`) exports the identity of the
-// code this library executes as DATA: `{contentDigest, provisional, version}` in
-// `dist/edition-protocol/edition-protocol.json`, and the edition contract in
-// `dist/edition-protocol/edition-contract.schema.json` (the identity, the
-// hashing convention, the entry subpaths this library may load, and every
-// kernel source file those subpaths load at runtime). `contentDigest` is the
-// kernel contract authority digest over the exact bytes of those files.
-//
-// The digest is a CONSERVATIVE, deterministic stand-in for protocol semantics.
-// Any change to accepted or refused edition semantics MUST change it; a
-// behaviour-preserving refactor MAY change it too, and the cost is a repin,
-// which is accepted. Semantic equivalence isn't computable, so it is never
-// detected.
-//
-// This library declares the versions it supports, each pinned to one digest,
-// and vendors a copy of each supported contract (`vendored/`, held to its pin
-// by `edition-protocol.test.mjs`). A kernel is accepted only when its identity
-// names a supported version, its digest is the one this library pins for that
-// version, and its contract file states that same identity. Nothing else about
-// the kernel is compared: a kernel change outside the protocol's source closure
-// needs no CLI release; a change inside it needs the CLI to add support.
-// Checking a kernel reads two files and executes nothing from it.
-
-import { realpathSync } from 'node:fs';
-
-import { RefusalError } from './collected-refusals.mjs';
-import { readBoundedNoFollowFile } from './no-follow-file.mjs';
-
-/** The edition protocols this library interprets: version -> content digest. A protocol is listed only
- * while every kernel published under it exports what this library imports (`kernel-export-coverage.test.mjs`).
- * Only v45 is listed (contracts 0.119.0: image-lock v5, build record `members`, and an idempotent
- * `carryForwardComposedArtifacts`). A v44 kernel's carry-forward bumps the generation on every call, so dist-check could never
- * be green on its seals; v43 cannot carry build record members; v42 and older lack `DEFAULT_COMPOSED_IMAGE_CLASS` and
- * `dedicatedServiceImageSubjects`. No legacy row is kept. */
-export const SUPPORTED_EDITION_PROTOCOLS = Object.freeze([
-  Object.freeze({ version: 45, contentDigest: '54eb2f7d40e966e6efd5bc2ef0f4751b1121786300f4c50066e8add10c3ecb6a' }),
-]);
-
-/** Where a kernel package publishes its identity and its contract, package-relative. */
-export const KERNEL_EDITION_PROTOCOL_FILE = 'dist/edition-protocol/edition-protocol.json';
-export const KERNEL_EDITION_CONTRACT_FILE = 'dist/edition-protocol/edition-contract.schema.json';
-
-/** This package's vendored copy of a supported contract, package-relative. */
-export const vendoredEditionContractFile = (version) =>
-  `edition/vendored/edition-contract-v${version}.schema.json`;
-
-const MAX_IDENTITY_BYTES = 4 * 1024;
-const MAX_CONTRACT_BYTES = 8 * 1024 * 1024;
-const SHA256_HEX = /^[a-f0-9]{64}$/;
-
-/** Why a kernel's edition protocol was refused. A closed set. */
-export const EditionProtocolMismatchReason = Object.freeze({
-  /** The kernel publishes no edition protocol identity. */
-  Undeclared: 'undeclared',
-  /** The identity file is not exactly `{contentDigest, provisional, version}`. */
-  Malformed: 'malformed',
-  /** The identity states `provisional: true`: a branch-local working identity, never pinned. */
-  Provisional: 'provisional',
-  /** This library supports no protocol of that version. */
-  UnsupportedVersion: 'unsupported-version',
-  /** The version is supported, but pinned to a different digest. */
-  DigestMismatch: 'digest-mismatch',
-  /** The kernel's contract file does not state its own identity. */
-  ContractMismatch: 'contract-mismatch',
-  /** The kernel's protocol is not the one compiled into the running verifier. */
-  BundleMismatch: 'bundle-mismatch',
-  /** No commit on the kernel checkout's first-parent history declares a protocol this library supports. */
-  NoSupportedCommit: 'no-supported-commit',
-  /** A kernel commit's protocol declaration source exists but does not parse; refused, never skipped. */
-  Unparseable: 'unparseable',
-  /** An explicit kernel commit is not on the first-parent history of the checkout's develop head. */
-  NotOnDevelop: 'not-on-develop',
-});
-
-export class EditionProtocolMismatchError extends RefusalError {
-  constructor(reason, message) {
-    super(message);
-    this.name = 'EditionProtocolMismatchError';
-    this.reason = reason;
-  }
-}
-
-const describe = ({ version, contentDigest }) => `edition protocol v${version} (${contentDigest})`;
-
-/** `v<N>, v<M>`: the versions this library supports, as every refusal names them. */
-export const supportedList = () =>
-  SUPPORTED_EDITION_PROTOCOLS.map((protocol) => `v${protocol.version}`).join(', ');
-
-/** Refuse an identity that states `provisional: true`; nothing provisional is ever read as a protocol. */
-function assertFinalIdentity(identity, label) {
-  if (identity.provisional !== false) {
-    throw new EditionProtocolMismatchError(
-      EditionProtocolMismatchReason.Provisional,
-      `${label} declares ${describe(identity)} as provisional (a branch-local working identity); a provisional edition protocol is never pinned`,
-    );
-  }
-}
-
-/**
- * Parse identity bytes strictly: exactly `{contentDigest, provisional, version}`, a positive integer version, a
- * lowercase SHA-256 hex digest and a boolean `provisional`. An identity stating `provisional: true` is refused.
- */
-export function parseEditionProtocolIdentity(bytes, label) {
-  let identity;
-  try {
-    identity = JSON.parse(bytes.toString('utf8'));
-  } catch (error) {
-    throw new EditionProtocolMismatchError(
-      EditionProtocolMismatchReason.Malformed,
-      `${label} is not JSON: ${error.message}`,
-    );
-  }
-  if (
-    identity === null ||
-    typeof identity !== 'object' ||
-    Array.isArray(identity) ||
-    Object.keys(identity).sort().join() !== 'contentDigest,provisional,version' ||
-    typeof identity.provisional !== 'boolean' ||
-    !Number.isSafeInteger(identity.version) ||
-    identity.version < 1 ||
-    typeof identity.contentDigest !== 'string' ||
-    !SHA256_HEX.test(identity.contentDigest)
-  ) {
-    throw new EditionProtocolMismatchError(
-      EditionProtocolMismatchReason.Malformed,
-      `${label} must be exactly {"contentDigest":"<64 lowercase hex>","provisional":<boolean>,"version":<positive integer>}`,
-    );
-  }
-  assertFinalIdentity(identity, label);
-  return Object.freeze({
-    contentDigest: identity.contentDigest,
-    provisional: identity.provisional,
-    version: identity.version,
-  });
-}
-
-/** The `{version, contentDigest}` a contract file states, or undefined. */
-function contractIdentity(contractBytes) {
-  let contract;
-  try {
-    contract = JSON.parse(contractBytes.toString('utf8'));
-  } catch {
-    return undefined;
-  }
-  if (
-    contract === null ||
-    typeof contract !== 'object' ||
-    !Number.isSafeInteger(contract.version) ||
-    typeof contract.contentDigest !== 'string'
-  ) {
-    return undefined;
-  }
-  return { version: contract.version, contentDigest: contract.contentDigest };
-}
-
-/**
- * Refuse an identity this library does not support: a provisional one, an
- * unsupported version, or a supported version at another digest. Returns it.
- */
-export function assertSupportedEditionIdentity(identity, source) {
-  assertFinalIdentity(identity, source);
-  const supported = SUPPORTED_EDITION_PROTOCOLS.find(
-    (protocol) => protocol.version === identity.version,
-  );
-  if (supported === undefined) {
-    throw new EditionProtocolMismatchError(
-      EditionProtocolMismatchReason.UnsupportedVersion,
-      `${source} declares ${describe(identity)}; this CLI supports ${supportedList()}. ` +
-        'Use a CLI release that supports it, or pin a kernel that speaks a supported protocol.',
-    );
-  }
-  if (supported.contentDigest !== identity.contentDigest) {
-    throw new EditionProtocolMismatchError(
-      EditionProtocolMismatchReason.DigestMismatch,
-      `${source} declares ${describe(identity)}; this CLI pins v${supported.version} to ` +
-        `${supported.contentDigest} (this CLI supports ${supportedList()}). The kernel changed the edition ` +
-        'contract without a new protocol version.',
-    );
-  }
-  return identity;
-}
-
-/** True when `identity` is final and is a row of the supported table (version and digest). */
-export const isSupportedEditionIdentity = (identity) =>
-  identity?.provisional === false &&
-  SUPPORTED_EDITION_PROTOCOLS.some(
-    (protocol) => protocol.version === identity.version && protocol.contentDigest === identity.contentDigest,
-  );
-
-/**
- * Refuse an identity this library does not support, and a contract file that
- * does not state that identity. Returns the identity.
- */
-export function assertSupportedEditionProtocol({ identity, contractBytes, source }) {
-  assertSupportedEditionIdentity(identity, source);
-  const stated = contractIdentity(contractBytes);
-  if (stated?.version !== identity.version || stated?.contentDigest !== identity.contentDigest) {
-    throw new EditionProtocolMismatchError(
-      EditionProtocolMismatchReason.ContractMismatch,
-      `${source} declares ${describe(identity)}, but its edition contract file states ` +
-        `${stated === undefined ? 'no identity' : describe(stated)}`,
-    );
-  }
-  return identity;
-}
-
-/**
- * Read and check the edition protocol of the built kernel package at
- * `kernelPackageDir`. Reads two files, no-follow and bounded; executes nothing.
- */
-export function readKernelEditionProtocol(kernelPackageDir) {
-  const source = `the kernel at ${kernelPackageDir}`;
-  let identityBytes;
-  try {
-    ({ bytes: identityBytes } = readBoundedNoFollowFile(
-      kernelPackageDir,
-      KERNEL_EDITION_PROTOCOL_FILE,
-      `${source}: ${KERNEL_EDITION_PROTOCOL_FILE}`,
-      MAX_IDENTITY_BYTES,
-    ));
-  } catch (error) {
-    if (error?.code !== 'ENOENT') {throw error;}
-    throw new EditionProtocolMismatchError(
-      EditionProtocolMismatchReason.Undeclared,
-      `${source} publishes no edition protocol (${KERNEL_EDITION_PROTOCOL_FILE} is absent); ` +
-        `this CLI supports ${supportedList()}. Pin a kernel that publishes its edition protocol identity.`,
-    );
-  }
-  const identity = parseEditionProtocolIdentity(
-    identityBytes,
-    `${source}: ${KERNEL_EDITION_PROTOCOL_FILE}`,
-  );
-  const { bytes: contractBytes } = readBoundedNoFollowFile(
-    kernelPackageDir,
-    KERNEL_EDITION_CONTRACT_FILE,
-    `${source}: ${KERNEL_EDITION_CONTRACT_FILE}`,
-    MAX_CONTRACT_BYTES,
-  );
-  return assertSupportedEditionProtocol({ identity, contractBytes, source });
-}
-
-const checkedKernels = new Map();
-
-/**
- * {@link readKernelEditionProtocol}, once per kernel directory. Every loader
- * that executes kernel code calls it first, so no code path interprets a
- * kernel whose protocol this library does not support.
- */
-export function assertKernelEditionProtocol(kernelPackageDir) {
-  const key = realpathSync(kernelPackageDir);
-  let identity = checkedKernels.get(key);
-  if (identity === undefined) {
-    identity = readKernelEditionProtocol(key);
-    checkedKernels.set(key, identity);
-  }
-  return identity;
-}
-
-/**
- * The running verifier interprets evidence with the contracts compiled into
- * it, so the kernel the workspace states must speak exactly that protocol.
- */
-export function assertKernelSpeaksBundledProtocol({ kernelPackageDir, bundled }) {
-  assertFinalIdentity(bundled, 'the edition protocol compiled into this verifier');
-  const stated = readKernelEditionProtocol(kernelPackageDir);
-  if (stated.version !== bundled.version || stated.contentDigest !== bundled.contentDigest) {
-    throw new EditionProtocolMismatchError(
-      EditionProtocolMismatchReason.BundleMismatch,
-      `the kernel at ${kernelPackageDir} declares ${describe(stated)}, but this verifier was built ` +
-        `with ${describe(bundled)}`,
-    );
-  }
-  return stated;
-}

package/edition/edition-publisher.mjs

@@ -1,21 +0,0 @@
-// edition-publisher — the grammar of an edition publisher: the exact GitHub Actions workflow whose keyless
-// signature admits an edition. `{repository, workflow, ref}`, each held to edition-contract.json
-// signers.publishers.shape; its certificate identity is `https://github.com/<repository>/<workflow>@<ref>`
-// (signers.identity), never a wildcard. The issuer is the contract's (edition-constants.mjs); the publisher
-// VALUES are the data root's (edition-workspace.json editionPublishers, edition-config.mjs).
-
-import { EDITION_CONTRACT } from './edition-constants.mjs';
-
-const SHAPE = Object.freeze(Object.fromEntries(Object.entries(EDITION_CONTRACT.signers.publishers.shape).map(([field, source]) => [field, new RegExp(source)])));
-
-/** Hold `publisher` to exactly `{repository, workflow, ref}`, each in the contract's shape; returns it. */
-export function assertPublisher(publisher, where) {
-  const keys = publisher !== null && typeof publisher === 'object' && !Array.isArray(publisher) ? Object.keys(publisher).sort().join() : '';
-  if (keys !== 'ref,repository,workflow' || !Object.entries(SHAPE).every(([field, pattern]) => typeof publisher[field] === 'string' && pattern.test(publisher[field]))) {
-    throw new Error(`${where} must be exactly {repository: <owner>/<name>, workflow: .github/workflows/<file>.yaml, ref: refs/heads/<branch>} (edition-contract.json signers.publishers.shape; got ${JSON.stringify(publisher)})`);
-  }
-  return publisher;
-}
-
-/** The exact keyless certificate identity of a publisher. */
-export const publisherIdentity = ({ repository, workflow, ref }) => `https://github.com/${repository}/${workflow}@${ref}`;

package/edition/edition-seal.mjs

@@ -1,257 +0,0 @@
-#!/usr/bin/env node
-// edition-seal — seal ONE exact resolved edition.
-//
-//   xema edition seal --resolved <registry root>/<channel segment>/xema-edition-<id>@sha256:<64 hex>
-//                     --manifest <file> --artifact <dir> --out <dir>
-//                     --cosign <absolute path> --resolve-workflow-sha <40 hex>
-//                     [--local]
-//                     --data-root <dir> --editions-root <dir> --kernel <dir>
-//
-// FIRST, the seal verifies its input and fails closed: `cosign verify` of --resolved (the manifest digest),
-// through the one pinned-cosign path (pinned-cosign.mjs: the caller's cosign held to the digest the data root's
-// pinned policy names, `--offline` against the policy's pinned trusted root), with every certificate constraint
-// (cosign-certificate-constraints.mjs): the identity of the RESOLVE publisher, the contract's issuer (never
-// overridden), its workflow repository and ref, and --resolve-workflow-sha, the commit the resolve workflow ran
-// at (it only narrows the constraint: a wrong value fails the verify). The publisher is the data root's resolved
-// publisher of the --resolved repository's channel (edition-workspace.json editionPublishers.resolved.<channel>,
-// refused by name when undeclared: no default, and no flag names another). Its repository must be the
-// repository the resolved descriptor records as its workflow (provenance.workflow.repository), checked before
-// cosign runs. A refused or unrunnable verify writes nothing.
-//
-// The caller pulls the resolved edition BY DIGEST (`oras manifest fetch` into --manifest, `oras pull`
-// into --artifact). A seal is RELEASE-ONLY (edition-contract.json sealOf.channel, D99): a --resolved edition of any
-// other channel is refused by name, and the sealed edition records provenance.channel release and goes to the
-// release repository. Nothing pulled is trusted until it is proven to be the edition --resolved names:
-//
-//   * the manifest bytes hash to the --resolved digest, it is an edition artifact (artifactType), and
-//     every layer is titled with a file an edition may hold, once;
-//   * every pulled file hashes to the digest of its layer, and the artifact holds no other file;
-//   * the descriptor parses (xema.edition/v2) and is `kind: resolved`, of the distribution and the
-//     channel the --resolved repository names.
-//
-// The sealed edition (written to --out, outside the committed trees) holds every layer of the resolved
-// edition but its descriptor BYTE FOR BYTE, plus a `kind: sealed` descriptor naming --resolved as `sealOf`,
-// with the resolved edition's channel (release), pins and engine image and the seal run as provenance.workflow.
-// A seal must be ARMED (edition-contract.json evidenceTrust.statesByKind): the data root's evidence trust
-// policy is judged on the resolved edition's channel, and anything but armed is refused by name
-// (EvidenceTrustRequiredError, EVIDENCE_TRUST_REQUIRED_UNARMED). The sealed repository is printed:
-// the same registry root, the release namespace segment. The workflow pushes --out there and signs the
-// manifest digest with the SEAL identity; who may seal is the signer's, not this command's.
-
-import { readFileSync, readdirSync } from 'node:fs';
-import { join, resolve } from 'node:path';
-
-import { certificateConstraintArgs } from './cosign-certificate-constraints.mjs';
-import { LOCAL_WORKFLOW, editionRepository, parseEditionDescriptor, parseSealOf, workflowFromEnv, writeSealedEditionArtifact } from './edition-artifact.mjs';
-import { editionPublisher } from './edition-config.mjs';
-import {
-  CATALOGUE_PIN_KEY,
-  EDITION_ARTIFACT_TYPE,
-  EDITION_DESCRIPTOR_FILE,
-  EDITION_FILES,
-  EDITION_SIGNER_OIDC_ISSUER,
-  EDITION_OFFERING_LAYERS,
-  EditionKind,
-  SEALED_EDITION_CHANNEL,
-} from './edition-constants.mjs';
-import { publisherIdentity } from './edition-publisher.mjs';
-import { WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule } from './edition-workspace.mjs';
-import { descriptorEvidenceTrust } from './evidence-trust-policy.mjs';
-import { sha256Hex } from './lib.mjs';
-import { cosignEnvironment, withPinnedCosign } from './pinned-cosign.mjs';
-import { splitImageRef } from './registry-credentials.mjs';
-import { parseStrictJson } from './strict-json.mjs';
-
-if (isEntryModule(import.meta.url)) {
-  configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Kernel]);
-}
-
-const REQUIRED_FLAGS = Object.freeze(['--resolved', '--manifest', '--artifact', '--out', '--cosign', '--resolve-workflow-sha']);
-const VALUE_FLAGS = REQUIRED_FLAGS;
-const USAGE =
-  'usage: seal --resolved <repository>@sha256:<digest> --manifest <file> --artifact <dir> --out <dir> --cosign <absolute path> ' +
-  '--resolve-workflow-sha <40 hex> [--local]';
-const WORKFLOW_SHA = /^[0-9a-f]{40}$/;
-const TITLE = 'org.opencontainers.image.title';
-/** Every file an edition artifact may hold: the descriptor, the locks, the offering layers. */
-const ADMITTED_FILES = Object.freeze([...EDITION_FILES, ...Object.values(EDITION_OFFERING_LAYERS)]);
-
-/** Parse the argv after the `seal` verb: every value flag exactly once, `--local` optional, nothing else. */
-export function parseSealArgs(argv) {
-  const options = {};
-  for (let i = 0; i < argv.length; i += 1) {
-    const arg = argv[i];
-    if (arg === '--local') {
-      options[arg] = true;
-    } else if (VALUE_FLAGS.includes(arg)) {
-      const value = argv[i + 1];
-      if (value === undefined || value.startsWith('--')) {throw new Error(`${arg} requires a value`);}
-      if (arg in options) {throw new Error(`${arg} is given twice`);}
-      options[arg] = value;
-      i += 1;
-    } else {
-      throw new Error(`unknown argument ${arg} for seal (${USAGE})`);
-    }
-  }
-  const missing = REQUIRED_FLAGS.filter((flag) => !(flag in options));
-  if (missing.length > 0) {throw new Error(`seal requires ${missing.join(', ')} (${USAGE})`);}
-  if (!WORKFLOW_SHA.test(options['--resolve-workflow-sha'])) {
-    throw new Error(`--resolve-workflow-sha ${JSON.stringify(options['--resolve-workflow-sha'])} is not the 40-hex commit the resolve workflow ran at`);
-  }
-  return options;
-}
-
-/**
- * Prove the pulled manifest and files are the resolved edition `sealOf` names, and return
- * `{ resolved, layers }`: its parsed descriptor and every other layer's bytes by title.
- *
- * @param {{ sealOf: string, manifestBytes: Buffer, artifactDir: string }} input
- */
-export function readResolvedEdition({ sealOf, manifestBytes, artifactDir }) {
-  const ref = parseSealOf(sealOf);
-  if (ref.channel !== SEALED_EDITION_CHANNEL) {
-    throw new Error(
-      `${sealOf} is a ${ref.channel} edition: a seal is ${SEALED_EDITION_CHANNEL}-only (edition-contract.json sealOf.channel); ` +
-        `seal the resolved ${SEALED_EDITION_CHANNEL} edition of "${ref.distributionId}" instead`,
-    );
-  }
-  if (`sha256:${sha256Hex(manifestBytes)}` !== ref.digest) {
-    throw new Error(`the manifest given hashes to sha256:${sha256Hex(manifestBytes)}, not to ${ref.digest}: it is not the manifest of ${sealOf}`);
-  }
-  const manifest = parseStrictJson(manifestBytes.toString('utf8'), 'the manifest');
-  if (manifest?.artifactType !== EDITION_ARTIFACT_TYPE || !Array.isArray(manifest.layers)) {
-    throw new Error(`${sealOf} is not an edition artifact (artifactType ${JSON.stringify(manifest?.artifactType)}, expected ${EDITION_ARTIFACT_TYPE})`);
-  }
-  const digestByTitle = new Map();
-  for (const layer of manifest.layers) {
-    const title = layer?.annotations?.[TITLE];
-    if (!ADMITTED_FILES.includes(title)) {
-      throw new Error(`${sealOf} carries a layer titled ${JSON.stringify(title)}, which is not a file an edition holds (${ADMITTED_FILES.join(', ')})`);
-    }
-    if (digestByTitle.has(title)) {throw new Error(`${sealOf} carries two layers titled ${title}`);}
-    digestByTitle.set(title, layer.digest);
-  }
-  const pulled = readdirSync(artifactDir).sort();
-  const expected = [...digestByTitle.keys()].sort();
-  if (pulled.join('\0') !== expected.join('\0')) {
-    throw new Error(`${artifactDir} holds ${pulled.join(', ') || 'nothing'}, but ${sealOf} has the layers ${expected.join(', ')}; pull exactly that artifact`);
-  }
-  const layers = new Map();
-  let descriptorBytes;
-  for (const [title, digest] of digestByTitle) {
-    const bytes = readFileSync(join(artifactDir, title));
-    if (`sha256:${sha256Hex(bytes)}` !== digest) {
-      throw new Error(`${join(artifactDir, title)} hashes to sha256:${sha256Hex(bytes)}, not to its layer digest ${digest} in ${sealOf}`);
-    }
-    if (title === EDITION_DESCRIPTOR_FILE) {descriptorBytes = bytes;} else {layers.set(title, bytes);}
-  }
-  if (descriptorBytes === undefined) {throw new Error(`${sealOf} carries no ${EDITION_DESCRIPTOR_FILE}`);}
-  const resolved = parseEditionDescriptor(parseStrictJson(descriptorBytes.toString('utf8'), `${sealOf} ${EDITION_DESCRIPTOR_FILE}`));
-  if (resolved.kind !== EditionKind.Resolved) {
-    throw new Error(`${sealOf} is a ${resolved.kind} edition; a seal seals exactly one resolved edition`);
-  }
-  if (resolved.distributionId !== ref.distributionId || resolved.provenance.channel !== ref.channel) {
-    throw new Error(
-      `${sealOf} is the ${ref.channel} repository of "${ref.distributionId}", but its descriptor records the ${resolved.provenance.channel} edition "${resolved.distributionId}"`,
-    );
-  }
-  return { resolved, layers };
-}
-
-/**
- * The resolve publisher a seal verifies against: ONLY the data root's edition-workspace.json
- * editionPublishers.resolved.<channel> (refused by name when undeclared; no flag or default names another), and only
- * when its repository is the one the resolved descriptor records as its workflow: a seal never verifies an edition
- * against a publisher its own provenance does not name. Checked before cosign runs.
- */
-export function resolvePublisher(resolved, sealOf) {
-  const channel = resolved.provenance.channel;
-  const publisher = editionPublisher(EditionKind.Resolved, channel);
-  const recorded = resolved.provenance.workflow?.repository;
-  if (publisher.repository !== recorded) {
-    throw new Error(
-      `${sealOf} records its resolve workflow in ${JSON.stringify(recorded)}, but the data root's resolved ${channel} publisher ` +
-        `(edition-workspace.json editionPublishers.resolved.${channel}) is in "${publisher.repository}": a seal verifies an edition only ` +
-        'against the publisher its provenance names; nothing is sealed',
-    );
-  }
-  return publisher;
-}
-
-/**
- * `cosign verify` of `sealOf` against the exact resolve publisher, through the one pinned-cosign path. Throws, naming
- * the publisher, when cosign refuses (unsigned, another identity, another commit) or cannot run; returns nothing.
- *
- * @param {{ sealOf: string, publisher: {repository: string, workflow: string, ref: string}, workflowSha: string, cosignBinary: string, env: object, pinned?: object }} input
- *   `pinned` are withPinnedCosign's injections (tests)
- */
-export async function verifyResolvedSignature({ sealOf, publisher, workflowSha, cosignBinary, env, pinned = {} }) {
-  const signer = {
-    certificateIdentity: publisherIdentity(publisher),
-    oidcIssuer: EDITION_SIGNER_OIDC_ISSUER,
-    githubWorkflow: { repository: publisher.repository, ref: publisher.ref },
-  };
-  const constraints = certificateConstraintArgs(signer, workflowSha);
-  const { authority } = splitImageRef(parseSealOf(sealOf).repository);
-  await withPinnedCosign({ cosignBinary, env, ...pinned }, async ({ runCosign, cosignEnvFor, trustedRootPath }) => {
-    let result;
-    try {
-      result = await runCosign(['verify', '--offline', '--trusted-root', trustedRootPath, ...constraints, sealOf], cosignEnvironment(cosignEnvFor, authority));
-    } catch (error) {
-      throw new Error(`cosign could not run for ${sealOf}: ${error.message}; nothing is sealed`);
-    }
-    if (result.code !== 0) {
-      throw new Error(
-        `cosign refused ${sealOf} as signed by the resolve publisher ${signer.certificateIdentity} (issuer ${EDITION_SIGNER_OIDC_ISSUER}, ` +
-          `workflow commit ${workflowSha}) (exit ${result.code}): ${String(result.stderr).trim()}; nothing is sealed`,
-      );
-    }
-  });
-}
-
-/**
- * Seal: prove the pulled edition by digest, verify the resolve publisher's signature over it, require an ARMED policy
- * on its channel, write the sealed edition. Returns `{ descriptor, repository }`; the repository is where the sealed edition goes.
- */
-export async function sealEdition({ options, env, evidenceTrust = descriptorEvidenceTrust, pinned = {} }) {
-  const sealOf = options['--resolved'];
-  const { resolved, layers } = readResolvedEdition({
-    sealOf,
-    manifestBytes: readFileSync(options['--manifest']),
-    artifactDir: resolve(options['--artifact']),
-  });
-  const channel = resolved.provenance.channel;
-  await verifyResolvedSignature({
-    sealOf,
-    publisher: resolvePublisher(resolved, sealOf),
-    workflowSha: options['--resolve-workflow-sha'],
-    cosignBinary: options['--cosign'],
-    env,
-    pinned,
-  });
-  const evidenceTrustPolicy = await evidenceTrust({
-    kind: EditionKind.Sealed,
-    channel,
-    consumesCatalogue: CATALOGUE_PIN_KEY in resolved.provenance.pins,
-  });
-  const descriptor = writeSealedEditionArtifact({
-    outDir: resolve(options['--out']),
-    resolved,
-    sealOf,
-    layers,
-    workflow: options['--local'] ? LOCAL_WORKFLOW : workflowFromEnv(env),
-    evidenceTrustPolicy,
-  });
-  const repository = editionRepository(resolved.distributionId, parseSealOf(sealOf).registryRoot, SEALED_EDITION_CHANNEL);
-  return { descriptor, repository };
-}
-
-if (isEntryModule(import.meta.url)) {
-  Promise.resolve()
-    .then(() => sealEdition({ options: parseSealArgs(process.argv.slice(2)), env: process.env }))
-    .then(({ repository }) => console.log(repository))
-    .catch((error) => {
-      console.error(`[edition-seal] ${error.message}`);
-      process.exit(1);
-    });
-}