@xemahq/xema 0.59.0 → 0.60.1

package/edition/kernel-package.mjs

@@ -1,206 +0,0 @@
-// kernel-package — the customer edition's kernel: `@xemahq/contracts` taken from public npm.
-//
-// A catalogue names its kernel package (`kernel: {name, version, integrity}`, catalogue.mjs). This module is
-// the ONE place that touches npm: it downloads that exact tarball (public, no credential, no .npmrc, no
-// npm/pnpm process), holds it by the catalogue's integrity BEFORE anything is extracted, extracts it with the
-// system `tar`, links its runtime dependencies to the copies this CLI itself ships, and proves the package is
-// the contract authority the catalogue was resolved under: first by its edition protocol identity (data, no
-// code executed), and only then, by loading its schemas, by the constants the authority was derived with.
-
-import { spawnSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, symlinkSync } from 'node:fs';
-import { createRequire } from 'node:module';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { isDeepStrictEqual } from 'node:util';
-
-import { readKernelEditionProtocol } from './edition-protocol.mjs';
-import { cacheDir, stateKernelPackageDir } from './edition-workspace.mjs';
-import { loadKernelDistributionSchemas } from './lib.mjs';
-
-export const KERNEL_PACKAGE_NAME = '@xemahq/contracts';
-const MAX_TARBALL_BYTES = 64 * 1024 * 1024;
-const DEPENDENCY_NAME = /^(?:@[a-z0-9~-][a-z0-9._~-]*\/)?[a-z0-9~-][a-z0-9._~-]*$/;
-const EXACT = /^(\d+)\.(\d+)\.(\d+)$/;
-const CARET = /^\^(\d+)\.(\d+)\.(\d+)$/;
-
-export class KernelPackageError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = 'KernelPackageError';
-  }
-}
-
-export const kernelTarballUrl = (version) => `https://registry.npmjs.org/${KERNEL_PACKAGE_NAME}/-/contracts-${version}.tgz`;
-
-/** The npm integrity string of `bytes`: `sha512-<base64>`. */
-export const integrityOf = (bytes) => `sha512-${createHash('sha512').update(bytes).digest('base64')}`;
-
-/** The published tarball of `@xemahq/contracts@version`, bounded in size. */
-export async function fetchKernelTarball(version, { fetch = globalThis.fetch } = {}) {
-  const url = kernelTarballUrl(version);
-  const response = await fetch(url);
-  if (response.status === 404) {
-    throw new KernelPackageError(`${KERNEL_PACKAGE_NAME}@${version} is not published on npm (${url}): a catalogue names a published kernel`);
-  }
-  if (!response.ok) {throw new KernelPackageError(`${url} answered HTTP ${response.status}`);}
-  const declared = Number(response.headers.get('content-length') ?? 0);
-  if (declared > MAX_TARBALL_BYTES) {throw new KernelPackageError(`${url} declares ${declared} bytes, over the ${MAX_TARBALL_BYTES} byte bound`);}
-  const chunks = [];
-  let size = 0;
-  for await (const chunk of response.body) {
-    size += chunk.length;
-    if (size > MAX_TARBALL_BYTES) {throw new KernelPackageError(`${url} is over the ${MAX_TARBALL_BYTES} byte bound`);}
-    chunks.push(chunk);
-  }
-  return Buffer.concat(chunks);
-}
-
-/**
- * Does `version` (exactly x.y.z) satisfy `range`? Exactly two range forms are supported: `x.y.z`, and
- * `^x.y.z` (x > 0: >=x.y.z <(x+1).0.0; 0.y.z: >=0.y.z <0.(y+1).0). Any other form is refused.
- */
-export function satisfiesDeclaredRange(version, range) {
-  const have = EXACT.exec(version)?.slice(1).map(Number);
-  if (have === undefined) {throw new KernelPackageError(`version ${JSON.stringify(version)} is not an exact x.y.z version`);}
-  const exact = EXACT.exec(range)?.slice(1).map(Number);
-  if (exact !== undefined) {return isDeepStrictEqual(have, exact);}
-  const caret = CARET.exec(range)?.slice(1).map(Number);
-  if (caret === undefined) {throw new KernelPackageError(`range ${JSON.stringify(range)} is not x.y.z or ^x.y.z, the only forms a kernel dependency may declare`);}
-  const compare = (a, b) => a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
-  const upper = caret[0] > 0 ? [caret[0] + 1, 0, 0] : [0, caret[1] + 1, 0];
-  return compare(have, caret) >= 0 && compare(have, upper) < 0;
-}
-
-/** The directory of `name` as this CLI itself ships it: its own resolution first, then its installed kernel's. */
-function shippedPackageDir(name) {
-  const own = createRequire(import.meta.url);
-  const attempts = [() => own, () => createRequire(realpathSync(own.resolve(`${KERNEL_PACKAGE_NAME}/package.json`)))];
-  for (const requireFrom of attempts) {
-    try {
-      return dirname(realpathSync(requireFrom().resolve(`${name}/package.json`)));
-    } catch (error) {
-      if (error?.code !== 'MODULE_NOT_FOUND' && error?.code !== 'ERR_PACKAGE_PATH_NOT_EXPORTED') {throw error;}
-    }
-  }
-  return undefined;
-}
-
-/**
- * The `@xemahq/contracts` package this CLI itself ships (installed from public npm with the CLI): the kernel of a
- * verb that runs with no kernel checkout and no catalogue, such as a third-party publisher's
- * `evidence assemble-third-party-input`. Refused when the CLI's installation has none.
- */
-export function shippedKernelPackageDir() {
-  const dir = shippedPackageDir(KERNEL_PACKAGE_NAME);
-  if (dir === undefined) {
-    throw new KernelPackageError(`this CLI's installation ships no ${KERNEL_PACKAGE_NAME}; reinstall the CLI from npm`);
-  }
-  return dir;
-}
-
-function linkRuntimeDependencies(packageDir) {
-  const manifest = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf8'));
-  const nodeModules = dirname(manifest.name.startsWith('@') ? dirname(packageDir) : packageDir);
-  for (const [name, range] of Object.entries(manifest.dependencies ?? {})) {
-    if (!DEPENDENCY_NAME.test(name)) {throw new KernelPackageError(`${KERNEL_PACKAGE_NAME} declares a dependency named ${JSON.stringify(name)}, which is not a package name`);}
-    const shipped = shippedPackageDir(name);
-    if (shipped === undefined) {throw new KernelPackageError(`${KERNEL_PACKAGE_NAME} depends on ${name}@${range}, which this CLI does not ship`);}
-    const version = JSON.parse(readFileSync(join(shipped, 'package.json'), 'utf8')).version;
-    let ok;
-    try {
-      ok = satisfiesDeclaredRange(version, range);
-    } catch (error) {
-      throw new KernelPackageError(`${KERNEL_PACKAGE_NAME} dependency ${name}: ${error.message} (this CLI ships ${version})`);
-    }
-    if (!ok) {throw new KernelPackageError(`${KERNEL_PACKAGE_NAME} depends on ${name}@${range}, but this CLI ships ${name}@${version}`);}
-    const link = join(nodeModules, name);
-    mkdirSync(dirname(link), { recursive: true });
-    symlinkSync(shipped, link, 'dir');
-  }
-}
-
-/**
- * Download the catalogue's kernel, hold it to `kernel.integrity` (refused before anything is written), extract it
- * under `<cacheDir>/kernel-npm/<version>-<16 hex of the sha512>/node_modules/@xemahq/contracts` (fresh every run)
- * and link its runtime dependencies. Returns the package directory.
- */
-export async function materializeKernelPackage({ kernel, cacheDir, fetchTarball = fetchKernelTarball }) {
-  const bytes = await fetchTarball(kernel.version);
-  const actual = integrityOf(bytes);
-  if (actual !== kernel.integrity) {
-    throw new KernelPackageError(`${KERNEL_PACKAGE_NAME}@${kernel.version} integrity ${actual} is not the catalogue's kernel.integrity ${kernel.integrity}`);
-  }
-  const hex = createHash('sha512').update(bytes).digest('hex').slice(0, 16);
-  const root = join(cacheDir, 'kernel-npm', `${kernel.version}-${hex}`);
-  const packageDir = join(root, 'node_modules', ...KERNEL_PACKAGE_NAME.split('/'));
-  rmSync(root, { recursive: true, force: true });
-  mkdirSync(packageDir, { recursive: true });
-  const extracted = spawnSync('tar', ['-xzf', '-', '-C', packageDir, '--strip-components', '1'], { input: bytes, stdio: ['pipe', 'ignore', 'pipe'] });
-  if (extracted.error !== undefined) {throw new KernelPackageError(`tar could not run: ${extracted.error.message}`);}
-  if (extracted.status !== 0) {throw new KernelPackageError(`tar failed extracting ${KERNEL_PACKAGE_NAME}@${kernel.version}: ${extracted.stderr.toString().trim()}`);}
-  const manifest = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf8'));
-  if (manifest.name !== KERNEL_PACKAGE_NAME || manifest.version !== kernel.version) {
-    throw new KernelPackageError(`the tarball holds ${manifest.name}@${manifest.version}, not ${KERNEL_PACKAGE_NAME}@${kernel.version}`);
-  }
-  linkRuntimeDependencies(packageDir);
-  return packageDir;
-}
-
-const refuse = (field, wanted, got) => new KernelPackageError(`the kernel package is not the catalogue's contract authority: ${field} is ${JSON.stringify(got)}, the catalogue states ${JSON.stringify(wanted)}`);
-
-/**
- * The kernel package at `kernelPackageDir` is the contract authority of `catalogue`. First its identity, read as
- * data (final, which the protocol read refuses otherwise, and the catalogue's digest); only then are its schemas loaded and held to the authority's constants.
- * `sourceCommit` is provenance and is not compared. Returns the loaded schemas.
- */
-export async function assertKernelPackageIsCatalogueAuthority({ catalogue, kernelPackageDir, loadSchemas }) {
-  const authority = catalogue.contractAuthority;
-  const identity = readKernelEditionProtocol(kernelPackageDir);
-  if (identity.contentDigest !== authority.contentDigest) {throw refuse('contentDigest', authority.contentDigest, identity.contentDigest);}
-  const schemas = await loadSchemas();
-  if (!isDeepStrictEqual(authority.sourcePaths, schemas.XEMA_KERNEL_CONTRACT_SOURCE_PATHS)) {
-    throw refuse('sourcePaths', authority.sourcePaths, schemas.XEMA_KERNEL_CONTRACT_SOURCE_PATHS);
-  }
-  const constants = [
-    ['generatorIdentity', schemas.XEMA_KERNEL_CONTRACT_AUTHORITY_GENERATOR],
-    ['repositoryUrl', schemas.XEMA_KERNEL_CONTRACT_REPOSITORY_URL],
-    ['contentHashAlgorithm', schemas.KernelContractContentHashAlgorithm.LengthFramedGitPathModeBlobV1],
-  ];
-  for (const [field, kernelValue] of constants) {
-    if (authority[field] !== kernelValue) {throw refuse(field, authority[field], kernelValue);}
-  }
-  return schemas;
-}
-
-/**
- * The `kernel` row a VENDOR catalogue carries: the published `@xemahq/contracts` the vendor's own kernel
- * (`kernelPackageDir`) is, taken from npm, proved to be `contractAuthority` and held by its integrity.
- * An unpublished version is refused. The downloaded package is extracted to a temporary directory and removed.
- */
-export async function kernelPackageOfAuthority({ kernelPackageDir, contractAuthority, fetchTarball = fetchKernelTarball, loadSchemas = loadKernelDistributionSchemas }) {
-  const manifest = JSON.parse(readFileSync(join(kernelPackageDir, 'package.json'), 'utf8'));
-  if (manifest.name !== KERNEL_PACKAGE_NAME) {throw new KernelPackageError(`the vendor kernel is ${manifest.name}, not ${KERNEL_PACKAGE_NAME}`);}
-  const bytes = await fetchTarball(manifest.version);
-  const kernel = { name: KERNEL_PACKAGE_NAME, version: manifest.version, integrity: integrityOf(bytes) };
-  const scratch = mkdtempSync(join(tmpdir(), 'xema-kernel-npm-'));
-  try {
-    const packageDir = await materializeKernelPackage({ kernel, cacheDir: scratch, fetchTarball: async () => bytes });
-    await assertKernelPackageIsCatalogueAuthority({ catalogue: { contractAuthority }, kernelPackageDir: packageDir, loadSchemas });
-  } finally {
-    rmSync(scratch, { recursive: true, force: true });
-  }
-  return kernel;
-}
-
-/**
- * A customer verb's one step between fetching its catalogue and using any kernel schema: the catalogue's kernel is
- * downloaded into the cache root, stated as the workspace's Kernel root, and proved to be the catalogue's contract
- * authority. Returns the kernel's distribution schemas.
- */
-export async function adoptCatalogueKernel(catalogue) {
-  const kernelPackageDir = await materializeKernelPackage({ kernel: catalogue.kernel, cacheDir: cacheDir() });
-  stateKernelPackageDir(kernelPackageDir);
-  return assertKernelPackageIsCatalogueAuthority({ catalogue, kernelPackageDir, loadSchemas: loadKernelDistributionSchemas });
-}

package/edition/kernel-protocol-choice.mjs

@@ -1,239 +0,0 @@
-// kernel-protocol-choice — which kernel commit a develop edition runs.
-//
-// The CLI runs the kernel's code and refuses a protocol it does not support
-// (edition-protocol.mjs), so a develop edition that always took the kernel's
-// develop HEAD would break on every kernel protocol bump until a CLI release
-// caught up. Commits that declare the same protocol identity (version AND
-// digest) are interchangeable by the digest contract, so the develop kernel is
-// the NEWEST commit on the checkout's first-parent history whose declared
-// identity is in this CLI's supported set: a deterministic choice, never a
-// fallback.
-//
-//   - head supported          -> the head              (reason head-supported)
-//   - head ahead of the CLI   -> the newest supported  (reason head-ahead, held)
-//   - an explicit 40-hex pin  -> the pin, still checked (reason explicit-pin); it must be on the first-parent
-//                                history of the develop head (refs/remotes/origin/develop), else not-on-develop
-//   - nothing supported       -> refused (EditionProtocolMismatchError, no-supported-commit); never the head.
-//                                The walk ends at the first commit with no declaration file (it predates the protocol).
-//   - a declaration that exists but does not parse, at the head or any walked commit
-//                             -> refused (EditionProtocolMismatchError, unparseable) naming the commit; never skipped
-//
-// The declared identity is read from each commit's SOURCE
-// (`<kernel package>/src/edition-protocol/lib/edition-protocol.ts`, the literal
-// `EDITION_PROTOCOL = Object.freeze({ version, provisional, contentDigest })`),
-// because the history is not built; the built kernel is checked again from its
-// dist files by every loader. Reads git objects only; writes nothing.
-
-import { execFileSync } from 'node:child_process';
-
-import {
-  EditionProtocolMismatchError,
-  EditionProtocolMismatchReason,
-  assertSupportedEditionIdentity,
-  isSupportedEditionIdentity,
-  supportedList,
-} from './edition-protocol.mjs';
-import { KERNEL_PACKAGE_REPO_PATH } from './edition-workspace.mjs';
-
-/** The kernel source file that declares the edition protocol identity, repository-relative. */
-export const KERNEL_EDITION_PROTOCOL_SOURCE = `${KERNEL_PACKAGE_REPO_PATH}/src/edition-protocol/lib/edition-protocol.ts`;
-
-/**
- * The kernel checkout's develop head: the remote-tracking ref a full-history checkout (`fetch-depth: 0`)
- * always has. Every choice and every explicit commit is judged against its first-parent history.
- */
-export const KERNEL_DEVELOP_REF = 'refs/remotes/origin/develop';
-
-/** Why a kernel commit was chosen. A closed set; `held` is exactly `head-ahead`. */
-export const KernelChoiceReason = Object.freeze({
-  HeadSupported: 'head-supported',
-  HeadAhead: 'head-ahead',
-  ExplicitPin: 'explicit-pin',
-});
-
-const SHA_PATTERN = /^[0-9a-f]{40}$/;
-const MAX_GIT_OUTPUT = 256 * 1024 * 1024;
-const DECLARATION = /export const EDITION_PROTOCOL\b[^=]*=\s*Object\.freeze\(\{([^}]*)\}\)/g;
-const FIELDS = Object.freeze([
-  ['version', /\bversion:\s*([1-9][0-9]*)\s*(?:,|$)/],
-  ['provisional', /\bprovisional:\s*(true|false)\s*(?:,|$)/],
-  ['contentDigest', /\bcontentDigest:\s*'([a-f0-9]{64})'\s*(?:,|$)/],
-]);
-
-/** A declaration source that exists but whose `EDITION_PROTOCOL` literal is absent or not exactly the three fields. */
-const malformed = (label) =>
-  new EditionProtocolMismatchError(
-    EditionProtocolMismatchReason.Unparseable,
-    `${label} does not parse: it must declare exactly one EDITION_PROTOCOL = Object.freeze({ version: <positive integer>, ` +
-      "provisional: <boolean>, contentDigest: '<64 lowercase hex>' })",
-  );
-
-/**
- * The identity `{contentDigest, provisional, version}` the source text declares. Strict: exactly one
- * declaration, each field exactly once, nothing else in the literal. Throws Unparseable otherwise.
- */
-export function parseDeclaredEditionProtocol(text, label) {
-  const declarations = [...text.matchAll(DECLARATION)];
-  if (declarations.length !== 1) {throw malformed(label);}
-  let rest = declarations[0][1];
-  const fields = {};
-  for (const [name, pattern] of FIELDS) {
-    const all = rest.match(new RegExp(pattern.source, 'g')) ?? [];
-    if (all.length !== 1) {throw malformed(label);}
-    fields[name] = all[0].match(pattern)[1];
-    rest = rest.replace(all[0], '');
-  }
-  if (rest.replace(/\/\/[^\n]*/g, '').trim() !== '') {throw malformed(label);}
-  return Object.freeze({
-    contentDigest: fields.contentDigest,
-    provisional: fields.provisional === 'true',
-    version: Number(fields.version),
-  });
-}
-
-const describeShort = (identity) =>
-  identity === undefined ? 'no declared protocol' : `v${identity.version}${identity.provisional ? '-provisional' : ''}`;
-
-/** Git against one checkout; `runGit(args, input?)` returns stdout as a string. */
-function gitIn(repoDir, runGit) {
-  return (args, input) =>
-    runGit('git', ['-C', repoDir, ...args], {
-      encoding: 'utf8',
-      maxBuffer: MAX_GIT_OUTPUT,
-      stdio: ['pipe', 'pipe', 'pipe'],
-      ...(input === undefined ? {} : { input }),
-    });
-}
-
-function assertCommit(git, sha, label) {
-  if (typeof sha !== 'string' || !SHA_PATTERN.test(sha)) {
-    throw new Error(`${label} is not a 40-hex commit SHA: ${JSON.stringify(sha)}`);
-  }
-  let resolved;
-  try {
-    resolved = git(['rev-parse', '--verify', '--quiet', `${sha}^{commit}`]).trim();
-  } catch {
-    resolved = '';
-  }
-  if (resolved !== sha) {throw new Error(`${label} is not a commit in the kernel checkout`);}
-}
-
-/** The commit {@link KERNEL_DEVELOP_REF} names; refused when the checkout has no such ref. */
-function readDevelopHead(git) {
-  let head;
-  try {
-    head = git(['rev-parse', '--verify', '--quiet', `${KERNEL_DEVELOP_REF}^{commit}`]).trim();
-  } catch {
-    head = '';
-  }
-  if (!SHA_PATTERN.test(head)) {
-    throw new Error(`the kernel checkout has no ${KERNEL_DEVELOP_REF}; check it out with full history (fetch-depth: 0)`);
-  }
-  return head;
-}
-
-/** The first-parent history of `head`, newest first. */
-const firstParentHistory = (git, head) =>
-  git(['rev-list', '--first-parent', head]).split('\n').filter((line) => line.length > 0);
-
-/**
- * The declaring blob of every commit, by one `git cat-file --batch-check`: a Map commit -> blob sha, or
- * undefined when the commit has no such file.
- */
-function declaringBlobs(git, commits) {
-  const input = commits.map((commit) => `${commit}:${KERNEL_EDITION_PROTOCOL_SOURCE}\n`).join('');
-  const lines = git(['cat-file', '--batch-check'], input).split('\n').filter((line) => line.length > 0);
-  if (lines.length !== commits.length) {
-    throw new Error(`git cat-file answered ${lines.length} lines for ${commits.length} kernel commits`);
-  }
-  return new Map(
-    commits.map((commit, index) => {
-      const [sha, type] = lines[index].split(' ');
-      return [commit, type === 'blob' && SHA_PATTERN.test(sha) ? sha : undefined];
-    }),
-  );
-}
-
-/** A reader of the declared identity per blob (memoized); `undefined` for an absent file. Throws Unparseable. */
-function identityReader(git) {
-  const byBlob = new Map();
-  return (commit, blob) => {
-    if (blob === undefined) {return undefined;}
-    if (!byBlob.has(blob)) {
-      const label = `the kernel commit ${commit}: ${KERNEL_EDITION_PROTOCOL_SOURCE}`;
-      byBlob.set(blob, parseDeclaredEditionProtocol(git(['cat-file', 'blob', blob]), label));
-    }
-    return byBlob.get(blob);
-  };
-}
-
-/**
- * Refuse a kernel commit whose declared identity this CLI does not support (absent, provisional, another
- * version, or a supported version at another digest), naming `label`. The one check behind an explicit pin
- * and `freeze-graph --kernel-sha`. Returns the identity.
- */
-export function assertKernelCommitSupported({ repoDir, commit, label = `the kernel commit ${commit}`, runGit = execFileSync }) {
-  const git = gitIn(repoDir, runGit);
-  assertCommit(git, commit, label);
-  const developHead = readDevelopHead(git);
-  if (!firstParentHistory(git, developHead).includes(commit)) {
-    throw new EditionProtocolMismatchError(
-      EditionProtocolMismatchReason.NotOnDevelop,
-      `${label} is not on the first-parent history of the kernel develop head ${developHead} (${KERNEL_DEVELOP_REF}); ` +
-        'an explicit kernel commit must be one that kernel develop actually passed through.',
-    );
-  }
-  const identity = identityReader(git)(commit, declaringBlobs(git, [commit]).get(commit));
-  if (identity === undefined) {
-    throw new EditionProtocolMismatchError(
-      EditionProtocolMismatchReason.Undeclared,
-      `${label} declares no edition protocol (${KERNEL_EDITION_PROTOCOL_SOURCE} is absent); this CLI supports ${supportedList()}.`,
-    );
-  }
-  return assertSupportedEditionIdentity(identity, `${label} (${KERNEL_EDITION_PROTOCOL_SOURCE})`);
-}
-
-/**
- * Choose the develop kernel commit in the checkout at `repoDir` (fetched with full history).
- *
- * @param {object} request
- * @param {string} request.repoDir the kernel-contracts checkout
- * @param {string} [request.pin] an explicit 40-hex commit; it wins, and is still checked
- * @returns {{ choice: {chosenSha: string, headSha: string, held: boolean, reason: string}, notice?: string }}
- *   `choice` is what is recorded; `notice` (only when held) is the run-summary line, never persisted.
- */
-export function chooseKernelCommit({ repoDir, pin, runGit = execFileSync }) {
-  const git = gitIn(repoDir, runGit);
-  const headSha = readDevelopHead(git);
-  if (pin !== undefined) {
-    assertKernelCommitSupported({ repoDir, commit: pin, label: `the kernel pin ${pin}`, runGit });
-    return { choice: { chosenSha: pin, headSha, held: false, reason: KernelChoiceReason.ExplicitPin } };
-  }
-  const commits = firstParentHistory(git, headSha);
-  const blobs = declaringBlobs(git, commits);
-  const identityAt = identityReader(git);
-  // Fail closed: an unparseable declaration (head or walked) is refused by name, never skipped; a commit
-  // with no declaration file predates the protocol, so the walk ends there.
-  const headIdentity = identityAt(headSha, blobs.get(headSha));
-  if (isSupportedEditionIdentity(headIdentity)) {
-    return { choice: { chosenSha: headSha, headSha, held: false, reason: KernelChoiceReason.HeadSupported } };
-  }
-  for (const commit of headIdentity === undefined ? [] : commits.slice(1)) {
-    const identity = identityAt(commit, blobs.get(commit));
-    if (identity === undefined) {break;}
-    if (isSupportedEditionIdentity(identity)) {
-      return {
-        choice: { chosenSha: commit, headSha, held: true, reason: KernelChoiceReason.HeadAhead },
-        notice:
-          `kernel held at ${describeShort(identity)} (${commit.slice(0, 12)}), ` +
-          `head at ${describeShort(headIdentity)} (${headSha.slice(0, 12)}): raise the CLI`,
-      };
-    }
-  }
-  throw new EditionProtocolMismatchError(
-    EditionProtocolMismatchReason.NoSupportedCommit,
-    `no commit on the first-parent history of the kernel head ${headSha} declares an edition protocol this CLI ` +
-      `supports (this CLI supports ${supportedList()}; the head declares ${describeShort(headIdentity)}` +
-      `${headIdentity === undefined ? '' : ` at ${headIdentity.contentDigest}`}). Raise the CLI; the head is never taken instead.`,
-  );
-}

package/edition/kernel-signer-kind.mjs

@@ -1,23 +0,0 @@
-import { createRequire } from 'node:module';
-
-import { assertKernelEditionProtocol } from './edition-protocol.mjs';
-import { kernelDistPath, kernelPackageDir } from './edition-workspace.mjs';
-
-const requireFromHere = createRequire(import.meta.url);
-
-/**
- * The kind of signer this library produces and verifies: a keyless OIDC
- * certificate, `SignerKind.OidcCertificate` of the built kernel. The producer
- * inputs and the trust-policy rows the evidence verbs handle carry it.
- */
-export function oidcCertificateSignerKind() {
-  assertKernelEditionProtocol(kernelPackageDir());
-  const { SignerKind } = requireFromHere(kernelDistPath('distribution', 'index.js'));
-  const kind = SignerKind?.OidcCertificate;
-  if (typeof kind !== 'string' || kind.length === 0) {
-    throw new Error(
-      `The built kernel distribution module at ${kernelDistPath('distribution', 'index.js')} does not export SignerKind.OidcCertificate; rebuild the kernel checkout.`,
-    );
-  }
-  return kind;
-}