@xemahq/xema 0.59.1 → 0.60.1

package/edition/evidence-checkout.mjs

@@ -1,439 +0,0 @@
-// Grades the checkouts the evidence verifier reads from: the data root and the
-// editions root. Each is judged to ONE standard — a trusted git binary, a
-// location no other user can write, an exact HEAD commit, every file the
-// verifier reads bound byte-for-byte to its HEAD blob, and no untrusted change
-// anywhere in the repository (the commit is what the completeness signature
-// binds to, so a checkout that is not exactly that commit is not that commit).
-//
-// Nothing here knows where this module sits: the verifier's own integrity is
-// bound by the data-root pin of its bundle (`evidence-trust-policy.mjs`), not by
-// a checkout of its source.
-
-import { execFileSync } from 'node:child_process';
-import { lstatSync, readFileSync, realpathSync } from 'node:fs';
-import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
-
-import { COMMIT_PATTERN } from './evidence-grammars.mjs';
-import {
-  assertPreparedExecutable,
-  exactExecutableOutput,
-  prepareRootOwnedPinnedExecutable,
-} from './trusted-executable.mjs';
-
-const GIT_VERSION_PATTERN = /^git version (\d+\.\d+\.\d+)(?: .*)?\n?$/;
-const GIT_ENV = Object.freeze({
-  GIT_CONFIG_NOSYSTEM: '1',
-  GIT_CONFIG_GLOBAL: '/dev/null',
-  GIT_TERMINAL_PROMPT: '0',
-  GIT_NO_REPLACE_OBJECTS: '1',
-  GIT_OPTIONAL_LOCKS: '0',
-  GIT_PAGER: 'cat',
-  LC_ALL: 'C',
-  PATH: '/usr/bin:/bin',
-});
-const GIT_SAFE_CONFIG = Object.freeze([
-  '-c',
-  'core.fsmonitor=false',
-  '-c',
-  'core.hooksPath=/dev/null',
-  '-c',
-  'core.attributesFile=/dev/null',
-  '--no-pager',
-]);
-
-/**
- * The largest output one git call here may return. Node's default `maxBuffer`
- * is 1 MiB, and a graded file can be larger (the Sigstore trusted root is up to
- * 8 MiB); with the default the verifier could not bind it to its HEAD blob and
- * would fail with `spawnSync git ENOBUFS`, which names neither the file nor the
- * limit. 64 MiB is a bound, not a hope: far above any file graded here and far
- * below anything that would matter to the host.
- */
-const MAX_GIT_OUTPUT_BYTES = 64 * 1024 * 1024;
-
-function git(trustedGit, directory, args, encoding = 'utf8') {
-  const gitBinary = assertPreparedExecutable(trustedGit, 'git');
-  const output = execFileSync(
-    gitBinary,
-    [...GIT_SAFE_CONFIG, '-C', directory, ...args],
-    {
-      encoding,
-      stdio: ['ignore', 'pipe', 'pipe'],
-      env: GIT_ENV,
-      maxBuffer: MAX_GIT_OUTPUT_BYTES,
-    },
-  );
-  assertPreparedExecutable(trustedGit, 'git');
-  return output;
-}
-
-export function prepareTrustedGitBinary({ gitBinary, policy }) {
-  return prepareRootOwnedPinnedExecutable({
-    executablePath: gitBinary,
-    trustedDigests: policy.trustedGitBinaryDigests,
-    label: 'git',
-    verifyVersion(privateBinary) {
-      const output = exactExecutableOutput(privateBinary, ['--version'], {
-        env: GIT_ENV,
-        timeout: 10_000,
-      });
-      const match = GIT_VERSION_PATTERN.exec(output);
-      if (!match) {
-        throw new Error('Git version output is not exact');
-      }
-      if (match[1] !== policy.gitVersion) {
-        throw new Error(
-          `Git version does not match pinned ${policy.gitVersion}`,
-        );
-      }
-    },
-  });
-}
-
-function assertContained(root, candidate, label, within) {
-  const rel = relative(root, candidate);
-  if (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
-    throw new Error(`${label} is outside ${within}`);
-  }
-}
-
-/**
- * `path` and every ancestor up to `/` must be owned by root or the current user
- * and not group/world writable. The refusal names the offending directory, its
- * mode and its owner: the fault is almost always one specific ancestor, and the
- * reader cannot otherwise tell which, nor whether it failed on ownership or on
- * the write bits.
- */
-export function assertProtectedPathAncestry(path, label) {
-  const currentUid =
-    typeof process.getuid === 'function' ? process.getuid() : undefined;
-  let current = realpathSync(path);
-  while (true) {
-    const stats = lstatSync(current);
-    const foreignOwner =
-      currentUid !== undefined && stats.uid !== 0 && stats.uid !== currentUid;
-    const groupOrWorldWritable = (stats.mode & 0o022) !== 0;
-    if (foreignOwner || groupOrWorldWritable) {
-      throw new Error(
-        `${label} and every ancestor must be verifier/root-owned and not group/world writable — ` +
-          `${current} is ${foreignOwner ? `owned by uid ${stats.uid} (running as uid ${currentUid})` : `mode ${(stats.mode & 0o7777).toString(8).padStart(4, '0')}`}`,
-      );
-    }
-    if (current === '/') {break;}
-    current = dirname(current);
-  }
-}
-
-function dirtyPaths(trustedGit, repositoryRoot) {
-  const records = git(
-    trustedGit,
-    repositoryRoot,
-    ['status', '--porcelain=v1', '-z', '--untracked-files=all'],
-    'buffer',
-  )
-    .toString('utf8')
-    .split('\0')
-    .filter(Boolean);
-  const entries = [];
-  for (let index = 0; index < records.length; index += 1) {
-    const record = records[index];
-    const status = record.slice(0, 2);
-    entries.push({ status, path: record.slice(3) });
-    if (status[0] === 'R' || status[0] === 'C') {
-      entries.push({ status, path: records[index + 1] });
-      index += 1;
-    }
-  }
-  return entries;
-}
-
-function assertSafeWorktreeFile(path, expectedMode, label) {
-  const stats = lstatSync(path);
-  if (!stats.isFile() || stats.isSymbolicLink()) {
-    throw new Error(`${label} must be a no-follow regular file`);
-  }
-  if (typeof process.getuid === 'function' && stats.uid !== process.getuid()) {
-    throw new Error(`${label} is not owned by the current user`);
-  }
-  const actualMode = stats.mode & 0o777;
-  if (actualMode !== expectedMode || (actualMode & 0o022) !== 0) {
-    throw new Error(
-      `${label} must have exact mode ${expectedMode.toString(8)}`,
-    );
-  }
-}
-
-function parseTreeRecord(record, expectedPath, label) {
-  const match = /^(100644|100755) blob ([a-f0-9]{40,64})\t(.+)$/.exec(record);
-  if (!match || match[3] !== expectedPath) {
-    throw new Error(
-      `${label} "${expectedPath}" is absent or has an untrusted HEAD mode`,
-    );
-  }
-  return { mode: match[1], objectId: match[2] };
-}
-
-function assertNormalIndexFlags(trustedGit, repositoryRoot, path, label) {
-  const tagged = git(
-    trustedGit,
-    repositoryRoot,
-    ['ls-files', '--stage', '-v', '-z', '--', path],
-    'buffer',
-  )
-    .toString('utf8')
-    .split('\0')
-    .filter(Boolean);
-  if (tagged.length !== 1 || !tagged[0].startsWith('H ')) {
-    throw new Error(
-      `${label} "${path}" has skip-worktree, assume-unchanged, or unexpected index state`,
-    );
-  }
-  const debug = git(trustedGit, repositoryRoot, [
-    'ls-files',
-    '--debug',
-    '--',
-    path,
-  ]);
-  const flags = /\bflags:\s+(\d+)\s*$/m.exec(debug);
-  if (!flags || flags[1] !== '0') {
-    throw new Error(`${label} "${path}" has non-zero Git index flags`);
-  }
-}
-
-/**
- * `path` is a repository-root-relative POSIX path. It must be exactly one HEAD
- * blob, carry no index flags, and match its HEAD bytes and mode in the working
- * tree. `label` names what the path IS in every refusal, so a reader can tell
- * which checkout refused.
- */
-function assertHeadBoundPath(trustedGit, repositoryRoot, path, label) {
-  const records = git(
-    trustedGit,
-    repositoryRoot,
-    ['ls-tree', '-z', 'HEAD', '--', path],
-    'buffer',
-  )
-    .toString('utf8')
-    .split('\0')
-    .filter(Boolean);
-  if (records.length !== 1) {
-    throw new Error(`${label} "${path}" is not one exact HEAD blob`);
-  }
-  const { mode, objectId } = parseTreeRecord(records[0], path, label);
-  assertNormalIndexFlags(trustedGit, repositoryRoot, path, label);
-
-  const absolutePath = resolve(repositoryRoot, path);
-  assertContained(
-    repositoryRoot,
-    absolutePath,
-    `${label} "${path}"`,
-    `the checkout ${repositoryRoot}`,
-  );
-  assertSafeWorktreeFile(
-    absolutePath,
-    mode === '100755' ? 0o755 : 0o644,
-    `${label} "${path}"`,
-  );
-  const headBytes = git(
-    trustedGit,
-    repositoryRoot,
-    ['cat-file', 'blob', objectId],
-    'buffer',
-  );
-  if (!readFileSync(absolutePath).equals(headBytes)) {
-    throw new Error(`${label} "${path}" does not match its HEAD blob`);
-  }
-}
-
-/**
- * Locate the Git checkout a root sits in. Locating it is separate from judging
- * it — see {@link assertTrustedCheckoutLocation}.
- */
-export function locateCheckout({ root, trustedGit, label }) {
-  assertPreparedExecutable(trustedGit, 'git');
-  let repositoryRoot;
-  try {
-    repositoryRoot = realpathSync(
-      git(trustedGit, root, ['rev-parse', '--show-toplevel']).trim(),
-    );
-  } catch {
-    throw new Error(`${label} verification requires a trusted Git checkout`);
-  }
-  const gitDirectory = realpathSync(
-    git(trustedGit, repositoryRoot, ['rev-parse', '--absolute-git-dir']).trim(),
-  );
-  return { repositoryRoot, gitDirectory };
-}
-
-/**
- * WHERE the checkout is: no ancestor may be writable by anyone but its owner or
- * root, or another local process could swap the inputs between verification and
- * use.
- *
- * This is a property of the MACHINE, not of the repository's contents, and the
- * two are deliberately separately callable and separately tested: fused, every
- * content test depended on the ambient environment (a runner whose `/home/<user>`
- * is 0777 failed them all) and this rule, the one with real security weight, had
- * no direct test. There is deliberately NO option to skip it in
- * {@link gradeTrustedCheckout}.
- */
-export function assertTrustedCheckoutLocation(
-  { repositoryRoot, gitDirectory },
-  label,
-) {
-  assertProtectedPathAncestry(repositoryRoot, `${label} checkout`);
-  assertProtectedPathAncestry(gitDirectory, `${label} Git directory`);
-}
-
-/**
- * WHAT the checkout contains: an exact HEAD, every required path bound to its
- * HEAD blob, and no untrusted working-tree change anywhere in the repository.
- *
- * `requirements` are `{root, label, requiredPaths}`: each `root` sits anywhere
- * inside `repositoryRoot` and each required path is relative to its root, so it
- * is re-rooted to the repository before git is asked. A path that resolves
- * outside its root is refused BY NAME before git runs.
- */
-export function verifyCheckoutContents({
-  repositoryRoot,
-  requirements,
-  trustedGit,
-  expectedCommit,
-}) {
-  const commit = git(trustedGit, repositoryRoot, [
-    'rev-parse',
-    '--verify',
-    'HEAD^{commit}',
-  ]).trim();
-  if (!COMMIT_PATTERN.test(commit)) {
-    throw new Error(`${repositoryRoot} HEAD is not an exact Git commit`);
-  }
-  if (expectedCommit !== undefined && commit !== expectedCommit) {
-    throw new Error(`${repositoryRoot} HEAD changed during verification`);
-  }
-  for (const { root, label, requiredPaths } of requirements) {
-    if (requiredPaths.length === 0) {
-      throw new Error(
-        `the ${label} checkout is graded for at least one path; none was named`,
-      );
-    }
-    for (const requiredPath of requiredPaths) {
-      const absolutePath = resolve(root, requiredPath);
-      assertContained(
-        root,
-        absolutePath,
-        `${label} path "${requiredPath}"`,
-        `the ${label} ${root}`,
-      );
-      assertHeadBoundPath(
-        trustedGit,
-        repositoryRoot,
-        relative(repositoryRoot, absolutePath).split(sep).join('/'),
-        label,
-      );
-    }
-  }
-  const unexpected = dirtyPaths(trustedGit, repositoryRoot).map(
-    (entry) => `${entry.status} ${entry.path}`,
-  );
-  if (unexpected.length > 0) {
-    throw new Error(
-      `checkout ${repositoryRoot} has untrusted source changes: ${unexpected.join(', ')}`,
-    );
-  }
-  return { repositoryRoot, commit };
-}
-
-/**
- * Locate, judge the location of, and grade the contents of the checkout one
- * root sits in. `root` and `requiredPaths` are as in {@link verifyCheckoutContents}.
- */
-export function gradeTrustedCheckout({
-  root,
-  requiredPaths,
-  label,
-  trustedGit,
-  expectedCommit,
-}) {
-  const canonicalRoot = realpathSync(root);
-  const location = locateCheckout({ root: canonicalRoot, trustedGit, label });
-  assertTrustedCheckoutLocation(location, label);
-  return verifyCheckoutContents({
-    repositoryRoot: location.repositoryRoot,
-    requirements: [{ root: canonicalRoot, label, requiredPaths }],
-    trustedGit,
-    expectedCommit,
-  });
-}
-
-/**
- * Grade several roots, each repository ONCE: roots in the same repository are
- * graded together under one HEAD and one clean-tree check. Returns a Map from
- * each (canonical) root to `{repositoryRoot, commit}`. `expected` is an earlier
- * result of this function; passing it demands every HEAD is unchanged.
- */
-export function gradeTrustedCheckouts({ grades, trustedGit, expected }) {
-  const byRepository = new Map();
-  for (const { root, label, requiredPaths } of grades) {
-    const canonicalRoot = realpathSync(root);
-    const location = locateCheckout({ root: canonicalRoot, trustedGit, label });
-    const group = byRepository.get(location.repositoryRoot) ?? {
-      location,
-      labels: [],
-      requirements: [],
-    };
-    group.labels.push(label);
-    group.requirements.push({ root: canonicalRoot, label, requiredPaths });
-    byRepository.set(location.repositoryRoot, group);
-  }
-  // A re-grade covers exactly the roots first graded: a root the first grade
-  // never saw has no HEAD to be held to, and is refused rather than re-graded
-  // unchecked.
-  if (expected !== undefined) {
-    const regraded = new Set(
-      [...byRepository.values()].flatMap((group) => group.requirements.map(({ root }) => root)),
-    );
-    for (const root of regraded) {
-      if (typeof expected.get(root)?.commit !== 'string') {
-        throw new Error(`${root} was not graded first, so its HEAD cannot be held unchanged`);
-      }
-    }
-    for (const root of expected.keys()) {
-      if (!regraded.has(root)) {
-        throw new Error(`${root} was graded first and is missing from the re-grade`);
-      }
-    }
-  }
-  const result = new Map();
-  for (const [repositoryRoot, group] of byRepository) {
-    assertTrustedCheckoutLocation(group.location, group.labels.join(' + '));
-    const graded = verifyCheckoutContents({
-      repositoryRoot,
-      requirements: group.requirements,
-      trustedGit,
-      expectedCommit: expected?.get(group.requirements[0].root).commit,
-    });
-    for (const { root } of group.requirements) {
-      if (expected !== undefined && expected.get(root).commit !== graded.commit) {
-        throw new Error(`${repositoryRoot} HEAD changed during verification`);
-      }
-      result.set(root, graded);
-    }
-  }
-  return result;
-}
-
-/**
- * A verifier input (the evidence tree, the replay state) must live outside every
- * graded checkout: a path inside one is graded as source, not as input.
- */
-export function assertExternalInput(repositoryRoots, path, label) {
-  const canonical = realpathSync(path);
-  for (const repositoryRoot of repositoryRoots) {
-    const rel = relative(repositoryRoot, canonical);
-    if (rel === '' || (!rel.startsWith(`..${sep}`) && rel !== '..')) {
-      throw new Error(`${label} must be outside the checkout ${repositoryRoot}`);
-    }
-  }
-  return canonical;
-}

package/edition/evidence-grammars.mjs

@@ -1,18 +0,0 @@
-// The lexical grammars the evidence plane checks, declared once. The kernel
-// states the same shapes inside its schemas (`@xemahq/contracts` distribution
-// schemas keep them module-private and export no pattern), so the evidence
-// plane has no kernel export to import; this is the ONE CLI declaration every
-// evidence module reads.
-
-/** A full 40-hex lowercase git commit. */
-export const COMMIT_PATTERN = /^[a-f0-9]{40}$/;
-/** 64 lowercase hex digits, no algorithm prefix. */
-export const SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/;
-/** An OCI/sigstore content digest: `sha256:` and 64 lowercase hex digits. */
-export const SHA256_DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
-/** `owner/repository` of a GitHub repository. */
-export const GITHUB_REPOSITORY_PATTERN = /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/;
-/** A policy, subject or run identifier: alphanumeric ends, `._:/@+-` inside, at most 256 characters. */
-export const CANONICAL_IDENTIFIER = /^[a-zA-Z0-9](?:[a-zA-Z0-9._:/@+-]{0,254}[a-zA-Z0-9])?$/;
-/** A GitHub branch or tag ref. */
-export const GITHUB_REF_PATTERN = /^refs\/(?:heads|tags)\/.+$/;

package/edition/evidence-input-mode.mjs

@@ -1,136 +0,0 @@
-// evidence-input-mode — where a producer-side evidence verb takes its kernel contract authority and schemas from.
-//
-// Vendor mode (`--data-root <dir> --kernel <dir>`): the authority the data root's evidence-trust pin records, and the
-// schemas of a kernel checkout at that commit. Public-input mode (`--contract-authority <file>`): a third-party
-// publisher's run, on public inputs only. The authority is the file, and the schemas are the `@xemahq/contracts` this
-// CLI bundles, proved to be that authority. There is no data root, no kernel checkout and no vendor trust policy; what
-// needs the vendor's trust policy is checked at the vendor's admission.
-//
-// `readPublicContractAuthority` is the one resolution of a `--contract-authority` file, shared by
-// `evidence assemble-third-party-input`, `statement producer <stage|accept>` and `oci <attach-plan|validate>`.
-
-import { readFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
-
-import { KernelContractAuthoritySchema } from '@xemahq/contracts/distribution';
-
-import { readKernelEditionProtocol } from './edition-protocol.mjs';
-import {
-  WorkspaceRoot,
-  configureEditionWorkspaceFromArgv,
-  kernelPackageDir,
-  stateKernelPackageDir,
-} from './edition-workspace.mjs';
-import { KERNEL_PACKAGE_NAME, assertKernelPackageIsCatalogueAuthority, shippedKernelPackageDir } from './kernel-package.mjs';
-import { loadKernelDistributionSchemas } from './lib.mjs';
-
-/** The two closed ways a producer-side evidence verb is given its kernel contract authority. */
-export const EvidenceInputMode = Object.freeze({
-  /** `--data-root` and `--kernel`: the vendor's pinned authority and kernel checkout. */
-  Vendor: 'vendor',
-  /** `--contract-authority`: a publisher's run on public inputs, with the kernel this CLI bundles. */
-  PublicInput: 'public-input',
-});
-
-const CONTRACT_AUTHORITY_FLAG = '--contract-authority';
-const VENDOR_FLAGS = ['--data-root', '--kernel'];
-
-const flagOf = (arg) => {
-  const eq = typeof arg === 'string' ? arg.indexOf('=') : -1;
-  return eq > 0 ? arg.slice(0, eq) : arg;
-};
-
-const readVersion = (packageJsonPath) => {
-  const { version } = JSON.parse(readFileSync(packageJsonPath, 'utf8'));
-  if (typeof version !== 'string' || version.length === 0) {throw new Error(`${packageJsonPath} has no "version"`);}
-  return version;
-};
-
-/**
- * The contract authority of a `--contract-authority` file, proved to be the kernel this CLI bundles (`kernelDir`),
- * and that kernel's distribution schemas. An authority whose contracts digest is not the bundled one is refused
- * first, naming both digests: the publisher installs the xema CLI whose bundled `@xemahq/contracts` is that authority.
- * The file is then strict-parsed by the kernel's `KernelContractAuthoritySchema` (imported from `@xemahq/contracts/distribution`, this CLI's own dependency, which is the bundled package) (an unknown or missing field is
- * refused) and returned in the schema's form, so its key order is never what a later comparison sees.
- *
- * `sourceCommit` is held to the schema's shape only: it is provenance, which the bundled package cannot prove. The
- * vendor holds it, comparing the statement's whole authority with its pinned one at the third-party pin writer
- * (`assertImageStatementBindsPin`, third-party-source-evidence.mjs).
- */
-export async function readPublicContractAuthority({ path, kernelDir = kernelPackageDir() }) {
-  let contractAuthority;
-  try {
-    contractAuthority = JSON.parse(readFileSync(path, 'utf8'));
-  } catch (error) {
-    throw new Error(`${CONTRACT_AUTHORITY_FLAG} ${path} is not a JSON kernel contract authority: ${error.message}`);
-  }
-  if (typeof contractAuthority !== 'object' || contractAuthority === null || Array.isArray(contractAuthority)) {
-    throw new Error(`${CONTRACT_AUTHORITY_FLAG} ${path} does not hold one kernel contract authority object`);
-  }
-  const bundledDigest = readKernelEditionProtocol(kernelDir).contentDigest;
-  if (contractAuthority.contentDigest !== bundledDigest) {
-    const cli = readVersion(new URL('../package.json', import.meta.url));
-    const contracts = readVersion(join(kernelDir, 'package.json'));
-    throw new Error(
-      `${CONTRACT_AUTHORITY_FLAG} ${path} is kernel contracts digest ${JSON.stringify(contractAuthority.contentDigest)}, ` +
-        `but this CLI (@xemahq/xema ${cli}) bundles ${KERNEL_PACKAGE_NAME} ${contracts}, digest ${bundledDigest}; ` +
-        `install the @xemahq/xema version whose bundled ${KERNEL_PACKAGE_NAME} has digest ${JSON.stringify(contractAuthority.contentDigest)}`,
-    );
-  }
-  const parsed = KernelContractAuthoritySchema.safeParse(contractAuthority);
-  if (!parsed.success) {
-    const issues = parsed.error.issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`).join('; ');
-    throw new Error(`${CONTRACT_AUTHORITY_FLAG} ${path} is not a kernel contract authority: ${issues}`);
-  }
-  contractAuthority = parsed.data;
-  try {
-    const schemas = await assertKernelPackageIsCatalogueAuthority({
-      catalogue: { contractAuthority },
-      kernelPackageDir: kernelDir,
-      loadSchemas: loadKernelDistributionSchemas,
-    });
-    return { contractAuthority, schemas };
-  } catch (error) {
-    throw new Error(
-      `${CONTRACT_AUTHORITY_FLAG} ${path} is not the kernel this CLI ships (${kernelDir}): ${error.message}; ` +
-        `install the xema CLI version whose ${KERNEL_PACKAGE_NAME} is that authority`,
-    );
-  }
-}
-
-/**
- * Configure a producer-side evidence verb from its argv in exactly one mode. `--contract-authority <file>` together
- * with `--data-root`/`--kernel`, or neither, is refused by name.
- *
- * Vendor mode configures the Data and Kernel roots and returns `{mode, rest}`; the verb reads its pinned authority.
- * Public-input mode configures no root, states the bundled kernel as the Kernel root and returns
- * `{mode, rest, contractAuthority, schemas}` from {@link readPublicContractAuthority}.
- */
-export async function configureEvidenceInputMode(argv, { verb }) {
-  const authorityAt = argv.findIndex((arg) => flagOf(arg) === CONTRACT_AUTHORITY_FLAG);
-  const vendorFlags = VENDOR_FLAGS.filter((flag) => argv.some((arg) => flagOf(arg) === flag));
-  const modes = `${CONTRACT_AUTHORITY_FLAG} <file> (public-input mode) or --data-root <dir> --kernel <dir> (vendor mode)`;
-  if (authorityAt !== -1 && vendorFlags.length > 0) {
-    throw new Error(`${verb}: ${CONTRACT_AUTHORITY_FLAG} and ${vendorFlags.join('/')} are two modes; pass one: ${modes}`);
-  }
-  if (authorityAt === -1 && vendorFlags.length === 0) {
-    throw new Error(`${verb} needs ${modes}`);
-  }
-  if (authorityAt === -1) {
-    return { mode: EvidenceInputMode.Vendor, rest: configureEditionWorkspaceFromArgv(argv, [WorkspaceRoot.Data, WorkspaceRoot.Kernel]) };
-  }
-  const arg = argv[authorityAt];
-  const inline = arg.length > CONTRACT_AUTHORITY_FLAG.length;
-  const path = inline ? arg.slice(CONTRACT_AUTHORITY_FLAG.length + 1) : argv[authorityAt + 1];
-  if (typeof path !== 'string' || path.length === 0 || path.startsWith('--')) {
-    throw new Error(`${CONTRACT_AUTHORITY_FLAG} requires a file path`);
-  }
-  if (argv.some((other, index) => index !== authorityAt && flagOf(other) === CONTRACT_AUTHORITY_FLAG)) {
-    throw new Error(`${CONTRACT_AUTHORITY_FLAG} is given more than once`);
-  }
-  const remaining = argv.filter((_, index) => index !== authorityAt && (inline || index !== authorityAt + 1));
-  const rest = configureEditionWorkspaceFromArgv(remaining, [], { refuseOthers: true });
-  stateKernelPackageDir(shippedKernelPackageDir());
-  const { contractAuthority, schemas } = await readPublicContractAuthority({ path: resolve(path) });
-  return { mode: EvidenceInputMode.PublicInput, rest, contractAuthority, schemas };
-}