@xemahq/repo-build-tooling 0.26.4 → 0.27.0

package/README.md

@@ -34,7 +34,6 @@ pnpm exec xema-scrub-swagger-paths dist
 | `xema-arm64-supplement-needed` | Decides whether an arm64 supplement is still owed at `REGISTRY/IMAGE:CONTENT_TAG` (env: `REGISTRY`, `IMAGE`, `CONTENT_TAG`, `REGISTRY_USER`, `REGISTRY_TOKEN`). `needed=false` only when the coordinate serves an index whose linux/arm64 child is proven by its own image config; any other resolvable state is `needed=true`; a 401/403/5xx or an unresolvable child is an error. Writes `needed=true\|false` to `$GITHUB_OUTPUT`. Replaces the generated `arm64-supplement-needed.mjs` copy. |
 | `xema-promote-image --service <name> --dev-ref <repo> --release-ref <repo> --tag <tag> --commit <sha> --main-ref <ref> --signer-repository <owner/repo> --develop-workflow <file> --release-workflow <file>... [--release-index-workflow <file>] --promotion-predicate-out <path> -- <tag command>` | Publishes the develop image's digest under the release tag instead of rebuilding: `reused` (the release digest carries an `image-promotion/v1` attestation signed by a `--release-workflow` identity on main, with exactly one verified statement about the digest and a `ghcr.io/<owner>/dev/<name>` source; no dev-ref probe), `copied` (the proven develop digest, digest-preserving; fails closed if the release digest differs) or `miss` (build it; a reuse whose release digest has no `image-promotion/v1` attestation, a legacy image, is a miss with `reason=reuse-no-promotion` on the stdout line; with `--release-index-workflow`, a release tag that names an image index signed by that workflow on main, with exactly one `linux/amd64` child whose own digest passes that same reuse check, is instead `reused` with `evidence=release-index`, `digest` = the amd64 child A, `index_digest` = the index D and no predicate, but only when A's selected promotion statement promotes `--commit` itself (a rerun; a later commit with the same content takes the existing miss and attests its own promotion). On `evidence=release-index` the caller skips sign/attest, tags `:<sha>` and `main-<sha>` to the amd64 subject `digest` (release-arm64 resolves `:<sha>` to it and verifies its promotion), and points only the content tag (and `latest`, if it moves it) at the index `index_digest`. Any failed step keeps the miss, and two amd64 children are an error; a signature or identity failure, or a source outside `dev/`, is an error; a copy whose dev digest carries no SLSA v1 provenance at all, an image reused on develop from before provenance, is a miss with `reason=copy-no-develop-provenance`, while provenance that is present but fails a leg is an error). A develop digest is proven only if its SLSA v1 provenance is signed by the develop workflow at `refs/heads/develop`, its revision is an ancestor of the main ref, and the tag command prints the same tag at that revision and at `--commit`; any failed leg is an error, never a miss. On every non-miss result it writes the `https://xema.dev/attestations/image-promotion/v1` predicate for the caller to attest: a copy states the facts just proved; a reuse states this run's `release` and `promotedCommit` and carries `source` and `developProvenance` from the earlier promotion. Writes `result`, `digest`, `source`, `revision`, `evidence`, `provenance_digest`, `promotion_predicate`, `promotion_predicate_type` to `$GITHUB_OUTPUT`. Needs `docker`, `cosign` (major v2, the same as the develop attest step and xema-deploy's verify; it runs `cosign version` first and refuses any other major or an unparsable version), `git` and full history. It does not sign |
 | `xema-check-no-vendored-deps` | Fails on a `workspace:` range for a package the repository does not own |
-| `xema-prepush-sanity` | Lefthook `pre-push`: turbo `lint` and `typecheck` on what the push changes plus dependents, and `test` and `openapi:current` (where defined) only on the packages the push changed; a fleet-wide change runs only `lint` and `typecheck` on the full graph; root `lint` only without turbo; a park-only push (`refs/xema-session/*`) skips |
 | `xema-check-workspace-ranges` | Fails on a `workspace:` range the local package does not satisfy |
 
 `xema-composed-image members --write|--check` accepts `--manifests <glob>` (repeatable, default `**/xema-biome.json`), `--canonical-dockerfile <path>` and `--cross-repo-manifest <path>`. `xema-composed-image dockerfile` requires `--copy`, `--cache-id` and `--build-source`; it pins the version of this tool itself, and there is no flag for it (`--tooling-version` is refused as an unknown option).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/repo-build-tooling",
-  "version": "0.26.4",
+  "version": "0.27.0",
   "description": "Dev-time build tooling shared by every Xema repository. Ships as plain ESM, depending only on @xemahq/release-policy for registry access, so the published artifact is the reviewed source.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -25,8 +25,6 @@
     "xema-check-no-vendored-deps": "src/check-no-vendored-deps.mjs",
     "xema-check-workspace-ranges": "src/check-workspace-range-matches-local.mjs",
     "xema-composed-image": "src/composed-image.mjs",
-    "xema-install-git-hooks": "src/install-git-hooks.mjs",
-    "xema-prepush-sanity": "src/prepush-sanity.mjs",
     "xema-promote-image": "src/promote-image.mjs",
     "xema-readiness": "src/readiness.mjs",
     "xema-scrub-swagger-paths": "src/scrub-swagger-plugin-paths.mjs",
@@ -38,9 +36,7 @@
     "./check-no-vendored-deps": "./src/check-no-vendored-deps.mjs",
     "./check-workspace-range-matches-local": "./src/check-workspace-range-matches-local.mjs",
     "./composed-image": "./src/composed-image.mjs",
-    "./install-git-hooks": "./src/install-git-hooks.mjs",
     "./package.json": "./package.json",
-    "./prepush-sanity": "./src/prepush-sanity.mjs",
     "./promote-image": "./src/promote-image.mjs",
     "./readiness": "./src/readiness.mjs",
     "./scrub-swagger-plugin-paths": "./src/scrub-swagger-plugin-paths.mjs",
@@ -51,9 +47,9 @@
     "@xemahq/release-policy": "^16.0.0"
   },
   "scripts": {
-    "test": "node src/scrub-swagger-plugin-paths.mjs --self-test && node --test src/check-workspace-range-matches-local.test.mjs && node --test src/check-no-vendored-deps.test.mjs && node --test src/readiness.test.mjs && node --test src/composed-image.test.mjs && node --test src/composed-image-coordinate-cli.test.mjs && node --test src/declaration-refusal.test.mjs && node --test src/smoke-refusal.test.mjs && node --test src/load-image.test.mjs && node --test src/composed-image-coordinate.test.mjs && node --test src/composed-image-dockerfile.test.mjs && node --test src/service-bootstrap.test.mjs && node --test src/service-bootstrap-protocols.test.mjs && node --test src/composed-image-prebuilt-dockerfile.test.mjs && node --test src/composed-image-in-image-closure.test.mjs && node --test src/composed-image-stage.test.mjs && node --test src/composed-image-stage-tree.test.mjs && node --test src/composed-image-install.test.mjs && node --test src/composed-image-proof.test.mjs && node --test src/composed-image-pnpm-context.test.mjs && node --test src/composed-image-sync-injected.test.mjs && node --test src/composed-image-prisma-check.test.mjs && node --test src/composed-image-prisma-engine.test.mjs && node --test src/composed-migrate.test.mjs && node --test src/promote-image.test.mjs && node --test src/arm64-supplement-needed.test.mjs && node --test src/prepush-sanity.test.mjs && node --test src/service-image.test.mjs && node --test src/install-git-hooks.test.mjs && node --test src/image-cpu-arch.test.mjs"
+    "test": "node src/scrub-swagger-plugin-paths.mjs --self-test && node --test src/check-workspace-range-matches-local.test.mjs && node --test src/check-no-vendored-deps.test.mjs && node --test src/readiness.test.mjs && node --test src/composed-image.test.mjs && node --test src/composed-image-coordinate-cli.test.mjs && node --test src/declaration-refusal.test.mjs && node --test src/smoke-refusal.test.mjs && node --test src/load-image.test.mjs && node --test src/composed-image-coordinate.test.mjs && node --test src/composed-image-dockerfile.test.mjs && node --test src/service-bootstrap.test.mjs && node --test src/service-bootstrap-protocols.test.mjs && node --test src/composed-image-prebuilt-dockerfile.test.mjs && node --test src/composed-image-in-image-closure.test.mjs && node --test src/composed-image-stage.test.mjs && node --test src/composed-image-stage-tree.test.mjs && node --test src/composed-image-install.test.mjs && node --test src/composed-image-proof.test.mjs && node --test src/composed-image-pnpm-context.test.mjs && node --test src/composed-image-sync-injected.test.mjs && node --test src/composed-image-prisma-check.test.mjs && node --test src/composed-image-prisma-engine.test.mjs && node --test src/composed-migrate.test.mjs && node --test src/promote-image.test.mjs && node --test src/arm64-supplement-needed.test.mjs && node --test src/service-image.test.mjs && node --test src/image-cpu-arch.test.mjs"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:c6b72c65876d81f6a2548bb6da641b908eccb57c9a6ecaa435e31da9b237d75e"
+    "sourceDigest": "sha256:4a2cf6b565691b2837d7562f58925a40e3ad2284eded9395b72a74312788d417"
   }
 }

package/src/composed-image-install.mjs

@@ -10,7 +10,8 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 import { assertPinsUnchanged } from './composed-image-in-image.mjs';
-import { nodeArch } from './service-image-platform.mjs';
+import { pruneForeignLibcPackages } from './prune-foreign-libc.mjs';
+import { libcOf, nodeArch } from './service-image-platform.mjs';
 
 /** The install-flag words that make pnpm copy workspace packages into the store layout. */
 export const injectFlags = () => ['--config.inject-workspace-packages=true', '--config.dedupe-injected-deps=false'];
@@ -27,7 +28,7 @@ export const lockfileOnlyCommand = (filters) => ['pnpm', 'install', '--lockfile-
 /** The production install for `filters` on `linux/<arch>` as `[file, ...args]`. */
 export const productionInstallCommand = (filters, arch) => [
   'pnpm', 'install', '--prod', '--offline', '--ignore-scripts', ...injectFlags(), ...filters, '--frozen-lockfile',
-  '--os=linux', `--cpu=${nodeArch(arch)}`, '--libc=glibc',
+  '--os=linux', `--cpu=${nodeArch(arch)}`, `--libc=${libcOf(arch)}`,
 ];
 
 const defaultExec = (file, args, { cwd }) => execFileSync(file, args, { cwd, stdio: 'inherit' });
@@ -47,6 +48,8 @@ export function installClosure({ treeRoot, filters, arch, exec = defaultExec })
     assertPinsUnchanged({ root: treeRoot, committedLockfile: committed });
     const [installFile, ...installArgs] = productionInstallCommand(filters, arch);
     exec(installFile, installArgs, { cwd: treeRoot });
+    // pnpm 10.33 frozen offline install does not filter by libc; cpu/os do.
+    pruneForeignLibcPackages(treeRoot, libcOf(arch));
   } finally {
     rmSync(scratch, { recursive: true, force: true });
   }

package/src/image-cpu-arch.test.mjs

@@ -2,13 +2,14 @@
 // optional x64 binary, so an amd64 image lost its @swc/core binding.
 import assert from 'node:assert/strict';
 import { execFileSync } from 'node:child_process';
-import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import test from 'node:test';
 import { injectFlags, productionInstallCommand } from './composed-image-install.mjs';
 import { deployArgs } from './service-image-stage.mjs';
-import { nodeArch } from './service-image-platform.mjs';
+import { pruneForeignLibcPackages } from './prune-foreign-libc.mjs';
+import { libcOf, nodeArch } from './service-image-platform.mjs';
 
 test('nodeArch maps amd64 to x64 and arm64 to arm64, and refuses an arch with no row', () => {
   assert.equal(nodeArch('amd64'), 'x64');
@@ -38,8 +39,9 @@ test('an amd64 stage installs @swc/core-linux-x64-gnu and no arm64 binding; arm6
   t.after(() => rmSync(dir, { recursive: true, force: true }));
   const x64 = fixturePackage(dir, '@swc/core-linux-x64-gnu', { os: ['linux'], cpu: ['x64'], libc: ['glibc'] });
   const arm64 = fixturePackage(dir, '@swc/core-linux-arm64-gnu', { os: ['linux'], cpu: ['arm64'], libc: ['glibc'] });
+  const x64musl = fixturePackage(dir, '@swc/core-linux-x64-musl', { os: ['linux'], cpu: ['x64'], libc: ['musl'] });
   const core = fixturePackage(dir, '@swc/core', {
-    optionalDependencies: { '@swc/core-linux-x64-gnu': `file:${x64}`, '@swc/core-linux-arm64-gnu': `file:${arm64}` },
+    optionalDependencies: { '@swc/core-linux-x64-gnu': `file:${x64}`, '@swc/core-linux-x64-musl': `file:${x64musl}`, '@swc/core-linux-arm64-gnu': `file:${arm64}` },
   });
   const store = join(dir, 'store');
   const env = { ...process.env, npm_config_store_dir: store };
@@ -51,17 +53,73 @@ test('an amd64 stage installs @swc/core-linux-x64-gnu and no arm64 binding; arm6
     }
   };
   for (const arch of ['amd64', 'arm64']) {
+    const manifest = JSON.stringify({ name: 'app', version: '1.0.0', dependencies: { '@swc/core': `file:${core}` } });
+    // Prime from a SEPARATE directory so the project under test carries no install state recording libc=*.
+    const prime = join(dir, `prime-${arch}`);
+    mkdirSync(prime);
+    writeFileSync(join(prime, 'package.json'), manifest);
+    // Resolve and fetch every platform's tarball into the store, as the real stage's committed lockfile and primed store do.
+    run(prime, ['install', '--ignore-workspace', '--ignore-scripts', ...injectFlags(), '--force', '--config.supported-architectures.cpu=*', '--config.supported-architectures.os=*', '--config.supported-architectures.libc=*']);
     const app = join(dir, `app-${arch}`);
     mkdirSync(app);
-    writeFileSync(join(app, 'package.json'), JSON.stringify({ name: 'app', version: '1.0.0', dependencies: { '@swc/core': `file:${core}` } }));
-    // Resolve and fetch every platform's tarball into the store, as the real stage's committed lockfile and primed store do.
-    run(app, ['install', '--ignore-workspace', '--ignore-scripts', ...injectFlags(), '--force', '--config.supported-architectures.cpu=*', '--config.supported-architectures.os=*', '--config.supported-architectures.libc=*']);
-    rmSync(join(app, 'node_modules'), { recursive: true, force: true });
+    writeFileSync(join(app, 'package.json'), manifest);
+    copyFileSync(join(prime, 'pnpm-lock.yaml'), join(app, 'pnpm-lock.yaml'));
     const [file, ...args] = productionInstallCommand(['--ignore-workspace'], arch);
     run(app, args);
     assert.equal(file, 'pnpm');
+    // pnpm 10.33 frozen offline install does not filter by libc; cpu/os do. The prune is what keeps musl out.
+    pruneForeignLibcPackages(app, libcOf(arch), () => {});
     const present = (binding) => existsSync(join(app, 'node_modules', '.pnpm', 'node_modules', '@swc', binding));
     assert.equal(present('core-linux-x64-gnu'), arch === 'amd64', `${arch}: x64 binding`);
+    assert.equal(present('core-linux-x64-musl'), false, `${arch}: a glibc image stages no musl binding`);
     assert.equal(present('core-linux-arm64-gnu'), arch === 'arm64', `${arch}: arm64 binding`);
   }
 });
+
+test('libcOf reads the IMAGE_PLATFORMS row and refuses an unknown arch', () => {
+  assert.equal(libcOf('amd64'), 'glibc');
+  assert.throws(() => libcOf('riscv64'), /no libc for image arch 'riscv64'/);
+});
+
+// A hand-built pnpm layout: .pnpm/<entry>/node_modules/<name> is the package, siblings are links to dependencies.
+function layout(root, packages, links) {
+  for (const [entry, name, manifest] of packages) {
+    const dir = join(root, 'node_modules', '.pnpm', entry, 'node_modules', name);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, 'package.json'), JSON.stringify({ name, version: '1.0.0', ...manifest }));
+  }
+  for (const [from, name, toEntry, toName] of links) {
+    const linkDir = join(root, 'node_modules', '.pnpm', from, 'node_modules');
+    symlinkSync(join(root, 'node_modules', '.pnpm', toEntry, 'node_modules', toName), join(linkDir, name));
+  }
+}
+
+test('prune removes only packages declaring a foreign libc, with their links; a package without libc is untouched', (t) => {
+  const root = mkdtempSync(join(tmpdir(), 'xema-prune-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  layout(root, [
+    ['core@1', 'core', { optionalDependencies: { gnu: '1', musl: '1' } }],
+    ['gnu@1', 'gnu', { libc: ['glibc'] }],
+    ['musl@1', 'musl', { libc: ['musl'] }],
+    ['plain@1', 'plain', {}],
+  ], [['core@1', 'gnu', 'gnu@1', 'gnu'], ['core@1', 'musl', 'musl@1', 'musl']]);
+  const lines = [];
+  assert.deepEqual(pruneForeignLibcPackages(root, 'glibc', (line) => lines.push(line)), ['musl@1']);
+  assert.equal(lines.length, 1);
+  const store = join(root, 'node_modules', '.pnpm');
+  assert.equal(existsSync(join(store, 'musl@1')), false);
+  assert.equal(lstatSync(join(store, 'core@1', 'node_modules', 'musl'), { throwIfNoEntry: false }), undefined);
+  for (const kept of ['gnu@1', 'plain@1', 'core@1']) assert.ok(existsSync(join(store, kept)), kept);
+  assert.ok(existsSync(join(store, 'core@1', 'node_modules', 'gnu', 'package.json')));
+});
+
+test('prune throws, naming both, when a kept package hard-depends on a pruned one', (t) => {
+  const root = mkdtempSync(join(tmpdir(), 'xema-prune-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  layout(root, [
+    ['app@1', 'app', { dependencies: { musl: '1' } }],
+    ['musl@1', 'musl', { libc: ['musl'] }],
+  ], [['app@1', 'musl', 'musl@1', 'musl']]);
+  assert.throws(() => pruneForeignLibcPackages(root, 'glibc', () => {}), /app depends on musl/);
+  assert.ok(existsSync(join(root, 'node_modules', '.pnpm', 'musl@1')));
+});

package/src/prune-foreign-libc.mjs

@@ -0,0 +1,96 @@
+// pnpm 10.33's frozen offline install does not filter packages by `libc` (cpu and os it does), so a glibc image's
+// tree also holds the musl bindings (`@swc/core-linux-x64-musl`). This removes every package that DECLARES a `libc`
+// list without the target's, and the symlinks to it. A package with no `libc` field is never touched.
+// Upstream: no pnpm issue found 2026-10-17 that tracks libc being ignored by supportedArchitectures/--libc in frozen
+// offline installs (nearest, not the same: pnpm/pnpm#11702, `pnpm add` on 11.1.2). Not fixed as of pnpm 10.33.
+// Delete this module at the first pnpm raise that filters libc (fixed in pnpm <version>).
+import { existsSync, lstatSync, readdirSync, readFileSync, readlinkSync, rmSync, unlinkSync } from 'node:fs';
+import { dirname, join, resolve, sep } from 'node:path';
+
+const readJson = (file) => JSON.parse(readFileSync(file, 'utf8'));
+const isDirectory = (path) => {
+  try {
+    return lstatSync(path).isDirectory();
+  } catch (error) {
+    if (error.code === 'ENOENT' || error.code === 'ENOTDIR') return false;
+    throw error;
+  }
+};
+
+/** The real (non-symlink) package directories under a `node_modules`, scoped ones included: `[{ name, dir }]`. */
+function realPackages(nodeModules) {
+  const found = [];
+  if (!isDirectory(nodeModules)) return found;
+  for (const entry of readdirSync(nodeModules)) {
+    const path = join(nodeModules, entry);
+    if (!isDirectory(path)) continue;
+    if (entry.startsWith('@')) {
+      for (const child of readdirSync(path)) if (isDirectory(join(path, child))) found.push({ name: `${entry}/${child}`, dir: join(path, child) });
+    } else {
+      found.push({ name: entry, dir: path });
+    }
+  }
+  return found;
+}
+
+/** Every symlink directly under `nodeModules` (scoped children included): absolute paths. */
+function symlinksIn(nodeModules) {
+  const links = [];
+  if (!isDirectory(nodeModules)) return links;
+  for (const entry of readdirSync(nodeModules)) {
+    const path = join(nodeModules, entry);
+    const stat = lstatSync(path);
+    if (stat.isSymbolicLink()) links.push(path);
+    else if (entry.startsWith('@') && stat.isDirectory()) {
+      for (const child of readdirSync(path)) if (lstatSync(join(path, child)).isSymbolicLink()) links.push(join(path, child));
+    }
+  }
+  return links;
+}
+
+/**
+ * Remove, under `<stagedRoot>/node_modules/.pnpm`, every package whose `libc` array lacks `libc`, with the symlinks
+ * to it. Throws, naming both, when a package that stays depends on a removed one non-optionally. Returns the removed
+ * `.pnpm` entry names, one log line each.
+ */
+export function pruneForeignLibcPackages(stagedRoot, libc, log = (line) => console.log(line)) {
+  const store = join(stagedRoot, 'node_modules', '.pnpm');
+  if (!isDirectory(store)) return [];
+  const removed = new Map(); // entry -> package name
+  const kept = [];
+  for (const entry of readdirSync(store)) {
+    const entryDir = join(store, entry);
+    if (entry === 'node_modules' || entry === 'lock.yaml' || !isDirectory(entryDir)) continue;
+    for (const { name, dir } of realPackages(join(entryDir, 'node_modules'))) {
+      const manifestFile = join(dir, 'package.json');
+      if (!existsSync(manifestFile)) continue;
+      const manifest = readJson(manifestFile);
+      // The entry's own package is the one whose directory is not a dependency link; a dependency's real dir lives in its own entry.
+      if (Array.isArray(manifest.libc) && !manifest.libc.includes(libc)) removed.set(entry, name);
+      else kept.push({ entry, name, manifest });
+    }
+  }
+  if (removed.size === 0) return [];
+  const removedNames = new Set(removed.values());
+  for (const { name, manifest } of kept) {
+    for (const dependency of Object.keys(manifest.dependencies ?? {})) {
+      if (removedNames.has(dependency)) {
+        throw new Error(`${name} depends on ${dependency} (not optionally), which declares a libc without '${libc}' and would be removed; refusing to break the image`);
+      }
+    }
+  }
+  const doomed = [...removed.keys()].map((entry) => join(store, entry) + sep);
+  const nodeModulesDirs = [join(stagedRoot, 'node_modules'), join(store, 'node_modules')];
+  for (const entry of readdirSync(store)) nodeModulesDirs.push(join(store, entry, 'node_modules'));
+  for (const directory of nodeModulesDirs) {
+    for (const link of symlinksIn(directory)) {
+      const target = resolve(dirname(link), readlinkSync(link)) + sep;
+      if (doomed.some((prefix) => target.startsWith(prefix))) unlinkSync(link);
+    }
+  }
+  for (const [entry, name] of removed) {
+    rmSync(join(store, entry), { recursive: true, force: true });
+    log(`pruned ${name} (.pnpm/${entry}): declares a libc without '${libc}'`);
+  }
+  return [...removed.keys()];
+}

package/src/scrub-swagger-plugin-paths.mjs

@@ -129,7 +129,7 @@
 
 import { createRequire } from 'node:module';
 import { readFileSync, realpathSync } from 'node:fs';
-import { mkdir, mkdtemp, readdir, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, readdir, readFile, rm, stat, symlink, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import process from 'node:process';
@@ -168,14 +168,14 @@ const FLAT_LEAK_REGEX = new RegExp(
 // and down into the contracts package.  There is no `node_modules/` segment
 // so shapes 1 and 2 above never fire.
 // Capture group 1: relative path from the scrubbed file to the package directory.
-// Capture group 2: first path segment after dist/ = the subpath export name.
+// Capture group 2: everything after dist/ (the physical subpath inside the package).
 // The public package name is NOT derived from the directory name or a fixed
 // scope: it is read from the target package's own package.json `name`, so
 // unscoped and differently-named workspace packages resolve correctly.
 // Scoped to paths that pass through `packages/`, `biomes/`, or `kernel/` to
 // avoid false-positive matches on intra-service relative requires.
 const RELATIVE_WORKSPACE_REGEX = new RegExp(
-  `require\\("((?:\\.\\./)+(?:packages|biomes|kernel)/(?:[a-z0-9][a-z0-9.-]*/)*[a-z0-9][a-z0-9.-]*)/dist/([a-z0-9][a-z0-9-]*)(?:/[^"]*)?"\\)`,
+  `require\\("((?:\\.\\./)+(?:packages|biomes|kernel)/(?:[a-z0-9][a-z0-9.-]*/)*[a-z0-9][a-z0-9.-]*)/dist/([a-z0-9][a-z0-9-]*(?:/[^"]*)?)"\\)`,
   'g',
 );
 
@@ -323,6 +323,7 @@ function reExportsReach(entry, target, depth = 6, seen = new Set()) {
  * @param {string} pkg      e.g. `@xemahq/kernel-contracts`
  * @param {string} subpath  physical path inside the package, e.g. `dist/agent-composition/lib/x`
  * @param {string} original the full leaked specifier, for the proof and the error
+ * @param {string} [importer] the file holding the require, named in the refusal
  */
 // NUL is the separator in the cache key because it cannot occur in a package
 // name or a subpath, so no two distinct specifiers can collide on a
@@ -332,7 +333,7 @@ function reExportsReach(entry, target, depth = 6, seen = new Set()) {
 // silently, and a file no search can read is a file no audit, no review and no
 // boundary check covers. Enforced by the aggregator boundary gate
 // `grep-readable-sources`.
-function publicSpecifierFor(resolveFrom, pkg, subpath, original) {
+function publicSpecifierFor(resolveFrom, pkg, subpath, original, importer) {
   const cacheKey = `${pkg}\u0000${subpath}`;
   if (specifierCache.has(cacheKey)) return specifierCache.get(cacheKey);
 
@@ -412,6 +413,7 @@ function publicSpecifierFor(resolveFrom, pkg, subpath, original) {
   throw new ScrubFailure(
     `no public specifier of ${pkg} resolves to the same file as\n` +
       `  ${original}\n` +
+      (importer ? `  required by ${importer}\n` : '') +
       `  tried: ${candidates.length > 0 ? candidates.join(', ') : '(none — the exports map admits no matching form)'}\n` +
       `  Add the needed entry to that package's "exports", or export the symbol from a\n` +
       `  path that is public. Rewriting to a specifier that resolves elsewhere would\n` +
@@ -586,10 +588,16 @@ async function scrubFile(path) {
         `  rather than reaching through dist/.`,
     );
   }
-  out = out.replace(RELATIVE_WORKSPACE_REGEX, (match, relPackageDir, subpath) => {
+  out = out.replace(RELATIVE_WORKSPACE_REGEX, (match, relPackageDir, rest) => {
     count += 1;
     const name = packageNameAt(resolve(dirname(path), relPackageDir), match);
-    return `require("${name}/${subpath}")`;
+    // Through the target's own `exports` map, never a hardcoded `<name>/<seg>`:
+    // a package that exports only "." has no such subpath, and the old form
+    // crashed at runtime with ERR_PACKAGE_PATH_NOT_EXPORTED. When the root
+    // barrel re-exports the file, the root is the proved public form; when no
+    // exported subpath reaches it, the build refuses.
+    const original = match.slice('require("'.length, -2);
+    return `require("${publicSpecifierFor(resolveFrom, name, `dist/${rest}`, original, path)}")`;
   });
   if (count > 0) {
     await writeFile(path, out, 'utf8');
@@ -712,6 +720,13 @@ async function expectFailure(label, fn) {
   return threw;
 }
 
+/** Make `name` resolvable from `consumerDir` the way a workspace install does. */
+async function linkWorkspacePackage(consumerDir, name, packageDir) {
+  const link = join(consumerDir, 'node_modules', name);
+  await mkdir(dirname(link), { recursive: true });
+  await symlink(packageDir, link, 'dir');
+}
+
 async function selfTest() {
   const root = await mkdtemp(join(tmpdir(), 'scrub-swagger-selftest-'));
   try {
@@ -830,11 +845,18 @@ async function selfTest() {
       ['packages/contracts/plain-dir', 'plain-contract'],
       ['packages/contracts/other-dir', '@xemahq/renamed'],
     ];
+    await mkdir(join(ws, 'services/svc/dist'), { recursive: true });
     for (const [dir, name] of pkgs) {
       await mkdir(join(ws, dir, 'dist/lib'), { recursive: true });
-      await writeFile(join(ws, dir, 'package.json'), JSON.stringify({ name }), 'utf8');
+      await writeFile(
+        join(ws, dir, 'package.json'),
+        JSON.stringify({ name, exports: { './*': './dist/*/index.js' } }),
+        'utf8',
+      );
+      await writeFile(join(ws, dir, 'dist/lib/index.js'), 'module.exports = require("./x");\n', 'utf8');
+      await writeFile(join(ws, dir, 'dist/lib/x.js'), 'module.exports = {};\n', 'utf8');
+      await linkWorkspacePackage(join(ws, 'services/svc'), name, join(ws, dir));
     }
-    await mkdir(join(ws, 'services/svc/dist'), { recursive: true });
     const wsFile = join(ws, 'services/svc/dist/dto.js');
     const relOf = (dir) => `../../../${dir}/dist/lib/x`;
     await writeFile(
@@ -851,6 +873,42 @@ async function selfTest() {
         throw new Error(`self-test: relative-workspace rewrite missing ${expected}: ${wsAfter}`);
       }
     }
+
+    // 4c. A package that exports ONLY "." (xema-base authorization-nest). The
+    // swagger plugin requires the enum's declaring file; `<name>/<file>` is not
+    // exported and crashed at runtime with ERR_PACKAGE_PATH_NOT_EXPORTED.
+    //   - root barrel re-exports the file -> the root is the proved form;
+    //   - no exported subpath reaches the file -> the build refuses, naming the
+    //     package, the file and the importing module.
+    const dot = join(root, 'dot');
+    const dotPkg = join(dot, 'packages/sdks/dot-only');
+    await mkdir(join(dotPkg, 'dist'), { recursive: true });
+    await mkdir(join(dot, 'svc/dist'), { recursive: true });
+    await writeFile(
+      join(dotPkg, 'package.json'),
+      JSON.stringify({ name: '@xemahq/dot-only', exports: { '.': './dist/index.js' } }),
+      'utf8',
+    );
+    await writeFile(join(dotPkg, 'dist/index.js'), 'module.exports = require("./grant-wire");\n', 'utf8');
+    await writeFile(join(dotPkg, 'dist/grant-wire.js'), 'module.exports = { Kind: {} };\n', 'utf8');
+    await writeFile(join(dotPkg, 'dist/internal-only.js'), 'module.exports = { Hidden: {} };\n', 'utf8');
+    await linkWorkspacePackage(join(dot, 'svc'), '@xemahq/dot-only', dotPkg);
+    const dotDto = (file) =>
+      `class Dto {\n  static _OPENAPI_METADATA_FACTORY() {\n    return { kind: { type: () => require("../../packages/sdks/dot-only/dist/${file}").Kind } };\n  }\n}\n`;
+    const dotFile = join(dot, 'svc/dist/dto.js');
+    await writeFile(dotFile, dotDto('grant-wire'), 'utf8');
+    await run([join(dot, 'svc/dist')]);
+    const dotAfter = await readFile(dotFile, 'utf8');
+    if (!dotAfter.includes('require("@xemahq/dot-only").Kind') || dotAfter.includes('dot-only/')) {
+      throw new Error(`self-test: a "."-only package must map to its root, got: ${dotAfter}`);
+    }
+    await writeFile(dotFile, dotDto('internal-only'), 'utf8');
+    const dotRefusal = await expectFailure('unexported file no exported subpath reaches', () => run([join(dot, 'svc/dist')]));
+    for (const named of ['@xemahq/dot-only', 'internal-only', dotFile]) {
+      if (!dotRefusal.message.includes(named)) {
+        throw new Error(`self-test: the refusal must name ${named}; got: ${dotRefusal.message}`);
+      }
+    }
     // A target directory without its own package.json is a hard failure.
     const orphan = join(root, 'orphan');
     await mkdir(join(orphan, 'svc/dist'), { recursive: true });

package/src/service-image-platform.mjs

@@ -13,8 +13,8 @@ import { join } from 'node:path';
  * schema engine Prisma would not use.
  */
 export const IMAGE_PLATFORMS = Object.freeze({
-  amd64: Object.freeze({ node: 'x64', elfMachine: 62, prismaBinaryTarget: 'debian-openssl-3.0.x' }),
-  arm64: Object.freeze({ node: 'arm64', elfMachine: 183, prismaBinaryTarget: 'linux-arm64-openssl-3.0.x' }),
+  amd64: Object.freeze({ node: 'x64', libc: 'glibc', elfMachine: 62, prismaBinaryTarget: 'debian-openssl-3.0.x' }),
+  arm64: Object.freeze({ node: 'arm64', libc: 'glibc', elfMachine: 183, prismaBinaryTarget: 'linux-arm64-openssl-3.0.x' }),
 });
 
 /** The Node `process.arch` name of an image arch (`amd64` → `x64`): what pnpm's `--cpu` takes. Refuses an arch with no row. */
@@ -25,6 +25,14 @@ export function nodeArch(arch) {
   return IMAGE_PLATFORMS[arch].node;
 }
 
+/** The libc of an image arch's runtime base (glibc: node:22-bookworm-slim), from the same row as `nodeArch`. Refuses an arch with no row. */
+export function libcOf(arch) {
+  if (!Object.hasOwn(IMAGE_PLATFORMS, arch)) {
+    throw new Error(`no libc for image arch '${arch}'; known: ${Object.keys(IMAGE_PLATFORMS).join(', ')}`);
+  }
+  return IMAGE_PLATFORMS[arch].libc;
+}
+
 /** `linux/<arch>` → `<arch>`; refuses any platform this recipe does not build. */
 export function platformArch(platform) {
   const match = /^linux\/([a-z0-9]+)$/.exec(String(platform ?? ''));

package/src/service-image-stage.mjs

@@ -31,7 +31,8 @@ import { prismaEnginesDirectories } from './composed-image-prisma-engine.mjs';
 import { copyTool, toolVersion } from './composed-image-stage.mjs';
 import { MANIFEST_FILE, MANIFEST_SCHEMA } from './service-image-in-image.mjs';
 import { LOCKFILE, TOOL_NAME, rootBuildInputNames, sha256File } from './staged-image-proof.mjs';
-import { IMAGE_PLATFORMS, nodeArch, platformArch, scanNatives } from './service-image-platform.mjs';
+import { pruneForeignLibcPackages } from './prune-foreign-libc.mjs';
+import { IMAGE_PLATFORMS, libcOf, nodeArch, platformArch, scanNatives } from './service-image-platform.mjs';
 
 
 export const DEFAULT_STAGE_DIR = '.xema-stage';
@@ -49,7 +50,7 @@ export const deployArgs = ({ service, arch, destination }) => [
   '--ignore-scripts',
   '--os=linux',
   `--cpu=${nodeArch(arch)}`,
-  '--libc=glibc',
+  `--libc=${libcOf(arch)}`,
   '--config.force-legacy-deploy=false',
   '--config.inject-workspace-packages=true',
   '--config.dedupe-injected-deps=true',
@@ -249,6 +250,8 @@ export async function stageService({
   const appDir = join(serviceStage, APP_DIRECTORY);
   mkdirSync(serviceStage, { recursive: true });
   deploy(deployArgs({ service, arch, destination: resolve(appDir) }), root);
+  // pnpm 10.33 frozen offline install does not filter by libc; cpu/os do.
+  pruneForeignLibcPackages(appDir, libcOf(arch));
   if (!existsSync(join(appDir, 'dist', 'main.js'))) problems.push(`the deploy of ${service} has no dist/main.js: is dist excluded from the package's files?`);
 
   // A dependency whose build script matters would have to run on the target; this recipe runs none.