@xemahq/repo-build-tooling 0.33.1 → 0.34.1

package/LICENSE

@@ -1,176 +1,175 @@
-Apache License
-Version 2.0, January 2004
-http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-"License" shall mean the terms and conditions for use, reproduction,
-and distribution as defined by Sections 1 through 9 of this document.
-
-"Licensor" shall mean the copyright owner or entity authorized by
-the copyright owner that is granting the License.
-
-"Legal Entity" shall mean the union of the acting entity and all
-other entities that control, are controlled by, or are under common
-control with that entity. For the purposes of this definition,
-"control" means (i) the power, direct or indirect, to cause the
-direction or management of such entity, whether by contract or
-otherwise, or (ii) ownership of fifty percent (50%) or more of the
-outstanding shares, or (iii) beneficial ownership of such entity.
-
-"You" (or "Your") shall mean an individual or Legal Entity
-exercising permissions granted by this License.
-
-"Source" form shall mean the preferred form for making modifications,
-including but not limited to software source code, documentation
-source, and configuration files.
-
-"Object" form shall mean any form resulting from mechanical
-transformation or translation of a Source form, including but
-not limited to compiled object code, generated documentation,
-and conversions to other media types.
-
-"Work" shall mean the work of authorship, whether in Source or
-Object form, made available under the License, as indicated by a
-copyright notice that is included in or attached to the work
-(an example is provided in the Appendix below).
-
-"Derivative Works" shall mean any work, whether in Source or Object
-form, that is based on (or derived from) the Work and for which the
-editorial revisions, annotations, elaborations, or other modifications
-represent, as a whole, an original work of authorship. For the purposes
-of this License, Derivative Works shall not include works that remain
-separable from, or merely link (or bind by name) to the interfaces of,
-the Work and Derivative Works thereof.
-
-"Contribution" shall mean any work of authorship, including
-the original version of the Work and any modifications or additions
-to that Work or Derivative Works thereof, that is intentionally
-submitted to Licensor for inclusion in the Work by the copyright owner
-or by an individual or Legal Entity authorized to submit on behalf of
-the copyright owner. For the purposes of this definition, "submitted"
-means any form of electronic, verbal, or written communication sent
-to the Licensor or its representatives, including but not limited to
-communication on electronic mailing lists, source code control systems,
-and issue tracking systems that are managed by, or on behalf of, the
-Licensor for the purpose of discussing and improving the Work, but
-excluding communication that is conspicuously marked or otherwise
-designated in writing by the copyright owner as "Not a Contribution."
-
-"Contributor" shall mean Licensor and any individual or Legal Entity
-on behalf of whom a Contribution has been received by Licensor and
-subsequently incorporated within the Work.
-
-2. Grant of Copyright License. Subject to the terms and conditions of
-this License, each Contributor hereby grants to You a perpetual,
-worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-copyright license to reproduce, prepare Derivative Works of,
-publicly display, publicly perform, sublicense, and distribute the
-Work and such Derivative Works in Source or Object form.
-
-3. Grant of Patent License. Subject to the terms and conditions of
-this License, each Contributor hereby grants to You a perpetual,
-worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-(except as stated in this section) patent license to make, have made,
-use, offer to sell, sell, import, and otherwise transfer the Work,
-where such license applies only to those patent claims licensable
-by such Contributor that are necessarily infringed by their
-Contribution(s) alone or by combination of their Contribution(s)
-with the Work to which such Contribution(s) was submitted. If You
-institute patent litigation against any entity (including a
-cross-claim or counterclaim in a lawsuit) alleging that the Work
-or a Contribution incorporated within the Work constitutes direct
-or contributory patent infringement, then any patent licenses
-granted to You under this License for that Work shall terminate
-as of the date such litigation is filed.
-
-4. Redistribution. You may reproduce and distribute copies of the
-Work or Derivative Works thereof in any medium, with or without
-modifications, and in Source or Object form, provided that You
-meet the following conditions:
-
-(a) You must give any other recipients of the Work or
-Derivative Works a copy of this License; and
-
-(b) You must cause any modified files to carry prominent notices
-stating that You changed the files; and
-
-(c) You must retain, in the Source form of any Derivative Works
-that You distribute, all copyright, patent, trademark, and
-attribution notices from the Source form of the Work,
-excluding those notices that do not pertain to any part of
-the Derivative Works; and
-
-(d) If the Work includes a "NOTICE" text file as part of its
-distribution, then any Derivative Works that You distribute must
-include a readable copy of the attribution notices contained
-within such NOTICE file, excluding those notices that do not
-pertain to any part of the Derivative Works, in at least one
-of the following places: within a NOTICE text file distributed
-as part of the Derivative Works; within the Source form or
-documentation, if provided along with the Derivative Works; or,
-within a display generated by the Derivative Works, if and
-wherever such third-party notices normally appear. The contents
-of the NOTICE file are for informational purposes only and
-do not modify the License. You may add Your own attribution
-notices within Derivative Works that You distribute, alongside
-or as an addendum to the NOTICE text from the Work, provided
-that such additional attribution notices cannot be construed
-as modifying the License.
-
-You may add Your own copyright statement to Your modifications and
-may provide additional or different license terms and conditions
-for use, reproduction, or distribution of Your modifications, or
-for any such Derivative Works as a whole, provided Your use,
-reproduction, and distribution of the Work otherwise complies with
-the conditions stated in this License.
-
-5. Submission of Contributions. Unless You explicitly state otherwise,
-any Contribution intentionally submitted for inclusion in the Work
-by You to the Licensor shall be under the terms and conditions of
-this License, without any additional terms or conditions.
-Notwithstanding the above, nothing herein shall supersede or modify
-the terms of any separate license agreement you may have executed
-with Licensor regarding such Contributions.
-
-6. Trademarks. This License does not grant permission to use the trade
-names, trademarks, service marks, or product names of the Licensor,
-except as required for reasonable and customary use in describing the
-origin of the Work and reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty. Unless required by applicable law or
-agreed to in writing, Licensor provides the Work (and each
-Contributor provides its Contributions) on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-implied, including, without limitation, any warranties or conditions
-of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-PARTICULAR PURPOSE. You are solely responsible for determining the
-appropriateness of using or redistributing the Work and assume any
-risks associated with Your exercise of permissions under this License.
-
-8. Limitation of Liability. In no event and under no legal theory,
-whether in tort (including negligence), contract, or otherwise,
-unless required by applicable law (such as deliberate and grossly
-negligent acts) or agreed to in writing, shall any Contributor be
-liable to You for damages, including any direct, indirect, special,
-incidental, or consequential damages of any character arising as a
-result of this License or out of the use or inability to use the
-Work (including but not limited to damages for loss of goodwill,
-work stoppage, computer failure or malfunction, or any and all
-other commercial damages or losses), even if such Contributor
-has been advised of the possibility of such damages.
-
-9. Accepting Warranty or Additional Liability. While redistributing
-the Work or Derivative Works thereof, You may choose to offer,
-and charge a fee for, acceptance of support, warranty, indemnity,
-or other liability obligations and/or rights consistent with this
-License. However, in accepting such obligations, You may act only
-on Your own behalf and on Your sole responsibility, not on behalf
-of any other Contributor, and only if You agree to indemnify,
-defend, and hold each Contributor harmless for any liability
-incurred by, or claims asserted against, such Contributor by reason
-of your accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
+Xema Business Source License 1.1
+
+License text copyright (c) 2020 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+-----------------------------------------------------------------------------
+
+Parameters
+
+Licensor:  Neuralchowder Inc.
+
+Licensed Work:  Xema. The Licensed Work is (c) 2026 Neuralchowder Inc.
+
+  The Licensed Work includes, without limitation, Xema Core, Xema Runtime,
+  Xema Kernel, Xema control plane, Xema application runtime, Xema biome
+  runtime, Xema biome registry, Xema store services, Xema orchestration
+  services, Xema agents, Xema skills, Xema memory services, Xema APIs, Xema
+  user interfaces, Xema command-line tools, Xema deployment artifacts, Xema
+  templates, Xema specifications, Xema schemas, Xema manifests, Xema
+  documentation, Xema examples, and all source code, object code, binaries,
+  packages, modules, configuration files, manifests, schemas, examples,
+  templates, documentation, and derivative works included in or distributed
+  as part of the Xema software project.
+
+  The Licensed Work does not include any third-party software, libraries,
+  dependencies, packages, assets, or components that are distributed with the
+  Licensed Work but are governed by their own separate license terms. Such
+  third-party materials remain subject to their respective licenses.
+
+  A specific file, package, component, or directory may state that it is
+  governed by a different license. In that case, that specific file, package,
+  component, or directory is governed by the license expressly stated therein.
+
+Additional Use Grant:
+
+  You may make production use of the Licensed Work, provided that your use
+  does not include offering, providing, making available, distributing,
+  hosting, managing, embedding, reselling, white-labeling, sublicensing,
+  commercializing, or otherwise making the Licensed Work, or any modified
+  version or derivative work of the Licensed Work, available to Third Parties
+  as part of a Competitive Offering.
+
+The following definitions and clarifications form part of, and govern
+the interpretation of, the Additional Use Grant set out above.
+
+  1. "Production Use" means any use of the Licensed Work other than for
+     development, testing, evaluation, demonstration, experimentation,
+     benchmarking, or other non-production purposes.
+
+  2. "Affiliate" means any entity that, directly or indirectly,
+     controls, is controlled by, or is under common control with you,
+     where "control" means ownership of more than fifty percent (50%) of
+     the voting interests of the entity, or the power to direct its
+     management.
+
+  3. "Third Party" means any natural person or legal entity other than
+     you and your Affiliates.
+
+  4. "Competitive Offering" means any product or service, made available
+     to one or more Third Parties for a fee or other consideration
+     (including without limitation on a paid, subscription,
+     advertising-supported, hosted, or managed-service basis), that is
+     offered or marketed as, or that competes with, a software platform,
+     runtime, orchestration system, agent or automation system,
+     extension or distribution marketplace, or other software system
+     that provides, in substantial part, the same or substantially
+     similar capabilities as those provided by the Licensed Work. A
+     product or service is a Competitive Offering whether the Licensed
+     Work is provided in whole or in part, alone or bundled with other
+     software, and whether modified or unmodified.
+
+  5. Providing, hosting, or managing the Licensed Work for a Third Party,
+     or otherwise making the Licensed Work available to a Third Party as
+     a hosted or managed service such that the Third Party obtains the
+     principal value or functionality of the Licensed Work, is a
+     Competitive Offering and is not permitted by the Additional Use
+     Grant.
+
+  6. Subject to the foregoing, the Additional Use Grant permits you to
+     make Production Use of the Licensed Work for your own internal
+     business purposes and to build, operate, and provide your own
+     products and services to Third Parties, provided that the Licensed
+     Work itself (whether modified or unmodified) is not the product or
+     service, and is not a Competitive Offering, made available to those
+     Third Parties.
+
+  7. You may modify the Licensed Work and create derivative works for
+     any purpose permitted by this License. Any Production Use of such
+     modified or derivative works remains subject to the same
+     restrictions as the Licensed Work, including the prohibition on
+     Competitive Offerings.
+
+  8. Use of the Licensed Work by your own employees, contractors, and
+     agents, acting on your behalf and for your benefit, is not by
+     itself making the Licensed Work available to a Third Party.
+
+  9. Embedding or distributing the Licensed Work as a component of your
+     own product or service is permitted only where the Licensed Work
+     does not constitute the principal value of that product or service
+     and the product or service is not a Competitive Offering.
+
+  10. Nothing in this Additional Use Grant grants any right to use any
+      name, trademark, service mark, or logo of the Licensor or its
+      Affiliates, except as reasonably required for customary
+      attribution.
+
+  11. The rights stated in this Additional Use Grant are the maximum
+      rights granted for Production Use prior to the Change Date. Any
+      Production Use not expressly permitted requires a separate
+      commercial license from the Licensor.
+
+  12. If any provision of this Additional Use Grant is held invalid or
+      unenforceable, that provision shall be limited or eliminated to
+      the minimum extent necessary so that the remainder of this
+      Additional Use Grant, and of this License, remains in full force
+      and effect. The Licensor reserves all rights not expressly granted
+      by this License.
+
+
+Change Date:  Four years from the date the specific version of the Licensed
+  Work is first publicly released by Licensor.
+
+Change License:  Mozilla Public License, Version 2.0
+
+For information about alternative licensing arrangements, commercial
+licensing, enterprise licensing, OEM licensing, appliance licensing, managed
+service licensing, cloud provider licensing, or other commercial use of the
+Licensed Work, please contact: licensing@neuralchowder.com
+
+-----------------------------------------------------------------------------
+
+Notice
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph above
+terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works of
+the Licensed Work, are subject to this License. This License applies separately
+for each version of the Licensed Work and the Change Date may vary for each
+version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or modified
+form from a third party, the terms and conditions set forth in this License
+apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of Licensor
+or its affiliates, provided that you may use a trademark or logo of Licensor
+as expressly required by this License.
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN
+"AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, EXPRESS
+OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND TITLE.

package/README.md

@@ -21,18 +21,20 @@ pnpm add -D @xemahq/repo-build-tooling
 ```bash
 pnpm exec xema-readiness
 pnpm exec xema-service-bootstrap --check
-pnpm exec xema-scrub-swagger-paths dist
 ```
 
 | Bin | What it does |
 | --- | --- |
 | `xema-readiness` | Runs the ordered checks between a source change and a push |
 | `xema-service-bootstrap [--check] [--filter <key>] [--root <dir>]` | Generates `src/generated/*.generated.ts` service and worker descriptors from the repository's `xema-biome.json` manifests; `--check` fails on drift. Also derives each component's boot-required environment and edition delivery from its entry source (`oci-default` gives `src/main.ts`, `node-module` `dist/<x>` gives `src/<x>.ts`) with `@xemahq/peer-analysis`, writes `src/generated/<component>.component-facts.generated.json`, and inlines the same `bootEnv` (and `editionDelivery`, when reached) in the descriptor |
-| `xema-scrub-swagger-paths <dist-dir>...` | Rewrites `@nestjs/swagger` plugin output that names a private install path, then fails the build if any leak remains (`--self-test` available) |
 | `xema-composed-image <command>` | Build-time half of a composed-process image: `members`, `filters`, `dirs`, `pins`, `index`, `load`, `stage`, `stage-tree`, `pnpm-context`, `sync-injected`, `prisma-check`, `migrate`, `coordinate`, `load-image`, `smoke-refusal`, `dockerfile` |
-| `xema-service-image stage --service <pkg> --path <dir> --platform linux/<amd64\|arm64> [--stage-dir <dir>]` | Runner half of a per-service image: `pnpm deploy --prod --offline --ignore-scripts` of a service already built on the runner, selected for the TARGET platform (`--os=linux --cpu=<arch> --libc=glibc`), into `<stage>/service/app`, with its Prisma client and the target's schema engine. Refuses a package whose native code holds no ELF for the target (a multi-platform package that also ships the target's binary is accepted) and production dependencies whose build script would have to run, uncommitted changes to tracked files, an untracked root build input, and running as any tool but the one the root installs. Fetches the schema engine from Prisma for every stage, checks it against both published checksums, and caches nothing. Writes `<stage>/service/xema-service-image.json` (commit, sha256 of each root build input: lockfile, root `package.json`, `pnpm-workspace.yaml`, `.npmrc`, `.pnpmfile.cjs`, `turbo.json`, `tsconfig*.json`; tool version; natives per package; engine sha256) and `<stage>/tool`. The Dockerfile COPYs those root inputs into `/proof/context/`, which puts them in the content tag, and its proof stage runs `src/service-image-in-image.mjs prove <app> <proof dir> --service <svc> --commit <BUILD_SHA>` on the target, offline: it checks the commit, the root inputs, the tool version, the platform and Node ABI, that each package's addons `dlopen`, and the engine's sha256 and version. The stage reaches the build as the named context `xema-service` (`--build-context xema-service=.xema-stage`); the authoritative name is `STAGED_SERVICE_CONTEXT` in `@xemahq/distribution-source-hash`, whose image hash frames such a service from its tracked tree, closure, turbo globalDependencies and tsconfig chain, so the stage must be built from no other repository input. The final stage only COPYs |
+| `xema-service-image stage --service <pkg> --path <dir> --platform linux/<amd64\|arm64> [--stage-dir <dir>]` | Runner half of a per-service image: `pnpm deploy --prod --offline --ignore-scripts` of a service already built on the runner, selected for the TARGET platform (`--os=linux --cpu=<arch> --libc=glibc`), into `<stage>/service/app`, with its Prisma client and the target's schema engine. Refuses a package whose native code holds no ELF for the target (a multi-platform package that also ships the target's binary is accepted) and production dependencies whose build script would have to run, uncommitted changes to tracked files, an untracked root build input, and running as any tool but one the lockfile pins for an importer of the repository. Fetches the schema engine from Prisma for every stage, checks it against both published checksums, and caches nothing. Writes `<stage>/service/xema-service-image.json` (commit, sha256 of each root build input: lockfile, root `package.json`, `pnpm-workspace.yaml`, `.npmrc`, `.pnpmfile.cjs`, `turbo.json`, `tsconfig*.json`; tool version; natives per package; engine sha256) and `<stage>/tool`. The Dockerfile COPYs those root inputs into `/proof/context/`, which puts them in the content tag, and its proof stage runs `src/service-image-in-image.mjs prove <app> <proof dir> --service <svc> --commit <BUILD_SHA>` on the target, offline: it checks the commit, the root inputs, the tool version, the platform and Node ABI, that each package's addons `dlopen`, and the engine's sha256 and version. The stage reaches the build as the named context `xema-service` (`--build-context xema-service=.xema-stage`); the authoritative name is `STAGED_SERVICE_CONTEXT` in `@xemahq/distribution-source-hash`, whose image hash frames such a service from its tracked tree, closure, turbo globalDependencies and tsconfig chain, so the stage must be built from no other repository input. The final stage only COPYs |
 | `xema-arm64-supplement-needed` | Decides whether an arm64 supplement is still owed at `REGISTRY/IMAGE:CONTENT_TAG` (env: `REGISTRY`, `IMAGE`, `CONTENT_TAG`, `REGISTRY_USER`, `REGISTRY_TOKEN`). `needed=false` only when the coordinate serves an index whose linux/arm64 child is proven by its own image config; any other resolvable state is `needed=true`; a 401/403/5xx or an unresolvable child is an error. Writes `needed=true\|false` to `$GITHUB_OUTPUT`. Replaces the generated `arm64-supplement-needed.mjs` copy. |
-| `xema-promote-image --service <name> --dev-ref <repo> --release-ref <repo> --tag <tag> --commit <sha> --main-ref <ref> --signer-repository <owner/repo> --develop-workflow <file> --release-workflow <file>... [--release-index-workflow <file>] --promotion-predicate-out <path> -- <tag command>` | Publishes the develop image's digest under the release tag instead of rebuilding: `reused` (the release digest carries an `image-promotion/v1` attestation signed by a `--release-workflow` identity on main, with exactly one verified statement about the digest and a `ghcr.io/<owner>/dev/<name>` source; no dev-ref probe), `copied` (the proven develop digest, digest-preserving; fails closed if the release digest differs) or `miss` (build it; a reuse whose release digest has no `image-promotion/v1` attestation, a legacy image, is a miss with `reason=reuse-no-promotion` on the stdout line; with `--release-index-workflow`, a release tag that names an image index signed by that workflow on main, with exactly one `linux/amd64` child whose own digest passes that same reuse check, is instead `reused` with `evidence=release-index`, `digest` = the amd64 child A, `index_digest` = the index D and no predicate, but only when A's selected promotion statement promotes `--commit` itself (a rerun; a later commit with the same content takes the existing miss and attests its own promotion). On `evidence=release-index` the caller skips sign/attest, tags `:<sha>` and `main-<sha>` to the amd64 subject `digest` (release-arm64 resolves `:<sha>` to it and verifies its promotion), and points only the content tag (and `latest`, if it moves it) at the index `index_digest`. Any failed step keeps the miss, and two amd64 children are an error; a signature or identity failure, or a source outside `dev/`, is an error; a copy whose dev digest carries no SLSA v1 provenance at all, an image reused on develop from before provenance, is a miss with `reason=copy-no-develop-provenance`, while provenance that is present but fails a leg is an error). A develop digest is proven only if its SLSA v1 provenance is signed by the develop workflow at `refs/heads/develop`, its revision is an ancestor of the main ref, and the tag command prints the same tag at that revision and at `--commit`; any failed leg is an error, never a miss. On every non-miss result it writes the `https://xema.dev/attestations/image-promotion/v1` predicate for the caller to attest: a copy states the facts just proved; a reuse states this run's `release` and `promotedCommit` and carries `source` and `developProvenance` from the earlier promotion. Writes `result`, `digest`, `source`, `revision`, `evidence`, `provenance_digest`, `promotion_predicate`, `promotion_predicate_type` to `$GITHUB_OUTPUT`. Needs `docker`, `cosign` (major v2, the same as the develop attest step and xema-deploy's verify; it runs `cosign version` first and refuses any other major or an unparsable version), `git` and full history. It does not sign |
+| `xema-promote-image --service <name> --dev-ref <repo> --release-ref <repo> --tag <tag>` | Publishes the develop image's digest under the release tag instead of rebuilding, and proves no provenance: `reused` (`<release-ref>:<tag>` exists; `digest` is the release digest, `source` empty), `copied` (`<dev-ref>:<tag>` exists; it is copied by digest, re-probed, and the tool fails if the release digest differs; `source` is `<dev-ref>@<digest>`) or `miss` (neither exists; the caller builds). Writes `result`, `digest`, `source` to `$GITHUB_OUTPUT` and needs only `docker`. |
+| `xema-affected-biomes --class <class> --affected-base <sha or ''> [--root <dir>] [--image-dir <dir>]` | Prints the biome ids a change affects, one per line and sorted, to stdout (logs go to stderr; empty output means none). A biome is affected when turbo (`turbo ls --affected` between the base and `HEAD`) reports one of its composed-process members' packages. An empty `--affected-base` selects every biome with members in the class. |
+| `xema-pack-bundle <out> --class <class> --platform linux/<amd64\|arm64> [--biome <id>]… [--root <dir>] [--image-dir <dir>] [--build-source <repository>@<commit>]` | Packs each named biome (default: every biome with members in the class) as ONE content-addressed bundle of all its members, after the build: their `dist`, Prisma clients, schema and migrations, the biome manifest, its index and `contributions/*.contribution.json`, and their production dependencies WITHOUT the packages the host provides. The bundle is proven outside the repository (Prisma clients run, every member loads) before it is archived. Writes `<out>/<hex>/`, `<out>/<hex>.tgz` (`<hex>` is the archive's sha256, its address) and `<out>/bundles.json`. The bundle's `xema-bundle.json` is graded by the contracts' bundle manifest schema and records the build source: in GitHub Actions the workflow's repository and sha, locally the checkout's `origin` (a GitHub remote as `owner/repo`) and `HEAD`. Outside a git checkout, with a dirty tree or without an origin the pack is refused unless `--build-source <repository>@<commit>` is given. |
+| `xema-publish-bundles <out> --registry <host/project> --channel <tag> --commit <40-hex> --source <owner/repo>` | Pushes the bundles in `<out>/bundles.json` with `oras` to `<registry>/bundles/<biome>:sha256-<hex>`, reads the pushed manifest back, and only then moves the `--channel` tag. A channel that already holds the digest is left alone (`unchanged`); a digest already pushed is only re-tagged (`retagged`). Writes `<out>/published.json`. Credentials come from the job's docker login. |
+| `xema-notify-biome-host <out> --biome-host <https url> --channel <tag> --token-file <path>` | Tells Biome Host where each biome's channel now points, for every entry of `<out>/published.json` (unchanged ones too, so a run that failed after an earlier biome moved still converges): one POST with the bearer token read from `--token-file`. The URL must be https. |
 | `xema-check-no-vendored-deps` | Fails on a `workspace:` range for a package the repository does not own |
 | `xema-check-workspace-ranges` | Fails on a `workspace:` range the local package does not satisfy |
 

package/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@xemahq/repo-build-tooling",
-  "version": "0.33.1",
+  "version": "0.34.1",
   "description": "Dev-time build tooling shared by every Xema repository. Ships as plain ESM, depending only on @xemahq/release-policy for registry access, so the published artifact is the reviewed source.",
-  "license": "Apache-2.0",
+  "license": "LicenseRef-Xema-BSL-1.1",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
   "homepage": "https://xema.dev",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/xema-dev/xema-runtime-core.git",
-    "directory": "packages/sdks/repo-build-tooling"
+    "url": "git+https://github.com/xema-dev/xema-base.git",
+    "directory": "kernel/runtime/sdks/repo-build-tooling"
   },
-  "bugs": "https://github.com/xema-dev/xema-runtime-core/issues",
+  "bugs": "https://github.com/xema-dev/xema-base/issues",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -21,39 +21,55 @@
     "src"
   ],
   "bin": {
+    "xema-affected-biomes": "src/bundle-affected-cli.mjs",
     "xema-arm64-supplement-needed": "src/arm64-supplement-needed.mjs",
     "xema-check-no-vendored-deps": "src/check-no-vendored-deps.mjs",
     "xema-check-workspace-ranges": "src/check-workspace-range-matches-local.mjs",
     "xema-composed-image": "src/composed-image.mjs",
     "xema-effective-input": "src/effective-input.mjs",
+    "xema-notify-biome-host": "src/bundle-notify-cli.mjs",
+    "xema-pack-bundle": "src/pack-bundle-cli.mjs",
     "xema-promote-image": "src/promote-image.mjs",
+    "xema-publish-bundles": "src/bundle-publish-cli.mjs",
     "xema-readiness": "src/readiness.mjs",
-    "xema-scrub-swagger-paths": "src/scrub-swagger-plugin-paths.mjs",
     "xema-service-bootstrap": "src/service-bootstrap.mjs",
     "xema-service-image": "src/service-image.mjs"
   },
   "exports": {
     "./arm64-supplement-needed": "./src/arm64-supplement-needed.mjs",
+    "./boot-graph-edges": "./src/boot-graph-edges.mjs",
+    "./bootstrap-closure": "./src/bootstrap-closure.mjs",
+    "./bundle-notify": "./src/bundle-notify.mjs",
+    "./bundle-publish": "./src/bundle-publish.mjs",
     "./check-no-vendored-deps": "./src/check-no-vendored-deps.mjs",
     "./check-workspace-range-matches-local": "./src/check-workspace-range-matches-local.mjs",
+    "./component-operations": "./src/component-operations.mjs",
     "./composed-image": "./src/composed-image.mjs",
     "./effective-input": "./src/effective-input.mjs",
+    "./pack-bundle": "./src/pack-bundle.mjs",
     "./package.json": "./package.json",
     "./promote-image": "./src/promote-image.mjs",
     "./readiness": "./src/readiness.mjs",
-    "./scrub-swagger-plugin-paths": "./src/scrub-swagger-plugin-paths.mjs",
     "./service-bootstrap": "./src/service-bootstrap.mjs",
     "./service-image": "./src/service-image.mjs"
   },
   "dependencies": {
-    "@xemahq/contracts": "^0.119.0",
-    "@xemahq/release-policy": "^16.0.0",
-    "@xemahq/peer-analysis": "^0.3.1"
+    "@xemahq/biome-bundle-pack": "^0.2.1",
+    "@xemahq/peer-analysis": "^0.4.0",
+    "@xemahq/contracts": "^0.120.1",
+    "@xemahq/release-policy": "^20.0.0",
+    "@xemahq/host-abi-node": "^0.2.0"
+  },
+  "devDependencies": {
+    "eslint": "^9.39.4",
+    "@xemahq/eslint-config": "^0.14.3"
   },
   "scripts": {
-    "test": "node src/scrub-swagger-plugin-paths.mjs --self-test && node --test src/check-workspace-range-matches-local.test.mjs && node --test src/check-no-vendored-deps.test.mjs && node --test src/readiness.test.mjs && node --test src/composed-image.test.mjs && node --test src/composed-image-class.test.mjs && node --test src/composed-image-coordinate-cli.test.mjs && node --test src/declaration-refusal.test.mjs && node --test src/smoke-refusal.test.mjs && node --test src/load-image.test.mjs && node --test src/composed-image-coordinate.test.mjs && node --test src/composed-image-dockerfile.test.mjs && node --test src/service-bootstrap.test.mjs && node --test src/service-bootstrap-component-facts.test.mjs && node --test src/service-bootstrap-protocols.test.mjs && node --test src/composed-image-prebuilt-dockerfile.test.mjs && node --test src/composed-image-in-image-closure.test.mjs && node --test src/composed-image-stage.test.mjs && node --test src/composed-image-stage-tree.test.mjs && node --test src/composed-image-install.test.mjs && node --test src/canonical-hidden-hoist.test.mjs && node --test src/composed-image-proof.test.mjs && node --test src/composed-image-pnpm-context.test.mjs && node --test src/composed-image-sync-injected.test.mjs && node --test src/composed-image-prisma-check.test.mjs && node --test src/composed-image-prisma-engine.test.mjs && node --test src/composed-migrate.test.mjs && node --test src/promote-image.test.mjs && node --test src/arm64-supplement-needed.test.mjs && node --test src/service-image.test.mjs && node --test src/image-cpu-arch.test.mjs && node --test src/staged-image-proof.test.mjs && node --test src/turbo-config-projection.test.mjs && node --test src/effective-input.test.mjs && node --test src/effective-input-deployed-files.test.mjs"
+    "lint": "eslint .",
+    "test": "node --test src/check-workspace-range-matches-local.test.mjs && node --test src/check-no-vendored-deps.test.mjs && node --test src/readiness.test.mjs && node --test src/composed-image.test.mjs && node --test src/composed-image-class.test.mjs && node --test src/composed-image-coordinate-cli.test.mjs && node --test src/declaration-refusal.test.mjs && node --test src/smoke-refusal.test.mjs && node --test src/load-image.test.mjs && node --test src/composed-image-coordinate.test.mjs && node --test src/composed-image-dockerfile.test.mjs && node --test src/service-bootstrap.test.mjs && node --test src/service-bootstrap-component-facts.test.mjs && node --test src/service-bootstrap-protocols.test.mjs && node --test src/composed-image-prebuilt-dockerfile.test.mjs && node --test src/composed-image-in-image-closure.test.mjs && node --test src/composed-image-stage.test.mjs && node --test src/composed-image-stage-deploy.test.mjs && node --test src/composed-image-stage-tree.test.mjs && node --test src/composed-image-install.test.mjs && node --test src/canonical-hidden-hoist.test.mjs && node --test src/composed-image-proof.test.mjs && node --test src/composed-image-pnpm-context.test.mjs && node --test src/composed-image-sync-injected.test.mjs && node --test src/composed-image-prisma-check.test.mjs && node --test src/composed-image-prisma-engine.test.mjs && node --test src/composed-migrate.test.mjs && node --test src/promote-image.test.mjs && node --test src/arm64-supplement-needed.test.mjs && node --test src/service-image.test.mjs && node --test src/image-cpu-arch.test.mjs && node --test src/staged-image-proof.test.mjs && node --test src/turbo-config-projection.test.mjs && node --test src/effective-input.test.mjs && node --test src/effective-input-deployed-files.test.mjs && node --test src/service-image-platform-twin.test.mjs && node --test src/pack-bundle.test.mjs && node --test src/bundle-publish.test.mjs && node --test src/bundle-notify.test.mjs && node --test src/bundle-affected.test.mjs && node --test src/boot-graph-edges.test.mjs && node --test src/bootstrap-closure.test.mjs && node --test src/component-operations.test.mjs"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:561f8561b0ff23023de261c59ca6f4067fc05f585edda41117a75f6d3d3f60e1"
+    "sourceDigest": "sha256:61ab673dbc2295bc71318bc83e3e150672f1b3a3ee1599763c60d8ceae14c45d",
+    "sha": "9a88d6fde912be61affb481b069f009abfdfde21"
   }
 }

package/src/arm64-supplement-needed.mjs

@@ -92,7 +92,7 @@ async function getJson({
     },
     { sleep },
   );
-  if (response.status === 404) return { status: 404, document: undefined };
+  if (response.status === 404) {return { status: 404, document: undefined };}
   if (response.status !== 200) {
     throw new Error(
       `${registry}: manifest lookup for ${repository}:${reference} returned HTTP ${response.status}`,
@@ -122,7 +122,7 @@ async function getJson({
  */
 export function declaredArm64Children(document) {
   const manifests = document?.manifests;
-  if (!Array.isArray(manifests)) return [];
+  if (!Array.isArray(manifests)) {return [];}
   return manifests
     .filter(
       (child) =>
@@ -279,8 +279,8 @@ async function main(env) {
   const registry = env.REGISTRY;
   const image = env.IMAGE;
   const contentHash = env.CONTENT_TAG;
-  if (!registry) throw new Error('REGISTRY is required.');
-  if (!image) throw new Error('IMAGE is required.');
+  if (!registry) {throw new Error('REGISTRY is required.');}
+  if (!image) {throw new Error('IMAGE is required.');}
   const prefix = `${registry}/`;
   if (!image.startsWith(prefix)) {
     throw new Error(`IMAGE '${image}' is not hosted on '${registry}'`);
@@ -311,7 +311,7 @@ async function main(env) {
   }
 
   const out = env.GITHUB_OUTPUT;
-  if (out) appendFileSync(out, `needed=${needed ? 'true' : 'false'}\n`);
+  if (out) {appendFileSync(out, `needed=${needed ? 'true' : 'false'}\n`);}
 }
 
 if (invokedDirectly(process.argv[1], import.meta.url)) {
@@ -319,7 +319,7 @@ if (invokedDirectly(process.argv[1], import.meta.url)) {
     console.error(
       `::error title=arm64 supplement probe failed::${error.message}`,
     );
-    for (const line of describeErrorChain(error)) console.error(`  ${line}`);
+    for (const line of describeErrorChain(error)) {console.error(`  ${line}`);}
     process.exit(1);
   });
 }