@xemahq/xema 0.31.2 → 0.33.0

package/edition/release-edition-artifact.mjs

@@ -21,13 +21,14 @@ import { assertCanonicalDistributionId } from './distribution-paths.mjs';
 import { LOCAL_WORKFLOW, assertEngineImage, editionTarget, workflowFromEnv, writeEditionArtifact } from './edition-artifact.mjs';
 import { assertRosteredChartSetLock } from './edition-chart-set.mjs';
 import { EditionChannel, EditionLockFile } from './edition-constants.mjs';
+import { editionPinnedInputs } from './edition-pinned-inputs.mjs';
 import { WorkspaceRoot, configureEditionWorkspaceFromProcess, editionsRoot, isEntryModule } from './edition-workspace.mjs';
 import { descriptorEvidenceTrust } from './evidence-trust-policy.mjs';
 import { loadKernelDistributionSchemas, validateImmutableImageLock } from './lib.mjs';
 import { releaseCatalogue } from './release-catalogue.mjs';
 import { assertReleaseEditionTree } from './release-channel-guard.mjs';
 import { externalSourceTrees, sourceTreeLocator } from './resolve-images.mjs';
-import { committedRepositoryPins, createPinnedSourceAuthority } from './source-authority.mjs';
+import { createPinnedSourceAuthority } from './source-authority.mjs';
 
 if (isEntryModule(import.meta.url)) {
   configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Sources, WorkspaceRoot.Kernel]);
@@ -110,7 +111,7 @@ export async function readCommittedEdition(id, root = editionsRoot()) {
       { cause: error },
     );
   }
-  const authority = createPinnedSourceAuthority({ pins: committedRepositoryPins() });
+  const authority = createPinnedSourceAuthority({ pins: (await editionPinnedInputs(id, { schemas })).repositoryPins });
   await verifyBiomeContentHashes({
     schemas,
     lock: sealed,

package/edition/resolve-distribution.mjs

@@ -77,7 +77,9 @@ import {
 import { resolveDispatchedRuntimeComponents } from './dispatched-runtime-components.mjs';
 import { fleetChartSetLockPath, writeEditionChartSet } from './edition-chart-set.mjs';
 import { workspaceSection } from './edition-config.mjs';
-import { WorkspaceRoot, biomeIndexPath, configureEditionWorkspaceFromProcess, editionsRoot, isEntryModule, kernelPackageDir, platformServiceIndexPath } from './edition-workspace.mjs';
+import { editionPinnedInputs } from './edition-pinned-inputs.mjs';
+import { splitEditionDefinition } from './edition-source-pins.mjs';
+import { WorkspaceRoot, configureEditionWorkspaceFromProcess, editionsRoot, isEntryModule, kernelPackageDir } from './edition-workspace.mjs';
 import { walkDeclaredSources } from './external-source-walk.mjs';
 import {
   biomeTierOrder,
@@ -260,7 +262,7 @@ export function loadEditionManifest(parseDistribution, id) {
         "(core class, the classes the edition's include names, and services a shipped biome's API requires)",
     );
   }
-  const manifest = parseDistribution(raw);
+  const manifest = parseDistribution(splitEditionDefinition(raw, id).document);
   if (manifest.id !== id) {
     throw new Error(`distribution at ${path} declares id "${manifest.id}", but it was addressed as "${id}"`);
   }
@@ -314,26 +316,6 @@ export function composeManifest(manifest, pinSource = PUBLISHED_PIN_SOURCE) {
   };
 }
 
-function readBiomeIndex() {
-  if (!existsSync(biomeIndexPath())) {
-    throw new Error(
-      `${biomeIndexPath()} not found — run \`${commandFor('build-biome-index.mjs')}\` first`,
-    );
-  }
-  return JSON.parse(readFileSync(biomeIndexPath(), 'utf8'));
-}
-
-function readPlatformServiceIndex(parsePlatformServiceSourceIndex) {
-  if (!existsSync(platformServiceIndexPath())) {
-    throw new Error(
-      `${platformServiceIndexPath()} not found — run the trusted platform-service index generator first`,
-    );
-  }
-  return parsePlatformServiceSourceIndex(
-    JSON.parse(readFileSync(platformServiceIndexPath(), 'utf8')),
-  );
-}
-
 /** Unique key for an index/lock entry (id+target+repo distinguishes cultivar/reference + web/server pairs). */
 function entryKey(e) {
   return JSON.stringify([e.id, e.target, e.repo]);
@@ -1473,6 +1455,9 @@ export function resolveDistributionFromInputs(
     // lose its UI. A web joins once EVERY server it requires is in the edition
     // (the last of them to be processed completes it), so a UI is never pulled
     // in ahead of the capability it administers.
+    // An operator-audience web is skipped here on purpose: operator biomes enter an edition only by explicit
+    // selection (selectors skip them in applySelectors; naming one forces it in; a required service owned by
+    // one must be selected explicitly). Pulling one in implicitly from a server biome would bypass that rule.
     const webBiomesByRequiredServer = new Map();
     for (const candidate of resourceProviderCandidates) {
       if (
@@ -2226,8 +2211,14 @@ export async function resolveDistributionWithIndex(id, { materialize, inputs, re
   // THE RELEASE READS THESE FROM DISK; A DEVELOP SNAPSHOT INJECTS THEM
   // (`develop-snapshot-inputs.mjs`). Either way they pass through the one
   // validation below, so there is a single resolve path and two sources.
-  const claimedPlatformServiceIndex =
-    inputs?.platformServiceIndex ?? readPlatformServiceIndex(schemas.parsePlatformServiceSourceIndex);
+  // The edition's own indexes (editionPinnedInputs): the committed ones, or
+  // rebuilt at the repositories it holds. Read only when the caller injected
+  // neither.
+  const pinned =
+    inputs?.platformServiceIndex === undefined || inputs?.biomeIndex === undefined
+      ? await editionPinnedInputs(id, { schemas })
+      : undefined;
+  const claimedPlatformServiceIndex = inputs?.platformServiceIndex ?? pinned.platformServiceIndex;
   // OWNERSHIP IS THE SERVICE'S OWN STATEMENT: each entry's capability domains
   // are re-derived from its pinned source manifest (hash-verified), so a
   // hand-edited index cannot move where grants land. Only the customer resolve
@@ -2239,7 +2230,7 @@ export async function resolveDistributionWithIndex(id, { materialize, inputs, re
       ? claimedPlatformServiceIndex
       : verifiedPlatformServiceIndex(claimedPlatformServiceIndex, { readManifest });
   const platformIndex = validateServiceDependencyOwnerParity(
-    validateImmutableBiomeIndex(inputs?.biomeIndex ?? readBiomeIndex()),
+    validateImmutableBiomeIndex(inputs?.biomeIndex ?? pinned.biomeIndex),
     platformServiceIndex,
   );
   const { entries, sourceRecords } = await walkDeclaredSources({

package/edition/resolve-images.mjs

@@ -36,6 +36,8 @@ import { execFileSync } from 'node:child_process';
 import { writeFileSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 
+import { assertBuildLedgerComplete } from './build-ledger-completeness.mjs';
+import { BUILD_LEDGER_FILE, readBuildLedger } from './build-ledger.mjs';
 import { resolveDispatchedRuntimeComponents } from './dispatched-runtime-components.mjs';
 import {
   assertCanonicalDistributionId,
@@ -43,7 +45,8 @@ import {
   readBoundDistributionFile,
 } from './distribution-paths.mjs';
 import { editionWorkspaceConfig } from './edition-config.mjs';
-import { biomeIndexPath, editionsRoot, runtimeImageSourceIndexPath, WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, sourcePath, sourcesRoot } from './edition-workspace.mjs';
+import { editionPinnedInputs } from './edition-pinned-inputs.mjs';
+import { dataRoot, editionsRoot, WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, sourcePath, sourcesRoot } from './edition-workspace.mjs';
 import {
   externalSourceCacheDir,
   materializeGitSource,
@@ -66,7 +69,6 @@ import {
 } from './lib.mjs';
 import { assertReleaseContent } from './release-channel-guard.mjs';
 import { composeEdition } from './resolve-distribution.mjs';
-import { readStrictJsonFile } from './strict-json.mjs';
 
 if (isEntryModule(import.meta.url)) {
   configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Sources, WorkspaceRoot.Kernel, WorkspaceRoot.Cache]);
@@ -162,10 +164,6 @@ const FIRST_PARTY_TREES = (repo) => ({ dir: sourcePath(repo), base: sourcesRoot(
 const imageBuildInputHashByIdentity = new Map();
 const sourceManifestHashByIdentity = new Map();
 
-function readJson(path) {
-  return readStrictJsonFile(path);
-}
-
 /**
  * Memoized image build-input closure hash.
  *
@@ -1487,8 +1485,13 @@ export function resolveCrossRepoInputsForRoster({
   return crossRepoInputsByConsumer;
 }
 
-/** The release's inputs: the COMMITTED locks and indexes, read from disk. */
-function releaseImageInputs(schemas, id) {
+/**
+ * The release's inputs: the COMMITTED lock, and the edition's own indexes
+ * (`editionPinnedInputs`: the committed ones, or rebuilt at the repositories the
+ * edition holds).
+ */
+async function releaseImageInputs(schemas, id) {
+  const pinned = await editionPinnedInputs(id, { schemas });
   return {
     lock: validateImmutableDistributionLock(
       readBoundDistributionFile({
@@ -1499,8 +1502,8 @@ function releaseImageInputs(schemas, id) {
         parse: (raw) => parseResolvedDistributionLock(schemas, raw),
       }).value,
     ),
-    runtimeSourceIndex: schemas.parseRuntimeImageSourceIndex(readJson(runtimeImageSourceIndexPath())),
-    biomeIndex: readJson(biomeIndexPath()),
+    runtimeSourceIndex: pinned.runtimeImageSourceIndex,
+    biomeIndex: pinned.biomeIndex,
     requiredPlatforms: resolveDistributionRequiredPlatforms(schemas, id),
     declaredSources: resolveDistributionDeclaredSources(schemas, id),
   };
@@ -1542,7 +1545,7 @@ export async function resolveImageRows(id, { inputs, lock } = {}) {
     biomeIndex,
     requiredPlatforms,
     declaredSources,
-  } = inputs === undefined ? releaseImageInputs(schemas, id) : snapshotImageInputs(schemas, { inputs, lock });
+  } = inputs === undefined ? await releaseImageInputs(schemas, id) : snapshotImageInputs(schemas, { inputs, lock });
   // Materialise every EXTERNAL source at the commit the lock pins, and resolve
   // every `repo` handle through one locator from here down.
   const locate = sourceTreeLocator(externalSourceTrees(distributionLock));
@@ -1652,6 +1655,17 @@ export async function resolveImageRows(id, { inputs, lock } = {}) {
       ),
     };
   });
+  // Release lane only: a develop snapshot or customer overlay is not covered by
+  // the committed ledger.
+  if (inputs === undefined) {
+    assertBuildLedgerComplete({
+      ledger: readBuildLedger(),
+      distributionId: id,
+      subjects,
+      requiredPlatforms,
+      expectedAt: join(dataRoot(), BUILD_LEDGER_FILE),
+    });
+  }
   const webBiomes = structure.webBiomes.map((biome) => ({
     ...biome,
     sourceCommit: commitsBefore.get(biome.repo),

package/edition/seal-image-digests.mjs

@@ -118,6 +118,7 @@ import { fetchCatalogue } from './catalogue-fetch.mjs';
 import { readCataloguePin } from './catalogue-pin.mjs';
 import { CATALOGUE_TOKEN_ENV_FLAG, CATALOGUE_USERNAME_FLAG, DEFINITION_FLAG } from './customer-flags.mjs';
 import { EditionChannel } from './edition-constants.mjs';
+import { editionPinnedInputs } from './edition-pinned-inputs.mjs';
 import { WorkspaceRoot, biomeIndexPath, configureEditionWorkspaceFromProcess, editionsRoot, isEntryModule, runtimeImageSourceIndexPath } from './edition-workspace.mjs';
 import {
   assertCoordinatesFinal,
@@ -508,11 +509,14 @@ export async function sealEditionLocks({ distributionId, root, digests = new Map
   }
   const raw = JSON.parse(readFileSync(lockPath, 'utf8'));
   const imageLock = schemas.parseImageLock(rawImages);
-  const pinned = vendoredCommit ?? ((repo) => createPinnedSourceAuthority({ pins: committedRepositoryPins() }).vendoredSourceCommitForRepository(repo));
+  // A release seal reads the EDITION's indexes and pins (a held repository is sealed at the held commit); a
+  // customer seal (catalogue) and a develop seal (injected `vendoredCommit`) are not vendor release editions.
+  const editionInputs = catalogue === undefined && vendoredCommit === undefined ? await editionPinnedInputs(distributionId, { schemas }) : undefined;
+  const pinned = vendoredCommit ?? ((repo) => createPinnedSourceAuthority({ pins: editionInputs?.repositoryPins ?? committedRepositoryPins() }).vendoredSourceCommitForRepository(repo));
   const lockDocument = raw !== null && typeof raw === 'object' && 'unsealedSchema' in raw ? schemas.parseUnsealedDistributionLock(raw) : schemas.parseDistributionLock(raw);
   if (lockMountsAdapters(lockDocument)) {
     // The adapter host's row: the verified catalogue's for a customer, the data root's biome index for the vendor.
-    const rows = catalogue === undefined ? JSON.parse(readFileSync(biomeIndexPath(), 'utf8')) : catalogue.biomes;
+    const rows = catalogue !== undefined ? catalogue.biomes : (editionInputs?.biomeIndex ?? JSON.parse(readFileSync(biomeIndexPath(), 'utf8')));
     await assertAdapterBundlesMatchHost({ lock: lockDocument, hostRow: adapterHostRow(rows), fetchManifest });
   }
   const result = await sealOrVerifyLock({
@@ -762,9 +766,12 @@ async function main() {
     ),
     imageLock,
     distributionId,
-    runtimeSourceIndex: JSON.parse(
-      readFileSync(runtimeImageSourceIndexPath(), 'utf8'),
-    ),
+    // A vendor edition grades the pins it RESOLVES at (a held repository is graded at the held commit);
+    // a customer seal grades the data root's committed index.
+    runtimeSourceIndex:
+      catalogue === undefined
+        ? (await editionPinnedInputs(distributionId, { schemas: await loadKernelDistributionSchemas() })).runtimeImageSourceIndex
+        : JSON.parse(readFileSync(runtimeImageSourceIndexPath(), 'utf8')),
   });
 
   const { writes, unchanged } = planDigestSeal({

package/edition/source-authority.mjs

@@ -9,6 +9,7 @@ import {
 import { tmpdir } from 'node:os';
 import { join, relative, resolve, sep } from 'node:path';
 
+import { BUILD_LEDGER_FILE, readBuildLedger } from './build-ledger.mjs';
 import { dataRoot, sourcesRoot } from './edition-workspace.mjs';
 
 export const PUBLISHED_SOURCE_REF = 'refs/remotes/origin/main';
@@ -91,7 +92,7 @@ const BUILT_COMMIT_SEARCH_LIMIT = 500;
  * A pin frozen eight days in the past is what kept a fix for a production
  * crashloop out of every image built from it.
  */
-export const BUILD_LEDGER_FILE = 'build-ledger.json';
+export { BUILD_LEDGER_FILE };
 
 /**
  * Read the committed ledger. A caller that resolves many repositories should
@@ -106,25 +107,11 @@ export const BUILD_LEDGER_FILE = 'build-ledger.json';
 export function loadBuildLedger(
   distributionsDir = dataRoot(),
 ) {
-  const path = join(distributionsDir, BUILD_LEDGER_FILE);
-  let raw;
-  try {
-    raw = JSON.parse(readFileSync(path, 'utf8'));
-  } catch (error) {
-    if (error?.code === 'ENOENT') {return null;}
-    throw error;
-  }
-  if (
-    raw === null ||
-    typeof raw !== 'object' ||
-    raw.schemaVersion !== 1 ||
-    typeof raw.repositories !== 'object' ||
-    raw.repositories === null ||
-    Array.isArray(raw.repositories)
-  ) {
-    throw new Error(`${BUILD_LEDGER_FILE} is not strict schema v1`);
-  }
-  return raw.repositories;
+  const ledger = readBuildLedger(distributionsDir);
+  if (ledger === null) {return null;}
+  return Object.fromEntries(
+    Object.entries(ledger.repositories).map(([repo, entry]) => [repo, entry.commits]),
+  );
 }
 
 /**
@@ -197,7 +184,7 @@ function ledgerCommits(repo, ledger) {
  * positive — each is a record that a build actually happened — while either
  * alone has been measured missing whole repositories.
  */
-function builtCommits(directory, ref, repo, ledger) {
+export function builtCommits(directory, ref, repo, ledger) {
   const fromTree = evidenceTreeCommits(directory, ref);
   const fromLedger = ledgerCommits(repo, ledger);
   // Null from BOTH means neither record has ever heard of this repository, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.31.2",
+  "version": "0.33.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -85,13 +85,13 @@
     "verify:pack": "node ./scripts/verify-packed-assets.cjs",
     "format": "prettier --write \"src/**/*.ts\"",
     "start": "node ./dist/cli.js",
-    "lint": "eslint .",
+    "lint": "eslint . --max-warnings 0",
     "lint:fix": "eslint . --fix",
     "test": "jest --config jest.config.cjs && pnpm run test:edition",
     "test:edition": "node --test \"edition/*.test.mjs\" \"edition/*-contract-tests.mjs\"",
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:98d3df3b954a3e3149f8099e228a7649cbba3f0ed37fbfc59c2c1e3cc3a2acef"
+    "sourceDigest": "sha256:ec5750fec69809f0c18307f59b655b145349cffd670741ac33dbb1aac0029d62"
   }
 }