@xemahq/xema 0.32.0 → 0.33.1

package/edition/release-catalogue.mjs

@@ -1,21 +1,22 @@
 // release-catalogue — the catalogue of a RELEASE offering, from its committed, sealed locks.
 
-import { readFileSync } from 'node:fs';
-
 import { biomeSourceTreeIds } from './biome-content.mjs';
 import { buildCatalogue } from './catalogue.mjs';
 import { EditionChannel } from './edition-constants.mjs';
-import { biomeIndexPath, kernelPackageDir, platformServiceIndexPath, runtimeImageSourceIndexPath } from './edition-workspace.mjs';
+import { editionPinnedInputs } from './edition-pinned-inputs.mjs';
+import { kernelPackageDir } from './edition-workspace.mjs';
 import { kernelPackageOfAuthority } from './kernel-package.mjs';
 import { loadKernelDistributionSchemas } from './lib.mjs';
 import { loadEditionManifest } from './resolve-distribution.mjs';
 import { externalSourceTrees, sourceTreeLocator } from './resolve-images.mjs';
-import { committedRepositoryPins, createPinnedSourceAuthority } from './source-authority.mjs';
+import { createPinnedSourceAuthority } from './source-authority.mjs';
 
 /** The catalogue of release offering `id`, from the committed locks (`locks` as `readCommittedEdition` returns them). */
 export async function releaseCatalogue(id, locks, { fetchKernelTarball } = {}) {
   const schemas = await loadKernelDistributionSchemas();
-  const authority = createPinnedSourceAuthority({ pins: committedRepositoryPins() });
+  // The EDITION's indexes and pins: a held repository is catalogued at the held commit.
+  const pinned = await editionPinnedInputs(id, { schemas });
+  const authority = createPinnedSourceAuthority({ pins: pinned.repositoryPins });
   // The WRITER of the catalogue's tree ids: the real `git rev-parse <commit>:<path>` of every biome.
   const sourceTreeIds = await biomeSourceTreeIds({
     schemas,
@@ -24,7 +25,7 @@ export async function releaseCatalogue(id, locks, { fetchKernelTarball } = {}) {
     locate: sourceTreeLocator(externalSourceTrees(locks.distributionLock)),
     vendoredCommit: (repo) => authority.vendoredSourceCommitForRepository(repo),
   });
-  const contractAuthority = schemas.parseRuntimeImageSourceIndex(JSON.parse(readFileSync(runtimeImageSourceIndexPath(), 'utf8'))).contractAuthority;
+  const { contractAuthority } = pinned.runtimeImageSourceIndex;
   return buildCatalogue({
     sourceTreeIds,
     offeringId: id,
@@ -32,8 +33,8 @@ export async function releaseCatalogue(id, locks, { fetchKernelTarball } = {}) {
     distributionLock: locks.distributionLock,
     imageLock: locks.imageLock,
     chartSetLock: locks.chartSetLock,
-    biomeIndex: JSON.parse(readFileSync(biomeIndexPath(), 'utf8')),
-    platformServiceIndex: schemas.parsePlatformServiceSourceIndex(JSON.parse(readFileSync(platformServiceIndexPath(), 'utf8'))),
+    biomeIndex: pinned.biomeIndex,
+    platformServiceIndex: pinned.platformServiceIndex,
     contractAuthority,
     kernel: await kernelPackageOfAuthority({
       kernelPackageDir: kernelPackageDir(),

package/edition/release-edition-artifact.mjs

@@ -21,13 +21,14 @@ import { assertCanonicalDistributionId } from './distribution-paths.mjs';
 import { LOCAL_WORKFLOW, assertEngineImage, editionTarget, workflowFromEnv, writeEditionArtifact } from './edition-artifact.mjs';
 import { assertRosteredChartSetLock } from './edition-chart-set.mjs';
 import { EditionChannel, EditionLockFile } from './edition-constants.mjs';
+import { editionPinnedInputs } from './edition-pinned-inputs.mjs';
 import { WorkspaceRoot, configureEditionWorkspaceFromProcess, editionsRoot, isEntryModule } from './edition-workspace.mjs';
 import { descriptorEvidenceTrust } from './evidence-trust-policy.mjs';
 import { loadKernelDistributionSchemas, validateImmutableImageLock } from './lib.mjs';
 import { releaseCatalogue } from './release-catalogue.mjs';
 import { assertReleaseEditionTree } from './release-channel-guard.mjs';
 import { externalSourceTrees, sourceTreeLocator } from './resolve-images.mjs';
-import { committedRepositoryPins, createPinnedSourceAuthority } from './source-authority.mjs';
+import { createPinnedSourceAuthority } from './source-authority.mjs';
 
 if (isEntryModule(import.meta.url)) {
   configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Sources, WorkspaceRoot.Kernel]);
@@ -110,7 +111,7 @@ export async function readCommittedEdition(id, root = editionsRoot()) {
       { cause: error },
     );
   }
-  const authority = createPinnedSourceAuthority({ pins: committedRepositoryPins() });
+  const authority = createPinnedSourceAuthority({ pins: (await editionPinnedInputs(id, { schemas })).repositoryPins });
   await verifyBiomeContentHashes({
     schemas,
     lock: sealed,

package/edition/resolve-distribution.mjs

@@ -77,7 +77,9 @@ import {
 import { resolveDispatchedRuntimeComponents } from './dispatched-runtime-components.mjs';
 import { fleetChartSetLockPath, writeEditionChartSet } from './edition-chart-set.mjs';
 import { workspaceSection } from './edition-config.mjs';
-import { WorkspaceRoot, biomeIndexPath, configureEditionWorkspaceFromProcess, editionsRoot, isEntryModule, kernelPackageDir, platformServiceIndexPath } from './edition-workspace.mjs';
+import { editionPinnedInputs } from './edition-pinned-inputs.mjs';
+import { splitEditionDefinition } from './edition-source-pins.mjs';
+import { WorkspaceRoot, configureEditionWorkspaceFromProcess, editionsRoot, isEntryModule, kernelPackageDir } from './edition-workspace.mjs';
 import { walkDeclaredSources } from './external-source-walk.mjs';
 import {
   biomeTierOrder,
@@ -260,7 +262,7 @@ export function loadEditionManifest(parseDistribution, id) {
         "(core class, the classes the edition's include names, and services a shipped biome's API requires)",
     );
   }
-  const manifest = parseDistribution(raw);
+  const manifest = parseDistribution(splitEditionDefinition(raw, id).document);
   if (manifest.id !== id) {
     throw new Error(`distribution at ${path} declares id "${manifest.id}", but it was addressed as "${id}"`);
   }
@@ -314,26 +316,6 @@ export function composeManifest(manifest, pinSource = PUBLISHED_PIN_SOURCE) {
   };
 }
 
-function readBiomeIndex() {
-  if (!existsSync(biomeIndexPath())) {
-    throw new Error(
-      `${biomeIndexPath()} not found — run \`${commandFor('build-biome-index.mjs')}\` first`,
-    );
-  }
-  return JSON.parse(readFileSync(biomeIndexPath(), 'utf8'));
-}
-
-function readPlatformServiceIndex(parsePlatformServiceSourceIndex) {
-  if (!existsSync(platformServiceIndexPath())) {
-    throw new Error(
-      `${platformServiceIndexPath()} not found — run the trusted platform-service index generator first`,
-    );
-  }
-  return parsePlatformServiceSourceIndex(
-    JSON.parse(readFileSync(platformServiceIndexPath(), 'utf8')),
-  );
-}
-
 /** Unique key for an index/lock entry (id+target+repo distinguishes cultivar/reference + web/server pairs). */
 function entryKey(e) {
   return JSON.stringify([e.id, e.target, e.repo]);
@@ -2229,8 +2211,14 @@ export async function resolveDistributionWithIndex(id, { materialize, inputs, re
   // THE RELEASE READS THESE FROM DISK; A DEVELOP SNAPSHOT INJECTS THEM
   // (`develop-snapshot-inputs.mjs`). Either way they pass through the one
   // validation below, so there is a single resolve path and two sources.
-  const claimedPlatformServiceIndex =
-    inputs?.platformServiceIndex ?? readPlatformServiceIndex(schemas.parsePlatformServiceSourceIndex);
+  // The edition's own indexes (editionPinnedInputs): the committed ones, or
+  // rebuilt at the repositories it holds. Read only when the caller injected
+  // neither.
+  const pinned =
+    inputs?.platformServiceIndex === undefined || inputs?.biomeIndex === undefined
+      ? await editionPinnedInputs(id, { schemas })
+      : undefined;
+  const claimedPlatformServiceIndex = inputs?.platformServiceIndex ?? pinned.platformServiceIndex;
   // OWNERSHIP IS THE SERVICE'S OWN STATEMENT: each entry's capability domains
   // are re-derived from its pinned source manifest (hash-verified), so a
   // hand-edited index cannot move where grants land. Only the customer resolve
@@ -2242,7 +2230,7 @@ export async function resolveDistributionWithIndex(id, { materialize, inputs, re
       ? claimedPlatformServiceIndex
       : verifiedPlatformServiceIndex(claimedPlatformServiceIndex, { readManifest });
   const platformIndex = validateServiceDependencyOwnerParity(
-    validateImmutableBiomeIndex(inputs?.biomeIndex ?? readBiomeIndex()),
+    validateImmutableBiomeIndex(inputs?.biomeIndex ?? pinned.biomeIndex),
     platformServiceIndex,
   );
   const { entries, sourceRecords } = await walkDeclaredSources({

package/edition/resolve-images.mjs

@@ -45,7 +45,8 @@ import {
   readBoundDistributionFile,
 } from './distribution-paths.mjs';
 import { editionWorkspaceConfig } from './edition-config.mjs';
-import { biomeIndexPath, dataRoot, editionsRoot, runtimeImageSourceIndexPath, WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, sourcePath, sourcesRoot } from './edition-workspace.mjs';
+import { editionPinnedInputs } from './edition-pinned-inputs.mjs';
+import { dataRoot, editionsRoot, WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, sourcePath, sourcesRoot } from './edition-workspace.mjs';
 import {
   externalSourceCacheDir,
   materializeGitSource,
@@ -68,7 +69,6 @@ import {
 } from './lib.mjs';
 import { assertReleaseContent } from './release-channel-guard.mjs';
 import { composeEdition } from './resolve-distribution.mjs';
-import { readStrictJsonFile } from './strict-json.mjs';
 
 if (isEntryModule(import.meta.url)) {
   configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Sources, WorkspaceRoot.Kernel, WorkspaceRoot.Cache]);
@@ -164,10 +164,6 @@ const FIRST_PARTY_TREES = (repo) => ({ dir: sourcePath(repo), base: sourcesRoot(
 const imageBuildInputHashByIdentity = new Map();
 const sourceManifestHashByIdentity = new Map();
 
-function readJson(path) {
-  return readStrictJsonFile(path);
-}
-
 /**
  * Memoized image build-input closure hash.
  *
@@ -1489,8 +1485,13 @@ export function resolveCrossRepoInputsForRoster({
   return crossRepoInputsByConsumer;
 }
 
-/** The release's inputs: the COMMITTED locks and indexes, read from disk. */
-function releaseImageInputs(schemas, id) {
+/**
+ * The release's inputs: the COMMITTED lock, and the edition's own indexes
+ * (`editionPinnedInputs`: the committed ones, or rebuilt at the repositories the
+ * edition holds).
+ */
+async function releaseImageInputs(schemas, id) {
+  const pinned = await editionPinnedInputs(id, { schemas });
   return {
     lock: validateImmutableDistributionLock(
       readBoundDistributionFile({
@@ -1501,8 +1502,8 @@ function releaseImageInputs(schemas, id) {
         parse: (raw) => parseResolvedDistributionLock(schemas, raw),
       }).value,
     ),
-    runtimeSourceIndex: schemas.parseRuntimeImageSourceIndex(readJson(runtimeImageSourceIndexPath())),
-    biomeIndex: readJson(biomeIndexPath()),
+    runtimeSourceIndex: pinned.runtimeImageSourceIndex,
+    biomeIndex: pinned.biomeIndex,
     requiredPlatforms: resolveDistributionRequiredPlatforms(schemas, id),
     declaredSources: resolveDistributionDeclaredSources(schemas, id),
   };
@@ -1544,7 +1545,7 @@ export async function resolveImageRows(id, { inputs, lock } = {}) {
     biomeIndex,
     requiredPlatforms,
     declaredSources,
-  } = inputs === undefined ? releaseImageInputs(schemas, id) : snapshotImageInputs(schemas, { inputs, lock });
+  } = inputs === undefined ? await releaseImageInputs(schemas, id) : snapshotImageInputs(schemas, { inputs, lock });
   // Materialise every EXTERNAL source at the commit the lock pins, and resolve
   // every `repo` handle through one locator from here down.
   const locate = sourceTreeLocator(externalSourceTrees(distributionLock));

package/edition/seal-image-digests.mjs

@@ -118,6 +118,7 @@ import { fetchCatalogue } from './catalogue-fetch.mjs';
 import { readCataloguePin } from './catalogue-pin.mjs';
 import { CATALOGUE_TOKEN_ENV_FLAG, CATALOGUE_USERNAME_FLAG, DEFINITION_FLAG } from './customer-flags.mjs';
 import { EditionChannel } from './edition-constants.mjs';
+import { editionPinnedInputs } from './edition-pinned-inputs.mjs';
 import { WorkspaceRoot, biomeIndexPath, configureEditionWorkspaceFromProcess, editionsRoot, isEntryModule, runtimeImageSourceIndexPath } from './edition-workspace.mjs';
 import {
   assertCoordinatesFinal,
@@ -508,11 +509,14 @@ export async function sealEditionLocks({ distributionId, root, digests = new Map
   }
   const raw = JSON.parse(readFileSync(lockPath, 'utf8'));
   const imageLock = schemas.parseImageLock(rawImages);
-  const pinned = vendoredCommit ?? ((repo) => createPinnedSourceAuthority({ pins: committedRepositoryPins() }).vendoredSourceCommitForRepository(repo));
+  // A release seal reads the EDITION's indexes and pins (a held repository is sealed at the held commit); a
+  // customer seal (catalogue) and a develop seal (injected `vendoredCommit`) are not vendor release editions.
+  const editionInputs = catalogue === undefined && vendoredCommit === undefined ? await editionPinnedInputs(distributionId, { schemas }) : undefined;
+  const pinned = vendoredCommit ?? ((repo) => createPinnedSourceAuthority({ pins: editionInputs?.repositoryPins ?? committedRepositoryPins() }).vendoredSourceCommitForRepository(repo));
   const lockDocument = raw !== null && typeof raw === 'object' && 'unsealedSchema' in raw ? schemas.parseUnsealedDistributionLock(raw) : schemas.parseDistributionLock(raw);
   if (lockMountsAdapters(lockDocument)) {
     // The adapter host's row: the verified catalogue's for a customer, the data root's biome index for the vendor.
-    const rows = catalogue === undefined ? JSON.parse(readFileSync(biomeIndexPath(), 'utf8')) : catalogue.biomes;
+    const rows = catalogue !== undefined ? catalogue.biomes : (editionInputs?.biomeIndex ?? JSON.parse(readFileSync(biomeIndexPath(), 'utf8')));
     await assertAdapterBundlesMatchHost({ lock: lockDocument, hostRow: adapterHostRow(rows), fetchManifest });
   }
   const result = await sealOrVerifyLock({
@@ -762,9 +766,12 @@ async function main() {
     ),
     imageLock,
     distributionId,
-    runtimeSourceIndex: JSON.parse(
-      readFileSync(runtimeImageSourceIndexPath(), 'utf8'),
-    ),
+    // A vendor edition grades the pins it RESOLVES at (a held repository is graded at the held commit);
+    // a customer seal grades the data root's committed index.
+    runtimeSourceIndex:
+      catalogue === undefined
+        ? (await editionPinnedInputs(distributionId, { schemas: await loadKernelDistributionSchemas() })).runtimeImageSourceIndex
+        : JSON.parse(readFileSync(runtimeImageSourceIndexPath(), 'utf8')),
   });
 
   const { writes, unchanged } = planDigestSeal({

package/edition/source-authority.mjs

@@ -184,7 +184,7 @@ function ledgerCommits(repo, ledger) {
  * positive — each is a record that a build actually happened — while either
  * alone has been measured missing whole repositories.
  */
-function builtCommits(directory, ref, repo, ledger) {
+export function builtCommits(directory, ref, repo, ledger) {
   const fromTree = evidenceTreeCommits(directory, ref);
   const fromLedger = ledgerCommits(repo, ledger);
   // Null from BOTH means neither record has ever heard of this repository, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.32.0",
+  "version": "0.33.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:94a9ed139c70716ccb6c498689b91e849e0f1576901722f0bef67403ba7fe593"
+    "sourceDigest": "sha256:a6f12761c7c95f7810ac5134c53e5e9712d2822e7f3d0a91f96eed09741f9605"
   }
 }