@xemahq/xema 0.33.1 → 0.33.2

package/dist/assets/distribution-assets.manifest.json

@@ -17,15 +17,6 @@
         "minimal/images.lock.json"
       ]
     },
-    {
-      "id": "core",
-      "sourceCommit": "59da66e97c7b38ec98b7846f2cfb7fbc750c3078",
-      "inputHash": "149da78845960be49cc1020621deedc204ab78ce082f47226fe22ec9ea0b33d4",
-      "files": [
-        "core/distribution.lock.json",
-        "core/images.lock.json"
-      ]
-    },
     {
       "id": "starter",
       "sourceCommit": "59da66e97c7b38ec98b7846f2cfb7fbc750c3078",
@@ -73,6 +64,7 @@
     }
   ],
   "excludedEditions": {
+    "core": "paused in xema-distributions (paused/core) until the kernel optional-operation marker and the base floor re-declaration; returns then",
     "xema-internal": "operator-audience edition (pulls the operator-only fleet-management biome). @xemahq/xema is a PUBLIC npm package; operator inventory does not belong in it. Operators run it from the aggregator checkout or with --lock."
   },
   "packageAssets": [
@@ -107,14 +99,6 @@
       "path": "cloud/images.lock.json",
       "sha256": "08b8b97f8a2d015e90023224fe91fd498f58161d92a3d978b8d66f0eb9e58009"
     },
-    {
-      "path": "core/distribution.lock.json",
-      "sha256": "de3630156fb43d91d11d8c614ab473f4786eabc751cef3d3c46b6528cca6d240"
-    },
-    {
-      "path": "core/images.lock.json",
-      "sha256": "2f087f1d459949051f1b6aa99fb0c9fc14dcfb3d947865af23568be6a50b31fd"
-    },
     {
       "path": "keycloak/realm-xema.json",
       "sha256": "19d088befb751bffba361d0d6a0ccaacf5338b891d2e2f2929f39a710b6428ac"

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -2203,223 +2203,223 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:bbeac7ff01376cb89ed2140526d4795d8e559b3f01612b404a701f19aaa24c6a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:161f522eb39e3db705bc709f8512988dd3e6752851d972521354eeccffd8075d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:fbda500315d45e35eb974f4701bbf36729c3b642a5d735bc1b07085c91d25b23"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:e3997bd9a0082e02d01760868b2a4f41ed3081e904126b30fdf86e7938dc6137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:71ae51028847ab3430ffec9b229b0516a7705b75a6de1fcfa665f5e1abf8e9bb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:c575e96b70bda82899931eb0b18567988e2e13e664fa498bcbef96b571dcabb4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:aa1a05f1728813a7bdb1e02d9305e9adf641d695e6767305210c67a1d81b38a7"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:2940a0ee8662970722aa2618a1635f8d5b4f5e54b85f09667f71ccf7c2c81b03"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b2190ace174a29875e2a9bd7209460b0ef6de186aca9b31bcd45dc17af57c1ba"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:f7267e93fd7dc07cf65fb8cac2c4439d28a72c1e0acbdeca1648c6859440eb32"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:b9dd5c01903394436530783614efb0cd357d982ed2befd844a39328479773cbc"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:09945712ecc6524d5f52cfd82141ef4cade45be35210777f6e32818792068881"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:20abdde62a7b037c01ea9bbe1ff1e6094e6b0efd0add2f656f1938a04409bf82"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/lib.mjs",
       "sha256": "sha256:4777627b3665e154f466251eb684ea7299ecd3c683447f65f2cc5b4041d29bdb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:ffe6fdc9da6b2974270fc86c11be0c41d0bc6d85c8e3c137d3c3bc00a72fc4f6"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/pin-source.mjs",
-      "sha256": "sha256:4e64d25b7aacec344253d1963f419f946998f36e8c269eea58b8c848e0f35e52"
+      "sha256": "sha256:fbaa6dffbdf4a262a13127bcf37bca791234fae74e327ac250e56ff4b78c1244"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:858b607dde94e2abd00a341f569e18cfa567d4bff139c64a2d60abbb7de4c85e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:62f83f8bb835f360535402d12657156d2c9d6e651b426c2b30a04a2dc2f8d3e8"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:058c849767434e9ba911d9310092bede42e3ef959c75bbd35ff8879dc21ce3ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.1",
+      "version": "0.33.2",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/edition/checkout-indexed-source-repositories.mjs

@@ -35,10 +35,14 @@ export function sourceCheckoutPlan(index, { sourceRepositoryUrlPrefix }) {
     if (!SHA.test(String(pin.sourceCommit ?? ''))) {
       throw new Error(`${pin.repo} sourceCommit is not exact lowercase 40-hex`);
     }
+    if (!SHA.test(String(pin.vendoredSourceCommit ?? ''))) {
+      throw new Error(`${pin.repo} vendoredSourceCommit is not exact lowercase 40-hex`);
+    }
     return Object.freeze({
       repo: pin.repo,
       repositoryUrl: pin.repositoryUrl,
       sourceCommit: pin.sourceCommit,
+      vendoredSourceCommit: pin.vendoredSourceCommit,
     });
   });
 }
@@ -47,6 +51,18 @@ function git(args, env) {
   execFileSync('git', args, { env, stdio: 'inherit' });
 }
 
+/**
+ * The SOURCE-axis commit a checkout must also hold when it differs from the
+ * image-axis `sourceCommit`: dist-check, publish-editions, seal-image-digests and
+ * store-publish read vendored and content-only bytes at `vendoredSourceCommit`.
+ * Maps repo to that commit; repositories whose axes are equal are absent.
+ */
+export function sourceAxisExtraCommits(plan) {
+  return new Map(
+    plan.filter((entry) => entry.vendoredSourceCommit !== entry.sourceCommit).map((entry) => [entry.repo, entry.vendoredSourceCommit]),
+  );
+}
+
 /**
  * The extra commits each checkout must also hold: resolve reads every platform
  * service's manifest at the `sourceCommit` platform-service-index.json pins, and
@@ -118,6 +134,7 @@ export function checkoutIndexedSources({ workspaceRoot, index, platformServiceIn
   const workspace = editionWorkspaceConfig();
   const plan = sourceCheckoutPlan(index, workspace);
   const extraCommits = platformServiceExtraCommits(plan, platformServiceIndex);
+  const sourceAxisCommits = sourceAxisExtraCommits(plan);
   const heldCommits = editionHeldCommits(plan, editionSourcePins);
   for (const entry of plan) {holdSource({ name: entry.repo, url: entry.repositoryUrl }, workspace, env);}
   for (const entry of plan) {
@@ -138,6 +155,11 @@ export function checkoutIndexedSources({ workspaceRoot, index, platformServiceIn
       if (actual !== entry.sourceCommit) {
         throw new Error(`${entry.repo} resolved ${actual}, expected ${entry.sourceCommit}`);
       }
+      if (sourceAxisCommits.has(entry.repo)) {
+        const commit = sourceAxisCommits.get(entry.repo);
+        runGit(['-C', target, 'fetch', '--quiet', '--depth=1', 'origin', commit], gitEnv);
+        console.log(`[source-checkout] ${entry.repo} also holds source-axis commit ${commit}`);
+      }
       for (const commit of extraCommits.get(entry.repo) ?? []) {
         runGit(['-C', target, 'fetch', '--quiet', '--depth=1', 'origin', commit], gitEnv);
         console.log(`[source-checkout] ${entry.repo} also holds platform-service commit ${commit}`);

package/edition/pin-source.mjs

@@ -222,10 +222,16 @@ function applySnapshot(runtimeSourceIndex, pins) {
     ...runtimeSourceIndex,
     repositoryPins: graph.map((pin) => ({
       ...pin,
-      // The IMAGE axis only. `vendoredSourceCommit` is the SOURCE axis (the
-      // published tip vendored bytes come from) and is deliberately NOT fused
-      // with it: see `build-runtime-image-source-index.mjs#repositoryIdentity`
-      // for the measured production failure that fusing the two caused.
+      // A develop snapshot pins every repository at its develop head, so that one
+      // SHA is both the built commit (image axis, `sourceCommit`) and the source
+      // tip (`vendoredSourceCommit`): the image pin lagging the source tip cannot
+      // arise, and the snapshot is "one frozen snapshot of pins and nothing else".
+      // Fusing both axes is the rule `effectiveRepositoryPins` and
+      // `createExactCommitSourceAuthority` already apply for an exact commit.
+      // The COMMITTED index keeps the axes apart (release channel): see
+      // `source-authority.mjs#publishedSourceTip` and
+      // `build-runtime-image-source-index.mjs#repositoryIdentity`.
+      vendoredSourceCommit: pins[pin.repo],
       sourceCommit: pins[pin.repo],
     })),
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.33.1",
+  "version": "0.33.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:a6f12761c7c95f7810ac5134c53e5e9712d2822e7f3d0a91f96eed09741f9605"
+    "sourceDigest": "sha256:de506f4bb207dcf31fb135d585486f8fa5bf4fc11d0d1841506d8773393fa423"
   }
 }