@xemahq/xema 0.33.1 → 0.33.3

package/edition/git-json.mjs

@@ -0,0 +1,54 @@
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+import { parseStrictJson } from './strict-json.mjs';
+
+const requireFromHere = createRequire(import.meta.url);
+
+let loadedSourceHash;
+
+/** Git-object primitives of `@xemahq/distribution-source-hash`; no kernel is consulted. */
+function gitObjectReader() {
+  loadedSourceHash ??= requireFromHere('@xemahq/distribution-source-hash');
+  return loadedSourceHash;
+}
+
+/**
+ * Read + parse a JSON file out of an exact Git commit (never the work tree).
+ *
+ * This is the seam every authored source file crosses on its way into a lock
+ * or an index — `xema-biome.json`, a platform service's `package.json`,
+ * `cross-repo-build-inputs.json`, the committed generated biome index — so it
+ * parses STRICTLY: a duplicated object key is refused, naming the commit, the
+ * path and the JSON pointer of the object. `JSON.parse` would keep the last
+ * occurrence, which is how a `resources` declaration was dropped from a sealed
+ * lock with every reader agreeing (see `strict-json.mjs`).
+ *
+ * The commit check, the buffer ceiling and the exact-UTF-8 decode are the
+ * source-hash package's own (loaded WITHOUT the kernel check hashing needs, so
+ * the source checkout, which runs before any kernel is built, can read a record
+ * too); only the parse differs from its
+ * `readGitJsonAtCommit`, which is lenient and is therefore not delegated to.
+ */
+export function readGitJsonAtCommit(repoDir, repoRelativePath, commit) {
+  const sourceHash = gitObjectReader();
+  sourceHash.assertGitCommitExists(repoDir, commit);
+  let raw;
+  try {
+    raw = execFileSync(
+      'git',
+      ['-C', repoDir, 'show', `${commit}:${repoRelativePath}`],
+      {
+        encoding: 'buffer',
+        maxBuffer: sourceHash.GIT_OBJECT_MAX_BUFFER_BYTES,
+        stdio: ['ignore', 'pipe', 'pipe'],
+      },
+    );
+  } catch {
+    throw new Error(
+      `cannot read "${repoRelativePath}" from Git commit "${commit}"`,
+    );
+  }
+  const context = `Git object "${commit}:${repoRelativePath}"`;
+  return parseStrictJson(sourceHash.decodeExactUtf8(raw, context), context);
+}

package/edition/lib.mjs

@@ -30,6 +30,7 @@ import {
   sourcePath,
 } from './edition-workspace.mjs';
 import { SHA256_HEX_PATTERN } from './evidence-grammars.mjs';
+import { readGitJsonAtCommit } from './git-json.mjs';
 import { isKernelCapabilityDomain } from './kernel-capability-domain.mjs';
 import {
   assertPrivilegesHavePrincipals,
@@ -42,7 +43,7 @@ import {
   PUBLISHED_SOURCE_REF,
   publishedSourceCommit,
 } from './source-authority.mjs';
-import { parseStrictJson, readStrictJsonFile } from './strict-json.mjs';
+import { readStrictJsonFile } from './strict-json.mjs';
 import { compareStrings } from './string-order.mjs';
 
 export {
@@ -51,6 +52,7 @@ export {
   DistributionSourceMode,
   PUBLISHED_SOURCE_REF,
   publishedSourceCommit,
+  readGitJsonAtCommit,
 };
 
 
@@ -3063,167 +3065,3 @@ export function hashImageBuildInputs(request, algorithm) {
   return distributionSourceHash().hashImageBuildInputs(request, algorithm);
 }
 
-/**
- * Read + parse a JSON file out of an exact Git commit (never the work tree).
- *
- * This is the seam every authored source file crosses on its way into a lock
- * or an index — `xema-biome.json`, a platform service's `package.json`,
- * `cross-repo-build-inputs.json`, the committed generated biome index — so it
- * parses STRICTLY: a duplicated object key is refused, naming the commit, the
- * path and the JSON pointer of the object. `JSON.parse` would keep the last
- * occurrence, which is how a `resources` declaration was dropped from a sealed
- * lock with every reader agreeing (see `strict-json.mjs`).
- *
- * The commit check, the buffer ceiling and the exact-UTF-8 decode are the
- * source-hash package's own; only the parse differs from its
- * `readGitJsonAtCommit`, which is lenient and is therefore not delegated to.
- */
-export function readGitJsonAtCommit(repoDir, repoRelativePath, commit) {
-  const sourceHash = distributionSourceHash();
-  sourceHash.assertGitCommitExists(repoDir, commit);
-  let raw;
-  try {
-    raw = execFileSync(
-      'git',
-      ['-C', repoDir, 'show', `${commit}:${repoRelativePath}`],
-      {
-        encoding: 'buffer',
-        maxBuffer: sourceHash.GIT_OBJECT_MAX_BUFFER_BYTES,
-        stdio: ['ignore', 'pipe', 'pipe'],
-      },
-    );
-  } catch {
-    throw new Error(
-      `cannot read "${repoRelativePath}" from Git commit "${commit}"`,
-    );
-  }
-  const context = `Git object "${commit}:${repoRelativePath}"`;
-  return parseStrictJson(sourceHash.decodeExactUtf8(raw, context), context);
-}
-
-/**
- * The producing repository's OWN committed record of what it vendored.
- *
- * `vendor-cross-repo-inputs.mjs` reads exactly this file, at the commit being
- * built, to emit the `--vendored <dest>=<repoDir>@<commit>:<src>` arguments it
- * hands `compute-image-tag.mjs`. It is therefore the ONLY source of the vendored
- * commit that can agree with the tag CI pushes.
- */
-export const CROSS_REPO_BUILD_INPUTS_PATH =
-  'tooling/release/cross-repo-build-inputs.json';
-
-/** Identity of one vendored input — the tuple that survives a pin bump. */
-export function crossRepoInputKey(input) {
-  return [input.sourceRepo, input.sourcePath, input.destinationPath].join('\u0000');
-}
-
-/**
- * Resolve the vendored inputs of ONE consumer repository at ONE commit.
- *
- * WHY THE COMMIT COMES FROM THE CONSUMER, NOT FROM THE INDEX
- *
- * The index's `crossRepoBuildInputs` carry no `sourceCommit`; they name only
- * WHICH content is vendored. Both this tooling and the parity gate used to
- * supply the missing commit from `runtimeSourceIndex.repositoryPins`, and CI
- * supplies it from the file above — so the two disagreed the moment a consumer
- * repository's mirror lagged the index by one pin, which is its NORMAL resting
- * state: the mirror is generated FROM the index and committed separately, so it
- * is stale by construction between the index moving and the consumer
- * regenerating.
- *
- * That is not a cosmetic disagreement. `crossRepo.sourceCommit` is framed into
- * the component KEY of the image-input hash, so a pin that differs by one
- * commit yields a different `contentHash` FOR BYTE-IDENTICAL VENDORED CONTENT —
- * a coordinate no CI run has ever pushed or ever will. Measured 2026-09-07 on
- * `origin/main`: five of the sixty-eight coordinates in the eight editions
- * (`backlog-api`, `channel-gateway-api`, `control-plane-api`,
- * `document-render-api` from repos/xema-community, and `biome-host-api` from
- * repos/xema-base) 404'd in the registry for exactly this reason, while the tags
- * their producing CI DID push were present and served on both platforms.
- *
- * Reading the index pin also imposed a requirement that cannot be satisfied.
- * `repos/xema-base` vendors from `repos/xema-community` and vice versa, so
- * "every mirror agrees with the index" is a mutual fixed point over a 2-cycle,
- * and bumping either side invalidates the other. No such pair exists: scanning
- * eighty commits of each on `origin/main` found ZERO mutually coherent pairs.
- * Reading the consumer's own record removes the fixed point entirely — an
- * image's identity depends only on the repository that builds it.
- *
- * It stays edition-INDEPENDENT, which is the property the previous design was
- * protecting: the record is a property of the consumer's COMMIT, not of any
- * edition's resolved commit map, so every edition shipping a subject still
- * derives the same `contentHash` for it.
- */
-export function resolveCrossRepoVendoredInputs({
-  indexInputs,
-  consumerRepo,
-  consumerRepoDir,
-  consumerCommit,
-}) {
-  const declared = indexInputs.filter(
-    (input) => input.consumerRepo === consumerRepo,
-  );
-  if (declared.length === 0) {return [];}
-  if (!consumerCommit) {
-    throw new Error(
-      `cross-repo build inputs are declared for "${consumerRepo}", but this ` +
-        `distribution resolves no commit for it — the vendored content cannot ` +
-        `be pinned, so the image cannot be addressed`,
-    );
-  }
-  let record;
-  try {
-    record = readGitJsonAtCommit(
-      consumerRepoDir,
-      CROSS_REPO_BUILD_INPUTS_PATH,
-      consumerCommit,
-    );
-  } catch (cause) {
-    throw new Error(
-      `"${consumerRepo}" declares cross-repo build inputs but ` +
-        `${CROSS_REPO_BUILD_INPUTS_PATH} is unreadable at ${consumerCommit}. ` +
-        `That file is what its CI feeds to compute-image-tag.mjs; without it ` +
-        `no coordinate this tooling derives can match the tag CI pushes.`,
-      { cause },
-    );
-  }
-  const mirrored = new Map();
-  for (const input of record?.inputs ?? []) {
-    mirrored.set(crossRepoInputKey(input), input.sourceCommit);
-  }
-  // Set equality in BOTH directions. A commit that LAGS is normal and is now
-  // honoured; a differing input SET is a genuine declaration disagreement, and
-  // it moves the hash just as surely — so it must fail rather than resolve to a
-  // coordinate built from a different closure.
-  const declaredKeys = new Set(declared.map((input) => crossRepoInputKey(input)));
-  const resolved = declared.map((input) => {
-    const sourceCommit = mirrored.get(crossRepoInputKey(input));
-    if (!sourceCommit) {
-      throw new Error(
-        `the runtime image source index declares a cross-repo build input for ` +
-          `"${consumerRepo}" vendoring "${input.sourceRepo}:${input.sourcePath}" ` +
-          `to "${input.destinationPath}", but ${CROSS_REPO_BUILD_INPUTS_PATH} at ` +
-          `${consumerCommit} declares no such input — its CI does not vendor it, ` +
-          `so the coordinate this tooling would derive is one nothing builds`,
-      );
-    }
-    return {
-      consumerService: input.consumerService ?? null,
-      destinationPath: input.destinationPath,
-      sourceRepoDir: sourcePath(input.sourceRepo),
-      sourcePath: input.sourcePath,
-      sourceCommit,
-    };
-  });
-  for (const key of mirrored.keys()) {
-    if (declaredKeys.has(key)) {continue;}
-    const [sourceRepo, sourcePath, destinationPath] = key.split('\0');
-    throw new Error(
-      `${CROSS_REPO_BUILD_INPUTS_PATH} at ${consumerCommit} vendors ` +
-        `"${sourceRepo}:${sourcePath}" to "${destinationPath}" for ` +
-        `"${consumerRepo}", which the runtime image source index does not ` +
-        `declare — its CI bakes content this tooling does not hash`,
-    );
-  }
-  return resolved;
-}

package/edition/pin-source.mjs

@@ -222,10 +222,16 @@ function applySnapshot(runtimeSourceIndex, pins) {
     ...runtimeSourceIndex,
     repositoryPins: graph.map((pin) => ({
       ...pin,
-      // The IMAGE axis only. `vendoredSourceCommit` is the SOURCE axis (the
-      // published tip vendored bytes come from) and is deliberately NOT fused
-      // with it: see `build-runtime-image-source-index.mjs#repositoryIdentity`
-      // for the measured production failure that fusing the two caused.
+      // A develop snapshot pins every repository at its develop head, so that one
+      // SHA is both the built commit (image axis, `sourceCommit`) and the source
+      // tip (`vendoredSourceCommit`): the image pin lagging the source tip cannot
+      // arise, and the snapshot is "one frozen snapshot of pins and nothing else".
+      // Fusing both axes is the rule `effectiveRepositoryPins` and
+      // `createExactCommitSourceAuthority` already apply for an exact commit.
+      // The COMMITTED index keeps the axes apart (release channel): see
+      // `source-authority.mjs#publishedSourceTip` and
+      // `build-runtime-image-source-index.mjs#repositoryIdentity`.
+      vendoredSourceCommit: pins[pin.repo],
       sourceCommit: pins[pin.repo],
     })),
   };

package/edition/resolve-images.mjs

@@ -38,6 +38,7 @@ import { join, relative, sep } from 'node:path';
 
 import { assertBuildLedgerComplete } from './build-ledger-completeness.mjs';
 import { BUILD_LEDGER_FILE, readBuildLedger } from './build-ledger.mjs';
+import { CROSS_REPO_BUILD_INPUTS_PATH, crossRepoInputKey, resolveCrossRepoVendoredInputs } from './cross-repo-build-inputs.mjs';
 import { resolveDispatchedRuntimeComponents } from './dispatched-runtime-components.mjs';
 import {
   assertCanonicalDistributionId,
@@ -53,15 +54,12 @@ import {
 } from './external-source-walk.mjs';
 import { assertDeclaredSourceId, firstPartySourceId } from './first-party-source-ids.mjs';
 import {
-  CROSS_REPO_BUILD_INPUTS_PATH,
   compareStrings,
-  crossRepoInputKey,
   hashImageBuildInputs,
   imageInputSourceHashAlgorithm,
   loadKernelDistributionSchemas,
   parseResolvedDistributionLock,
   readGitJsonAtCommit,
-  resolveCrossRepoVendoredInputs,
   serializeJson,
   sha256Hex,
   validateImmutableDistributionLock,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.33.1",
+  "version": "0.33.3",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:a6f12761c7c95f7810ac5134c53e5e9712d2822e7f3d0a91f96eed09741f9605"
+    "sourceDigest": "sha256:fddbe95c5e82a8ecc251e4d62f65718c96630117ec28d6fb9c8f0f05174432bc"
   }
 }