@xemahq/xema 0.33.2 → 0.33.3

package/dist/edition/verify-image-evidence.bundle.mjs

@@ -59664,7 +59664,7 @@ var EDITION_LOCKS = Object.freeze([...EDITION_CONTRACT.locks]);
 var EDITION_FILES = Object.freeze([EDITION_DESCRIPTOR_FILE, ...EDITION_LOCKS]);
 
 // edition/lib.mjs
-import { createRequire as createRequire3 } from "node:module";
+import { createRequire as createRequire4 } from "node:module";
 import { isIP } from "node:net";
 var import_yaml = __toESM(require_dist(), 1);
 
@@ -60350,12 +60350,16 @@ var COMMIT_PATTERN = /^[a-f0-9]{40}$/;
 var SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/;
 var SHA256_DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
 
-// edition/kernel-capability-domain.mjs
+// edition/git-json.mjs
 import { createRequire } from "node:module";
 var requireFromHere = createRequire(import.meta.url);
 
-// edition/operation-requirements.mjs
+// edition/kernel-capability-domain.mjs
 import { createRequire as createRequire2 } from "node:module";
+var requireFromHere2 = createRequire2(import.meta.url);
+
+// edition/operation-requirements.mjs
+import { createRequire as createRequire3 } from "node:module";
 
 // edition/string-order.mjs
 function compareStrings(a, b) {
@@ -60366,7 +60370,7 @@ function compareStrings(a, b) {
 }
 
 // edition/operation-requirements.mjs
-var requireFromHere2 = createRequire2(import.meta.url);
+var requireFromHere3 = createRequire3(import.meta.url);
 var PRINCIPAL_PRIVILEGE_FIELDS = Object.freeze(["requiresOperations", "requiresOrganizationSweeps"]);
 
 // edition/source-authority.mjs
@@ -60376,7 +60380,7 @@ var DistributionSourceMode = Object.freeze({
 });
 
 // edition/lib.mjs
-var requireFromLib = createRequire3(import.meta.url);
+var requireFromLib = createRequire4(import.meta.url);
 var WorkerProtocolKind = Object.freeze({ Worker: "worker", None: "none" });
 var GIT_LS_TREE_MAX_BUFFER = 256 * 1024 * 1024;
 function serializeJson(value) {

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "artifactSha256": "sha256:172a95b35134b37d8f25d140bb3f8f955c3965d11b2e5ad56aa534d0c1556b3f",
+  "artifactSha256": "sha256:09f40c552224a946fef9f54e2d2c2de6885a76b386daece39862f2e42382235b",
   "esbuild": {
     "version": "0.28.2"
   },
@@ -2203,223 +2203,229 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:bbeac7ff01376cb89ed2140526d4795d8e559b3f01612b404a701f19aaa24c6a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:161f522eb39e3db705bc709f8512988dd3e6752851d972521354eeccffd8075d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:fbda500315d45e35eb974f4701bbf36729c3b642a5d735bc1b07085c91d25b23"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:e3997bd9a0082e02d01760868b2a4f41ed3081e904126b30fdf86e7938dc6137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:71ae51028847ab3430ffec9b229b0516a7705b75a6de1fcfa665f5e1abf8e9bb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:c575e96b70bda82899931eb0b18567988e2e13e664fa498bcbef96b571dcabb4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:aa1a05f1728813a7bdb1e02d9305e9adf641d695e6767305210c67a1d81b38a7"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:2940a0ee8662970722aa2618a1635f8d5b4f5e54b85f09667f71ccf7c2c81b03"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b2190ace174a29875e2a9bd7209460b0ef6de186aca9b31bcd45dc17af57c1ba"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:f7267e93fd7dc07cf65fb8cac2c4439d28a72c1e0acbdeca1648c6859440eb32"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:b9dd5c01903394436530783614efb0cd357d982ed2befd844a39328479773cbc"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
+      "path": "edition/git-json.mjs",
+      "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
+    },
+    {
+      "package": "@xemahq/xema",
+      "version": "0.33.3",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:09945712ecc6524d5f52cfd82141ef4cade45be35210777f6e32818792068881"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:20abdde62a7b037c01ea9bbe1ff1e6094e6b0efd0add2f656f1938a04409bf82"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/lib.mjs",
-      "sha256": "sha256:4777627b3665e154f466251eb684ea7299ecd3c683447f65f2cc5b4041d29bdb"
+      "sha256": "sha256:0e9045632a14cb1a035bce7aac3ad26e7b2211daa3f9c2cd27a55dfd772e3b6b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:ffe6fdc9da6b2974270fc86c11be0c41d0bc6d85c8e3c137d3c3bc00a72fc4f6"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:fbaa6dffbdf4a262a13127bcf37bca791234fae74e327ac250e56ff4b78c1244"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:858b607dde94e2abd00a341f569e18cfa567d4bff139c64a2d60abbb7de4c85e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:62f83f8bb835f360535402d12657156d2c9d6e651b426c2b30a04a2dc2f8d3e8"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:058c849767434e9ba911d9310092bede42e3ef959c75bbd35ff8879dc21ce3ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.3",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/edition/checkout-indexed-source-repositories.mjs

@@ -4,6 +4,7 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 
+import { readCrossRepoBuildInputsRecord, splitCrossRepoInputKey } from './cross-repo-build-inputs.mjs';
 import { discoverDistributionIds } from './distribution-paths.mjs';
 import { editionWorkspaceConfig } from './edition-config.mjs';
 import { readEditionSourcePins } from './edition-source-pins.mjs';
@@ -120,6 +121,53 @@ export function editionHeldCommits(plan, sourcePinsByEdition) {
   return new Map([...held].map(([repo, commits]) => [repo, [...commits]]));
 }
 
+/**
+ * The commits each checkout must also hold because a consumer's cross-repo
+ * build-input record vendors bytes from them. The resolve hashes those paths at
+ * the record's commit (`resolveCrossRepoVendoredInputs`), and that commit lags
+ * or leads the source repository's own pin. The record is read AT THE
+ * CONSUMER'S PIN, by the same reader the resolve uses, from the consumer's
+ * checkout under `workspaceRoot` (so every repository must already be checked
+ * out). Maps source repo to the distinct such commits, excluding the commits
+ * the checkout already holds. A consumer or source repository without a
+ * repository pin is refused: there is no checkout to read or fetch into.
+ *
+ * @param {{ repo: string, sourceCommit: string, vendoredSourceCommit: string }[]} plan
+ * @returns {Map<string, string[]>}
+ */
+export function crossRepoVendoredCommits(plan, index, workspaceRoot) {
+  const pins = new Map(plan.map((entry) => [entry.repo, entry]));
+  const consumers = [...new Set((index.crossRepoBuildInputs ?? []).map((input) => input.consumerRepo))].sort();
+  const extra = new Map();
+  for (const consumerRepo of consumers) {
+    const consumer = pins.get(consumerRepo);
+    if (!consumer) {
+      throw new Error(`cross-repo build inputs name consumer ${JSON.stringify(consumerRepo)}, which has no repository pin in the runtime image source index`);
+    }
+    const record = readCrossRepoBuildInputsRecord({
+      consumerRepo,
+      consumerRepoDir: resolve(workspaceRoot, consumerRepo),
+      consumerCommit: consumer.sourceCommit,
+    });
+    for (const [key, commit] of record) {
+      const [sourceRepo] = splitCrossRepoInputKey(key);
+      const source = pins.get(sourceRepo);
+      if (!source) {
+        throw new Error(
+          `${consumerRepo} at ${consumer.sourceCommit} vendors from ${JSON.stringify(sourceRepo)}, which has no repository pin in the runtime image source index`,
+        );
+      }
+      if (!SHA.test(String(commit ?? ''))) {
+        throw new Error(`${consumerRepo} at ${consumer.sourceCommit} vendors from ${sourceRepo} at a sourceCommit that is not exact lowercase 40-hex`);
+      }
+      if (commit === source.sourceCommit || commit === source.vendoredSourceCommit) {continue;}
+      if (!extra.has(sourceRepo)) {extra.set(sourceRepo, new Set());}
+      extra.get(sourceRepo).add(commit);
+    }
+  }
+  return new Map([...extra].map(([repo, commits]) => [repo, [...commits].sort()]));
+}
+
 /** The `sourcePins` of every edition under the configured editions root. */
 export function readEditionsSourcePins() {
   return new Map(
@@ -129,6 +177,24 @@ export function readEditionsSourcePins() {
   );
 }
 
+/**
+ * Second pass, once every repository sits at its pin: fetch the commits the
+ * consumers' cross-repo build-input records vendor from.
+ */
+export function fetchCrossRepoVendoredCommits({ workspaceRoot, plan, index, workspace, env, runGit }) {
+  const vendored = crossRepoVendoredCommits(plan, index, workspaceRoot);
+  for (const entry of plan) {
+    const commits = vendored.get(entry.repo);
+    if (!commits) {continue;}
+    withSourceGitEnv({ name: entry.repo, url: entry.repositoryUrl }, { workspace, env }, (gitEnv) => {
+      for (const commit of commits) {
+        runGit(['-C', resolve(workspaceRoot, entry.repo), 'fetch', '--quiet', '--depth=1', 'origin', commit], gitEnv);
+        console.log(`[source-checkout] ${entry.repo} also holds cross-repo vendored commit ${commit}`);
+      }
+    });
+  }
+}
+
 export function checkoutIndexedSources({ workspaceRoot, index, platformServiceIndex, editionSourcePins = new Map(), env = process.env, runGit = git }) {
   if (!workspaceRoot) {throw new Error('workspaceRoot is required');}
   const workspace = editionWorkspaceConfig();
@@ -176,6 +242,7 @@ export function checkoutIndexedSources({ workspaceRoot, index, platformServiceIn
     });
     console.log(`[source-checkout] ${entry.repo} @ ${entry.sourceCommit}`);
   }
+  fetchCrossRepoVendoredCommits({ workspaceRoot, plan, index, workspace, env, runGit });
   return plan.length;
 }
 

package/edition/cross-repo-build-inputs.mjs

@@ -0,0 +1,158 @@
+/**
+ * The ONE reader of a consumer repository's cross-repo build-input record, and
+ * the resolver built on it. The source checkout (which commits to fetch) and the
+ * image resolve (which bytes to hash) both read the record here, at the
+ * consumer's pin, so the plan and the resolve cannot diverge.
+ */
+import { sourcePath } from './edition-workspace.mjs';
+import { readGitJsonAtCommit } from './git-json.mjs';
+
+/**
+ * The producing repository's OWN committed record of what it vendored.
+ *
+ * `vendor-cross-repo-inputs.mjs` reads exactly this file, at the commit being
+ * built, to emit the `--vendored <dest>=<repoDir>@<commit>:<src>` arguments it
+ * hands `compute-image-tag.mjs`. It is therefore the ONLY source of the vendored
+ * commit that can agree with the tag CI pushes.
+ */
+export const CROSS_REPO_BUILD_INPUTS_PATH =
+  'tooling/release/cross-repo-build-inputs.json';
+
+/** Identity of one vendored input — the tuple that survives a pin bump. */
+export function crossRepoInputKey(input) {
+  return [input.sourceRepo, input.sourcePath, input.destinationPath].join('\u0000');
+}
+
+/** The `[sourceRepo, sourcePath, destinationPath]` a `crossRepoInputKey` frames. */
+export function splitCrossRepoInputKey(key) {
+  return key.split('\u0000');
+}
+
+/**
+ * The consumer's record of what it vendored, read at ONE commit of the consumer
+ * (never the work tree): a map from `crossRepoInputKey` to the vendored
+ * `sourceCommit`. Unreadable is an error, not an empty record.
+ */
+export function readCrossRepoBuildInputsRecord({
+  consumerRepo,
+  consumerRepoDir,
+  consumerCommit,
+}) {
+  let record;
+  try {
+    record = readGitJsonAtCommit(
+      consumerRepoDir,
+      CROSS_REPO_BUILD_INPUTS_PATH,
+      consumerCommit,
+    );
+  } catch (cause) {
+    throw new Error(
+      `"${consumerRepo}" declares cross-repo build inputs but ` +
+        `${CROSS_REPO_BUILD_INPUTS_PATH} is unreadable at ${consumerCommit}. ` +
+        `That file is what its CI feeds to compute-image-tag.mjs; without it ` +
+        `no coordinate this tooling derives can match the tag CI pushes.`,
+      { cause },
+    );
+  }
+  const mirrored = new Map();
+  for (const input of record?.inputs ?? []) {
+    mirrored.set(crossRepoInputKey(input), input.sourceCommit);
+  }
+  return mirrored;
+}
+
+/**
+ * Resolve the vendored inputs of ONE consumer repository at ONE commit.
+ *
+ * WHY THE COMMIT COMES FROM THE CONSUMER, NOT FROM THE INDEX
+ *
+ * The index's `crossRepoBuildInputs` carry no `sourceCommit`; they name only
+ * WHICH content is vendored. Both this tooling and the parity gate used to
+ * supply the missing commit from `runtimeSourceIndex.repositoryPins`, and CI
+ * supplies it from the file above — so the two disagreed the moment a consumer
+ * repository's mirror lagged the index by one pin, which is its NORMAL resting
+ * state: the mirror is generated FROM the index and committed separately, so it
+ * is stale by construction between the index moving and the consumer
+ * regenerating.
+ *
+ * That is not a cosmetic disagreement. `crossRepo.sourceCommit` is framed into
+ * the component KEY of the image-input hash, so a pin that differs by one
+ * commit yields a different `contentHash` FOR BYTE-IDENTICAL VENDORED CONTENT —
+ * a coordinate no CI run has ever pushed or ever will. Measured 2026-09-07 on
+ * `origin/main`: five of the sixty-eight coordinates in the eight editions
+ * (`backlog-api`, `channel-gateway-api`, `control-plane-api`,
+ * `document-render-api` from repos/xema-community, and `biome-host-api` from
+ * repos/xema-base) 404'd in the registry for exactly this reason, while the tags
+ * their producing CI DID push were present and served on both platforms.
+ *
+ * Reading the index pin also imposed a requirement that cannot be satisfied.
+ * `repos/xema-base` vendors from `repos/xema-community` and vice versa, so
+ * "every mirror agrees with the index" is a mutual fixed point over a 2-cycle,
+ * and bumping either side invalidates the other. No such pair exists: scanning
+ * eighty commits of each on `origin/main` found ZERO mutually coherent pairs.
+ * Reading the consumer's own record removes the fixed point entirely — an
+ * image's identity depends only on the repository that builds it.
+ *
+ * It stays edition-INDEPENDENT, which is the property the previous design was
+ * protecting: the record is a property of the consumer's COMMIT, not of any
+ * edition's resolved commit map, so every edition shipping a subject still
+ * derives the same `contentHash` for it.
+ */
+export function resolveCrossRepoVendoredInputs({
+  indexInputs,
+  consumerRepo,
+  consumerRepoDir,
+  consumerCommit,
+}) {
+  const declared = indexInputs.filter(
+    (input) => input.consumerRepo === consumerRepo,
+  );
+  if (declared.length === 0) {return [];}
+  if (!consumerCommit) {
+    throw new Error(
+      `cross-repo build inputs are declared for "${consumerRepo}", but this ` +
+        `distribution resolves no commit for it — the vendored content cannot ` +
+        `be pinned, so the image cannot be addressed`,
+    );
+  }
+  const mirrored = readCrossRepoBuildInputsRecord({
+    consumerRepo,
+    consumerRepoDir,
+    consumerCommit,
+  });
+  // Set equality in BOTH directions. A commit that LAGS is normal and is now
+  // honoured; a differing input SET is a genuine declaration disagreement, and
+  // it moves the hash just as surely — so it must fail rather than resolve to a
+  // coordinate built from a different closure.
+  const declaredKeys = new Set(declared.map((input) => crossRepoInputKey(input)));
+  const resolved = declared.map((input) => {
+    const sourceCommit = mirrored.get(crossRepoInputKey(input));
+    if (!sourceCommit) {
+      throw new Error(
+        `the runtime image source index declares a cross-repo build input for ` +
+          `"${consumerRepo}" vendoring "${input.sourceRepo}:${input.sourcePath}" ` +
+          `to "${input.destinationPath}", but ${CROSS_REPO_BUILD_INPUTS_PATH} at ` +
+          `${consumerCommit} declares no such input — its CI does not vendor it, ` +
+          `so the coordinate this tooling would derive is one nothing builds`,
+      );
+    }
+    return {
+      consumerService: input.consumerService ?? null,
+      destinationPath: input.destinationPath,
+      sourceRepoDir: sourcePath(input.sourceRepo),
+      sourcePath: input.sourcePath,
+      sourceCommit,
+    };
+  });
+  for (const key of mirrored.keys()) {
+    if (declaredKeys.has(key)) {continue;}
+    const [sourceRepo, sourcePath, destinationPath] = splitCrossRepoInputKey(key);
+    throw new Error(
+      `${CROSS_REPO_BUILD_INPUTS_PATH} at ${consumerCommit} vendors ` +
+        `"${sourceRepo}:${sourcePath}" to "${destinationPath}" for ` +
+        `"${consumerRepo}", which the runtime image source index does not ` +
+        `declare — its CI bakes content this tooling does not hash`,
+    );
+  }
+  return resolved;
+}

package/edition/git-json.mjs

@@ -0,0 +1,54 @@
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+import { parseStrictJson } from './strict-json.mjs';
+
+const requireFromHere = createRequire(import.meta.url);
+
+let loadedSourceHash;
+
+/** Git-object primitives of `@xemahq/distribution-source-hash`; no kernel is consulted. */
+function gitObjectReader() {
+  loadedSourceHash ??= requireFromHere('@xemahq/distribution-source-hash');
+  return loadedSourceHash;
+}
+
+/**
+ * Read + parse a JSON file out of an exact Git commit (never the work tree).
+ *
+ * This is the seam every authored source file crosses on its way into a lock
+ * or an index — `xema-biome.json`, a platform service's `package.json`,
+ * `cross-repo-build-inputs.json`, the committed generated biome index — so it
+ * parses STRICTLY: a duplicated object key is refused, naming the commit, the
+ * path and the JSON pointer of the object. `JSON.parse` would keep the last
+ * occurrence, which is how a `resources` declaration was dropped from a sealed
+ * lock with every reader agreeing (see `strict-json.mjs`).
+ *
+ * The commit check, the buffer ceiling and the exact-UTF-8 decode are the
+ * source-hash package's own (loaded WITHOUT the kernel check hashing needs, so
+ * the source checkout, which runs before any kernel is built, can read a record
+ * too); only the parse differs from its
+ * `readGitJsonAtCommit`, which is lenient and is therefore not delegated to.
+ */
+export function readGitJsonAtCommit(repoDir, repoRelativePath, commit) {
+  const sourceHash = gitObjectReader();
+  sourceHash.assertGitCommitExists(repoDir, commit);
+  let raw;
+  try {
+    raw = execFileSync(
+      'git',
+      ['-C', repoDir, 'show', `${commit}:${repoRelativePath}`],
+      {
+        encoding: 'buffer',
+        maxBuffer: sourceHash.GIT_OBJECT_MAX_BUFFER_BYTES,
+        stdio: ['ignore', 'pipe', 'pipe'],
+      },
+    );
+  } catch {
+    throw new Error(
+      `cannot read "${repoRelativePath}" from Git commit "${commit}"`,
+    );
+  }
+  const context = `Git object "${commit}:${repoRelativePath}"`;
+  return parseStrictJson(sourceHash.decodeExactUtf8(raw, context), context);
+}

package/edition/lib.mjs

@@ -30,6 +30,7 @@ import {
   sourcePath,
 } from './edition-workspace.mjs';
 import { SHA256_HEX_PATTERN } from './evidence-grammars.mjs';
+import { readGitJsonAtCommit } from './git-json.mjs';
 import { isKernelCapabilityDomain } from './kernel-capability-domain.mjs';
 import {
   assertPrivilegesHavePrincipals,
@@ -42,7 +43,7 @@ import {
   PUBLISHED_SOURCE_REF,
   publishedSourceCommit,
 } from './source-authority.mjs';
-import { parseStrictJson, readStrictJsonFile } from './strict-json.mjs';
+import { readStrictJsonFile } from './strict-json.mjs';
 import { compareStrings } from './string-order.mjs';
 
 export {
@@ -51,6 +52,7 @@ export {
   DistributionSourceMode,
   PUBLISHED_SOURCE_REF,
   publishedSourceCommit,
+  readGitJsonAtCommit,
 };
 
 
@@ -3063,167 +3065,3 @@ export function hashImageBuildInputs(request, algorithm) {
   return distributionSourceHash().hashImageBuildInputs(request, algorithm);
 }
 
-/**
- * Read + parse a JSON file out of an exact Git commit (never the work tree).
- *
- * This is the seam every authored source file crosses on its way into a lock
- * or an index — `xema-biome.json`, a platform service's `package.json`,
- * `cross-repo-build-inputs.json`, the committed generated biome index — so it
- * parses STRICTLY: a duplicated object key is refused, naming the commit, the
- * path and the JSON pointer of the object. `JSON.parse` would keep the last
- * occurrence, which is how a `resources` declaration was dropped from a sealed
- * lock with every reader agreeing (see `strict-json.mjs`).
- *
- * The commit check, the buffer ceiling and the exact-UTF-8 decode are the
- * source-hash package's own; only the parse differs from its
- * `readGitJsonAtCommit`, which is lenient and is therefore not delegated to.
- */
-export function readGitJsonAtCommit(repoDir, repoRelativePath, commit) {
-  const sourceHash = distributionSourceHash();
-  sourceHash.assertGitCommitExists(repoDir, commit);
-  let raw;
-  try {
-    raw = execFileSync(
-      'git',
-      ['-C', repoDir, 'show', `${commit}:${repoRelativePath}`],
-      {
-        encoding: 'buffer',
-        maxBuffer: sourceHash.GIT_OBJECT_MAX_BUFFER_BYTES,
-        stdio: ['ignore', 'pipe', 'pipe'],
-      },
-    );
-  } catch {
-    throw new Error(
-      `cannot read "${repoRelativePath}" from Git commit "${commit}"`,
-    );
-  }
-  const context = `Git object "${commit}:${repoRelativePath}"`;
-  return parseStrictJson(sourceHash.decodeExactUtf8(raw, context), context);
-}
-
-/**
- * The producing repository's OWN committed record of what it vendored.
- *
- * `vendor-cross-repo-inputs.mjs` reads exactly this file, at the commit being
- * built, to emit the `--vendored <dest>=<repoDir>@<commit>:<src>` arguments it
- * hands `compute-image-tag.mjs`. It is therefore the ONLY source of the vendored
- * commit that can agree with the tag CI pushes.
- */
-export const CROSS_REPO_BUILD_INPUTS_PATH =
-  'tooling/release/cross-repo-build-inputs.json';
-
-/** Identity of one vendored input — the tuple that survives a pin bump. */
-export function crossRepoInputKey(input) {
-  return [input.sourceRepo, input.sourcePath, input.destinationPath].join('\u0000');
-}
-
-/**
- * Resolve the vendored inputs of ONE consumer repository at ONE commit.
- *
- * WHY THE COMMIT COMES FROM THE CONSUMER, NOT FROM THE INDEX
- *
- * The index's `crossRepoBuildInputs` carry no `sourceCommit`; they name only
- * WHICH content is vendored. Both this tooling and the parity gate used to
- * supply the missing commit from `runtimeSourceIndex.repositoryPins`, and CI
- * supplies it from the file above — so the two disagreed the moment a consumer
- * repository's mirror lagged the index by one pin, which is its NORMAL resting
- * state: the mirror is generated FROM the index and committed separately, so it
- * is stale by construction between the index moving and the consumer
- * regenerating.
- *
- * That is not a cosmetic disagreement. `crossRepo.sourceCommit` is framed into
- * the component KEY of the image-input hash, so a pin that differs by one
- * commit yields a different `contentHash` FOR BYTE-IDENTICAL VENDORED CONTENT —
- * a coordinate no CI run has ever pushed or ever will. Measured 2026-09-07 on
- * `origin/main`: five of the sixty-eight coordinates in the eight editions
- * (`backlog-api`, `channel-gateway-api`, `control-plane-api`,
- * `document-render-api` from repos/xema-community, and `biome-host-api` from
- * repos/xema-base) 404'd in the registry for exactly this reason, while the tags
- * their producing CI DID push were present and served on both platforms.
- *
- * Reading the index pin also imposed a requirement that cannot be satisfied.
- * `repos/xema-base` vendors from `repos/xema-community` and vice versa, so
- * "every mirror agrees with the index" is a mutual fixed point over a 2-cycle,
- * and bumping either side invalidates the other. No such pair exists: scanning
- * eighty commits of each on `origin/main` found ZERO mutually coherent pairs.
- * Reading the consumer's own record removes the fixed point entirely — an
- * image's identity depends only on the repository that builds it.
- *
- * It stays edition-INDEPENDENT, which is the property the previous design was
- * protecting: the record is a property of the consumer's COMMIT, not of any
- * edition's resolved commit map, so every edition shipping a subject still
- * derives the same `contentHash` for it.
- */
-export function resolveCrossRepoVendoredInputs({
-  indexInputs,
-  consumerRepo,
-  consumerRepoDir,
-  consumerCommit,
-}) {
-  const declared = indexInputs.filter(
-    (input) => input.consumerRepo === consumerRepo,
-  );
-  if (declared.length === 0) {return [];}
-  if (!consumerCommit) {
-    throw new Error(
-      `cross-repo build inputs are declared for "${consumerRepo}", but this ` +
-        `distribution resolves no commit for it — the vendored content cannot ` +
-        `be pinned, so the image cannot be addressed`,
-    );
-  }
-  let record;
-  try {
-    record = readGitJsonAtCommit(
-      consumerRepoDir,
-      CROSS_REPO_BUILD_INPUTS_PATH,
-      consumerCommit,
-    );
-  } catch (cause) {
-    throw new Error(
-      `"${consumerRepo}" declares cross-repo build inputs but ` +
-        `${CROSS_REPO_BUILD_INPUTS_PATH} is unreadable at ${consumerCommit}. ` +
-        `That file is what its CI feeds to compute-image-tag.mjs; without it ` +
-        `no coordinate this tooling derives can match the tag CI pushes.`,
-      { cause },
-    );
-  }
-  const mirrored = new Map();
-  for (const input of record?.inputs ?? []) {
-    mirrored.set(crossRepoInputKey(input), input.sourceCommit);
-  }
-  // Set equality in BOTH directions. A commit that LAGS is normal and is now
-  // honoured; a differing input SET is a genuine declaration disagreement, and
-  // it moves the hash just as surely — so it must fail rather than resolve to a
-  // coordinate built from a different closure.
-  const declaredKeys = new Set(declared.map((input) => crossRepoInputKey(input)));
-  const resolved = declared.map((input) => {
-    const sourceCommit = mirrored.get(crossRepoInputKey(input));
-    if (!sourceCommit) {
-      throw new Error(
-        `the runtime image source index declares a cross-repo build input for ` +
-          `"${consumerRepo}" vendoring "${input.sourceRepo}:${input.sourcePath}" ` +
-          `to "${input.destinationPath}", but ${CROSS_REPO_BUILD_INPUTS_PATH} at ` +
-          `${consumerCommit} declares no such input — its CI does not vendor it, ` +
-          `so the coordinate this tooling would derive is one nothing builds`,
-      );
-    }
-    return {
-      consumerService: input.consumerService ?? null,
-      destinationPath: input.destinationPath,
-      sourceRepoDir: sourcePath(input.sourceRepo),
-      sourcePath: input.sourcePath,
-      sourceCommit,
-    };
-  });
-  for (const key of mirrored.keys()) {
-    if (declaredKeys.has(key)) {continue;}
-    const [sourceRepo, sourcePath, destinationPath] = key.split('\0');
-    throw new Error(
-      `${CROSS_REPO_BUILD_INPUTS_PATH} at ${consumerCommit} vendors ` +
-        `"${sourceRepo}:${sourcePath}" to "${destinationPath}" for ` +
-        `"${consumerRepo}", which the runtime image source index does not ` +
-        `declare — its CI bakes content this tooling does not hash`,
-    );
-  }
-  return resolved;
-}

package/edition/resolve-images.mjs

@@ -38,6 +38,7 @@ import { join, relative, sep } from 'node:path';
 
 import { assertBuildLedgerComplete } from './build-ledger-completeness.mjs';
 import { BUILD_LEDGER_FILE, readBuildLedger } from './build-ledger.mjs';
+import { CROSS_REPO_BUILD_INPUTS_PATH, crossRepoInputKey, resolveCrossRepoVendoredInputs } from './cross-repo-build-inputs.mjs';
 import { resolveDispatchedRuntimeComponents } from './dispatched-runtime-components.mjs';
 import {
   assertCanonicalDistributionId,
@@ -53,15 +54,12 @@ import {
 } from './external-source-walk.mjs';
 import { assertDeclaredSourceId, firstPartySourceId } from './first-party-source-ids.mjs';
 import {
-  CROSS_REPO_BUILD_INPUTS_PATH,
   compareStrings,
-  crossRepoInputKey,
   hashImageBuildInputs,
   imageInputSourceHashAlgorithm,
   loadKernelDistributionSchemas,
   parseResolvedDistributionLock,
   readGitJsonAtCommit,
-  resolveCrossRepoVendoredInputs,
   serializeJson,
   sha256Hex,
   validateImmutableDistributionLock,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.33.2",
+  "version": "0.33.3",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:de506f4bb207dcf31fb135d585486f8fa5bf4fc11d0d1841506d8773393fa423"
+    "sourceDigest": "sha256:fddbe95c5e82a8ecc251e4d62f65718c96630117ec28d6fb9c8f0f05174432bc"
   }
 }