@xemahq/xema 0.33.2 → 0.33.4

package/edition/cross-repo-build-inputs.mjs

@@ -0,0 +1,158 @@
+/**
+ * The ONE reader of a consumer repository's cross-repo build-input record, and
+ * the resolver built on it. The source checkout (which commits to fetch) and the
+ * image resolve (which bytes to hash) both read the record here, at the
+ * consumer's pin, so the plan and the resolve cannot diverge.
+ */
+import { sourcePath } from './edition-workspace.mjs';
+import { readGitJsonAtCommit } from './git-json.mjs';
+
+/**
+ * The producing repository's OWN committed record of what it vendored.
+ *
+ * `vendor-cross-repo-inputs.mjs` reads exactly this file, at the commit being
+ * built, to emit the `--vendored <dest>=<repoDir>@<commit>:<src>` arguments it
+ * hands `compute-image-tag.mjs`. It is therefore the ONLY source of the vendored
+ * commit that can agree with the tag CI pushes.
+ */
+export const CROSS_REPO_BUILD_INPUTS_PATH =
+  'tooling/release/cross-repo-build-inputs.json';
+
+/** Identity of one vendored input — the tuple that survives a pin bump. */
+export function crossRepoInputKey(input) {
+  return [input.sourceRepo, input.sourcePath, input.destinationPath].join('\u0000');
+}
+
+/** The `[sourceRepo, sourcePath, destinationPath]` a `crossRepoInputKey` frames. */
+export function splitCrossRepoInputKey(key) {
+  return key.split('\u0000');
+}
+
+/**
+ * The consumer's record of what it vendored, read at ONE commit of the consumer
+ * (never the work tree): a map from `crossRepoInputKey` to the vendored
+ * `sourceCommit`. Unreadable is an error, not an empty record.
+ */
+export function readCrossRepoBuildInputsRecord({
+  consumerRepo,
+  consumerRepoDir,
+  consumerCommit,
+}) {
+  let record;
+  try {
+    record = readGitJsonAtCommit(
+      consumerRepoDir,
+      CROSS_REPO_BUILD_INPUTS_PATH,
+      consumerCommit,
+    );
+  } catch (cause) {
+    throw new Error(
+      `"${consumerRepo}" declares cross-repo build inputs but ` +
+        `${CROSS_REPO_BUILD_INPUTS_PATH} is unreadable at ${consumerCommit}. ` +
+        `That file is what its CI feeds to compute-image-tag.mjs; without it ` +
+        `no coordinate this tooling derives can match the tag CI pushes.`,
+      { cause },
+    );
+  }
+  const mirrored = new Map();
+  for (const input of record?.inputs ?? []) {
+    mirrored.set(crossRepoInputKey(input), input.sourceCommit);
+  }
+  return mirrored;
+}
+
+/**
+ * Resolve the vendored inputs of ONE consumer repository at ONE commit.
+ *
+ * WHY THE COMMIT COMES FROM THE CONSUMER, NOT FROM THE INDEX
+ *
+ * The index's `crossRepoBuildInputs` carry no `sourceCommit`; they name only
+ * WHICH content is vendored. Both this tooling and the parity gate used to
+ * supply the missing commit from `runtimeSourceIndex.repositoryPins`, and CI
+ * supplies it from the file above — so the two disagreed the moment a consumer
+ * repository's mirror lagged the index by one pin, which is its NORMAL resting
+ * state: the mirror is generated FROM the index and committed separately, so it
+ * is stale by construction between the index moving and the consumer
+ * regenerating.
+ *
+ * That is not a cosmetic disagreement. `crossRepo.sourceCommit` is framed into
+ * the component KEY of the image-input hash, so a pin that differs by one
+ * commit yields a different `contentHash` FOR BYTE-IDENTICAL VENDORED CONTENT —
+ * a coordinate no CI run has ever pushed or ever will. Measured 2026-09-07 on
+ * `origin/main`: five of the sixty-eight coordinates in the eight editions
+ * (`backlog-api`, `channel-gateway-api`, `control-plane-api`,
+ * `document-render-api` from repos/xema-community, and `biome-host-api` from
+ * repos/xema-base) 404'd in the registry for exactly this reason, while the tags
+ * their producing CI DID push were present and served on both platforms.
+ *
+ * Reading the index pin also imposed a requirement that cannot be satisfied.
+ * `repos/xema-base` vendors from `repos/xema-community` and vice versa, so
+ * "every mirror agrees with the index" is a mutual fixed point over a 2-cycle,
+ * and bumping either side invalidates the other. No such pair exists: scanning
+ * eighty commits of each on `origin/main` found ZERO mutually coherent pairs.
+ * Reading the consumer's own record removes the fixed point entirely — an
+ * image's identity depends only on the repository that builds it.
+ *
+ * It stays edition-INDEPENDENT, which is the property the previous design was
+ * protecting: the record is a property of the consumer's COMMIT, not of any
+ * edition's resolved commit map, so every edition shipping a subject still
+ * derives the same `contentHash` for it.
+ */
+export function resolveCrossRepoVendoredInputs({
+  indexInputs,
+  consumerRepo,
+  consumerRepoDir,
+  consumerCommit,
+}) {
+  const declared = indexInputs.filter(
+    (input) => input.consumerRepo === consumerRepo,
+  );
+  if (declared.length === 0) {return [];}
+  if (!consumerCommit) {
+    throw new Error(
+      `cross-repo build inputs are declared for "${consumerRepo}", but this ` +
+        `distribution resolves no commit for it — the vendored content cannot ` +
+        `be pinned, so the image cannot be addressed`,
+    );
+  }
+  const mirrored = readCrossRepoBuildInputsRecord({
+    consumerRepo,
+    consumerRepoDir,
+    consumerCommit,
+  });
+  // Set equality in BOTH directions. A commit that LAGS is normal and is now
+  // honoured; a differing input SET is a genuine declaration disagreement, and
+  // it moves the hash just as surely — so it must fail rather than resolve to a
+  // coordinate built from a different closure.
+  const declaredKeys = new Set(declared.map((input) => crossRepoInputKey(input)));
+  const resolved = declared.map((input) => {
+    const sourceCommit = mirrored.get(crossRepoInputKey(input));
+    if (!sourceCommit) {
+      throw new Error(
+        `the runtime image source index declares a cross-repo build input for ` +
+          `"${consumerRepo}" vendoring "${input.sourceRepo}:${input.sourcePath}" ` +
+          `to "${input.destinationPath}", but ${CROSS_REPO_BUILD_INPUTS_PATH} at ` +
+          `${consumerCommit} declares no such input — its CI does not vendor it, ` +
+          `so the coordinate this tooling would derive is one nothing builds`,
+      );
+    }
+    return {
+      consumerService: input.consumerService ?? null,
+      destinationPath: input.destinationPath,
+      sourceRepoDir: sourcePath(input.sourceRepo),
+      sourcePath: input.sourcePath,
+      sourceCommit,
+    };
+  });
+  for (const key of mirrored.keys()) {
+    if (declaredKeys.has(key)) {continue;}
+    const [sourceRepo, sourcePath, destinationPath] = splitCrossRepoInputKey(key);
+    throw new Error(
+      `${CROSS_REPO_BUILD_INPUTS_PATH} at ${consumerCommit} vendors ` +
+        `"${sourceRepo}:${sourcePath}" to "${destinationPath}" for ` +
+        `"${consumerRepo}", which the runtime image source index does not ` +
+        `declare — its CI bakes content this tooling does not hash`,
+    );
+  }
+  return resolved;
+}

package/edition/develop-chart-set.mjs

@@ -0,0 +1,61 @@
+// develop-chart-set — the chart-set lock of a develop edition.
+//
+// A develop edition renders with the charts the publisher actually published:
+// the committed release chart-set lock's entries (names, content versions and
+// digests, and each index digest), unchanged. xema-deploy publishes charts per
+// content version (`<n>-h<16 hex>`) for the commit its release set was closed
+// at, so that commit is the only deploy commit whose charts exist in the
+// registry. A develop edition frozen at that commit takes the release lock
+// as it is, and asks the registry nothing about a chart's tag; a develop edition
+// frozen at any other commit is refused, because no chart was published for it
+// (a develop chart lane in xema-deploy is the owner's decision, not built).
+
+import { basename } from 'node:path';
+
+import { chartSetSourceCommits } from './chart-set-source-commit.mjs';
+import { assertRosteredChartSetLock } from './edition-chart-set.mjs';
+import { COMMIT_PATTERN } from './evidence-grammars.mjs';
+import { deployPinKey } from './pin-source.mjs';
+import { CHART_SET_LOCK_FILE, chartRegistryClient, chartSetLockPath, readLock } from './resolve-chart-set.mjs';
+
+/** The source commits of `lock`'s publishers, read from their index charts at the digests the lock pins. */
+const registrySourceCommits = (lock) => chartSetSourceCommits({ client: chartRegistryClient(), lock });
+
+/**
+ * The develop chart-set lock for the deploy commit `xemaDeploySha`: the committed
+ * release lock, when that lock's deploy publisher closed its set at this commit.
+ * `readSourceCommits(lock)` defaults to the chart registry's index charts and
+ * returns `{publishers: [{repo, sourceCommit}]}`.
+ *
+ * TEMPORARY BRIDGE (owner: edition, lead D41 10-13): only the release set's
+ * source commit is resolvable here. Exit: develop charts resolved by content
+ * version (edition T37: the shared developChartVersionFromDigest, published by
+ * xema-deploy publish-charts on develop pushes), which replaces this function
+ * before t348-i2 lands.
+ */
+export async function resolveDevelopChartSet({ xemaDeploySha, releaseLock = readLock(), readSourceCommits = registrySourceCommits }) {
+  if (!COMMIT_PATTERN.test(xemaDeploySha ?? '')) {
+    throw new Error(`the deploy checkout SHA is not a 40-hex commit: ${JSON.stringify(xemaDeploySha)}`);
+  }
+  if (releaseLock === null) {
+    throw new Error(`${chartSetLockPath()} is missing or is not JSON: run 'xema edition chart-set resolve' first`);
+  }
+  assertRosteredChartSetLock(releaseLock, CHART_SET_LOCK_FILE);
+  const deployRepo = basename(deployPinKey());
+  const deployPublishers = releaseLock.publishers.filter((publisher) => basename(publisher.repo) === deployRepo);
+  if (deployPublishers.length !== 1) {
+    throw new Error(
+      `${deployPublishers.length} chart publishers of ${CHART_SET_LOCK_FILE} have repository ${deployRepo} (the deploy pin role); exactly one must, ` +
+        'since its source commit is the one commit whose charts were published',
+    );
+  }
+  const { sourceCommit } = (await readSourceCommits(releaseLock)).publishers.find((publisher) => publisher.index === deployPublishers[0].index) ?? {};
+  if (sourceCommit !== xemaDeploySha) {
+    throw new Error(
+      `the develop deploy commit ${xemaDeploySha} is not the commit ${CHART_SET_LOCK_FILE} was published from (${sourceCommit}): ` +
+        'develop charts are only published for the release set\'s source commit, so no chart exists for this commit. ' +
+        'A develop chart lane in the deploy repository is required to develop at another commit (owner decision, not built)',
+    );
+  }
+  return releaseLock;
+}

package/edition/develop-edition-resolve.mjs

@@ -2,26 +2,26 @@
 //
 // The whole pipeline, in the order the release runs it, over the snapshot's
 // injected inputs: distribution lock -> authorization base (composed, never
-// written) -> images lock -> develop seal, plus the chart-set lock: the frozen
-// xema-deploy charts' registry manifest digests, in the release roster shape. Nothing here writes to the editions
+// written) -> images lock -> develop seal, plus the chart-set lock: the release
+// lock's published charts (develop-chart-set.mjs). Nothing here writes to the editions
 // trees; the caller writes the artifact (edition-artifact.mjs).
 
 import { adapterHostRow, assertAdapterBundlesMatchHost, fetchRegistryManifest } from './adapter-bundled-versions.mjs';
 import { biomeSourceTreeIds, sealLock } from './biome-content.mjs';
 import { buildCatalogue } from './catalogue.mjs';
+import { resolveDevelopChartSet } from './develop-chart-set.mjs';
 import { sealDevelopImages } from './develop-seal.mjs';
 import { assertFrozenCheckouts, buildSnapshotInputs } from './develop-snapshot-inputs.mjs';
 import { EditionChannel } from './edition-constants.mjs';
-import { deployRoot, kernelPackageDir } from './edition-workspace.mjs';
+import { kernelPackageDir } from './edition-workspace.mjs';
 import { kernelPackageOfAuthority } from './kernel-package.mjs';
 import { loadKernelDistributionSchemas } from './lib.mjs';
 import { deployPinKey } from './pin-source.mjs';
-import { resolveDevelopChartSet } from './resolve-chart-set.mjs';
 import { composeAuthorizationBase, resolveDistributionWithIndex } from './resolve-distribution.mjs';
 import { externalSourceTrees, resolveImages, sourceTreeLocator } from './resolve-images.mjs';
 import { createPinnedSourceAuthority } from './source-authority.mjs';
 
-export async function resolveDevelopEdition({ id, pins, env = process.env, sealOptions = {}, chartDigestLookup, fetchKernelTarball, fetchManifest = fetchRegistryManifest }) {
+export async function resolveDevelopEdition({ id, pins, env = process.env, sealOptions = {}, readSourceCommits, fetchKernelTarball, fetchManifest = fetchRegistryManifest }) {
   const schemas = await loadKernelDistributionSchemas();
   assertFrozenCheckouts(pins);
   const inputs = await buildSnapshotInputs({ id, pins, schemas });
@@ -41,9 +41,8 @@ export async function resolveDevelopEdition({ id, pins, env = process.env, sealO
     vendoredCommit: (repo) => authority.vendoredSourceCommitForRepository(repo),
   });
   const chartSetLock = await resolveDevelopChartSet({
-    xemaDeployDir: deployRoot(),
     xemaDeploySha: pins[deployPinKey()],
-    lookup: chartDigestLookup,
+    ...(readSourceCommits === undefined ? {} : { readSourceCommits }),
   });
   const sourceTreeIds = await biomeSourceTreeIds({
     schemas,

package/edition/dist-check.mjs

@@ -37,7 +37,6 @@ import {
   loadKernelAuthorizationComposer,
 } from './authorization-base.mjs';
 import { verifyBiomeContentHashes } from './biome-content.mjs';
-import { EditionChannel } from './edition-channel.mjs';
 import {
   EDITION_CHART_SET_FILE,
   EditionChartSetCheck,
@@ -951,7 +950,7 @@ async function main() {
   let chartSetPinText = null;
   try {
     chartSetPinText = readFileSync(fleetChartSetLockPath(), 'utf8');
-    assertRosteredChartSetLock(JSON.parse(chartSetPinText), EDITION_CHART_SET_FILE, EditionChannel.Release);
+    assertRosteredChartSetLock(JSON.parse(chartSetPinText), EDITION_CHART_SET_FILE);
   } catch (err) {
     console.error(`[dist:check] chart-set pin: ${err.message}. Run \`${commandFor('resolve-chart-set.mjs')}\`.`);
     failed = true;

package/edition/edition-artifact.mjs

@@ -276,7 +276,7 @@ export function writeEditionArtifact({
       throw new Error(`edition "${distributionId}" has no ${file}: an edition carries all four locks`);
     }
   }
-  assertRosteredChartSetLock(chartSetLock, EDITION_CHART_SET_FILE, channel);
+  assertRosteredChartSetLock(chartSetLock, EDITION_CHART_SET_FILE);
   const descriptor = editionDescriptor({ distributionId, channel, pins, workflow, evidenceTrustPolicy, engineImage });
   mkdirSync(outDir, { recursive: true });
   for (const [file, value] of [[EDITION_DESCRIPTOR_FILE, descriptor], ...byFile]) {

package/edition/edition-chart-set.mjs

@@ -26,7 +26,6 @@
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
-import { EditionChannel } from './edition-channel.mjs';
 import { dataRoot } from './edition-workspace.mjs';
 
 export const EDITION_CHART_SET_FILE = 'chart-set.lock.json';
@@ -39,38 +38,12 @@ export const EditionChartSetCheck = Object.freeze({
   STALE: 'stale',
 });
 
-/**
- * A published chart's version coordinate, per channel: `-h<16 hex>` (content
- * hash) in a release chart set, `-dev.<12 hex>` (the frozen xema-deploy SHA) in a
- * develop one. One lock SHAPE serves both; the coordinate is what the producer
- * of each channel writes, so each producer validates its own channel's (this is
- * a check of what is being written, not a branch of any reader).
- */
-const CHART_VERSION_COORDINATE = Object.freeze({
-  [EditionChannel.Release]: /-h[0-9a-f]{16}$/,
-  [EditionChannel.Develop]: /-dev\.[0-9a-f]{12}$/,
-});
+/** A published chart's version coordinate: `-h<16 hex>`, the content hash its publisher mints. A develop chart set takes the release set's charts, so it carries the same coordinate. */
+const CHART_VERSION_COORDINATE = /-h[0-9a-f]{16}$/;
 
 /** The chart-set lock schema every reader accepts; a lock of any other schema is re-resolved, never migrated. */
 export const CHART_SET_LOCK_SCHEMA_VERSION = 4;
 
-/** The version prefix of a develop snapshot chart set (`0.0.0-dev.<sha12>`): xema-deploy's frozen-SHA charts, which have no index chart. */
-export const DEVELOP_CHART_VERSION_PREFIX = '0.0.0-dev.';
-
-/** The length of the lowercase-hex xema-deploy SHA a develop snapshot version carries. */
-export const DEVELOP_CHART_SHA_LENGTH = 12;
-
-/** The full develop snapshot version grammar: `0.0.0-dev.<12 lowercase hex>`, anchored. */
-export const DEVELOP_CHART_VERSION_PATTERN = new RegExp(
-  `^${DEVELOP_CHART_VERSION_PREFIX.replaceAll('.', '\\.')}[0-9a-f]{${DEVELOP_CHART_SHA_LENGTH}}$`,
-);
-
-/** Does `version` start with the develop prefix, whether or not it is the full develop grammar? */
-export const hasDevelopChartVersionPrefix = (version) => typeof version === 'string' && version.startsWith(DEVELOP_CHART_VERSION_PREFIX);
-
-/** Is `version` a develop snapshot version? The one predicate for "this publisher has no index chart". */
-export const isDevelopChartVersion = (version) => typeof version === 'string' && DEVELOP_CHART_VERSION_PATTERN.test(version);
-
 /** An OCI manifest digest: `sha256:` and 64 lowercase hex. */
 export const OCI_DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
 
@@ -79,15 +52,10 @@ export const RESOLVE_CHART_SET_INSTRUCTION = 're-resolve the chart set with `xem
 
 /**
  * A chart-set lock (schemaVersion 4) that pins every member by version and OCI
- * manifest digest, with `channel`'s version coordinate, and pins each publisher's
- * index chart by `indexDigest` (null exactly for a develop snapshot version,
- * which has no index chart; the release channel refuses null).
+ * manifest digest, with the `-h<16 hex>` content coordinate, and pins each
+ * publisher's index chart by `indexDigest` (always a sha256 digest).
  */
-export function assertRosteredChartSetLock(lock, label, channel) {
-  const coordinate = CHART_VERSION_COORDINATE[channel];
-  if (coordinate === undefined) {
-    throw new Error(`${label}: cannot validate a chart-set lock for channel ${JSON.stringify(channel)}; expected ${Object.values(EditionChannel).join(' | ')}`);
-  }
+export function assertRosteredChartSetLock(lock, label) {
   const fail = (why) => {
     throw new Error(`${label} is not a rostered chart-set lock: ${why}`);
   };
@@ -101,30 +69,20 @@ export function assertRosteredChartSetLock(lock, label, channel) {
     }
     for (const [name, member] of Object.entries(pin.charts)) {
       if (!member || typeof member !== 'object' || Array.isArray(member)) {fail(`${pin.index}: ${name} must be {version, digest}`);}
-      if (!coordinate.test(String(member.version))) {fail(`${pin.index}: ${name} has no ${channel} content coordinate (${member.version}); a ${channel} chart set carries ${coordinate}`);}
+      if (!CHART_VERSION_COORDINATE.test(String(member.version))) {fail(`${pin.index}: ${name} has no content coordinate (${member.version}); a chart set carries ${CHART_VERSION_COORDINATE}`);}
       if (!OCI_DIGEST_PATTERN.test(String(member.digest))) {fail(`${pin.index}: ${name} has no sha256 manifest digest`);}
     }
-    assertIndexDigest(pin, position, channel, fail);
+    assertIndexDigest(pin, position, fail);
   }
   return lock;
 }
 
-/** The `indexDigest` rule: present, a sha256 digest unless the version is a develop snapshot (then null), and never null in a release lock. */
-function assertIndexDigest(pin, position, channel, fail) {
+/** The `indexDigest` rule: the key is present and is a sha256 digest. */
+function assertIndexDigest(pin, position, fail) {
   const where = `publisher ${position} (${pin?.index ?? '?'})`;
   if (!pin || typeof pin !== 'object' || !Object.hasOwn(pin, 'indexDigest')) {
-    fail(`${where} carries no indexDigest key (required: "sha256:<64 hex>" for a release index, null for a develop snapshot version)`);
-  }
-  if (hasDevelopChartVersionPrefix(pin.version) && !isDevelopChartVersion(pin.version)) {
-    fail(`${where} has malformed develop chart version ${JSON.stringify(pin.version)}; a develop version is exactly ${DEVELOP_CHART_VERSION_PREFIX}<${DEVELOP_CHART_SHA_LENGTH} lowercase hex>`);
-  }
-  const develop = isDevelopChartVersion(pin.version);
-  if (pin.indexDigest === null) {
-    if (!develop) {fail(`${where} has indexDigest null with version ${JSON.stringify(pin.version)}; null is only for a develop snapshot version (${DEVELOP_CHART_VERSION_PREFIX}<sha12>)`);}
-    if (channel === EditionChannel.Release) {fail(`${where} has indexDigest null, which a release chart set refuses; a release index chart is pinned by digest`);}
-    return;
+    fail(`${where} carries no indexDigest key (required: "sha256:<64 hex>")`);
   }
-  if (develop) {fail(`${where} has an indexDigest with develop snapshot version ${pin.version}; a develop snapshot has no index chart, so indexDigest must be null`);}
   if (!OCI_DIGEST_PATTERN.test(String(pin.indexDigest))) {fail(`${where} has a malformed indexDigest (${JSON.stringify(pin.indexDigest)}); expected "sha256:<64 lowercase hex>"`);}
 }
 
@@ -134,7 +92,7 @@ function assertIndexDigest(pin, position, channel, fail) {
  * coordinates is written.
  */
 export function writeEditionChartSet(editionDir, pinText) {
-  assertRosteredChartSetLock(JSON.parse(pinText), EDITION_CHART_SET_FILE, EditionChannel.Release);
+  assertRosteredChartSetLock(JSON.parse(pinText), EDITION_CHART_SET_FILE);
   writeFileSync(join(editionDir, EDITION_CHART_SET_FILE), pinText);
 }
 

package/edition/git-json.mjs

@@ -0,0 +1,54 @@
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+import { parseStrictJson } from './strict-json.mjs';
+
+const requireFromHere = createRequire(import.meta.url);
+
+let loadedSourceHash;
+
+/** Git-object primitives of `@xemahq/distribution-source-hash`; no kernel is consulted. */
+function gitObjectReader() {
+  loadedSourceHash ??= requireFromHere('@xemahq/distribution-source-hash');
+  return loadedSourceHash;
+}
+
+/**
+ * Read + parse a JSON file out of an exact Git commit (never the work tree).
+ *
+ * This is the seam every authored source file crosses on its way into a lock
+ * or an index — `xema-biome.json`, a platform service's `package.json`,
+ * `cross-repo-build-inputs.json`, the committed generated biome index — so it
+ * parses STRICTLY: a duplicated object key is refused, naming the commit, the
+ * path and the JSON pointer of the object. `JSON.parse` would keep the last
+ * occurrence, which is how a `resources` declaration was dropped from a sealed
+ * lock with every reader agreeing (see `strict-json.mjs`).
+ *
+ * The commit check, the buffer ceiling and the exact-UTF-8 decode are the
+ * source-hash package's own (loaded WITHOUT the kernel check hashing needs, so
+ * the source checkout, which runs before any kernel is built, can read a record
+ * too); only the parse differs from its
+ * `readGitJsonAtCommit`, which is lenient and is therefore not delegated to.
+ */
+export function readGitJsonAtCommit(repoDir, repoRelativePath, commit) {
+  const sourceHash = gitObjectReader();
+  sourceHash.assertGitCommitExists(repoDir, commit);
+  let raw;
+  try {
+    raw = execFileSync(
+      'git',
+      ['-C', repoDir, 'show', `${commit}:${repoRelativePath}`],
+      {
+        encoding: 'buffer',
+        maxBuffer: sourceHash.GIT_OBJECT_MAX_BUFFER_BYTES,
+        stdio: ['ignore', 'pipe', 'pipe'],
+      },
+    );
+  } catch {
+    throw new Error(
+      `cannot read "${repoRelativePath}" from Git commit "${commit}"`,
+    );
+  }
+  const context = `Git object "${commit}:${repoRelativePath}"`;
+  return parseStrictJson(sourceHash.decodeExactUtf8(raw, context), context);
+}

package/edition/lib.mjs

@@ -30,6 +30,7 @@ import {
   sourcePath,
 } from './edition-workspace.mjs';
 import { SHA256_HEX_PATTERN } from './evidence-grammars.mjs';
+import { readGitJsonAtCommit } from './git-json.mjs';
 import { isKernelCapabilityDomain } from './kernel-capability-domain.mjs';
 import {
   assertPrivilegesHavePrincipals,
@@ -42,7 +43,7 @@ import {
   PUBLISHED_SOURCE_REF,
   publishedSourceCommit,
 } from './source-authority.mjs';
-import { parseStrictJson, readStrictJsonFile } from './strict-json.mjs';
+import { readStrictJsonFile } from './strict-json.mjs';
 import { compareStrings } from './string-order.mjs';
 
 export {
@@ -51,6 +52,7 @@ export {
   DistributionSourceMode,
   PUBLISHED_SOURCE_REF,
   publishedSourceCommit,
+  readGitJsonAtCommit,
 };
 
 
@@ -3063,167 +3065,3 @@ export function hashImageBuildInputs(request, algorithm) {
   return distributionSourceHash().hashImageBuildInputs(request, algorithm);
 }
 
-/**
- * Read + parse a JSON file out of an exact Git commit (never the work tree).
- *
- * This is the seam every authored source file crosses on its way into a lock
- * or an index — `xema-biome.json`, a platform service's `package.json`,
- * `cross-repo-build-inputs.json`, the committed generated biome index — so it
- * parses STRICTLY: a duplicated object key is refused, naming the commit, the
- * path and the JSON pointer of the object. `JSON.parse` would keep the last
- * occurrence, which is how a `resources` declaration was dropped from a sealed
- * lock with every reader agreeing (see `strict-json.mjs`).
- *
- * The commit check, the buffer ceiling and the exact-UTF-8 decode are the
- * source-hash package's own; only the parse differs from its
- * `readGitJsonAtCommit`, which is lenient and is therefore not delegated to.
- */
-export function readGitJsonAtCommit(repoDir, repoRelativePath, commit) {
-  const sourceHash = distributionSourceHash();
-  sourceHash.assertGitCommitExists(repoDir, commit);
-  let raw;
-  try {
-    raw = execFileSync(
-      'git',
-      ['-C', repoDir, 'show', `${commit}:${repoRelativePath}`],
-      {
-        encoding: 'buffer',
-        maxBuffer: sourceHash.GIT_OBJECT_MAX_BUFFER_BYTES,
-        stdio: ['ignore', 'pipe', 'pipe'],
-      },
-    );
-  } catch {
-    throw new Error(
-      `cannot read "${repoRelativePath}" from Git commit "${commit}"`,
-    );
-  }
-  const context = `Git object "${commit}:${repoRelativePath}"`;
-  return parseStrictJson(sourceHash.decodeExactUtf8(raw, context), context);
-}
-
-/**
- * The producing repository's OWN committed record of what it vendored.
- *
- * `vendor-cross-repo-inputs.mjs` reads exactly this file, at the commit being
- * built, to emit the `--vendored <dest>=<repoDir>@<commit>:<src>` arguments it
- * hands `compute-image-tag.mjs`. It is therefore the ONLY source of the vendored
- * commit that can agree with the tag CI pushes.
- */
-export const CROSS_REPO_BUILD_INPUTS_PATH =
-  'tooling/release/cross-repo-build-inputs.json';
-
-/** Identity of one vendored input — the tuple that survives a pin bump. */
-export function crossRepoInputKey(input) {
-  return [input.sourceRepo, input.sourcePath, input.destinationPath].join('\u0000');
-}
-
-/**
- * Resolve the vendored inputs of ONE consumer repository at ONE commit.
- *
- * WHY THE COMMIT COMES FROM THE CONSUMER, NOT FROM THE INDEX
- *
- * The index's `crossRepoBuildInputs` carry no `sourceCommit`; they name only
- * WHICH content is vendored. Both this tooling and the parity gate used to
- * supply the missing commit from `runtimeSourceIndex.repositoryPins`, and CI
- * supplies it from the file above — so the two disagreed the moment a consumer
- * repository's mirror lagged the index by one pin, which is its NORMAL resting
- * state: the mirror is generated FROM the index and committed separately, so it
- * is stale by construction between the index moving and the consumer
- * regenerating.
- *
- * That is not a cosmetic disagreement. `crossRepo.sourceCommit` is framed into
- * the component KEY of the image-input hash, so a pin that differs by one
- * commit yields a different `contentHash` FOR BYTE-IDENTICAL VENDORED CONTENT —
- * a coordinate no CI run has ever pushed or ever will. Measured 2026-09-07 on
- * `origin/main`: five of the sixty-eight coordinates in the eight editions
- * (`backlog-api`, `channel-gateway-api`, `control-plane-api`,
- * `document-render-api` from repos/xema-community, and `biome-host-api` from
- * repos/xema-base) 404'd in the registry for exactly this reason, while the tags
- * their producing CI DID push were present and served on both platforms.
- *
- * Reading the index pin also imposed a requirement that cannot be satisfied.
- * `repos/xema-base` vendors from `repos/xema-community` and vice versa, so
- * "every mirror agrees with the index" is a mutual fixed point over a 2-cycle,
- * and bumping either side invalidates the other. No such pair exists: scanning
- * eighty commits of each on `origin/main` found ZERO mutually coherent pairs.
- * Reading the consumer's own record removes the fixed point entirely — an
- * image's identity depends only on the repository that builds it.
- *
- * It stays edition-INDEPENDENT, which is the property the previous design was
- * protecting: the record is a property of the consumer's COMMIT, not of any
- * edition's resolved commit map, so every edition shipping a subject still
- * derives the same `contentHash` for it.
- */
-export function resolveCrossRepoVendoredInputs({
-  indexInputs,
-  consumerRepo,
-  consumerRepoDir,
-  consumerCommit,
-}) {
-  const declared = indexInputs.filter(
-    (input) => input.consumerRepo === consumerRepo,
-  );
-  if (declared.length === 0) {return [];}
-  if (!consumerCommit) {
-    throw new Error(
-      `cross-repo build inputs are declared for "${consumerRepo}", but this ` +
-        `distribution resolves no commit for it — the vendored content cannot ` +
-        `be pinned, so the image cannot be addressed`,
-    );
-  }
-  let record;
-  try {
-    record = readGitJsonAtCommit(
-      consumerRepoDir,
-      CROSS_REPO_BUILD_INPUTS_PATH,
-      consumerCommit,
-    );
-  } catch (cause) {
-    throw new Error(
-      `"${consumerRepo}" declares cross-repo build inputs but ` +
-        `${CROSS_REPO_BUILD_INPUTS_PATH} is unreadable at ${consumerCommit}. ` +
-        `That file is what its CI feeds to compute-image-tag.mjs; without it ` +
-        `no coordinate this tooling derives can match the tag CI pushes.`,
-      { cause },
-    );
-  }
-  const mirrored = new Map();
-  for (const input of record?.inputs ?? []) {
-    mirrored.set(crossRepoInputKey(input), input.sourceCommit);
-  }
-  // Set equality in BOTH directions. A commit that LAGS is normal and is now
-  // honoured; a differing input SET is a genuine declaration disagreement, and
-  // it moves the hash just as surely — so it must fail rather than resolve to a
-  // coordinate built from a different closure.
-  const declaredKeys = new Set(declared.map((input) => crossRepoInputKey(input)));
-  const resolved = declared.map((input) => {
-    const sourceCommit = mirrored.get(crossRepoInputKey(input));
-    if (!sourceCommit) {
-      throw new Error(
-        `the runtime image source index declares a cross-repo build input for ` +
-          `"${consumerRepo}" vendoring "${input.sourceRepo}:${input.sourcePath}" ` +
-          `to "${input.destinationPath}", but ${CROSS_REPO_BUILD_INPUTS_PATH} at ` +
-          `${consumerCommit} declares no such input — its CI does not vendor it, ` +
-          `so the coordinate this tooling would derive is one nothing builds`,
-      );
-    }
-    return {
-      consumerService: input.consumerService ?? null,
-      destinationPath: input.destinationPath,
-      sourceRepoDir: sourcePath(input.sourceRepo),
-      sourcePath: input.sourcePath,
-      sourceCommit,
-    };
-  });
-  for (const key of mirrored.keys()) {
-    if (declaredKeys.has(key)) {continue;}
-    const [sourceRepo, sourcePath, destinationPath] = key.split('\0');
-    throw new Error(
-      `${CROSS_REPO_BUILD_INPUTS_PATH} at ${consumerCommit} vendors ` +
-        `"${sourceRepo}:${sourcePath}" to "${destinationPath}" for ` +
-        `"${consumerRepo}", which the runtime image source index does not ` +
-        `declare — its CI bakes content this tooling does not hash`,
-    );
-  }
-  return resolved;
-}