@xemahq/xema 0.33.2 → 0.33.4

package/edition/release-channel-guard.mjs

@@ -17,7 +17,7 @@ import { join, resolve } from 'node:path';
 
 import { isDevelopImageRef } from './develop-image-coordinate.mjs';
 import { EDITION_CHART_SET_FILE, assertRosteredChartSetLock } from './edition-chart-set.mjs';
-import { EditionChannel, EditionLockFile } from './edition-constants.mjs';
+import { EditionLockFile } from './edition-constants.mjs';
 import { isEntryModule } from './edition-workspace.mjs';
 
 /** Throws when `value` (a parsed JSON document) names a develop image repository. `where` names it in the refusal. */
@@ -30,10 +30,9 @@ export function assertReleaseContent(value, where) {
         'a release lock names release repositories only',
     );
   }
-  // A chart-set lock (one with a roster of publishers) carries release chart
-  // coordinates only: a develop chart set copied into a release is refused.
+  // A chart-set lock (one with a roster of publishers) carries content coordinates only.
   if (Array.isArray(value.publishers)) {
-    assertRosteredChartSetLock(value, where, EditionChannel.Release);
+    assertRosteredChartSetLock(value, where);
   }
 }
 

package/edition/release-edition-artifact.mjs

@@ -123,7 +123,7 @@ export async function readCommittedEdition(id, root = editionsRoot()) {
     distributionLock,
     imageLock: read(EditionLockFile.Images),
     authorizationLock: read(EditionLockFile.Authorization),
-    chartSetLock: assertRosteredChartSetLock(read(EditionLockFile.ChartSet), join(dir, EditionLockFile.ChartSet), EditionChannel.Release),
+    chartSetLock: assertRosteredChartSetLock(read(EditionLockFile.ChartSet), join(dir, EditionLockFile.ChartSet)),
   };
 }
 

package/edition/resolve-chart-set.mjs

@@ -55,27 +55,21 @@
 //   shape this plane has been bitten by: a claim that outlives its evidence.
 
 import { existsSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
-import { basename, join } from 'node:path';
+import { join } from 'node:path';
 
-import { EditionChannel } from './edition-channel.mjs';
 import {
   EDITION_CHART_SET_FILE,
   CHART_SET_LOCK_SCHEMA_VERSION,
-  DEVELOP_CHART_VERSION_PREFIX,
   EditionChartSetCheck,
   OCI_DIGEST_PATTERN,
   assertRosteredChartSetLock,
   checkEditionChartSet,
-  DEVELOP_CHART_SHA_LENGTH,
-  hasDevelopChartVersionPrefix,
-  isDevelopChartVersion,
   writeEditionChartSet,
 } from './edition-chart-set.mjs';
 import { vendorChartSetConfig } from './edition-config.mjs';
 import { WorkspaceRoot, configureEditionWorkspaceFromProcess, dataRoot, editionsRoot, isEntryModule } from './edition-workspace.mjs';
 import { serializeJson } from './lib.mjs';
 import { OrasRegistry } from './oras.mjs';
-import { deployPinKey } from './pin-source.mjs';
 import {
   loadRegistryCredentialDeclarations,
   resolveRegistryCredential,
@@ -129,11 +123,8 @@ export function isVersionTag(tag) {
  * last: guessing an order for a coordinate whose age is unknown is how a stale
  * set gets pinned as current.
  */
-export function selectNewestIndex(allCandidates) {
-  if (!Array.isArray(allCandidates)) {return null;}
-  // Anything with the develop prefix (`0.0.0-dev.`) is a frozen xema-deploy
-  // snapshot or a malformed develop version, never a release index: it is not a candidate for the release pin.
-  const candidates = allCandidates.filter((c) => !hasDevelopChartVersionPrefix(c.tag));
+export function selectNewestIndex(candidates) {
+  if (!Array.isArray(candidates)) {return null;}
   if (candidates.length === 0) {return null;}
   const undated = candidates.filter((c) => !c.createdAt);
   if (undated.length > 0) {
@@ -155,8 +146,7 @@ export const INDEX_ROSTER_ANNOTATION = 'xema.dev/chart-set-charts';
 
 /**
  * The lock for `publishers`: each publisher's index version, the manifest digest
- * the registry served for that index (`indexDigestsByIndex`, null for a develop
- * snapshot, which has no index chart), and its sealed roster.
+ * the registry served for that index (`indexDigestsByIndex`), and its sealed roster.
  */
 export function buildLock(versionsByIndex, rostersByIndex, indexDigestsByIndex, publishers = chartSetPublishers()) {
   // Every publisher's VERSION first: a pin that resolved nothing for one half is
@@ -193,9 +183,8 @@ export function buildLock(versionsByIndex, rostersByIndex, indexDigestsByIndex,
       }
       // The digest the registry served for the index manifest the roster was read from.
       const indexDigest = indexDigestsByIndex?.[publisher.index];
-      const wellFormed = isDevelopChartVersion(version) ? indexDigest === null : DIGEST_PATTERN.test(String(indexDigest));
-      if (!wellFormed) {
-        throw new Error(`no index manifest digest was read for '${publisher.index}@${version}' (got ${JSON.stringify(indexDigest ?? null)}; a release index needs sha256:<64 hex>, a develop snapshot null)`);
+      if (!DIGEST_PATTERN.test(String(indexDigest))) {
+        throw new Error(`no index manifest digest was read for '${publisher.index}@${version}' (got ${JSON.stringify(indexDigest ?? null)}; a release index needs sha256:<64 hex>)`);
       }
       return { ...publisher, version, indexDigest, charts };
     }),
@@ -277,63 +266,12 @@ function editionDirs() {
     .sort();
 }
 
-const SHA_PATTERN = /^[0-9a-f]{40}$/;
-
-/** The develop chart version xema-deploy publishes for a frozen SHA: `0.0.0-dev.<sha12>`, also the OCI tag. */
-export const developChartVersion = (sha) => `${DEVELOP_CHART_VERSION_PREFIX}${sha.slice(0, DEVELOP_CHART_SHA_LENGTH)}`;
-
-/** Every chart (a directory with a Chart.yaml, library charts included) of an xema-deploy checkout, sorted. */
-function deployChartNames(xemaDeployDir) {
-  const chartsDir = join(xemaDeployDir, 'charts');
-  if (!existsSync(chartsDir)) {throw new Error(`${xemaDeployDir} has no charts/ directory`);}
-  return readdirSync(chartsDir, { withFileTypes: true })
-    .filter((entry) => entry.isDirectory() && existsSync(join(chartsDir, entry.name, 'Chart.yaml')))
-    .map((entry) => entry.name)
-    .sort();
-}
-
 /** The registry client for the chart registry, with the data root's declared credential. */
 export function chartRegistryClient() {
   const credential = resolveRegistryCredential({ authority: registryAuthority(), declarations: loadRegistryCredentialDeclarations() });
   return new OrasRegistry({ credential });
 }
 
-/** The manifest digest the chart registry serves for `<chart>:<version>`. */
-const registryManifestDigest = (client) => async (name, version) =>
-  (await client.getManifestByTag(registryRepository(name), version)).digest;
-
-/**
- * The develop chart-set lock: the SAME rostered lock a release pins, over the
- * charts xema-deploy publishes for the frozen SHA. The deploy publisher (the
- * workspace publisher whose repository is the deploy pin role's) publishes every
- * chart directory of its tree at `0.0.0-dev.<sha12>`; the roster records each
- * chart's registry manifest digest, so a consumer pulls by digest exactly as it
- * does for a release. A chart the registry does not serve is refused by name.
- * `lookup(name, version)` defaults to the chart registry and returns the digest.
- */
-export async function resolveDevelopChartSet({ xemaDeployDir, xemaDeploySha, lookup }) {
-  if (!SHA_PATTERN.test(xemaDeploySha ?? '')) {
-    throw new Error(`the deploy checkout SHA is not a 40-hex commit: ${JSON.stringify(xemaDeploySha)}`);
-  }
-  const names = deployChartNames(xemaDeployDir);
-  if (names.length === 0) {throw new Error(`the deploy checkout at ${xemaDeploySha} has no chart (charts/<name>/Chart.yaml)`);}
-  const deployRepo = basename(deployPinKey());
-  const publishers = chartSetPublishers().filter((publisher) => basename(publisher.repo) === deployRepo);
-  if (publishers.length !== 1) {
-    throw new Error(
-      `${publishers.length} chart publishers have repository ${deployRepo} (the deploy pin role); exactly one must, ` +
-        'since it is the publisher whose develop charts this lock pins',
-    );
-  }
-  const version = developChartVersion(xemaDeploySha);
-  const digestOf = lookup ?? registryManifestDigest(chartRegistryClient());
-  const roster = Object.fromEntries(names.map((name) => [name, { version }]));
-  const sealed = await sealRoster(roster, digestOf, `${publishers[0].index}@${version}`);
-  // A develop snapshot has no index chart: its roster is the deploy checkout's chart directories.
-  const lock = buildLock({ [publishers[0].index]: version }, { [publishers[0].index]: sealed }, { [publishers[0].index]: null }, publishers);
-  return assertRosteredChartSetLock(lock, EDITION_CHART_SET_FILE, EditionChannel.Develop);
-}
-
 export function readLock(path = chartSetLockPath()) {
   try {
     return JSON.parse(readFileSync(path, 'utf8'));
@@ -395,7 +333,7 @@ async function main(argv) {
   const check = argv.includes('--check');
   const { versionsByIndex, rostersByIndex, indexDigestsByIndex } = await resolveFromRegistry();
   const next = buildLock(versionsByIndex, rostersByIndex, indexDigestsByIndex);
-  assertRosteredChartSetLock(next, CHART_SET_LOCK_FILE, EditionChannel.Release);
+  assertRosteredChartSetLock(next, CHART_SET_LOCK_FILE);
   const pinText = serializeJson(next);
   const current = readLock();
   // The pin AND every edition's copy of it: one writer, one run, so the N copies

package/edition/resolve-customer-edition.mjs

@@ -326,7 +326,7 @@ export async function resolveCustomerEdition(request) {
   const imageLock = await resolveCustomerImages({ id, catalogue, lock, composed, schemas, inputs, sealOwn: request.sealOwn });
   // The chart-set is copied whole, so it carries the coordinates of the channel it was published on:
   // the edition being written states its channel, and a chart-set of the other one is refused here.
-  const chartSetLock = assertRosteredChartSetLock(catalogue.chartSet, `the catalogue's chart-set of "${catalogue.offeringId}"`, request.channel);
+  const chartSetLock = assertRosteredChartSetLock(catalogue.chartSet, `the catalogue's chart-set of "${catalogue.offeringId}"`);
   return { id, distributionLock: lock, imageLock, authorizationLock, chartSetLock };
 }
 

package/edition/resolve-images.mjs

@@ -38,6 +38,7 @@ import { join, relative, sep } from 'node:path';
 
 import { assertBuildLedgerComplete } from './build-ledger-completeness.mjs';
 import { BUILD_LEDGER_FILE, readBuildLedger } from './build-ledger.mjs';
+import { CROSS_REPO_BUILD_INPUTS_PATH, crossRepoInputKey, resolveCrossRepoVendoredInputs } from './cross-repo-build-inputs.mjs';
 import { resolveDispatchedRuntimeComponents } from './dispatched-runtime-components.mjs';
 import {
   assertCanonicalDistributionId,
@@ -53,15 +54,12 @@ import {
 } from './external-source-walk.mjs';
 import { assertDeclaredSourceId, firstPartySourceId } from './first-party-source-ids.mjs';
 import {
-  CROSS_REPO_BUILD_INPUTS_PATH,
   compareStrings,
-  crossRepoInputKey,
   hashImageBuildInputs,
   imageInputSourceHashAlgorithm,
   loadKernelDistributionSchemas,
   parseResolvedDistributionLock,
   readGitJsonAtCommit,
-  resolveCrossRepoVendoredInputs,
   serializeJson,
   sha256Hex,
   validateImmutableDistributionLock,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.33.2",
+  "version": "0.33.4",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:de506f4bb207dcf31fb135d585486f8fa5bf4fc11d0d1841506d8773393fa423"
+    "sourceDigest": "sha256:a8780b8b95054688b280033f5aec97bbdb0d4bc211513d09a992a3c025af653e"
   }
 }