@xemahq/xema 0.36.2 → 0.38.0

package/dist/edition/verify-image-evidence.bundle.mjs

@@ -62932,7 +62932,7 @@ function compareStrings(a, b) {
 
 // edition/operation-requirements.mjs
 var requireFromHere3 = createRequire3(import.meta.url);
-var PRINCIPAL_PRIVILEGE_FIELDS = Object.freeze(["requiresOperations", "requiresOrganizationSweeps"]);
+var PRINCIPAL_PRIVILEGE_FIELDS = Object.freeze(["requiresOperations", "optionalOperations", "requiresOrganizationSweeps"]);
 
 // edition/source-authority.mjs
 var DistributionSourceMode = Object.freeze({

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "artifactSha256": "sha256:85a8f844799b403c2686b5f6fdbecaaa07f2edfcab348d0502b2e803040f66cc",
+  "artifactSha256": "sha256:a372353def55d2dc330427711ddb3024938a009b390a6888f752019072c44d5f",
   "esbuild": {
     "version": "0.28.2"
   },
@@ -2383,229 +2383,229 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:bbeac7ff01376cb89ed2140526d4795d8e559b3f01612b404a701f19aaa24c6a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:287e4cf042626963e07396c706350e9668adbcacd238a7ad4db1d68bba3858b2"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:f9f16b58279c8c2619a39c5cc92bdbc334543d1a324304cd5d3b120d66dc8f3a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:e3997bd9a0082e02d01760868b2a4f41ed3081e904126b30fdf86e7938dc6137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:71ae51028847ab3430ffec9b229b0516a7705b75a6de1fcfa665f5e1abf8e9bb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:c575e96b70bda82899931eb0b18567988e2e13e664fa498bcbef96b571dcabb4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:aa1a05f1728813a7bdb1e02d9305e9adf641d695e6767305210c67a1d81b38a7"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:c488ac72ff3f23c0f28f8db159bf84d2c86ec5cda3633db1fe91ca3f21b12214"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b141474fff33b06734fb62cd2552752b991c8267bb1c9bccb22a81dd80e91c6c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:18ba727e6b13ca252def25cc6bd9adf894cbc2018198c41ce522637eeac7f871"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:b9dd5c01903394436530783614efb0cd357d982ed2befd844a39328479773cbc"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/git-json.mjs",
       "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:433202eb2db84510acd11de6fe5ede81c8d96b8bc72991444940f7f84a48897f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:20abdde62a7b037c01ea9bbe1ff1e6094e6b0efd0add2f656f1938a04409bf82"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/lib.mjs",
-      "sha256": "sha256:dfcfdc0716b63f91db88364c4fecc2f8941511b302a20429fd5921270e375cb6"
+      "sha256": "sha256:adb469d6a59dd4f326477973e2d6f2d11cc4b33fff4c438ae1cd6f1da3b46fb0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/operation-requirements.mjs",
-      "sha256": "sha256:ffe6fdc9da6b2974270fc86c11be0c41d0bc6d85c8e3c137d3c3bc00a72fc4f6"
+      "sha256": "sha256:e7fed25747ee92be84cdc864ca35a723356df5b3d08923cf71f4bc66a791eb5d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:a23fef4698ef66ba9de4a1aabe3eebe6487d1f105f3fc161bafc5a33b99a2440"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:858b607dde94e2abd00a341f569e18cfa567d4bff139c64a2d60abbb7de4c85e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:62f83f8bb835f360535402d12657156d2c9d6e651b426c2b30a04a2dc2f8d3e8"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:058c849767434e9ba911d9310092bede42e3ef959c75bbd35ff8879dc21ce3ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.36.2",
+      "version": "0.38.0",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/edition/develop-chart-set.mjs

@@ -12,10 +12,16 @@
 // member against the registry, and build the same schemaVersion 4 lock. The
 // committed release lock is never read.
 //
-// ONE PUBLISHER. A develop lock lists only the publisher whose repository is
-// the deploy pin role's: a develop deployment renders no infra chart (the
-// deploy engine refuses scope infra on the develop channel), and the other
-// publishers have no develop channel.
+// TWO PUBLISHERS. A develop lock lists the publisher whose repository is the
+// deploy pin role's (this resolution) followed by the release infra publisher,
+// taken verbatim from the data root's committed chart-set.lock.json. Infra
+// charts have no develop channel: the committed release entry is the only
+// published infra set, and the deploy engine plans and applies scope infra on
+// every channel, so a develop deployment needs it to move infra (pgbouncer,
+// external-services) through the pipeline. The data root pin is already in the
+// develop tag, so a moved infra entry moves the tag. A committed lock that is
+// absent, or lacks exactly one infra publisher, is refused: no fallback, no
+// develop-without-infra mode.
 //
 // NOT PUBLISHED IS A REFUSAL. An index or member the registry does not serve
 // (404) is refused by name and version: publish-charts for the deploy commit
@@ -31,9 +37,11 @@ import { deployPinKey } from './pin-source.mjs';
 import {
   CHART_SET_LOCK_FILE,
   buildLock,
+  chartSetLockPath,
   chartRegistryClient,
   chartSetPublishers,
   indexRosterAndDigest,
+  readLock,
   registryChartDigest,
   sealRoster,
 } from './resolve-chart-set.mjs';
@@ -53,6 +61,30 @@ function deployPublisher() {
   return publishers[0];
 }
 
+/** The configured publishers that are not the deploy pin role's: the infra publisher(s) a release lock carries. */
+function infraPublisherIndexes() {
+  const deployRepo = basename(deployPinKey());
+  return chartSetPublishers().filter((publisher) => basename(publisher.repo) !== deployRepo).map((publisher) => publisher.index);
+}
+
+/** The ONE infra publisher entry of the data root's committed release lock, unchanged. */
+function committedInfraPublisher() {
+  const path = chartSetLockPath();
+  const committed = readLock(path);
+  if (committed === null) {
+    throw new Error(`${path} is absent or unreadable; a develop edition carries the release infra chart set from it`);
+  }
+  assertRosteredChartSetLock(committed, path);
+  const indexes = infraPublisherIndexes();
+  const found = committed.publishers.filter((publisher) => indexes.includes(publisher.index));
+  if (indexes.length !== 1 || found.length !== 1) {
+    throw new Error(
+      `${path} carries ${found.length} infra publisher entries (${indexes.length} infra publishers configured); exactly one is required`,
+    );
+  }
+  return found[0];
+}
+
 /** Run `read`; a registry 404 becomes the "not published yet" refusal naming `what` and the publisher's run for the deploy commit. */
 async function published(read, what, { publisher, xemaDeploySha }) {
   try {
@@ -87,6 +119,7 @@ export async function resolveDevelopChartSet({ xemaDeploySha, deployDir = deploy
     throw new Error(`the deploy checkout SHA is not a 40-hex commit: ${JSON.stringify(xemaDeploySha)}`);
   }
   const publisher = deployPublisher();
+  const infraPublisher = committedInfraPublisher();
   const { indexVersion, members } = readRoster(deployDir);
   const registry = client ?? chartRegistryClient();
   const label = `${publisher.index}@${indexVersion}`;
@@ -108,5 +141,6 @@ export async function resolveDevelopChartSet({ xemaDeploySha, deployDir = deploy
     { [publisher.index]: indexDigest },
     [publisher],
   );
+  lock.publishers.push(infraPublisher);
   return assertRosteredChartSetLock(lock, CHART_SET_LOCK_FILE);
 }

package/edition/lib.mjs

@@ -32,8 +32,10 @@ import { SHA256_HEX_PATTERN } from './evidence-grammars.mjs';
 import { readGitJsonAtCommit } from './git-json.mjs';
 import { isKernelCapabilityDomain } from './kernel-capability-domain.mjs';
 import {
+  PRINCIPAL_PRIVILEGE_FIELDS,
   assertPrivilegesHavePrincipals,
   componentOperationRequirements,
+  componentOptionalOperationRequirements,
   componentOrganizationSweepRequirements,
 } from './operation-requirements.mjs';
 import {
@@ -1608,7 +1610,7 @@ export async function manifestToIndexEntry({ raw, generatedIndex, rel, repo, pat
         'resolve no worker image: a worker declares artifact.kind "oci-image" or "shared-oci-image"',
     );
   }
-  // A privilege (`requiresOperations`, `requiresOrganizationSweeps`) is admitted for a lock workload
+  // A privilege (`requiresOperations`, `optionalOperations`, `requiresOrganizationSweeps`) is admitted for a lock workload
   // principal only; on any other component it is refused, never dropped.
   assertPrivilegesHavePrincipals(components, imageComponents, rel);
   // A biome must declare its images in EXACTLY ONE shape. Declaring both a
@@ -1655,6 +1657,10 @@ export async function manifestToIndexEntry({ raw, generatedIndex, rel, repo, pat
   // (`requiresOperations`), keyed by the SAME name the lock uses. Declared
   // intent only: the seal admits or refuses each one.
   const operationRequirements = {};
+  // `component → the operations it uses only when their owner is served`
+  // (`optionalOperations`), keyed like `operationRequirements`. Declared
+  // intent only: the seal grants, leaves ungranted or refuses each one.
+  const optionalOperationRequirements = {};
   // `component → the organization sweeps it may hold`
   // (`requiresOrganizationSweeps`), keyed like `operationRequirements`.
   // Declared intent only: the seal admits or refuses each one.
@@ -1752,7 +1758,7 @@ export async function manifestToIndexEntry({ raw, generatedIndex, rel, repo, pat
         }
         // An operation grant is admitted for a rostered workload caller, and a
         // runtime component is not one. Refused rather than dropped.
-        for (const field of ['requiresOperations', 'requiresOrganizationSweeps']) {
+        for (const field of PRINCIPAL_PRIVILEGE_FIELDS) {
           if (component[field] !== undefined) {
             throw new Error(
               `${where} declares scheduler "runtime" and ${field} — a ` +
@@ -1846,6 +1852,8 @@ export async function manifestToIndexEntry({ raw, generatedIndex, rel, repo, pat
       serviceProcessFacts[name] = componentProcessFacts(component, where);
       const operations = componentOperationRequirements(component, where);
       if (operations !== null) {operationRequirements[name] = operations;}
+      const optionalOperations = componentOptionalOperationRequirements(component, where);
+      if (optionalOperations !== null) {optionalOperationRequirements[name] = optionalOperations;}
       const sweeps = componentOrganizationSweepRequirements(component, where);
       if (sweeps !== null) {organizationSweepRequirements[name] = sweeps;}
       const queues = componentWorkerTaskQueues(component, protocol, where);
@@ -2285,6 +2293,17 @@ export async function manifestToIndexEntry({ raw, generatedIndex, rel, repo, pat
           ),
         }
       : {}),
+    // The operations each workload component uses only when their owner is
+    // served; omitted when none declares any.
+    ...(Object.keys(optionalOperationRequirements).length > 0
+      ? {
+          optionalOperationRequirements: Object.fromEntries(
+            Object.entries(optionalOperationRequirements).sort(([a], [b]) =>
+              compareStrings(a, b),
+            ),
+          ),
+        }
+      : {}),
     // The organization sweeps each workload component may hold; omitted when
     // none declares any.
     ...(Object.keys(organizationSweepRequirements).length > 0

package/edition/operation-requirements.mjs

@@ -69,6 +69,18 @@ export function componentOperationRequirements(component, where) {
   return declaredPrivilegeList(component, where, 'requiresOperations', OperationIdSchema, 'operation id');
 }
 
+/**
+ * The operations one workload component uses only when their owner is served
+ * (`optionalOperations`), graded exactly like `requiresOperations`. Declared
+ * INTENT only: the seal grants each one whose owner is served, leaves it
+ * ungranted when the owner is absent, and refuses one listed in both lists
+ * (`admitOperationGrants`).
+ */
+export function componentOptionalOperationRequirements(component, where) {
+  const { OperationIdSchema } = loadKernelPrivilegeGrammars();
+  return declaredPrivilegeList(component, where, 'optionalOperations', OperationIdSchema, 'operation id');
+}
+
 /**
  * The organization sweeps one workload component declares it may hold
  * (`requiresOrganizationSweeps`), each a member of the kernel's closed
@@ -84,7 +96,7 @@ export function componentOrganizationSweepRequirements(component, where) {
  * The privilege declarations a component may carry only if it is a workload
  * principal in the lock.
  */
-export const PRINCIPAL_PRIVILEGE_FIELDS = Object.freeze(['requiresOperations', 'requiresOrganizationSweeps']);
+export const PRINCIPAL_PRIVILEGE_FIELDS = Object.freeze(['requiresOperations', 'optionalOperations', 'requiresOrganizationSweeps']);
 
 /**
  * Thrown when a component that has no workload principal in the lock declares

package/edition/resolve-distribution.mjs

@@ -2040,6 +2040,13 @@ export function resolveDistributionFromInputs(
       Object.keys(e.operationRequirements).length > 0
         ? { operationRequirements: e.operationRequirements }
         : {}),
+      // The operations each workload component uses only when their owner is
+      // served, forwarded verbatim; the seal grants them or leaves them
+      // ungranted (`admitOperationGrants`), and refuses one also required.
+      ...(e.optionalOperationRequirements !== undefined &&
+      Object.keys(e.optionalOperationRequirements).length > 0
+        ? { optionalOperationRequirements: e.optionalOperationRequirements }
+        : {}),
       // The organization sweeps each workload component may hold, forwarded
       // verbatim; the seal admits them (`admitOrganizationSweeps`).
       ...(e.organizationSweepRequirements !== undefined &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.36.2",
+  "version": "0.38.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:aa5ec41f0d6de03b782bdfffd1dd994683c03ffe47476ea830c1f4ed9674ceda"
+    "sourceDigest": "sha256:6ceee7eaad77b410aeb26998f61349944a56481549d146a3bc42a7a325ab3890"
   }
 }