@xemahq/xema 0.38.0 → 0.39.0

package/dist/edition/verify-image-evidence.bundle.mjs

@@ -62628,6 +62628,17 @@ function subjectKind(value, where) {
   }
   return value;
 }
+var SupplementalLauncherKind = Object.freeze({
+  Biome: "biome"
+});
+var LAUNCHER_KINDS = Object.values(SupplementalLauncherKind);
+function supplementalLauncher(value, where) {
+  exactObject(value, where, ["kind", "biomeId"]);
+  if (!LAUNCHER_KINDS.includes(value.kind)) {
+    fail(`${where}.kind`, `must be one of ${LAUNCHER_KINDS.join(", ")}`);
+  }
+  return Object.freeze({ kind: value.kind, biomeId: text(value.biomeId, `${where}.biomeId`) });
+}
 function parseFirstPartySources(value) {
   const where = '"firstPartySources"';
   if (!isObject(value) || Object.keys(value).length === 0) {
@@ -62695,13 +62706,14 @@ function parseRuntimeImageSources(value) {
   const where = '"runtimeImageSources"';
   exactObject(value, where, ["supplementalSources", "crossRepoBuildInputs", "buildStepContextDirectories"]);
   const supplementalSources = list(value.supplementalSources, `${where}.supplementalSources`, (item, at) => {
-    exactObject(item, at, ["kind", "id", "repo", "path", "sourceManifestPath"]);
+    exactObject(item, at, ["kind", "id", "repo", "path", "sourceManifestPath"], ["launchedBy"]);
     return {
       kind: subjectKind(item.kind, `${at}.kind`),
       id: text(item.id, `${at}.id`),
       repo: repoHandle(item.repo, `${at}.repo`),
       path: text(item.path, `${at}.path`),
-      sourceManifestPath: text(item.sourceManifestPath, `${at}.sourceManifestPath`)
+      sourceManifestPath: text(item.sourceManifestPath, `${at}.sourceManifestPath`),
+      ...Object.hasOwn(item, "launchedBy") ? { launchedBy: supplementalLauncher(item.launchedBy, `${at}.launchedBy`) } : {}
     };
   });
   uniqueBy(supplementalSources, `${where}.supplementalSources`, (item) => `${item.kind}/${item.id}`);

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "artifactSha256": "sha256:a372353def55d2dc330427711ddb3024938a009b390a6888f752019072c44d5f",
+  "artifactSha256": "sha256:a0dea64dc420fa95f88ee79cc0a13927a8ef0b60d333d866a440f3d7a0c78250",
   "esbuild": {
     "version": "0.28.2"
   },
@@ -2383,229 +2383,229 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:bbeac7ff01376cb89ed2140526d4795d8e559b3f01612b404a701f19aaa24c6a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:287e4cf042626963e07396c706350e9668adbcacd238a7ad4db1d68bba3858b2"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:f9f16b58279c8c2619a39c5cc92bdbc334543d1a324304cd5d3b120d66dc8f3a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:e3997bd9a0082e02d01760868b2a4f41ed3081e904126b30fdf86e7938dc6137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:71ae51028847ab3430ffec9b229b0516a7705b75a6de1fcfa665f5e1abf8e9bb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:c575e96b70bda82899931eb0b18567988e2e13e664fa498bcbef96b571dcabb4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:aa1a05f1728813a7bdb1e02d9305e9adf641d695e6767305210c67a1d81b38a7"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:c488ac72ff3f23c0f28f8db159bf84d2c86ec5cda3633db1fe91ca3f21b12214"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b141474fff33b06734fb62cd2552752b991c8267bb1c9bccb22a81dd80e91c6c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:18ba727e6b13ca252def25cc6bd9adf894cbc2018198c41ce522637eeac7f871"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:b9dd5c01903394436530783614efb0cd357d982ed2befd844a39328479773cbc"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/git-json.mjs",
       "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:433202eb2db84510acd11de6fe5ede81c8d96b8bc72991444940f7f84a48897f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:20abdde62a7b037c01ea9bbe1ff1e6094e6b0efd0add2f656f1938a04409bf82"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/lib.mjs",
       "sha256": "sha256:adb469d6a59dd4f326477973e2d6f2d11cc4b33fff4c438ae1cd6f1da3b46fb0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:e7fed25747ee92be84cdc864ca35a723356df5b3d08923cf71f4bc66a791eb5d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:a23fef4698ef66ba9de4a1aabe3eebe6487d1f105f3fc161bafc5a33b99a2440"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:858b607dde94e2abd00a341f569e18cfa567d4bff139c64a2d60abbb7de4c85e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:62f83f8bb835f360535402d12657156d2c9d6e651b426c2b30a04a2dc2f8d3e8"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "edition/workspace-sections.mjs",
-      "sha256": "sha256:058c849767434e9ba911d9310092bede42e3ef959c75bbd35ff8879dc21ce3ff"
+      "sha256": "sha256:383f37ce066ea5573c30cedf124022095bf94d050f0a266a5881f587cff0ced0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/edition/dist-check.mjs

@@ -73,6 +73,7 @@ import {
   resolveComposedProcessStructure,
   resolveImageStructure,
   sourceTreeLocator,
+  supplementalSourcesFor,
 } from './resolve-images.mjs';
 import { withoutSealedDigests } from './seal-image-digests.mjs';
 import { createPinnedSourceAuthority } from './source-authority.mjs';
@@ -301,7 +302,7 @@ export async function checkImagesLock(id, checkSourceEvidence) {
         schemas,
         requiredPlatforms,
         resolveDistributionDeclaredSources(schemas, id),
-        { biomeIndex: pinned.biomeIndex },
+        { biomeIndex: pinned.biomeIndex, supplementalSources: supplementalSourcesFor(runtimeSourceIndex) },
       ),
       schemas,
       requiredPlatforms,

package/edition/resolve-images.mjs

@@ -45,7 +45,7 @@ import {
   distributionOutputPath,
   readBoundDistributionFile,
 } from './distribution-paths.mjs';
-import { editionWorkspaceConfig } from './edition-config.mjs';
+import { editionWorkspaceConfig, workspaceSection } from './edition-config.mjs';
 import { editionPinnedInputs } from './edition-pinned-inputs.mjs';
 import { dataRoot, editionsRoot, WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, sourcePath, sourcesRoot } from './edition-workspace.mjs';
 import {
@@ -398,6 +398,14 @@ function missingArtifactDependencyMessage(lock, serviceName, binding, biomeIndex
  * `dispatchesRuntimeComponents`: the runtime components that biome launches,
  * whose images enter this roster as runtime-component rows although their
  * biomes are not rostered (see `dispatched-runtime-components.mjs`).
+ *
+ * `options.supplementalSources` is the edition workspace's
+ * `runtimeImageSources.supplementalSources`: the declarations the source
+ * index's supplemental subjects were built from, carrying each one's
+ * `launchedBy`. A subject launched by a biome ships, owned by that biome, in
+ * every edition whose roster contains it; one a platform service binds ships
+ * with that service. A declared subject with neither is refused by name: it
+ * could never enter any edition, and it used to be dropped silently.
  */
 export function resolveImageStructure(
   lock,
@@ -405,7 +413,7 @@ export function resolveImageStructure(
   enums,
   requiredPlatforms,
   declaredSources,
-  { biomeIndex } = {},
+  { biomeIndex, supplementalSources } = {},
 ) {
   if (!Array.isArray(requiredPlatforms) || requiredPlatforms.length === 0) {
     throw new Error(
@@ -420,6 +428,12 @@ export function resolveImageStructure(
         'the runtime components a rostered biome dispatches, so a roster without it can omit images',
     );
   }
+  if (!Array.isArray(supplementalSources)) {
+    throw new Error(
+      `distribution "${lock.distributionId}" resolved its images without the supplemental source declarations — ` +
+        'they say which biome launches a supplemental subject, so a roster without them can omit images',
+    );
+  }
   const subjects = new Map();
   const webBiomes = [];
   const platformServiceBindings = [];
@@ -436,6 +450,28 @@ export function resolveImageStructure(
     }
     return pin;
   };
+  // A supplemental subject of the runtime-image source index, built at its
+  // repository pin, owned by whatever brings it into this edition.
+  const addSupplementalSubject = (supplemental, owners) => {
+    const repository = requireRepositoryPin(supplemental.repo);
+    if (supplemental.sourceCommit !== repository.sourceCommit) {
+      throw new Error(
+        `runtime subject "${supplemental.kind}:${supplemental.id}" source commit does not match its repository pin`,
+      );
+    }
+    addSubject(subjects, {
+      kind: supplemental.kind,
+      id: supplemental.id,
+      imageRef: supplemental.imageRef,
+      repo: supplemental.repo,
+      path: supplemental.path,
+      sourceCommit: repository.sourceCommit,
+      sourceManifestHash: supplemental.sourceManifestHash,
+      sourceManifestPath: supplemental.sourceManifestPath,
+      requiredPlatforms,
+      owners,
+    });
+  };
 
   for (const biome of lock.biomes) {
     // WHERE THIS BIOME'S IMAGES LIVE, and WHICH COMMIT THEY ARE BUILT FROM.
@@ -674,6 +710,50 @@ export function resolveImageStructure(
     ]),
   );
 
+  // Supplemental subjects a BIOME launches (`launchedBy`): sealed, owned by
+  // that biome, in every edition whose roster contains it. The catalogue
+  // checks run for every edition, rostered launcher or not.
+  const boundSubjects = new Set(
+    runtimeSourceIndex.platformServiceBindings.map((binding) => bindingKey(binding)),
+  );
+  const launchers = new Map(
+    supplementalSources
+      .filter((source) => source.launchedBy !== undefined)
+      .map((source) => [subjectKey(source), source.launchedBy]),
+  );
+  for (const key of launchers.keys()) {
+    if (!supplementalSubjects.has(key)) {
+      throw new Error(
+        `supplemental source "${key.replace('\0', ':')}" declares a launcher, but the runtime image source index ` +
+          'has no such supplemental subject — rebuild the index from the current declarations',
+      );
+    }
+  }
+  for (const [key, supplemental] of supplementalSubjects) {
+    const launcher = launchers.get(key);
+    if (launcher === undefined) {
+      if (!boundSubjects.has(key)) {
+        throw new Error(
+          `supplemental subject "${supplemental.kind}:${supplemental.id}" has neither a launchedBy nor a ` +
+            'platform-service binding, so no edition could ever carry it — declare what launches it ' +
+            '(runtimeImageSources.supplementalSources[].launchedBy) or bind it to a platform service',
+        );
+      }
+      continue;
+    }
+    if (!biomeIndex.some((entry) => entry.id === launcher.biomeId && entry.source === undefined)) {
+      throw new Error(
+        `supplemental subject "${supplemental.kind}:${supplemental.id}" is launched by biome ` +
+          `"${launcher.biomeId}", which the first-party biome index does not carry`,
+      );
+    }
+    if (lock.biomes.some((biome) => biome.id === launcher.biomeId)) {
+      addSupplementalSubject(supplemental, [
+        { kind: enums.RuntimeImageOwnerKind.Biome, biomeId: launcher.biomeId },
+      ]);
+    }
+  }
+
   for (const service of lock.platformServices ?? []) {
     let binding;
     // The discriminator is the DECLARED runtime binding, never "does the lock
@@ -726,29 +806,12 @@ export function resolveImageStructure(
       const key = bindingKey(binding);
       const supplemental = supplementalSubjects.get(key);
       if (supplemental) {
-        const repository = requireRepositoryPin(supplemental.repo);
-        if (supplemental.sourceCommit !== repository.sourceCommit) {
-          throw new Error(
-            `runtime subject "${supplemental.kind}:${supplemental.id}" source commit does not match its repository pin`,
-          );
-        }
-        addSubject(subjects, {
-          kind: supplemental.kind,
-          id: supplemental.id,
-          imageRef: supplemental.imageRef,
-          repo: supplemental.repo,
-          path: supplemental.path,
-          sourceCommit: repository.sourceCommit,
-          sourceManifestHash: supplemental.sourceManifestHash,
-          sourceManifestPath: supplemental.sourceManifestPath,
-          requiredPlatforms,
-          owners: [
-            {
-              kind: enums.RuntimeImageOwnerKind.PlatformService,
-              platformService: service.name,
-            },
-          ],
-        });
+        addSupplementalSubject(supplemental, [
+          {
+            kind: enums.RuntimeImageOwnerKind.PlatformService,
+            platformService: service.name,
+          },
+        ]);
       } else {
         const target = subjects.get(key);
         if (!target) {
@@ -1523,6 +1586,18 @@ function snapshotImageInputs(schemas, { inputs, lock }) {
   };
 }
 
+/**
+ * The supplemental source declarations an image resolve reads beside
+ * `runtimeSourceIndex`. An index with no supplemental subjects (a customer
+ * edition's own rows) needs none, and its workspace need not declare the
+ * section; any other reads the edition workspace's.
+ */
+export function supplementalSourcesFor(runtimeSourceIndex) {
+  return runtimeSourceIndex.supplementalSubjects.length === 0
+    ? []
+    : workspaceSection('runtimeImageSources', 'resolving supplemental image subjects').supplementalSources;
+}
+
 /**
  * The image ROWS of one edition: its subjects (hashed at the commits the lock
  * pins), its platform-service bindings and its bundled web biomes, after every
@@ -1555,7 +1630,7 @@ export async function resolveImageRows(id, { inputs, lock } = {}) {
       schemas,
       requiredPlatforms,
       declaredSources,
-      { biomeIndex },
+      { biomeIndex, supplementalSources: supplementalSourcesFor(runtimeSourceIndex) },
     ),
     schemas,
     requiredPlatforms,

package/edition/workspace-sections.mjs

@@ -73,6 +73,24 @@ function subjectKind(value, where) {
   return value;
 }
 
+/**
+ * What launches a supplemental subject that no platform service binds: the
+ * owner its image-lock row is sealed under. Closed, one member until a second
+ * real case exists: a BIOME, which launches the subject's image itself, so
+ * the subject ships in every edition whose roster contains that biome.
+ */
+export const SupplementalLauncherKind = Object.freeze({
+  Biome: 'biome',
+});
+
+const LAUNCHER_KINDS = Object.values(SupplementalLauncherKind);
+
+function supplementalLauncher(value, where) {
+  exactObject(value, where, ['kind', 'biomeId']);
+  if (!LAUNCHER_KINDS.includes(value.kind)) {fail(`${where}.kind`, `must be one of ${LAUNCHER_KINDS.join(', ')}`);}
+  return Object.freeze({ kind: value.kind, biomeId: text(value.biomeId, `${where}.biomeId`) });
+}
+
 export function parseFirstPartySources(value) {
   const where = '"firstPartySources"';
   if (!isObject(value) || Object.keys(value).length === 0) {fail(where, 'must be a non-empty {repo handle: source id} object');}
@@ -138,13 +156,16 @@ export function parseRuntimeImageSources(value) {
   const where = '"runtimeImageSources"';
   exactObject(value, where, ['supplementalSources', 'crossRepoBuildInputs', 'buildStepContextDirectories']);
   const supplementalSources = list(value.supplementalSources, `${where}.supplementalSources`, (item, at) => {
-    exactObject(item, at, ['kind', 'id', 'repo', 'path', 'sourceManifestPath']);
+    exactObject(item, at, ['kind', 'id', 'repo', 'path', 'sourceManifestPath'], ['launchedBy']);
     return {
       kind: subjectKind(item.kind, `${at}.kind`),
       id: text(item.id, `${at}.id`),
       repo: repoHandle(item.repo, `${at}.repo`),
       path: text(item.path, `${at}.path`),
       sourceManifestPath: text(item.sourceManifestPath, `${at}.sourceManifestPath`),
+      ...(Object.hasOwn(item, 'launchedBy')
+        ? { launchedBy: supplementalLauncher(item.launchedBy, `${at}.launchedBy`) }
+        : {}),
     };
   });
   uniqueBy(supplementalSources, `${where}.supplementalSources`, (item) => `${item.kind}/${item.id}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:6ceee7eaad77b410aeb26998f61349944a56481549d146a3bc42a7a325ab3890"
+    "sourceDigest": "sha256:7df2765700a493e798389fee5d75e5a405b33634922715a3d6bf56990bf15cd4"
   }
 }