@xemahq/xema 0.45.1 → 0.46.0

package/edition/resolve-distribution.mjs

@@ -83,6 +83,7 @@ import { walkDeclaredSources } from './external-source-walk.mjs';
 import {
   biomeTierOrder,
   assertDeclaredDatabasesUnowned,
+  buildAudienceNamespaceOwners,
   buildCapabilityDomainOwners,
   compareIndexEntries,
   loadKernelBiomeContracts,
@@ -97,7 +98,10 @@ import {
 import {
   assertInstalledOperationCeilingAdmitted,
   assertOperationGrantsAdmitted,
+  assertExactAudiencesAdmitted,
   assertOrganizationSweepsAdmitted,
+  assertEventSubscriptionsAdmitted,
+  assertOrgContextRelaysAdmitted,
   assertStoreWorkloadCeilingAdmitted,
 } from './operation-grant-admission.mjs';
 import { PUBLISHED_PIN_SOURCE, pinnedSource } from './pin-source.mjs';
@@ -310,6 +314,7 @@ export function composeManifest(manifest, pinSource = PUBLISHED_PIN_SOURCE) {
     // reduces the declarations.
     declaredVisibilities: manifest.visibility === undefined ? [] : [manifest.visibility],
     storeWorkloadCeiling: manifest.storeWorkloadCeiling,
+    storeEventCeiling: manifest.storeEventCeiling,
     declaredSourceNames: new Set(sources.map((source) => source.name)),
     declaredSources: sources.map((source) => pinnedSource(source, pinSource)),
     owner: manifest.owner,
@@ -1163,6 +1168,7 @@ export function resolveDistributionFromInputs(
     trustCeiling,
     declaredVisibilities,
     storeWorkloadCeiling,
+    storeEventCeiling,
     owner,
     leaf,
     // Absent on a selector-model composition — including every `composed` a
@@ -2058,12 +2064,29 @@ export function resolveDistributionFromInputs(
       Object.keys(e.installedOperationRequests).length > 0
         ? { installedOperationRequests: e.installedOperationRequests }
         : {}),
+      // The workload components that relay an organization context, forwarded
+      // verbatim; the lock admits them (`admitOrgContextRelays`).
+      ...(e.orgContextRelayers !== undefined && e.orgContextRelayers.length > 0
+        ? { orgContextRelayers: e.orgContextRelayers }
+        : {}),
+      // The event subscription clauses each workload component declares,
+      // forwarded verbatim; the lock admits them (`admitEventSubscriptions`).
+      ...(e.eventSubscriptionRequirements !== undefined &&
+      Object.keys(e.eventSubscriptionRequirements).length > 0
+        ? { eventSubscriptionRequirements: e.eventSubscriptionRequirements }
+        : {}),
       // The organization sweeps each workload component may hold, forwarded
       // verbatim; the seal admits them (`admitOrganizationSweeps`).
       ...(e.organizationSweepRequirements !== undefined &&
       Object.keys(e.organizationSweepRequirements).length > 0
         ? { organizationSweepRequirements: e.organizationSweepRequirements }
         : {}),
+      // The exact audiences each workload component requires, forwarded
+      // verbatim; the seal admits them (`admitExactAudiences`).
+      ...(e.audienceRequirements !== undefined &&
+      Object.keys(e.audienceRequirements).length > 0
+        ? { audienceRequirements: e.audienceRequirements }
+        : {}),
       // --- Catalog projection (consumed by biome-host's DistributionCatalogSource) ---
       // Forwarded verbatim from the index so the lock is the SELF-CONTAINED
       // single source of truth for the biome catalog: biome-host builds the
@@ -2140,6 +2163,12 @@ export function resolveDistributionFromInputs(
         ...(source.ownsCapabilityDomains === undefined
           ? {}
           : { ownsCapabilityDomains: source.ownsCapabilityDomains }),
+        // The service's own requirement and ownership declarations, likewise
+        // verbatim from the index row: `admitOperationGrants` and
+        // `admitExactAudiences` read them from the lock.
+        ...(source.requiresOperations === undefined ? {} : { requiresOperations: source.requiresOperations }),
+        ...(source.requiresAudiences === undefined ? {} : { requiresAudiences: source.requiresAudiences }),
+        ...(source.ownsAudienceNamespaces === undefined ? {} : { ownsAudienceNamespaces: source.ownsAudienceNamespaces }),
         source,
       };
     })
@@ -2157,6 +2186,7 @@ export function resolveDistributionFromInputs(
   // owning biome from the store and then bind its refs to a URL they control.
   // See `buildCapabilityDomainOwners`. Throws on a duplicate claim.
   const capabilityDomainOwners = buildCapabilityDomainOwners(index);
+  const audienceNamespaceOwners = buildAudienceNamespaceOwners(index);
 
   // inputHash: deterministic over the index SUBSET that fed the lock + the
   // reservation table + the leaf manifest, so drift in any input is detectable.
@@ -2164,8 +2194,11 @@ export function resolveDistributionFromInputs(
   const platform = serializeJson(platformServiceList);
   const owners = serializeJson(capabilityDomainOwners);
   const manifestImg = serializeJson(leaf);
+  // The audience-namespace owners are derived from the WHOLE index, so a claim change in an unselected
+  // biome is drift. Appended only when non-empty: an edition with none keeps the hash it always had.
+  const audienceOwners = audienceNamespaceOwners.length > 0 ? `\0${serializeJson(audienceNamespaceOwners)}` : '';
   const inputHash = sha256Hex(
-    `${subset}\0${platform}\0${owners}\0${manifestImg}`,
+    `${subset}\0${platform}\0${owners}\0${manifestImg}${audienceOwners}`,
   );
 
   const lock = {
@@ -2181,6 +2214,9 @@ export function resolveDistributionFromInputs(
     resolvedAt,
     inputHash,
   };
+  // Appended after `inputHash` and only when a biome owns a namespace, like
+  // `owner` below: an unconditional key would change the bytes of every lock.
+  if (audienceNamespaceOwners.length > 0) {lock.audienceNamespaceOwners = audienceNamespaceOwners;}
 
   // Owner and visibility are written ONLY when something declared them, and
   // they are appended AFTER `inputHash` rather than woven into the literal
@@ -2216,6 +2252,9 @@ export function resolveDistributionFromInputs(
   // The edition's store-workload ceiling — written ONLY when the edition
   // declares one (the kernel refuses an empty list), carried unchanged.
   if (storeWorkloadCeiling !== undefined) {lock.storeWorkloadCeiling = storeWorkloadCeiling;}
+  // The edition's store event ceiling — written ONLY when the edition declares
+  // one (the kernel refuses an empty list), carried unchanged.
+  if (storeEventCeiling !== undefined) {lock.storeEventCeiling = storeEventCeiling;}
 
   // (7) Re-derive the ownership index through the KERNEL so the table this
   //     resolver emits is validated by the exact code every consumer will read
@@ -2235,6 +2274,9 @@ export function resolveDistributionFromInputs(
   //     never fails (the resolve and `edition check` both run through here).
   assertOperationGrantsAdmitted(schemas, parsed, { report: (line) => console.log(`[operations] ${line}`) });
   assertOrganizationSweepsAdmitted(schemas, parsed);
+  assertExactAudiencesAdmitted(schemas, parsed);
+  assertOrgContextRelaysAdmitted(schemas, parsed);
+  assertEventSubscriptionsAdmitted(schemas, parsed);
   assertInstalledOperationCeilingAdmitted(schemas, parsed);
   assertStoreWorkloadCeilingAdmitted(schemas, parsed);
   return validateImmutableDistributionLock(lock);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.45.1",
+  "version": "0.46.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -54,7 +54,7 @@
     "@xemahq/distribution-source-hash": "^0.2.2",
     "@xemahq/dsl": "^0.24.0",
     "@xemahq/identity-client": "^0.16.0",
-    "@xemahq/contracts": "^0.102.0",
+    "@xemahq/contracts": "^0.110.0",
     "@xemahq/kernel-state-runtime": "^0.8.0",
     "@xemahq/license-verifier": "^0.2.0",
     "@xemahq/service-registry-nest": "^0.12.2",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:04abcd3c081c6cd50d0133c543310f75801357071b18834ec4b15af587760461"
+    "sourceDigest": "sha256:184f63317ecd8173e0fd3122d80aca617832209e5221bd8d984ec9c5eff5ef6c"
   }
 }