@xemahq/xema 0.59.0 → 0.60.1

package/edition/collected-refusals.mjs

@@ -1,59 +0,0 @@
-// The one rule for a check that runs every independent assertion before it refuses.
-//
-// A REFUSAL is the answer "no" to the input: a lock the data does not admit, a commit that is not pinned, an image that is
-// not built. It is a `RefusalError` and is collected so one run names them all. Anything else is a DEFECT (a TypeError, a
-// missing file, a registry that answered 5xx, an unnamed Error): it is never collected, never reported as a refusal, and
-// propagates unchanged with its stack.
-//
-// Nothing refused returns; exactly one refusal is rethrown unchanged (its type and message are the contract of whoever
-// catches it); several become ONE error of the caller's class that joins their messages and keeps them as `.errors`.
-
-/** An error that is a REFUSAL of the input. Extend it for a named refusal; throw it directly for an unnamed one. */
-export class RefusalError extends Error {}
-
-/** The kernel's own bundle-signer refusals, named as the kernel names them (their classes load lazily from the built kernel). */
-export const KernelRefusalName = Object.freeze({
-  UnknownPolicy: 'LockedBundleSignerUnknownPolicyError',
-  AmbiguousPolicy: 'LockedBundleSignerAmbiguousPolicyError',
-  Mismatch: 'LockedBundleSignerMismatchError',
-});
-const KERNEL_REFUSAL_NAMES = new Set(Object.values(KernelRefusalName));
-
-/** Whether a thrown value is a refusal. Everything else (a TypeError, a failed system call, an unnamed Error) is a defect. */
-export const isRefusal = (error) => error instanceof RefusalError || (error instanceof Error && KERNEL_REFUSAL_NAMES.has(error.name));
-
-/** Run `fn`; a refusal is pushed on `errors` and `undefined` returned, anything else is rethrown unchanged. */
-export function captureRefusal(errors, fn, refusal) {
-  try {
-    return fn();
-  } catch (error) {
-    if (!refusal(error)) {throw error;}
-    errors.push(error);
-    return undefined;
-  }
-}
-
-/**
- * Run `fn` on every item, keeping each refusal, then refuse once all were seen: one refusal is rethrown unchanged, several
- * are one `CollectedError(errors)`. A defect stops the run at once and is rethrown as it was thrown.
- *
- * @param {Iterable<T>} items
- * @param {(item: T) => void} fn
- * @param {(error: unknown) => boolean} refusal which thrown values are refusals (`isRefusal`)
- * @param {new (errors: readonly Error[]) => Error} CollectedError the class that carries several
- */
-export function collectRefusals(items, fn, refusal, CollectedError) {
-  const errors = [];
-  for (const item of items) {captureRefusal(errors, () => fn(item), refusal);}
-  throwCollectedRefusals(errors, CollectedError);
-}
-
-/** Nothing collected returns, one is rethrown unchanged, several become one `CollectedError`. */
-export function throwCollectedRefusals(errors, CollectedError) {
-  if (errors.length === 0) {return;}
-  if (errors.length === 1) {throw errors[0];}
-  throw new CollectedError(errors);
-}
-
-/** The message of an error that stands for several: each refusal's message, separated by a blank line. */
-export const joinRefusalMessages = (errors) => errors.map((error) => error.message).join('\n\n');

package/edition/comment-blanker.mjs

@@ -1,75 +0,0 @@
-// Blank comments before asking a source file "what does this file DO?".
-//
-// A structural assertion that greps RAW source text cannot tell a CALL from a
-// MENTION, so it can be satisfied by — or tripped by — the scanned file's own
-// prose. That is not a hypothetical here: the call sites this repository
-// asserts on carry twenty-line docblocks explaining the very invariant being
-// asserted, so a raw `includes()` passes on a file whose call has been deleted
-// and whose comment survives. It is the mutation an ordinary mutation test
-// misses, because the usual mutation removes the code and its comment
-// together.
-//
-// SHARED BECAUSE THERE ARE NOW TWO CONSUMERS, and a second private copy is
-// what the fleet's own rule forbids: `seal-image-digests.test.mjs` (the
-// fleet-finality call) and `editions-root-platform-verification.test.mjs` (the
-// two `verifyDistributionPlatforms` call sites). Both previously would have
-// needed the same fourteen lines.
-//
-// DELIBERATELY NARROW: `/* */` blocks, and `//` only where it STARTS a line. A
-// trailing `//` is left alone because `'file://'` occurs in executable code in
-// these very files, and blanking it would delete a real line. A line that
-// BEGINS with `//` is unambiguously a comment.
-//
-// LINE COUNT IS PRESERVED — every blanked character becomes a space rather
-// than being dropped — so a caller may still report a line number derived from
-// a match without it silently shifting.
-//
-// It is NOT a parser and must not grow into one: a `//` inside a string
-// literal at the start of a line would be blanked wrongly. No such line exists
-// in either consumer, and each consumer's two-sided control is what proves the
-// blanker discriminated on ITS file rather than trusting this note.
-export function blankComments(source) {
-  return source
-    .replace(/\/\*[\s\S]*?\*\//gu, (match) => match.replace(/[^\n]/gu, ' '))
-    .replace(/^[ \t]*\/\/.*$/gmu, (match) => match.replace(/[^\n]/gu, ' '));
-}
-
-// ── AND THE TRAILING `//`, FOR THE ONE CALLER THAT CANNOT LEAVE IT ──────────
-//
-// `blankComments` above deliberately leaves a trailing `//` alone, and the
-// reason it gives is exact: `'file://'` occurs in executable code in its two
-// consumers, and blanking from there would delete a real line.
-//
-// `platform-lock-readability.mjs` asks a question those two do not — "does
-// this repository CALL the lock parser?" — over source it did not write, in
-// seven other repositories. There, prose naming the parser is the NORM rather
-// than the exception, and it is not hypothetical: measured 2026-09-27 at the
-// committed pins, `submodules/xema-host-web`'s `src/lib/nav-registry.ts:1135`
-// and `repos/xema-cultivars`'s `decision-api.client.ts:53` each name
-// `distribution.lock.json` in a comment and neither parses one.
-//
-// So this variant blanks a `//` to end of line UNLESS it is immediately
-// preceded by `:`. That single guard is what keeps `'file://'`,
-// `'https://…'` and every other scheme intact, which is the whole objection
-// the narrow version was written around.
-//
-// THE FAILURE DIRECTION IS THE POINT, and it decides why the guard is this
-// shape rather than a smarter one. Under-blanking makes a MENTION read as a
-// call — the caller then grades a repository it need not, which is merely
-// over-strict. OVER-blanking makes a CALL disappear — the caller then skips a
-// real reader, which is the 2026-09-17 incident itself. A real call cannot
-// follow a `//` on a line that is not a comment except inside a string,
-// template or regex, and none of those is a call; so the only way this hides
-// one is a call interpolated after a literal `//` inside a template on the
-// same line. Its caller reports RAW-vs-EXECUTABLE file counts for exactly that
-// reason: an over-blank shows up as a difference a human can see, rather than
-// as a silently smaller corpus.
-//
-// It is NOT a parser, for the same reason its sibling is not, and the guard
-// above is the whole of its cleverness.
-export function blankAllComments(source) {
-  return blankComments(source).replace(
-    /(^|[^:])\/\/.*$/gmu,
-    (match, before) => before + ' '.repeat(match.length - before.length),
-  );
-}

package/edition/connector-source-authority.mjs

@@ -1,60 +0,0 @@
-import { editionWorkspaceConfig } from './edition-config.mjs';
-
-// The connector repository, its production connector biomes and the ids that are
-// deliberately not production are the data root's (`connectorSources` in
-// edition-workspace.json); this module is the rule over them.
-
-// A data root with no connector repository declares no `connectorSources`:
-// there is then nothing to exclude and nothing to vendor, which is a stated
-// absence of the thing, not a skipped check. `undefined` below means exactly that.
-const connectorSources = () => editionWorkspaceConfig().connectorSources;
-
-/** The production connector biomes: id, repo, repo-relative path and aggregate path. */
-export const productionConnectorSourceBindings = () => {
-  const sources = connectorSources();
-  if (sources === undefined) {return [];}
-  const { repository, bindings } = sources;
-  return bindings.map(({ id, path }) =>
-    Object.freeze({ id, repo: repository, repoPath: path, path: `${repository}/${path}` }),
-  );
-};
-
-/** The cross-repo build inputs that vendor each production connector into the consuming image. */
-export const connectorCrossRepoBuildInputs = () => {
-  const sources = connectorSources();
-  if (sources === undefined) {return [];}
-  const { buildInput } = sources;
-  return productionConnectorSourceBindings().map(({ id, repo, repoPath }) => ({
-    consumerRepo: buildInput.consumerRepo,
-    consumerService: buildInput.consumerService,
-    sourceRepo: repo,
-    sourcePath: repoPath,
-    destinationPath: `${buildInput.destinationRoot}/${id}`,
-  }));
-};
-
-/**
- * Decide whether a discovered manifest is an authoritative production source.
- *
- * The old community connector trees are intentionally ignored, not used as a
- * fallback. The connector repository's `examples/` tree is also never a
- * production source, even when an example carries a valid biome manifest.
- */
-export function isAuthoritativeProductionBiomeSource({ id, repo, path }) {
-  const sources = connectorSources();
-  if (sources === undefined) {return true;}
-  const { nonProductionIds, repository } = sources;
-  if (nonProductionIds.includes(id)) {return false;}
-
-  const binding = productionConnectorSourceBindings().find((candidate) => candidate.id === id);
-  if (binding) {return repo === binding.repo && path === binding.path;}
-
-  if (repo !== repository) {return true;}
-  if (path.startsWith(`${repository}/examples/`)) {return false;}
-  if (path.startsWith(`${repository}/connectors/`)) {
-    throw new Error(
-      `${path}/xema-biome.json declares unrecognized production connector id "${String(id)}"`,
-    );
-  }
-  return false;
-}

package/edition/contract-authority.mjs

@@ -1,122 +0,0 @@
-#!/usr/bin/env node
-// `xema edition contract-authority`: the full kernel contract authority of the `@xemahq/contracts` this CLI
-// ships, as canonical JSON on stdout — the `--contract-authority <file>` a third-party publisher's public-input
-// run passes (Third-party sources, README).
-//
-// usage: xema edition contract-authority
-// stdout: the KernelContractAuthority object, canonical JSON, one line.
-//
-// The kernel's release derives the object at publish time, `sourceCommit` = the commit as the kernel release states it (carried, never proven here: only contentDigest and
-// sourcePaths are proven against the package), and ships
-// it as `dist/edition-protocol/contract-authority.json` (exported by name). This verb resolves that export from
-// this CLI's own resolution, parses it with the kernel's KernelContractAuthoritySchema, refuses it unless its
-// contentDigest is the bundled kernel's edition protocol digest, and then proves the bundled package IS that
-// authority (assertKernelPackageIsCatalogueAuthority). It fails closed: a kernel with no file (a dev build, or a
-// release older than the file) is refused by name, with no fallback to any derived or remembered authority.
-
-import { readFileSync, realpathSync } from 'node:fs';
-import { createRequire } from 'node:module';
-import { sep } from 'node:path';
-
-import { KernelContractAuthoritySchema } from '@xemahq/contracts/distribution';
-
-import { canonicalJson } from './canonical-evidence-json.mjs';
-import { readKernelEditionProtocol } from './edition-protocol.mjs';
-import { configureEditionWorkspaceFromArgv, isEntryModule, stateKernelPackageDir } from './edition-workspace.mjs';
-import { KERNEL_PACKAGE_NAME, assertKernelPackageIsCatalogueAuthority, shippedKernelPackageDir } from './kernel-package.mjs';
-import { loadKernelDistributionSchemas } from './lib.mjs';
-
-export const CONTRACT_AUTHORITY_EXPORT = '@xemahq/contracts/edition-protocol/contract-authority.json';
-export const CONTRACT_AUTHORITY_USAGE = 'usage: xema edition contract-authority';
-
-export class BundledContractAuthorityError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = 'BundledContractAuthorityError';
-  }
-}
-
-const ownRequire = createRequire(import.meta.url);
-
-/**
- * The ONE refusal of a kernel that carries no contract-authority.json, for the verb and for every edition test
- * fixture that reads the authority through this module: the file is emitted only at release, so a dev build (an
- * aggregator-linked kernel) never carries one, by design.
- */
-function missingContractAuthority(kernelDir, detail) {
-  return new BundledContractAuthorityError(
-    `the ${KERNEL_PACKAGE_NAME} at ${kernelDir} carries no edition-protocol/contract-authority.json (${detail}): the file is emitted ` +
-      `only at release, so a dev build of the kernel never has one. The verb, and the edition evidence tests, need a published ` +
-      `${KERNEL_PACKAGE_NAME} (install a released @xemahq/xema, or run the tests against the published kernel the CLI's lockfile installs)`,
-  );
-}
-
-/** The bundled kernel's contract-authority.json, resolved by its package export from this CLI's own resolution. */
-export function resolveBundledContractAuthorityFile({ resolve = (specifier) => ownRequire.resolve(specifier), kernelDir = shippedKernelPackageDir() } = {}) {
-  try {
-    return resolve(CONTRACT_AUTHORITY_EXPORT);
-  } catch (error) {
-    if (error?.code !== 'MODULE_NOT_FOUND' && error?.code !== 'ERR_PACKAGE_PATH_NOT_EXPORTED') {throw error;}
-    throw missingContractAuthority(kernelDir, error.code);
-  }
-}
-
-/**
- * Read, parse and prove the contract authority at `file` against the kernel package at `kernelDir`: the file must
- * be inside that package, parse as KernelContractAuthoritySchema, carry the package's edition protocol digest, and
- * the package must be that authority. Returns the parsed authority.
- */
-export async function readBundledContractAuthority({
-  kernelDir = shippedKernelPackageDir(),
-  file = resolveBundledContractAuthorityFile({ kernelDir }),
-  loadSchemas = loadKernelDistributionSchemas,
-} = {}) {
-  let real;
-  try {
-    real = realpathSync(file);
-  } catch (error) {
-    if (error?.code === 'ENOENT') {throw missingContractAuthority(kernelDir, `${file} does not exist`);}
-    throw new BundledContractAuthorityError(`${file} cannot be read: ${error.message}`);
-  }
-  if (!real.startsWith(`${realpathSync(kernelDir)}${sep}`)) {
-    throw new BundledContractAuthorityError(`${real} is not inside the kernel package this CLI ships (${kernelDir})`);
-  }
-  let raw;
-  try {
-    raw = JSON.parse(readFileSync(real, 'utf8'));
-  } catch (error) {
-    throw new BundledContractAuthorityError(`${real} is not JSON: ${error.message}`);
-  }
-  const parsed = KernelContractAuthoritySchema.safeParse(raw);
-  if (!parsed.success) {
-    const issues = parsed.error.issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`).join('; ');
-    throw new BundledContractAuthorityError(`${real} is not a kernel contract authority: ${issues}`);
-  }
-  const authority = parsed.data;
-  const bundledDigest = readKernelEditionProtocol(kernelDir).contentDigest;
-  if (authority.contentDigest !== bundledDigest) {
-    throw new BundledContractAuthorityError(
-      `${real} states contentDigest ${authority.contentDigest}, but the bundled kernel's edition protocol digest is ${bundledDigest}`,
-    );
-  }
-  await assertKernelPackageIsCatalogueAuthority({ catalogue: { contractAuthority: authority }, kernelPackageDir: kernelDir, loadSchemas });
-  return authority;
-}
-
-async function main() {
-  const rest = configureEditionWorkspaceFromArgv(process.argv.slice(2), [], { refuseOthers: true });
-  if (rest.length > 0) {throw new Error(CONTRACT_AUTHORITY_USAGE);}
-  const kernelDir = shippedKernelPackageDir();
-  stateKernelPackageDir(kernelDir);
-  const authority = await readBundledContractAuthority({ kernelDir });
-  process.stdout.write(`${canonicalJson(authority)}\n`);
-}
-
-if (isEntryModule(import.meta.url)) {
-  try {
-    await main();
-  } catch (error) {
-    console.error(`[contract-authority] ${error.message}`);
-    process.exitCode = 1;
-  }
-}

package/edition/cosign-certificate-constraints.mjs

@@ -1,50 +0,0 @@
-// cosign-certificate-constraints — the certificate claims every keyless verification here pins.
-//
-// One signer shape, `{certificateIdentity, oidcIssuer, githubWorkflow: {repository, ref}}`, plus the exact
-// workflow commit the certificate must carry. Every `cosign verify*` of this CLI takes its constraints
-// from here, so no call site can leave one of the five out.
-
-const WORKFLOW_SHA = /^[0-9a-f]{40}$/;
-
-function requireText(value, what) {
-  if (typeof value !== 'string' || value.length === 0) {
-    throw new Error(`certificate constraints: ${what} must be a non-empty string; got ${JSON.stringify(value)}`);
-  }
-  return value;
-}
-
-/**
- * The flags that pin a signer's exact identity, issuer, workflow repository and ref. They carry no workflow commit: use
- * {@link certificateConstraintArgs} unless the signing workflow's own commit is, by design, not known to the verifier (a
- * `workflow_run` follower runs the default branch's copy), and then bind the built commit by a signed annotation.
- *
- * @param {{ certificateIdentity: string, oidcIssuer: string, githubWorkflow: { repository: string, ref: string } }} signer
- * @returns {string[]}
- */
-export function certificateIdentityArgs(signer) {
-  if (signer === null || typeof signer !== 'object') {
-    throw new Error('certificate constraints: the signer must be an object');
-  }
-  return [
-    '--certificate-identity',
-    requireText(signer.certificateIdentity, 'certificateIdentity'),
-    '--certificate-oidc-issuer',
-    requireText(signer.oidcIssuer, 'oidcIssuer'),
-    '--certificate-github-workflow-repository',
-    requireText(signer.githubWorkflow?.repository, 'githubWorkflow.repository'),
-    '--certificate-github-workflow-ref',
-    requireText(signer.githubWorkflow?.ref, 'githubWorkflow.ref'),
-  ];
-}
-
-/**
- * @param {{ certificateIdentity: string, oidcIssuer: string, githubWorkflow: { repository: string, ref: string } }} signer
- * @param {string} workflowSha the 40-hex commit the signing workflow ran at
- * @returns {string[]} the cosign flags that pin identity, issuer, workflow repository, ref and sha
- */
-export function certificateConstraintArgs(signer, workflowSha) {
-  if (typeof workflowSha !== 'string' || !WORKFLOW_SHA.test(workflowSha)) {
-    throw new Error(`certificate constraints: the workflow sha must be 40 lowercase hex characters; got ${JSON.stringify(workflowSha)}`);
-  }
-  return [...certificateIdentityArgs(signer), '--certificate-github-workflow-sha', workflowSha];
-}

package/edition/cross-repo-build-inputs.mjs

@@ -1,158 +0,0 @@
-/**
- * The ONE reader of a consumer repository's cross-repo build-input record, and
- * the resolver built on it. The source checkout (which commits to fetch) and the
- * image resolve (which bytes to hash) both read the record here, at the
- * consumer's pin, so the plan and the resolve cannot diverge.
- */
-import { sourcePath } from './edition-workspace.mjs';
-import { readGitJsonAtCommit } from './git-json.mjs';
-
-/**
- * The producing repository's OWN committed record of what it vendored.
- *
- * `vendor-cross-repo-inputs.mjs` reads exactly this file, at the commit being
- * built, to emit the `--vendored <dest>=<repoDir>@<commit>:<src>` arguments it
- * hands `compute-image-tag.mjs`. It is therefore the ONLY source of the vendored
- * commit that can agree with the tag CI pushes.
- */
-export const CROSS_REPO_BUILD_INPUTS_PATH =
-  'tooling/release/cross-repo-build-inputs.json';
-
-/** Identity of one vendored input — the tuple that survives a pin bump. */
-export function crossRepoInputKey(input) {
-  return [input.sourceRepo, input.sourcePath, input.destinationPath].join('\u0000');
-}
-
-/** The `[sourceRepo, sourcePath, destinationPath]` a `crossRepoInputKey` frames. */
-export function splitCrossRepoInputKey(key) {
-  return key.split('\u0000');
-}
-
-/**
- * The consumer's record of what it vendored, read at ONE commit of the consumer
- * (never the work tree): a map from `crossRepoInputKey` to the vendored
- * `sourceCommit`. Unreadable is an error, not an empty record.
- */
-export function readCrossRepoBuildInputsRecord({
-  consumerRepo,
-  consumerRepoDir,
-  consumerCommit,
-}) {
-  let record;
-  try {
-    record = readGitJsonAtCommit(
-      consumerRepoDir,
-      CROSS_REPO_BUILD_INPUTS_PATH,
-      consumerCommit,
-    );
-  } catch (cause) {
-    throw new Error(
-      `"${consumerRepo}" declares cross-repo build inputs but ` +
-        `${CROSS_REPO_BUILD_INPUTS_PATH} is unreadable at ${consumerCommit}. ` +
-        `That file is what its CI feeds to compute-image-tag.mjs; without it ` +
-        `no coordinate this tooling derives can match the tag CI pushes.`,
-      { cause },
-    );
-  }
-  const mirrored = new Map();
-  for (const input of record?.inputs ?? []) {
-    mirrored.set(crossRepoInputKey(input), input.sourceCommit);
-  }
-  return mirrored;
-}
-
-/**
- * Resolve the vendored inputs of ONE consumer repository at ONE commit.
- *
- * WHY THE COMMIT COMES FROM THE CONSUMER, NOT FROM THE INDEX
- *
- * The index's `crossRepoBuildInputs` carry no `sourceCommit`; they name only
- * WHICH content is vendored. Both this tooling and the parity gate used to
- * supply the missing commit from `runtimeSourceIndex.repositoryPins`, and CI
- * supplies it from the file above — so the two disagreed the moment a consumer
- * repository's mirror lagged the index by one pin, which is its NORMAL resting
- * state: the mirror is generated FROM the index and committed separately, so it
- * is stale by construction between the index moving and the consumer
- * regenerating.
- *
- * That is not a cosmetic disagreement. `crossRepo.sourceCommit` is framed into
- * the component KEY of the image-input hash, so a pin that differs by one
- * commit yields a different `contentHash` FOR BYTE-IDENTICAL VENDORED CONTENT —
- * a coordinate no CI run has ever pushed or ever will. Measured 2026-09-07 on
- * `origin/main`: five of the sixty-eight coordinates in the eight editions
- * (`backlog-api`, `channel-gateway-api`, `control-plane-api`,
- * `document-render-api` from repos/xema-community, and `biome-host-api` from
- * repos/xema-base) 404'd in the registry for exactly this reason, while the tags
- * their producing CI DID push were present and served on both platforms.
- *
- * Reading the index pin also imposed a requirement that cannot be satisfied.
- * `repos/xema-base` vendors from `repos/xema-community` and vice versa, so
- * "every mirror agrees with the index" is a mutual fixed point over a 2-cycle,
- * and bumping either side invalidates the other. No such pair exists: scanning
- * eighty commits of each on `origin/main` found ZERO mutually coherent pairs.
- * Reading the consumer's own record removes the fixed point entirely — an
- * image's identity depends only on the repository that builds it.
- *
- * It stays edition-INDEPENDENT, which is the property the previous design was
- * protecting: the record is a property of the consumer's COMMIT, not of any
- * edition's resolved commit map, so every edition shipping a subject still
- * derives the same `contentHash` for it.
- */
-export function resolveCrossRepoVendoredInputs({
-  indexInputs,
-  consumerRepo,
-  consumerRepoDir,
-  consumerCommit,
-}) {
-  const declared = indexInputs.filter(
-    (input) => input.consumerRepo === consumerRepo,
-  );
-  if (declared.length === 0) {return [];}
-  if (!consumerCommit) {
-    throw new Error(
-      `cross-repo build inputs are declared for "${consumerRepo}", but this ` +
-        `distribution resolves no commit for it — the vendored content cannot ` +
-        `be pinned, so the image cannot be addressed`,
-    );
-  }
-  const mirrored = readCrossRepoBuildInputsRecord({
-    consumerRepo,
-    consumerRepoDir,
-    consumerCommit,
-  });
-  // Set equality in BOTH directions. A commit that LAGS is normal and is now
-  // honoured; a differing input SET is a genuine declaration disagreement, and
-  // it moves the hash just as surely — so it must fail rather than resolve to a
-  // coordinate built from a different closure.
-  const declaredKeys = new Set(declared.map((input) => crossRepoInputKey(input)));
-  const resolved = declared.map((input) => {
-    const sourceCommit = mirrored.get(crossRepoInputKey(input));
-    if (!sourceCommit) {
-      throw new Error(
-        `the runtime image source index declares a cross-repo build input for ` +
-          `"${consumerRepo}" vendoring "${input.sourceRepo}:${input.sourcePath}" ` +
-          `to "${input.destinationPath}", but ${CROSS_REPO_BUILD_INPUTS_PATH} at ` +
-          `${consumerCommit} declares no such input — its CI does not vendor it, ` +
-          `so the coordinate this tooling would derive is one nothing builds`,
-      );
-    }
-    return {
-      consumerService: input.consumerService ?? null,
-      destinationPath: input.destinationPath,
-      sourceRepoDir: sourcePath(input.sourceRepo),
-      sourcePath: input.sourcePath,
-      sourceCommit,
-    };
-  });
-  for (const key of mirrored.keys()) {
-    if (declaredKeys.has(key)) {continue;}
-    const [sourceRepo, sourcePath, destinationPath] = splitCrossRepoInputKey(key);
-    throw new Error(
-      `${CROSS_REPO_BUILD_INPUTS_PATH} at ${consumerCommit} vendors ` +
-        `"${sourceRepo}:${sourcePath}" to "${destinationPath}" for ` +
-        `"${consumerRepo}", which the runtime image source index does not ` +
-        `declare — its CI bakes content this tooling does not hash`,
-    );
-  }
-  return resolved;
-}