@xemahq/xema 0.59.1 → 0.60.1

package/edition/biome-content.mjs

@@ -1,327 +0,0 @@
-// biome-content — the content address of every biome a distribution lock ships.
-//
-// A sealed (v5) lock carries, per biome, `biomeContentHash`: the kernel's
-// `computeBiomeContentHash` over THREE facts the lock itself cannot vouch for:
-//
-//   * the biome's source manifest hash, recomputed from the manifest AT the
-//     pinned commit (`computeBiomeSourceManifestHash`);
-//   * the git tree object id of the biome directory at that commit
-//     (`git rev-parse <commit>:<path>`);
-//   * the sorted image subject digests of the images the biome owns, from the
-//     SEALED images lock.
-//
-// The kernel cannot recompute any of them ("sealed" is only a field), so the
-// producer of the seal AND every verifier recompute from the sources and REFUSE
-// a mismatch, naming the biome. Nothing here assembles a v5 lock: the unsealed
-// document goes to the kernel's `sealDistributionLock` together with the hashes
-// computed below.
-
-import { execFileSync } from 'node:child_process';
-import { relative, sep } from 'node:path';
-
-import { CatalogueLockField, catalogueLockFieldOf } from './catalogue-lock-field.mjs';
-import { assertCustomerLockWithinCatalogueCeiling } from './catalogue.mjs';
-import { readGitJsonAtCommit } from './lib.mjs';
-import { assertLockBundleSigners } from './locked-bundle-signer.mjs';
-import { admitDistributionLock } from './operation-grant-admission.mjs';
-
-/** A biome whose recomputed content hash is not the lock's, or whose inputs cannot be recomputed. */
-export class BiomeContentHashError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = 'BiomeContentHashError';
-  }
-}
-
-/**
- * The commit a biome's content is pinned at. A biome that ships images (or a web
- * bundle) is pinned where its images lock row is; a declared source at its
- * locked commit; a content-only first-party biome at the vendored-source pin
- * (`vendoredCommit(repo)`), the axis its manifest hash was read on.
- *
- * `contentCommits` (repo -> commit) is a CANDIDATE edition's recorded override
- * (candidate-edition.mjs): every first-party biome of a named repo has its content
- * at the recorded commit, not at its carried images' `sourceCommit`. Absent, the
- * rule above is the whole rule. Nothing reads it but a caller that holds the record.
- */
-function pinnedCommit({ biome, imageLock, ownerKinds, vendoredCommit, contentCommits }) {
-  if (biome.source !== undefined) {return biome.source.commit;}
-  const recorded = contentCommits?.get(biome.repo);
-  if (recorded !== undefined) {return recorded;}
-  // Only subjects from the biome's OWN repo pin its content commit; a runtime component it
-  // launches from another repo is owned (and digest-bound) but is not where the biome lives.
-  const owned = imageLock.subjects.filter(
-    (subject) =>
-      subject.repo === biome.repo &&
-      subject.owners.some((owner) => owner.kind === ownerKinds.Biome && owner.biomeId === biome.id),
-  );
-  const commits = new Set(owned.map((subject) => subject.sourceCommit));
-  if (commits.size > 1) {
-    throw new BiomeContentHashError(`biome "${biome.id}": its images in its own repo "${biome.repo}" pin ${commits.size} different commits`);
-  }
-  if (commits.size === 1) {return [...commits][0];}
-  const web = imageLock.webBiomes.find((row) => row.biomeId === biome.id);
-  if (web !== undefined) {return web.sourceCommit;}
-  return vendoredCommit(biome.repo);
-}
-
-function treeId({ parseGitTreeId, repoDirectory, commit, repoRelativePath }) {
-  const object = repoRelativePath === '.' ? `${commit}^{tree}` : `${commit}:${repoRelativePath}`;
-  const out = execFileSync('git', ['-C', repoDirectory, 'rev-parse', '--verify', object], {
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'pipe'],
-  });
-  return parseGitTreeId(out.trim());
-}
-
-/** The sorted `sha256:` subject digests of the images `biome` owns; an unsealed row is refused. */
-function imageSubjectDigests({ biome, imageLock, ownerKinds, parseOciDigest }) {
-  return imageLock.subjects
-    .filter((subject) => subject.owners.some((owner) => owner.kind === ownerKinds.Biome && owner.biomeId === biome.id))
-    .map((subject) => {
-      if (subject.imageDigest === undefined) {
-        throw new BiomeContentHashError(
-          `biome "${biome.id}": image ${subject.kind}:${subject.id} is not sealed (no imageDigest); seal the images lock first`,
-        );
-      }
-      return parseOciDigest(subject.imageDigest);
-    });
-}
-
-function ownedSubjects(imageLock, ownerKinds, biomeId) {
-  return imageLock.subjects.filter((subject) =>
-    subject.owners.some((owner) => owner.kind === ownerKinds.Biome && owner.biomeId === biomeId),
-  );
-}
-
-/** The biome's `xema-biome.json` AT the commit its content is pinned at, read from the source checkout `locate` names. */
-function readPinnedManifest({ biome, commit, locate }) {
-  const { dir: repoDirectory, base } = locate(biome.repo);
-  const repoRelativePath = relative(repoDirectory, `${base}${sep}${biome.path}`).split(sep).join('/') || '.';
-  const manifestPath = repoRelativePath === '.' ? 'xema-biome.json' : `${repoRelativePath}/xema-biome.json`;
-  return { repoDirectory, repoRelativePath, manifestPath, manifest: readGitJsonAtCommit(repoDirectory, manifestPath, commit) };
-}
-
-/**
- * The manifest at the pinned commit, held to the lock: its hash, by the kernel's
- * `computeBiomeSourceManifestHash`, is the lock's `sourceManifestHash`, or the biome is
- * refused. The ONE comparison, for the seal, the verify step and `biome-manifests`.
- */
-async function readLockedManifest({ schemas, biome, commit, locate }) {
-  const pinned = readPinnedManifest({ biome, commit, locate });
-  const sourceManifestHash = await schemas.computeBiomeSourceManifestHash(pinned.manifest);
-  if (sourceManifestHash !== biome.sourceManifestHash) {
-    throw new BiomeContentHashError(
-      `biome "${biome.id}": the manifest at ${biome.repo}@${commit}:${pinned.manifestPath} hashes to ${sourceManifestHash}, ` +
-        `not the lock's sourceManifestHash ${biome.sourceManifestHash}`,
-    );
-  }
-  return { ...pinned, sourceManifestHash };
-}
-
-/**
- * The pinned `xema-biome.json` of every biome of a lock, read exactly as the seal
- * and the verify step read it, sorted by biome id: `[{ id, repo, sourceCommit, manifest }]`.
- * A manifest that cannot be read at its pinned commit, or that is not the manifest
- * the lock names (`sourceManifestHash`), is refused, naming the biome.
- */
-export async function pinnedBiomeManifests({ schemas, lock, imageLock, locate, vendoredCommit, contentCommits }) {
-  const ownerKinds = schemas.RuntimeImageOwnerKind;
-  const manifests = [];
-  for (const biome of [...lock.biomes].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))) {
-    const sourceCommit = pinnedCommit({ biome, imageLock, ownerKinds, vendoredCommit, contentCommits });
-    let manifest;
-    try {
-      ({ manifest } = await readLockedManifest({ schemas, biome, commit: sourceCommit, locate }));
-    } catch (error) {
-      if (error instanceof BiomeContentHashError) {throw error;}
-      throw new BiomeContentHashError(`biome "${biome.id}": its manifest at ${biome.repo}@${sourceCommit} cannot be read: ${error.message}`);
-    }
-    manifests.push({ id: biome.id, repo: biome.repo, sourceCommit, manifest });
-  }
-  return manifests;
-}
-
-/** The three facts of a biome recomputed from a checkout of its source at the pinned commit. */
-async function sourceFacts({ schemas, biome, imageLock, locate, vendoredCommit, contentCommits }) {
-  const ownerKinds = schemas.RuntimeImageOwnerKind;
-  const commit = pinnedCommit({ biome, imageLock, ownerKinds, vendoredCommit, contentCommits });
-  const { repoDirectory, repoRelativePath, sourceManifestHash } = await readLockedManifest({ schemas, biome, commit, locate });
-  return {
-    sourceManifestHash,
-    sourceTreeId: treeId({ parseGitTreeId: schemas.parseGitTreeId, repoDirectory, commit, repoRelativePath }),
-    imageSubjectDigests: imageSubjectDigests({ biome, imageLock, ownerKinds, parseOciDigest: schemas.parseOciDigest }),
-  };
-}
-
-const CATALOGUE_AUTHORITY_NOTE =
-  "the vendor biome's source tree id is an INPUT taken on the catalogue's authority; it is not re-derived " +
-  'from a checkout (the customer has none), so this is not a verification of the vendor source';
-
-/**
- * The three facts of a VENDOR biome in a customer edition. The customer holds no
- * checkout of the vendor source, so, on the catalogue's authority (and ONLY
- * there): the tree id is the catalogue's `sourceTreeIds[biome]`, and the
- * manifest hash is the catalogue row's. Everything the customer CAN check is
- * checked: the lock's manifest hash equals the row's, and the image digests the
- * customer's images lock carries for the biome equal the catalogue's. A biome
- * the catalogue does not carry, or carries without a tree id, is refused.
- */
-async function catalogueFacts({ schemas, biome, imageLock, catalogue }) {
-  const ownerKinds = schemas.RuntimeImageOwnerKind;
-  const row = catalogue.biomes.find((candidate) => candidate.id === biome.id);
-  if (row === undefined) {
-    throw new BiomeContentHashError(`vendor biome "${biome.id}" is absent from catalogue "${catalogue.offeringId}"; ${CATALOGUE_AUTHORITY_NOTE}`);
-  }
-  const treeIdText = catalogue.sourceTreeIds?.[biome.id];
-  if (treeIdText === undefined) {
-    throw new BiomeContentHashError(`catalogue "${catalogue.offeringId}" carries no source tree id for vendor biome "${biome.id}"; ${CATALOGUE_AUTHORITY_NOTE}`);
-  }
-  if (row.sourceManifestHash !== biome.sourceManifestHash) {
-    throw new BiomeContentHashError(
-      `vendor biome "${biome.id}": the lock's sourceManifestHash ${biome.sourceManifestHash} is not the catalogue row's ${row.sourceManifestHash}`,
-    );
-  }
-  const own = imageSubjectDigests({ biome, imageLock, ownerKinds, parseOciDigest: schemas.parseOciDigest });
-  const offered = ownedSubjects({ subjects: catalogue.images.subjects }, ownerKinds, biome.id)
-    .map((subject) => schemas.parseOciDigest(subject.imageDigest));
-  if (JSON.stringify([...own].sort()) !== JSON.stringify([...offered].sort())) {
-    throw new BiomeContentHashError(
-      `vendor biome "${biome.id}": its image digests in the images lock differ from the catalogue's (${[...own].sort().join(',')} vs ${[...offered].sort().join(',')})`,
-    );
-  }
-  return {
-    sourceManifestHash: schemas.parseBiomeSourceManifestHash(row.sourceManifestHash),
-    sourceTreeId: schemas.parseGitTreeId(treeIdText),
-    imageSubjectDigests: own,
-  };
-}
-
-/**
- * Customer mode: the lock must say which catalogue produced its hashes, and it must be
- * the catalogue supplied, in the same field: `catalogueDigest` (a published catalogue artifact)
- * or `catalogueContentDigest` (the catalogue bytes of a catalogue-free resolve), exactly one supplied
- * and the lock carrying that one only. A lock without it, with another digest, or naming the catalogue
- * in the other field, was not resolved against this catalogue, so its hashes cannot be checked on
- * this catalogue's authority.
- */
-function assertLockNamesCatalogue({ schemas, lock, catalogue, catalogueDigest, catalogueContentDigest, storePublisherAnchorKeys }) {
-  const { key, digest } = catalogueLockFieldOf({ catalogueDigest, catalogueContentDigest }, { what: `customer mode for catalogue "${catalogue.offeringId}"`, ErrorType: BiomeContentHashError });
-  const other = key === CatalogueLockField.Artifact ? CatalogueLockField.Content : CatalogueLockField.Artifact;
-  if (lock[other] !== undefined) {
-    throw new BiomeContentHashError(
-      `distribution "${lock.distributionId}": the lock carries ${other}, but the supplied catalogue is named by ${key} ${digest}`,
-    );
-  }
-  if (lock[key] === undefined) {
-    throw new BiomeContentHashError(
-      `distribution "${lock.distributionId}": the lock carries no ${key}, so it was not resolved against a catalogue; supplied catalogue ${digest}`,
-    );
-  }
-  if (lock[key] !== digest) {
-    throw new BiomeContentHashError(
-      `distribution "${lock.distributionId}": the lock was resolved against catalogue ${lock[key]}, not the supplied ${digest} (${key})`,
-    );
-  }
-  // The lock is within the catalogue's ceiling: the kernel's one check, its Store publishers against the definition's selection.
-  assertCustomerLockWithinCatalogueCeiling({ schemas, catalogue, lock, storePublisherAnchorKeys });
-}
-
-/**
- * Recompute every biome's `biomeContentHash`.
- *
- * @param {object} request
- * @param {object} request.schemas the kernel distribution schemas (`loadKernelDistributionSchemas`)
- * @param {object} request.lock the unsealed or sealed distribution lock
- * @param {object} request.imageLock the SEALED images lock
- * @param {(repo: string) => {dir: string, base: string}} request.locate repo handle -> checkout
- * @param {(repo: string) => string} request.vendoredCommit the vendored-source pin of a first-party repo
- * @param {object} [request.catalogue] customer mode: the digest-pinned catalogue vendor biomes are taken from
- * @param {string} [request.catalogueDigest] customer mode, a published catalogue: the digest of its artifact; the lock must carry the same one
- * @param {string} [request.catalogueContentDigest] customer mode, catalogue-free: the digest of the catalogue bytes; exclusive with catalogueDigest, the lock must carry the same one
- * @param {readonly string[]} [request.storePublisherAnchorKeys] customer mode: the definition's Store publisher selection (absent = none)
- * @param {Map<string, string>} [request.contentCommits] a candidate edition's recorded override: repo -> the commit its first-party biomes' content is read at
- * @returns {Promise<Map<string, string>>} biome id -> BiomeContentHash
- */
-export async function computeBiomeContentHashes({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, catalogueContentDigest, storePublisherAnchorKeys, sourceFactsById, contentCommits }) {
-  if (catalogue !== undefined) {assertLockNamesCatalogue({ schemas, lock, catalogue, catalogueDigest, catalogueContentDigest, storePublisherAnchorKeys });}
-  const hashes = new Map();
-  for (const biome of lock.biomes) {
-    const facts =
-      catalogue !== undefined && biome.source === undefined
-        ? await catalogueFacts({ schemas, biome, imageLock, catalogue })
-        : sourceFactsById === undefined
-          ? await sourceFacts({ schemas, biome, imageLock, locate, vendoredCommit, contentCommits })
-          : precomputedFacts(sourceFactsById, biome);
-    hashes.set(biome.id, await schemas.computeBiomeContentHash(facts));
-  }
-  return hashes;
-}
-
-/**
- * The source facts of every biome of `lock`, read ONCE: a caller that needs both
- * the content hashes and the tree ids (the develop resolve) passes the result to
- * `sealLock` and `biomeSourceTreeIds` as `sourceFactsById`, instead of each walking
- * every biome's checkout again.
- *
- * @returns {Promise<Map<string, object>>} biome id -> the three source facts
- */
-export async function readBiomeSourceFacts({ schemas, lock, imageLock, locate, vendoredCommit, contentCommits }) {
-  const facts = new Map();
-  for (const biome of lock.biomes) {
-    facts.set(biome.id, await sourceFacts({ schemas, biome, imageLock, locate, vendoredCommit, contentCommits }));
-  }
-  return facts;
-}
-
-function precomputedFacts(sourceFactsById, biome) {
-  const facts = sourceFactsById.get(biome.id);
-  if (facts === undefined) {
-    throw new BiomeContentHashError(`biome "${biome.id}": the precomputed source facts do not cover it`);
-  }
-  return facts;
-}
-
-/**
- * The git tree id of every biome of a VENDOR offering at its pinned commit, as
- * the catalogue publishes them: `{ [biomeId]: GitTreeId }`, sorted by id.
- * THIS is the writer's source of the catalogue's `sourceTreeIds` (callers:
- * release-catalogue.mjs `releaseCatalogue`, develop-edition-resolve.mjs).
- */
-export async function biomeSourceTreeIds({ schemas, lock, imageLock, locate, vendoredCommit, sourceFactsById }) {
-  const ids = {};
-  for (const biome of [...lock.biomes].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))) {
-    const facts = sourceFactsById === undefined
-      ? await sourceFacts({ schemas, biome, imageLock, locate, vendoredCommit })
-      : precomputedFacts(sourceFactsById, biome);
-    ids[biome.id] = facts.sourceTreeId;
-  }
-  return ids;
-}
-
-/** Seal: the unsealed lock + the recomputed hashes -> the kernel's `sealDistributionLock`. */
-export async function sealLock({ schemas, unsealed, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, catalogueContentDigest, storePublisherAnchorKeys, sourceFactsById, bundleSigners, contentCommits, gitSourcedBundle }) {
-  assertLockBundleSigners({ lock: unsealed, selection: bundleSigners, schemas, gitSourcedBundle });
-  const hashes = await computeBiomeContentHashes({ schemas, lock: unsealed, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, catalogueContentDigest, storePublisherAnchorKeys, sourceFactsById, contentCommits });
-  admitDistributionLock(schemas, unsealed);
-  return schemas.sealDistributionLock(unsealed, hashes);
-}
-
-/**
- * Verify: recompute every biome's hash and REFUSE a mismatch, naming the biome.
- * The lock's own field is never trusted; a missing or extra biome is a mismatch.
- */
-export async function verifyBiomeContentHashes({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, catalogueContentDigest, storePublisherAnchorKeys, bundleSigners, contentCommits, gitSourcedBundle }) {
-  const expected = await computeBiomeContentHashes({ schemas, lock, imageLock, locate, vendoredCommit, catalogue, catalogueDigest, catalogueContentDigest, storePublisherAnchorKeys, contentCommits });
-  assertLockBundleSigners({ lock, selection: bundleSigners, schemas, gitSourcedBundle });
-  const mismatched = lock.biomes
-    .filter((biome) => biome.biomeContentHash !== expected.get(biome.id))
-    .map((biome) => `${biome.id} (lock ${String(biome.biomeContentHash)}, recomputed ${expected.get(biome.id)})`);
-  if (mismatched.length > 0) {
-    throw new BiomeContentHashError(
-      `distribution "${lock.distributionId}": biomeContentHash does not match its inputs for ${mismatched.join('; ')}` +
-        (catalogue === undefined ? '' : `; ${CATALOGUE_AUTHORITY_NOTE}`),
-    );
-  }
-  return expected;
-}

package/edition/build-biome-index.mjs

@@ -1,180 +0,0 @@
-#!/usr/bin/env node
-// build-biome-index — walk every `xema-biome.json` in the monorepo and emit the
-// global biome index (`distributions/biome-index.json`) that the distribution
-// resolver reads. The index is the single source of truth for "which biomes
-// exist, at what tier/target/origin/version, and what they require". It carries
-// PACKAGING-relevant fields only.
-//
-// Usage:
-//   node build-biome-index.mjs [--check] [--source published|workspace] [--unpinned]
-//
-// THE COMMITTED PINS ARE THE AUTHORITY, and this index is a CONSUMER of them.
-// Each repository's commit comes from `runtime-image-source-index.json`'s
-// `repositoryPins`; nothing here asks a repository what its newest built commit
-// is. `--unpinned` is the one way to reach a live resolution and it is a POLICY
-// operation — see `pinAuthority` below.
-//
-// Fail-fast on any manifest missing id/scope/target or with an unknown tier
-// (see manifestToIndexEntry). mjs tooling — clocks are fine; the index itself
-// carries no timestamp so it is reproducible.
-
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { dirname } from 'node:path';
-
-import { WorkspaceRoot, biomeIndexPath, configureEditionWorkspaceFromProcess, isEntryModule, platformServiceIndexPath } from './edition-workspace.mjs';
-import {
-  buildBiomeIndex,
-  distributionBiomeSourceRepositories,
-  loadKernelDistributionSchemas,
-  serializeJson,
-} from './lib.mjs';
-import { commandForSelf } from './remedy-command.mjs';
-import {
-  DistributionSourceMode,
-  committedRepositoryPins,
-  createPinnedSourceAuthority,
-  createSourceAuthority,
-  parseSourceModeArgs,
-} from './source-authority.mjs';
-
-if (isEntryModule(import.meta.url)) {
-  configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Sources, WorkspaceRoot.Kernel]);
-}
-
-/**
- * WHY THIS INDEX READS THE PINS INSTEAD OF RESOLVING REPOSITORIES ITSELF.
- *
- * This index and `runtime-image-source-index.json` used to be derived from the
- * same fact and DERIVE IT SEPARATELY: each called `commitForRepository`, which
- * asks the world a live question whose answer moves whenever a build lands.
- * `resolve-images` refuses any disagreement between them — it re-reads each
- * biome manifest at the RUNTIME pin and fails with "sourceManifestHash does not
- * match" — so two derivations minutes apart could produce two artifacts that
- * cannot resolve together.
- *
- * A `--repo <repository>` scope was added to narrow the second derivation to
- * one repository. It narrowed the COLLATERAL and left the RACE: the scoped
- * repository was still resolved live, so a build landing between
- * `build-runtime-image-source-index --repo X` and `build-biome-index --repo X`
- * split the two artifacts on exactly the repository the operator was refreshing.
- *
- * So the scope is gone and the derivation with it. There is ONE artifact whose
- * job is to decide what commit a repository is at — the runtime image source
- * index — and everything downstream reads its record. A scoped refresh of this
- * index is not a mode here any more: it is what you GET, because advancing one
- * pin is the only thing that can move one repository's entries.
- *
- * `--unpinned` is the escape, and it is a POLICY operation rather than a
- * correctness one. Two cases need it and no third has appeared:
- *
- *   - BOOTSTRAP — a data root with no committed pins at all. A repository
- *     JOINING a data root that has pins is not this case: it has no pin yet,
- *     and `createPinnedSourceAuthority` refuses it here rather than resolving
- *     it live. The join is `build-runtime-image-source-index.mjs
- *     --trusted-write --repo <repository> [--at <sha>]`, which resolves the
- *     joining repository ONCE and writes this index, the platform-service
- *     index and the runtime index from that one pin set, every committed pin
- *     kept (`buildIndexesWithJoiningRepository`). A `--repo` here would
- *     resolve it a second time: the race above.
- *   - WORKSPACE — `--source workspace` snapshots a dirty local tree, which has
- *     no pin by construction. It therefore IMPLIES `--unpinned`, rather than
- *     making the operator state both.
- */
-function parseUnpinned(argv) {
-  const index = argv.indexOf('--unpinned');
-  if (index === -1) {return { unpinned: false, remaining: argv };}
-  return {
-    unpinned: true,
-    remaining: [...argv.slice(0, index), ...argv.slice(index + 1)],
-  };
-}
-
-async function main() {
-  const { unpinned: unpinnedFlag, remaining: afterUnpinned } = parseUnpinned(
-    process.argv.slice(2),
-  );
-  const { mode, remaining } = parseSourceModeArgs(afterUnpinned);
-  const check = remaining.includes('--check');
-  if (remaining.some((argument) => argument !== '--check')) {
-    throw new Error(
-      'usage: build-biome-index.mjs [--check] [--source published|workspace] ' +
-        '[--unpinned]',
-    );
-  }
-  // A workspace snapshot has no pin and never will — see `parseUnpinned`.
-  const unpinned = unpinnedFlag || mode === DistributionSourceMode.Workspace;
-  const schemas = await loadKernelDistributionSchemas();
-  const platformServiceIndex = schemas.parsePlatformServiceSourceIndex(
-    JSON.parse(readFileSync(platformServiceIndexPath(), 'utf8')),
-  );
-  const sourceRepositories = distributionBiomeSourceRepositories();
-  const sourceAuthority = unpinned
-    ? createSourceAuthority({
-        mode,
-        knownRepositories: sourceRepositories.map(({ repo }) => repo),
-      })
-    : // NO DELEGATE, deliberately. A consumer artifact has nothing to resolve,
-      // and passing a live authority it "will not use" makes that a claim about
-      // this call site rather than a property of the object. Without one, any
-      // repository missing from the record REFUSES by name instead of quietly
-      // resolving to whatever its tip happens to be today.
-      createPinnedSourceAuthority({ pins: committedRepositoryPins() });
-  const index = await buildBiomeIndex(
-    platformServiceIndex,
-    sourceRepositories,
-    sourceAuthority,
-  );
-  const serialized = serializeJson(index);
-
-  if (check) {
-    let committed;
-    try {
-      committed = readFileSync(biomeIndexPath(), 'utf8');
-    } catch {
-      console.error(
-        `[dist:index --check] ${biomeIndexPath()} does not exist. Run \`${commandForSelf(import.meta.url)}\`.`,
-      );
-      process.exit(1);
-    }
-    if (committed !== serialized) {
-      const regenerateCommand =
-        mode === DistributionSourceMode.Workspace
-          ? `${commandForSelf(import.meta.url, '--source', 'workspace')} (local-only output; do not publish it)`
-          : commandForSelf(import.meta.url);
-      // WHICH AUTHORITY DISAGREED is the first thing the reader needs, because
-      // the two have different remedies: a PINNED divergence means the index
-      // does not match the pins and regenerating fixes it, while an UNPINNED one
-      // means the fleet has moved and regenerating MOVES EVERY PIN. Saying which
-      // ran is what keeps the second from being done by reflex.
-      console.error(
-        `[dist:index --check] authority: ${
-          unpinned
-            ? 'UNPINNED — every repository was resolved LIVE, so this verdict ' +
-              'is about the fleet right now and regenerating will move pins'
-            : `PINNED — ${
-                committedRepositoryPins().length
-              } committed pin(s), no live resolution`
-        }.`,
-      );
-      console.error(
-        `[dist:index --check] biome-index.json is out of date. Run \`${regenerateCommand}\`.`,
-      );
-      process.exit(1);
-    }
-    console.log(
-      `[dist:index --check] biome-index.json is up to date (${index.length} biomes).`,
-    );
-    return;
-  }
-
-  mkdirSync(dirname(biomeIndexPath()), { recursive: true });
-  writeFileSync(biomeIndexPath(), serialized);
-  console.log(
-    `[dist:index] wrote ${biomeIndexPath()} (${index.length} biomes).`,
-  );
-}
-
-main().catch((error) => {
-  console.error(`[dist:index] ${error.message}`);
-  process.exitCode = 1;
-});

package/edition/build-ledger-completeness.mjs

@@ -1,67 +0,0 @@
-// Release-lane completeness: with a v2 ledger, every resolved subject's
-// `imageRef:contentHash` must be published with every platform its edition
-// requires. Seal stays the final registry check; this refuses earlier, and
-// names everything missing in one error.
-import { platformIdentity } from './verify-image-platforms.mjs';
-
-export class BuildLedgerIncompleteError extends Error {
-  constructor(distributionId, missing) {
-    const lines = missing.map(
-      (entry) =>
-        `  ${entry.imageRef}:${entry.contentHash} lacks ${entry.platform} (repo ${entry.repo} pinned at ${entry.sourceCommit})`,
-    );
-    super(
-      `edition "${distributionId}" names ${missing.length} image coordinate(s) the build ledger ` +
-        `does not show published with every required platform:\n${lines.join('\n')}\n` +
-        `Build or re-project those images, or pin a repository commit whose images are complete.`,
-    );
-    this.name = 'BuildLedgerIncompleteError';
-    this.missing = missing;
-  }
-}
-
-export class BuildLedgerMissingError extends Error {
-  constructor(distributionId, expectedAt) {
-    super(
-      `edition "${distributionId}" is resolved on the release lane, which needs the build ledger, but ` +
-        `${expectedAt} does not exist. Project the ledger into the data root; an absent ledger is not ` +
-        `read as "nothing to check".`,
-    );
-    this.name = 'BuildLedgerMissingError';
-  }
-}
-
-/**
- * `ledger` is the parsed ledger (`readBuildLedger`); null means it is absent and is REFUSED.
- * A v1 ledger records no per-image facts, so nothing is checked (transitional, like the v1 parser branch).
- */
-export function assertBuildLedgerComplete({
-  ledger,
-  distributionId,
-  subjects,
-  requiredPlatforms,
-  expectedAt,
-}) {
-  if (ledger === null) {throw new BuildLedgerMissingError(distributionId, expectedAt);}
-  if (ledger.schemaVersion !== 2) {return;}
-  const required = requiredPlatforms.map(platformIdentity);
-  const missing = [];
-  for (const subject of subjects) {
-    const repository = ledger.repositories[subject.repo];
-    const published =
-      repository?.images?.[subject.imageRef]?.contentHashes?.[subject.contentHash];
-    const have = new Set(published?.platforms ?? []);
-    for (const platform of required) {
-      if (!have.has(platform)) {
-        missing.push({
-          repo: subject.repo,
-          sourceCommit: subject.sourceCommit,
-          imageRef: subject.imageRef,
-          contentHash: subject.contentHash,
-          platform,
-        });
-      }
-    }
-  }
-  if (missing.length > 0) {throw new BuildLedgerIncompleteError(distributionId, missing);}
-}