@xemahq/xema 0.59.1 → 0.60.1

package/edition/develop-catalogue-free-resolve.mjs

@@ -1,280 +0,0 @@
-// develop-catalogue-free-resolve — the catalogue-free CUSTOMER develop resolve:
-//
-//   xema edition develop resolve --definition-at <owner>/<repo>,<path>,<dataRoot> --offering <owner>/<repo>,<path>,<dataRoot>
-//       --pins <file> --out <dir> --registry <root> --engine-repository <repository> --engine-signer <certificate identity>
-//       --cosign <abs path> --offering-previous-lock <file> --offering-previous-lock-sha256 <hex>
-//       (--previous-lock <file> --previous-lock-sha256 <hex> | --first-seal) [--source-image <source>=<registry>/<prefix>]... [--local]
-//
-// A dev deployment of a customer definition resolves the vendor offering it builds on IN THE SAME CALL instead of
-// pinning a published catalogue: no catalogue.pin.json is read (its presence beside the definition is refused, never
-// a fallback), and no public flag substitutes a catalogue file. Two workspaces, two steps, one CLI:
-//
-//   vendor    a child `develop resolve <offering id> --pins <vendor pins> --local` of this CLI on the VENDOR roots
-//             (the roots this call was given), unchanged: it writes the vendor artifact and catalogue.json into a
-//             scratch directory. --offering names the offering's directory inside the vendor data checkout, held to
-//             it like follow's --definition-at (the checkout is the declared repository, clean at the vendor data
-//             pin, the data root and the directory where the triple says). Never defaulted.
-//   customer  the definition repository fetched at --pins "definition-repository" (the walk's git source fetch, by
-//             exact commit) and its tree at that commit checked out from the object store into this call's private
-//             scratch before the vendor step runs (a temporary index, symlinks as plain files): the shared fetch cache
-//             is never read again, so a cache tree that moves or changes mid-run cannot change what is resolved. The
-//             workspace is re-stated on the scratch copy's roots (data = <copy>/<dataRoot>, editions = the parent of
-//             <copy>/<path>, a fresh sources root, the same cache), and the customer resolve run against the catalogue
-//             the vendor step wrote. The edition's pins are the catalogue-free form
-//             (edition-contract.json provenancePins.customerForms): the vendor pins, the customer's own
-//             sources/<name> commits, "definition-repository" and the definition digest, never a catalogue pin.
-//             The catalogue CONTENT digest is sha256 of the EXACT catalogue.json bytes the vendor step wrote (parsed
-//             strictly, so a duplicate key refuses), the convention of the catalogue layer digest of an offering
-//             artifact (produce-edition-catalogue-evidence's predicate catalogueDigest). It goes into the distribution
-//             lock only, as catalogueContentDigest (kernel edition protocol v37), never catalogueDigest: no catalogue
-//             artifact exists, so the lock never names one (catalogue-lock-field.mjs).
-//
-// --pins is the COMPLETE frozen set; nothing here reads a head. It is split once, before anything is fetched: a
-// sources/<name> key the definition declares is the customer's own, every other key but "definition-repository" goes
-// to the vendor step (which refuses what its offering does not declare). A source name both the offering and the
-// definition declare is refused before the vendor step: its one pin could not say whose source it is.
-
-import { execFileSync, spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { basename, dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-import { sha256Digest } from './canonical-evidence-json.mjs';
-import { CATALOGUE_PIN_FILE } from './catalogue-pin.mjs';
-import { CATALOGUE_FILE, parseCatalogue } from './catalogue.mjs';
-import { customerPreviousSeal, customerSourceImages, declaredSourceNamesOf, resolveCustomerChannelEdition } from './customer-edition-verbs.mjs';
-import { DEFINITION_AT_FLAG, OFFERING_FLAG, OFFERING_PREVIOUS_LOCK_FLAG, OFFERING_PREVIOUS_LOCK_SHA256_FLAG } from './customer-flags.mjs';
-import { assertDefinitionCheckout, parseFollowDefinition } from './develop-follow.mjs';
-import { customerDevelopGitBundleVerifier } from './develop-git-bundles.mjs';
-import { assertCanonicalDistributionId } from './distribution-paths.mjs';
-import { LOCAL_WORKFLOW, parseEditionDescriptor, snapshotEditionTarget, workflowFromEnv, writeEditionArtifact } from './edition-artifact.mjs';
-import { resetEditionWorkspaceConfig } from './edition-config.mjs';
-import { CATALOGUE_PIN_KEY, DEFINITION_PIN_KEY, DEFINITION_REPOSITORY_PIN_KEY, EDITION_DESCRIPTOR_FILE, EditionChannel, EditionKind, VENDOR_MEMBER_PIN_PATTERN } from './edition-constants.mjs';
-import { WorkspaceRoot, cacheDir, configureEditionWorkspace, configuredWorkspace, editionsRoot, workspaceArgv } from './edition-workspace.mjs';
-import { descriptorEvidenceTrust } from './evidence-trust-policy.mjs';
-import { materializeGitSource } from './external-source-walk.mjs';
-import { serializeJson } from './lib.mjs';
-import { dataPinKey, isSourcePinKey, sortedSnapshotPins, sourceNameOfPinKey } from './pin-source.mjs';
-import { parseStrictJson, readStrictJsonFile } from './strict-json.mjs';
-
-export { DEFINITION_REPOSITORY_PIN_KEY };
-/** The definition file in a definition directory (the editions-root layout). */
-const DEFINITION_FILE = 'xema-distribution.json';
-const SHA_PATTERN = /^[0-9a-f]{40}$/;
-const ENTRY = join(dirname(fileURLToPath(import.meta.url)), 'develop-edition.mjs');
-
-/**
- * `sha256:<hex>` of the exact catalogue.json bytes the vendor step wrote (the catalogue layer digest convention): the
- * lock's catalogueContentDigest, never a pin.
- */
-export const catalogueContentDigestOf = (bytes) => sha256Digest(bytes);
-
-/**
- * --pins checked and split once, before anything is fetched: `{ definitionRepositoryCommit, members }`, the members
- * every other key. "catalogue" and "definition" are computed, never input.
- */
-export function splitCatalogueFreePins(pins) {
-  if (pins === null || typeof pins !== 'object' || Array.isArray(pins)) {throw new Error('--pins must be an object mapping pin key -> 40-hex commit');}
-  for (const computed of [CATALOGUE_PIN_KEY, DEFINITION_PIN_KEY]) {
-    if (computed in pins) {throw new Error(`--pins names "${computed}": a catalogue-free resolve computes the definition digest and pins no catalogue`);}
-  }
-  const { [DEFINITION_REPOSITORY_PIN_KEY]: definitionRepositoryCommit, ...members } = pins;
-  if (typeof definitionRepositoryCommit !== 'string' || !SHA_PATTERN.test(definitionRepositoryCommit)) {
-    throw new Error(`--pins "${DEFINITION_REPOSITORY_PIN_KEY}" must be the 40-hex commit the definition repository is read at, got ${JSON.stringify(definitionRepositoryCommit)}`);
-  }
-  if (!Object.keys(members).some((key) => VENDOR_MEMBER_PIN_PATTERN.test(key))) {
-    throw new Error('--pins carries no vendor member pin (repos/<x> or submodules/<x>): a catalogue-free resolve resolves the vendor offering from them');
-  }
-  return { definitionRepositoryCommit, members };
-}
-
-/**
- * The members of --pins between the two steps: `{ own, vendor }`, own the sources/<name> keys the definition declares.
- * `offering` and `definition` are `{ label, sourceNames }`: a source name both declare is refused, naming both.
- */
-export function partitionCatalogueFreePins(members, { offering, definition }) {
-  const vendorNames = new Set(offering.sourceNames);
-  const shared = [...new Set(definition.sourceNames)].filter((name) => vendorNames.has(name));
-  if (shared.length > 0) {
-    throw new Error(`the source${shared.length === 1 ? '' : 's'} ${shared.map((name) => `"${name}"`).join(', ')} ${shared.length === 1 ? 'is' : 'are'} declared by both the offering ${offering.label} and the definition ${definition.label}: a catalogue-free resolve splits each sources/<name> pin to one of them, so a source name is declared once`);
-  }
-  const ownNames = new Set(definition.sourceNames);
-  const own = {};
-  const vendor = {};
-  for (const [key, commit] of Object.entries(members)) {
-    if (isSourcePinKey(key) && ownNames.has(sourceNameOfPinKey(key))) {own[key] = commit;} else {vendor[key] = commit;}
-  }
-  return { own, vendor: sortedSnapshotPins(vendor) };
-}
-
-/** The definition repository at `commit`, through the source walk's fetch by exact commit; returns its (shared cache) directory. */
-export function fetchDefinitionRepository({ repository, commit, env }) {
-  const source = { kind: 'git', name: DEFINITION_REPOSITORY_PIN_KEY, url: `https://github.com/${repository}.git`, ref: commit };
-  return materializeGitSource({ source, cacheRoot: join(cacheDir(), 'definition-repositories', ...repository.split('/')), env }).directory;
-}
-
-/**
- * The tree of `commit` in the repository at `repository`, written into the new directory `into` from the object store
- * (a temporary index beside `into`, never the repository's own index or worktree; symlinks as plain files, so nothing
- * read from `into` resolves outside it). Returns `into`.
- */
-export function materializeDefinitionCommit({ repository, commit, into }) {
-  mkdirSync(into);
-  const env = { ...process.env, GIT_INDEX_FILE: `${into}.index`, GIT_NO_LAZY_FETCH: '1' };
-  const git = (args) => execFileSync('git', ['-C', repository, '-c', 'core.symlinks=false', ...args], { env, stdio: ['ignore', 'pipe', 'pipe'] });
-  try {
-    git(['read-tree', `${commit}^{tree}`]);
-    git(['checkout-index', '--all', `--prefix=${into}/`]);
-  } finally {
-    rmSync(`${into}.index`, { force: true });
-  }
-  return into;
-}
-
-/** The argv of the vendor step's child `develop resolve` (after the node binary). */
-export function vendorResolveArgs({ offeringId, pinsFile, outDir, options, roots }) {
-  // Always --local: the child is a step of this call, not a release workflow; its descriptor never leaves the scratch
-  // directory, and the edition this call writes records this call's own workflow (LOCAL_WORKFLOW only under --local).
-  // The child finds and proves the engine itself (--engine-repository/--engine-signer), and seals against the OFFERING's
-  // own previous seal (the images lock `develop follow` froze), held by the child to its sha256 and to the offering's id.
-  return [
-    ENTRY, 'resolve', offeringId, '--pins', pinsFile, '--out', outDir, '--registry', options['--registry'],
-    '--engine-repository', options['--engine-repository'], '--engine-signer', options['--engine-signer'], '--cosign', options['--cosign'],
-    '--previous-lock', options[OFFERING_PREVIOUS_LOCK_FLAG], '--previous-lock-sha256', options[OFFERING_PREVIOUS_LOCK_SHA256_FLAG],
-    '--local', ...roots,
-  ];
-}
-
-/** The vendor step: a child `develop resolve` of this CLI on the vendor roots, writing into `outDir`. */
-export function runVendorResolve({ offeringId, pinsFile, outDir, options, env, roots }) {
-  const result = spawnSync(process.execPath, vendorResolveArgs({ offeringId, pinsFile, outDir, options, roots }), { env, stdio: ['ignore', 'ignore', 'inherit'] });
-  if (result.error !== undefined || result.status !== 0) {
-    throw new Error(`the vendor resolve of the offering "${offeringId}" failed (${result.error?.message ?? `exit ${result.status ?? result.signal}`}); its refusal is above`);
-  }
-}
-
-/**
- * The catalogue the vendor step wrote, its digest, the engine it proved, and the proof the vendor artifact is that offering
- * at those pins. (The digest is of `bytes` as read, the same bytes parsed: never a re-serialisation.)
- */
-export function readVendorCatalogue({ outDir, offeringId, vendorPins }) {
-  const path = join(outDir, CATALOGUE_FILE);
-  const bytes = readFileSync(path);
-  const catalogue = parseCatalogue(parseStrictJson(bytes.toString('utf8'), path));
-  if (catalogue.offeringId !== offeringId || catalogue.channel !== EditionChannel.Develop) {
-    throw new Error(`the vendor step wrote the catalogue of "${catalogue.offeringId}" (${catalogue.channel}), not of the develop offering "${offeringId}"`);
-  }
-  const descriptor = parseEditionDescriptor(readStrictJsonFile(join(outDir, EDITION_DESCRIPTOR_FILE)));
-  if (serializeJson(sortedSnapshotPins(descriptor.provenance.pins)) !== serializeJson(vendorPins)) {
-    throw new Error(`the vendor step resolved "${offeringId}" at other pins than the vendor pins it was given`);
-  }
-  return { catalogue, catalogueContentDigest: catalogueContentDigestOf(bytes), engineImage: descriptor.engine.image };
-}
-
-/** Run `body` with the workspace on `roots`, restoring the previous roots after. */
-async function onRoots(roots, body) {
-  const restored = configuredWorkspace();
-  resetEditionWorkspaceConfig();
-  configureEditionWorkspace(roots);
-  try {
-    return await body();
-  } finally {
-    resetEditionWorkspaceConfig();
-    configureEditionWorkspace(restored);
-  }
-}
-
-/**
- * The catalogue-free customer develop resolve (see the header). Writes the artifact to --out and returns
- * `{ id, pins, target, catalogueContentDigest, engineImage }`. The edition records the engine the vendor step proved, and
- * carries the customer's own composed generations from --previous-lock (or --first-seal) under the customer's id.
- * `fetchDefinition`, `vendorResolve`, `resolveCustomer`, `evidenceTrust` and `write` are replaced by tests; `print`
- * receives the target.
- */
-export async function resolveCatalogueFree({
-  options,
-  env = process.env,
-  fetchDefinition = fetchDefinitionRepository,
-  vendorResolve = runVendorResolve,
-  resolveCustomer = resolveCustomerChannelEdition,
-  evidenceTrust = descriptorEvidenceTrust,
-  write = writeEditionArtifact,
-  print = (line) => console.log(line),
-}) {
-  const definition = parseFollowDefinition(options[DEFINITION_AT_FLAG], DEFINITION_AT_FLAG);
-  const offering = parseFollowDefinition(options[OFFERING_FLAG], OFFERING_FLAG);
-  const rawPins = readStrictJsonFile(options['--pins']);
-  const offeringId = assertDefinitionCheckout({ definition: offering, dataSha: rawPins?.[dataPinKey()], flag: OFFERING_FLAG, shaLabel: `--pins "${dataPinKey()}"` });
-  const { definitionRepositoryCommit, members } = splitCatalogueFreePins(rawPins);
-  const offeringLabel = `${offering.repository}:${offering.path}/${DEFINITION_FILE}`;
-  const offeringSourceNames = declaredSourceNamesOf(readStrictJsonFile(join(editionsRoot(), offeringId, DEFINITION_FILE)));
-  const vendorRoots = configuredWorkspace();
-  const scratch = mkdtempSync(join(tmpdir(), 'xema-catalogue-free-'));
-  try {
-    const cached = fetchDefinition({ repository: definition.repository, commit: definitionRepositoryCommit, env });
-    const checkout = materializeDefinitionCommit({ repository: cached, commit: definitionRepositoryCommit, into: join(scratch, DEFINITION_REPOSITORY_PIN_KEY) });
-    const definitionDir = join(checkout, definition.path);
-    const definitionLabel = `${definition.repository}:${definition.path}/${DEFINITION_FILE}`;
-    if (existsSync(join(definitionDir, CATALOGUE_PIN_FILE))) {
-      throw new Error(`${definition.repository}:${definition.path} carries ${CATALOGUE_PIN_FILE}: a definition is resolved against its pinned catalogue (--definition <file>) or catalogue-free, never both`);
-    }
-    const rawDefinition = readStrictJsonFile(join(definitionDir, DEFINITION_FILE));
-    assertCanonicalDistributionId(rawDefinition?.id);
-    if (rawDefinition.id !== basename(definition.path)) {
-      throw new Error(`${definitionLabel} is "${rawDefinition.id}", not the directory's "${basename(definition.path)}"`);
-    }
-    const split = partitionCatalogueFreePins(members, {
-      offering: { label: offeringLabel, sourceNames: offeringSourceNames },
-      definition: { label: definitionLabel, sourceNames: declaredSourceNamesOf(rawDefinition) },
-    });
-    const sourceImages = customerSourceImages(options, rawDefinition);
-    const vendorOut = join(scratch, 'vendor');
-    const pinsFile = join(scratch, 'vendor-pins.json');
-    writeFileSync(pinsFile, serializeJson(split.vendor));
-    vendorResolve({ offeringId, pinsFile, outDir: vendorOut, options, env, roots: workspaceArgv() });
-    const { catalogue, catalogueContentDigest, engineImage } = readVendorCatalogue({ outDir: vendorOut, offeringId, vendorPins: split.vendor });
-    const sources = join(scratch, 'sources');
-    mkdirSync(sources);
-    const customerRoots = {
-      [WorkspaceRoot.Data]: join(checkout, definition.dataRoot),
-      [WorkspaceRoot.Editions]: dirname(definitionDir),
-      [WorkspaceRoot.Sources]: sources,
-      [WorkspaceRoot.Cache]: vendorRoots[WorkspaceRoot.Cache],
-    };
-    return await onRoots(customerRoots, async () => {
-      const { id, pins, ...resolved } = await resolveCustomer({
-        channel: EditionChannel.Develop,
-        rawDefinition,
-        catalogue,
-        catalogueContentDigest,
-        pins: split.own,
-        vendorPins: { ...split.vendor, [DEFINITION_REPOSITORY_PIN_KEY]: definitionRepositoryCommit },
-        previousSeal: customerPreviousSeal(EditionChannel.Develop, options),
-        sourceImages,
-        env,
-        // The customer's git-sourced OCI bundles, verified under the definition's own pinned policy (its data root).
-        developGitBundles: customerDevelopGitBundleVerifier({ channel: EditionChannel.Develop, cosignBinary: options['--cosign'], env }),
-      });
-      const evidenceTrustPolicy = await evidenceTrust({ kind: EditionKind.Resolved, channel: EditionChannel.Develop, consumesCatalogue: true });
-      const target = snapshotEditionTarget(EditionChannel.Develop, id, pins, { registry: options['--registry'], engineImage, sourceImages });
-      write({
-        outDir: resolve(options['--out']),
-        channel: EditionChannel.Develop,
-        distributionId: id,
-        pins,
-        workflow: options['--local'] ? LOCAL_WORKFLOW : workflowFromEnv(env),
-        evidenceTrustPolicy,
-        engineImage,
-        distributionLock: resolved.distributionLock,
-        imageLock: resolved.imageLock,
-        authorizationLock: resolved.authorizationLock,
-        chartSetLock: resolved.chartSetLock,
-      });
-      print(target);
-      return { id, pins, target, catalogueContentDigest, engineImage };
-    });
-  } finally {
-    rmSync(scratch, { recursive: true, force: true });
-  }
-}

package/edition/develop-chart-roster.mjs

@@ -1,96 +0,0 @@
-// develop-chart-roster — the develop chart roster of a deploy checkout, as the
-// deploy repository itself computes it.
-//
-// A develop chart's version is `0.0.0-h<16 hex>`, the first 16 hex of its full
-// content digest (xema-deploy scripts/lib/chart-content-digest.mjs,
-// developChartVersionFromDigest). That function belongs to the deploy
-// repository, and so does the index version derived from the roster: publish-
-// charts on refs/heads/develop runs the same code to publish the charts and
-// close the set with its `xema-chart-set` index. So the CLI never reimplements
-// or vendors it: it runs the entry point of the frozen deploy checkout
-// (`scripts/chart-content-digest.mjs --develop-roster --json`), which is the
-// code the publisher ran for that commit, and validates the one document it
-// prints. A vendored copy would pin the CLI to one revision of a hash whose
-// owner is the deploy commit being resolved.
-
-import { execFileSync } from 'node:child_process';
-import { join } from 'node:path';
-
-import { parseStrictJson } from './strict-json.mjs';
-
-/** The schema string the deploy entry point stamps on its develop roster. */
-export const DEVELOP_CHART_ROSTER_SCHEMA = 'xema-develop-chart-roster/1';
-
-/** The entry point, relative to the deploy checkout, and its arguments. */
-export const DEVELOP_CHART_ROSTER_ENTRY = 'scripts/chart-content-digest.mjs';
-export const DEVELOP_CHART_ROSTER_ARGS = Object.freeze(['--develop-roster', '--json']);
-
-/** A develop channel coordinate: revision 0 and the content digest's first 16 hex. */
-export const DEVELOP_CHART_VERSION_PATTERN = /^0\.0\.0-h[0-9a-f]{16}$/;
-
-/** A chart name as Helm and the registry address it. */
-const CHART_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
-
-const ROSTER_KEYS = 'indexVersion,members,schema';
-const MEMBER_KEYS = 'name,version';
-
-/**
- * Validate the develop roster document `document` (from `source`) and return
- * `{indexVersion, members: [{name, version}]}`. Every rule is strict: the exact
- * schema string and keys, develop coordinates only, and members sorted by name
- * with no name twice.
- */
-export function parseDevelopChartRoster(document, source) {
-  const fail = (why) => {
-    throw new Error(`${source} is not a ${DEVELOP_CHART_ROSTER_SCHEMA} roster: ${why}`);
-  };
-  if (!document || typeof document !== 'object' || Array.isArray(document)) {fail('it is not a JSON object');}
-  if (document.schema !== DEVELOP_CHART_ROSTER_SCHEMA) {fail(`schema must be "${DEVELOP_CHART_ROSTER_SCHEMA}" (got ${JSON.stringify(document.schema)})`);}
-  const keys = Object.keys(document).sort().join(',');
-  if (keys !== ROSTER_KEYS) {fail(`it must carry exactly ${ROSTER_KEYS} (got ${keys})`);}
-  if (!DEVELOP_CHART_VERSION_PATTERN.test(String(document.indexVersion))) {
-    fail(`indexVersion must be a develop coordinate 0.0.0-h<16 hex> (got ${JSON.stringify(document.indexVersion)})`);
-  }
-  if (!Array.isArray(document.members) || document.members.length === 0) {fail('members must be a non-empty array');}
-  let previous = '';
-  const members = document.members.map((member, position) => {
-    if (!member || typeof member !== 'object' || Array.isArray(member) || Object.keys(member).sort().join(',') !== MEMBER_KEYS) {
-      fail(`member ${position} must be exactly {name, version}`);
-    }
-    if (!CHART_NAME_PATTERN.test(String(member.name))) {fail(`member ${position} has a malformed chart name ${JSON.stringify(member.name)}`);}
-    if (!DEVELOP_CHART_VERSION_PATTERN.test(String(member.version))) {
-      fail(`${member.name} has no develop coordinate 0.0.0-h<16 hex> (got ${JSON.stringify(member.version)})`);
-    }
-    if (member.name <= previous) {fail(`members must be sorted by name with no name twice (${member.name} follows ${previous})`);}
-    previous = member.name;
-    return { name: member.name, version: member.version };
-  });
-  return { indexVersion: document.indexVersion, members };
-}
-
-/**
- * The develop roster of the deploy checkout at `deployDir`: its own entry point
- * run with this node, in that checkout, with only PATH from the environment (the
- * entry point needs git and nothing else; no credential reaches it).
- */
-export function readDevelopChartRoster(deployDir) {
-  const entry = join(deployDir, DEVELOP_CHART_ROSTER_ENTRY);
-  let stdout;
-  try {
-    stdout = execFileSync(process.execPath, [entry, ...DEVELOP_CHART_ROSTER_ARGS], {
-      cwd: deployDir,
-      encoding: 'utf8',
-      env: { PATH: process.env.PATH ?? '' },
-      maxBuffer: 16 * 1024 * 1024,
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-  } catch (error) {
-    const stderr = typeof error?.stderr === 'string' ? error.stderr.trim() : '';
-    throw new Error(
-      `the deploy checkout's develop roster failed (node ${DEVELOP_CHART_ROSTER_ENTRY} ${DEVELOP_CHART_ROSTER_ARGS.join(' ')} in ${deployDir}): ${stderr || error.message}`,
-      { cause: error },
-    );
-  }
-  const source = `${DEVELOP_CHART_ROSTER_ENTRY} ${DEVELOP_CHART_ROSTER_ARGS.join(' ')}`;
-  return parseDevelopChartRoster(parseStrictJson(stdout, source), source);
-}

package/edition/develop-chart-set.mjs

@@ -1,147 +0,0 @@
-// develop-chart-set — the chart-set lock of a develop edition.
-//
-// A develop edition renders the charts of its frozen deploy commit. The deploy
-// checkout computes its own develop roster (develop-chart-roster.mjs: every
-// chart at `0.0.0-h<16 hex>` and the set's index version), and xema-deploy
-// publish-charts on refs/heads/develop publishes those charts and closes the
-// set with a `xema-chart-set` index at that index version, the same artifact
-// a release closes its set with. So a develop lock is resolved exactly as a
-// release one is (resolve-chart-set.mjs), only at a version the deploy commit
-// names instead of the newest the registry holds: read the index at the
-// roster's index version, require its members to be the roster, seal every
-// member against the registry, and build the same schemaVersion 4 lock. The
-// committed release lock is never read.
-//
-// TWO PUBLISHERS. A develop lock lists the publisher whose repository is the
-// deploy pin role's (this resolution) followed by the release infra publisher,
-// taken verbatim from the data root's committed chart-set.lock.json. Infra
-// charts have no develop channel: the committed release entry is the only
-// published infra set, and the deploy engine plans and applies scope infra on
-// every channel, so a develop deployment needs it to move infra (pgbouncer,
-// external-services) through the pipeline. The data root pin is already in the
-// develop tag, so a moved infra entry moves the tag. A committed lock that is
-// absent, or lacks exactly one infra publisher, is refused: no fallback, no
-// develop-without-infra mode.
-//
-// NOT PUBLISHED IS A REFUSAL. An index or member the registry does not serve
-// (404) is refused by name and version: publish-charts for the deploy commit
-// has not finished green. There is no fallback to any other set.
-
-import { basename } from 'node:path';
-
-import { RefusalError } from './collected-refusals.mjs';
-import { readDevelopChartRoster } from './develop-chart-roster.mjs';
-import { assertRosteredChartSetLock } from './edition-chart-set.mjs';
-import { deployRoot } from './edition-workspace.mjs';
-import { COMMIT_PATTERN } from './evidence-grammars.mjs';
-import { deployPinKey } from './pin-source.mjs';
-import {
-  CHART_SET_LOCK_FILE,
-  buildLock,
-  chartSetLockPath,
-  chartRegistryClient,
-  chartSetPublishers,
-  indexRosterAndDigest,
-  readLock,
-  registryChartDigest,
-  sealRoster,
-} from './resolve-chart-set.mjs';
-
-const NOT_FOUND = 404;
-
-/** The publisher whose repository is the deploy pin role's; exactly one must be configured. */
-function deployPublisher() {
-  const deployRepo = basename(deployPinKey());
-  const publishers = chartSetPublishers().filter((publisher) => basename(publisher.repo) === deployRepo);
-  if (publishers.length !== 1) {
-    throw new RefusalError(
-      `${publishers.length} configured chart publishers have repository ${deployRepo} (the deploy pin role); exactly one must, ` +
-        'since a develop chart set is that publisher\'s set at the deploy commit',
-    );
-  }
-  return publishers[0];
-}
-
-/** The configured publishers that are not the deploy pin role's: the infra publisher(s) a release lock carries. */
-function infraPublisherIndexes() {
-  const deployRepo = basename(deployPinKey());
-  return chartSetPublishers().filter((publisher) => basename(publisher.repo) !== deployRepo).map((publisher) => publisher.index);
-}
-
-/** The ONE infra publisher entry of the data root's committed release lock, unchanged. */
-function committedInfraPublisher() {
-  const path = chartSetLockPath();
-  const committed = readLock(path);
-  if (committed === null) {
-    throw new RefusalError(`${path} is absent or unreadable; a develop edition carries the release infra chart set from it`);
-  }
-  assertRosteredChartSetLock(committed, path);
-  const indexes = infraPublisherIndexes();
-  const found = committed.publishers.filter((publisher) => indexes.includes(publisher.index));
-  if (indexes.length !== 1 || found.length !== 1) {
-    throw new RefusalError(
-      `${path} carries ${found.length} infra publisher entries (${indexes.length} infra publishers configured); exactly one is required`,
-    );
-  }
-  return found[0];
-}
-
-/** Run `read`; a registry 404 becomes the "not published yet" refusal naming `what` and the publisher's run for the deploy commit. */
-async function published(read, what, { publisher, xemaDeploySha }) {
-  try {
-    return await read();
-  } catch (error) {
-    if (error?.status !== NOT_FOUND) {throw error;}
-    throw new RefusalError(`${what} is not published yet; ${publisher.repo} publish-charts for ${xemaDeploySha} not green`, { cause: error });
-  }
-}
-
-/** Refuse an index whose members are not exactly the roster's names at the roster's versions. */
-function assertIndexIsRoster(indexRoster, members, label) {
-  const expected = members.map(({ name, version }) => `${name} ${version}`);
-  const actual = Object.entries(indexRoster).map(([name, member]) => `${name} ${member.version}`);
-  const missing = expected.filter((line) => !actual.includes(line));
-  const extra = actual.filter((line) => !expected.includes(line));
-  if (missing.length > 0 || extra.length > 0) {
-    throw new RefusalError(
-      `${label} does not carry the deploy checkout's develop roster: ` +
-        `missing [${missing.join(', ')}], unexpected [${extra.join(', ')}]`,
-    );
-  }
-}
-
-/**
- * The develop chart-set lock for the deploy commit `xemaDeploySha`, whose frozen
- * checkout is `deployDir`. `readRoster(deployDir)` returns `{indexVersion, members}`;
- * `client` is the chart registry client the release resolver uses.
- */
-export async function resolveDevelopChartSet({ xemaDeploySha, deployDir = deployRoot(), readRoster = readDevelopChartRoster, client }) {
-  if (!COMMIT_PATTERN.test(xemaDeploySha ?? '')) {
-    throw new RefusalError(`the deploy checkout SHA is not a 40-hex commit: ${JSON.stringify(xemaDeploySha)}`);
-  }
-  const publisher = deployPublisher();
-  const infraPublisher = committedInfraPublisher();
-  const { indexVersion, members } = readRoster(deployDir);
-  const registry = client ?? chartRegistryClient();
-  const label = `${publisher.index}@${indexVersion}`;
-  const { roster, indexDigest } = await published(
-    () => indexRosterAndDigest(registry, publisher.index, indexVersion),
-    `the chart-set index ${label}`,
-    { publisher, xemaDeploySha },
-  );
-  assertIndexIsRoster(roster, members, label);
-  const lookup = registryChartDigest(registry);
-  const charts = await sealRoster(
-    roster,
-    (name, version) => published(() => lookup(name, version), `chart ${name}:${version}`, { publisher, xemaDeploySha }),
-    label,
-  );
-  const lock = buildLock(
-    { [publisher.index]: indexVersion },
-    { [publisher.index]: charts },
-    { [publisher.index]: indexDigest },
-    [publisher],
-  );
-  lock.publishers.push(infraPublisher);
-  return assertRosteredChartSetLock(lock, CHART_SET_LOCK_FILE);
-}