@xemahq/xema 0.32.0 → 0.33.0

package/dist/edition/verify-image-evidence.bundle.mjs

@@ -22802,9 +22802,9 @@ ${code}
       doc.write(`const ${v} = typeof ${accessor} === "string" && ${inDoubt} ? ${cpLen}(${accessor}) : ${accessor}.length;`);
       return v;
     }
-    function numericOperand(value, label) {
+    function numericOperand(value, label2) {
       if (typeof value !== "number" || !Number.isFinite(value)) {
-        throw new ZodCompileUnsupportedError(`${label} bound of type ${typeof value}`);
+        throw new ZodCompileUnsupportedError(`${label2} bound of type ${typeof value}`);
       }
       return `${value}`;
     }
@@ -32037,10 +32037,10 @@ var require_space_ref_parser = __commonJS({
       const example = head === SpaceRefScopeHead.Apps ? "xema://orgs/<orgId>/projects/<projectId>/apps/<appId>" : "xema://orgs/<orgId>/projects/<projectId>";
       return `SpaceRef URI opens with "${head}", which addresses a tier beneath an organisation and is valid only NESTED — e.g. "${example}". A URI may open with: ${SPACE_REF_ROOT_SCOPE_HEADS.join(", ")}.`;
     }
-    function requireSegment(segments, index, raw, label) {
+    function requireSegment(segments, index, raw, label2) {
       const value = segments[index];
       if (value === void 0 || value.length === 0) {
-        throw new space_1.SpaceRefParseError(`SpaceRef URI is missing the "${label}" segment.`, raw);
+        throw new space_1.SpaceRefParseError(`SpaceRef URI is missing the "${label2}" segment.`, raw);
       }
       return value;
     }
@@ -33216,7 +33216,7 @@ var require_effective_capability_set = __commonJS({
       }
       addSecretMaterialIssues(set, context);
     }
-    function addStrictlySortedIssues(values, keyOf, context, path, label) {
+    function addStrictlySortedIssues(values, keyOf, context, path, label2) {
       for (let index = 1; index < values.length; index += 1) {
         const previous = values[index - 1];
         const current = values[index];
@@ -33229,7 +33229,7 @@ var require_effective_capability_set = __commonJS({
           context.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
             path: [...path, index],
-            message: currentKey === previousKey ? `${label} must not contain duplicates.` : `${label} must be sorted in ascending canonical order.`
+            message: currentKey === previousKey ? `${label2} must not contain duplicates.` : `${label2} must be sorted in ascending canonical order.`
           });
         }
       }
@@ -37436,10 +37436,10 @@ var require_xema_object_ref = __commonJS({
         throw err;
       }
     }
-    function requireSegment(segments, index, ref, label) {
+    function requireSegment(segments, index, ref, label2) {
       const value = segments[index];
       if (value === void 0 || value.length === 0) {
-        throw new XemaObjectRefParseError(ref, `missing ${label} segment`);
+        throw new XemaObjectRefParseError(ref, `missing ${label2} segment`);
       }
       return value;
     }
@@ -37762,7 +37762,7 @@ ${oneOff.text}`
     function resourceBindingKey(entry) {
       return entry.ref;
     }
-    function addStrictlySortedIssues(values, keyOf, context, path, label) {
+    function addStrictlySortedIssues(values, keyOf, context, path, label2) {
       for (let index = 1; index < values.length; index += 1) {
         const previous = values[index - 1];
         const current = values[index];
@@ -37775,7 +37775,7 @@ ${oneOff.text}`
           context.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
             path: [...path, index],
-            message: currentKey === previousKey ? `${label} must not contain duplicates.` : `${label} must be sorted in ascending canonical order.`
+            message: currentKey === previousKey ? `${label2} must not contain duplicates.` : `${label2} must be sorted in ascending canonical order.`
           });
         }
       }
@@ -39355,7 +39355,7 @@ var require_launch_definition = __commonJS({
     function isMutableRevisionAlias(revisionId) {
       return /(?:^|[@:/])(?:active|current|latest)$/iu.test(revisionId);
     }
-    function addStrictlySortedIssues(values, keyOf, context, path, label) {
+    function addStrictlySortedIssues(values, keyOf, context, path, label2) {
       for (let index = 1; index < values.length; index += 1) {
         const previous = values[index - 1];
         const current = values[index];
@@ -39368,7 +39368,7 @@ var require_launch_definition = __commonJS({
           context.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
             path: [...path, index],
-            message: currentKey === previousKey ? `${label} must not contain duplicates.` : `${label} must be sorted in ascending canonical order.`
+            message: currentKey === previousKey ? `${label2} must not contain duplicates.` : `${label2} must be sorted in ascending canonical order.`
           });
         }
       }
@@ -49796,7 +49796,7 @@ var require_resolved_session_composition = __commonJS({
         throw new TypeError(`runtimeProfileRevision.contentHash mismatch: expected ${expected}, received ${content.runtimeProfileRevision.contentHash}.`);
       }
     }
-    function addStrictlySortedIssues(values, keyOf, context, path, label) {
+    function addStrictlySortedIssues(values, keyOf, context, path, label2) {
       for (let index = 1; index < values.length; index += 1) {
         const previous = values[index - 1];
         const current = values[index];
@@ -49809,7 +49809,7 @@ var require_resolved_session_composition = __commonJS({
           context.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
             path: [...path, index],
-            message: currentKey === previousKey ? `${label} must not contain duplicates.` : `${label} must be sorted in ascending canonical order.`
+            message: currentKey === previousKey ? `${label2} must not contain duplicates.` : `${label2} must be sorted in ascending canonical order.`
           });
         }
       }
@@ -50037,7 +50037,7 @@ var require_workspace = __commonJS({
     function serializeWorkspace(input) {
       return (0, content_address_1.canonicalJsonStringify)(createWorkspace(input));
     }
-    function addSortedUniqueIssues(values, context, path, label) {
+    function addSortedUniqueIssues(values, context, path, label2) {
       if (values === void 0) {
         return;
       }
@@ -50051,7 +50051,7 @@ var require_workspace = __commonJS({
           context.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
             path: [...path, index],
-            message: current === previous ? `${label} must not contain duplicates.` : `${label} must be sorted in ascending canonical order.`
+            message: current === previous ? `${label2} must not contain duplicates.` : `${label2} must be sorted in ascending canonical order.`
           });
         }
       }
@@ -55261,11 +55261,11 @@ var require_biome_closure = __commonJS({
     function compareEdges(a, b) {
       return compare(a.relationship, b.relationship) || compare(edgeTargetKey(a), edgeTargetKey(b)) || compare(a.consumer.componentKey ?? "", b.consumer.componentKey ?? "");
     }
-    function indexBiomes(facts, label) {
+    function indexBiomes(facts, label2) {
       const map = /* @__PURE__ */ new Map();
       for (const biome of facts?.biomes ?? []) {
         if (map.has(biome.id)) {
-          throw new BiomeClosureError(BiomeClosureErrorCode.AmbiguousPeer, `${label} names biome "${biome.id}" twice — a closure over an ambiguous catalogue cannot choose`);
+          throw new BiomeClosureError(BiomeClosureErrorCode.AmbiguousPeer, `${label2} names biome "${biome.id}" twice — a closure over an ambiguous catalogue cannot choose`);
         }
         map.set(biome.id, biome);
       }
@@ -58041,7 +58041,7 @@ var require_image_producer_evidence = __commonJS({
           return false;
         if (parsed.hostname.startsWith("["))
           return true;
-        return parsed.hostname.split(".").every((label) => label.length > 0 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label));
+        return parsed.hostname.split(".").every((label2) => label2.length > 0 && label2.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label2));
       } catch {
         return false;
       }
@@ -58287,10 +58287,10 @@ var require_image_producer_evidence = __commonJS({
         });
       }
     });
-    function parseWithSchema(label, schema, raw) {
+    function parseWithSchema(label2, schema, raw) {
       const result = schema.safeParse(raw);
       if (!result.success) {
-        throw new Error(`Invalid ${label}: ${result.error.issues.map((issue) => `[${issue.path.join(".")}] ${issue.message}`).join("; ")}`);
+        throw new Error(`Invalid ${label2}: ${result.error.issues.map((issue) => `[${issue.path.join(".")}] ${issue.message}`).join("; ")}`);
       }
       return result.data;
     }
@@ -59682,16 +59682,16 @@ import {
   statSync as statSync2
 } from "node:fs";
 import { basename, dirname, isAbsolute, join as join2, relative, resolve as resolve2, sep } from "node:path";
-function readBoundedNoFollowFile(root2, candidate, label, maxBytes) {
+function readBoundedNoFollowFile(root2, candidate, label2, maxBytes) {
   if (typeof candidate !== "string" || candidate.length === 0 || isAbsolute(candidate)) {
-    throw new Error(`${label} must be a repository-relative path`);
+    throw new Error(`${label2} must be a repository-relative path`);
   }
   const rootReal = realpathSync2(root2);
   const lexicalPath = resolve2(rootReal, candidate);
   const directoryReal = realpathSync2(dirname(lexicalPath));
   const rel = relative(rootReal, directoryReal);
   if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
-    throw new Error(`${label} escapes its evidence root`);
+    throw new Error(`${label2} escapes its evidence root`);
   }
   const path = join2(directoryReal, basename(lexicalPath));
   const directoryChecked = statSync2(directoryReal);
@@ -59704,7 +59704,7 @@ function readBoundedNoFollowFile(root2, candidate, label, maxBytes) {
   } catch (error) {
     if (error?.code === "ELOOP") {
       throw new Error(
-        `${label} escapes its evidence root or is not a no-follow file`
+        `${label2} escapes its evidence root or is not a no-follow file`
       );
     }
     throw error;
@@ -59712,14 +59712,14 @@ function readBoundedNoFollowFile(root2, candidate, label, maxBytes) {
   try {
     const directoryOpened = statSync2(directoryReal);
     if (directoryOpened.dev !== directoryChecked.dev || directoryOpened.ino !== directoryChecked.ino || realpathSync2(directoryReal) !== directoryReal) {
-      throw new Error(`${label}'s directory changed while it was opened`);
+      throw new Error(`${label2}'s directory changed while it was opened`);
     }
     const before = fstatSync(descriptor);
     if (!before.isFile()) {
-      throw new Error(`${label} must be a no-follow regular file`);
+      throw new Error(`${label2} must be a no-follow regular file`);
     }
     if (before.size > maxBytes) {
-      throw new Error(`${label} exceeds ${maxBytes} bytes`);
+      throw new Error(`${label2} exceeds ${maxBytes} bytes`);
     }
     const bytes = Buffer.alloc(before.size);
     let offset = 0;
@@ -59732,17 +59732,17 @@ function readBoundedNoFollowFile(root2, candidate, label, maxBytes) {
         offset
       );
       if (count === 0) {
-        throw new Error(`${label} was truncated while reading`);
+        throw new Error(`${label2} was truncated while reading`);
       }
       offset += count;
     }
     if (readSync(descriptor, Buffer.alloc(1), 0, 1, offset) !== 0) {
-      throw new Error(`${label} grew while reading`);
+      throw new Error(`${label2} grew while reading`);
     }
     const after = fstatSync(descriptor);
     for (const field of ["dev", "ino", "size", "mtimeMs", "ctimeMs"]) {
       if (after[field] !== before[field]) {
-        throw new Error(`${label} changed while reading`);
+        throw new Error(`${label2} changed while reading`);
       }
     }
     return { path, bytes };
@@ -59788,31 +59788,31 @@ var EditionProtocolMismatchError = class extends Error {
 };
 var describe = ({ version, contentDigest }) => `edition protocol v${version} (${contentDigest})`;
 var supportedList = () => SUPPORTED_EDITION_PROTOCOLS.map((protocol) => `v${protocol.version}`).join(", ");
-function assertFinalIdentity(identity, label) {
+function assertFinalIdentity(identity, label2) {
   if (identity.provisional !== false) {
     throw new EditionProtocolMismatchError(
       EditionProtocolMismatchReason.Provisional,
-      `${label} declares ${describe(identity)} as provisional (a branch-local working identity); a provisional edition protocol is never pinned`
+      `${label2} declares ${describe(identity)} as provisional (a branch-local working identity); a provisional edition protocol is never pinned`
     );
   }
 }
-function parseEditionProtocolIdentity(bytes, label) {
+function parseEditionProtocolIdentity(bytes, label2) {
   let identity;
   try {
     identity = JSON.parse(bytes.toString("utf8"));
   } catch (error) {
     throw new EditionProtocolMismatchError(
       EditionProtocolMismatchReason.Malformed,
-      `${label} is not JSON: ${error.message}`
+      `${label2} is not JSON: ${error.message}`
     );
   }
   if (identity === null || typeof identity !== "object" || Array.isArray(identity) || Object.keys(identity).sort().join() !== "contentDigest,provisional,version" || typeof identity.provisional !== "boolean" || !Number.isSafeInteger(identity.version) || identity.version < 1 || typeof identity.contentDigest !== "string" || !SHA256_HEX.test(identity.contentDigest)) {
     throw new EditionProtocolMismatchError(
       EditionProtocolMismatchReason.Malformed,
-      `${label} must be exactly {"contentDigest":"<64 lowercase hex>","provisional":<boolean>,"version":<positive integer>}`
+      `${label2} must be exactly {"contentDigest":"<64 lowercase hex>","provisional":<boolean>,"version":<positive integer>}`
     );
   }
-  assertFinalIdentity(identity, label);
+  assertFinalIdentity(identity, label2);
   return Object.freeze({
     contentDigest: identity.contentDigest,
     provisional: identity.provisional,
@@ -60406,7 +60406,7 @@ function isCanonicalDnsHost(host) {
   }
   const labels = host.split(".");
   return labels.every(
-    (label) => label.length >= 1 && label.length <= MAX_DNS_LABEL_LENGTH && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label)
+    (label2) => label2.length >= 1 && label2.length <= MAX_DNS_LABEL_LENGTH && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label2)
   );
 }
 function isCanonicalRegistryAuthority(authority) {
@@ -60603,17 +60603,17 @@ var PREPARED_EXECUTABLES = /* @__PURE__ */ new WeakMap();
 function sha256Digest(bytes) {
   return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
 }
-function validatePreparedExecutable(record, label) {
+function validatePreparedExecutable(record, label2) {
   const stats = lstatSync(record.path);
   if (!stats.isFile() || stats.isSymbolicLink()) {
     throw new Error(
-      `prepared trusted ${label} must be a no-follow regular file`
+      `prepared trusted ${label2} must be a no-follow regular file`
     );
   }
   if (record.kind === "root-owned") {
     for (const field of ["dev", "ino", "uid", "mode", "size"]) {
       if (stats[field] !== record.snapshot[field]) {
-        throw new Error(`prepared trusted ${label} file identity changed`);
+        throw new Error(`prepared trusted ${label2} file identity changed`);
       }
     }
     let current = record.path;
@@ -60621,7 +60621,7 @@ function validatePreparedExecutable(record, label) {
       const currentStats = lstatSync(current);
       if (currentStats.uid !== 0 || (currentStats.mode & 18) !== 0) {
         throw new Error(
-          `${label} and every ancestor must be root-owned and not group/world writable`
+          `${label2} and every ancestor must be root-owned and not group/world writable`
         );
       }
       if (current === "/") {
@@ -60630,34 +60630,34 @@ function validatePreparedExecutable(record, label) {
       current = dirname2(current);
     }
     if ((stats.mode & 511) !== 493) {
-      throw new Error(`prepared trusted ${label} must have exact mode 0755`);
+      throw new Error(`prepared trusted ${label2} must have exact mode 0755`);
     }
   }
   if (sha256Digest(readFileSync2(record.path)) !== record.digest) {
-    throw new Error(`prepared trusted ${label} bytes changed`);
+    throw new Error(`prepared trusted ${label2} bytes changed`);
   }
 }
 function prepareDigestPinnedExecutable({
   executablePath,
   trustedDigests,
-  label,
+  label: label2,
   verifyVersion
 }) {
   if (!isAbsolute2(executablePath)) {
-    throw new Error(`${label} executable path must be absolute`);
+    throw new Error(`${label2} executable path must be absolute`);
   }
   const sourceStats = lstatSync(executablePath);
   if (!sourceStats.isFile() || sourceStats.isSymbolicLink()) {
-    throw new Error(`${label} executable must be a no-follow regular file`);
+    throw new Error(`${label2} executable must be a no-follow regular file`);
   }
   const bytes = readFileSync2(executablePath);
   const digest = sha256Digest(bytes);
   if (!trustedDigests.includes(digest)) {
     throw new Error(
-      `${label} executable digest ${digest} is not trusted by policy`
+      `${label2} executable digest ${digest} is not trusted by policy`
     );
   }
-  const directory = mkdtempSync(join4(tmpdir(), `xema-trusted-${label}-`));
+  const directory = mkdtempSync(join4(tmpdir(), `xema-trusted-${label2}-`));
   const privatePath = join4(directory, basename2(executablePath));
   try {
     let descriptor;
@@ -60695,15 +60695,15 @@ function prepareDigestPinnedExecutable({
 function prepareRootOwnedPinnedExecutable({
   executablePath,
   trustedDigests,
-  label,
+  label: label2,
   verifyVersion
 }) {
   if (!isAbsolute2(executablePath)) {
-    throw new Error(`${label} executable path must be absolute`);
+    throw new Error(`${label2} executable path must be absolute`);
   }
   const initialStats = lstatSync(executablePath);
   if (!initialStats.isFile() || initialStats.isSymbolicLink()) {
-    throw new Error(`${label} executable must be a no-follow regular file`);
+    throw new Error(`${label2} executable must be a no-follow regular file`);
   }
   const handle = { path: executablePath, dispose() {
   } };
@@ -60720,22 +60720,22 @@ function prepareRootOwnedPinnedExecutable({
     }
   };
   PREPARED_EXECUTABLES.set(handle, record);
-  validatePreparedExecutable(record, label);
+  validatePreparedExecutable(record, label2);
   if (!trustedDigests.includes(record.digest)) {
     throw new Error(
-      `${label} executable digest ${record.digest} is not trusted by policy`
+      `${label2} executable digest ${record.digest} is not trusted by policy`
     );
   }
   verifyVersion(executablePath);
-  validatePreparedExecutable(record, label);
+  validatePreparedExecutable(record, label2);
   return handle;
 }
-function assertPreparedExecutable(handle, label) {
+function assertPreparedExecutable(handle, label2) {
   const record = PREPARED_EXECUTABLES.get(handle);
   if (!record) {
-    throw new Error(`a prepared trusted ${label} executable is required`);
+    throw new Error(`a prepared trusted ${label2} executable is required`);
   }
-  validatePreparedExecutable(record, label);
+  validatePreparedExecutable(record, label2);
   return record.path;
 }
 function exactExecutableOutput(path, args, options = {}) {
@@ -60805,13 +60805,13 @@ function prepareTrustedGitBinary({ gitBinary, policy }) {
     }
   });
 }
-function assertContained(root2, candidate, label, within) {
+function assertContained(root2, candidate, label2, within) {
   const rel = relative2(root2, candidate);
   if (rel === ".." || rel.startsWith(`..${sep2}`) || isAbsolute3(rel)) {
-    throw new Error(`${label} is outside ${within}`);
+    throw new Error(`${label2} is outside ${within}`);
   }
 }
-function assertProtectedPathAncestry(path, label) {
+function assertProtectedPathAncestry(path, label2) {
   const currentUid = typeof process.getuid === "function" ? process.getuid() : void 0;
   let current = realpathSync3(path);
   while (true) {
@@ -60820,7 +60820,7 @@ function assertProtectedPathAncestry(path, label) {
     const groupOrWorldWritable = (stats.mode & 18) !== 0;
     if (foreignOwner || groupOrWorldWritable) {
       throw new Error(
-        `${label} and every ancestor must be verifier/root-owned and not group/world writable — ${current} is ${foreignOwner ? `owned by uid ${stats.uid} (running as uid ${currentUid})` : `mode ${(stats.mode & 4095).toString(8).padStart(4, "0")}`}`
+        `${label2} and every ancestor must be verifier/root-owned and not group/world writable — ${current} is ${foreignOwner ? `owned by uid ${stats.uid} (running as uid ${currentUid})` : `mode ${(stats.mode & 4095).toString(8).padStart(4, "0")}`}`
       );
     }
     if (current === "/") {
@@ -60848,31 +60848,31 @@ function dirtyPaths(trustedGit, repositoryRoot) {
   }
   return entries;
 }
-function assertSafeWorktreeFile(path, expectedMode, label) {
+function assertSafeWorktreeFile(path, expectedMode, label2) {
   const stats = lstatSync2(path);
   if (!stats.isFile() || stats.isSymbolicLink()) {
-    throw new Error(`${label} must be a no-follow regular file`);
+    throw new Error(`${label2} must be a no-follow regular file`);
   }
   if (typeof process.getuid === "function" && stats.uid !== process.getuid()) {
-    throw new Error(`${label} is not owned by the current user`);
+    throw new Error(`${label2} is not owned by the current user`);
   }
   const actualMode = stats.mode & 511;
   if (actualMode !== expectedMode || (actualMode & 18) !== 0) {
     throw new Error(
-      `${label} must have exact mode ${expectedMode.toString(8)}`
+      `${label2} must have exact mode ${expectedMode.toString(8)}`
     );
   }
 }
-function parseTreeRecord(record, expectedPath, label) {
+function parseTreeRecord(record, expectedPath, label2) {
   const match = /^(100644|100755) blob ([a-f0-9]{40,64})\t(.+)$/.exec(record);
   if (!match || match[3] !== expectedPath) {
     throw new Error(
-      `${label} "${expectedPath}" is absent or has an untrusted HEAD mode`
+      `${label2} "${expectedPath}" is absent or has an untrusted HEAD mode`
     );
   }
   return { mode: match[1], objectId: match[2] };
 }
-function assertNormalIndexFlags(trustedGit, repositoryRoot, path, label) {
+function assertNormalIndexFlags(trustedGit, repositoryRoot, path, label2) {
   const tagged = git(
     trustedGit,
     repositoryRoot,
@@ -60881,7 +60881,7 @@ function assertNormalIndexFlags(trustedGit, repositoryRoot, path, label) {
   ).toString("utf8").split("\0").filter(Boolean);
   if (tagged.length !== 1 || !tagged[0].startsWith("H ")) {
     throw new Error(
-      `${label} "${path}" has skip-worktree, assume-unchanged, or unexpected index state`
+      `${label2} "${path}" has skip-worktree, assume-unchanged, or unexpected index state`
     );
   }
   const debug = git(trustedGit, repositoryRoot, [
@@ -60892,10 +60892,10 @@ function assertNormalIndexFlags(trustedGit, repositoryRoot, path, label) {
   ]);
   const flags = /\bflags:\s+(\d+)\s*$/m.exec(debug);
   if (!flags || flags[1] !== "0") {
-    throw new Error(`${label} "${path}" has non-zero Git index flags`);
+    throw new Error(`${label2} "${path}" has non-zero Git index flags`);
   }
 }
-function assertHeadBoundPath(trustedGit, repositoryRoot, path, label) {
+function assertHeadBoundPath(trustedGit, repositoryRoot, path, label2) {
   const records = git(
     trustedGit,
     repositoryRoot,
@@ -60903,21 +60903,21 @@ function assertHeadBoundPath(trustedGit, repositoryRoot, path, label) {
     "buffer"
   ).toString("utf8").split("\0").filter(Boolean);
   if (records.length !== 1) {
-    throw new Error(`${label} "${path}" is not one exact HEAD blob`);
+    throw new Error(`${label2} "${path}" is not one exact HEAD blob`);
   }
-  const { mode, objectId } = parseTreeRecord(records[0], path, label);
-  assertNormalIndexFlags(trustedGit, repositoryRoot, path, label);
+  const { mode, objectId } = parseTreeRecord(records[0], path, label2);
+  assertNormalIndexFlags(trustedGit, repositoryRoot, path, label2);
   const absolutePath = resolve3(repositoryRoot, path);
   assertContained(
     repositoryRoot,
     absolutePath,
-    `${label} "${path}"`,
+    `${label2} "${path}"`,
     `the checkout ${repositoryRoot}`
   );
   assertSafeWorktreeFile(
     absolutePath,
     mode === "100755" ? 493 : 420,
-    `${label} "${path}"`
+    `${label2} "${path}"`
   );
   const headBytes = git(
     trustedGit,
@@ -60926,10 +60926,10 @@ function assertHeadBoundPath(trustedGit, repositoryRoot, path, label) {
     "buffer"
   );
   if (!readFileSync3(absolutePath).equals(headBytes)) {
-    throw new Error(`${label} "${path}" does not match its HEAD blob`);
+    throw new Error(`${label2} "${path}" does not match its HEAD blob`);
   }
 }
-function locateCheckout({ root: root2, trustedGit, label }) {
+function locateCheckout({ root: root2, trustedGit, label: label2 }) {
   assertPreparedExecutable(trustedGit, "git");
   let repositoryRoot;
   try {
@@ -60937,16 +60937,16 @@ function locateCheckout({ root: root2, trustedGit, label }) {
       git(trustedGit, root2, ["rev-parse", "--show-toplevel"]).trim()
     );
   } catch {
-    throw new Error(`${label} verification requires a trusted Git checkout`);
+    throw new Error(`${label2} verification requires a trusted Git checkout`);
   }
   const gitDirectory = realpathSync3(
     git(trustedGit, repositoryRoot, ["rev-parse", "--absolute-git-dir"]).trim()
   );
   return { repositoryRoot, gitDirectory };
 }
-function assertTrustedCheckoutLocation({ repositoryRoot, gitDirectory }, label) {
-  assertProtectedPathAncestry(repositoryRoot, `${label} checkout`);
-  assertProtectedPathAncestry(gitDirectory, `${label} Git directory`);
+function assertTrustedCheckoutLocation({ repositoryRoot, gitDirectory }, label2) {
+  assertProtectedPathAncestry(repositoryRoot, `${label2} checkout`);
+  assertProtectedPathAncestry(gitDirectory, `${label2} Git directory`);
 }
 function verifyCheckoutContents({
   repositoryRoot,
@@ -60965,10 +60965,10 @@ function verifyCheckoutContents({
   if (expectedCommit !== void 0 && commit !== expectedCommit) {
     throw new Error(`${repositoryRoot} HEAD changed during verification`);
   }
-  for (const { root: root2, label, requiredPaths } of requirements) {
+  for (const { root: root2, label: label2, requiredPaths } of requirements) {
     if (requiredPaths.length === 0) {
       throw new Error(
-        `the ${label} checkout is graded for at least one path; none was named`
+        `the ${label2} checkout is graded for at least one path; none was named`
       );
     }
     for (const requiredPath of requiredPaths) {
@@ -60976,14 +60976,14 @@ function verifyCheckoutContents({
       assertContained(
         root2,
         absolutePath,
-        `${label} path "${requiredPath}"`,
-        `the ${label} ${root2}`
+        `${label2} path "${requiredPath}"`,
+        `the ${label2} ${root2}`
       );
       assertHeadBoundPath(
         trustedGit,
         repositoryRoot,
         relative2(repositoryRoot, absolutePath).split(sep2).join("/"),
-        label
+        label2
       );
     }
   }
@@ -60999,16 +60999,16 @@ function verifyCheckoutContents({
 }
 function gradeTrustedCheckouts({ grades, trustedGit, expected }) {
   const byRepository = /* @__PURE__ */ new Map();
-  for (const { root: root2, label, requiredPaths } of grades) {
+  for (const { root: root2, label: label2, requiredPaths } of grades) {
     const canonicalRoot = realpathSync3(root2);
-    const location = locateCheckout({ root: canonicalRoot, trustedGit, label });
+    const location = locateCheckout({ root: canonicalRoot, trustedGit, label: label2 });
     const group = byRepository.get(location.repositoryRoot) ?? {
       location,
       labels: [],
       requirements: []
     };
-    group.labels.push(label);
-    group.requirements.push({ root: canonicalRoot, label, requiredPaths });
+    group.labels.push(label2);
+    group.requirements.push({ root: canonicalRoot, label: label2, requiredPaths });
     byRepository.set(location.repositoryRoot, group);
   }
   if (expected !== void 0) {
@@ -61044,12 +61044,12 @@ function gradeTrustedCheckouts({ grades, trustedGit, expected }) {
   }
   return result;
 }
-function assertExternalInput(repositoryRoots, path, label) {
+function assertExternalInput(repositoryRoots, path, label2) {
   const canonical = realpathSync3(path);
   for (const repositoryRoot of repositoryRoots) {
     const rel = relative2(repositoryRoot, canonical);
     if (rel === "" || !rel.startsWith(`..${sep2}`) && rel !== "..") {
-      throw new Error(`${label} must be outside the checkout ${repositoryRoot}`);
+      throw new Error(`${label2} must be outside the checkout ${repositoryRoot}`);
     }
   }
   return canonical;
@@ -61075,6 +61075,87 @@ import {
 } from "node:path";
 import { TextDecoder as TextDecoder2 } from "node:util";
 
+// edition/edition-source-pins.mjs
+var SOURCE_PINS_KEY = "sourcePins";
+var SOURCE_PIN_KEYS = Object.freeze(["ref", "repo", "until"]);
+var GRAPH_REPO = /^(repos|submodules)\/[a-z0-9][a-z0-9-]*$/;
+var EditionSourcePinsError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "EditionSourcePinsError";
+  }
+};
+var label = (id) => id === void 0 ? "" : `edition "${id}": `;
+function parseEditionSourcePins(raw, id) {
+  if (raw === void 0) {
+    return [];
+  }
+  if (!Array.isArray(raw) || raw.length === 0) {
+    throw new EditionSourcePinsError(`${label(id)}"${SOURCE_PINS_KEY}" must be a non-empty array of {repo, ref, until}; got ${JSON.stringify(raw)}`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return raw.map((entry, index) => {
+    const where = `${label(id)}${SOURCE_PINS_KEY}[${index}] ${JSON.stringify(entry)}`;
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry) || Object.keys(entry).sort().join() !== SOURCE_PIN_KEYS.join()) {
+      throw new EditionSourcePinsError(`${where} must be exactly {repo, ref, until}; \`until\` (the exit condition of the hold) is required`);
+    }
+    if (typeof entry.repo !== "string" || !GRAPH_REPO.test(entry.repo)) {
+      throw new EditionSourcePinsError(`${where}: repo must be a repository path (repos/<name> or submodules/<name>)`);
+    }
+    if (typeof entry.ref !== "string" || !COMMIT_PATTERN.test(entry.ref)) {
+      throw new EditionSourcePinsError(`${where}: ref must be an exact lowercase 40-hex commit, not a branch, tag or abbreviation`);
+    }
+    if (typeof entry.until !== "string" || entry.until.trim().length === 0) {
+      throw new EditionSourcePinsError(`${where}: until must be non-empty text stating when the hold ends`);
+    }
+    if (seen.has(entry.repo)) {
+      throw new EditionSourcePinsError(`${where}: repo ${entry.repo} is pinned twice`);
+    }
+    seen.add(entry.repo);
+    return Object.freeze({ repo: entry.repo, ref: entry.ref, until: entry.until });
+  });
+}
+function splitEditionDefinition(raw, id) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw) || !Object.hasOwn(raw, SOURCE_PINS_KEY)) {
+    return { document: raw, sourcePins: [] };
+  }
+  const { [SOURCE_PINS_KEY]: declared, ...document } = raw;
+  return { document, sourcePins: parseEditionSourcePins(declared, id) };
+}
+var canonicalRepositoryUrl = (url) => String(url).replace(/\.git$/u, "");
+function effectiveRepositoryPins(committedRepositoryPins, sourcePins, { id, contractAuthority } = {}) {
+  if (sourcePins === void 0 || sourcePins.length === 0) {
+    return committedRepositoryPins;
+  }
+  if (typeof contractAuthority?.repositoryUrl !== "string") {
+    throw new EditionSourcePinsError(`${label(id)}held pins are computed against the index's contractAuthority, and none was given`);
+  }
+  const kernelUrl = canonicalRepositoryUrl(contractAuthority.repositoryUrl);
+  const held = new Map(sourcePins.map((pin) => [pin.repo, pin.ref]));
+  for (const repo of held.keys()) {
+    const committed = committedRepositoryPins.find((pin) => pin.repo === repo);
+    if (committed === void 0) {
+      throw new EditionSourcePinsError(
+        `${label(id)}${SOURCE_PINS_KEY} holds ${repo}, which has no repository pin in runtime-image-source-index.json (not an image source repository)`
+      );
+    }
+    const ref = held.get(repo);
+    if (committed.sourceCommit === ref && committed.vendoredSourceCommit === ref) {
+      throw new EditionSourcePinsError(
+        `${label(id)}${SOURCE_PINS_KEY} entry for ${repo} is not a hold: ${ref} is the shared repository pin; remove it (xema edition unpin)`
+      );
+    }
+    if (canonicalRepositoryUrl(committed.repositoryUrl) === kernelUrl) {
+      throw new EditionSourcePinsError(
+        `${label(id)}${SOURCE_PINS_KEY} may not hold ${repo}: it is the kernel contract repository, whose authority is the data root's alone`
+      );
+    }
+  }
+  return committedRepositoryPins.map(
+    (pin) => held.has(pin.repo) ? { ...pin, sourceCommit: held.get(pin.repo), vendoredSourceCommit: held.get(pin.repo) } : pin
+  );
+}
+
 // edition/kernel-contract-authority.mjs
 var GIT_ENV2 = Object.freeze({
   GIT_CONFIG_NOSYSTEM: "1",
@@ -61099,10 +61180,10 @@ var GIT_MAX_BUFFER = 1024 * 1024 * 1024;
 function exactAuthorityJson(value) {
   return JSON.stringify(value);
 }
-function assertKernelContractAuthorityEqual(actual, expected, label) {
+function assertKernelContractAuthorityEqual(actual, expected, label2) {
   if (exactAuthorityJson(actual) !== exactAuthorityJson(expected)) {
     throw new Error(
-      `${label} does not exactly match kernel contract authority`
+      `${label2} does not exactly match kernel contract authority`
     );
   }
   return actual;
@@ -61151,56 +61232,56 @@ function canonicalJsonBytes(value) {
 function sha256Digest2(bytes) {
   return `sha256:${createHash2("sha256").update(bytes).digest("hex")}`;
 }
-function decodeExactUtf8(bytes, label) {
+function decodeExactUtf8(bytes, label2) {
   let text2;
   try {
     text2 = STRICT_UTF8.decode(bytes);
   } catch {
-    throw new Error(`${label} contains invalid UTF-8`);
+    throw new Error(`${label2} contains invalid UTF-8`);
   }
   if (!Buffer.from(text2, "utf8").equals(bytes)) {
-    throw new Error(`${label} is not exact UTF-8`);
+    throw new Error(`${label2} is not exact UTF-8`);
   }
   return text2;
 }
-function parseCanonicalJsonBytes(bytes, label) {
-  const text2 = decodeExactUtf8(bytes, label);
+function parseCanonicalJsonBytes(bytes, label2) {
+  const text2 = decodeExactUtf8(bytes, label2);
   let value;
   try {
     value = JSON.parse(text2);
   } catch (error) {
-    throw new Error(`${label} is not valid JSON: ${error.message}`);
+    throw new Error(`${label2} is not valid JSON: ${error.message}`);
   }
   const canonical = canonicalJsonBytes(value);
   if (!bytes.equals(canonical)) {
     throw new Error(
-      `${label} is not canonical JSON (duplicate keys, non-canonical ordering, or whitespace are refused)`
+      `${label2} is not canonical JSON (duplicate keys, non-canonical ordering, or whitespace are refused)`
     );
   }
   return value;
 }
-function readExactDescriptorFile(root2, path, expectedDigest, label, maxBytes) {
+function readExactDescriptorFile(root2, path, expectedDigest, label2, maxBytes) {
   if (!SHA256_DIGEST_PATTERN.test(expectedDigest)) {
-    throw new Error(`${label} has an invalid expected sha256 digest`);
+    throw new Error(`${label2} has an invalid expected sha256 digest`);
   }
   const { path: resolved, bytes } = readBoundedNoFollowFile(
     root2,
     path,
-    `${label} path`,
+    `${label2} path`,
     maxBytes
   );
   const actual = sha256Digest2(bytes);
   if (actual !== expectedDigest) {
     throw new Error(
-      `${label} digest mismatch: expected ${expectedDigest}, got ${actual}`
+      `${label2} digest mismatch: expected ${expectedDigest}, got ${actual}`
     );
   }
   return { path: resolved, bytes };
 }
-function readCanonicalJsonFromRoot(root2, path, label, maxBytes = MAX_CANONICAL_JSON_BYTES) {
+function readCanonicalJsonFromRoot(root2, path, label2, maxBytes = MAX_CANONICAL_JSON_BYTES) {
   return parseCanonicalJsonBytes(
-    readBoundedNoFollowFile(root2, path, label, maxBytes).bytes,
-    label
+    readBoundedNoFollowFile(root2, path, label2, maxBytes).bytes,
+    label2
   );
 }
 function validatePinnedTrustedRoot(policyRoot, policy) {
@@ -61222,24 +61303,24 @@ function validatePinnedTrustedRoot(policyRoot, policy) {
   }
   return { path: trustedRoot, bytes: rootBytes };
 }
-function assertTimeWindow({ issuedAt, expiresAt, now, maxTtlSeconds, label }) {
+function assertTimeWindow({ issuedAt, expiresAt, now, maxTtlSeconds, label: label2 }) {
   const issued = Date.parse(issuedAt);
   const expires = Date.parse(expiresAt);
   const instant = now instanceof Date ? now.getTime() : Date.parse(now);
   if (![issued, expires, instant].every(Number.isFinite)) {
-    throw new Error(`${label} has an invalid time`);
+    throw new Error(`${label2} has an invalid time`);
   }
   if (issued > instant) {
-    throw new Error(`${label} is not yet valid`);
+    throw new Error(`${label2} is not yet valid`);
   }
   if (expires <= instant) {
-    throw new Error(`${label} is expired`);
+    throw new Error(`${label2} is expired`);
   }
   if (expires <= issued) {
-    throw new Error(`${label} expiresAt must be after issuedAt`);
+    throw new Error(`${label2} expiresAt must be after issuedAt`);
   }
   if (expires - issued > maxTtlSeconds * 1e3) {
-    throw new Error(`${label} exceeds the trusted maximum TTL`);
+    throw new Error(`${label2} exceeds the trusted maximum TTL`);
   }
 }
 function sourceIdentity(subject) {
@@ -61254,24 +61335,24 @@ function comparePlatform(left, right) {
 function platformIdentity(platform) {
   return `${platform.os}/${platform.architecture}/${platform.variant ?? ""}`;
 }
-function assertPlatforms(platforms, requiredPlatforms, label) {
+function assertPlatforms(platforms, requiredPlatforms, label2) {
   if (platforms.length === 0) {
-    throw new Error(`${label} omits its complete platform set`);
+    throw new Error(`${label2} omits its complete platform set`);
   }
   const sorted = [...platforms].sort(comparePlatform);
   if (canonicalJson(platforms) !== canonicalJson(sorted)) {
-    throw new Error(`${label} platforms are not canonically ordered`);
+    throw new Error(`${label2} platforms are not canonically ordered`);
   }
   const identities = /* @__PURE__ */ new Set();
   const digests = /* @__PURE__ */ new Set();
   for (const platform of platforms) {
     const identity = platformIdentity(platform);
     if (identities.has(identity)) {
-      throw new Error(`${label} has duplicate platform "${identity}"`);
+      throw new Error(`${label2} has duplicate platform "${identity}"`);
     }
     if (digests.has(platform.manifestDigest)) {
       throw new Error(
-        `${label} reuses platform digest "${platform.manifestDigest}"`
+        `${label2} reuses platform digest "${platform.manifestDigest}"`
       );
     }
     identities.add(identity);
@@ -61283,7 +61364,7 @@ function assertPlatforms(platforms, requiredPlatforms, label) {
   ].filter((identity) => !actualIdentities.has(identity)).sort();
   if (missing.length > 0) {
     throw new Error(
-      `${label} attests platforms ${[...actualIdentities].sort().join(", ")}, which omit ${missing.join(", ")} required by images.lock.json`
+      `${label2} attests platforms ${[...actualIdentities].sort().join(", ")}, which omit ${missing.join(", ")} required by images.lock.json`
     );
   }
 }
@@ -61310,24 +61391,24 @@ function validateProducerStatementBinding({
     );
   }
   const { predicate } = statement;
-  const label = `producer evidence for ${subject.kind}:${subject.id}`;
+  const label2 = `producer evidence for ${subject.kind}:${subject.id}`;
   assertKernelContractAuthorityEqual(
     predicate.contractAuthority,
     expectedContractAuthority,
-    label
+    label2
   );
   assertTimeWindow({
     issuedAt: predicate.producerRun.issuedAt,
     expiresAt: predicate.producerRun.expiresAt,
     now,
     maxTtlSeconds,
-    label
+    label: label2
   });
   if (consumedNonces.has(predicate.producerRun.nonce)) {
-    throw new Error(`${label} replays an already-consumed nonce`);
+    throw new Error(`${label2} replays an already-consumed nonce`);
   }
   if (repositoryPin?.repo !== subject.repo || repositoryPin.sourceCommit !== subject.sourceCommit) {
-    throw new Error(`${label} does not match the committed repository pin`);
+    throw new Error(`${label2} does not match the committed repository pin`);
   }
   const expectedSource = {
     kind: subject.kind,
@@ -61344,22 +61425,22 @@ function validateProducerStatementBinding({
     sourceTreeHash: subject.contentHash
   };
   if (canonicalJson(predicate.source) !== canonicalJson(expectedSource)) {
-    throw new Error(`${label} source identity does not match images.lock.json`);
+    throw new Error(`${label2} source identity does not match images.lock.json`);
   }
   if (statement.subject[0].name !== subject.imageRef || `sha256:${statement.subject[0].digest.sha256}` !== predicate.artifact.manifestDigest || predicate.artifact.imageRepository !== subject.imageRef) {
-    throw new Error(`${label} has an OCI subject/digest substitution`);
+    throw new Error(`${label2} has an OCI subject/digest substitution`);
   }
   if (typeof subject.imageDigest !== "string") {
     throw new Error(
-      `${label}: images.lock.json seals no imageDigest for ${subject.kind}:${subject.id}, so the attested manifest is bound to nothing. Run \`xema edition seal\` first.`
+      `${label2}: images.lock.json seals no imageDigest for ${subject.kind}:${subject.id}, so the attested manifest is bound to nothing. Run \`xema edition seal\` first.`
     );
   }
   if (subject.imageDigest !== predicate.artifact.manifestDigest) {
     throw new Error(
-      `${label} attests manifest ${predicate.artifact.manifestDigest} but images.lock.json seals ${subject.imageDigest} for ${subject.imageRef}`
+      `${label2} attests manifest ${predicate.artifact.manifestDigest} but images.lock.json seals ${subject.imageDigest} for ${subject.imageRef}`
     );
   }
-  assertPlatforms(predicate.build.platforms, subject.requiredPlatforms, label);
+  assertPlatforms(predicate.build.platforms, subject.requiredPlatforms, label2);
   const authorizedBuildIdentity = Boolean(producerPolicy) && producerPolicy.builderIds.includes(predicate.build.builderId) && producerPolicy.buildTypes.includes(predicate.build.buildType) && producerPolicy.manifestMediaTypes.includes(
     predicate.artifact.manifestMediaType
   ) && pinnedAllowlistAdmits(
@@ -61371,7 +61452,7 @@ function validateProducerStatementBinding({
   );
   if (!authorizedBuildIdentity) {
     throw new Error(
-      `${label} build identity, definition, parameters, or OCI media type is not authorized`
+      `${label2} build identity, definition, parameters, or OCI media type is not authorized`
     );
   }
   const protectedDigests = /* @__PURE__ */ new Set([
@@ -61381,7 +61462,7 @@ function validateProducerStatementBinding({
   ]);
   if (protectedDigests.size !== 3) {
     throw new Error(
-      `${label} substitutes an image, SBOM, or provenance digest`
+      `${label2} substitutes an image, SBOM, or provenance digest`
     );
   }
   return statement;
@@ -61404,32 +61485,32 @@ function validateCompletenessStatementBinding({
   evidenceNonces = /* @__PURE__ */ new Set()
 }) {
   const { predicate } = statement;
-  const label = `distribution completeness for ${imageLock.distributionId}`;
+  const label2 = `distribution completeness for ${imageLock.distributionId}`;
   assertTimeWindow({
     issuedAt: predicate.issuedAt,
     expiresAt: predicate.expiresAt,
     now,
     maxTtlSeconds,
-    label
+    label: label2
   });
   if (evidenceNonces.has(predicate.nonce)) {
-    throw new Error(`${label} reuses a producer nonce`);
+    throw new Error(`${label2} reuses a producer nonce`);
   }
   if (predicate.releaseSourceCommit !== expectedReleaseSourceCommit) {
     throw new Error(
-      `${label} does not bind the exact editions release source commit`
+      `${label2} does not bind the exact editions release source commit`
     );
   }
   const lockDigest = normalizedImageLockDigest(imageLock);
   if (predicate.distributionId !== distributionLock.distributionId || predicate.distributionInputHash !== distributionLock.inputHash || predicate.normalizedImageLockDigest !== lockDigest || statement.subject[0].name !== `xema-distribution/${distributionLock.distributionId}` || `sha256:${statement.subject[0].digest.sha256}` !== lockDigest) {
-    throw new Error(`${label} does not bind the selected distribution locks`);
+    throw new Error(`${label2} does not bind the selected distribution locks`);
   }
   const expectedImages = imageLock.subjects.map((subject) => {
     const key = sourceIdentity(subject);
     const producer = verifiedProducers.get(key);
     const descriptor = evidenceDescriptors.get(key);
     if (!producer || !descriptor) {
-      throw new Error(`${label} omits producer evidence for ${key}`);
+      throw new Error(`${label2} omits producer evidence for ${key}`);
     }
     return {
       subjectKind: subject.kind,
@@ -61444,7 +61525,7 @@ function validateCompletenessStatementBinding({
   const expected = normalizedCompletenessImages(expectedImages);
   if (canonicalJson(predicate.images) !== canonicalJson(actual) || canonicalJson(actual) !== canonicalJson(expected)) {
     throw new Error(
-      `${label} image set is incomplete, contains extras, or is not canonically ordered`
+      `${label2} image set is incomplete, contains extras, or is not canonically ordered`
     );
   }
   return statement;
@@ -61461,30 +61542,30 @@ function validateEntitlementStatementBinding({
   consumedNonces = /* @__PURE__ */ new Set()
 }) {
   const { predicate } = statement;
-  const label = `delivery entitlement for ${customerId}`;
+  const label2 = `delivery entitlement for ${customerId}`;
   assertTimeWindow({
     issuedAt: predicate.issuedAt,
     expiresAt: predicate.expiresAt,
     now,
     maxTtlSeconds,
-    label
+    label: label2
   });
   if (consumedNonces.has(predicate.nonce)) {
-    throw new Error(`${label} is replayed`);
+    throw new Error(`${label2} is replayed`);
   }
   if (predicate.customerId !== customerId || predicate.distributionId !== distributionId || predicate.distributionStatementDigest !== completenessStatementDigest || predicate.mode !== mode || predicate.targetRegistry !== targetRegistry) {
     throw new Error(
-      `${label} does not authorize the requested customer, distribution, mode, and target`
+      `${label2} does not authorize the requested customer, distribution, mode, and target`
     );
   }
   if (statement.subject[0].name !== `xema-distribution/${distributionId}` || `sha256:${statement.subject[0].digest.sha256}` !== completenessStatementDigest) {
-    throw new Error(`${label} substitutes the distribution release`);
+    throw new Error(`${label2} substitutes the distribution release`);
   }
   return statement;
 }
-function assertKernelPredicateAccepted(label, refusal) {
+function assertKernelPredicateAccepted(label2, refusal) {
   if (refusal !== void 0) {
-    throw new Error(`${label} is refused: ${refusal}`);
+    throw new Error(`${label2} is refused: ${refusal}`);
   }
 }
 function assertEvidenceChannel(channel) {
@@ -62014,19 +62095,21 @@ async function loadValidatedImageLocks(distributionId, dataRoot2, schemas2, { ed
       "images.lock.json kernel contract authority does not exactly match runtime-image-source-index.json"
     );
   }
-  const repositoryPins = new Map(
-    runtimeSourceIndex.repositoryPins.map((repository) => [
-      repository.repo,
-      repository
-    ])
-  );
-  const distribution2 = schemas2.parseDistribution(
+  const { document, sourcePins } = splitEditionDefinition(
     JSON.parse(
       readFileSync4(
         join5(editionsRoot2, distributionId, "xema-distribution.json"),
         "utf8"
       )
-    )
+    ),
+    distributionId
+  );
+  const distribution2 = schemas2.parseDistribution(document);
+  const repositoryPins = new Map(
+    effectiveRepositoryPins(runtimeSourceIndex.repositoryPins, sourcePins, { id: distributionId, contractAuthority: runtimeSourceIndex.contractAuthority }).map((repository) => [
+      repository.repo,
+      repository
+    ])
   );
   if (distribution2.id !== distributionId) {
     throw new Error(
@@ -62100,11 +62183,11 @@ function loadDeclaredTrustPolicy({ dataRoot: dataRoot2, declaration, schemas: sc
   return Object.freeze({ policy, policyDigest: trustPolicyDigest(policy) });
 }
 function readEvidenceTrustPin({ dataRoot: dataRoot2, declaration }) {
-  const label = "declared image evidence trust pin";
+  const label2 = "declared image evidence trust pin";
   const { bytes } = readBoundedNoFollowFile(
     dataRoot2,
     declaration.pin,
-    label,
+    label2,
     MAX_PIN_BYTES
   );
   const pin = parseStrictJson(bytes.toString("utf8"), declaration.pin);
@@ -62169,12 +62252,12 @@ function readStatedKernelContractAuthority({ dataRoot: dataRoot2, schemas: schem
   );
   return schemas2.parseRuntimeImageSourceIndex(JSON.parse(bytes.toString("utf8"))).contractAuthority;
 }
-function assertPinnedKernelContractAuthority({ pin, authority, label }) {
+function assertPinnedKernelContractAuthority({ pin, authority, label: label2 }) {
   const actual = kernelContractAuthorityPin(authority);
   if (actual.sourceCommit !== pin.kernelContractAuthority.sourceCommit || actual.digest !== pin.kernelContractAuthority.digest) {
     throw new KernelContractAuthorityPinError(
       KERNEL_CONTRACT_AUTHORITY_NOT_PINNED_ONE,
-      `${label} states kernel contract authority ${actual.sourceCommit} (${actual.digest}) but the pin records ${pin.kernelContractAuthority.sourceCommit} (${pin.kernelContractAuthority.digest}); review the kernel contract change, then re-pin with \`${REPIN_COMMAND}\``
+      `${label2} states kernel contract authority ${actual.sourceCommit} (${actual.digest}) but the pin records ${pin.kernelContractAuthority.sourceCommit} (${pin.kernelContractAuthority.digest}); review the kernel contract change, then re-pin with \`${REPIN_COMMAND}\``
     );
   }
   return authority;