@xemahq/xema 0.33.2 → 0.33.4

package/dist/edition/verify-image-evidence.bundle.mjs

@@ -59428,9 +59428,6 @@ function assertCanonicalDistributionId(distributionId) {
   return distributionId;
 }
 
-// edition/edition-channel.mjs
-var EditionChannel = Object.freeze({ Develop: "develop", Release: "release" });
-
 // edition/edition-workspace.mjs
 import { existsSync, realpathSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
@@ -59544,15 +59541,9 @@ var EditionChartSetCheck = Object.freeze({
   MISSING: "missing",
   STALE: "stale"
 });
-var CHART_VERSION_COORDINATE = Object.freeze({
-  [EditionChannel.Release]: /-h[0-9a-f]{16}$/,
-  [EditionChannel.Develop]: /-dev\.[0-9a-f]{12}$/
-});
-var DEVELOP_CHART_VERSION_PREFIX = "0.0.0-dev.";
-var DEVELOP_CHART_SHA_LENGTH = 12;
-var DEVELOP_CHART_VERSION_PATTERN = new RegExp(
-  `^${DEVELOP_CHART_VERSION_PREFIX.replaceAll(".", "\\.")}[0-9a-f]{${DEVELOP_CHART_SHA_LENGTH}}$`
-);
+
+// edition/edition-channel.mjs
+var EditionChannel = Object.freeze({ Develop: "develop", Release: "release" });
 
 // edition/edition-contract-parse.mjs
 var EDITION_CONTRACT_SCHEMA = "xema.edition-contract/v2";
@@ -59664,7 +59655,7 @@ var EDITION_LOCKS = Object.freeze([...EDITION_CONTRACT.locks]);
 var EDITION_FILES = Object.freeze([EDITION_DESCRIPTOR_FILE, ...EDITION_LOCKS]);
 
 // edition/lib.mjs
-import { createRequire as createRequire3 } from "node:module";
+import { createRequire as createRequire4 } from "node:module";
 import { isIP } from "node:net";
 var import_yaml = __toESM(require_dist(), 1);
 
@@ -60350,12 +60341,16 @@ var COMMIT_PATTERN = /^[a-f0-9]{40}$/;
 var SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/;
 var SHA256_DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
 
-// edition/kernel-capability-domain.mjs
+// edition/git-json.mjs
 import { createRequire } from "node:module";
 var requireFromHere = createRequire(import.meta.url);
 
-// edition/operation-requirements.mjs
+// edition/kernel-capability-domain.mjs
 import { createRequire as createRequire2 } from "node:module";
+var requireFromHere2 = createRequire2(import.meta.url);
+
+// edition/operation-requirements.mjs
+import { createRequire as createRequire3 } from "node:module";
 
 // edition/string-order.mjs
 function compareStrings(a, b) {
@@ -60366,7 +60361,7 @@ function compareStrings(a, b) {
 }
 
 // edition/operation-requirements.mjs
-var requireFromHere2 = createRequire2(import.meta.url);
+var requireFromHere3 = createRequire3(import.meta.url);
 var PRINCIPAL_PRIVILEGE_FIELDS = Object.freeze(["requiresOperations", "requiresOrganizationSweeps"]);
 
 // edition/source-authority.mjs
@@ -60376,7 +60371,7 @@ var DistributionSourceMode = Object.freeze({
 });
 
 // edition/lib.mjs
-var requireFromLib = createRequire3(import.meta.url);
+var requireFromLib = createRequire4(import.meta.url);
 var WorkerProtocolKind = Object.freeze({ Worker: "worker", None: "none" });
 var GIT_LS_TREE_MAX_BUFFER = 256 * 1024 * 1024;
 function serializeJson(value) {

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "artifactSha256": "sha256:172a95b35134b37d8f25d140bb3f8f955c3965d11b2e5ad56aa534d0c1556b3f",
+  "artifactSha256": "sha256:4fffbefc61cab2c4844351c1397fd18198f33d58532a4c31b9c333c3627097ba",
   "esbuild": {
     "version": "0.28.2"
   },
@@ -2203,223 +2203,229 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:bbeac7ff01376cb89ed2140526d4795d8e559b3f01612b404a701f19aaa24c6a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/edition-artifact.mjs",
-      "sha256": "sha256:161f522eb39e3db705bc709f8512988dd3e6752851d972521354eeccffd8075d"
+      "sha256": "sha256:e8a391938c88398f63f86fdf413582d3a18eb20c219784a01fa84794bbd22e38"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/edition-chart-set.mjs",
-      "sha256": "sha256:fbda500315d45e35eb974f4701bbf36729c3b642a5d735bc1b07085c91d25b23"
+      "sha256": "sha256:cea98292ffc8bfe2afcc01f327172bc9071a83ef9b62a4e56236f2029d2699a9"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:e3997bd9a0082e02d01760868b2a4f41ed3081e904126b30fdf86e7938dc6137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:71ae51028847ab3430ffec9b229b0516a7705b75a6de1fcfa665f5e1abf8e9bb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:c575e96b70bda82899931eb0b18567988e2e13e664fa498bcbef96b571dcabb4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:aa1a05f1728813a7bdb1e02d9305e9adf641d695e6767305210c67a1d81b38a7"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:2940a0ee8662970722aa2618a1635f8d5b4f5e54b85f09667f71ccf7c2c81b03"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b2190ace174a29875e2a9bd7209460b0ef6de186aca9b31bcd45dc17af57c1ba"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:f7267e93fd7dc07cf65fb8cac2c4439d28a72c1e0acbdeca1648c6859440eb32"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:b9dd5c01903394436530783614efb0cd357d982ed2befd844a39328479773cbc"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
+      "path": "edition/git-json.mjs",
+      "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
+    },
+    {
+      "package": "@xemahq/xema",
+      "version": "0.33.4",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:09945712ecc6524d5f52cfd82141ef4cade45be35210777f6e32818792068881"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:20abdde62a7b037c01ea9bbe1ff1e6094e6b0efd0add2f656f1938a04409bf82"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/lib.mjs",
-      "sha256": "sha256:4777627b3665e154f466251eb684ea7299ecd3c683447f65f2cc5b4041d29bdb"
+      "sha256": "sha256:0e9045632a14cb1a035bce7aac3ad26e7b2211daa3f9c2cd27a55dfd772e3b6b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:ffe6fdc9da6b2974270fc86c11be0c41d0bc6d85c8e3c137d3c3bc00a72fc4f6"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:fbaa6dffbdf4a262a13127bcf37bca791234fae74e327ac250e56ff4b78c1244"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:858b607dde94e2abd00a341f569e18cfa567d4bff139c64a2d60abbb7de4c85e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:62f83f8bb835f360535402d12657156d2c9d6e651b426c2b30a04a2dc2f8d3e8"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:058c849767434e9ba911d9310092bede42e3ef959c75bbd35ff8879dc21ce3ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.33.2",
+      "version": "0.33.4",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/dist/runtime/runner/chart-set-lock.d.ts

@@ -1,9 +1,6 @@
 export declare const CHART_SET_LOCK_ENV = "XEMA_CHART_SET_LOCK";
 export declare const CHART_SET_LOCK_FILENAME = "chart-set.lock.json";
 export declare const CHART_SET_LOCK_SCHEMA_VERSION = 4;
-export declare const DEVELOP_CHART_VERSION_PREFIX = "0.0.0-dev.";
-export declare const DEVELOP_CHART_SHA_LENGTH = 12;
-export declare const DEVELOP_CHART_VERSION_PATTERN: RegExp;
 export declare const CHART_DIGEST_PATTERN: RegExp;
 export interface ChartSetMember {
     readonly version: string;

package/dist/runtime/runner/chart-set-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chart-set-lock.d.ts","sourceRoot":"","sources":["../../../src/runtime/runner/chart-set-lock.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAGxD,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAG7D,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAG/C,eAAO,MAAM,4BAA4B,eAAe,CAAC;AAGzD,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAG3C,eAAO,MAAM,6BAA6B,QAEzC,CAAC;AAGF,eAAO,MAAM,oBAAoB,QAA0B,CAAC;AAG5D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAE3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACvD;AAGD,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAQR;AAQD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAuBlE;AAwID,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAMrD"}
+{"version":3,"file":"chart-set-lock.d.ts","sourceRoot":"","sources":["../../../src/runtime/runner/chart-set-lock.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAGxD,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAG7D,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAG/C,eAAO,MAAM,oBAAoB,QAA0B,CAAC;AAG5D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAE3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACvD;AAGD,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAQR;AAQD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAuBlE;AAuGD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAMrD"}

package/dist/runtime/runner/chart-set-lock.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CHART_DIGEST_PATTERN = exports.DEVELOP_CHART_VERSION_PATTERN = exports.DEVELOP_CHART_SHA_LENGTH = exports.DEVELOP_CHART_VERSION_PREFIX = exports.CHART_SET_LOCK_SCHEMA_VERSION = exports.CHART_SET_LOCK_FILENAME = exports.CHART_SET_LOCK_ENV = void 0;
+exports.CHART_DIGEST_PATTERN = exports.CHART_SET_LOCK_SCHEMA_VERSION = exports.CHART_SET_LOCK_FILENAME = exports.CHART_SET_LOCK_ENV = void 0;
 exports.defaultChartSetLockPath = defaultChartSetLockPath;
 exports.loadChartSetLock = loadChartSetLock;
 exports.isMissingPath = isMissingPath;
@@ -9,9 +9,6 @@ const appliance_context_1 = require("./appliance-context");
 exports.CHART_SET_LOCK_ENV = 'XEMA_CHART_SET_LOCK';
 exports.CHART_SET_LOCK_FILENAME = 'chart-set.lock.json';
 exports.CHART_SET_LOCK_SCHEMA_VERSION = 4;
-exports.DEVELOP_CHART_VERSION_PREFIX = '0.0.0-dev.';
-exports.DEVELOP_CHART_SHA_LENGTH = 12;
-exports.DEVELOP_CHART_VERSION_PATTERN = new RegExp(`^${exports.DEVELOP_CHART_VERSION_PREFIX.replaceAll('.', '\\.')}[0-9a-f]{${exports.DEVELOP_CHART_SHA_LENGTH}}$`);
 exports.CHART_DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
 function defaultChartSetLockPath(env = process.env) {
     const declared = env[exports.CHART_SET_LOCK_ENV];
@@ -83,28 +80,9 @@ function parseChartSetLock(parsed, path) {
 function assertIndexDigest(publisher, index, path) {
     const where = `${path}: publisher '${index}'`;
     if (!Object.hasOwn(publisher, 'indexDigest')) {
-        throw new Error(`${where} carries no 'indexDigest' key (required: sha256:<64 hex> for a ` +
-            'release index, null for a develop snapshot version).');
-    }
-    const { version, indexDigest } = publisher;
-    if (typeof version === 'string' &&
-        version.startsWith(exports.DEVELOP_CHART_VERSION_PREFIX) &&
-        !exports.DEVELOP_CHART_VERSION_PATTERN.test(version)) {
-        throw new Error(`${where} has malformed develop chart version ${JSON.stringify(version)}; ` +
-            `a develop version is exactly ${exports.DEVELOP_CHART_VERSION_PREFIX}<${exports.DEVELOP_CHART_SHA_LENGTH} lowercase hex>.`);
-    }
-    const develop = typeof version === 'string' && exports.DEVELOP_CHART_VERSION_PATTERN.test(version);
-    if (indexDigest === null) {
-        if (!develop) {
-            throw new Error(`${where} has indexDigest null with version ${JSON.stringify(version)}; ` +
-                `null is only for a develop snapshot version (${exports.DEVELOP_CHART_VERSION_PREFIX}<sha12>).`);
-        }
-        return;
-    }
-    if (develop) {
-        throw new Error(`${where} has an indexDigest with develop snapshot version ${String(version)}; ` +
-            'a develop snapshot has no index chart, so indexDigest must be null.');
+        throw new Error(`${where} carries no 'indexDigest' key (required: sha256:<64 hex>).`);
     }
+    const { indexDigest } = publisher;
     if (typeof indexDigest !== 'string' || !exports.CHART_DIGEST_PATTERN.test(indexDigest)) {
         throw new Error(`${where} has a malformed indexDigest (${JSON.stringify(indexDigest)}); ` +
             'expected sha256:<64 hex>.');

package/dist/runtime/runner/chart-set-lock.js.map

@@ -1 +1 @@
-{"version":3,"file":"chart-set-lock.js","sourceRoot":"","sources":["../../../src/runtime/runner/chart-set-lock.ts"],"names":[],"mappings":";;;AA8DA,0DAUC;AAQD,4CAuBC;AAwID,sCAMC;AArPD,qCAAuC;AAEvC,2DAAiE;AAsBpD,QAAA,kBAAkB,GAAG,qBAAqB,CAAC;AAG3C,QAAA,uBAAuB,GAAG,qBAAqB,CAAC;AAGhD,QAAA,6BAA6B,GAAG,CAAC,CAAC;AAGlC,QAAA,4BAA4B,GAAG,YAAY,CAAC;AAG5C,QAAA,wBAAwB,GAAG,EAAE,CAAC;AAG9B,QAAA,6BAA6B,GAAG,IAAI,MAAM,CACrD,IAAI,oCAA4B,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,gCAAwB,IAAI,CAChG,CAAC;AAGW,QAAA,oBAAoB,GAAG,uBAAuB,CAAC;AAkB5D,SAAgB,uBAAuB,CACrC,MAAyB,OAAO,CAAC,GAAG;IAIpC,MAAM,QAAQ,GAAG,GAAG,CAAC,0BAAkB,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,IAAA,8CAA0B,EAAC,EAAE,GAAG,EAAE,CAAC,IAAI,+BAAuB,EAAE,CAAC;AAC7E,CAAC;AAQD,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,kCAAkC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC5E,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,uBAAuB,MAAM,CAAC,KAAK,CAAC,gCAAgC;YACzE,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAe,EAAE,IAAY;IACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qDAAqD,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,KAAK,qCAA6B,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,sBAAsB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS;YACtE,iBAAiB,MAAM,CAAC,qCAA6B,CAAC,oBAAoB;YAC1E,4EAA4E;YAC5E,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sDAAsD,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wDAAwD,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAuB,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,CAAC;QAC/B,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;QACvE,CAAC;QACD,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gBAAgB,KAAK,4BAA4B,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,YAAY,IAAI,8CAA8C;oBACnE,8DAA8D,CACjE,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;AACpD,CAAC;AAOD,SAAS,iBAAiB,CACxB,SAAkC,EAClC,KAAa,EACb,IAAY;IAEZ,MAAM,KAAK,GAAG,GAAG,IAAI,gBAAgB,KAAK,GAAG,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,iEAAiE;YACvE,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IAC3C,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,CAAC,UAAU,CAAC,oCAA4B,CAAC;QAChD,CAAC,qCAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,wCAAwC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI;YACzE,gCAAgC,oCAA4B,IAAI,gCAAwB,kBAAkB,CAC7G,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,qCAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3F,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,sCAAsC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI;gBACvE,gDAAgD,oCAA4B,WAAW,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,qDAAqD,MAAM,CAAC,OAAO,CAAC,IAAI;YAC9E,qEAAqE,CACxE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,4BAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,iCAAiC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK;YACvE,2BAA2B,CAC9B,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAc,EAAE,IAAY;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,aAAa,IAAI,sCAAsC;YAC5D,gEAAgE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CACtC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,QAAQ,CAC/C,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,aAAa,IAAI,iCAAiC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3E,wCAAwC,CAC3C,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,aAAa,IAAI,mBAAmB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,4BAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,aAAa,IAAI,sCAAsC;YAC5D,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,8BAA8B,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAGD,SAAgB,aAAa,CAAC,KAAc;IAC1C,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QACzC,CAAC,CAAE,KAA4B,CAAC,IAAI;QACpC,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC;AACjD,CAAC"}
+{"version":3,"file":"chart-set-lock.js","sourceRoot":"","sources":["../../../src/runtime/runner/chart-set-lock.ts"],"names":[],"mappings":";;;AAmDA,0DAUC;AAQD,4CAuBC;AAuGD,sCAMC;AAzMD,qCAAuC;AAEvC,2DAAiE;AAsBpD,QAAA,kBAAkB,GAAG,qBAAqB,CAAC;AAG3C,QAAA,uBAAuB,GAAG,qBAAqB,CAAC;AAGhD,QAAA,6BAA6B,GAAG,CAAC,CAAC;AAGlC,QAAA,oBAAoB,GAAG,uBAAuB,CAAC;AAkB5D,SAAgB,uBAAuB,CACrC,MAAyB,OAAO,CAAC,GAAG;IAIpC,MAAM,QAAQ,GAAG,GAAG,CAAC,0BAAkB,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,IAAA,8CAA0B,EAAC,EAAE,GAAG,EAAE,CAAC,IAAI,+BAAuB,EAAE,CAAC;AAC7E,CAAC;AAQD,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,kCAAkC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC5E,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,uBAAuB,MAAM,CAAC,KAAK,CAAC,gCAAgC;YACzE,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAe,EAAE,IAAY;IACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qDAAqD,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,KAAK,qCAA6B,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,sBAAsB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS;YACtE,iBAAiB,MAAM,CAAC,qCAA6B,CAAC,oBAAoB;YAC1E,4EAA4E;YAC5E,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sDAAsD,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wDAAwD,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAuB,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,CAAC;QAC/B,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;QACvE,CAAC;QACD,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gBAAgB,KAAK,4BAA4B,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,YAAY,IAAI,8CAA8C;oBACnE,8DAA8D,CACjE,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;AACpD,CAAC;AAGD,SAAS,iBAAiB,CACxB,SAAkC,EAClC,KAAa,EACb,IAAY;IAEZ,MAAM,KAAK,GAAG,GAAG,IAAI,gBAAgB,KAAK,GAAG,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4DAA4D,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IAClC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,4BAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,iCAAiC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK;YACvE,2BAA2B,CAC9B,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAc,EAAE,IAAY;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,aAAa,IAAI,sCAAsC;YAC5D,gEAAgE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CACtC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,QAAQ,CAC/C,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,aAAa,IAAI,iCAAiC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3E,wCAAwC,CAC3C,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,aAAa,IAAI,mBAAmB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,4BAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,aAAa,IAAI,sCAAsC;YAC5D,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,8BAA8B,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAGD,SAAgB,aAAa,CAAC,KAAc;IAC1C,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QACzC,CAAC,CAAE,KAA4B,CAAC,IAAI;QACpC,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC;AACjD,CAAC"}

package/edition/chart-set-source-commit.mjs

@@ -3,14 +3,12 @@
 //
 // The publisher stamps its index chart with `xema.dev/chart-set-source-sha`
 // next to `xema.dev/chart-set-charts`. This verb reads that stamp from the index
-// chart at the digest the committed fleet `chart-set.lock.json` pins (a develop
-// lock has none and is refused), and prints one JSON document. It refuses,
+// chart at the digest the committed fleet `chart-set.lock.json` pins and prints one JSON document. It refuses,
 // printing nothing, when the stamp is absent or is not a 40-hex commit, when the
 // registry does not serve the locked digest, or when the index's roster is not
 // the one the lock records for that publisher: the commit it would name would then be
 // the commit of a different set than the locked one.
 
-import { EditionChannel } from './edition-channel.mjs';
 import { assertRosteredChartSetLock } from './edition-chart-set.mjs';
 import { WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule } from './edition-workspace.mjs';
 import { COMMIT_PATTERN } from './evidence-grammars.mjs';
@@ -59,9 +57,6 @@ export async function chartSetSourceCommits({ client, lock }) {
   const publishers = [];
   for (const { index, repo, version, indexDigest, charts } of lock.publishers) {
     const label = `${index}@${version}`;
-    if (indexDigest === null) {
-      throw new Error(`${label}: a develop chart set names its deploy commit in the snapshot pins, not in an index chart (indexDigest is null)`);
-    }
     // The index is read BY the digest the lock pins, so a re-pushed tag cannot answer.
     const served = await client.getManifestByDigest(registryRepository(index), indexDigest);
     if (served.digest !== indexDigest) {
@@ -89,7 +84,7 @@ async function main(argv) {
   if (lock === null) {
     throw new Error(`${chartSetLockPath()} is missing or is not JSON: run 'xema edition chart-set resolve' first`);
   }
-  assertRosteredChartSetLock(lock, CHART_SET_LOCK_FILE, EditionChannel.Release);
+  assertRosteredChartSetLock(lock, CHART_SET_LOCK_FILE);
   const document = await chartSetSourceCommits({ client: chartRegistryClient(), lock });
   process.stdout.write(serializeJson(document));
 }

package/edition/checkout-indexed-source-repositories.mjs

@@ -4,6 +4,7 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 
+import { readCrossRepoBuildInputsRecord, splitCrossRepoInputKey } from './cross-repo-build-inputs.mjs';
 import { discoverDistributionIds } from './distribution-paths.mjs';
 import { editionWorkspaceConfig } from './edition-config.mjs';
 import { readEditionSourcePins } from './edition-source-pins.mjs';
@@ -120,6 +121,53 @@ export function editionHeldCommits(plan, sourcePinsByEdition) {
   return new Map([...held].map(([repo, commits]) => [repo, [...commits]]));
 }
 
+/**
+ * The commits each checkout must also hold because a consumer's cross-repo
+ * build-input record vendors bytes from them. The resolve hashes those paths at
+ * the record's commit (`resolveCrossRepoVendoredInputs`), and that commit lags
+ * or leads the source repository's own pin. The record is read AT THE
+ * CONSUMER'S PIN, by the same reader the resolve uses, from the consumer's
+ * checkout under `workspaceRoot` (so every repository must already be checked
+ * out). Maps source repo to the distinct such commits, excluding the commits
+ * the checkout already holds. A consumer or source repository without a
+ * repository pin is refused: there is no checkout to read or fetch into.
+ *
+ * @param {{ repo: string, sourceCommit: string, vendoredSourceCommit: string }[]} plan
+ * @returns {Map<string, string[]>}
+ */
+export function crossRepoVendoredCommits(plan, index, workspaceRoot) {
+  const pins = new Map(plan.map((entry) => [entry.repo, entry]));
+  const consumers = [...new Set((index.crossRepoBuildInputs ?? []).map((input) => input.consumerRepo))].sort();
+  const extra = new Map();
+  for (const consumerRepo of consumers) {
+    const consumer = pins.get(consumerRepo);
+    if (!consumer) {
+      throw new Error(`cross-repo build inputs name consumer ${JSON.stringify(consumerRepo)}, which has no repository pin in the runtime image source index`);
+    }
+    const record = readCrossRepoBuildInputsRecord({
+      consumerRepo,
+      consumerRepoDir: resolve(workspaceRoot, consumerRepo),
+      consumerCommit: consumer.sourceCommit,
+    });
+    for (const [key, commit] of record) {
+      const [sourceRepo] = splitCrossRepoInputKey(key);
+      const source = pins.get(sourceRepo);
+      if (!source) {
+        throw new Error(
+          `${consumerRepo} at ${consumer.sourceCommit} vendors from ${JSON.stringify(sourceRepo)}, which has no repository pin in the runtime image source index`,
+        );
+      }
+      if (!SHA.test(String(commit ?? ''))) {
+        throw new Error(`${consumerRepo} at ${consumer.sourceCommit} vendors from ${sourceRepo} at a sourceCommit that is not exact lowercase 40-hex`);
+      }
+      if (commit === source.sourceCommit || commit === source.vendoredSourceCommit) {continue;}
+      if (!extra.has(sourceRepo)) {extra.set(sourceRepo, new Set());}
+      extra.get(sourceRepo).add(commit);
+    }
+  }
+  return new Map([...extra].map(([repo, commits]) => [repo, [...commits].sort()]));
+}
+
 /** The `sourcePins` of every edition under the configured editions root. */
 export function readEditionsSourcePins() {
   return new Map(
@@ -129,6 +177,24 @@ export function readEditionsSourcePins() {
   );
 }
 
+/**
+ * Second pass, once every repository sits at its pin: fetch the commits the
+ * consumers' cross-repo build-input records vendor from.
+ */
+export function fetchCrossRepoVendoredCommits({ workspaceRoot, plan, index, workspace, env, runGit }) {
+  const vendored = crossRepoVendoredCommits(plan, index, workspaceRoot);
+  for (const entry of plan) {
+    const commits = vendored.get(entry.repo);
+    if (!commits) {continue;}
+    withSourceGitEnv({ name: entry.repo, url: entry.repositoryUrl }, { workspace, env }, (gitEnv) => {
+      for (const commit of commits) {
+        runGit(['-C', resolve(workspaceRoot, entry.repo), 'fetch', '--quiet', '--depth=1', 'origin', commit], gitEnv);
+        console.log(`[source-checkout] ${entry.repo} also holds cross-repo vendored commit ${commit}`);
+      }
+    });
+  }
+}
+
 export function checkoutIndexedSources({ workspaceRoot, index, platformServiceIndex, editionSourcePins = new Map(), env = process.env, runGit = git }) {
   if (!workspaceRoot) {throw new Error('workspaceRoot is required');}
   const workspace = editionWorkspaceConfig();
@@ -176,6 +242,7 @@ export function checkoutIndexedSources({ workspaceRoot, index, platformServiceIn
     });
     console.log(`[source-checkout] ${entry.repo} @ ${entry.sourceCommit}`);
   }
+  fetchCrossRepoVendoredCommits({ workspaceRoot, plan, index, workspace, env, runGit });
   return plan.length;
 }