@xemahq/xema 0.34.0 → 0.35.0

package/dist/commands/edition.js

@@ -7,7 +7,7 @@ const verb_map_1 = require("../runtime/edition/verb-map");
 const VERB_SUMMARY = {
     [verb_map_1.EditionVerb.Resolve]: 'Resolve the whole release lock set of an edition: xema edition resolve <id> [--check]; or a customer edition against the catalogue pinned in catalogue.pin.json beside the definition: xema edition resolve --definition <file> --channel <release|develop> --out <dir> [--source-image <source>=<registry>/<prefix>]...',
     [verb_map_1.EditionVerb.Seal]: 'Seal the image digests of an edition: xema edition seal <id> [--definition <file>] (a customer edition seals against the release catalogue pinned in catalogue.pin.json beside the definition)',
-    [verb_map_1.EditionVerb.Develop]: 'Resolve a develop edition snapshot: xema edition develop <resolve|target|freeze-graph|freeze-sources|check-existing|check-overrides> ...; or a customer develop edition (catalogue pinned in catalogue.pin.json beside the definition): xema edition develop <resolve|target|check-existing|freeze-sources> --definition <file> ... (resolve: --pins <file> --out <dir> --registry <root> --engine-image <repo>@sha256:<digest> [--source-image <source>=<registry>/<prefix>]...)',
+    [verb_map_1.EditionVerb.Develop]: 'Resolve a develop edition snapshot: xema edition develop <resolve|target|freeze-graph|freeze-sources|check-existing|check-overrides> ...; or a customer develop edition (catalogue pinned in catalogue.pin.json beside the definition): xema edition develop <resolve|target|check-existing|freeze-sources> --definition <file> ... (resolve: --pins <file> --out <dir> --registry <root> --engine-image <repo>@sha256:<digest> [--source-image <source>=<registry>/<prefix>]...; target: --pins <file> --registry <root> --engine-image <repo>@sha256:<digest> [--source-image ...]; check-existing: --pins <file> --artifact <dir> --engine-image <repo>@sha256:<digest> [--source-image ...]). The develop tag is sha256 of the CLI version, the engine image, the pins and the source-image map.',
     [verb_map_1.EditionVerb.Artifact]: 'Write the OCI artifact files of a release edition from the committed sealed locks: xema edition artifact <id> --channel release --registry <root> --coordinate <tag> --engine-image <repo>@sha256:<digest> --out <dir>',
     [verb_map_1.EditionVerb.Catalogue]: 'Write the catalogue.json of a release offering from its committed sealed locks: xema edition catalogue <id> --out <dir>',
     [verb_map_1.EditionVerb.Index]: `Rebuild a catalogue index: xema edition index <${Object.values(verb_map_1.EditionIndexKind).join('|')}> [--check]; xema edition index runtime-image-source --repin-contract-authority --kernel-commit <40-hex> replaces only the contract authority of the committed index with the kernel checkout's at the stated commit (its HEAD must equal it)`,

package/dist/commands/edition.js.map

@@ -1 +1 @@
-{"version":3,"file":"edition.js","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":";;AA6CA,0CAiBC;AA9DD,kDAA8D;AAC9D,4DAA8D;AAC9D,0DAA2H;AAW3H,MAAM,YAAY,GAA0C;IAC1D,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,0TAA0T;IAC5T,CAAC,sBAAW,CAAC,IAAI,CAAC,EAAE,gMAAgM;IACpN,CAAC,sBAAW,CAAC,OAAO,CAAC,EAAE,mdAAmd;IAC1e,CAAC,sBAAW,CAAC,QAAQ,CAAC,EACpB,wNAAwN;IAC1N,CAAC,sBAAW,CAAC,SAAS,CAAC,EAAE,yHAAyH;IAClJ,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,kDAAkD,MAAM,CAAC,MAAM,CAAC,2BAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,+OAA+O;IAC/V,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,oIAAoI;IACzJ,CAAC,sBAAW,CAAC,GAAG,CAAC,EAAE,qEAAqE;IACxF,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,qGAAqG;IACpI,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,wEAAwE;IACvG,CAAC,sBAAW,CAAC,kBAAkB,CAAC,EAAE,mIAAmI;IACrK,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,yQAAyQ;IAC3Q,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,+EAA+E,MAAM,CAAC,MAAM,CAAC,8BAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;IACxJ,CAAC,sBAAW,CAAC,IAAI,CAAC,EAAE,6FAA6F;IACjH,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,6JAA6J;IAClL,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,gGAAgG,MAAM,CAAC,MAAM,CAAC,mCAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qKAAqK;IAC9U,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,6LAA6L;IAC/L,CAAC,sBAAW,CAAC,MAAM,CAAC,EAClB,yMAAyM;IAC3M,CAAC,sBAAW,CAAC,GAAG,CAAC,EACf,mWAAmW;IACrW,CAAC,sBAAW,CAAC,KAAK,CAAC,EACjB,qMAAqM;IACvM,CAAC,sBAAW,CAAC,aAAa,CAAC,EACzB,uMAAuM;CAC1M,CAAC;AAEF,SAAgB,eAAe,CAAC,OAAgB;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACvF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,sBAAW,CAAC,EAAE,CAAC;QAC9C,OAAO;aACJ,OAAO,CAAC,IAAI,CAAC;aACb,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;aAC/B,QAAQ,CAAC,WAAW,EAAE,0DAA0D,CAAC;aACjF,kBAAkB,EAAE;aACpB,MAAM,CAAC,CAAC,IAAc,EAAE,EAAE;YACzB,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAA,0BAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,qBAAQ,EAAC,4BAAe,CAAC,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC;AACH,CAAC"}
+{"version":3,"file":"edition.js","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":";;AA6CA,0CAiBC;AA9DD,kDAA8D;AAC9D,4DAA8D;AAC9D,0DAA2H;AAW3H,MAAM,YAAY,GAA0C;IAC1D,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,0TAA0T;IAC5T,CAAC,sBAAW,CAAC,IAAI,CAAC,EAAE,gMAAgM;IACpN,CAAC,sBAAW,CAAC,OAAO,CAAC,EAAE,swBAAswB;IAC7xB,CAAC,sBAAW,CAAC,QAAQ,CAAC,EACpB,wNAAwN;IAC1N,CAAC,sBAAW,CAAC,SAAS,CAAC,EAAE,yHAAyH;IAClJ,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,kDAAkD,MAAM,CAAC,MAAM,CAAC,2BAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,+OAA+O;IAC/V,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,oIAAoI;IACzJ,CAAC,sBAAW,CAAC,GAAG,CAAC,EAAE,qEAAqE;IACxF,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,qGAAqG;IACpI,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,wEAAwE;IACvG,CAAC,sBAAW,CAAC,kBAAkB,CAAC,EAAE,mIAAmI;IACrK,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,yQAAyQ;IAC3Q,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,+EAA+E,MAAM,CAAC,MAAM,CAAC,8BAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;IACxJ,CAAC,sBAAW,CAAC,IAAI,CAAC,EAAE,6FAA6F;IACjH,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,6JAA6J;IAClL,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,gGAAgG,MAAM,CAAC,MAAM,CAAC,mCAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qKAAqK;IAC9U,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,6LAA6L;IAC/L,CAAC,sBAAW,CAAC,MAAM,CAAC,EAClB,yMAAyM;IAC3M,CAAC,sBAAW,CAAC,GAAG,CAAC,EACf,mWAAmW;IACrW,CAAC,sBAAW,CAAC,KAAK,CAAC,EACjB,qMAAqM;IACvM,CAAC,sBAAW,CAAC,aAAa,CAAC,EACzB,uMAAuM;CAC1M,CAAC;AAEF,SAAgB,eAAe,CAAC,OAAgB;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACvF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,sBAAW,CAAC,EAAE,CAAC;QAC9C,OAAO;aACJ,OAAO,CAAC,IAAI,CAAC;aACb,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;aAC/B,QAAQ,CAAC,WAAW,EAAE,0DAA0D,CAAC;aACjF,kBAAkB,EAAE;aACpB,MAAM,CAAC,CAAC,IAAc,EAAE,EAAE;YACzB,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAA,0BAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,qBAAQ,EAAC,4BAAe,CAAC,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC;AACH,CAAC"}

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -2383,229 +2383,229 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:bbeac7ff01376cb89ed2140526d4795d8e559b3f01612b404a701f19aaa24c6a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/edition-artifact.mjs",
-      "sha256": "sha256:e8a391938c88398f63f86fdf413582d3a18eb20c219784a01fa84794bbd22e38"
+      "sha256": "sha256:287e4cf042626963e07396c706350e9668adbcacd238a7ad4db1d68bba3858b2"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:cea98292ffc8bfe2afcc01f327172bc9071a83ef9b62a4e56236f2029d2699a9"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:e3997bd9a0082e02d01760868b2a4f41ed3081e904126b30fdf86e7938dc6137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:71ae51028847ab3430ffec9b229b0516a7705b75a6de1fcfa665f5e1abf8e9bb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:c575e96b70bda82899931eb0b18567988e2e13e664fa498bcbef96b571dcabb4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:aa1a05f1728813a7bdb1e02d9305e9adf641d695e6767305210c67a1d81b38a7"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:c488ac72ff3f23c0f28f8db159bf84d2c86ec5cda3633db1fe91ca3f21b12214"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b141474fff33b06734fb62cd2552752b991c8267bb1c9bccb22a81dd80e91c6c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:22235719a41c0cf6206f5bcd7489341dccb22150df0b129724ef8ab566b5bff1"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:b9dd5c01903394436530783614efb0cd357d982ed2befd844a39328479773cbc"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/git-json.mjs",
       "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:433202eb2db84510acd11de6fe5ede81c8d96b8bc72991444940f7f84a48897f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:20abdde62a7b037c01ea9bbe1ff1e6094e6b0efd0add2f656f1938a04409bf82"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/lib.mjs",
       "sha256": "sha256:9708d6d385f69105bbd77359f5571ffec7b0c7f7fd343c4bbb88b33c4a61e780"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:ffe6fdc9da6b2974270fc86c11be0c41d0bc6d85c8e3c137d3c3bc00a72fc4f6"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/pin-source.mjs",
-      "sha256": "sha256:fbaa6dffbdf4a262a13127bcf37bca791234fae74e327ac250e56ff4b78c1244"
+      "sha256": "sha256:a23fef4698ef66ba9de4a1aabe3eebe6487d1f105f3fc161bafc5a33b99a2440"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:858b607dde94e2abd00a341f569e18cfa567d4bff139c64a2d60abbb7de4c85e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:62f83f8bb835f360535402d12657156d2c9d6e651b426c2b30a04a2dc2f8d3e8"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:058c849767434e9ba911d9310092bede42e3ef959c75bbd35ff8879dc21ce3ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.34.0",
+      "version": "0.35.0",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/edition/README.md

@@ -75,6 +75,7 @@ xema edition list --editions-root <dir>
 xema edition locks <id> --channel <release|develop>  # validated locks as JSON; an unsealed distribution lock is read on develop only
 xema edition artifact <id> --channel release --registry <ns> --coordinate <tag> --engine-image <repo>@sha256:<digest> --out <dir>
 xema edition develop <freeze-sources|resolve|target|check-existing> ...
+# develop tag = sha256 of { cli, engine, pins, sourceImages }; target and check-existing take --engine-image, and a customer's --source-image
 xema edition develop check-overrides --overrides <json> --data-root <dir>   # data root only
 xema edition chart-set <resolve|source-commit> ...
 xema edition arming --channel <release|develop> --data-root <dir> --kernel <dir>

package/edition/catalogue-edition.mjs

@@ -24,11 +24,11 @@ if (isEntryModule(import.meta.url)) {
   configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Sources, WorkspaceRoot.Kernel]);
 }
 
-/** `{ id, out }` of `catalogue <distribution-id> --out <dir>`; anything else is the usage error. */
+/** `{ id, out }` of `<distribution-id> --out <dir>` (the argv AFTER the `catalogue` verb, which the edition dispatcher has already stripped); anything else is the usage error. */
 export function parseCatalogueArgs(argv) {
-  const [command, id, flag, out, ...extra] = argv;
-  if (command !== 'catalogue' || id === undefined || flag !== '--out' || out === undefined || out.startsWith('--') || extra.length > 0) {
-    throw new Error('usage: catalogue <distribution-id> --out <dir>');
+  const [id, flag, out, ...extra] = argv;
+  if (id === undefined || flag !== '--out' || out === undefined || out.startsWith('--') || extra.length > 0) {
+    throw new Error('usage: xema edition catalogue <distribution-id> --out <dir>');
   }
   assertCanonicalDistributionId(id);
   return { id, out };

package/edition/develop-customer-edition.mjs

@@ -5,20 +5,23 @@
 // declares and nothing else (the vendor repositories are the catalogue's, not
 // the customer's). The digest of the catalogue artifact the edition was
 // resolved against is frozen into the descriptor's provenance pins as
-// `catalogue`; the snapshot hash (the artifact tag) covers it. The vendor image
+// `catalogue`; the artifact tag (developEditionTag) covers it. The vendor image
 // rows arrive sealed from the catalogue; only the customer's own image rows are
 // sealed against the develop image repositories.
 
+import { join } from 'node:path';
+
 import { sealLock } from './biome-content.mjs';
 import { parseCatalogueRef } from './catalogue-fetch.mjs';
 import { readCataloguePin } from './catalogue-pin.mjs';
+import { developImageRef } from './develop-image-coordinate.mjs';
 import { sealDevelopImageSubjects } from './develop-seal.mjs';
 import { assertCanonicalDistributionId } from './distribution-paths.mjs';
-import { CATALOGUE_PIN_KEY, EditionChannel } from './edition-constants.mjs';
+import { CATALOGUE_PIN_KEY, EditionChannel, EditionLockFile } from './edition-constants.mjs';
 import { loadKernelDistributionSchemas } from './lib.mjs';
 import { isSourcePinKey, sortedSnapshotPins, sourcePinKey } from './pin-source.mjs';
 import { resolveCustomerEdition } from './resolve-customer-edition.mjs';
-import { externalSourceTrees, sourceTreeLocator } from './resolve-images.mjs';
+import { externalSourceTrees, imageRefForSubject, sourceTreeLocator } from './resolve-images.mjs';
 import { readStrictJsonFile } from './strict-json.mjs';
 
 const SHA_PATTERN = /^[0-9a-f]{40}$/;
@@ -116,3 +119,31 @@ export function customerDevelopFrame({ definitionFile, pinsFile }) {
   const pins = customerDevelopPins({ pins: readStrictJsonFile(pinsFile), declaredSourceNames: declaredSourceNamesOf(rawDefinition), catalogueDigest: digest });
   return { id: rawDefinition.id, rawDefinition, catalogueRef, catalogueDigest: digest, pins };
 }
+
+/**
+ * The own image rows of an existing customer develop artifact are the rows this `--source-image` map composes:
+ * every subject owned by a biome drawn from a declared source is `<registry>/<prefix><subject>` mapped to its
+ * develop repository. The tag covers the map, but a tag is mutable registry state, so the pulled bytes are
+ * compared too. Throws naming the first row that differs.
+ */
+export function assertOwnImageRowsMatch({ artifactDir, sourceImages }) {
+  const lock = readStrictJsonFile(join(artifactDir, EditionLockFile.Distribution));
+  const imageLock = readStrictJsonFile(join(artifactDir, EditionLockFile.Images));
+  const sourceOf = new Map((lock.biomes ?? []).filter((biome) => biome.source !== undefined).map((biome) => [biome.id, biome.source.name]));
+  for (const subject of imageLock.subjects ?? []) {
+    const biomeId = (subject.owners ?? []).find((owner) => sourceOf.has(owner.biomeId))?.biomeId;
+    if (biomeId === undefined) {continue;}
+    const name = sourceOf.get(biomeId);
+    const image = sourceImages.get(name);
+    if (image === undefined) {
+      throw new Error(`the existing artifact draws biome "${biomeId}" from source "${name}", which has no --source-image; refusing to reuse it`);
+    }
+    const expected = developImageRef(imageRefForSubject(subject.id, image.imageRegistry, image.imageNamePrefix));
+    if (subject.imageRef !== expected) {
+      throw new Error(
+        `the existing artifact's own image row ${subject.kind}:${subject.id} is ${subject.imageRef}, not ${expected} ` +
+          '(the --source-image map differs); refusing to reuse it',
+      );
+    }
+  }
+}

package/edition/develop-edition.mjs

@@ -16,11 +16,14 @@
 //       declares (`freeze-sources --definition` writes it); the catalogue digest is frozen into the descriptor's
 //       provenance pins as `catalogue`. The id is the definition's. Takes --data-root, --editions-root,
 //       --sources-root, --cache-dir (no --deploy-root, no --kernel: the kernel is the catalogue's, from npm).
-//   target  <id> --pins <file> --registry <root>
-//       print <root>/<develop segment>/xema-edition-<id>:<snapshot hash>. The root is always the caller's
+//   target  <id> --pins <file> --registry <root> --engine-image <repository>@sha256:<digest>
+//       print <root>/<develop segment>/xema-edition-<id>:<tag>, the tag being sha256 of the canonical
+//       { cli, engine, pins, sourceImages } (developEditionTag): every input of the bytes the artifact records,
+//       so the same pins with another engine, source-image map or CLI version are another artifact. The root is always the caller's
 //       registry root (e.g. registry.example.com/acme); the develop namespace segment and the repository
 //       prefix come from edition-contract.json, and no root is implied.
-//   target  --definition <file> --pins <file> --registry <root>
+//   target  --definition <file> --pins <file> --registry <root> --engine-image <repository>@sha256:<digest>
+//           [--source-image <source>=<registry>/<prefix>]...
 //       the same for a customer edition (id = the definition's; the tag covers the pinned catalogue digest).
 //   freeze-graph --data-sha <sha> --kernel-sha <sha>
 //                --deploy-sha <sha> [--editions-root-url <https url>]
@@ -31,9 +34,9 @@
 //   check-existing <id> --pins <file> --artifact <dir> --engine-image <repository>@sha256:<digest>
 //       refuse to reuse a pulled artifact whose descriptor disagrees with this snapshot.
 //   check-existing --definition <file> --pins <file> --artifact <dir> --engine-image <repository>@sha256:<digest>
-//                  [--catalogue-username <name> --catalogue-token-env <VAR>]
+//                  [--catalogue-username <name> --catalogue-token-env <VAR>] [--source-image <source>=<registry>/<prefix>]...
 //       the same for a customer artifact; its descriptor's catalogue provenance pin must also equal the
-//       pinned develop catalogue digest. It fetches that catalogue (as `resolve --definition` does) to take the
+//       pinned develop catalogue digest, and its own image rows must be the rows the --source-image map composes. It fetches that catalogue (as `resolve --definition` does) to take the
 //       kernel from it. Takes --data-root, --cache-dir.
 //   check-overrides --overrides <json>
 //       refuse a pins override that would select the tooling this run executes
@@ -55,7 +58,7 @@ import { fetchCatalogue } from './catalogue-fetch.mjs';
 import { readCataloguePin } from './catalogue-pin.mjs';
 import { writeCatalogue } from './catalogue.mjs';
 import { CATALOGUE_TOKEN_ENV_FLAG, CATALOGUE_USERNAME_FLAG, DEFINITION_FLAG, SOURCE_IMAGE_FLAG } from './customer-flags.mjs';
-import { customerDevelopFrame, resolveCustomerDevelopEdition } from './develop-customer-edition.mjs';
+import { assertOwnImageRowsMatch, customerDevelopFrame, resolveCustomerDevelopEdition } from './develop-customer-edition.mjs';
 import { resolveDevelopEdition } from './develop-edition-resolve.mjs';
 import { assertNoToolingOverride, freezeCustomerSources, freezeGraph, freezeSources, lsRemoteDevelopHead } from './develop-freeze.mjs';
 import { assertCanonicalDistributionId } from './distribution-paths.mjs';
@@ -68,7 +71,7 @@ import { holdSource } from './git-source-auth.mjs';
 import { adoptCatalogueKernel } from './kernel-package.mjs';
 import { loadKernelDistributionSchemas, serializeJson } from './lib.mjs';
 import { snapshotPinSource } from './pin-source.mjs';
-import { parseSourceImages } from './resolve-customer-edition.mjs';
+import { assertSourceImagesCoverDefinition, parseSourceImages } from './resolve-customer-edition.mjs';
 import { composeEdition } from './resolve-distribution.mjs';
 import { readStrictJsonFile } from './strict-json.mjs';
 
@@ -111,10 +114,10 @@ const COMMANDS = Object.freeze({
   },
   target: {
     positional: true,
-    values: ['--pins', '--registry'],
+    values: ['--pins', '--registry', '--engine-image'],
     switches: [],
-    required: ['--pins', '--registry'],
-    customer: { values: [DEFINITION_FLAG], required: ['--pins', '--registry'], refused: [] },
+    required: ['--pins', '--registry', '--engine-image'],
+    customer: { values: [DEFINITION_FLAG, SOURCE_IMAGE_FLAG], required: ['--pins', '--registry', '--engine-image'], refused: [] },
   },
   'freeze-graph': {
     positional: false,
@@ -135,7 +138,7 @@ const COMMANDS = Object.freeze({
     values: ['--pins', '--artifact', '--engine-image'],
     switches: [],
     required: ['--pins', '--artifact', '--engine-image'],
-    customer: { values: [DEFINITION_FLAG, ...CREDENTIAL_FLAGS], required: ['--pins', '--artifact', '--engine-image'], refused: [] },
+    customer: { values: [DEFINITION_FLAG, ...CREDENTIAL_FLAGS, SOURCE_IMAGE_FLAG], required: ['--pins', '--artifact', '--engine-image'], refused: [] },
   },
 });
 
@@ -223,6 +226,7 @@ function fetchPinnedDevelopCatalogue(options, env) {
 async function resolveCustomer(options, env) {
   const { catalogue, digest } = await fetchPinnedDevelopCatalogue(options, env);
   const rawDefinition = readStrictJsonFile(options[DEFINITION_FLAG]);
+  const sourceImages = parseSourceImages(options[SOURCE_IMAGE_FLAG] ?? []);
   // The catalogue's kernel is adopted inside the resolve, before any kernel schema is loaded; the evidence trust
   // state loads kernel schemas, so it is read after.
   const { id, pins, ...resolved } = await resolveCustomerDevelopEdition({
@@ -230,11 +234,11 @@ async function resolveCustomer(options, env) {
     catalogue,
     catalogueDigest: digest,
     pins: readStrictJsonFile(options['--pins']),
-    sourceImages: parseSourceImages(options[SOURCE_IMAGE_FLAG] ?? []),
+    sourceImages,
     env,
   });
   const evidenceTrustPolicy = await descriptorEvidenceTrust({ channel: EditionChannel.Develop });
-  const target = developEditionTarget(id, pins, { registry: options['--registry'] });
+  const target = developEditionTarget(id, pins, { registry: options['--registry'], engineImage: options['--engine-image'], sourceImages });
   writeEditionArtifact({
     outDir: resolve(options['--out']),
     channel: EditionChannel.Develop,
@@ -254,6 +258,7 @@ async function resolveCustomer(options, env) {
 /** A customer check-existing: the pinned catalogue is fetched to take its kernel; the digest fetched is the digest the artifact is compared with. */
 export async function checkExistingCustomer(options, env, { adopt = adoptCatalogueKernel } = {}) {
   const frame = customerDevelopFrame({ definitionFile: options[DEFINITION_FLAG], pinsFile: options['--pins'] });
+  const sourceImages = customerSourceImages(options, frame.rawDefinition);
   const { catalogue, digest } = await fetchPinnedDevelopCatalogue(options, env);
   if (digest !== frame.catalogueDigest) {
     throw new Error(`the fetched catalogue is ${digest}, not the pinned ${frame.catalogueDigest}`);
@@ -268,6 +273,14 @@ export async function checkExistingCustomer(options, env, { adopt = adoptCatalog
     engineImage: options['--engine-image'],
     catalogueDigest: frame.catalogueDigest,
   });
+  assertOwnImageRowsMatch({ artifactDir: resolve(options['--artifact']), sourceImages });
+}
+
+/** The parsed --source-image map of a customer verb, covering exactly the definition's declared sources. */
+function customerSourceImages(options, rawDefinition) {
+  const sourceImages = parseSourceImages(options[SOURCE_IMAGE_FLAG] ?? []);
+  assertSourceImagesCoverDefinition(rawDefinition, sourceImages);
+  return sourceImages;
 }
 
 async function run(argv, env) {
@@ -276,17 +289,18 @@ async function run(argv, env) {
     case 'target': {
       if (customer) {
         const frame = customerDevelopFrame({ definitionFile: options[DEFINITION_FLAG], pinsFile: options['--pins'] });
-        console.log(developEditionTarget(frame.id, frame.pins, { registry: options['--registry'] }));
+        const sourceImages = customerSourceImages(options, frame.rawDefinition);
+        console.log(developEditionTarget(frame.id, frame.pins, { registry: options['--registry'], engineImage: options['--engine-image'], sourceImages }));
         return;
       }
-      console.log(developEditionTarget(id, readStrictJsonFile(options['--pins']), { registry: options['--registry'] }));
+      console.log(developEditionTarget(id, readStrictJsonFile(options['--pins']), { registry: options['--registry'], engineImage: options['--engine-image'] }));
       return;
     }
     case 'resolve': {
       if (customer) {return resolveCustomer(options, env);}
       const pins = readStrictJsonFile(options['--pins']);
       const workflow = options['--local'] ? LOCAL_WORKFLOW : workflowFromEnv(env);
-      const target = developEditionTarget(id, pins, { registry: options['--registry'] });
+      const target = developEditionTarget(id, pins, { registry: options['--registry'], engineImage: options['--engine-image'] });
       const evidenceTrustPolicy = await descriptorEvidenceTrust({ channel: EditionChannel.Develop });
       const { catalogue, ...resolved } = await resolveDevelopEdition({ id, pins, env });
       const outDir = resolve(options['--out']);

package/edition/edition-artifact.mjs

@@ -5,14 +5,14 @@
 // from edition-contract.json), addressed by digest, whose titled layers are
 // `xema-edition.json` (the descriptor) plus the lock files. It is written to a
 // scratch directory; the workflow pushes it with oras and signs the digest.
-// Tags are for humans only (develop: the snapshot hash; release: the
+// Tags are for humans only (develop: the hash of every input, developEditionTag; release: the
 // coordinate). Admission rests on the signature of the manifest digest, never on
 // a channel label: no reader branches on `provenance.channel`.
 //
 // The artifact is never written to git, so the writer REFUSES a target inside
 // either the data tree or the editions root.
 
-import { existsSync, mkdirSync, realpathSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
 import { basename, dirname, join, relative, resolve, sep, isAbsolute } from 'node:path';
 
 import { assertCanonicalDistributionId } from './distribution-paths.mjs';
@@ -29,8 +29,8 @@ import {
   EvidenceTrustState,
 } from './edition-constants.mjs';
 import { dataRoot, editionsRoot } from './edition-workspace.mjs';
-import { serializeJson } from './lib.mjs';
-import { snapshotHash, sortedSnapshotPins } from './pin-source.mjs';
+import { serializeJson, sha256Hex } from './lib.mjs';
+import { sortedSnapshotPins } from './pin-source.mjs';
 import { readStrictJsonFile } from './strict-json.mjs';
 
 /** Which GitHub Actions run produced the artifact; recorded in its descriptor. */
@@ -217,9 +217,49 @@ export function editionTarget(distributionId, registryRoot, channel, tag) {
   return `${editionRepository(distributionId, registryRoot, channel)}:${tag}`;
 }
 
-/** A develop edition's target: the tag is its snapshot hash. */
-export function developEditionTarget(distributionId, pins, { registry }) {
-  return editionTarget(distributionId, registry, EditionChannel.Develop, snapshotHash(pins));
+/** The version of this CLI, the writer of every descriptor and lock: read lazily, so a bundle that never tags does not need it. */
+let cliVersionMemo;
+export function cliVersion() {
+  if (cliVersionMemo === undefined) {
+    const { version } = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+    if (typeof version !== 'string' || version.length === 0) {throw new Error('@xemahq/xema: no "version" in its package.json');}
+    cliVersionMemo = version;
+  }
+  return cliVersionMemo;
+}
+
+/** `{ <source>: "<registry>/<prefix>" }` sorted by source: the canonical form of a parsed --source-image map. */
+export function canonicalSourceImages(sourceImages = new Map()) {
+  return Object.fromEntries(
+    [...sourceImages.entries()]
+      .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+      .map(([name, { imageRegistry, imageNamePrefix }]) => [name, `${imageRegistry}/${imageNamePrefix}`]),
+  );
+}
+
+/**
+ * A develop edition's tag: sha256 of the canonical `{ cli, engine, pins, sourceImages }`. Every input of
+ * the bytes the artifact records is inside it. The pins fix the locks and the descriptor's pins; the
+ * descriptor's `engine.image` is not a pin; a customer's `--source-image` map composes its own image rows
+ * (`<registry>/<prefix><subject>`) and is not a pin either; and the CLI version is the writer of every
+ * byte. A tag over the pins alone named two artifacts that differ in any of the others, and a re-run could
+ * only refuse the existing one (`check-existing`) or reuse a stale one. `provenance.workflow` (the run that
+ * wrote the bytes) is the one recorded field outside it: a fact about the artifact, not an input to it.
+ */
+export function developEditionTag({ pins, engineImage, sourceImages = new Map(), version = cliVersion() }) {
+  return sha256Hex(
+    serializeJson({
+      cli: version,
+      engine: assertEngineImage(engineImage),
+      pins: sortedSnapshotPins(pins),
+      sourceImages: canonicalSourceImages(sourceImages),
+    }),
+  );
+}
+
+/** A develop edition's target: the tag is `developEditionTag` of the pins, the engine and the source images. */
+export function developEditionTarget(distributionId, pins, { registry, engineImage, sourceImages }) {
+  return editionTarget(distributionId, registry, EditionChannel.Develop, developEditionTag({ pins, engineImage, sourceImages }));
 }
 
 function realpathOfPlanned(path) {
@@ -286,8 +326,8 @@ export function writeEditionArtifact({
 }
 
 /**
- * An existing snapshot-hash tag is reused only if it IS this snapshot: the tag
- * is a hash of the pins, but a tag is mutable registry state, so the pulled
+ * An existing develop tag is reused only if it IS this snapshot: the tag
+ * is a hash of its inputs, but a tag is mutable registry state, so the pulled
  * descriptor must say the same edition, the same channel, exactly the same pins,
  * the same engine image, the same evidence trust state and the same lock set. A customer artifact (`catalogueDigest` given) must also record that digest
  * as its catalogue provenance pin. Throws naming the first difference.

package/edition/pin-source.mjs

@@ -21,7 +21,7 @@
 //   sources/<name>                    one per `sources[]` entry declared in the chain
 
 import { workspaceSection } from './edition-config.mjs';
-import { compareStrings, serializeJson, sha256Hex } from './lib.mjs';
+import { compareStrings } from './lib.mjs';
 import { PinRole } from './workspace-sections.mjs';
 
 export const PinSourceKind = Object.freeze({
@@ -154,11 +154,6 @@ export function sortedSnapshotPins(pins) {
   return Object.fromEntries(Object.entries(pins).sort(([a], [b]) => compareStrings(a, b)));
 }
 
-/** sha256 hex of the canonical JSON of the pins sorted by key: the snapshot's identity. */
-export function snapshotHash(pins) {
-  return sha256Hex(serializeJson(sortedSnapshotPins(pins)));
-}
-
 /** A declared source with its ref replaced by the snapshot pin; identity under a published pin source. */
 export function pinnedSource(source, pinSource = PUBLISHED_PIN_SOURCE) {
   if (pinSource?.kind !== PinSourceKind.Snapshot) {return source;}

package/edition/release-edition-artifact.mjs

@@ -2,7 +2,7 @@
 // release-edition-artifact — write the OCI artifact of a RELEASE edition from
 // the committed, sealed locks of the editions root.
 //
-//   artifact <id> --channel release --registry <root> --coordinate <tag>
+//   <id> --channel release --registry <root> --coordinate <tag>
 //            --engine-image <repository>@sha256:<digest> --out <dir> [--local]
 //
 // The artifact has the layout of every edition (edition-artifact.mjs): the
@@ -28,6 +28,7 @@ import { loadKernelDistributionSchemas, validateImmutableImageLock } from './lib
 import { releaseCatalogue } from './release-catalogue.mjs';
 import { assertReleaseEditionTree } from './release-channel-guard.mjs';
 import { externalSourceTrees, sourceTreeLocator } from './resolve-images.mjs';
+import { readSealedDistributionLock } from './sealed-distribution-lock.mjs';
 import { createPinnedSourceAuthority } from './source-authority.mjs';
 
 if (isEntryModule(import.meta.url)) {
@@ -38,10 +39,9 @@ const VALUE_FLAGS = Object.freeze(['--channel', '--registry', '--coordinate', '-
 const REQUIRED_FLAGS = VALUE_FLAGS;
 const DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
 
-/** Parse `artifact <id> --flag value ...`; only the release channel is written by this verb. */
+/** Parse `<id> --flag value ...` (the argv AFTER the `artifact` verb, which the edition dispatcher has already stripped); only the release channel is written by this verb. */
 export function parseReleaseArtifactArgs(argv) {
-  const [command, ...rest] = argv;
-  if (command !== 'artifact') {throw new Error(`unknown command ${JSON.stringify(command)}; expected artifact`);}
+  const rest = argv;
   const options = {};
   const positional = [];
   for (let i = 0; i < rest.length; i += 1) {
@@ -100,17 +100,11 @@ export async function readCommittedEdition(id, root = editionsRoot()) {
   const schemas = await loadKernelDistributionSchemas();
   const imageLock = validateImmutableImageLock(schemas.parseImageLock(read(EditionLockFile.Images)), schemas);
   assertSealedImageLock(imageLock, join(dir, EditionLockFile.Images));
-  const distributionLock = read(EditionLockFile.Distribution);
-  let sealed;
-  try {
-    sealed = schemas.parseDistributionLock(distributionLock);
-  } catch (error) {
-    throw new Error(
-      `${join(dir, EditionLockFile.Distribution)} is not a sealed distribution lock, so nothing is published from it. ` +
-        `Run \`xema edition seal ${id}\` first. (${error.message})`,
-      { cause: error },
-    );
-  }
+  const { raw: distributionLock, sealed } = readSealedDistributionLock({
+    schemas,
+    lockPath: join(dir, EditionLockFile.Distribution),
+    distributionId: id,
+  });
   const authority = createPinnedSourceAuthority({ pins: (await editionPinnedInputs(id, { schemas })).repositoryPins });
   await verifyBiomeContentHashes({
     schemas,

package/edition/resolve-customer-edition.mjs

@@ -84,14 +84,21 @@ export function parseSourceImages(values) {
  * The definition's sources with the configured registry/prefix injected; every declared source needs its --source-image.
  * With `pins` (a develop customer edition) each source's ref is the frozen commit of its `sources/<name>` pin.
  */
-function withSourceImages(definition, sourceImages, pins) {
+/** Every --source-image names a declared source, and every declared source has one: the registry is configuration and has no default. */
+export function assertSourceImagesCoverDefinition(definition, sourceImages) {
   const declared = new Set((definition.sources ?? []).map((source) => source.name));
   for (const name of sourceImages.keys()) {
     if (!declared.has(name)) {throw new Error(`--source-image names source "${name}", which the definition does not declare (declared: ${[...declared].join(', ') || 'none'})`);}
   }
+  for (const name of declared) {
+    if (!sourceImages.has(name)) {throw new Error(`source "${name}" has no --source-image ${name}=<registry>/<prefix>: the registry is configuration and has no default`);}
+  }
+}
+
+function withSourceImages(definition, sourceImages, pins) {
+  assertSourceImagesCoverDefinition(definition, sourceImages);
   return (definition.sources ?? []).map((source) => {
     const image = sourceImages.get(source.name);
-    if (image === undefined) {throw new Error(`source "${source.name}" has no --source-image ${source.name}=<registry>/<prefix>: the registry is configuration and has no default`);}
     const pinned = pins === undefined ? source : pinnedSource(source, snapshotPinSource(pins));
     return { ...pinned, ...image };
   });

package/edition/seal-image-digests.mjs

@@ -98,8 +98,9 @@
 //                     state a pin advance leaves, owner ruling 2026-09-29), as
 //                     ONE line on stdout, exit 0. A malformed, empty or
 //                     PARTIALLY sealed lock exits 1: a broken artifact.
-//                     OFFLINE and structural: it reads the lock and nothing
-//                     else. That is deliberate rather than a shortcut — a
+//                     OFFLINE and structural: it reads the locks and nothing
+//                     else (the distribution lock through the built kernel,
+//                     `--kernel`, only when the images lock is PUBLISHABLE). That is deliberate rather than a shortcut — a
 //                     publication gate that needs a registry credential can
 //                     fail for reasons that have nothing to do with the artifact
 //                     being published, and a gate people learn to re-run is a
@@ -133,6 +134,7 @@ import { assertPlatformCanParseLock } from './platform-lock-readability.mjs';
 import { assertReleaseEditionTree } from './release-channel-guard.mjs';
 import { commandForSelf } from './remedy-command.mjs';
 import { externalSourceTrees, sourceTreeLocator } from './resolve-images.mjs';
+import { readSealedDistributionLock } from './sealed-distribution-lock.mjs';
 import { committedRepositoryPins, createPinnedSourceAuthority } from './source-authority.mjs';
 import { readStrictJsonFile } from './strict-json.mjs';
 import {
@@ -306,10 +308,10 @@ export const PublicationVerdict = Object.freeze({
  *     some services by digest and silently leave the rest un-pinned.
  *
  * IT CHECKS SHAPE AS WELL AS PRESENCE. This gate reads the lock with
- * `JSON.parse` because the publication workflow checks out this repository
- * ALONE, with no built kernel to parse through, so the kernel's digest regex is
- * not upstream of it and this file's own `SHA256_DIGEST` is the only rule on
- * this path.
+ * `JSON.parse`, so the kernel's digest regex is not upstream of it and this
+ * file's own `SHA256_DIGEST` is the only rule on the images lock. (The sealed
+ * grammar of the distribution lock is the kernel's, asked of it separately once
+ * the images lock reads PUBLISHABLE.)
  */
 export function classifyPublicationState({
   distributionId,
@@ -598,19 +600,12 @@ async function main() {
     );
   }
 
-  // PUBLICATION GATE — offline and structural. It returns BEFORE any call that
-  // would load the built kernel contracts, so it needs no sibling repository, no
-  // credential and no `node_modules`.
+  // PUBLICATION GATE — offline (no network, no credential) and structural. The images lock is
+  // classified with no kernel at all. A PUBLISHABLE verdict then also reads the distribution lock
+  // through the BUILT kernel (`readSealedDistributionLock`, the predicate `xema edition artifact`
+  // uses), so the publication workflow provisions the built kernel before it asks (`--kernel`).
+  // It returns BEFORE `loadImageLockForVerification`, which needs sibling repositories and the registry.
   //
-  // The distinction is the IMPORT versus the CALL, and getting it wrong once
-  // cost a needless refactor: importing `verify-image-platforms.mjs`,
-  // `oras.mjs` and `lib.mjs` is all FINE without a kernel —
-  // measured, all three load in a flat checkout — because
-  // `loadKernelDistributionSchemas()` is invoked at USE time, not at module
-  // load. What fails in the publication checkout is CALLING
-  // `loadImageLockForVerification`. So the fix is to not call it, which is what
-  // this early return does; making the imports dynamic bought nothing and was
-  // reverted.
   // EVERY mode, the offline publication verdict included: a release edition
   // never carries develop content, whatever the sealer is asked to do with it.
   assertReleaseEditionTree(join(editionsRoot(), distributionId));
@@ -627,6 +622,13 @@ async function main() {
     // including an empty stdout from a crash — is a failure there, never a
     // withhold. The human explanation goes to stderr.
     if (state.verdict === PublicationVerdict.Publishable) {
+      // The artifact verb reads the distribution lock through this same predicate; a verdict that
+      // passed an unsealed one would be the first thing `xema edition artifact` contradicts.
+      readSealedDistributionLock({
+        schemas: await loadKernelDistributionSchemas(),
+        lockPath: join(editionsRoot(), distributionId, 'distribution.lock.json'),
+        distributionId,
+      });
       console.error(
         `[dist:seal-digests --publication-verdict] "${distributionId}": all ` +
           `${state.subjectCount} subject(s) carry a canonical imageDigest; publishable. ` +

package/edition/sealed-distribution-lock.mjs

@@ -0,0 +1,22 @@
+// sealed-distribution-lock — the one predicate for "this committed distribution.lock.json is the SEALED grammar".
+// `xema edition artifact` and the `xema edition seal --publication-verdict` gate both ask it, so the verdict can
+// never say PUBLISHABLE for a lock the artifact verb then refuses.
+
+import { readFileSync } from 'node:fs';
+
+/**
+ * Parse the committed distribution lock at `lockPath` as the sealed grammar; an unsealed (or otherwise
+ * unparseable) lock is refused, naming the file. Returns the parsed sealed lock.
+ */
+export function readSealedDistributionLock({ schemas, lockPath, distributionId }) {
+  const raw = JSON.parse(readFileSync(lockPath, 'utf8'));
+  try {
+    return { raw, sealed: schemas.parseDistributionLock(raw) };
+  } catch (error) {
+    throw new Error(
+      `${lockPath} is not a sealed distribution lock, so nothing is published from it. ` +
+        `Run \`xema edition seal ${distributionId}\` first. (${error.message})`,
+      { cause: error },
+    );
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:86028f64405f33d817413fe305f1263168fe9aa57714b65d43a2ff27e304b1c4"
+    "sourceDigest": "sha256:5a8392acd12bf89ba47fdff3d9cbb4ec49b8194b218af9ebbfaea8d6ce16114f"
   }
 }