@xemahq/xema 0.35.0 → 0.36.1

package/dist/edition/verify-image-evidence.bundle.mjs

@@ -62225,9 +62225,9 @@ var EDITION_LOCKS = Object.freeze([...EDITION_CONTRACT.locks]);
 var EDITION_FILES = Object.freeze([EDITION_DESCRIPTOR_FILE, ...EDITION_LOCKS]);
 
 // edition/lib.mjs
+var import_yaml = __toESM(require_dist(), 1);
 import { createRequire as createRequire4 } from "node:module";
 import { isIP } from "node:net";
-var import_yaml = __toESM(require_dist(), 1);
 
 // edition/adapter-host-versions.mjs
 var BUNDLED_PACKAGES = Object.freeze(["@xemahq/contracts", "@xemahq/biome-sdk"]);

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "artifactSha256": "sha256:6a1bb7ce2649255733671979ea5914287fde441ca5afc07eba451145401eccee",
+  "artifactSha256": "sha256:85a8f844799b403c2686b5f6fdbecaaa07f2edfcab348d0502b2e803040f66cc",
   "esbuild": {
     "version": "0.28.2"
   },
@@ -2383,229 +2383,229 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:bbeac7ff01376cb89ed2140526d4795d8e559b3f01612b404a701f19aaa24c6a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:287e4cf042626963e07396c706350e9668adbcacd238a7ad4db1d68bba3858b2"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/edition-chart-set.mjs",
-      "sha256": "sha256:cea98292ffc8bfe2afcc01f327172bc9071a83ef9b62a4e56236f2029d2699a9"
+      "sha256": "sha256:f9f16b58279c8c2619a39c5cc92bdbc334543d1a324304cd5d3b120d66dc8f3a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:e3997bd9a0082e02d01760868b2a4f41ed3081e904126b30fdf86e7938dc6137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:71ae51028847ab3430ffec9b229b0516a7705b75a6de1fcfa665f5e1abf8e9bb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:c575e96b70bda82899931eb0b18567988e2e13e664fa498bcbef96b571dcabb4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:aa1a05f1728813a7bdb1e02d9305e9adf641d695e6767305210c67a1d81b38a7"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:c488ac72ff3f23c0f28f8db159bf84d2c86ec5cda3633db1fe91ca3f21b12214"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b141474fff33b06734fb62cd2552752b991c8267bb1c9bccb22a81dd80e91c6c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/edition-workspace.mjs",
-      "sha256": "sha256:22235719a41c0cf6206f5bcd7489341dccb22150df0b129724ef8ab566b5bff1"
+      "sha256": "sha256:18ba727e6b13ca252def25cc6bd9adf894cbc2018198c41ce522637eeac7f871"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:b9dd5c01903394436530783614efb0cd357d982ed2befd844a39328479773cbc"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/git-json.mjs",
       "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:433202eb2db84510acd11de6fe5ede81c8d96b8bc72991444940f7f84a48897f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:20abdde62a7b037c01ea9bbe1ff1e6094e6b0efd0add2f656f1938a04409bf82"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/lib.mjs",
-      "sha256": "sha256:9708d6d385f69105bbd77359f5571ffec7b0c7f7fd343c4bbb88b33c4a61e780"
+      "sha256": "sha256:dfcfdc0716b63f91db88364c4fecc2f8941511b302a20429fd5921270e375cb6"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:ffe6fdc9da6b2974270fc86c11be0c41d0bc6d85c8e3c137d3c3bc00a72fc4f6"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:a23fef4698ef66ba9de4a1aabe3eebe6487d1f105f3fc161bafc5a33b99a2440"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:858b607dde94e2abd00a341f569e18cfa567d4bff139c64a2d60abbb7de4c85e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:62f83f8bb835f360535402d12657156d2c9d6e651b426c2b30a04a2dc2f8d3e8"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:058c849767434e9ba911d9310092bede42e3ef959c75bbd35ff8879dc21ce3ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.35.0",
+      "version": "0.36.1",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/edition/develop-chart-roster.mjs

@@ -0,0 +1,96 @@
+// develop-chart-roster — the develop chart roster of a deploy checkout, as the
+// deploy repository itself computes it.
+//
+// A develop chart's version is `0.0.0-h<16 hex>`, the first 16 hex of its full
+// content digest (xema-deploy scripts/lib/chart-content-digest.mjs,
+// developChartVersionFromDigest). That function belongs to the deploy
+// repository, and so does the index version derived from the roster: publish-
+// charts on refs/heads/develop runs the same code to publish the charts and
+// close the set with its `xema-chart-set` index. So the CLI never reimplements
+// or vendors it: it runs the entry point of the frozen deploy checkout
+// (`scripts/chart-content-digest.mjs --develop-roster --json`), which is the
+// code the publisher ran for that commit, and validates the one document it
+// prints. A vendored copy would pin the CLI to one revision of a hash whose
+// owner is the deploy commit being resolved.
+
+import { execFileSync } from 'node:child_process';
+import { join } from 'node:path';
+
+import { parseStrictJson } from './strict-json.mjs';
+
+/** The schema string the deploy entry point stamps on its develop roster. */
+export const DEVELOP_CHART_ROSTER_SCHEMA = 'xema-develop-chart-roster/1';
+
+/** The entry point, relative to the deploy checkout, and its arguments. */
+export const DEVELOP_CHART_ROSTER_ENTRY = 'scripts/chart-content-digest.mjs';
+export const DEVELOP_CHART_ROSTER_ARGS = Object.freeze(['--develop-roster', '--json']);
+
+/** A develop channel coordinate: revision 0 and the content digest's first 16 hex. */
+export const DEVELOP_CHART_VERSION_PATTERN = /^0\.0\.0-h[0-9a-f]{16}$/;
+
+/** A chart name as Helm and the registry address it. */
+const CHART_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
+
+const ROSTER_KEYS = 'indexVersion,members,schema';
+const MEMBER_KEYS = 'name,version';
+
+/**
+ * Validate the develop roster document `document` (from `source`) and return
+ * `{indexVersion, members: [{name, version}]}`. Every rule is strict: the exact
+ * schema string and keys, develop coordinates only, and members sorted by name
+ * with no name twice.
+ */
+export function parseDevelopChartRoster(document, source) {
+  const fail = (why) => {
+    throw new Error(`${source} is not a ${DEVELOP_CHART_ROSTER_SCHEMA} roster: ${why}`);
+  };
+  if (!document || typeof document !== 'object' || Array.isArray(document)) {fail('it is not a JSON object');}
+  if (document.schema !== DEVELOP_CHART_ROSTER_SCHEMA) {fail(`schema must be "${DEVELOP_CHART_ROSTER_SCHEMA}" (got ${JSON.stringify(document.schema)})`);}
+  const keys = Object.keys(document).sort().join(',');
+  if (keys !== ROSTER_KEYS) {fail(`it must carry exactly ${ROSTER_KEYS} (got ${keys})`);}
+  if (!DEVELOP_CHART_VERSION_PATTERN.test(String(document.indexVersion))) {
+    fail(`indexVersion must be a develop coordinate 0.0.0-h<16 hex> (got ${JSON.stringify(document.indexVersion)})`);
+  }
+  if (!Array.isArray(document.members) || document.members.length === 0) {fail('members must be a non-empty array');}
+  let previous = '';
+  const members = document.members.map((member, position) => {
+    if (!member || typeof member !== 'object' || Array.isArray(member) || Object.keys(member).sort().join(',') !== MEMBER_KEYS) {
+      fail(`member ${position} must be exactly {name, version}`);
+    }
+    if (!CHART_NAME_PATTERN.test(String(member.name))) {fail(`member ${position} has a malformed chart name ${JSON.stringify(member.name)}`);}
+    if (!DEVELOP_CHART_VERSION_PATTERN.test(String(member.version))) {
+      fail(`${member.name} has no develop coordinate 0.0.0-h<16 hex> (got ${JSON.stringify(member.version)})`);
+    }
+    if (member.name <= previous) {fail(`members must be sorted by name with no name twice (${member.name} follows ${previous})`);}
+    previous = member.name;
+    return { name: member.name, version: member.version };
+  });
+  return { indexVersion: document.indexVersion, members };
+}
+
+/**
+ * The develop roster of the deploy checkout at `deployDir`: its own entry point
+ * run with this node, in that checkout, with only PATH from the environment (the
+ * entry point needs git and nothing else; no credential reaches it).
+ */
+export function readDevelopChartRoster(deployDir) {
+  const entry = join(deployDir, DEVELOP_CHART_ROSTER_ENTRY);
+  let stdout;
+  try {
+    stdout = execFileSync(process.execPath, [entry, ...DEVELOP_CHART_ROSTER_ARGS], {
+      cwd: deployDir,
+      encoding: 'utf8',
+      env: { PATH: process.env.PATH ?? '' },
+      maxBuffer: 16 * 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+  } catch (error) {
+    const stderr = typeof error?.stderr === 'string' ? error.stderr.trim() : '';
+    throw new Error(
+      `the deploy checkout's develop roster failed (node ${DEVELOP_CHART_ROSTER_ENTRY} ${DEVELOP_CHART_ROSTER_ARGS.join(' ')} in ${deployDir}): ${stderr || error.message}`,
+      { cause: error },
+    );
+  }
+  const source = `${DEVELOP_CHART_ROSTER_ENTRY} ${DEVELOP_CHART_ROSTER_ARGS.join(' ')}`;
+  return parseDevelopChartRoster(parseStrictJson(stdout, source), source);
+}

package/edition/develop-chart-set.mjs

@@ -1,61 +1,112 @@
 // develop-chart-set — the chart-set lock of a develop edition.
 //
-// A develop edition renders with the charts the publisher actually published:
-// the committed release chart-set lock's entries (names, content versions and
-// digests, and each index digest), unchanged. xema-deploy publishes charts per
-// content version (`<n>-h<16 hex>`) for the commit its release set was closed
-// at, so that commit is the only deploy commit whose charts exist in the
-// registry. A develop edition frozen at that commit takes the release lock
-// as it is, and asks the registry nothing about a chart's tag; a develop edition
-// frozen at any other commit is refused, because no chart was published for it
-// (a develop chart lane in xema-deploy is the owner's decision, not built).
+// A develop edition renders the charts of its frozen deploy commit. The deploy
+// checkout computes its own develop roster (develop-chart-roster.mjs: every
+// chart at `0.0.0-h<16 hex>` and the set's index version), and xema-deploy
+// publish-charts on refs/heads/develop publishes those charts and closes the
+// set with a `xema-chart-set` index at that index version, the same artifact
+// a release closes its set with. So a develop lock is resolved exactly as a
+// release one is (resolve-chart-set.mjs), only at a version the deploy commit
+// names instead of the newest the registry holds: read the index at the
+// roster's index version, require its members to be the roster, seal every
+// member against the registry, and build the same schemaVersion 4 lock. The
+// committed release lock is never read.
+//
+// ONE PUBLISHER. A develop lock lists only the publisher whose repository is
+// the deploy pin role's: a develop deployment renders no infra chart (the
+// deploy engine refuses scope infra on the develop channel), and the other
+// publishers have no develop channel.
+//
+// NOT PUBLISHED IS A REFUSAL. An index or member the registry does not serve
+// (404) is refused by name and version: publish-charts for the deploy commit
+// has not finished green. There is no fallback to any other set.
 
 import { basename } from 'node:path';
 
-import { chartSetSourceCommits } from './chart-set-source-commit.mjs';
+import { readDevelopChartRoster } from './develop-chart-roster.mjs';
 import { assertRosteredChartSetLock } from './edition-chart-set.mjs';
+import { deployRoot } from './edition-workspace.mjs';
 import { COMMIT_PATTERN } from './evidence-grammars.mjs';
 import { deployPinKey } from './pin-source.mjs';
-import { CHART_SET_LOCK_FILE, chartRegistryClient, chartSetLockPath, readLock } from './resolve-chart-set.mjs';
+import {
+  CHART_SET_LOCK_FILE,
+  buildLock,
+  chartRegistryClient,
+  chartSetPublishers,
+  indexRosterAndDigest,
+  registryChartDigest,
+  sealRoster,
+} from './resolve-chart-set.mjs';
 
-/** The source commits of `lock`'s publishers, read from their index charts at the digests the lock pins. */
-const registrySourceCommits = (lock) => chartSetSourceCommits({ client: chartRegistryClient(), lock });
+const NOT_FOUND = 404;
 
-/**
- * The develop chart-set lock for the deploy commit `xemaDeploySha`: the committed
- * release lock, when that lock's deploy publisher closed its set at this commit.
- * `readSourceCommits(lock)` defaults to the chart registry's index charts and
- * returns `{publishers: [{repo, sourceCommit}]}`.
- *
- * TEMPORARY BRIDGE (owner: edition, lead D41 10-13): only the release set's
- * source commit is resolvable here. Exit: develop charts resolved by content
- * version (edition T37: the shared developChartVersionFromDigest, published by
- * xema-deploy publish-charts on develop pushes), which replaces this function
- * before t348-i2 lands.
- */
-export async function resolveDevelopChartSet({ xemaDeploySha, releaseLock = readLock(), readSourceCommits = registrySourceCommits }) {
-  if (!COMMIT_PATTERN.test(xemaDeploySha ?? '')) {
-    throw new Error(`the deploy checkout SHA is not a 40-hex commit: ${JSON.stringify(xemaDeploySha)}`);
-  }
-  if (releaseLock === null) {
-    throw new Error(`${chartSetLockPath()} is missing or is not JSON: run 'xema edition chart-set resolve' first`);
-  }
-  assertRosteredChartSetLock(releaseLock, CHART_SET_LOCK_FILE);
+/** The publisher whose repository is the deploy pin role's; exactly one must be configured. */
+function deployPublisher() {
   const deployRepo = basename(deployPinKey());
-  const deployPublishers = releaseLock.publishers.filter((publisher) => basename(publisher.repo) === deployRepo);
-  if (deployPublishers.length !== 1) {
+  const publishers = chartSetPublishers().filter((publisher) => basename(publisher.repo) === deployRepo);
+  if (publishers.length !== 1) {
     throw new Error(
-      `${deployPublishers.length} chart publishers of ${CHART_SET_LOCK_FILE} have repository ${deployRepo} (the deploy pin role); exactly one must, ` +
-        'since its source commit is the one commit whose charts were published',
+      `${publishers.length} configured chart publishers have repository ${deployRepo} (the deploy pin role); exactly one must, ` +
+        'since a develop chart set is that publisher\'s set at the deploy commit',
     );
   }
-  const { sourceCommit } = (await readSourceCommits(releaseLock)).publishers.find((publisher) => publisher.index === deployPublishers[0].index) ?? {};
-  if (sourceCommit !== xemaDeploySha) {
+  return publishers[0];
+}
+
+/** Run `read`; a registry 404 becomes the "not published yet" refusal naming `what` and the publisher's run for the deploy commit. */
+async function published(read, what, { publisher, xemaDeploySha }) {
+  try {
+    return await read();
+  } catch (error) {
+    if (error?.status !== NOT_FOUND) {throw error;}
+    throw new Error(`${what} is not published yet; ${publisher.repo} publish-charts for ${xemaDeploySha} not green`, { cause: error });
+  }
+}
+
+/** Refuse an index whose members are not exactly the roster's names at the roster's versions. */
+function assertIndexIsRoster(indexRoster, members, label) {
+  const expected = members.map(({ name, version }) => `${name} ${version}`);
+  const actual = Object.entries(indexRoster).map(([name, member]) => `${name} ${member.version}`);
+  const missing = expected.filter((line) => !actual.includes(line));
+  const extra = actual.filter((line) => !expected.includes(line));
+  if (missing.length > 0 || extra.length > 0) {
     throw new Error(
-      `the develop deploy commit ${xemaDeploySha} is not the commit ${CHART_SET_LOCK_FILE} was published from (${sourceCommit}): ` +
-        'develop charts are only published for the release set\'s source commit, so no chart exists for this commit. ' +
-        'A develop chart lane in the deploy repository is required to develop at another commit (owner decision, not built)',
+      `${label} does not carry the deploy checkout's develop roster: ` +
+        `missing [${missing.join(', ')}], unexpected [${extra.join(', ')}]`,
     );
   }
-  return releaseLock;
+}
+
+/**
+ * The develop chart-set lock for the deploy commit `xemaDeploySha`, whose frozen
+ * checkout is `deployDir`. `readRoster(deployDir)` returns `{indexVersion, members}`;
+ * `client` is the chart registry client the release resolver uses.
+ */
+export async function resolveDevelopChartSet({ xemaDeploySha, deployDir = deployRoot(), readRoster = readDevelopChartRoster, client }) {
+  if (!COMMIT_PATTERN.test(xemaDeploySha ?? '')) {
+    throw new Error(`the deploy checkout SHA is not a 40-hex commit: ${JSON.stringify(xemaDeploySha)}`);
+  }
+  const publisher = deployPublisher();
+  const { indexVersion, members } = readRoster(deployDir);
+  const registry = client ?? chartRegistryClient();
+  const label = `${publisher.index}@${indexVersion}`;
+  const { roster, indexDigest } = await published(
+    () => indexRosterAndDigest(registry, publisher.index, indexVersion),
+    `the chart-set index ${label}`,
+    { publisher, xemaDeploySha },
+  );
+  assertIndexIsRoster(roster, members, label);
+  const lookup = registryChartDigest(registry);
+  const charts = await sealRoster(
+    roster,
+    (name, version) => published(() => lookup(name, version), `chart ${name}:${version}`, { publisher, xemaDeploySha }),
+    label,
+  );
+  const lock = buildLock(
+    { [publisher.index]: indexVersion },
+    { [publisher.index]: charts },
+    { [publisher.index]: indexDigest },
+    [publisher],
+  );
+  return assertRosteredChartSetLock(lock, CHART_SET_LOCK_FILE);
 }

package/edition/develop-edition-resolve.mjs

@@ -2,8 +2,8 @@
 //
 // The whole pipeline, in the order the release runs it, over the snapshot's
 // injected inputs: distribution lock -> authorization base (composed, never
-// written) -> images lock -> develop seal, plus the chart-set lock: the release
-// lock's published charts (develop-chart-set.mjs). Nothing here writes to the editions
+// written) -> images lock -> develop seal, plus the chart-set lock: the frozen
+// deploy commit's develop chart set (develop-chart-set.mjs). Nothing here writes to the editions
 // trees; the caller writes the artifact (edition-artifact.mjs).
 
 import { adapterHostRow, assertAdapterBundlesMatchHost, fetchRegistryManifest } from './adapter-bundled-versions.mjs';
@@ -21,7 +21,7 @@ import { composeAuthorizationBase, resolveDistributionWithIndex } from './resolv
 import { externalSourceTrees, resolveImages, sourceTreeLocator } from './resolve-images.mjs';
 import { createPinnedSourceAuthority } from './source-authority.mjs';
 
-export async function resolveDevelopEdition({ id, pins, env = process.env, sealOptions = {}, readSourceCommits, fetchKernelTarball, fetchManifest = fetchRegistryManifest }) {
+export async function resolveDevelopEdition({ id, pins, env = process.env, sealOptions = {}, fetchKernelTarball, fetchManifest = fetchRegistryManifest }) {
   const schemas = await loadKernelDistributionSchemas();
   assertFrozenCheckouts(pins);
   const inputs = await buildSnapshotInputs({ id, pins, schemas });
@@ -40,10 +40,7 @@ export async function resolveDevelopEdition({ id, pins, env = process.env, sealO
     locate: sourceTreeLocator(externalSourceTrees(lock)),
     vendoredCommit: (repo) => authority.vendoredSourceCommitForRepository(repo),
   });
-  const chartSetLock = await resolveDevelopChartSet({
-    xemaDeploySha: pins[deployPinKey()],
-    ...(readSourceCommits === undefined ? {} : { readSourceCommits }),
-  });
+  const chartSetLock = await resolveDevelopChartSet({ xemaDeploySha: pins[deployPinKey()] });
   const sourceTreeIds = await biomeSourceTreeIds({
     schemas,
     lock,

package/edition/edition-chart-set.mjs

@@ -38,7 +38,7 @@ export const EditionChartSetCheck = Object.freeze({
   STALE: 'stale',
 });
 
-/** A published chart's version coordinate: `-h<16 hex>`, the content hash its publisher mints. A develop chart set takes the release set's charts, so it carries the same coordinate. */
+/** A published chart's version coordinate: `-h<16 hex>`, the content hash its publisher mints, on both channels (develop: `0.0.0-h<16 hex>`). */
 const CHART_VERSION_COORDINATE = /-h[0-9a-f]{16}$/;
 
 /** The chart-set lock schema every reader accepts; a lock of any other schema is re-resolved, never migrated. */

package/edition/edition-workspace.mjs

@@ -109,6 +109,8 @@ export const kernelDistPath = (...segments) =>
 
 export const biomeIndexPath = () => join(dataRoot(), 'biome-index.json');
 export const storePublisherIdentitiesPath = () => join(dataRoot(), 'store-publisher-identities.json');
+export const storeSourceRepositoriesPath = () =>
+  join(dataRoot(), 'vendor-ops', 'store-source-repositories.json');
 export const platformServiceIndexPath = () =>
   join(dataRoot(), 'platform-service-index.json');
 export const runtimeImageSourceIndexPath = () =>

package/edition/lib.mjs

@@ -12,7 +12,6 @@ import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { createRequire } from 'node:module';
 import { isIP } from 'node:net';
-import { join } from 'node:path';
 
 import { parse as parseYaml } from 'yaml';
 
@@ -23,11 +22,11 @@ import {
 } from './connector-source-authority.mjs';
 import { assertKernelEditionProtocol } from './edition-protocol.mjs';
 import {
-  dataRoot,
   kernelDistPath,
   kernelPackageDir,
   kernelRepoDir,
   sourcePath,
+  storeSourceRepositoriesPath,
 } from './edition-workspace.mjs';
 import { SHA256_HEX_PATTERN } from './evidence-grammars.mjs';
 import { readGitJsonAtCommit } from './git-json.mjs';
@@ -1021,11 +1020,19 @@ function isFixtureManifest(repoRelativePath) {
 }
 
 export function distributionBiomeSourceRepositories() {
-  const publishersPath = join(
-    dataRoot(),
-    'store-publisher-identities.json',
-  );
+  const publishersPath = storeSourceRepositoriesPath();
   const publishers = readStrictJsonFile(publishersPath);
+  if (publishers.schemaVersion !== 1) {
+    throw new Error(`${publishersPath} must declare schemaVersion 1`);
+  }
+  const unknownKeys = Object.keys(publishers).filter(
+    (key) => key !== 'schemaVersion' && key !== 'publishers',
+  );
+  if (unknownKeys.length > 0) {
+    throw new Error(
+      `${publishersPath}: unknown top-level key ${unknownKeys.map((key) => JSON.stringify(key)).join(', ')}`,
+    );
+  }
   if (
     !Array.isArray(publishers.publishers) ||
     publishers.publishers.length === 0

package/edition/resolve-chart-set.mjs

@@ -96,7 +96,7 @@ export const chartSetLockPath = () => join(dataRoot(), CHART_SET_LOCK_FILE);
  * (edition-chart-set.mjs).
  */
 const chartRegistry = () => vendorChartSetConfig().chartRegistry;
-const chartSetPublishers = () => vendorChartSetConfig().chartPublishers;
+export const chartSetPublishers = () => vendorChartSetConfig().chartPublishers;
 
 /** `<host>/<path>` -> the repository path the registry API addresses. */
 export function registryRepository(indexName) {
@@ -252,12 +252,15 @@ export async function manifestAnnotations(client, indexName, version, served) {
 }
 
 /** The roster and the served manifest digest of the index chart `<indexName>:<version>`, from ONE manifest read. */
-async function indexRosterAndDigest(client, indexName, version) {
+export async function indexRosterAndDigest(client, indexName, version) {
   const served = await client.getManifestByTag(registryRepository(indexName), version);
   const annotations = await manifestAnnotations(client, indexName, version, served);
   return { roster: parseIndexRoster(annotations[INDEX_ROSTER_ANNOTATION], `${indexName}@${version}`), indexDigest: served.digest };
 }
 
+/** The `sealRoster` lookup through `client`: the manifest digest the registry serves for `<name>:<version>`. */
+export const registryChartDigest = (client) => async (name, version) => (await client.getManifestByTag(registryRepository(name), version)).digest;
+
 /** Every edition directory (one holding a distribution.lock.json) under the editions root. */
 function editionDirs() {
   return readdirSync(editionsRoot(), { withFileTypes: true })
@@ -320,11 +323,7 @@ export async function resolveFromRegistry(client = chartRegistryClient()) {
     indexDigestsByIndex[index] = indexDigest;
     // The registry is asked for every member, so an index digest is checked
     // against it and a member without one still gets sealed.
-    rostersByIndex[index] = await sealRoster(
-      roster,
-      async (name, memberVersion) => (await client.getManifestByTag(registryRepository(name), memberVersion)).digest,
-      `${index}@${version}`,
-    );
+    rostersByIndex[index] = await sealRoster(roster, registryChartDigest(client), `${index}@${version}`);
   }
   return { versionsByIndex, rostersByIndex, indexDigestsByIndex };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.35.0",
+  "version": "0.36.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:5a8392acd12bf89ba47fdff3d9cbb4ec49b8194b218af9ebbfaea8d6ce16114f"
+    "sourceDigest": "sha256:ddb945be16ae0e12c4ce9bd6fbb8b22dc9186a1bc6d927b2243fa762a600caa7"
   }
 }