@xemahq/xema 0.42.0 → 0.44.0

package/edition/dist-check.mjs

@@ -370,7 +370,7 @@ export async function checkImagesLock(id, checkSourceEvidence) {
   }
 }
 
-async function checkCommittedRuntimeImageSourceIndex(checkSources) {
+export async function checkCommittedRuntimeImageSourceIndex(checkSources) {
   try {
     const schemas = await loadKernelDistributionSchemas();
     schemas.parseRuntimeImageSourceIndex(
@@ -394,7 +394,7 @@ async function checkCommittedRuntimeImageSourceIndex(checkSources) {
   }
 }
 
-function checkCommittedIndex() {
+export function checkCommittedIndex() {
   try {
     const index = validateImmutableBiomeIndex(
       JSON.parse(readFileSync(biomeIndexPath(), 'utf8')),
@@ -464,7 +464,7 @@ export function checkCommittedDataRootReaders() {
   return green;
 }
 
-async function checkCommittedPlatformServiceIndex() {
+export async function checkCommittedPlatformServiceIndex() {
   try {
     const schemas = await loadKernelDistributionSchemas();
     const index = schemas.parsePlatformServiceSourceIndex(
@@ -493,7 +493,7 @@ async function checkCommittedPlatformServiceIndex() {
   }
 }
 
-function discoverDistributionIds() {
+export function discoverDistributionIds() {
   if (!existsSync(editionsRoot())) {
     console.error(`[dist:check] ${editionsRoot()} does not exist.`);
     process.exit(1);
@@ -514,37 +514,16 @@ function discoverDistributionIds() {
 }
 
 /**
- * Guard for the capability-domain OWNERSHIP (reservation) table.
- *
- * This repo has no test runner (no package.json, no CI workflow of its own) —
- * `dist:check` IS its gate — so the invariant is asserted here, where it
- * actually runs, rather than in a spec file nothing would execute.
- *
- * THE INVARIANT THAT MATTERS: **every edition carries the IDENTICAL table.**
+ * The lock-free half of the ownership guard: the kernel's reader, exercised
+ * against synthetic tables. (a) two biomes claiming one domain is refused,
+ * naming it; (b) a listed domain resolves to its owner and an unlisted one is
+ * not first-party; (c) an invalid domain is refused. Reads no lock, so the
+ * authored check runs it too.
  *
- *   Ownership is a property of the platform, not of what an edition preloads.
- *   An earlier design put the claim on each `LockedBiome`, which made a trimmed
- *   edition (`appliance-lean`) leave `kb`/`agent`/… unowned — so an
- *   org admin could install the owning biome from the store and THEN bind
- *   `kb:page.read@1` to a URL they control, silently shadowing the platform
- *   data plane. The table is now built from the FULL biome index and reserves
- *   the domain even when its owning biome is absent from that edition — which
- *   is exactly the case the reservation exists to cover.
- *
- * Also re-asserts the two structural rules, through the KERNEL's own reader:
- *   (a) two biomes claiming the SAME domain is refused (ambiguous ownership has
- *       no safe resolution — fail the build, never pick a winner);
- *   (b) a domain in NO table entry is not first-party (so a claim that never
- *       made it into a resolved, committed, drift-checked lock carries no
- *       weight), and an invalid domain is refused rather than silently carried.
- *
- * @param {string[]} ids every distribution id discovered in this repo.
- * @returns {Promise<boolean>} true when green.
+ * @param {(lock: object) => Map<string, string>} resolveFirstPartyCapabilityDomains the kernel's reader
+ * @returns {string[]} the failures, empty when green
  */
-async function checkOwnershipInvariant(ids) {
-  const { resolveFirstPartyCapabilityDomains } =
-    await loadKernelDistributionSchemas();
-
+export function ownershipSelfTestFailures(resolveFirstPartyCapabilityDomains) {
   const lockOf = (capabilityDomainOwners) => ({
     schemaVersion: 1,
     distributionId: 'dist-check-selftest',
@@ -599,6 +578,43 @@ async function checkOwnershipInvariant(ids) {
     /* expected */
   }
 
+  return failures;
+}
+
+/**
+ * Guard for the capability-domain OWNERSHIP (reservation) table.
+ *
+ * This repo has no test runner (no package.json, no CI workflow of its own) —
+ * `dist:check` IS its gate — so the invariant is asserted here, where it
+ * actually runs, rather than in a spec file nothing would execute.
+ *
+ * THE INVARIANT THAT MATTERS: **every edition carries the IDENTICAL table.**
+ *
+ *   Ownership is a property of the platform, not of what an edition preloads.
+ *   An earlier design put the claim on each `LockedBiome`, which made a trimmed
+ *   edition (`appliance-lean`) leave `kb`/`agent`/… unowned — so an
+ *   org admin could install the owning biome from the store and THEN bind
+ *   `kb:page.read@1` to a URL they control, silently shadowing the platform
+ *   data plane. The table is now built from the FULL biome index and reserves
+ *   the domain even when its owning biome is absent from that edition — which
+ *   is exactly the case the reservation exists to cover.
+ *
+ * Also re-asserts the two structural rules, through the KERNEL's own reader:
+ *   (a) two biomes claiming the SAME domain is refused (ambiguous ownership has
+ *       no safe resolution — fail the build, never pick a winner);
+ *   (b) a domain in NO table entry is not first-party (so a claim that never
+ *       made it into a resolved, committed, drift-checked lock carries no
+ *       weight), and an invalid domain is refused rather than silently carried.
+ *
+ * @param {string[]} ids every distribution id discovered in this repo.
+ * @returns {Promise<boolean>} true when green.
+ */
+async function checkOwnershipInvariant(ids) {
+  const { resolveFirstPartyCapabilityDomains } =
+    await loadKernelDistributionSchemas();
+
+  const failures = ownershipSelfTestFailures(resolveFirstPartyCapabilityDomains);
+
   // (d) THE headline invariant — every committed edition carries the same,
   //     non-empty table. An edition-specific table is the fail-open bug.
   let reference;
@@ -919,13 +935,16 @@ export async function checkBiomeContentHashes(id) {
   }
 }
 
-async function main() {
-  let failed = false;
-  // The tests spawned below resolve the editions root from THEIR OWN argv and
-  // env; a root stated here by --editions-root must reach them, or they
-  // would grade the vendor's editions under a customer's dist-check.
-  const checkSources = process.argv.includes('--check-sources');
-
+/**
+ * The data-root plane both checks grade before any edition: the kernel speaks
+ * a supported edition protocol (a refusal throws), the committed biome,
+ * platform-service and runtime-image-source indexes validate offline, the
+ * evidence trust policy and the data-root readers are sound. `checkSources`
+ * adds the trusted live-source audit of the indexes (release path only).
+ * Returns true when green.
+ */
+export async function checkDataRootPlane({ checkSources }) {
+  let green = true;
   // 0. The pinned kernel speaks an edition protocol this CLI supports. This is
   // the ONE comparison between the CLI and the kernel; a refusal throws
   // EditionProtocolMismatchError and stops the check before anything is read.
@@ -938,13 +957,13 @@ async function main() {
   // A live sibling-source scan is an explicit trusted regeneration audit only;
   // CI/shared working trees must not make unrelated uncommitted sources into
   // packaging inputs.
-  if (!checkCommittedIndex()) {failed = true;}
-  if (!(await checkCommittedPlatformServiceIndex())) {failed = true;}
+  if (!checkCommittedIndex()) {green = false;}
+  if (!(await checkCommittedPlatformServiceIndex())) {green = false;}
   if (!(await checkCommittedRuntimeImageSourceIndex(checkSources))) {
-    failed = true;
+    green = false;
   }
-  if (!(await checkEvidenceTrustPolicy())) {failed = true;}
-  if (!checkCommittedDataRootReaders()) {failed = true;}
+  if (!(await checkEvidenceTrustPolicy())) {green = false;}
+  if (!checkCommittedDataRootReaders()) {green = false;}
   if (checkSources) {
     try {
       execFileSync(
@@ -958,9 +977,48 @@ async function main() {
         { stdio: 'inherit' },
       );
     } catch {
-      failed = true;
+      green = false;
     }
   }
+  return green;
+}
+
+/**
+ * The pinned kernel's authorization composer (`kernel` null when the pin
+ * predates it). `green` is false when the composer could not be loaded.
+ */
+export async function loadPlaneAuthorizationKernel() {
+  try {
+    return { green: true, kernel: await loadKernelAuthorizationComposer({ kernelPackageDir: kernelPackageDir() }) };
+  } catch (err) {
+    console.error(`[dist:check] ${err.message}`);
+    return { green: false, kernel: undefined };
+  }
+}
+
+/**
+ * The fleet chart-set pin every edition must carry (edition-chart-set.mjs), as
+ * committed text, or null when it is absent or not a rostered chart-set lock.
+ */
+export function readFleetChartSetPin() {
+  try {
+    const text = readFileSync(fleetChartSetLockPath(), 'utf8');
+    assertRosteredChartSetLock(JSON.parse(text), EDITION_CHART_SET_FILE);
+    return text;
+  } catch (err) {
+    console.error(`[dist:check] chart-set pin: ${err.message}. Run \`${commandFor('resolve-chart-set.mjs')}\`.`);
+    return null;
+  }
+}
+
+async function main() {
+  let failed = false;
+  // The tests spawned below resolve the editions root from THEIR OWN argv and
+  // env; a root stated here by --editions-root must reach them, or they
+  // would grade the vendor's editions under a customer's dist-check.
+  const checkSources = process.argv.includes('--check-sources');
+
+  if (!(await checkDataRootPlane({ checkSources }))) {failed = true;}
 
   const distributionIds = discoverDistributionIds();
 
@@ -972,25 +1030,12 @@ async function main() {
   if (!(await checkOwnershipInvariant(distributionIds))) {failed = true;}
 
   // The pinned kernel's authorization composer (null when the pin predates it).
-  let authorizationKernel;
-  try {
-    authorizationKernel = await loadKernelAuthorizationComposer({
-      kernelPackageDir: kernelPackageDir(),
-    });
-  } catch (err) {
-    console.error(`[dist:check] ${err.message}`);
-    failed = true;
-  }
+  const { green: authorizationKernelGreen, kernel: authorizationKernel } = await loadPlaneAuthorizationKernel();
+  if (!authorizationKernelGreen) {failed = true;}
 
   // The fleet chart-set pin every edition must carry (edition-chart-set.mjs).
-  let chartSetPinText = null;
-  try {
-    chartSetPinText = readFileSync(fleetChartSetLockPath(), 'utf8');
-    assertRosteredChartSetLock(JSON.parse(chartSetPinText), EDITION_CHART_SET_FILE);
-  } catch (err) {
-    console.error(`[dist:check] chart-set pin: ${err.message}. Run \`${commandFor('resolve-chart-set.mjs')}\`.`);
-    failed = true;
-  }
+  const chartSetPinText = readFleetChartSetPin();
+  if (chartSetPinText === null) {failed = true;}
 
   // 3 + 4 + 5 + 6 + 7. Every distribution: distribution.lock, images.lock,
   // authorization.lock, chart-set.lock.

package/edition/edition-config.mjs

@@ -7,7 +7,9 @@
 
 import { join } from 'node:path';
 
+import { canonicalPublicHttpsRepositoryUrl } from './canonical-repository-url.mjs';
 import { dataRoot } from './edition-workspace.mjs';
+import { isUnderSourcePrefix } from './git-source-auth.mjs';
 import { readStrictJsonFile } from './strict-json.mjs';
 import {
   parseConfinedBiomes,
@@ -163,6 +165,28 @@ function requireEvidenceTrustPolicy(config) {
   return Object.freeze({ policy: value.policy, pin: value.pin });
 }
 
+/**
+ * Every first-party repository URL is canonical and under the workspace's
+ * `sourceRepositoryUrlPrefix`: the develop graph sends the source token there.
+ */
+function assertFirstPartyUrls(firstPartySources, prefix) {
+  for (const [repo, { repositoryUrl }] of Object.entries(firstPartySources)) {
+    const where = `${EDITION_WORKSPACE_CONFIG_FILE}: "firstPartySources"["${repo}"].repositoryUrl`;
+    let canonical;
+    try {
+      canonical = canonicalPublicHttpsRepositoryUrl(repositoryUrl, where);
+    } catch (err) {
+      throw new EditionWorkspaceConfigError(err.message);
+    }
+    if (canonical !== repositoryUrl) {
+      throw new EditionWorkspaceConfigError(`${where} ${JSON.stringify(repositoryUrl)} is not in its canonical form (${canonical})`);
+    }
+    if (!isUnderSourcePrefix(canonical, prefix)) {
+      throw new EditionWorkspaceConfigError(`${where} ${JSON.stringify(repositoryUrl)} is not under sourceRepositoryUrlPrefix ${prefix}`);
+    }
+  }
+}
+
 /** Validate a parsed config document; returns the frozen, typed config. */
 export function parseEditionWorkspaceConfig(document) {
   if (document === null || typeof document !== 'object' || Array.isArray(document)) {
@@ -179,11 +203,13 @@ export function parseEditionWorkspaceConfig(document) {
       .filter(([key]) => document[key] !== undefined)
       .map(([key, parse]) => [key, parse(document[key])]),
   );
+  const sourceRepositoryUrlPrefix = requireString(document, 'sourceRepositoryUrlPrefix', SOURCE_URL_PREFIX, 'https://<host>/<organisation>/ with a trailing slash');
+  if (sections.firstPartySources !== undefined) {assertFirstPartyUrls(sections.firstPartySources, sourceRepositoryUrlPrefix);}
   return Object.freeze({
     ...sections,
     imageRegistry: requireString(document, 'imageRegistry', IMAGE_REGISTRY, '<host>/<namespace> with no scheme or trailing slash'),
     ...optionalChartSet(document),
-    sourceRepositoryUrlPrefix: requireString(document, 'sourceRepositoryUrlPrefix', SOURCE_URL_PREFIX, 'https://<host>/<organisation>/ with a trailing slash'),
+    sourceRepositoryUrlPrefix,
     sourceAuthUsername: requireSourceAuthUsername(document),
     evidenceTrustPolicy: requireEvidenceTrustPolicy(document),
   });

package/edition/first-party-source-ids.mjs

@@ -15,20 +15,23 @@ import { workspaceSection } from './edition-config.mjs';
 // `sources[]` entry, so its id is declared in the data root's
 // `edition-workspace.json` (`firstPartySources`), keyed by the `repo` handle the
 // runtime image source index pins it under. The key is a lookup handle and may
-// move with the aggregator layout; the VALUE is the identity and must not.
+// move with the aggregator layout; the entry's `sourceId` is the identity and
+// must not. The entry's `repositoryUrl` is where the repository lives
+// (provenance, never identity): the develop graph resolves heads there.
 //
-// EVERY repository `runtime-image-source-index.json` pins is declared there (a
-// contract test holds the two sets equal), so a newly pinned repository is
-// refused at once rather than the day it first declares a composed image. A
-// lookup of an undeclared repository is refused (`firstPartySourceId`), never
-// named by a fallback.
+// EVERY repository `runtime-image-source-index.json` pins is declared there, at
+// the same URL (the offline index check refuses otherwise), so a newly pinned
+// repository is refused at once rather than the day it first declares a
+// composed image. A declared repository need not be pinned yet: the develop
+// graph carries it before any release does. A lookup of an undeclared
+// repository is refused (`firstPartySourceId`), never named by a fallback.
 
 /** The kernel's source-handle grammar (`BiomeSourceNameSchema`): lowercase kebab-case. */
 export const DECLARED_SOURCE_ID_PATTERN = /^[a-z][a-z0-9-]*$/;
 
-/** The data root's declared id of each first-party repository (`firstPartySources`). */
-export const firstPartySourceIds = () =>
-  workspaceSection('firstPartySources', 'naming a runtime subject after its first-party source');
+/** The data root's first-party repositories (`firstPartySources`): repo handle -> { sourceId, repositoryUrl }. */
+export const firstPartySources = (needed = 'naming a runtime subject after its first-party source') =>
+  workspaceSection('firstPartySources', needed);
 
 export class UndeclaredSourceIdError extends Error {
   constructor(message) {
@@ -48,12 +51,12 @@ export function assertDeclaredSourceId(sourceId, where) {
 }
 
 export function firstPartySourceId(repo) {
-  const ids = firstPartySourceIds();
-  if (!Object.hasOwn(ids, repo)) {
+  const sources = firstPartySources();
+  if (!Object.hasOwn(sources, repo)) {
     throw new UndeclaredSourceIdError(
       `first-party repository "${repo}" has no declared source id — declare it in ` +
         'edition-workspace.json under "firstPartySources"; a runtime identity is never derived from a repository name or URL',
     );
   }
-  return assertDeclaredSourceId(ids[repo], `first-party repository "${repo}"`);
+  return assertDeclaredSourceId(sources[repo].sourceId, `first-party repository "${repo}"`);
 }

package/edition/git-source-auth.mjs

@@ -25,7 +25,7 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
-import { canonicalPublicHttpsRepositoryUrl } from './lib.mjs';
+import { canonicalPublicHttpsRepositoryUrl } from './canonical-repository-url.mjs';
 
 /** The fixed environment variable holding the source read token. */
 export const SOURCE_READ_TOKEN_ENV = 'EVIDENCE_REPOSITORIES_TOKEN';

package/edition/lib.mjs

@@ -3075,38 +3075,6 @@ export function validateImmutableImageLock(lock, schemas) {
   return lock;
 }
 
-export function canonicalPublicHttpsRepositoryUrl(raw, context) {
-  if (typeof raw !== 'string' || raw.length === 0 || raw.trim() !== raw) {
-    throw new Error(`${context} must be a non-empty canonical HTTPS URL`);
-  }
-  let parsed;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    throw new Error(`${context} is not a valid URL`);
-  }
-  if (parsed.protocol !== 'https:') {
-    throw new Error(`${context} must use HTTPS`);
-  }
-  if (parsed.username.length > 0 || parsed.password.length > 0) {
-    throw new Error(
-      `${context} must not contain username/password credentials`,
-    );
-  }
-  if (
-    parsed.search.length > 0 ||
-    parsed.hash.length > 0 ||
-    raw.includes('?') ||
-    raw.includes('#')
-  ) {
-    throw new Error(`${context} must not contain a query or fragment`);
-  }
-  if (parsed.hostname.length === 0) {
-    throw new Error(`${context} must identify a repository host`);
-  }
-  return parsed.toString();
-}
-
 /**
  * Assert that an exact 40-hex commit exists in a source repository. Delegates
  * to `@xemahq/distribution-source-hash` — the tooling holds no second copy of

package/edition/pin-source.mjs

@@ -10,8 +10,9 @@
 // published pin. This module owns the SHAPE of that map: a flat object whose
 // keys live in six closed namespaces and whose values are exact 40-hex SHAs.
 //
-//   repos/<x> | submodules/<x>        every `repositoryPins[].repo` of the runtime
-//                                     image source index (the graph), no more, no fewer
+//   repos/<x> | submodules/<x>        every repository of the develop graph (the
+//                                     data root's firstPartySources, develop-graph.mjs),
+//                                     no more, no fewer
 //   <pinRoles.data>                   the commit of the data root checkout (editions and indices)
 //   <pinRoles.kernel>                 the commit of the kernel the authorization lock is sealed
 //                                     with (may match repos/<x>, but is NOT in the graph)
@@ -20,6 +21,7 @@
 //                                     only when that root is NOT this repository
 //   sources/<name>                    one per `sources[]` entry declared in the chain
 
+import { developGraphMembers } from './develop-graph.mjs';
 import { workspaceSection } from './edition-config.mjs';
 import { compareStrings } from './lib.mjs';
 import { PinRole } from './workspace-sections.mjs';
@@ -109,19 +111,20 @@ function graphPinsOf(pins) {
 }
 
 /**
- * Validate a COMPLETE snapshot against the graph and the composed chain.
- * `declaredSourceNames` are the `sources[].name` entries the chain declares;
- * `editionsRootExternal` is whether the editions root is another repository.
- * Every refusal names the offending key; nothing falls back to a published pin.
+ * Validate a COMPLETE snapshot against the develop graph and the composed
+ * chain. `declaredSourceNames` are the `sources[].name` entries the chain
+ * declares; `editionsRootExternal` is whether the editions root is another
+ * repository. Every refusal names the offending key; nothing falls back to a
+ * published pin.
  */
 export function validateSnapshotPins(
   pins,
-  { runtimeSourceIndex, declaredSourceNames, editionsRootExternal },
+  { declaredSourceNames, editionsRootExternal },
 ) {
   assertPinsObject(pins);
   assertExactShas(pins);
   for (const key of Object.keys(pins)) {snapshotPinNamespace(key);}
-  checkGraphPins(runtimeSourceIndex.repositoryPins, pins);
+  checkGraphPins(developGraphMembers(), pins);
   for (const [key, what] of [
     [dataPinKey(), 'the commit of the data root checkout'],
     [kernelPinKey(), 'the commit of the kernel the authorization lock is sealed with'],
@@ -175,7 +178,10 @@ export function snapshotPinSource(pins) {
 /**
  * Apply a pin source to a parsed runtime image source index. Published returns
  * the SAME object (inert, byte for byte). Snapshot returns a copy whose
- * `repositoryPins` carry the snapshot SHAs.
+ * `repositoryPins` are the DEVELOP GRAPH (develop-graph.mjs) at the snapshot
+ * SHAs: the committed index's own pins are not read, so a first-party
+ * repository no release pins yet is in it, and a pinned one that is not
+ * first-party is not.
  */
 export function applyPinSource(runtimeSourceIndex, pinSource = PUBLISHED_PIN_SOURCE) {
   switch (pinSource?.kind) {
@@ -211,12 +217,13 @@ function applySnapshot(runtimeSourceIndex, pins) {
   assertPinsObject(pins);
   assertExactShas(pins);
   for (const key of Object.keys(pins)) {snapshotPinNamespace(key);}
-  const graph = runtimeSourceIndex.repositoryPins;
+  const graph = developGraphMembers();
   checkGraphPins(graph, pins);
   return {
     ...runtimeSourceIndex,
-    repositoryPins: graph.map((pin) => ({
-      ...pin,
+    repositoryPins: graph.map(({ repo, repositoryUrl }) => ({
+      repo,
+      repositoryUrl,
       // A develop snapshot pins every repository at its develop head, so that one
       // SHA is both the built commit (image axis, `sourceCommit`) and the source
       // tip (`vendoredSourceCommit`): the image pin lagging the source tip cannot
@@ -226,8 +233,8 @@ function applySnapshot(runtimeSourceIndex, pins) {
       // The COMMITTED index keeps the axes apart (release channel): see
       // `source-authority.mjs#publishedSourceTip` and
       // `build-runtime-image-source-index.mjs#repositoryIdentity`.
-      vendoredSourceCommit: pins[pin.repo],
-      sourceCommit: pins[pin.repo],
+      sourceCommit: pins[repo],
+      vendoredSourceCommit: pins[repo],
     })),
   };
 }

package/edition/workspace-sections.mjs

@@ -91,16 +91,46 @@ function supplementalLauncher(value, where) {
   return Object.freeze({ kind: value.kind, biomeId: text(value.biomeId, `${where}.biomeId`) });
 }
 
+/**
+ * The retired `{repo handle: source id}` string form of a `firstPartySources`
+ * entry. Refused, never read: the entry also declares where the repository
+ * lives, which the develop graph resolves its head from.
+ */
+export class RetiredFirstPartySourceShapeError extends Error {
+  constructor(repo, id) {
+    super(
+      `${FILE}: "firstPartySources"["${repo}"] is the retired source-id string ${JSON.stringify(id)}. ` +
+        `Migrate it to { "sourceId": ${JSON.stringify(id)}, "repositoryUrl": "<the repository's canonical https URL>" }.`,
+    );
+    this.name = 'RetiredFirstPartySourceShapeError';
+  }
+}
+
+/**
+ * `firstPartySources`: every first-party repository, keyed by its source
+ * checkout handle, with its declared source id (the identity a runtime subject
+ * is named after) and its repository URL (where it lives: the develop graph
+ * resolves its head there, and a release pin must name the same URL). The URL
+ * is checked canonical and under `sourceRepositoryUrlPrefix` with the whole
+ * config (edition-config.mjs).
+ */
 export function parseFirstPartySources(value) {
   const where = '"firstPartySources"';
-  if (!isObject(value) || Object.keys(value).length === 0) {fail(where, 'must be a non-empty {repo handle: source id} object');}
-  const entries = Object.entries(value).map(([repo, id]) => {
+  if (!isObject(value) || Object.keys(value).length === 0) {
+    fail(where, 'must be a non-empty {repo handle: { sourceId, repositoryUrl }} object');
+  }
+  const entries = Object.entries(value).map(([repo, entry]) => {
     repoHandle(repo, `${where} key`);
-    if (typeof id !== 'string' || !SOURCE_ID.test(id)) {
-      fail(`${where}["${repo}"]`, `must be a lowercase kebab-case source id; got ${JSON.stringify(id)}`);
+    if (typeof entry === 'string') {throw new RetiredFirstPartySourceShapeError(repo, entry);}
+    const at = `${where}["${repo}"]`;
+    exactObject(entry, at, ['sourceId', 'repositoryUrl']);
+    if (typeof entry.sourceId !== 'string' || !SOURCE_ID.test(entry.sourceId)) {
+      fail(`${at}.sourceId`, `must be a lowercase kebab-case source id; got ${JSON.stringify(entry.sourceId)}`);
     }
-    return [repo, id];
+    return [repo, Object.freeze({ sourceId: entry.sourceId, repositoryUrl: text(entry.repositoryUrl, `${at}.repositoryUrl`) })];
   });
+  uniqueBy(entries, `${where} sourceId`, ([, entry]) => entry.sourceId);
+  uniqueBy(entries, `${where} repositoryUrl`, ([, entry]) => entry.repositoryUrl);
   return Object.freeze(Object.fromEntries(entries));
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.42.0",
+  "version": "0.44.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:ae545509930a5b6f1215c413f3e7121b15a29d5fd3e14ab373f0910ceaa9063d"
+    "sourceDigest": "sha256:72008b3d37f2cbcef3c5ec25e2d85989198ebc1f9bc1f481b8b767965813d5aa"
   }
 }