@xemahq/xema 0.43.0 → 0.44.0

package/dist/edition/verify-image-evidence.bundle.mjs

@@ -62888,6 +62888,39 @@ var AuthorizationLockCheck = Object.freeze({
 // edition/edition-config.mjs
 import { join as join3 } from "node:path";
 
+// edition/canonical-repository-url.mjs
+function canonicalPublicHttpsRepositoryUrl(raw, context) {
+  if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw) {
+    throw new Error(`${context} must be a non-empty canonical HTTPS URL`);
+  }
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw new Error(`${context} is not a valid URL`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(`${context} must use HTTPS`);
+  }
+  if (parsed.username.length > 0 || parsed.password.length > 0) {
+    throw new Error(
+      `${context} must not contain username/password credentials`
+    );
+  }
+  if (parsed.search.length > 0 || parsed.hash.length > 0 || raw.includes("?") || raw.includes("#")) {
+    throw new Error(`${context} must not contain a query or fragment`);
+  }
+  if (parsed.hostname.length === 0) {
+    throw new Error(`${context} must identify a repository host`);
+  }
+  return parsed.toString();
+}
+
+// edition/git-source-auth.mjs
+function isUnderSourcePrefix(canonicalUrl, prefix) {
+  return canonicalUrl.startsWith(prefix) && canonicalUrl.length > prefix.length;
+}
+
 // edition/strict-json.mjs
 import { readFileSync } from "node:fs";
 var DuplicateJsonKeyError = class extends Error {
@@ -63056,18 +63089,33 @@ function supplementalLauncher(value, where) {
   }
   return Object.freeze({ kind: value.kind, biomeId: text(value.biomeId, `${where}.biomeId`) });
 }
+var RetiredFirstPartySourceShapeError = class extends Error {
+  constructor(repo, id) {
+    super(
+      `${FILE}: "firstPartySources"["${repo}"] is the retired source-id string ${JSON.stringify(id)}. Migrate it to { "sourceId": ${JSON.stringify(id)}, "repositoryUrl": "<the repository's canonical https URL>" }.`
+    );
+    this.name = "RetiredFirstPartySourceShapeError";
+  }
+};
 function parseFirstPartySources(value) {
   const where = '"firstPartySources"';
   if (!isObject(value) || Object.keys(value).length === 0) {
-    fail(where, "must be a non-empty {repo handle: source id} object");
+    fail(where, "must be a non-empty {repo handle: { sourceId, repositoryUrl }} object");
   }
-  const entries = Object.entries(value).map(([repo, id]) => {
+  const entries = Object.entries(value).map(([repo, entry]) => {
     repoHandle(repo, `${where} key`);
-    if (typeof id !== "string" || !SOURCE_ID.test(id)) {
-      fail(`${where}["${repo}"]`, `must be a lowercase kebab-case source id; got ${JSON.stringify(id)}`);
+    if (typeof entry === "string") {
+      throw new RetiredFirstPartySourceShapeError(repo, entry);
+    }
+    const at = `${where}["${repo}"]`;
+    exactObject(entry, at, ["sourceId", "repositoryUrl"]);
+    if (typeof entry.sourceId !== "string" || !SOURCE_ID.test(entry.sourceId)) {
+      fail(`${at}.sourceId`, `must be a lowercase kebab-case source id; got ${JSON.stringify(entry.sourceId)}`);
     }
-    return [repo, id];
+    return [repo, Object.freeze({ sourceId: entry.sourceId, repositoryUrl: text(entry.repositoryUrl, `${at}.repositoryUrl`) })];
   });
+  uniqueBy(entries, `${where} sourceId`, ([, entry]) => entry.sourceId);
+  uniqueBy(entries, `${where} repositoryUrl`, ([, entry]) => entry.repositoryUrl);
   return Object.freeze(Object.fromEntries(entries));
 }
 function parseRuntimeBinding(value, where) {
@@ -63299,6 +63347,23 @@ function requireEvidenceTrustPolicy(config) {
   }
   return Object.freeze({ policy: value.policy, pin: value.pin });
 }
+function assertFirstPartyUrls(firstPartySources2, prefix) {
+  for (const [repo, { repositoryUrl }] of Object.entries(firstPartySources2)) {
+    const where = `${EDITION_WORKSPACE_CONFIG_FILE}: "firstPartySources"["${repo}"].repositoryUrl`;
+    let canonical;
+    try {
+      canonical = canonicalPublicHttpsRepositoryUrl(repositoryUrl, where);
+    } catch (err) {
+      throw new EditionWorkspaceConfigError(err.message);
+    }
+    if (canonical !== repositoryUrl) {
+      throw new EditionWorkspaceConfigError(`${where} ${JSON.stringify(repositoryUrl)} is not in its canonical form (${canonical})`);
+    }
+    if (!isUnderSourcePrefix(canonical, prefix)) {
+      throw new EditionWorkspaceConfigError(`${where} ${JSON.stringify(repositoryUrl)} is not under sourceRepositoryUrlPrefix ${prefix}`);
+    }
+  }
+}
 function parseEditionWorkspaceConfig(document) {
   if (document === null || typeof document !== "object" || Array.isArray(document)) {
     throw new Error(`${EDITION_WORKSPACE_CONFIG_FILE} must be a JSON object`);
@@ -63314,11 +63379,15 @@ function parseEditionWorkspaceConfig(document) {
   const sections = Object.fromEntries(
     Object.entries(SECTIONS).filter(([key]) => document[key] !== void 0).map(([key, parse]) => [key, parse(document[key])])
   );
+  const sourceRepositoryUrlPrefix = requireString(document, "sourceRepositoryUrlPrefix", SOURCE_URL_PREFIX, "https://<host>/<organisation>/ with a trailing slash");
+  if (sections.firstPartySources !== void 0) {
+    assertFirstPartyUrls(sections.firstPartySources, sourceRepositoryUrlPrefix);
+  }
   return Object.freeze({
     ...sections,
     imageRegistry: requireString(document, "imageRegistry", IMAGE_REGISTRY, "<host>/<namespace> with no scheme or trailing slash"),
     ...optionalChartSet(document),
-    sourceRepositoryUrlPrefix: requireString(document, "sourceRepositoryUrlPrefix", SOURCE_URL_PREFIX, "https://<host>/<organisation>/ with a trailing slash"),
+    sourceRepositoryUrlPrefix,
     sourceAuthUsername: requireSourceAuthUsername(document),
     evidenceTrustPolicy: requireEvidenceTrustPolicy(document)
   });

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "artifactSha256": "sha256:7fa4aabdd08ee4c39e6f08a9e28a081ec1d3080fbd043e40ade1f0ecdfac65fe",
+  "artifactSha256": "sha256:945753c501638be9393cd1ebc697d58c2ddb11adbdebcdac7ae045e2cd34bf9b",
   "esbuild": {
     "version": "0.28.2"
   },
@@ -2419,253 +2419,277 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:bbeac7ff01376cb89ed2140526d4795d8e559b3f01612b404a701f19aaa24c6a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
+      "path": "edition/canonical-repository-url.mjs",
+      "sha256": "sha256:91e7590afba782a3ee2fa64084e7c715e6a5b52c11e8a9cc68c64397f181b888"
+    },
+    {
+      "package": "@xemahq/xema",
+      "version": "0.44.0",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
+      "path": "edition/develop-graph.mjs",
+      "sha256": "sha256:319db77e708dd73a9dd4a81a963d86e52b030cad3346b104c0862af4e38a2237"
+    },
+    {
+      "package": "@xemahq/xema",
+      "version": "0.44.0",
       "path": "edition/dispatched-runtime-components.mjs",
       "sha256": "sha256:9712823d183a60108cd002b2d36a9e5c0867b9d576dd02825264a18f7b8ece69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:282b6d5e70736f7e41cff41167d2cd99b7d0127dcc2b712132888dcfc82e36cd"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:f9f16b58279c8c2619a39c5cc92bdbc334543d1a324304cd5d3b120d66dc8f3a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/edition-config.mjs",
-      "sha256": "sha256:e3997bd9a0082e02d01760868b2a4f41ed3081e904126b30fdf86e7938dc6137"
+      "sha256": "sha256:7604e79a480c9b9db1d1c256155f05298adf6caa49da95ad232f6be581f3c72e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:d3747ca300f38832796521b47d12076bdba7f214199a1dec52c9384ab3dde394"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:c575e96b70bda82899931eb0b18567988e2e13e664fa498bcbef96b571dcabb4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:af7c88854007e63e4e77863cf72610f59ff838959dbd381087ec50ba782ae0e1"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:1f10ece5f34b6a6b0dbe169b6cbabe4b1b0778a1bc136c9c5c29b54181b1f546"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b141474fff33b06734fb62cd2552752b991c8267bb1c9bccb22a81dd80e91c6c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:892b360f9f80d2308b0b12f9b99658ae06173878d9b71cf5d6fc8bd717b3c86e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:65077589d1d9bd129c175c03a6dca6bb4eaf277fa29d6391e1065654fe8cc246"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
+      "path": "edition/first-party-source-ids.mjs",
+      "sha256": "sha256:20cb1ad7cfb8c6e6686a6be5a51289da4bba76c20b58d9c1b5b6b3813a38dc1c"
+    },
+    {
+      "package": "@xemahq/xema",
+      "version": "0.44.0",
       "path": "edition/git-json.mjs",
       "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
+      "path": "edition/git-source-auth.mjs",
+      "sha256": "sha256:c1b32aa6f7d59798db58238d632cafeadbd4f07376396a31acdeb5f0ac56dcac"
+    },
+    {
+      "package": "@xemahq/xema",
+      "version": "0.44.0",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:8ccbd4e7ce482cbb25521e893ac047d31ca1da782e87ee2179629e8911aa6aa3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:20abdde62a7b037c01ea9bbe1ff1e6094e6b0efd0add2f656f1938a04409bf82"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/lib.mjs",
-      "sha256": "sha256:7ed1bf641f501ec6a85d4fe24c4373a2e3885b799489dd33c77ff874fc138b25"
+      "sha256": "sha256:2cf8f4b52f9532f536a27c8bf6736cc760d7026754945209b1cf5be23391ef49"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:92656c5e920fca2a5a75c0b8db133d551ba044c84a149f33435479248b3dff8b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/pin-source.mjs",
-      "sha256": "sha256:a23fef4698ef66ba9de4a1aabe3eebe6487d1f105f3fc161bafc5a33b99a2440"
+      "sha256": "sha256:32fa918729a83587b4d3bca6e5fe381f5a525397ebc49d52729ec1f8cf216c37"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/sigstore-bundle-media-type.mjs",
       "sha256": "sha256:e0aa5a3992f0385ddbbe69eb0307d642ac428ef516c8394816ac4fd52e0ac39c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:9c351f60e8ea838f445f89c3709c60b7f13b021b78d6e40eaef91350a793f0ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/trust-policy-arming.mjs",
       "sha256": "sha256:6f6f192118407e71a744087caea988bcf3d33aca9803217bceb8134d7e2b9120"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/verify-catalogue-evidence.mjs",
       "sha256": "sha256:d7e42efc9edced97e4330cddc46183445a870ba22f57896a7ea6bc600d369137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:396936f3d9e0ed68902b8b03c6fa02479e439357e6194ac8ce0e0991be834706"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "edition/workspace-sections.mjs",
-      "sha256": "sha256:383f37ce066ea5573c30cedf124022095bf94d050f0a266a5881f587cff0ced0"
+      "sha256": "sha256:18c28e9fa2a6b7d8589c8434fc6ed9f1e93954d41339813e711ed0fbbcf5c61d"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.43.0",
+      "version": "0.44.0",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/edition/README.md

@@ -106,6 +106,20 @@ It refuses on:
 
 It reads no lock content (the committed `distribution`, `images`, `authorization` and per-edition `chart-set` locks; the trust-arming rule counts lock files by presence) and no source checkout at a pinned commit. The sources root is read only for the kernel contract checkout the runtime-image-source index check verifies its authority against. `--check-sources` is refused: it is the release check's source audit.
 
+## Develop graph
+
+The develop graph is the data root's first-party repositories, declared in `edition-workspace.json`:
+
+```json
+"firstPartySources": {
+  "repos/xema-base": { "sourceId": "xema-base", "repositoryUrl": "https://git.example.com/acme/xema-base.git" }
+}
+```
+
+- Each key is a repository handle (`repos/<x>` or `submodules/<x>`); `sourceId` is its kebab-case source id; `repositoryUrl` is canonical HTTPS under `sourceRepositoryUrlPrefix`. Both are unique. The retired string form (`"repos/x": "x"`) is refused with `RetiredFirstPartySourceShapeError`.
+- `xema edition develop freeze-graph` pins every declared repository at the `develop` head of its declared URL; overrides may name any of them. The snapshot's `repositoryPins` (`develop resolve`, `checkout-indexed-source-repositories.mjs --snapshot-pins`) are exactly these repositories. The runtime image source index's `repositoryPins` are release pins and are not read on develop.
+- A first-party repository is in the develop graph before any release pins it. The converse is checked offline: every `repositoryPins` entry must be declared first-party at the same `repositoryUrl`.
+
 ## Develop plane invariants
 
 `xema edition develop resolve` asserts the capability-domain reservation table and biome confinement on the candidate it resolves, against the develop graph it froze, before any later phase. On develop they are asserted only there; `xema edition check` asserts them over the committed locks.

package/edition/build-platform-service-index.mjs

@@ -3,9 +3,9 @@
 import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 
+import { canonicalPublicHttpsRepositoryUrl } from './canonical-repository-url.mjs';
 import { platformServiceIndexPath , WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, sourcePath } from './edition-workspace.mjs';
 import {
-  canonicalPublicHttpsRepositoryUrl,
   loadKernelDistributionSchemas,
   readGitJsonAtCommit,
   serializeJson,

package/edition/build-runtime-image-source-index.mjs

@@ -5,10 +5,12 @@ import { existsSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
 
 import { buildValidatedPlatformServiceIndex } from './build-platform-service-index.mjs';
+import { canonicalPublicHttpsRepositoryUrl } from './canonical-repository-url.mjs';
 import { connectorCrossRepoBuildInputs } from './connector-source-authority.mjs';
 import { editionWorkspaceConfig, workspaceSection } from './edition-config.mjs';
 import { biomeIndexPath, dataRoot, platformServiceIndexPath, runtimeImageSourceIndexPath, WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, sourcePath } from './edition-workspace.mjs';
 import { COMMIT_PATTERN } from './evidence-grammars.mjs';
+import { firstPartySources } from './first-party-source-ids.mjs';
 import {
   buildTrustedKernelContractAuthority,
   KERNEL_COMMIT_FLAG,
@@ -17,7 +19,6 @@ import {
 } from './kernel-contract-authority.mjs';
 import {
   buildBiomeIndex,
-  canonicalPublicHttpsRepositoryUrl,
   compareStrings,
   distributionBiomeSourceRepositories,
   loadKernelDistributionSchemas,
@@ -572,6 +573,28 @@ function compareSubject(left, right) {
   );
 }
 
+/**
+ * Every release pin names a first-party repository (`firstPartySources`) at
+ * the URL declared there. The converse is not required: a first-party
+ * repository is in the develop graph before any release pins it.
+ */
+function assertPinsAreFirstParty(repositoryPins) {
+  const declared = firstPartySources('checking that every release pin is a first-party repository');
+  for (const pin of repositoryPins) {
+    const source = declared[pin.repo];
+    if (source === undefined) {
+      throw new Error(
+        `runtime-image-source-index pins ${JSON.stringify(pin.repo)}, which edition-workspace.json does not declare under "firstPartySources"`,
+      );
+    }
+    if (source.repositoryUrl !== pin.repositoryUrl) {
+      throw new Error(
+        `runtime-image-source-index pins ${pin.repo} at ${pin.repositoryUrl}, but "firstPartySources" declares it at ${source.repositoryUrl}`,
+      );
+    }
+  }
+}
+
 export async function validateRuntimeImageSourceIndex(
   index,
   schemas,
@@ -658,6 +681,7 @@ export async function validateRuntimeImageSourceIndex(
       throw new Error(`${repository.repo} repositoryUrl is not canonical`);
     }
   }
+  assertPinsAreFirstParty(index.repositoryPins);
   // Every subject a biome contributes to the image plane — BOTH the standing
   // services and the runtime components. A runtime component is a full image
   // subject (built, signed, mirrored) that simply is never scheduled, so a

package/edition/canonical-repository-url.mjs

@@ -0,0 +1,35 @@
+// The canonical form of a public HTTPS repository URL, and the refusals that
+// define it. Leaf module: the workspace config and the git source hold read it
+// without importing the edition library.
+
+export function canonicalPublicHttpsRepositoryUrl(raw, context) {
+  if (typeof raw !== 'string' || raw.length === 0 || raw.trim() !== raw) {
+    throw new Error(`${context} must be a non-empty canonical HTTPS URL`);
+  }
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw new Error(`${context} is not a valid URL`);
+  }
+  if (parsed.protocol !== 'https:') {
+    throw new Error(`${context} must use HTTPS`);
+  }
+  if (parsed.username.length > 0 || parsed.password.length > 0) {
+    throw new Error(
+      `${context} must not contain username/password credentials`,
+    );
+  }
+  if (
+    parsed.search.length > 0 ||
+    parsed.hash.length > 0 ||
+    raw.includes('?') ||
+    raw.includes('#')
+  ) {
+    throw new Error(`${context} must not contain a query or fragment`);
+  }
+  if (parsed.hostname.length === 0) {
+    throw new Error(`${context} must identify a repository host`);
+  }
+  return parsed.toString();
+}

package/edition/checkout-indexed-source-repositories.mjs

@@ -250,7 +250,8 @@ const SNAPSHOT_PINS_FLAG = '--snapshot-pins';
 
 /**
  * `--snapshot-pins <file>` is the only argument: with it, the plan is the
- * committed index applied to that snapshot (the develop edition's frozen pins);
+ * develop graph (the data root's firstPartySources) at that snapshot (the
+ * develop edition's frozen pins), never the committed index's repositoryPins;
  * without it, the committed index untouched.
  */
 export function indexForCheckout(committedIndex, argv) {

package/edition/develop-edition.mjs

@@ -28,8 +28,8 @@
 //   freeze-graph --data-sha <sha> --kernel-sha <sha>
 //                --deploy-sha <sha> [--editions-root-url <https url>]
 //                [--overrides <json>] --out <file>
-//       resolve refs/heads/develop once per graph repository (and the editions
-//       root) from this checkout's runtime-image-source-index.json; the three checked-out
+//       resolve refs/heads/develop once per develop-graph repository (the data root's
+//       firstPartySources, at each declared URL) and the editions root; the three checked-out
 //       repositories are pinned at what the workflow checked out; write the pins. --kernel-sha is refused
 //       unless its declared edition protocol is one this CLI supports (the check choose-kernel applies to a pin).
 //   check-existing <id> --pins <file> --artifact <dir> --engine-image <repository>@sha256:<digest>
@@ -76,7 +76,7 @@ import { resolveDevelopEdition } from './develop-edition-resolve.mjs';
 import { assertNoToolingOverride, freezeGraph, freezeSources } from './develop-freeze.mjs';
 import { LOCAL_WORKFLOW, assertExistingArtifactMatches, developEditionTarget, workflowFromEnv, writeEditionArtifact } from './edition-artifact.mjs';
 import { EditionChannel } from './edition-constants.mjs';
-import { WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, kernelRepoDir, runtimeImageSourceIndexPath } from './edition-workspace.mjs';
+import { WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule, kernelRepoDir } from './edition-workspace.mjs';
 import { descriptorEvidenceTrust } from './evidence-trust-policy.mjs';
 import { assertKernelCommitSupported, chooseKernelCommit } from './kernel-protocol-choice.mjs';
 import { loadKernelDistributionSchemas } from './lib.mjs';
@@ -187,7 +187,6 @@ async function run(argv, env) {
     case 'freeze-graph': {
       assertKernelCommitSupported({ repoDir: kernelRepoDir(), commit: options['--kernel-sha'], label: `--kernel-sha ${options['--kernel-sha']}` });
       const pins = freezeGraph({
-        runtimeSourceIndex: readStrictJsonFile(runtimeImageSourceIndexPath()),
         dataSha: options['--data-sha'],
         kernelSha: options['--kernel-sha'],
         deploySha: options['--deploy-sha'],

package/edition/develop-freeze.mjs

@@ -15,9 +15,10 @@
 
 import { execFileSync } from 'node:child_process';
 
+import { canonicalPublicHttpsRepositoryUrl } from './canonical-repository-url.mjs';
+import { developGraphMembers } from './develop-graph.mjs';
 import { EditionChannel } from './edition-channel.mjs';
 import { assertCanonicalSourceUrl, assertSourceDeclaresNoCredential, isUnderSourcePrefix, withSourceGitEnv } from './git-source-auth.mjs';
-import { canonicalPublicHttpsRepositoryUrl } from './lib.mjs';
 import {
   dataPinKey,
   EDITIONS_ROOT_PIN_KEY,
@@ -144,7 +145,6 @@ function assertCheckedOutPin({ key, sha, flag, what, overrides }) {
 
 /**
  * @param {object} request
- * @param {object} request.runtimeSourceIndex the checkout's runtime-image-source-index.json (raw)
  * @param {string} request.dataSha the commit the data root checkout is at
  * @param {string} request.kernelSha the commit the kernel checkout is at
  * @param {string} request.deploySha the commit the deploy checkout is at
@@ -152,7 +152,6 @@ function assertCheckedOutPin({ key, sha, flag, what, overrides }) {
  * @param {(source: {name: string, url: string}) => void} request.holdSource the hold of one source; runs for ALL graph sources before the first head
  */
 export function freezeGraph({
-  runtimeSourceIndex,
   dataSha,
   kernelSha,
   deploySha,
@@ -164,7 +163,9 @@ export function freezeGraph({
   assertNoToolingOverride(overrides);
   assertOverrides(overrides, GRAPH_PHASE);
   const head = memoizedHeads(resolveHead);
-  const graph = new Set(runtimeSourceIndex.repositoryPins.map((pin) => pin.repo));
+  // The develop graph is the data root's first-party repositories (develop-graph.mjs), never the release pins.
+  const members = developGraphMembers();
+  const graph = new Set(members.map((member) => member.repo));
   for (const [key] of Object.entries(overrides)) {
     if (snapshotPinNamespace(key) === SnapshotPinNamespace.Graph && !graph.has(key)) {
       throw new Error(`override names "${key}", which is not a repository in the graph`);
@@ -176,7 +177,7 @@ export function freezeGraph({
     { key: deployPinKey(), sha: deploySha, flag: '--deploy-sha', what: 'the deploy checkout' },
   ];
   for (const { key, sha, flag, what } of checkedOut) {assertCheckedOutPin({ key, sha, flag, what, overrides });}
-  const toResolve = runtimeSourceIndex.repositoryPins.map((pin) => ({ name: pin.repo, url: pin.repositoryUrl }));
+  const toResolve = members.map((member) => ({ name: member.repo, url: member.repositoryUrl }));
   if (editionsRootUrl !== undefined) {
     toResolve.push({ name: EDITIONS_ROOT_PIN_KEY, url: canonicalPublicHttpsRepositoryUrl(editionsRootUrl, '--editions-root-url') });
   }
@@ -186,8 +187,8 @@ export function freezeGraph({
     throw new Error(`override names "${EDITIONS_ROOT_PIN_KEY}", but the editions root is this repository`);
   }
   const pins = Object.fromEntries(checkedOut.map(({ key, sha }) => [key, sha]));
-  for (const pin of runtimeSourceIndex.repositoryPins) {
-    pins[pin.repo] = overrides[pin.repo] ?? head({ name: pin.repo, url: pin.repositoryUrl });
+  for (const member of members) {
+    pins[member.repo] = overrides[member.repo] ?? head({ name: member.repo, url: member.repositoryUrl });
   }
   if (editionsRootUrl !== undefined) {
     const url = canonicalPublicHttpsRepositoryUrl(editionsRootUrl, '--editions-root-url');

package/edition/develop-graph.mjs

@@ -0,0 +1,26 @@
+// develop-graph — which repositories a DEVELOP candidate is built from.
+//
+// The develop graph is every first-party repository the data root declares
+// (`firstPartySources` in edition-workspace.json), each at its declared
+// `repositoryUrl`. It is never read from the release pins
+// (`runtime-image-source-index.json#repositoryPins`): develop and release are
+// separate lifecycles, and a repository is first-party on develop before any
+// release pins it. freeze-graph, the snapshot checkout, the snapshot pins'
+// validation and the snapshot's index all take their members from here.
+
+import { firstPartySources } from './first-party-source-ids.mjs';
+import { compareStrings } from './lib.mjs';
+
+/**
+ * The develop graph: `{ repo, repositoryUrl }` per declared first-party
+ * repository, sorted by repo handle.
+ *
+ * @returns {readonly { repo: string, repositoryUrl: string }[]}
+ */
+export function developGraphMembers() {
+  return Object.freeze(
+    Object.entries(firstPartySources('the develop graph'))
+      .map(([repo, { repositoryUrl }]) => Object.freeze({ repo, repositoryUrl }))
+      .sort((a, b) => compareStrings(a.repo, b.repo)),
+  );
+}

package/edition/develop-snapshot-inputs.mjs

@@ -81,7 +81,6 @@ export async function buildSnapshotInputs({ id, pins, schemas }) {
     readStrictJsonFile(runtimeImageSourceIndexPath()),
   );
   validateSnapshotPins(pins, {
-    runtimeSourceIndex: committedIndex,
     declaredSourceNames: composed.declaredSourceNames,
     editionsRootExternal: editionsRoot() !== dataRoot(),
   });

package/edition/edition-config.mjs

@@ -7,7 +7,9 @@
 
 import { join } from 'node:path';
 
+import { canonicalPublicHttpsRepositoryUrl } from './canonical-repository-url.mjs';
 import { dataRoot } from './edition-workspace.mjs';
+import { isUnderSourcePrefix } from './git-source-auth.mjs';
 import { readStrictJsonFile } from './strict-json.mjs';
 import {
   parseConfinedBiomes,
@@ -163,6 +165,28 @@ function requireEvidenceTrustPolicy(config) {
   return Object.freeze({ policy: value.policy, pin: value.pin });
 }
 
+/**
+ * Every first-party repository URL is canonical and under the workspace's
+ * `sourceRepositoryUrlPrefix`: the develop graph sends the source token there.
+ */
+function assertFirstPartyUrls(firstPartySources, prefix) {
+  for (const [repo, { repositoryUrl }] of Object.entries(firstPartySources)) {
+    const where = `${EDITION_WORKSPACE_CONFIG_FILE}: "firstPartySources"["${repo}"].repositoryUrl`;
+    let canonical;
+    try {
+      canonical = canonicalPublicHttpsRepositoryUrl(repositoryUrl, where);
+    } catch (err) {
+      throw new EditionWorkspaceConfigError(err.message);
+    }
+    if (canonical !== repositoryUrl) {
+      throw new EditionWorkspaceConfigError(`${where} ${JSON.stringify(repositoryUrl)} is not in its canonical form (${canonical})`);
+    }
+    if (!isUnderSourcePrefix(canonical, prefix)) {
+      throw new EditionWorkspaceConfigError(`${where} ${JSON.stringify(repositoryUrl)} is not under sourceRepositoryUrlPrefix ${prefix}`);
+    }
+  }
+}
+
 /** Validate a parsed config document; returns the frozen, typed config. */
 export function parseEditionWorkspaceConfig(document) {
   if (document === null || typeof document !== 'object' || Array.isArray(document)) {
@@ -179,11 +203,13 @@ export function parseEditionWorkspaceConfig(document) {
       .filter(([key]) => document[key] !== undefined)
       .map(([key, parse]) => [key, parse(document[key])]),
   );
+  const sourceRepositoryUrlPrefix = requireString(document, 'sourceRepositoryUrlPrefix', SOURCE_URL_PREFIX, 'https://<host>/<organisation>/ with a trailing slash');
+  if (sections.firstPartySources !== undefined) {assertFirstPartyUrls(sections.firstPartySources, sourceRepositoryUrlPrefix);}
   return Object.freeze({
     ...sections,
     imageRegistry: requireString(document, 'imageRegistry', IMAGE_REGISTRY, '<host>/<namespace> with no scheme or trailing slash'),
     ...optionalChartSet(document),
-    sourceRepositoryUrlPrefix: requireString(document, 'sourceRepositoryUrlPrefix', SOURCE_URL_PREFIX, 'https://<host>/<organisation>/ with a trailing slash'),
+    sourceRepositoryUrlPrefix,
     sourceAuthUsername: requireSourceAuthUsername(document),
     evidenceTrustPolicy: requireEvidenceTrustPolicy(document),
   });

package/edition/first-party-source-ids.mjs

@@ -15,20 +15,23 @@ import { workspaceSection } from './edition-config.mjs';
 // `sources[]` entry, so its id is declared in the data root's
 // `edition-workspace.json` (`firstPartySources`), keyed by the `repo` handle the
 // runtime image source index pins it under. The key is a lookup handle and may
-// move with the aggregator layout; the VALUE is the identity and must not.
+// move with the aggregator layout; the entry's `sourceId` is the identity and
+// must not. The entry's `repositoryUrl` is where the repository lives
+// (provenance, never identity): the develop graph resolves heads there.
 //
-// EVERY repository `runtime-image-source-index.json` pins is declared there (a
-// contract test holds the two sets equal), so a newly pinned repository is
-// refused at once rather than the day it first declares a composed image. A
-// lookup of an undeclared repository is refused (`firstPartySourceId`), never
-// named by a fallback.
+// EVERY repository `runtime-image-source-index.json` pins is declared there, at
+// the same URL (the offline index check refuses otherwise), so a newly pinned
+// repository is refused at once rather than the day it first declares a
+// composed image. A declared repository need not be pinned yet: the develop
+// graph carries it before any release does. A lookup of an undeclared
+// repository is refused (`firstPartySourceId`), never named by a fallback.
 
 /** The kernel's source-handle grammar (`BiomeSourceNameSchema`): lowercase kebab-case. */
 export const DECLARED_SOURCE_ID_PATTERN = /^[a-z][a-z0-9-]*$/;
 
-/** The data root's declared id of each first-party repository (`firstPartySources`). */
-export const firstPartySourceIds = () =>
-  workspaceSection('firstPartySources', 'naming a runtime subject after its first-party source');
+/** The data root's first-party repositories (`firstPartySources`): repo handle -> { sourceId, repositoryUrl }. */
+export const firstPartySources = (needed = 'naming a runtime subject after its first-party source') =>
+  workspaceSection('firstPartySources', needed);
 
 export class UndeclaredSourceIdError extends Error {
   constructor(message) {
@@ -48,12 +51,12 @@ export function assertDeclaredSourceId(sourceId, where) {
 }
 
 export function firstPartySourceId(repo) {
-  const ids = firstPartySourceIds();
-  if (!Object.hasOwn(ids, repo)) {
+  const sources = firstPartySources();
+  if (!Object.hasOwn(sources, repo)) {
     throw new UndeclaredSourceIdError(
       `first-party repository "${repo}" has no declared source id — declare it in ` +
         'edition-workspace.json under "firstPartySources"; a runtime identity is never derived from a repository name or URL',
     );
   }
-  return assertDeclaredSourceId(ids[repo], `first-party repository "${repo}"`);
+  return assertDeclaredSourceId(sources[repo].sourceId, `first-party repository "${repo}"`);
 }

package/edition/git-source-auth.mjs

@@ -25,7 +25,7 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
-import { canonicalPublicHttpsRepositoryUrl } from './lib.mjs';
+import { canonicalPublicHttpsRepositoryUrl } from './canonical-repository-url.mjs';
 
 /** The fixed environment variable holding the source read token. */
 export const SOURCE_READ_TOKEN_ENV = 'EVIDENCE_REPOSITORIES_TOKEN';

package/edition/lib.mjs

@@ -3075,38 +3075,6 @@ export function validateImmutableImageLock(lock, schemas) {
   return lock;
 }
 
-export function canonicalPublicHttpsRepositoryUrl(raw, context) {
-  if (typeof raw !== 'string' || raw.length === 0 || raw.trim() !== raw) {
-    throw new Error(`${context} must be a non-empty canonical HTTPS URL`);
-  }
-  let parsed;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    throw new Error(`${context} is not a valid URL`);
-  }
-  if (parsed.protocol !== 'https:') {
-    throw new Error(`${context} must use HTTPS`);
-  }
-  if (parsed.username.length > 0 || parsed.password.length > 0) {
-    throw new Error(
-      `${context} must not contain username/password credentials`,
-    );
-  }
-  if (
-    parsed.search.length > 0 ||
-    parsed.hash.length > 0 ||
-    raw.includes('?') ||
-    raw.includes('#')
-  ) {
-    throw new Error(`${context} must not contain a query or fragment`);
-  }
-  if (parsed.hostname.length === 0) {
-    throw new Error(`${context} must identify a repository host`);
-  }
-  return parsed.toString();
-}
-
 /**
  * Assert that an exact 40-hex commit exists in a source repository. Delegates
  * to `@xemahq/distribution-source-hash` — the tooling holds no second copy of

package/edition/pin-source.mjs

@@ -10,8 +10,9 @@
 // published pin. This module owns the SHAPE of that map: a flat object whose
 // keys live in six closed namespaces and whose values are exact 40-hex SHAs.
 //
-//   repos/<x> | submodules/<x>        every `repositoryPins[].repo` of the runtime
-//                                     image source index (the graph), no more, no fewer
+//   repos/<x> | submodules/<x>        every repository of the develop graph (the
+//                                     data root's firstPartySources, develop-graph.mjs),
+//                                     no more, no fewer
 //   <pinRoles.data>                   the commit of the data root checkout (editions and indices)
 //   <pinRoles.kernel>                 the commit of the kernel the authorization lock is sealed
 //                                     with (may match repos/<x>, but is NOT in the graph)
@@ -20,6 +21,7 @@
 //                                     only when that root is NOT this repository
 //   sources/<name>                    one per `sources[]` entry declared in the chain
 
+import { developGraphMembers } from './develop-graph.mjs';
 import { workspaceSection } from './edition-config.mjs';
 import { compareStrings } from './lib.mjs';
 import { PinRole } from './workspace-sections.mjs';
@@ -109,19 +111,20 @@ function graphPinsOf(pins) {
 }
 
 /**
- * Validate a COMPLETE snapshot against the graph and the composed chain.
- * `declaredSourceNames` are the `sources[].name` entries the chain declares;
- * `editionsRootExternal` is whether the editions root is another repository.
- * Every refusal names the offending key; nothing falls back to a published pin.
+ * Validate a COMPLETE snapshot against the develop graph and the composed
+ * chain. `declaredSourceNames` are the `sources[].name` entries the chain
+ * declares; `editionsRootExternal` is whether the editions root is another
+ * repository. Every refusal names the offending key; nothing falls back to a
+ * published pin.
  */
 export function validateSnapshotPins(
   pins,
-  { runtimeSourceIndex, declaredSourceNames, editionsRootExternal },
+  { declaredSourceNames, editionsRootExternal },
 ) {
   assertPinsObject(pins);
   assertExactShas(pins);
   for (const key of Object.keys(pins)) {snapshotPinNamespace(key);}
-  checkGraphPins(runtimeSourceIndex.repositoryPins, pins);
+  checkGraphPins(developGraphMembers(), pins);
   for (const [key, what] of [
     [dataPinKey(), 'the commit of the data root checkout'],
     [kernelPinKey(), 'the commit of the kernel the authorization lock is sealed with'],
@@ -175,7 +178,10 @@ export function snapshotPinSource(pins) {
 /**
  * Apply a pin source to a parsed runtime image source index. Published returns
  * the SAME object (inert, byte for byte). Snapshot returns a copy whose
- * `repositoryPins` carry the snapshot SHAs.
+ * `repositoryPins` are the DEVELOP GRAPH (develop-graph.mjs) at the snapshot
+ * SHAs: the committed index's own pins are not read, so a first-party
+ * repository no release pins yet is in it, and a pinned one that is not
+ * first-party is not.
  */
 export function applyPinSource(runtimeSourceIndex, pinSource = PUBLISHED_PIN_SOURCE) {
   switch (pinSource?.kind) {
@@ -211,12 +217,13 @@ function applySnapshot(runtimeSourceIndex, pins) {
   assertPinsObject(pins);
   assertExactShas(pins);
   for (const key of Object.keys(pins)) {snapshotPinNamespace(key);}
-  const graph = runtimeSourceIndex.repositoryPins;
+  const graph = developGraphMembers();
   checkGraphPins(graph, pins);
   return {
     ...runtimeSourceIndex,
-    repositoryPins: graph.map((pin) => ({
-      ...pin,
+    repositoryPins: graph.map(({ repo, repositoryUrl }) => ({
+      repo,
+      repositoryUrl,
       // A develop snapshot pins every repository at its develop head, so that one
       // SHA is both the built commit (image axis, `sourceCommit`) and the source
       // tip (`vendoredSourceCommit`): the image pin lagging the source tip cannot
@@ -226,8 +233,8 @@ function applySnapshot(runtimeSourceIndex, pins) {
       // The COMMITTED index keeps the axes apart (release channel): see
       // `source-authority.mjs#publishedSourceTip` and
       // `build-runtime-image-source-index.mjs#repositoryIdentity`.
-      vendoredSourceCommit: pins[pin.repo],
-      sourceCommit: pins[pin.repo],
+      sourceCommit: pins[repo],
+      vendoredSourceCommit: pins[repo],
     })),
   };
 }

package/edition/workspace-sections.mjs

@@ -91,16 +91,46 @@ function supplementalLauncher(value, where) {
   return Object.freeze({ kind: value.kind, biomeId: text(value.biomeId, `${where}.biomeId`) });
 }
 
+/**
+ * The retired `{repo handle: source id}` string form of a `firstPartySources`
+ * entry. Refused, never read: the entry also declares where the repository
+ * lives, which the develop graph resolves its head from.
+ */
+export class RetiredFirstPartySourceShapeError extends Error {
+  constructor(repo, id) {
+    super(
+      `${FILE}: "firstPartySources"["${repo}"] is the retired source-id string ${JSON.stringify(id)}. ` +
+        `Migrate it to { "sourceId": ${JSON.stringify(id)}, "repositoryUrl": "<the repository's canonical https URL>" }.`,
+    );
+    this.name = 'RetiredFirstPartySourceShapeError';
+  }
+}
+
+/**
+ * `firstPartySources`: every first-party repository, keyed by its source
+ * checkout handle, with its declared source id (the identity a runtime subject
+ * is named after) and its repository URL (where it lives: the develop graph
+ * resolves its head there, and a release pin must name the same URL). The URL
+ * is checked canonical and under `sourceRepositoryUrlPrefix` with the whole
+ * config (edition-config.mjs).
+ */
 export function parseFirstPartySources(value) {
   const where = '"firstPartySources"';
-  if (!isObject(value) || Object.keys(value).length === 0) {fail(where, 'must be a non-empty {repo handle: source id} object');}
-  const entries = Object.entries(value).map(([repo, id]) => {
+  if (!isObject(value) || Object.keys(value).length === 0) {
+    fail(where, 'must be a non-empty {repo handle: { sourceId, repositoryUrl }} object');
+  }
+  const entries = Object.entries(value).map(([repo, entry]) => {
     repoHandle(repo, `${where} key`);
-    if (typeof id !== 'string' || !SOURCE_ID.test(id)) {
-      fail(`${where}["${repo}"]`, `must be a lowercase kebab-case source id; got ${JSON.stringify(id)}`);
+    if (typeof entry === 'string') {throw new RetiredFirstPartySourceShapeError(repo, entry);}
+    const at = `${where}["${repo}"]`;
+    exactObject(entry, at, ['sourceId', 'repositoryUrl']);
+    if (typeof entry.sourceId !== 'string' || !SOURCE_ID.test(entry.sourceId)) {
+      fail(`${at}.sourceId`, `must be a lowercase kebab-case source id; got ${JSON.stringify(entry.sourceId)}`);
     }
-    return [repo, id];
+    return [repo, Object.freeze({ sourceId: entry.sourceId, repositoryUrl: text(entry.repositoryUrl, `${at}.repositoryUrl`) })];
   });
+  uniqueBy(entries, `${where} sourceId`, ([, entry]) => entry.sourceId);
+  uniqueBy(entries, `${where} repositoryUrl`, ([, entry]) => entry.repositoryUrl);
   return Object.freeze(Object.fromEntries(entries));
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:abf054b00865c8a4b0bb44bccd5cc3c65162b8ea8dec47126bc0dfd837392fcd"
+    "sourceDigest": "sha256:72008b3d37f2cbcef3c5ec25e2d85989198ebc1f9bc1f481b8b767965813d5aa"
   }
 }