@xemahq/xema 0.59.0 → 0.60.1

package/edition/develop-freeze.mjs

@@ -1,289 +0,0 @@
-// develop-freeze — freeze the develop branches into one snapshot of pins.
-//
-// Resolves `refs/heads/develop` ONCE per distinct repository URL, applies the
-// caller's per-key overrides (an override wins and is never looked up), and
-// returns the pins. After this, NOTHING reads a branch: every later step takes
-// the pins. Two phases, because the declared sources are only known once the
-// edition's chain can be read from the checked-out editions root:
-//
-//   freezeGraph    the graph repositories, the data root, the kernel, the deploy checkout, the editions root
-//   freezeSources  one pin per `sources[]` entry the chain declares
-//
-// With `memberPins` (a select-records selection) the members are pinned at the selected build records instead; the one
-// declared exception, a member that keeps its current resolution, is pinned at its develop head.
-//
-// `resolveHead({ name, url })` is the one network seam (default: `git ls-remote` through
-// git-source-auth: the data root's token only for a repository under its
-// `sourceRepositoryUrlPrefix`, no credential for any other, never argv).
-
-import { execFileSync } from 'node:child_process';
-
-import { canonicalPublicHttpsRepositoryUrl } from './canonical-repository-url.mjs';
-import { currentResolutionOf } from './develop-current-resolution.mjs';
-import { developGraphMembers } from './develop-graph.mjs';
-import { EditionChannel } from './edition-channel.mjs';
-import { assertCanonicalSourceUrl, assertSourceDeclaresNoCredential, isUnderSourcePrefix, withSourceGitEnv } from './git-source-auth.mjs';
-import {
-  dataPinKey,
-  EDITIONS_ROOT_PIN_KEY,
-  kernelPinKey,
-  SnapshotPinNamespace,
-  deployPinKey,
-  snapshotPinNamespace,
-  sortedSnapshotPins,
-  sourceNameOfPinKey,
-  sourcePinKey,
-} from './pin-source.mjs';
-
-const SHA_PATTERN = /^[0-9a-f]{40}$/;
-
-/** The ref namespaces a freeze may resolve a ref in. */
-export const RefKind = Object.freeze({ Branch: 'branch', Tag: 'tag' });
-
-const REF_PREFIX = Object.freeze({ [RefKind.Branch]: 'refs/heads/', [RefKind.Tag]: 'refs/tags/' });
-const PEELED_SUFFIX = '^{}';
-
-/**
- * What each channel freezes a source at. A develop edition freezes the head of the `develop` BRANCH of every
- * repository; a release edition freezes each source at the ref its definition declares, a branch or a tag.
- */
-const FREEZE_REF_KINDS = Object.freeze({
-  [EditionChannel.Develop]: Object.freeze([RefKind.Branch]),
-  [EditionChannel.Release]: Object.freeze([RefKind.Branch, RefKind.Tag]),
-});
-
-/**
- * The commit `ref` names in one source `{ name, url }`, by `git ls-remote <url> <refs/heads/ref | refs/tags/ref |
- * refs/tags/ref^{}>` (only the namespaces the channel freezes at). A tag resolves to its peeled commit when it is annotated.
- * Throws naming the repository when the ref is absent, or when it is both a branch and a tag. The source is held and its
- * git environment built by `withSourceGitEnv`: the workspace credential reaches only a repository under `sourceRepositoryUrlPrefix`.
- */
-export function lsRemoteRef(source, ref, { channel, workspace, env = process.env, runGit = execFileSync }) {
-  const kinds = FREEZE_REF_KINDS[channel];
-  if (kinds === undefined) {throw new Error(`unknown edition channel ${JSON.stringify(channel)}`);}
-  if (typeof ref !== 'string' || ref.length === 0) {
-    throw new Error(`source "${source.name}" declares no ref; a ${channel} edition cannot be frozen without one`);
-  }
-  const names = kinds.flatMap((kind) => (kind === RefKind.Tag ? [`${REF_PREFIX[kind]}${ref}`, `${REF_PREFIX[kind]}${ref}${PEELED_SUFFIX}`] : [`${REF_PREFIX[kind]}${ref}`]));
-  const output = withSourceGitEnv(source, { workspace, env }, (gitEnv) =>
-    runGit('git', ['ls-remote', source.url, ...names], {
-      env: gitEnv,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'pipe'],
-    }),
-  ).trim();
-  const served = new Map();
-  for (const line of output.split('\n')) {
-    const [sha, name] = line.trim().split(/\s+/);
-    if (names.includes(name)) {
-      if (!SHA_PATTERN.test(sha ?? '')) {throw new Error(`${source.url}: git ls-remote answered ${JSON.stringify(line)} for ${name}`);}
-      served.set(name, sha);
-    }
-  }
-  const branch = served.get(`${REF_PREFIX[RefKind.Branch]}${ref}`);
-  const tagName = `${REF_PREFIX[RefKind.Tag]}${ref}`;
-  const tag = served.get(`${tagName}${PEELED_SUFFIX}`) ?? served.get(tagName);
-  if (branch !== undefined && tag !== undefined) {
-    throw new Error(`${source.url}: ${JSON.stringify(ref)} is both a branch and a tag; a ${channel} edition cannot be frozen at an ambiguous ref`);
-  }
-  const commit = branch ?? tag;
-  if (commit === undefined) {
-    throw new Error(`${source.url} has no ${kinds.map((kind) => `${REF_PREFIX[kind]}${ref}`).join(' or ')}; a ${channel} edition cannot be frozen without it`);
-  }
-  return commit;
-}
-
-/** A resolver that asks `resolveHead` at most once per distinct URL and ref; it takes the source `{ name, url, ref? }`. */
-function memoizedHeads(resolveHead) {
-  const heads = new Map();
-  return (source) => {
-    const key = JSON.stringify([source.url, source.ref]);
-    if (!heads.has(key)) {heads.set(key, resolveHead(source));}
-    return heads.get(key);
-  };
-}
-
-/**
- * The pins input selects WHICH inputs a snapshot resolves, never which tooling
- * code runs: the distributions plane that executes is the dispatching ref's own
- * checkout, so an override for its pin key is refused outright (even one equal
- * to that checkout), naming the key.
- */
-export function assertNoToolingOverride(overrides) {
-  if (overrides[dataPinKey()] !== undefined) {
-    throw new Error(
-      `pins override "${dataPinKey()}" is refused: it would select the tooling code this run executes. ` +
-        'The distributions plane is always the dispatching ref\'s own checkout; pins choose inputs, never tooling.',
-    );
-  }
-}
-
-function assertOverrides(overrides, allowed) {
-  for (const [key, sha] of Object.entries(overrides)) {
-    const namespace = snapshotPinNamespace(key);
-    if (!allowed.has(namespace)) {continue;} // another phase's pin
-    if (typeof sha !== 'string' || !SHA_PATTERN.test(sha)) {
-      throw new Error(`override for "${key}" is not a 40-hex commit SHA: ${JSON.stringify(sha)}`);
-    }
-  }
-}
-
-/** The member pins name exactly the graph minus the current-resolution members; a missing or extra member is refused by name. */
-function assertMemberPinsAreTheGraph(memberPins, members) {
-  const current = new Set(Object.keys(currentResolutionOf(members)));
-  const expected = members.map(({ repo }) => repo).filter((repo) => !current.has(repo));
-  const missing = expected.filter((repo) => !Object.hasOwn(memberPins, repo));
-  const extra = Object.keys(memberPins).filter((repo) => !expected.includes(repo));
-  if (missing.length > 0 || extra.length > 0) {
-    throw new Error(`--member-pins must pin exactly the develop graph minus ${JSON.stringify([...current])}: missing ${JSON.stringify(missing)}, extra ${JSON.stringify(extra)}`);
-  }
-}
-
-const GRAPH_PHASE = new Set([
-  SnapshotPinNamespace.Graph,
-  SnapshotPinNamespace.Distributions,
-  SnapshotPinNamespace.Kernel,
-  SnapshotPinNamespace.ChartSource,
-  SnapshotPinNamespace.EditionsRoot,
-]);
-const SOURCE_PHASE = new Set([SnapshotPinNamespace.Source]);
-
-/** A repository the workflow checked out is pinned at what it checked out; an override may only agree. */
-function assertCheckedOutPin({ key, sha, flag, what, overrides }) {
-  if (!SHA_PATTERN.test(sha ?? '')) {
-    throw new Error(`${flag} is not a 40-hex commit SHA: ${JSON.stringify(sha)}`);
-  }
-  if (overrides[key] !== undefined && overrides[key] !== sha) {
-    throw new Error(`override for "${key}" is ${overrides[key]}, but ${what} is checked out at ${sha}`);
-  }
-}
-
-/**
- * @param {object} request
- * @param {string} request.dataSha the commit the data root checkout is at
- * @param {string} request.kernelSha the commit the kernel checkout is at
- * @param {string} request.deploySha the commit the deploy checkout is at
- * @param {string} [request.editionsRootUrl] https URL of the editions root; absent = this repository
- * @param {Record<string, string>} [request.memberPins] the graph members' pins from a selection (`--member-pins`): exactly the
- *   graph minus the members that keep their current resolution (develop-current-resolution.mjs), which are pinned at their
- *   develop head; refused together with overrides
- * @param {(source: {name: string, url: string}) => void} request.holdSource the hold of one source; runs for ALL graph sources before the first head
- */
-export function freezeGraph({
-  dataSha,
-  kernelSha,
-  deploySha,
-  editionsRootUrl,
-  overrides = {},
-  memberPins,
-  resolveHead,
-  holdSource,
-}) {
-  if (memberPins !== undefined && Object.keys(overrides).length > 0) {
-    throw new Error('--member-pins and --overrides are exclusive: the member pins are the selected build records, never overridden');
-  }
-  assertNoToolingOverride(overrides);
-  assertOverrides(overrides, GRAPH_PHASE);
-  const head = memoizedHeads(resolveHead);
-  // The develop graph is the data root's first-party repositories (develop-graph.mjs), never the release pins.
-  const members = developGraphMembers();
-  const graph = new Set(members.map((member) => member.repo));
-  for (const [key] of Object.entries(overrides)) {
-    if (snapshotPinNamespace(key) === SnapshotPinNamespace.Graph && !graph.has(key)) {
-      throw new Error(`override names "${key}", which is not a repository in the graph`);
-    }
-  }
-  if (memberPins !== undefined) {assertMemberPinsAreTheGraph(memberPins, members);}
-  const checkedOut = [
-    { key: dataPinKey(), sha: dataSha, flag: '--data-sha', what: 'the data root checkout' },
-    { key: kernelPinKey(), sha: kernelSha, flag: '--kernel-sha', what: 'the kernel checkout' },
-    { key: deployPinKey(), sha: deploySha, flag: '--deploy-sha', what: 'the deploy checkout' },
-  ];
-  for (const { key, sha, flag, what } of checkedOut) {assertCheckedOutPin({ key, sha, flag, what, overrides });}
-  const toResolve = members.map((member) => ({ name: member.repo, url: member.repositoryUrl }));
-  if (editionsRootUrl !== undefined) {
-    toResolve.push({ name: EDITIONS_ROOT_PIN_KEY, url: canonicalPublicHttpsRepositoryUrl(editionsRootUrl, '--editions-root-url') });
-  }
-  // Every source is held before the first head is asked: a refusal of the last leaves no git call behind.
-  for (const source of toResolve) {holdSource(source);}
-  if (editionsRootUrl === undefined && overrides[EDITIONS_ROOT_PIN_KEY] !== undefined) {
-    throw new Error(`override names "${EDITIONS_ROOT_PIN_KEY}", but the editions root is this repository`);
-  }
-  const pins = Object.fromEntries(checkedOut.map(({ key, sha }) => [key, sha]));
-  for (const member of members) {
-    pins[member.repo] = overrides[member.repo] ?? memberPins?.[member.repo] ?? head({ name: member.repo, url: member.repositoryUrl });
-  }
-  if (editionsRootUrl !== undefined) {
-    const url = canonicalPublicHttpsRepositoryUrl(editionsRootUrl, '--editions-root-url');
-    pins[EDITIONS_ROOT_PIN_KEY] = overrides[EDITIONS_ROOT_PIN_KEY] ?? head({ name: EDITIONS_ROOT_PIN_KEY, url });
-  }
-  return sortedSnapshotPins(pins);
-}
-
-/**
- * @param {object} request
- * @param {Record<string,string>} request.pins the graph phase's pins
- * @param {object[]} request.declaredSources every `sources[]` entry in the chain (`{ name, url, ... }`)
- * @param {(source: {name: string, url: string}) => void} request.holdSource the hold of one source (`holdSource` of git-source-auth with the workspace and env); runs for ALL sources before the first head
- */
-export function freezeSources({ pins, declaredSources, overrides = {}, resolveHead, holdSource }) {
-  assertOverrides(overrides, SOURCE_PHASE);
-  const head = memoizedHeads(resolveHead);
-  const sourceByName = new Map();
-  for (const source of declaredSources) {
-    const known = sourceByName.get(source.name);
-    if (known !== undefined && known.url !== source.url) {
-      throw new Error(`source "${source.name}" is declared at two URLs (${known.url}, ${source.url})`);
-    }
-    sourceByName.set(source.name, source);
-  }
-  for (const key of Object.keys(overrides)) {
-    if (snapshotPinNamespace(key) === SnapshotPinNamespace.Source && !sourceByName.has(sourceNameOfPinKey(key))) {
-      throw new Error(`override names "${key}", but the chain declares no such source`);
-    }
-  }
-  // Every source is held before the first head is asked: a refusal of the last leaves no git call behind.
-  for (const source of sourceByName.values()) {holdSource(source);}
-  const frozen = { ...pins };
-  for (const [name, source] of sourceByName) {
-    frozen[sourcePinKey(name)] = overrides[sourcePinKey(name)] ?? head(source);
-  }
-  return sortedSnapshotPins(frozen);
-}
-
-/**
- * The declared source URLs a customer freeze may ask, held BEFORE any network call: the token of the
- * run (EVIDENCE_REPOSITORIES_TOKEN) is sent to the origin of each URL, so a URL is refused unless it is
- * a canonical public HTTPS repository URL written in its canonical form and lies under the workspace's
- * `sourceRepositoryUrlPrefix`. A definition that merely names another origin never receives the token.
- */
-export function assertCustomerSourceUrls(sources, sourceRepositoryUrlPrefix) {
-  if (typeof sourceRepositoryUrlPrefix !== 'string' || sourceRepositoryUrlPrefix.length === 0) {
-    throw new Error('a customer freeze takes the workspace\'s sourceRepositoryUrlPrefix');
-  }
-  for (const source of sources) {
-    assertSourceDeclaresNoCredential(source);
-    const canonical = assertCanonicalSourceUrl(source);
-    const context = `source "${source.name}" url`;
-    if (!isUnderSourcePrefix(canonical, sourceRepositoryUrlPrefix)) {
-      throw new Error(
-        `${context} ${JSON.stringify(source.url)} is not under the workspace's sourceRepositoryUrlPrefix ${sourceRepositoryUrlPrefix}: ` +
-          'the source token is sent only to repositories under that prefix',
-      );
-    }
-  }
-}
-
-/**
- * The pins of a CUSTOMER edition: exactly one `sources/<name>` commit per source its definition declares,
- * each the head of refs/heads/develop of that source's repository, resolved once. Every URL is held by
- * `assertCustomerSourceUrls` before the first head is asked.
- */
-export function freezeCustomerSources({ definition, resolveHead, holdSource, sourceRepositoryUrlPrefix }) {
-  const sources = definition?.sources ?? [];
-  if (!Array.isArray(sources) || sources.some((source) => typeof source?.name !== 'string' || typeof source?.url !== 'string')) {
-    throw new Error('the definition\'s sources must be an array of {name, url}');
-  }
-  assertCustomerSourceUrls(sources, sourceRepositoryUrlPrefix);
-  return freezeSources({ pins: {}, declaredSources: sources, resolveHead, holdSource });
-}

package/edition/develop-git-bundles.mjs

@@ -1,255 +0,0 @@
-// develop-git-bundles — the OCI bundle of a git-sourced biome, in a DEVELOP edition only (XEMA-2456): a vendor develop
-// resolve, or a customer develop resolve (`--definition`) whose data root declares a pinned evidence trust policy
-// (`customerDevelopGitBundleVerifier`). Each is verified under the trust policy of ITS OWN data root.
-//
-// A release edition never carries an OCI bundle on a git-sourced row: the manifest's `bundleSource` names an artifact
-// the release lane builds, not one built from the pinned commit (resolve-distribution.mjs strips it, the release refuses
-// it). A resolve without a verifier (a customer edition whose data root declares no policy, or any customer release)
-// refuses it on a required row (`assertNoUnverifiedRequiredGitBundles`). A develop edition freezes a git source at its develop head F, and the source's own develop lane
-// publishes the bundle the manifest names, signed keyless by its develop workflow. This module proves that bundle is
-// the one F describes, and only then does the resolve keep it on the row, by DIGEST, with its develop bundle signer:
-//
-//   1. the bundle: the manifest's own `bundleSource.ociRef` at F (`<repository>:<version>`; the kernel holds the tag to
-//      the manifest version) resolved to its digest at the registry. The lock records `<repository>@sha256:<hex>`, never
-//      the tag, so the edition names immutable bytes;
-//   2. the signer: the ONE `develop` row of the source's repository in the data root's trust policy
-//      (`bundleSignerRowFor`). cosign verifies the digest's signature under that row's identity, issuer, workflow
-//      repository and ref, and states the ONE commit P its certificate was issued at (`verifiedBundleSignerCommit`);
-//      `verifyBundleOnRegistry` then holds the signature AND the SLSA provenance to exactly the row and P. P is never
-//      read from bytes cosign has not verified;
-//   3. the content binding of P to F. A version that is already published is never re-attested by the publisher
-//      (`xema biome publish` "already current"), so P is the commit that last published the version, and F may be a
-//      later commit of the same version. Two checks, refused on either, each naming P, F and the mismatching pair:
-//        (a) the kernel's `computeBiomeSourceManifestHash` of the bundle's own `xema-biome.json` equals the
-//            `sourceManifestHash` of the biome at F (the hash the seal and verify hold to the git source at F);
-//        (b) the git tree id of the biome directory at P equals its tree id at F (the catalogue's `sourceTreeIds`
-//            notion), so the bundle was built from the same biome source F holds.
-//      THE GAP, develop only: build inputs outside the biome directory (shared packages, the lockfile, the publisher's
-//      toolchain) are not bound. A change there between P and F reaches no check here. A release never relies on this:
-//      it carries a third-party bundle only through an `oci` source with a third-party pin, whose evidence is bound to
-//      the pinned commit itself.
-//
-// Every failure is a `DevelopGitBundleError` naming the biome; all subjects are verified before one is refused.
-
-import { canonicalPublicHttpsRepositoryUrl, repositoryOwnerName } from './canonical-repository-url.mjs';
-import { RefusalError } from './collected-refusals.mjs';
-import { EditionChannel } from './edition-channel.mjs';
-import { editionWorkspaceConfig } from './edition-config.mjs';
-import { dataRoot as configuredDataRoot, editionsRoot } from './edition-workspace.mjs';
-import { loadPinnedDeclaredTrustPolicy } from './evidence-trust-pin.mjs';
-import { sourceTreeIdAt } from './external-source-walk.mjs';
-import { prepareTrustedCosignBinary } from './image-evidence.mjs';
-import { BundleSignerRefusedError, DevelopGitBundleError } from './locked-bundle-signer.mjs';
-import { createRegistryClientResolver } from './oci-image-source-evidence.mjs';
-import { bundleDigestRef, fetchBundleManifest, verifiedBundleSignerCommit, verifyBundleOnRegistry } from './third-party-bundle-registry.mjs';
-import { bundleSignerRowFor } from './third-party-source-evidence.mjs';
-import { OCI_BUNDLE_SOURCE_KIND } from './third-party-subjects.mjs';
-
-/** The key a verified bundle is looked up by: the source name and the biome id of its index entry. */
-export const developGitBundleKey = (sourceName, biomeId) => `${sourceName}\u0000${biomeId}`;
-
-/**
- * The rows a develop resolve must verify a bundle for: each git-sourced biome of `lock` (a row with a `source`) whose
- * index entry declares a biome-level OCI `bundleSource`.
- *
- * @returns {{biomeId: string, source: {name: string, url: string, commit: string}, entry: object}[]}
- */
-export function developGitBundleSubjects({ lock, index }) {
-  const entries = new Map(index.filter((entry) => entry.source !== undefined).map((entry) => [developGitBundleKey(entry.source, entry.id), entry]));
-  return lock.biomes.flatMap((biome) => {
-    if (biome.source === undefined) {return [];}
-    const entry = entries.get(developGitBundleKey(biome.source.name, biome.id));
-    return entry?.bundleSource?.kind === OCI_BUNDLE_SOURCE_KIND ? [{ biomeId: biome.id, source: biome.source, entry }] : [];
-  });
-}
-
-const subjectLabel = ({ biomeId, source }) => `biome "${biomeId}" (git source "${source.name}" at ${source.commit})`;
-
-/**
- * A resolve with no develop bundle verifier (a customer edition, either channel) drops a git-sourced row's OCI
- * `bundleSource` (resolve-distribution.mjs, at the copy point). For a row the edition installs as `required`, that
- * drop is never silent: biome-host would get a required biome with no bundle to fetch. Every such row is refused at
- * once, naming the declared bundle and what is missing (XEMA-2456).
- *
- * @param {object} options
- * @param {object} options.lock the resolved lock (its rows carry `installPolicy`)
- * @param {object[]} options.index the index it was resolved from (it still holds the manifest's bundleSource)
- * @param {string} options.required the kernel's `BiomeInstallPolicy.Required`
- */
-export function assertNoUnverifiedRequiredGitBundles({ lock, index, required }) {
-  const requiredRows = new Set(lock.biomes.filter((biome) => biome.installPolicy === required).map((biome) => biome.id));
-  const refused = developGitBundleSubjects({ lock, index })
-    .filter((subject) => requiredRows.has(subject.biomeId))
-    .map(
-      (subject) =>
-        new DevelopGitBundleError(
-          `${subjectLabel(subject)} is installPolicy required and its manifest declares an OCI bundleSource (${subject.entry.bundleSource.ociRef}), ` +
-            'but this resolve verifies no git-sourced bundle, so its lock row would carry no bundleSource and no bundleSigner and biome-host could not install it. ' +
-            'A develop resolve verifies it when its data root declares a pinned evidenceTrustPolicy (edition-workspace.json) holding the ONE develop ' +
-            `bundle-signer row of the source's repository, and it is given --cosign; a release carries such a biome only as an \`oci\` source with a third-party source pin`,
-        ),
-    );
-  if (refused.length === 1) {throw refused[0];}
-  if (refused.length > 1) {throw new BundleSignerRefusedError(refused);}
-}
-
-/** The biome directory relative to its source repository: the index path is `<source name>/<directory>`. */
-function repositoryPathOf({ source, entry }) {
-  const prefix = `${source.name}/`;
-  if (!entry.path.startsWith(prefix)) {
-    throw new Error(`${subjectLabel({ biomeId: entry.id, source })}: index path ${JSON.stringify(entry.path)} is not under the source "${source.name}"`);
-  }
-  return entry.path.slice(prefix.length);
-}
-
-/** Verify every subject, then refuse them all at once: one refusal is rethrown unchanged, several are one error. */
-async function verifyEach(subjects, verifyOne) {
-  const verified = new Map();
-  const refused = [];
-  for (const subject of subjects) {
-    try {
-      verified.set(developGitBundleKey(subject.source.name, subject.biomeId), await verifyOne(subject));
-    } catch (error) {
-      // A refusal, or a plain Error of the registry, cosign or git: this subject is refused. A defect (TypeError, ...) is not.
-      const refusal = error instanceof RefusalError || error?.constructor === Error;
-      if (!refusal) {throw error;}
-      refused.push(error instanceof DevelopGitBundleError ? error : new DevelopGitBundleError(`${subjectLabel(subject)}: ${error.message}`));
-    }
-  }
-  if (refused.length === 1) {throw refused[0];}
-  if (refused.length > 1) {throw new BundleSignerRefusedError(refused);}
-  return verified;
-}
-
-/**
- * One subject, verified (steps 1 to 3 of this file's header). `context` is `{policy, policyRoot, schemas, trustedCosign}`.
- *
- * @returns {Promise<{bundleSource: object}>} the bundle source the lock row carries: the declared one, by digest
- */
-export async function verifyDevelopGitBundle({
-  subject,
-  checkout,
-  context,
-  clientFor,
-  signerCommit = verifiedBundleSignerCommit,
-  verifyOnRegistry = verifyBundleOnRegistry,
-  treeIdAt = sourceTreeIdAt,
-  env = process.env,
-}) {
-  const { biomeId, source, entry } = subject;
-  const label = subjectLabel(subject);
-  if (checkout === undefined) {
-    throw new Error(`${label}: the source walk holds no checkout of "${source.name}"`);
-  }
-  const repository = repositoryOwnerName(canonicalPublicHttpsRepositoryUrl(source.url, `${label} source url`), `${label} source url`);
-  const row = bundleSignerRowFor({ policy: context.policy, repository, channel: EditionChannel.Develop, schemas: context.schemas, label: `${label} develop bundle signer` });
-
-  // 1 + 2: the digest the manifest's tag serves; the commit P cosign verified the develop signature at; signature and
-  // provenance held to the row at P.
-  const ociRef = await bundleDigestRef({ clientFor, ociRef: entry.bundleSource.ociRef });
-  const cosign = { trustedCosign: context.trustedCosign, policy: context.policy, policyRoot: context.policyRoot, row, ociRef, env };
-  const attestedCommit = signerCommit(cosign);
-  verifyOnRegistry({ ...cosign, workflowSha: attestedCommit });
-
-  // 3: the content binding of P to F (see the header for the gap it leaves: build inputs outside the biome directory).
-  const binding = `the bundle ${ociRef} attested at ${attestedCommit} (P) against the source at ${source.commit} (F)`;
-  const { manifest } = await fetchBundleManifest({ clientFor, ociRef });
-  if (manifest?.xema?.id !== biomeId) {
-    throw new Error(`${label}: ${ociRef} declares xema.id ${JSON.stringify(manifest?.xema?.id)}, not "${biomeId}"`);
-  }
-  const bundleManifestHash = await context.schemas.computeBiomeSourceManifestHash(manifest);
-  if (bundleManifestHash !== entry.sourceManifestHash) {
-    throw new DevelopGitBundleError(
-      `${label}: ${binding}: the bundle's xema-biome.json hashes to sourceManifestHash ${bundleManifestHash}, but the manifest at F hashes to ${entry.sourceManifestHash}`,
-    );
-  }
-  const path = repositoryPathOf(subject);
-  const treeAtAttested = treeIdAt({ checkout, commit: attestedCommit, path, env });
-  const treeAtFrozen = treeIdAt({ checkout, commit: source.commit, path, env });
-  if (treeAtAttested !== treeAtFrozen) {
-    throw new DevelopGitBundleError(
-      `${label}: ${binding}: the biome directory ${path} is tree ${treeAtAttested} at P but tree ${treeAtFrozen} at F; publish a new version of the biome from F`,
-    );
-  }
-  return { bundleSource: { ...entry.bundleSource, ociRef } };
-}
-
-/**
- * The verifier a vendor develop resolve hands `prepareDistributionWithIndex` (`inputs.developGitBundles`). Nothing is
- * read (no trust policy, no cosign) unless a subject exists.
- *
- * @param {object} options
- * @param {string|undefined} options.cosignBinary the cosign the trust policy pins by digest (`--cosign`)
- * @param {string} options.dataRoot the root whose pinned trust policy holds the develop bundle-signer rows
- * @param {string} [options.registryRoot] the root whose image-registry-credentials.json the registry is read with (default: dataRoot)
- */
-export function createDevelopGitBundleVerifier({ cosignBinary, dataRoot, registryRoot = dataRoot, env = process.env, clientFor, treeIdAt }) {
-  return Object.freeze({
-    async verify({ subjects, checkouts, schemas }) {
-      if (subjects.length === 0) {return new Map();}
-      if (cosignBinary === undefined) {
-        throw new DevelopGitBundleError(
-          `${subjects.map(subjectLabel).join(', ')} declare an OCI bundle; verifying it needs a cosign binary (--cosign), and none was given`,
-        );
-      }
-      const policy = loadPinnedDeclaredTrustPolicy({ dataRoot, declaration: editionWorkspaceConfig().evidenceTrustPolicy, schemas });
-      const trustedCosign = prepareTrustedCosignBinary({ cosignBinary, policy });
-      const context = { policy, policyRoot: dataRoot, schemas, trustedCosign };
-      const registry = clientFor ?? createRegistryClientResolver({ dataRoot: registryRoot });
-      try {
-        return await verifyEach(subjects, (subject) =>
-          verifyDevelopGitBundle({ subject, checkout: checkouts.get(subject.source.name), context, clientFor: registry, env, ...(treeIdAt === undefined ? {} : { treeIdAt }) }),
-        );
-      } finally {
-        trustedCosign.dispose();
-      }
-    },
-  });
-}
-
-/**
- * The verifier a CUSTOMER resolve (`--definition`) hands `resolveCustomerDistribution`, or undefined. Only a develop
- * resolve whose configured data root DECLARES an evidence trust policy gets one: the bundles are verified under that
- * customer policy, held to its pin (`loadPinnedDeclaredTrustPolicy`, read only when a subject exists), never the
- * vendor's. The registry is read with the editions root's credentials, as the customer's own images are. Without a
- * declared policy (or on release) there is none, and a required git-sourced row declaring an OCI bundle is refused
- * (`assertNoUnverifiedRequiredGitBundles`).
- */
-export function customerDevelopGitBundleVerifier({ channel, cosignBinary, env = process.env, clientFor, treeIdAt }) {
-  if (channel !== EditionChannel.Develop) {return undefined;}
-  if (editionWorkspaceConfig().evidenceTrustPolicy.policy === null) {return undefined;}
-  return createDevelopGitBundleVerifier({
-    cosignBinary,
-    dataRoot: configuredDataRoot(),
-    registryRoot: editionsRoot(),
-    env,
-    ...(clientFor === undefined ? {} : { clientFor }),
-    ...(treeIdAt === undefined ? {} : { treeIdAt }),
-  });
-}
-
-/**
- * The OFFLINE verifier of a candidate re-seal: the bundle the pinned develop edition already verified for the SAME
- * source commit, carried forward unchanged, with the signer it was verified under (`pinnedBundleSigner`): the resolve
- * refuses the row when the current trust policy selects any other signer (a rotated develop row). A subject at another commit, or one the pinned edition carried no bundle
- * for, is refused: verifying a new bundle reads the registry, which an offline re-seal does not.
- *
- * @param {object} pinnedLock the pinned edition's parsed distribution lock
- */
-export function carriedDevelopGitBundles(pinnedLock) {
-  return Object.freeze({
-    async verify({ subjects }) {
-      return verifyEach(subjects, async (subject) => {
-        const row = pinnedLock.biomes.find(
-          (biome) => biome.id === subject.biomeId && biome.source?.name === subject.source.name && biome.source.commit === subject.source.commit,
-        );
-        if (row?.bundleSource?.kind !== OCI_BUNDLE_SOURCE_KIND || row.bundleSigner === undefined) {
-          throw new DevelopGitBundleError(
-            `${subjectLabel(subject)}: the pinned edition carries no verified bundle at this commit, and an offline re-seal cannot verify one; resolve the develop edition instead`,
-          );
-        }
-        return { bundleSource: row.bundleSource, pinnedBundleSigner: row.bundleSigner };
-      });
-    },
-  });
-}

package/edition/develop-graph.mjs

@@ -1,28 +0,0 @@
-// develop-graph — which repositories a DEVELOP candidate is built from.
-//
-// The develop graph is every first-party repository the data root declares
-// (`firstPartySources` in edition-workspace.json), each at its declared
-// `repositoryUrl`. It is never read from the release pins
-// (`runtime-image-source-index.json#repositoryPins`): develop and release are
-// separate lifecycles, and a repository is first-party on develop before any
-// release pins it. freeze-graph, the snapshot checkout, the snapshot pins'
-// validation and the snapshot's index all take their members from here.
-
-import { firstPartySources } from './first-party-source-ids.mjs';
-import { compareStrings } from './lib.mjs';
-
-/**
- * The develop graph: `{ repo, repositoryUrl }` per declared first-party
- * repository, sorted by repo handle, plus `currentResolution` (its ticket) on a
- * member the data root declares one for (develop-current-resolution.mjs).
- *
- * @returns {readonly { repo: string, repositoryUrl: string, currentResolution?: string }[]}
- */
-export function developGraphMembers() {
-  return Object.freeze(
-    Object.entries(firstPartySources('the develop graph'))
-      .map(([repo, { repositoryUrl, currentResolution }]) =>
-        Object.freeze({ repo, repositoryUrl, ...(currentResolution === undefined ? {} : { currentResolution }) }))
-      .sort((a, b) => compareStrings(a.repo, b.repo)),
-  );
-}

package/edition/develop-image-coordinate.mjs

@@ -1,54 +0,0 @@
-// develop-image-coordinate — the ONE mapping from a release image repository to
-// the develop repository its producer pushes the same build to.
-//
-//   <host>/<owner>/<name...>   ->   <host>/<owner>/dev/<name...>
-//
-// A producer's develop lane pushes `<devRepository>:<contentHash>` (contract C1)
-// and nothing else reads or writes that namespace, so a release coordinate can
-// never be satisfied by a develop build or the other way round.
-
-import { DEVELOP_IMAGE_NAMESPACE_SEGMENT } from './edition-constants.mjs';
-import { splitImageRef } from './registry-credentials.mjs';
-
-const DEVELOP_NAMESPACE_SEGMENT = DEVELOP_IMAGE_NAMESPACE_SEGMENT;
-
-const OWNER_SEGMENT_INDEX = 0;
-const NAMESPACE_SEGMENT_INDEX = 1;
-const MINIMUM_REPOSITORY_SEGMENTS = 2;
-
-/** `developImageRef('registry.example.com/acme/identity-api') === 'registry.example.com/acme/dev/identity-api'`. */
-export function developImageRef(releaseImageRef) {
-  const { authority, repository } = splitImageRef(releaseImageRef);
-  if (repository.includes('@') || repository.includes(':')) {
-    throw new Error(
-      `image reference "${releaseImageRef}" carries a tag or digest; a develop coordinate maps a bare repository`,
-    );
-  }
-  const segments = repository.split('/');
-  if (segments.length < MINIMUM_REPOSITORY_SEGMENTS) {
-    throw new Error(
-      `image reference "${releaseImageRef}" has no <owner>/<name> repository path; it cannot be mapped to a develop repository`,
-    );
-  }
-  if (segments[NAMESPACE_SEGMENT_INDEX] === DEVELOP_NAMESPACE_SEGMENT) {
-    throw new Error(`image reference "${releaseImageRef}" is already a develop repository`);
-  }
-  const [owner, ...name] = segments;
-  return `${authority}/${owner}/${DEVELOP_NAMESPACE_SEGMENT}/${name.join('/')}`;
-}
-
-/** Whether a repository reference lies in the develop namespace. */
-export function isDevelopImageRef(imageRef) {
-  let repository;
-  try {
-    ({ repository } = splitImageRef(imageRef));
-  } catch {
-    return false;
-  }
-  const segments = repository.split('/');
-  return (
-    segments.length > MINIMUM_REPOSITORY_SEGMENTS &&
-    segments[OWNER_SEGMENT_INDEX].length > 0 &&
-    segments[NAMESPACE_SEGMENT_INDEX] === DEVELOP_NAMESPACE_SEGMENT
-  );
-}