@xemahq/xema 0.42.0 → 0.43.0

package/dist/commands/edition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"edition.d.ts","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2CzC,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiBtD"}
+{"version":3,"file":"edition.d.ts","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6CzC,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiBtD"}

package/dist/commands/edition.js

@@ -13,6 +13,7 @@ const VERB_SUMMARY = {
     [verb_map_1.EditionVerb.Catalogue]: 'Write the catalogue.json of a release offering from its committed sealed locks: xema edition catalogue <id> --out <dir>',
     [verb_map_1.EditionVerb.Index]: `Rebuild a catalogue index: xema edition index <${Object.values(verb_map_1.EditionIndexKind).join('|')}> [--check]; xema edition index runtime-image-source --repin-contract-authority --kernel-commit <40-hex> replaces only the contract authority of the committed index with the kernel checkout's at the stated commit (its HEAD must equal it)`,
     [verb_map_1.EditionVerb.Check]: 'Check the committed edition locks and catalogue indices; prints every active per-edition hold (sourcePins) with its exit condition',
+    [verb_map_1.EditionVerb.CheckAuthored]: 'Check the authored distribution source offline (the develop gate): the definitions, the indexes, the trust policy, the data-root readers, the chart-set pin and the ownership self-tests; resolves no edition and reads no lock content and no source checkout at a pinned commit: xema edition check-authored --data-root <dir> --editions-root <dir> --sources-root <dir> --kernel <dir>',
     [verb_map_1.EditionVerb.Why]: 'Explain why a biome is in an edition: xema edition why <id> <biome>',
     [verb_map_1.EditionVerb.VerifyPlatforms]: 'Prove the registry serves every required platform of an edition: xema edition verify-platforms <id>',
     [verb_map_1.EditionVerb.CheckoutSources]: 'Check out the source repositories the runtime image source index names',

package/dist/commands/edition.js.map

@@ -1 +1 @@
-{"version":3,"file":"edition.js","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":";;AA+CA,0CAiBC;AAhED,kDAA8D;AAC9D,4DAA8D;AAC9D,0DAA2H;AAW3H,MAAM,YAAY,GAA0C;IAC1D,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,0TAA0T;IAC5T,CAAC,sBAAW,CAAC,IAAI,CAAC,EAAE,gMAAgM;IACpN,CAAC,sBAAW,CAAC,OAAO,CAAC,EAAE,oxBAAoxB;IAC3yB,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,2lBAA2lB;IAC7lB,CAAC,sBAAW,CAAC,QAAQ,CAAC,EACpB,wNAAwN;IAC1N,CAAC,sBAAW,CAAC,SAAS,CAAC,EAAE,yHAAyH;IAClJ,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,kDAAkD,MAAM,CAAC,MAAM,CAAC,2BAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,+OAA+O;IAC/V,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,oIAAoI;IACzJ,CAAC,sBAAW,CAAC,GAAG,CAAC,EAAE,qEAAqE;IACxF,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,qGAAqG;IACpI,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,wEAAwE;IACvG,CAAC,sBAAW,CAAC,kBAAkB,CAAC,EAAE,mIAAmI;IACrK,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,yQAAyQ;IAC3Q,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,+EAA+E,MAAM,CAAC,MAAM,CAAC,8BAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;IACxJ,CAAC,sBAAW,CAAC,IAAI,CAAC,EAAE,6FAA6F;IACjH,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,6JAA6J;IAClL,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,gGAAgG,MAAM,CAAC,MAAM,CAAC,mCAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qKAAqK;IAC9U,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,6LAA6L;IAC/L,CAAC,sBAAW,CAAC,MAAM,CAAC,EAClB,yMAAyM;IAC3M,CAAC,sBAAW,CAAC,GAAG,CAAC,EACf,mWAAmW;IACrW,CAAC,sBAAW,CAAC,KAAK,CAAC,EACjB,qMAAqM;IACvM,CAAC,sBAAW,CAAC,aAAa,CAAC,EACzB,uMAAuM;CAC1M,CAAC;AAEF,SAAgB,eAAe,CAAC,OAAgB;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACvF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,sBAAW,CAAC,EAAE,CAAC;QAC9C,OAAO;aACJ,OAAO,CAAC,IAAI,CAAC;aACb,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;aAC/B,QAAQ,CAAC,WAAW,EAAE,0DAA0D,CAAC;aACjF,kBAAkB,EAAE;aACpB,MAAM,CAAC,CAAC,IAAc,EAAE,EAAE;YACzB,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAA,0BAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,qBAAQ,EAAC,4BAAe,CAAC,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC;AACH,CAAC"}
+{"version":3,"file":"edition.js","sourceRoot":"","sources":["../../src/commands/edition.ts"],"names":[],"mappings":";;AAiDA,0CAiBC;AAlED,kDAA8D;AAC9D,4DAA8D;AAC9D,0DAA2H;AAW3H,MAAM,YAAY,GAA0C;IAC1D,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,0TAA0T;IAC5T,CAAC,sBAAW,CAAC,IAAI,CAAC,EAAE,gMAAgM;IACpN,CAAC,sBAAW,CAAC,OAAO,CAAC,EAAE,oxBAAoxB;IAC3yB,CAAC,sBAAW,CAAC,OAAO,CAAC,EACnB,2lBAA2lB;IAC7lB,CAAC,sBAAW,CAAC,QAAQ,CAAC,EACpB,wNAAwN;IAC1N,CAAC,sBAAW,CAAC,SAAS,CAAC,EAAE,yHAAyH;IAClJ,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,kDAAkD,MAAM,CAAC,MAAM,CAAC,2BAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,+OAA+O;IAC/V,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,oIAAoI;IACzJ,CAAC,sBAAW,CAAC,aAAa,CAAC,EACzB,4XAA4X;IAC9X,CAAC,sBAAW,CAAC,GAAG,CAAC,EAAE,qEAAqE;IACxF,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,qGAAqG;IACpI,CAAC,sBAAW,CAAC,eAAe,CAAC,EAAE,wEAAwE;IACvG,CAAC,sBAAW,CAAC,kBAAkB,CAAC,EAAE,mIAAmI;IACrK,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,yQAAyQ;IAC3Q,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,+EAA+E,MAAM,CAAC,MAAM,CAAC,8BAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;IACxJ,CAAC,sBAAW,CAAC,IAAI,CAAC,EAAE,6FAA6F;IACjH,CAAC,sBAAW,CAAC,KAAK,CAAC,EAAE,6JAA6J;IAClL,CAAC,sBAAW,CAAC,QAAQ,CAAC,EAAE,gGAAgG,MAAM,CAAC,MAAM,CAAC,mCAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qKAAqK;IAC9U,CAAC,sBAAW,CAAC,cAAc,CAAC,EAC1B,6LAA6L;IAC/L,CAAC,sBAAW,CAAC,MAAM,CAAC,EAClB,yMAAyM;IAC3M,CAAC,sBAAW,CAAC,GAAG,CAAC,EACf,mWAAmW;IACrW,CAAC,sBAAW,CAAC,KAAK,CAAC,EACjB,qMAAqM;IACvM,CAAC,sBAAW,CAAC,aAAa,CAAC,EACzB,uMAAuM;CAC1M,CAAC;AAEF,SAAgB,eAAe,CAAC,OAAgB;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACvF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,sBAAW,CAAC,EAAE,CAAC;QAC9C,OAAO;aACJ,OAAO,CAAC,IAAI,CAAC;aACb,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;aAC/B,QAAQ,CAAC,WAAW,EAAE,0DAA0D,CAAC;aACjF,kBAAkB,EAAE;aACpB,MAAM,CAAC,CAAC,IAAc,EAAE,EAAE;YACzB,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAA,0BAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,qBAAQ,EAAC,4BAAe,CAAC,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC;AACH,CAAC"}

package/dist/edition/verify-image-evidence.bundle.provenance.json

@@ -2419,253 +2419,253 @@
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/adapter-host-versions.mjs",
       "sha256": "sha256:1b7ebd3592f4da1225fba74aaba912e7d85fbceeb1626f7dcdac83491cbb4d69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/authorization-base.mjs",
       "sha256": "sha256:bbeac7ff01376cb89ed2140526d4795d8e559b3f01612b404a701f19aaa24c6a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/build-ledger.mjs",
       "sha256": "sha256:05202cbdd606aee086c8e9c62d28be68c429653a8b1d73a289ed0fe4ff14da85"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/connector-source-authority.mjs",
       "sha256": "sha256:ea94475f4324737673accd7de1303c44db1cbc4dac61a865a06cd83abe310164"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/dispatched-runtime-components.mjs",
       "sha256": "sha256:9712823d183a60108cd002b2d36a9e5c0867b9d576dd02825264a18f7b8ece69"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/distribution-paths.mjs",
       "sha256": "sha256:d78a5c8405bc6c25d36fcec61b0030e1fdacac7d528e698adb96f906f4b70279"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/edition-artifact.mjs",
       "sha256": "sha256:282b6d5e70736f7e41cff41167d2cd99b7d0127dcc2b712132888dcfc82e36cd"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/edition-channel.mjs",
       "sha256": "sha256:3c0c1564dc50be133cad500452d953353aa5beb703142c05a17bbce8175ba9f3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/edition-chart-set.mjs",
       "sha256": "sha256:f9f16b58279c8c2619a39c5cc92bdbc334543d1a324304cd5d3b120d66dc8f3a"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/edition-config.mjs",
       "sha256": "sha256:e3997bd9a0082e02d01760868b2a4f41ed3081e904126b30fdf86e7938dc6137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/edition-constants.mjs",
       "sha256": "sha256:d3747ca300f38832796521b47d12076bdba7f214199a1dec52c9384ab3dde394"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/edition-contract-parse.mjs",
       "sha256": "sha256:c575e96b70bda82899931eb0b18567988e2e13e664fa498bcbef96b571dcabb4"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/edition-contract.json",
       "sha256": "sha256:af7c88854007e63e4e77863cf72610f59ff838959dbd381087ec50ba782ae0e1"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/edition-protocol.mjs",
       "sha256": "sha256:1f10ece5f34b6a6b0dbe169b6cbabe4b1b0778a1bc136c9c5c29b54181b1f546"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/edition-source-pins.mjs",
       "sha256": "sha256:b141474fff33b06734fb62cd2552752b991c8267bb1c9bccb22a81dd80e91c6c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/edition-workspace.mjs",
       "sha256": "sha256:892b360f9f80d2308b0b12f9b99658ae06173878d9b71cf5d6fc8bd717b3c86e"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/evidence-checkout.mjs",
       "sha256": "sha256:31fb669769b31de4c6f2b2501bb96959548172ef166e7568edbbfed7f5079a11"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/evidence-grammars.mjs",
       "sha256": "sha256:4dae22b61ade99219a482b971c9780d68a3d37d021e39cdfe860b245364b8b9f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/evidence-trust-pin.mjs",
       "sha256": "sha256:65077589d1d9bd129c175c03a6dca6bb4eaf277fa29d6391e1065654fe8cc246"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/git-json.mjs",
       "sha256": "sha256:d0d25cda0c19007becabc9a2827c3dcf759b295cd0b41596eb4480c9549a1f21"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/image-delivery-entitlement-descriptor.mjs",
       "sha256": "sha256:4726b66116f01bf2523fafe2b7a356591eca8fb5ca6bd8b154dd4821873e921b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/image-evidence-replay-state.mjs",
       "sha256": "sha256:eba0cf1d38af0ab2f00c5099fa8bc2edc543136ce92f895544d4d284b3d6af0f"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/image-evidence.mjs",
       "sha256": "sha256:8ccbd4e7ce482cbb25521e893ac047d31ca1da782e87ee2179629e8911aa6aa3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/kernel-capability-domain.mjs",
       "sha256": "sha256:3ecf887dd8d399e91a8285f6f115f6e418fb59bbf3f004539fe65ec667219356"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/kernel-contract-authority.mjs",
       "sha256": "sha256:20abdde62a7b037c01ea9bbe1ff1e6094e6b0efd0add2f656f1938a04409bf82"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/lib.mjs",
       "sha256": "sha256:7ed1bf641f501ec6a85d4fe24c4373a2e3885b799489dd33c77ff874fc138b25"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/no-follow-file.mjs",
       "sha256": "sha256:c17bdf5e441f3c079aa06d4b48bbed05cad087855b9ad2a5e6dc43d5ee2b17c3"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/operation-requirements.mjs",
       "sha256": "sha256:92656c5e920fca2a5a75c0b8db133d551ba044c84a149f33435479248b3dff8b"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/pin-source.mjs",
       "sha256": "sha256:a23fef4698ef66ba9de4a1aabe3eebe6487d1f105f3fc161bafc5a33b99a2440"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/sigstore-bundle-media-type.mjs",
       "sha256": "sha256:e0aa5a3992f0385ddbbe69eb0307d642ac428ef516c8394816ac4fd52e0ac39c"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/source-authority.mjs",
       "sha256": "sha256:9c351f60e8ea838f445f89c3709c60b7f13b021b78d6e40eaef91350a793f0ff"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/strict-json.mjs",
       "sha256": "sha256:f95778396df7f38b086f55d2ec4f3b6644a8aeff2b32282a62829145fb544562"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/string-order.mjs",
       "sha256": "sha256:b3210cd273e4b2e01fb8b1a91e28734cd211d4010c080d0ce95f5e5ff631cffb"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/trust-policy-arming.mjs",
       "sha256": "sha256:6f6f192118407e71a744087caea988bcf3d33aca9803217bceb8134d7e2b9120"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/trusted-executable.mjs",
       "sha256": "sha256:37d46cdbc999ddd55d4ea8aeed4850ddd1efde89ed7b532f5a2ddec87105d796"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/verifier-binding.mjs",
       "sha256": "sha256:80732658617f5255258c538eeb2383331ec8553b44b58d552b567845a7b916aa"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/verifier-files.mjs",
       "sha256": "sha256:cdd14a20a63f0f194a8abb55680a5a7e3ced1f09f8b210a90d349e655f6de0c0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/verifier-provenance.mjs",
       "sha256": "sha256:3e2fb8e07cf1f66b8ad6c7ac2555fe3af64ec7abeb07cecbaf1939a18c2b3663"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/verify-catalogue-evidence.mjs",
       "sha256": "sha256:d7e42efc9edced97e4330cddc46183445a870ba22f57896a7ea6bc600d369137"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/verify-image-evidence.mjs",
       "sha256": "sha256:396936f3d9e0ed68902b8b03c6fa02479e439357e6194ac8ce0e0991be834706"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "edition/workspace-sections.mjs",
       "sha256": "sha256:383f37ce066ea5573c30cedf124022095bf94d050f0a266a5881f587cff0ced0"
     },
     {
       "package": "@xemahq/xema",
-      "version": "0.42.0",
+      "version": "0.43.0",
       "path": "scripts/build-evidence-verifier.mjs",
       "sha256": "sha256:5a688d20c47dc88aff37aa0c6cc02daf2c370a5bc610fef8446ce7be222d4c0b"
     },

package/dist/runtime/edition/verb-map.d.ts

@@ -7,6 +7,7 @@ export declare enum EditionVerb {
     Catalogue = "catalogue",
     Index = "index",
     Check = "check",
+    CheckAuthored = "check-authored",
     Why = "why",
     VerifyPlatforms = "verify-platforms",
     CheckoutSources = "checkout-sources",

package/dist/runtime/edition/verb-map.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verb-map.d.ts","sourceRoot":"","sources":["../../../src/runtime/edition/verb-map.ts"],"names":[],"mappings":"AAKA,oBAAY,WAAW;IACrB,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,KAAK,UAAU;IACf,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,eAAe,qBAAqB;IACpC,eAAe,qBAAqB;IACpC,kBAAkB,yBAAyB;IAC3C,cAAc,oBAAoB;IAClC,QAAQ,aAAa;IACrB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,aAAa,mBAAmB;IAChC,QAAQ,cAAc;IACtB,cAAc,oBAAoB;IAClC,MAAM,WAAW;IACjB,GAAG,QAAQ;IACX,KAAK,UAAU;CAChB;AAGD,oBAAY,wBAAwB;IAClC,OAAO,YAAY;IACnB,YAAY,kBAAkB;CAC/B;AAGD,oBAAY,mBAAmB;IAC7B,aAAa,mBAAmB;IAChC,SAAS,cAAc;IACvB,WAAW,iBAAiB;IAC5B,cAAc,oBAAoB;IAClC,WAAW,iBAAiB;IAC5B,GAAG,QAAQ;CACZ;AAGD,oBAAY,wBAAwB;IAClC,QAAQ,aAAa;IACrB,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;IAC3B,SAAS,cAAc;CACxB;AAGD,oBAAY,gBAAgB;IAC1B,KAAK,UAAU;IACf,eAAe,qBAAqB;IACpC,kBAAkB,yBAAyB;CAC5C;AAGD,oBAAY,oBAAoB;IAC9B,OAAO,YAAY;IACnB,MAAM,WAAW;CAClB;AAGD,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,MAAM,CAAC,CAE1F,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,KAAK,GAAG,WAAW,CAAC,cAAc,GAAG,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAoBnI,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAGtF,CAAC;AAEF,eAAO,MAAM,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAK/F,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAQxH,CAAC;AAGF,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAE9C,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAI1E,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IAExC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAiDD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CAoBtG"}
+{"version":3,"file":"verb-map.d.ts","sourceRoot":"","sources":["../../../src/runtime/edition/verb-map.ts"],"names":[],"mappings":"AAKA,oBAAY,WAAW;IACrB,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,KAAK,UAAU;IACf,KAAK,UAAU;IACf,aAAa,mBAAmB;IAChC,GAAG,QAAQ;IACX,eAAe,qBAAqB;IACpC,eAAe,qBAAqB;IACpC,kBAAkB,yBAAyB;IAC3C,cAAc,oBAAoB;IAClC,QAAQ,aAAa;IACrB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,aAAa,mBAAmB;IAChC,QAAQ,cAAc;IACtB,cAAc,oBAAoB;IAClC,MAAM,WAAW;IACjB,GAAG,QAAQ;IACX,KAAK,UAAU;CAChB;AAGD,oBAAY,wBAAwB;IAClC,OAAO,YAAY;IACnB,YAAY,kBAAkB;CAC/B;AAGD,oBAAY,mBAAmB;IAC7B,aAAa,mBAAmB;IAChC,SAAS,cAAc;IACvB,WAAW,iBAAiB;IAC5B,cAAc,oBAAoB;IAClC,WAAW,iBAAiB;IAC5B,GAAG,QAAQ;CACZ;AAGD,oBAAY,wBAAwB;IAClC,QAAQ,aAAa;IACrB,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;IAC3B,SAAS,cAAc;CACxB;AAGD,oBAAY,gBAAgB;IAC1B,KAAK,UAAU;IACf,eAAe,qBAAqB;IACpC,kBAAkB,yBAAyB;CAC5C;AAGD,oBAAY,oBAAoB;IAC9B,OAAO,YAAY;IACnB,MAAM,WAAW;CAClB;AAGD,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,MAAM,CAAC,CAE1F,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,KAAK,GAAG,WAAW,CAAC,cAAc,GAAG,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAqBnI,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAGtF,CAAC;AAEF,eAAO,MAAM,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAK/F,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAQxH,CAAC;AAGF,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAE9C,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAI1E,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IAExC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAiDD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CAoBtG"}

package/dist/runtime/edition/verb-map.js

@@ -12,6 +12,7 @@ var EditionVerb;
     EditionVerb["Catalogue"] = "catalogue";
     EditionVerb["Index"] = "index";
     EditionVerb["Check"] = "check";
+    EditionVerb["CheckAuthored"] = "check-authored";
     EditionVerb["Why"] = "why";
     EditionVerb["VerifyPlatforms"] = "verify-platforms";
     EditionVerb["CheckoutSources"] = "checkout-sources";
@@ -70,6 +71,7 @@ exports.EDITION_VERB_ENTRY = {
     [EditionVerb.Artifact]: 'release-edition-artifact.mjs',
     [EditionVerb.Catalogue]: 'catalogue-edition.mjs',
     [EditionVerb.Check]: 'dist-check.mjs',
+    [EditionVerb.CheckAuthored]: 'authored-source-check.mjs',
     [EditionVerb.Why]: 'why.mjs',
     [EditionVerb.VerifyPlatforms]: 'verify-image-platforms.mjs',
     [EditionVerb.CheckoutSources]: 'checkout-indexed-source-repositories.mjs',

package/dist/runtime/edition/verb-map.js.map

@@ -1 +1 @@
-{"version":3,"file":"verb-map.js","sourceRoot":"","sources":["../../../src/runtime/edition/verb-map.ts"],"names":[],"mappings":";;;AAsLA,4DAoBC;AArMD,IAAY,WAuBX;AAvBD,WAAY,WAAW;IACrB,kCAAmB,CAAA;IACnB,4BAAa,CAAA;IACb,kCAAmB,CAAA;IACnB,kCAAmB,CAAA;IACnB,oCAAqB,CAAA;IACrB,sCAAuB,CAAA;IACvB,8BAAe,CAAA;IACf,8BAAe,CAAA;IACf,0BAAW,CAAA;IACX,mDAAoC,CAAA;IACpC,mDAAoC,CAAA;IACpC,0DAA2C,CAAA;IAC3C,iDAAkC,CAAA;IAClC,oCAAqB,CAAA;IACrB,4BAAa,CAAA;IACb,8BAAe,CAAA;IACf,+CAAgC,CAAA;IAChC,qCAAsB,CAAA;IACtB,iDAAkC,CAAA;IAClC,gCAAiB,CAAA;IACjB,0BAAW,CAAA;IACX,8BAAe,CAAA;AACjB,CAAC,EAvBW,WAAW,2BAAX,WAAW,QAuBtB;AAGD,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,+CAAmB,CAAA;IACnB,0DAA8B,CAAA;AAChC,CAAC,EAHW,wBAAwB,wCAAxB,wBAAwB,QAGnC;AAGD,IAAY,mBAOX;AAPD,WAAY,mBAAmB;IAC7B,uDAAgC,CAAA;IAChC,8CAAuB,CAAA;IACvB,mDAA4B,CAAA;IAC5B,yDAAkC,CAAA;IAClC,mDAA4B,CAAA;IAC5B,kCAAW,CAAA;AACb,CAAC,EAPW,mBAAmB,mCAAnB,mBAAmB,QAO9B;AAGD,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,iDAAqB,CAAA;IACrB,yDAA6B,CAAA;IAC7B,uDAA2B,CAAA;IAC3B,mDAAuB,CAAA;AACzB,CAAC,EALW,wBAAwB,wCAAxB,wBAAwB,QAKnC;AAGD,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,mCAAe,CAAA;IACf,wDAAoC,CAAA;IACpC,+DAA2C,CAAA;AAC7C,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAGD,IAAY,oBAGX;AAHD,WAAY,oBAAoB;IAC9B,2CAAmB,CAAA;IACnB,yCAAiB,CAAA;AACnB,CAAC,EAHW,oBAAoB,oCAApB,oBAAoB,QAG/B;AAGY,QAAA,yBAAyB,GAAyD;IAC7F,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,kCAAkC;CACjE,CAAC;AAEW,QAAA,kBAAkB,GAE3B;IACF,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,qBAAqB;IAC5C,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,wBAAwB;IAC5C,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,qBAAqB;IAC5C,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,qBAAqB;IAC5C,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,8BAA8B;IACtD,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,uBAAuB;IAChD,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,gBAAgB;IACrC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,SAAS;IAC5B,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,4BAA4B;IAC3D,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,0CAA0C;IACzE,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,0BAA0B;IAC5D,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,kBAAkB;IACtC,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,mBAAmB;IACxC,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,oBAAoB;IACjD,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,6BAA6B;IAC3D,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,8BAA8B;IACpD,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,iBAAiB;IACpC,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,mBAAmB;CACzC,CAAC;AAEW,QAAA,uBAAuB,GAAuD;IACzF,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,uBAAuB;IAC3D,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,6BAA6B;CACvE,CAAC;AAEW,QAAA,gCAAgC,GAAuD;IAClG,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,mCAAmC;IACxE,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,gDAAgD;IACzF,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,iDAAiD;IACzF,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,wCAAwC;CAC/E,CAAC;AAEW,QAAA,sBAAsB,GAA0F;IAC3H,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,6BAA6B;IAElE,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,wCAAgC,CAAC,wBAAwB,CAAC,YAAY,CAAC;IAC1G,CAAC,mBAAmB,CAAC,cAAc,CAAC,EAAE,oCAAoC;IAC1E,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,iCAAiC;IAEpE,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,wBAAwB;CACpD,CAAC;AAGW,QAAA,qBAAqB,GAAG,QAAQ,CAAC;AAEjC,QAAA,mBAAmB,GAA+C;IAC7E,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,uBAAuB;IACjD,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,kCAAkC;IACtE,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,sCAAsC;CAC9E,CAAC;AAWF,MAAM,WAAW,GAAG,CAAC,KAAyB,EAA6B,EAAE,CAC3E,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AAEjE,MAAM,cAAc,GAAG,CAAC,KAAyB,EAAgC,EAAE,CACjF,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AAEpE,MAAM,mBAAmB,GAAG,CAAC,KAAyB,EAAqC,EAAE,CAC3F,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC;AAEnF,MAAM,KAAK,GAAG,CAAC,KAAyB,EAAU,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAGtG,SAAS,yBAAyB,CAAC,IAAuB;IACxD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,8BAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,6BAAqB,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IACjI,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,CAAC,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,8BAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrG,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,GAAG,aAAa,CAAC,GAAG,IAAI,CAAC;IAC3C,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,SAAS,CAAC,GAAG,CAC/H,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,wCAAgC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AAC7H,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,KAAyB,EAAqC,EAAE,CAC3F,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC;AAGnF,SAAS,yBAAyB,CAAC,IAAuB;IACxD,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAClC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,SAAS,CAAC,GAAG,CACtH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,+BAAuB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC3G,CAAC;AAGD,SAAgB,wBAAwB,CAAC,IAAiB,EAAE,IAAuB;IACjF,IAAI,IAAI,KAAK,WAAW,CAAC,cAAc,EAAE,CAAC;QACxC,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,iCAAyB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,0BAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,GAAG,CACtI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,2BAAmB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClG,CAAC"}
+{"version":3,"file":"verb-map.js","sourceRoot":"","sources":["../../../src/runtime/edition/verb-map.ts"],"names":[],"mappings":";;;AAwLA,4DAoBC;AAvMD,IAAY,WAwBX;AAxBD,WAAY,WAAW;IACrB,kCAAmB,CAAA;IACnB,4BAAa,CAAA;IACb,kCAAmB,CAAA;IACnB,kCAAmB,CAAA;IACnB,oCAAqB,CAAA;IACrB,sCAAuB,CAAA;IACvB,8BAAe,CAAA;IACf,8BAAe,CAAA;IACf,+CAAgC,CAAA;IAChC,0BAAW,CAAA;IACX,mDAAoC,CAAA;IACpC,mDAAoC,CAAA;IACpC,0DAA2C,CAAA;IAC3C,iDAAkC,CAAA;IAClC,oCAAqB,CAAA;IACrB,4BAAa,CAAA;IACb,8BAAe,CAAA;IACf,+CAAgC,CAAA;IAChC,qCAAsB,CAAA;IACtB,iDAAkC,CAAA;IAClC,gCAAiB,CAAA;IACjB,0BAAW,CAAA;IACX,8BAAe,CAAA;AACjB,CAAC,EAxBW,WAAW,2BAAX,WAAW,QAwBtB;AAGD,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,+CAAmB,CAAA;IACnB,0DAA8B,CAAA;AAChC,CAAC,EAHW,wBAAwB,wCAAxB,wBAAwB,QAGnC;AAGD,IAAY,mBAOX;AAPD,WAAY,mBAAmB;IAC7B,uDAAgC,CAAA;IAChC,8CAAuB,CAAA;IACvB,mDAA4B,CAAA;IAC5B,yDAAkC,CAAA;IAClC,mDAA4B,CAAA;IAC5B,kCAAW,CAAA;AACb,CAAC,EAPW,mBAAmB,mCAAnB,mBAAmB,QAO9B;AAGD,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,iDAAqB,CAAA;IACrB,yDAA6B,CAAA;IAC7B,uDAA2B,CAAA;IAC3B,mDAAuB,CAAA;AACzB,CAAC,EALW,wBAAwB,wCAAxB,wBAAwB,QAKnC;AAGD,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,mCAAe,CAAA;IACf,wDAAoC,CAAA;IACpC,+DAA2C,CAAA;AAC7C,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAGD,IAAY,oBAGX;AAHD,WAAY,oBAAoB;IAC9B,2CAAmB,CAAA;IACnB,yCAAiB,CAAA;AACnB,CAAC,EAHW,oBAAoB,oCAApB,oBAAoB,QAG/B;AAGY,QAAA,yBAAyB,GAAyD;IAC7F,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,kCAAkC;CACjE,CAAC;AAEW,QAAA,kBAAkB,GAE3B;IACF,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,qBAAqB;IAC5C,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,wBAAwB;IAC5C,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,qBAAqB;IAC5C,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,qBAAqB;IAC5C,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,8BAA8B;IACtD,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,uBAAuB;IAChD,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,gBAAgB;IACrC,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,2BAA2B;IACxD,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,SAAS;IAC5B,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,4BAA4B;IAC3D,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,0CAA0C;IACzE,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,0BAA0B;IAC5D,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,kBAAkB;IACtC,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,mBAAmB;IACxC,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,oBAAoB;IACjD,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,6BAA6B;IAC3D,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,8BAA8B;IACpD,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,iBAAiB;IACpC,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,mBAAmB;CACzC,CAAC;AAEW,QAAA,uBAAuB,GAAuD;IACzF,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,uBAAuB;IAC3D,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,6BAA6B;CACvE,CAAC;AAEW,QAAA,gCAAgC,GAAuD;IAClG,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,mCAAmC;IACxE,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,gDAAgD;IACzF,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,iDAAiD;IACzF,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,wCAAwC;CAC/E,CAAC;AAEW,QAAA,sBAAsB,GAA0F;IAC3H,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,6BAA6B;IAElE,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,wCAAgC,CAAC,wBAAwB,CAAC,YAAY,CAAC;IAC1G,CAAC,mBAAmB,CAAC,cAAc,CAAC,EAAE,oCAAoC;IAC1E,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,iCAAiC;IAEpE,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,wBAAwB;CACpD,CAAC;AAGW,QAAA,qBAAqB,GAAG,QAAQ,CAAC;AAEjC,QAAA,mBAAmB,GAA+C;IAC7E,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,uBAAuB;IACjD,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,kCAAkC;IACtE,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,sCAAsC;CAC9E,CAAC;AAWF,MAAM,WAAW,GAAG,CAAC,KAAyB,EAA6B,EAAE,CAC3E,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AAEjE,MAAM,cAAc,GAAG,CAAC,KAAyB,EAAgC,EAAE,CACjF,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AAEpE,MAAM,mBAAmB,GAAG,CAAC,KAAyB,EAAqC,EAAE,CAC3F,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC;AAEnF,MAAM,KAAK,GAAG,CAAC,KAAyB,EAAU,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAGtG,SAAS,yBAAyB,CAAC,IAAuB;IACxD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,8BAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,6BAAqB,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IACjI,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,CAAC,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,8BAAsB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrG,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,GAAG,aAAa,CAAC,GAAG,IAAI,CAAC;IAC3C,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,SAAS,CAAC,GAAG,CAC/H,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,wCAAgC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AAC7H,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,KAAyB,EAAqC,EAAE,CAC3F,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC;AAGnF,SAAS,yBAAyB,CAAC,IAAuB;IACxD,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAClC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,SAAS,CAAC,GAAG,CACtH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,+BAAuB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC3G,CAAC;AAGD,SAAgB,wBAAwB,CAAC,IAAiB,EAAE,IAAuB;IACjF,IAAI,IAAI,KAAK,WAAW,CAAC,cAAc,EAAE,CAAC;QACxC,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,iCAAyB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,0BAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,GAAG,CACtI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,2BAAmB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClG,CAAC"}

package/edition/README.md

@@ -33,6 +33,7 @@ Each takes the roots below plus its own arguments (`--check`, an edition id, ...
 | `seal-image-digests.mjs` | data, editions, kernel |
 | `verify-image-platforms.mjs` | data, editions, kernel |
 | `dist-check.mjs` | data, editions, sources, kernel, deploy, cache |
+| `authored-source-check.mjs` (`xema edition check-authored`) | data, editions, sources, kernel |
 | `develop-edition.mjs` | data, editions, sources, kernel, deploy, cache |
 | `release-edition.mjs` (`xema edition release`) | per verb: `freeze-sources` data; `target` none; `check-existing` data, cache; `resolve` data, editions, sources, cache |
 | `release-edition-artifact.mjs` (`xema edition artifact`) | data, editions, kernel |
@@ -71,6 +72,7 @@ Read strictly: every key is required, an unknown key or a duplicate key is refus
 xema edition resolve <id> [--check]     # write or verify the lock set
 xema edition seal <id>                  # seal image digests
 xema edition check                      # committed locks and indices are current
+xema edition check-authored             # the authored source, offline: definitions, indexes, policies, chart-set pin
 xema edition why <id> <biome>           # why a biome is in an edition
 xema edition list --editions-root <dir>
 xema edition locks <id> --channel <release|develop>  # validated locks as JSON; an unsealed distribution lock is read on develop only
@@ -87,6 +89,32 @@ xema edition evidence <assemble-input|check-committed|plan-refresh|statement|ass
 
 Results are JSON on stdout and diagnostics on stderr. Exit 0 is success and 1 is a refusal. `xema edition <verb> --help` names the roots and flags each verb takes.
 
+## Authored-source check
+
+`xema edition check-authored` grades what is authored, offline, and reads no release state. `xema edition check` is the full release-path check; the authored check is a separate entry, not that check with parts turned off. It resolves no edition.
+
+It refuses on:
+
+- the kernel's edition protocol;
+- `biome-index.json`: immutable entries, deterministic order, no duplicate source identity;
+- `platform-service-index.json` and `runtime-image-source-index.json`, validated offline;
+- the evidence trust policy, its pin and its arming (an unarmed policy counts the editions that hold a release lock, by presence only);
+- the data-root readers (store source repositories, publisher trust);
+- the fleet chart-set pin and the pinned kernel's authorization composer;
+- the ownership self-tests: the kernel's capability-domain reader refuses two owners of one domain and an invalid domain, and counts no unlisted domain as first-party;
+- every edition definition's structure: the kernel parses it, `sourcePins` included, and it composes.
+
+It reads no lock content (the committed `distribution`, `images`, `authorization` and per-edition `chart-set` locks; the trust-arming rule counts lock files by presence) and no source checkout at a pinned commit. The sources root is read only for the kernel contract checkout the runtime-image-source index check verifies its authority against. `--check-sources` is refused: it is the release check's source audit.
+
+## Develop plane invariants
+
+`xema edition develop resolve` asserts the capability-domain reservation table and biome confinement on the candidate it resolves, against the develop graph it froze, before any later phase. On develop they are asserted only there; `xema edition check` asserts them over the committed locks.
+
+- Reservation: the candidate's `capabilityDomainOwners` is non-empty, accepted by the kernel's reader, and exactly the table the frozen graph's full biome index builds, so every candidate over one graph carries the same table.
+- Confinement: each `confinedBiomes` declaration names a biome the frozen index carries and a substantive `consequence`; the candidate ships a confined biome only when admitted, and an admission of the candidate for a biome it does not ship is refused as stale.
+
+A violation throws `DevelopEditionInvariantError`, whose `violations` carry a `DevelopEditionInvariantReason` each.
+
 ## Evidence trust
 
 The edition library builds, validates and verifies evidence statements; it never signs. Signing is done by the caller with `cosign`.

package/edition/authored-source-check.mjs

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+// authored-source-check — `xema edition check-authored`: grades the AUTHORED
+// distribution source, the develop lifecycle's gate. It is its own mode, not
+// the release check with assertions turned off: `xema edition check`
+// (dist-check.mjs) stays the full release-path grade, and nothing here can
+// make it skip anything.
+//
+// Authored and release state are separate lifecycles. What is authored is
+// graded here, offline; what only a release carries is not read: no lock
+// content (the committed distribution / images / authorization / chart-set
+// locks; the trust-arming rule counts lock files by presence), and nothing that
+// needs a source checkout at a committed `repositoryPins` commit. No edition is
+// resolved here: the plane invariants over a resolved edition (the
+// capability-domain reservation table and biome confinement) are asserted on
+// develop by the develop resolve against the graph it froze
+// (develop-edition-invariants.mjs), and on the release path by
+// `xema edition check` over the committed locks. One place per assertion.
+//
+// KEPT (each refuses):
+//   - the kernel speaks a supported edition protocol;
+//   - biome-index.json: immutable entries, deterministic order, no duplicate
+//     source identity, a serviceDependencies projection on every entry;
+//   - platform-service-index.json: parses, matches the declared
+//     platformServiceSources offline, service-dependency owner parity;
+//   - runtime-image-source-index.json: the offline `--check`;
+//   - the evidence trust policy, its data-root pin and its arming assessment;
+//   - the data-root readers (store source repositories, publisher trust);
+//   - the fleet chart-set pin is a rostered chart-set lock;
+//   - the pinned kernel's authorization composer loads;
+//   - the ownership self-tests: the kernel's capability-domain reader refuses
+//     two owners of one domain and an invalid domain, and counts no unlisted
+//     domain as first-party (synthetic tables, no lock);
+//   - every edition definition is structurally valid: the kernel parses it
+//     (its `sourcePins` included) and it composes.
+//
+// NOT HERE:
+//   - lock currency, sealed hashes, the authorization lock, each edition's
+//     chart-set.lock.json copy, platform-service ownership at pinned commits,
+//     `--check-sources` (refused): release state, `xema edition check`;
+//   - the definition resolve, reservations, confinement: the develop resolve.
+
+import {
+  checkDataRootPlane,
+  discoverDistributionIds,
+  loadPlaneAuthorizationKernel,
+  ownershipSelfTestFailures,
+  readFleetChartSetPin,
+} from './dist-check.mjs';
+import { describeEditionHolds } from './edition-source-pins.mjs';
+import { WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule } from './edition-workspace.mjs';
+import { loadKernelDistributionSchemas } from './lib.mjs';
+import { composeEdition } from './resolve-distribution.mjs';
+
+/** The release-path flag this mode refuses rather than ignores. */
+const CHECK_SOURCES_FLAG = '--check-sources';
+
+/**
+ * Whether edition `id`'s definition is structurally valid: the kernel parses it
+ * and it composes. Nothing is resolved and no index or source is read.
+ *
+ * @returns {Promise<string | null>} the refusal, or null when valid
+ */
+export async function definitionRefusal(id) {
+  try {
+    const schemas = await loadKernelDistributionSchemas();
+    composeEdition(schemas.parseDistribution, id);
+    return null;
+  } catch (err) {
+    return err.message;
+  }
+}
+
+/**
+ * The ownership self-tests (dist-check.mjs): the kernel's capability-domain
+ * reader, against synthetic tables. Lock-free. Returns true when green.
+ */
+async function checkOwnershipSelfTests(resolveFirstPartyCapabilityDomains) {
+  let failures;
+  try {
+    failures = ownershipSelfTestFailures(resolveFirstPartyCapabilityDomains);
+  } catch (err) {
+    failures = [`the kernel's capability-domain reader threw on a valid table: ${err.message}`];
+  }
+  for (const failure of failures) {console.error(`[dist:check-authored] ownership self-test FAILED: ${failure}`);}
+  if (failures.length === 0) {console.log('[dist:check-authored] ownership self-tests: green.');}
+  return failures.length === 0;
+}
+
+/**
+ * The authored check over the configured roots. Returns true when green.
+ * `resolveFirstPartyCapabilityDomains` is the kernel's reader unless a test
+ * stands in for it.
+ */
+export async function checkAuthoredSource({ resolveFirstPartyCapabilityDomains } = {}) {
+  let green = await checkDataRootPlane({ checkSources: false });
+  const reader = resolveFirstPartyCapabilityDomains ?? (await loadKernelDistributionSchemas()).resolveFirstPartyCapabilityDomains;
+  if (!(await checkOwnershipSelfTests(reader))) {green = false;}
+
+  const distributionIds = discoverDistributionIds();
+  for (const line of describeEditionHolds(distributionIds)) {console.log(line);}
+  for (const id of distributionIds) {
+    const refusal = await definitionRefusal(id);
+    if (refusal === null) {
+      console.log(`[dist:check-authored] ${id}: the definition is valid.`);
+    } else {
+      console.error(`[dist:check-authored] ${id}: the definition is invalid — ${refusal}`);
+      green = false;
+    }
+  }
+
+  const { green: authorizationKernelGreen } = await loadPlaneAuthorizationKernel();
+  if (!authorizationKernelGreen) {green = false;}
+  if (readFleetChartSetPin() === null) {green = false;}
+
+  return green;
+}
+
+async function main() {
+  if (process.argv.includes(CHECK_SOURCES_FLAG)) {
+    throw new Error(
+      `${CHECK_SOURCES_FLAG} audits the indexes against source checkouts, which is release state: ` +
+        `run \`xema edition check ${CHECK_SOURCES_FLAG}\`.`,
+    );
+  }
+  if (!(await checkAuthoredSource())) {process.exit(1);}
+  console.log('[dist:check-authored] the authored distribution source is green.');
+}
+
+if (isEntryModule(import.meta.url)) {
+  configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Sources, WorkspaceRoot.Kernel]);
+  main().catch((err) => {
+    console.error(`[dist:check-authored] ${err.message}`);
+    process.exit(1);
+  });
+}

package/edition/develop-edition-invariants.mjs

@@ -0,0 +1,141 @@
+// develop-edition-invariants — the plane invariants a DEVELOP candidate asserts
+// itself, against the develop graph it froze: the capability-domain
+// reservation table and biome confinement.
+//
+// On develop these live ONLY here. `xema edition check-authored` reads no
+// resolved edition, and `xema edition check` (the release path) grades the
+// same two invariants over the committed locks.
+//
+// RESERVATION. Ownership is a property of the platform, not of what an edition
+// preloads (see `buildCapabilityDomainOwners`): every edition carries the table
+// built from the FULL index. The release check proves it by comparing the
+// committed locks with each other. A single candidate proves the same thing
+// alone: its table must be exactly the one the frozen graph's full biome index
+// builds, so any two candidates over one graph carry the identical table. It
+// must also be non-empty (an empty table makes nothing first-party), and the
+// kernel's reader must accept it (one owner per domain, valid domains).
+//
+// CONFINEMENT. The data root's `confinedBiomes` name biomes whose contents must
+// not reach an unadmitted installation. The candidate is one graded edition:
+// a declaration naming a biome the frozen index does not carry guards nothing
+// and is refused; shipping a confined biome without an admission is refused; an
+// admission of this edition for a biome it does not ship is a stale permission
+// and is refused; a declaration without a substantive consequence is refused.
+
+import { editionWorkspaceConfig } from './edition-config.mjs';
+import { buildCapabilityDomainOwners, serializeJson } from './lib.mjs';
+
+/** Why a develop candidate was refused. */
+export const DevelopEditionInvariantReason = Object.freeze({
+  RESERVATION_TABLE_EMPTY: 'reservation-table-empty',
+  RESERVATION_TABLE_NOT_PLATFORM_TABLE: 'reservation-table-not-platform-table',
+  RESERVATION_TABLE_REFUSED_BY_KERNEL: 'reservation-table-refused-by-kernel',
+  CONFINED_BIOME_UNKNOWN: 'confined-biome-unknown',
+  CONFINED_BIOME_UNADMITTED: 'confined-biome-unadmitted',
+  CONFINEMENT_ADMISSION_STALE: 'confinement-admission-stale',
+  CONFINEMENT_CONSEQUENCE_MISSING: 'confinement-consequence-missing',
+});
+
+/** The shortest `consequence` that can name what a confinement protects. */
+const MIN_CONSEQUENCE_LENGTH = 40;
+
+/** A develop candidate broke a plane invariant. `violations` carries every one, each with its reason. */
+export class DevelopEditionInvariantError extends Error {
+  /** @param {string} id @param {{ reason: string, detail: string }[]} violations */
+  constructor(id, violations) {
+    super(
+      `develop edition "${id}" breaks ${violations.length} plane invariant(s):\n` +
+        violations.map(({ reason, detail }) => `  - [${reason}] ${detail}`).join('\n'),
+    );
+    this.name = 'DevelopEditionInvariantError';
+    this.distributionId = id;
+    this.violations = violations;
+  }
+}
+
+/**
+ * The reservation violations of `lock`, whose graph's full biome index is
+ * `biomeIndex`. `resolveFirstPartyCapabilityDomains` is the kernel's reader.
+ */
+export function reservationViolations({ lock, biomeIndex, resolveFirstPartyCapabilityDomains }) {
+  const R = DevelopEditionInvariantReason;
+  const table = lock.capabilityDomainOwners;
+  if (!Array.isArray(table) || table.length === 0) {
+    return [{
+      reason: R.RESERVATION_TABLE_EMPTY,
+      detail: 'capabilityDomainOwners is missing or empty: an empty reservation table makes NOTHING first-party (fail-open)',
+    }];
+  }
+  const violations = [];
+  try {
+    resolveFirstPartyCapabilityDomains(lock);
+  } catch (err) {
+    violations.push({ reason: R.RESERVATION_TABLE_REFUSED_BY_KERNEL, detail: err.message });
+  }
+  if (serializeJson(table) !== serializeJson(buildCapabilityDomainOwners(biomeIndex))) {
+    violations.push({
+      reason: R.RESERVATION_TABLE_NOT_PLATFORM_TABLE,
+      detail:
+        'capabilityDomainOwners is not the table the frozen graph\'s full biome index builds. Ownership must not vary ' +
+        'by edition, or a trimmed edition leaves domains org-bindable',
+    });
+  }
+  return violations;
+}
+
+/**
+ * The confinement violations of edition `id` shipping `lock`, under the data
+ * root's `declarations`, with `knownBiomeIds` the frozen index's biome ids.
+ */
+export function confinementViolations({ id, lock, declarations, knownBiomeIds }) {
+  const R = DevelopEditionInvariantReason;
+  const shipped = new Set(lock.biomes.map((biome) => biome.id));
+  const violations = [];
+  for (const decl of declarations) {
+    if (typeof decl.consequence !== 'string' || decl.consequence.trim().length < MIN_CONSEQUENCE_LENGTH) {
+      violations.push({
+        reason: R.CONFINEMENT_CONSEQUENCE_MISSING,
+        detail: `confinement declaration "${decl.biomeId}" carries no substantive \`consequence\`; a refusal would name a rule without naming what it protects`,
+      });
+    }
+    if (!knownBiomeIds.has(decl.biomeId)) {
+      violations.push({
+        reason: R.CONFINED_BIOME_UNKNOWN,
+        detail:
+          `confinement declaration names biome "${decl.biomeId}", which the frozen biome index does not carry: it would ` +
+          'guard nothing. Repoint it to the renamed biome, or delete it if the biome is gone',
+      });
+      continue;
+    }
+    const admitted = decl.admittedEditions.includes(id);
+    if (shipped.has(decl.biomeId) && !admitted) {
+      violations.push({
+        reason: R.CONFINED_BIOME_UNADMITTED,
+        detail:
+          `ships biome "${decl.biomeId}", which holds ${decl.holds}. That is a CONFINEMENT decision, not a packaging one: ` +
+          `${decl.consequence}. If intended, add "${id}" to its admittedEditions in edition-workspace.json in its own commit, naming who agreed`,
+      });
+    }
+    if (!shipped.has(decl.biomeId) && admitted) {
+      violations.push({
+        reason: R.CONFINEMENT_ADMISSION_STALE,
+        detail: `the admission "${decl.biomeId}" -> "${id}" suppresses NOTHING: the edition does not ship the biome. Delete it`,
+      });
+    }
+  }
+  return violations;
+}
+
+/**
+ * Assert both invariants on develop candidate `id`. Throws
+ * {@link DevelopEditionInvariantError} naming every violation; returns the
+ * counts it graded otherwise.
+ */
+export function assertDevelopEditionInvariants({ id, lock, biomeIndex, schemas, declarations = editionWorkspaceConfig().confinedBiomes ?? [] }) {
+  const violations = [
+    ...reservationViolations({ lock, biomeIndex, resolveFirstPartyCapabilityDomains: schemas.resolveFirstPartyCapabilityDomains }),
+    ...confinementViolations({ id, lock, declarations, knownBiomeIds: new Set(biomeIndex.map((entry) => entry.id)) }),
+  ];
+  if (violations.length > 0) {throw new DevelopEditionInvariantError(id, violations);}
+  return { reservedDomains: lock.capabilityDomainOwners.length, confinedBiomes: declarations.length };
+}

package/edition/develop-edition-resolve.mjs

@@ -1,7 +1,8 @@
 // develop-edition-resolve — resolve and seal one DEVELOP edition from a snapshot.
 //
 // The whole pipeline, in the order the release runs it, over the snapshot's
-// injected inputs: distribution lock -> authorization base (composed, never
+// injected inputs: distribution lock -> plane invariants (reservation table,
+// confinement; develop-edition-invariants.mjs) -> authorization base (composed, never
 // written) -> images lock -> develop seal, plus the chart-set lock: the frozen
 // deploy commit's develop chart set (develop-chart-set.mjs). Nothing here writes to the editions
 // trees; the caller writes the artifact (edition-artifact.mjs).
@@ -10,6 +11,7 @@ import { adapterHostRow, assertAdapterBundlesMatchHost, fetchRegistryManifest }
 import { biomeSourceTreeIds, readBiomeSourceFacts, sealLock } from './biome-content.mjs';
 import { buildCatalogue } from './catalogue.mjs';
 import { resolveDevelopChartSet } from './develop-chart-set.mjs';
+import { assertDevelopEditionInvariants } from './develop-edition-invariants.mjs';
 import { createDevelopImageProbe } from './develop-image-probe.mjs';
 import { assertFrozenCheckouts, buildSnapshotInputs } from './develop-snapshot-inputs.mjs';
 import { EditionChannel } from './edition-constants.mjs';
@@ -30,6 +32,7 @@ export const DEVELOP_EDITION_STEPS = Object.freeze({
   assertFrozenCheckouts,
   buildSnapshotInputs,
   resolveDistributionWithIndex,
+  assertDevelopEditionInvariants,
   assertAdapterBundlesMatchHost,
   composeAuthorizationBase,
   resolveImages,
@@ -59,6 +62,9 @@ export async function resolveDevelopEdition({ id, pins, env = process.env, sealO
   // One line per phase, with the time since the resolve began, so the step is never silent for long.
   const phase = (name) => progress(`[develop-edition] ${name} (+${Date.now() - startedAt}ms)`);
   const { schemas, inputs, lock, index } = await resolveDevelopSnapshot({ id, pins, steps, phase });
+  // The plane invariants, against the graph this candidate froze (develop-edition-invariants.mjs).
+  const graded = steps.assertDevelopEditionInvariants({ id, lock, biomeIndex: inputs.biomeIndex, schemas });
+  phase(`reservation table asserted (${graded.reservedDomains} domains); confinement asserted (${graded.confinedBiomes} declaration(s))`);
   await steps.assertAdapterBundlesMatchHost({ lock, hostRow: adapterHostRow(index), fetchManifest });
   const authorizationLock = await steps.composeAuthorizationBase(id, lock, index);
   phase('distribution lock resolved');

package/edition/dist-check.mjs

@@ -370,7 +370,7 @@ export async function checkImagesLock(id, checkSourceEvidence) {
   }
 }
 
-async function checkCommittedRuntimeImageSourceIndex(checkSources) {
+export async function checkCommittedRuntimeImageSourceIndex(checkSources) {
   try {
     const schemas = await loadKernelDistributionSchemas();
     schemas.parseRuntimeImageSourceIndex(
@@ -394,7 +394,7 @@ async function checkCommittedRuntimeImageSourceIndex(checkSources) {
   }
 }
 
-function checkCommittedIndex() {
+export function checkCommittedIndex() {
   try {
     const index = validateImmutableBiomeIndex(
       JSON.parse(readFileSync(biomeIndexPath(), 'utf8')),
@@ -464,7 +464,7 @@ export function checkCommittedDataRootReaders() {
   return green;
 }
 
-async function checkCommittedPlatformServiceIndex() {
+export async function checkCommittedPlatformServiceIndex() {
   try {
     const schemas = await loadKernelDistributionSchemas();
     const index = schemas.parsePlatformServiceSourceIndex(
@@ -493,7 +493,7 @@ async function checkCommittedPlatformServiceIndex() {
   }
 }
 
-function discoverDistributionIds() {
+export function discoverDistributionIds() {
   if (!existsSync(editionsRoot())) {
     console.error(`[dist:check] ${editionsRoot()} does not exist.`);
     process.exit(1);
@@ -514,37 +514,16 @@ function discoverDistributionIds() {
 }
 
 /**
- * Guard for the capability-domain OWNERSHIP (reservation) table.
- *
- * This repo has no test runner (no package.json, no CI workflow of its own) —
- * `dist:check` IS its gate — so the invariant is asserted here, where it
- * actually runs, rather than in a spec file nothing would execute.
- *
- * THE INVARIANT THAT MATTERS: **every edition carries the IDENTICAL table.**
+ * The lock-free half of the ownership guard: the kernel's reader, exercised
+ * against synthetic tables. (a) two biomes claiming one domain is refused,
+ * naming it; (b) a listed domain resolves to its owner and an unlisted one is
+ * not first-party; (c) an invalid domain is refused. Reads no lock, so the
+ * authored check runs it too.
  *
- *   Ownership is a property of the platform, not of what an edition preloads.
- *   An earlier design put the claim on each `LockedBiome`, which made a trimmed
- *   edition (`appliance-lean`) leave `kb`/`agent`/… unowned — so an
- *   org admin could install the owning biome from the store and THEN bind
- *   `kb:page.read@1` to a URL they control, silently shadowing the platform
- *   data plane. The table is now built from the FULL biome index and reserves
- *   the domain even when its owning biome is absent from that edition — which
- *   is exactly the case the reservation exists to cover.
- *
- * Also re-asserts the two structural rules, through the KERNEL's own reader:
- *   (a) two biomes claiming the SAME domain is refused (ambiguous ownership has
- *       no safe resolution — fail the build, never pick a winner);
- *   (b) a domain in NO table entry is not first-party (so a claim that never
- *       made it into a resolved, committed, drift-checked lock carries no
- *       weight), and an invalid domain is refused rather than silently carried.
- *
- * @param {string[]} ids every distribution id discovered in this repo.
- * @returns {Promise<boolean>} true when green.
+ * @param {(lock: object) => Map<string, string>} resolveFirstPartyCapabilityDomains the kernel's reader
+ * @returns {string[]} the failures, empty when green
  */
-async function checkOwnershipInvariant(ids) {
-  const { resolveFirstPartyCapabilityDomains } =
-    await loadKernelDistributionSchemas();
-
+export function ownershipSelfTestFailures(resolveFirstPartyCapabilityDomains) {
   const lockOf = (capabilityDomainOwners) => ({
     schemaVersion: 1,
     distributionId: 'dist-check-selftest',
@@ -599,6 +578,43 @@ async function checkOwnershipInvariant(ids) {
     /* expected */
   }
 
+  return failures;
+}
+
+/**
+ * Guard for the capability-domain OWNERSHIP (reservation) table.
+ *
+ * This repo has no test runner (no package.json, no CI workflow of its own) —
+ * `dist:check` IS its gate — so the invariant is asserted here, where it
+ * actually runs, rather than in a spec file nothing would execute.
+ *
+ * THE INVARIANT THAT MATTERS: **every edition carries the IDENTICAL table.**
+ *
+ *   Ownership is a property of the platform, not of what an edition preloads.
+ *   An earlier design put the claim on each `LockedBiome`, which made a trimmed
+ *   edition (`appliance-lean`) leave `kb`/`agent`/… unowned — so an
+ *   org admin could install the owning biome from the store and THEN bind
+ *   `kb:page.read@1` to a URL they control, silently shadowing the platform
+ *   data plane. The table is now built from the FULL biome index and reserves
+ *   the domain even when its owning biome is absent from that edition — which
+ *   is exactly the case the reservation exists to cover.
+ *
+ * Also re-asserts the two structural rules, through the KERNEL's own reader:
+ *   (a) two biomes claiming the SAME domain is refused (ambiguous ownership has
+ *       no safe resolution — fail the build, never pick a winner);
+ *   (b) a domain in NO table entry is not first-party (so a claim that never
+ *       made it into a resolved, committed, drift-checked lock carries no
+ *       weight), and an invalid domain is refused rather than silently carried.
+ *
+ * @param {string[]} ids every distribution id discovered in this repo.
+ * @returns {Promise<boolean>} true when green.
+ */
+async function checkOwnershipInvariant(ids) {
+  const { resolveFirstPartyCapabilityDomains } =
+    await loadKernelDistributionSchemas();
+
+  const failures = ownershipSelfTestFailures(resolveFirstPartyCapabilityDomains);
+
   // (d) THE headline invariant — every committed edition carries the same,
   //     non-empty table. An edition-specific table is the fail-open bug.
   let reference;
@@ -919,13 +935,16 @@ export async function checkBiomeContentHashes(id) {
   }
 }
 
-async function main() {
-  let failed = false;
-  // The tests spawned below resolve the editions root from THEIR OWN argv and
-  // env; a root stated here by --editions-root must reach them, or they
-  // would grade the vendor's editions under a customer's dist-check.
-  const checkSources = process.argv.includes('--check-sources');
-
+/**
+ * The data-root plane both checks grade before any edition: the kernel speaks
+ * a supported edition protocol (a refusal throws), the committed biome,
+ * platform-service and runtime-image-source indexes validate offline, the
+ * evidence trust policy and the data-root readers are sound. `checkSources`
+ * adds the trusted live-source audit of the indexes (release path only).
+ * Returns true when green.
+ */
+export async function checkDataRootPlane({ checkSources }) {
+  let green = true;
   // 0. The pinned kernel speaks an edition protocol this CLI supports. This is
   // the ONE comparison between the CLI and the kernel; a refusal throws
   // EditionProtocolMismatchError and stops the check before anything is read.
@@ -938,13 +957,13 @@ async function main() {
   // A live sibling-source scan is an explicit trusted regeneration audit only;
   // CI/shared working trees must not make unrelated uncommitted sources into
   // packaging inputs.
-  if (!checkCommittedIndex()) {failed = true;}
-  if (!(await checkCommittedPlatformServiceIndex())) {failed = true;}
+  if (!checkCommittedIndex()) {green = false;}
+  if (!(await checkCommittedPlatformServiceIndex())) {green = false;}
   if (!(await checkCommittedRuntimeImageSourceIndex(checkSources))) {
-    failed = true;
+    green = false;
   }
-  if (!(await checkEvidenceTrustPolicy())) {failed = true;}
-  if (!checkCommittedDataRootReaders()) {failed = true;}
+  if (!(await checkEvidenceTrustPolicy())) {green = false;}
+  if (!checkCommittedDataRootReaders()) {green = false;}
   if (checkSources) {
     try {
       execFileSync(
@@ -958,9 +977,48 @@ async function main() {
         { stdio: 'inherit' },
       );
     } catch {
-      failed = true;
+      green = false;
     }
   }
+  return green;
+}
+
+/**
+ * The pinned kernel's authorization composer (`kernel` null when the pin
+ * predates it). `green` is false when the composer could not be loaded.
+ */
+export async function loadPlaneAuthorizationKernel() {
+  try {
+    return { green: true, kernel: await loadKernelAuthorizationComposer({ kernelPackageDir: kernelPackageDir() }) };
+  } catch (err) {
+    console.error(`[dist:check] ${err.message}`);
+    return { green: false, kernel: undefined };
+  }
+}
+
+/**
+ * The fleet chart-set pin every edition must carry (edition-chart-set.mjs), as
+ * committed text, or null when it is absent or not a rostered chart-set lock.
+ */
+export function readFleetChartSetPin() {
+  try {
+    const text = readFileSync(fleetChartSetLockPath(), 'utf8');
+    assertRosteredChartSetLock(JSON.parse(text), EDITION_CHART_SET_FILE);
+    return text;
+  } catch (err) {
+    console.error(`[dist:check] chart-set pin: ${err.message}. Run \`${commandFor('resolve-chart-set.mjs')}\`.`);
+    return null;
+  }
+}
+
+async function main() {
+  let failed = false;
+  // The tests spawned below resolve the editions root from THEIR OWN argv and
+  // env; a root stated here by --editions-root must reach them, or they
+  // would grade the vendor's editions under a customer's dist-check.
+  const checkSources = process.argv.includes('--check-sources');
+
+  if (!(await checkDataRootPlane({ checkSources }))) {failed = true;}
 
   const distributionIds = discoverDistributionIds();
 
@@ -972,25 +1030,12 @@ async function main() {
   if (!(await checkOwnershipInvariant(distributionIds))) {failed = true;}
 
   // The pinned kernel's authorization composer (null when the pin predates it).
-  let authorizationKernel;
-  try {
-    authorizationKernel = await loadKernelAuthorizationComposer({
-      kernelPackageDir: kernelPackageDir(),
-    });
-  } catch (err) {
-    console.error(`[dist:check] ${err.message}`);
-    failed = true;
-  }
+  const { green: authorizationKernelGreen, kernel: authorizationKernel } = await loadPlaneAuthorizationKernel();
+  if (!authorizationKernelGreen) {failed = true;}
 
   // The fleet chart-set pin every edition must carry (edition-chart-set.mjs).
-  let chartSetPinText = null;
-  try {
-    chartSetPinText = readFileSync(fleetChartSetLockPath(), 'utf8');
-    assertRosteredChartSetLock(JSON.parse(chartSetPinText), EDITION_CHART_SET_FILE);
-  } catch (err) {
-    console.error(`[dist:check] chart-set pin: ${err.message}. Run \`${commandFor('resolve-chart-set.mjs')}\`.`);
-    failed = true;
-  }
+  const chartSetPinText = readFleetChartSetPin();
+  if (chartSetPinText === null) {failed = true;}
 
   // 3 + 4 + 5 + 6 + 7. Every distribution: distribution.lock, images.lock,
   // authorization.lock, chart-set.lock.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.42.0",
+  "version": "0.43.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:ae545509930a5b6f1215c413f3e7121b15a29d5fd3e14ab373f0910ceaa9063d"
+    "sourceDigest": "sha256:abf054b00865c8a4b0bb44bccd5cc3c65162b8ea8dec47126bc0dfd837392fcd"
   }
 }