@xemahq/xema 0.59.0 → 0.60.1

package/edition/assemble-third-party-input.mjs

@@ -1,336 +0,0 @@
-#!/usr/bin/env node
-// assemble-third-party-input — the producer input of ONE image of a THIRD-PARTY biome, assembled in the publisher's own
-// GitHub-hosted workflow (XEMA-1611 design section 5).
-//
-//   xema edition evidence assemble-third-party-input \
-//     --bundle <oci repository>@sha256:<64-hex> \
-//     --contract-authority <file> \
-//     --image <image repository>@sha256:<64-hex> \
-//     --subject-id <component image name> \
-//     --provenance <absolute exported BuildKit SLSA v1 predicate> \
-//     --registry-credentials <file> \
-//     --output <path> \
-//     [--ttl-seconds <n>]
-//
-// It runs on PUBLIC inputs only: this CLI and the `@xemahq/contracts` it ships (both from public npm), the publisher's
-// own checkout at GITHUB_WORKSPACE, its own registry credential declaration and the GITHUB_* context of the run. It
-// takes no data root, no kernel checkout and nothing of the vendor's. The checks that need the vendor's trust policy
-// (the producer TTL ceiling, the signer rows, image ownership) run at the vendor's admission, by the trusted writer
-// (`index runtime-image-source --trusted-write --third-party`), never here.
-//
-// Emits the EXACT producer input `produce-image-source-evidence.mjs` accepts, through the first-party assembler's own
-// document builder and gates (`assemble-producer-input.mjs`). Field derivation:
-//   * contractAuthority   — the `--contract-authority` file (the kernel contract authority the vendor's evidence trust
-//                           pin names), proved to be the kernel this CLI ships before anything else is read.
-//   * subject kind and id — the bundle's `xema-biome.json` (`--bundle`, read BY DIGEST): the one service or worker
-//                           component with an `oci-image` artifact whose image name is `--subject-id` (a service by
-//                           `protocol.serviceName`, a worker by its key), kind `runtime-component` for a
-//                           `scheduler: runtime` component and `service` otherwise, as the index builder names it.
-//   * repo, repositoryUrl, sourceCommit, producerWorkflowSha, signer, builderId, runId, runAttempt
-//                         — GITHUB_REPOSITORY, GITHUB_SHA, GITHUB_WORKFLOW_REF, GITHUB_RUN_ID, GITHUB_RUN_ATTEMPT.
-//   * sourceManifestHash  — the kernel hash of the bundle's `xema-biome.json`.
-//   * path                — `<repo>/<biome dir>`: the directory of the ONE `xema-biome.json` of the checkout at
-//                           GITHUB_SHA whose hash is the bundle's (none, or more than one, is refused by name).
-//   * sourceTreeHash      — `hashImageBuildInputs` over the publisher's checkout at GITHUB_SHA, the same algorithm
-//                           first-party images are hashed with, with no cross-repo inputs. It is publisher-attested:
-//                           the vendor never recomputes it.
-//   * builder digests     — the exported BuildKit SLSA v1 predicate (`--provenance`), whose VCS revision must be
-//                           GITHUB_SHA.
-//   * manifest media type, platforms, sbomDigest, provenanceDigest
-//                         — the registry, read BY DIGEST at `--image` (no tag is read), with the publisher's credential.
-//   * issuedAt/expiresAt  — now, plus `--ttl-seconds` or DEFAULT_PRODUCER_TTL_SECONDS (72h). The ceiling is the vendor
-//                           trust policy's maxProducerTtlSeconds, enforced by the vendor's third-party pin writer
-//                           (`index runtime-image-source --trusted-write --third-party`) and `verify-evidence`; this CLI holds
-//                           no second one. A value that is not a positive integer, or whose expiresAt RFC 3339 cannot
-//                           name, is refused by name.
-//
-// It refuses to run unless RUNNER_ENVIRONMENT is `github-hosted` and GITHUB_REF is `refs/heads/main`. Those variables are
-// self-asserted by the run, so this is only a fail-fast mirror: the authority is the vendor's admission, which checks
-// the Fulcio certificate's Runner Environment and Source Repository Ref extensions (a third-party source is admitted
-// only from the release channel of a GitHub-hosted workflow).
-
-import { isAbsolute, resolve } from 'node:path';
-
-import {
-  ProducerTtlCeilingSource,
-  assertAssembledProducerInput,
-  assertCanonicalSubjectId,
-  assertWorkflowContext,
-  deriveBuilder,
-  producerInputDocument,
-  producerTtlSecondsFlag,
-  readAssemblerFlags,
-  resolveImageArtifactEvidenceByDigest,
-  resolveProducerTtlSeconds,
-  writeProducerInputFile,
-} from './assemble-producer-input.mjs';
-import { configureEditionWorkspaceFromArgv, isEntryModule, kernelPackageDir, stateKernelPackageDir } from './edition-workspace.mjs';
-import { readPublicContractAuthority } from './evidence-input-mode.mjs';
-import { shippedKernelPackageDir } from './kernel-package.mjs';
-import {
-  assertGitCommitExists,
-  biomeImageComponents,
-  claimBiomeImageName,
-  hashImageBuildInputs,
-  isRuntimeImageComponent,
-  imageInputSourceHashAlgorithm,
-  readGitJsonAtCommit,
-} from './lib.mjs';
-import { OrasRegistry } from './oras.mjs';
-import { sandboxedGit } from './produce-image-source-evidence.mjs';
-import { loadRegistryCredentialDeclarationsFile, resolveRegistryCredential, splitImageRef } from './registry-credentials.mjs';
-import { subjectServicePath } from './resolve-images.mjs';
-import { fetchBundleManifest } from './third-party-bundle-registry.mjs';
-import { OCI_REPOSITORY_AT_DIGEST } from './third-party-source-flags.mjs';
-import { PUBLISHER_ATTESTED_LABEL } from './third-party-subjects.mjs';
-
-/** The runner a third-party producer input is assembled on. */
-export const THIRD_PARTY_RUNNER_ENVIRONMENT = 'github-hosted';
-/** The only ref a third-party producer input is assembled from (the release channel). */
-export const THIRD_PARTY_PRODUCER_REF = 'refs/heads/main';
-
-const BIOME_MANIFEST_FILE = 'xema-biome.json';
-const OCI_IMAGE_ARTIFACT = 'oci-image';
-
-/** The flags of the verb; every one but `--ttl-seconds` is required. */
-export const THIRD_PARTY_INPUT_FLAGS = Object.freeze({
-  bundle: 'bundle',
-  contractAuthority: 'contract-authority',
-  image: 'image',
-  subjectId: 'subject-id',
-  provenance: 'provenance',
-  registryCredentials: 'registry-credentials',
-  output: 'output',
-  ttlSeconds: 'ttl-seconds',
-});
-
-export const THIRD_PARTY_INPUT_USAGE =
-  'usage: xema edition evidence assemble-third-party-input --bundle <oci repository>@sha256:<64-hex> ' +
-  '--contract-authority <file> --image <image repository>@sha256:<64-hex> --subject-id <component image name> ' +
-  '--provenance <absolute exported SLSA v1 predicate> --registry-credentials <file> --output <path> [--ttl-seconds <n>]';
-
-/**
- * Refuse a run that is not a GitHub-hosted run of refs/heads/main, before anything else is read. RUNNER_ENVIRONMENT
- * and GITHUB_REF are self-asserted, so this is a fail-fast mirror only; the authority is the vendor admission's check
- * of the Fulcio certificate's Runner Environment and Source Repository Ref extensions.
- */
-export function assertThirdPartyRunner(env) {
-  if (env.RUNNER_ENVIRONMENT !== THIRD_PARTY_RUNNER_ENVIRONMENT) {
-    throw new Error(
-      `a third-party producer input is assembled only on a ${THIRD_PARTY_RUNNER_ENVIRONMENT} runner ` +
-        `(RUNNER_ENVIRONMENT is ${JSON.stringify(env.RUNNER_ENVIRONMENT ?? null)}): the vendor admits only certificates whose ` +
-        'Fulcio Runner Environment extension is github-hosted',
-    );
-  }
-  if (env.GITHUB_REF !== THIRD_PARTY_PRODUCER_REF) {
-    throw new Error(
-      `a third-party producer input is assembled only from ${THIRD_PARTY_PRODUCER_REF} ` +
-        `(GITHUB_REF is ${JSON.stringify(env.GITHUB_REF ?? null)}): the vendor admits only certificates whose Fulcio ` +
-        `Source Repository Ref extension is ${THIRD_PARTY_PRODUCER_REF}, the release channel`,
-    );
-  }
-}
-
-function ociReference(flag, value) {
-  if (!OCI_REPOSITORY_AT_DIGEST.test(value ?? '')) {
-    throw new Error(`--${flag} must be <repository>@sha256:<64-hex>; got ${JSON.stringify(value)}`);
-  }
-  const at = value.indexOf('@');
-  return { repository: value.slice(0, at), digest: value.slice(at + 1) };
-}
-
-/**
- * The bundle component `subjectId` names, and its runtime image subject kind, by the index builder's own rule
- * (`biomeImageComponents`, `claimBiomeImageName`, `isRuntimeImageComponent` in lib.mjs): every image component is
- * named, so a component with no image name, a web biome with an image and a duplicate image name are refused as the
- * index builder refuses them; the subject is the one with its own `oci-image` artifact named `subjectId`.
- */
-export function bundleImageSubject({ manifest, subjectId, enums, bundleRef }) {
-  const xema = manifest?.xema;
-  const components = Array.isArray(xema?.components) ? xema.components : [];
-  const rel = `bundle ${bundleRef} ${BIOME_MANIFEST_FILE}`;
-  const taken = new Set();
-  const images = biomeImageComponents(components)
-    .map((component) => ({ component, name: claimBiomeImageName(component, { rel, id: xema?.id, target: xema?.target, taken }) }))
-    .filter(({ component }) => component.artifact?.kind === OCI_IMAGE_ARTIFACT);
-  const match = images.find(({ name }) => name === subjectId);
-  if (match === undefined) {
-    throw new Error(
-      `bundle ${bundleRef} has no ${OCI_IMAGE_ARTIFACT} service or worker component named ${JSON.stringify(subjectId)} ` +
-        `(its images: ${images.map(({ name }) => name).join(', ') || 'none'}); --subject-id names exactly one`,
-    );
-  }
-  const kind = isRuntimeImageComponent(match.component)
-    ? enums.RuntimeImageSubjectKind.RuntimeComponent
-    : enums.RuntimeImageSubjectKind.Service;
-  return { kind, id: subjectId };
-}
-
-/**
- * The biome directory of the publisher's checkout at `commit`: the directory of the ONE `xema-biome.json` whose kernel
- * source manifest hash is `sourceManifestHash` (`''` for the repository root). None, or more than one, is refused.
- */
-export async function biomeDirectoryAtCommit({ checkout, commit, sourceManifestHash, schemas, bundleRef }) {
-  const paths = sandboxedGit(checkout, ['ls-tree', '-r', '-z', '--name-only', commit])
-    .split('\0')
-    .filter((path) => path === BIOME_MANIFEST_FILE || path.endsWith(`/${BIOME_MANIFEST_FILE}`));
-  const matching = [];
-  for (const path of paths) {
-    const hash = await schemas.computeBiomeSourceManifestHash(readGitJsonAtCommit(checkout, path, commit));
-    if (hash === sourceManifestHash) {matching.push(path);}
-  }
-  if (matching.length !== 1) {
-    throw new Error(
-      `the checkout at ${commit} has ${matching.length} ${BIOME_MANIFEST_FILE} files whose source manifest hash is ` +
-        `${sourceManifestHash}, the hash of bundle ${bundleRef} ` +
-        `(${matching.length === 0 ? `its ${BIOME_MANIFEST_FILE} files: ${paths.join(', ') || 'none'}` : matching.join(', ')}); exactly one is required: ` +
-        'the bundle must be published from this commit',
-    );
-  }
-  const [path] = matching;
-  return path === BIOME_MANIFEST_FILE ? '' : path.slice(0, -`/${BIOME_MANIFEST_FILE}`.length);
-}
-
-/**
- * Assemble the producer input of one third-party image and prove it satisfies the producer's exact contract.
- *
- * @param {object} request
- * @param {string} request.bundle `<oci repository>@sha256:<hex>` of the published biome bundle
- * @param {string} request.contractAuthorityPath the `--contract-authority` file
- * @param {string} request.image `<image repository>@sha256:<hex>` of the published image
- * @param {string} request.subjectId the bundle component's image name
- * @param {string} request.provenancePath the exported BuildKit SLSA v1 predicate (absolute)
- * @param {string} request.registryCredentialsPath the publisher's registry credential declaration file
- * @param {number} [request.ttlSeconds]
- * @param {string} [request.kernelDir] the kernel package (default: the configured Kernel root)
- * @param {object} [request.env]
- * @param {Function} [request.registryFor] `({authority, credential}) => client`, for tests
- * @param {number} [request.now]
- */
-export async function assembleThirdPartyInput({
-  bundle,
-  contractAuthorityPath,
-  image,
-  subjectId,
-  provenancePath,
-  registryCredentialsPath,
-  ttlSeconds,
-  kernelDir = kernelPackageDir(),
-  env = process.env,
-  fetchImpl = globalThis.fetch,
-  registryFor = null,
-  now = Date.now(),
-}) {
-  assertThirdPartyRunner(env);
-  const context = assertWorkflowContext(env);
-  ociReference(THIRD_PARTY_INPUT_FLAGS.bundle, bundle);
-  const imageRef = ociReference(THIRD_PARTY_INPUT_FLAGS.image, image);
-  assertCanonicalSubjectId(subjectId);
-  const effectiveTtlSeconds = resolveProducerTtlSeconds({ ttlSeconds, now, ceiling: { source: ProducerTtlCeilingSource.VendorAdmission } });
-  const checkout = env.GITHUB_WORKSPACE;
-  if (typeof checkout !== 'string' || !isAbsolute(checkout)) {
-    throw new Error(
-      `GITHUB_WORKSPACE (${JSON.stringify(checkout ?? null)}) is not an absolute path: the publisher's checkout at GITHUB_SHA is hashed there`,
-    );
-  }
-  try {
-    assertGitCommitExists(checkout, context.sha);
-  } catch (error) {
-    throw new Error(`the publisher's checkout at GITHUB_WORKSPACE ${checkout} does not hold GITHUB_SHA ${context.sha}: ${error.message}`);
-  }
-  const { contractAuthority, schemas } = await readPublicContractAuthority({ path: contractAuthorityPath, kernelDir });
-  const builder = deriveBuilder({ provenancePath, sourceCommit: context.sha });
-
-  const declarations = loadRegistryCredentialDeclarationsFile(registryCredentialsPath);
-  const clients = new Map();
-  const clientFor = (authority) => {
-    if (!clients.has(authority)) {
-      const credential = resolveRegistryCredential({ authority, declarations, env });
-      // No vendor data root: the publisher's oras is held to its version, not to a vendor pin. Every byte read is
-      // content-addressed here and re-verified by the vendor's admission.
-      clients.set(authority, registryFor ? registryFor({ authority, credential }) : new OrasRegistry({ credential, trust: () => null, fetchImpl }));
-    }
-    return clients.get(authority);
-  };
-
-  const { manifest } = await fetchBundleManifest({ clientFor, ociRef: bundle });
-  const sourceManifestHash = await schemas.computeBiomeSourceManifestHash(manifest);
-  const subject = bundleImageSubject({ manifest, subjectId, enums: schemas, bundleRef: bundle });
-  const biomeDirectory = await biomeDirectoryAtCommit({ checkout, commit: context.sha, sourceManifestHash, schemas, bundleRef: bundle });
-  const servicePath = subjectServicePath(
-    { kind: subject.kind, id: subject.id, repo: context.repository, path: biomeDirectory === '' ? '.' : biomeDirectory },
-    context.sha,
-    () => ({ dir: checkout, base: checkout }),
-  );
-  const sourceTreeHash = hashImageBuildInputs(
-    { repoDir: checkout, service: subject.id, servicePath, commit: context.sha, crossRepoInputs: [], buildStepDirectories: [] },
-    imageInputSourceHashAlgorithm(),
-  );
-  const artifact = await resolveImageArtifactEvidenceByDigest({
-    client: clientFor(splitImageRef(imageRef.repository).authority),
-    imageRepository: imageRef.repository,
-    manifestDigest: imageRef.digest,
-    referenceProvenance: builder.predicate,
-  });
-  const input = producerInputDocument({
-    contractAuthority,
-    context,
-    builder,
-    now,
-    ttlSeconds: effectiveTtlSeconds,
-    subject: {
-      kind: subject.kind,
-      id: subject.id,
-      repositoryUrl: `https://github.com/${context.repository}`,
-      repo: context.repository,
-      path: biomeDirectory === '' ? context.repository : `${context.repository}/${biomeDirectory}`,
-      sourceCommit: context.sha,
-      sourceManifestHash,
-      sourceTreeHash,
-      imageRepository: imageRef.repository,
-      ...artifact,
-    },
-  });
-  assertAssembledProducerInput({ input, schemas, contractAuthority, context });
-  return input;
-}
-
-function requireFlag(flags, name) {
-  const value = flags.get(name);
-  if (value === undefined) {
-    throw new Error(`--${name} is required\n${THIRD_PARTY_INPUT_USAGE}`);
-  }
-  return value;
-}
-
-async function main() {
-  // No workspace root: the verb runs on public inputs, with the kernel this CLI ships.
-  const args = configureEditionWorkspaceFromArgv(process.argv.slice(2), [], { refuseOthers: true });
-  stateKernelPackageDir(shippedKernelPackageDir());
-  const flags = readAssemblerFlags(args, new Set(Object.values(THIRD_PARTY_INPUT_FLAGS)));
-  const output = resolve(requireFlag(flags, THIRD_PARTY_INPUT_FLAGS.output));
-  const ttl = flags.get(THIRD_PARTY_INPUT_FLAGS.ttlSeconds);
-  const input = await assembleThirdPartyInput({
-    bundle: requireFlag(flags, THIRD_PARTY_INPUT_FLAGS.bundle),
-    contractAuthorityPath: resolve(requireFlag(flags, THIRD_PARTY_INPUT_FLAGS.contractAuthority)),
-    image: requireFlag(flags, THIRD_PARTY_INPUT_FLAGS.image),
-    subjectId: requireFlag(flags, THIRD_PARTY_INPUT_FLAGS.subjectId),
-    provenancePath: requireFlag(flags, THIRD_PARTY_INPUT_FLAGS.provenance),
-    registryCredentialsPath: resolve(requireFlag(flags, THIRD_PARTY_INPUT_FLAGS.registryCredentials)),
-    ttlSeconds: producerTtlSecondsFlag(ttl),
-  });
-  writeProducerInputFile(output, input);
-  const [subject] = input.subjects;
-  console.log(
-    `[assemble-third-party-input] wrote ${output} for subject ${subject.kind}:${subject.id} ` +
-      `(${subject.imageRepository}@${subject.manifestDigest}, ${subject.repo}@${subject.sourceCommit}, ` +
-      `sourceTreeHash (${PUBLISHER_ATTESTED_LABEL}) ${subject.sourceTreeHash})`,
-  );
-}
-
-if (isEntryModule(import.meta.url)) {
-  main().catch((error) => {
-    console.error(`[assemble-third-party-input] ${error.message}`);
-    process.exitCode = 1;
-  });
-}

package/edition/authored-source-check.mjs

@@ -1,135 +0,0 @@
-#!/usr/bin/env node
-// authored-source-check — `xema edition check-authored`: grades the AUTHORED
-// distribution source, the develop lifecycle's gate. It is its own mode, not
-// the release check with assertions turned off: `xema edition check`
-// (dist-check.mjs) stays the full release-path grade, and nothing here can
-// make it skip anything.
-//
-// Authored and release state are separate lifecycles. What is authored is
-// graded here, offline; what only a release carries is not read: no lock
-// content (the committed distribution / images / authorization / chart-set
-// locks; the trust-arming rule counts lock files by presence), and nothing that
-// needs a source checkout at a committed `repositoryPins` commit. No edition is
-// resolved here: the plane invariants over a resolved edition (the
-// capability-domain reservation table and biome confinement) are asserted on
-// develop by the develop resolve against the graph it froze
-// (develop-edition-invariants.mjs), and on the release path by
-// `xema edition check` over the committed locks. One place per assertion.
-//
-// KEPT (each refuses):
-//   - the kernel speaks a supported edition protocol;
-//   - biome-index.json: immutable entries, deterministic order, no duplicate
-//     source identity, a serviceDependencies projection on every entry;
-//   - platform-service-index.json: parses, matches the declared
-//     platformServiceSources offline, service-dependency owner parity;
-//   - runtime-image-source-index.json: the offline `--check`;
-//   - the evidence trust policy, its data-root pin and its arming assessment;
-//   - the data-root readers (store source repositories, publisher trust);
-//   - the fleet chart-set pin is a rostered chart-set lock;
-//   - the pinned kernel's authorization composer loads;
-//   - the ownership self-tests: the kernel's capability-domain reader refuses
-//     two owners of one domain and an invalid domain, and counts no unlisted
-//     domain as first-party (synthetic tables, no lock);
-//   - every edition definition is structurally valid: the kernel parses it
-//     (its `sourcePins` included) and it composes.
-//
-// NOT HERE:
-//   - lock currency, sealed hashes, the authorization lock, each edition's
-//     chart-set.lock.json copy, platform-service ownership at pinned commits,
-//     `--check-sources` (refused): release state, `xema edition check`;
-//   - the definition resolve, reservations, confinement: the develop resolve.
-
-import {
-  checkDataRootPlane,
-  discoverDistributionIds,
-  loadPlaneAuthorizationKernel,
-  ownershipSelfTestFailures,
-  readFleetChartSetPin,
-} from './dist-check.mjs';
-import { describeEditionHolds } from './edition-source-pins.mjs';
-import { WorkspaceRoot, configureEditionWorkspaceFromProcess, isEntryModule } from './edition-workspace.mjs';
-import { loadKernelDistributionSchemas } from './lib.mjs';
-import { composeEdition } from './resolve-distribution.mjs';
-
-/** The release-path flag this mode refuses rather than ignores. */
-const CHECK_SOURCES_FLAG = '--check-sources';
-
-/**
- * Whether edition `id`'s definition is structurally valid: the kernel parses it
- * and it composes. Nothing is resolved and no index or source is read.
- *
- * @returns {Promise<string | null>} the refusal, or null when valid
- */
-export async function definitionRefusal(id) {
-  try {
-    const schemas = await loadKernelDistributionSchemas();
-    composeEdition(schemas.parseDistribution, id);
-    return null;
-  } catch (err) {
-    return err.message;
-  }
-}
-
-/**
- * The ownership self-tests (dist-check.mjs): the kernel's capability-domain
- * reader, against synthetic tables. Lock-free. Returns true when green.
- */
-async function checkOwnershipSelfTests(resolveFirstPartyCapabilityDomains) {
-  let failures;
-  try {
-    failures = ownershipSelfTestFailures(resolveFirstPartyCapabilityDomains);
-  } catch (err) {
-    failures = [`the kernel's capability-domain reader threw on a valid table: ${err.message}`];
-  }
-  for (const failure of failures) {console.error(`[dist:check-authored] ownership self-test FAILED: ${failure}`);}
-  if (failures.length === 0) {console.log('[dist:check-authored] ownership self-tests: green.');}
-  return failures.length === 0;
-}
-
-/**
- * The authored check over the configured roots. Returns true when green.
- * `resolveFirstPartyCapabilityDomains` is the kernel's reader unless a test
- * stands in for it.
- */
-export async function checkAuthoredSource({ resolveFirstPartyCapabilityDomains } = {}) {
-  let green = await checkDataRootPlane({ checkSources: false });
-  const reader = resolveFirstPartyCapabilityDomains ?? (await loadKernelDistributionSchemas()).resolveFirstPartyCapabilityDomains;
-  if (!(await checkOwnershipSelfTests(reader))) {green = false;}
-
-  const distributionIds = discoverDistributionIds();
-  for (const line of describeEditionHolds(distributionIds)) {console.log(line);}
-  for (const id of distributionIds) {
-    const refusal = await definitionRefusal(id);
-    if (refusal === null) {
-      console.log(`[dist:check-authored] ${id}: the definition is valid.`);
-    } else {
-      console.error(`[dist:check-authored] ${id}: the definition is invalid — ${refusal}`);
-      green = false;
-    }
-  }
-
-  const { green: authorizationKernelGreen } = await loadPlaneAuthorizationKernel();
-  if (!authorizationKernelGreen) {green = false;}
-  if (readFleetChartSetPin() === null) {green = false;}
-
-  return green;
-}
-
-async function main() {
-  if (process.argv.includes(CHECK_SOURCES_FLAG)) {
-    throw new Error(
-      `${CHECK_SOURCES_FLAG} audits the indexes against source checkouts, which is release state: ` +
-        `run \`xema edition check ${CHECK_SOURCES_FLAG}\`.`,
-    );
-  }
-  if (!(await checkAuthoredSource())) {process.exit(1);}
-  console.log('[dist:check-authored] the authored distribution source is green.');
-}
-
-if (isEntryModule(import.meta.url)) {
-  configureEditionWorkspaceFromProcess([WorkspaceRoot.Data, WorkspaceRoot.Editions, WorkspaceRoot.Sources, WorkspaceRoot.Kernel]);
-  main().catch((err) => {
-    console.error(`[dist:check-authored] ${err.message}`);
-    process.exit(1);
-  });
-}