@fabricorg/assembly 0.3.0

package/dist/index.cjs

@@ -0,0 +1,735 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// index.ts
+var index_exports = {};
+__export(index_exports, {
+  ASSEMBLY_LOCKFILE_FORMAT_VERSION: () => ASSEMBLY_LOCKFILE_FORMAT_VERSION,
+  ASSEMBLY_MANIFEST_FORMAT_VERSION: () => ASSEMBLY_MANIFEST_FORMAT_VERSION,
+  assertAssemblyLockfile: () => assertAssemblyLockfile,
+  assertAssemblyManifest: () => assertAssemblyManifest,
+  assertAssemblyResolved: () => assertAssemblyResolved,
+  assertAssemblyRuntimeCompatible: () => assertAssemblyRuntimeCompatible,
+  assertComponentPackManifest: () => assertComponentPackManifest,
+  computeUsageContractDocumentDigest: () => computeUsageContractDocumentDigest,
+  parseSemverRange: () => parseSemverRange,
+  resolveAssembly: () => resolveAssembly,
+  resolveVersionRange: () => resolveVersionRange,
+  satisfiesRange: () => satisfiesRange,
+  validateAssemblyBindings: () => validateAssemblyBindings
+});
+module.exports = __toCommonJS(index_exports);
+var import_node_crypto = require("crypto");
+var import_adoption_bindings = require("@fabricorg/adoption-bindings");
+var import_gen_capability = require("@fabricorg/gen-capability");
+var ASSEMBLY_MANIFEST_FORMAT_VERSION = 2;
+var ASSEMBLY_LOCKFILE_FORMAT_VERSION = 2;
+function parseSemver(input) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(input.trim());
+  if (!match) return void 0;
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: match[4] ? match[4].split(".") : []
+  };
+}
+function comparePrerelease(a, b) {
+  if (a.length === 0 && b.length === 0) return 0;
+  if (a.length === 0) return 1;
+  if (b.length === 0) return -1;
+  for (let i = 0; i < Math.max(a.length, b.length); i++) {
+    const ai = a[i];
+    const bi = b[i];
+    if (ai === void 0) return -1;
+    if (bi === void 0) return 1;
+    const an = /^\d+$/.test(ai);
+    const bn = /^\d+$/.test(bi);
+    if (an && bn) {
+      const diff = Number(ai) - Number(bi);
+      if (diff !== 0) return diff;
+    } else if (an) {
+      return -1;
+    } else if (bn) {
+      return 1;
+    } else {
+      if (ai < bi) return -1;
+      if (ai > bi) return 1;
+    }
+  }
+  return 0;
+}
+function compareSemver(a, b) {
+  if (a.major !== b.major) return a.major - b.major;
+  if (a.minor !== b.minor) return a.minor - b.minor;
+  if (a.patch !== b.patch) return a.patch - b.patch;
+  return comparePrerelease(a.prerelease, b.prerelease);
+}
+function caretComparator(range) {
+  return (version) => {
+    if (compareSemver(version, range) < 0) return false;
+    if (version.major !== range.major) return false;
+    if (version.major === 0) {
+      if (version.minor !== range.minor) return false;
+      if (range.minor === 0 && version.patch !== range.patch) return false;
+    }
+    return true;
+  };
+}
+function tildeComparator(range) {
+  return (version) => {
+    if (compareSemver(version, range) < 0) return false;
+    return version.major === range.major && version.minor === range.minor;
+  };
+}
+function exactComparator(range) {
+  return (version) => compareSemver(version, range) === 0;
+}
+function gteComparator(range) {
+  return (version) => compareSemver(version, range) >= 0;
+}
+function gtComparator(range) {
+  return (version) => compareSemver(version, range) > 0;
+}
+function lteComparator(range) {
+  return (version) => compareSemver(version, range) <= 0;
+}
+function ltComparator(range) {
+  return (version) => compareSemver(version, range) < 0;
+}
+function anyComparator() {
+  return () => true;
+}
+function parseComparator(raw) {
+  const trimmed = raw.trim();
+  if (trimmed === "*" || trimmed === "") return { operator: "*", comparator: anyComparator(), raw: trimmed, rangeVersion: void 0 };
+  const caret = /^(\^)(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/.exec(trimmed);
+  if (caret) {
+    const version = parseSemver(caret[2]);
+    if (!version) return void 0;
+    return { operator: "^", comparator: caretComparator(version), raw: trimmed, rangeVersion: version };
+  }
+  const tilde = /^(~)(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/.exec(trimmed);
+  if (tilde) {
+    const version = parseSemver(tilde[2]);
+    if (!version) return void 0;
+    return { operator: "~", comparator: tildeComparator(version), raw: trimmed, rangeVersion: version };
+  }
+  const op = /^(>=|<=|>|<|=)(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/.exec(trimmed);
+  if (op) {
+    const version = parseSemver(op[2]);
+    if (!version) return void 0;
+    const operator = op[1];
+    let comparator;
+    switch (operator) {
+      case ">=":
+        comparator = gteComparator(version);
+        break;
+      case "<=":
+        comparator = lteComparator(version);
+        break;
+      case ">":
+        comparator = gtComparator(version);
+        break;
+      case "<":
+        comparator = ltComparator(version);
+        break;
+      default:
+        comparator = exactComparator(version);
+        break;
+    }
+    return { operator, comparator, raw: trimmed, rangeVersion: version };
+  }
+  const bare = /^(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/.exec(trimmed);
+  if (bare) {
+    const version = parseSemver(bare[1]);
+    if (!version) return void 0;
+    return { operator: "=", comparator: exactComparator(version), raw: trimmed, rangeVersion: version };
+  }
+  return void 0;
+}
+function comparatorRangeVersion(comparator) {
+  return comparator.rangeVersion;
+}
+function parseSemverRange(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return void 0;
+  const parts = trimmed.split(/\s+/);
+  const comparators = [];
+  for (const part of parts) {
+    const parsed = parseComparator(part);
+    if (!parsed) return void 0;
+    comparators.push(parsed);
+  }
+  if (comparators.length === 0) return void 0;
+  return { comparators, raw: trimmed };
+}
+function satisfiesRange(version, range) {
+  const parsed = parseSemver(version);
+  if (!parsed) return false;
+  if (!range.comparators.every((comparator) => comparator.comparator(parsed))) return false;
+  if (parsed.prerelease.length > 0) {
+    return range.comparators.some((comparator) => {
+      const rangeVersion = comparatorRangeVersion(comparator);
+      return rangeVersion !== void 0 && rangeVersion.prerelease.length > 0 && rangeVersion.major === parsed.major && rangeVersion.minor === parsed.minor && rangeVersion.patch === parsed.patch;
+    });
+  }
+  return true;
+}
+function resolveVersionRange(range, available) {
+  const parsed = available.map((version) => ({ version, parsed: parseSemver(version) })).filter((entry) => entry.parsed !== void 0).filter((entry) => {
+    if (!range.comparators.every((comparator) => comparator.comparator(entry.parsed))) return false;
+    if (entry.parsed.prerelease.length > 0) {
+      return range.comparators.some((comparator) => {
+        const rangeVersion = comparatorRangeVersion(comparator);
+        return rangeVersion !== void 0 && rangeVersion.prerelease.length > 0 && rangeVersion.major === entry.parsed.major && rangeVersion.minor === entry.parsed.minor && rangeVersion.patch === entry.parsed.patch;
+      });
+    }
+    return true;
+  }).sort((a, b) => compareSemver(b.parsed, a.parsed));
+  return parsed[0]?.version;
+}
+function sortJson(value) {
+  if (Array.isArray(value)) return value.map(sortJson);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, child]) => [key, sortJson(child)])
+    );
+  }
+  return value;
+}
+function stableStringify(value) {
+  return JSON.stringify(sortJson(value));
+}
+function assemblyDigest(value) {
+  return (0, import_node_crypto.createHash)("sha256").update(stableStringify(value)).digest("hex");
+}
+function computeUsageContractDocumentDigest(document) {
+  (0, import_gen_capability.assertUsageContractDocument)(document);
+  return assemblyDigest(document);
+}
+function lockfileDigestBody(lockfile) {
+  return {
+    formatVersion: lockfile.formatVersion,
+    application: lockfile.application,
+    capabilities: lockfile.capabilities,
+    componentPacks: lockfile.componentPacks,
+    bindings: lockfile.bindings
+  };
+}
+function fail(path, message) {
+  throw new Error(`Assembly manifest ${path} ${message}.`);
+}
+function requireString(value, path) {
+  if (typeof value !== "string" || !value.trim()) fail(path, "must be a non-empty string");
+  return value;
+}
+function requireArray(value, path) {
+  if (!Array.isArray(value)) fail(path, "must be an array");
+  return value;
+}
+function assertAssemblyManifest(value, path = "assembly") {
+  if (!value || typeof value !== "object" || Array.isArray(value)) fail(path, "must be an object");
+  const manifest = value;
+  if (manifest.formatVersion !== ASSEMBLY_MANIFEST_FORMAT_VERSION) {
+    fail(`${path}.formatVersion`, `must be ${ASSEMBLY_MANIFEST_FORMAT_VERSION}, received ${JSON.stringify(manifest.formatVersion)}`);
+  }
+  if (!/^[a-z][a-z0-9-]*$/.test(requireString(manifest.application, `${path}.application`))) {
+    fail(`${path}.application`, "must be lowercase letters, numbers and hyphens");
+  }
+  requireArray(manifest.capabilities, `${path}.capabilities`).forEach((entry, index) => {
+    const capability = entry;
+    requireString(capability?.namespace, `${path}.capabilities[${index}].namespace`);
+    requireString(capability?.range, `${path}.capabilities[${index}].range`);
+  });
+  requireArray(manifest.componentPacks, `${path}.componentPacks`).forEach((entry, index) => {
+    const pack = entry;
+    requireString(pack?.pack, `${path}.componentPacks[${index}].pack`);
+    requireString(pack?.namespace, `${path}.componentPacks[${index}].namespace`);
+    requireString(pack?.range, `${path}.componentPacks[${index}].range`);
+  });
+  requireArray(manifest.bindings, `${path}.bindings`).forEach((entry, index) => {
+    const binding = entry;
+    requireString(binding?.capability, `${path}.bindings[${index}].capability`);
+    (0, import_adoption_bindings.assertAdoptionBinding)(binding?.binding, `${path}.bindings[${index}].binding`);
+  });
+  requireArray(manifest.contracts, `${path}.contracts`).forEach((entry, index) => {
+    const contract = entry;
+    requireString(contract?.namespace, `${path}.contracts[${index}].namespace`);
+    try {
+      (0, import_gen_capability.assertUsageContractDocument)(contract?.document);
+    } catch (error) {
+      fail(`${path}.contracts[${index}].document`, error instanceof Error ? error.message : String(error));
+    }
+  });
+}
+function assertComponentPackManifest(value, path = "pack") {
+  if (!value || typeof value !== "object" || Array.isArray(value)) fail(path, "must be an object");
+  const pack = value;
+  requireString(pack.pack, `${path}.pack`);
+  requireString(pack.namespace, `${path}.namespace`);
+  requireString(pack.version, `${path}.version`);
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(pack.version)) {
+    fail(`${path}.version`, "must be a semver version");
+  }
+  if (!pack.components || typeof pack.components !== "object" || Array.isArray(pack.components)) {
+    fail(`${path}.components`, "must be an object");
+  }
+  if (!/^[0-9a-f]{64}$/.test(requireString(pack.artifactDigest, `${path}.artifactDigest`))) {
+    fail(`${path}.artifactDigest`, "must be a lowercase SHA-256 digest");
+  }
+}
+function assertAssemblyLockfile(value, path = "lockfile") {
+  if (!value || typeof value !== "object" || Array.isArray(value)) fail(path, "must be an object");
+  const lockfile = value;
+  if (lockfile.formatVersion !== ASSEMBLY_LOCKFILE_FORMAT_VERSION) {
+    fail(`${path}.formatVersion`, `must be ${ASSEMBLY_LOCKFILE_FORMAT_VERSION}, received ${JSON.stringify(lockfile.formatVersion)}`);
+  }
+  if (!/^[a-z][a-z0-9-]*$/.test(requireString(lockfile.application, `${path}.application`))) {
+    fail(`${path}.application`, "must be lowercase letters, numbers and hyphens");
+  }
+  if (!/^[0-9a-f]{64}$/.test(requireString(lockfile.assemblyDigest, `${path}.assemblyDigest`))) {
+    fail(`${path}.assemblyDigest`, "must be a lowercase SHA-256 digest");
+  }
+  const capabilities = requireArray(lockfile.capabilities, `${path}.capabilities`);
+  const componentPacks = requireArray(lockfile.componentPacks, `${path}.componentPacks`);
+  const bindings = requireArray(lockfile.bindings, `${path}.bindings`);
+  const seenCapabilities = /* @__PURE__ */ new Set();
+  for (const [index, entry] of capabilities.entries()) {
+    const capability = entry;
+    const namespace = String(capability?.namespace);
+    if (seenCapabilities.has(namespace)) {
+      fail(`${path}.capabilities[${index}]`, `declares capability "${namespace}" a second time`);
+    }
+    seenCapabilities.add(namespace);
+    requireString(capability?.namespace, `${path}.capabilities[${index}].namespace`);
+    requireString(capability?.version, `${path}.capabilities[${index}].version`);
+    requireString(capability?.range, `${path}.capabilities[${index}].range`);
+    if (!/^[0-9a-f]{64}$/.test(requireString(capability?.manifestDigest, `${path}.capabilities[${index}].manifestDigest`))) {
+      fail(`${path}.capabilities[${index}].manifestDigest`, "must be a lowercase SHA-256 digest");
+    }
+    if (capability?.usageContractDigest !== void 0 && !/^[0-9a-f]{64}$/.test(requireString(capability.usageContractDigest, `${path}.capabilities[${index}].usageContractDigest`))) {
+      fail(`${path}.capabilities[${index}].usageContractDigest`, "must be a lowercase SHA-256 digest");
+    }
+  }
+  const seenPackIdentities = /* @__PURE__ */ new Set();
+  for (const [index, entry] of componentPacks.entries()) {
+    const pack = entry;
+    requireString(pack?.pack, `${path}.componentPacks[${index}].pack`);
+    const identity = `${String(pack?.namespace)}/${String(pack?.pack)}`;
+    if (seenPackIdentities.has(identity)) {
+      fail(`${path}.componentPacks[${index}]`, `declares component pack "${identity}" a second time; first-match resolution would make the choice arbitrary`);
+    }
+    seenPackIdentities.add(identity);
+    requireString(pack?.namespace, `${path}.componentPacks[${index}].namespace`);
+    requireString(pack?.version, `${path}.componentPacks[${index}].version`);
+    requireString(pack?.range, `${path}.componentPacks[${index}].range`);
+    if (!/^[0-9a-f]{64}$/.test(requireString(pack?.artifactDigest, `${path}.componentPacks[${index}].artifactDigest`))) {
+      fail(`${path}.componentPacks[${index}].artifactDigest`, "must be a lowercase SHA-256 digest");
+    }
+    if (pack?.remote !== void 0) {
+      const remotePath = `${path}.componentPacks[${index}].remote`;
+      const remote = pack.remote;
+      if (remote === null || typeof remote !== "object" || Array.isArray(remote)) fail(remotePath, "must be an object");
+      requireString(remote.entry, `${remotePath}.entry`);
+      if (!/^sha(256|384|512)-[A-Za-z0-9+/]+={0,2}$/.test(requireString(remote.integrity, `${remotePath}.integrity`))) {
+        fail(`${remotePath}.integrity`, 'must be a subresource-integrity value, e.g. "sha384-\u2026"');
+      }
+      const exposes = remote.exposes;
+      if (exposes === null || typeof exposes !== "object" || Array.isArray(exposes)) {
+        fail(`${remotePath}.exposes`, "must be an object");
+      }
+      for (const [component, modulePath] of Object.entries(exposes)) {
+        requireString(modulePath, `${remotePath}.exposes.${component}`);
+      }
+    }
+  }
+  for (const [index, entry] of bindings.entries()) {
+    const binding = entry;
+    requireString(binding?.capability, `${path}.bindings[${index}].capability`);
+    if (!/^[0-9a-f]{64}$/.test(requireString(binding?.bindingDigest, `${path}.bindings[${index}].bindingDigest`))) {
+      fail(`${path}.bindings[${index}].bindingDigest`, "must be a lowercase SHA-256 digest");
+    }
+    if (binding?.valid !== true) fail(`${path}.bindings[${index}].valid`, "must be true");
+    requireArray(binding?.findings, `${path}.bindings[${index}].findings`);
+  }
+  const expected = assemblyDigest(lockfileDigestBody({
+    formatVersion: ASSEMBLY_LOCKFILE_FORMAT_VERSION,
+    application: lockfile.application,
+    capabilities,
+    componentPacks,
+    bindings
+  }));
+  if (lockfile.assemblyDigest !== expected) {
+    fail(`${path}.assemblyDigest`, `does not match resolved lockfile content; expected "${expected}"`);
+  }
+}
+function assertAssemblyRuntimeCompatible(lockfile, loadedCapabilities) {
+  assertAssemblyLockfile(lockfile);
+  const loadedByNamespace = /* @__PURE__ */ new Map();
+  for (const loaded of loadedCapabilities) {
+    if (loadedByNamespace.has(loaded.namespace)) {
+      throw new Error(`Loaded capability "${loaded.namespace}" is duplicated.`);
+    }
+    loadedByNamespace.set(loaded.namespace, loaded);
+  }
+  for (const approved of lockfile.capabilities) {
+    const loaded = loadedByNamespace.get(approved.namespace);
+    if (!loaded || loaded.version !== approved.version || loaded.manifestDigest !== approved.manifestDigest) {
+      throw new Error(
+        `Loaded capability "${approved.namespace}" does not match approved capability "${approved.namespace}@${approved.version}" with manifest digest "${approved.manifestDigest}".`
+      );
+    }
+  }
+  for (const loaded of loadedCapabilities) {
+    if (!lockfile.capabilities.some((approved) => approved.namespace === loaded.namespace)) {
+      throw new Error(`Loaded capability "${loaded.namespace}" is not approved by assembly "${lockfile.assemblyDigest}".`);
+    }
+  }
+}
+function resolveAssembly(input) {
+  assertAssemblyManifest(input.manifest);
+  const findings = [];
+  const add = (code, path, message) => {
+    findings.push({ code, path, message });
+  };
+  const capabilityNamespaces = /* @__PURE__ */ new Set();
+  for (const capability of input.manifest.capabilities) {
+    if (capabilityNamespaces.has(capability.namespace)) {
+      add(
+        "duplicate_capability",
+        `assembly.capabilities.${capability.namespace}`,
+        `capability "${capability.namespace}" is declared more than once`
+      );
+    }
+    capabilityNamespaces.add(capability.namespace);
+  }
+  const packKeys = /* @__PURE__ */ new Set();
+  for (const pack of input.manifest.componentPacks) {
+    const key = `${pack.namespace}/${pack.pack}`;
+    if (packKeys.has(key)) {
+      add(
+        "duplicate_component_pack",
+        `assembly.componentPacks.${key}`,
+        `component pack "${key}" is declared more than once`
+      );
+    }
+    packKeys.add(key);
+  }
+  const contractNamespaces = /* @__PURE__ */ new Set();
+  for (const contract of input.manifest.contracts) {
+    if (contractNamespaces.has(contract.namespace)) {
+      add(
+        "duplicate_contract",
+        `assembly.contracts.${contract.namespace}`,
+        `contract for "${contract.namespace}" is declared more than once`
+      );
+    }
+    contractNamespaces.add(contract.namespace);
+  }
+  const resolvedCapabilities = [];
+  const capabilitiesByNamespace = /* @__PURE__ */ new Map();
+  for (const available of input.capabilities) {
+    const list = capabilitiesByNamespace.get(available.namespace) ?? [];
+    list.push(available);
+    capabilitiesByNamespace.set(available.namespace, list);
+  }
+  for (const ref of input.manifest.capabilities) {
+    const range = parseSemverRange(ref.range);
+    if (!range) {
+      add(
+        "invalid_range",
+        `assembly.capabilities.${ref.namespace}.range`,
+        `range "${ref.range}" is not a valid semver range`
+      );
+      continue;
+    }
+    const available = capabilitiesByNamespace.get(ref.namespace) ?? [];
+    const versions = available.map((entry) => entry.version);
+    const resolved = resolveVersionRange(range, versions);
+    if (!resolved) {
+      add(
+        "unresolved_capability",
+        `assembly.capabilities.${ref.namespace}`,
+        `no available version of "${ref.namespace}" satisfies range "${ref.range}"`
+      );
+      continue;
+    }
+    const matched = available.find((entry) => entry.version === resolved);
+    resolvedCapabilities.push({
+      namespace: ref.namespace,
+      version: resolved,
+      range: ref.range,
+      manifestDigest: matched.manifestDigest
+    });
+  }
+  const resolvedPacks = [];
+  const packsByKey = /* @__PURE__ */ new Map();
+  for (const available of input.componentPacks) {
+    const key = `${available.namespace}/${available.pack}`;
+    const list = packsByKey.get(key) ?? [];
+    list.push(available);
+    packsByKey.set(key, list);
+  }
+  for (const ref of input.manifest.componentPacks) {
+    const range = parseSemverRange(ref.range);
+    if (!range) {
+      add(
+        "invalid_range",
+        `assembly.componentPacks.${ref.namespace}/${ref.pack}.range`,
+        `range "${ref.range}" is not a valid semver range`
+      );
+      continue;
+    }
+    const key = `${ref.namespace}/${ref.pack}`;
+    const available = packsByKey.get(key) ?? [];
+    const versions = available.map((entry) => entry.version);
+    const resolved = resolveVersionRange(range, versions);
+    if (!resolved) {
+      add(
+        "unresolved_component_pack",
+        `assembly.componentPacks.${key}`,
+        `no available version of pack "${key}" satisfies range "${ref.range}"`
+      );
+      continue;
+    }
+    const matched = available.find((entry) => entry.version === resolved);
+    resolvedPacks.push({
+      pack: ref.pack,
+      namespace: ref.namespace,
+      version: resolved,
+      range: ref.range,
+      artifactDigest: matched.artifactDigest,
+      ...matched.remote ? { remote: matched.remote } : {}
+    });
+  }
+  const packManifests = input.packManifests ?? [];
+  for (const pack of packManifests) {
+    try {
+      assertComponentPackManifest(pack);
+    } catch (error) {
+      add(
+        "invalid_component_pack",
+        `packManifests.${pack.namespace}/${pack.pack}`,
+        error instanceof Error ? error.message : String(error)
+      );
+    }
+  }
+  const resolvedPackManifests = [];
+  for (const resolved of resolvedPacks) {
+    const key = `${resolved.namespace}/${resolved.pack}`;
+    const manifest = packManifests.find(
+      (candidate) => candidate.namespace === resolved.namespace && candidate.pack === resolved.pack && candidate.version === resolved.version
+    );
+    if (!manifest) {
+      add(
+        "missing_component_pack_manifest",
+        `assembly.componentPacks.${key}`,
+        `resolved pack "${key}@${resolved.version}" has no matching component-pack manifest`
+      );
+      continue;
+    }
+    if (manifest.artifactDigest !== resolved.artifactDigest) {
+      add(
+        "component_pack_artifact_digest_mismatch",
+        `assembly.componentPacks.${key}.artifactDigest`,
+        `component-pack manifest digest "${manifest.artifactDigest}" does not match resolved artifact digest "${resolved.artifactDigest}"`
+      );
+      continue;
+    }
+    resolvedPackManifests.push(manifest);
+  }
+  const contractsByNamespace = /* @__PURE__ */ new Map();
+  for (const entry of input.manifest.contracts) {
+    try {
+      (0, import_gen_capability.assertUsageContractDocument)(entry.document);
+    } catch (error) {
+      add(
+        "invalid_contract",
+        `assembly.contracts.${entry.namespace}`,
+        error instanceof Error ? error.message : String(error)
+      );
+      continue;
+    }
+    if (entry.document.capability.namespace !== entry.namespace) {
+      add(
+        "contract_namespace_mismatch",
+        `assembly.contracts.${entry.namespace}`,
+        `contract namespace "${entry.document.capability.namespace}" does not match assembly namespace "${entry.namespace}"`
+      );
+    }
+    const resolved = resolvedCapabilities.find((capability) => capability.namespace === entry.namespace);
+    if (resolved && entry.document.manifestDigest !== resolved.manifestDigest) {
+      add(
+        "contract_manifest_digest_mismatch",
+        `assembly.contracts.${entry.namespace}.manifestDigest`,
+        `contract manifest digest "${entry.document.manifestDigest}" does not match resolved capability digest "${resolved.manifestDigest}"`
+      );
+    } else if (resolved) {
+      resolved.usageContractDigest = computeUsageContractDocumentDigest(entry.document);
+    }
+    contractsByNamespace.set(entry.namespace, entry.document.capability);
+  }
+  const resolvedBindings = [];
+  for (const entry of input.manifest.bindings) {
+    const contract = contractsByNamespace.get(entry.capability);
+    if (!contract) {
+      add(
+        "unknown_contract_for_binding",
+        `assembly.bindings.${entry.capability}`,
+        `binding targets capability "${entry.capability}" but no contract for it is declared`
+      );
+      resolvedBindings.push({
+        capability: entry.capability,
+        bindingDigest: assemblyDigest(entry.binding),
+        valid: false,
+        findings: []
+      });
+      continue;
+    }
+    const result = (0, import_adoption_bindings.validateBinding)({
+      contract,
+      binding: entry.binding,
+      packs: resolvedPackManifests,
+      coreComponents: input.coreComponents ?? [],
+      availableContracts: input.availableContracts ?? []
+    });
+    resolvedBindings.push({
+      capability: entry.capability,
+      bindingDigest: assemblyDigest(entry.binding),
+      valid: result.valid,
+      findings: result.findings
+    });
+    if (!result.valid) {
+      for (const finding of result.findings) {
+        add(
+          "binding_validation_failed",
+          `assembly.bindings.${entry.capability}.${finding.path}`,
+          finding.message
+        );
+      }
+    }
+  }
+  const capabilities = [...resolvedCapabilities].sort(
+    (a, b) => a.namespace < b.namespace ? -1 : a.namespace > b.namespace ? 1 : 0
+  );
+  const componentPacks = [...resolvedPacks].sort((a, b) => {
+    const key = (e) => `${e.namespace}/${e.pack}`;
+    return key(a) < key(b) ? -1 : key(a) > key(b) ? 1 : 0;
+  });
+  const bindings = [...resolvedBindings].sort(
+    (a, b) => a.capability < b.capability ? -1 : a.capability > b.capability ? 1 : 0
+  );
+  const lockfileBody = {
+    formatVersion: ASSEMBLY_LOCKFILE_FORMAT_VERSION,
+    application: input.manifest.application,
+    capabilities,
+    componentPacks,
+    bindings
+  };
+  const lockfile = {
+    formatVersion: ASSEMBLY_LOCKFILE_FORMAT_VERSION,
+    application: input.manifest.application,
+    assemblyDigest: assemblyDigest(lockfileDigestBody(lockfileBody)),
+    capabilities,
+    componentPacks,
+    bindings
+  };
+  return {
+    lockfile: findings.length === 0 ? lockfile : void 0,
+    findings
+  };
+}
+function assertAssemblyResolved(input) {
+  const result = resolveAssembly(input);
+  if (result.findings.length === 0) return result.lockfile;
+  throw new Error([
+    `Assembly "${input.manifest.application}" could not be resolved:`,
+    ...result.findings.map((finding) => `  - [${finding.code}] ${finding.path}: ${finding.message}`)
+  ].join("\n"));
+}
+function validateAssemblyBindings(input) {
+  assertAssemblyManifest(input.manifest);
+  const findings = [];
+  const add = (code, path, message) => {
+    findings.push({ code, path, message });
+  };
+  const contractsByNamespace = /* @__PURE__ */ new Map();
+  for (const entry of input.manifest.contracts) {
+    try {
+      (0, import_gen_capability.assertUsageContractDocument)(entry.document);
+    } catch (error) {
+      add(
+        "invalid_contract",
+        `assembly.contracts.${entry.namespace}`,
+        error instanceof Error ? error.message : String(error)
+      );
+      continue;
+    }
+    contractsByNamespace.set(entry.namespace, entry.document.capability);
+  }
+  const packManifests = input.packManifests ?? [];
+  for (const entry of input.manifest.bindings) {
+    const contract = contractsByNamespace.get(entry.capability);
+    if (!contract) {
+      add(
+        "unknown_contract_for_binding",
+        `assembly.bindings.${entry.capability}`,
+        `binding targets capability "${entry.capability}" but no contract for it is declared`
+      );
+      continue;
+    }
+    try {
+      (0, import_adoption_bindings.assertBindingValid)({
+        contract,
+        binding: entry.binding,
+        packs: packManifests,
+        coreComponents: input.coreComponents ?? [],
+        availableContracts: input.availableContracts ?? []
+      });
+    } catch (error) {
+      add(
+        "binding_validation_failed",
+        `assembly.bindings.${entry.capability}`,
+        error instanceof Error ? error.message : String(error)
+      );
+    }
+  }
+  return {
+    lockfile: void 0,
+    findings
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ASSEMBLY_LOCKFILE_FORMAT_VERSION,
+  ASSEMBLY_MANIFEST_FORMAT_VERSION,
+  assertAssemblyLockfile,
+  assertAssemblyManifest,
+  assertAssemblyResolved,
+  assertAssemblyRuntimeCompatible,
+  assertComponentPackManifest,
+  computeUsageContractDocumentDigest,
+  parseSemverRange,
+  resolveAssembly,
+  resolveVersionRange,
+  satisfiesRange,
+  validateAssemblyBindings
+});
+//# sourceMappingURL=index.cjs.map