@xemahq/contracts 0.1.0

package/dist/distribution/lib/kernel-contract-authority.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KernelContractAuthoritySchema = exports.KernelContractContentHashAlgorithm = exports.XEMA_KERNEL_CONTRACT_AUTHORITY_DIGEST_VERSION = exports.XEMA_KERNEL_CONTRACT_AUTHORITY_DIGEST_DOMAIN = exports.XEMA_KERNEL_CONTRACT_AUTHORITY_GENERATOR = exports.XEMA_KERNEL_CONTRACT_SOURCE_MODE = exports.XEMA_KERNEL_CONTRACT_SOURCE_PATHS = exports.XEMA_KERNEL_CONTRACT_REPOSITORY_URL = void 0;
+exports.encodeKernelContractAuthorityDigestPreimage = encodeKernelContractAuthorityDigestPreimage;
+exports.computeKernelContractAuthorityContentDigest = computeKernelContractAuthorityContentDigest;
+const zod_1 = require("zod");
+const content_address_1 = require("../../content-address");
+exports.XEMA_KERNEL_CONTRACT_REPOSITORY_URL = 'https://github.com/xema-dev/xema-kernel-contracts.git';
+exports.XEMA_KERNEL_CONTRACT_SOURCE_PATHS = Object.freeze([
+    'packages/kernel/kernel-contracts/src/distribution/index.ts',
+    'packages/kernel/kernel-contracts/src/distribution/lib/image-lock.ts',
+    'packages/kernel/kernel-contracts/src/distribution/lib/image-producer-evidence.ts',
+    'packages/kernel/kernel-contracts/src/distribution/lib/kernel-contract-authority.ts',
+    'packages/kernel/kernel-contracts/src/distribution/lib/runtime-image-source-index.ts',
+]);
+exports.XEMA_KERNEL_CONTRACT_SOURCE_MODE = '100644';
+exports.XEMA_KERNEL_CONTRACT_AUTHORITY_GENERATOR = 'xema-distributions/build-runtime-image-source-index.mjs@v1';
+exports.XEMA_KERNEL_CONTRACT_AUTHORITY_DIGEST_DOMAIN = 'xema.kernel-contract-authority.digest';
+exports.XEMA_KERNEL_CONTRACT_AUTHORITY_DIGEST_VERSION = 1;
+var KernelContractContentHashAlgorithm;
+(function (KernelContractContentHashAlgorithm) {
+    KernelContractContentHashAlgorithm["LengthFramedGitPathModeBlobV1"] = "xema-kernel-contract-authority-length-framed-git-path-mode-blob-sha256-v1";
+})(KernelContractContentHashAlgorithm || (exports.KernelContractContentHashAlgorithm = KernelContractContentHashAlgorithm = {}));
+const Sha256HexSchema = zod_1.z.string().regex(/^[a-f0-9]{64}$/);
+const GitCommitSchema = zod_1.z.string().regex(/^[a-f0-9]{40}$/);
+exports.KernelContractAuthoritySchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(1),
+    generatorIdentity: zod_1.z.literal(exports.XEMA_KERNEL_CONTRACT_AUTHORITY_GENERATOR),
+    repositoryUrl: zod_1.z.literal(exports.XEMA_KERNEL_CONTRACT_REPOSITORY_URL),
+    sourceCommit: GitCommitSchema,
+    sourcePaths: zod_1.z
+        .tuple([
+        zod_1.z.literal(exports.XEMA_KERNEL_CONTRACT_SOURCE_PATHS[0]),
+        zod_1.z.literal(exports.XEMA_KERNEL_CONTRACT_SOURCE_PATHS[1]),
+        zod_1.z.literal(exports.XEMA_KERNEL_CONTRACT_SOURCE_PATHS[2]),
+        zod_1.z.literal(exports.XEMA_KERNEL_CONTRACT_SOURCE_PATHS[3]),
+        zod_1.z.literal(exports.XEMA_KERNEL_CONTRACT_SOURCE_PATHS[4]),
+    ])
+        .readonly(),
+    contentHashAlgorithm: zod_1.z.literal(KernelContractContentHashAlgorithm.LengthFramedGitPathModeBlobV1),
+    contentDigest: Sha256HexSchema,
+})
+    .strict();
+function encodeKernelContractAuthorityDigestPreimage(sources) {
+    validateSources(sources);
+    const domain = encodeUtf8(exports.XEMA_KERNEL_CONTRACT_AUTHORITY_DIGEST_DOMAIN);
+    const chunks = [
+        encodeUint32(domain.byteLength),
+        domain,
+        encodeUint32(exports.XEMA_KERNEL_CONTRACT_AUTHORITY_DIGEST_VERSION),
+        encodeUint32(sources.length),
+    ];
+    for (const source of sources) {
+        const path = encodeUtf8(source.path);
+        const mode = encodeUtf8(source.mode);
+        chunks.push(encodeUint32(path.byteLength), path, encodeUint32(mode.byteLength), mode, encodeUint64(source.blob.byteLength), source.blob);
+    }
+    return concatenate(chunks);
+}
+async function computeKernelContractAuthorityContentDigest(sources) {
+    return (0, content_address_1.sha256Hex)(encodeKernelContractAuthorityDigestPreimage(sources));
+}
+function validateSources(sources) {
+    if (!Array.isArray(sources)) {
+        throw new Error('Kernel contract authority sources must be an array.');
+    }
+    if (sources.length !== exports.XEMA_KERNEL_CONTRACT_SOURCE_PATHS.length) {
+        throw new Error(`Kernel contract authority requires exactly ${exports.XEMA_KERNEL_CONTRACT_SOURCE_PATHS.length} sources.`);
+    }
+    for (const [index, expectedPath,] of exports.XEMA_KERNEL_CONTRACT_SOURCE_PATHS.entries()) {
+        const source = sources[index];
+        if (source === undefined || source.path !== expectedPath) {
+            throw new Error(`Kernel contract authority source[${index}] must be "${expectedPath}".`);
+        }
+        if (source.mode !== exports.XEMA_KERNEL_CONTRACT_SOURCE_MODE) {
+            throw new Error(`Kernel contract authority source[${index}] must have Git mode ${exports.XEMA_KERNEL_CONTRACT_SOURCE_MODE}.`);
+        }
+        if (!(source.blob instanceof Uint8Array)) {
+            throw new Error(`Kernel contract authority source[${index}] blob must be a Uint8Array.`);
+        }
+    }
+}
+function encodeUtf8(value) {
+    return new TextEncoder().encode(value);
+}
+function encodeUint32(value) {
+    const encoded = new Uint8Array(4);
+    new DataView(encoded.buffer).setUint32(0, value, false);
+    return encoded;
+}
+function encodeUint64(value) {
+    const encoded = new Uint8Array(8);
+    new DataView(encoded.buffer).setBigUint64(0, BigInt(value), false);
+    return encoded;
+}
+function concatenate(chunks) {
+    const byteLength = chunks.reduce((total, chunk) => total + chunk.byteLength, 0);
+    const result = new Uint8Array(byteLength);
+    let offset = 0;
+    for (const chunk of chunks) {
+        result.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return result;
+}
+//# sourceMappingURL=kernel-contract-authority.js.map

package/dist/distribution/lib/kernel-contract-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-contract-authority.js","sourceRoot":"","sources":["../../../src/distribution/lib/kernel-contract-authority.ts"],"names":[],"mappings":";;;AAuEA,kGAyBC;AAKD,kGAIC;AAzGD,6BAAwB;AACxB,2DAAkD;AAErC,QAAA,mCAAmC,GAC9C,uDAAgE,CAAC;AAEtD,QAAA,iCAAiC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7D,4DAA4D;IAC5D,qEAAqE;IACrE,kFAAkF;IAClF,oFAAoF;IACpF,qFAAqF;CAC7E,CAAC,CAAC;AAEC,QAAA,gCAAgC,GAAG,QAAiB,CAAC;AAErD,QAAA,wCAAwC,GACnD,4DAAqE,CAAC;AAE3D,QAAA,4CAA4C,GACvD,uCAAgD,CAAC;AAEtC,QAAA,6CAA6C,GAAG,CAAU,CAAC;AAExE,IAAY,kCAEX;AAFD,WAAY,kCAAkC;IAC5C,iJAA2G,CAAA;AAC7G,CAAC,EAFW,kCAAkC,kDAAlC,kCAAkC,QAE7C;AAQD,MAAM,eAAe,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAC3D,MAAM,eAAe,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAE9C,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,iBAAiB,EAAE,OAAC,CAAC,OAAO,CAAC,gDAAwC,CAAC;IACtE,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,2CAAmC,CAAC;IAC7D,YAAY,EAAE,eAAe;IAC7B,WAAW,EAAE,OAAC;SACX,KAAK,CAAC;QACL,OAAC,CAAC,OAAO,CAAC,yCAAiC,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAC,CAAC,OAAO,CAAC,yCAAiC,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAC,CAAC,OAAO,CAAC,yCAAiC,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAC,CAAC,OAAO,CAAC,yCAAiC,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAC,CAAC,OAAO,CAAC,yCAAiC,CAAC,CAAC,CAAC,CAAC;KAChD,CAAC;SACD,QAAQ,EAAE;IACb,oBAAoB,EAAE,OAAC,CAAC,OAAO,CAC7B,kCAAkC,CAAC,6BAA6B,CACjE;IACD,aAAa,EAAE,eAAe;CAC/B,CAAC;KACD,MAAM,EAAE,CAAC;AAcZ,SAAgB,2CAA2C,CACzD,OAAuD;IAEvD,eAAe,CAAC,OAAO,CAAC,CAAC;IAEzB,MAAM,MAAM,GAAG,UAAU,CAAC,oDAA4C,CAAC,CAAC;IACxE,MAAM,MAAM,GAAiB;QAC3B,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC;QAC/B,MAAM;QACN,YAAY,CAAC,qDAA6C,CAAC;QAC3D,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;KAC7B,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CACT,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAC7B,IAAI,EACJ,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAC7B,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EACpC,MAAM,CAAC,IAAI,CACZ,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAKM,KAAK,UAAU,2CAA2C,CAC/D,OAAuD;IAEvD,OAAO,IAAA,2BAAS,EAAC,2CAA2C,CAAC,OAAO,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,eAAe,CACtB,OAAuD;IAEvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,yCAAiC,CAAC,MAAM,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,8CAA8C,yCAAiC,CAAC,MAAM,WAAW,CAClG,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CACT,KAAK,EACL,YAAY,EACb,IAAI,yCAAiC,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,cAAc,YAAY,IAAI,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,wCAAgC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,wBAAwB,wCAAgC,GAAG,CACrG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,8BAA8B,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,MAA6B;IAChD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAC9B,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,EAC1C,CAAC,CACF,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/distribution/lib/platform-service-source-index.d.ts

@@ -0,0 +1,21 @@
+import { z } from 'zod';
+import { type PlatformServiceTier } from './distribution';
+export interface PlatformServiceSourceIdentity {
+    name: string;
+    tier: PlatformServiceTier;
+    repositoryUrl: string;
+    repo: string;
+    path: string;
+    sourceCommit: string;
+    version: string;
+    sourceManifestHash: string;
+    imageKey: string;
+}
+export declare const PlatformServiceSourceIdentitySchema: z.ZodType<PlatformServiceSourceIdentity>;
+export interface PlatformServiceSourceIndex {
+    schemaVersion: 1;
+    services: readonly PlatformServiceSourceIdentity[];
+}
+export declare const PlatformServiceSourceIndexSchema: z.ZodType<PlatformServiceSourceIndex>;
+export declare function parsePlatformServiceSourceIndex(raw: unknown): PlatformServiceSourceIndex;
+//# sourceMappingURL=platform-service-source-index.d.ts.map

package/dist/distribution/lib/platform-service-source-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-service-source-index.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/platform-service-source-index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AAgBxB,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,mBAAmB,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IAEtB,IAAI,EAAE,MAAM,CAAC;IAEb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,mCAAmC,EA0BxC,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;AAEjD,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,CAAC,CAAC;IACjB,QAAQ,EAAE,SAAS,6BAA6B,EAAE,CAAC;CACpD;AAED,eAAO,MAAM,gCAAgC,EA+BrC,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAE9C,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,0BAA0B,CAU5B"}

package/dist/distribution/lib/platform-service-source-index.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PlatformServiceSourceIndexSchema = exports.PlatformServiceSourceIdentitySchema = void 0;
+exports.parsePlatformServiceSourceIndex = parsePlatformServiceSourceIndex;
+const zod_1 = require("zod");
+const distribution_1 = require("./distribution");
+const SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/;
+const GIT_COMMIT_PATTERN = /^[a-f0-9]{40}$/;
+const EXACT_SEMVER_PATTERN = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+(?:[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
+const SOURCE_REPO_PATTERN = /^(?:repos|repos-infra|submodules)\/[^/]+$/;
+const POSIX_SOURCE_PATH_PATTERN = /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$)).+$/;
+const IMAGE_KEY_PATTERN = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/;
+exports.PlatformServiceSourceIdentitySchema = zod_1.z
+    .object({
+    name: zod_1.z.string().min(1),
+    tier: distribution_1.PlatformServiceTierSchema,
+    repositoryUrl: zod_1.z
+        .string()
+        .url()
+        .refine((value) => new URL(value).protocol === 'https:', {
+        message: 'must use HTTPS',
+    }),
+    repo: zod_1.z.string().regex(SOURCE_REPO_PATTERN),
+    path: zod_1.z.string().regex(POSIX_SOURCE_PATH_PATTERN),
+    sourceCommit: zod_1.z.string().regex(GIT_COMMIT_PATTERN),
+    version: zod_1.z.string().regex(EXACT_SEMVER_PATTERN),
+    sourceManifestHash: zod_1.z.string().regex(SHA256_HEX_PATTERN),
+    imageKey: zod_1.z.string().regex(IMAGE_KEY_PATTERN),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (!value.path.startsWith(`${value.repo}/`)) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['path'],
+            message: `must be inside repo "${value.repo}"`,
+        });
+    }
+});
+exports.PlatformServiceSourceIndexSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(1),
+    services: zod_1.z.array(exports.PlatformServiceSourceIdentitySchema).readonly(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const names = new Map();
+    const imageKeys = new Map();
+    for (const [index, service] of value.services.entries()) {
+        const existingName = names.get(service.name);
+        if (existingName !== undefined) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['services', index, 'name'],
+                message: `duplicates services[${existingName}].name "${service.name}"`,
+            });
+        }
+        else {
+            names.set(service.name, index);
+        }
+        const existingImageKey = imageKeys.get(service.imageKey);
+        if (existingImageKey !== undefined) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['services', index, 'imageKey'],
+                message: `duplicates services[${existingImageKey}].imageKey "${service.imageKey}"`,
+            });
+        }
+        else {
+            imageKeys.set(service.imageKey, index);
+        }
+    }
+});
+function parsePlatformServiceSourceIndex(raw) {
+    const result = exports.PlatformServiceSourceIndexSchema.safeParse(raw);
+    if (!result.success) {
+        throw new Error(`Invalid platform-service-index.json: ${result.error.issues
+            .map((issue) => `[${issue.path.join('.')}] ${issue.message}`)
+            .join('; ')}`);
+    }
+    return result.data;
+}
+//# sourceMappingURL=platform-service-source-index.js.map

package/dist/distribution/lib/platform-service-source-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-service-source-index.js","sourceRoot":"","sources":["../../../src/distribution/lib/platform-service-source-index.ts"],"names":[],"mappings":";;;AAoGA,0EAYC;AAhHD,6BAAwB;AACxB,iDAGwB;AAExB,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAC5C,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAC5C,MAAM,oBAAoB,GACxB,+LAA+L,CAAC;AAClM,MAAM,mBAAmB,GAAG,2CAA2C,CAAC;AACxE,MAAM,yBAAyB,GAAG,sCAAsC,CAAC;AACzE,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAsB9C,QAAA,mCAAmC,GAAG,OAAC;KACjD,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,wCAAyB;IAC/B,aAAa,EAAE,OAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE;QACvD,OAAO,EAAE,gBAAgB;KAC1B,CAAC;IACJ,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC3C,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACjD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAClD,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IAC/C,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACxD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC;CAC9C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,OAAO,EAAE,wBAAwB,KAAK,CAAC,IAAI,GAAG;SAC/C,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAA6C,CAAC;AAOpC,QAAA,gCAAgC,GAAG,OAAC;KAC9C,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,2CAAmC,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC;gBACjC,OAAO,EAAE,uBAAuB,YAAY,WAAW,OAAO,CAAC,IAAI,GAAG;aACvE,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,gBAAgB,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC;gBACrC,OAAO,EAAE,uBAAuB,gBAAgB,eAAe,OAAO,CAAC,QAAQ,GAAG;aACnF,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;AACH,CAAC,CAA0C,CAAC;AAE9C,SAAgB,+BAA+B,CAC7C,GAAY;IAEZ,MAAM,MAAM,GAAG,wCAAgC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,KAAK,CAAC,MAAM;aACxD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC5D,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/distribution/lib/runtime-image-platform.d.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+import type { RuntimeImagePlatform } from './image-lock';
+export declare enum RuntimeImagePlatformKey {
+    LinuxAmd64 = "linux/amd64",
+    LinuxArm64 = "linux/arm64"
+}
+export declare const RuntimeImagePlatformKeySchema: z.ZodEnum<typeof RuntimeImagePlatformKey>;
+export declare const RUNTIME_IMAGE_PLATFORM_BY_KEY: Readonly<Record<RuntimeImagePlatformKey, RuntimeImagePlatform>>;
+export declare const DistributionRequiredPlatformsSchema: z.ZodType<readonly RuntimeImagePlatformKey[]>;
+export declare function resolveRuntimeImagePlatforms(keys: readonly RuntimeImagePlatformKey[]): readonly RuntimeImagePlatform[];
+//# sourceMappingURL=runtime-image-platform.d.ts.map

package/dist/distribution/lib/runtime-image-platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-image-platform.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/runtime-image-platform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAuBzD,oBAAY,uBAAuB;IACjC,UAAU,gBAAgB;IAC1B,UAAU,gBAAgB;CAC3B;AAED,eAAO,MAAM,6BAA6B,2CAEzC,CAAC;AAOF,eAAO,MAAM,6BAA6B,EAAE,QAAQ,CAClD,MAAM,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAUrD,CAAC;AAkBH,eAAO,MAAM,mCAAmC,EA0BxC,CAAC,CAAC,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAAC;AAWtD,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,SAAS,uBAAuB,EAAE,GACvC,SAAS,oBAAoB,EAAE,CAajC"}

package/dist/distribution/lib/runtime-image-platform.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DistributionRequiredPlatformsSchema = exports.RUNTIME_IMAGE_PLATFORM_BY_KEY = exports.RuntimeImagePlatformKeySchema = exports.RuntimeImagePlatformKey = void 0;
+exports.resolveRuntimeImagePlatforms = resolveRuntimeImagePlatforms;
+const zod_1 = require("zod");
+var RuntimeImagePlatformKey;
+(function (RuntimeImagePlatformKey) {
+    RuntimeImagePlatformKey["LinuxAmd64"] = "linux/amd64";
+    RuntimeImagePlatformKey["LinuxArm64"] = "linux/arm64";
+})(RuntimeImagePlatformKey || (exports.RuntimeImagePlatformKey = RuntimeImagePlatformKey = {}));
+exports.RuntimeImagePlatformKeySchema = zod_1.z.nativeEnum(RuntimeImagePlatformKey);
+exports.RUNTIME_IMAGE_PLATFORM_BY_KEY = Object.freeze({
+    [RuntimeImagePlatformKey.LinuxAmd64]: Object.freeze({
+        os: 'linux',
+        architecture: 'amd64',
+    }),
+    [RuntimeImagePlatformKey.LinuxArm64]: Object.freeze({
+        os: 'linux',
+        architecture: 'arm64',
+    }),
+});
+exports.DistributionRequiredPlatformsSchema = zod_1.z
+    .array(exports.RuntimeImagePlatformKeySchema)
+    .min(1)
+    .superRefine((value, context) => {
+    const seen = new Map();
+    let previous;
+    for (const [index, key] of value.entries()) {
+        if (previous !== undefined && key < previous) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: [index],
+                message: 'must be canonically ordered by os, then architecture',
+            });
+        }
+        const incumbent = seen.get(key);
+        if (incumbent !== undefined) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: [index],
+                message: `duplicates requiredPlatforms[${incumbent}] "${key}"`,
+            });
+        }
+        else {
+            seen.set(key, index);
+        }
+        previous = key;
+    }
+});
+function resolveRuntimeImagePlatforms(keys) {
+    const result = exports.DistributionRequiredPlatformsSchema.safeParse(keys);
+    if (!result.success) {
+        throw new Error(`Invalid distribution requiredPlatforms: ${result.error.issues
+            .map((issue) => `[${issue.path.join('.')}] ${issue.message}`)
+            .join('; ')}. Declared platforms must be a non-empty, unique, ` +
+            `canonically ordered subset of ${Object.values(RuntimeImagePlatformKey).join(', ')}.`);
+    }
+    return Object.freeze(result.data.map((key) => exports.RUNTIME_IMAGE_PLATFORM_BY_KEY[key]));
+}
+//# sourceMappingURL=runtime-image-platform.js.map

package/dist/distribution/lib/runtime-image-platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-image-platform.js","sourceRoot":"","sources":["../../../src/distribution/lib/runtime-image-platform.ts"],"names":[],"mappings":";;;AAwGA,oEAeC;AAvHD,6BAAwB;AAwBxB,IAAY,uBAGX;AAHD,WAAY,uBAAuB;IACjC,qDAA0B,CAAA;IAC1B,qDAA0B,CAAA;AAC5B,CAAC,EAHW,uBAAuB,uCAAvB,uBAAuB,QAGlC;AAEY,QAAA,6BAA6B,GAAG,OAAC,CAAC,UAAU,CACvD,uBAAuB,CACxB,CAAC;AAOW,QAAA,6BAA6B,GAEtC,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,uBAAuB,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAClD,EAAE,EAAE,OAAO;QACX,YAAY,EAAE,OAAO;KACtB,CAAC;IACF,CAAC,uBAAuB,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAClD,EAAE,EAAE,OAAO;QACX,YAAY,EAAE,OAAO;KACtB,CAAC;CACH,CAAC,CAAC;AAkBU,QAAA,mCAAmC,GAAG,OAAC;KACjD,KAAK,CAAC,qCAA6B,CAAC;KACpC,GAAG,CAAC,CAAC,CAAC;KACN,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,IAAI,QAA4B,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3C,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,GAAG,QAAQ,EAAE,CAAC;YAC7C,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,KAAK,CAAC;gBACb,OAAO,EAAE,sDAAsD;aAChE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,KAAK,CAAC;gBACb,OAAO,EAAE,gCAAgC,SAAS,MAAM,GAAG,GAAG;aAC/D,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,QAAQ,GAAG,GAAG,CAAC;IACjB,CAAC;AACH,CAAC,CAAkD,CAAC;AAWtD,SAAgB,4BAA4B,CAC1C,IAAwC;IAExC,MAAM,MAAM,GAAG,2CAAmC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,2CAA2C,MAAM,CAAC,KAAK,CAAC,MAAM;aAC3D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC5D,IAAI,CAAC,IAAI,CAAC,oDAAoD;YAC/D,iCAAiC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,qCAA6B,CAAC,GAAG,CAAC,CAAC,CAC7D,CAAC;AACJ,CAAC"}

package/dist/distribution/lib/runtime-image-source-index.d.ts

@@ -0,0 +1,75 @@
+import { z } from 'zod';
+import { RuntimeImageSubjectKind } from './image-lock';
+export declare const RuntimeImageSupplementalSourceSchema: z.ZodObject<{
+    kind: z.ZodEnum<typeof RuntimeImageSubjectKind>;
+    id: z.ZodString;
+    imageRef: z.ZodString;
+    repositoryUrl: z.ZodString;
+    repo: z.ZodString;
+    path: z.ZodString;
+    sourceManifestPath: z.ZodString;
+    sourceCommit: z.ZodString;
+    sourceManifestHash: z.ZodString;
+}, z.core.$strict>;
+export declare const CrossRepoBuildInputSchema: z.ZodObject<{
+    consumerRepo: z.ZodString;
+    consumerService: z.ZodNullable<z.ZodString>;
+    sourceRepo: z.ZodString;
+    sourcePath: z.ZodString;
+    destinationPath: z.ZodString;
+}, z.core.$strict>;
+export type CrossRepoBuildInput = z.infer<typeof CrossRepoBuildInputSchema>;
+export declare const BuildStepContextDirectorySchema: z.ZodObject<{
+    repo: z.ZodString;
+    path: z.ZodString;
+    reason: z.ZodString;
+}, z.core.$strict>;
+export type BuildStepContextDirectory = z.infer<typeof BuildStepContextDirectorySchema>;
+export declare const RuntimeImageSourceIndexSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    contractAuthority: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        generatorIdentity: z.ZodLiteral<"xema-distributions/build-runtime-image-source-index.mjs@v1">;
+        repositoryUrl: z.ZodLiteral<"https://github.com/xema-dev/xema-kernel-contracts.git">;
+        sourceCommit: z.ZodString;
+        sourcePaths: z.ZodReadonly<z.ZodTuple<[z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/index.ts">, z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/lib/image-lock.ts">, z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/lib/image-producer-evidence.ts">, z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/lib/kernel-contract-authority.ts">, z.ZodLiteral<"packages/kernel/kernel-contracts/src/distribution/lib/runtime-image-source-index.ts">], null>>;
+        contentHashAlgorithm: z.ZodLiteral<import("./kernel-contract-authority").KernelContractContentHashAlgorithm>;
+        contentDigest: z.ZodString;
+    }, z.core.$strict>;
+    supplementalSubjects: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<typeof RuntimeImageSubjectKind>;
+        id: z.ZodString;
+        imageRef: z.ZodString;
+        repositoryUrl: z.ZodString;
+        repo: z.ZodString;
+        path: z.ZodString;
+        sourceManifestPath: z.ZodString;
+        sourceCommit: z.ZodString;
+        sourceManifestHash: z.ZodString;
+    }, z.core.$strict>>>;
+    crossRepoBuildInputs: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        consumerRepo: z.ZodString;
+        consumerService: z.ZodNullable<z.ZodString>;
+        sourceRepo: z.ZodString;
+        sourcePath: z.ZodString;
+        destinationPath: z.ZodString;
+    }, z.core.$strict>>>;
+    buildStepContextDirectories: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        repo: z.ZodString;
+        path: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strict>>>;
+    repositoryPins: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        repo: z.ZodString;
+        repositoryUrl: z.ZodString;
+        sourceCommit: z.ZodString;
+    }, z.core.$strict>>>;
+    platformServiceBindings: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        platformService: z.ZodString;
+        subjectKind: z.ZodEnum<typeof RuntimeImageSubjectKind>;
+        subjectId: z.ZodString;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type RuntimeImageSourceIndex = z.infer<typeof RuntimeImageSourceIndexSchema>;
+export declare function parseRuntimeImageSourceIndex(raw: unknown): RuntimeImageSourceIndex;
+//# sourceMappingURL=runtime-image-source-index.d.ts.map

package/dist/distribution/lib/runtime-image-source-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-image-source-index.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/runtime-image-source-index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AA0CvD,eAAO,MAAM,oCAAoC;;;;;;;;;;kBAYtC,CAAC;AAeZ,eAAO,MAAM,yBAAyB;;;;;;kBAiB3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAc5E,eAAO,MAAM,+BAA+B;;;;kBASjC,CAAC;AAEZ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAyLtC,CAAC;AAEL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AAEF,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,OAAO,GACX,uBAAuB,CAUzB"}

package/dist/distribution/lib/runtime-image-source-index.js

@@ -0,0 +1,254 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuntimeImageSourceIndexSchema = exports.BuildStepContextDirectorySchema = exports.CrossRepoBuildInputSchema = exports.RuntimeImageSupplementalSourceSchema = void 0;
+exports.parseRuntimeImageSourceIndex = parseRuntimeImageSourceIndex;
+const zod_1 = require("zod");
+const image_lock_1 = require("./image-lock");
+const kernel_contract_authority_1 = require("./kernel-contract-authority");
+const RuntimeIdentitySchema = zod_1.z
+    .string()
+    .regex(/^[a-z0-9](?:[a-z0-9._-]{0,254}[a-z0-9])?$/);
+const CanonicalRelativePathSchema = zod_1.z
+    .string()
+    .min(1)
+    .refine((value) => value === value.normalize('NFC') &&
+    !value.startsWith('/') &&
+    !value.endsWith('/') &&
+    !value
+        .split('/')
+        .some((segment) => segment === '' || segment === '.' || segment === '..'), 'must be an NFC-normalized repository-relative path without traversal');
+const GitCommitSchema = zod_1.z.string().regex(/^[a-f0-9]{40}$/);
+const CanonicalRepositoryUrlSchema = zod_1.z
+    .string()
+    .url()
+    .refine((value) => {
+    try {
+        const parsed = new URL(value);
+        return (parsed.protocol === 'https:' &&
+            parsed.username === '' &&
+            parsed.password === '' &&
+            parsed.search === '' &&
+            parsed.hash === '' &&
+            parsed.pathname !== '/' &&
+            parsed.toString() === value);
+    }
+    catch {
+        return false;
+    }
+}, 'must be a canonical public HTTPS Git repository URL');
+exports.RuntimeImageSupplementalSourceSchema = zod_1.z
+    .object({
+    kind: zod_1.z.nativeEnum(image_lock_1.RuntimeImageSubjectKind),
+    id: RuntimeIdentitySchema,
+    imageRef: zod_1.z.string().min(1),
+    repositoryUrl: CanonicalRepositoryUrlSchema,
+    repo: CanonicalRelativePathSchema,
+    path: CanonicalRelativePathSchema,
+    sourceManifestPath: CanonicalRelativePathSchema,
+    sourceCommit: GitCommitSchema,
+    sourceManifestHash: zod_1.z.string().regex(/^[a-f0-9]{64}$/),
+})
+    .strict();
+exports.CrossRepoBuildInputSchema = zod_1.z
+    .object({
+    consumerRepo: CanonicalRelativePathSchema,
+    consumerService: RuntimeIdentitySchema.nullable(),
+    sourceRepo: CanonicalRelativePathSchema,
+    sourcePath: CanonicalRelativePathSchema,
+    destinationPath: CanonicalRelativePathSchema,
+})
+    .strict();
+exports.BuildStepContextDirectorySchema = zod_1.z
+    .object({
+    repo: CanonicalRelativePathSchema,
+    path: CanonicalRelativePathSchema,
+    reason: zod_1.z.string().min(20),
+})
+    .strict();
+exports.RuntimeImageSourceIndexSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(1),
+    contractAuthority: kernel_contract_authority_1.KernelContractAuthoritySchema,
+    supplementalSubjects: zod_1.z
+        .array(exports.RuntimeImageSupplementalSourceSchema)
+        .readonly(),
+    crossRepoBuildInputs: zod_1.z.array(exports.CrossRepoBuildInputSchema).readonly(),
+    buildStepContextDirectories: zod_1.z
+        .array(exports.BuildStepContextDirectorySchema)
+        .readonly(),
+    repositoryPins: zod_1.z
+        .array(zod_1.z
+        .object({
+        repo: CanonicalRelativePathSchema,
+        repositoryUrl: CanonicalRepositoryUrlSchema,
+        sourceCommit: GitCommitSchema,
+    })
+        .strict())
+        .min(1)
+        .readonly(),
+    platformServiceBindings: zod_1.z
+        .array(zod_1.z
+        .object({
+        platformService: RuntimeIdentitySchema,
+        subjectKind: zod_1.z.nativeEnum(image_lock_1.RuntimeImageSubjectKind),
+        subjectId: RuntimeIdentitySchema,
+    })
+        .strict())
+        .readonly(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const subjects = new Map();
+    const imageRepositories = new Map();
+    const repositories = new Map();
+    for (const [index, repository] of value.repositoryPins.entries()) {
+        const incumbent = repositories.get(repository.repo);
+        if (incumbent !== undefined) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['repositoryPins', index, 'repo'],
+                message: `duplicates repositoryPins[${incumbent}].repo "${repository.repo}"`,
+            });
+        }
+        else {
+            repositories.set(repository.repo, index);
+        }
+    }
+    for (const [index, subject] of value.supplementalSubjects.entries()) {
+        const key = `${subject.kind}\0${subject.id}`;
+        const subjectIncumbent = subjects.get(key);
+        if (subjectIncumbent !== undefined) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['supplementalSubjects', index, 'id'],
+                message: `duplicates supplementalSubjects[${subjectIncumbent}] identity "${subject.kind}:${subject.id}"`,
+            });
+        }
+        else {
+            subjects.set(key, index);
+        }
+        const imageIncumbent = imageRepositories.get(subject.imageRef);
+        if (imageIncumbent !== undefined) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['supplementalSubjects', index, 'imageRef'],
+                message: `reuses supplementalSubjects[${imageIncumbent}].imageRef "${subject.imageRef}"`,
+            });
+        }
+        else {
+            imageRepositories.set(subject.imageRef, index);
+        }
+        const repositoryIndex = repositories.get(subject.repo);
+        const repository = repositoryIndex === undefined
+            ? undefined
+            : value.repositoryPins[repositoryIndex];
+        if (repository === undefined ||
+            repository.repositoryUrl !== subject.repositoryUrl ||
+            repository.sourceCommit !== subject.sourceCommit) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['supplementalSubjects', index, 'sourceCommit'],
+                message: 'must exactly match repositoryPins repositoryUrl and sourceCommit',
+            });
+        }
+    }
+    const crossRepoKeys = new Map();
+    let previousCrossRepoKey;
+    for (const [index, input] of value.crossRepoBuildInputs.entries()) {
+        const key = [
+            input.consumerRepo,
+            input.consumerService ?? '',
+            input.destinationPath,
+        ].join('\0');
+        if (previousCrossRepoKey !== undefined && key < previousCrossRepoKey) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['crossRepoBuildInputs', index],
+                message: 'must be canonically ordered by consumerRepo, consumerService, destinationPath',
+            });
+        }
+        previousCrossRepoKey = key;
+        const incumbent = crossRepoKeys.get(key);
+        if (incumbent !== undefined) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['crossRepoBuildInputs', index, 'destinationPath'],
+                message: `duplicates crossRepoBuildInputs[${incumbent}] destination "${input.destinationPath}"`,
+            });
+        }
+        else {
+            crossRepoKeys.set(key, index);
+        }
+        if (input.sourceRepo === input.consumerRepo) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['crossRepoBuildInputs', index, 'sourceRepo'],
+                message: 'must differ from consumerRepo — an in-repo copy is already covered by the repository’s own source tree',
+            });
+        }
+        for (const repo of [input.consumerRepo, input.sourceRepo]) {
+            if (!repositories.has(repo)) {
+                context.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: ['crossRepoBuildInputs', index],
+                    message: `references repository "${repo}" that has no repositoryPins entry`,
+                });
+            }
+        }
+    }
+    const buildStepDirectories = new Map();
+    let previousBuildStepKey;
+    for (const [index, directory,] of value.buildStepContextDirectories.entries()) {
+        const key = `${directory.repo}\0${directory.path}`;
+        if (previousBuildStepKey !== undefined && key < previousBuildStepKey) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['buildStepContextDirectories', index],
+                message: 'must be canonically ordered by repo, path',
+            });
+        }
+        previousBuildStepKey = key;
+        const incumbent = buildStepDirectories.get(key);
+        if (incumbent !== undefined) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['buildStepContextDirectories', index, 'path'],
+                message: `duplicates buildStepContextDirectories[${incumbent}]`,
+            });
+        }
+        else {
+            buildStepDirectories.set(key, index);
+        }
+        if (!repositories.has(directory.repo)) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['buildStepContextDirectories', index, 'repo'],
+                message: `references repository "${directory.repo}" that has no repositoryPins entry`,
+            });
+        }
+    }
+    const platformServices = new Map();
+    for (const [index, binding] of value.platformServiceBindings.entries()) {
+        const incumbent = platformServices.get(binding.platformService);
+        if (incumbent !== undefined) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['platformServiceBindings', index, 'platformService'],
+                message: `duplicates platformServiceBindings[${incumbent}].platformService "${binding.platformService}"`,
+            });
+        }
+        else {
+            platformServices.set(binding.platformService, index);
+        }
+    }
+});
+function parseRuntimeImageSourceIndex(raw) {
+    const result = exports.RuntimeImageSourceIndexSchema.safeParse(raw);
+    if (!result.success) {
+        throw new Error(`Invalid runtime-image-source-index.json: ${result.error.issues
+            .map((issue) => `[${issue.path.join('.')}] ${issue.message}`)
+            .join('; ')}`);
+    }
+    return result.data;
+}
+//# sourceMappingURL=runtime-image-source-index.js.map