@xemahq/contracts 0.1.0

package/dist/principal/lib/delegation-chain.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationChainError = exports.DelegationErrorCodeSchema = exports.DelegationErrorCode = exports.MAX_DELEGATION_DEPTH = void 0;
+exports.resolveDelegationChain = resolveDelegationChain;
+const zod_1 = require("zod");
+const subject_1 = require("../../subject");
+exports.MAX_DELEGATION_DEPTH = 3;
+var DelegationErrorCode;
+(function (DelegationErrorCode) {
+    DelegationErrorCode["ChainTooDeep"] = "DELEGATION_CHAIN_TOO_DEEP";
+    DelegationErrorCode["Cycle"] = "DELEGATION_CHAIN_CYCLE";
+    DelegationErrorCode["Discontinuous"] = "DELEGATION_CHAIN_DISCONTINUOUS";
+    DelegationErrorCode["NotAnchoredAtActor"] = "DELEGATION_CHAIN_NOT_ANCHORED_AT_ACTOR";
+    DelegationErrorCode["NotAnchoredAtExecutor"] = "DELEGATION_CHAIN_NOT_ANCHORED_AT_EXECUTOR";
+    DelegationErrorCode["EmptyChainMismatch"] = "DELEGATION_CHAIN_EMPTY_MISMATCH";
+})(DelegationErrorCode || (exports.DelegationErrorCode = DelegationErrorCode = {}));
+exports.DelegationErrorCodeSchema = zod_1.z.nativeEnum(DelegationErrorCode);
+class DelegationChainError extends Error {
+    code;
+    constructor(args) {
+        super(args.message);
+        this.name = 'DelegationChainError';
+        this.code = args.code;
+    }
+}
+exports.DelegationChainError = DelegationChainError;
+function subjectsEqual(a, b) {
+    return (0, subject_1.subjectRefToString)(a) === (0, subject_1.subjectRefToString)(b);
+}
+function resolveDelegationChain(args) {
+    const { actor, executor, chain } = args;
+    if (chain.length === 0) {
+        if (!subjectsEqual(actor, executor)) {
+            throw new DelegationChainError({
+                code: DelegationErrorCode.EmptyChainMismatch,
+                message: `Empty delegation chain requires actor === executor, but actor "${(0, subject_1.subjectRefToString)(actor)}" ≠ executor "${(0, subject_1.subjectRefToString)(executor)}".`,
+            });
+        }
+        return Object.freeze([]);
+    }
+    if (chain.length > exports.MAX_DELEGATION_DEPTH) {
+        throw new DelegationChainError({
+            code: DelegationErrorCode.ChainTooDeep,
+            message: `Delegation chain has ${chain.length} hops; the maximum is ${exports.MAX_DELEGATION_DEPTH}.`,
+        });
+    }
+    if (!subjectsEqual(chain[0].from, actor)) {
+        throw new DelegationChainError({
+            code: DelegationErrorCode.NotAnchoredAtActor,
+            message: `Delegation chain must start at actor "${(0, subject_1.subjectRefToString)(actor)}", but its first hop starts at "${(0, subject_1.subjectRefToString)(chain[0].from)}".`,
+        });
+    }
+    const last = chain[chain.length - 1];
+    if (!subjectsEqual(last.to, executor)) {
+        throw new DelegationChainError({
+            code: DelegationErrorCode.NotAnchoredAtExecutor,
+            message: `Delegation chain must end at executor "${(0, subject_1.subjectRefToString)(executor)}", but its last hop ends at "${(0, subject_1.subjectRefToString)(last.to)}".`,
+        });
+    }
+    const seen = new Set();
+    const firstKey = (0, subject_1.subjectRefToString)(chain[0].from);
+    seen.add(firstKey);
+    for (let i = 0; i < chain.length; i += 1) {
+        if (i > 0 && !subjectsEqual(chain[i - 1].to, chain[i].from)) {
+            throw new DelegationChainError({
+                code: DelegationErrorCode.Discontinuous,
+                message: `Delegation chain is not contiguous at hop ${i}: previous "to" "${(0, subject_1.subjectRefToString)(chain[i - 1].to)}" ≠ this "from" "${(0, subject_1.subjectRefToString)(chain[i].from)}".`,
+            });
+        }
+        const toKey = (0, subject_1.subjectRefToString)(chain[i].to);
+        if (seen.has(toKey)) {
+            throw new DelegationChainError({
+                code: DelegationErrorCode.Cycle,
+                message: `Delegation chain contains a cycle: subject "${toKey}" appears more than once.`,
+            });
+        }
+        seen.add(toKey);
+    }
+    return Object.freeze([...chain]);
+}
+//# sourceMappingURL=delegation-chain.js.map

package/dist/principal/lib/delegation-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-chain.js","sourceRoot":"","sources":["../../../src/principal/lib/delegation-chain.ts"],"names":[],"mappings":";;;AAwEA,wDAwEC;AAhJD,6BAAwB;AACxB,2CAAoE;AASvD,QAAA,oBAAoB,GAAG,CAAC,CAAC;AAMtC,IAAY,mBAiBX;AAjBD,WAAY,mBAAmB;IAE7B,iEAA0C,CAAA;IAE1C,uDAAgC,CAAA;IAEhC,uEAAgD,CAAA;IAEhD,oFAA6D,CAAA;IAE7D,0FAAmE,CAAA;IAMnE,6EAAsD,CAAA;AACxD,CAAC,EAjBW,mBAAmB,mCAAnB,mBAAmB,QAiB9B;AAEY,QAAA,yBAAyB,GAAG,OAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAM3E,MAAa,oBAAqB,SAAQ,KAAK;IACpC,IAAI,CAAsB;IAEnC,YAAY,IAAoD;QAC9D,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;CACF;AARD,oDAQC;AAED,SAAS,aAAa,CAAC,CAAa,EAAE,CAAa;IACjD,OAAO,IAAA,4BAAkB,EAAC,CAAC,CAAC,KAAK,IAAA,4BAAkB,EAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAmBD,SAAgB,sBAAsB,CAAC,IAItC;IACC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAIxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,mBAAmB,CAAC,kBAAkB;gBAC5C,OAAO,EAAE,kEAAkE,IAAA,4BAAkB,EAC3F,KAAK,CACN,iBAAiB,IAAA,4BAAkB,EAAC,QAAQ,CAAC,IAAI;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,4BAAoB,EAAE,CAAC;QACxC,MAAM,IAAI,oBAAoB,CAAC;YAC7B,IAAI,EAAE,mBAAmB,CAAC,YAAY;YACtC,OAAO,EAAE,wBAAwB,KAAK,CAAC,MAAM,yBAAyB,4BAAoB,GAAG;SAC9F,CAAC,CAAC;IACL,CAAC;IAGD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,oBAAoB,CAAC;YAC7B,IAAI,EAAE,mBAAmB,CAAC,kBAAkB;YAC5C,OAAO,EAAE,yCAAyC,IAAA,4BAAkB,EAClE,KAAK,CACN,mCAAmC,IAAA,4BAAkB,EAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,IAAI;SAC3E,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACtC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,oBAAoB,CAAC;YAC7B,IAAI,EAAE,mBAAmB,CAAC,qBAAqB;YAC/C,OAAO,EAAE,0CAA0C,IAAA,4BAAkB,EACnE,QAAQ,CACT,gCAAgC,IAAA,4BAAkB,EAAC,IAAI,CAAC,EAAE,CAAC,IAAI;SACjE,CAAC,CAAC;IACL,CAAC;IAID,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAA,4BAAkB,EAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,mBAAmB,CAAC,aAAa;gBACvC,OAAO,EAAE,6CAA6C,CAAC,oBAAoB,IAAA,4BAAkB,EAC3F,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,EAAE,CACjB,oBAAoB,IAAA,4BAAkB,EAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,IAAI;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,4BAAkB,EAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,mBAAmB,CAAC,KAAK;gBAC/B,OAAO,EAAE,+CAA+C,KAAK,2BAA2B;aACzF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;AACnC,CAAC"}

package/dist/principal/lib/delegation-grant.d.ts

@@ -0,0 +1,10 @@
+import { z } from 'zod';
+import { type SubjectRef } from '../../subject';
+export interface DelegationGrant {
+    from: SubjectRef;
+    to: SubjectRef;
+    grantedAt: string;
+    reason?: string;
+}
+export declare const DelegationGrantSchema: z.ZodType<DelegationGrant>;
+//# sourceMappingURL=delegation-grant.d.ts.map

package/dist/principal/lib/delegation-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-grant.d.ts","sourceRoot":"","sources":["../../../src/principal/lib/delegation-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAkBlE,MAAM,WAAW,eAAe;IAE9B,IAAI,EAAE,UAAU,CAAC;IAEjB,EAAE,EAAE,UAAU,CAAC;IAEf,SAAS,EAAE,MAAM,CAAC;IAElB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,qBAAqB,EAOnB,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC"}

package/dist/principal/lib/delegation-grant.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationGrantSchema = void 0;
+const zod_1 = require("zod");
+const subject_1 = require("../../subject");
+exports.DelegationGrantSchema = zod_1.z
+    .object({
+    from: subject_1.SubjectRefSchema,
+    to: subject_1.SubjectRefSchema,
+    grantedAt: zod_1.z.string().datetime(),
+    reason: zod_1.z.string().min(1).optional(),
+})
+    .strict();
+//# sourceMappingURL=delegation-grant.js.map

package/dist/principal/lib/delegation-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-grant.js","sourceRoot":"","sources":["../../../src/principal/lib/delegation-grant.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,2CAAkE;AA6BrD,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,0BAAgB;IACtB,EAAE,EAAE,0BAAgB;IACpB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAgC,CAAC"}

package/dist/principal/lib/execution-principal.d.ts

@@ -0,0 +1,20 @@
+import { z } from 'zod';
+import { type SubjectRef, type TokenClass } from '../../subject';
+import { type ExecutionEnvironmentRef } from '../../execution-environment';
+import { type AppChannel } from '../../app-platform';
+import { type DelegationGrant } from './delegation-grant';
+export interface ExecutionPrincipal {
+    actor: SubjectRef;
+    executor: SubjectRef;
+    delegationChain: readonly DelegationGrant[];
+    tokenClass: TokenClass;
+    environment: ExecutionEnvironmentRef;
+    orgId: string;
+    appId?: string;
+    releaseId?: string;
+    channel?: AppChannel;
+    tenantId?: string;
+    purpose?: string;
+}
+export declare const ExecutionPrincipalSchema: z.ZodType<ExecutionPrincipal>;
+//# sourceMappingURL=execution-principal.d.ts.map

package/dist/principal/lib/execution-principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-principal.d.ts","sourceRoot":"","sources":["../../../src/principal/lib/execution-principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,UAAU,EAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAwB5B,MAAM,WAAW,kBAAkB;IAEjC,KAAK,EAAE,UAAU,CAAC;IAElB,QAAQ,EAAE,UAAU,CAAC;IAErB,eAAe,EAAE,SAAS,eAAe,EAAE,CAAC;IAE5C,UAAU,EAAE,UAAU,CAAC;IAEvB,WAAW,EAAE,uBAAuB,CAAC;IAErC,KAAK,EAAE,MAAM,CAAC;IAEd,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,OAAO,CAAC,EAAE,UAAU,CAAC;IAErB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,wBAAwB,EActB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC"}

package/dist/principal/lib/execution-principal.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExecutionPrincipalSchema = void 0;
+const zod_1 = require("zod");
+const subject_1 = require("../../subject");
+const execution_environment_1 = require("../../execution-environment");
+const app_platform_1 = require("../../app-platform");
+const delegation_grant_1 = require("./delegation-grant");
+exports.ExecutionPrincipalSchema = zod_1.z
+    .object({
+    actor: subject_1.SubjectRefSchema,
+    executor: subject_1.SubjectRefSchema,
+    delegationChain: zod_1.z.array(delegation_grant_1.DelegationGrantSchema).readonly(),
+    tokenClass: subject_1.TokenClassSchema,
+    environment: execution_environment_1.ExecutionEnvironmentRefSchema,
+    orgId: zod_1.z.string().min(1),
+    appId: zod_1.z.string().min(1).optional(),
+    releaseId: zod_1.z.string().min(1).optional(),
+    channel: app_platform_1.AppChannelSchema.optional(),
+    tenantId: zod_1.z.string().min(1).optional(),
+    purpose: zod_1.z.string().min(1).optional(),
+})
+    .strict();
+//# sourceMappingURL=execution-principal.js.map

package/dist/principal/lib/execution-principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-principal.js","sourceRoot":"","sources":["../../../src/principal/lib/execution-principal.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,2CAKuB;AACvB,uEAGqC;AACrC,qDAAuE;AACvE,yDAG4B;AAiDf,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,0BAAgB;IACvB,QAAQ,EAAE,0BAAgB;IAC1B,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,wCAAqB,CAAC,CAAC,QAAQ,EAAE;IAC1D,UAAU,EAAE,0BAAgB;IAC5B,WAAW,EAAE,qDAA6B;IAC1C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,+BAAgB,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC;KACD,MAAM,EAAmC,CAAC"}

package/dist/process-topology/index.d.ts

@@ -0,0 +1,3 @@
+export * from './lib/process-topology';
+export * from './lib/resolve-process-topology';
+//# sourceMappingURL=index.d.ts.map

package/dist/process-topology/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/process-topology/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,gCAAgC,CAAC"}

package/dist/process-topology/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/process-topology"), exports);
+__exportStar(require("./lib/resolve-process-topology"), exports);
+//# sourceMappingURL=index.js.map

package/dist/process-topology/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/process-topology/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC;AACvC,iEAA+C"}

package/dist/process-topology/lib/process-topology.d.ts

@@ -0,0 +1,67 @@
+import { z } from 'zod';
+export declare const ProcessMemberSchema: z.ZodObject<{
+    biomeId: z.ZodString;
+    componentKey: z.ZodString;
+}, z.core.$strict>;
+export type ProcessMember = z.infer<typeof ProcessMemberSchema>;
+export declare function processMemberKey(member: ProcessMember): string;
+export declare const ProcessBasePathStrategySchema: z.ZodEnum<{
+    "service-name": "service-name";
+}>;
+export type ProcessBasePathStrategy = z.infer<typeof ProcessBasePathStrategySchema>;
+export declare const ProcessDefinitionSchema: z.ZodObject<{
+    name: z.ZodString;
+    members: z.ZodArray<z.ZodObject<{
+        biomeId: z.ZodString;
+        componentKey: z.ZodString;
+    }, z.core.$strict>>;
+    replicas: z.ZodObject<{
+        min: z.ZodNumber;
+        max: z.ZodNumber;
+    }, z.core.$strict>;
+    listen: z.ZodObject<{
+        port: z.ZodNumber;
+        basePathStrategy: z.ZodEnum<{
+            "service-name": "service-name";
+        }>;
+    }, z.core.$strict>;
+    resources: z.ZodOptional<z.ZodObject<{
+        cpu: z.ZodString;
+        memory: z.ZodString;
+    }, z.core.$strict>>;
+    database: z.ZodOptional<z.ZodObject<{
+        poolMaxPerMount: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ProcessDefinition = z.infer<typeof ProcessDefinitionSchema>;
+export declare const PROCESS_TOPOLOGY_SCHEMA_VERSION: 1;
+export declare const ProcessTopologySchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    distributionId: z.ZodString;
+    processes: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        members: z.ZodArray<z.ZodObject<{
+            biomeId: z.ZodString;
+            componentKey: z.ZodString;
+        }, z.core.$strict>>;
+        replicas: z.ZodObject<{
+            min: z.ZodNumber;
+            max: z.ZodNumber;
+        }, z.core.$strict>;
+        listen: z.ZodObject<{
+            port: z.ZodNumber;
+            basePathStrategy: z.ZodEnum<{
+                "service-name": "service-name";
+            }>;
+        }, z.core.$strict>;
+        resources: z.ZodOptional<z.ZodObject<{
+            cpu: z.ZodString;
+            memory: z.ZodString;
+        }, z.core.$strict>>;
+        database: z.ZodOptional<z.ZodObject<{
+            poolMaxPerMount: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ProcessTopology = z.infer<typeof ProcessTopologySchema>;
+//# sourceMappingURL=process-topology.d.ts.map

package/dist/process-topology/lib/process-topology.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-topology.d.ts","sourceRoot":"","sources":["../../../src/process-topology/lib/process-topology.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkCxB,eAAO,MAAM,mBAAmB;;;kBAWrB,CAAC;AACZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAE9D;AAaD,eAAO,MAAM,6BAA6B;;EAA2B,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AAgBF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;kBA+DhC,CAAC;AACL,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,+BAA+B,EAAG,CAAU,CAAC;AAG1D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmC9B,CAAC;AACL,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/process-topology/lib/process-topology.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProcessTopologySchema = exports.PROCESS_TOPOLOGY_SCHEMA_VERSION = exports.ProcessDefinitionSchema = exports.ProcessBasePathStrategySchema = exports.ProcessMemberSchema = void 0;
+exports.processMemberKey = processMemberKey;
+const zod_1 = require("zod");
+exports.ProcessMemberSchema = zod_1.z
+    .object({
+    biomeId: zod_1.z
+        .string()
+        .min(1)
+        .regex(/^[a-z][a-z0-9-]*$/, 'biome id must be lowercase kebab-case'),
+    componentKey: zod_1.z
+        .string()
+        .min(1)
+        .regex(/^[a-z][a-z0-9-]*$/, 'component key must be lowercase kebab-case'),
+})
+    .strict();
+function processMemberKey(member) {
+    return `${member.biomeId}/${member.componentKey}`;
+}
+exports.ProcessBasePathStrategySchema = zod_1.z.enum(['service-name']);
+const CpuQuantitySchema = zod_1.z
+    .string()
+    .regex(/^(?:[1-9]\d*m|0\.(?:00[1-9]|0[1-9]\d|[1-9]\d{0,2})|[1-9]\d*(?:\.\d{1,3})?)$/, 'CPU quantity must be positive cores or millicores with at most three decimal places (for example 0.5 or 500m)');
+const ByteQuantitySchema = zod_1.z
+    .string()
+    .regex(/^[1-9]\d*(?:Ki|Mi|Gi|Ti)$/, 'byte quantity must be a positive binary unit (Ki, Mi, Gi, or Ti)');
+exports.ProcessDefinitionSchema = zod_1.z
+    .object({
+    name: zod_1.z
+        .string()
+        .min(1)
+        .max(63)
+        .regex(/^[a-z]([a-z0-9-]*[a-z0-9])?$/, 'process name must be a lowercase DNS label'),
+    members: zod_1.z.array(exports.ProcessMemberSchema).min(1),
+    replicas: zod_1.z
+        .object({
+        min: zod_1.z.number().int().nonnegative(),
+        max: zod_1.z.number().int().positive(),
+    })
+        .strict()
+        .refine((replicas) => replicas.max >= replicas.min, {
+        message: 'replicas.max cannot be below replicas.min',
+        path: ['max'],
+    }),
+    listen: zod_1.z
+        .object({
+        port: zod_1.z.number().int().min(1).max(65535),
+        basePathStrategy: exports.ProcessBasePathStrategySchema,
+    })
+        .strict(),
+    resources: zod_1.z
+        .object({ cpu: CpuQuantitySchema, memory: ByteQuantitySchema })
+        .strict()
+        .optional(),
+    database: zod_1.z
+        .object({
+        poolMaxPerMount: zod_1.z.number().int().positive(),
+    })
+        .strict()
+        .optional(),
+})
+    .strict()
+    .superRefine((process, ctx) => {
+    const seen = new Set();
+    process.members.forEach((member, index) => {
+        const key = processMemberKey(member);
+        if (seen.has(key)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['members', index],
+                message: `duplicate member "${key}" in process "${process.name}"`,
+            });
+        }
+        seen.add(key);
+    });
+});
+exports.PROCESS_TOPOLOGY_SCHEMA_VERSION = 1;
+exports.ProcessTopologySchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(exports.PROCESS_TOPOLOGY_SCHEMA_VERSION),
+    distributionId: zod_1.z.string().min(1),
+    processes: zod_1.z.array(exports.ProcessDefinitionSchema).min(1),
+})
+    .strict()
+    .superRefine((topology, ctx) => {
+    const names = new Set();
+    const owners = new Map();
+    topology.processes.forEach((process, index) => {
+        if (names.has(process.name)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['processes', index, 'name'],
+                message: `duplicate process name "${process.name}"`,
+            });
+        }
+        names.add(process.name);
+        for (const member of process.members) {
+            const key = processMemberKey(member);
+            const owner = owners.get(key);
+            if (owner !== undefined) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: ['processes', index, 'members'],
+                    message: `component "${key}" is a member of both "${owner}" and ` +
+                        `"${process.name}" — each component sits in exactly ONE process`,
+                });
+                continue;
+            }
+            owners.set(key, process.name);
+        }
+    });
+});
+//# sourceMappingURL=process-topology.js.map

package/dist/process-topology/lib/process-topology.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-topology.js","sourceRoot":"","sources":["../../../src/process-topology/lib/process-topology.ts"],"names":[],"mappings":";;;AAoDA,4CAEC;AAtDD,6BAAwB;AAkCX,QAAA,mBAAmB,GAAG,OAAC;KACjC,MAAM,CAAC;IACN,OAAO,EAAE,OAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,mBAAmB,EAAE,uCAAuC,CAAC;IACtE,YAAY,EAAE,OAAC;SACZ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,mBAAmB,EAAE,4CAA4C,CAAC;CAC5E,CAAC;KACD,MAAM,EAAE,CAAC;AAOZ,SAAgB,gBAAgB,CAAC,MAAqB;IACpD,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;AACpD,CAAC;AAaY,QAAA,6BAA6B,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AAKtE,MAAM,iBAAiB,GAAG,OAAC;KACxB,MAAM,EAAE;KACR,KAAK,CACJ,6EAA6E,EAC7E,+GAA+G,CAChH,CAAC;AACJ,MAAM,kBAAkB,GAAG,OAAC;KACzB,MAAM,EAAE;KACR,KAAK,CACJ,2BAA2B,EAC3B,kEAAkE,CACnE,CAAC;AAGS,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,CAAC;IAKN,IAAI,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CACJ,8BAA8B,EAC9B,4CAA4C,CAC7C;IACH,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,2BAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,QAAQ,EAAE,OAAC;SACR,MAAM,CAAC;QACN,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QACnC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;SACD,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE;QAClD,OAAO,EAAE,2CAA2C;QACpD,IAAI,EAAE,CAAC,KAAK,CAAC;KACd,CAAC;IACJ,MAAM,EAAE,OAAC;SACN,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;QACxC,gBAAgB,EAAE,qCAA6B;KAChD,CAAC;SACD,MAAM,EAAE;IACX,SAAS,EAAE,OAAC;SACT,MAAM,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;SAC9D,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,QAAQ,EAAE,OAAC;SACR,MAAM,CAAC;QAQN,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC7C,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC;gBACxB,OAAO,EAAE,qBAAqB,GAAG,iBAAiB,OAAO,CAAC,IAAI,GAAG;aAClE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGQ,QAAA,+BAA+B,GAAG,CAAU,CAAC;AAG7C,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,aAAa,EAAE,OAAC,CAAC,OAAO,CAAC,uCAA+B,CAAC;IACzD,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,+BAAuB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACnD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5C,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC;gBAClC,OAAO,EAAE,2BAA2B,OAAO,CAAC,IAAI,GAAG;aACpD,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC;oBACrC,OAAO,EACL,cAAc,GAAG,0BAA0B,KAAK,QAAQ;wBACxD,IAAI,OAAO,CAAC,IAAI,gDAAgD;iBACnE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/process-topology/lib/resolve-process-topology.d.ts

@@ -0,0 +1,37 @@
+import { BiomeComponentExecutionMode, BiomeScalingMode, CompositionTrustClass } from '../../biome';
+import { type ProcessTopology } from './process-topology';
+export declare enum ProcessTopologyViolationCode {
+    UnknownMember = "unknown-member",
+    MemberNotComposable = "member-not-composable",
+    MixedTrustClasses = "mixed-trust-classes",
+    MissingTrustClass = "missing-trust-class",
+    SingletonScaled = "singleton-scaled",
+    InvocationOnlyMember = "invocation-only-member",
+    UnplacedComponent = "unplaced-component",
+    FloatingMemberVersion = "floating-member-version",
+    KernelMajorDisagreement = "kernel-major-disagreement"
+}
+export interface ProcessTopologyViolation {
+    readonly code: ProcessTopologyViolationCode;
+    readonly process?: string;
+    readonly member?: string;
+    readonly message: string;
+}
+export interface ComposableComponentFacts {
+    readonly biomeId: string;
+    readonly componentKey: string;
+    readonly executionModes: readonly BiomeComponentExecutionMode[];
+    readonly compositionTrustClass?: CompositionTrustClass;
+    readonly scalingMode: BiomeScalingMode;
+    readonly version: string;
+    readonly kernelMajor?: number;
+}
+export interface ResolveProcessTopologyInput {
+    readonly topology: ProcessTopology;
+    readonly composableComponents: readonly ComposableComponentFacts[];
+}
+export declare function isExactVersion(value: string): boolean;
+export declare function resolveProcessTopology(input: ResolveProcessTopologyInput): readonly ProcessTopologyViolation[];
+export declare function assertProcessTopology(input: ResolveProcessTopologyInput): void;
+export declare function oneProcessPerComponent(distributionId: string, components: readonly ComposableComponentFacts[], listenPort: number): ProcessTopology;
+//# sourceMappingURL=resolve-process-topology.d.ts.map

package/dist/process-topology/lib/resolve-process-topology.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-process-topology.d.ts","sourceRoot":"","sources":["../../../src/process-topology/lib/resolve-process-topology.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AA0B5E,oBAAY,4BAA4B;IAEtC,aAAa,mBAAmB;IAEhC,mBAAmB,0BAA0B;IAE7C,iBAAiB,wBAAwB;IAEzC,iBAAiB,wBAAwB;IAEzC,eAAe,qBAAqB;IAEpC,oBAAoB,2BAA2B;IAE/C,iBAAiB,uBAAuB;IAExC,qBAAqB,4BAA4B;IAEjD,uBAAuB,8BAA8B;CACtD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAE5C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAUD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAChE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IASvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAUzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAOnC,QAAQ,CAAC,oBAAoB,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACpE;AAYD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAErD;AAYD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,2BAA2B,GACjC,SAAS,wBAAwB,EAAE,CAiKrC;AAWD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,2BAA2B,GAAG,IAAI,CAS9E;AAgBD,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,SAAS,wBAAwB,EAAE,EAC/C,UAAU,EAAE,MAAM,GACjB,eAAe,CAajB"}

package/dist/process-topology/lib/resolve-process-topology.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProcessTopologyViolationCode = void 0;
+exports.isExactVersion = isExactVersion;
+exports.resolveProcessTopology = resolveProcessTopology;
+exports.assertProcessTopology = assertProcessTopology;
+exports.oneProcessPerComponent = oneProcessPerComponent;
+const biome_1 = require("../../biome");
+const process_topology_1 = require("./process-topology");
+var ProcessTopologyViolationCode;
+(function (ProcessTopologyViolationCode) {
+    ProcessTopologyViolationCode["UnknownMember"] = "unknown-member";
+    ProcessTopologyViolationCode["MemberNotComposable"] = "member-not-composable";
+    ProcessTopologyViolationCode["MixedTrustClasses"] = "mixed-trust-classes";
+    ProcessTopologyViolationCode["MissingTrustClass"] = "missing-trust-class";
+    ProcessTopologyViolationCode["SingletonScaled"] = "singleton-scaled";
+    ProcessTopologyViolationCode["InvocationOnlyMember"] = "invocation-only-member";
+    ProcessTopologyViolationCode["UnplacedComponent"] = "unplaced-component";
+    ProcessTopologyViolationCode["FloatingMemberVersion"] = "floating-member-version";
+    ProcessTopologyViolationCode["KernelMajorDisagreement"] = "kernel-major-disagreement";
+})(ProcessTopologyViolationCode || (exports.ProcessTopologyViolationCode = ProcessTopologyViolationCode = {}));
+const EXACT_VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+function isExactVersion(value) {
+    return EXACT_VERSION.test(value);
+}
+const REPLICABLE_SCALING_MODES = new Set([
+    biome_1.BiomeScalingMode.Horizontal,
+    biome_1.BiomeScalingMode.Partitioned,
+]);
+function resolveProcessTopology(input) {
+    const violations = [];
+    const facts = new Map();
+    for (const component of input.composableComponents) {
+        facts.set((0, process_topology_1.processMemberKey)({
+            biomeId: component.biomeId,
+            componentKey: component.componentKey,
+        }), component);
+    }
+    const placed = new Set();
+    for (const process of input.topology.processes) {
+        const trustClasses = new Map();
+        const kernelMajors = new Map();
+        for (const member of process.members) {
+            const key = (0, process_topology_1.processMemberKey)(member);
+            placed.add(key);
+            const component = facts.get(key);
+            if (component === undefined) {
+                violations.push({
+                    code: ProcessTopologyViolationCode.UnknownMember,
+                    process: process.name,
+                    member: key,
+                    message: `process "${process.name}" names member "${key}", which is not a ` +
+                        `composable component of distribution "${input.topology.distributionId}". ` +
+                        `Either the component does not exist, or it does not declare composed execution.`,
+                });
+                continue;
+            }
+            if (!component.executionModes.includes(biome_1.BiomeComponentExecutionMode.Composed)) {
+                violations.push({
+                    code: ProcessTopologyViolationCode.MemberNotComposable,
+                    process: process.name,
+                    member: key,
+                    message: `"${key}" does not declare "${biome_1.BiomeComponentExecutionMode.Composed}" ` +
+                        `execution, so it cannot be loaded into process "${process.name}". ` +
+                        `A component runs in its own process unless its author says it tolerates a shared one.`,
+                });
+            }
+            if (component.compositionTrustClass === undefined) {
+                violations.push({
+                    code: ProcessTopologyViolationCode.MissingTrustClass,
+                    process: process.name,
+                    member: key,
+                    message: `"${key}" declares no compositionTrustClass, so what may share its ` +
+                        `heap is unknown. An unclassified component is REFUSED rather than ` +
+                        `defaulted — defaulting would silently admit custody code into a product heap.`,
+                });
+            }
+            else {
+                const members = trustClasses.get(component.compositionTrustClass) ?? [];
+                members.push(key);
+                trustClasses.set(component.compositionTrustClass, members);
+            }
+            if (component.scalingMode === biome_1.BiomeScalingMode.InvocationOnly) {
+                violations.push({
+                    code: ProcessTopologyViolationCode.InvocationOnlyMember,
+                    process: process.name,
+                    member: key,
+                    message: `"${key}" is invocation-only, so nothing rosters it as a standing ` +
+                        `workload and it cannot be a member of process "${process.name}". ` +
+                        `An invocation-only component is launched per invocation by the runner plane.`,
+                });
+            }
+            else if (process.replicas.max > 1 &&
+                !REPLICABLE_SCALING_MODES.has(component.scalingMode)) {
+                violations.push({
+                    code: ProcessTopologyViolationCode.SingletonScaled,
+                    process: process.name,
+                    member: key,
+                    message: `"${key}" declares scaling.mode "${component.scalingMode}", so process ` +
+                        `"${process.name}" may run at most one replica — it declares ` +
+                        `replicas.max ${process.replicas.max}. ` +
+                        `"Leader-elected" is singleton plus a kernel-state lease, not a scaling mode: ` +
+                        `a component that elects still runs one instance of its scheduled work.`,
+                });
+            }
+            if (!isExactVersion(component.version)) {
+                violations.push({
+                    code: ProcessTopologyViolationCode.FloatingMemberVersion,
+                    process: process.name,
+                    member: key,
+                    message: `"${key}" resolves to "${component.version}", which is not an exact ` +
+                        `version. A floating range would decide what shares a heap at install ` +
+                        `time, so two installs of one edition could differ and "which code was ` +
+                        `in that heap" would be unanswerable after the fact.`,
+                });
+            }
+            if (component.kernelMajor !== undefined) {
+                const members = kernelMajors.get(component.kernelMajor) ?? [];
+                members.push(key);
+                kernelMajors.set(component.kernelMajor, members);
+            }
+        }
+        if (trustClasses.size > 1) {
+            const summary = [...trustClasses.entries()]
+                .map(([trustClass, members]) => `${trustClass} (${members.join(', ')})`)
+                .sort()
+                .join(' and ');
+            violations.push({
+                code: ProcessTopologyViolationCode.MixedTrustClasses,
+                process: process.name,
+                message: `process "${process.name}" mixes trust classes: ${summary}. ` +
+                    `A process contains components of exactly ONE class — composing two ` +
+                    `merges their blast radius into one heap, one uid and one set of ambient ` +
+                    `credentials. Declare more processes; a distribution may always isolate ` +
+                    `MORE, never less.`,
+            });
+        }
+        if (kernelMajors.size > 1) {
+            const summary = [...kernelMajors.entries()]
+                .map(([major, members]) => `${major} (${members.join(', ')})`)
+                .sort()
+                .join(' and ');
+            violations.push({
+                code: ProcessTopologyViolationCode.KernelMajorDisagreement,
+                process: process.name,
+                message: `process "${process.name}" mixes kernel majors: ${summary}. ` +
+                    `Members of one process share one module graph, so they must resolve one ` +
+                    `compatible kernel major. This is refused at resolve time rather than ` +
+                    `discovered at boot.`,
+            });
+        }
+    }
+    for (const component of input.composableComponents) {
+        const key = (0, process_topology_1.processMemberKey)(component);
+        if (placed.has(key))
+            continue;
+        violations.push({
+            code: ProcessTopologyViolationCode.UnplacedComponent,
+            member: key,
+            message: `"${key}" is a composable component of distribution ` +
+                `"${input.topology.distributionId}" and no process contains it. ` +
+                `A topology declares where EVERY composable component runs; an omission ` +
+                `would silently drop a service from the installation.`,
+        });
+    }
+    return violations;
+}
+function assertProcessTopology(input) {
+    const violations = resolveProcessTopology(input);
+    if (violations.length === 0)
+        return;
+    const lines = violations.map((violation) => `  - [${violation.code}] ${violation.message}`);
+    throw new Error(`process topology for distribution "${input.topology.distributionId}" is refused ` +
+        `(${violations.length} violation${violations.length === 1 ? '' : 's'}):\n` +
+        lines.join('\n'));
+}
+function oneProcessPerComponent(distributionId, components, listenPort) {
+    return {
+        schemaVersion: 1,
+        distributionId,
+        processes: components.map((component) => ({
+            name: `${component.biomeId}-${component.componentKey}`,
+            members: [
+                { biomeId: component.biomeId, componentKey: component.componentKey },
+            ],
+            replicas: { min: 1, max: 1 },
+            listen: { port: listenPort, basePathStrategy: 'service-name' },
+        })),
+    };
+}
+//# sourceMappingURL=resolve-process-topology.js.map