@xemahq/contracts 0.69.0 → 0.71.0

package/dist/deployment/lib/trust-partition.d.ts

@@ -0,0 +1,28 @@
+export declare enum TrustPartitionViolationCode {
+    UnknownBiome = "unknown-biome",
+    ExceedsCeiling = "exceeds-ceiling",
+    IdentitySpansTrustDomains = "identity-spans-trust-domains",
+    DuplicateIdentity = "duplicate-identity",
+    UnplacedIdentityBiome = "unplaced-identity-biome"
+}
+export interface TrustPartitionViolation {
+    readonly code: TrustPartitionViolationCode;
+    readonly domain?: string;
+    readonly serviceAccount?: string;
+    readonly message: string;
+}
+export interface PartitionedBiome {
+    readonly id: string;
+    readonly trustCeiling: string;
+    readonly trustDomain: string;
+}
+export declare function gradeTrustRefinement(biomes: readonly PartitionedBiome[]): TrustPartitionViolation[];
+export interface EnforcementIdentity {
+    readonly serviceAccount: string;
+    readonly actsFor: readonly {
+        readonly biome: string;
+        readonly component: string;
+    }[];
+}
+export declare function gradeEnforcementIdentities(identities: readonly EnforcementIdentity[], domainOf: Readonly<Record<string, string>>): TrustPartitionViolation[];
+//# sourceMappingURL=trust-partition.d.ts.map

package/dist/deployment/lib/trust-partition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-partition.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/trust-partition.ts"],"names":[],"mappings":"AAmBA,oBAAY,2BAA2B;IAErC,YAAY,kBAAkB;IAE9B,cAAc,oBAAoB;IAElC,yBAAyB,iCAAiC;IAE1D,iBAAiB,uBAAuB;IAExC,qBAAqB,4BAA4B;CAClD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAE3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAEjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AASD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAClC,uBAAuB,EAAE,CA2B3B;AAGD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACrF;AAaD,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,SAAS,mBAAmB,EAAE,EAC1C,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACzC,uBAAuB,EAAE,CAkD3B"}

package/dist/deployment/lib/trust-partition.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustPartitionViolationCode = void 0;
+exports.gradeTrustRefinement = gradeTrustRefinement;
+exports.gradeEnforcementIdentities = gradeEnforcementIdentities;
+var TrustPartitionViolationCode;
+(function (TrustPartitionViolationCode) {
+    TrustPartitionViolationCode["UnknownBiome"] = "unknown-biome";
+    TrustPartitionViolationCode["ExceedsCeiling"] = "exceeds-ceiling";
+    TrustPartitionViolationCode["IdentitySpansTrustDomains"] = "identity-spans-trust-domains";
+    TrustPartitionViolationCode["DuplicateIdentity"] = "duplicate-identity";
+    TrustPartitionViolationCode["UnplacedIdentityBiome"] = "unplaced-identity-biome";
+})(TrustPartitionViolationCode || (exports.TrustPartitionViolationCode = TrustPartitionViolationCode = {}));
+function gradeTrustRefinement(biomes) {
+    const ceilingsOf = new Map();
+    for (const biome of biomes) {
+        const ceilings = ceilingsOf.get(biome.trustDomain) ?? new Map();
+        const members = ceilings.get(biome.trustCeiling) ?? [];
+        members.push(biome.id);
+        ceilings.set(biome.trustCeiling, members);
+        ceilingsOf.set(biome.trustDomain, ceilings);
+    }
+    const violations = [];
+    for (const domain of [...ceilingsOf.keys()].sort(codeUnit)) {
+        const ceilings = ceilingsOf.get(domain);
+        if (ceilings.size <= 1)
+            continue;
+        const summary = [...ceilings.entries()]
+            .map(([ceiling, members]) => `${ceiling} (${[...members].sort(codeUnit).join(', ')})`)
+            .sort(codeUnit)
+            .join(' and ');
+        violations.push({
+            code: TrustPartitionViolationCode.ExceedsCeiling,
+            domain,
+            message: `trust domain "${domain}" holds biomes of ${ceilings.size} edition ceiling domains: ${summary}. ` +
+                `A deployment may only split an edition's trust domains, never merge them; to let these biomes ` +
+                `share a domain, the edition must group them in its trustCeiling.`,
+        });
+    }
+    return violations;
+}
+function gradeEnforcementIdentities(identities, domainOf) {
+    const violations = [];
+    const seen = new Set();
+    for (const identity of identities) {
+        if (seen.has(identity.serviceAccount)) {
+            violations.push({
+                code: TrustPartitionViolationCode.DuplicateIdentity,
+                serviceAccount: identity.serviceAccount,
+                message: `ServiceAccount "${identity.serviceAccount}" is listed twice; list it once with every ` +
+                    `component it acts for, since a boundary sees one identity.`,
+            });
+            continue;
+        }
+        seen.add(identity.serviceAccount);
+        const domains = new Map();
+        for (const { biome, component } of identity.actsFor) {
+            const domain = Object.prototype.hasOwnProperty.call(domainOf, biome)
+                ? domainOf[biome]
+                : undefined;
+            if (domain === undefined) {
+                violations.push({
+                    code: TrustPartitionViolationCode.UnplacedIdentityBiome,
+                    serviceAccount: identity.serviceAccount,
+                    message: `ServiceAccount "${identity.serviceAccount}" acts for ${biome}/${component}, ` +
+                        `but the partition places no biome "${biome}".`,
+                });
+                continue;
+            }
+            const members = domains.get(domain) ?? [];
+            members.push(`${biome}/${component}`);
+            domains.set(domain, members);
+        }
+        if (domains.size > 1) {
+            const summary = [...domains.entries()]
+                .map(([domain, members]) => `${domain} (${members.sort(codeUnit).join(', ')})`)
+                .sort(codeUnit)
+                .join(' and ');
+            violations.push({
+                code: TrustPartitionViolationCode.IdentitySpansTrustDomains,
+                serviceAccount: identity.serviceAccount,
+                message: `ServiceAccount "${identity.serviceAccount}" acts for components of ${domains.size} trust ` +
+                    `domains: ${summary}. One account is one identity at every boundary, so these domains ` +
+                    `are not separate; run the components under separate accounts or place them in one domain.`,
+            });
+        }
+    }
+    return violations;
+}
+function codeUnit(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+//# sourceMappingURL=trust-partition.js.map

package/dist/deployment/lib/trust-partition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-partition.js","sourceRoot":"","sources":["../../../src/deployment/lib/trust-partition.ts"],"names":[],"mappings":";;;AA0DA,oDA6BC;AAmBD,gEAqDC;AA5ID,IAAY,2BAWX;AAXD,WAAY,2BAA2B;IAErC,6DAA8B,CAAA;IAE9B,iEAAkC,CAAA;IAElC,yFAA0D,CAAA;IAE1D,uEAAwC,CAAA;IAExC,gFAAiD,CAAA;AACnD,CAAC,EAXW,2BAA2B,2CAA3B,2BAA2B,QAWtC;AA4BD,SAAgB,oBAAoB,CAClC,MAAmC;IAEnC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,GAAG,EAAoB,CAAC;QAClF,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC1C,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,UAAU,GAA8B,EAAE,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAA0B,CAAC;QACjE,IAAI,QAAQ,CAAC,IAAI,IAAI,CAAC;YAAE,SAAS;QACjC,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;aACrF,IAAI,CAAC,QAAQ,CAAC;aACd,IAAI,CAAC,OAAO,CAAC,CAAC;QACjB,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,2BAA2B,CAAC,cAAc;YAChD,MAAM;YACN,OAAO,EACL,iBAAiB,MAAM,qBAAqB,QAAQ,CAAC,IAAI,6BAA6B,OAAO,IAAI;gBACjG,gGAAgG;gBAChG,kEAAkE;SACrE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAmBD,SAAgB,0BAA0B,CACxC,UAA0C,EAC1C,QAA0C;IAE1C,MAAM,UAAU,GAA8B,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,2BAA2B,CAAC,iBAAiB;gBACnD,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,OAAO,EACL,mBAAmB,QAAQ,CAAC,cAAc,6CAA6C;oBACvF,4DAA4D;aAC/D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,KAAK,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;gBAClE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACjB,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,2BAA2B,CAAC,qBAAqB;oBACvD,cAAc,EAAE,QAAQ,CAAC,cAAc;oBACvC,OAAO,EACL,mBAAmB,QAAQ,CAAC,cAAc,cAAc,KAAK,IAAI,SAAS,IAAI;wBAC9E,sCAAsC,KAAK,IAAI;iBAClD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;iBACnC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;iBAC9E,IAAI,CAAC,QAAQ,CAAC;iBACd,IAAI,CAAC,OAAO,CAAC,CAAC;YACjB,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,2BAA2B,CAAC,yBAAyB;gBAC3D,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,OAAO,EACL,mBAAmB,QAAQ,CAAC,cAAc,4BAA4B,OAAO,CAAC,IAAI,SAAS;oBAC3F,YAAY,OAAO,oEAAoE;oBACvF,2FAA2F;aAC9F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC"}

package/dist/distribution/index.d.ts

@@ -17,4 +17,5 @@ export * from './lib/nexus-binding';
 export * from './lib/resolve-nexus-bindings';
 export * from './lib/nexus-endpoint-specs';
 export * from './lib/lock-consumers';
+export * from './lib/verify-resolved-deployment';
 //# sourceMappingURL=index.d.ts.map

package/dist/distribution/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/distribution/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,kCAAkC,CAAC;AACjD,cAAc,sCAAsC,CAAC;AACrD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/distribution/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,kCAAkC,CAAC;AACjD,cAAc,sCAAsC,CAAC;AACrD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kCAAkC,CAAC"}

package/dist/distribution/index.js

@@ -33,4 +33,5 @@ __exportStar(require("./lib/nexus-binding"), exports);
 __exportStar(require("./lib/resolve-nexus-bindings"), exports);
 __exportStar(require("./lib/nexus-endpoint-specs"), exports);
 __exportStar(require("./lib/lock-consumers"), exports);
+__exportStar(require("./lib/verify-resolved-deployment"), exports);
 //# sourceMappingURL=index.js.map

package/dist/distribution/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/distribution/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,8DAA4C;AAC5C,+DAA6C;AAC7C,qDAAmC;AACnC,2DAAyC;AACzC,sDAAoC;AACpC,0DAAwC;AACxC,mDAAiC;AACjC,gEAA8C;AAC9C,kEAAgD;AAChD,sEAAoD;AACpD,mEAAiD;AACjD,uEAAqD;AACrD,+DAA6C;AAC7C,qDAAmC;AACnC,sDAAoC;AACpC,+DAA6C;AAC7C,6DAA2C;AAC3C,uDAAqC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/distribution/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,8DAA4C;AAC5C,+DAA6C;AAC7C,qDAAmC;AACnC,2DAAyC;AACzC,sDAAoC;AACpC,0DAAwC;AACxC,mDAAiC;AACjC,gEAA8C;AAC9C,kEAAgD;AAChD,sEAAoD;AACpD,mEAAiD;AACjD,uEAAqD;AACrD,+DAA6C;AAC7C,qDAAmC;AACnC,sDAAoC;AACpC,+DAA6C;AAC7C,6DAA2C;AAC3C,uDAAqC;AACrC,mEAAiD"}

package/dist/distribution/lib/distribution-lock.d.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { BiomeComponentKind, BiomeScalingMode, type BiomeComponentProcessFacts, type PostgresExtensionName, type BiomeTier, type BiomeTarget, type BiomeOrigin, type BiomeAudience, type BiomeBundleSourceSpec } from '../../biome';
+import { type ResolvedDeployment } from '../../deployment';
 import { type ResourceInclusion, type ResourceKindRef, type ResourceLogicalName, type ResourceScope } from '../../resource-requirement';
 import { type PlatformServiceTier } from './distribution';
 import { type ClosureEntry } from './biome-closure';
@@ -98,7 +99,9 @@ export interface LockedBiome {
     nexusRequires?: readonly NexusServiceRequirement[];
     workerTaskQueues?: Readonly<Record<string, readonly LockedWorkerTaskQueue[]>>;
     workflowClients?: Readonly<Record<string, readonly LockedWorkflowClient[]>>;
-    workerImages?: Readonly<Record<string, LockedWorkerImage>>;
+    workflowSubjects?: readonly LockedWorkflowSubject[];
+    trustCeiling?: string;
+    workerImages: Readonly<Record<string, LockedWorkerImage>>;
     imageDigest?: string;
     displayName: string;
     packageName: string | null;
@@ -120,16 +123,48 @@ export declare const LockedWorkerImageSchema: z.ZodObject<{
     entry: z.ZodString;
 }, z.core.$strict>;
 export interface LockedWorkflowClient {
+    biome?: string | undefined;
     component: string;
     taskQueue: LockedWorkerTaskQueue;
 }
 export declare const LockedWorkflowClientSchema: z.ZodObject<{
+    biome: z.ZodOptional<z.ZodString>;
     component: z.ZodString;
     taskQueue: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
         name: z.ZodEnum<typeof import("../../workflow").TaskQueueName>;
         placement: z.ZodEnum<typeof import("../../execution-target").TaskQueuePlacement>;
     }, z.core.$strict>]>;
 }, z.core.$strict>;
+export declare enum WorkflowSubjectPermission {
+    Write = "write"
+}
+export declare function controllerTokenServiceAccount(worker: string): string;
+export interface LockedWorkflowSubject {
+    component: string;
+    permissions: WorkflowSubjectPermission[];
+}
+export declare const LockedWorkflowSubjectSchema: z.ZodObject<{
+    component: z.ZodString;
+    permissions: z.ZodArray<z.ZodEnum<typeof WorkflowSubjectPermission>>;
+}, z.core.$strict>;
+export declare function deriveWorkflowSubjects(biome: {
+    readonly workerTaskQueues?: Readonly<Record<string, readonly LockedWorkerTaskQueue[]>> | undefined;
+    readonly workflowClients?: Readonly<Record<string, readonly LockedWorkflowClient[]>> | undefined;
+}): LockedWorkflowSubject[];
+export interface ResolvedWorkflowSubject {
+    serviceAccount: string;
+    permissions: WorkflowSubjectPermission[];
+    actsFor: {
+        biome: string;
+        component: string;
+    }[];
+}
+export declare function resolveWorkflowSubjects(lock: {
+    readonly biomes: readonly {
+        readonly id: string;
+        readonly workflowSubjects?: readonly LockedWorkflowSubject[] | undefined;
+    }[];
+}, resolved: Pick<ResolvedDeployment, 'biomes' | 'serviceAccounts'>): Record<string, ResolvedWorkflowSubject[]>;
 export declare const LockedWorkerTaskQueueSchema: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
     name: z.ZodEnum<typeof import("../../workflow").TaskQueueName>;
     placement: z.ZodEnum<typeof import("../../execution-target").TaskQueuePlacement>;
@@ -142,7 +177,7 @@ export interface LockedBiomeDisplay {
     summary?: string;
     accent?: string;
 }
-export type LockedBiomeV3 = Omit<LockedBiome, 'bundleSource' | 'serviceResources' | 'serviceProcessFacts' | 'nexusProvides' | 'nexusRequires' | 'workerTaskQueues' | 'workflowClients' | 'workerImages'>;
+export type LockedBiomeV3 = Omit<LockedBiome, 'bundleSource' | 'serviceResources' | 'serviceProcessFacts' | 'nexusProvides' | 'nexusRequires' | 'workerTaskQueues' | 'workflowClients' | 'workflowSubjects' | 'trustCeiling' | 'workerImages'>;
 export type LockedBiomeV2 = Omit<LockedBiomeV3, 'serviceDatabaseExtensions' | 'source'> & {
     source?: LockedBiomeSourceV2;
 };

package/dist/distribution/lib/distribution-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distribution-lock.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/distribution-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAML,kBAAkB,EAGlB,gBAAgB,EAEhB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC3B,MAAM,aAAa,CAAC;AAQrB,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,eAAe,EAKhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,+BAA+B,EAU7B,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAEpD,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,6BAA6B,CAAC;CACvC;AAED,eAAO,MAAM,kCAAkC,EAKhC,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;AAEvD,MAAM,MAAM,oBAAoB,GAC5B,yBAAyB,GACzB,4BAA4B,CAAC;AAEjC,eAAO,MAAM,0BAA0B,EAGjC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAOtC,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,oBAAoB,CAAC;CAC7B;AAED,eAAO,MAAM,6BAA6B,EAM3B,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAMlD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,4BAA4B,EAK1B,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAuBjD,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,eAAe,CAAC;IACtB,WAAW,EAAE,mBAAmB,CAAC;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAED,eAAO,MAAM,2BAA2B,EASzB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAYhD,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,MAAM,GAAG,aAAa,CAAC,EAC1E,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,MAAM,GAAG,aAAa,CAAC,GACzE,MAAM,CAMR;AAsDD,eAAO,MAAM,4BAA4B,EAKvB,CAAC,CAAC,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAAC;AAM9D,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,OAAO,GACX,SAAS,qBAAqB,EAAE,CAUlC;AAwBD,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,YAAY,EAAE,qBAAqB,CAAC;CACrC;AAED,eAAO,MAAM,sBAAsB,EAcpB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AA+B3C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC;IAE1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IAEZ,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAOD,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAgB7E,eAAO,MAAM,yBAAyB,EAEvB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAS9C,eAAO,MAAM,uBAAuB,EACL,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAQ5D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IAEpB,MAAM,EAAE,WAAW,CAAC;IAEpB,SAAS,EAAE,OAAO,CAAC;IAEnB,aAAa,EAAE,kBAAkB,CAAC;IAKlC,MAAM,EAAE,eAAe,CAAC;IAExB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IAUb,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAmB5B,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAsBnD,yBAAyB,CAAC,EAAE,QAAQ,CAClC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CACjD,CAAC;IAeF,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAErC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAmCzC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IAKrC,mBAAmB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IA0BxD,gBAAgB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAqBpD,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAkB1E,aAAa,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACjD,aAAa,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAqBnD,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAAC,CAAC;IAiB9E,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC,CAAC,CAAC;IAe5E,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAE3D,WAAW,CAAC,EAAE,MAAM,CAAC;IASrB,WAAW,EAAE,MAAM,CAAC;IAMpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC,QAAQ,EAAE,aAAa,CAAC;IAExB,WAAW,EAAE,OAAO,CAAC;IAErB,aAAa,EAAE,OAAO,CAAC;IAEvB,kBAAkB,EAAE,MAAM,CAAC;IAE3B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAS7B,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAGD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,uBAAuB;;;kBAKzB,CAAC;AAGZ,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAED,eAAO,MAAM,0BAA0B;;;;;;kBAK5B,CAAC;AAGZ,eAAO,MAAM,2BAA2B;;;oBAA2B,CAAC;AACpE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAGhF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAE9E;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkBD,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,WAAW,EACT,cAAc,GACd,kBAAkB,GAClB,qBAAqB,GACrB,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,iBAAiB,GACjB,cAAc,CACjB,CAAC;AAYF,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,aAAa,EACb,2BAA2B,GAAG,QAAQ,CACvC,GAAG;IACF,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAWF,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,kBAAkB,CAAC,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACtE,WAAW,EAAE,gBAAgB,CAAC;IAC9B,YAAY,CAAC,EAAE,0BAA0B,CAAC;CAC3C;AAED,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;kBAMjC,CAAC;AAqYZ,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC;CACpG,GAAG,SAAS,MAAM,EAAE,CAEpB;AAUD,eAAO,MAAM,mBAAmB,EACI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AA6B7D,eAAO,MAAM,mBAAmB,EACI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AA2C7D,eAAO,MAAM,iBAAiB,EACM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AA2C3D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IAEb,IAAI,EAAE,mBAAmB,CAAC;IAI1B,MAAM,EAAE,6BAA6B,CAAC;CACvC;AAED,eAAO,MAAM,2BAA2B,EAsBhC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAqBzC,MAAM,WAAW,qBAAqB;IAEpC,MAAM,EAAE,MAAM,CAAC;IAEf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,2BAA2B,EAKzB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAiFhD,eAAO,MAAM,iCAAiC,oBAAqB,CAAC;AAEpE,MAAM,MAAM,6BAA6B,GACvC,CAAC,OAAO,iCAAiC,CAAC,CAAC,MAAM,CAAC,CAAC;AASrD,eAAO,MAAM,yCAAyC,EAAG,CAAU,CAAC;AAgBpE,eAAO,MAAM,gCAAgC,GACF,CAAC;AAO5C,eAAO,MAAM,mCAAmC,EAAG,CAAU,CAAC;AAoB9D,eAAO,MAAM,uCAAuC,EAAG,CAAU,CAAC;AAMlE,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAC;IAWvB,sBAAsB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEzD,gBAAgB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEnD,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAUlB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAa1B,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACrC;AAGD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,yCAAyC,CAAC;IAChE,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAClC;AAOD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,mCAAmC,CAAC;IAC1D,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAClC;AAQD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,uCAAuC,CAAC;IAC9D,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IAQ/B,UAAU,CAAC,EAAE,0BAA0B,CAAC;IAQxC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC/C;AAOD,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;CAClC;AAED,eAAO,MAAM,gCAAgC,EA6B1B,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAqDzD,MAAM,MAAM,gBAAgB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,CAAC;AAOvB,OAAO,CAAC,MAAM,wBAAwB,EAAE,OAAO,MAAM,CAAC;AActD,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG;IACxD,QAAQ,CAAC,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC;CAC3C,CAAC;AAMF,MAAM,MAAM,2BAA2B,GAAG,oBAAoB,GAAG;IAC/D,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,QAAQ,CAAC,CAAC,wBAAwB,CAAC,CAAC,EAAE,KAAK,CAAC;CAC7C,CAAC;AA4GF,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEvE,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEvE,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAqBvE,eAAO,MAAM,sBAAsB,EAIlB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AA2B7C,eAAO,MAAM,4BAA4B,EAOzB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAsB5C,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG;IACxC,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,GAAG,SAAS,CAAC;CACpE,GACA,6BAA6B,CA4C/B;AAYD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,2BAA2B,GAChC,gBAAgB,CAGlB;AA8CD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAEpE;AASD,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,wBAAwB,CAK1B"}
+{"version":3,"file":"distribution-lock.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/distribution-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAML,kBAAkB,EAIlB,gBAAgB,EAEhB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC3B,MAAM,aAAa,CAAC;AAQrB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,eAAe,EAKhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,+BAA+B,EAU7B,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAEpD,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,6BAA6B,CAAC;CACvC;AAED,eAAO,MAAM,kCAAkC,EAKhC,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;AAEvD,MAAM,MAAM,oBAAoB,GAC5B,yBAAyB,GACzB,4BAA4B,CAAC;AAEjC,eAAO,MAAM,0BAA0B,EAGjC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAOtC,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,oBAAoB,CAAC;CAC7B;AAED,eAAO,MAAM,6BAA6B,EAM3B,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAMlD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,4BAA4B,EAK1B,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAuBjD,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,eAAe,CAAC;IACtB,WAAW,EAAE,mBAAmB,CAAC;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAED,eAAO,MAAM,2BAA2B,EASzB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAYhD,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,MAAM,GAAG,aAAa,CAAC,EAC1E,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,MAAM,GAAG,aAAa,CAAC,GACzE,MAAM,CAMR;AAsDD,eAAO,MAAM,4BAA4B,EAKvB,CAAC,CAAC,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAAC;AAM9D,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,OAAO,GACX,SAAS,qBAAqB,EAAE,CAUlC;AAwBD,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,YAAY,EAAE,qBAAqB,CAAC;CACrC;AAED,eAAO,MAAM,sBAAsB,EAcpB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AA+B3C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC;IAE1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IAEZ,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAOD,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAgB7E,eAAO,MAAM,yBAAyB,EAEvB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAS9C,eAAO,MAAM,uBAAuB,EACL,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAQ5D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IAEpB,MAAM,EAAE,WAAW,CAAC;IAEpB,SAAS,EAAE,OAAO,CAAC;IAEnB,aAAa,EAAE,kBAAkB,CAAC;IAKlC,MAAM,EAAE,eAAe,CAAC;IAExB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IAUb,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAmB5B,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAsBnD,yBAAyB,CAAC,EAAE,QAAQ,CAClC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CACjD,CAAC;IAeF,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAErC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAmCzC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IAKrC,mBAAmB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IA0BxD,gBAAgB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAqBpD,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAkB1E,aAAa,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACjD,aAAa,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAqBnD,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAAC,CAAC;IAiB9E,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC,CAAC,CAAC;IAiB5E,gBAAgB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAapD,YAAY,CAAC,EAAE,MAAM,CAAC;IA4BtB,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAE1D,WAAW,CAAC,EAAE,MAAM,CAAC;IASrB,WAAW,EAAE,MAAM,CAAC;IAMpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC,QAAQ,EAAE,aAAa,CAAC;IAExB,WAAW,EAAE,OAAO,CAAC;IAErB,aAAa,EAAE,OAAO,CAAC;IAEvB,kBAAkB,EAAE,MAAM,CAAC;IAE3B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAS7B,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAGD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,uBAAuB;;;kBAKzB,CAAC;AAOZ,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAED,eAAO,MAAM,0BAA0B;;;;;;;kBAM5B,CAAC;AAOZ,oBAAY,yBAAyB;IACnC,KAAK,UAAU;CAChB;AAYD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpE;AAaD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,yBAAyB,EAAE,CAAC;CAC1C;AAED,eAAO,MAAM,2BAA2B;;;kBAU7B,CAAC;AAUZ,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EACtB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAAC,GAC1D,SAAS,CAAC;IACd,QAAQ,CAAC,eAAe,CAAC,EACrB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC,CAAC,GACzD,SAAS,CAAC;CACf,GAAG,qBAAqB,EAAE,CAS1B;AAGD,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,yBAAyB,EAAE,CAAC;IAEzC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjD;AAiBD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE;IACJ,QAAQ,CAAC,MAAM,EAAE,SAAS;QACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,qBAAqB,EAAE,GAAG,SAAS,CAAC;KAC1E,EAAE,CAAC;CACL,EACD,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,iBAAiB,CAAC,GAC/D,MAAM,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,CA+C3C;AAOD,eAAO,MAAM,2BAA2B;;;oBAA2B,CAAC;AACpE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAGhF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAE9E;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkBD,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,WAAW,EACT,cAAc,GACd,kBAAkB,GAClB,qBAAqB,GACrB,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,iBAAiB,GACjB,kBAAkB,GAClB,cAAc,GACd,cAAc,CACjB,CAAC;AAYF,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,aAAa,EACb,2BAA2B,GAAG,QAAQ,CACvC,GAAG;IACF,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAWF,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,kBAAkB,CAAC,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACtE,WAAW,EAAE,gBAAgB,CAAC;IAC9B,YAAY,CAAC,EAAE,0BAA0B,CAAC;CAC3C;AAED,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;kBAMjC,CAAC;AAscZ,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC;CACpG,GAAG,SAAS,MAAM,EAAE,CAEpB;AAUD,eAAO,MAAM,mBAAmB,EACI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AA6B7D,eAAO,MAAM,mBAAmB,EACI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AA4C7D,eAAO,MAAM,iBAAiB,EACM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AA6C3D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IAEb,IAAI,EAAE,mBAAmB,CAAC;IAI1B,MAAM,EAAE,6BAA6B,CAAC;CACvC;AAED,eAAO,MAAM,2BAA2B,EAsBhC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAqBzC,MAAM,WAAW,qBAAqB;IAEpC,MAAM,EAAE,MAAM,CAAC;IAEf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,2BAA2B,EAKzB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAiFhD,eAAO,MAAM,iCAAiC,oBAAqB,CAAC;AAEpE,MAAM,MAAM,6BAA6B,GACvC,CAAC,OAAO,iCAAiC,CAAC,CAAC,MAAM,CAAC,CAAC;AAOrD,eAAO,MAAM,yCAAyC,EAAG,CAAU,CAAC;AAcpE,eAAO,MAAM,gCAAgC,GACF,CAAC;AAO5C,eAAO,MAAM,mCAAmC,EAAG,CAAU,CAAC;AAoB9D,eAAO,MAAM,uCAAuC,EAAG,CAAU,CAAC;AAMlE,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAC;IAWvB,sBAAsB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEzD,gBAAgB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEnD,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAUlB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAa1B,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACrC;AAGD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,yCAAyC,CAAC;IAChE,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAClC;AAOD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,mCAAmC,CAAC;IAC1D,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAClC;AAQD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,uCAAuC,CAAC;IAC9D,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IAQ/B,UAAU,CAAC,EAAE,0BAA0B,CAAC;IAQxC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC/C;AAOD,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;CAClC;AAED,eAAO,MAAM,gCAAgC,EA6B1B,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAqDzD,MAAM,MAAM,gBAAgB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,CAAC;AAOvB,OAAO,CAAC,MAAM,wBAAwB,EAAE,OAAO,MAAM,CAAC;AActD,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG;IACxD,QAAQ,CAAC,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC;CAC3C,CAAC;AAMF,MAAM,MAAM,2BAA2B,GAAG,oBAAoB,GAAG;IAC/D,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,QAAQ,CAAC,CAAC,wBAAwB,CAAC,CAAC,EAAE,KAAK,CAAC;CAC7C,CAAC;AA8KF,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEvE,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEvE,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAqBvE,eAAO,MAAM,sBAAsB,EAIlB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AA2B7C,eAAO,MAAM,4BAA4B,EAOzB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAmB5C,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG;IACxC,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,GAAG,SAAS,CAAC;CACpE,GACA,6BAA6B,CAY/B;AASD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,2BAA2B,GAChC,gBAAgB,CAGlB;AA8CD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAEpE;AASD,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,wBAAwB,CAK1B"}

package/dist/distribution/lib/distribution-lock.js

@@ -1,8 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DistributionLockReaderSchema = exports.DistributionLockSchema = exports.DistributionLockV4Schema = exports.DistributionLockV3Schema = exports.DistributionLockV2Schema = exports.DistributionLockResolutionSchema = exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_LATEST = exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_V3 = exports.DISTRIBUTION_LOCK_SCHEMA_VERSION = exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_BASELINE = exports.DISTRIBUTION_LOCK_SCHEMA_VERSIONS = exports.CapabilityDomainOwnerSchema = exports.LockedPlatformServiceSchema = exports.LockedBiomeSchema = exports.LockedBiomeV3Schema = exports.LockedBiomeV2Schema = exports.LockedServiceProcessFactsSchema = exports.LockedWorkerTaskQueueSchema = exports.LockedWorkflowClientSchema = exports.LockedWorkerImageSchema = exports.LockedBiomeSourceSchema = exports.LockedBiomeSourceV2Schema = exports.LockedHostModuleSchema = exports.LockedServiceResourcesSchema = exports.LockedServiceResourceSchema = exports.LockedResourceProviderSchema = exports.LockedServiceDependencySchema = exports.ServiceOwnerIdentitySchema = exports.PlatformServiceOwnerIdentitySchema = exports.BiomeServiceOwnerIdentitySchema = void 0;
+exports.DistributionLockReaderSchema = exports.DistributionLockSchema = exports.DistributionLockV4Schema = exports.DistributionLockV3Schema = exports.DistributionLockV2Schema = exports.DistributionLockResolutionSchema = exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_LATEST = exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_V3 = exports.DISTRIBUTION_LOCK_SCHEMA_VERSION = exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_BASELINE = exports.DISTRIBUTION_LOCK_SCHEMA_VERSIONS = exports.CapabilityDomainOwnerSchema = exports.LockedPlatformServiceSchema = exports.LockedBiomeSchema = exports.LockedBiomeV3Schema = exports.LockedBiomeV2Schema = exports.LockedServiceProcessFactsSchema = exports.LockedWorkerTaskQueueSchema = exports.LockedWorkflowSubjectSchema = exports.WorkflowSubjectPermission = exports.LockedWorkflowClientSchema = exports.LockedWorkerImageSchema = exports.LockedBiomeSourceSchema = exports.LockedBiomeSourceV2Schema = exports.LockedHostModuleSchema = exports.LockedServiceResourcesSchema = exports.LockedServiceResourceSchema = exports.LockedResourceProviderSchema = exports.LockedServiceDependencySchema = exports.ServiceOwnerIdentitySchema = exports.PlatformServiceOwnerIdentitySchema = exports.BiomeServiceOwnerIdentitySchema = void 0;
 exports.compareLockedServiceResources = compareLockedServiceResources;
 exports.parseLockedServiceResources = parseLockedServiceResources;
+exports.controllerTokenServiceAccount = controllerTokenServiceAccount;
+exports.deriveWorkflowSubjects = deriveWorkflowSubjects;
+exports.resolveWorkflowSubjects = resolveWorkflowSubjects;
 exports.lockedWorkerTaskQueueName = lockedWorkerTaskQueueName;
 exports.lockedVersionedWorkers = lockedVersionedWorkers;
 exports.distributionLockSchemaVersionFor = distributionLockSchemaVersionFor;
@@ -13,6 +16,8 @@ const zod_1 = require("zod");
 const biome_1 = require("../../biome");
 const capability_1 = require("../../capability");
 const execution_target_1 = require("../../execution-target");
+const deployment_1 = require("../../deployment");
+const process_topology_1 = require("../../process-topology");
 const resource_requirement_1 = require("../../resource-requirement");
 const distribution_1 = require("./distribution");
 const biome_closure_1 = require("./biome-closure");
@@ -158,10 +163,90 @@ exports.LockedWorkerImageSchema = zod_1.z
     .strict();
 exports.LockedWorkflowClientSchema = zod_1.z
     .object({
+    biome: biome_1.BiomeIdSchema.optional(),
     component: zod_1.z.string().min(1),
     taskQueue: execution_target_1.WorkerTaskQueueRefSchema,
 })
     .strict();
+var WorkflowSubjectPermission;
+(function (WorkflowSubjectPermission) {
+    WorkflowSubjectPermission["Write"] = "write";
+})(WorkflowSubjectPermission || (exports.WorkflowSubjectPermission = WorkflowSubjectPermission = {}));
+const CONTROLLER_TOKEN_SERVICE_ACCOUNT_SUFFIX = '-controller-token';
+function controllerTokenServiceAccount(worker) {
+    return `${worker}${CONTROLLER_TOKEN_SERVICE_ACCOUNT_SUFFIX}`;
+}
+exports.LockedWorkflowSubjectSchema = zod_1.z
+    .object({
+    component: zod_1.z.string().min(1),
+    permissions: zod_1.z
+        .array(zod_1.z.nativeEnum(WorkflowSubjectPermission))
+        .min(1)
+        .refine((permissions) => new Set(permissions).size === permissions.length, {
+        message: 'must not name a permission twice',
+    }),
+})
+    .strict();
+function deriveWorkflowSubjects(biome) {
+    const components = new Set([
+        ...Object.keys(biome.workerTaskQueues ?? {}),
+        ...Object.keys(biome.workflowClients ?? {}),
+    ]);
+    return [...components].sort(codeUnitOrder).map((component) => ({
+        component,
+        permissions: [WorkflowSubjectPermission.Write],
+    }));
+}
+function resolveWorkflowSubjects(lock, resolved) {
+    const domainOf = new Map(resolved.biomes.map((biome) => [biome.id, biome.trustDomain]));
+    const accountsOf = new Map();
+    for (const account of resolved.serviceAccounts) {
+        for (const { biome, component } of account.actsFor) {
+            const key = `${biome}/${component}`;
+            accountsOf.set(key, [...(accountsOf.get(key) ?? []), account.name]);
+        }
+    }
+    const byDomain = new Map();
+    for (const biome of lock.biomes) {
+        const subjects = biome.workflowSubjects ?? [];
+        if (subjects.length === 0)
+            continue;
+        const domain = domainOf.get(biome.id);
+        if (domain === undefined) {
+            throw new Error(`resolveWorkflowSubjects: the resolved deployment places no biome "${biome.id}"; it was not resolved from this lock`);
+        }
+        const rows = byDomain.get(domain) ?? new Map();
+        for (const subject of subjects) {
+            for (const serviceAccount of accountsOf.get(`${biome.id}/${subject.component}`) ?? []) {
+                const row = rows.get(serviceAccount) ?? { serviceAccount, permissions: [], actsFor: [] };
+                for (const permission of subject.permissions) {
+                    if (!row.permissions.includes(permission))
+                        row.permissions.push(permission);
+                }
+                row.actsFor.push({ biome: biome.id, component: subject.component });
+                rows.set(serviceAccount, row);
+            }
+        }
+        byDomain.set(domain, rows);
+    }
+    const result = {};
+    for (const domain of [...byDomain.keys()].sort(codeUnitOrder)) {
+        const rows = [...byDomain.get(domain).values()];
+        if (rows.length === 0)
+            continue;
+        result[domain] = rows
+            .map((row) => ({
+            serviceAccount: row.serviceAccount,
+            permissions: [...row.permissions].sort(codeUnitOrder),
+            actsFor: [...row.actsFor].sort((a, b) => codeUnitOrder(a.biome, b.biome) || codeUnitOrder(a.component, b.component)),
+        }))
+            .sort((a, b) => codeUnitOrder(a.serviceAccount, b.serviceAccount));
+    }
+    return result;
+}
+function codeUnitOrder(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
 exports.LockedWorkerTaskQueueSchema = execution_target_1.WorkerTaskQueueRefSchema;
 function lockedWorkerTaskQueueName(queue) {
     return (0, execution_target_1.workerTaskQueueRefDeclaration)(queue).name;
@@ -321,6 +406,8 @@ const refineLockedBiomeResources = (value, context) => {
     (0, resolve_nexus_bindings_1.refineLockedNexusFacts)(value, context);
     refineLockedWorkerTaskQueues(value, context);
     refineLockedWorkflowClients(value, context);
+    refineLockedWorkflowSubjects(value, context);
+    refineLockedTrustCeiling(value, context);
     refineLockedWorkerImages(value, context);
 };
 const refineLockedWorkerImages = (value, context) => {
@@ -414,7 +501,7 @@ const refineLockedWorkflowClients = (value, context) => {
         clients.forEach((client, index) => {
             const clientQueue = (0, execution_target_1.workerTaskQueueRefDeclaration)(client.taskQueue);
             const clientQueueKey = (0, execution_target_1.workerTaskQueueKey)(clientQueue);
-            const pair = `${client.component}:${clientQueueKey}`;
+            const pair = `${client.biome ?? value.id}/${client.component}:${clientQueueKey}`;
             if (seen.has(pair)) {
                 context.addIssue({
                     code: zod_1.z.ZodIssueCode.custom,
@@ -423,6 +510,8 @@ const refineLockedWorkflowClients = (value, context) => {
                 });
             }
             seen.add(pair);
+            if (client.biome !== undefined && client.biome !== value.id)
+                return;
             const queues = Object.prototype.hasOwnProperty.call(workerQueues, client.component)
                 ? workerQueues[client.component]
                 : undefined;
@@ -443,6 +532,42 @@ const refineLockedWorkflowClients = (value, context) => {
         });
     }
 };
+const refineLockedWorkflowSubjects = (value, context) => {
+    const stated = value.workflowSubjects;
+    if (stated === undefined)
+        return;
+    if (stated.length === 0) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['workflowSubjects'],
+            message: 'must be omitted when empty',
+        });
+        return;
+    }
+    const expected = deriveWorkflowSubjects(value);
+    const render = (row) => row === undefined ? '(none)' : JSON.stringify(row);
+    for (let index = 0; index < Math.max(stated.length, expected.length); index += 1) {
+        if (render(stated[index]) !== render(expected[index])) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['workflowSubjects', index],
+                message: `differs from the subjects derived from biome "${value.id}": stated ${render(stated[index])}, derived ${render(expected[index])}`,
+            });
+            return;
+        }
+    }
+};
+const refineLockedTrustCeiling = (value, context) => {
+    if (value.trustCeiling === undefined || value.origin === undefined)
+        return;
+    if (value.trustCeiling === (0, process_topology_1.defaultTrustDomain)(value.id, value.origin)) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['trustCeiling'],
+            message: `"${value.trustCeiling}" is biome "${value.id}"'s default domain; the writer omits it`,
+        });
+    }
+};
 function lockedVersionedWorkers(biome) {
     return Object.keys(biome.workerTaskQueues ?? {}).sort();
 }
@@ -490,10 +615,11 @@ const lockedBiomeV4Shape = {
         .record(zod_1.z.string().min(1), zod_1.z.array(exports.LockedWorkflowClientSchema).min(1).readonly())
         .readonly()
         .optional(),
+    workflowSubjects: zod_1.z.array(exports.LockedWorkflowSubjectSchema).readonly().optional(),
+    trustCeiling: deployment_1.TrustDomainNameSchema.optional(),
     workerImages: zod_1.z
         .record(zod_1.z.string().min(1), exports.LockedWorkerImageSchema)
-        .readonly()
-        .optional(),
+        .readonly(),
 };
 const lockedBiomeV4Object = zod_1.z
     .object(lockedBiomeV4Shape)
@@ -517,6 +643,7 @@ const readerLockedBiomeV4Object = zod_1.z
         .array(ReaderLockedServiceResourceSchema)
         .readonly()
         .optional(),
+    workerImages: lockedBiomeV4Shape.workerImages.optional(),
 })
     .superRefine(refineLockedBiome);
 exports.LockedPlatformServiceSchema = zod_1.z
@@ -651,6 +778,46 @@ const refineResourceProviders = (lock, context) => {
         });
     });
 };
+const refineCrossBiomeWorkflowClients = (lock, context) => {
+    const byId = new Map(lock.biomes.map((biome) => [biome.id, biome]));
+    lock.biomes.forEach((biome, biomeIndex) => {
+        for (const [name, clients] of Object.entries(biome.workflowClients ?? {})) {
+            clients.forEach((client, index) => {
+                if (client.biome === undefined || client.biome === biome.id)
+                    return;
+                const path = ['biomes', biomeIndex, 'workflowClients', name, index];
+                const target = byId.get(client.biome);
+                if (target === undefined) {
+                    context.addIssue({
+                        code: zod_1.z.ZodIssueCode.custom,
+                        path: [...path, 'biome'],
+                        message: `names biome "${client.biome}", which this lock does not ship`,
+                    });
+                    return;
+                }
+                const queues = Object.prototype.hasOwnProperty.call(target.workerTaskQueues ?? {}, client.component)
+                    ? target.workerTaskQueues?.[client.component]
+                    : undefined;
+                if (queues === undefined) {
+                    context.addIssue({
+                        code: zod_1.z.ZodIssueCode.custom,
+                        path: [...path, 'component'],
+                        message: `"${client.component}" is not a worker/v2 of biome "${client.biome}" — it has no workerTaskQueues entry`,
+                    });
+                    return;
+                }
+                const wanted = (0, execution_target_1.workerTaskQueueRefDeclaration)(client.taskQueue);
+                if (!queues.some((queue) => (0, execution_target_1.sameWorkerTaskQueue)((0, execution_target_1.workerTaskQueueRefDeclaration)(queue), wanted))) {
+                    context.addIssue({
+                        code: zod_1.z.ZodIssueCode.custom,
+                        path: [...path, 'taskQueue'],
+                        message: `task queue "${(0, execution_target_1.workerTaskQueueKey)(wanted)}" is not one worker "${client.component}" of biome "${client.biome}" polls`,
+                    });
+                }
+            });
+        }
+    });
+};
 const distributionLockV4Object = zod_1.z
     .object({
     schemaVersion: zod_1.z.literal(exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_LATEST),
@@ -663,7 +830,8 @@ const distributionLockV4Object = zod_1.z
     .superRefine(refineResourceProviders)
     .superRefine(refineResolutionCoverage)
     .superRefine(nexus_binding_1.refineNexusBindings)
-    .superRefine(resolve_nexus_bindings_1.refineNexusBindingsAgreeWithFacts);
+    .superRefine(resolve_nexus_bindings_1.refineNexusBindingsAgreeWithFacts)
+    .superRefine(refineCrossBiomeWorkflowClients);
 const readerDistributionLockV2Object = zod_1.z.looseObject({
     schemaVersion: zod_1.z.literal(exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_BASELINE),
     biomes: zod_1.z.array(readerLockedBiomeV2Object).readonly(),
@@ -695,35 +863,15 @@ exports.DistributionLockReaderSchema = zod_1.z.discriminatedUnion('schemaVersion
     readerDistributionLockV4Object,
 ]);
 function distributionLockSchemaVersionFor(body) {
-    if (body.resolution !== undefined ||
-        (body.nexusBindings !== undefined && body.nexusBindings.length > 0)) {
-        return exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_LATEST;
-    }
-    if (body.biomes.some((biome) => biome.bundleSource !== undefined ||
-        (biome.serviceResources !== undefined &&
-            biome.serviceResources.length > 0) ||
-        (biome.serviceProcessFacts !== undefined &&
-            Object.keys(biome.serviceProcessFacts).length > 0) ||
-        (biome.nexusProvides !== undefined && biome.nexusProvides.length > 0) ||
-        (biome.nexusRequires !== undefined && biome.nexusRequires.length > 0) ||
-        (biome.workerTaskQueues !== undefined &&
-            Object.keys(biome.workerTaskQueues).length > 0) ||
-        (biome.workflowClients !== undefined &&
-            Object.keys(biome.workflowClients).length > 0) ||
-        (biome.workerImages !== undefined &&
-            Object.keys(biome.workerImages).length > 0))) {
-        return exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_LATEST;
-    }
-    for (const biome of body.biomes) {
-        const extensions = biome.serviceDatabaseExtensions;
-        if (extensions !== undefined && Object.keys(extensions).length > 0) {
-            return exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_V3;
-        }
-        if (biome.source?.imageNamePrefix !== undefined) {
-            return exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_V3;
-        }
+    const silent = body.biomes
+        .filter((biome) => biome.workerImages === undefined)
+        .map((biome) => biome.id);
+    if (silent.length > 0) {
+        throw new Error(`distribution lock biome(s) ${silent.join(', ')} state no workerImages: a ` +
+            `producer states every biome's shared-image workers, {} when it has none, ` +
+            `so that an absent field can never read as "no workers"`);
     }
-    return exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_BASELINE;
+    return exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_LATEST;
 }
 function sealDistributionLock(body) {
     const schemaVersion = distributionLockSchemaVersionFor(body);