npm - @xemahq/contracts - Versions diffs - 0.70.0 → 0.71.0 - Mend

@xemahq/contracts 0.70.0 → 0.71.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (74) hide show

package/dist/deployment/lib/trust-partition.d.ts ADDED Viewed

@@ -0,0 +1,28 @@
+export declare enum TrustPartitionViolationCode {
+    UnknownBiome = "unknown-biome",
+    ExceedsCeiling = "exceeds-ceiling",
+    IdentitySpansTrustDomains = "identity-spans-trust-domains",
+    DuplicateIdentity = "duplicate-identity",
+    UnplacedIdentityBiome = "unplaced-identity-biome"
+}
+export interface TrustPartitionViolation {
+    readonly code: TrustPartitionViolationCode;
+    readonly domain?: string;
+    readonly serviceAccount?: string;
+    readonly message: string;
+}
+export interface PartitionedBiome {
+    readonly id: string;
+    readonly trustCeiling: string;
+    readonly trustDomain: string;
+}
+export declare function gradeTrustRefinement(biomes: readonly PartitionedBiome[]): TrustPartitionViolation[];
+export interface EnforcementIdentity {
+    readonly serviceAccount: string;
+    readonly actsFor: readonly {
+        readonly biome: string;
+        readonly component: string;
+    }[];
+}
+export declare function gradeEnforcementIdentities(identities: readonly EnforcementIdentity[], domainOf: Readonly<Record<string, string>>): TrustPartitionViolation[];
+//# sourceMappingURL=trust-partition.d.ts.map

package/dist/deployment/lib/trust-partition.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"trust-partition.d.ts","sourceRoot":"","sources":["../../../src/deployment/lib/trust-partition.ts"],"names":[],"mappings":"AAmBA,oBAAY,2BAA2B;IAErC,YAAY,kBAAkB;IAE9B,cAAc,oBAAoB;IAElC,yBAAyB,iCAAiC;IAE1D,iBAAiB,uBAAuB;IAExC,qBAAqB,4BAA4B;CAClD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAE3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAEjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AASD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAClC,uBAAuB,EAAE,CA2B3B;AAGD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACrF;AAaD,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,SAAS,mBAAmB,EAAE,EAC1C,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACzC,uBAAuB,EAAE,CAkD3B"}

package/dist/deployment/lib/trust-partition.js ADDED Viewed

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustPartitionViolationCode = void 0;
+exports.gradeTrustRefinement = gradeTrustRefinement;
+exports.gradeEnforcementIdentities = gradeEnforcementIdentities;
+var TrustPartitionViolationCode;
+(function (TrustPartitionViolationCode) {
+    TrustPartitionViolationCode["UnknownBiome"] = "unknown-biome";
+    TrustPartitionViolationCode["ExceedsCeiling"] = "exceeds-ceiling";
+    TrustPartitionViolationCode["IdentitySpansTrustDomains"] = "identity-spans-trust-domains";
+    TrustPartitionViolationCode["DuplicateIdentity"] = "duplicate-identity";
+    TrustPartitionViolationCode["UnplacedIdentityBiome"] = "unplaced-identity-biome";
+})(TrustPartitionViolationCode || (exports.TrustPartitionViolationCode = TrustPartitionViolationCode = {}));
+function gradeTrustRefinement(biomes) {
+    const ceilingsOf = new Map();
+    for (const biome of biomes) {
+        const ceilings = ceilingsOf.get(biome.trustDomain) ?? new Map();
+        const members = ceilings.get(biome.trustCeiling) ?? [];
+        members.push(biome.id);
+        ceilings.set(biome.trustCeiling, members);
+        ceilingsOf.set(biome.trustDomain, ceilings);
+    }
+    const violations = [];
+    for (const domain of [...ceilingsOf.keys()].sort(codeUnit)) {
+        const ceilings = ceilingsOf.get(domain);
+        if (ceilings.size <= 1)
+            continue;
+        const summary = [...ceilings.entries()]
+            .map(([ceiling, members]) => `${ceiling} (${[...members].sort(codeUnit).join(', ')})`)
+            .sort(codeUnit)
+            .join(' and ');
+        violations.push({
+            code: TrustPartitionViolationCode.ExceedsCeiling,
+            domain,
+            message: `trust domain "${domain}" holds biomes of ${ceilings.size} edition ceiling domains: ${summary}. ` +
+                `A deployment may only split an edition's trust domains, never merge them; to let these biomes ` +
+                `share a domain, the edition must group them in its trustCeiling.`,
+        });
+    }
+    return violations;
+}
+function gradeEnforcementIdentities(identities, domainOf) {
+    const violations = [];
+    const seen = new Set();
+    for (const identity of identities) {
+        if (seen.has(identity.serviceAccount)) {
+            violations.push({
+                code: TrustPartitionViolationCode.DuplicateIdentity,
+                serviceAccount: identity.serviceAccount,
+                message: `ServiceAccount "${identity.serviceAccount}" is listed twice; list it once with every ` +
+                    `component it acts for, since a boundary sees one identity.`,
+            });
+            continue;
+        }
+        seen.add(identity.serviceAccount);
+        const domains = new Map();
+        for (const { biome, component } of identity.actsFor) {
+            const domain = Object.prototype.hasOwnProperty.call(domainOf, biome)
+                ? domainOf[biome]
+                : undefined;
+            if (domain === undefined) {
+                violations.push({
+                    code: TrustPartitionViolationCode.UnplacedIdentityBiome,
+                    serviceAccount: identity.serviceAccount,
+                    message: `ServiceAccount "${identity.serviceAccount}" acts for ${biome}/${component}, ` +
+                        `but the partition places no biome "${biome}".`,
+                });
+                continue;
+            }
+            const members = domains.get(domain) ?? [];
+            members.push(`${biome}/${component}`);
+            domains.set(domain, members);
+        }
+        if (domains.size > 1) {
+            const summary = [...domains.entries()]
+                .map(([domain, members]) => `${domain} (${members.sort(codeUnit).join(', ')})`)
+                .sort(codeUnit)
+                .join(' and ');
+            violations.push({
+                code: TrustPartitionViolationCode.IdentitySpansTrustDomains,
+                serviceAccount: identity.serviceAccount,
+                message: `ServiceAccount "${identity.serviceAccount}" acts for components of ${domains.size} trust ` +
+                    `domains: ${summary}. One account is one identity at every boundary, so these domains ` +
+                    `are not separate; run the components under separate accounts or place them in one domain.`,
+            });
+        }
+    }
+    return violations;
+}
+function codeUnit(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+//# sourceMappingURL=trust-partition.js.map

package/dist/deployment/lib/trust-partition.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"trust-partition.js","sourceRoot":"","sources":["../../../src/deployment/lib/trust-partition.ts"],"names":[],"mappings":";;;AA0DA,oDA6BC;AAmBD,gEAqDC;AA5ID,IAAY,2BAWX;AAXD,WAAY,2BAA2B;IAErC,6DAA8B,CAAA;IAE9B,iEAAkC,CAAA;IAElC,yFAA0D,CAAA;IAE1D,uEAAwC,CAAA;IAExC,gFAAiD,CAAA;AACnD,CAAC,EAXW,2BAA2B,2CAA3B,2BAA2B,QAWtC;AA4BD,SAAgB,oBAAoB,CAClC,MAAmC;IAEnC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,GAAG,EAAoB,CAAC;QAClF,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC1C,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,UAAU,GAA8B,EAAE,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAA0B,CAAC;QACjE,IAAI,QAAQ,CAAC,IAAI,IAAI,CAAC;YAAE,SAAS;QACjC,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;aACrF,IAAI,CAAC,QAAQ,CAAC;aACd,IAAI,CAAC,OAAO,CAAC,CAAC;QACjB,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,2BAA2B,CAAC,cAAc;YAChD,MAAM;YACN,OAAO,EACL,iBAAiB,MAAM,qBAAqB,QAAQ,CAAC,IAAI,6BAA6B,OAAO,IAAI;gBACjG,gGAAgG;gBAChG,kEAAkE;SACrE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAmBD,SAAgB,0BAA0B,CACxC,UAA0C,EAC1C,QAA0C;IAE1C,MAAM,UAAU,GAA8B,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,2BAA2B,CAAC,iBAAiB;gBACnD,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,OAAO,EACL,mBAAmB,QAAQ,CAAC,cAAc,6CAA6C;oBACvF,4DAA4D;aAC/D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,KAAK,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;gBAClE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACjB,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,2BAA2B,CAAC,qBAAqB;oBACvD,cAAc,EAAE,QAAQ,CAAC,cAAc;oBACvC,OAAO,EACL,mBAAmB,QAAQ,CAAC,cAAc,cAAc,KAAK,IAAI,SAAS,IAAI;wBAC9E,sCAAsC,KAAK,IAAI;iBAClD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;iBACnC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;iBAC9E,IAAI,CAAC,QAAQ,CAAC;iBACd,IAAI,CAAC,OAAO,CAAC,CAAC;YACjB,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,2BAA2B,CAAC,yBAAyB;gBAC3D,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,OAAO,EACL,mBAAmB,QAAQ,CAAC,cAAc,4BAA4B,OAAO,CAAC,IAAI,SAAS;oBAC3F,YAAY,OAAO,oEAAoE;oBACvF,2FAA2F;aAC9F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC"}

package/dist/distribution/index.d.ts CHANGED Viewed

@@ -17,4 +17,5 @@ export * from './lib/nexus-binding';
 export * from './lib/resolve-nexus-bindings';
 export * from './lib/nexus-endpoint-specs';
 export * from './lib/lock-consumers';
+export * from './lib/verify-resolved-deployment';
 //# sourceMappingURL=index.d.ts.map

package/dist/distribution/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/distribution/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,kCAAkC,CAAC;AACjD,cAAc,sCAAsC,CAAC;AACrD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/distribution/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,kCAAkC,CAAC;AACjD,cAAc,sCAAsC,CAAC;AACrD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kCAAkC,CAAC"}

package/dist/distribution/index.js CHANGED Viewed

@@ -33,4 +33,5 @@ __exportStar(require("./lib/nexus-binding"), exports);
 __exportStar(require("./lib/resolve-nexus-bindings"), exports);
 __exportStar(require("./lib/nexus-endpoint-specs"), exports);
 __exportStar(require("./lib/lock-consumers"), exports);
+__exportStar(require("./lib/verify-resolved-deployment"), exports);
 //# sourceMappingURL=index.js.map

package/dist/distribution/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/distribution/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,8DAA4C;AAC5C,+DAA6C;AAC7C,qDAAmC;AACnC,2DAAyC;AACzC,sDAAoC;AACpC,0DAAwC;AACxC,mDAAiC;AACjC,gEAA8C;AAC9C,kEAAgD;AAChD,sEAAoD;AACpD,mEAAiD;AACjD,uEAAqD;AACrD,+DAA6C;AAC7C,qDAAmC;AACnC,sDAAoC;AACpC,+DAA6C;AAC7C,6DAA2C;AAC3C,uDAAqC"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/distribution/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,8DAA4C;AAC5C,+DAA6C;AAC7C,qDAAmC;AACnC,2DAAyC;AACzC,sDAAoC;AACpC,0DAAwC;AACxC,mDAAiC;AACjC,gEAA8C;AAC9C,kEAAgD;AAChD,sEAAoD;AACpD,mEAAiD;AACjD,uEAAqD;AACrD,+DAA6C;AAC7C,qDAAmC;AACnC,sDAAoC;AACpC,+DAA6C;AAC7C,6DAA2C;AAC3C,uDAAqC;AACrC,mEAAiD"}

package/dist/distribution/lib/distribution-lock.d.ts CHANGED Viewed

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { BiomeComponentKind, BiomeScalingMode, type BiomeComponentProcessFacts, type PostgresExtensionName, type BiomeTier, type BiomeTarget, type BiomeOrigin, type BiomeAudience, type BiomeBundleSourceSpec } from '../../biome';
+import { type ResolvedDeployment } from '../../deployment';
 import { type ResourceInclusion, type ResourceKindRef, type ResourceLogicalName, type ResourceScope } from '../../resource-requirement';
 import { type PlatformServiceTier } from './distribution';
 import { type ClosureEntry } from './biome-closure';
@@ -98,6 +99,8 @@ export interface LockedBiome {
     nexusRequires?: readonly NexusServiceRequirement[];
     workerTaskQueues?: Readonly<Record<string, readonly LockedWorkerTaskQueue[]>>;
     workflowClients?: Readonly<Record<string, readonly LockedWorkflowClient[]>>;
+    workflowSubjects?: readonly LockedWorkflowSubject[];
+    trustCeiling?: string;
     workerImages: Readonly<Record<string, LockedWorkerImage>>;
     imageDigest?: string;
     displayName: string;
@@ -120,16 +123,48 @@ export declare const LockedWorkerImageSchema: z.ZodObject<{
     entry: z.ZodString;
 }, z.core.$strict>;
 export interface LockedWorkflowClient {
+    biome?: string | undefined;
     component: string;
     taskQueue: LockedWorkerTaskQueue;
 }
 export declare const LockedWorkflowClientSchema: z.ZodObject<{
+    biome: z.ZodOptional<z.ZodString>;
     component: z.ZodString;
     taskQueue: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
         name: z.ZodEnum<typeof import("../../workflow").TaskQueueName>;
         placement: z.ZodEnum<typeof import("../../execution-target").TaskQueuePlacement>;
     }, z.core.$strict>]>;
 }, z.core.$strict>;
+export declare enum WorkflowSubjectPermission {
+    Write = "write"
+}
+export declare function controllerTokenServiceAccount(worker: string): string;
+export interface LockedWorkflowSubject {
+    component: string;
+    permissions: WorkflowSubjectPermission[];
+}
+export declare const LockedWorkflowSubjectSchema: z.ZodObject<{
+    component: z.ZodString;
+    permissions: z.ZodArray<z.ZodEnum<typeof WorkflowSubjectPermission>>;
+}, z.core.$strict>;
+export declare function deriveWorkflowSubjects(biome: {
+    readonly workerTaskQueues?: Readonly<Record<string, readonly LockedWorkerTaskQueue[]>> | undefined;
+    readonly workflowClients?: Readonly<Record<string, readonly LockedWorkflowClient[]>> | undefined;
+}): LockedWorkflowSubject[];
+export interface ResolvedWorkflowSubject {
+    serviceAccount: string;
+    permissions: WorkflowSubjectPermission[];
+    actsFor: {
+        biome: string;
+        component: string;
+    }[];
+}
+export declare function resolveWorkflowSubjects(lock: {
+    readonly biomes: readonly {
+        readonly id: string;
+        readonly workflowSubjects?: readonly LockedWorkflowSubject[] | undefined;
+    }[];
+}, resolved: Pick<ResolvedDeployment, 'biomes' | 'serviceAccounts'>): Record<string, ResolvedWorkflowSubject[]>;
 export declare const LockedWorkerTaskQueueSchema: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
     name: z.ZodEnum<typeof import("../../workflow").TaskQueueName>;
     placement: z.ZodEnum<typeof import("../../execution-target").TaskQueuePlacement>;
@@ -142,7 +177,7 @@ export interface LockedBiomeDisplay {
     summary?: string;
     accent?: string;
 }
-export type LockedBiomeV3 = Omit<LockedBiome, 'bundleSource' | 'serviceResources' | 'serviceProcessFacts' | 'nexusProvides' | 'nexusRequires' | 'workerTaskQueues' | 'workflowClients' | 'workerImages'>;
+export type LockedBiomeV3 = Omit<LockedBiome, 'bundleSource' | 'serviceResources' | 'serviceProcessFacts' | 'nexusProvides' | 'nexusRequires' | 'workerTaskQueues' | 'workflowClients' | 'workflowSubjects' | 'trustCeiling' | 'workerImages'>;
 export type LockedBiomeV2 = Omit<LockedBiomeV3, 'serviceDatabaseExtensions' | 'source'> & {
     source?: LockedBiomeSourceV2;
 };

package/dist/distribution/lib/distribution-lock.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"distribution-lock.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/distribution-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAML,kBAAkB,~~EAGlB~~,gBAAgB,EAEhB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC3B,MAAM,aAAa,CAAC;AAQrB,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,eAAe,EAKhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,+BAA+B,EAU7B,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAEpD,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,6BAA6B,CAAC;CACvC;AAED,eAAO,MAAM,kCAAkC,EAKhC,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;AAEvD,MAAM,MAAM,oBAAoB,GAC5B,yBAAyB,GACzB,4BAA4B,CAAC;AAEjC,eAAO,MAAM,0BAA0B,EAGjC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAOtC,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,oBAAoB,CAAC;CAC7B;AAED,eAAO,MAAM,6BAA6B,EAM3B,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAMlD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,4BAA4B,EAK1B,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAuBjD,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,eAAe,CAAC;IACtB,WAAW,EAAE,mBAAmB,CAAC;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAED,eAAO,MAAM,2BAA2B,EASzB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAYhD,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,MAAM,GAAG,aAAa,CAAC,EAC1E,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,MAAM,GAAG,aAAa,CAAC,GACzE,MAAM,CAMR;AAsDD,eAAO,MAAM,4BAA4B,EAKvB,CAAC,CAAC,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAAC;AAM9D,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,OAAO,GACX,SAAS,qBAAqB,EAAE,CAUlC;AAwBD,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,YAAY,EAAE,qBAAqB,CAAC;CACrC;AAED,eAAO,MAAM,sBAAsB,EAcpB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AA+B3C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC;IAE1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IAEZ,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAOD,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAgB7E,eAAO,MAAM,yBAAyB,EAEvB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAS9C,eAAO,MAAM,uBAAuB,EACL,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAQ5D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IAEpB,MAAM,EAAE,WAAW,CAAC;IAEpB,SAAS,EAAE,OAAO,CAAC;IAEnB,aAAa,EAAE,kBAAkB,CAAC;IAKlC,MAAM,EAAE,eAAe,CAAC;IAExB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IAUb,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAmB5B,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAsBnD,yBAAyB,CAAC,EAAE,QAAQ,CAClC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CACjD,CAAC;IAeF,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAErC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAmCzC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IAKrC,mBAAmB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IA0BxD,gBAAgB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAqBpD,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAkB1E,aAAa,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACjD,aAAa,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAqBnD,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAAC,CAAC;IAiB9E,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC,CAAC,CAAC;~~IA4B5E~~,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAE1D,WAAW,CAAC,EAAE,MAAM,CAAC;IASrB,WAAW,EAAE,MAAM,CAAC;IAMpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC,QAAQ,EAAE,aAAa,CAAC;IAExB,WAAW,EAAE,OAAO,CAAC;IAErB,aAAa,EAAE,OAAO,CAAC;IAEvB,kBAAkB,EAAE,MAAM,CAAC;IAE3B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAS7B,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAGD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,uBAAuB;;;kBAKzB,CAAC;~~AAGZ~~,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAED,eAAO,MAAM,0BAA0B~~;;;;;;kBAK5B~~,CAAC;~~AAGZ~~,eAAO,MAAM,2BAA2B;;;oBAA2B,CAAC;AACpE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAGhF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAE9E;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkBD,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,WAAW,EACT,cAAc,GACd,kBAAkB,GAClB,qBAAqB,GACrB,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,iBAAiB,GACjB,cAAc,CACjB,CAAC;AAYF,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,aAAa,EACb,2BAA2B,GAAG,QAAQ,CACvC,GAAG;IACF,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAWF,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,kBAAkB,CAAC,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACtE,WAAW,EAAE,gBAAgB,CAAC;IAC9B,YAAY,CAAC,EAAE,0BAA0B,CAAC;CAC3C;AAED,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;kBAMjC,CAAC;~~AAqYZ~~,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC;CACpG,GAAG,SAAS,MAAM,EAAE,CAEpB;AAUD,eAAO,MAAM,mBAAmB,EACI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AA6B7D,eAAO,MAAM,mBAAmB,EACI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;~~AA0C7D~~,eAAO,MAAM,iBAAiB,EACM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AA6C3D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IAEb,IAAI,EAAE,mBAAmB,CAAC;IAI1B,MAAM,EAAE,6BAA6B,CAAC;CACvC;AAED,eAAO,MAAM,2BAA2B,EAsBhC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAqBzC,MAAM,WAAW,qBAAqB;IAEpC,MAAM,EAAE,MAAM,CAAC;IAEf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,2BAA2B,EAKzB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAiFhD,eAAO,MAAM,iCAAiC,oBAAqB,CAAC;AAEpE,MAAM,MAAM,6BAA6B,GACvC,CAAC,OAAO,iCAAiC,CAAC,CAAC,MAAM,CAAC,CAAC;AAOrD,eAAO,MAAM,yCAAyC,EAAG,CAAU,CAAC;AAcpE,eAAO,MAAM,gCAAgC,GACF,CAAC;AAO5C,eAAO,MAAM,mCAAmC,EAAG,CAAU,CAAC;AAoB9D,eAAO,MAAM,uCAAuC,EAAG,CAAU,CAAC;AAMlE,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAC;IAWvB,sBAAsB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEzD,gBAAgB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEnD,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAUlB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAa1B,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACrC;AAGD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,yCAAyC,CAAC;IAChE,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAClC;AAOD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,mCAAmC,CAAC;IAC1D,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAClC;AAQD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,uCAAuC,CAAC;IAC9D,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IAQ/B,UAAU,CAAC,EAAE,0BAA0B,CAAC;IAQxC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC/C;AAOD,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;CAClC;AAED,eAAO,MAAM,gCAAgC,EA6B1B,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAqDzD,MAAM,MAAM,gBAAgB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,CAAC;AAOvB,OAAO,CAAC,MAAM,wBAAwB,EAAE,OAAO,MAAM,CAAC;AActD,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG;IACxD,QAAQ,CAAC,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC;CAC3C,CAAC;AAMF,MAAM,MAAM,2BAA2B,GAAG,oBAAoB,GAAG;IAC/D,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,QAAQ,CAAC,CAAC,wBAAwB,CAAC,CAAC,EAAE,KAAK,CAAC;CAC7C,CAAC;~~AA4GF~~,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEvE,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEvE,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAqBvE,eAAO,MAAM,sBAAsB,EAIlB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AA2B7C,eAAO,MAAM,4BAA4B,EAOzB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAmB5C,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG;IACxC,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,GAAG,SAAS,CAAC;CACpE,GACA,6BAA6B,CAY/B;AASD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,2BAA2B,GAChC,gBAAgB,CAGlB;AA8CD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAEpE;AASD,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,wBAAwB,CAK1B"}
1	+ {"version":3,"file":"distribution-lock.d.ts","sourceRoot":"","sources":["../../../src/distribution/lib/distribution-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAML,kBAAkB,EAIlB,gBAAgB,EAEhB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC3B,MAAM,aAAa,CAAC;AAQrB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,eAAe,EAKhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,+BAA+B,EAU7B,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAEpD,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,6BAA6B,CAAC;CACvC;AAED,eAAO,MAAM,kCAAkC,EAKhC,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;AAEvD,MAAM,MAAM,oBAAoB,GAC5B,yBAAyB,GACzB,4BAA4B,CAAC;AAEjC,eAAO,MAAM,0BAA0B,EAGjC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAOtC,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,oBAAoB,CAAC;CAC7B;AAED,eAAO,MAAM,6BAA6B,EAM3B,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAMlD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,4BAA4B,EAK1B,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAuBjD,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,eAAe,CAAC;IACtB,WAAW,EAAE,mBAAmB,CAAC;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAED,eAAO,MAAM,2BAA2B,EASzB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAYhD,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,MAAM,GAAG,aAAa,CAAC,EAC1E,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,MAAM,GAAG,aAAa,CAAC,GACzE,MAAM,CAMR;AAsDD,eAAO,MAAM,4BAA4B,EAKvB,CAAC,CAAC,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAAC;AAM9D,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,OAAO,GACX,SAAS,qBAAqB,EAAE,CAUlC;AAwBD,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,YAAY,EAAE,qBAAqB,CAAC;CACrC;AAED,eAAO,MAAM,sBAAsB,EAcpB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AA+B3C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC;IAE1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IAEZ,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAOD,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAgB7E,eAAO,MAAM,yBAAyB,EAEvB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAS9C,eAAO,MAAM,uBAAuB,EACL,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAQ5D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IAEpB,MAAM,EAAE,WAAW,CAAC;IAEpB,SAAS,EAAE,OAAO,CAAC;IAEnB,aAAa,EAAE,kBAAkB,CAAC;IAKlC,MAAM,EAAE,eAAe,CAAC;IAExB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IAUb,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAmB5B,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAsBnD,yBAAyB,CAAC,EAAE,QAAQ,CAClC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CACjD,CAAC;IAeF,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAErC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAmCzC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IAKrC,mBAAmB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IA0BxD,gBAAgB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAqBpD,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAkB1E,aAAa,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACjD,aAAa,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAqBnD,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAAC,CAAC;IAiB9E,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC,CAAC,CAAC;IAiB5E,gBAAgB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAapD,YAAY,CAAC,EAAE,MAAM,CAAC;IA4BtB,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAE1D,WAAW,CAAC,EAAE,MAAM,CAAC;IASrB,WAAW,EAAE,MAAM,CAAC;IAMpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IAExC,QAAQ,EAAE,aAAa,CAAC;IAExB,WAAW,EAAE,OAAO,CAAC;IAErB,aAAa,EAAE,OAAO,CAAC;IAEvB,kBAAkB,EAAE,MAAM,CAAC;IAE3B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAS7B,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAGD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,uBAAuB;;;kBAKzB,CAAC;AAOZ,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAED,eAAO,MAAM,0BAA0B;;;;;;;kBAM5B,CAAC;AAOZ,oBAAY,yBAAyB;IACnC,KAAK,UAAU;CAChB;AAYD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpE;AAaD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,yBAAyB,EAAE,CAAC;CAC1C;AAED,eAAO,MAAM,2BAA2B;;;kBAU7B,CAAC;AAUZ,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EACtB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAAC,GAC1D,SAAS,CAAC;IACd,QAAQ,CAAC,eAAe,CAAC,EACrB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC,CAAC,GACzD,SAAS,CAAC;CACf,GAAG,qBAAqB,EAAE,CAS1B;AAGD,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,yBAAyB,EAAE,CAAC;IAEzC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjD;AAiBD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE;IACJ,QAAQ,CAAC,MAAM,EAAE,SAAS;QACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,qBAAqB,EAAE,GAAG,SAAS,CAAC;KAC1E,EAAE,CAAC;CACL,EACD,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,iBAAiB,CAAC,GAC/D,MAAM,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,CA+C3C;AAOD,eAAO,MAAM,2BAA2B;;;oBAA2B,CAAC;AACpE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAGhF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAE9E;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkBD,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,WAAW,EACT,cAAc,GACd,kBAAkB,GAClB,qBAAqB,GACrB,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,iBAAiB,GACjB,kBAAkB,GAClB,cAAc,GACd,cAAc,CACjB,CAAC;AAYF,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,aAAa,EACb,2BAA2B,GAAG,QAAQ,CACvC,GAAG;IACF,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAWF,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,kBAAkB,CAAC,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACtE,WAAW,EAAE,gBAAgB,CAAC;IAC9B,YAAY,CAAC,EAAE,0BAA0B,CAAC;CAC3C;AAED,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;kBAMjC,CAAC;AAscZ,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC;CACpG,GAAG,SAAS,MAAM,EAAE,CAEpB;AAUD,eAAO,MAAM,mBAAmB,EACI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AA6B7D,eAAO,MAAM,mBAAmB,EACI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AA4C7D,eAAO,MAAM,iBAAiB,EACM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AA6C3D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IAEb,IAAI,EAAE,mBAAmB,CAAC;IAI1B,MAAM,EAAE,6BAA6B,CAAC;CACvC;AAED,eAAO,MAAM,2BAA2B,EAsBhC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAqBzC,MAAM,WAAW,qBAAqB;IAEpC,MAAM,EAAE,MAAM,CAAC;IAEf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,2BAA2B,EAKzB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAiFhD,eAAO,MAAM,iCAAiC,oBAAqB,CAAC;AAEpE,MAAM,MAAM,6BAA6B,GACvC,CAAC,OAAO,iCAAiC,CAAC,CAAC,MAAM,CAAC,CAAC;AAOrD,eAAO,MAAM,yCAAyC,EAAG,CAAU,CAAC;AAcpE,eAAO,MAAM,gCAAgC,GACF,CAAC;AAO5C,eAAO,MAAM,mCAAmC,EAAG,CAAU,CAAC;AAoB9D,eAAO,MAAM,uCAAuC,EAAG,CAAU,CAAC;AAMlE,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAC;IAWvB,sBAAsB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEzD,gBAAgB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAEnD,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAUlB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAa1B,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACrC;AAGD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,yCAAyC,CAAC;IAChE,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAClC;AAOD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,mCAAmC,CAAC;IAC1D,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAClC;AAQD,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,aAAa,EAAE,OAAO,uCAAuC,CAAC;IAC9D,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IAQ/B,UAAU,CAAC,EAAE,0BAA0B,CAAC;IAQxC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC/C;AAOD,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;CAClC;AAED,eAAO,MAAM,gCAAgC,EA6B1B,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAqDzD,MAAM,MAAM,gBAAgB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,CAAC;AAOvB,OAAO,CAAC,MAAM,wBAAwB,EAAE,OAAO,MAAM,CAAC;AActD,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG;IACxD,QAAQ,CAAC,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC;CAC3C,CAAC;AAMF,MAAM,MAAM,2BAA2B,GAAG,oBAAoB,GAAG;IAC/D,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,QAAQ,CAAC,CAAC,wBAAwB,CAAC,CAAC,EAAE,KAAK,CAAC;CAC7C,CAAC;AA8KF,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEvE,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEvE,eAAO,MAAM,wBAAwB,EACI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAqBvE,eAAO,MAAM,sBAAsB,EAIlB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AA2B7C,eAAO,MAAM,4BAA4B,EAOzB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAmB5C,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG;IACxC,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,GAAG,SAAS,CAAC;CACpE,GACA,6BAA6B,CAY/B;AASD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,2BAA2B,GAChC,gBAAgB,CAGlB;AA8CD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAEpE;AASD,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,wBAAwB,CAK1B"}

package/dist/distribution/lib/distribution-lock.js CHANGED Viewed

@@ -1,8 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DistributionLockReaderSchema = exports.DistributionLockSchema = exports.DistributionLockV4Schema = exports.DistributionLockV3Schema = exports.DistributionLockV2Schema = exports.DistributionLockResolutionSchema = exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_LATEST = exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_V3 = exports.DISTRIBUTION_LOCK_SCHEMA_VERSION = exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_BASELINE = exports.DISTRIBUTION_LOCK_SCHEMA_VERSIONS = exports.CapabilityDomainOwnerSchema = exports.LockedPlatformServiceSchema = exports.LockedBiomeSchema = exports.LockedBiomeV3Schema = exports.LockedBiomeV2Schema = exports.LockedServiceProcessFactsSchema = exports.LockedWorkerTaskQueueSchema = exports.LockedWorkflowClientSchema = exports.LockedWorkerImageSchema = exports.LockedBiomeSourceSchema = exports.LockedBiomeSourceV2Schema = exports.LockedHostModuleSchema = exports.LockedServiceResourcesSchema = exports.LockedServiceResourceSchema = exports.LockedResourceProviderSchema = exports.LockedServiceDependencySchema = exports.ServiceOwnerIdentitySchema = exports.PlatformServiceOwnerIdentitySchema = exports.BiomeServiceOwnerIdentitySchema = void 0;
+exports.DistributionLockReaderSchema = exports.DistributionLockSchema = exports.DistributionLockV4Schema = exports.DistributionLockV3Schema = exports.DistributionLockV2Schema = exports.DistributionLockResolutionSchema = exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_LATEST = exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_V3 = exports.DISTRIBUTION_LOCK_SCHEMA_VERSION = exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_BASELINE = exports.DISTRIBUTION_LOCK_SCHEMA_VERSIONS = exports.CapabilityDomainOwnerSchema = exports.LockedPlatformServiceSchema = exports.LockedBiomeSchema = exports.LockedBiomeV3Schema = exports.LockedBiomeV2Schema = exports.LockedServiceProcessFactsSchema = exports.LockedWorkerTaskQueueSchema = exports.LockedWorkflowSubjectSchema = exports.WorkflowSubjectPermission = exports.LockedWorkflowClientSchema = exports.LockedWorkerImageSchema = exports.LockedBiomeSourceSchema = exports.LockedBiomeSourceV2Schema = exports.LockedHostModuleSchema = exports.LockedServiceResourcesSchema = exports.LockedServiceResourceSchema = exports.LockedResourceProviderSchema = exports.LockedServiceDependencySchema = exports.ServiceOwnerIdentitySchema = exports.PlatformServiceOwnerIdentitySchema = exports.BiomeServiceOwnerIdentitySchema = void 0;
 exports.compareLockedServiceResources = compareLockedServiceResources;
 exports.parseLockedServiceResources = parseLockedServiceResources;
+exports.controllerTokenServiceAccount = controllerTokenServiceAccount;
+exports.deriveWorkflowSubjects = deriveWorkflowSubjects;
+exports.resolveWorkflowSubjects = resolveWorkflowSubjects;
 exports.lockedWorkerTaskQueueName = lockedWorkerTaskQueueName;
 exports.lockedVersionedWorkers = lockedVersionedWorkers;
 exports.distributionLockSchemaVersionFor = distributionLockSchemaVersionFor;
@@ -13,6 +16,8 @@ const zod_1 = require("zod");
 const biome_1 = require("../../biome");
 const capability_1 = require("../../capability");
 const execution_target_1 = require("../../execution-target");
+const deployment_1 = require("../../deployment");
+const process_topology_1 = require("../../process-topology");
 const resource_requirement_1 = require("../../resource-requirement");
 const distribution_1 = require("./distribution");
 const biome_closure_1 = require("./biome-closure");
@@ -158,10 +163,90 @@ exports.LockedWorkerImageSchema = zod_1.z
     .strict();
 exports.LockedWorkflowClientSchema = zod_1.z
     .object({
+    biome: biome_1.BiomeIdSchema.optional(),
     component: zod_1.z.string().min(1),
     taskQueue: execution_target_1.WorkerTaskQueueRefSchema,
 })
     .strict();
+var WorkflowSubjectPermission;
+(function (WorkflowSubjectPermission) {
+    WorkflowSubjectPermission["Write"] = "write";
+})(WorkflowSubjectPermission || (exports.WorkflowSubjectPermission = WorkflowSubjectPermission = {}));
+const CONTROLLER_TOKEN_SERVICE_ACCOUNT_SUFFIX = '-controller-token';
+function controllerTokenServiceAccount(worker) {
+    return `${worker}${CONTROLLER_TOKEN_SERVICE_ACCOUNT_SUFFIX}`;
+}
+exports.LockedWorkflowSubjectSchema = zod_1.z
+    .object({
+    component: zod_1.z.string().min(1),
+    permissions: zod_1.z
+        .array(zod_1.z.nativeEnum(WorkflowSubjectPermission))
+        .min(1)
+        .refine((permissions) => new Set(permissions).size === permissions.length, {
+        message: 'must not name a permission twice',
+    }),
+})
+    .strict();
+function deriveWorkflowSubjects(biome) {
+    const components = new Set([
+        ...Object.keys(biome.workerTaskQueues ?? {}),
+        ...Object.keys(biome.workflowClients ?? {}),
+    ]);
+    return [...components].sort(codeUnitOrder).map((component) => ({
+        component,
+        permissions: [WorkflowSubjectPermission.Write],
+    }));
+}
+function resolveWorkflowSubjects(lock, resolved) {
+    const domainOf = new Map(resolved.biomes.map((biome) => [biome.id, biome.trustDomain]));
+    const accountsOf = new Map();
+    for (const account of resolved.serviceAccounts) {
+        for (const { biome, component } of account.actsFor) {
+            const key = `${biome}/${component}`;
+            accountsOf.set(key, [...(accountsOf.get(key) ?? []), account.name]);
+        }
+    }
+    const byDomain = new Map();
+    for (const biome of lock.biomes) {
+        const subjects = biome.workflowSubjects ?? [];
+        if (subjects.length === 0)
+            continue;
+        const domain = domainOf.get(biome.id);
+        if (domain === undefined) {
+            throw new Error(`resolveWorkflowSubjects: the resolved deployment places no biome "${biome.id}"; it was not resolved from this lock`);
+        }
+        const rows = byDomain.get(domain) ?? new Map();
+        for (const subject of subjects) {
+            for (const serviceAccount of accountsOf.get(`${biome.id}/${subject.component}`) ?? []) {
+                const row = rows.get(serviceAccount) ?? { serviceAccount, permissions: [], actsFor: [] };
+                for (const permission of subject.permissions) {
+                    if (!row.permissions.includes(permission))
+                        row.permissions.push(permission);
+                }
+                row.actsFor.push({ biome: biome.id, component: subject.component });
+                rows.set(serviceAccount, row);
+            }
+        }
+        byDomain.set(domain, rows);
+    }
+    const result = {};
+    for (const domain of [...byDomain.keys()].sort(codeUnitOrder)) {
+        const rows = [...byDomain.get(domain).values()];
+        if (rows.length === 0)
+            continue;
+        result[domain] = rows
+            .map((row) => ({
+            serviceAccount: row.serviceAccount,
+            permissions: [...row.permissions].sort(codeUnitOrder),
+            actsFor: [...row.actsFor].sort((a, b) => codeUnitOrder(a.biome, b.biome) || codeUnitOrder(a.component, b.component)),
+        }))
+            .sort((a, b) => codeUnitOrder(a.serviceAccount, b.serviceAccount));
+    }
+    return result;
+}
+function codeUnitOrder(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
 exports.LockedWorkerTaskQueueSchema = execution_target_1.WorkerTaskQueueRefSchema;
 function lockedWorkerTaskQueueName(queue) {
     return (0, execution_target_1.workerTaskQueueRefDeclaration)(queue).name;
@@ -321,6 +406,8 @@ const refineLockedBiomeResources = (value, context) => {
     (0, resolve_nexus_bindings_1.refineLockedNexusFacts)(value, context);
     refineLockedWorkerTaskQueues(value, context);
     refineLockedWorkflowClients(value, context);
+    refineLockedWorkflowSubjects(value, context);
+    refineLockedTrustCeiling(value, context);
     refineLockedWorkerImages(value, context);
 };
 const refineLockedWorkerImages = (value, context) => {
@@ -414,7 +501,7 @@ const refineLockedWorkflowClients = (value, context) => {
         clients.forEach((client, index) => {
             const clientQueue = (0, execution_target_1.workerTaskQueueRefDeclaration)(client.taskQueue);
             const clientQueueKey = (0, execution_target_1.workerTaskQueueKey)(clientQueue);
-            const pair = `${client.component}:${clientQueueKey}`;
+            const pair = `${client.biome ?? value.id}/${client.component}:${clientQueueKey}`;
             if (seen.has(pair)) {
                 context.addIssue({
                     code: zod_1.z.ZodIssueCode.custom,
@@ -423,6 +510,8 @@ const refineLockedWorkflowClients = (value, context) => {
                 });
             }
             seen.add(pair);
+            if (client.biome !== undefined && client.biome !== value.id)
+                return;
             const queues = Object.prototype.hasOwnProperty.call(workerQueues, client.component)
                 ? workerQueues[client.component]
                 : undefined;
@@ -443,6 +532,42 @@ const refineLockedWorkflowClients = (value, context) => {
         });
     }
 };
+const refineLockedWorkflowSubjects = (value, context) => {
+    const stated = value.workflowSubjects;
+    if (stated === undefined)
+        return;
+    if (stated.length === 0) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['workflowSubjects'],
+            message: 'must be omitted when empty',
+        });
+        return;
+    }
+    const expected = deriveWorkflowSubjects(value);
+    const render = (row) => row === undefined ? '(none)' : JSON.stringify(row);
+    for (let index = 0; index < Math.max(stated.length, expected.length); index += 1) {
+        if (render(stated[index]) !== render(expected[index])) {
+            context.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['workflowSubjects', index],
+                message: `differs from the subjects derived from biome "${value.id}": stated ${render(stated[index])}, derived ${render(expected[index])}`,
+            });
+            return;
+        }
+    }
+};
+const refineLockedTrustCeiling = (value, context) => {
+    if (value.trustCeiling === undefined || value.origin === undefined)
+        return;
+    if (value.trustCeiling === (0, process_topology_1.defaultTrustDomain)(value.id, value.origin)) {
+        context.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['trustCeiling'],
+            message: `"${value.trustCeiling}" is biome "${value.id}"'s default domain; the writer omits it`,
+        });
+    }
+};
 function lockedVersionedWorkers(biome) {
     return Object.keys(biome.workerTaskQueues ?? {}).sort();
 }
@@ -490,6 +615,8 @@ const lockedBiomeV4Shape = {
         .record(zod_1.z.string().min(1), zod_1.z.array(exports.LockedWorkflowClientSchema).min(1).readonly())
         .readonly()
         .optional(),
+    workflowSubjects: zod_1.z.array(exports.LockedWorkflowSubjectSchema).readonly().optional(),
+    trustCeiling: deployment_1.TrustDomainNameSchema.optional(),
     workerImages: zod_1.z
         .record(zod_1.z.string().min(1), exports.LockedWorkerImageSchema)
         .readonly(),
@@ -651,6 +778,46 @@ const refineResourceProviders = (lock, context) => {
         });
     });
 };
+const refineCrossBiomeWorkflowClients = (lock, context) => {
+    const byId = new Map(lock.biomes.map((biome) => [biome.id, biome]));
+    lock.biomes.forEach((biome, biomeIndex) => {
+        for (const [name, clients] of Object.entries(biome.workflowClients ?? {})) {
+            clients.forEach((client, index) => {
+                if (client.biome === undefined || client.biome === biome.id)
+                    return;
+                const path = ['biomes', biomeIndex, 'workflowClients', name, index];
+                const target = byId.get(client.biome);
+                if (target === undefined) {
+                    context.addIssue({
+                        code: zod_1.z.ZodIssueCode.custom,
+                        path: [...path, 'biome'],
+                        message: `names biome "${client.biome}", which this lock does not ship`,
+                    });
+                    return;
+                }
+                const queues = Object.prototype.hasOwnProperty.call(target.workerTaskQueues ?? {}, client.component)
+                    ? target.workerTaskQueues?.[client.component]
+                    : undefined;
+                if (queues === undefined) {
+                    context.addIssue({
+                        code: zod_1.z.ZodIssueCode.custom,
+                        path: [...path, 'component'],
+                        message: `"${client.component}" is not a worker/v2 of biome "${client.biome}" — it has no workerTaskQueues entry`,
+                    });
+                    return;
+                }
+                const wanted = (0, execution_target_1.workerTaskQueueRefDeclaration)(client.taskQueue);
+                if (!queues.some((queue) => (0, execution_target_1.sameWorkerTaskQueue)((0, execution_target_1.workerTaskQueueRefDeclaration)(queue), wanted))) {
+                    context.addIssue({
+                        code: zod_1.z.ZodIssueCode.custom,
+                        path: [...path, 'taskQueue'],
+                        message: `task queue "${(0, execution_target_1.workerTaskQueueKey)(wanted)}" is not one worker "${client.component}" of biome "${client.biome}" polls`,
+                    });
+                }
+            });
+        }
+    });
+};
 const distributionLockV4Object = zod_1.z
     .object({
     schemaVersion: zod_1.z.literal(exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_LATEST),
@@ -663,7 +830,8 @@ const distributionLockV4Object = zod_1.z
     .superRefine(refineResourceProviders)
     .superRefine(refineResolutionCoverage)
     .superRefine(nexus_binding_1.refineNexusBindings)
-    .superRefine(resolve_nexus_bindings_1.refineNexusBindingsAgreeWithFacts);
+    .superRefine(resolve_nexus_bindings_1.refineNexusBindingsAgreeWithFacts)
+    .superRefine(refineCrossBiomeWorkflowClients);
 const readerDistributionLockV2Object = zod_1.z.looseObject({
     schemaVersion: zod_1.z.literal(exports.DISTRIBUTION_LOCK_SCHEMA_VERSION_BASELINE),
     biomes: zod_1.z.array(readerLockedBiomeV2Object).readonly(),